>choco install nmap
Chocolatey v0.10.15
Installing the following packages:
nmap
By installing you accept licenses for the packages.
nmap v7.80 [Approved]
nmap package files install completed. Performing other installation steps.
The package nmap wants to run 'chocolateyInstall.ps1'.
Note: If you don't run this script, the installation will fail.
Note: To confirm automatically next time, use '-y' or consider:
choco feature enable -n allowGlobalConfirmation
Do you want to run the script?([Y]es/[A]ll - yes to all/[N]o/[P]rint): Y
Installing nmap...
nmap has been installed.
nmap installed to 'C:\Program Files (x86)\Nmap'
nmap may be able to be automatically uninstalled.
Environment Vars (like PATH) have changed. Close/reopen your shell to
see the changes (or in powershell/cmd.exe just type `refreshenv`).
The install of nmap was successful.
Software installed as 'exe', install location is likely default.
Chocolatey installed 1/1 packages.
See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).
Not all API operations that are defined by a service can be used as an action in an IAM policy. In addition, a service might define some actions that don't directly correspond to an API operation.
$ amplify init
Note: It is recommended to run this command from the root of your app directory
? Enter a name for the project amplify
? Enter a name for the environment dev
? Choose your default editor: None
? Choose the type of app that you're building javascript
Please tell us about your project
? What javascript framework are you using react
? Source Directory Path: src
? Distribution Directory Path: build
? Build Command: npm run-script build
? Start Command: npm run-script start
new file: .graphqlconfig.yml
new file: amplify/.config/project-config.json
new file: amplify/backend/api/amplify/parameters.json
new file: amplify/backend/api/amplify/schema.graphql
new file: amplify/backend/api/amplify/stacks/CustomResources.json
new file: amplify/backend/api/amplify/transform.conf.json
new file: amplify/backend/auth/amplifyc38b6d9a/amplifyc38b6d9a-cloudformation-template.yml
new file: amplify/backend/auth/amplifyc38b6d9a/parameters.json
new file: amplify/backend/backend-config.json
new file: amplify/team-provider-info.json
new file: src/graphql/mutations.js
new file: src/graphql/queries.js
new file: src/graphql/schema.json
new file: src/graphql/subscriptions.js
The purpose of this file is basically sharing it within your team-members on the same project and want to update/use the same AWS Infrastructure tied to an environment. If you're open-sourcing your project you can totally get rid of this file (or make it a part of .gitignore).
The goal of this level is for you to log into the game using SSH. The host to which you need to connect is bandit.labs.overthewire.org, on port 2220. The username is bandit0 and the password is bandit0. Once logged in, go to the Level 1 page to find out how to beat Level 1.
NAME
ssh — OpenSSH SSH client (remote login program)
~
DESCRIPTION
ssh (SSH client) is a program for logging into a remote machine and for
executing commands on a remote machine.
$ ssh bandit.labs.overthewire.org -l bandit0 -p 2220
The authenticity of host '[bandit.labs.overthewire.org]:2220 ([176.9.9.172]:2220)'
can't be established.ECDSA key fingerprint is
SHA256:98UL0ZWr85496EtCRkKlo20X3OPnyPSB5tB5RPbhczc.
Are you sure you want to continue connecting (yes/no)?
yes
Warning: Permanently added '[bandit.labs.overthewire.org]:2220,[176.9.9.172]:2220' (ECDSA) to the list of known hosts.
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
bandit0@bandit.labs.overthewire.org's password:
The password for the next level is stored in a file called readme located in the home directory. Use this password to log into bandit1 using SSH. Whenever you find a password for a level, use SSH (on port 2220) to log into that level and continue the game.
$ ssh bandit.labs.overthewire.org -l bandit1 -p 2220
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
bandit1@bandit.labs.overthewire.org's password:
# boJ9jbbUNNfktd78OOpsqOltutMc3MY1を入力
・
・ 中略
・
Enjoy your stay!
bandit1@bandit:~$
bandit1へのログインに成功しました。
Level1達成です。
Level 1 → Level 2
次の問題です。
The password for the next level is stored in a file called - located in the home directory
$ ls
spaces in this filename
$ cat spaces in this filename
cat: spaces: No such file or directory
cat: in: No such file or directory
cat: this: No such file or directory
cat: filename: No such file or directory
そこで、Level1でも言及したエスケープ文字を使います。
spaces in this filenameを、シングルクォーテーション' 'で囲んであげる訳です。
$ cat 'spaces in this filename'
UmHadQclWmgdLOKQ3YNgjWxGoRMb5luK
これで、パスワードが手に入りました。
Level 3 → Level 4
次の問題です。
The password for the next level is stored in a hidden file in the inhere directory.
inhereディレクトリの中にある隠しファイルに、パスワードが書かれているようです。
まずはinhereディレクトリに移動し、そこにあるファイルをlsコマンドで見てみます。
$ ls
inhere
$ cd inhere # inhereに移動
$ ls
# ファイルが一つも表示されない
lsコマンドでは、ファイルが表示されませんでした。
そこで、lsコマンドのオプション-aを使うことにします。
-aオプションは、マニュアルによると、
-a, --all
do not ignore entries starting with .
.からはじまる隠しファイルを無視せず表示することができます。
さっそくやってみます。
$ ls -a
. .. .hidden
.hiddenという隠しファイルが現れました。
中身を見ます。
$ cat .hidden
pIwrPrtPN36QITSp3EQaw936yaFoFgAB
みごとパスワードがありました。
Level 4 → Level 5
The password for the next level is stored in the only human-readable file in the inhere directory. Tip: if your terminal is messed up, try the “reset” command.
$ file * # すべてのファイルにfileコマンドを実行
file: Cannot open `ile00' (No such file or directory).
file: Cannot open `ile01' (No such file or directory).
file: Cannot open `ile02' (No such file or directory).
file: Cannot open `ile03' (No such file or directory).
file: Cannot open `ile04' (No such file or directory).
file: Cannot open `ile05' (No such file or directory).
file: Cannot open `ile06' (No such file or directory).
file: Cannot open `ile07' (No such file or directory).
file: Cannot open `ile08' (No such file or directory).
file: Cannot open `ile09' (No such file or directory).
$ file ./*
./-file00: data
./-file01: data
./-file02: data
./-file03: data
./-file04: data
./-file05: data
./-file06: data
./-file07: ASCII text
./-file08: data
./-file09: data
まさしく、-file07のみがASCIIテキストファイルであることが分かりました。
中身を見ると、
$ cat ./-file07
koReBOKuIDDepwhWk7jZC0RTdopnAYKh
パスワードが見つかりました。
ちなみに-file07以外のファイルを見ようとすると、
$ cat ./-file01
���U"7�w���H��ê�Q����(���#���
まさに、"人間には理解できない"文字列が入っていました。
Level 5 → Level 6
The password for the next level is stored in a file somewhere under the inhere directory and has all of the following properties:
human-readable
1033 bytes in size
not executable
The password for the next level is stored somewhere on the server and has all of the following properties:
owned by user bandit7
owned by group bandit6
33 bytes in size
NAME
base64 - base64 encode/decode data and print to standard output
・・・
-d, --decode
decode data
base64コマンドの-dオプションを使えば、デコードできるようです。
$ base64 -d data.txt
The password is IFukwKGsFW8MOq3IRFqrxE1hxTNEbUPR
これでパスワードを見つけました。
Level 11 → Level 12
The password for the next level is stored in the file data.txt, where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions
$ cat data.txt | tr A-Za-z N-ZA-Mn-za-m
The password is 5Te8Y4drgCRfCx8ugdwuEX8KFC6k2EUu
これで、パスワードを割り出すことができました。
Level 12 → Level 13
The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed. For this level it may be useful to create a directory under /tmp in which you can work using mkdir. For example: mkdir /tmp/myname123. Then copy the datafile using cp, and rename it using mv (read the manpages!)
$ cat data_gz-3
The password is 8ZjyCRiBWFYkneahHwxCv3wb2a1ORpYL
長い道のりでしたが、ようやくパスワードにありつきました。
Level 13 → Level 14
The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on
$ exit
logout
Connection to bandit.labs.overthewire.org closed.
$ cd .ssh
$ ls
known_hosts # id_rsaはまだ存在しない
$ vim id_rsa
# id_rsaを作成し、上記SSH秘密鍵をコピーペースト
$ ls
id_rsa known_hosts
$ file id_rsa
id_rsa: PEM RSA private key # 秘密鍵として登録された
これで、~/.ssh/id_rsaにSSH秘密鍵が登録されたはずです。
bandit14へのログインを試みます。
$ ssh bandit14@bandit.labs.overthewire.org -p 2220
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/<user name>/.ssh/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
秘密鍵が守られていない、という警告が出され、秘密鍵が認証されませんでした。
パーミッションを確認してみると、
$ ls -l id_rsa
-rw-r--r-- 1 user user 1680 5月 2 12:13 id_rsa
$ chmod 600 id_rsa # オプションに600を与え、オーナー以外のパーミッションを拒否 (オーナーはrw)
$ ls -l id_rsa
-rw------- 1 user user 1680 5月 2 12:13 id_rsa
これでパーミッションも設定できました。
bandit14のログインにリベンジします。
$ ssh bandit14@bandit.labs.overthewire.org -p 2220
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
・
・
・
Enjoy your stay!
bandit14@bandit:~$
みごと、ログインに成功しました。
Level 14 → Level 15
The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.
Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…
The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.
$ nmap -p31000-32000 localhost
Starting Nmap 7.40 ( https://nmap.org ) at 2019-05-02 09:49 CEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00020s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
31046/tcp open unknown
31790/tcp open unknown
31960/tcp open unknown
$ openssl s_client -connect localhost:31046
CONNECTED(00000003)
140211373733120:error:141A10F4:SSL routines:ossl_statem_client_read_transition:unexpected message:../ssl/statem/statem_clnt.c:269:
---
no peer certificate available
---
No client certificate CA names sent
・
・以下略
・
There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is in passwords.new and is the only line that has been changed between passwords.old and passwords.new
The password for the next level is stored in a file readme in the homedirectory. Unfortunately, someone has modified .bashrc to log you out when you log in with SSH.
ssh [user@]hostname [command]
・・・
If command is specified, it is executed on the remote host instead of a login shell.
さっそく試します。
$ ssh -p 2220 bandit18@bandit.labs.overthewire.org cat readme
This is a OverTheWire game server. More information on http://www.overthewire.org/wargames
bandit18@bandit.labs.overthewire.org's password:
IueksS7Ubh8G3DCwVzrTd8rAVOwq3M5x
するとこのように、readmeに書かれていたパスワードを読み出すことができました。
Level 19 → Level 20
To gain access to the next level, you should use the setuid binary in the homedirectory. Execute it without arguments to find out how to use it. The password for this level can be found in the usual place (/etc/bandit_pass), after you have used the setuid binary.
setuid と setgid は、UNIXにおけるアクセス権を表すフラグの名称であり、ユーザーが実行ファイルを実行する際にその実行ファイルの所有者やグループの権限で実行できるようにする。それぞれ、set user ID と set group ID の略。一般ユーザーが高い特権レベルでしか実行できないタスクを一時的に実行できるようにする仕組みである。
$ ls
bandit20-do
$ file bandit20-do
bandit20-do: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=8e941f24b8c5cd0af67b22b724c57e1ab92a92a1, not stripped
$ ./bandit20-do
Run a command as another user.
Example: ./bandit20-do id
On the up side, administrative privilege is not required to install Ghidra for personal use. Also, because installing Ghidra does not update any OS configurations such as the registry on Windows, removing Ghidra is as simple as deleting the Ghidra installation directory.
さて、InstallationGuide.htmlの先を読み進めると、JDK(Java Development Kit)のインストールが必要と書かれています。
Ghidra requires a supported version of a Java Runtime and Development Kit on the PATH to run.
JDKのインストール方法とPATHへの通し方も、丁寧に記載されていました。
Linux and macOS (OS X): Extract the JDK distribution (.tar.gz file) to your desired location, and add the JDK's bin directory to your PATH:
1. Extract the JDK:
tar xvf <JDK distribution .tar.gz>
2. Open ~/.bashrc with an editor of your choice. For example:
vi ~/.bashrc
3. At the very end of the file, add the JDK bin directory to the PATH variable:
export PATH=<path of extracted JDK dir>/bin:$PATH
4. Save file
5. Restart any open terminal windows for changes to take effect
このインストールガイドに従ってやっていきます。
まずは、JDKをダウンロードします。
GhidraがサポートされているJDKバージョンは、
Java 11 Runtime and Development Kit (JDK).OpenJDK distributed from jdk.java.net is suggested
The password for the files is "crackmes.one". If it does not work, this is probably because the crackme has been imported from crackmes.de, so use the password "crackmes.de" instead.
つぎに、先程ダウンロード/解凍したバイナリファイルをプロジェクトにインポートします。
やり方は簡単で、ウィンドウにバイナリファイルをドラッグするだけです。
ドラッグすると設定ウィンドウが開きますので、それぞれ適当な設定をして"OK"を押せばインポート完了です。
今回の場合ですと、"Format"は"Executable and Linking Format (ELF)"、"Language"は"x86:LE:64:dafault:gcc"としました。
インポートが完了したら、そのファイルをダブルクリックすることで解析ウィンドウを開くことができます。
解析ウィンドウを開くと、<ファイル名> has not been analyzed. Would you like to analyze it now?と聞かれるので、Yesとします。
すると、Analysis Optionsウィンドウが開いて多くのオプションが提示されますが、今回はとりあえずデフォルトのまま"Analyze"を押して先へ進みました。
これで、解析ができます(Fig. 1)。
> ?
Usage: [.][times][cmd][~grep][@[@iter]addr!size][|>pipe] ; ...
Append '?' to any char command to get detailed help
Prefix with number to repeat command N times (f.ex: 3x)
| %var=value alias for 'env' command
| *[?] off[=[0x]value] pointer read/write data/values (see ?v, wx, wv)
| (macro arg0 arg1) manage scripting macros
| .[?] [-|(m)|f|!sh|cmd] Define macro or load r2, cparse or rlang file
| _[?] Print last output
| =[?] [cmd] send/listen for remote commands (rap://, http://, <fd>)
| <[...] push escaped string into the RCons.readChar buffer
| /[?] search for bytes, regexps, patterns, ..
| ![?] [cmd] run given command as in system(3)
| #[?] !lang [..] Hashbang to run an rlang script
| a[?] analysis commands
| b[?] display or change the block size
| c[?] [arg] compare block with given data
~
#以下略
上の方にAppend '?' to any char command to get detailed helpとあるように、更に詳細なヘルプを見るにはコマンドに再度?を付ければいいようです。
例えば、コマンドaの次に何のコマンドを追加すればいいかを調べたければ、a?とすればaに付け加えるべきコマンドが表示されます。
>aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Type matching analysis for all functions (afta)
[x] Use -AA or aaaa to perform additional experimental analysis.
(gdb) ni
0x00005555555546db in main ()
(gdb)
0x00005555555546de in main ()
(gdb)
0x00005555555546e2 in main ()
(gdb)
0x00005555555546e5 in main ()
(gdb)
0x00005555555546e9 in main ()
(gdb)
0x00005555555546ed in main ()
アドレス748、つまり左の分岐ルートに行ったことがわかります。
これは、アドレス6e9において、ある変数と0x2を比較cmpした結果が"not equal"だったため、アドレス748にjne(jump not equal)した、ということを意味しています。
このままniコマンドで先へ行くと、
(gdb) ni
0x000055555555474f in main ()
(gdb)
Access Denied.
0x0000555555554754 in main ()
(gdb)
0x0000555555554759 in main ()
(gdb)
0x000055555555475a in main ()
(gdb) run wrong-password
Starting program: /home/user/your_pass wrong-password
Breakpoint 1, 0x00005555555546da in main ()
(gdb) ni
0x00005555555546db in main ()
(gdb)
0x00005555555546de in main ()
(gdb)
0x00005555555546e2 in main ()
(gdb)
0x00005555555546e5 in main ()
(gdb)
0x00005555555546e9 in main ()
(gdb)
0x00005555555546ed in main ()
~
(gdb)
0x0000555555554709 in main ()
(gdb)
Checking Your Pass: wrong-password
~
(gdb)
0x000055555555472a in main ()
(gdb)
0x000055555555473a in main ()
(gdb)
0x0000555555554741 in main ()
(gdb)
Access Denied.
~
(gdb) ni
0x000055555555472a in main ()
(gdb)
0x000055555555472c in main ()
(gdb)
0x0000555555554733 in main ()
(gdb)
Hello, Master.
0x0000555555554738 in main ()
strcmpのマニュアルによると、It returns an integer less than, equal to, or greater than zero if s1 is found, respectively, to be less than, to match, or be greater than s2.つまりstrcmpは、比較する２つの変数が等しい時、0を返します。↩
NAME
gdb - The GNU Debugger
~
DESCRIPTION
The purpose of a debugger such as GDB is to allow you to see what is going on "inside"
another program while it executes -- or what another program was doing at the moment it
crashed.
· Start your program, specifying anything that might affect its behavior.
· Make your program stop on specified conditions.
· Examine what has happened, when your program has stopped.
· Change things in your program, so you can experiment with correcting the effects of
one bug and go on to learn about another.
