> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2020/2020-wang-ding-bei/zhu-que-zu-think-java.md).

# \[朱雀组]Think Java

存在swagger-ui，访问swagger-ui.html获取所有接口

审计代码可得dbName值可控，用来JDBC连接MySQL数据库以及查询，且查询未经过预编译，存在SQL注入。jdbc连接忽略#?，使用以下payload

```
myapp#' union select group_concat(name,0x3a,pwd) from user#
```

<figure><img src="https://1298837596-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUlxElCQcjylbSFsJycU3%2Fuploads%2FqBNTu5wXOP0rOYPB8QPw%2Fimage.png?alt=media&amp;token=3039dfed-492f-44d4-8f84-7058a86f8f3f" alt=""><figcaption></figcaption></figure>

登录成功

<figure><img src="https://1298837596-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUlxElCQcjylbSFsJycU3%2Fuploads%2FfL0kvdZ638PymHILYcto%2F1665323543967.png?alt=media&amp;token=3c7a4c60-3c6c-48e5-ac92-d88daeb354c5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1298837596-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUlxElCQcjylbSFsJycU3%2Fuploads%2F7gY3q7mRfF0x8dJXLUB1%2F1665323647768.png?alt=media&amp;token=f1ee35b5-9f85-4ba4-b8db-6b1e1f5dd872" alt=""><figcaption></figcaption></figure>

其中返回序列化对象可以current查询

<figure><img src="https://1298837596-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUlxElCQcjylbSFsJycU3%2Fuploads%2FAgwgPDFrLpRwxeNGaAjS%2F1665323798736.png?alt=media&amp;token=c3ac3cf0-a684-4d40-86c7-1f7174c847ef" alt=""><figcaption></figcaption></figure>

推测存在反序列化漏洞，这里通过burp扫描检测反序列化类型为ROME，存在RCE。（发现这个插件挺好用

<figure><img src="https://1298837596-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUlxElCQcjylbSFsJycU3%2Fuploads%2Fm8ilU7IBr5BMnZA2mjWh%2Fimage.png?alt=media&amp;token=b3e98237-212f-48c7-ae45-e54fcd0de198" alt=""><figcaption></figcaption></figure>

修改exploting内容，通过yso发送反序列化内容进行反序列化，执行命令

<figure><img src="https://1298837596-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUlxElCQcjylbSFsJycU3%2Fuploads%2F635nwOcmKwmcwnTKdnYu%2Fimage.png?alt=media&amp;token=a7514d0a-52d3-4163-82df-8853f9ee9455" alt=""><figcaption></figcaption></figure>

收到flag