SECCON2016Yokohama x CEDEC CHALLENGE(totem)

by totem

Slide 1

Slide 1 text

totem(@bbottait) SECCON 2016 × CEDEC CHALLENGE   ήʔϜΫϥοΩϯάˍνʔτνϟϨϯδ ௐࠪ݁Ռ

Slide 2

Slide 2 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  • ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அͷґཔ಺༰ SECCON 2016 x CEDEC CHALLENGE

Slide 3

Slide 3 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ ਍அ݁Ռ:είΞͷվ͟Μ΍HPͷෆਖ਼૿Ճ͸೉͍͠  ϦεΫ: ͳ͠  Өڹ: ͳ͠  ରԠࡦ: ͳ͠    ݕূ؀ڥ: BlueStacks(0.9.30, Android 4.4.2)+ GameGurdian(8.5.6)  ॴݟ: ϝϞϦ͕ద੾ʹ҉߸Խ͞Ε͍ͯΔͨΊʹɺ  ͜ΕΒͷϝϞϦվ͟Μʹର͢Δνʔτ͸೉͍͠   SECCON 2016 x CEDEC CHALLENGE

Slide 4

Slide 4 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ਍அ݁Ռ: ήʔϜຊମͷιʔείʔυͷӾཡ͸Մೳ  ϦεΫ: େ  Өڹ: ஌తࡒ࢈ͷଛࣦ  ରԠࡦ: ޙड़    ݕূ؀ڥ: Android Virtual Device(Nexus5 Android 6.0) ॴݟ: ϦόʔεΤϯδχΞϦϯάରࡦࣗମ͸ߦ͍ͬͯΔ ΋ͷͷෆे෼Ͱ͋Γɺ΋ͬͱద੾ͳରࡦ͕ඞཁͰ͋Δ  SECCON 2016 x CEDEC CHALLENGE

Slide 5

Slide 5 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ Assembly-CSharp.dllΛ҉߸Խ  ݱঢ়ͷNightMareͷϦόʔεΤϯδχΞϦϯάରࡦ •໰୊఺  ϑΝΠϧ͕҉߸Խ͞Ε͍ͯΔ΋ͷͷɺ࣮ߦ࣌ʹ͸෮߸Խ ͞ΕΔͨΊɺιʔείʔυͷӾཡ͕Ͱ͖ͯ͠·͏ SECCON 2016 x CEDEC CHALLENGE

Slide 6

Slide 6 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ࠶ݱख๏ πʔϧ: - GikDbg.Art ͳͲɺAndroid্ͰgdbΛ࢖͏πʔϧ - foremost ͳͲɺόΠφϦ͔ΒϑΝΠϧΛ෮ݩ͢Δπʔϧ - ILSpyͳͲɺdllϑΝΠϧ͔ΒC#ιʔείʔυΛ෮ݩ͢Δπʔϧ ख๏: ήʔϜͷϓϩηεΛgdbʹΞλονͯ͠ɺcoreϑΝΠϧΛಘΔ  foremostͳͲͷπʔϧͰcoreϑΝΠϧ͔ΒdllϑΝΠϧΛ෮ݩ͢Δ  ILSpyͳͲͷπʔϧͰdll͔ΒC#ͷιʔείʔυΛ෮ݩ͢Δ SECCON 2016 x CEDEC CHALLENGE

Slide 7

Slide 7 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ࠶ݱख๏ͷ࣮ࡍ gdbʹΞϓϦͷϓϩηεΛΞλονͯ͠gcoreͰίΞΠϝʔδΛॻ͖ग़͢ SECCON 2016 x CEDEC CHALLENGE

Slide 8

Slide 8 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ࠶ݱख๏ͷ࣮ࡍ ͳ͓ɺࠓճϑΥϨϯδοΫπʔϧͰ͋ΔwinHexΛ༻͍ͯͷϑΝΠϧͷ෮ݩ΋ ࢼΈ͕ͨɺͦͪΒ͸ࣦഊͨ͠ ಘΒΕͨίΞϑΝΠϧʹforemostΛ༻͍Δ ͢Δͱ্ͷΑ͏ʹdllϑΝΠϧ͕ಘΒΕΔ SECCON 2016 x CEDEC CHALLENGE

Slide 9

Slide 9 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ࠶ݱख๏ͷ࣮ࡍ dllϑΝΠϧΛILSpyͰ։͘ SECCON 2016 x CEDEC CHALLENGE

Slide 10

Slide 10 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ରࡦҊ̍ ιʔείʔυࣗମʹࣝผࢠมߋͳͲͷ೉ಡԽॲཧΛ͔͚͔ͯΒ҉߸Խ͢Δ ϝϦοτ σϝϦοτ ιʔείʔυ͕ӾཡͰ͖ͯ΋ίʔυͷཧղʹ͕͔͔࣌ؒΔΑ͏ʹͳΔ  πʔϧͳͲͰखܰʹߦ͑Δ ೉ಡԽ͞Ε͍ͯͯ΋ࠜؾ͕͋Ε͹ಡΊͯ͠·͏ͷͰ׬શͳରࡦͱ ͸ͳΒͳ͍ SECCON 2016 x CEDEC CHALLENGE ίετ ௿

Slide 11

Slide 11 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ରࡦҊ̎ C#ʹଘࡏ͠ͳ͍ػೳΛILϨΠϠͰهड़͢Δ ϝϦοτ σϝϦοτ σίϯύΠϧՄೳͳͷ͕ILϨΠϠ·ͰͱͳΓɺίʔυࣗମ͸อޢ͞ΕΔ ιʔείʔυͦ͜ӾཡͰ͖ͳ͍΋ͷͷɺIL͸·ͩόΠφϦΑΓ͸ ಡΈ΍͘͢ɺཧղͰ͖ͯ͠·͏ SECCON 2016 x CEDEC CHALLENGE ίετ த

Slide 12

Slide 12 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ରࡦҊ̏ IL2CppͰίϯύΠϧΛߦͬͯɺ෮ݩՄೳͳILͷঢ়ଶʹ͠ͳ͍ ϝϦοτ σϝϦοτ ιʔείʔυʹ෮ݩ͞ΕΔՄೳੑ͕ͳ͍ ιʔε͕ࣦΘΕΔͨΊɺιʔείʔυߦ୯Ґͷσόοά͕Ͱ͖ͳ͍ MonoͰಈ͍ͯ΋IL2CPPͰಈ͔ͳ͍৔߹͕͋Δ SECCON 2016 x CEDEC CHALLENGE ίετ த blogs.unity3d.com ΑΓҾ༻

Slide 13

Slide 13 text

• ήʔϜຊମͷιʔείʔυΛӾཡͰ͖Δ͔? NightMareͷ਍அ݁Ռ ରࡦҊ·ͱΊ SECCON 2016 x CEDEC CHALLENGE ίετ ϝϦοτ σϝϦοτ ೉ಡԽ ௿ খ খ ILͰهड़ த த খ IL2CPP த େ த ՄೳͰ͋Ε͹IL2CPPΛબ୒ɺͦ͏Ͱͳ͚Ε͹ILͰͷهड़ͱ೉ಡԽΛߦ͍͍ͨ

Slide 14

Slide 14 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ ιʔείʔυͷӾཡ͕ՄೳͳΒ͹ɺ  ιʔεͷॻ͖׵͑Ͱ্ͷΑ͏ͳνʔτ͕Մೳ͔ʁ SECCON 2016 x CEDEC CHALLENGE dllͷ෮߸Խॲཧ͕ߦΘΕΔͨΊɺ҉߸Խ͞Εͯͳ͍վ଄dllΛ഑ஔͯ͠΋ಈ͔ͳ͍  ·ͨɺ҉߸Խͷ伴ͷೖख͸೉͍͠  ෮߸Խॲཧ෦෼ʹύονΛ౰ͯΔͱ͍͏ख๏΋͋Δ͕ɺ೉͍͠ ΋ͪΖΜ೉͍͕͠ՄೳͰ͸͋ΔͷͰɺιʔείʔυͷӾཡࣗମΛ๷͙΂͖

Slide 15

Slide 15 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ೉͍͕͠ɺ෮߸Խॲཧ෦෼ʹύονΛ౰ͯΕ͹ՄೳͰ͋Δ ࠶ݱख๏ πʔϧ: - VisualStudio - IDA Pro DEMO - Stirling ͳͲͷόΠφϦΤσΟλ ख๏: VisualStudioͰapkιʔείʔυͷdllΛվ͟Μͯ͠Ϗϧυ  IDA Pro ͰɺϑΝΠϧ෮߸Խॲཧ෦෼Λ୳͠ɺ  StirlingͰॻ͖׵͑Δ

Slide 16

Slide 16 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE VisualStudioͰείΞΛվ͟Μ͠Ϗϧυ ࠶ݱख๏ͷ࣮ࡍ

Slide 17

Slide 17 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE IDA ProͰAssembly-CSharpͷಡΈࠐ·ΕΔ৔ॴΛಛఆ͠ɺ  StirilingͷΑ͏ͳόΠφϦΤσΟλͰcrypt෦෼Λ  nop(Կ΋͠ͳ͍)ͰຒΊΔ  (Demo൛Ͱ͸ฤूΛอଘͰ͖ͳ͍) ࠶ݱख๏ͷ࣮ࡍ

Slide 18

Slide 18 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ

Slide 19

Slide 19 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ

Slide 20

Slide 20 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ ૬खͷ߈ܸͰମྗ͕ݮࢉ͞ΕΔॲཧΛ  Ճࢉʹมߋͯ͠Ϗϧυ͢Δ

Slide 21

Slide 21 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ HPΛෆਖ਼ʹ૿Ճͤ͞  ෆࢮ਎

Slide 22

Slide 22 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ ࣗ༝ʹιʔε͕ॻ͖׵͑ΒΕΔͷͰHPɺείΞʹݶΒͣ߈ܸྗͷνʔτ΍  ఢͷࣗյͰ΋ԿͰ΋ࣗ༝ʹͰ͖ͯ͠·͏

Slide 23

Slide 23 text

• είΞͷվ͟Μ͸Ͱ͖Δ͔?  • HPΛෆਖ਼ʹ૿ՃͰ͖Δ͔?  NightMareͷ਍அ݁Ռ ରࡦҊ SECCON 2016 x CEDEC CHALLENGE ιʔείʔυͷӾཡࣗମΛ๷͙ վ͟Μݕ஌΋nopͰ௵͞Εͯͦ͜·ͰޮՌ͕ͳ͍ͷͰ

Slide 24

Slide 24 text

NightMareͷ਍அ݁Ռ ࠓޙIL2CPPͰ͸ϦόʔεΤϯδχΞϦϯάΛ๷͖͗ΕΔ͔? SECCON 2016 x CEDEC CHALLENGE IL2CPPͷڧΈ   -> UnityEngine෦෼ɺIL2CPP෦෼ɺϢʔβʔίʔυ෦෼͕શͯStripped Binary  -> ͜ΕͰ͸ղੳ͕౰વ೉͍͠  IL2CPPͷഁΓํ  UnityEngine෦෼ɺIL2CPP෦෼ʹ͍ͭͯ͸ڞ௨෦෼Ͱ͋ΔͷͰɺಛఆ͕Մೳ  ࠓޙ೥݄͕ܦͭʹ͖ͭɺΞηϯϒϥ͔ΒͲͷؔ਺͔ಛఆ͞Ε͏ΔΑ͏ʹͳΔ    -> ͋ͱ͸ϢʔβʔίʔυͷΞηϯϒϥ͚ͩ͹ಡΊ͹͍͍  -> ಛʹUnityEngineʹ৐͔ͬΔϓϩάϥϜͰ͋Δ͔ΒɺUnityEngineͷͲͷؔ਺ΛݺͿ͔Ͱ  -> େମͷϓϩάϥϜͷಈ͖͕෼͔ͬͯ͠·͏ ैདྷͷAnti-Disassembleٕज़(ΨʔϕʔδόΠτͷ഑ஔͳͲ)ͱ૊Έ߹Θͤͯ๷͙΂͖

Slide 25

Slide 25 text

֤छεςʔλεΛ͸͡ΊɺશൠతͳηΩϡϦςΟ (νʔτͷՄ൱)ʹ͍ͭͯௐ͍͚ࠪͯͨͩ͠Ε͹ ͱ ࢥ͍·͢ɻ νʔτ͕Ͱ͖Δ৔߹͸ɺͦͷख๏ͱରࡦҊ΋͝ ڭत͍͚ͨͩΕ͹༗೉͍Ͱ͢ɻ SUNIDRA2ͷ਍அͷґཔ಺༰ SECCON 2016 x CEDEC CHALLENGE

Slide 26

Slide 26 text

εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ϦεΫ: த  Өڹ: ήʔϜͷण໋ΛॖΊΔ  ରԠࡦ: ޙड़    ݕূ؀ڥ:Android Virtual Device(Nexus5 Android 6.0)  ॴݟ: rootԽͯ͠shared_prefsΛॻ͖׵͑Δ͚ͩͰग़དྷ ΔͷͰ༰қ 

Slide 27

Slide 27 text

εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ͸վ͟ΜՕॴ

Slide 28

Slide 28 text

εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ πʔϧ: - rootԽͨ͠Android୺຤ ख๏: /data/data/com.kenji.seccon.cedec.game/shared_prefs/ com.kenji.seccon.cedec.game.xml  ͷstamina_update_timeͷvalue΍game_flagɺstaminaͳͲΛฤू͢Δ

Slide 29

Slide 29 text

εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ Key΋Value΋Θ͔Γ΍͘͢อଘ͞Ε͓ͯΓɺ༰қʹվ͟ΜՄೳ (·ͨɺrootͰͳ͍ͱΞΫηεͰ͖ͳ͍ͱͯ͠΋ύεϫʔυͷฏจอଘ͸ਪ঑͞Εͳ͍) (΋ͪΖΜͦ΋ͦ΋rootԽ͸ਪ঑Ͱ͖·ͤΜ!!)

Slide 30

Slide 30 text

εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE νʔτͰ͸ͳ͍͕… ύεϫʔυ͕ฏจอଘ͞Ε͍ͯΔ  -> ΞΧ΢ϯτϋοΩϯάʹͭͳ͕Δ  ख๏  ϑΝΠϧ͔ΒύεϫʔυͱIDΛಡΈग़ͯ͠௨৴͢ΔΞϓϦΛ࡞Γ  SUNIDRA2ͷνʔτπʔϧΛ໊৐ͬͯ഑෍͢Δ  [rootԽ͍ͯ͠ΔSUNIDRA2ϢʔβʔʹλʔήοτΛߜΕΔ] ରࡦҊ ύεϫʔυΛฏจอଘ͠ͳ͍ ͔͠͠ɺΦʔτίϯϓϦʔτͰύεϫʔυΛิ׬͢ΔͨΊʹ෮߸ॲཧ͕ΞϓϦʹؚ·ΕΔ  -> ϦόʔεΤϯδχΞϦϯάͰ෮߸ॲཧ͕ݟ͚ͭΒΕΔͱഁΒΕΔ ϢʔβʔଆͰrootԽ͠ͳ͍ɺո͍͠πʔϧΛΠϯετʔϧ͠ͳ͍

Slide 31

Slide 31 text

εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ରࡦҊ̍ Root୺຤Ͱ͸ήʔϜΛϓϨΠग़དྷͳ͍Α͏ʹઃఆ͢Δ ϝϦοτ σϝϦοτ ଞͷνʔτ΁ͷରࡦͱͯ͠΋ػೳ͢Δ RootͰxml͕ฤूͰ͖ɺ͔ͭΞϓϦଆ͔Β͸rootͰ͸ͳ͍Α ͏ʹݟ͑ΔΑ͏ʹઃఆͰ͖ΔͷͰޮՌ͸ݶఆత ίετ த

Slide 32

Slide 32 text

εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ରࡦҊ̎ xmlʹ֨ೲ͢ΔσʔλΛ҉߸Խ͢Δ+ϋογϡͰվ͟Μݕ஌ ϝϦοτ σϝϦοτ σʔλͷվ͟Μ͕೉͘͠ͳΔ ελϛφͳͲ͸ɺϋογϡʹΑΔվ͟Μݕ஌ΛؚΊͨͱͯɺ ஋ͱͦͷ࣌ͷϋογϡΛه࿥͢Δ͜ͱͰɺϋογϡ΋ؚΊ վ͟Μ͢Δ͜ͱͰվ͟Μݕ஌ΛճආͰ͖ͯ͠·͏ ίετ த

Slide 33

Slide 33 text

εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ରࡦҊ̏ ͦ΋ͦ΋୺຤ʹͦ͏͍ͬͨσʔλΛอଘ͠ͳ͍ ϝϦοτ σϝϦοτ ϩʔΧϧσʔλͷվ͟ΜΛ׬શʹ્ࢭͰ͖Δ ௨৴ྔ͕େ͖͘ͳͬͯ͠·͏  αʔόʔͱͷ௨৴ؒνʔτʹϦεΫ͕ूத͢Δ ίετ த

Slide 34

Slide 34 text

SUNIDRA2ͷ਍அ݁Ռ ରࡦҊ·ͱΊ SECCON 2016 x CEDEC CHALLENGE ίετ ϝϦοτ σϝϦοτ Rootରࡦ த த খ ҉߸Խ  +վ͟Μݕ஌ த த খ σʔλͷҠৡ த େ த Rootରࡦ͸ޮՌ͸ݶఆత͕ͩߦ͏΂͖ɺԼ2ͭͷରࡦ͸ΞϓϦʹԠͯ͡બ୒ εςʔδΫϦΞঢ়گٴͼελϛφͷվ͟Μ͕༰қ

Slide 35

Slide 35 text

ΞϓϦىಈ࣌ʹωοτϫʔΫ͕ෆ௨ͷ৔߹ɺ ϩάΠϯޙͷ௨৴͕ෆೳʹͳΔ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ϦεΫ: ࢀߟఔ౓  Өڹ: ϢʔβʔͷࠞཚΛট͘  ରԠࡦ: ޙड़    ݕূ؀ڥ:Android Virtual Device(Nexus5 Android 6.0)  ॴݟ: ޙड़ͷνʔτํ๏Λࢥ͍ͭ͘ख͕͔ΓͱͳΓಘΔ 

Slide 36

Slide 36 text

ΞϓϦىಈ࣌ʹωοτϫʔΫ͕ෆ௨ͷ৔߹ɺ ϩάΠϯޙͷ௨৴͕ෆೳʹͳΔ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ πʔϧ: - /etc/hostsͷॻ͖׵͑ΒΕͨAndroid୺຤ - burp suite ͳͲͷϓϩΩγπʔϧ ख๏: BurpͰΞϓϦىಈ࣌ʹߦΘΕΔ௨৴Ͱbodyʹcodeͱ͍͏key͕͋Δ ϦΫΤετΛDrop͢Δ

Slide 37

Slide 37 text

ΞϓϦىಈ࣌ʹωοτϫʔΫ͕ෆ௨ͷ৔߹ɺ ϩάΠϯޙͷ௨৴͕ෆೳʹͳΔ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ ͜ΕΛDrop͢Δ

Slide 38

Slide 38 text

ΞϓϦىಈ࣌ʹωοτϫʔΫ͕ෆ௨ͷ৔߹ɺ ϩάΠϯޙͷ௨৴͕ෆೳʹͳΔ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ 2Dը໘΁ͱભҠ͠ɺΞΠίϯͷλοϓɺ  ఢͱͷ઀৮ʹؔΘΒͣ௨৴͕ੜͣ͡3Dγʔϯ΁ͷҠߦ΋ͳ͍

Slide 39

Slide 39 text

SUNIDRA2ͷ਍அ݁Ռ ରࡦҊ codeͷ௨৴ΛϩάΠϯͷϘλϯΛԡͨ͠ޙͷॲཧ΁ͱҠ͢ ϝϦοτ σϝϦοτ codeͷ௨৴ͰΤϥʔ͕ੜͯ͡΋ϩάΠϯॲཧͷࣦഊͱͯ͠ද ࣔͰ͖ɺϢʔβʔ͕ࠞཚͤͣʹcodeͷ௨৴Λ੒ޭͤ͞ΒΕΔ ಛʹͳ͠ SECCON 2016 x CEDEC CHALLENGE ίετ ௿ ΞϓϦىಈ࣌ʹωοτϫʔΫ͕ෆ௨ͷ৔߹ɺ ϩάΠϯޙͷ௨৴͕ෆೳʹͳΔ

Slide 40

Slide 40 text

μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ϦεΫ: େ  Өڹ: ήʔϜόϥϯεͷ่յɺήʔϜͷण໋ΛॖΊΔ  ରԠࡦ: ޙड़    ݕূ؀ڥ:Android Virtual Device(Nexus5 Android 6.0)  ॴݟ: ࣮૷্ͷෆඋ͔Β͔ɺϩʔΧϧͰͷΈμΠϠੴΛ500 ݸʹ૿΍͢͜ͱ͕Ͱ͖Δ  ੴʹର͠՝ۚͳͲΛ՝͢৔߹ɺ՝ۚγεςϜ่͕յ͢Δ  (μΠϠੴͷվ͟ΜʹΑͬͯ࢒Γ3ύϥϝʔλͷνʔτ)

Slide 41

Slide 41 text

μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE (μΠϠੴͷվ͟ΜʹΑͬͯ࢒Γ3ύϥϝʔλͷνʔτ) ͸վ͟ΜՕॴ

Slide 42

Slide 42 text

Ұͭલͷ໰୊఺ͱ߹ΘͤΔͱ 2Dը໘ͷύϥϝʔλ͸͍ͣΕ΋νʔτ͠͏Δ SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ͸վ͟ΜՕॴ

Slide 43

Slide 43 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ πʔϧ: - /etc/hostsͷॻ͖׵͑ΒΕͨAndroid୺຤ - burp suite ͳͲͷϓϩΩγπʔϧ ख๏: ϓϩΩγπʔϧͰ௨৴Λվ͟Μ͢Δ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ

Slide 44

Slide 44 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE SUNIDRA2ͷ௨৴ͷྲྀΕ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ୺຤ࣝผͷσʔλʁ ϩάΠϯͷॲཧ ϢʔβʔͷύϥϝʔλΛऔͬͯ͘Δॲཧ Ҏ߱ήʔϜͷॲཧ ͳ͓ɺσʔλ͸҉߸Խ͞Ε͓ͯΓɺվ͟Μ͸೉͍͠

Slide 45

Slide 45 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ୺຤ࣝผͷσʔλʁ ϩάΠϯͷॲཧ ϢʔβʔͷύϥϝʔλΛऔͬͯ͘Δॲཧ ͜ͷ௨৴ΛDropͯ͠΍Δ

Slide 46

Slide 46 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ࣮૷্ͷෆඋ͔Β͔ɺ߈ܸྗɺମྗɺίΠϯ͕ॳظ஋ɺμΠϠੴ͕500ͱ͍͏ঢ়ଶʹͳΔ

Slide 47

Slide 47 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ߈ܸྗUpɺମྗUpͳͲͷϦΫΤετ Success or Fail ஋ͷݕূ ੴͷݸ਺ͰϦΫΤετ੍ݶ

Slide 48

Slide 48 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ૹ৴͞ΕΔϦΫΤετ͸session idͱ҉߸Խ͞Εͨσʔλ

Slide 49

Slide 49 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ αʔόʔଆͷ஋ͷݕূʹҾ͔͔ͬΔͱ ্ͷΑ͏ʹϨεϙϯε͕ฦΓɺΞϓϦ͕ఀࢭ͢Δ(Dropͯ͠΋ಉ༷ʹఀࢭ͢Δ)

Slide 50

Slide 50 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ҰํϦΫΤετ͕ਖ਼ৗʹॲཧ͞ΕΔͱ succeed{session}ͷΑ͏ʹϨεϙϯε͕ฦΔ

Slide 51

Slide 51 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ߈ܸྗUpɺମྗUpͳͲͷϦΫΤετ Success or Fail ਖ਼نαʔόʔ ࣮૷ͷෆඋͰੴ500ί ௨ৗ͸͜͜ͰFailΛฦ͢͜ͱʹΑͬͯվ͟Μ๷ࢭ

Slide 52

Slide 52 text

SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ਖ਼نαʔόʔ ࣮૷ͷෆඋͰੴ500ί ߈ܸྗUpɺମྗUpͳͲͷϦΫΤετ ѱҙ͋Δαʔό ஋ͷݕূΛߦΘͣɺৗʹsuccessΛฦ͢ ※αʔόʔ͸೚ҙ͕ͩɺࠓճ͸node.jsΛ༻͍ͨ Ϧ μ Π Ϩ Ϋ τ SUNIDRA2ͷ਍அ݁Ռ

Slide 53

Slide 53 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ِ૷ͨ͠Ϩεϙϯε͸ӈ(node.jsͷExpressΛ࢖༻͍ͯ͠Δ)

Slide 54

Slide 54 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ߈ܸྗ΍ମྗ͸͜ͷΑ͏ʹվ͟ΜՄೳ

Slide 55

Slide 55 text

SUNIDRA2ͷ਍அ݁Ռ SECCON 2016 x CEDEC CHALLENGE ࠶ݱख๏ͷ࣮ࡍ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ίΠϯ΋ಉ༷ʹͯ͠վ͟ΜՄೳ

Slide 56

Slide 56 text

SUNIDRA2ͷ਍அ݁Ռ ରࡦҊ̍ εςʔλεΛड͚औΒͳ͍ঢ়ଶͰͷμΠϠੴΛ0ίʹ͓ͯ͘͠ ϝϦοτ σϝϦοτ ௨৴ΛDrop͞Εͨ৔߹Ͱ΋μΠϠੴͷෆਖ਼Λ๷ࢭ͢Δ  ࣮૷ͷෆඋͷగਖ਼ ಛʹͳ͠ SECCON 2016 x CEDEC CHALLENGE μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ίετ ௿

Slide 57

Slide 57 text

SUNIDRA2ͷ਍அ݁Ռ ରࡦҊ̎ ϩάΠϯ࣌ʹμΠϠੴ΍߈ܸྗͳͲͷεςʔλεΛड͚औΔΑ͏ʹ͢Δ ϝϦοτ σϝϦοτ ࣮૷ͷෆඋ͕ଘࡏ͍ͯͯ͠΋ɺෆਖ਼Λ๷ࢭ͢Δ͜ͱ͕Ͱ͖Δ ಛʹͳ͠ SECCON 2016 x CEDEC CHALLENGE μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ίετ ௿

Slide 58

Slide 58 text

SUNIDRA2ͷ਍அ݁Ռ ରࡦҊ̏ ௨৴ͷresponse΋Success{session}͚ͩͰ͸ແ͘ɺ࣌ࠁͳͲΛมԽ ͢Δ஋Λ෇Ճ্ͨ͠Ͱ҉߸ԽΛߦ͏ ϝϦοτ σϝϦοτ Ϩεϙϯεͷِ૷͕ඇৗʹ೉͘͠ͳΔ ॲཧ͕૿͑ΔͨΊ଎౓͕མͪΔ SECCON 2016 x CEDEC CHALLENGE μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ ίετ த

Slide 59

Slide 59 text

SUNIDRA2ͷ਍அ݁Ռ ରࡦҊ·ͱΊ SECCON 2016 x CEDEC CHALLENGE ίετ ϝϦοτ σϝϦοτ ࣮૷ͷෆඋͷగਖ਼ ௿ த ಛʹͳ͠ ௨৴λΠϛϯά ͷվળ ௿ த ಛʹͳ͠ responseͷ҉߸Խ த த খ ͍ͣΕ΋িಥ͠ͳ͍ͷͰׂ͚ΔίετʹԠͯ͡ߦ͏΂͖ μΠϠੴɺ߈ܸྗɺମྗɺίΠϯͷվ͟Μ͕Մೳ