No image

Security/Wargame

[Hackthebox] - [Web] Render Quest Writeup(문제풀이)

문제 이름: Render Quest 문제 유형: Web 문제 난이도: Easy 문제 설명: You've found a website that lets you input remote templates for rendering. Your task is to exploit this system's vulnerabilities to access and retrieve a hidden flag. Good luck! 취약한 코드 설명 func (p RequestData) FetchServerInfo(command string) string { out, err := exec.Command("sh", "-c", command).Output() if err != nil { return "" } return string(..

by 알 수 없는 사용자 2023. 12. 20.

No image

Security/Wargame

[Hackthebox] - [Web] The Magic Informer Writeup(문제풀이)

문제 개요 The Magic Informer is the only byte-sized wizarding newspaper that brings the best magical news to you at your fingertips! Due to popular demand and bold headlines, we are often targeted by wizards and hackers alike. We need you to pentest our news portal and see if you can gain access to our server. 코드 분석 FLAG의 위치는 Dockerfile에서 찾을 수 있습니다. RUN gcc -o /readflag /readflag.c && chmod 4755 /re..

by 알 수 없는 사용자 2023. 2. 1.

No image

Security/Wargame

[Hackthebox] - [Web] baby website rick Writeup(문제풀이)

문제 개요 Look Morty, look! I turned myself into a website Morty, I'm Website Rick babyyy!! But don't play around with some of them anti pickle serum I have stored somewhere safe, if I turn back to a human I'll have to go to family therapy and we don't want that Morty. 문제 분석 첫 화면에 위와 같이 나왔습니다. 이라고 나오는 문자열의 경우 파이썬에서 특정 클래스를 출력할 때 위와 같이 나옵니다. 그리고 pickle 이라는 단어를 봤을 때 python 의 pickle 모듈을 사용했을 것으로 유추되는 상..

by 알 수 없는 사용자 2023. 1. 24.

No image

Security/Wargame

[Hackthebox] - [Forensics] Wrong Spooky Season Writeup(문제풀이)

문제 개요 "I told them it was too soon and in the wrong season to deploy such a website, but they assured me that theming it properly would be enough to stop the ghosts from haunting us. I was wrong." Now there is an internal breach in the `Spooky Network` and you need to find out what happened. Analyze the the network traffic and find how the scary ghosts got in and what they did. 문제 풀이 프로토콜 계층 통계를..

by 알 수 없는 사용자 2023. 1. 9.

No image

Security/Wargame

[Hackthebox] WS-Todo Writeup(문제풀이)

이번에 정말 오랜만에 Hackthebox 에 Web Challenge 카테고리에 따끈따끈한 신규 문제가 출제되었다는 소식을 듣고 후다닥 가서 풀어보았는데요! 역시 명불허전 무척이나 흥미로운 문제였습니다. 옛날에 React 공부할 때 todo list 를 만들었던 기억이 새록새록 떠오르는데요. 이번 문제도 역시나 todo list 관련 문제였습니다... 근데 todo list 에 왠걸 관리자가 있네요? 엄청난 짬뽕 조합이 아닐 수 없습니다. 하지만 푸는 재미만 있으면 되니 그냥 풀어봅니다! 문제 개요 문제 설명 : This WebSockets-based Todo application features ✨millitary-grade encryption✨ and is extremely low-latency. I..

by 알 수 없는 사용자 2023. 1. 1.

No image

Security/CTF

[HackTheBoo] [Web] Cursed Secret Party Writeup(문제풀이)

Introduction Category : Web Difficulty : Medium Description : You've just received an invitation to a party. Authorities have reported that the party is cursed, and the guests are trapped in a never-ending unsolvable murder mystery party. Can you investigate further and try to save everyone? Code Analysis Flag의 위치는 bot.js 파일에 있었습니다. const flag = fs.readFileSync('/flag.txt', 'utf8'); // ... 생략 ....

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/CTF

[HackTheBoo] [Web] Juggling Facts Writeup(문제풀이)

Introduction Category : Web Difficulty : easy Description : An organization seems to possess knowledge of the true nature of pumpkins. Can you find out what they honestly know and uncover this centuries-long secret once and for all? Code Analysis Flag 가 어디있나 살펴봤고, entrypoint.sh 파일에서 DB 생성 시에 입력되는 것을 볼 수 있었습니다. CREATE DATABASE web_juggling_facts; USE web_juggling_facts; CREATE TABLE facts ( id IN..

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/CTF

[HackTheBoo] [Web] Horror Feeds Writeup(문제풀이)

Introduction Category : Web Difficulty : easy Description : An unknown entity has taken over every screen worldwide and is broadcasting this haunted feed that introduces paranormal activity to random internet-accessible CCTV devices. Could you take down this streaming service? Code Analysis 먼저 Flag를 획득하기 위한 방법에 대해서 알아봅니다. Flag는 config.py에 Flask 환경변수로 저장된 것을 볼 수 있습니다. class Config(object): SECRET..

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/CTF

[HackTheBoo] [Web] Spookifier Writeup(문제풀이)

Introduction Category : Web Difficulty : easy Description : There's a new trend of an application that generates a spooky name for you. Users of that application later discovered that their real names were also magically changed, causing havoc in their life. Could you help bring down this application? Code Analysis application/blueprints/routes.py 파일의 코드를 보면 GET 파라미터 들어온 text 값을 spookify 함수로 넘기고..

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/CTF

[HackTheBoo] [Web] Evaluation Deck Writeup(문제풀이)

Introduction Category : web Difficulty : easy Description : A powerful demon has sent one of his ghost generals into our world to ruin the fun of Halloween. The ghost can only be defeated by luck. Are you lucky enough to draw the right cards to defeat him and save this Halloween? Code Analysis application/blueprints/routes.py 파일의 코드를 보면 Python Arbitrary Code Injection 이 가능하다는 것을 알 수 있습니다. @api.r..

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/Wargame

[Hackthebox] Letter Dispair Writeup(문제풀이)

문제 개요 문제 설명 난이도 및 유형 A high-profile political individual was a victim of a spear-phishing attack. The email came from a legitimate government entity in a nation we don't have jurisdiction. However, we have traced the originating mail to a government webserver. Further enumeration revealed an open directory index containing a PHP mailer script we think was used to send the email. We need access t..

by 알 수 없는 사용자 2022. 8. 16.

No image

Security/CTF

[Hackthebox] - [Forensics] Rogue Writeup(문제풀이)

문제 설명 SecCorp has reached us about a recent cyber security incident. They are confident that a malicious entity has managed to access a shared folder that stores confidential files. Our threat intel informed us about an active dark web forum where disgruntled employees offer to give access to their employer's internal network for a financial reward. In this forum, one of SecCorp's employees offe..

by 알 수 없는 사용자 2022. 7. 27.