๋ณธ๋ฌธ ๋ฐ”๋กœ๊ฐ€๊ธฐ
โœ’๏ธ Web Hacking/Dreamhack

[Dreamhack] Command-Injection-ChatGPT ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด

by A Lim Han 2023. 8. 15.

๐ŸŽ Command-Injection-ChatGPT ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด

1. ๋ฌธ์ œ์— ๋Œ€ํ•œ ์„ค๋ช…์„ ์ฝ์€ ํ›„ ์„œ๋ฒ„ ์ƒ์„ฑ

 

2. ์ƒ์„ฑ๋œ ๋งํฌ๋กœ ์ ‘์† ํ›„ Ping ๋ฉ”๋‰ด๋กœ ์ด๋™

3. ์ž…๋ ฅ๋ž€์— ์•„๋ฌด ๊ฐ’์ด๋‚˜ ์ž…๋ ฅ  -->  Error ๋ฌธ์ด ์ถœ๋ ฅ๋˜๋ฉฐ ๋ช…๋ น์–ด ํ˜•์‹ ํ™•์ธ ๊ฐ€๋Šฅ

4. ; ls ๋ฅผ ์ž…๋ ฅ๋ž€์— ๋„ฃ๊ณ  Ping! ํด๋ฆญ  -->  ์กด์žฌํ•˜๋Š” ํŒŒ์ผ ๋ชฉ๋ก ํ™•์ธ ๊ฐ€๋Šฅ 

5. cat ๋ช…๋ น์–ด๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ flag.py ํŒŒ์ผ ์—ด๊ธฐ  -->  FLAG ํ™•์ธ ๊ฐ€๋Šฅ