๋ณธ๋ฌธ ๋ฐ”๋กœ๊ฐ€๊ธฐ

dreamhack19

[Dreamhack] rev-basic-1 WriteUp โ˜‚๏ธ rev-basic-1 WriteUp 1. ๋ฌธ์ œ ์„ค๋ช… ํ™•์ธ ํ›„ ํŒŒ์ผ ๋‹ค์šด๋กœ๋“œ 2. ๋‹ค์šด๋ฐ›์€ ์‘์šฉ ํ”„๋กœ๊ทธ๋žจ ์‹คํ–‰ ํ›„ ์ž„์˜์˜ ๋ฌธ์ž์—ด ์ž…๋ ฅ --> Enter ์„ ํด๋ฆญํ•˜๋‹ˆ ํ”„๋กœ๊ทธ๋žจ์ด ์ข…๋ฃŒ๋จ์„ ํ™•์ธ 3. x64dbg๋ฅผ ํ†ตํ•ด ์‘์šฉ ํ”„๋กœ๊ทธ๋žจ ์˜คํ”ˆ 4. ์ƒ๋‹จ์˜ '๊ธฐํ˜ธ' ํƒญ์—์„œ 'chall1.exe' ํด๋ฆญ 5. ์ž…๋ ฅ๋ฐ›์€ ๋ฌธ์ž์—ด์„ ์ •๋‹ต๊ณผ ๋น„๊ตํ•˜๋Š” ๋ถ€๋ถ„ ๋ฐœ๊ฒฌ --> ์ •๋‹ต์€ "DH{Compar3_the_ch4ract3r}" 6. ๋ฐœ๊ฒฌํ•œ FLAG ์ž…๋ ฅ --> ๋ฌธ์ œ ํ•ด๊ฒฐ ์„ฑ๊ณต 2023. 11. 20.
[Dreamhack] rev-basic-0 WriteUp ๐Ÿ™ rev-basic-0 WriteUp 1. ๋ฌธ์ œ ์„ค๋ช… ํ™•์ธ ํ›„ ํŒŒ์ผ ๋‹ค์šด๋กœ๋“œ 2. ๋‹ค์šด๋ฐ›์€ ์‘์šฉ ํ”„๋กœ๊ทธ๋žจ ์‹คํ–‰ ํ›„ ์ž„์˜์˜ ๋ฌธ์ž์—ด ์ž…๋ ฅ --> Enter ์„ ํด๋ฆญํ•˜๋‹ˆ ํ”„๋กœ๊ทธ๋žจ์ด ์ข…๋ฃŒ๋จ์„ ํ™•์ธ 3. IDA ๋ฅผ ํ†ตํ•ด ์‘์šฉ ํ”„๋กœ๊ทธ๋žจ ์˜คํ”ˆ 4. ๋ฌธ์ž์—ด ๊ฒ€์ƒ‰ ๊ธฐ๋Šฅ์„ ํ†ตํ•ด 'Correct' ๋ฉ”์‹œ์ง€ ๊ฒ€์ƒ‰ --> Wrong & Correct ๋ฉ”์‹œ์ง€ ๋ฐœ๊ฒฌ 5. ์œ„๋กœ ์Šคํฌ๋กคํ•˜๋‹ˆ ์ž…๋ ฅ๋ฐ›์€ ๋ฌธ์ž์—ด์„ ์ •๋‹ต๊ณผ ๋น„๊ตํ•˜๋Š” ๋ถ€๋ถ„ ๋ฐœ๊ฒฌ --> ์ •๋‹ต์€ "Compar3_the_str1ng" 6. ๋ฐœ๊ฒฌํ•œ FLAG ์ž…๋ ฅ --> ๋ฌธ์ œ ํ•ด๊ฒฐ ์„ฑ๊ณต 2023. 11. 19.
[Dreamhack] broken-png ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด ๐Ÿคณ broken-png ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด 1. ๋ฌธ์ œ์— ๋Œ€ํ•œ ์„ค๋ช…์„ ์ฝ์€ ํ›„ ๋ฌธ์ œ ํŒŒ์ผ ๋‹ค์šด๋กœ๋“œ 2. ๋‹ค์šด๋ฐ›์€ ์ด๋ฏธ์ง€ ํŒŒ์ผ ์—ด๊ธฐ --> FLAG ์ผ๋ถ€๊ฐ€ ์ž˜๋ ค์žˆ์Œ์„ ํ™•์ธ 3. HxD ์–ดํ”Œ์„ ํ†ตํ•ด ๋‹ค์šด๋ฐ›์€ ์ด๋ฏธ์ง€ ํŒŒ์ผ ์—ด๊ธฐ ++ HxD ํ”„๋กœ๊ทธ๋žจ์ด๋ž€? HxD๋Š” ์œˆ๋„์šฐ ์šด์˜ ์ฒด์ œ์—์„œ ๋™์ž‘ํ•˜๋Š” ํ”„๋ฆฌ์›จ์–ด ํ—ฅ์Šค ์—๋””ํ„ฐ๋กœ, ์ฃผ๋กœ ์ปดํ“จํ„ฐ ํŒŒ์ผ์˜ ์ด์ง„ ๋ฐ์ดํ„ฐ๋ฅผ ํŽธ์ง‘ ๋ฐ ๋ถ„์„ํ•˜๋Š” ๋„๊ตฌ๋กœ ์‚ฌ์šฉ๋œ๋‹ค. ์ด ์™ธ์—๋„ HxD๋Š” CRC(์ˆœํ™˜ ์ค‘๋ณต ๊ฒ€์‚ฌ) ์ง„ํ–‰ ๋ฐ ๋ฉ”๋ชจ๋ฆฌ ๊ฒ€์‚ฌ ๊ธฐ๋Šฅ๋„ ์ง€์›ํ•˜๋Š” ๊ฐ•๋ ฅํ•œ ๋„๊ตฌ๋กœ์„œ, ์ฃผ๋กœ ์‹œ์Šคํ…œ ๊ด€๋ฆฌ์ž๋‚˜ ํ”„๋กœ๊ทธ๋ž˜๋จธ, ๋ณด์•ˆ ์ „๋ฌธ๊ฐ€ ๋ฐ ์—”์ง€๋‹ˆ์–ด๊ฐ€ ์‚ฌ์šฉํ•œ๋‹ค. 4. ์ง„์ˆ˜ ์„ค์ •์„ '10'์œผ๋กœ ๋ณ€๊ฒฝํ•œ ๋’ค, ์ด๋ฏธ์ง€์˜ ์„ธ๋กœ ํฌ๊ธฐ๋ฅผ ๊ฐ€๋กœ์™€ ๋™์ผํ•˜๊ฒŒ ์กฐ์ • ํŒŒ๋ž‘ ๋ถ€๋ถ„ ๋นจ๊ฐ• ๋ถ€๋ถ„ 00 00 02 00 (10์ง„์ˆ˜) 00 00 0.. 2023. 8. 20.
[Dreamhack] 64se64 ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด ๐Ÿ‘’ 64se64 ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด 1. ๋ฌธ์ œ์— ๋Œ€ํ•œ ์„ค๋ช… ์ˆ™์ง€ (๋ฌธ์ œ ํŒŒ์ผ์€ ๋ณ„๋„ ๋‹ค์šด๋กœ๋“œ ํ•„์š” X) 2. ์„œ๋ฒ„ ์ƒ์„ฑ ํ›„ ์•ˆ๋‚ด๋œ ๋งํฌ๋กœ ์ ‘์† 3. F12 ๋‹จ์ถ•ํ‚ค๋ฅผ ํ†ตํ•ด ๊ฐœ๋ฐœ์ž ๋„๊ตฌ ์‹คํ–‰ --> Sources ํƒญ์—์„œ ์†Œ์Šค ์ฝ”๋“œ ํ™•์ธ Welcome! ๐Ÿ‘‹ 4. value ๋ณ€์ˆ˜ ์† base64๋กœ ์ธ์ฝ”๋”ฉ๋œ ๋ฌธ์ž์—ด ํ•ด๋…์„ ์œ„ํ•œ ์Šคํฌ๋ฆฝํŠธ ์ž‘์„ฑ import base64 encoded_data = "IyEvdXNyL2Jpbi9lbnYgcHl0aG9uMwphc2M9WzY4LCA3MiwgMTIzLCA5OCwgMTAxLCA0OCwgNTIsIDU0LCA5OCwgNTUsIDUzLCA1MCwgNTAsIDk3LCA5NywgNTAsIDEwMSwgNTAsIDU2LCAxMDIsIDUwLCA1NSwgNTQsIDEwMSwgNDgsID.. 2023. 8. 19.
[Dreamhack] SingleByteXor ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด ๐Ÿž SingleByteXor ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด 1. ๋ฌธ์ œ์— ๋Œ€ํ•œ ์„ค๋ช… ์ˆ™์ง€ (๋ฌธ์ œ ํŒŒ์ผ์€ ๋ณ„๋„ ๋‹ค์šด๋กœ๋“œ ํ•„์š” X) ++ XOR(Exclusive OR) ์•”ํ˜ธ๋ž€? XOR(Exclusive OR) ์•”ํ˜ธ๋ฒ•์€ ๋‘ ๋น„ํŠธ๋‚˜ ๋ถˆ(Boolean) ๊ฐ’์ด ๋‹ค๋ฅผ ๋•Œ 1, ๊ฐ™์„ ๋•Œ 0์„ ๋ฐ˜ํ™˜ํ•˜๋Š” "๋ฐฐํƒ€์  ๋…ผ๋ฆฌํ•ฉ" ์—ฐ์‚ฐ์„ ์‚ฌ์šฉํ•˜์—ฌ ๋ฐ์ดํ„ฐ๋ฅผ ์•”ํ˜ธํ™”ํ•˜๋Š” ๊ฐ„๋‹จํ•œ ์•”ํ˜ธํ™” ๊ธฐ๋ฒ•์ด๋‹ค. XOR(Exclusive OR) ์—ฐ์‚ฐ์€ ๊ฐ ๋ฐ์ดํ„ฐ ๋น„ํŠธ์™€ ์•”ํ˜ธํ™” ํ‚ค ๋น„ํŠธ ๊ฐ„ ์—ฐ์‚ฐ์„ ์ˆ˜ํ–‰ํ•˜๋Š” ๋ฐฉ์‹์œผ๋กœ ๋™์ž‘ํ•˜๋ฉฐ, ๊ฐ ๋น„ํŠธ์— ๋Œ€ํ•ด ์•”ํ˜ธํ™” ํ‚ค์˜ ํ•ด๋‹น ๋น„ํŠธ์™€ XOR ์—ฐ์‚ฐ์„ ์ˆ˜ํ–‰ํ•˜๋ฉด ์•”ํ˜ธ๋ฌธ์ด ์ƒ์„ฑ๋œ๋‹ค. ๋ณตํ˜ธํ™”์˜ ๊ฒฝ์šฐ ๋™์ผํ•œ ํ‚ค๋ฅผ ํ†ตํ•ด ์—ฐ์‚ฐ์„ ์ถ”๊ฐ€ ์ˆ˜ํ–‰ํ•จ์œผ๋กœ์จ ์–ป์„ ์ˆ˜ ์žˆ๋‹ค. 2. ๋ณตํ˜ธํ™”๋ฅผ ์œ„ํ•œ Python ์Šคํฌ๋ฆฝํŠธ ์ž‘์„ฑ hex_value = "54586b.. 2023. 8. 18.
[Dreamhack] Simple-web-request ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด ๐Ÿฟ Simple-web-request ๋“œ๋ฆผํ•ต ์›Œ๊ฒŒ์ž„ ๋ฌธ์ œ ํ’€์ด 1. ๋ฌธ์ œ์— ๋Œ€ํ•œ ์„ค๋ช…์„ ์ฝ์€ ํ›„ ๋ฌธ์ œ ํŒŒ์ผ ๋‹ค์šด๋กœ๋“œ 2. ๋‹ค์šด๋ฐ›์€ app.py ํŒŒ์ผ ์˜คํ”ˆ ํ›„ ์ฝ”๋“œ ๋ถ„์„ #!/usr/bin/python3 import os from flask import Flask, request, render_template, redirect, url_for import sys app = Flask(__name__) try: # flag is here! FLAG = open("./flag.txt", "r").read() except: FLAG = "[**FLAG**]" @app.route("/") def index(): return render_template("index.html") @app.route("/step1",.. 2023. 8. 17.