|
http://www.hackerschool.org/HS_Boards/zboard.php?id=Free_Lectures&no=8594 [복사]
bandit은 너무 쉬운 기초이며 구글에서 공략 또한 많이 있기 때문에
leviathan을 공략해보겠다.
리눅스에서 ssh로 접속해보았다.
ka0r1@ka0r1-To-Be-Filled-By-O-E-M:~$ ssh leviathan0@leviathan.labs.overthewire.org -p2223
_ _ _ _
| | _____ _(_) __ _| |_| |__ __ _ _ __
| |/ _ \ \ / / |/ _` | __| '_ \ / _` | '_ \
| | __/\ V /| | (_| | |_| | | | (_| | | | |
|_|\___| \_/ |_|\__,_|\__|_| |_|\__,_|_| |_|
This is an OverTheWire game server.
More information on http://www.overthewire.org/wargames
leviathan0@leviathan.labs.overthewire.org's password:
,----.. ,----, .---.
/ / \ ,/ .`| /. ./|
/ . : ,` .' : .--'. ' ;
. / ;. \ ; ; / /__./ \ : |
. ; / ` ; .'___,/ ,' .--'. ' \' .
; | ; \ ; | | : | /___/ \ | ' '
| : | ; | ' ; |.'; ; ; \ \; :
. | ' ' ' : `----' | | \ ; ` |
' ; \; / | ' : ; . \ .\ ;
\ \ ', / | | ' \ \ ' \ |
; : / ' : | : ' |--"
\ \ .' ; |.' \ \ ;
www. `---` ver '---' he '---" ire.org
Welcome to OverTheWire!
If you find any problems, please report them to the #wargames channel on
discord or IRC.
--[ Playing the games ]--
This machine might hold several wargames.
If you are playing "somegame", then:
* USERNAMES are somegame0, somegame1, ...
* Most LEVELS are stored in /somegame/.
* PASSWORDS for each level are stored in /etc/somegame_pass/.
Write-access to homedirectories is disabled. It is advised to create a
working directory with a hard-to-guess name in /tmp/. You can use the
command "mktemp -d" in order to generate a random and hard to guess
directory in /tmp/. Read-access to both /tmp/ is disabled and to /proc
restricted so that users cannot snoop on eachother. Files and directories
with easily guessable or short names will be periodically deleted! The /tmp
directory is regularly wiped.
Please play nice:
* don't leave orphan processes running
* don't leave exploit-files laying around
* don't annoy other players
* don't post passwords or spoilers
* again, DONT POST SPOILERS!
This includes writeups of your solution on your blog or website!
--[ Tips ]--
This machine has a 64bit processor and many security-features enabled
by default, although ASLR has been switched off. The following
compiler flags might be interesting:
-m32 compile for 32bit
-fno-stack-protector disable ProPolice
-Wl,-z,norelro disable relro
In addition, the execstack tool can be used to flag the stack as
executable on ELF binaries.
Finally, network-access is limited for most levels by a local
firewall.
--[ Tools ]--
For your convenience we have installed a few useful tools which you can find
in the following locations:
* gef (https://github.com/hugsy/gef) in /opt/gef/
* pwndbg (https://github.com/pwndbg/pwndbg) in /opt/pwndbg/
* gdbinit (https://github.com/gdbinit/Gdbinit) in /opt/gdbinit/
* pwntools (https://github.com/Gallopsled/pwntools)
* radare2 (http://www.radare.org/)
--[ More information ]--
For more information regarding individual wargames, visit
http://www.overthewire.org/wargames/
For support, questions or comments, contact us on discord or IRC.
Enjoy your stay!
leviathan은 특별한 프로그래밍이나 해킹 스킬이 없어도 공략이 가능하겠금
만들어 놓은 워게임이며 bandit의 확장판이라고 봐도 무방하다...
leviathan0@gibson:~$ ls -al
total 24
drwxr-xr-x 3 root root 4096 Sep 19 07:07 .
drwxr-xr-x 83 root root 4096 Sep 19 07:09 ..
drwxr-x--- 2 leviathan1 leviathan0 4096 Sep 19 07:07 .backup
-rw-r--r-- 1 root root 220 Mar 31 2024 .bash_logout
-rw-r--r-- 1 root root 3771 Mar 31 2024 .bashrc
-rw-r--r-- 1 root root 807 Mar 31 2024 .profile
보이는가? .backup이라고 숨겨진 폴더가 있다.
leviathan0@gibson:~$ cd .backup
leviathan0@gibson:~/.backup$ ls
bookmarks.html
bookmarks.html이 있으며 이것을 cat명령어로 읽어본 결과...
leviathan0@gibson:~/.backup$ cat bookmarks.html
<!DOCTYPE NETSCAPE-Bookmark-file-1>
<!-- This is an automatically generated file.
It will be read and overwritten.
DO NOT EDIT! -->
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
<TITLE>Bookmarks</TITLE>
<H1 LAST_MODIFIED="1160271046">Bookmarks</H1>
<DL><p>
<DT><H3 LAST_MODIFIED="1160249304" PERSONAL_TOOLBAR_FOLDER="true" ID="rdf:#$FvPhC3">Bookmarks Toolbar Folder</H3>
<DD>Add bookmarks to this folder to see them displayed on the Bookmarks Toolbar
<DL><p>
</DL><p>
<HR>
<DT><A HREF="http://www.goshen.edu/art/" ADD_DATE="1133884188" LAST_CHARSET="ISO-8859-1" ID="rdf:#$2wIU71">Art Department</A>
<DT><A HREF="http://www.goshen.edu/art/ed/art-ed-links.html#links" ADD_DATE="1134961650" LAST_CHARSET="ISO-8859-1" ID="64936479">com for Bartel artwork</A>
<DT><A HREF="http://www.goshen.edu/%7Emarvinpb/MB_bio.htm" ADD_DATE="1124894614" LAST_CHARSET="ISO-8859-1" ID="13861712">Bio</A>
<DT><A HREF="http://www.goshen.edu/art/ed/art-ed-links.html#links" ADD_DATE="1131475703" LAST_CHARSET="ISO-8859-1" ID="60650012">Links</A>
<DT><A HREF="http://www.goshen.edu/art/ed/creativitykillers.html" ADD_DATE="1101295712" LAST_CHARSET="ISO-8859-1" ID="63341225">Creativity <b>Killers</b></A>
<DT><A HREF="http://www.bartelart.com/arted/transfer.html" ADD_DATE="1144619369" LAST_CHARSET="ISO-8859-1" ID="90301948">Teaching for <strong>Transfer</strong> of Learning</A>
<DT><A HREF="http://www.bartelart.com/arted/questions.html" ADD_DATE="1158993029" LAST_CHARSET="ISO-8859-1" ID="51087167">Teaching with <strong>Questions</strong></A>
.
.
.
.
.
생략
.
.
.
.
.
<DT><A HREF="http://www.warholstars.org/" ADD_DATE="1151503884" LAST_CHARSET="ISO-8859-1" ID="rdf:#$2wIU71">Warhol</A>
<DT><A HREF="http://www.x-rayspex.com/" ADD_DATE="1121479563" LAST_CHARSET="ISO-8859-1" ID="rdf:#$2wIU71">X-Ray Spex</A>
</DL><p>
엄청난 소스 코드의 길이에 의아했지만...
leviathan은 프로그래밍 스킬이 필요 없다는 가정하에 눈높이에 맞춰 생각해보았다.
분명 소스 코드를 해석하여 공격하는 그런 워게임이 아니란 것을...
정규표현식 grep을 이용하여 혹시나 "password"라는 단어를 파이프라인과 함께
cat과 동시에 읽어보았다.
leviathan0@gibson:~/.backup$ cat bookmarks.html | grep password
<DT><A HREF="http://leviathan.labs.overthewire.org/passwordus.html | This will be fixed later, the password for leviathan1 is 3QJ3TgzHDq" ADD_DATE="1155384634" LAST_CHARSET="ISO-8859-1" ID="rdf:#$2wIU71">password to leviathan1</A>
leviathan0@gibson:~/.backup$
"3QJ3TgzHDq"가 다음 레벨의 패스워드이다. |
Hit : 553 Date : 2025/01/14 12:44
|
1603, 
1/81 
