-
해커스쿨 FTZ level2정보보안/포너블 2017. 12. 26. 15:27123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216login as: level2level2@192.168.244.128's password:[level2@ftz level2]$ lshint public_html tmp`[level2@ftz level2]$ cat hint텍스트 파일 편집 중 쉘의 명령을 실행시킬 수 있다는데...[level2@ftz level2]$ find / -user level2 -perm -4000find: /lost+found: Permission deniedfind: /boot/lost+found: Permission deniedfind: /proc/1/fd: Permission deniedfind: /proc/2/fd: Permission deniedfind: /proc/3/fd: Permission deniedfind: /proc/4/fd: Permission deniedfind: /proc/9/fd: Permission deniedfind: /proc/5/fd: Permission deniedfind: /proc/6/fd: Permission deniedfind: /proc/7/fd: Permission deniedfind: /proc/8/fd: Permission deniedfind: /proc/10/fd: Permission deniedfind: /proc/11/fd: Permission deniedfind: /proc/19/fd: Permission deniedfind: /proc/77/fd: Permission deniedfind: /proc/1165/fd: Permission deniedfind: /proc/1474/fd: Permission deniedfind: /proc/1530/fd: Permission deniedfind: /proc/1534/fd: Permission deniedfind: /proc/1552/fd: Permission deniedfind: /proc/1571/fd: Permission deniedfind: /proc/1638/fd: Permission deniedfind: /proc/1675/fd: Permission deniedfind: /proc/1709/fd: Permission deniedfind: /proc/1718/fd: Permission deniedfind: /proc/1728/fd: Permission deniedfind: /proc/1737/fd: Permission deniedfind: /proc/1746/fd: Permission deniedfind: /proc/1767/fd: Permission deniedfind: /proc/1782/fd: Permission deniedfind: /proc/1812/fd: Permission deniedfind: /proc/1824/fd: Permission deniedfind: /proc/.1825/fd: Permission deniedfind: /proc/.1826/fd: Permission deniedfind: /proc/.1827/fd: Permission deniedfind: /proc/.1828/fd: Permission deniedfind: /proc/.1829/fd: Permission deniedfind: /proc/.1830/fd: Permission deniedfind: /proc/.1831/fd: Permission deniedfind: /proc/.1832/fd: Permission deniedfind: /proc/1877/fd: Permission deniedfind: /proc/1878/fd: Permission deniedfind: /proc/1879/fd: Permission deniedfind: /proc/1880/fd: Permission deniedfind: /proc/1881/fd: Permission deniedfind: /proc/1882/fd: Permission deniedfind: /proc/1883/fd: Permission deniedfind: /proc/1884/fd: Permission deniedfind: /proc/2403/fd: Permission deniedfind: /proc/2405/fd: Permission deniedfind: /proc/2488/fd: Permission deniedfind: /proc/2489/fd: Permission deniedfind: /proc/2492/fd: Permission deniedfind: /proc/2494/fd: Permission deniedfind: /var/lib/slocate: Permission deniedfind: /var/lib/nfs/statd: Permission deniedfind: /var/lib/dav: Permission deniedfind: /var/lib/mysql/mysql: Permission deniedfind: /var/lib/mysql/test: Permission deniedfind: /var/lib/pgsql: Permission deniedfind: /var/log/httpd: Permission deniedfind: /var/log/squid: Permission deniedfind: /var/log/samba: Permission deniedfind: /var/cache/mod_ssl: Permission deniedfind: /var/cache/alchemist/printconf.rpm: Permission deniedfind: /var/cache/alchemist/printconf.local: Permission deniedfind: /var/run/sudo: Permission deniedfind: /var/spool/at: Permission deniedfind: /var/spool/clientmqueue: Permission deniedfind: /var/spool/mqueue: Permission deniedfind: /var/spool/cron: Permission deniedfind: /var/spool/squid: Permission deniedfind: /var/empty/sshd: Permission deniedfind: /var/tux: Permission deniedfind: /tmp/cgn5EpxN: Permission deniedfind: /etc/sysconfig/pgsql: Permission deniedfind: /etc/default: Permission deniedfind: /etc/httpd/conf/ssl.crl: Permission deniedfind: /etc/httpd/conf/ssl.crt: Permission deniedfind: /etc/httpd/conf/ssl.csr: Permission deniedfind: /etc/httpd/conf/ssl.key: Permission deniedfind: /etc/httpd/conf/ssl.prm: Permission deniedfind: /root: Permission deniedfind: /usr/share/ssl/CA: Permission denied/bin/ExecuteMefind: /home/clear: Permission deniedfind: /home/level10/program: Permission deniedfind: /home/level5/tmp: Permission deniedfind: /home/trainer1: Permission deniedfind: /home/trainer10: Permission deniedfind: /home/trainer2: Permission deniedfind: /home/trainer3: Permission deniedfind: /home/trainer4: Permission deniedfind: /home/trainer5: Permission deniedfind: /home/trainer6: Permission deniedfind: /home/trainer7: Permission deniedfind: /home/trainer8: Permission deniedfind: /home/trainer9: Permission denied[level2@ftz level2]$ find / -user level3 -perm -4000find: /lost+found: Permission deniedfind: /boot/lost+found: Permission deniedfind: /proc/1/fd: Permission deniedfind: /proc/2/fd: Permission deniedfind: /proc/3/fd: Permission deniedfind: /proc/4/fd: Permission deniedfind: /proc/9/fd: Permission deniedfind: /proc/5/fd: Permission deniedfind: /proc/6/fd: Permission deniedfind: /proc/7/fd: Permission deniedfind: /proc/8/fd: Permission deniedfind: /proc/10/fd: Permission deniedfind: /proc/11/fd: Permission deniedfind: /proc/19/fd: Permission deniedfind: /proc/77/fd: Permission deniedfind: /proc/1165/fd: Permission deniedfind: /proc/1474/fd: Permission deniedfind: /proc/1530/fd: Permission deniedfind: /proc/1534/fd: Permission deniedfind: /proc/1552/fd: Permission deniedfind: /proc/1571/fd: Permission deniedfind: /proc/1638/fd: Permission deniedfind: /proc/1675/fd: Permission deniedfind: /proc/1709/fd: Permission deniedfind: /proc/1718/fd: Permission deniedfind: /proc/1728/fd: Permission deniedfind: /proc/1737/fd: Permission deniedfind: /proc/1746/fd: Permission deniedfind: /proc/1767/fd: Permission deniedfind: /proc/1782/fd: Permission deniedfind: /proc/1812/fd: Permission deniedfind: /proc/1824/fd: Permission deniedfind: /proc/.1825/fd: Permission deniedfind: /proc/.1826/fd: Permission deniedfind: /proc/.1827/fd: Permission deniedfind: /proc/.1828/fd: Permission deniedfind: /proc/.1829/fd: Permission deniedfind: /proc/.1830/fd: Permission deniedfind: /proc/.1831/fd: Permission deniedfind: /proc/.1832/fd: Permission deniedfind: /proc/1877/fd: Permission deniedfind: /proc/1878/fd: Permission deniedfind: /proc/1879/fd: Permission deniedfind: /proc/1880/fd: Permission deniedfind: /proc/1881/fd: Permission deniedfind: /proc/1882/fd: Permission deniedfind: /proc/1883/fd: Permission deniedfind: /proc/1884/fd: Permission deniedfind: /proc/2403/fd: Permission deniedfind: /proc/2405/fd: Permission deniedfind: /proc/2488/fd: Permission deniedfind: /proc/2489/fd: Permission deniedfind: /proc/2492/fd: Permission deniedfind: /proc/2494/fd: Permission deniedfind: /var/lib/slocate: Permission deniedfind: /var/lib/nfs/statd: Permission deniedfind: /var/lib/dav: Permission deniedfind: /var/lib/mysql/mysql: Permission deniedfind: /var/lib/mysql/test: Permission deniedfind: /var/lib/pgsql: Permission deniedfind: /var/log/httpd: Permission deniedfind: /var/log/squid: Permission deniedfind: /var/log/samba: Permission deniedfind: /var/cache/mod_ssl: Permission deniedfind: /var/cache/alchemist/printconf.rpm: Permission deniedfind: /var/cache/alchemist/printconf.local: Permission deniedfind: /var/run/sudo: Permission deniedfind: /var/spool/at: Permission deniedfind: /var/spool/clientmqueue: Permission deniedfind: /var/spool/mqueue: Permission deniedfind: /var/spool/cron: Permission deniedfind: /var/spool/squid: Permission deniedfind: /var/empty/sshd: Permission deniedfind: /var/tux: Permission deniedfind: /tmp/cgn5EpxN: Permission deniedfind: /etc/sysconfig/pgsql: Permission deniedfind: /etc/default: Permission deniedfind: /etc/httpd/conf/ssl.crl: Permission deniedfind: /etc/httpd/conf/ssl.crt: Permission deniedfind: /etc/httpd/conf/ssl.csr: Permission deniedfind: /etc/httpd/conf/ssl.key: Permission deniedfind: /etc/httpd/conf/ssl.prm: Permission deniedfind: /root: Permission denied/usr/bin/editorfind: /usr/share/ssl/CA: Permission deniedfind: /home/clear: Permission deniedfind: /home/level10/program: Permission deniedfind: /home/level5/tmp: Permission deniedfind: /home/trainer1: Permission deniedfind: /home/trainer10: Permission deniedfind: /home/trainer2: Permission deniedfind: /home/trainer3: Permission deniedfind: /home/trainer4: Permission deniedfind: /home/trainer5: Permission deniedfind: /home/trainer6: Permission deniedfind: /home/trainer7: Permission deniedfind: /home/trainer8: Permission deniedfind: /home/trainer9: Permission denied[level2@ftz level2]$ cd /usr/bin[level2@ftz bin]$ file editoreditor: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared libs), not stripped[level2@ftz bin]$ editor[level3@ftz bin]$ my-passLevel3 Password is "can you fly?".
cs editor를 실행하면 vi editor가 실행되는데 !/bin/bash라고 type하여 shell을 따고, password를 얻어낸다.
'정보보안 > 포너블' 카테고리의 다른 글
pwnable.kr 1번 fd (0) 2017.12.26 해커스쿨 FTZ level4 (0) 2017.12.26 해커스쿨 FTZ level3 (0) 2017.12.26 해커스쿨 FTZ level1 (0) 2017.12.26 note (0) 2017.12.20