まだ見ぬ攻撃を求めて

by Kazuaki Morihisa

Slide 1

Slide 1 text

2020೥1݄25೔ ୈ7ճϋχʔϙολʔٕज़ަྲྀձ ൃදࢿྉ ·ͩݟ͵߈ܸΛݟ͚ͭΔ @morihi_soc

Slide 2

Slide 2 text

2 XIPBNJ w ৿ٱ࿨ত !NPSJIJ@TPD $*441 44$1 w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ w ϒϩάˠIUUQTXXXNPSJIJTPDOFU w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ w IUUQTIBOJQPUFDIDPOOQBTTDPN ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦) ɾ*5,FZT ݱ4FD$BQ ɾωοτϫʔΫύέοτΛಡΉձ Ծ ɾ/*4$αΠόʔϋϩ΢Οϯɾ*OUFSOFU8FFL ɾ)BSEFOJOHɾTTNKQɾ"*4FDɾ4UVEZ$PEF ɾULULηΩϡϦςΟษڧձ ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ ɾ08"41/BHPZBɾ*P54FD+1 ɾ͢ΈͩηΩϡϦςΟษڧձ ɾαΠόʔηΩϡϦςΟษڧձJOԘ৲ ࣥචͨ͠ຊ΍ٕज़ಉਓࢽ

Slide 3

Slide 3 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ໨࣍ w ϋχʔϙολʔϞνϕʔγϣϯ w ϋχʔϙοτԿ୆২͑ͯΔ w &YQMPJU5SFBTVSF)VOU w ϩά͸ͳͥ૿͑Δͷ͔ w ͻΒΊ͖ͱ'VMM)5513FRVFTU)BTI w ౰વͷٙ໰ͱվྑͷ༨஍ w ·ͱΊ 3

Slide 4

Slide 4 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ϋχʔϙολʔϞνϕʔγϣϯ 4 ৽͍͠߈ܸΛݟ͍ͨ

Slide 5

Slide 5 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ϋχʔϙοτԿ୆২͑ͯΔ w 808)POFZQPU w ௿ର࿩ܕαʔόଆͷ8FCʹಛԽͨ͠ϋχʔϙοτ w ݸਓͷ׆ಈʹ͓͍ͯϝΠϯͰ࢖͍ͬͯΔ w ࢖༻Ϧιʔε͕গͳͯ͘΋ಈ͘ͷͰɺ͓ࡒ෍ͷڐ͢ ݶΓɺϨϯλϧαʔόΛआΓͯෳ਺୆ՔಇͰ͖Δ w ࠷େಉ࣌ʹ୆ಈ͔͍ͯͨ͜͠ͱ΋ w ϲ݄ถυϧY୆ɾɾɾ 5 https://github.com/morihisa/WOWHoneypot

Slide 6

Slide 6 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ༨ஊ 808)POFZQPUΛ$JUSJYΧελϚΠζ w 808)POFZQPU͸ϦΫΤετʹ߹ΘͤͯϨεϙϯ εΛม͑Δ͜ͱ͕Մೳɻ w ࠷ۙྲྀߦΓͷ$JUSJYͷ੬ऑੑ $7& ΋ΧόʔͰ͖·͢ɻ w ΍Γ͔ͨ Ϩεϙϯε಺༰Λఆٛͨ͠ϑΝΠϧ࡞੒ ϚονϨεϙϯεϧʔϧʹ௥Ճ 6

Slide 7

Slide 7 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ༨ஊ 808)POFZQPUΛ$JUSJYΧελϚΠζ w BSUσΟϨΫτϦʹDJUSJYUYUͱ͍͏ϑΝΠϧΛԼه ͷ಺༰Ͱ࡞੒͢Δ ίϯϑΟάࢀߟ ɻ w BSUσΟϨΫτϦͷ NSSVMFTYNMʹ ӈهͷϧʔϧΛ௥Ճ ˞NSSJE͸దٓमਖ਼ 7 [global] encrypt passwords = yes name resolve order = lmhosts bcast host *1 http://www.samba.gr.jp/project/translation/4.5/htmldocs/manpages/smb.conf.5.html 1045 True Citrix exploit(CVE-2019-19781) pns/cfg/smb.conf 200

Slide 8

Slide 8 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ༨ஊ 808)POFZQPUΛ$JUSJYΧελϚΠζ w $7&ͷεΩϟφͰ֬ೝͯ͠ΈΔ w ϧʔϧ௥Ճલ w ϧʔϧ௥Ճޙ 8 →Citrix αʔόͰ͸ͳ͍(੬ऑͰ͸ͳ͍)ͱ൑ఆ͞Εͨ →੬ऑͳ Citrix αʔόͱ൑ఆ͞Εͨ

Slide 9

Slide 9 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ೥ͷϋχʔϙοτՔಇ࣮੷ w 808)POFZQPUͷϩά w ֤݄ͷϩάྔ w ͹Β͖͕ͭ݁ߏ͋Δ 9 ݄ .# ݄ (# ݄ .# ݄ .# ݄ .# ݄ .# ݄ .# ݄ .# ݄ .# ݄ .# ݄ .# ݄ .#

Slide 10

Slide 10 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ &YQMPJU5SFBTVSF)VOU w ৽͍͠߈ܸख๏Λ෼ੳ͢Δͷ͸ָ͍͠˕ w ࠷ۙͷ܏޲Λ஌ΔͨΊͷΞϯςφͷͭ w ಉ͡ϩάΛ܁Γฦ͠໨ͰݟΔͷ͸ͭΒ͍ w ਺ઍ݅ɾ਺ສ݅ͷϩά͸෺ཧతʹແཧ 10

Slide 11

Slide 11 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ෳ਺ͷϋχʔϙοτΛ২͑Δฐ֐ w ެ։αʔόΛεΩϟϯ͍ͯ͠ΔΑ͏ͳ߈ܸऀʹΑΓ ෳ਺ͷϋχʔϙοτͰಉ͡߈ܸͷϩά͕࢒Δ w ෼ੳ͍ͨ͠ͷ͸ɺ߈ܸऀͱͷϩάݸ͚ͩ 11 ߈ܸऀ1 ߈ܸऀ2 ϋχʔϙοτ1 ϋχʔϙοτ2 ϋχʔϙοτ3 ϋχʔϙοτ1ͷ߈ܸऀ1ͷϩά ϋχʔϙοτ1ͷ߈ܸऀ2ͷϩά ϋχʔϙοτ2ͷ߈ܸऀ1ͷϩά ϋχʔϙοτ2ͷ߈ܸऀ2ͷϩά ϋχʔϙοτ3ͷ߈ܸऀ1ͷϩά ϋχʔϙοτ3ͷ߈ܸऀ2ͷϩά ߹ܭ6ݸͷϩά

Slide 12

Slide 12 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ϩάྔ ॏෳ ΛݮΒ͢ 12 w ͳΜΒ͔ͷج४Λ༻͍ͯॏෳΛഉআ w 63* w ߈ܸऀͷ*1ΞυϨε w ϖΠϩʔυͷXHFUDVSMͷμ΢ϯϩʔυ63- w *%4ʹΑΔΞϥʔτ w ͦͷଞ ͲΕ͔1ͭʹݶఆ͢Δඞཁ͸ͳ͍ (૊Έ߹Θͤͯ࢖͏)

Slide 13

Slide 13 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ͻΒΊ͖ w )551ϦΫΤετΛϋογϡԽ͢Δɻ ͨͩ͠)PTUϔομͷ஋͸औΓআ͘ɻ ཧ༝͸ޙड़ w ϋογϡ஋ͷσʔλϕʔεΛ࡞Δɻ w σʔλϕʔεʹؚ·Ε͍ͯͳ͍ϋογϡ஋ͷ߈ܸ͸ ৽͍͠߈ܸͱ͢Δ ˠಉ͡߈ܸऀ͔Βͷෳ਺ͷ௨৴Λճ͚ͩݟΔ͜ͱ ͕Ͱ͖ΔΑ͏ʹͳΔͷͰ͸ 13

Slide 14

Slide 14 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ 'VMM)5513FRVFTU)BTI ')3) 14 cf4398dabdd0b1fd1d3878bac7e5a445a73c909ebbdf8121df58fca55eb27d67 Host ϔομͷ஋Λۭʹ͢Δ શମΛϋογϡԽ͢Δ(SHA256) ᶃ ᶄ ᶅ

Slide 15

Slide 15 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ )PTUϔομͷॲཧ w )551ͷόʔδϣϯͰ͸ɺ)PTUϔομͷࢦఆ͕ ඞਢ 3'$ w ϋογϡԽ͸ɺݩͷϝοηʔδ͕όΠτҧ͏ͱੜ ੒͞ΕΔϋογϡ஋΋ҟͳΔੑ࣭͕͋Δɻ w ϋχʔϙοτͷάϩʔόϧ*1ΞυϨε΍υϝΠϯ໊ ʹΑΓϋογϡ஋͕มΘͬͯ͠·͏ͱɺಉ͡߈ܸ௨ ৴͕ҟͳΔϋογϡ஋ʹͳͬͯ͠·͏ɻ ˠ)PTUϔομͷ஋͚ͩ࡟আ͕ඞཁ 15

Slide 16

Slide 16 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ೥ͷϩάͰࢼͯ͠Έͨ 16 ݄ ݩσʔλ ')3) ࡟ݮ཰ ݄ ݄ ݄ ݄ ݄ ݄ ݄ ݄ ݄ ݄ ݄ ݄ ୯Ґɿߦ਺

Slide 17

Slide 17 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ॲཧ࣌ؒ w ܭଌ؀ڥ J.BD w ()[ΫΞουίΞ*OUFM$PSFJ ϝϞϦ(#.)[%%344% w ϓϩάϥϜ w 1ZUIPO w ܭଌ w UJNFίϚϯυ w ௕ͯ͘΋෼΄Ͳ 17 1݄ ./fhrh.py 5.32s user 0.21s system 97% cpu 5.675 total 2݄ ./fhrh.py 62.29s user 1.39s system 98% cpu 1:04.59 total 3݄ ./fhrh.py 22.76s user 1.01s system 98% cpu 24.101 total 4݄ ./fhrh.py 17.83s user 0.84s system 97% cpu 19.100 total 5݄ ./fhrh.py 10.17s user 0.60s system 97% cpu 11.018 total 6݄ ./fhrh.py 8.22s user 0.42s system 98% cpu 8.803 total 7݄ ./fhrh.py 10.09s user 0.47s system 98% cpu 10.739 total 8݄ ./fhrh.py 7.01s user 0.37s system 98% cpu 7.516 total 9݄ ./fhrh.py 5.66s user 0.33s system 98% cpu 6.097 total 10݄ ./fhrh.py 5.25s user 0.35s system 98% cpu 5.713 total 11݄ ./fhrh.py 12.61s user 0.62s system 98% cpu 13.424 total 12݄ ./fhrh.py 6.36s user 0.39s system 97% cpu 6.893 total

Slide 18

Slide 18 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ౰વͷٙ໰ w 263*͚ͩͰϑΟϧλͨ͠Βμϝͳͷ w "μϝ͡Όͳ͍͚Ͳɺ63*͸ڧྗ͗͢Δɻ ')3)ͱ૊Έ߹ΘͤΔͱྑ͍Μ͡Όͳ͍͔ͳɻ 18

Slide 19

Slide 19 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ྫ &UIFSFVNͷϊʔυ୳ࠪ w ʮ1045)551ʯ͚ͩͰ΋ɺෳ਺ͷ߈ܸΛݕ ஌͍ͯ͠Δɻ63*͚ͩͩͱऔΓ͜΅͢ɻ 19

Slide 20

Slide 20 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ྫ 5PNDBUʹର͢ΔϒϧʔτϑΥʔε w 63*͸ಉ͚ͩ͡Ͳ"VUIPSJ[BUJPOϔομ͕ҟͳΔɻ 20 web:admin root:admin tomcat:admin manager:admin

Slide 21

Slide 21 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ')3)ͱ૊Έ߹ΘͤΔ w ෼ੳ͠ͳ͍ͱ൑அͨ͠΋ͷΛϑΟϧλ͢Δ w ྫ w 5PNDBUϒϧʔτϑΥʔε͸ݟ๞͖ͨ ˠʮNBOBHFSIUNMʯΛϑΟϧλ͢Δɻ w ΫϩʔϦϯά͸෼ੳ͠ͳ͍ ˠʮSPCPUTUYUʯΛϑΟϧλ͢Δɻ w /FVUSJOPϘοτ͔ΒͷίϚϯυ࣮ߦ͸෼ੳෆཁ ˠʮEJF !NE ʯΛؚΉϦΫΤετΛϑΟϧλ͢Δɻ 21 Finding Neutrino https://blog.ptsecurity.com/2019/08/ﬁnding-neutrino.html

Slide 22

Slide 22 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ $JUSJYͷ੬ऑੑ͸Ͳ͏ͳͷ w )551ϔομ͕ϥϯμϜจࣈྻʹͳΔͷͰɺ')3) ͷద༻͸ݫͦ͠͏ 22

Slide 23

Slide 23 text

·ͩݟ͵߈ܸΛݟ͚ͭΔ ·ͱΊ w ϩάͷࢁ͔Βɺ৽͍͠߈ܸΛݟ͚ͭΔͱ͍͏Ϟν ϕʔγϣϯΛݩʹɺ)551ϦΫΤετΛϋογϡԽ ͢Δख๏Λߟ͑·ͨ͠ɻ w ࣮૷ͯ͠Έͨͱ͜Ζɺݩͷϩάͷྔ ߦ਺ ͔ΒҎ ԼʹݮΓ·ͨ͠ɻ w ϋχʔϙολʔΛଓ͚ΔͨΊͷ޻෉͸େ੾ 23