728x90

# 1

#Hint
FLAG๋ฅผ ๋ณด๋‚ด์ฃผ๊ธฐ๋กœ ํ–ˆ๋Š”๋ฐ ์ŠคํŒธ ๋ฉ”์ผ์ด ์™”๋‹ค. ์ŠคํŒธ์ธ์ฒ™ ํ•˜๋Š” ๊ฑด๊ฐ€...?
Dear Friend , Thank-you for your interest in our newsletter ! This is a one time mailing there is no need to request removal if you won't want any more . This mail is being sent in compliance with Senate bill 1916 , Title 9 , Section 309 . THIS IS NOT MULTI-LEVEL MARKETING . Why work for somebody else when you can become rich inside 54 WEEKS . Have you ever noticed people will do almost anything to avoid mailing their bills and most everyone has a cellphone ! Well, now is your chance to capitalize on this . WE will help YOU process your orders within seconds and increase customer response by 120% ! You can begin at absolutely no cost to you ! But don't believe us . Mrs Simpson who resides in Idaho tried us and says "I've been poor and I've been rich - rich is better" . We are a BBB member in good standing . For the sake of your family order now ! Sign up a friend and your friend will be rich too . Thank-you for your serious consideration of our offer ! Dear E-Commerce professional ; Thank-you for your interest in our briefing . If you are not interested in our publications and wish to be removed from our lists, simply do NOT respond and ignore this mail . This mail is being sent in compliance with Senate bill 1626 ; Title 4 ; Section 309 . This is not multi-level marketing ! Why work for somebody else when you can become rich within 41 months ! Have you ever noticed nearly every commercial on television has a .com on in it and people love convenience ! Well, now is your chance to capitalize on this . We will help you sell more and deliver goods right to the customer's doorstep . The best thing about our system is that it is absolutely risk free for you . But don't believe us ! Mrs Jones of Montana tried us and says "I was skeptical but it worked for me" ! This offer is 100% legal ! We BESEECH you - act now . Sign up a friend and you'll get a discount of 50% . Thank-you for your serious consideration of our offer .
  • ํžŒํŠธ๋ฅผ ํ†ตํ•ด ๋ฉ”์ผ ๋ณธ๋ฌธ ์•ˆ์— ํ”Œ๋ž˜๊ทธ๊ฐ€ ์ˆจ๊ฒจ์ ธ ์žˆ๋‚˜ ๋ถ„์„ํ•ด ๋ณด์•˜์ง€๋งŒ ํ”Œ๋ž˜๊ทธ๋ฅผ ์–ป์„ ์ˆ˜ ์—†์—ˆ๊ณ  ์ŠคํŒธ ๋ฉ”์‹œ์ง€ ์•ˆ์— ์ˆจ๊ฒจ์ง„ ๋ฉ”์‹œ์ง€๋ฅผ ์ฐพ๊ธฐ ์œ„ํ•ด์„œ ์•„๋ž˜ ์‚ฌ์ดํŠธ๋ฅผ ์ด์šฉํ•ด์„œ ๋ณธ๋ฌธ์„ Decode ํ•ด๋ณด์•˜์Šต๋‹ˆ๋‹ค.

https://www.spammimic.com/decode.shtml

 

spammimic - decode

 

www.spammimic.com

 

  • ํ”Œ๋ž˜๊ทธ๋ฅผ ํš๋“ํ–ˆ์Šต๋‹ˆ๋‹ค! EVI$ION{2023_6th_fighting}

# 2

#Hint
๋“ฑ์ž” ๋ฐ‘์ด ์–ด๋‘ก๋‹ค. BRUTE FORCE๋Š” ๋‹ต์ด ๋  ์ˆ˜ ์—†์–ด์š”

  • ๋จผ์ € mojo.png ํŒŒ์ผ์„ HxDํ”„๋กœ๊ทธ๋žจ์„ ํ†ตํ•ด ๋ถ„์„์„ ํ•ด๋ณด์•˜๋”๋‹ˆ ๋งˆ์ง€๋ง‰ ๋ถ€๋ถ„์— flag.txt ์žˆ๋Š” ๊ฑธ ๋ฐœ๊ฒฌํ–ˆ์Šต๋‹ˆ๋‹ค.

 

http://forensic-proof.com/archives/300

 

ํŒŒ์ผ ์‹œ๊ทธ๋‹ˆ์ฒ˜ ๋ชจ์Œ (Common File Signatures) | FORENSIC-PROOF

 

forensic-proof.com

 

  • ์•ž๋ถ€๋ถ„ PK ๋ถ€๋ถ„์— 50 4B 03 04 ํŒŒ์ผ์˜ ํ™•์žฅ์ž๋ฅผ ์•Œ์•„๋‚ด๊ธฐ ์œ„ ํŒŒ์ผ ์‹œ๊ทธ๋‹ˆ์ฒ˜ ์‚ฌ์ดํŠธ์—์„œ ์ฐพ์•„๋ณธ ๊ฒฐ๊ณผ ZIP ํŒŒ์ผ์ธ ๊ฑธ ํ™•์ธํ–ˆ์Šต๋‹ˆ๋‹ค.

  • ํŒŒ์ผ ํ—ค๋” ๋ถ€๋ถ„๋ถ€ํ„ฐ ๋๊นŒ์ง€ ๋ณต์‚ฌํ•ด์„œ ํ™•์žฅ์ž .zip๋กœ ํ•ด์„œ ์ƒˆ๋กœ ์ €์žฅํ•ด ์ฃผ์—ˆ์Šต๋‹ˆ๋‹ค.
  • ์••์ถ•ํ•ด์ œ ํ–ˆ๋”๋‹ˆ ํ”Œ๋ž˜๊ทธ๋ฅผ ํš๋“ํ•  ์ˆ˜ ์žˆ์—ˆ์Šต๋‹ˆ๋‹ค. EVI$ION{MOJO_IS_SEEING_YOU}

 

// ๋‹ค๋ฅธ ๋ถ„๋“ค ํ’€์ดํ•œ ๊ฑฐ ๋ณด๋‹ˆ ์•”ํ˜ธ๊ฐ€ ๊ฑธ๋ ค์žˆ๋˜๋ฐ.. ์ €๋Š” ์•”ํ˜ธ ์ž…๋ ฅ ์—†์ด ๋ฐ”๋กœ ์••์ถ•ํ•ด์ œ๊ฐ€ ๋๋Š”๋ฐ.. ํ˜น์‹œ ํ’€์ด ์ค‘๊ฐ„์— ๋ฌธ์ œ๊ฐ€ ์žˆ์œผ๋ฉด ์•Œ๋ ค์ฃผ์‹œ๋ฉด ๊ฐ์‚ฌํ•˜๊ฒ ์Šต๋‹ˆ๋‹ค..


# 3

#Hint
๋ถ„๋ช… ํŠน์ดํ•˜๊ฒŒ ์ƒ๊ธด ์นœ๊ตฌ๊ฐ€ ํ•˜๋‚˜ ์žˆ์—ˆ๋Š”๋ฐ, ์–ด๋”” ๊ฐ”์„๊นŒ...? ๊ทธ ์นœ๊ตฌ๊ฐ€ ๋ถ„๋ช… ํ”Œ๋ž˜๊ทธ๋ฅผ ๊ฐ€์ง€๊ณ  ๋„๋ง๊ฐ”์–ด!

 

  • ์šฐ์„  ํžŒํŠธ๋ฅผ ํ†ตํ•ด ํŒŒ์ผ ํ•˜๋‚˜๊ฐ€ ์‚ฌ๋ผ์กŒ๋‹ค๊ณ  ์ƒ๊ฐํ•˜๊ณ  HxD๋ฅผ ํ†ตํ•ด ํŒŒ์ผ์„ ๋ถ„์„ํ–ˆ๋”๋‹ˆ ๋กœ์ปฌ ๋””๋ ‰ํ† ๋ฆฌ์—์„œ๋Š” 4๊ฐœ์˜ ํŒŒ์ผ์ด ์žˆ๋‹ค๋Š” ๊ฒƒ์„ ์•Œ๊ฒŒ ๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

  • ๊ทธ๋‹ค์Œ, ์„ผํŠธ๋Ÿด ๋””๋ ‰ํ† ๋ฆฌ์™€ ์—”๋“œ ์˜ค๋ธŒ ์„ผํŠธ๋Ÿด ๋””๋ ‰ํ† ๋ฆฌ๋ฅผ ํ™•์ธํ–ˆ๋”๋‹ˆ ๋กœ์ปฌ ๋””๋ ‰ํ† ๋ฆฌ์—์„œ๋Š” 4๊ฐœ์˜ ํŒŒ์ผ์ด ์žˆ์ง€๋งŒ, End of Central Directory์—์„œ๋Š” 3๊ฐœ๋กœ๋งŒ ๋˜์–ด ์žˆ์–ด ๋‚˜ํƒ€๋‚˜๋Š” ์˜ค๋ฅ˜์ธ ๊ฑธ ์•Œ์•„๋ƒˆ์Šต๋‹ˆ๋‹ค.

  • ๊ทธ๋ž˜์„œ ๊ฐœ์ˆ˜๋ฅผ 4๊ฐœ๋กœ ๋ฐ”๊ฟ”์ค€ ๋‹ค์Œ ์ €์žฅํ•˜๊ณ  ์••์ถ•ํ•ด์ œ ํ–ˆ๋”๋‹ˆ ์ƒˆ๋กœ์šด ๊ณ ์–‘์ด ์นœ๊ตฌ๋ฅผ ๋ฐœ๊ฒฌํ–ˆ์Šต๋‹ˆ๋‹ค.
  • ์‚ฌ์ง„ ์•ˆ์—๋Š” ๋‹ค๋ฅธ flag๋ฅผ ๋ฐœ๊ฒฌ์„ ๋ชป ํ–ˆ๊ณ  HxD๋ฅผ ํ†ตํ•ด ๋ถ„์„์„ ํ–ˆ์Šต๋‹ˆ๋‹ค.

  • ๋งˆ์ง€๋ง‰ footer signature ์ดํ›„์— ์ด์ƒํ•œ ๋ฌธ์ž์—ด์ด ์กด์žฌํ•˜๋Š” ๊ฒƒ์„ ๋ฐœ๊ฒฌํ–ˆ๊ณ  ๋””์ฝ”๋”ฉ์„ ํ•ด์•ผ๊ฒ ๋‹ค๋Š” ์ƒ๊ฐ์„ ํ–ˆ์Šต๋‹ˆ๋‹ค.

  • ๋””์ฝ”๋”ฉ์„ ํ†ตํ•ด ํ”Œ๋ž˜๊ทธ๋ฅผ ํš๋“ํ–ˆ์Šต๋‹ˆ๋‹ค! EVI$ION{Do_I_look_like_a_cat?}

https://www.base64decode.org/ko/

 

Base64 ๋””์ฝ”๋”ฉ ๋ฐ ์ธ์ฝ”๋”ฉ - ์˜จ๋ผ์ธ

Base64 ํ˜•์‹์—์„œ ๋””์ฝ”๋”ฉํ•ด๋ณด์„ธ์š”. ์•„๋‹ˆ๋ฉด ๋‹ค์–‘ํ•œ ๊ณ ๊ธ‰ ์˜ต์…˜์œผ๋กœ ์ธ์ฝ”๋”ฉํ•ด๋ณด์„ธ์š”. ์ €ํฌ ์‚ฌ์ดํŠธ์—๋Š” ๋ฐ์ดํ„ฐ ๋ณ€ํ™˜ํ•˜๊ธฐ์— ์‚ฌ์šฉํ•˜๊ธฐ ์‰ฌ์šด ์˜จ๋ผ์ธ ๋„๊ตฌ๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค.

www.base64decode.org


# 4

#Hint
๋„ค์ด๋ฒ„์—์„œ ์ œ๊ณตํ•˜๋Š” TTS ์„œ๋น„์Šค๋Š” ๊ฐœ์ธ์—๊ฒŒ ์ œํ•œ์ ์œผ๋กœ ๋ฌด๋ฃŒ์ด๋‹ค. ํ”Œ๋ž˜๊ทธ ํ˜•์‹ ์˜ˆ์‹œ: EVI$ION{ENTER_YOUR_FLAG}

  • ๋จผ์ €, HxD์œผ๋กœ ๋ถ„์„ํ•ด ๋ณด๋‹ˆ ํ™•์žฅ์ž wav๋กœ ๋ฐ”๊ฟ”์ค˜์•ผ๊ฒ ๋‹ค๊ณ  ์ƒ๊ฐํ–ˆ์Šต๋‹ˆ๋‹ค.

  • ๋ฐ”๊ฟ”์„œ ์Œ์„ฑ์„ ๋“ค์–ด๋ณด๋‹ˆ ํ”Œ๋ž˜๊ทธ๋Š” ๋‹ค์Œ ๋ฌธ์žฅ๊ณผ ๊ฐ™์Šต๋‹ˆ๋‹ค. made by clova voice์ธ ๊ฑธ ํ™•์ธํ–ˆ์Šต๋‹ˆ๋‹ค.
  • EVI$ION{MADE_BY_CLOVA_VOICE}

# 5

  • ๋จผ์ € snow.jpeg๋ฅผ ๋ถ„์„ํ•ด ๋ณด์•˜์ง€๋งŒ.. ๋”ฑํžˆ ๋ฌธ์ œ์ ์ด๋‚˜ flag๋ฅผ ๋ฐœ๊ฒฌํ•  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค.
  • ์œ„ ๋ฌธ์ œ๋“ค์ฒ˜๋Ÿผ ๋ฌธ์ž์—ด์ด ์ˆจ๊ฒจ์ ธ ์žˆ๋‚˜ ๋ถ„์„ํ•ด ๋ณด์•˜์ง€๋งŒ ์•„๋ฌด๊ฒƒ๋„ ์–ป์„ ์ˆ˜ ์—†์—ˆ์Šต๋‹ˆ๋‹ค.
  • ๊ทธ๋ž˜์„œ ๋‹ค๋ฅธ ๋ฌธ์ œ๋“ค๊ณผ ๋‹ฌ๋ฆฌ ํžŒํŠธ๊ฐ€ ์•„๋‹Œ flag.txt๊ฐ€ ์ฃผ์–ด์ ธ ์žˆ๋Š” ๊ฑธ ๋ณด๋‹ˆ flag.txt๋ฅผ ์ด์šฉํ•ด์„œ ํ’€์–ด์•ผ ํ•˜๋‚˜ ์ƒ๊ฐ์ด ๋“ค์—ˆ๊ณ  ๊ทธ๋ž˜์„œ flag.txt ํŒŒ์ผ์„ ๋ถ„์„ํ–ˆ์Šต๋‹ˆ๋‹ค.

  • ๊ทผ๋ฐ ๋”ฑํžˆ ์ž˜ ๋ชจ๋ฅด๊ฒ ์–ด์„œ.. ์—ด์‹ฌํžˆ ๊ตฌ๊ธ€๋ง ํ•ด๋ดค๋”๋‹ˆ..
  • Whitespace steganography ๋ฌธ์„œ๋‚˜ ๋ฐ์ดํ„ฐ ํŒŒ์ผ ๋‚ด์—์„œ ๋ณด์ด์ง€ ์•Š๋Š” ๊ณต๋ฐฑ(ํ™”์ดํŠธ ์ŠคํŽ˜์ด์Šค) ๋ฌธ์ž๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์ •๋ณด๋ฅผ ์ˆจ๊ธฐ๋Š” ๊ธฐ์ˆ ์„ ์•Œ๊ฒŒ ๋˜์—ˆ์Šต๋‹ˆ๋‹ค.
  • ์ด๋ฅผ ํ’€๊ธฐ ์œ„ํ•ด์„œ๋Š” ์•„๋ž˜ ์‚ฌ์ดํŠธ์—์„œ SNOW.EXE ํŒŒ์ผ์„ ๋‹ค์šด๋กœ๋“œํ•˜๊ณ  cmd์—์„œ SNOW.EXE -C filename ์ž…๋ ฅํ•ด์„œ ํ•ด๊ฒฐํ•  ์ˆ˜ ์žˆ๋‹ค๋Š” ๊ฒƒ์„ ๋ฐฐ์› ์Šต๋‹ˆ๋‹ค.

https://darkside.com.au/snow/index.html

 

The SNOW Home Page

The SNOW Home Page Whitespace steganography The program SNOW is used to conceal messages in ASCII text by appending whitespace to the end of lines. Because spaces and tabs are generally not visible in text viewers, the message is effectively hidden from ca

darkside.com.au

  • cmd์—์„œ ๋ช…๋ น์–ด๋ฅผ ์ž…๋ ฅํ•ด ํ”Œ๋ž˜๊ทธ๋ฅผ ์–ป์—ˆ์Šต๋‹ˆ๋‹ค. DH{w0w_1t_Sn0w5}

'EVI$ION > 7th' ์นดํ…Œ๊ณ ๋ฆฌ์˜ ๋‹ค๋ฅธ ๊ธ€

[EVI$ION] Pwnable  (2) 2024.11.21
[EVI$ION] #4 - Reversing 1  (0) 2024.11.07
[EVI$ION] #2 - Web Hacking Assignment  (1) 2024.09.26
[EVI$ION] #1 - Web Hacking Assignment  (1) 2024.09.19

+ Recent posts