[OSCP] Client-side Attacks - Information Gathering

 

1. Download old.pdf from the Mountain Vegetables website on VM #1 by clicking on the OLD button. Use exiftool to review the file's metadata. Enter the value of the Author tag.
   --> OS{8c200b6b1a349b46823a1dc54e6a3989}

1. Start VM #2 and use gobuster to bruteforce the contents of the web server. Specify "pdf" as the filetype and find a document other than old.pdf and brochure.pdf. After you identify the file, download it and extract the flag in the metadata.
   --> OS{e9ea284e4f7dd61f9aad4606a70aaee0}

gobuster dir -u http://192.168.197.197 -w /usr/share/wordlists/dirb/common.txt -x pdf

---

중요하게 체크해야 할 부분들

 

백업 파일 생성 체크
ExifTool은 기본적으로 원본 파일의 백업을 만듭니다. 예를 들어, image.jpg_original과 같은 파일이 생성됩니다.

 백업 파일이 필요 없으면 -overwrite_original 옵션을 사용해야 함