Tokumaru-Seminar-oganyan3

OS Command Injection

Transcript

1. 04ίϚϯυɾΠϯδΣΫγϣϯ ಙؙษڧձ 
   ͓͕ʹΌΜ
2. 04ίϚϯυɾΠϯδΣΫγϣϯ γΣϧܦ༝Ͱ04ίϚϯυΛ࣮ߦ͢Δ৔߹ʹҙਤ͠ͳ͍04 ίϚϯυ͕࣮ߦ͞ΕΔ੬ऑੑ
   ඃ֐ͷྲྀΕ
    ߈ܸ༻πʔϧΛ֎෦͔Βμ΢ϯϩʔυ
    μ΢ϯϩʔυͨ͠πʔϧʹ࣮ߦݖݶΛ༩͑Δ
    04ͷ੬ऑੑΛ಺෦͔Β߈ܸͯ͠؅ཧऀݖݶΛಘΔ
    8FCαʔό͸߈ܸऀͷࢥ͍ͷ··ʹ
3. ྫ NBJM
   
   @1045<NBJM>
   TZTUFN VTSTCJOTFOENBJM
   J
   
   UFNQMBUFUYU
   
   
   NBJM  'SPN
   UFTU!FYBNQMFDPN
   4VCKFDU
   ͜Ε͸ςετͰ͢
   ςετͷຊจͰ͢ɻ UFNQMBUFUYU NBJM NBJM
   
   PHBOZBO!FYBNQMFDPN 
   TI
   D
   VTSTCJOTFOENBJM
   J
   
   UFNQMBUFUYU
   PHBOZBO!FYBNQMFDPN
4. 
   TI
   D
   VTSTCJOTFOENBJM
   J
   
   UFNQMBUFUYU
   PHBOZBO!FYBNQMFDPN
   SN
   SG
    NBJM
   
   PHBOZBO!FYBNQMFDPN
   SN
   SG
    ྫ NBJM
   
   @1045<NBJM>
   TZTUFN VTSTCJOTFOENBJM
   J
   
   UFNQMBUFUYU
   
   
   NBJM  'SPN
   UFTU!FYBNQMFDPN
   4VCKFDU
   ͜Ε͸ςετͰ͢
   ςετͷຊจͰ͢ɻ UFNQMBUFUYU NBJM
5. γΣϧͰͷෳ਺ίϚϯυ࣮ߦ 
   FDIP
   BBB
   FDIP
   CCC
   BBB
   CCC 
   FDIP
   BBB
   
   FDIP
   CCC
   BBB
   CCC 
   FDIP
   BBB
   
   FDIP
   CCC
   BBB
   CCC 
   DBU
   BBB
   cc
   FDIP
   CCC
   DBU
   BBB
   /P
   TVDI
   pMF
   PS
   EJSFDUPSZ
   CCC
6. ݪҼ w γΣϧΛݺͼग़͢ػೳͷ͋Δؔ਺Λར༻͍ͯ͠Δ
   w γΣϧݺͼग़͠ͷػೳͷ͋Δؔ਺ʹύϥϝʔλΛ
 ౉͍ͯ͠Δ
   w ύϥϝʔλ಺ʹؚ·ΕΔγΣϧͷϝλจࣈΛ
 Τεέʔϓ͍ͯ͠ͳ͍
7. ରࡦ w 04ίϚϯυݺͼग़͠Λ࢖Θͳ͍࣮૷ํ๏Λબ୒͢Δ NBJM
   
   !@1045<NBJM>
   NC@TFOE@NBJM NBJM
   ͜Ε͸ςετͰ͢
   ςετͷຊจͰ͢ɻ
   'SPN
   UFTU!FYBNQMFDPN  NBJM
   
   PHBOZBO!FYBNQMFDPN NBJM
   
   @1045<NBJM>
   TZTUFN VTSTCJOTFOENBJM
   J
   
   UFNQMBUFUYU
   
   
   NBJM  NBJM
8. ରࡦ w γΣϧݺͼग़͠ػೳͷ͋Δؔ਺ͷར༻Λආ͚Δ TZTUFN CJOHSFQ
   LFZXPSE
   WBSEBUB UYU  TZTUFN CJOHSFQ
   Š
   LFZXPSE
   HMPC WBSEBUB UYU 
9. ରࡦ w ֎෦͔Βೖྗ͞ΕͨจࣈྻΛίϚϯυϥΠϯͷύϥϝʔλ ʹ౉͞ͳ͍ 5P
   NBJM
   'SPN
   UFTU!FYBNQMFDPN
   4VCKFDU
   ͜Ε͸ςετͰ͢
   $POUFOU5ZQF
   UFYUQMBJO
   DIBSTFU65'
   $POUFOU5SBOTGFS&ODPEJOH
   CJU
   ςετͷຊจͰ͢ɻ
   &OE0G.BJM NBJM
   
   @1045<NBJM>
   TZTUFN VTSTCJOTFOENBJM
   U
   J
   
   UFNQMBUFUYU 
10. ରࡦ w 04ίϚϯυʹ౉͢ύϥϝʔλΛ҆શͳؔ਺ʹΑΓΤε έʔϓ͢Δ NBJM
    
    @1045<NBJM>
    TZTUFN VTSTCJOTFOENBJM
    
    UFNQMBUFUYU
    
    
    FTDBQFTIFMMBSH NBJM 
11. ͓͠·͍