$30 off During Our Annual Pro Sale. View Details »

Drupalgeddon2 をハニーポットで観察してみた

Drupalgeddon2 をハニーポットで観察してみた

2018年6月30日 第4回 ハニーポッター技術交流会 発表資料 @morihi_soc #hanipo_tech
https://hanipo-tech.connpass.com/event/90337/

Kazuaki Morihisa

June 30, 2018
Tweet

More Decks by Kazuaki Morihisa

Other Decks in Technology

Transcript

  1. 2018೥6݄30೔ ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձൃදࢿྉ
    Drupalgeddon2 Λ
    ϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    @morihi_soc

    View Slide

  2. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    XIPBNJ
    w ৿ٱ࿨ত !NPSJIJ@TPD

    w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ
    w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ
    w ϒϩάˠIUUQXXXNPSJIJTPDOFU
    w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ
    w IUUQTIBOJQPUFDIDPOOQBTTDPN
    2
    ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦)
    ɾ*5,FZT ݱ4FD$BQ

    ɾωοτϫʔΫύέοτΛಡΉձ Ծ

    ɾ/*4$αΠόʔϋϩ΢Οϯ
    ɾ*OUFSOFU8FFLɾ)BSEFOJOH
    ɾTTNKQɾ"*4FDɾ4UVEZ$PEF
    ɾULULηΩϡϦςΟษڧձ
    ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ
    ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ

    View Slide

  3. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ͓඼ॻ͖
    w %SVQBMHFEEPOͱ͸
    w ߈ܸαϯϓϧ঺հ
    w 808)POFZQPUͰͷݕ஌ঢ়گ
    w ௿ର࿩ܕͱߴର࿩ܕͷൺֱ
    w ·ͱΊ
    3

    View Slide

  4. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    %SVQBMHFEEPOͱ͸
    w %SVQBMʹ͸ɺϦϞʔτ͔Β೚ҙͷίʔυ͕࣮ߦՄ
    ೳͱͳΔ੬ऑੑ $7&
    ͕ଘࡏ͠ɺ͜ͷ
    ੬ऑੑΛѱ༻͢Δ͜ͱͰɺԕִͷୈࡾऀ͕ɺඇެ։
    σʔλΛ઄औͨ͠ΓɺγεςϜσʔλΛվมͨ͠Γ
    ͢ΔͳͲͷՄೳੑ͕͋Δͱͷ͜ͱͰ͢ɻ
    w ӨڹΛड͚Δόʔδϣϯ͸࣍ͷ௨Γɻͨͩ͠αϙʔ
    τ͕੾Ε͍ͯΔݹ͍όʔδϣϯ΋ӨڹΛड͚ΔՄೳ
    ੑ͕͋Γɻ
    w %SVQBMΑΓલͷόʔδϣϯ
    w %SVQBMΑΓલͷόʔδϣϯ
    4
    JPCERT/CC ͷϖʔδ͔ΒҾ༻
    https://www.jpcert.or.jp/at/2018/at180012.html

    View Slide

  5. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ڪාͷେԦ;ͨͨͼ
    w ೥݄೔%SVQBMެ͔ࣜΒɺिؒޙʹηΩϡ
    ϦςΟϦϦʔεΛ͢Δͱͷൃද
    w ೥݄೔$7&ͷ੬ऑੑΛमਖ਼
    ͨ͠όʔδϣϯ͕ެ։
    w ೥݄೔ηΩϡϦςΟݚڀऀʹΑΓɺϦϞʔ
    τίʔυ࣮ߦͷղੳ৘ใ͕ެ։ɻ

    ೥ͷ੬ऑੑ $7&
    Λኲኵͱͤ͞Δ
    ΄Ͳةݥ౓͕ߴ͘ɺ%SVQBMHFEEPOͱݺ͹ΕΔɻ
    5
    *1 https://www.drupal.org/psa-2018-001
    *2 https://www.drupal.org/SA-CORE-2018-002
    *3 https://research.checkpoint.com/uncovering-drupalgeddon-2/
    ը૾Ҿ༻ݩˣ
    https://scanforsecurity.com/news/drupalgeddon-2-vulnerability-used-infect-servers-backdoors-coinminers.html

    View Slide

  6. ߈ܸαϯϓϧ
    ঺հ
    ↑2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ
    ৯஬২෺Ͱ͸ͳ͍ɻ

    View Slide

  7. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸαϯϓϧ঺հ
    w ϋχʔϙοτʹର͢Δ߈ܸͰ࠷΋ଟ͔ͬͨύλʔϯ
    w ߈ܸର৅ͷύε͸ʮVTFSSFHJTUFSʯ
    7

    View Slide

  8. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸαϯϓϧ঺հ
    w %SVQBMܥΛૂͬͨ߈ܸύλʔϯ
    w ஈ֊Ͱ߈ܸΛ੒ཱͤ͞Δ
    w 8FCαʔό͔ΒͷԠ౴ʹGPSNͷJEؚ͕·ΕΔ
    w
    8

    View Slide

  9. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸαϯϓϧ঺հ
    w %SVQBMܥΛૂͬͨ߈ܸύλʔϯ
    w ճ໨ͷΞΫηεͰGPSNͷσʔλΛΩϟογϡ͞
    ͤͯɺճ໨ͷΞΫηεͰϨϯμϦϯάͤͯ͞ίϚϯ
    υ࣮ߦΛࢼΈΔɻ
    9

    View Slide

  10. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸऀͷૂ͍Λ୳Δ
    w 1045ͷϘσΟ෦෼ʹ஫໨͠ɺ߈ܸऀ͕ͲΜͳҙਤ
    Ͱ߈ܸ͖ͯͨ͠ͷ͔ߟ͑ͯΈΑ͏
    w ੬ऑੑͷௐࠪΛ͍ͯ͠Δ௨৴͔ΒɺϚϧ΢ΣΞײછ
    ΛࢼΈΔ΋ͷ·Ͱ༷ʑͳ߈ܸΛݕ஌
    w ͍͔ͭ͘ϐοΫΞοϓͯ͠঺հ
    10

    View Slide

  11. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ੬ऑੑͷௐࠪ

    w FDIPίϚϯυͰจࣈྻΛදࣔ͢Δ
    w JEίϚϯυͰϢʔβ໊Λදࣔ͢Δ
    11

    View Slide

  12. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ

    w ੬ऑੑΛಥ͍ͯγΣϧεΫϦϓτΛμ΢ϯϩʔυ͠
    ࣮ͯߦͤ͞Δ߈ܸ
    w GFUDIίϚϯυ΋࢖͍ͬͯͯɺ#4%ܥ΋߈ܸର৅
    12

    View Slide

  13. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ

    w TIϑΝΠϧͰμ΢ϯϩʔυΛࢼΈΔϑΝΠϧΛ

    ௥ՃͰௐࠪͯ͠Έͨ݁Ռɻ
    w ෳ਺ͷ$16ΞʔΩςΫνϟʹରԠͰ͖ΔΑ͏ʹɺ
    ϑΝΠϧΛμ΢ϯϩʔυ͍ͯͨ͠ɻ
    13

    View Slide

  14. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ

    w த਎͸%%P4ʹར༻͞ΕΔ5TVOBNJϚϧ΢ΣΞ
    IUUQTXXXWJSVTUPUBMDPNFOpMFDDBBCFDCGDDEDD⒎CBEFGEDECBFBOBMZTJT
    14

    View Slide

  15. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧ࡞੒

    w FDIPίϚϯυΛύΠϓͰܨ͍Ͱɺ1)1ϑΝΠϧΛ
    ࡞੒͍ͯ͠Δɻ
    w #"4&Ͱσίʔυ͢Δͱɺͳʹ΍Βո͍͠งғؾɻ
    15

    View Slide

  16. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ߈ܸࣄྫ ϑΝΠϧ࡞੒

    w 04ίϚϯυ࣮ߦػೳͱϑΝΠϧΞοϓϩʔυػೳ
    Λ࣋ͭ8FC4IFMMͩͬͨ
    16
    ※WebShell ͸ɺϒϥ΢β͔Β Web αʔόΛૢ࡞͢Δ͜ͱ͕Ͱ͖ΔϓϩάϥϜɻ

    ৄ͘͠͸ ٕज़ಉਓࢽͷʮWebShell ਤේʯΛݟͯͶ! https://booth.pm/ja/items/718303

    View Slide

  17. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    808)POFZQPUͰͷݕ஌ঢ়گ
    w ೥݄೔͔Β݄೔·ͰͷظؒΛநग़
    17

    View Slide

  18. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ௿ର࿩ܕͱߴର࿩ܕͷൺֱ
    w ϋχʔϙοτ͸͍͔ͭ͘෼ྨ͢Δํ๏͕͋Γ·͢
    w ௿ର࿩ܕ ྫɿ808)POFZQPU

    w ࣮ࡏ͢Διϑτ΢ΣΞΛ໛฿͢Δํࣜ
    w ϩά෼ੳ͠΍͘͢ͳ͍ͬͯΔ͕ɺ੬ऑੑͷ໛฿͸

    ׬ᘳʹͰ͖ͳ͍ɻ
    w ߴର࿩ܕ ྫɿ"QBDIF1)1%SVQBM

    w ιϑτ΢ΣΞΛͦͷ··࢖͏ํࣜ
    w ຊ෺ͳͷͰඪతΛߜͬͨ߈ܸΛݕ஌͠΍͍͕͢
    EBZͷ੬ऑੑʹΑΓɺϛΠϥऔΓ͕ϛΠϥঢ়ଶʹ
    ͳΓ͔Ͷͳ͍ɻ
    18

    View Slide

  19. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    %SVQBMHFEEPOͰݟΔ௿ɾߴର࿩ܕ
    w ௿ର࿩ܕͰ͋Δ808)POFZQPUͷݕ஌ঢ়گͱ

    ߴର࿩ܕͰ͋Δ%SVQBMͷϋχʔϙοτͷݕ஌ঢ়گ
    Λൺֱͯ͠Έͨ
    w ΋ͪΖΜ%SVQBM͸ύονΛଈ೔ద༻ࡁΈɻ
    w %SVQBMͷϋχʔϙοτ͸ɺ808)POFZQPUΑΓ
    গ͠લ͔Βެ։ͯ͠߈ܸ৘ใΛऩू͍ͯͨ͠ɻ
    w ͪΐ͏Ͳ%SVQBMHFEEPO͕ग़ͨͱ͖͸ɺผʑͷαʔ
    όͰ؅ཧ͍ͯͨ͠ͷͰɺൺֱ͕Մೳͩͬͨɻ
    w ͨͩ͠ɺ%SVQBMͷϋχʔϙοτ͸୆͔͠Քಇͯ͠
    ͓Βͣɺ808)POFZQPUͷํ͕୆਺͕ଟ͍ɻ
    19

    View Slide

  20. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ॳճͷ߈ܸݕ஌೔
    w ͓͞Β͍
    w ೥݄೔ʹ੬ऑੑ͕ެ։ɺ݄೔ʹ੬ऑ
    ੑͷղઆ͕ެ։ɻ
    20
    ؍ଌ஍఺ ॳճݕ஌೔
    %SVQBMͷߴର࿩ܕϋχʔϙοτ ݄೔
    808)POFZQPU ௿ର࿩ܕ
    ݄೔
    ࢀߟ
    ܯࢹிΠϯλʔωοτఆ఺؍ଌγεςϜ ݄೔
    ࢀߟ
    NPSJIJTPDͷϒϩά 8PSE1SFTT
    ݄೔
    *1 https://www.npa.go.jp/cyberpolice/detect/pdf/20180418.pdf

    View Slide

  21. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ϋχʔϙοτͷछผʹΑΔ߈ܸ؍ଌߟ࡯
    w NPSJIJTPDͷϋχʔϙοτ؀ڥͰ͸ɺ%SVQBMΛ࢖ͬ
    ͍ͯΔͱ͜Ζ͕࠷΋ૣ͘߈ܸΛݕ஌ͨ͠ɻ
    w ੬ऑੑ͕ެ։͞ΕͨΒɺ੬ऑੑ͕͋Γͦ͏ͳͱ͜
    Ζ͕ɺਅͬઌʹૂΘΕΔɻ
    w ͱ͸͍͑ɺ௿ର࿩ܕͷϋχʔϙοτͰ΋߈ܸͷ؍ଌ
    ͸Մೳͩͬͨɻ
    w 8PSE1SFTTͷΑ͏ͳɺ੬ऑੑͷର৅ͱϛεϚον
    ͳ؀ڥ͸ɺ߈ܸͷ؍ଌʹ͕͔͔࣌ؒΔɻ
    w αϯϓϧ਺͕গͳ͍ͷͰۮવ͔΋͠Εͳ͍ɻ
    21

    View Slide

  22. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    ·ͱΊ
    w %SVQBMHHFEPOͷ੬ऑੑΛૂͬͨ߈ܸΛࣄྫΛ౿
    ·͑ͯ঺հͨ͠ɻ
    w ݕ஌ͨ͠߈ܸ͸ɺ੬ऑੑͷௐࠪΛࢼΈΔ΋ͷ͔Βɺ
    %%P4Ϛϧ΢ΣΞʹײછͤ͞Δ΋ͷɺ8FC4IFMMͷ
    ઃஔΛࢼΈΔ΋ͷͳͲ༷ʑͩͬͨɻ
    w ϋχʔϙοτͷछผʹΑͬͯɺॳճͷ߈ܸݕ஌೔ʹ
    ҧ͍͕͋ͬͨɻ

    ͨͩ͠αϯϓϧ਺͕গͳ͍ͷͰࢀߟఔ౓ʹ

    22

    View Slide

  23. Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ
    )BQQZ)POFZQPU
    23
    ←2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ
    ৯஬২෺Ͱ͸ͳ͍ɻ
    ͓͠·͍

    View Slide