๋ณธ๋ฌธ ๋ฐ”๋กœ๊ฐ€๊ธฐ
๋ฐ˜์‘ํ˜•

[Dreamhack]WebHacking32

[Dreamhack] CTF Season 5 Round #2 - php7cmp4re ๐Ÿ›Ž๏ธ Access php 7.4๋กœ ์ž‘์„ฑ๋œ ํŽ˜์ด์ง€์ž…๋‹ˆ๋‹ค. ์•Œ๋งž์€ Input ๊ฐ’์„ ์ž…๋ ฅํ•˜๊ณ  ํ”Œ๋ž˜๊ทธ๋ฅผ ํš๋“ํ•˜์„ธ์š”. ํ”Œ๋ž˜๊ทธ ํ˜•์‹์€ DH{} ์ž…๋‹ˆ๋‹ค. ๐Ÿ‘พ Exploit Algorithm & Payload > index.php ๋”๋ณด๊ธฐ php7cmp4re index page Enter the correct Input. > check.php ๋”๋ณด๊ธฐ php7cmp4re Index page > flag.php ๋”๋ณด๊ธฐ #1 : '/' ํŽ˜์ด์ง€์—์„œ ๋‹ค์Œ๊ณผ ๊ฐ™์ด input1๊ณผ input2์— ์ž…๋ ฅ ํ›„ ์ œ์ถœํ•˜๋ฉด ๊ฐ’์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ์„ ๊ฒƒ์œผ๋กœ ์˜ˆ์ƒ๋œ๋‹ค. : ๊ทธ๋Ÿฌ๋‚˜ ์–ด๋–ค ๊ฐ’์„ ์ž…๋ ฅํ•˜์—ฌ๋„ "Try again."์ด๋ผ๋Š” ๊ฒฐ๊ณผ๊ฐ€ ์ถœ๋ ฅ๋˜์–ด์„œ ์ฝ”๋“œ๋ฅผ ๋ถ„์„ํ–ˆ๋‹ค. #2 1) input_1๊ณผ input_2๋Š” ๊ณต๋ฐฑ์ด์—ฌ์„œ๋Š” ์•ˆ๋œ๋‹ค 2) input_1์˜ ๋ฌธ์ž.. 2024. 1. 28.
[Dreamhack] Level1: error based sql injection ๐Ÿ›Ž๏ธ Access Simple Error Based SQL Injection ! ๐Ÿ‘พ Exploit Algorithm & Payload > app.py ๋”๋ณด๊ธฐ import os from flask import Flask, request from flask_mysqldb import MySQL app = Flask(__name__) app.config['MYSQL_HOST'] = os.environ.get('MYSQL_HOST', 'localhost') app.config['MYSQL_USER'] = os.environ.get('MYSQL_USER', 'user') app.config['MYSQL_PASSWORD'] = os.environ.get('MYSQL_PASSWORD', 'pass') app.conf.. 2024. 1. 26.
[Dreamhack] Level3: CSP Bypass Advanced ๐Ÿ›Ž๏ธAccess Exercise: CSP Bypass์˜ ํŒจ์น˜๋œ ๋ฌธ์ œ์ด๋‹ค. ๐Ÿ‘พExploit Algorithm & Payload ๋”๋ณด๊ธฐ #!/usr/bin/python3 from flask import Flask, request, render_template from selenium import webdriver import urllib import os app = Flask(__name__) app.secret_key = os.urandom(32) nonce = os.urandom(16).hex() try: FLAG = open("./flag.txt", "r").read() except: FLAG = "[**FLAG**]" def read_url(url, cookie={"name": "name", "val.. 2024. 1. 17.
[Dreamhack] Level2: blind-command ๐Ÿ›Ž๏ธAccess Read the flag file XD ๐Ÿ‘พExploit Algorithm & Payload ๋”๋ณด๊ธฐ #!/usr/bin/env python3 from flask import Flask, request import os app = Flask(__name__) @app.route('/' , methods=['GET']) def index(): cmd = request.args.get('cmd', '') if not cmd: return "?cmd=[cmd]" if request.method == 'GET': '' else: os.system(cmd) return cmd app.run(host='0.0.0.0', port=8000) #1 : '/' ํŽ˜์ด์ง€์—์„œ ?cmd=[cmd]๋ผ๋Š” ํ™”๋ฉด์ด ์ถœ๋ ฅ๋จ.. 2024. 1. 5.
๋ฐ˜์‘ํ˜•