Jeff_ITBlog

https://www.vulnhub.com/entry/kioptrix-level-13-4,25/ Kioptrix: Level 1.3 (#4)This mentions the name of this release, when it was released, who made it, a link to 'series' and a link to the homepage of the release. It's common for an author to release multiple 'scenarios', making up a 'series' of machines to attack.www.vulnhub.comkioptrix 4번째 실습입니다. 실습 VM 구축은 이전에 설정하는 것과 똑같이 진행하면 이상없이 IP가 잘 잡힐것입..

https://www.vulnhub.com/entry/kioptrix-level-12-3,24/ Kioptrix: Level 1.2 (#3)This mentions the name of this release, when it was released, who made it, a link to 'series' and a link to the homepage of the release. It's common for an author to release multiple 'scenarios', making up a 'series' of machines to attack.www.vulnhub.com이번 실습 VM의 특이사항이라면 /etc/hosts에 실습 VM의 IP를 넣어줘야한다는 점이 있습니다.sudo vi /..

https://www.vulnhub.com/entry/kioptrix-level-11-2,23/ Kioptrix: Level 1.1 (#2)This mentions the name of this release, when it was released, who made it, a link to 'series' and a link to the homepage of the release. It's common for an author to release multiple 'scenarios', making up a 'series' of machines to attack.www.vulnhub.com실습 VM이 IP가 안잡힌다면 이전 글에서 설명한 실습 VM 셋팅을 보시고 셋팅을 하면 잘 잡힙니다. 실습 환경 : V..

https://www.vulnhub.com/entry/kioptrix-level-1-1,22/ Kioptrix: Level 1 (#1)This mentions the name of this release, when it was released, who made it, a link to 'series' and a link to the homepage of the release. It's common for an author to release multiple 'scenarios', making up a 'series' of machines to attack.www.vulnhub.com이번 시나리오 모의해킹은 Kioptrix 입니다. 이 실습 VM은 IP가 잘안잡혀서 살짝 삽질을 좀 했는데 IP 설정하는 것..

https://www.vulnhub.com/entry/dina-101,200/  Dina: 1.0.1This mentions the name of this release, when it was released, who made it, a link to 'series' and a link to the homepage of the release. It's common for an author to release multiple 'scenarios', making up a 'series' of machines to attack.www.vulnhub.com시나리오 모의해킹을 공부하고 연습하기 위해서 수많은 ctf, wargame 사이트 중에서 제가 선택한 사이트는 vulnhub 입니다. ctf에서 출제된 문제들..

이전 게시글에서는 익스플로잇 하는 방법에 대해서 살펴보았다. 이 취약점은 21년도 12월에 제로데이로 트위터에 게시되어 많은 관심이 있었다고 한다 이 취약점이 공개된 이후 단 4일만에 공식 패치가 출시되어 짧은 시간동안만 제로데이였다고 한다.  이제 익스플로잇 코드에 대한 분석을 해볼 것이다. # Exploit Title: Grafana 8.3.0 - Directory Traversal and Arbitrary File Read# Date: 08/12/2021# Exploit Author: s1gh# Vendor Homepage: https://grafana.com/# Vulnerability Details: https://github.com/grafana/grafana/security/advisorie..

풀이 rcity18@9947d876f6e5:~$ ls -l total 4 -rw-r--r-- 1 root root 918 Mar 6 08:04 rcity19 rcity18@9947d876f6e5:~$ head rcity19 Flag components: adding one by one adding one by one adding one by one adding one by one adding one by one adding one by one adding one by one adding one by one adding one by one 뭔가 엄청나게 많은 것같다 rcity18@9947d876f6e5:~$ git log commit 7599ad53e055ece5b61ef8b81f149940187bd35f..

풀이 rcity17@9947d876f6e5:~$ ls rcity18 rcity17@9947d876f6e5:~$ cat rcity18 Initial commit Add feature A Add feature B 별 다른 내용 없다 rcity17@9947d876f6e5:~$ git log commit ace1b3e50dc2d3e51d56174ae9df97751b28317a (HEAD -> master) Author: rcity17 Date: Wed Mar 6 08:04:14 2024 +0000 Add feature B by Alice commit 6c18974e94e36f197b21d1229eaab6c6da6b6d42 Author: rcity17 Date: Wed Mar 6 08:04:14 2024 +000..

풀이 rcity16@9947d876f6e5:~$ ls -al total 36 drwxr-xr-x 1 root root 4096 Mar 6 08:04 . drwxr-xr-x 1 root root 4096 Mar 6 08:03 .. -rw-r--r-- 1 root root 220 Jan 6 2022 .bash_logout -rw-r--r-- 1 root root 3771 Jan 6 2022 .bashrc dr-xrw---- 8 rcity16 root 4096 Mar 6 08:04 .git -rw-rw-r-- 1 rcity16 rcity16 34 Mar 6 08:04 .gitconfig -rw-r--r-- 1 root root 807 Jan 6 2022 .profile -rw-r--r-- 1 root root..

풀이 rcity15@9947d876f6e5:~$ ls rcity14-flag.txt rcity15-data.bin rcity15@9947d876f6e5:~$ file rcity15-data.bin rcity15-data.bin: data rcity15@9947d876f6e5:~$ xxd rcity15-data.bin 00000000: 273b 3673 353f 3234 733a 2073 2965 0260 ';6s5?24s: s)e.` 00000010: 3e6b 0b67 2062 1466 3b6a 0164 3763 1f0a >k.g b.f;j.d7c.. 00000020: 0a6b 6579 2069 7320 3533 0a .key is 53. rcity15-data.bin 이라는 바이너리 파일이 있는데 파일..