Drupalgeddon2 をハニーポットで観察してみた

by Kazuaki Morihisa

Slide 1

Slide 1 text

2018೥6݄30೔ ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձൃදࢿྉ Drupalgeddon2 Λ ϋχʔϙοτͰ؍࡯ͯ͠Έͨ @morihi_soc

Slide 2

Slide 2 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ XIPBNJ w ৿ٱ࿨ত !NPSJIJ@TPD w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ w ϒϩάˠIUUQXXXNPSJIJTPDOFU w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ w IUUQTIBOJQPUFDIDPOOQBTTDPN 2 ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦) ɾ*5,FZT ݱ4FD$BQ ɾωοτϫʔΫύέοτΛಡΉձ Ծ ɾ/*4$αΠόʔϋϩ΢Οϯ ɾ*OUFSOFU8FFLɾ)BSEFOJOH ɾTTNKQɾ"*4FDɾ4UVEZ$PEF ɾULULηΩϡϦςΟษڧձ ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ

Slide 3

Slide 3 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ͓඼ॻ͖ w %SVQBMHFEEPOͱ͸ w ߈ܸαϯϓϧ঺հ w 808)POFZQPUͰͷݕ஌ঢ়گ w ௿ର࿩ܕͱߴର࿩ܕͷൺֱ w ·ͱΊ 3

Slide 4

Slide 4 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ %SVQBMHFEEPOͱ͸ w %SVQBMʹ͸ɺϦϞʔτ͔Β೚ҙͷίʔυ͕࣮ߦՄ ೳͱͳΔ੬ऑੑ $7& ͕ଘࡏ͠ɺ͜ͷ ੬ऑੑΛѱ༻͢Δ͜ͱͰɺԕִͷୈࡾऀ͕ɺඇެ։ σʔλΛ઄औͨ͠ΓɺγεςϜσʔλΛվมͨ͠Γ ͢ΔͳͲͷՄೳੑ͕͋Δͱͷ͜ͱͰ͢ɻ w ӨڹΛड͚Δόʔδϣϯ͸࣍ͷ௨Γɻͨͩ͠αϙʔ τ͕੾Ε͍ͯΔݹ͍όʔδϣϯ΋ӨڹΛड͚ΔՄೳ ੑ͕͋Γɻ w %SVQBMΑΓલͷόʔδϣϯ w %SVQBMΑΓલͷόʔδϣϯ 4 JPCERT/CC ͷϖʔδ͔ΒҾ༻ https://www.jpcert.or.jp/at/2018/at180012.html

Slide 5

Slide 5 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ڪාͷେԦ;ͨͨͼ w ೥݄೔%SVQBMެ͔ࣜΒɺिؒޙʹηΩϡ ϦςΟϦϦʔεΛ͢Δͱͷൃද w ೥݄೔$7&ͷ੬ऑੑΛमਖ਼ ͨ͠όʔδϣϯ͕ެ։ w ೥݄೔ηΩϡϦςΟݚڀऀʹΑΓɺϦϞʔ τίʔυ࣮ߦͷղੳ৘ใ͕ެ։ɻ  ೥ͷ੬ऑੑ $7& Λኲኵͱͤ͞Δ ΄Ͳةݥ౓͕ߴ͘ɺ%SVQBMHFEEPOͱݺ͹ΕΔɻ 5 *1 https://www.drupal.org/psa-2018-001 *2 https://www.drupal.org/SA-CORE-2018-002 *3 https://research.checkpoint.com/uncovering-drupalgeddon-2/ ը૾Ҿ༻ݩˣ https://scanforsecurity.com/news/drupalgeddon-2-vulnerability-used-infect-servers-backdoors-coinminers.html

Slide 6

Slide 6 text

߈ܸαϯϓϧ ঺հ ↑2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ ৯஬২෺Ͱ͸ͳ͍ɻ

Slide 7

Slide 7 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸαϯϓϧ঺հ w ϋχʔϙοτʹର͢Δ߈ܸͰ࠷΋ଟ͔ͬͨύλʔϯ w ߈ܸର৅ͷύε͸ʮVTFSSFHJTUFSʯ 7

Slide 8

Slide 8 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸαϯϓϧ঺հ w %SVQBMܥΛૂͬͨ߈ܸύλʔϯ w ஈ֊Ͱ߈ܸΛ੒ཱͤ͞Δ w 8FCαʔό͔ΒͷԠ౴ʹGPSNͷJEؚ͕·ΕΔ w 8

Slide 9

Slide 9 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸαϯϓϧ঺հ w %SVQBMܥΛૂͬͨ߈ܸύλʔϯ w ճ໨ͷΞΫηεͰGPSNͷσʔλΛΩϟογϡ͞ ͤͯɺճ໨ͷΞΫηεͰϨϯμϦϯάͤͯ͞ίϚϯ υ࣮ߦΛࢼΈΔɻ 9

Slide 10

Slide 10 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸऀͷૂ͍Λ୳Δ w 1045ͷϘσΟ෦෼ʹ஫໨͠ɺ߈ܸऀ͕ͲΜͳҙਤ Ͱ߈ܸ͖ͯͨ͠ͷ͔ߟ͑ͯΈΑ͏ w ੬ऑੑͷௐࠪΛ͍ͯ͠Δ௨৴͔ΒɺϚϧ΢ΣΞײછ ΛࢼΈΔ΋ͷ·Ͱ༷ʑͳ߈ܸΛݕ஌ w ͍͔ͭ͘ϐοΫΞοϓͯ͠঺հ 10

Slide 11

Slide 11 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸࣄྫ ੬ऑੑͷௐࠪ w FDIPίϚϯυͰจࣈྻΛදࣔ͢Δ w JEίϚϯυͰϢʔβ໊Λදࣔ͢Δ 11

Slide 12

Slide 12 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ w ੬ऑੑΛಥ͍ͯγΣϧεΫϦϓτΛμ΢ϯϩʔυ͠ ࣮ͯߦͤ͞Δ߈ܸ w GFUDIίϚϯυ΋࢖͍ͬͯͯɺ#4%ܥ΋߈ܸର৅ 12

Slide 13

Slide 13 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ w TIϑΝΠϧͰμ΢ϯϩʔυΛࢼΈΔϑΝΠϧΛ  ௥ՃͰௐࠪͯ͠Έͨ݁Ռɻ w ෳ਺ͷ$16ΞʔΩςΫνϟʹରԠͰ͖ΔΑ͏ʹɺ ϑΝΠϧΛμ΢ϯϩʔυ͍ͯͨ͠ɻ 13

Slide 14

Slide 14 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸࣄྫ ϑΝΠϧμ΢ϯϩʔυ w த਎͸%%P4ʹར༻͞ΕΔ5TVOBNJϚϧ΢ΣΞ IUUQTXXXWJSVTUPUBMDPNFOpMFDDBBCFDCGDDEDD⒎CBEFGEDECBFBOBMZTJT 14

Slide 15

Slide 15 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸࣄྫ ϑΝΠϧ࡞੒ w FDIPίϚϯυΛύΠϓͰܨ͍Ͱɺ1)1ϑΝΠϧΛ ࡞੒͍ͯ͠Δɻ w #"4&Ͱσίʔυ͢Δͱɺͳʹ΍Βո͍͠งғؾɻ 15

Slide 16

Slide 16 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ߈ܸࣄྫ ϑΝΠϧ࡞੒ w 04ίϚϯυ࣮ߦػೳͱϑΝΠϧΞοϓϩʔυػೳ Λ࣋ͭ8FC4IFMMͩͬͨ 16 ※WebShell ͸ɺϒϥ΢β͔Β Web αʔόΛૢ࡞͢Δ͜ͱ͕Ͱ͖ΔϓϩάϥϜɻ  ৄ͘͠͸ ٕज़ಉਓࢽͷʮWebShell ਤේʯΛݟͯͶ! https://booth.pm/ja/items/718303

Slide 17

Slide 17 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ 808)POFZQPUͰͷݕ஌ঢ়گ w ೥݄೔͔Β݄೔·ͰͷظؒΛநग़ 17

Slide 18

Slide 18 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ௿ର࿩ܕͱߴର࿩ܕͷൺֱ w ϋχʔϙοτ͸͍͔ͭ͘෼ྨ͢Δํ๏͕͋Γ·͢ w ௿ର࿩ܕ ྫɿ808)POFZQPU w ࣮ࡏ͢Διϑτ΢ΣΞΛ໛฿͢Δํࣜ w ϩά෼ੳ͠΍͘͢ͳ͍ͬͯΔ͕ɺ੬ऑੑͷ໛฿͸  ׬ᘳʹͰ͖ͳ͍ɻ w ߴର࿩ܕ ྫɿ"QBDIF1)1%SVQBM w ιϑτ΢ΣΞΛͦͷ··࢖͏ํࣜ w ຊ෺ͳͷͰඪతΛߜͬͨ߈ܸΛݕ஌͠΍͍͕͢ EBZͷ੬ऑੑʹΑΓɺϛΠϥऔΓ͕ϛΠϥঢ়ଶʹ ͳΓ͔Ͷͳ͍ɻ 18

Slide 19

Slide 19 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ %SVQBMHFEEPOͰݟΔ௿ɾߴର࿩ܕ w ௿ର࿩ܕͰ͋Δ808)POFZQPUͷݕ஌ঢ়گͱ  ߴର࿩ܕͰ͋Δ%SVQBMͷϋχʔϙοτͷݕ஌ঢ়گ Λൺֱͯ͠Έͨ w ΋ͪΖΜ%SVQBM͸ύονΛଈ೔ద༻ࡁΈɻ w %SVQBMͷϋχʔϙοτ͸ɺ808)POFZQPUΑΓ গ͠લ͔Βެ։ͯ͠߈ܸ৘ใΛऩू͍ͯͨ͠ɻ w ͪΐ͏Ͳ%SVQBMHFEEPO͕ग़ͨͱ͖͸ɺผʑͷαʔ όͰ؅ཧ͍ͯͨ͠ͷͰɺൺֱ͕Մೳͩͬͨɻ w ͨͩ͠ɺ%SVQBMͷϋχʔϙοτ͸୆͔͠Քಇͯ͠ ͓Βͣɺ808)POFZQPUͷํ͕୆਺͕ଟ͍ɻ 19

Slide 20

Slide 20 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ॳճͷ߈ܸݕ஌೔ w ͓͞Β͍ w ೥݄೔ʹ੬ऑੑ͕ެ։ɺ݄೔ʹ੬ऑ ੑͷղઆ͕ެ։ɻ 20 ؍ଌ஍఺ ॳճݕ஌೔ %SVQBMͷߴର࿩ܕϋχʔϙοτ ݄೔ 808)POFZQPU ௿ର࿩ܕ ݄೔ ࢀߟ ܯࢹிΠϯλʔωοτఆ఺؍ଌγεςϜ ݄೔ ࢀߟ NPSJIJTPDͷϒϩά 8PSE1SFTT ݄೔ *1 https://www.npa.go.jp/cyberpolice/detect/pdf/20180418.pdf

Slide 21

Slide 21 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ϋχʔϙοτͷछผʹΑΔ߈ܸ؍ଌߟ࡯ w NPSJIJTPDͷϋχʔϙοτ؀ڥͰ͸ɺ%SVQBMΛ࢖ͬ ͍ͯΔͱ͜Ζ͕࠷΋ૣ͘߈ܸΛݕ஌ͨ͠ɻ w ੬ऑੑ͕ެ։͞ΕͨΒɺ੬ऑੑ͕͋Γͦ͏ͳͱ͜ Ζ͕ɺਅͬઌʹૂΘΕΔɻ w ͱ͸͍͑ɺ௿ର࿩ܕͷϋχʔϙοτͰ΋߈ܸͷ؍ଌ ͸Մೳͩͬͨɻ w 8PSE1SFTTͷΑ͏ͳɺ੬ऑੑͷର৅ͱϛεϚον ͳ؀ڥ͸ɺ߈ܸͷ؍ଌʹ͕͔͔࣌ؒΔɻ w αϯϓϧ਺͕গͳ͍ͷͰۮવ͔΋͠Εͳ͍ɻ 21

Slide 22

Slide 22 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ ·ͱΊ w %SVQBMHHFEPOͷ੬ऑੑΛૂͬͨ߈ܸΛࣄྫΛ౿ ·͑ͯ঺հͨ͠ɻ w ݕ஌ͨ͠߈ܸ͸ɺ੬ऑੑͷௐࠪΛࢼΈΔ΋ͷ͔Βɺ %%P4Ϛϧ΢ΣΞʹײછͤ͞Δ΋ͷɺ8FC4IFMMͷ ઃஔΛࢼΈΔ΋ͷͳͲ༷ʑͩͬͨɻ w ϋχʔϙοτͷछผʹΑͬͯɺॳճͷ߈ܸݕ஌೔ʹ ҧ͍͕͋ͬͨɻ  ͨͩ͠αϯϓϧ਺͕গͳ͍ͷͰࢀߟఔ౓ʹ 22

Slide 23

Slide 23 text

Drupalgeddon2 ΛϋχʔϙοτͰ؍࡯ͯ͠Έͨ )BQQZ)POFZQPU 23 ←2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ ৯஬২෺Ͱ͸ͳ͍ɻ ͓͠·͍