Vuls × STNSで始める脆弱性検知の自動化

Slide 1

Slide 1 text

dΦϨ͸΋͏$7&৘ใൃ৴͞ΕΔ౓ʹർฐ͢Δͷ͸΍ΊͨΜͩd !QZBNB(.01FQBCP *OD ۝भΠϯϑϥަྲྀษڧձ ,JYT 7PM 7VMTº45/4Ͱ࢝ΊΔ ੬ऑੑݕ஌ͷࣗಈԽ

Slide 2

Slide 2 text

IUUQTUFOTOBQPODPN νʔϑςΫχΧϧϦʔυ ࢁԼ࿨඙!QZBNB ϗεςΟϯάࣄۀ෦

Slide 3

Slide 3 text

ϗεςΟϯάࣄۀ෦ શ෦Λ͍͍ײ͡ʹόʔϯͱ

Slide 4

Slide 4 text

੬ऑੑ

Slide 5

Slide 5 text

αʔόӡ༻ͷ੬ऑੑରԠͷ՝୊ wαʔό୆਺͕ଟ͍৔߹ɺௐࠪ͢Βେม wṖͷ๏ଇʹΑΓ୹ظؒʹଟ͘ͷ੬ऑੑ͕ݕ஌͞ΕΔͨΊɺ౓ॏͳΔௐࠪͰ؅ཧ ऀ͕ർฐ͢Δ

Slide 6

Slide 6 text

TTIUFYBNQMKQSQNRBcHSFQPQFOTTM

Slide 7

Slide 7 text

BOTJCMFGFYNQMFa<a> aFYBNQMFKQTBlSQNRBcHSFQ PQFOTTMlUMPHTPQFOTT@AEBUF :NEA

Slide 8

Slide 8 text

7VMT

Slide 9

Slide 9 text

$7&৘ใͱඃݧαʔόΛಥ߹͠ɺ ੬ऑੑͷ༗ແΛࣗಈ൑ఆͯ͘͠ΕΔ (PMBOH੡ͷ044

Slide 10

Slide 10 text

7VMT HPDWFEJDUJPOBSZ WVMT TFSWFS 5IF*OUFSOFU $7&৘ใͷμ΢ϯϩʔυ $7&৘ใࢀর $7&৘ใͱͷಥ߹

Slide 11

Slide 11 text

$7& $PNNPO7VMOFSBCJMJUJFTBOE&YQPTVSFT wڞ௨੬ऑੑࣝผࢠ w$7&::::4&2ͷΑ͏ʹ࠾൪

Slide 12

Slide 12 text

$744 $PNNPO7VMOFSBCJMJUZ4DPSJOH4ZTUFN w جຊධՁج४ ݱঢ়ධՁج४ ؀ڥධՁج४͝ͱʹɺηΩϡϦςΟͷେཁ݅ʹର͢Δ  ӨڹΛ਺஋Խͨ͠΋ͷ w ػີੑ w ৘ใࢿ࢈Λਖ਼౰ͳݖརΛ࣋ͬͨਓ͚͕ͩ࢖༻Ͱ͖Δঢ়ଶʹ͓ͯ͘͜͠ͱ w ׬શੑ w ৘ใࢿ࢈͕ਖ਼౰ͳݖརΛ࣋ͨͳ͍ਓʹΑΓมߋ͞Ε͍ͯͳ͍͜ͱΛ࣮֬ʹ͓ͯ͠ ͘͜ͱ w Մ༻ੑ w ৘ใࢿ࢈Λඞཁͳͱ͖ʹ࢖༻Ͱ͖Δ͜ͱ

Slide 13

Slide 13 text

$744஋͕Λ௒͑ͯ͘ΔͱӨڹ΋େ͖͍͔ͭɺ߈ܸ ͕༰қͰ͋ΔՄೳੑ͕ߴ͍ɻ·ͨݱঢ়ධՁج४ ߈ ܸίʔυͷग़ݱ༗ແ΍ରࡦ৘ใ͕ར༻ՄೳՄ൱ ΋߹ Θͤͯ֬ೝ͠·͠ΐ͏ $744 $PNNPO7VMOFSBCJMJUZ4DPSJOH4ZTUFN

Slide 14

Slide 14 text

7VMTͷ࣮ߦ # CVE৘ใͷ࠷৽Խ $ go-cve-dictionary fetchnvd -last2y # ઃఆϑΝΠϧͷࣗಈੜ੒ $ vuls discover 172.31.4.0/24 # ੬ऑੑͷεΩϟϯ $ vuls scan --cve-dictionary-dbpath /home/vuls/cve.sqlite3 - report-slack -cvss-over=7

Slide 15

Slide 15 text

7VMTલఏ৚݅ w$FOU04ͷ৔߹͸ZVNQMVHJODIBOHFMPH͕ඞཁ wWVMTಈ࡞αʔό͔Βඃݧαʔόʹରͯ͠ɺ44)ϩάΠϯग़དྷΔඞཁ͕͋Γɺߋ ʹ4VEPग़དྷΔඞཁ͕͋Δ w4MBDL௨஌͸͍·͍ͪݟͮΒ͍

Slide 16

Slide 16 text

No content

Slide 17

Slide 17 text

45/4ͱ͸ QPSU JODMVEFFUDTUOTDPOGE TBMU@FOBCMFUSVF TUSFUDIJOH@OVNCFS VTFSlCBTJD@VTFS QBTTXPSECBTJD@QBTTXPSE JE HSPVQ@JE LFZT<TTISTB99999ʜ> JE VTFST<FYBNQMF> QBTTXPSEMLGKEMLKGBMEKGBYYEGBEGBEB VJE HSPVQ % ls -ltr -rw-r--r-- 1 example wheel 0 May 8 00:09 kixs_in_pepabo.txt 50.-ܗࣜͷઃఆϑΝΠϧͰɺ-JOVYͷϢʔβʔ؅ཧΛߦ͑Δ044 MJCOTTTUOT

Slide 18

Slide 18 text

UFOBOU" UFOBOU# 7VMTº45/4 JE HSPVQ@JE LFZT<TTISTB99999ʜ> OFUXPSLUFOBOU" OFUXPSLUFOBOU# $IFDL "VUIFOUJDBUJPO /FUXPSLͷఆٛΛ௥Ճ͢Δ͚ͩͰ ࣗಈ੬ऑੑ؅ཧ͕࢝ΊΒΕΔ

Slide 19

Slide 19 text

7VMTº45/4 #!/bin/bash cd /home/vuls # CVE৘ใͷ࠷৽Խ /opt/go/bin/go-cve-dictionary fetchnvd -last2y echo -n > net_config.toml array=(“192.168.xxx.xxx/24”) for i in "${array[@]}" do /opt/go/bin/vuls discover $i | sed -n '/\[servers\./,$p' >> net_config.toml done cat config_base.toml net_config.toml > config.toml /opt/go/bin/vuls scan --cve-dictionary-dbpath /home/vuls/cve.sqlite3 -report-slack -cvss-over=7

Slide 20

Slide 20 text

੬ऑੑΛݕ஌ͨ͠Β

Slide 21

Slide 21 text

ZVNZVQEBUF

Slide 22

Slide 22 text

Կ΋ى͖ͳ͍Ͱ͘ΕʂཔΉ

Slide 23

Slide 23 text

·ͱΊ w(PMBOH੡ͳͷͰ؀ڥΛબ͹ͣಋೖՄೳ w44)ϩάΠϯϕʔεͰಈ࡞͢ΔͷͰɺ45/4ͱ૊Έ߹ΘͤΔͱΑΓศར wಋೖύοέʔδΛ೺Ѳ͢ΔΑΓ΋ɺ໰୊͕͋ΔύοέʔδΛݕ஌͢Δӡ༻΁ w΋͏͙͢೥ͩ͠ɺιʔεΠϯετʔϧ͸΍Ίͯ%PDLFSͰCVJME͠Α͏

Slide 24

Slide 24 text

ࢀߟจݙ w ڞ௨੬ऑੑࣝผࢠ$7&֓આ IUUQTXXXJQBHPKQTFDVSJUZWVMO$7&IUNM w ڞ௨੬ऑੑධՁγεςϜ$744֓આ IUUQXXXJQBHPKQTFDVSJUZWVMO $744IUNM