Upgrade to Pro — share decks privately, control downloads, hide ads and more …

まだ見ぬ攻撃を求めて

 まだ見ぬ攻撃を求めて

2020年1月25日 第7回 ハニーポッター技術交流会
@morihi_soc #hanipo_tech
https://hanipo-tech.connpass.com/event/160302/

Kazuaki Morihisa

January 25, 2020
Tweet

More Decks by Kazuaki Morihisa

Other Decks in Technology

Transcript

  1. 2020೥1݄25೔ ୈ7ճϋχʔϙολʔٕज़ަྲྀձ ൃදࢿྉ
    ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    @morihi_soc

    View full-size slide

  2. 2
    XIPBNJ
    w ৿ٱ࿨ত !NPSJIJ@TPD
    $*441 44$1
    w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ
    w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ
    w ϒϩάˠIUUQTXXXNPSJIJTPDOFU
    w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ
    w IUUQTIBOJQPUFDIDPOOQBTTDPN
    ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦)
    ɾ*5,FZT ݱ4FD$BQ

    ɾωοτϫʔΫύέοτΛಡΉձ Ծ

    ɾ/*4$αΠόʔϋϩ΢Οϯɾ*OUFSOFU8FFL
    ɾ)BSEFOJOHɾTTNKQɾ"*4FDɾ4UVEZ$PEF
    ɾULULηΩϡϦςΟษڧձ
    ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ
    ɾ08"41/BHPZBɾ*P54FD+1
    ɾ͢ΈͩηΩϡϦςΟษڧձ
    ɾαΠόʔηΩϡϦςΟษڧձJOԘ৲
    ࣥචͨ͠ຊ΍ٕज़ಉਓࢽ

    View full-size slide

  3. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ໨࣍
    w ϋχʔϙολʔϞνϕʔγϣϯ
    w ϋχʔϙοτԿ୆২͑ͯΔ
    w &YQMPJU5SFBTVSF)VOU
    w ϩά͸ͳͥ૿͑Δͷ͔
    w ͻΒΊ͖ͱ'VMM)5513FRVFTU)BTI
    w ౰વͷٙ໰ͱվྑͷ༨஍
    w ·ͱΊ
    3

    View full-size slide

  4. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ϋχʔϙολʔϞνϕʔγϣϯ
    4
    ৽͍͠߈ܸΛݟ͍ͨ

    View full-size slide

  5. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ϋχʔϙοτԿ୆২͑ͯΔ
    w 808)POFZQPU
    w ௿ର࿩ܕαʔόଆͷ8FCʹಛԽͨ͠ϋχʔϙοτ
    w ݸਓͷ׆ಈʹ͓͍ͯϝΠϯͰ࢖͍ͬͯΔ
    w ࢖༻Ϧιʔε͕গͳͯ͘΋ಈ͘ͷͰɺ͓ࡒ෍ͷڐ͢
    ݶΓɺϨϯλϧαʔόΛआΓͯෳ਺୆ՔಇͰ͖Δ
    w ࠷େಉ࣌ʹ୆ಈ͔͍ͯͨ͜͠ͱ΋
    w ϲ݄ถυϧY୆ɾɾɾ
    5
    https://github.com/morihisa/WOWHoneypot

    View full-size slide

  6. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ༨ஊ
    808)POFZQPUΛ$JUSJYΧελϚΠζ
    w 808)POFZQPU͸ϦΫΤετʹ߹ΘͤͯϨεϙϯ
    εΛม͑Δ͜ͱ͕Մೳɻ
    w ࠷ۙྲྀߦΓͷ$JUSJYͷ੬ऑੑ $7&

    ΋ΧόʔͰ͖·͢ɻ
    w ΍Γ͔ͨ
    Ϩεϙϯε಺༰Λఆٛͨ͠ϑΝΠϧ࡞੒
    ϚονϨεϙϯεϧʔϧʹ௥Ճ
    6

    View full-size slide

  7. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ༨ஊ
    808)POFZQPUΛ$JUSJYΧελϚΠζ
    w BSUσΟϨΫτϦʹDJUSJYUYUͱ͍͏ϑΝΠϧΛԼه
    ͷ಺༰Ͱ࡞੒͢Δ ίϯϑΟάࢀߟ
    ɻ
    w BSUσΟϨΫτϦͷ
    NSSVMFTYNMʹ
    ӈهͷϧʔϧΛ௥Ճ
    ˞NSSJE͸దٓमਖ਼
    7
    [global]
    encrypt passwords = yes
    name resolve order = lmhosts bcast host
    *1 http://www.samba.gr.jp/project/translation/4.5/htmldocs/manpages/smb.conf.5.html


    1045
    True
    Citrix exploit(CVE-2019-19781)


    pns/cfg/smb.conf


    200



    View full-size slide

  8. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ༨ஊ
    808)POFZQPUΛ$JUSJYΧελϚΠζ
    w $7&ͷεΩϟφͰ֬ೝͯ͠ΈΔ
    w ϧʔϧ௥Ճલ
    w ϧʔϧ௥Ճޙ
    8
    →Citrix αʔόͰ͸ͳ͍(੬ऑͰ͸ͳ͍)ͱ൑ఆ͞Εͨ
    →੬ऑͳ Citrix αʔόͱ൑ఆ͞Εͨ

    View full-size slide

  9. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ೥ͷϋχʔϙοτՔಇ࣮੷
    w 808)POFZQPUͷϩά
    w ֤݄ͷϩάྔ
    w ͹Β͖͕ͭ݁ߏ͋Δ
    9
    ݄ .#
    ݄ (#
    ݄ .#
    ݄ .#
    ݄ .#
    ݄ .#
    ݄ .#
    ݄ .#
    ݄ .#
    ݄ .#
    ݄ .#
    ݄ .#

    View full-size slide

  10. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    &YQMPJU5SFBTVSF)VOU
    w ৽͍͠߈ܸख๏Λ෼ੳ͢Δͷ͸ָ͍͠˕
    w ࠷ۙͷ܏޲Λ஌ΔͨΊͷΞϯςφͷͭ
    w ಉ͡ϩάΛ܁Γฦ͠໨ͰݟΔͷ͸ͭΒ͍
    w ਺ઍ݅ɾ਺ສ݅ͷϩά͸෺ཧతʹແཧ
    10

    View full-size slide

  11. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ෳ਺ͷϋχʔϙοτΛ২͑Δฐ֐
    w ެ։αʔόΛεΩϟϯ͍ͯ͠ΔΑ͏ͳ߈ܸऀʹΑΓ
    ෳ਺ͷϋχʔϙοτͰಉ͡߈ܸͷϩά͕࢒Δ
    w ෼ੳ͍ͨ͠ͷ͸ɺ߈ܸऀͱͷϩάݸ͚ͩ
    11
    ߈ܸऀ1
    ߈ܸऀ2
    ϋχʔϙοτ1
    ϋχʔϙοτ2
    ϋχʔϙοτ3
    ϋχʔϙοτ1ͷ߈ܸऀ1ͷϩά
    ϋχʔϙοτ1ͷ߈ܸऀ2ͷϩά
    ϋχʔϙοτ2ͷ߈ܸऀ1ͷϩά
    ϋχʔϙοτ2ͷ߈ܸऀ2ͷϩά
    ϋχʔϙοτ3ͷ߈ܸऀ1ͷϩά
    ϋχʔϙοτ3ͷ߈ܸऀ2ͷϩά
    ߹ܭ6ݸͷϩά

    View full-size slide

  12. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ϩάྔ ॏෳ
    ΛݮΒ͢
    12
    w ͳΜΒ͔ͷج४Λ༻͍ͯॏෳΛഉআ
    w 63*
    w ߈ܸऀͷ*1ΞυϨε
    w ϖΠϩʔυͷXHFUDVSMͷμ΢ϯϩʔυ63-
    w *%4ʹΑΔΞϥʔτ
    w ͦͷଞ
    ͲΕ͔1ͭʹݶఆ͢Δඞཁ͸ͳ͍
    (૊Έ߹Θͤͯ࢖͏)

    View full-size slide

  13. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ͻΒΊ͖
    w )551ϦΫΤετΛϋογϡԽ͢Δɻ
    ͨͩ͠)PTUϔομͷ஋͸औΓআ͘ɻ ཧ༝͸ޙड़

    w ϋογϡ஋ͷσʔλϕʔεΛ࡞Δɻ
    w σʔλϕʔεʹؚ·Ε͍ͯͳ͍ϋογϡ஋ͷ߈ܸ͸
    ৽͍͠߈ܸͱ͢Δ
    ˠಉ͡߈ܸऀ͔Βͷෳ਺ͷ௨৴Λճ͚ͩݟΔ͜ͱ
    ͕Ͱ͖ΔΑ͏ʹͳΔͷͰ͸
    13

    View full-size slide

  14. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    'VMM)5513FRVFTU)BTI ')3)

    14
    cf4398dabdd0b1fd1d3878bac7e5a445a73c909ebbdf8121df58fca55eb27d67
    Host ϔομͷ஋Λۭʹ͢Δ
    શମΛϋογϡԽ͢Δ(SHA256)



    View full-size slide

  15. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    )PTUϔομͷॲཧ
    w )551ͷόʔδϣϯͰ͸ɺ)PTUϔομͷࢦఆ͕
    ඞਢ 3'$

    w ϋογϡԽ͸ɺݩͷϝοηʔδ͕όΠτҧ͏ͱੜ
    ੒͞ΕΔϋογϡ஋΋ҟͳΔੑ࣭͕͋Δɻ
    w ϋχʔϙοτͷάϩʔόϧ*1ΞυϨε΍υϝΠϯ໊
    ʹΑΓϋογϡ஋͕มΘͬͯ͠·͏ͱɺಉ͡߈ܸ௨
    ৴͕ҟͳΔϋογϡ஋ʹͳͬͯ͠·͏ɻ
    ˠ)PTUϔομͷ஋͚ͩ࡟আ͕ඞཁ
    15

    View full-size slide

  16. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ೥ͷϩάͰࢼͯ͠Έͨ
    16
    ݄ ݩσʔλ ')3) ࡟ݮ཰
    ݄
    ݄
    ݄
    ݄
    ݄
    ݄
    ݄
    ݄
    ݄
    ݄
    ݄
    ݄ ୯Ґɿߦ਺

    View full-size slide

  17. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ॲཧ࣌ؒ
    w ܭଌ؀ڥ J.BD

    w ()[ΫΞουίΞ*OUFM$PSFJ
    ϝϞϦ(#.)[%%344%
    w ϓϩάϥϜ
    w 1ZUIPO
    w ܭଌ
    w UJNFίϚϯυ
    w ௕ͯ͘΋෼΄Ͳ
    17
    1݄ ./fhrh.py 5.32s user 0.21s system 97% cpu 5.675 total
    2݄ ./fhrh.py 62.29s user 1.39s system 98% cpu 1:04.59 total
    3݄ ./fhrh.py 22.76s user 1.01s system 98% cpu 24.101 total
    4݄ ./fhrh.py 17.83s user 0.84s system 97% cpu 19.100 total
    5݄ ./fhrh.py 10.17s user 0.60s system 97% cpu 11.018 total
    6݄ ./fhrh.py 8.22s user 0.42s system 98% cpu 8.803 total
    7݄ ./fhrh.py 10.09s user 0.47s system 98% cpu 10.739 total
    8݄ ./fhrh.py 7.01s user 0.37s system 98% cpu 7.516 total
    9݄ ./fhrh.py 5.66s user 0.33s system 98% cpu 6.097 total
    10݄ ./fhrh.py 5.25s user 0.35s system 98% cpu 5.713 total
    11݄ ./fhrh.py 12.61s user 0.62s system 98% cpu 13.424 total
    12݄ ./fhrh.py 6.36s user 0.39s system 97% cpu 6.893 total

    View full-size slide

  18. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ౰વͷٙ໰
    w 263*͚ͩͰϑΟϧλͨ͠Βμϝͳͷ
    w "μϝ͡Όͳ͍͚Ͳɺ63*͸ڧྗ͗͢Δɻ
    ')3)ͱ૊Έ߹ΘͤΔͱྑ͍Μ͡Όͳ͍͔ͳɻ
    18

    View full-size slide

  19. ·ͩݟ͵߈ܸΛݟ͚ͭΔ

    &UIFSFVNͷϊʔυ୳ࠪ
    w ʮ1045)551ʯ͚ͩͰ΋ɺෳ਺ͷ߈ܸΛݕ
    ஌͍ͯ͠Δɻ63*͚ͩͩͱऔΓ͜΅͢ɻ
    19

    View full-size slide

  20. ·ͩݟ͵߈ܸΛݟ͚ͭΔ

    5PNDBUʹର͢ΔϒϧʔτϑΥʔε
    w 63*͸ಉ͚ͩ͡Ͳ"VUIPSJ[BUJPOϔομ͕ҟͳΔɻ
    20
    web:admin
    root:admin tomcat:admin
    manager:admin

    View full-size slide

  21. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ')3)ͱ૊Έ߹ΘͤΔ
    w ෼ੳ͠ͳ͍ͱ൑அͨ͠΋ͷΛϑΟϧλ͢Δ
    w ྫ

    w 5PNDBUϒϧʔτϑΥʔε͸ݟ๞͖ͨ
    ˠʮNBOBHFSIUNMʯΛϑΟϧλ͢Δɻ
    w ΫϩʔϦϯά͸෼ੳ͠ͳ͍
    ˠʮSPCPUTUYUʯΛϑΟϧλ͢Δɻ
    w /FVUSJOPϘοτ͔ΒͷίϚϯυ࣮ߦ͸෼ੳෆཁ
    ˠʮEJF !NE ʯΛؚΉϦΫΤετΛϑΟϧλ͢Δɻ
    21
    Finding Neutrino
    https://blog.ptsecurity.com/2019/08/finding-neutrino.html

    View full-size slide

  22. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    $JUSJYͷ੬ऑੑ͸Ͳ͏ͳͷ
    w )551ϔομ͕ϥϯμϜจࣈྻʹͳΔͷͰɺ')3)
    ͷద༻͸ݫͦ͠͏
    22

    View full-size slide

  23. ·ͩݟ͵߈ܸΛݟ͚ͭΔ
    ·ͱΊ
    w ϩάͷࢁ͔Βɺ৽͍͠߈ܸΛݟ͚ͭΔͱ͍͏Ϟν
    ϕʔγϣϯΛݩʹɺ)551ϦΫΤετΛϋογϡԽ
    ͢Δख๏Λߟ͑·ͨ͠ɻ
    w ࣮૷ͯ͠Έͨͱ͜Ζɺݩͷϩάͷྔ ߦ਺
    ͔ΒҎ
    ԼʹݮΓ·ͨ͠ɻ
    w ϋχʔϙολʔΛଓ͚ΔͨΊͷ޻෉͸େ੾
    23

    View full-size slide