Noah's Box

Welcome to an Fantacy Weborld!

0%

本文章没有针对任何厂商和平台, 我只是平等地看不起所有把开源代码修改几下, 自以为是地加个所谓的”加密”, 就敢把产品拿出来祸害用户的垃圾厂商.

本文章的所有内容纯属虚构, 如有雷同纯属巧合.

0 写在前面

本文中以虚构的笔X分享为例, 介绍一种通过 HTTP 流量抓包/重放实现的简单的获取声称”被加密”的 PDF 源文件的方法.

首先来细数这类分享平台的罪恶:

  • 滥用开源代码, 不遵守开源协议. 不仅代码闭源, 甚至在不标注代码来源的情况下修改代码后商用.
  • 以文件”加密”平台自居, 实际上并未对文件进行任何意义上的加密, 仅使用开源的前端 JS 代码对 web 端页面权限进行限制. 文件传输\读取过程暴露在完全未加密的状态下, 属于是害人来的.
  • 文件水印功能实际上只显示在前端, 并未对文件进行加水印操作, 属于是想省钱想疯了.
阅读全文 »

Walkthrough for DC-03

1
2
3
4
5
6
7
8
9
10
11
12
13
Description

DC-3 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.

As with the previous DC releases, this one is designed with beginners in mind, although this time around, there is only one flag, one entry point and no clues at all.

Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.

For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won't give you the answer, instead, I'll give you an idea about how to move forward.

For those with experience doing CTF and Boot2Root challenges, this probably won't take you long at all (in fact, it could take you less than 20 minutes easily).

If that's the case, and if you want it to be a bit more of a challenge, you can always redo the challenge and explore other ways of gaining root and obtaining the flag.
阅读全文 »

Walkthrough for DC-02

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
Description

Much like DC-1, DC-2 is another purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing.
就像DC-1一样,DC-2是另一个专门构建的易受攻击的实验室,目的是获得渗透测试领域的经验。

As with the original DC-1, it's designed with beginners in mind.
与DC-1,它的设计充分考虑初学者。

Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
需要具备Linux技能并熟悉Linux命令行,以及一些基本渗透测试工具。

Just like with DC-1, there are five flags including the final flag.
与DC-1一样,共有包括final flag在内的5个flag。

And again, just like with DC-1, the flags are important for beginners, but not so important for those who have experience.
同样,就像DC-1一样,flag对于初学者来说很重要,但对有经验的人则不那么重要。

In short, the only flag that really counts, is the final flag.
简而言之,唯一真正重要的flag是final flag。

For beginners, Google is your friend. Well, apart from all the privacy concerns etc etc.
对于初学者来说,Google是您的朋友。 好吧,除了所有的隐私问题等等。

I haven't explored all the ways to achieve root, as I scrapped the previous version I had been working on, and started completely fresh apart from the base OS install.
我没有探索获取root权限的所有方法,因为我废弃了我一直在使用的先前版本,并且除了基本的OS安装之外,还开始全新的学习。
阅读全文 »

Walkthrough for DC-01

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
Description
简介

DC-1 is a purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing.
DC-1是为增长渗透测试经验而搭建的渗透测试靶机。

It was designed to be a challenge for beginners, but just how easy it is will depend on your skills and knowledge, and your ability to learn.
它设计给新手,但它的难度取决于你的知识与技能、以及学习能力。

To successfully complete this challenge, you will require Linux skills, familiarity with the Linux command line and experience with basic penetration testing tools, such as the tools that can be found on Kali Linux, or Parrot Security OS.
你需要linux技能(熟悉linux命令行)、基本的渗透测试工具(Kali Linux预装工具或Parrot Security OS)。

There are multiple ways of gaining root, however, I have included some flags which contain clues for beginners.
有很多种提权方法,不过,我在靶机中放置了一些flag作为给新手的提示。

There are five flags in total, but the ultimate goal is to find and read the flag in root's home directory. You don't even need to be root to do this, however, you will require root privileges.
一共有5个flag,但最终目标是读取root目录下的flag。你甚至不需要root账号,但至少需要root权限。

Depending on your skill level, you may be able to skip finding most of these flags and go straight for root.
如果你够强,你或许会跳过大多数flag直冲root。

Beginners may encounter challenges that they have never come across previously, but a Google search should be all that is required to obtain the information required to complete this challenge.
新手或许会遭遇到从来没有遇见过的挑战,去谷歌搜吧。
阅读全文 »