20140714 SITCON Camp 揭開駭客的神祕面紗

2014-07-14 SITCON Camp 揭開駭客的神祕面紗

Transcript

1. 揭開駭客的神祕面紗 
   4*5$0/
   $BNQ 翁浩正 Allen Own allenown@devco.re Ꮦ˃੒ဧٰ΅Ϟࠢʮ̡
2. ᑺ٫ᔊʧ ॽख͍
   "MMFO
   0XO
   %&7$03&
   Ꮦ˃੒ဧٰ΅Ϟࠢʮ̡
   ੂБڗ
   BMMFOPXO!EFWDPSF
   ! )*5$0/
   ̨ᝄᎡ܄ϋึਓᐼ̜
   /*43"
   ༟τྠඟ௴፬ɛ
   ༟τҦঐږ޷ᆤᘩᒄϋڿࠏeϋԭࠏ
   ༟τద᜗ၣ१ታ१ᚥਪ
3. ٷ᧼㔃க൥፞
   )*5$0/
   9
   "%"15
   50
   5)&
   /&8
   &3"
   0'
   4&$63*5:
   5)3&"54
   
   ˾
   _
   
   ̄
   ٷ׸ޠΥḛ৮㑱ൽ㡴˒৴ἵ⃄㋒
   ̙ቢῳ፞⁠୹㒔
   IUUQIJUDPOPSH
5. νОϓމ੶٫k
8. ኪࣧʔ݊Ϟ઺෗k
   މʡჿᒔࠅІʉрɢk
9. ኪࣧ઺ԃ
   ଣሞeʫ̌
 
 ุޢ
   ྼਕeуࣛ኷ɢe؛̌
10. ኪࣧ઺ԃ
    ଣሞeʫ̌ 
 ุޢ
    ྼਕeуࣛ኷ɢe؛̌ ๖
11. ৷
    ʕ ɽ ኪ ޼ Ӻ ה ఱ ุ
12. ৷
    ʕ ɽ ኪ ޼ Ӻ ה ఱ ุ 為什麼？
13. ৷
    ʕ ɽ ኪ ޼ Ӻ ה ఱ ุ ????
14. ৷
    ʕ ɽ ኪ ޼ Ӻ ה ఱ ุ ㄨ
15. ੽ྼਕࠦ̈೯
    ᓘ՟ุޢeၣ༩ɪٙٝᗆ
    ໾ԑኪࣧίྼਕɪٙʔԑ
16. ᜊ੶ٙږᝌjІ˴ኪ୦
17. 老老師領領進門，修行行在個㆟人
20. І˴ኪ୦ ഛ͜ၣ༩ɪٙ઺ኪ༟๕
    ʔࠅ׊ᔊ᜗ʕ˖eߵ˖
    й፰ဲdਗ˓ਂఱ࿁əl
    ϓఱชܘࠠࠅl
21. ʔࠅ׊̰઻
    ̰઻ٙɛdʑ݊ኪՑ௰εٙ
22. ࡳԬٝᗆ݊Ңࡁ̀௪ٙճk
23. ೻όႧԊ
    $
    
    $
    
    +BWB
    
    $
    ໔͉ႧԊ
    4DSJQUJOH
    -BOHVBHF
    4IFMM
    4DSJQU
    
    +BWB4DSJQU
    
    1ZUIPO
    
    3VCZ
    
    1FSM
    ၣࠫᏐ͜೻όႧԊ
    "41/&5
    
    1)1
    
    +41
    
    3P3
    Бਗༀໄ೻όႧԊ
    
    "OESPJE
    +BWB
    
    J04
    0CKFDUJWF$
    
    8JOEPXT
    1IPOF
24. νО፯኿೻όႧԊk 5*0#&
    1SPHSBNNJOH
    $PNNVOJUZ
    *OEFY
    IUUQXXXUJPCFDPNJOEFYQIQDPOUFOUQBQFSJOGPUQDJ JOEFYIUNM
    ੽રБᒈැ̙˸޶ՑႧԊٙᆠژ೻ܓ˸ʿุޢٙცӋ
27. ڐಂ༟τࠅၲ
28. ᒄژ᚛дj
    ̘ϋΌଢϞᄂഅࡈ༟̮ރ ᒄژ᚛д௰อ*453ၣ༩τΌ۾উజѓܸ̈d̘ϋ೯͛ٙ ༟τԫ΁ᜑͪdᎡ܄ҸᏘ੽Ҟ஺ҸᏘᔷމڗಂᆑͿٙɓ ϣ׌ɽ஝ᅼҸᏘdϋΌଢߒϞᄂഅ༟̮ࣘރf
    ί༈జѓ୕ࠇʕd̨ᝄίϋ዆᜗ၣ༩۾উʕΤΐΌ ଢୋdԭݲසϣ׵ʕ਷eΙܓf਷ʫϞٙ০࿁׌ ҸᏘᕁ֛Ցɛ஝ᅼٙʕɽۨΆุdҭ೯ʿႡி ุމҸᏘᕁ֛ٙՇɽପุfϾ̘ϋ̨ᝄչѫඉ΁રΤ੽ ୋΤɪʺЇୋdⶋ܉ၣ༩ɰરΤୋf IUUQXXXJUIPNFDPNUXOFXT
29. F#BZ
    ቊල܄ɝڧ
 
    ᄂ͜˒༟̮ࣘރ F#BZ
    ˚ί֜˙ၣ१ʮ̺dʦϋ˜ֵЇ˜ڋd ᄂ܄˒ٙཥඉήѧe̋੗ܝٙ੗ᇁë͛˚ಂʿИѧ ഃᅰኽ஗ೳ՟dШ஗ೳ՟ٙ˖΁Ѱʔўৌਕ༟ࣘfʮ ̡ڮሗᄂ͜˒һҷ੗ᇁf
    F#BZڌͪdմۃ೯ତவԬቊᎡٙਪᕚኯᗇdމə࿏ֵ ૶ݟਪᕚdה˸ٜՑ˚ʑʮ̺dШ൷ᕎ˜ڋቊල܄ ɝڧࣛගʊ຾ڐࡈ˜f IUUQXXXCCDDPVL[IPOHXFOUSBEXPSME@FCBZ@IBDLFSTIUNM
30. "0-վוӻ୕ቊɝڧd
 Ꭱ܄̙ঐπ՟ɽඎԴ͜٫੮໮ "0-ᆽႩᎡ܄͊຾બᛆπ՟əўϞɽඎԴ͜٫੮໮ٙУ ؂ኜdܼ̍͜˒ٙཥɿඉ΁੮໮eήѧeஷৃ፽e̋ ੗ٙ੗ᇁe̋੗ٙτΌஷᗫ੗Ⴇd˸ʿʈЪఊЗdϾ ˲"0-ɰ޴ڦչѫᔥʊ຾ෂ৔ൟᗺඉ΁ഗߒ͜˒ٙ ஷৃ፽ʾɛf IUUQXXXJUIPNFDPNUXOFXT
31. ߕ਷ཧਯਠ*5ӻ୕௘Κዚ
 ৰə5BSHFUε࢕ཧਯਠɰቊݪ ௰ڐdԨʔස˟׵
    5BSHFU
    ɓ࢕೯͛ࠠɽ༟̮ࣘރԫ΁f ࣬ኽ༩ீٟܸ̈dίື˚ᒅي֙ಂගdৰə
    5BSHFU
    ၾ /FJNBO
    .BSDVT
    ʘ̮ٙ஢εཧਯਠdɰቊՑᎡ܄ҸᏘf
    ɪ඄
    5BSHFU
    ீᚣܸ̈dᎡ܄᛿՟ə΍ ຬഅٙᚥ܄ ֑Τeඉ΁ήѧeཥ༑໮ᇁeཥɿඉ΁ήѧၾ˕˹̔ ༟ࣘdШ̘ϋ˜ʕϚৎ΋జኬ፲̰ٙഅᅰމ ຬ അf IUUQOFXTOFUXPSLNBHB[JOFDPNUXDMBTTJGJDBUJPOTFDVSJUZ
32. ӚϞʔτΌٙӻ୕
 ̥ϞʔτΌٙɛ
35. A Nice Password, but….? Admin password Admin.R386W
36. Is Your Password Safe?
37. ΋ซซІʉϞӚϞਂՑτΌf ׉ໆӻ୕ʔτΌʘۃd
38. ༟τ۾উၾᏐ࿁ ԣጏ٫Ԩʔᆞ઄ҸᏘ٫ٙː࿒eͦٙeҦஔഃdኬߧ ԫ΁೯͛ܝʑঐආБࡌ໾fϾʔٝ༸ҸᏘٙҦஔၾ˙ جdࡌ໾ɰසطᅺʔط͉
    ෂ୕ٙԣጏ˙όdܼ̍ӻ୕ࡌ໾eԣጏe̋੗dேΪ อҦஔɓɓ஗ॎ༆dԷνʱ౳όஈଣeථ၌e(16e 3BJOCPX5BCMF
39. ༟τ۾উၾᏐ࿁ ٝʉٝ־dϵ኷ʔݫ
    ኪ୦Ꭱ܄ٙܠၪd௰อٙҦஔdԨ˲ə༆Іʉӻ୕ٙ ঌࢮᓃӺ௞ίОஈ
40. Cyberwar
    ݊ʡჿk
41. http://www.flickr.com/photos/42514833@N07/5246970893/ Cyberwar
42. ၣ༩኷͍ίආБʕl
43. Ŗϓၣ༩ගፒҸᏘ
    ԸІ਷࢕ॴዚ࿴೯ਗ ࣬ኽ
    
    ϋ
    7FSJ[PO
    ௰อ೯̺ٙ
    
    ༟̮ࣘރሜݟజ ѓܸ̈dίሜݟڐ΁ٙၣ༩ගፒҸᏘԫ΁ʕdϞ ݊ԸІ׵਷࢕ִ݁ॴዚ࿴ٙ೯ਗdՉʕऒʿ༟̮ࣘރٙҸ Ꮨݺਗۆ݊Цəfజѓɰܸ̈dϞਗ਼ڐɓ̒  ٙ ၣ༩ගፒݺਗேԸІ׵ʕ਷ձՉ̴؇ԭ਷࢕ה˴ኬd̤̮ ɰϞĈۆ݊ԸІ؇ᆄήਜ਷࢕f຅ʕһϞ൴ཀ̒ᅰ˸ɪ ٙၣ༩ගፒҸᏘ࿁൥݊˸ߕ਷މ˴dՉϣ݊˚͉  ձᒵ ਷  f
    IUUQXXXJUIPNFDPNUXOFXT
44. Ꭱ܄ᜣ့ཥൖ̨ვБ
    یᒵజኬj̏ᒵהމ یᒵɪ˜ቊᎡ܄ɝڧdε࢕ཥൖ̨ձვБΌࠦᜣ့d یᒵᙆ˙ɓܓ၈Ꭱ܄ҸᏘԸІʕ਷dܝҷɹ݊ߕ਷ʿ ᆄݲഃࡈ਷࢕dШʦ˂یᒵʮ̺͍όజѓdܸછ̏ᒵ ᆽމவৎҸᏘࣩٙ˴ፑdᘪ೥ࣛගڗ༺˜ʘɮf
    IUUQXXXBQQMFEBJMZDPNUXSFBMUJNFOFXTBSUJDMFJOUFSOBUJPOBM
45. Ꭱ܄त၇௅ඟ ږ㛬Έˏ͜ɓ΅̏ᒵִ݁֜˙˖΁༟ܸࣘ̈d̏ᒵʊ ݂ჯኬɛږ͍˚ϋᒔፋІɨ˿ਗ਼ணί̻ᘎٙၣ༩ त၇௅ඟᓒᇜЇ ɛdᒱ್༈΅˖΁ٙॆྼ׌͊຾ ᆽႩdШږ㛬ΈኽϤౣ಻d̏ᒵᎡ܄ɛᅰʘܝʊɽష ᄣ̋dϞԬ݊ݼታʕ਷d˸ک੽ԫသீऎ̮ၣ༩ٙ΂ ਕf
    IUUQOFXTDIJOBUJNFTDPNXPSMEIUNM
47. Die Hard 4.0
48. ၣ༩኷ٙͦٙ݊ʡჿk ᛿՟਷࢕ઋజ
    ᜣ့ၣ༩
    ਔ॰
    ܁౮ІҢଣׂ
49. Ꭱ܄݊ʡჿk What is Hacker?
50. http://www.flickr.com/photos/torh/5275187124/
51. Ꭱ܄݊ʡჿ Ꭱ܄
    )BDLFS
    ࡡจމ
 ˜ᆠহ׵ཥ໘ӻ୕Ҧஔ޼Ӻٙਖ਼࢕™
    ɽඎႬ͜ɨ˜Ꭱ܄™ɓ൚੭ϞࠋࠦЍ੹d੬މ ڢجెจॎᕸeɝڧӻ୕ٙɛ
52. Ꭱ܄݊ʡჿ White Hat 白帽駭客 ༟τਖ਼࢕d࿁ӻ୕τΌආБ޼ӺԨԣጏࡌ໾fεᅰ ੽ԫ༟ৃτΌ޴ᗫБุ
    Black Hat 黑帽駭客 ආБ͕ໆٙɝڧБމdਖ਼̡ॎᕸd˸ۃ͵̙၈ މ
    $SBDLFS
53. Ꭱ܄݊ʡჿ (SFZ
    )BU
    ϲసᎡ܄
    ʧ׵
    8IJUF
    )BU
    ʿ
    #MBDL
    )BU
    ʘග
    4DSJQU
    ,JEEJF
    ҦஔʔॱᆞאʔᏑࡡଣd̥ึԴ͜ତϞҸᏘ೻ όආБెจॎᕸٙҸᏘ٫d஗Ꮥ၈މ
    4DSJQU
    ,JEEJFdͦۃεᅰెจॎᕸ٫ޫ݊
55. Ꭱ܄ଡ଼ᔌ ֜˙ᇜՓ
    ਷࢕
    ִ݁
    Άุ
    ڢ֜˙ᇜՓ€ήɨ
56. Ꭱ܄ҸᏘٙͦᅺ ͦᅺjУ؂ኜ
    
    ࡈɛཥ໘
    ెจᎡ܄މə༺ՑݔԬͦٙdึҸᏘУ؂ኜא ࡈɛཥ໘fʔΝٙͦᅺึϞʔΝٙҸᏘ˓جd ɰึϞഹʔΝٙͦٙf
57. ၣ१஗ɝڧٙܝ؈k Ꭱ܄Ցֵࠅٙ݊ʡჿk
58. ၣ१஗ɝڧٙܝ؈k 
    ᛿՟ၣ१ʫ௅༟ࣘ
    
    ਂމ༪ؐҸᏘՉ˼˴ዚ
    
    નᇁא׳ໄెจ೻ό
    
    ໄ౬ࠫࠦאॎᕸ
    
    ᛿՟१ʫ੮໮੗ᇁࡈ༟
64. Ꭱ܄՟੻੮໮੗ᇁνОԴ͜ 
    ০࿁׌ٙೳ͜ݔ੮໮
    
    ՟੻၍ଣ٫ᛆࠢ
    
    ਗ਼੗ᇁᏦႡЪϓοՊᏦ
67. ࡈɛཥ໘஗ɝڧٙܝ؈k Ꭱ܄Ցֵࠅٙ݊ʡჿk
68. ࡈɛཥ໘஗ɝڧٙܝ؈k  ᛿՟ཥ໘ʫ௅༟ࣘ
     ᛿՟ཥ໘ʫ੮໮੗ᇁࡈ༟
     ਂމ༪ؐҸᏘՉ˼˴ዚ
69. 㔃கሯᇜḢပᚓ㢂
70. ೸⁰ഥ ␶㉺ ⁔ፇ ሟᇌ␹ ༃༦⾬̳ ⳽୷⭶ё ῳ̎ഇ₁༓༶⾽̿
71. ೸⁰ഥ ␶㉺ ⁔ፇ ሟᇌ␹ ⳽୷⭶ё ᖤஞቒ̳ ῳ̎ഇ₁༓༶⾽̿
72. ሟᇌ␹ ⳽୷⭶ё ⋣⃳ ⳽ቛൻ #PUOFU %%P4
    ሯᇜ
73. ሟᇌ␹ ⳽୷⭶ё ⋣⃳ ⳽ቛൻ #PUOFU %%P4
    ሯᇜ
74. ሟᇌ␹ ⳽୷⭶ё ⋣⃳ ⳽ቛൻ ṬᄍӴξͥ፦࠵
75. http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/ 你更新了嗎？
76. 你更新了嗎？
77. ੬ԈτΌဍݸ࡚ؓ
78. ၣ१༟ৃރဍ ၣ१፹Ⴌৃࢹ͊ᒯᔛ
    У؂ኜක೯٫و͉છ၍ࠫࠦ͊୅ৰ
    ၣࠫУ؂ኜක઼ͦ፽ΐڌ
    *OEFY
    0G
    ࠬᎈjഗʚᎡ܄ɝڧٙ༟ৃdܼ̍ӻ୕ৣໄeͦ፽dޟ Ї੮໮e੗ᇁഃ
79. ⊷ਘῠ῵໊aіa⊷ਘῠ଀Ẁ஥ᇂ
80. ↌ᅟℯⅴਫ਼῅
82. ？
83. B 網站 密碼：1qaz2wsx C 網站 密碼：1@#$%^%^*ag 密碼：1qaz2wsx A 網站 (遭⼊入侵) (⼊入侵)
84. ၍ଣ٫͊းப΂ ᒯਛʔజ
    
    ˏ೯һᘌࠠٙԫ࿒
    પ՝ப΂
    
    ೌج༆Ӕਪᕚ
    ಴๘ᗇኽ
    
    ਪᕚԱᔚπίdᎡ܄ஶჇІί
88. ၣ१τΌᏨ಻νОྼЪ
89. ၣ१τΌᏨ಻νОྼЪ ݟ༔У؂ኜeࢁ΁ٙو͉༟ৃ
    ᝈ࿀ၣ१ࠫࠦeʩ९eආɝᓃ
    ഗʚ͍੬ٙ፩ɝeମ੬ٙ፩ɝdᝈ࿀ၣ१ٙˀᏐʿৃ ࢹ
    5SJBM
    BOE
    &SSPS
90. ಻༊ʈՈ .BOUSB
    IUUQXXXHFUNBOUSBDPN
    #VSQ
    4VJUF
    IUUQQPSUTXJHHFSOFUCVSQ
    'JEEMFS
    IUUQGJEEMFSDPN
92. τΌᏨ಻ʃҦ̷ Ꮸ಻ၣ१݊щಀ஗Ꭱ
    IUUQXXXHPPHMFDPNTBGFCSPXTJOHEJBHOPTUJD TJUF
    IUUQ[POFIPSH
    IUUQXXXNBMXBSFEPNBJOMJTUDPNNEMQIQ
    IUUQXXXVSMWPJEDPN
93. Ꭱ܄ٙܠၪ༧Ңࡁʔɓᅵ
95. Injection? Path? Path?
97. admin ‘ or 1=1 -- admin
 abc123
 123456
 password 3939889
 19831001
 A12345678 87468c07c02e370ef84d4b7e3a668589 Try to get the password WordPress Vulnerability?
98. Ꭱ܄ҸᏘݴ೻ 3FDPOOBJTTBODF
    4DBOOJOH
    (BJOJOH
    "DDFTT
    .BJOUBJOJOH
    "DDFTT
    $MFBSJOH
    5SBDLT Reconnaissance Scanning Gaining
 Access Maintaining
 Access Clearing
 Tracks
99. ॆྼҸᏘԫԷ Ꭱ܄຾͟ၣ१ҬՑɪෂeᄳᏦഃࢮᓃdಔɝ
    XFCTIFMM
    ܝژஹɝ˴ዚf
    IUUQWJDUJNPSHTIFMMQIQ DNEPYPY
    ΢၇ၣࠫτΌਪᕚޫ̙л͜dܼ̍ᄳᏦeҷᏦeɪ ෂᏦࣩf
100. ॆྼҸᏘԫԷ
     $POU ஹɝ˴ዚܝ೯ତ੮໮ᛆࠢʔԑd੽˴ዚʫరҬ̙ٙ͜ ༟ৃf
     ᛆࠢjOPCPEZOPHSPVQ
     Ҭర̙͜੮໮
     FUDQBTTXE
     ݟ༔ӻ୕̙͜༟ৃ
     WBSMPH
     ฤరϞೌ
     TFUVJE
     GJMFT
     ̙Զл͜
101. ॆྼҸᏘԫԷ
     $POU ೯ତ˴ዚ
     ,FSOFM
     و͉ཀᔚdϞ̙౤ᛆٙࢮᓃf
     ᅠᄳ
     
     ฤర
     &YQMPJU
     ҸᏘd՟੻
     SPPU
     ᛆࠢf
     IUUQXXXFYQMPJUECDPN
     (PPHMF
     #Z
     ZPVSTFMG
102. ॆྼҸᏘԫԷ
     $POU ׳ໄܝژ
     
     3PPULJU
     ˸Զ˚ܝԴ͜f
     FUDQBTTXE
     ܔͭ੮໮
     FUDSDE
     ׳ໄܝژ
     ˾౬
     TTIE
     ഃ
103. ॆྼҸᏘԫԷ
     $POU ૶ৰԑ༦jা፽Ꮶʿӻ୕ߏ፽
     _IJTUPSZ
     _CBTI@IJTUPSZ
     WBSMPH
104. ၣ༩݊τΌٙ෗k
106. 8FMDPNF
     UP
     QIQ.Z"ENJO
     "/%
     
 
     $SFBUF
     OFX
     EBUBCBTF
     GJMFUZQFQIQ
110. -BC
111. ІҢኪ୦
112. ༟τהცٙٝᗆߠ౻ၾҦঐ ༟ৃϗණ
     *OGPSNBUJPO
     (BUIFSJOH
     ӻ୕τΌ
     4ZTUFN
     4FDVSJUZ
     ၣ༩τΌ
     /FUXPSL
     4FDVSJUZ
     ၣ१ၾၣࠫᏐ͜೻ότΌ
     8FC
     4FDVSJUZ
     ̋੗ၾ༆੗
     $SZQUPHSBQIZ
     ెจ೻όᏨ಻
     .BMXBSF
     %FUFDUJPO
     ৕Σʈ೻
     3FWFSTJOH
     &OHJOFFSJOH
     ᅰЗᛠᗆ
     %JHJUBM
     'PSFOTJDT
     Бਗༀໄ
     .PCJMF
     %FWJDFT
113. ІҢᇖ୦ IUUQTXXXPXBTQPSHJOEFYQIQ$BUFHPSZ08"41@8FC(PBU@1SPKFDU
     IUUQTQFOUFTUFSMBCDPN
     IUUQXXXEWXBDPVL
     IUUQXXXIBDLUIJTTJUFPSH
     IUUQIBDLBEFNJDUFJMBSHS
     IUUQTIBDLNF
     IUUQ[FSPXFCBQQTFDVSJUZDPN
     IUUQTPVSDFGPSHFOFUQSPKFDUTNVUJMMJEBF
115. 2
     
     "
116. ᑌഖ˙ό ߰Ϟ΂ОٙဲਪdᛇڎᎇࣛၾҢᑌᖩf
     " " ॽख͍
     "MMFO
     0XO
     IUUQEFWDPSF
     BMMFOPXO!EFWDPSF