{"id":92627,"date":"2020-08-29T19:42:16","date_gmt":"2020-08-29T17:42:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kto-ostanovil-shreder-ili-kak-nuzhno-bylo-prohodit-kvest-s-unichtozheniem-servera"},"modified":"2020-08-29T19:42:16","modified_gmt":"2020-08-29T17:42:16","slug":"kto-ostanovil-shreder-ili-kak-nuzhno-bylo-prohodit-kvest-s-unichtozheniem-servera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kto-ostanovil-shreder-ili-kak-nuzhno-bylo-prohodit-kvest-s-unichtozheniem-servera","title":{"rendered":"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>P\u0159ed p\u00e1r dny jsme dokon\u010dili jednu z nejv\u00edce emocion\u00e1ln\u011b nabit\u00fdch ud\u00e1lost\u00ed, kterou jsme m\u011bli tu \u010dest organizovat v r\u00e1mci blogu \u2014 hackerskou online hru s destrukc\u00ed serveru. <\/p>\n<p>V\u00fdsledky p\u0159ekonaly v\u0161echna na\u0161e o\u010dek\u00e1v\u00e1n\u00ed: \u00fa\u010dastn\u00edci se nejen zapojili, ale rychle se zorganizovali do soudr\u017en\u00e9ho spole\u010denstv\u00ed 620 lid\u00ed na Discordu, kter\u00e9 doslova dob\u00fdvalo quest b\u011bhem dvou dn\u016f bez p\u0159est\u00e1vky na sp\u00e1nek. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/515522\/\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/07361f9696343b564c3ef3335ea99167.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nA tak to skon\u010dilo:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"V27nv2svc_A\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/V27nv2svc_A\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<h2>Jak to v\u0161echno za\u010dalo a o co vlastn\u011b \u0161lo?<\/h2>\n<p>\nHra za\u010dala 12. srpna, kdy jsme na blogu zve\u0159ejnili <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/514776\/\">p\u0159\u00edsp\u011bvek<\/a><\/noindex> video, ve kter\u00e9m hacker v kost\u00fdm\u011b lebky vyz\u00fdv\u00e1 k \u00fa\u010dasti ve h\u0159e, zni\u010dit server, zp\u016fsobit v m\u00edstnosti zkrat (nebo mini po\u017e\u00e1r) a vz\u00edt zbyl\u00e9 pen\u00edze ve shredderu.<\/p>\n<p>Byl to online quest: spustili jsme YouTube p\u0159enos z m\u00edstnosti, kterou jsme naplnili IoT za\u0159\u00edzen\u00edmi, pod postel\u00ed byl server (kter\u00fd m\u011bl b\u00fdt zni\u010den), a nad serverem jsme um\u00edstili akv\u00e1rium a zav\u011bsili nad n\u00edm z\u00e1va\u017e\u00ed. Aby hra byla zaj\u00edmav\u011bj\u0161\u00ed, rozhodli jsme se vytvo\u0159it cenov\u00fd fond ve v\u00fd\u0161i 200 000 rubl\u016f, kter\u00fd jsme nalo\u017eili do shredderu a nastavili ho na zapnut\u00ed ka\u017ed\u00fdch 60 minut. Ka\u017edou hodinu shredder zkonzumoval 1000 rubl\u016f \u2014 \u010d\u00edm d\u0159\u00edve by hr\u00e1\u010di zastavili, t\u00edm v\u00edce pen\u011bz by vyhr\u00e1li.<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"7z5Snigwg08\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/7z5Snigwg08\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center> <\/p>\n<p>Budov\u00e1n\u00ed tohoto questu bylo samo o sob\u011b questem \u2014 museli jsme se stravovat z jedn\u00e9 slu\u017eby a sp\u00e1t n\u011bkolik hodin denn\u011b p\u0159\u00edmo v t\u00e9\u017ee m\u00edstnosti. Nejd\u016fle\u017eit\u011bj\u0161\u00ed v\u0161ak bylo pozorovat tok my\u0161lenek hr\u00e1\u010d\u016f a jejich emocion\u00e1ln\u00ed zapojen\u00ed b\u011bhem procesu.<\/p>\n<p>Pokud m\u00e1m b\u00fdt up\u0159\u00edmn\u00fd, tak vynal\u00e9zavost hr\u00e1\u010d\u016f p\u0159i \u0159e\u0161en\u00ed \u00fakol\u016f mnohokr\u00e1t p\u0159ekonala n\u00e1\u0161 skromn\u00fd pl\u00e1n: ka\u017edou volnou minutu jsme sledovali chat na Discordu a v n\u011bkter\u00fdch p\u0159\u00edpadech jsme doslova plakali sm\u00edchy, kdy\u017e jsme zji\u0161\u0165ovali, co hr\u00e1\u010di d\u011blaj\u00ed a jak b\u011bhem hry \u017eertuj\u00ed.<\/p>\n<p>Na projektu ne\u00fanavn\u011b pracovalo 7 lid\u00ed: backend v\u00fdvoj\u00e1\u0159, hardwarov\u00fd specialista, skute\u010dn\u00fd filmov\u00fd producent, CG designer a dva tv\u016frci n\u00e1pad\u016f.<\/p>\n<p>V n\u00e1sleduj\u00edc\u00edch p\u0159\u00edsp\u011bvc\u00edch v\u00e1m pov\u00edme, jak byl quest technicky realizov\u00e1n, a zat\u00edm v\u00e1m odhal\u00edm jeho rozlu\u0161t\u011bn\u00ed: jak spr\u00e1vn\u011b hacknout tuto m\u00edstnost b\u011bhem p\u0159enosu. Tak\u00e9 si p\u0159ipomeneme chronologii ud\u00e1lost\u00ed a v\u0161echny \u0161\u00edlen\u00e9 iluminate teorie z chatteru na Discordu a v\u0161echno dal\u0161\u00ed.<\/p>\n<h2>Co m\u011bli hr\u00e1\u010di na za\u010d\u00e1tku hry<\/h2>\n<p>\nV\u0161echny p\u0159edm\u011bty v m\u00edstnosti byly rozd\u011bleny do t\u0159\u00ed kategori\u00ed:<\/p>\n<ul>\n<li>Jednodu\u0161e ovladateln\u00e9, nehern\u00ed IoT za\u0159\u00edzen\u00ed<\/li>\n<li>Hern\u00ed za\u0159\u00edzen\u00ed pro absolvov\u00e1n\u00ed quest\u016f<\/li>\n<li>Atmosf\u00e9ra<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/d9069fcfaf597a90b34dc2b54b442805.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUm\u00edstili jsme 8 velmi snadno ovladateln\u00fdch prvk\u016f: dv\u011b lampy, jeden girland, p\u011bt p\u00edsmen SOKOL, z nich\u017e ka\u017ed\u00e9 bylo mo\u017en\u00e9 m\u011bnit barvu. V\u0161echny je bylo mo\u017en\u00e9 zap\u00ednat\/vyp\u00ednat p\u0159\u00edmo z webu a ihned vid\u011bt v\u00fdsledek na p\u0159enosu \u2014 speci\u00e1ln\u011b jsme je ud\u011blali dostupn\u00e9 pro v\u0161echny hr\u00e1\u010de, bez ohledu na \u00farove\u0148 technick\u00e9 zdatnosti.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/5a1b0ee08046109141d46572f0bb1c8e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>V\u0161e, co se jednodu\u0161e zap\u00ednalo z webu<\/i><\/p>\n<p>Z d\u016fle\u017eit\u00fdch hern\u00edch prvk\u016f, kter\u00e9 byly nezbytn\u00e9 pro absolvov\u00e1n\u00ed quest\u016f a k nim\u017e nebyl tak snadn\u00fd p\u0159\u00edstup:<\/p>\n<ol>\n<li>Server s otev\u0159en\u00fdm v\u00edkem a akv\u00e1riem nad n\u00edm <\/li>\n<li>Kettlebell zav\u011b\u0161en\u00e1 tak, aby rozbila akv\u00e1rium <\/li>\n<li>Megatron 3000 \u2014 v\u00fdkonn\u00e1 laserov\u00e1 ukazov\u00e1tka, nam\u00ed\u0159en\u00e1 na provaz, kter\u00fd dr\u017e\u00ed kettlebell<\/li>\n<li>V\u00fdkonn\u00fd ventil\u00e1tor, kter\u00fd se zap\u00ednal p\u0159i z\u00e1t\u011b\u017ei na serveru <\/li>\n<li>Flipchart, na kter\u00e9m byly naps\u00e1ny login a heslo k Megatronu<\/li>\n<li>Telefon, na kter\u00fd bylo mo\u017en\u00e9 zavolat a vid\u011bt svou hovor v p\u0159\u00edm\u00e9m p\u0159enosu<\/li>\n<li>\u0160krab\u00e1k, kter\u00fd stravoval 1000-rublovou bankovku za hodinu<\/li>\n<\/ol>\n<p><\/p>\n<h2>Jak byl p\u0159esn\u011b vy\u0159e\u0161en kv\u00edz<\/h2>\n<p>\n\u0158eknu hned: krabi\u010dka se otev\u00edrala docela jednodu\u0161e.<\/p>\n<p>C\u00edlem hry bylo zastavit \u0161krab\u00e1ka t\u00edm, \u017ee se ud\u011bl\u00e1 zkrat v m\u00edstnosti. K tomu bylo nutn\u00e9 rozb\u00edt akv\u00e1rium, vhodit do n\u011bj kettlebell a zal\u00edt server vodou. Kettlebell byla dr\u017eena na prov\u00e1zku, na kter\u00fd m\u00ed\u0159il Megatron. Ovl\u00e1dat Megatronem, lana bylo mo\u017en\u00e9 p\u0159eru\u0161it. To se dalo ud\u011blat ve 5 jednoduch\u00fdch kroc\u00edch:<\/p>\n<h3>Krok 1. Zat\u00ed\u017eit server, kter\u00fd st\u00e1l v m\u00edstnosti<\/h3>\n<p>\nNap\u0159\u00edklad odes\u00edl\u00e1n\u00edm paket\u016f p\u0159\u00edkazem.<\/p>\n<pre><code class=\"bash\">ab -r -n 10000 -c 100 -s 280 -l https:\/\/ws.ooosokol.ru\/captcha<\/code><\/pre>\n<p>\nN\u00e1pov\u011bdou byla velmi zat\u011b\u017euj\u00edc\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/ooosokol.ru\/pricelist\">kap\u010da<\/a><\/noindex> na <noindex><a rel=\"nofollow\" href=\"https:\/\/ooosokol.ru\/pricelist\">str\u00e1nka Cen\u00edk<\/a><\/noindex>.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/80af2bf38beb1f29902f60608ca65dc2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Ta sam\u00e1 kap\u010da, kterou bylo t\u0159eba napadnout<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/36039026faaa0ef5cfb6e6956ce84e97.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159i z\u00e1t\u011b\u017ei serveru se zvy\u0161ovala jeho teplota a to bylo mo\u017en\u00e9 sledovat na monitorov\u00e1n\u00ed, kter\u00e9 bylo otev\u0159eno p\u0159\u00edmo p\u0159ed kamerou. Pot\u00e9 se zapnul ventil\u00e1tor, kter\u00fd otev\u0159el lehk\u00fd z\u00e1v\u011bs na flipchartu. Tehdy se otev\u0159el napsan\u00fd na tabuli login a heslo pro p\u0159\u00edstup na str\u00e1nku Megatronu.<\/p>\n<p>A samotnou str\u00e1nku pro \u0159\u00edzen\u00ed Megatronu bylo mo\u017en\u00e9 naj\u00edt, pokud zkontrolujete v\u0161echny certifik\u00e1ty vydan\u00e9 na dom\u00e9nu ooosokol.ru.<\/p>\n<p>Na subdom\u00e9n\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/megatron.ooosokol.ru\/\">megatron.ooosokol.ru<\/a><\/noindex> byla str\u00e1nka spr\u00e1vy Megatronu. Ale neotev\u0159ela se, dokud nebylo Megatronu dod\u00e1no prim\u00e1rn\u00ed nap\u00e1jen\u00ed.<\/p>\n<p>V\u0161echny tyto etapy hr\u00e1\u010di pro\u0161li t\u00e9m\u011b\u0159 okam\u017eit\u011b v koment\u00e1\u0159\u00edch vys\u00edl\u00e1n\u00ed na YouTube. D\u00e1le byly \u00fakoly slo\u017eit\u011bj\u0161\u00ed a hr\u00e1\u010di vytvo\u0159ili Discord server RUVDS Hack Room a pokra\u010dovali v diskusi tam.<\/p>\n<h3>Krok 2. Dod\u00e1n\u00ed prim\u00e1rn\u00edho nap\u00e1jen\u00ed na Megatron<\/h3>\n<p>\nV\u0161echna chytr\u00e1 za\u0159\u00edzen\u00ed ovl\u00e1dan\u00e1 z webu (ty stejn\u00e9 lampy, kter\u00e9 bez p\u0159est\u00e1n\u00ed zap\u00ednali nebo vyp\u00ednali hr\u00e1\u010di) m\u011bla sv\u00e9 identifik\u00e1tory.<\/p>\n<p>Aby bylo mo\u017en\u00e9 dod\u00e1vat prim\u00e1rn\u00ed nap\u00e1jen\u00ed na Megatron a z\u00e1rove\u0148 jej osv\u00edtit, bylo t\u0159eba naj\u00edt a zapnout skryt\u00e9 za\u0159\u00edzen\u00ed na str\u00e1nce spr\u00e1vy kancel\u00e1\u0159e.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/21d4b2bd950f49282c7c6d3deb26aaa8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK tomu bylo nutn\u00e9 se pod\u00edvat na identifik\u00e1tory za\u0159\u00edzen\u00ed a zjistit, \u017ee celkem za\u0159\u00edzen\u00ed je 4, zat\u00edmco na webu jsou dostupn\u00e1 jen 3. <\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/452ad83a2f77cc07a9cfb92c96a9bf0c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nStr\u00e1nka Megatronu se po zapnut\u00ed 4. za\u0159\u00edzen\u00ed stala dostupnou a samotn\u00fd laser se rozsv\u00edtil. Ale p\u0159itom bylo nemo\u017en\u00e9 st\u0159\u00edlet laserem, proto\u017ee na n\u011bm <noindex><a rel=\"nofollow\" href=\"https:\/\/megatron.ooosokol.ru\/\">str\u00e1nce<\/a><\/noindex> visela zpr\u00e1va, \u017ee laser zat\u00edm nen\u00ed dostupn\u00fd, a n\u00e1pov\u011bda: v kancel\u00e1\u0159i vyho\u0159ely pojistky, je t\u0159eba volat na spr\u00e1vn\u00ed spole\u010dnost a po\u017e\u00e1dat o zapnut\u00ed nap\u00e1jen\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/de8f502aee113b887ff16213d40f25c2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>N\u00e1pov\u011bda o spr\u00e1vn\u00ed spole\u010dnosti<\/i><\/p>\n<h3>3. Zavolat na spr\u00e1vn\u00ed spole\u010dnost a po\u017e\u00e1dat o zapnut\u00ed nap\u00e1jen\u00ed Megatronu<\/h3>\n<p>\nPodle LORu Megatron nemohl vyst\u0159elit, proto\u017ee v kancel\u00e1\u0159i vyho\u0159ely pojistky. Nap\u00e1jen\u00ed zp\u011bt mohl zapnout pouze spr\u00e1vn\u00ed spole\u010dnost, na kterou bylo t\u0159eba zavolat a proj\u00edt identifikac\u00ed jako majitel LLC.<\/p>\n<p>Naj\u00edt \u010d\u00edslo spr\u00e1vn\u00ed spole\u010dnosti bylo snadn\u00e9 \u2014 vlo\u017eili jsme jej p\u0159\u00edmo do pati\u010dky.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/d3f2467e8bd2838258e6b837fe162b40.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAle proj\u00edt identifikac\u00ed bylo mnohem slo\u017eit\u011bj\u0161\u00ed.<\/p>\n<p>P\u0159i zavol\u00e1n\u00ed na \u010d\u00edslo +74991130688, zvedla telefon oper\u00e1torka a nudn\u00fdm hlasem po\u017e\u00e1dala o uveden\u00ed I\u010cO spole\u010dnosti a cel\u00e9 jm\u00e9no majitele. Bez toho zapojen\u00ed nap\u00e1jen\u00ed odm\u00edtala a vysv\u011btlila to t\u00edm, \u017ee je to oby\u010dejn\u00e1 dispe\u010dersk\u00e1 slu\u017eba na outsourcingu, maj\u00ed 2000 klient\u016f a kancel\u00e1\u0159\u00ed a bez t\u011bchto informac\u00ed nen\u00ed mo\u017en\u00e9 naj\u00edt po\u017eadovan\u00fd.<\/p>\n<p>Pro hr\u00e1\u010de to byl nejt\u011b\u017e\u0161\u00ed krok. Spr\u00e1vn\u00e9 I\u010cO a jm\u00e9no majitele hledali t\u00e9m\u011b\u0159 dva dny, a j\u00e1 (v roli oper\u00e1tora dispe\u010dersk\u00e9 slu\u017eby) b\u011bhem t\u00e9to doby p\u0159ijala v\u00edce ne\u017e 400 telefon\u00e1t\u016f. Telefon zvonil ka\u017ed\u00e9 2-3 minuty.<\/p>\n<p>Kluci p\u00e1trali, jak mohli. Pou\u017e\u00edvali v\u0161e: prozkoum\u00e1vali zdrojov\u00e9 k\u00f3dy webu, googlili majitele webu Sokola, zkoumali soci\u00e1ln\u00ed s\u00edt\u011b.<\/p>\n<p>                        <b class=\"spoiler_title\">Hledali I\u010cO r\u016fzn\u00fdch spole\u010dnost\u00ed<\/b><br \/>\n                        <noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/6g\/8w\/tx\/6g8wtxbp95x9nyiwev6kjhgdbgu.jpeg\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/fffdd8281583cbf7fe4c5bd59959fb83.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/rj\/gx\/8o\/rjgx8ocqpcvs2oy8o8q_pw7pzoc.jpeg\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/e0050986383f457dad2bbd5945e9d504.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/6a95a02ed91acc94fd81efa11688cef6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/nv\/ww\/f5\/nvwwf5i97bwoux4lh3pbbsl6sf8.jpeg\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/a23fff75b5d9151d53319f01751deb3c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/aa\/el\/i4\/aaeli4ms2vd7ooik-5an_1pi1ts.jpeg\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/0820c8aab2fcbd6cb8aff0a29f71777d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<i>T\u00e9m\u011b\u0159 kompletn\u00ed sch\u00e9ma vyhled\u00e1v\u00e1n\u00ed<\/i><br \/>\n                    <br \/>\nV jednu chv\u00edli dokonce zavolali se zam\u011bn\u011bn\u00fdm \u010d\u00edslem \u2014 jako by volali z kancel\u00e1\u0159e spole\u010dnosti Sokolec uveden\u00e9 v pati\u010dce.<\/p>\n<p>Tehdy jsme zjistili, kolik obrovsk\u00e9 mno\u017estv\u00ed firem nese n\u00e1zev Sokolec. Prakticky ka\u017ed\u00e9 z t\u011bchto firem se dovolali hr\u00e1\u010di, ale to se nedalo srovn\u00e1vat s t\u00edm, co za\u017eil web <noindex><a rel=\"nofollow\" href=\"http:\/\/lasermasters.ru\">lasermasters.ru<\/a><\/noindex>, od kter\u00e9 jsme skute\u010dn\u011b kupovali ten Megatron p\u0159ed p\u0159ibli\u017en\u011b m\u011bs\u00edcem.<\/p>\n<p>Nejprve Discord za\u00fato\u010dil na podporu LaserMasters.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/f2d222336193140558b8b4717a2a3194.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPak tam dok\u00e1zali naj\u00edt n\u011b\u010d\u00ed \u00fa\u010det! Zat\u00edmco podpora LaserMasters u\u017e ne\u0161et\u0159ila v\u00fdrazy.<\/p>\n<p>                        <b class=\"spoiler_title\">Pozor, odstra\u0148te d\u011bti od obrazovky<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/95f2fa7cc62b6b2dc9dc92257a99783f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/7f6858e7fbb4ac30de4d58da733dd72c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\nNakonec jsme se rozhodli prost\u011b DDoSovat LaserMasters a jejich web spadl. Stejn\u011b se poda\u0159ilo polo\u017eit i web Sokolec, i kdy\u017e jsme ho rychle zvedli.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/hsto.org\/webt\/e4\/8q\/-b\/e48q-b6gvy5zm2yu8bqmg0jgzke.jpeg\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/06f14b9680c8a31129afdf4308289e65.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>B\u011bhem vy\u0161et\u0159ov\u00e1n\u00ed kluci z Discordu dokonce na\u0161li herce, jeho\u017e fotografii jsme koupili ze stock\u016f, aby hr\u00e1l roli hlavn\u00edho antagonisty, vlastn\u00edka LLC Andreje Sokolova. Uk\u00e1zalo se, \u017ee se jmenuje Jurij a nem\u00e1 v\u016fbec pon\u011bt\u00ed, do jak\u00e9ho mal\u00e1tn\u00e9ho dobrodru\u017estv\u00ed se dostal.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/5d54b13b62c803a761dc6fab397f2890.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Andrej Sokolov, postava hry<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/0d2cbf9920a15cf9065d14651c377d9d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Jurij, model<\/i><\/p>\n<p>Kdyby v\u011bd\u011bl, jak p\u0159inutit 600 lid\u00ed nesp\u00e1t dv\u011b noci...)<\/p>\n<p>Pak za\u010dali kopat konkr\u00e9tn\u011b pod m\u011b, jako organiz\u00e1tora quest\u016f (co\u017e mohlo skon\u010dit \u00fasp\u011bchem, kdyby kluci uh\u00e1dli, jak hacknout moje pracovn\u00ed kan\u00e1ly). <\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/1e2babd073723d3ae968c5575e642a80.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrochu jsem se znepokojila, kdy\u017e zm\u00ednili m\u00e9 patronymikum a dokonce i I\u010cO. Ale ulevilo se mi, kdy\u017e mi b\u011bhem procesu zkreslen\u00e9ho telefonu n\u00e1hle p\u0159i\u0161el star\u0161\u00ed bratr, kter\u00fd se n\u00e1hle uk\u00e1zal jako technick\u00fd \u0159editel Habra. <\/p>\n<p>                        <b class=\"spoiler_title\">M\u016fj drah\u00fd rodn\u00fd bratr, kter\u00e9mu to tak\u00e9 spadlo do kl\u00edna<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/ca21d19236d8d1caca4d659f49e7a477.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n                    <\/p>\n<p>                        <b class=\"spoiler_title\">Mezit\u00edm se domn\u011bnky st\u00e1valy st\u00e1le neuv\u011b\u0159iteln\u011bj\u0161\u00ed<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/13f47fddd45c6d40ba68ba7f233bb792.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA\u017e do ilumin\u00e1tsk\u00fdch teori\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/344c2d70581e69ab5376bbe67eabd51e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\nNejsou to nej\u0161\u0165avnat\u011bj\u0161\u00ed konspira\u010dn\u00ed teorie t\u00fdkaj\u00edc\u00ed se Sponge Boba, Harryho Pottera a blikaj\u00edc\u00ed \u010d\u00ednsk\u00e9 LED \u0159et\u011bzy, kter\u00e9 jsme polo\u017eili dovnit\u0159 syst\u00e9mov\u00e9 jednotky.<\/p>\n<p>Odkud Sponge Bob a Harry Potter, \u0159eknete? Jejich adresy jsme vlo\u017eili na str\u00e1nku kontakt\u016f Sokolec a to vyvolalo spoustu domn\u011bnek v discordov\u00e9 komunit\u011b. P\u0159itom jsme jen cht\u011bli vzd\u00e1t hold na\u0161im obl\u00edben\u00fdm d\u011btsk\u00fdm d\u00edl\u016fm.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/1f541f8cbe5f7e73b616e47652299fa9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Ta sam\u00e1 zm\u00ednka na str\u00e1nce &quot;<noindex><a rel=\"nofollow\" href=\"https:\/\/ooosokol.ru\/contacts\">Kontakty<\/a><\/noindex>&quot;<\/i><\/p>\n<p>A nakonec<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/35100c95ef78dadf12c63b0e08f0ec7c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/6719a54c7b643fa14104a49edaee8623.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/5cb070879fdf390de89e33ed96723ef6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/93edce804c2d0c1a9581141113d0c064.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/e90e11145ba4165622b2b3053efe8944.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Uk\u00e1zalo se, \u017ee v seri\u00e1lu skute\u010dn\u011b existuj\u00ed dokumenty Houbov\u00e9ho Bobka. Byly naz\u00fdv\u00e1ny jako I\u010cO<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/8b78647a05f13e9a7402278e2185daf5.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJedna z nejobt\u00ed\u017en\u011bj\u0161\u00edch teori\u00ed byla ta, \u017ee blik\u00e1n\u00ed \u010d\u00ednsk\u00fdch lampion\u016f obsahuje zpr\u00e1vu v Morseov\u011b abeced\u011b. <\/p>\n<p>                        <b class=\"spoiler_title\">Jasn\u00e9 sign\u00e1ly byly zachycov\u00e1ny a pokou\u0161eli se je de\u0161ifrovat.<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/c888d827ad21791bad17ec760ef4803a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/41c29bbd0769e30cb4e5d92b86868570.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/5c9af43e5d2194a1e0b5fcd65e0c06ef.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\nZ jednodu\u0161\u0161\u00edch teori\u00ed se sna\u017eili zjistit, jestli nen\u00ed n\u011bjak\u00e1 n\u00e1pov\u011bda zasunut\u00e1 v map\u00e1ch.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/81d237a6a2dece0b7bc882d68b4e2d04.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCestou n\u00e1s srovn\u00e1vali s <noindex><a rel=\"nofollow\" href=\"https:\/\/www.wikiwand.com\/ru\/%D0%A6%D0%B8%D0%BA%D0%B0%D0%B4%D0%B0_3301\">Cik\u00e1dou 3301<\/a><\/noindex> \u2014 nep\u0159im\u011b\u0159en\u011b vysoko hodnocen\u00ed, ale i tak p\u0159\u00edjemn\u00e9.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/475ef299f129b98caea79cf63f77e80a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/b1b9d95f7825dc901f7786d9a5a87e1b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHr\u00e1\u010di naplno zkou\u0161eli soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed. Volali mi pod z\u00e1minkou FSB, hasi\u010d\u016f, samotn\u00e9ho Sokolova, jeho b\u00fdval\u00e9 \u017eeny a ochr\u00e1nce, kter\u00fd pr\u00fd sed\u00ed dole. \u0158\u00edkali, \u017ee za\u010dal po\u017e\u00e1r, n\u011bkdo uv\u00edzl v v\u00fdtahu, a nejv\u00edce dojemn\u00e1 byla historka o tom, \u017ee v kancel\u00e1\u0159i, kterou zachv\u00e1til ohe\u0148, pr\u00fd sed\u00ed pejsek volaj\u00edc\u00edho.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/4c62680deb599ae4cd3c6cc0bd155c70.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Pokusy o \u00faplatky tak\u00e9 prob\u011bhly.<\/i><\/p>\n<p>Postupn\u011b se v chatu za\u010daly objevovat vlastn\u00ed memy.<\/p>\n<p>                        <b class=\"spoiler_title\">Tady je p\u00e1r z nich.<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/4e8d3c503bb50298eabeb9508c178787.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/1a870b382e1600f5dfa348f689a4c59c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/637a118228dff4474b9f4de5bde4316a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">A tov\u00e1rny mezit\u00edm st\u00e1ly.<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/f290372308405e5b66628dbfa76d8fe3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/475a70bfd5d8c009d38cc80559285c76.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/74f3b257b715ad2a4610c9932a57c62f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/9dbf2a67f7ab74dc435cb23d20ea1c71.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/67002cb3e89799ffdee4a71b0b85f9d0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h2>N\u00e1pov\u011bda<\/h2>\n<p>\nPen\u011bz ve \u0161rederu ub\u00fdvalo. Aby v\u00edt\u011bz z\u00edskal n\u011bco, rozhodli jsme se ud\u011blat n\u00e1pov\u011bdu. A tak\u00e9, vych\u00e1zej\u00edc\u00ed ze z\u00e1sad hern\u00edho designu, p\u0159\u00edmo p\u0159ed fin\u00e1le zv\u00fd\u0161it nap\u011bt\u00ed.<\/p>\n<p>Samostatn\u00fdm <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/515048\/\">p\u0159\u00edsp\u011bvkem<\/a><\/noindex> na blogu jsme zve\u0159ejnili video. Na za\u010d\u00e1tku byl vlo\u017een \u00faryvek z Klub rv\u00e1\u010d\u016f \u2014 jako odkaz na Tylera Durdena, kter\u00fd myslel na vkl\u00e1d\u00e1n\u00ed 25. sn\u00edmku do film\u016f, zat\u00edmco pracoval v kinech.<\/p>\n<p>Rozhodli jsme se pou\u017e\u00edt tuto stejnou mechaniku a vlo\u017eili 25. sn\u00edmek jako n\u00e1pov\u011bdu, jak <noindex><a rel=\"nofollow\" href=\"https:\/\/sbis.ru\/contragents\/7723558400\/772301001\">vygooglit<\/a><\/noindex> spr\u00e1vn\u00e9 I\u010c a jm\u00e9no vlastn\u00edka. <\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"dEZyyESJg4s\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/dEZyyESJg4s\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/cac950eea233c4c8c332f29bb6ee930e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Pot\u00e9 se kluci velmi rychle zorientovali.<\/i><\/p>\n<h3>Krok 4. St\u0159\u00edlet laserem v nebojov\u00e9m re\u017eimu.<\/h3>\n<p>\nP\u0159i dod\u00e1vce energie spr\u00e1vcem a po zapnut\u00ed pojistek se Megatron zapnul a mohl st\u0159\u00edlet v testovac\u00edm re\u017eimu. Do formul\u00e1\u0159e pro zad\u00e1n\u00ed byl ji\u017e vlo\u017een token pro testovac\u00ed v\u00fdst\u0159el.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/b395705d08e3d812bbfd4271fd5aaf88.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Ka\u017ed\u00fdch 25 sekund se generoval nov\u00fd token, kter\u00fd bylo mo\u017en\u00e9 vyu\u017e\u00edt k zapnut\u00ed laseru na 10 sekund na v\u00fdkonu 10\/255.<\/i><\/p>\n<p>Pot\u00e9 se laser chladil 1 minutu a v tuto minutu nebyl dostupn\u00fd, nep\u0159ij\u00edmal nov\u00e9 v\u00fdst\u0159ely.<\/p>\n<p>Tento v\u00fdkon nebyl v\u016fbec dostate\u010dn\u00fd k p\u0159ep\u00e1len\u00ed provazu, ale kter\u00fdkoli hr\u00e1\u010d mohl vyst\u0159elit z Megatrona a vid\u011bt laserov\u00fd paprsek v akci. <\/p>\n<p>                        <b class=\"spoiler_title\">Reakce komunity byla v\u00edce ne\u017e bou\u0159liv\u00e1.<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/7292e32723d99262ce40636a130eb8e0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n                    <\/p>\n<p>                        <b class=\"spoiler_title\">Ale v\u0161ichni se rychle uklidnili a pochopili, \u017ee to je\u0161t\u011b nen\u00ed konec hry.<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/2432f414389af3cbafd56ed8a2be7a1e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\nD\u00e1l se komunita za\u010dala zab\u00fdvat t\u00edm, jak spustit bojov\u00fd re\u017eim.<\/p>\n<p>                        <b class=\"spoiler_title\">Brainstorming.<\/b><br \/>\n                        <noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/vm\/j-\/kd\/vmj-kdsd94p2izz2_ux_4dgq49m.jpeg\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/abc96e77747b9483c551f8e9f5b4bcff.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/0d34ed960407c0a5e60688437f9174c7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ws\/zr\/kw\/wszrkwzj7f3mlcjmva5xvusmdl8.jpeg\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/c5a0bfd6a0f309cfb683e3aeee10bc37.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/c0f8c5e41c3523b4abf2885a1f0371cf.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Na Discordu se objevily fake \u00fa\u010dty.<\/i><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/7x\/ug\/po\/7xugpozxfrkw3hqk9ian6m_tmgm.jpeg\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/a95b843f41183646b8dcb4d2fcc194cc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<i>Nev\u011bd\u011bli jsme, \u017ee na noze stolu je v p\u0159enosu n\u011bco naps\u00e1no.<\/i><\/p>\n<h3>Komunita se dostala k kroku 4. Porozum\u011bt, jak se generuj\u00ed tokeny: naj\u00edt gist a vygenerovat token, kter\u00fd zahrnuje laser v bojov\u00e9m re\u017eimu.<\/h3>\n<p>\nBojov\u00fd re\u017eim Megatronu je 100% v\u00fdkon laseru na 3 W. To je zcela dosta\u010duj\u00edc\u00ed na 2 minuty, aby sp\u00e1lil provaz, kter\u00fd dr\u017eel z\u00e1va\u017e\u00ed, rozbil akv\u00e1rium a zalil server vodou.<\/p>\n<p>Zanechali jsme n\u011bkolik n\u00e1pov\u011bd na <noindex><a rel=\"nofollow\" href=\"https:\/\/gist.github.com\/ooosokol\/605eab15b856d46d7e45f27e89040b8d\">gitHubu projektu.<\/a><\/noindex>: konkr\u00e9tn\u011b k\u00f3d generov\u00e1n\u00ed tokenu, podle kter\u00e9ho bylo mo\u017en\u00e9 pochopit, \u017ee testovac\u00ed a bojov\u00e9 tokeny se generuj\u00ed na z\u00e1klad\u011b jedn\u00e9 hodnoty po\u010d\u00edtadla. V p\u0159\u00edpad\u011b bojov\u00e9ho tokenu se krom\u011b hodnoty po\u010d\u00edtadla je\u0161t\u011b pou\u017e\u00edv\u00e1 s\u016fl, kterou jsme t\u00e9m\u011b\u0159 \u00fapln\u011b nechali v historii zm\u011bn tohoto gistu, krom\u011b dvou posledn\u00edch znak\u016f.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/7f1780e701e32bf8849d170c62cdd32a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Jak si v\u0161ichni rychle domysleli, bylo to 42.<\/i><\/p>\n<p>V koment\u00e1\u0159\u00edch gistu byla korespondence Andreje Sokolova s v\u00fdvoj\u00e1\u0159em (\"moudr\u00fd v\u00fdvoj\u00e1\u0159\", jak ho nazvali kluci z Discordu).<\/p>\n<p>V korespondenci Andrej poslal jeden z bojov\u00fdch token\u016f a v\u00fdvoj\u00e1\u0159 odpov\u011bd\u011bl, \u017ee tento token byl inicializov\u00e1n p\u0159i hodnot\u011b po\u010d\u00edtadla 42.<\/p>\n<p><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/6e58da9fc8f86ea1d9f1d29d5f300488.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nS t\u011bmito \u00fadaji bylo mo\u017en\u00e9 vyzkou\u0161et 2 posledn\u00ed znaky soli a fakticky zjistit, \u017ee pro ni byla pou\u017eita \u010d\u00edsla z Lost, p\u0159eveden\u00e1 do 16-\u010d\u00edslicov\u00e9 soustavy.<\/p>\n<p>Pot\u00e9 hr\u00e1\u010d\u016fm zb\u00fdvalo pouze chytit hodnotu po\u010d\u00edtadla (analyzov\u00e1n\u00edm testovac\u00edho tokenu) a vygenerovat bojov\u00fd token, pou\u017e\u00edvaj\u00edc n\u00e1sleduj\u00edc\u00ed hodnotu po\u010d\u00edtadla a vybranou s\u016fl z p\u0159edchoz\u00edho kroku.<\/p>\n<p>Po\u010d\u00edtadlo se jednodu\u0161e inkrementovalo p\u0159i ka\u017ed\u00e9m testovac\u00edm v\u00fdst\u0159elu a ka\u017ed\u00fdch 25 sekund. O tom jsme nikde nezmi\u0148ovali, to m\u011blo b\u00fdt malou hern\u00ed ne\u010dekanost\u00ed. Kluci si s t\u00edm velmi rychle poradili a spustili Megatron v bojov\u00e9m re\u017eimu.<\/p>\n<h3>Krok 5. Sp\u00e1lit provaz laserem.<\/h3>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"XpEgI5AknN4\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/XpEgI5AknN4\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\n<i>Jak to prob\u00edhalo.<\/i><\/p>\n<p>Tady u\u017e to bylo jednoduch\u00e9. Odesl\u00e1n\u00ed bojov\u00e9ho tokenu zahrnovalo laser do bojov\u00e9ho re\u017eimu, a m\u00edstnost se m\u011bnila a p\u0159ech\u00e1zela do \u201ere\u017eimu katastrofy\u201c, jak jsme to nazvali v celkov\u00e9m sc\u00e9n\u00e1\u0159i:<\/p>\n<ul>\n<li>Ve\u0161ker\u00e9 sv\u011btlo v m\u00edstnosti se vypnulo.<\/li>\n<li>Tla\u010d\u00edtka IoT za\u0159\u00edzen\u00ed na webu se stala nedostupn\u00fdmi.<\/li>\n<li>Rozsv\u00edtila se blikaj\u00edc\u00ed sv\u011btla a zvuk sir\u00e9ny.<\/li>\n<li>\u010cerven\u00e9 z\u00e1va\u017e\u00ed se rozsv\u00edtilo.<\/li>\n<li>Na obrazovce televize za\u010dal odpo\u010det do spu\u0161t\u011bn\u00ed laseru v bojov\u00e9m re\u017eimu. <\/li>\n<\/ul>\n<p>\nDali jsme p\u016fldruh\u00e9 hodiny na odpo\u010det, aby se v\u0161ichni, kdo hr\u00e1li, stihli zapnout p\u0159enos a vid\u011bt fin\u00e1le. A ne\u0161lo o n\u00e1hodu: zat\u00edmco jsem s nap\u011bt\u00edm o\u010dek\u00e1vala zvuk \u00faderu a rozb\u00edjej\u00edc\u00edho se skla z vedlej\u0161\u00ed m\u00edstnosti, cel\u00fd t\u00fdm, kter\u00fd sestavil quest, se bez domluvy za\u010dal sj\u00ed\u017ed\u011bt na z\u00e1kladnu, aby vid\u011bli fin\u00e1le na vlastn\u00ed o\u010di. Prost\u011b vb\u00edhali do m\u00edstnosti a za\u010dali se obj\u00edmat.<\/p>\n<p>                        <b class=\"spoiler_title\">Mezit\u00edm v Discordu<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/b831bfdf5faec76962c063cca307b4e6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/33c40df26042ccf8b3bb8fe56b70de78.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\nPo skon\u010den\u00ed odpo\u010dtu se laser zapnul do bojov\u00e9ho re\u017eimu a za dv\u011b minuty p\u0159ep\u00e1lil provaz \u2014 kettlebell let\u011bla p\u0159\u00edmo do akv\u00e1ria. P\u0159ed n\u00e1razem na obrazovce zak\u0159i\u010dela \u0161\u00edlen\u00e1 kapibara, panika\u0159ila a zvedla mal\u00e9 tlapi\u010dky.<\/p>\n<p>Kdy\u017e u\u017e se tam se\u0161el cel\u00fd t\u00fdm, nato\u010dili jsme kr\u00e1tkou zpr\u00e1vu pro v\u0161echny, kdo dva dny bojovali za fin\u00e1le na Discordu, a \u0161li otev\u0159\u00edt \u0161ampa\u0148sk\u00e9:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"ZypmDzfF55Y\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/ZypmDzfF55Y\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<h2>Jak jsme spo\u010d\u00edtali \u010das spu\u0161t\u011bn\u00ed reklamn\u00edch vide\u00ed a let kettlebellu?<\/h2>\n<p>\nPo des\u00edtk\u00e1ch test\u016f p\u0159epalov\u00e1n\u00ed provazu laserem jsme zjistili, \u017ee to je velmi nespolehliv\u00e1 konstrukce \u2014 polop\u0159ep\u00e1len\u00fd provaz se stal ten\u010d\u00edm, pod v\u00e1hou kettlebellu se nap\u00ednal, m\u011bnil polohu a laser ji\u017e nemohl proj\u00edt a\u017e do konce. <\/p>\n<p>Proto jsme \u0161li jinou cestou: dublovali jsme p\u0159epalov\u00e1n\u00ed, omot\u00e1n\u00edm provazu nichromov\u00fdm dr\u00e1tem. Skrze dr\u00e1t jsme pou\u0161t\u011bli proud, ten se na\u017ehavil a p\u0159ep\u00e1lil provaz p\u0159ibli\u017en\u011b za 2 sekundy \u2014 to n\u00e1m dalo p\u0159esnou p\u0159edstavu o tom, kdy zapnout k\u0159i\u010d\u00edc\u00ed kapibaru, zastavit \u010dasova\u010d spu\u0161t\u011bn\u00ed a spustit reklamn\u00ed video:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"HvLjeorvmOg\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/HvLjeorvmOg\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<h2>Co se n\u00e1m nepovedlo?<\/h2>\n<p>\nVe fin\u00e1le m\u011bl z boxu vych\u00e1zet hust\u00fd kou\u0159, jako p\u0159i po\u017e\u00e1ru \u2014 p\u0159ipravili jsme d\u00fdmovnice, zapalovali je podobn\u00fdm zp\u016fsobem, ale n\u011bjak to nefungovalo (pravd\u011bpodobn\u011b kv\u016fli vod\u011b).<\/p>\n<h2>Kdo je v\u00edt\u011bz?<\/h2>\n<p>\nV\u00edt\u011bzem se stal <b>Arkadiy Alexeev<\/b> ze Sankt-Pet\u011brburgu \u2014 on jako prvn\u00ed vygeneroval testovac\u00ed token a vyhr\u00e1l zbytek pen\u011bz ve shredderu ve v\u00fd\u0161i 134 000 rubl\u016f.<\/p>\n<p>Kr\u00e1tk\u00fd rozhovor s Arkadiem.<\/p>\n<h4>Pov\u011bz mi o sob\u011b, \u010demu se v\u011bnuje\u0161 v pr\u00e1ci?<\/h4>\n<p><\/p>\n<blockquote><p>Jsem bezpe\u010dnostn\u00ed technik, studoval jsem BITS na ITMO. Pracuji jako full-stack webov\u00fd v\u00fdvoj\u00e1\u0159 na voln\u00e9 noze. Ve \u0161kole jsem byl olympionik, v\u010detn\u011b programov\u00e1n\u00ed a matematiky.<\/p><\/blockquote>\n<p><\/p>\n<h4>Jak jsi se o h\u0159e dozv\u011bd\u011bl?<\/h4>\n<p><\/p>\n<blockquote><p>Za\u0161el jsem na Habr jen tak na \u010dten\u00ed, vid\u011bl jsem \u010dl\u00e1nek, zaujal m\u011b.<\/p><\/blockquote>\n<p><\/p>\n<h4>Kolik hodin jsi hr\u00e1l, kdy\u017e ses p\u0159ipojil?<\/h4>\n<p><\/p>\n<blockquote><p>P\u0159ipojil jsem se ve\u010der toho dne, kdy byla zve\u0159ejn\u011bna \u010dl\u00e1nek (tj. den p\u0159ed koncem). Sed\u011bl jsem ve\u010der a velkou \u010d\u00e1st n\u00e1sleduj\u00edc\u00edho dne.<\/p><\/blockquote>\n<p><\/p>\n<h4>Co se ti l\u00edbilo a co ne?<\/h4>\n<p><\/p>\n<blockquote><p>Celkov\u011b se mi to v\u0161echno l\u00edbilo (no a co, vyhr\u00e1l jsem)), ale trochu m\u011b obt\u011b\u017eovalo, jak \u010dasto jsem musel volat. No, volat a kontrolovat ka\u017edou verzi je tak n\u011bjak nep\u0159\u00edjemn\u00e9, p\u0159inejmen\u0161\u00edm bylo trapn\u00e9 - ch\u00e1pal jsem, \u017ee tam vol\u00e1 dal\u0161\u00edch n\u011bkolik des\u00edtek lid\u00ed, polovina si d\u011bl\u00e1 srandu a sna\u017e\u00ed se o soc. in\u017een\u00fdrstv\u00ed.<\/p><\/blockquote>\n<p><\/p>\n<h4>Jak jsi pochopil, jak naj\u00edt bojov\u00fd token k megatronu?<\/h4>\n<p><\/p>\n<blockquote><p>Kdy\u017e jsem p\u0159i\u0161el, u\u017e spammovali server, hr\u00e1li si s tla\u010d\u00edtky, na\u0161li heslo od admin panelu laseru, r\u016fzn\u00e9 subdom\u00e9ny a str\u00e1nky. <\/p>\n<p>Je\u0161t\u011b bylo snadn\u00e9 naj\u00edt profil na Gitu a gist s koment\u00e1\u0159i. Odtud je z\u0159ejm\u00fd proces generov\u00e1n\u00ed tokenu a secret pro n\u011bj. V takov\u00fdch questech nen\u00ed pot\u0159eba \u0161\u00edlen\u011b vym\u00fd\u0161let, proto\u017ee se d\u00e1 utopit v hromad\u011b mo\u017en\u00fdch sc\u00e9n\u00e1\u0159\u016f; a t\u00edm p\u00e1dem je pot\u0159eba n\u00e1sledovat to, kam t\u011b tla\u010d\u00ed tv\u016frce questu. <\/p>\n<p>S ohledem na ostatn\u00ed subdom\u00e9ny a testovac\u00ed web na Tild\u011b bylo jasn\u00e9, \u017ee pot\u00e9, co se zapne nap\u00e1jen\u00ed laseru, bude pot\u0159eba z\u00edskat token. Proto jsem je\u0161t\u011b ten ve\u010der sepsal p\u0159ibli\u017en\u00fd po\u017eadavek na zapnut\u00ed laseru (na z\u00e1klad\u011b 4 dostupn\u00fdch formul\u00e1\u0159\u016f: 1 na pracovn\u00edm webu a 3 na testovac\u00edm\/staro-n\u00ed) a pokusil jsem se bruteforce pracuj\u00edc\u00edmi tokeny od 42 (no, prost\u011b tak, na blbce - t\u0159eba u\u017e je v\u0161echno zapnuto a str\u00e1nka pro odes\u00edl\u00e1n\u00ed tokenu se jednodu\u0161e otev\u0159e po I\u010c a jm\u00e9n\u011b). <\/p>\n<p>Nejsem si jist\u00fd, \u017ee po\u017eadavek byl spr\u00e1vn\u00fd, proto\u017ee nebyl \u010das na kontrolu (proto\u017ee bylo mo\u017en\u00e9 zkontrolovat jen zapnut\u00ed laseru), ale na p\u0159eb\u00edr\u00e1n\u00ed tokenu jsem se p\u0159ipravoval p\u0159edem. <\/p>\n<p>Je\u0161t\u011b tam byla z\u0159ejm\u00e1 logika s websockety a ovl\u00e1d\u00e1n\u00edm za\u0159\u00edzen\u00ed v souboru app.js. Byl tam siln\u00fd n\u00e1znak na za\u0159\u00edzen\u00ed a9, na kter\u00e9 odesl\u00e1n\u00ed power: true zp\u016fsobilo p\u00e1d socketu. Zkou\u0161el jsem na n\u011bj pos\u00edlat r\u016fzn\u00e9 p\u0159\u00edkazy - t\u0159eba tam mohlo b\u00fdt dal\u0161\u00ed za\u0159\u00edzen\u00ed pro odhalen\u00ed I\u010c, ale bez \u00fasp\u011bchu. <\/p>\n<p>Po chv\u00edli jsem prozkoumal i ostatn\u00ed ID v okol\u00ed t\u011bch deseti, ale v\u0161ude bylo unknown device. Pak jsem se pokusil vyhled\u00e1vat r\u016fzn\u00e9 v\u011bci, p\u0159ihl\u00e1sil jsem se na chsokolow@gmail.com, poslal jsem r\u016fzn\u00e9 informace ve formul\u00e1\u0159i na str\u00e1nce s cenami, zkoumal jsem lasermasters, ale v\u0161echno bez \u00fasp\u011bchu. N\u00e1sleduj\u00edc\u00ed den jsem byl v chatu, vyhled\u00e1val jsem r\u016fzn\u00e1 t\u00e9mata, pak se objevilo stego-t\u00e9ma a poradil jsem se s n\u011bk\u00fdm ohledn\u011b stegosolve pro obr\u00e1zky a GIFy (ale rozum mi \u0159\u00edkal, \u017ee 99% tam nic nen\u00ed, proto\u017ee by to bylo p\u0159\u00edli\u0161 + odporovalo by to hlavn\u00ed linii questu). <\/p>\n<p>Nakonec jsem tak\u00e9 p\u00e1r hodin proch\u00e1zel v\u0161echny obr\u00e1zky a GIFy. Znovu jsem volal s r\u016fzn\u00fdmi variantami I\u010cO, ale nic. Potom jsem se rozhodl na chv\u00edli zapomenout, ale n\u011bkdo zve\u0159ejnil n\u00e1pov\u011bdu \u2014 a bylo jasn\u00e9, \u017ee I\u010cO brzy najdou, co\u017e se i stalo. Pak to bu\u010f j\u00e1, nebo n\u011bkdo jin\u00fd (to nen\u00ed jasn\u00e9) poslalo power: true na a9 za\u0159\u00edzen\u00ed a laser za\u010dal fungovat, i kdy\u017e mo\u017en\u00e1 zde nen\u00ed spojen\u00ed a za\u010dal fungovat prost\u011b po I\u010cO. Ka\u017edop\u00e1dn\u011b jsem se dostal do administrace laseru a byl jsem nemile p\u0159ekvapen, proto\u017ee server s\u00e1m pos\u00edlal token (a j\u00e1 u\u017e jsem se p\u0159ipravoval na bruteforce). Bylo jasn\u00e9, \u017ee token je testovac\u00ed, proto\u017ee vys\u00edl\u00e1n\u00ed + zdrav\u00fd rozum + j\u00e1 jsem ho zkontroloval. <\/p>\n<p>V k\u00f3du byla logika pro pos\u00edl\u00e1n\u00ed pracovn\u00edho tokenu n\u011bkam notifikac\u00ed, ale z\u0159ejm\u011b to byl bu\u010f neplatn\u00fd k\u00f3d, nebo to bylo pot\u0159eba pro jin\u00e9 \u010d\u00e1sti syst\u00e9mu. Napsal jsem skript pro z\u00edsk\u00e1n\u00ed aktu\u00e1ln\u00edho pracovn\u00edho tokenu z aktu\u00e1ln\u00edho testovac\u00edho a pak jsem \u010dekal na F5, sna\u017ee se je poslat \u2014 s t\u00edm byly probl\u00e9my, proto\u017ee v\u0161ichni neust\u00e1le ma\u010dkali tla\u010d\u00edtko odeslat, \u010d\u00edm\u017e m\u011bnili token. Potom tak\u00e9 web spadl, \u010d\u00edta\u010d se resetoval, ale te\u010f u\u017e na tom nez\u00e1le\u017e\u00ed \u2014 po n\u011bjak\u00e9 dob\u011b jsem poslal pracovn\u00ed token. Podle pl\u00e1nu m\u011bl \u010d\u00edta\u010d 58 a <b>token byl 449a776938f7ce4cf19f8603045dca0f<\/b> v dob\u011b aktivace, pokud se nepletu. To je vlastn\u011b v\u0161echno.<\/p>\n<p>Pak jsem m\u011bl je\u0161t\u011b p\u00e1r roz\u010dilen\u00ed z koment\u00e1\u0159\u016f jako \"ano, to je v\u0161echno trivi\u00e1ln\u00ed, ano, m\u011bl jsi prost\u011b \u0161t\u011bst\u00ed.\" No, pokud se dostanete na str\u00e1nku, promysl\u00edte to minutu, nap\u00ed\u0161ete skript za p\u00e1r minut, zkontrolujete ho \u2014 pak ano, trivi\u00e1ln\u00ed. Ale j\u00e1 to ud\u011blal za 10-20 sekund, a pak jsem prost\u011b n\u011bkolik minut nemohl token odeslat. <\/p>\n<p>Samoz\u0159ejm\u011b, mohl jsem zkusit napsat logiku pro automatick\u00e9 zachycen\u00ed a odes\u00edl\u00e1n\u00ed, ale to by bylo del\u0161\u00ed a s velk\u00fdm rizikem, nav\u00edc by snad cloud za\u010dal protestovat. To, co mi opravdu vy\u0161lo, bylo samotn\u00e9 posledn\u00ed f\u00e1ze \u2014 trochu algoritm\u016f na rychlost + rychlost reakce, to je p\u0159esn\u011b moje. Kdyby tam bylo zad\u00e1n\u00ed p\u0159\u00edmo z pentestu, pravd\u011bpodobn\u011b bych nebyl prvn\u00ed.<\/p><\/blockquote>\n<p><\/p>\n<h2>Ale to je\u0161t\u011b nen\u00ed konec<\/h2>\n<p>\nNemohu se do\u010dkat, a\u017e v\u00e1m pov\u00edm o cel\u00e9m \u00fa\u017easn\u00e9m t\u00fdmu, kter\u00fd tento \u00fakol vybudoval, a o v\u0161ech in\u017een\u00fdrsk\u00fdch \u0159e\u0161en\u00edch, kter\u00e1 na\u0161li. Ale tento p\u0159\u00edsp\u011bvek u\u017e je tak obrovsk\u00fd \u2014 proto o tom budou samostatn\u00e9 \u010dl\u00e1nky, tak\u017ee z\u016fsta\u0148te s n\u00e1mi a sledujte n\u00e1\u0161 blog na Habru.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=special&amp;utm_campaign=servergame_thirdpost#order\"><img decoding=\"async\" alt=\"Kdo zastavil shredder nebo jak m\u011bl b\u00fdt dokon\u010den quest se zni\u010den\u00edm serveru\" src=\"\/wp-content\/uploads\/2020\/08\/1c05684db1a155b4f84fb44016a9702c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/515522\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u043c\u044b \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u043b\u0438 \u043e\u0434\u043d\u043e \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u044d\u043c\u043e\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e-\u0437\u0430\u0440\u044f\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0430\u043c \u043f\u043e\u0432\u0435\u0437\u043b\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0431\u043b\u043e\u0433\u0430 \u2014 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u043e\u043d\u043b\u0430\u0439\u043d-\u0438\u0433\u0440\u0443 \u0441 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043f\u0440\u0435\u0432\u0437\u043e\u0448\u043b\u0438 \u0432\u0441\u0435 \u043d\u0430\u0448\u0438 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f: \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u0440\u0438\u043d\u044f\u043b\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0435, \u0430 \u0431\u044b\u0441\u0442\u0440\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0441\u043b\u0430\u0436\u0435\u043d\u043d\u043e\u0435 \u043a\u043e\u043c\u043c\u044c\u044e\u043d\u0438\u0442\u0438 \u0438\u0437 620 \u0447\u0435\u043b\u043e\u0432\u0435\u043a \u0432 \u0434\u0438\u0441\u043a\u043e\u0440\u0434\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0448\u0442\u0443\u0440\u043c\u043e\u043c \u0432\u0437\u044f\u043b\u043e \u043a\u0432\u0435\u0441\u0442 \u0437\u0430 \u0434\u0432\u043e\u0435 \u0441\u0443\u0442\u043e\u043a \u0431\u0435\u0437 \u043f\u0435\u0440\u0435\u0440\u044b\u0432\u0430 \u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92628,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92627","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u043c\u044b \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u043b\u0438 \u043e\u0434\u043d\u043e \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u044d\u043c\u043e\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e-\u0437\u0430\u0440\u044f\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0430\u043c \u043f\u043e\u0432\u0435\u0437\u043b\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0431\u043b\u043e\u0433\u0430 \u2014 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u043e\u043d\u043b\u0430\u0439\u043d-\u0438\u0433\u0440\u0443 \u0441 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kto-ostanovil-shreder-ili-kak-nuzhno-bylo-prohodit-kvest-s-unichtozheniem-servera\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0442\u043e \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0448\u0440\u0435\u0434\u0435\u0440 \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0443\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442\u044c \u043a\u0432\u0435\u0441\u0442 \u0441 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u043c\u044b \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u043b\u0438 \u043e\u0434\u043d\u043e \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u044d\u043c\u043e\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e-\u0437\u0430\u0440\u044f\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0430\u043c \u043f\u043e\u0432\u0435\u0437\u043b\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0431\u043b\u043e\u0433\u0430 \u2014 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u043e\u043d\u043b\u0430\u0439\u043d-\u0438\u0433\u0440\u0443 \u0441 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kto-ostanovil-shreder-ili-kak-nuzhno-bylo-prohodit-kvest-s-unichtozheniem-servera\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-29T17:42:16+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-29T17:42:16+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kdo zastavil shredder nebo jak m\u011bl b\u00fdt \u00fakol s ni\u010den\u00edm serveru | ProHoster","description":"P\u0159ed p\u00e1r dny jsme dokon\u010dili jednu z nejv\u00edce emocion\u00e1ln\u011b nabit\u00fdch ud\u00e1lost\u00ed, kterou jsme m\u011bli tu \u010dest organizovat v r\u00e1mci blogu \u2014 hackerskou online hru s destrukc\u00ed serveru.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kto-ostanovil-shreder-ili-kak-nuzhno-bylo-prohodit-kvest-s-unichtozheniem-servera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0442\u043e \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0448\u0440\u0435\u0434\u0435\u0440 \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0443\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442\u044c \u043a\u0432\u0435\u0441\u0442 \u0441 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 | ProHoster","og:description":"\u041f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u043c\u044b \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u043b\u0438 \u043e\u0434\u043d\u043e \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u044d\u043c\u043e\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e-\u0437\u0430\u0440\u044f\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0430\u043c \u043f\u043e\u0432\u0435\u0437\u043b\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0431\u043b\u043e\u0433\u0430 \u2014 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u043e\u043d\u043b\u0430\u0439\u043d-\u0438\u0433\u0440\u0443 \u0441 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kto-ostanovil-shreder-ili-kak-nuzhno-bylo-prohodit-kvest-s-unichtozheniem-servera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-29T17:42:16+00:00","article:modified_time":"2020-08-29T17:42:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92627","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:04:28","updated":"2026-08-11 12:50:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/92627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=92627"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/92627\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/92628"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=92627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=92627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=92627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}