ํฌ์ŠคํŒ… ์ธ๋„ค์ผ ์ด๋ฏธ์ง€

CTF

[DawgCTF 2021] :pwn: Bofit Write-Up

Bofit - 125pts Description Tag pwnable, BOF Problem Analysis ์•„๋งˆ ์ œ์ผ ์‰ฌ์šด ๋ฌธ์ œ๊ฐ€ ์•„๋‹ˆ์˜€์„๊นŒ ์‹ถ์–ด์šฉ ๋ด…์‹œ๋‹น ์žฅ๋‚œ๊ฐ BOP-IT์„ ์˜ค๋งˆ์ฃผํ•œ ๊ฒƒ ๊ฐ™๋„ค์šฉ 3๋ฒˆ ์ผ€์ด์Šค์ธ Shout it!์„ ๋ณด๋ฉด ์•„์˜ˆ gets๋กœ ์ž…๋ ฅ์„ ๋ฐ›๋Š” ๊ฒƒ์„ ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๊ฑธ ๊ฐ€์ง€๊ณ  ๋ฐ”๋กœ BOF๋ฅผ ์ง„ํ–‰ํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค. ๋ณ„๋‹ค๋ฅธ ์ž‘์—…ํ•  ๊ฒƒ ์—†์ด ๊ทธ๋ƒฅ ํ•˜๋ฉด ๋˜๊ฒ ๋„ค์œ  ๊ตณ๊ตณ

2021.05.14 ๊ฒŒ์‹œ๋จ

 ํฌ์ŠคํŒ… ์ธ๋„ค์ผ ์ด๋ฏธ์ง€

CTF

[DawgCTF 2021] :pwn: No Step On Snek Write-Up

No Step On Snek - 75pts Description Tag pwnable, python, RCE Problem Analysis ์ ‘์†์„ ํ•˜๋ฉด ์ด๋Ÿฐ ์ฐฝ์ด ๋‚˜ํƒ€๋‚˜๋Š”๋ฐ, ์„ค๋ช…์— ์“ฐ์—ฌ์ ธ์žˆ๋Š” ํ‚ค๋ฅผ ๋ˆŒ๋Ÿฌ๋„ ์•„๋ฌด๊ฒƒ๋„ ์‹คํ–‰์ด ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๊ทธ๋ž˜์„œ ์ด์ƒํ•œ ๊ฐ’์„ ์ง‘์–ด๋„ฃ๋Š” ๊ฒฝ์šฐ์—๋Š” ์ด๋Ÿฐ๊ฒŒ ๋ฐœ์ƒํ•ฉ๋‹ˆ๋‹ค. ๋ณด์•„ํ•˜๋‹ˆ, make_move(maze)๋ผ๋Š” ๋ช…๋ น์–ด๊ฐ€ ์‹คํ–‰์ด ๋˜๊ณ , ์ด๋•Œ maze๋ผ๋Š” ๊ฒƒ์€ ์ €ํฌ์˜ ์ž…๋ ฅ์ธ ๊ฒƒ์„ ์•Œ ์ˆ˜ ์žˆ๋„ค์š”. ์ด ์ ์„ ์ด์šฉํ•ด์„œ code injection์„ ์‹คํ–‰์‹œ์ผœ์ฃผ๋ฉด ์ข‹์ง€ ์•Š์„๊นŒ ์ƒ๊ฐํ•ฉ๋‹ˆ๋‹ค. Exploit ๊ทธ๋ž˜์„œ ํ™•์ธ์„ ์šฐ์„  ํ•ด ๋ด…์‹œ๋‹ค! __builtins__.__dict__['__import__']("os").system("ls") ์ž˜ ์‹คํ–‰์ด ๋˜๋„ค์š”. ๊ทธ๋ž˜์„œ ๋ฐ”๋กœ flag.txt๋ฅผ ์—ด์–ด๋ณด๋ฉด __..

2021.05.14 ๊ฒŒ์‹œ๋จ

 ํฌ์ŠคํŒ… ์ธ๋„ค์ผ ์ด๋ฏธ์ง€

War Games/ํ•ด์ปค์Šค์ฟจ LOB

[ํ•ด์ปค์Šค์ฟจ LOB] Level3: cobolt >> goblin

Level 3. Cobolt >> Goblin Theme: Basic BufferOverFlow (w/ stdin) ๋กœ๊ทธ์ธํ•ฉ์‹œ๋‹ค id: cobolt pw: hacking exposed ls -l๋กœ ๋””๋ ‰ํ† ๋ฆฌ๋ฅผ ํ™•์ธํ•˜๋ฉด ์—ญ์‹œ๋‚˜ [cobolt@localhost cobolt]$ ls -l total 16 -rwsr-sr-x 1 goblin goblin 11824 Feb 26 2010 goblin -rw-r--r-- 1 root root 193 Mar 29 2010 goblin.c [cobolt@localhost cobolt]$ nl goblin.c 1 /* 2 The Lord of the BOF : The Fellowship of the BOF 3 - goblin 4 - small buffer + stdin 5..

2019.09.24 ๊ฒŒ์‹œ๋จ

 ํฌ์ŠคํŒ… ์ธ๋„ค์ผ ์ด๋ฏธ์ง€

War Games/ํ•ด์ปค์Šค์ฟจ LOB

[ํ•ด์ปค์Šค์ฟจ LOB] Level2: gremlin >> cobolt

Level 2. Gremlin >> Cobolt Theme: Basic BufferOverFlow (smaller buffer) ๋“ค์–ด๊ฐ‘์‹œ๋‹ค. id: gremlin pw: hello bof world ๊ธฐ๋ณธ bash2์ž…๋ ฅ ํ›„, ls -l๋กœ ๋””๋ ‰ํ† ๋ฆฌ๋ฅผ ํ™•์ธํ•ด์ฃผ๋ฉด [gremlin@localhost gremlin]$ bash2 [gremlin@localhost gremlin]$ ls -l total 20 -rwsr-sr-x 1 cobolt cobolt 11970 Feb 26 2010 cobolt -rw-r--r-- 1 gremlin gremlin 291 Mar 29 2010 cobolt.c cobolt.cํŒŒ์ผ์„ ์—ด์–ด๋ณด๋ฉด [gremlin@localhost gremlin]$ nl cobolt.c 1 /* 2 The ..

2019.09.24 ๊ฒŒ์‹œ๋จ

 ํฌ์ŠคํŒ… ์ธ๋„ค์ผ ์ด๋ฏธ์ง€

War Games/ํ•ด์ปค์Šค์ฟจ LOB

[ํ•ด์ปค์Šค์ฟจ LOB] Level1: gate >> gremlin

Level 1. Gate >> Gremlin Theme: Basic BufferOverFlow LOB์— ์˜ค์‹  ์—ฌ๋Ÿฌ๋ถ„๋“ค ํ™˜์˜ํ•ฉ๋‹ˆ๋‹ค! ์šฐ์„  ๋“ค์–ด๊ฐ€์ค์‹œ๋‹ค. id: gate pw: gate ์•„ ์ผ๋‹จ ์ฒซ ๋ฌธ์ œ์ธ ๋งŒํผ, ์šฐ๋ฆฌ๊ฐ€ ์ด ๋ฌธ์ œ๋ฅผ ์™œ ํ’€๊ณ ์žˆ์œผ๋ฉฐ, ์–ด๋–ป๊ฒŒ ํ•˜๋ฉด ์ด ๋ฌธ์ œ๋ฅผ ํ’€ ์ˆ˜ ์žˆ๋Š” ๊ฒƒ์ธ์ง€ ํƒ๊ตฌํ•ด๋ด…์‹œ๋‹ค. ์ผ๋‹จ ํฌ๋„ˆ๋ธ” ๋ฌธ์ œ๋“ค์˜ ๊ธฐ๋ณธ์€ ๊ด€๋ฆฌ์ž์˜ ๊ถŒํ•œ์„ ํƒˆ์ทจํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค. ๊ทธ๋Ÿฐ ๋’ค ์ •์ƒ์ ์œผ๋กœ๋Š” ์ ‘๊ทผํ•  ์ˆ˜ ์—†๋Š” ๊ณณ๋“ค์„ ์ ‘๊ทผํ•œ๋‹ค๋Š” ๊ฒƒ์ด ๊ธฐ๋ณธ์ ์ธ ์‹œ์Šคํ…œ ํ•ดํ‚น์˜ ๊ฐœ๋…์ด๊ณ ์š”. ๊ทธ๋ž˜์„œ ๋˜‘๊ฐ™์ด LOB์˜ ๋ชจ๋“  ๋ฌธ์ œ๋“ค๋„ ์ƒ์œ„ ๊ถŒํ•œ์„ ํš๋“ํ•˜์—ฌ ๋‹ค์Œ ๋‹จ๊ณ„์˜ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์•Œ์•„๋‚ด๋Š” ๊ฒƒ์ด ๋ชฉ์ ์ž…๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋ฉด LOB ๋ฌธ์ œ์˜ ํ๋ฆ„์€ ๋‹ค์Œ๊ณผ ๊ฐ™์Šต๋‹ˆ๋‹ค. 1. ํ”„๋กœ๊ทธ๋žจ์ƒ์˜ ์ทจ์•ฝ์ ์„ ๋ฐœ๊ฒฌํ•ฉ๋‹ˆ๋‹ค. 2. ์ทจ์•ฝ์ ์„ ๊ธฐ๋ฐ˜์œผ๋กœ ๊ณต๊ฒฉ ์‹œ๋‚˜๋ฆฌ์˜ค๋ฅผ ์ž‘์„ฑํ•ฉ๋‹ˆ๋‹ค. 3...

2019.09.18 ๊ฒŒ์‹œ๋จ