Upgrade to Pro — share decks privately, control downloads, hide ads and more …

セキュリティの夕べ20161124_公開用.pdf

 セキュリティの夕べ20161124_公開用.pdf

「セキュリティの夕べ」で発表した資料です。Walti.ioさくらクーポンが配布されました。ぜひお使いください。 https://walti.io #さくらの夕べ

FUJISAKI Masanori

November 24, 2016
Tweet

More Decks by FUJISAKI Masanori

Other Decks in Programming

Transcript

  1. 8BMUJJPΛ࢖ͬͯ ̋̋ͷηΩϡϦςΟ਍அ ΍ͬͨͬͨʔʂ ηΩϡϦςΟͷ༦΂ גࣜձࣾ΢ΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ೔ຊ.41ڠձ

  2. 2016/11/24 © Walti, Inc. ࣗݾ঺հ • ౻࡚ ਖ਼ൣ 'VKJTBLJ.BTBOPSJ גࣜձࣾϋʔτϏʔπ

    ୅දऔక໾ גࣜձࣾ΢ΥϧςΟ ୅දऔక໾ ೔ຊ.41ڠձ ཧࣄ • ೥ʹגࣜձࣾϋʔτϏʔπΛઃཱ • ೥݄ʹגࣜձࣾ΢ΥϧςΟΛઃཱ • ೥݄ʹ೔ຊ.41ڠձͷઃཱʹࢀը ΠϯϑϥΤϯδχΞͱͯ͠׆ಈ͢Δ๣Βɺ೔ຊͷ αʔόʔͷηΩϡϦςΟਫ४Λ্͍͛ͯ͜͏ͱ ʮαʔόʔαΠυͷηΩϡϦςΟεΩϟϯΛ਎ۙʹ ͢Δ׆ಈʯΛ΢ΥϧςΟͰ࣮ࢪதɻۀքஂମͰ͸ .41ͷೝ஌౓޲্ʹ౒ΊΔɻ
  3. 2016/11/24 © Walti, Inc. ͯ͞

  4. 2016/11/24 © Walti, Inc. ͍͖ͳΓͰ͕͢ ΫΠζͰ͢ɻ

  5. 2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ͸ ͲΕͰ͠ΐ͏ʁ

  6. 2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ͸ ͲΕͰ͠ΐ͏ʁ  ͘͞Βͷ౦ژΦϑΟε

  7. 2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ͸ ͲΕͰ͠ΐ͏ʁ  ͘͞Βͷ౦ژΦϑΟε  ͘͞ΒͷφϨοδ

  8. 2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ͸ ͲΕͰ͠ΐ͏ʁ  ͘͞Βͷ౦ژΦϑΟε  ͘͞ΒͷφϨοδ

     ాத͞Μͷݸਓαʔό
  9. 2016/11/24 © Walti, Inc. ࠓճεΩϟϯͨ͠ͷ͸ ͲΕͰ͠ΐ͏ʁ  ͘͞Βͷ౦ژΦϑΟε  ͘͞ΒͷφϨοδ

     ాத͞Μͷݸਓαʔό ਖ਼ղ˒
  10. ηΩϡϦςΟͷ༦΂ גࣜձࣾ΢ΥϧςΟ ౻࡚ਖ਼ൣ גࣜձࣾϋʔτϏʔπ ೔ຊ.41ڠձ 8BMUJJPΛ࢖ͬͯ ͘͞ΒͷφϨοδͷ ηΩϡϦςΟ਍அ ΍ͬͨͬͨʔʂ

  11. 2016/11/24 © Walti, Inc. ͸͡Ίʹ

  12. ͸͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ 2016/11/24 © Walti, Inc.

  13. ͸͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.

  14. ͸͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.

    ࣗ৴Λ΋ͬͯճ౴͢Δʹ͸ ঢ়گΛ೺Ѳ͍ͯ͠Δ͜ͱ͕େ੾
  15. ͸͡Ίʹ ηΩϡϦςΟରࡦɺόονϦ͍ͯ͠·͔͢ʁ ➜ όονϦ͍ͯ͠·͢ Ұ෦͍ͯ͠·͢ ͍ͯ͠·ͤΜ 2016/11/24 © Walti, Inc.

    ࣗ৴Λ΋ͬͯճ౴͢Δʹ͸ ঢ়گΛ೺Ѳ͍ͯ͠Δ͜ͱ͕େ੾ ʢͰ΋༧ࢉͳ͍͜ͱଟ͍…ʣ
  16. ଛ֐ഛঈͷ൑ྫ΋ʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛ֐ഛঈʹͭͳ͕Δ͜ͱ΋ɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$൑ྫθϛ  ଛ֐ഛঈ੥ٻࣄ݅

    ౦ژ஍ํࡋ൑ॴ൑ܾฏ੒೥ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥22,523,697ʂ ߹ܭड஫ֹ(¥9,788,100)ͷ 2ഒҎ্…
  17. ଛ֐ഛঈͷ൑ྫ΋ʜ 42-ΠϯδΣΫγϣϯରࡦ͍ͯ͠ͳ͍ͱɺଛ֐ഛঈʹͭͳ͕Δ͜ͱ΋ɻ 2016/11/24 © Walti, Inc. ग़య 40'5*$൑ྫθϛ  ଛ֐ഛঈ੥ٻࣄ݅

    ౦ژ஍ํࡋ൑ॴ൑ܾฏ੒೥ ϫ ୈ߸ IUUQXXXTPGUJDPSKQTFNJ@PQQEG ¥109,135,528ʂ ߹ܭड஫ֹ(¥9,788,100)ͷ 10ഒҎ্…
  18. ʮ৘ใηΩϡϦςΟେڴҖ ʯ 2016/11/24 © Walti, Inc. ग़య ৘ใॲཧਪਐػߏ ৘ใηΩϡϦςΟେڴҖ IUUQTXXXJQBHPKQTFDVSJUZWVMOUISFBUTIUNM

    ࣄۀΛܧଓʹ͸ αʔόʔॏཁɻ
  19. 2016/11/24 © Walti, Inc. ͯ͞ ࠓճͷຊ୊Ͱ͢

  20. 2016/11/24 © Walti, Inc. ΈΜͳେ޷͖ ͘͞ΒͷφϨοδʂ

  21. ͝ڠྗ͋Γ͕ͱ͏͍͟͝·͢ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷ؅ཧਓ http://knowledge.sakura.ad.jp/ unimal

    Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
  22. ؆୯ͳߏ੒ 2016/11/24 © Walti, Inc. *OUFSOFU ͘͞ΒͷϚωʔδυαʔό

  23. ͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS

  24. ͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS

  25. ͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTT؅ཧ͸͘͞Β͞

    ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4౳ͷηΩϡϦςΟ؅ཧ͸ ϢʔβʔͰରԠ
  26. ͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTT؅ཧ͸͘͞Β͞

    ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4౳ͷηΩϡϦςΟ؅ཧ͸ ϢʔβʔͰରԠ ͪ͜Β͸ ͘͞Β͞Μʹ ͓·͔ͤ
  27. ͘͞ΒͷϚωʔδυαʔό 2016/11/24 © Walti, Inc. ग़లIUUQXXXTBLVSBOFKQNBOBHFETFSWFS ͘͞ΒΠϯλʔωοτ͞Μ͕ Ϛωʔδυͯ͘͠ΕΔαʔϏεɻ • *QUBCMFTQSPDFTT؅ཧ͸͘͞Β͞

    ΜͷαʔϏεϙϦγʔͰܾ·Δ • $.4౳ͷηΩϡϦςΟ؅ཧ͸ ϢʔβʔͰରԠ ͜͜ΛؤுΔʂ
  28. 2016/11/24 © Walti, Inc. 8BMUJJPͰ Ͱ͖Δ͜ͱ

  29. ϑΝΠΞ΢Υʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ

    wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙ΋ରԠ044εΩϟφΛ௥Ճ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొ࿥ͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹ͸ొ࿥ͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯର৅ʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ࢖͑ ·͢ɻ
  30. ϑΝΠΞ΢Υʔϧ wwONBQ IUUQTONBQPSH 8FCαʔόઃఆ wwOJLUP https://cirt.net/Nikto2 44-ূ໌ॻ wwTTMZ[F https://github.com/iSECPartners/sslyze 8FCΞϓϦέʔγϣϯ

    wwTLJQGJTI https://code.google.com/p/skipfish/ ➡ ࠓޙ΋ରԠ044εΩϟφΛ௥Ճ༧ఆͰ͢ɻ 2016/11/24 © Walti, Inc. 10ԁ/ճ 10ԁ/ճ 5ԁ/ճ 100ԁ/ճ 8BMUJJPͰͰ͖Δ͜ͱ 8BMUJJPͷ8FCαΠτ͔ΒϢʔβʔొ࿥ͯ͠ར༻͢ΔϓϥϯͰ͢ɻεΩϟϯΛ͢Δ ͨΊʹ͸ొ࿥ͨ͠8FCαΠτΛΞΫςΟϕʔτ͢Δඞཁ͕͋Γ·͢ɻ ҎԼͷ֤εΩϟϯର৅ʹରԠ͍ͯ͠Δ044εΩϟϯπʔϧΛ̍ճຖͷྉۚͰ࢖͑ ·͢ɻ 8PSE1SFTT ɾɾXQTDBO IUUQTXQTDBOPSH ແྉʂ ϦϦʔε
  31. 2016/11/24 © Walti, Inc. ·ͣ͸ εΩϟϯ͠·͢

  32. IUUQTXBMUJJP΁ΞΫηε 2016/11/24 © Walti, Inc. ͔͜͜Β ΞΧ΢ϯτ࡞੒

  33. ΞΧ΢ϯτొ࿥ 2016/11/24 © Walti, Inc. 'BDFCPPL(JU)VCָ͕

  34. ૊৫Λͭͬͯ͘ 2016/11/24 © Walti, Inc.

  35. ؔ܎ऀΛొ࿥͠·͢ɻ 2016/11/24 © Walti, Inc.

  36. ؔ܎ऀΛొ࿥͠·͢ɻ 2016/11/24 © Walti, Inc. ΈΜͳͰঢ়گ೺Ѳ͢Δ͜ͱ͕ ରԠͷ༏ઌ౓ΛܾΊΔ্Ͱେ੾

  37. ࣍ʹ8BMUJJPʹλʔήοτొ࿥͠·͢ɻ 2016/11/24 © Walti, Inc.

  38. 8BMUJJPʹλʔήοτొ࿥͠·͢ɻ 2016/11/24 © Walti, Inc. LOPXMFEHFTBLVSBBEKQ Λొ࿥

  39. λʔήοτͷॴ༗ऀ֬ೝΛߦ͍·͢ɻ 2016/11/24 © Walti, Inc.

  40. ॴ༗ऀ֬ೝ׬ྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc.

  41. ॴ༗ऀ֬ೝ׬ྃ͠·ͨ͠ɻ 2016/11/24 © Walti, Inc. ॳճ͸'SFFεΩϟϯ ׬શແྉͰ͢ʂ

  42. 2016/11/24 © Walti, Inc. εΩϟϯத…

  43. εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc.

  44. εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. ͍ͬͺ͍ग़ͯΔΑ͏ʹݟ͑Δ ͚Ͳɺޡݕ஌ɾରԠෆཁ΋ ͋ΔͷͰ൵؍͸ෆཁ

  45. ରԠ͠ͳ͚Ε͹ͳΒͳ͍΋ͷ 2016/11/24 © Walti, Inc. छผ ߲໨ ରԠཁ൱ ରԠྫ nikto

    YQPXFSFECZϔομʹ 1)1όʔδϣϯ͕هࡌ͞Ε ͍ͯΔ ਪ঑ QIQJOJͰ [email protected]Λ0GGʹ ͢Δ nikto ΫϦοΫδϟοΩϯά๷ࢭ ͷͨΊͷYGSBNFPQUJPOT ϔομΛฦ͍ͯ͠ͳ͍ ਪ঑ 8PSE1SFTTଆͰग़ ྗ͢ΔΑ͏ʹ͢Δ ͔ɺIUBDDFTTͰ ϔομΛηοτ͢Δ
  46. ରԠ͠ͳ͚Ε͹ͳΒͳ͍΋ͷ 2016/11/24 © Walti, Inc. छผ ߲໨ ରԠཁ൱ ରԠྫ wpscan

    XQDPOUFOUVQMPBEσΟ ϨΫτϦͷϑΝΠϧҰཡ ͕ެ։͞Ε͍ͯΔ ਪ঑ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan XQJODVEFTσΟϨΫτϦ ͷϑΝΠϧҰཡ͕ެ։͞ Ε͍ͯΔ ਪ঑ ϑΝΠϧҰཡΛදࣔ ͠ͳ͍Α͏ʹXFC αʔόͷઃఆΛมߋ ͢Δ wpscan 8PSE1SFTTͷόʔδϣϯ ͕هࡌ͞ΕͨSFBENFϑΝ Πϧ͕αʔόʹଘࡏ͢Δ ਪ঑ SFBENFϑΝΠϧΛ ࡟আ͢Δ wpscan ੬ऑੑͷ͋Δ 8PSE1SFTT  Λ࢖༻ ͍ͯ͠Δ ඞਢ ੬ऑੑ͕मਖ਼͞Εͨ όʔδϣϯʹΞοϓ σʔτ
  47. 2016/11/24 © Walti, Inc. ରԠத… by

  48. 2016/11/24 © Walti, Inc. ͪʔΜ (ϨϯδԻత)

  49. 2016/11/24 © Walti, Inc. ରԠ಺༰

  50. 2016/11/24 © Walti, Inc. ରԠ಺༰

  51. 2016/11/24 © Walti, Inc. ࠶εΩϟϯத…

  52. ࠶εΩϟϯͨ݁͠Ռ 2016/11/24 © Walti, Inc. 8BMUJJPͷதͷਓ

  53. ରԠ࣌ؒ 2016/11/24 © Walti, Inc.

  54. ରԠ࣌ؒ 2016/11/24 © Walti, Inc. ੬ऑੑରԠͷௐࠪɿ I ରԠͷ࡞ۀɿ I ରԠͷಈ࡞νΣοΫ

    I ࡞ۀલόοΫΞοϓɺ εςʔδϯά؀ڥ࡞ۀͳͲ΋ ͍ΕΔͱ͢΂ͯͰEBZ I
  55. ରԠޙͷײ૝ͳͲ 2016/11/24 © Walti, Inc.

  56. ରԠޙͷײ૝ͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷରԠ౳͸άάΕ͹͙͢ • ൃݟɺಛఆͱ͍͏ͷ͕ ීஈ͔ΒΊΜͲ͍͘͞࡞ۀ

    • ߲໨͑͞ग़ͯ͘Ε͹ ΄΅࣌ؒ͸͔͔Βͳ͍ • ࣗ෼ͷ؀ڥͩͬͨΒ ෼΋͔͔Βͳ͍ʂ
  57. ରԠޙͷײ૝ͳͲ 2016/11/24 © Walti, Inc. • ੬ऑੑͷݕࠪɾಛఆ͸8BMUJJPͰɺ ରࡦ͸αΫοͱάάͬͯ΍ͬͯ͠·͏ • εςʔδϯά؀ڥΛৗʹ4ZOD͓ͯ͠

    ͍ͯɺରԠޙεϜʔζʹϦϦʔεͰ͖ Δ͜ͱ͕͜Ε͔Βͷ՝୊
  58. ͞Βʹ 2016/11/24 © Walti, Inc. 

  59. 8PSE1SFTTͷόʔδϣϯΞοϓ࡞ۀͳͲʹ 2016/11/24 © Walti, Inc. IUUQTTOBQVQKQ

  60. 2016/11/24 © Walti, Inc. কདྷʹ޲͚ͨ४උ

  61. εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc.

  62. εΩϟϯͷఆظ࣮ߦΛઃఆ͠Α͏ʂ 2016/11/24 © Walti, Inc. 8PSE1SFTT͸ແྉͳͷͰɺ ि̍ͷνΣοΫΛొ࿥ͯ͠΋ ແྉʂ

  63. 2016/11/24 © Walti, Inc. 8BMUJJP͘͞ΒΫʔϙϯ ຖ݄ԁ෼ΛແྉͰ ͘͞Β͞ΜͷҰ෦ͷ αʔϏεʹεΩϟϯΛ ͔͚Δ͜ͱ͕Ͱ͖·͢ɻ

  64. ·ͱΊ ɾIUUQTXBMUJJP Λ׆༻ͯ͠੬ऑੑΛ೺Ѳ͠ରԠ͠Α͏ʂ ɾ͘͞ΒͷφϨοδɺ ηΩϡϦςΟɺόονϦͬͯΑʂʲॏཁʳ ɾIUUQTTOBQVQKQ ΋ΑΖ͘͠ʂ ɾఆظతʹεΩϟϯ͢Δ͜ͱͰɺ ੬ऑੑ͕ൃੜͨ͠Β͙͢ೝࣝͰ͖ΔΑ͏ʹͯ͠ ܧଓతʹηΩϡϦςΟ؅ཧΛߦ͍ͬͯ͜͏ʂ

    ɾʮ8BMUJJP͘͞ΒΫʔϙϯʯΛ׆༻͢Δͱ ຖ݄ԁ෼8BMUJJP͕࢖͑ΔΑʂ 2016/11/24 © Walti, Inc.
  65. վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷ؅ཧਓ http://knowledge.sakura.ad.jp/ unimal

    Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com
  66. վΊͯ͝ڠྗ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ 2016/11/24 © Walti, Inc. ͘͞ΒΠϯλʔωοτ ܵҪ͞· ͘͞ΒͷφϨοδͷ؅ཧਓ http://knowledge.sakura.ad.jp/ unimal

    Ӭా͞· ͘͞ΒͷφϨοδͷγεςϜαϙʔτ Web੍࡞νʔϜͷͨΊͷ ΫϦΤΠςΟϒɾϓϥοτϑΥʔϜ ʮuniversionsʢϢχόʔδϣϯζʣʯ http://universions.com ಛʹɺࠓճͷاըΛࣗΒ͝ఏҊ௖͍ͨ ܵҪ͞Μͷ༐ؾͱӳஅʹײँ͠·͢ʂ
  67. ͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ 2016/11/24 © Walti, Inc.