DNSトンネリングの手法 / A technique of DNS tunneling (#ssmjp)

by shutingrz

Slide 1

Slide 1 text

%/4τϯωϦϯάͷख๏ ͠Ύʔͱ !TIVUJOHS[

Slide 2

Slide 2 text

ࣗݾ঺հ w ͱ͋ΔηΩϡϦςΟձࣾͷ40$ΤϯδχΞ w %/4 #(1ͳͲΠϯλʔωοτج൫͕޷͖ w ۀ຿ʹ͸͋·Γؔ܎ͳ͍ɾɾɾ w ઌ݄͕TTNKQॳࢀՃʢਓ਺͍͢͝

Slide 3

Slide 3 text

΍ͬͯΔ͜ͱ w "4ͱϐΞϦϯά w ͱϑϧϧʔτΛ໯ͬͯ·͢ w ࠷ۙ6αʔόΛखʹೖΕͨͷͰ ਓݖΛಘΒΕͨ

Slide 4

Slide 4 text

΍ͬͯΔ͜ͱ w %/4ΩϟογϡϙΠζχϯάΛ ߦ͏.FUBTQMPJUϞδϡʔϧͱ͔ ࡞ͬͯ·ͨ͠ w ͕͢͞ʹඇެ։Ͱ͢

Slide 5

Slide 5 text

υϝΠϯϩοΫ͞Εͨ '#*ʢ'FEFSBM#VSFBVPG*OWFTUJHBUJPOʣ  ͔ΒͷࢦࣔʹΑΓɺ

Slide 6

Slide 6 text

%/4τϯωϦϯά

Slide 7

Slide 7 text

%/4τϯωϦϯάͱ͸ w %/4௨৴ʹผͷ໨తΛ࣋ͬͨ৘ใΛؚΊΔ͜ͱ w ِ૷௨৴ͷҰछ

Slide 8

Slide 8 text

҉߸Խ௨৴ͱͷҧ͍ w ҉߸Խ௨৴ w ͲͷΑ͏ͳσʔλ͔֬ೝͰ͖ͳ͍Α͏ʹ͢Δ w ௨৴͕ߦΘΕ͍ͯΔ͜ͱ͸ೝ஌͞Εͯ΋Α͍ w ِ૷௨৴ w ҙຯͷ͋ΔσʔλΛૹ৴͍ͯ͠Δ͜ͱΛ  ஌ΒΕͳ͍Α͏ʹ͢Δ

Slide 9

Slide 9 text

%/4τϯωϦϯάͷར༻ྫ w ϑΟϧλϦϯά؀ڥԼͰͷ71/ w VEQ UDQ͸։͍͍ͯΔՄೳੑ͕ߴ͍ w Ϛϧ΢ΣΞ w )551ʹൺ΂ͯϩΪϯά͞Ε͍ͯͳ͍

Slide 10

Slide 10 text

%/4τϯωϦϯάͷར༻ྫ w ϑΟϧλϦϯά؀ڥԼͰͷ71/ w VEQ UDQ͸։͍͍ͯΔՄೳੑ͕ߴ͍ w Ϛϧ΢ΣΞ w )551ʹൺ΂ͯϩΪϯά͞Ε͍ͯͳ͍

Slide 11

Slide 11 text

Ϛϧ΢ΣΞͷ)551௨৴ w Ϛϧ΢ΣΞ͕)551௨৴Λར༻͢Δཧ༝ ΄ͱΜͲͷ04Ͱ)551௨৴͕ՄೳͰ͋Δ ϓϩΩγαʔό͕ଘࡏ͍ͯ͠Δ৔߹Ͱ΋ɺ  ΫϥΠΞϯτͷ௨৴͕΄΅ͦͷ··Ͱ֎෦ ʹൈ͚ग़ͤΔΑ͏ʹͳ͍ͬͯΔ ༷ʑͳσʔλΛॊೈʹදݱͰ͖Δ

Slide 12

Slide 12 text

Ϛϧ΢ΣΞͷ)551௨৴ w Ϛϧ΢ΣΞ͕)551௨৴Λར༻͢Δཧ༝ ΄ͱΜͲͷ04Ͱ)551௨৴͕ՄೳͰ͋Δ ϓϩΩγαʔό͕ଘࡏ͍ͯ͠Δ৔߹Ͱ΋ɺ  ΫϥΠΞϯτͷ௨৴͕΄΅ͦͷ··Ͱ֎෦ ʹൈ͚ग़ͤΔΑ͏ʹͳ͍ͬͯΔ ༷ʑͳσʔλΛॊೈʹදݱͰ͖Δ %/4 ϑϧϦκϧό %/4 %/4

Slide 13

Slide 13 text

%/4τϯωϦϯά Ϛϧ΢ΣΞͷ௨৴ྫ

Slide 14

Slide 14 text

Ϛϧ΢ΣΞ໊ ϗετ໊ͷنଇ 33 1MVH9 YB <Կ͔ͷنଇ>TVCEPNBJO 595 1MVH9 Y TVCEPNBJO 595 .6-5*(3"*/ MPHTVCEPNBJO 595 QJTMPBEFS <Կ͔ͷنଇ>TVCEPNBJO 595 'FFEFSCPU <CZUFT><$)6/,*%> TVCEPNBJO 595 %/4.FTTFOHFS <҉߸Խ\σʔλ>^>TVCEPNBJO 595 'SBNFXPSL104 <Τϯίʔυ>EPNBJO """"" $1303"$$00/ EPNBJO $/".& )FMNJOUI < SBOEPN > <%"5">EPNBJO " %FOJT <">EPNBJO ಠࣗ ݁ߏଟ͍ʂ

Slide 15

Slide 15 text

Ϛϧ΢ΣΞͷಛ௃͔ΒΘ͔Δ %/4τϯωϦϯάͷख๏ w αʔό͔ΒΫϥΠΞϯτ΁ͷ໋ྩ͸595͕ଟ͍ w 595͸೚ҙͷσʔλΛؚΊΒΕΔͨΊ w ΫϥΠΞϯτ͔Βͷ৘ใૹ৴͸ROBNFΛ࢖͏ w Ωϟογϡαʔό͸ROBNFͷΈΛར༻͢ΔͨΊ w ROBNF͕௕͍ w ؚΊΒΕΔσʔλྔͷؔ܎ͱɺΩϟογϡ͞ΕΔͨΊ

Slide 16

Slide 16 text

ٙࣅϚϧ΢ΣΞʹΑΔ %/4τϯωϦϯάσϞ w "ϨίʔυΛ༻͍ͨ$௨৴ w )FMNJOUIΛղੳͯ͠࡞੒ͨ͠$αʔό w 595ϨίʔυΛ༻͍ͨ$௨৴

Slide 17

Slide 17 text

Ϛϧ΢ΣΞ࡞੒ऀΛ ग़͠ൈ͚Δ͔

Slide 18

Slide 18 text

छͷΞϓϩʔν w ௚઀௨৴Ͱ͖Δ৔߹ ΫϥΠΞϯτ͔Βαʔό αʔό͔ΒΫϥΠΞϯτ w ϑϧϦκϧόΛܦ༝͢Δ৔߹ ΫϥΠΞϯτ͔Βαʔό αʔό͔ΒΫϥΠΞϯτ

Slide 19

Slide 19 text

4UVCSFTPMWFS XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ DBDIF 'VMM 'VMMTFSWJDF SFTPMWFS BSPPUTFSWFSTOFU BHUMETFSWFSTOFU OTTIVUJOHS[DPN "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS ௚઀௨৴͢Δ৔߹

Slide 20

Slide 20 text

4UVCSFTPMWFS XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ DBDIF 'VMM 'VMMTFSWJDF SFTPMWFS XXXTIVUJOHS[DPN*/" Ωϟογϡ֬ೝ BSPPUTFSWFSTOFU BHUMETFSWFSTOFU OTTIVUJOHS[DPN "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS XXXTIVUJOHS[DPN*/"ʁ DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ XXXTIVUJOHS[DPN*/"ʁ XXXTIVUJOHS[DPN*/"ʁ ` XXXTIVUJOHS[DPN*/" ΩϟογϡαʔόΛܦ༝͢Δ৔߹

Slide 21

Slide 21 text

௚઀௨৴Ͱ͖Δ৔߹

Slide 22

Slide 22 text

௚઀௨৴Ͱ͖Δ৔߹ w ͳΜͰ΋Ͱ͖Δ w ϑΥϨϯδοΧʔʹόϨͳ͍Α͏ʹ

Slide 23

Slide 23 text

ϔομ 2VFTUJPOηΫγϣϯ ϦιʔεϨίʔυ

Slide 24

Slide 24 text

&%/4 w &%/4ͷσʔλ෦Λར༻ w σʔλ͕ROBNFʹݱΕͳ͍ w σʔλྔ͸όΠτ͕࠷େ w ࣮ࡍ͸όΠτ͘Β͍͡Ό ͳ͍ͱόϨͦ͏

Slide 25

Slide 25 text

৭ʑͳ&%/4Φϓγϣϯ w &%/4$MJFOU4VCOFU &$4 w ΫϥΠΞϯτ৘ใΛݖҖαʔόʹૹ৴͢Δ w %/4$PPLJF w ࠮শ๷ࢭ༻ʹݖҖαʔόʹૹ৴͢Δ

Slide 26

Slide 26 text

৭ʑͳ&%/4Φϓγϣϯ w $)"*/ w ݕূࡁΈκʔϯ৘ใΛϑϧϦκϧόʹૹ৴͢Δ w 1BEEJOH w ҉߸Խ௨৴ͷฏจਪଌ๷ࢭͷͨΊύσΟϯά ΛؚΊΔ

Slide 27

Slide 27 text

&%/4Λ࢖ͬͨ %/4τϯωϦϯάσϞ w ROBNFʹσʔλ͕ೖΒͳ͍ͱ͜Ζ͕ಛ௃ w ޙड़͢ΔROBNFݕ஌ख๏͕શ͘໾ʹཱͨͳ͍

Slide 28

Slide 28 text

ϑϧϦκϧόΛ ܦ༝͢Δ৔߹

Slide 29

Slide 29 text

ϑϧϦκϧόΛܦ༝͢Δ৔߹ w ҎԼͷ੍ݶ͕͋Δ w ࠶ؼ໰͍߹Θͤʹෆཁͳσʔλ͸࡟আ͞ΕΔ w ಉ͡ROBNFͱ33͸55-ඵΩϟογϡ͞ΕΔ

Slide 30

Slide 30 text

αʔό͔ΒΫϥΠΞϯτ

Slide 31

Slide 31 text

595 w ৭ΜͳݕূͷͨΊʹαʔό͕໰͍߹ΘͤΔ w σʔλ͸?όΠτ 3%"5"ͷ࠷େ஋ w ͕͢͞ʹେ͖͗͢ΔͱόϨΔ w ݩʑΪϦڐ͕ͤͨ͜͏΋࢖ΘΕͯ͸΋͏μϝ

Slide 32

Slide 32 text

334*( w %/44&$ݕূʹ༻͍Δ33 w ֤334FUʹ෇༩͞ΕΔ w σʔλ͸όΠτ͘Β͍͕ݱ࣮త w ྲྀΕ͍ͯͯ΋ΪϦڐ͞Εͦ͏ʢࠓޙΛߟ͑Δͱ w /8಺෦ͷόϦσʔλ͸͕͢͞ʹ͓͔͍͠ʁ

Slide 33

Slide 33 text

$/".& w $%/͕ϝδϟʔʹͳͬͨࠓɺվΊͯΦεεϝ w σʔλྔ͸MFO EPNBJO όΠτ w RUZQF͕"ͳͷʹจࣈྻ͕ฦ͖ͬͯͯΑ͍ w ࣗκʔϯͷ໊લΛࣔͯ͠XJMEDBSE͢Ε͹  ໊લղܾ͕Ͱ͖ɺෆ৹ੑΛ཈͑Δ͜ͱ͕Մೳ

Slide 34

Slide 34 text

ΫϥΠΞϯτ͔Βαʔό

Slide 35

Slide 35 text

ROBNF͔͠ͳ͍

Slide 36

Slide 36 text

%/4ͷ࢓༷ͱ࣮૷ w ϑϧϦκϧό͸ελϒϦκϧόͷ26&45*0/ 4&$5*0/ͷΈΛ࠶ؼ໰͍߹Θͤʹίϐʔ͢Δ w ͭ·ΓɺROBNF RDMBTT RUZQFͷΈ͕  %/4τϯωϦϯάʹ࢖͑Δ w ݁ՌɺROBNFʹσʔλΛೖΕΔ͔͠ͳ͍ ˠROBNFʹ͑͞ؾΛ͚ͭΕ͹ݕ஌Ͱ͖Δʂ

Slide 37

Slide 37 text

%/4τϯωϦϯάͷݕग़

Slide 38

Slide 38 text

௚઀௨৴͢Δ৔߹ w ߟ͑͏Δύλʔϯ͕ଟ͘ݕ஌͸೉͍͠ w ΫΤϦϩάʹ࢒Βͳ͍΋ͷ΋ͨ͘͞Μ͋Δ w ݕ஌ͤ͞ΔΑΓɺϑϧϦκϧό͔ΒҎ֎ͷ  UDQ VEQΛϑΟϧλ͢Ε͹ 'VMM ✗

Slide 39

Slide 39 text

ϑϧϦκϧόΛܦ༝͢Δ৔߹ w αʔό͔ΒΫϥΠΞϯτ w ීஈ࢖Θͳ͍33͔ w αΠζ͕େ͖͘ͳ͍͔ w 3$0%&͕/0&3303Ҏ֎ w 55-͕খ͘͞ͳ͍͔

Slide 40

Slide 40 text

ϑϧϦκϧόΛܦ༝͢Δ৔߹ w ΫϥΠΞϯτ͔Βαʔό w ROBNFͷ௕͞ w υϝΠϯʹର͢Δϗετ໊ͷ਺ w ROBNFͷෆ৹͞

Slide 41

Slide 41 text

ROBNFͷෆ৹͞ w จࣈ୯ޠͷϥϯμϜੑɾූ߸Խݕ஌ w EOVGL͸UFTUUFTUΑΓ΋zෳࡶz w ୯ޠͷؔ࿈ੑΛείΞϦϯά w ͜͜Β΁Μ͸JOGPCMPY͕ಛڐ࣋ͬͯΔΒ͍͠

Slide 42

Slide 42 text

·ͱΊ

Slide 43

Slide 43 text

·ͱΊ w %/4τϯωϦϯά͸ͻͬͦΓͱ࢖ΘΕ͍ͯΔ w ϩΪϯά͞Εͳ͍͔Βඪతܕ߈ܸʹ࢖ΘΕΔ w ௚઀௨৴Ͱ͖Δ৔߹͸ݕ஌͸ඇৗʹ೉͍͠ w ϑϧϦκϧό͔ΒҎ֎ΛϑΟϧλ͢Ε͹0, w ͋ͱ͸ROBNF͚ͩݟΕ͹ΞϊϚϦݕ஌Ͱ͖Δ w ద੾ͳઃఆ͕Ͱ͖Ε͹ࢥͬͨΑΓ΋୯७