0x001简单的看一下
界面一套云短信轰炸跟电话轰炸
直接丢到seay审计工具里面看看
发现突破好像挺多的
随即就找到了一处无过滤的sql
- http://www.sj.com/user/km.php
- $km = $_POST["km"];
- if($km)
- {
- $res=$DB->get_row("SELECT * FROM msg_km WHERE km='".$_POST['km']."'");
- if($res)
- {
- if($res["status"]==0)
- {
- $money = $res['money'];//卡密值
- $deduct="update msg_km set status=1 where km='{$_POST['km']}'";
- $DB->query($deduct);
- $deduct="update user_list set money = money+{$money} where user = '{$_SESSION['user']}'";
- $DB->query($deduct);
- echo alert('卡密充值成功，面额:'.$money."元");
- }else
- {
- echo alert("卡密已被使用");
- }
- }
- else
- {
- echo alert("卡密不存在");
- }
- }
一处post注入构造一下post包来丢到sqlmap里面看看
- POST /user/km.php HTTP/1.1
- Host: www.sj.com
- Proxy-Connection: keep-alive
- Content-Length: 51
- Cache-Control: max-age=0
- Origin: http://www.sj.com
- Upgrade-Insecure-Requests: 1
- Content-Type: application/x-www-form-urlencoded
- User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Ch
- rome/78.0.3904.108 Safari/537.36
- Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,ap
- plication/signed-exchange;v=b3
- Referer: http://www.sj.com/user/km.php
- Accept-Encoding: gzip, deflate
- Accept-Language: zh-CN,zh;q=0.9
- Cookie: PHPSESSID=qhu0c9khc8suen3r5pv27ttpr0
- km=1
果然是不出所料阿确实是一处注入
但是到了这一步之后看到这段代码的时候已经选择性放弃了
- $rand = mt_rand(111,999);
- if ($_POST['s']==1) {$filename=$_FILES['file']['name'];
- $ext=substr($filename,strripos($filename,'.')+1);
- $arr=array(0=>'png',1=>'jpg',2=>'gif',3=>'jpeg',4=>'webp',5=>'bmp');
所以就到此为止了
告辞后会有期 |
