{"id":38822,"date":"2019-10-31T22:26:11","date_gmt":"2019-10-31T19:26:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/reshenie-zadaniya-s-pwnable-kr-25-otp-ogranichenie-ramera-fajla-v-linux\/"},"modified":"2019-10-31T22:26:11","modified_gmt":"2019-10-31T19:26:11","slug":"reshenie-zadaniya-s-pwnable-kr-25-otp-ogranichenie-ramera-fajla-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/reshenie-zadaniya-s-pwnable-kr-25-otp-ogranichenie-ramera-fajla-v-linux","title":{"rendered":"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/70434b41e923b3b46bcdff1ab7e03937.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nEn este art\u00edculo resolveremos la tarea 25 del sitio <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnable.kr\/index.php\">pwnable.kr<\/a><\/noindex>.<\/p>\n<p><b class=\"spoiler_title\">Informaci\u00f3n organizativa<\/b>Espec\u00edficamente para aquellos que quieren aprender algo nuevo y desarrollarse en cualquiera de las \u00e1reas de la seguridad inform\u00e1tica, escribir\u00e9 y hablar\u00e9 sobre las siguientes categor\u00edas:<\/p>\n<ul>\n<li>PWN;<\/li>\n<li>criptograf\u00eda (Crypto);<\/li>\n<li>tecnolog\u00edas de red (Network);<\/li>\n<li>ingenier\u00eda inversa (Reverse Engineering);<\/li>\n<li>esteganograf\u00eda (Stegano);<\/li>\n<li>b\u00fasqueda y explotaci\u00f3n de vulnerabilidades en la WEB.<\/li>\n<\/ul>\n<p>\nAdem\u00e1s de esto, compartir\u00e9 mi experiencia en la inform\u00e1tica forense, an\u00e1lisis de malware y firmware, ataques a redes inal\u00e1mbricas y redes computacionales locales, realizaci\u00f3n de pentests y escritura de exploits.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPara que puedan conocer nuevos art\u00edculos, software y otra informaci\u00f3n, he creado <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/RalfHackerChannel\">un canal en Telegram<\/a><\/noindex> y <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/RalfHackerPublicChat\">un grupo para discutir cualquier pregunta<\/a><\/noindex> en el \u00e1rea de seguridad inform\u00e1tica. Tambi\u00e9n considerar\u00e9 personalmente y responder\u00e9 a todas sus solicitudes, preguntas, propuestas y recomendaciones <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/hackerralf8\">de forma individual.<\/a><\/noindex>.<\/p>\n<p>Toda la informaci\u00f3n se presenta exclusivamente con fines educativos. El autor de este documento no asume ninguna responsabilidad por cualquier da\u00f1o causado a cualquier persona como resultado del uso de los conocimientos y m\u00e9todos adquiridos al estudiar este documento.<\/p>\n<h2>Soluci\u00f3n de la tarea otp<\/h2>\n<p>\nContinuamos con la segunda secci\u00f3n. Diremos de inmediato que es m\u00e1s complicada que la primera, pero esta vez nos proporcionan el c\u00f3digo fuente del programa. No olviden sobre la discusi\u00f3n aqu\u00ed (https:\/\/t.me\/RalfHackerPublicChat) y aqu\u00ed (https:\/\/t.me\/RalfHackerChannel). Empecemos.<\/p>\n<p>Hacemos clic en el \u00edcono con la etiqueta otp. Nos dan la direcci\u00f3n y el puerto para conectarnos.<\/p>\n<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/fec98a1c755c36ba1a7117bfc5154611.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNos conectamos y exploramos el servidor.<\/p>\n<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/71983f5701fe2b1366cebfb0d2d57f74.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLa bandera que no podemos leer, el programa y su c\u00f3digo fuente. Vamos a ver el c\u00f3digo fuente.<\/p>\n<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/63e409cd939f41db29ee5c1edfa107a0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLo desensamblamos. El programa toma como argumento una contrase\u00f1a.<\/p>\n<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/5eb6bccb7ed4b82fdd01e24854c2c953.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLuego se guarda en la variable otp 16 bytes aleatorios.<\/p>\n<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/c1420a16c9721a8c87fb86277674f0f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEn la carpeta tmp se crea un archivo con un nombre aleatorio (los primeros 8 bytes de otp) y se escriben 8 bytes aleatorios (los segundos 8 bytes de otp).<\/p>\n<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/d6fcc612f6cddbff338fff0aaf9b73a1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPor alguna raz\u00f3n, se lee el valor del archivo creado y se compara con la contrase\u00f1a ingresada.<\/p>\n<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/42302a748b7cd57a6337be00eab2c47b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAqu\u00ed es donde est\u00e1 la vulnerabilidad. Consiste en que el n\u00famero generado se guarda temporalmente en un archivo. Podemos limitar el tama\u00f1o del archivo, por ejemplo, a 0, de modo que al escribir y leer con la contrase\u00f1a se comparar\u00e1 con 0. Esto se puede hacer as\u00ed.<\/p>\n<pre><code class=\"bash\"># ulimit -f 0<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/3af83c20d1de7435b0f40a36c8187ff0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAhora ejecutemos el programa.<\/p>\n<p><img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/a289bd59a22aa495fe6407c3c8ff0416.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRecibimos un error. No te preocupes, se puede manejar con el mismo Python.<\/p>\n<pre><code class=\"python\">python -c \"import os, signal; signal.signal(signal.SIGXFSZ, signal.SIG_IGN); os.system('.\/otp 0')\" <\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Resoluci\u00f3n de la tarea con pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux\" src=\"\/wp-content\/uploads\/2019\/10\/b8513f020879d5e5ee957e1bc137b61a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nObtenemos la bandera y nuestros f\u00e1ciles 100 puntos. Y continuamos: en el pr\u00f3ximo art\u00edculo hablaremos sobre Web. Puedes unirte a nosotros en <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/RalfHackerChannel\">Telegram<\/a><\/noindex>.<br \/>\n<br \/>Fuente: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/471042\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0435\u0448\u0438\u043c 25-\u0435 \u0437\u0430\u0434\u0430\u043d\u0438\u0435 \u0441 \u0441\u0430\u0439\u0442\u0430 pwnable.kr. \u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0442\u0435\u0445, \u043a\u0442\u043e \u0445\u043e\u0447\u0435\u0442 \u0443\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0447\u0442\u043e-\u0442\u043e \u043d\u043e\u0432\u043e\u0435 \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u043b\u044e\u0431\u043e\u0439 \u0438\u0437 \u0441\u0444\u0435\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u044f \u0431\u0443\u0434\u0443 \u043f\u0438\u0441\u0430\u0442\u044c \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044f\u0445: PWN; \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044f (Crypto); c\u0435\u0442\u0435\u0432\u044b\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 (Network); \u0440\u0435\u0432\u0435\u0440\u0441 (Reverse Engineering); \u0441\u0442\u0435\u0433\u0430\u043d\u043e\u0433\u0440\u0430\u0444\u0438\u044f (Stegano); \u043f\u043e\u0438\u0441\u043a \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f WEB-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412\u0434\u043e\u0431\u0430\u0432\u043e\u043a \u043a \u044d\u0442\u043e\u043c\u0443 \u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29120,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/reshenie-zadaniya-s-pwnable-kr-25-otp-ogranichenie-ramera-fajla-v-linux\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"es_ES\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u0437\u0430\u0434\u0430\u043d\u0438\u044f \u0441 pwnable.kr 25 \u2014 otp. \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0440\u0430\u043c\u0435\u0440\u0430 \u0444\u0430\u0439\u043b\u0430 \u0432 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/reshenie-zadaniya-s-pwnable-kr-25-otp-ogranichenie-ramera-fajla-v-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:26:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:26:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Soluci\u00f3n del desaf\u00edo de pwnable.kr 25 \u2014 otp. L\u00edmite de tama\u00f1o de archivo en Linux | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/reshenie-zadaniya-s-pwnable-kr-25-otp-ogranichenie-ramera-fajla-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u0437\u0430\u0434\u0430\u043d\u0438\u044f \u0441 pwnable.kr 25 \u2014 otp. \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0440\u0430\u043c\u0435\u0440\u0430 \u0444\u0430\u0439\u043b\u0430 \u0432 Linux | ProHoster","og:url":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/reshenie-zadaniya-s-pwnable-kr-25-otp-ogranichenie-ramera-fajla-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:26:11+00:00","article:modified_time":"2019-10-31T19:26:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:33:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:01:37","updated":"2026-01-23 23:33:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/38822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=38822"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/38822\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media\/29120"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=38822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=38822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=38822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}