ハニーポットが捕まえた WebShell を分析してみた

by Kazuaki Morihisa

Slide 1

Slide 1 text

2017೥9݄30೔ ୈ1ճϋχʔϙολʔٕज़ަྲྀձ ൃදࢿྉ ϋχʔϙοτ͕ั·͑ͨ WebShell Λ෼ੳͯ͠Έͨ @morihi_soc

Slide 2

Slide 2 text

XIPBNJ w ৿ٱ࿨ত !NPSJIJ@TPD w ຊۀ͸ηΩϡϦςΟΤϯδχΞɾΞφϦετ w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ w ϒϩάˠIUUQXXXNPSJIJTPDOFU w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ w άϧʔϓˠIUUQTIBOJQPUFDIDPOOQBTTDPN ˡϒϩάͷʮϋχʔϙοτ؍࡯ه࿥ʯ͕ ຊʹͳΓ·ͨ͠ ೥݄೔ൃച ిࢠॻ੶൛ແྉࢼಡ൛͋Γ·͢ ʮαΠόʔ߈ܸͷ଍੻Λ෼ੳ͢Δ ϋχʔϙοτ؍࡯ه࿥ʯ ஶऀɿ৿ٱ࿨ত ग़൛ɿल࿨γεςϜ ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ ɾ*5,FZT ݱ4FD$BQ ɾωοτϫʔΫύέοτΛಡΉձ Ծ ɾ/*4$αΠόʔϋϩ΢Οϯ ɾ*OUFSOFU8FFL ɾ)BSEFOJOH 7BMVF$IBJO༏উ ɾTTNKQ ɾ"*4FD ɾULULηΩϡϦςΟษڧձ

Slide 3

Slide 3 text

/P/P%JNFOTJPO 3 Ҿ༻ɿhttps://www.ﬂickr.com/photos/nasawebbtelescope/16678793810/in/album-72157624413830771/ δΣΠϜζɾ΢ΣοϒӉ஦๬ԕڸ ίίʹطࢹײ͕ʁ ԕ͍Ӊ஦Λ؍ଌ͢ΔӉ஦๬ԕڸͱ αΠόʔ߈ܸΛ؍ଌ͢Δϋχʔϙοτ NASA ͸ϋχϙςοΫΛ༧ଌ͍ͯͨ͠?

Slide 4

Slide 4 text

͜ΜͳΞΫηεϩάݟͨ͜ͱ͋ΔΑͶʁ HSFQ1045BDDFTT@MPHcHSFQaQIQl 4 1045XQBENJOBENJOBKBYQIQ)551 1045XQDPOUFOUQMVHJOTGPSNDSBGUpMFVQMPBETFSWFSDPOUFOUVQMPBEQIQ 1045'$,VQMPBEQIQ)551 1045'MBTI$IBUVQMPBEQIQ)551 1045'MBTI$IBU@W@DIBUVQMPBEQIQ)551 1045NVQMPBEQIQ)551 1045NPEVMFTBUUSJCVUFXJ[BSEQSP0-%pMF@VQMPBEQIQ)551 1045NPEVMFTBUUSJCVUFXJ[BSEQSPpMF@VQMPBEQIQ)551 1045NPEVMFTDBSUBCBOEPONFOUQSPVQMPBEQIQ)551 1045NPEVMFTDPMVNOBEWFSUTVQMPBEJNBHFQIQ)551 1045NPEVMFTIPNFQBHFBEWFSUJTFVQMPBEJNBHFQIQ)551 1045NPEVMFTKSP@IPNFQBHFBEWFSUJTFVQMPBEJNBHFQIQ)551 1045NPEVMFTNPE@TJNQMFpMFVQMPBEWFMFNFOUTVEEQIQ)551z 1045NPEVMFTQSPEVDUQBHFBEWFSUTVQMPBEJNBHFQIQ)551 1045NQMJTUVQMPBEQIQ)551

Slide 5

Slide 5 text

1045ͷѼઌΛूܭͯ͠ΈΔ 1045XQBENJOBENJOBKBYQIQ)551 1045XQBENJOBENJOBKBYQIQ)551 1045 QXQBENJOBENJOBKBYQIQ)551 1045YNMSQDQIQ)551z 1045XQMPHJOQIQ)551 1045YNMSQDQIQ)551 1045 QXQBENJOBENJOBKBYQIQ)551 1045DPNNBOEQIQ)551 1045 QXQBENJOBENJOBKBYQIQ)551 1045MJDFOTFQIQ)551 5 աڈ1೥൒ͷΞΫηεϩάʹ͓͚Δ্Ґ10݅ͷΞΫηε݅਺ͱURL /wp-admin/admin-ajax.php Ѽͷ߈ܸ͕ѹ౗తʹଟ͍!

Slide 6

Slide 6 text

͓͞Β͍ w 1045ˠΫϥΠΞϯτ͔Βαʔό΁ͷσʔλૹ৴ w ϑΥʔϜͷೖྗ΍ϑΝΠϧͷΞοϓϩʔυͰར༻ w XQBENJOBENJOBKBYQIQΛ෼ղ͢Δͱ w XQBENJOˠ8PSE1SFTTͷσΟϨΫτϦ w BENJOBKBYQIQˠ8PSE1SFTTͰ"+"9ͷ  ΞΫηεΛड͚෇͚ΔͨΊͷΠϯλʔϑΣʔε  "+"9ʜϖʔδશମΛ࠶ಡΈࠐΈ͢Δ͜ͱͳ͘ɺ  Ұ෦ͷ৘ใ͚ͩΛߋ৽Ͱ͖ΔΑ͏ʹ͢Δٕज़ 6 AJAX ͷΠϯλʔϑΣʔεͳΒ͹ɺ ௨ৗ௨৴ͷՄೳੑ͕͋ΔͷͰ͸?

Slide 7

Slide 7 text

QDBQ͸ޠΔ 7 revslider_ajax_action ͷ௨৴ zip ϑΝΠϧͷΞοϓϩʔυ

Slide 8

Slide 8 text

Ξοϓϩʔυ͞ΕͨϑΝΠϧΛௐࠪ w [JQϑΝΠϧΛల։͠ɺத਎ͷECQIQϑΝΠϧΛ  औΓग़ͯ͠ɺεΩϟϯͯ͠Έͨɻ 8 VirusTotal ͷ݁Ռ https://www.virustotal.com/en/ﬁle/3ae2f819031e2ce67bf0c05106c3fbcee37449ab3459011b4be78af711b3994e/analysis/ ෆ৹ͳ ϑΝΠϧ!

Slide 9

Slide 9 text

೉ಡԽΛݩʹ໭͢ 9 FOPO ͷσίʔυαʔϏεఏڙαΠτˠ http://decode.tools/ UnPHP ΋σίʔυαʔϏεΛఏڙ͠Δ͕ɺFOPO ͸͏·͘ݩʹ໭ͤͳ͍ˠ https://www.unphp.net/ ↑db.php ΛςΩετΤσΟλͰ։͘ͱ FOPO ͱ͍͏୯ޠ͕ݟ͑Δ ↓FOPO ͷσίʔυޙ WSO

Slide 10

Slide 10 text

$7& w ͜ͷ௨৴͸ɺ8PSE1SFTT༻5IFNF1VODI4MJEFS 3FWPMVUJPOϓϥάΠϯ͓Αͼ4IPXCJ[1SP  ϓϥάΠϯʹ͓͚Δ೚ҙͷϑΝΠϧΛΞοϓϩʔυ ͞ΕΔ੬ऑੑΛૂͬͨ߈ܸͰ͢ɻ w $7&͸೥Ͱ͕͢ɺ೥ݱࡏͰ΋߈ܸ͸ଟ ਺ݕ஌͍ͯ͠·͢ɻ w ߈ܸऀ͕ଟ਺ଘࡏ͢ΔͷͰ͋Ε͹ɺΞοϓϩʔυ͢ ΔϑΝΠϧ΋ҧ͏͜ͱ͕༧૝͞ΕΔ  10 →ϑΝΠϧΛऩूͯ͠෼ੳ͍ͨ͠ͱ͍͏޷ح৺ IUUQKWOECKWOKQKBDPOUFOUT+7/%#IUNM

Slide 11

Slide 11 text

1045ͷσʔλ෦෼ w ௨ৗͷ8FCαʔόͷΞΫηεϩάʹɺ  ࠓճͷΑ͏ͳ1045ͷσʔλ෦෼͸ه࿥͞Εͳ͍ w ύέοτμϯϓΛͣͬͱ͢Δ͜ͱ΋ࠔ೉ w ͯ͞Ͳ͏͢Δ͔ɾɾɾ 11

Slide 12

Slide 12 text

ͦΜͳ͓೰ΈΛ͓࣋ͪͷํʹ͏͚ͬͯͭͷٕज़͕ 12 ϋχʔϙοτͩͬͨΒɺ  ௨৴Λ·Δͬͱه࿥Ͱ͖ͯޙ͔Β෼ੳͰ͖Δ!

Slide 13

Slide 13 text

8FC4IFMM঺հ w ͭ঺հ͢ΔΑ 13 ᶃ ᶄ ᶅ ᶆ

Slide 14

Slide 14 text

8FC4IFMMͦͷ 14

Slide 15

Slide 15 text

8FC4IFMMͦͷ w 8FC4IFMMքͰ͸༗໊ͳ840ͱ͍͏ϑΝΠϧ w ಛ௃ɿଟػೳ w αʔό৘ใͷ؆қදࣔ 04όʔδϣϯ΍ϋʔυσΟεΫ౳ w ϑΝΠϧͷΞοϓϩʔυɾࢀরɾฤूɾ࡟আ w 04ίϚϯυ࣮ߦ༻ίϯιʔϧ w 42-઀ଓ༻ίϯιʔϧ w 1)1ίʔυ࣮ߦ༻ίϯιʔϧ w 1)1ηʔϑϞʔυճආ w จࣈྻม׵πʔϧ w ϒϧʔτϑΥʔε߈ܸπʔϧ '51.Z4RM1PTUHSF4RM w όοΫυΞ઀ଓ༻ωοτϫʔΫπʔϧ w ࣗݾ࡟আػೳ౳ w ݟͨ໨΋௚ײతʹΘ͔Γ΍͘͢ɺ߈ܸऀ͕Α͘࢖͍ͬͯΔɻ 15

Slide 16

Slide 16 text

8FC4IFMMͦͷ 16

Slide 17

Slide 17 text

8FC4IFMMͦͷ w ϑΝΠϧૢ࡞͕ओػೳͷ8FC4IFMM w 840ʹ͸ྼΔ͕ଟػೳ w αʔό৘ใͷ؆қදࣔ 04όʔδϣϯ΍ϋʔυσΟεΫ౳ w ϑΝΠϧͷΞοϓϩʔυɾࢀরɾฤूɾ࡟আ w 04ίϚϯυ࣮ߦ༻ίϯιʔϧ w 42-઀ଓ༻ίϯιʔϧ w όοΫυΞ઀ଓ༻ωοτϫʔΫπʔϧ౳ w վม͞ΕͯΑ͘ݟΔ 17

Slide 18

Slide 18 text

8FC4IFMMͦͷ 18

Slide 19

Slide 19 text

8FC4IFMMͦͷ w 1)11SJODFͱ໊৐ΔελΠϦογϡͳ8FC4IFMM w 840Λ௒͑ΔػೳΛ࣋ͭ w αʔό৘ใͷ؆қදࣔ 04όʔδϣϯ΍ϋʔυσΟεΫ౳ w ϑΝΠϧͷΞοϓϩʔυɾࢀরɾฤूɾ࡟আ w 04ίϚϯυ࣮ߦ༻ίϯιʔϧ w 42-઀ଓ༻ίϯιʔϧ w 1)1ίʔυ࣮ߦ༻ίϯιʔϧ w 1)1ηʔϑϞʔυճආ w จࣈྻม׵πʔϧ w ϒϧʔτϑΥʔε߈ܸπʔϧ w όοΫυΞ઀ଓ༻ωοτϫʔΫπʔϧ w ϙʔτεΩϟφʔ w XIPJTػೳ w IUBDDFTTIUQBTTXEੜ੒πʔϧ w ϝʔϧૹ৴ػೳ౳ 19

Slide 20

Slide 20 text

8FC4IFMMͦͷ 20

Slide 21

Slide 21 text

8FC4IFMMͦͷ w ϑΝΠϧΞοϓϩʔυػೳ͔͠ͳ͍ w ը໘ΛΑ͘ݟΔͱʮ(*'B(ʯͱදࣔ͞Ε͍ͯΔ w pMFίϚϯυͰͷ൑ผͯ͠ΈΔͱɾɾɾ 21 த਎͸ PHP ϑΝΠϧͳͷʹɺGIF ϑΝΠϧͱ൑ఆ https://www.virustotal.com/en/ﬁle/7a800b47cfa6656f3925e6c0b421201e98faee59c201b361dc86745b70dba80f/analysis/1506670589/

Slide 22

Slide 22 text

8FC4IFMMΛઃஔ͞ΕΔͱͲ͏ͳΔ w ϋχʔϙοτͰ؍ଌͰ͖Δͷ͸ɺ8FC4IFMMͷ  Ξοϓϩʔυߦҝ·Ͱɻ w ͦͷޙͷߦಈ͸؍ଌͰ͖͍ͯͳ͍ͷͰ༧ଌɻ w 8FCαʔό಺෦ͷϑΝΠϧͷ઄औ΍վ͟Μ w 8FCαʔόҎ֎΁৵ೖ͢Δԣల։ w ֎෦ϗετ΁ͷ߈ܸͷ౿Έ୆ w Ϛϧ΢ΣΞͷஔ͖৔ɾ֦ࢄʹར༻͞ΕΔ w ϑΟογϯάαΠτΛઃஔ͞ΕΔ w ϝʔϧͷεύϜૹ৴ʹར༻͞ΕΔ 22

Slide 23

Slide 23 text

8FC4IFMMΛ෼ੳ͢Δͱ͖ͷ஫ҙ w ΫϩʔζυωοτϫʔΫͰ෼ੳ͠·͠ΐ͏ɻ w ೉ಡԽ͞Ε͍ͯΔ৔߹ɺಈ͔͢ ϒϥ΢βͰΞΫηε ͢Δͱ͍࣋ͬͯΔػೳΛ೺Ѳ͠΍͍͢Ͱ͢ɻ w 1)1Ͱ͋Ε͹FWBM ˠQSJOU ʹஔ׵΋༗ޮ w ΞΫηε੍ݶػೳΛ͍࣋ͬͯΔ৔߹͸ɺιʔε  ίʔυͷ֘౰෦෼ΛίϝϯτΞ΢τͯ͠όΠύεɻ 23

Slide 24

Slide 24 text

8FC4IFMM͔ΒαʔόΛकΔɾൃݟ͢Δ w $.4Ͱ͋Ε͹ΞοϓσʔτΛ͔ܽ͞ͳ͍ w ֦ுػೳ͕ૂΘΕΔ͜ͱ΋͋Δ w 8"' 8FC"QQMJDBUJPO'JSFXBMM Λಋೖ͢Δ w ΦʔϓϯιʔεͰ͸.PE4FDVSJUZ͕༗໊ w վ͟Μݕ஌ػೳΛಋೖ͢Δ w ΦʔϓϯιʔεͰ͸"*%&͕༗໊ w Ξϯν΢ΠϧειϑτͰεΩϟϯ w ΋͠΋ͷͱ͖ͷૣظൃݟʹͭͳ͕Δ 24

Slide 25

Slide 25 text

·ͱΊ w 4MJEFS3FWPMVUJPOͷ੬ऑੑΛૂͬͨ߈ܸ͸ࠓͰ΋ ଟ਺ݕ஌͍ͯ͠Δɻ w ௨ৗͷ8FCαʔόͰ͸ɺ1045ͷσʔλ෦෼͕ϩ άʹ࢒Βͳ͍ઃఆ͚ͩͲɺϋχʔϙοτͩͬͨΒͦ ͷ෦෼΋ؚΊͯه࿥͞ΕΔɻ w 8FC4IFMM͸ଟػೳͳ΋ͷ͔Βղੳආ͚Λ͢Δ΋ͷ ·Ͱଟछଟ༷ͳ΋ͷ͕͋Δɻ w ߈ܸऀͷखͷ಺Λ஌ͬͯɺηΩϡϦςΟରࡦʹ׆͔ ͠·͠ΐ͏ɻ 25

Slide 26

Slide 26 text

͓͠·͍ 26 Happy Honeypot!