2022年6月27日(月)、早稲田大学 大学院経営管理研究科「サイバーセキュリティ」にて使用したスライドです。
20227-8(WBS)2022 7-8 — 2022-06-27 – p.1/49
View Slide
https://speakerdeck.com/ks91( )WBS2022 7-8 — 2022-06-27 – p.2/49
1 6 6 •2 6 6 •3 6 13 •4 6 13 •5 6 20 I ( ) •6 6 20 I ( ) •7 6 27 ( ) •8 6 27 ( ) •9 7 410 7 411 7 1112 7 1113 7 18 II ( )14 7 18 II ( )15 7 252022 7-8 — 2022-06-27 – p.3/49
+I( )+2022 7-8 — 2022-06-27 – p.4/49
2022 7-8 — 2022-06-27 – p.5/49
3.(1) ( )(2)2022 6 23 ( ) 23:59 JST ( )Waseda Moodle (Q & A )2022 7-8 — 2022-06-27 – p.6/49
( )(1 )2022 7-8 — 2022-06-27 – p.7/49
. . . . . .9 9 ( ) ( ). . .2022 7-8 — 2022-06-27 – p.8/49
U( )⇒. . .2022 7-8 — 2022-06-27 – p.9/49
U( )⇒II↓ ^^;2022 7-8 — 2022-06-27 – p.10/49
YSNS⇒(cf. ). . .↑2022 7-8 — 2022-06-27 – p.11/49
YNFTTech⇒(Tech )II. . . (Alec Peterson)2022 7-8 — 2022-06-27 – p.12/49
T“ ”⇒ ^^;( )⇒ ( )Chain of command2022 7-8 — 2022-06-27 – p.13/49
A( )⇒2022 7-8 — 2022-06-27 – p.14/49
K⇒( )2022 7-8 — 2022-06-27 – p.15/49
M⇒. . .( )( )( )2022 7-8 — 2022-06-27 – p.16/49
OCEOCEO⇒CEO⇒ ( II )2022 7-8 — 2022-06-27 – p.17/49
2022 7-8 — 2022-06-27 – p.18/49
I(. . .)( )2022 7-8 — 2022-06-27 – p.19/49
AliceAlicesudo (superuser do)sudo UNIXMalissa (= Alice)MalissaWBSNFT2022 7-8 — 2022-06-27 – p.20/49
( )αʔό ʮ8#4/'5ʯαʔϏεӡ༻ڥ ΫϥΠΞϯτ ࡏڥ ಉҰਓ·ͨؒ௨৴ܦ࿏.BMJTTB߈ܸऀ ޒेཛྷ͞ΜʁᶃͦͷลͷίϯϐϡʔλͷݖݶΛୣऔɹ Φϓγϣφϧ#PCҰൠΤϯδχΞ ฏԬ͞Μ"MJDFཧऀ ޒेཛྷ͞Μཧऀ͔͠ॻ͖ࠐΊͳ͍ϑΝΠϧ܈FUDQBTTXEFUDHSPVQFUDTIBEPXཧऀ͔͠ಡΈग़ͤͳ͍ϑΝΠϧ܈&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&.#"ެ։伴ᶈެ։伴Λ͢ᶅQBTTXEͱTIBEPXɹΛ͢ᶆαʔόͷ6/*9ύεϫʔυΛΫϥοΫͯ͠ɹ#PCͷύεϫʔυ͕ऑ͍͜ͱΛൃݟˠ#PCҙਂ͘ͳ͍ΤϯδχΞೝఆʂᶉཧऀͱͯ͠ه͢Δᶊ.BMJTTB#PCͱͯ͠ɹϦϞʔτϩάΠϯՄೳʜ˞ࠓճ੨ࣈͷ෦Λ࣮ԋ͠·͢.BMJTTB#PCʹͳΓ͢·ͭͭ͠ɹཧऀͷΑ͏ʹৼΔ͑Δʜ˕"MJDFୀ৬ޙαʔόΛίϯτϩʔϧͰ͖ΔɹͨΊͷखஈΛಘͨᶋ#PCΛTVEPՄʹᶄಡΈग़͠ᶄಡΈग़͠伴ϖΞൿີ伴ΞΞΞΞΞΞΞΞΞΞΞΞΞΞΞΞൿີ伴伴ެ։伴伴ϖΞൿີ伴ΞΞΞΞΞΞΞΞΞΞΞΞΞΞΞൿີ伴伴ެ։伴ᶇ伴ϖΞੜʮ४උʯʹͯํ๏Λॻ͖·͢ൿີ伴ൿີ伴伴"MJDFͷެ։伴"MJDFͷ࡞ۀڥ44) 4FDVSF4IFMM44)44)PWFS5PS 5IF0OJPO3PVUFS#PCͷ࡞ۀڥ#PCͷެ։伴.BMJTTBͷެ։伴2022 7-8 — 2022-06-27 – p.21/49
UNIX҉߸ֶతϋογϡؔ 4)"ιϧτ ϥϯμϜ ੜ͞ΕͨμΠδΣετ“/etc/shadow”$ $ $1 MD55 SHA-2566 SHA-512base64 (64 )2022 7-8 — 2022-06-27 – p.22/49
( ) (1/5)Ubuntu 20.04 ( ) 2(Parallels)$ ip address IPalice ( ), bob ( )# adduser alice...Enter new UNIX password: structure...# adduser bob...Enter new UNIX password: quicksand...2022 7-8 — 2022-06-27 – p.23/49
( ) (2/5)alice (sudo : superuser do)# gpasswd -a alice sudo$ grep "sudo" /etc/group alicemalissa ( )# adduser malissa...Enter new UNIX password: irresistible...“structure quicksand irresistible . . .”( ) 1 1( )2022 7-8 — 2022-06-27 – p.24/49
( ) (3/5)SSH (Secure Shell) ( ) ( 1) (apt : Advanced Packaging Tool)$ sudo apt install openssh-serverSSH ( )(Ed25519 )$ ssh-keygen -t ed25519...Enter passphrase (empty for no passphrase):...$ cat .ssh/id_ed25519.pubalice: “heartbeat”, bob: “okinawa”, malissa: “darkness”( )cat ( )cat catenate ( ) ( )2022 7-8 — 2022-06-27 – p.25/49
( ) (4/5)SSH ( ) ( 2)( )$ mkdir .ssh$ chmod 700 .ssh$ cd .ssh$ nano authorized_keys( )$ chmod 600 authorized_keys( )alice, bobmalissa$ slogin IP$ exit2022 7-8 — 2022-06-27 – p.26/49
( ) (5/5)$ sudo apt install git nmap johngitnmap“Matrix Reloaded” (https://nmap.org/images/matrix/matrix-hack-screen3.png)SSHjohn (John the Ripper)bob2022 7-8 — 2022-06-27 – p.27/49
I. . .. . .^^;2022 7-8 — 2022-06-27 – p.28/49
Tor (The Onion Router)→( )1Tor : https://www.torproject.orgTor( )2022 7-8 — 2022-06-27 – p.29/49
Imalissa$ passwdESCrecovery moderoot# mount -o remount,rw /# passwd malissa# exitmalissaUbuntu OS ( )2022 7-8 — 2022-06-27 – p.30/49
(1)I ( )malissa bob22 SSH$ nmap -sV -p 22 IP$ git clone https://github.com/danielmiessler/SecLists.gitbobmalissa bob“/etc/ssh/sshd_config”#PasswordAuthentication yes# ( ) no$ sudo systemctl restart ssh SSHmalissa bob2022 7-8 — 2022-06-27 – p.31/49
SSHalice = malissa alice bob “authorized_keys”bob$ sudo -s# cd ../bob/.ssh# nano authorized_keys( malissa )bobalice(bob )malissa bob2022 7-8 — 2022-06-27 – p.32/49
alice = malissa$ sudo gpasswd -a bob sudosudo malissa bob2022 7-8 — 2022-06-27 – p.33/49
(2)“/etc/shadow” “/etc/passwd”alicemalissa$ unshadow passwdfile.txt shadowfile.txt > crackfile.txt$ john --wordlist=SecLists/Passwords/Common-Credentials/10-million-password-list-top-100000.txt crackfile.txt...quicksand (bob)...8bob “10-million-password-list-top-100000.txt”bobbobJohn the Ripper2022 7-8 — 2022-06-27 – p.34/49
. . .WBSNFT↑2022 7-8 — 2022-06-27 – p.35/49
( )(1)JavaScript( )(2)(3)(1) (3) (2) (3)(A)(B)A ≡ B2022 7-8 — 2022-06-27 – p.36/49
GitHub( )Git -https://git-scm.com/book/ja/v2/Git- -Githttps://gist.github.com/ktx2207/3167fa69531bdd6b44f1( )GitHub“The Octopus Scanner Malware: Attacking the open source supply chain”2022 7-8 — 2022-06-27 – p.37/49
& (C&C)IRC (Internet Relay Chat)IRC ( )Bitcoin IRC&“Glupteba – the malware that gets secret messages from the Bitcoin blockchain”Bitcoin2022 7-8 — 2022-06-27 – p.38/49
( ). . .2. . .2022 7-8 — 2022-06-27 – p.39/49
(1) :I2022 7-8 — 2022-06-27 – p.40/49
( )2022 7-8 — 2022-06-27 – p.41/49
(2)Q&A (2020)https://www.nisc.go.jp/security-site/law_handbook/index.html2022 7-8 — 2022-06-27 – p.42/49
( )2022 7-8 — 2022-06-27 – p.43/49
(2) :2022 7-8 — 2022-06-27 – p.44/49
(3) : Coinhive: https://ja.wikipedia.org/wiki/Coinhive2022 7-8 — 2022-06-27 – p.45/49
(4) ::https://www3.nhk.or.jp/news/html/20220624/k10013686711000.html2022 7-8 — 2022-06-27 – p.46/49
2022 7-8 — 2022-06-27 – p.47/49
4.(1) ( )(2)2022 6 30 ( ) 23:59 JST ( )Waseda Moodle (Q & A )2022 7-8 — 2022-06-27 – p.48/49
2022 7-8 — 2022-06-27 – p.49/49
ks91
smt7174
rynsuke
is_ryo
cybozuinsideout
nayuts
leveragestech
dahatake
line_developers_tw
naohachi89
coconala_engineer
yuya4
kojira
chrisshort
jacobian
bkeepers
tanoku
garrettdimon
quramy
samlambert
reverentgeek
jponch
mojombo
jasonvnalue
zenorocha