๋ณธ๋ฌธ ๋ฐ”๋กœ๊ฐ€๊ธฐ
๋ฐ˜์‘ํ˜•

DreamHack37

[Dreamhack] CTF Season 5 Round #4 - BypassIF ๐Ÿ›Ž๏ธ Access Admin์˜ KEY๊ฐ€ ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค! ์•Œ๋งž์€ KEY๊ฐ’์„ ์ž…๋ ฅํ•˜์—ฌ ํ”Œ๋ž˜๊ทธ๋ฅผ ํš๋“ํ•˜์„ธ์š”. ํ”Œ๋ž˜๊ทธ ํ˜•์‹์€ DH{...} ์ž…๋‹ˆ๋‹ค. ๐Ÿ‘พ Exploit Algorithm & Payload > ./app.py ๋”๋ณด๊ธฐ #!/usr/bin/env python3 import subprocess from flask import Flask, request, render_template, redirect, url_for import string import os import hashlib app = Flask(__name__) try: FLAG = open("./flag.txt", "r").read() except: FLAG = "[**FLAG**]" KEY = hashlib.md5(FLAG.encode()).h.. 2024. 2. 25.
[Dreamhack] Level2: baby-sqlite ๐Ÿ›Ž๏ธ Access ๋กœ๊ทธ์ธ ์„œ๋น„์Šค์ž…๋‹ˆ๋‹ค. SQL INJECTION ์ทจ์•ฝ์ ์„ ํ†ตํ•ด ํ”Œ๋ž˜๊ทธ๋ฅผ ํš๋“ํ•˜์„ธ์š”! ๐Ÿ‘พ Exploit Algorithm & Payload > app.py ๋”๋ณด๊ธฐ #!/usr/bin/env python3 from flask import Flask, request, render_template, make_response, redirect, url_for, session, g import urllib import os import sqlite3 app = Flask(__name__) app.secret_key = os.urandom(32) from flask import _app_ctx_stack DATABASE = 'users.db' def get_db(): top = _app_ctx_sta.. 2024. 2. 23.
[Dreamhack] Level4: KeyCat ๐Ÿ›Ž๏ธ Accesscat loves cats  ๐Ÿ‘พ Exploit Algorithm & Payload> deploy > docker-compose.yml... (*๋งŽ์€ ํด๋”์˜ ์ •๋ณด ์œ ์‹ฌํžˆ ๋ณผ ํ•„์š” ์žˆ์Œ)  #1: docker-compose.yml ํŒŒ์ผ์„ ๋ถ„์„ํ–ˆ๋‹ค.: Dockeer-compose๋Š” ์—ฌ๋Ÿฌ๊ฐœ์˜ ์ปจํ…Œ์ด๋„ˆ๋กœ๋ถ€ํ„ฐ ์ด๋ฃจ์–ด์ง„ ์„œ๋น„์Šค๋ฅผ ๊ตฌ์ถ•, ์‹คํ–‰ํ•˜๋Š” ์ˆœ์„œ๋ฅผ ์ž๋™์œผ๋กœ ํ•˜์—ฌ ๊ด€๋ฆฌ๋ฅผ ๊ฐ„๋‹จํ•˜๊ฒŒ ํ•˜๋Š” ๊ฒƒ์œผ๋กœ, ์—ฌ๋Ÿฌ๊ฐœ์˜ ์ปจํ…Œ์ด๋„ˆ ์„ค์ • ๋‚ด์šฉ์„ ํ•˜๋‚˜์˜ yml ํŒŒ์ผ์— ๋ชจ์•„์„œ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค. ์ฆ‰, compose ํŒŒ์ผ์„ ์ค€๋น„ํ•ด์„œ ์ปค๋งจ๋“œ 1๋ฒˆ์„ ์‹คํ–‰ํ•˜๋Š” ๊ฒƒ๋งŒ์œผ๋กœ ๊ทธ ํŒŒ์ผ๋กœ๋ถ€ํ„ฐ ์„ค์ •์„ ์ฝ์–ด๋“ค์—ฌ ๋ชจ๋“  ์ปจํ…Œ์ด๋„ˆ ์„œ๋น„์Šค๋ฅผ ์‹คํ–‰์‹œํ‚ฌ ์ˆ˜ ์žˆ๋„๋ก ํ•˜์˜€๋‹ค.: ๊ผญ ๋ฌธ์ œ์—์„œ ์‚ฌ์šฉํ•˜์ง€ ์•Š์•„๋„ ๋œ๋‹ค. ๋‹จ, ๋ฌธ์ œ์˜ ์ ‘์† ํฌํŠธ๊ฐ€ ์ผ์ • ์‹œ๊ฐ„์ด ์ง€๋‚˜.. 2024. 2. 23.
[Dreamhack] Level1:Beginner blue-whale ๐Ÿ›Ž๏ธ Access๋ณด์ฝ”๊ฐ€ ์—ฌ๋Ÿฌ๋ถ„์—๊ฒŒ ๋„์›€์„ ์š”์ฒญํ•ฉ๋‹ˆ๋‹ค. "๋ถ„๋ช… ํ”Œ๋ž˜๊ทธ ํŒŒ์ผ์ด ์žˆ์—ˆ๋Š”๋ฐ์š”... ์—†์–ด์กŒ์–ด์š”."Docker hub์˜ dreamhackofficial/blue-whale ๋ ˆํฌ์ง€ํ† ๋ฆฌ (TAG:1) ์—์„œ ๋„์ปค ์ด๋ฏธ์ง€๋ฅผ ๋‹ค์šด๋ฐ›์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋„์ปค ์ด๋ฏธ์ง€๋ฅผ ๋ถ„์„ํ•˜์—ฌ ํ”Œ๋ž˜๊ทธ๋ฅผ ํš๋“ํ•˜์„ธ์š”.์ฃผ์–ด์ง„ Dockerfile์€ ์ด๋ฏธ์ง€๋ฅผ ๋นŒ๋“œํ•  ๋•Œ ์‚ฌ์šฉํ•œ ํŒŒ์ผ๋กœ, ํ’€์ด์ž๊ฐ€ ์‚ฌ์šฉํ•  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค.ํ”Œ๋ž˜๊ทธ ํ˜•์‹์€ DH{...} ์ž…๋‹ˆ๋‹ค.  ๐Ÿ‘พ Exploit Algorithm & Payload> Dokerfile๋”๋ณด๊ธฐFROM ubuntu:22.04@sha256:27cb6e6ccef575a4698b66f5de06c7ecd61589132d5a91d098f7f3f9285415a9ENV user challENV chall_port .. 2024. 2. 7.
๋ฐ˜์‘ํ˜•

ํ‹ฐ์Šคํ† ๋ฆฌํˆด๋ฐ”