WelComeToHoneyPOTWORLD/ 低対話型ハニーポットを調査してみた

by sec-chick

Slide 1

Slide 1 text

௿ର࿩ܕϋχʔϙοτ Λௐࠪͯ͠Έͨ WELCOME TO HONEY POT WORLD ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ

Slide 2

Slide 2 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ͓඼ॻ͖ 1. ࣗݾ঺հ 2.ϋχʔϙοτͱ͸ 3.ϋχʔϙολʔ΁ͷಓͷΓ 4. ϋχʔϙοτௐࠪ 5. ௐࠪ݁Ռ(·ͱΊʣ

Slide 3

Slide 3 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ͸͡Ίʹ ▸ ຊൃද͸ݸਓతͳҙݟ͓ΑͼݸਓతͳௐࠪʹΑΔ΋ͷͰ͢ɻ ▸ Կ͔ຊൃදͰޡΓ͕͋Γ·ͨ͠Βɺޙ΄Ͳ  twittrͳͲͰڭ͑ͯ௖͚Δͱ޾͍Ͱ͢ɻ

Slide 4

Slide 4 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ࣗݾ঺հ ▸ ໊લ  sec chick@one_sec_chick ▸ ͓࢓ࣄ  αΠόʔηΩϡϦςΟؔ࿈  ˞ PSOCͰΞφϦετΛ͍ͯ͠·ͨ͠ ▸ ϋχʔϙολʔྺ  6ϲ݄ ▸ ར༻ϋχʔϙοτ  WoWHoneypot

Slide 5

Slide 5 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ࠓճͷൃද ▸ T-pot͕εϖοΫతʹݫ͘͠ɺ௿ର࿩ܕϋχʔϙοτͰӡ༻͠Α͏ͱ  ͍ͯ͠Δਓʹ޲͚ͯɺͦΕͧΕɺͲͷΑ͏ͳಛ௃͕͋Δ͔Λௐࠪ  ˞௿ର࿩ܕɿಛఆͷOS΍ΞϓϦέʔγϣϯΛΤϛϡϨʔτ͠؂ࢹ  ▸ ࠓճɺௐ΂ͨϋχʔϙοτ͸ҎԼͷ௨Γ • cowrie • dionaea • glastopf • honeytrap • WoW Honeypot  ‣ ͜ͷൃදͰ1ਓͰ΋ϋχʔϙολʔ͕૿͑ͯ͘ΕΔ͜ͱΛ໨ඪʹͯ͠ൃද

Slide 6

Slide 6 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ϋχʔϙοτͱ͸ ▸ Θ͟ͱ੬ऑͳ؀ڥΛઃஔ͠߈ܸऀʹ৵ೖͤ͞ɺ߈ܸऀͷߦ ಈΛ؂ࢹ͠ɺ෼ੳ͢Δ͜ͱΛ໨తͱͨ͠γεςϜ ▸ ϋχʔϙοτͷछྨͱͯ͠͸ɺओʹαʔϏεΛΤϛϡϨʔτ ͢Δ௿ର࿩ܕͱຊ෺ͷΞϓϦέʔγϣϯ΍OSΛ࢖͏  ߴର࿩ܕ͕ଘࡏ ▸ ࣮ࡍʹϩάΛݟΔ͜ͱͰɺ߈ܸऀ͕ͲͷΑ͏ͳ੬ऑੑΛར༻ ͠ɺͲͷΑ͏ͳ໨తͰ߈ܸ͍ͯ͠Δ͔Λ؍࡯Ͱ͖Δ

Slide 7

Slide 7 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ϋχʔϙοτͱ͸ ੬ऑͳαʔό )POOFZQPU ߈ܸΛ࢓ֻ͚Δ ߈ܸΛ෼ੳ

Slide 8

Slide 8 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ϋχʔϙολʔ΁ͷಓͷΓᶃ ▸ ษڧձͷαΠτΛݟ͍ͯΔͱɺԿ΍Βϋχʔϙοτͱ͍͏  จࣈྻΛൃݟ ▸ ௐ΂ͯΈΔͱɺ͋͑ͯ੬ऑੑͳ؀ڥʹͯ͠ɺ߈ܸͤ͞Δ͜ͱ Ͱɺ߈ܸํ๏Λ؍࡯͢Δͱ͍͏ັྃతͳϫʔυ ▸ ໘നͦ͏ͩͱࢥ͍ɺࣗ෼΋ϋχʔϙολʔʹͳΔ͜ͱΛܾҙ

Slide 9

Slide 9 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ϋχʔϙολʔ΁ͷಓͷΓᶄ ▸ ·ͣ͸ϋχʔϙοτΛબͿඞཁ͕͋Δ͕ɺछྨ͕ଟ͘ͲΕΛબ΂͹ ͍͍͔෼͔Βͳ͍

Slide 10

Slide 10 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ϋχʔϙολʔ΁ͷಓͷΓᶅ ▸ ωοτͰௐ΂ͯΈΔͱɺT-PotΛ࢖͍ͬͯΔਓ͕ଟ͍ ▸ T-Pot͸ෳ਺ͷϋχʔϙοτΛ؍ଌՄೳͰ͋ΓɺΠϯετʔϧ͢Δͩ ͚Ͱ෯޿͍αʔϏεΛ؍ଌͰ͖Δϋχʔϙοτ

Slide 11

Slide 11 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ϋχʔϙολʔ΁ͷಓͷΓᶆ ▸ ࣗ୐ʹT-PotΛߏங͠Α͏ͱࢥ͕ͬͨɺ҆શੑΛߟྀͯ͠ VPSʹߏங͢Δ͜ͱʹ ▸ ͜͜Ͱ T-Potͷਪ঑εϖοΫ͕ωοΫʹɻɻɻɻ  ˞ඪ४ͷΠϯετʔϧͰ΋ϝϞϦ 4GBɺSSD 64 GB ͷ༰ྔ͕ඞཁ ▸ ਪ঑εϖοΫͰ͸ͳ͍͕ɺ͓ۚͷ౎߹্ɺϝϞϦ2GͰಈ͔ͯ͠ΈΔ͜ͱʹ ਪ঑εϖοΫͰ͘͞ΒVPSͰՁ ֨ΛݟͯΈΔͱɺ݁ߏߴ͍ ਪ঑εϖοΫ͡Όͳ͍͚Ͳɺ ϝϞϦΛ2GBͯ͠΋େৎ෉͔ͳ

Slide 12

Slide 12 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ʲࢀߟʳ͘͞ΒVPSͷ͓஋ஈ ࢀরɿhttps://vps.sakura.ad.jp/speciﬁcation/

Slide 13

Slide 13 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ʲࢀߟʳϋχʔϙοτઃஔՄೳαʔϏε ▸ աڈʹϋχʔϙολ͕ௐ΂ͯ಺༰Ͱ֤αʔϏεͰͷϋχʔϙοτͷ ӡ༻Մ൱ʹ͍ͭͯௐ͓ࠪͯ͠Γɺଟ͘ͷ؀ڥͰར༻͢Δ͜ͱ͕Մೳ αʔϏε໊ αϙʔτ͔Β ͷճ౴೔ Մ൱ උߟ ConoHa 2017.06.21 NG ن໿ҧ൓Ͱ͸ͳ͍͕ଞͷ͓٬༷΁ͷӨڹ͕ݒ೦͞ΕΔͷͰ߇͑ͯ΄͍͠ ͘͞ΒͷΫϥ΢υ 2017.08.10 OK ར༻ن໿΍੍ݶࣄ߲ʹ͸֘౰͠ͳ͍ͷͰ໰୊ͳ͍ɻଞͷ͓٬༷ʹ໎࿭͕͔͔Δঢ় گ(େྔͷτϥϑΟοΫ͕ൃੜ͢Δɺར༻͍ͯ͠Δαʔό͕ݪҼͰ֎෦ͷෆਖ਼α ʔόͷϦετʹొ࿥͞ΕΔɺ౳)͕͋Ε͹ɺݸผʹ੍ݶΛ࣮ࢪ͢৔߹͕͋Δ ͘͞ΒͷVPS 2017.08.10 OK ಉ্ IDCFΫϥ΢υ 2017.08.10 OK Ϋϥ΢υ্ͰӡӦ͢Δ಺༰ʹ͍ͭͯ͸໰ΘΕͳ͍ͷͰӡ༻Մೳɻͨͩ͠ɺୈࡾऀ ౳ʹෆਖ਼ʹѻΘΕͨ৔߹͸໿׺౳ʹ౰ͯ͸·ΔՄೳੑ͕͋Δ ABLENET VPS 2017.08.10 OK ϋχʔϙοτͷΠϯετʔϧΛېࢭ͸͍ͯ͠ͳ͍͕ɺଞͷ͓٬༷ͷར༻ʹӨڹ͕ ग़ΔΑ͏ͳ৔߹͸ར༻ͷ੍ݶ΍ܖ໿ղআΛߦ͏৔߹͕͋Δ KAGOYA CLOUDʗ2 2017.08.10 OK ϋχʔϙοτͷӡ༻ʹର੍ͯ͠ݶ͸ͳ͍͕ɺ߈ܸΛड͚ΔલఏͷγεςϜͳͷͰ ηΩϡϦςΟରࡦΛे෼ʹ࣮ࢪͨ͠͏͑Ͱӡ༻ͯ͠΄͍͠ɻ ServersManˏVPS 2017.08.10 OK Πϯετʔϧ͢ΔΞϓϦέʔγϣϯʹ੍ݶ͸ઃ͚͍ͯͳ͍͕ɺن໿ͷୈ17৚͓ Αͼୈ32৚ʹ֘౰͢Δͱ൑அ͞Εͨ৔߹͸੍ݶΛߦ͏ࣄ͕͋Δɻ ʮServersMan@VPSϓϥϯར༻ن໿ʯͷېࢭࣄ߲Λ֬ೝͯ͠΄͍͠ɻ ໊͓લ.comVPS 2017.08.14 OK ࢀরɿϋχʔϙοτͷӡ༻͕ن໿ҧ൓Ͱͳ͍͔ௐ΂ͯΈͨIUUQTCMBDLMFQBSEOFUWCON

Slide 14

Slide 14 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ϋχʔϙολʔ΁ͷಓͷΓᶇ ▸ ਺೔ؒ͸ॱௐʹಈ͍͍͕ͯͨɺΤϥʔͰT-Pot͕ࢭ·ͬͯ͠·͏ࣄ৅ ͕ଟൃ  ▸ ݁ہɺ҆ఆͯ͠ಈ͔ͳ͍ͷͰɺղ໿͢Δ͜ͱʹɻɻɻɻ  ▸ ݱࡏ͸ɺ௿εϖοΫͰ΋ՔಇՄೳͰɺHTTPͷ߈ܸΛ؂ࢹͰ͖Δ  WoWHoneypotΛӡ༻த

Slide 15

Slide 15 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ௿ର࿩ܕ HONEYPOT ௐࠪ ▸ ௿ର࿩ܕͷϋχʔϙοτΛ঺հ

Slide 16

Slide 16 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ GLASTOPF ▸ WEBͰͷ߈ܸΛ؂ࢹʹಛԽͨ͠ϋχʔϙοτ ▸ σΟϨΫτϦτϥόʔαϧ΍ SQL Injection ʹରͯ͠ɺΤϛϡϨʔτ ͨ݁͠ՌΛදࣔ

Slide 17

Slide 17 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ GLASTOPF Ϩεϙϯεྫ ▸ ϦΫΤετྫ1  http://192.168.0.xx/test.php?q=SELECT%20A%20FROM%20B  Ϩεϙϯε  Invalid query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SELECT A FROM B' at line 1 ▸ ϦΫΤετྫ2  http://192.168.0.xx/test.php?a=../../../../../../../etc/passwd  Ϩεϙϯε  root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x: 2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x: ~ লུ ~  ※ ҎԼͷgithubͷςετέʔεΛࢀߟ  ɹhttps://github.com/mushorg/glastopf/blob/master/glastopf/testing

Slide 18

Slide 18 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ WOW HONEYPOT ▸ HTTPͷ߈ܸΛ؂ࢹ໨తͱͨ͠ϋχʔϙοτ ▸ ߈ܸऀͷϦΫΤετʹରͯ͠ɺ߈ܸ͕੒ޭͨ͠Α͏ʹݟ͔͚ͤΔ  ϨεϙϯεΛฦ৴ ▸ ϋϯςΟϯάػೳʹΑΓɺϚϧ΢ΣΞΛVirus TotalͰղੳՄೳ  (ݕମ͸อଘ͠ͳ͍) ▸ Πϯετʔϧ͕؆୯ʢҎԼͷϖʔδΛࢀߟʹΠϯετʔϧՄೳʣ  https://github.com/morihisa/WOWHoneypot

Slide 19

Slide 19 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ WOW HONEYPOT ߈ܸऀ͕αʔό΁ϦΫΤετΛૹ৴ αʔόͷ'8Ͱϙʔτసૹ  ྫɿϙʔτ͔Βϙʔτ΁ ϦΫΤετ͔ΒϨεϙϯε಺༰Λܾఆ ߈ܸऀ΁ϨεϙϯεΛฦ͢ 8P8)POFZQPU ࢀߟɿॳ৺ऀ޲͚ϋχʔϙοτ808)POFZQPUͷ঺հ  ɹɹɹIUUQTTQFBLFSEFDLDPNNPSJIJ@TPDDIVYJO[IFYJBOHLFIBOJIPUVUPXPXIPOFZQPUGBMTFTIBPKJF TMJEF

Slide 20

Slide 20 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ WOW HONEYPOT Ϩεϙϯεྫ ▸ GET /etc/passwd  Ϩεϙϯεɿ  root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/ usr/sbin/nologin ~লུ~  ▸ GET /getcfg.php (D-Link)  Ϩεϙϯεɿ DEVICE.ACCOUNT 100 admin 100 adminpass administrators manage  ▸ POST /wls-wsat/CoordinatorPortType  εςʔλείʔυɿ500

Slide 21

Slide 21 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ COWRIE ▸ SSH͓ΑͼTelnetͷ؂ࢹΛ໨తͱͨ͠ϋχʔϙοτ ▸ ߈ܸऀͷଧͪࠐΜͩίϚϯυͷه࿥͓Αͼ࠶ੜ͕Մೳ ▸ ߈ܸऀ͕ϋχʔϙοτʹμ΢ϯϩʔυͨ͠ϑΝΠϧΛอଘ

Slide 22

Slide 22 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ COWRIE ▸ ϩά (/log/cowrie-textlog.log)  2018-06-21T06:20:11.790706Z login attempt [sec_chick/aaaaaa] failed  2018-06-21T06:20:15.884342Z login attempt [sec_chick/bbbbb] failed  2018-06-21T06:20:18.976004Z login attempt [sec_chick/cccccc] succeeded  2018-06-21T06:20:19.466336Z Terminal Size: 24 80  2018-06-21T06:20:19.467874Z request_env: LANG=ja_JP.UTF-8  2018-06-21T06:20:19.470091Z Opening TTY Log: log/tty/ 20180621-062019-758689600833-0i.log  2018-06-21T06:20:33.007909Z CMD: ls  2018-06-21T06:20:33.020759Z Command found: ls   2018-06-21T06:20:49.834860Z CMD: wget www[.]yahoo.co.jp  2018-06-21T06:20:49.839532Z Command found: wget www[.]yahoo.co.jp  2018-06-21T06:20:49.937292Z Downloaded URL (http://www[.]yahoo.co.jp) with SHA-256 bbede94bcf9ab5fbc4469b382335449ebf2499595ffc84b64eb492faa79b35e1 to dl/ bbede94bcf9ab5fbc4469b382335449ebf2499595ffc84b64eb492faa79b35e1

Slide 23

Slide 23 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ COWRIE ϩάΠϯ࣌ ▸ ϩάΠϯ࣌ͷϩά  login attempt [sec_chick/aaaaaa] failed  login attempt [sec_chick/bbbbb] failed  login attempt [sec_chick/cccccc] succeeded  ▸ ͋͑ͯԿ౓͔ϩάΠϯΛࣦഊ͔ͤͯ͞ΒϩάΠϯͤ͞Δ࢓૊Έ  ˞̏ճ໨ͰϩάΠϯ੒ޭ  ▸ ϩάΠϯ෦෼Ͱ͸Ϣʔβ໊͓ΑͼύεϫʔυΛऩू

Slide 24

Slide 24 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ COWRIE ϩάΠϯޙ ▸ ϩάΠϯޙͷϩά  CMD: ls  Command found: ls   CMD: wget www.yahoo.co.jp  Command found: wget www[.]yahoo.co.jp  Downloaded URL (http://www[.]yahoo.co.jp) with SHA-256 bbede94bcf9ab5fbc4469b382335449ebf2499595ffc ~লུ~ ▸ ϩάΠϯ੒ޭޙɺ߈ܸऀ͕ͲͷΑ͏ͳίϚϯυΛ࣮ߦ͔ͨ͠  ֬ೝՄೳ ▸ μ΢ϯϩʔυ͞ΕͨϑΝΠϧ͸อଘ͞ΕΔͨΊɺޙ͔Β֬ೝՄೳ

Slide 25

Slide 25 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ DIONAEA ▸ ωοτϫʔΫ্ͰՔಇ͍ͯ͠ΔαʔϏεͷ੬ऑੑΛૂͬͨϚ ϧ΢ΣΞͷั֫Λ໨తͱͨ͠ϋχʔϙοτ ▸ FTPɺHTTPɺMySQLɺSMBͳͲͷ෯޿͍αʔϏε(16छྨ) ʹؔ͢Δ߈ܸΛ؂ࢹՄೳ ▸ ั֫͞ΕͨϚϧ΢ΣΞ͸σΟϨΫτϦʹอଘ͞ΕΔ

Slide 26

Slide 26 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ DIONAEA ▸ ҎԼͷαʔϏε͕dionaea্Ͱ؂ࢹՄೳ ໊લ αʔϏε ϙʔτ ϓϩτί Black hole telnet 23 tcp DNS 53 tcp,udp NTP 123 udp EPMAP SMB 135 tcp FTP FTP 21 tcp HTTP HTTP 80 tcp Memache memcache 11211 tcp mirror mirror 42 tcp MongoDB MongoDB 27017 tcp mqtt MQ Telemetry Transport 1883 tcp ໊લ αʔϏε ϙʔτ ϓϩτί MSSQL MSSQL 1433 tcp MYSQL MYSQL 3306 tcp PPTP PPTP 1723 tcp SIP (VoIP) SIP 5060 tcp SIP over TLS 5061 tcp SIP 5060 udp SMB SMB 445 tcp TFTP TFTP 69 udp UPnP UPnP 1900 udp

Slide 27

Slide 27 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ DIONAEA දࣔྫ(HTTP) ▸ σϑΥϧτͰ͸ Directory listing for ͷϖʔδ͕දࣔ͞ΕΔ

Slide 28

Slide 28 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ DIONAEA දࣔྫ(FTP) ▸ FTP઀ଓ࣌ͷ༷ࢠ  220 FTP server ready.  USER sec_chick  331 Password required for sec_chick.  PASS password  230 User logged in, proceed  pwd  257 "/"  help  502 Command 'HELP' not implemented

Slide 29

Slide 29 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ HONEYTRAP ▸ ෯޿͍αʔϏεΛ؂ࢹ͢Δ͜ͱ͕Ͱ͖Δϋχʔϙοτ ▸ TCP͓ΑͼUDPʹରͯ͠ͷ௨৴Λϩάʹه࿥  ˞ύέοτΛNFQUEUEʹૹΓɺHoneytrap͕ॲཧ ▸ ୅දతͳϓϩτίϧʹରͯ͠ɺܾ·ͬͨϨεϙϯεΛ  ฦ͢͜ͱ͕Մೳ ▸ αʔϏεΛݶఆ͍ͯ͠ͳ͍ͨΊɺ༷ʑͳ߈ܸΛ؂ࢹՄೳ

Slide 30

Slide 30 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ HONEYTRAP Ϩεϙϯεྫ ▸ FTP  220 Welcome to localhost ▸ SMTP  250 localhost ESMTP Postﬁx ▸ MYSQL  4.0.24_Debian-10sarge1-logu3;n:u`b,

Slide 31

Slide 31 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ֤ϋχʔϙοτ·ͱΊ ϋχʔϙοτ໊ ֓ཁ औಘՄೳͳ৘ใ glastopf ɾWebܦ༝Ͱͷ߈ܸΛ؂ࢹΛ໨తͱͨ͠ϋχʔϙοτ ɾσΟϨΫτϦτϥόʔαϧ ΍ SQL Injection ʹରͯ͠  ੬ऑੑͳ൓ԠΛ߈ܸऀ΁ฦ͢ ɾPOSTϦΫΤετͷBODY෦ͷ৘ใΛऔಘՄೳ ɾHTTPϦΫΤετͷ಺༰ WoWHoneypot ɾHTTPͷ߈ܸΛ؂ࢹ໨తͱͨ͠ϋχʔϙοτ ɾHTTP ϦΫΤετΛ·Δͬͱอଘ ɾ߈ܸऀͷϦΫΤετʹରͯ͠ɺ߈ܸ͕੒ޭͨ͠Α͏ʹ ɹݟ͔͚ͤΔϨεϙϯεΛฦ৴ ɾϋϯςΟϯάػೳʹΑΓɺϚϧ΢ΣΞΛVirus Totalʹ࿈ܞ  Մೳ(ݕମ͸อଘ͠ͳ͍) ɾΠϯετʔϧ͕؆୯ ɾHTTPϦΫΤετͷ಺༰ ɾϚϧ΢ΣΞͷURLઌ ▸ HTTPʹؔ͢ΔϋχʔϙοτͰ͋Ε͹ɺglastopf΋͘͠͸  WoWHoneypot͕Φεεϝ

Slide 32

Slide 32 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ֤ϋχʔϙοτ·ͱΊ ϋχʔϙοτ໊ ֓ཁ औಘՄೳͳ৘ใ cowrie ɾSSH͓ΑͼTelnetͷ؂ࢹΛ໨తͱͨ͠ϋχʔϙοτ ɾ৵ೖऀͷଧͪࠐΜͩίϚϯυͷه࿥͓Αͼ࠶ੜ͕Մೳ ɾ৵ೖऀ͕ϋχʔϙοτʹμ΢ϯϩʔυͨ͠ϑΝΠϧΛอଘ ɾSSH͓ΑͼTelnetͰར༻ͨ͠Ϣʔβ໊ɺPW ɾϩάΠϯޙʹೖྗ͞ΕͨίϚϯυ ɾwget, curl Ͱμ΢ϯϩʔυ͞Εͨ ϑΝΠϧ dionaea ɾωοτϫʔΫ্ͰՔಇ͍ͯ͠ΔαʔϏεͷ੬ऑੑΛૂͬͨ Ϛϧ΢ΣΞͷั֫Λ໨తͱͨ͠ϋχʔϙοτ ɾFTPɺHTTPɺMySQLɺSMBͳͲͷ෯޿͍αʔϏε (16छྨ)ΛΧόʔ ɾ৵ೖऀ͕ઃஔͨ͠Ϛϧ΢ΣΞ΋ޙ͔ΒࢀরՄೳ ɾՔಈ͍ͯ͠ΔαʔϏε΁ͷ௨৴ ɾ഑ஔ͞ΕͨϚϧ΢ΣΞ honeytrap ɾ෯޿͍αʔϏεΛ؂ࢹ͢Δ͜ͱ͕Մೳ (ࠓճͷݕূͰ࠷΋ଟ͘ͷϙʔτͰͷ௨৴Λݕ஌) ɾ࣮ࡍͷ௨৴಺༰΋֬ೝՄೳ ɾओཁϙʔτ΁ͷ؆қతͳϨεϙϯεΛฦ͢ ɾhoneytrapѼ΁ͷ௨৴ ▸ HTTPҎ֎ͰͷϋχʔϙοτͰ͋Ε͹ɺcowrieɺdionaeaɺ honeytrap͕Φεεϝ

Slide 33

Slide 33 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ௐࠪ݁Ռʢ·ͱΊʣ ▸ ௿ର࿩ܕͷϋχʔϙοτʹ͍ͭͯௐࠪΛ࣮ࢪ ▸ ௿ର࿩ܕʹ΋ͦΕͧΕछྨ͕͋ΔͨΊɺ ࣗ෼ͷ؍࡯͍ͨ͠  ߈ܸͰϋχʔϙοτΛબ୒͠·͠ΐ͏ʂ ▸ ͓ۚʹ༨༟͕͋Δਓ͸T-PotΛӡ༻͢Δͷ΋༗ ▸ ௿ର࿩ܕϋχʔϙοτͷಋೖํ๏͸ɺϒϩά΍ॻ੶Ҏ֎ʹ΋  Dockerﬁle͕ࢀߟʹͳΔ(ͲͷίϚϯυΛଧͯ͹͍͍͔෼͔ΔͨΊʣ ▸ ࠓճͷൃදͰҰਓͰ΋ଟ͘ͷϋχʔϙολʔ͕૿͑Δͱخ͍͠Ͱ͢ʂʂʂ

Slide 34

Slide 34 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ऴΘΓ ▸ ͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂʂʂ

Slide 35

Slide 35 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ࢀߟURL ▸ Githubؔ࿈  https://github.com/dtag-dev-sec/tpotce  https://github.com/micheloosterhof/cowrie  https://github.com/dinotools/dionaea  https://github.com/mushorg/glastopf  https://github.com/armedpot/honeytrap  https://github.com/morihisa/WOWHoneypot

Slide 36

Slide 36 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ࢀߟURL ▸ www.morihi-soc.net  http://www.morihi-soc.net/  https://speakerdeck.com/morihi_soc/chu-xin-zhe-xiang-kehanihotuto-wowhoneypot-falseshao- jie ▸ HONEYPOTӡ༻೔ه  https://blog.n-etupirka.net/ ▸ αΠόʔηΩϡϦςΟ͸͡Ί·ͨ͠  https://tk-secu.hateblo.jp/ ▸ Misc notes  https://fatsheep.hateblo.jp/ ▸ nanka iroiro  http://waaai-tanoshiiiii.hatenablog.com/ ▸ ଞʹ΋༷ʑͳϋχʔϙολʔͷϒϩάΛࢀߟʹͤͯ͞΋Β͍·ͨ͠

Slide 37

Slide 37 text

ୈ4ճ ϋχʔϙολʔٕज़ަྲྀձ ࢀߟॻ੶ ▸ Ոܭʹ΍͍͞͠ϋχʔϙοτೖ໳  ஶऀɿʹ΄Μ΋΋Μ͕  ߪೖURL: https://booth.pm/ja/items/663689 ▸ WOWHoneypotͷ༡ͼ͔ͨ  ஶऀɿmorihi-soc  ߪೖURL: https://booth.pm/ja/items/824586