분류 전체보기

4-2 게시판 구현하기(게시판 등록) 2023.11.19
Actor의 위치 디버깅(DrawDebugSphere) 2023.11.18
Bandit WarGame Level 16 -> Level 17 2023.11.17
Bandit WarGame Level 15 -> Level 16(openssl s_client) 2023.11.17

4-2 게시판 구현하기(게시판 등록)

팥들었슈_ 2023. 11. 19. 14:42

2023. 11. 19. 14:42

디렉토리 구조

wirte.php

<?php
ini_set('display_errors', 1);
require_once '../common/header.php';
require_once '/app/lib/login_check.php';
?>

// 등록 로직
<?php
  $isetTitle = isset($_POST['title']) && strlen($_POST['title']) > 0;
  $issetContent = isset($_POST['content']) && strlen($_POST['content']) > 0;
  $isSubmit = isset($_POST['submit']) && strlen($_POST['submit']) > 0;

  require_once "/app/board/board_function.php";
  if ($isetTitle && $issetContent && $isSubmit) {

    // 저장하기
    $title = $_POST['title'];
    $content = $_POST['content'];
    $result = insert_tbl_board($title, $content);
    
    if($result) {
      echo "<script>alert('작성 완료.');
               location.href='/board/list.php'
              </script>";
              exit;
    }

  }

?>

<div style="width: 100%; height:100%">

  <div style="width: 80%; height:20%; margin: 50px">
    <h1> 글쓰기 </h1>
  </div>

  <!-- 글쓰기 섹션 -->
  <div style="width: 80%; height:80%; margin: 50px"> 
    <form method="POST">
      <div style="height: 20%;"> 
        <div class="form-floating mb-3">
          <input type="text" name="title" class="form-control" id="floatingInput" placeholder="name@example.com"
          value="<?php
              if ($isSubmit) {
                echo $_POST['title'];
              }
            ?>"/>
          <label for="floatingInput">제목</label>
        </div>
      </div>
  
  
        <div >
          <div class="form-floating">
          <textarea name="content" style="height: 500px;" class="form-control" placeholder="Leave a comment here" id="floatingTextarea"
            ><?php
              if ($isSubmit) {
                echo $_POST['content'];
              }
            ?></textarea>
          <label for="floatingTextarea">내용</label>
        </div>
        <input hidden/ value="submit" name="submit">
        <div style="margin-top: 20px;">

          <button>작성</button>
          <span>
            <?php
              if($isSubmit)
              echo "제목, 내용을 확인해주세요";
            ?>
          </span>
        </div>

    </form>

  </div>
</div>

  



<?php
// require_once '../common/footer.php';
?>

board_function.php

<?php
require '/app/lib/db_connection.php';

function getDbConn() {
  if (!isset($db_conn)) {
    $db_conn = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
    $db_conn -> set_charset('utf8');
  }
  return $db_conn;
}

function insert_tbl_board($title, $content)  {
  $db_conn = getDbConn();
  $token = $_COOKIE['REFRESH_TOKEN'];

  $sql = "insert into tbl_board 
  (IDX, TITLE, CONTENT, FIRST_REG_USER, FIRST_REG_TIME, LAST_UPD_USER, LAST_UPD_TIME
  ) value 
  (null, '{$title}', '{$content}'
  , (SELECT USER_ID FROM user WHERE REFRESH_TOKEN ='{$token}'), NOW()
  , (SELECT USER_ID FROM user WHERE REFRESH_TOKEN ='{$token}'), NOW() )";

  return mysqli_query($db_conn, $sql);
}

?>

쿠키에 id를 저장하고 있지만 변조가 쉽기 때문에 Refresh_token으로 USER_ID를 조회하여 insert한다.

저작자표시

'웹 해킹 코스 > 과제' 카테고리의 다른 글

6주차 1.SQL Injection2 (2)	2023.12.01
4-3 게시판 구현하기(게시판 목록) (1)	2023.11.19
4-1 javascript를 사용한 키로거 (0)	2023.11.16
3-2 JWT 토큰이란? (3)	2023.11.12
3-1(로그인 케이스) (0)	2023.11.09

Actor의 위치 디버깅(DrawDebugSphere)

팥들었슈_ 2023. 11. 18. 07:24

2023. 11. 18. 07:24

블루프린트를 사용한 위치 확인

C++를 사용한 위치 디버깅

// Fill out your copyright notice in the Description page of Project Settings.


#include "Item/Item.h"
#include "DrawDebugHelpers.h"

// 매크로의 구성 
#define DRAW_SPHERE(Location) if (GetWorld()) DrawDebugSphere(GetWorld(), Location, 25.f, 20, FColor::Red, false, 60.f)

// Sets default values
AItem::AItem()
{
 	// Set this actor to call Tick() every frame.  You can turn this off to improve performance if you don't need it.
	PrimaryActorTick.bCanEverTick = true;

}

// 액터가 스폰 되었을 때 실행되는 함수
void AItem::BeginPlay()
{
	Super::BeginPlay();
    // 아웃풋 콘솔에 표기되는 로그
	UE_LOG(LogTemp, Warning,TEXT("wow"));
    
	/* 
		UWorld* world = GetWorld();
		if (world) {
			DrawDebugSphere(world, location, 20.f, 32, FColor::Cyan,false ,60.f);
	
		}
	*/
	FVector Location = GetActorLocation();
	DRAW_SPHERE(Location);


	
}

// 매 프레임마다 동작하는 함수
void AItem::Tick(float DeltaTime)
{
	Super::Tick(DeltaTime);
	if (GEngine) {
    	// Actor가 가지는 이름
		FString Name = GetName();
        // GetName은 FStringdlrl 이므로 *Name으로 TCHAR로 변환
		 FString Message = FString::Printf(TEXT("Name is %s"), *Name);
		// FString Message = FString::Printf(TEXT("DeltaTime is %f"), DeltaTime);

		GEngine->AddOnScreenDebugMessage(1, 60, FColor::Cyan, Message);
	
	}
}

FString의 operator*

/**
 * Get pointer to the string
 *
 * @Return Pointer to Array of TCHAR if Num, otherwise the empty string
 */
UE_NODISCARD FORCEINLINE const TCHAR* operator*() const UE_LIFETIMEBOUND
{
	return Data.Num() ? Data.GetData() : TEXT("");
}

결과

흰색 구체는 BluePrint로 그린 것이고 빨간색이 C++로 그린 구체

저작자표시

'기타 > UnReal Engine' 카테고리의 다른 글

멤버변수의 추가와 sin함수 (1)	2023.11.21
오브젝트의 이동 (초당 이동거리, Persistent, AddActorWorldOffser) (0)	2023.11.21
언리얼 엔진 레벨 연습 (0)	2023.11.13
UNREAL Engine(시작해요 언리얼2033) Level Instance (0)	2023.11.12
UNREAL_01_02(Quixel, MegaScans, Charactor) (0)	2023.11.12

Bandit WarGame Level 16 -> Level 17

팥들었슈_ 2023. 11. 17. 10:58

2023. 11. 17. 10:58

Bandit Level 16 → Level 17

Level Goal

The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

Helpful Reading Material

Port scanner on Wikipedia

다음 레벨로가기위해서 현재레벨의 비밀번호를 제출해라 localhost의 31000 - 32000 포트중에서 포트는 1개 이상이다.

일단 31000 - 32000포트 중 리슨중인 포트를 찾아보자.

bandit16@bandit:~$ nc -vz localhost 31000-32000 2>&1 | grep "succeeded!"
Connection to localhost (127.0.0.1) 31046 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31518 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31691 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31790 port [tcp/*] succeeded!
Connection to localhost (127.0.0.1) 31960 port [tcp/*] succeeded!

nc(netcat): 호스트의 포트로 접속

-v: 추가 정보를 볼 수 있다. 옵션을 주지 않으면 아무것도 보이지 않는다.
-z: 기본적으로 nc는 포트가 리슨이라면 접속 후 대기한다. z옵션은 접속 하지 않고 검색만한다.
31000-32000: 포트접속 범위

접속가능한 포트는 5개이다.

bandit16@bandit:~$ openssl s_client -connect localhost:31790
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 CN = localhost
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN = localhost
verify error:num=10:certificate has expired
notAfter=Nov 14 21:28:41 2023 GMT
verify return:1
depth=0 CN = localhost
notAfter=Nov 14 21:28:41 2023 GMT
verify return:1
---
Certificate chain
 0 s:CN = localhost
   i:CN = localhost
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1
   v:NotBefore: Nov 14 21:27:41 2023 GMT; NotAfter: Nov 14 21:28:41 2023 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDCzCCAfOgAwIBAgIEPPSSSjANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDDAls
b2NhbGhvc3QwHhcNMjMxMTE0MjEyNzQxWhcNMjMxMTE0MjEyODQxWjAUMRIwEAYD
VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB
IlejBXoR34ClW2gpf9BwT9mBZj7MlPBqzA1wqoVj0aAaiIjVkuaqFM6bDWkebjql
z1R0bZfMPrlG2rcSB46R0mTZEc+dS1ifSw8lXzRB+YWbZcTU4O8xaDvnQcu6WcnV
tz6mnB7YwpFeZCZx1cEpcwYZAtqyhNz/4vjtvLc5tj7mk5oZRpuibEB/HJe+YIsY
AC2LBmIT5Ld6s5kOyIHhrlQZaIHX0j2q4SZusAUaVsvqF5lYJYqZRESHHxyV3EOw
AprzDR0COBlC9gX8es0j4/m2Kdt03xAcGD8i4Mk/Bj5gkkZyHm97h8hE8r2I1O39
/qmvYzubUFrfxKE/GGhZAgMBAAGjZTBjMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDBL
BglghkgBhvhCAQ0EPhY8QXV0b21hdGljYWxseSBnZW5lcmF0ZWQgYnkgTmNhdC4g
U2VlIGh0dHBzOi8vbm1hcC5vcmcvbmNhdC8uMA0GCSqGSIb3DQEBBQUAA4IBAQCG
8jn78KslFph6DMwit8hQ1TB1bUtF6TfHojgjOGIYgKz2IECcDKyvBXqWG5XYM9B2
FR7yfQRTtVKraPipZg4eyXfFWeIEKbv7by868IlrjuseoprB3tGs6QdMPBkHyti8
4RUk9/RGNnzYJZ1/98FLqZz/Nn4PDq4w3CCk7tLH4lVYMEpbYDMp/FNS8QUZJHDr
xTxMD+q67q4YcnsW6zhYEYfDsaNlFaJ5jCIrgsEeZZZVsDCDUKEmDGKnpTba9oOo
BdhzuIB3Rfu2HKImaHx3BU7S3vSdvMlvCgODUKp745dOegSRM5O6KDql+Bv/EF5+
R4TyvPpslc6E6C4zgMbm
-----END CERTIFICATE-----
subject=CN = localhost
issuer=CN = localhost
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1339 bytes and written 373 bytes
Verification error: certificate has expired
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 10 (certificate has expired)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 50FFF1CE36BCE3573679CBB36DB4396B87650EA334A2399DABC686E585277B4F
    Session-ID-ctx:
    Resumption PSK: F67614789291F6260A5F666EC8FC35D3414BADC9E6EEB7CA4DF3C7B9D77D8129193263ED1E8072196AB0CE56C27EAEA8
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 4d ce 25 75 b6 48 66 23-0e 0c 97 96 1e 3d 75 b2   M.%u.Hf#.....=u.
    0010 - eb 9c 29 32 fd 07 13 85-99 26 1e 7a df ec 2d 88   ..)2.....&.z..-.
    0020 - 3f 10 0c 0d 8f 67 99 02-99 2d 62 67 57 3f 1f fa   ?....g...-bgW?..
    0030 - 02 15 a1 25 c2 d9 7b 8e-fd 7c 01 72 72 45 cb 63   ...%..{..|.rrE.c
    0040 - b5 06 03 e7 24 aa 49 f2-8e 9c 03 0f 8c ff 99 40   ....$.I........@
    0050 - 97 04 af 36 5a 6f b3 01-fc 30 76 c1 73 71 59 cf   ...6Zo...0v.sqY.
    0060 - f9 f7 26 14 f9 ad 68 5b-90 c8 51 0b d0 02 95 25   ..&...h[..Q....%
    0070 - 6c 8c e6 ad b0 d0 5d a4-07 47 97 66 46 88 2c 7e   l.....]..G.fF.,~
    0080 - 8c 61 79 17 56 e1 aa 80-2a 33 c2 9f 21 71 51 b2   .ay.V...*3..!qQ.
    0090 - 16 f6 a5 29 98 7b b3 e7-73 f0 df 88 f2 56 df fa   ...).{..s....V..
    00a0 - 94 10 e0 da 3c 41 65 1f-28 37 b8 34 0a 13 96 e3   ....<Ae.(7.4....
    00b0 - 49 16 14 0b 31 aa bc f7-d8 9a 83 05 dc 19 e7 f0   I...1...........
    00c0 - 74 07 e4 35 6c 65 33 de-6d 0a 2c 07 82 e6 4d e2   t..5le3.m.,...M.

    Start Time: 1700184803
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: F706A8D5FB8A59F379D588528A382372E116D92D7D0DA42D6533B4F63D7667ED
    Session-ID-ctx:
    Resumption PSK: 222B5500FBE8111E0343E8348B2BDB0E9BFDDBADC7CE1766E7D780B4FE09447BA63333F3E2A44ABB96E03A24E867BB8A
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 4d ce 25 75 b6 48 66 23-0e 0c 97 96 1e 3d 75 b2   M.%u.Hf#.....=u.
    0010 - 00 b7 e6 63 5f 88 45 78-6c 6c 18 a7 48 61 df 04   ...c_.Exll..Ha..
    0020 - cd 3c 15 e3 39 3d ed fb-35 a4 86 6e 78 d5 58 3e   .<..9=..5..nx.X>
    0030 - 72 b7 9c f1 45 b5 39 40-a9 e1 cc b4 89 73 70 6f   r...E.9@.....spo
    0040 - b0 b2 99 66 0a 6c fb d4-a7 e8 3d 29 31 16 30 3c   ...f.l....=)1.0<
    0050 - 02 1b e0 9c f1 9e 8d ae-9b 82 fc 29 a8 09 1f ad   ...........)....
    0060 - 7b b8 e3 b7 22 cc f2 ff-61 8e 0a 95 ec 0b 49 70   {..."...a.....Ip
    0070 - 9d d7 67 44 73 9c 7f c3-13 14 a8 d8 e3 4c 45 ff   ..gDs........LE.
    0080 - 42 b0 5f 9d 1a 9a f4 06-fc ba 3d 8e 9d 84 ce f8   B._.......=.....
    0090 - ca 89 bf 00 e7 a7 b2 d3-de 7a e0 e6 d9 08 a5 01   .........z......
    00a0 - 2a 89 be 69 7c 5d 56 d2-49 28 5e ea f7 55 f1 52   *..i|]V.I(^..U.R
    00b0 - 16 5e 33 c8 e1 a5 82 81-71 4c 2b b5 ba 0b 69 45   .^3.....qL+...iE
    00c0 - d7 da 8b a3 65 51 4a 66-af 5d f2 00 33 de 36 7b   ....eQJf.]..3.6{

    Start Time: 1700184803
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
JQttfApK4SeyHwDlI9SXGR50qclOAil1
Correct!
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ
Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu
DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW
JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX
x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD
KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl
J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd
d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC
YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A
vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama
+TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT
8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx
SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd
HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt
SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A
R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi
Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg
R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu
L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni
blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU
YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM
77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b
dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----

closed

/etc/tmp/patrache25 디렉토리 생성후

key.private 파일을 생성하여 begin부터 end 까지 붙여넣기 후 chmod 600 key.private 한다.

bandit16@bandit:/tmp/patrache25$ ll
total 408
drwxrwxr-x    2 bandit16 bandit16   4096 Nov 17 01:41 ./
drwxrwx-wt 2115 root     root     405504 Nov 17 01:43 ../
-rw-------    1 bandit16 bandit16   1675 Nov 17 01:41 key.private
bandit16@bandit:/tmp/patrache25$ cat key.private
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvmOkuifmMg6HL2YPIOjon6iWfbp7c3jx34YkYWqUH57SUdyJ
imZzeyGC0gtZPGujUSxiJSWI/oTqexh+cAMTSMlOJf7+BrJObArnxd9Y7YT2bRPQ
Ja6Lzb558YW3FZl87ORiO+rW4LCDCNd2lUvLE/GL2GWyuKN0K5iCd5TbtJzEkQTu
DSt2mcNn4rhAL+JFr56o4T6z8WWAW18BR6yGrMq7Q/kALHYW3OekePQAzL0VUYbW
JGTi65CxbCnzc/w4+mqQyvmzpWtMAzJTzAzQxNbkR2MBGySxDLrjg0LWN6sK7wNX
x0YVztz/zbIkPjfkU1jHS+9EbVNj+D1XFOJuaQIDAQABAoIBABagpxpM1aoLWfvD
KHcj10nqcoBc4oE11aFYQwik7xfW+24pRNuDE6SFthOar69jp5RlLwD1NhPx3iBl
J9nOM8OJ0VToum43UOS8YxF8WwhXriYGnc1sskbwpXOUDc9uX4+UESzH22P29ovd
d8WErY0gPxun8pbJLmxkAtWNhpMvfe0050vk9TL5wqbu9AlbssgTcCXkMQnPw9nC
YNN6DDP2lbcBrvgT9YCNL6C+ZKufD52yOQ9qOkwFTEQpjtF4uNtJom+asvlpmS8A
vLY9r60wYSvmZhNqBUrj7lyCtXMIu1kkd4w7F77k+DjHoAXyxcUp1DGL51sOmama
+TOWWgECgYEA8JtPxP0GRJ+IQkX262jM3dEIkza8ky5moIwUqYdsx0NxHgRRhORT
8c8hAuRBb2G82so8vUHk/fur85OEfc9TncnCY2crpoqsghifKLxrLgtT+qDpfZnx
SatLdt8GfQ85yA7hnWWJ2MxF3NaeSDm75Lsm+tBbAiyc9P2jGRNtMSkCgYEAypHd
HCctNi/FwjulhttFx/rHYKhLidZDFYeiE/v45bN4yFm8x7R/b0iE7KaszX+Exdvt
SghaTdcG0Knyw1bpJVyusavPzpaJMjdJ6tcFhVAbAjm7enCIvGCSx+X3l5SiWg0A
R57hJglezIiVjv3aGwHwvlZvtszK6zV6oXFAu0ECgYAbjo46T4hyP5tJi93V5HDi
Ttiek7xRVxUl+iU7rWkGAXFpMLFteQEsRr7PJ/lemmEY5eTDAFMLy9FL2m9oQWCg
R8VdwSk8r9FGLS+9aKcV5PI/WEKlwgXinB3OhYimtiG2Cg5JCqIZFHxD6MjEGOiu
L8ktHMPvodBwNsSBULpG0QKBgBAplTfC1HOnWiMGOU3KPwYWt0O6CdTkmJOmL8Ni
blh9elyZ9FsGxsgtRBXRsqXuz7wtsQAgLHxbdLq/ZJQ7YfzOKU4ZxEnabvXnvWkU
YOdjHdSOoKvDQNWu6ucyLRAWFuISeXw9a/9p7ftpxm0TSgyvmfLF2MIAEwyzRqaM
77pBAoGAMmjmIJdjp+Ez8duyn3ieo36yrttF5NSsJLAbxFpdlc1gvtGCWW+9Cq0b
dxviW8+TFVEBl1O4f7HVm6EpTscdDxU+bCXWkfjuRb7Dy9GOtt9JPsX8MBTakzh3
vBgsyi/sN3RqRBcGU40fOoZyfAMT8s1m/uYv52O6IgeuZ/ujbjY=
-----END RSA PRIVATE KEY-----

이제 key로 bandit17로 접속하면 끝

bandit16@bandit:/tmp/patrache25$ ssh -i key.private bandit17@localhost -p2220

bandit17@bandit:~$ cat /etc/bandit_pass/bandit17
VwOSWtCA7lRKkTfbr2IDh6awj9RNZM5e

저작자표시

'WarGame > Bandit WarGame' 카테고리의 다른 글

Bandit WarGame Level 15 -> Level 16(openssl s_client) (0)	2023.11.17
Bandit WarGame Level 14 -> Level 15(telnet) (0)	2023.11.17
Bandit WarGame Level 13 -> Level 14 (ssh -i) (0)	2023.11.17
Bandit WarGame Level 12 -> Level 13(xxd, tar -xvf, gzip -d) (0)	2023.11.15
Bandit WarGame Level 11 -> Level 12(tr, 문자치환) (1)	2023.11.15

Bandit WarGame Level 15 -> Level 16(openssl s_client)

팥들었슈_ 2023. 11. 17. 10:05

2023. 11. 17. 10:05

Bandit Level 15 → Level 16

Level Goal

The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.

Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

Helpful Reading Material

다음 레벨의 비밀번호를 얻기위해 현제 레벨의 30001포트로 SSL encrypion을 사용하여 접속하라

Commands you may need to solve this level들을 찾아보니

openssl의 s_client 옵션이 있다.

https://kimkmg.tistory.com/44

OpenSSL 과 s_client

OpenSSL SSL/TLS 프로토콜을 구현한 라이브러리 중 하나로, 통신전문과 문서를 암호화 할 수 있음 s_client (SSL/TLS client program) SSL/TLS 를 사용하는 원격 호스트에 접속하기 위한 일반적인 SSL/TLS client를

kimkmg.tistory.com

bandit14@bandit:~/.ssh$ openssl s_client localhost:30001
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 CN = localhost
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN = localhost
verify error:num=10:certificate has expired
notAfter=Nov 14 21:28:40 2023 GMT
verify return:1
depth=0 CN = localhost
notAfter=Nov 14 21:28:40 2023 GMT
verify return:1
---
Certificate chain
 0 s:CN = localhost
   i:CN = localhost
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1
   v:NotBefore: Nov 14 21:27:40 2023 GMT; NotAfter: Nov 14 21:28:40 2023 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDCzCCAfOgAwIBAgIEM6RIkjANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDDAls
b2NhbGhvc3QwHhcNMjMxMTE0MjEyNzQwWhcNMjMxMTE0MjEyODQwWjAUMRIwEAYD
VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1
wifvEdFWIeI2PJy/Ahfb5tN0GZ944HsRBxLC3vFvUqVimmxRSgEwmZ9iYbhI/dLQ
TqyNCAZqE1AVaYfkFr7SFoLQ+3OIZbnEy4JSNlSWHdgnoObBwpz9aFKnTy2yI5LV
6Ep7nReXr/xpRpl2b/WS41WhKrg8eR3CkE9Vc3XFUqBdB+PBJRhAT5cPhYkCZVWo
b00JKC+jO96YfXzZ8zg72L10sKUeIUoA5/npKi1t4wG6dVCGyi5svPIv2pNBxJCq
M50hpaN9LB88+hZl+zRqIfcVzMsHDK06kHGIiEr4L24aMO+OD8lRThtBZ7yYkNN3
XR0rgJR79/+1WEHZ03RFAgMBAAGjZTBjMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDBL
BglghkgBhvhCAQ0EPhY8QXV0b21hdGljYWxseSBnZW5lcmF0ZWQgYnkgTmNhdC4g
U2VlIGh0dHBzOi8vbm1hcC5vcmcvbmNhdC8uMA0GCSqGSIb3DQEBBQUAA4IBAQA8
H1DosaYoBW1zkfNg/Xj7+sd/ReR3BcDjg3bDUN3dpNBSKxUHvxo2WttPcLQY/4Zq
fzHxKTWuqMrGEoiZN7vE46cVcjRePDoCLWq4QoIfWeNcIVUGjtOwdPFqQSrignTb
g7qD1NOh4NFWRub7NxoRlywqtWeUfXBQ5XGI82tJzZa4qib2BGOuB6rOPSWZbwaV
JKThaMGm+hky40ZvnPc70HDXpED3DFuWyexvsfpSsGU+uFoQ0ULbtnOkWbWfFFHL
db9NauNMnGGozRbOvKhTWpMxA2GYVSXtsawKmf93do3UOCWVTo+pkfhqhJolmWXm
W/RG59GpXpt37aWvGnX3
-----END CERTIFICATE-----
subject=CN = localhost
issuer=CN = localhost
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1339 bytes and written 373 bytes
Verification error: certificate has expired
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 10 (certificate has expired)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 376B1A05858513EC8D5259E5770D33FDEC887E074D932D075160097F7066839F
    Session-ID-ctx:
    Resumption PSK: 448ED7C212C91F5FF5F06304A7F93E3FFE2B764697450FF1BA19C0FAE5B8743F6B5F4B13F0A6EC2C9B7E524F5BCA57F6
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 00 ce 70 c8 45 c4 d3 37-32 1f 89 92 6a ab 5a 57   ..p.E..72...j.ZW
    0010 - 98 12 98 8b 15 07 5e 3f-73 6b b2 13 e7 69 df f0   ......^?sk...i..
    0020 - 9a b3 2a 25 45 13 44 03-23 8a b0 e8 24 26 09 1e   ..*%E.D.#...$&..
    0030 - d2 b7 c3 b8 96 5a ee 32-ab 4f 39 ae 84 0a 39 ef   .....Z.2.O9...9.
    0040 - 22 0a 14 ba ca 5c 11 2b-b2 92 79 6e 41 f8 b3 7e   "....\.+..ynA..~
    0050 - 78 24 f4 5a 08 73 75 52-90 29 e8 cd 43 4f 55 d4   x$.Z.suR.)..COU.
    0060 - 2a 7a 64 93 23 2f e0 4d-9d 95 8c 85 14 ec ae d2   *zd.#/.M........
    0070 - 74 87 ff 0a 11 c1 c5 f0-85 cf b7 33 3b 6e 81 41   t..........3;n.A
    0080 - 18 39 64 67 dd 3e 0b 39-87 f2 e3 80 f3 77 e5 8b   .9dg.>.9.....w..
    0090 - 53 cd 35 2b d4 d4 e5 db-86 cc 0e 17 b2 22 71 63   S.5+........."qc
    00a0 - e3 ed f1 d0 a0 ca 26 c3-f8 ab f8 2e 41 65 ae 4a   ......&.....Ae.J
    00b0 - 21 7d 76 17 fa f2 b5 1d-ad 8b 47 89 dd 52 ab 33   !}v.......G..R.3
    00c0 - 55 e0 db 13 9f 6e 4a 7c-00 85 e4 7c fe ea f1 85   U....nJ|...|....

    Start Time: 1700182691
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 8EA9A947757D4C2B632BE5C1474C8D53900AAA61B6B262074A188581E8C738F2
    Session-ID-ctx:
    Resumption PSK: 5F434F8EE5043076AE0B0D47636FAD326A21939F3C1545FB3AD557A310257BCDA119C5EC33CDC3FBA5C18521932B757C
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 00 ce 70 c8 45 c4 d3 37-32 1f 89 92 6a ab 5a 57   ..p.E..72...j.ZW
    0010 - 95 37 23 8f 95 c4 89 21-7c 6f 9e 88 11 bd ea 26   .7#....!|o.....&
    0020 - 66 57 fb b4 bc b8 19 f7-d7 31 4b 05 2f 36 a9 02   fW.......1K./6..
    0030 - 3a 39 e8 82 b0 6b 6c bb-f1 56 d8 08 cd b0 a1 a9   :9...kl..V......
    0040 - 09 e6 0b 39 9a 94 09 a0-b2 6a 15 8b 8f 63 90 be   ...9.....j...c..
    0050 - 09 8b ea 58 90 7f 45 ce-66 ca 3a 07 e7 75 6e 3b   ...X..E.f.:..un;
    0060 - 8e 7a b7 32 6b c3 44 db-18 70 2f b2 e1 f4 a7 83   .z.2k.D..p/.....
    0070 - 31 e6 3e e1 e8 f3 05 e4-22 00 45 61 4f 37 89 22   1.>.....".EaO7."
    0080 - 38 8b 25 07 8b ca 15 b1-db 1f 2a 12 b7 b7 38 d9   8.%.......*...8.
    0090 - b0 93 57 fa 8e 7c 8f 25-81 a2 37 bc 73 78 49 87   ..W..|.%..7.sxI.
    00a0 - b5 ee 55 62 5d 5d ee 99-62 3c d6 b1 27 0c 1a bf   ..Ub]]..b<..'...
    00b0 - 19 43 b1 24 8b 32 48 4b-1d 02 cf 6a 14 22 35 3b   .C.$.2HK...j."5;
    00c0 - 79 e9 16 14 f4 ae 54 b2-80 40 00 20 6a 05 4c a6   y.....T..@. j.L.

    Start Time: 1700182691
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
jN2kgmIXJ6fShzhT2avhotn4Zcka6tnt
Correct!
JQttfApK4SeyHwDlI9SXGR50qclOAil1

closed

이해가 잘 안간다.

저작자표시

'WarGame > Bandit WarGame' 카테고리의 다른 글

Bandit WarGame Level 16 -> Level 17 (0)	2023.11.17
Bandit WarGame Level 14 -> Level 15(telnet) (0)	2023.11.17
Bandit WarGame Level 13 -> Level 14 (ssh -i) (0)	2023.11.17
Bandit WarGame Level 12 -> Level 13(xxd, tar -xvf, gzip -d) (0)	2023.11.15
Bandit WarGame Level 11 -> Level 12(tr, 문자치환) (1)	2023.11.15

PREV 이전 1 ···20 21 22 23 24 25 26 ···32 NEXT 다음

팥들었슈

분류 전체보기

4-2 게시판 구현하기(게시판 등록)

디렉토리 구조

'웹 해킹 코스 > 과제' 카테고리의 다른 글

Actor의 위치 디버깅(DrawDebugSphere)

블루프린트를 사용한 위치 확인

C++를 사용한 위치 디버깅

결과

'기타 > UnReal Engine' 카테고리의 다른 글

Bandit WarGame Level 16 -> Level 17

Bandit Level 16 → Level 17

Level Goal

Commands you may need to solve this level

Helpful Reading Material

'WarGame > Bandit WarGame' 카테고리의 다른 글

Bandit WarGame Level 15 -> Level 16(openssl s_client)

Bandit Level 15 → Level 16

Level Goal

Commands you may need to solve this level

Helpful Reading Material

'WarGame > Bandit WarGame' 카테고리의 다른 글

+ Recent posts

티스토리툴바