Drupalgeddon2 をハニーポットで観察してみた

2018年6月30日 第4回 ハニーポッター技術交流会 発表資料 @morihi_soc #hanipo_tech
https://hanipo-tech.connpass.com/event/90337/

Transcript

1. 2018೥6݄30೔ ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձൃදࢿྉ
   Drupalgeddon2 Λ
   ϋχʔϙοτͰ؍࡯ͯ͠Έͨ
   @morihi_soc
   

   View Slide

2. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
   XIPBNJ
   w ৿ٱ࿨ত !NPSJIJ@TPD
   
   w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ
   w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ
   w ϒϩάˠIUUQXXXNPSJIJTPDOFU
   w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ
   w IUUQTIBOJQPUFDIDPOOQBTTDPN
   2
   ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦)
   ɾ*5,FZT ݱ4FD$BQ
   
   ɾωοτϫʔΫύέοτΛಡΉձ Ծ
   
   ɾ/*4$αΠόʔϋϩ΢Οϯ
   ɾ*OUFSOFU8FFLɾ)BSEFOJOH
   ɾTTNKQɾ"*4FDɾ4UVEZ$PEF
   ɾULULηΩϡϦςΟษڧձ
   ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ
   ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ
   

   View Slide

3. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
   ͓඼ॻ͖
   w %SVQBMHFEEPOͱ͸
   w ߈ܸαϯϓϧ঺հ
   w 808)POFZQPUͰͷݕ஌ঢ়گ
   w ௿ର࿩ܕͱߴର࿩ܕͷൺֱ
   w ·ͱΊ
   3
   

   View Slide

4. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
   %SVQBMHFEEPOͱ͸
   w %SVQBMʹ͸ɺϦϞʔτ͔Β೚ҙͷίʔυ͕࣮ߦՄ
   ೳͱͳΔ੬ऑੑ $7&
   ͕ଘࡏ͠ɺ͜ͷ
   ੬ऑੑΛѱ༻͢Δ͜ͱͰɺԕִͷୈࡾऀ͕ɺඇެ։
   σʔλΛ઄औͨ͠ΓɺγεςϜσʔλΛվมͨ͠Γ
   ͢ΔͳͲͷՄೳੑ͕͋Δͱͷ͜ͱͰ͢ɻ
   w ӨڹΛड͚Δόʔδϣϯ͸࣍ͷ௨Γɻͨͩ͠αϙʔ
   τ͕੾Ε͍ͯΔݹ͍όʔδϣϯ΋ӨڹΛड͚ΔՄೳ
   ੑ͕͋Γɻ
   w %SVQBMΑΓલͷόʔδϣϯ
   w %SVQBMΑΓલͷόʔδϣϯ
   4
   JPCERT/CC ͷϖʔδ͔ΒҾ༻
   https://www.jpcert.or.jp/at/2018/at180012.html
   

   View Slide

5. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
   ڪාͷେԦ;ͨͨͼ
   w ೥݄೔%SVQBMެ͔ࣜΒɺिؒޙʹηΩϡ
   ϦςΟϦϦʔεΛ͢Δͱͷൃද
   w ೥݄೔$7&ͷ੬ऑੑΛमਖ਼
   ͨ͠όʔδϣϯ͕ެ։
   w ೥݄೔ηΩϡϦςΟݚڀऀʹΑΓɺϦϞʔ
   τίʔυ࣮ߦͷղੳ৘ใ͕ެ։ɻ

   ೥ͷ੬ऑੑ $7&
   Λኲኵͱͤ͞Δ
   ΄Ͳةݥ౓͕ߴ͘ɺ%SVQBMHFEEPOͱݺ͹ΕΔɻ
   5
   *1 https://www.drupal.org/psa-2018-001
   *2 https://www.drupal.org/SA-CORE-2018-002
   *3 https://research.checkpoint.com/uncovering-drupalgeddon-2/
   ը૾Ҿ༻ݩˣ
   https://scanforsecurity.com/news/drupalgeddon-2-vulnerability-used-infect-servers-backdoors-coinminers.html
   

   View Slide

6. ߈ܸαϯϓϧ
   ঺հ
   ↑2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ
   ৯஬২෺Ͱ͸ͳ͍ɻ
   

   View Slide

7. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
   ߈ܸαϯϓϧ঺հ
   w ϋχʔϙοτʹର͢Δ߈ܸͰ࠷΋ଟ͔ͬͨύλʔϯ
   w ߈ܸର৅ͷύε͸ʮVTFSSFHJTUFSʯ
   7
   

   View Slide

8. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
   ߈ܸαϯϓϧ঺հ
   w %SVQBMܥΛૂͬͨ߈ܸύλʔϯ
   w ஈ֊Ͱ߈ܸΛ੒ཱͤ͞Δ
   w 8FCαʔό͔ΒͷԠ౴ʹGPSNͷJEؚ͕·ΕΔ
   w
   8
   

   View Slide

9. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
   ߈ܸαϯϓϧ঺հ
   w %SVQBMܥΛૂͬͨ߈ܸύλʔϯ
   w ճ໨ͷΞΫηεͰGPSNͷσʔλΛΩϟογϡ͞
   ͤͯɺճ໨ͷΞΫηεͰϨϯμϦϯάͤͯ͞ίϚϯ
   υ࣮ߦΛࢼΈΔɻ
   9
   

   View Slide

10. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸऀͷૂ͍Λ୳Δ
    w 1045ͷϘσΟ෦෼ʹ஫໨͠ɺ߈ܸऀ͕ͲΜͳҙਤ
    Ͱ߈ܸ͖ͯͨ͠ͷ͔ߟ͑ͯΈΑ͏
    w ੬ऑੑͷௐࠪΛ͍ͯ͠Δ௨৴͔ΒɺϚϧ΢ΣΞײછ
    ΛࢼΈΔ΋ͷ·Ͱ༷ʑͳ߈ܸΛݕ஌
    w ͍͔ͭ͘ϐοΫΞοϓͯ͠঺հ
    10
    

    View Slide

11. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ੬ऑੑͷௐࠪ
    
    w FDIPίϚϯυͰจࣈྻΛදࣔ͢Δ
    w JEίϚϯυͰϢʔβ໊Λදࣔ͢Δ
    11
    

    View Slide

12. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ
    
    w ੬ऑੑΛಥ͍ͯγΣϧεΫϦϓτΛμ΢ϯϩʔυ͠
    ࣮ͯߦͤ͞Δ߈ܸ
    w GFUDIίϚϯυ΋࢖͍ͬͯͯɺ#4%ܥ΋߈ܸର৅
    12
    

    View Slide

13. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ
    
    w TIϑΝΠϧͰμ΢ϯϩʔυΛࢼΈΔϑΝΠϧΛ

    ௥ՃͰௐࠪͯ͠Έͨ݁Ռɻ
    w ෳ਺ͷ$16ΞʔΩςΫνϟʹରԠͰ͖ΔΑ͏ʹɺ
    ϑΝΠϧΛμ΢ϯϩʔυ͍ͯͨ͠ɻ
    13
    

    View Slide

14. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ
    
    w த਎͸%%P4ʹར༻͞ΕΔ5TVOBNJϚϧ΢ΣΞ
    IUUQTXXXWJSVTUPUBMDPNFOpMFDDBBCFDCGDDEDD⒎CBEFGEDECBFBOBMZTJT
    14
    

    View Slide

15. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧ࡞੒
    
    w FDIPίϚϯυΛύΠϓͰܨ͍Ͱɺ1)1ϑΝΠϧΛ
    ࡞੒͍ͯ͠Δɻ
    w #"4&Ͱσίʔυ͢Δͱɺͳʹ΍Βո͍͠งғؾɻ
    15
    

    View Slide

16. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧ࡞੒
    
    w 04ίϚϯυ࣮ߦػೳͱϑΝΠϧΞοϓϩʔυػೳ
    Λ࣋ͭ8FC4IFMMͩͬͨ
    16
    ※WebShell ͸ɺϒϥ΢β͔Β Web αʔόΛૢ࡞͢Δ͜ͱ͕Ͱ͖ΔϓϩάϥϜɻ

    ৄ͘͠͸ ٕज़ಉਓࢽͷʮWebShell ਤේʯΛݟͯͶ! https://booth.pm/ja/items/718303
    

    View Slide

17. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    808)POFZQPUͰͷݕ஌ঢ়گ
    w ೥݄೔͔Β݄೔·ͰͷظؒΛநग़
    17
    

    View Slide

18. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ௿ର࿩ܕͱߴର࿩ܕͷൺֱ
    w ϋχʔϙοτ͸͍͔ͭ͘෼ྨ͢Δํ๏͕͋Γ·͢
    w ௿ର࿩ܕ ྫɿ808)POFZQPU
    
    w ࣮ࡏ͢Διϑτ΢ΣΞΛ໛฿͢Δํࣜ
    w ϩά෼ੳ͠΍͘͢ͳ͍ͬͯΔ͕ɺ੬ऑੑͷ໛฿͸

    ׬ᘳʹͰ͖ͳ͍ɻ
    w ߴର࿩ܕ ྫɿ"QBDIF1)1%SVQBM
    
    w ιϑτ΢ΣΞΛͦͷ··࢖͏ํࣜ
    w ຊ෺ͳͷͰඪతΛߜͬͨ߈ܸΛݕ஌͠΍͍͕͢
    EBZͷ੬ऑੑʹΑΓɺϛΠϥऔΓ͕ϛΠϥঢ়ଶʹ
    ͳΓ͔Ͷͳ͍ɻ
    18
    

    View Slide

19. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    %SVQBMHFEEPOͰݟΔ௿ɾߴର࿩ܕ
    w ௿ର࿩ܕͰ͋Δ808)POFZQPUͷݕ஌ঢ়گͱ

    ߴର࿩ܕͰ͋Δ%SVQBMͷϋχʔϙοτͷݕ஌ঢ়گ
    Λൺֱͯ͠Έͨ
    w ΋ͪΖΜ%SVQBM͸ύονΛଈ೔ద༻ࡁΈɻ
    w %SVQBMͷϋχʔϙοτ͸ɺ808)POFZQPUΑΓ
    গ͠લ͔Βެ։ͯ͠߈ܸ৘ใΛऩू͍ͯͨ͠ɻ
    w ͪΐ͏Ͳ%SVQBMHFEEPO͕ग़ͨͱ͖͸ɺผʑͷαʔ
    όͰ؅ཧ͍ͯͨ͠ͷͰɺൺֱ͕Մೳͩͬͨɻ
    w ͨͩ͠ɺ%SVQBMͷϋχʔϙοτ͸୆͔͠Քಇͯ͠
    ͓Βͣɺ808)POFZQPUͷํ͕୆਺͕ଟ͍ɻ
    19
    

    View Slide

20. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ॳճͷ߈ܸݕ஌೔
    w ͓͞Β͍
    w ೥݄೔ʹ੬ऑੑ͕ެ։ɺ݄೔ʹ੬ऑ
    ੑͷղઆ͕ެ։ɻ
    20
    ؍ଌ஍఺ ॳճݕ஌೔
    %SVQBMͷߴର࿩ܕϋχʔϙοτ ݄೔
    808)POFZQPU ௿ର࿩ܕ
    ݄೔
    ࢀߟ
    ܯࢹிΠϯλʔωοτఆ఺؍ଌγεςϜ ݄೔
    ࢀߟ
    NPSJIJTPDͷϒϩά 8PSE1SFTT
    ݄೔
    *1 https://www.npa.go.jp/cyberpolice/detect/pdf/20180418.pdf
    

    View Slide

21. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ϋχʔϙοτͷछผʹΑΔ߈ܸ؍ଌߟ࡯
    w NPSJIJTPDͷϋχʔϙοτ؀ڥͰ͸ɺ%SVQBMΛ࢖ͬ
    ͍ͯΔͱ͜Ζ͕࠷΋ૣ͘߈ܸΛݕ஌ͨ͠ɻ
    w ੬ऑੑ͕ެ։͞ΕͨΒɺ੬ऑੑ͕͋Γͦ͏ͳͱ͜
    Ζ͕ɺਅͬઌʹૂΘΕΔɻ
    w ͱ͸͍͑ɺ௿ର࿩ܕͷϋχʔϙοτͰ΋߈ܸͷ؍ଌ
    ͸Մೳͩͬͨɻ
    w 8PSE1SFTTͷΑ͏ͳɺ੬ऑੑͷର৅ͱϛεϚον
    ͳ؀ڥ͸ɺ߈ܸͷ؍ଌʹ͕͔͔࣌ؒΔɻ
    w αϯϓϧ਺͕গͳ͍ͷͰۮવ͔΋͠Εͳ͍ɻ
    21
    

    View Slide

22. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ·ͱΊ
    w %SVQBMHHFEPOͷ੬ऑੑΛૂͬͨ߈ܸΛࣄྫΛ౿
    ·͑ͯ঺հͨ͠ɻ
    w ݕ஌ͨ͠߈ܸ͸ɺ੬ऑੑͷௐࠪΛࢼΈΔ΋ͷ͔Βɺ
    %%P4Ϛϧ΢ΣΞʹײછͤ͞Δ΋ͷɺ8FC4IFMMͷ
    ઃஔΛࢼΈΔ΋ͷͳͲ༷ʑͩͬͨɻ
    w ϋχʔϙοτͷछผʹΑͬͯɺॳճͷ߈ܸݕ஌೔ʹ
    ҧ͍͕͋ͬͨɻ

    ͨͩ͠αϯϓϧ਺͕গͳ͍ͷͰࢀߟఔ౓ʹ
    
    22
    

    View Slide

23. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    )BQQZ)POFZQPU
    23
    ←2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ
    ৯஬২෺Ͱ͸ͳ͍ɻ
    ͓͠·͍
    

    View Slide