์ƒˆ์†Œ์‹

์ธ๊ธฐ ๊ฒ€์ƒ‰์–ด

๐Ÿ“  Secure

file download ์‹ฌํ™” ๊ณต๊ฒฉ

  • -
๋ฐ˜์‘ํ˜•
์›น ๋””๋ ‰ํ„ฐ๋ฆฌ๋ฅผ ํŒŒ์•…ํ•œ๋‹ค

 

why ?

์›น์…€์„ ์—…๋กœ๋“œ ํ•˜๊ธฐ ์œ„ํ•ด์„œ ( ํŒŒ์ผ ์—…๋กœ๋“œ ์ทจ์•ฝ์  )

* ํŒŒ์ผ ์—…๋กœ๋“œ ์ทจ์•ฝ์ ์„ ์„ฑ๊ณต์ ์œผ๋กœ ์ˆ˜ํ–‰ํ•˜๊ธฐ ์œ„ํ•ด์„œ ์›น ๋””๋ ‰ํ„ฐ๋ฆฌ ํŒŒ์•…์ด ํ•„์ˆ˜

์—…๋กœ๋“œ์˜ ์ƒ์„ธ ๊ฒฝ๋กœ๋ฅผ ๋ชจ๋ฅด๋Š” ๊ฒฝ์šฐ๊ฐ€ ๋งŽ๊ธฐ ๋•Œ๋ฌธ์—, ์›น ๋””๋ ‰ํ„ฐ๋ฆฌ ํŒŒ์•…๊ณผ ์ •๋ณด์ˆ˜์ง‘์€ ํ•„์ˆ˜

์ฆ‰, ์‹ฌํ™”๊ณต๊ฒฉ์€ ์—ฐ๊ณ„ ๊ณต๊ฒฉ์„ ํ•˜๊ธฐ ์œ„ํ•œ ๋ฐ‘์ž‘์—… ์ด๋‹ค

์›น ๋””๋ ‰ํ„ฐ๋ฆฌ๋ž€ : ์›น ์†Œ์Šค์ฝ”๋“œ๊ฐ€ ์‹คํ–‰์ด ๋˜๋Š” ์ตœ์ƒ์œ„ ๋””๋ ‰ํ„ฐ๋ฆฌ

window apache ๊ธฐ์ค€์œผ๋กœ htdocs, Tomcat์œผ๋กœ๋Š” Root, linux apache /var/www/html

 

๊ฒฝ๋กœ ์ด๋™๋ฌธ์ž

../ > ์šฐํšŒํ•ด์„œ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋‹ค๋Š”๊ฒƒ ๊ฐ€์ • > ์›น ๋””๋ ‰ํ„ฐ๋ฆฌ๋ฅผ ํŒŒ์•…

 

์›น ๋””๋ ‰ํ„ฐ๋ฆฌ ( ROOT ) - upload ํด๋” - image ํด๋”

ํ™˜๊ฒฝ๋ถ„์„์œผ๋กœ JAVA ์–ธ์–ด ๊ธฐ๋ฐ˜์ธ๊ฒƒ์„ ์œ ์ถ”

> index.html, index.jsp

../index.html

../../index.html

../../../index.html ๋กœ indexํŒŒ์ผ ๊ฒฝ๋กœ ์œ ์ถ”

 

../../index.jsp ํŒŒ์ผ ํ™•์ธ ๊ฐ€๋Šฅ - index ํŒŒ์ผ ํ™•์ธ ๋ฐ ๊ฒฝ๋กœ ํ™•์ธ ๊ฐ€๋Šฅ

JAVA : index.html , index.jsp, index.do // WEB-INF/web.xml

PHP : index.html, index.php

web-inf ํŒŒ์ผ ํ™•์ธ ๊ฐ€๋Šฅ
html๋กœ๋Š” ์ ‘๊ทผ ๋ถˆ๊ฐ€๋Šฅ

์ •๋ณด ์ˆ˜์ง‘ ๋ฐ ๋ถ„์„

1) ํŒŒ์ผ์ด ์–ด๋””์— ์—…๋กœ๋“œ๊ฐ€ ๋˜๋Š”์ง€ ๊ฒฝ๋กœ๋ฅผ ํŒŒ์•…ํ•œ๋‹ค

- ํŒŒ์ผ ์—…๋กœ๋“œ ์†Œ์Šค์ฝ”๋“œ๋ฅผ ๋‹ค์šด ๋ฐ›์€ ํ›„ ๋ถ„์„

2) ์›น ์†Œ์Šค์ฝ”๋“œ๋„ ๋‹ค์šด๋กœ๋“œํ•œ ๋’ค ์›น ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜ ๋กœ์ง์„ ๋ถ„์„ํ•œ๋‹ค

- ํ•ด๋‹น ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜ ์†Œ์Šค์ฝ”๋“œ๋ฅผ ๋‹ค์šด ๋ฐ›์€ ํ›„ ๋ถ„์„

3) ํ†ฐ์บฃ(WEB-INF) ๋””๋ ‰ํ„ฐ๋ฆฌ์—์„œ web.xml ํŒŒ์ผ์„ ๋‹ค์šด ๋ฐ›์€ ํ›„ ์ •๋ณด๋ฅผ ํš๋“ํ•œ๋‹ค

-../ ๋ฅผ ์ถ”๊ฐ€ํ•˜๋ฉด์„œ WEB-INF/web.xml ํŒŒ์ผ์„ ๋‹ค์šด ๋ฐ›์€ ํ›„ ๋ถ„์„

4) ํžˆ์Šคํ† ๋ฆฌ ๋ฐ ๋กœ๊ทธํŒŒ์ผ์„ ๋ถ„์„ํ•˜์—ฌ ์ •๋ณด ํš๋“

 

 

192.168.0.200/download_vuln/prob1

 

๋ชฉํ‘œ

C:\success\Open Me.txt ๋ฉ”๋ชจ์žฅ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์‹œ์˜ค

 

๋Œ€๋ฌธ์ž๋กœ ๋ณ€๊ฒฝํ•ด๋„ ์˜ค๋ฅ˜ ์—†์Œ > ์œˆ๋„์šฐ ์„œ๋ฒ„์ž„์„ ํ™•์ธ
../๊ฐ€ null ๊ฐ’์œผ๋กœ ์น˜ํ™˜ ๋์Œ์„ ์•Œ ์ˆ˜ ์žˆ๋‹ค.
index.html ํŒŒ์ผ ํ™•์ธ ๊ฐ€๋Šฅ
ํ•ด๋‹น ํŒŒ์ผ ํ™•์ธ

 

 

 

๋ชฉํ‘œ2

C:\success\Open Me.txt ๋ฉ”๋ชจ์žฅ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์‹œ์˜ค

๋Œ€๋ฌธ์ž ๋ณ€๊ฒฝํ•ด๋„ ๊ฐ™์€ ๊ฐ’ ์ถœ๋ ฅ > ์œˆ๋„์šฐ ์„œ๋ฒ„
/๋ฅผ ์ฐจ๋‹จํ•ด๋‘”๊ฒƒ
%5C๋กœ ์น˜ํ™˜ ํ›„ ๋‚ด์šฉ ํ™•์ธ \๋กœ ์น˜ํ™˜ ํ›„ ๋‚ด์šฉ ํ™•์ธ
UTF-8๋กœ ๋ณ€๊ฒฝ ํ›„ ํ•ด๋‹น ๋‚ด์šฉ ํ™•์ธ
ํ˜น์€ proxy์—์„œ ํ•ด๋‹น ๊ตฌ๋ฌธ ์ž…๋ ฅ ํ›„ 
๋‹ค์šด๋กœ๋“œํ•œ ํŒŒ์ผ ํ™•์ธ

๋ชฉํ‘œ3

C:\success\Open Me.txt ๋ฉ”๋ชจ์žฅ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์‹œ์˜ค

download.php(ํ•ด๋‹น์‚ฌ์ดํŠธ์˜ ์ฝ”๋“œ) ํŒŒ์ผ ๋‚ด์šฉ ํ™•์ธ
ํŒŒ์ผ ์ด๋ฆ„์— \์™€ / ๊ธˆ์ง€ ๋ฐ /๊ฐ€ ๋“ค์–ด๊ฐ”์„ ๊ฒฝ์šฐ ํ—ˆ์šฉ๋˜์ง€ ์•Š์€ ๋ฌธ์ž ํฌํ•จ ๊ฒฝ๊ณ ์ฐฝ ๊ทธ๋ฆฌ๊ณ  path/filename
Forward ํ›„ ๋‹ค์šด๋กœ๋“œ ๋‚ด์šฉํ™•์ธ
๋‹ค์šด๋กœ๋“œ ํ›„ ๋‚ด์šฉ ํ™•์ธ

 

 

 

๋ชฉํ‘œ4

C:\success\Open Me.txt ๋ฉ”๋ชจ์žฅ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์‹œ์˜ค

base64๋กœ ๋œ ๊ฒƒ ํ™•์ธ ํ›„
์ธ์ฝ”๋”ฉ
ํ•ด๋‹น txt ํŒŒ์ผ ํ™•์ธ
forward ํ›„ ํŒŒ์ผ ๋‹ค์šด๋กœ๋“œ - ๋ฉ”๋ชจ์žฅ ํ™•์ธ

 

 

๋ชฉํ‘œ5

C:\success\Open Me.txt ๋ฉ”๋ชจ์žฅ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์‹œ์˜ค

./์™€ /์™€ \์™€ .\๊ฐ€ ๋ง‰ํžŒ๊ฒƒ์„ ํ™•์ธ ํ›„ ....//๋ฅผ ์‚ฌ์šฉํ•ด์„œ ํ™•์ธ
์ด ํ›„ forward ํ•˜๋ฉด ๋œจ๋Š”
ํ•ด๋‹น ๋ฌธ๊ตฌ ํ™•์ธ

 

 

๋ชฉํ‘œ6

C:\success\Open Me.txt ๋ฉ”๋ชจ์žฅ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์‹œ์˜ค

./์™€ /์™€ \์™€ .\๊ฐ€ ๋ง‰ํžŒ๊ฒƒ์„ ํ™•์ธ ํ›„ ...// , ....//๋„ ๋ง‰ํžŒ๊ฒƒ ํ™•์ธ .....///๊ณผ ........//// ์‚ฌ์šฉ ํ›„ ๋ฉ”์„ธ์ง€ ํ™•์ธ
์‹œํ์–ด ์ฝ”๋”ฉ์— ์‹œํ์–ด์ฝ”๋”ฉ ๋”ํ•  ์ˆ˜ ์žˆ์Œ
ํ•ด๋‹น ๋ฌธ๊ตฌ ํ™•์ธ

 

 

๋ชฉํ‘œ7

C:\success\Open Me.txt ๋ฉ”๋ชจ์žฅ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•˜์‹œ์˜ค

/ = ๊ณต๋ฐฑ ์น˜ํ™˜

./ = ํ•ด๋‹น ํŒŒ์ผ์ด ์กด์žฌ x

.. = ๊ณต๋ฐฑ ์น˜ํ™˜

\ = ์‚ฌ์šฉ ๊ฐ€๋Šฅ > ํŒŒ์ผ๋ช…์˜ ์ฒ˜์Œ,๋’ค์—๋Š” ๊ดœ์ฐฎ์€๋ฐ ์ค‘๊ฐ„์— ๋“ค์–ด๊ฐ€๋ฉด ํ•ด๋‹นํŒŒ์ผ์ด ์กด์žฌ x

. = ์‚ฌ์šฉ ๊ฐ€๋Šฅ > ํŒŒ์ผ๋ช…์˜ ์ฒ˜์Œ,๋’ค์—๋Š” ๊ดœ์ฐฎ์€๋ฐ ์ค‘๊ฐ„์— ๋“ค์–ด๊ฐ€๋ฉด ํ•ด๋‹นํŒŒ์ผ์ด ์กด์žฌ x

์น˜ํ™˜ ์ˆœ์„œ = / ๋จผ์ € ์น˜ํ™˜ ํ›„ .. ์น˜ํ™˜ > ์‚ฌ์šฉ ๋ถˆ๊ฐ€

./. > .. >  ๋‘˜ ๋‹ค ์ง€์›Œ์ง„๋‹ค

..์ด ๋จผ์ € ์น˜ํ™˜ ํ›„ / ์น˜ํ™˜ > ์‚ฌ์šฉ ๊ฐ€๋Šฅ

./. > /์ด ์‚ด์•„๋‚จ๊ณ  ../ == /๊ฐ€ ๋จผ์ € ์น˜ํ™˜ ๋˜๋Š”๊ฒƒ์„ ๋…ธ๋ฆฌ๊ธฐ

 

๋ฐ˜์‘ํ˜•
Contents

ํฌ์ŠคํŒ… ์ฃผ์†Œ๋ฅผ ๋ณต์‚ฌํ–ˆ์Šต๋‹ˆ๋‹ค

์ด ๊ธ€์ด ๋„์›€์ด ๋˜์—ˆ๋‹ค๋ฉด ๊ณต๊ฐ ๋ถ€ํƒ๋“œ๋ฆฝ๋‹ˆ๋‹ค.