Slide 1
Slide 1 text
20182݄24 ୈ3ճϋχʔϙολʔٕज़ަྲྀձൃදࢿྉ
WebLogic ͷ੬ऑੑ(CVE-2017-10271)Λ
ૂ͏߈ܸऀͨͪͷख๏
@morihi_soc
Slide 2
Slide 2 text
XIPBNJ
w ٱত !NPSJIJ@TPD
w ຊۀηΩϡϦςΟΤϯδχΞɾΞφϦετ
w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ
w ϒϩάˠIUUQXXXNPSJIJTPDOFU
w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ
w άϧʔϓˠIUUQTIBOJQPUFDIDPOOQBTTDPN
ˡϒϩάͷʮϋχʔϙοτ؍هʯ͕
ຊʹͳΓ·ͨ͠
݄ൃച
ిࢠॻ੶൛ແྉࢼಡ൛͋Γ·͢
ʮαΠόʔ߈ܸͷΛੳ͢Δ
ϋχʔϙοτ؍هʯ
ஶऀɿٱত
ग़൛ɿलγεςϜ
ࠓ·Ͱʹ͓ੈʹͳͬͨΠϕϯτ
ɾ*5,FZT ݱ4FD$BQ
ɾωοτϫʔΫύέοτΛಡΉձ Ծ
ɾ/*4$αΠόʔϋϩΟϯ
ɾ*OUFSOFU8FFL
ɾ)BSEFOJOH 7BMVF$IBJO༏উ
ɾTTNKQ
ɾ"*4FD
ɾULULηΩϡϦςΟษڧձ
Slide 3
Slide 3 text
͓ॻ͖
w 8FC-PHJDͷ੬ऑੑ $7&
ͱ
w ࠃ͝ͱͷ߈ܸݕճͷूܭ
w ߈ܸසͷੳ
w ߈ܸରͷௐࠪͱ߈ܸ
w Ͳͷϙʔτ͕ૂΘΕͨͷ͔
w ߈ܸऀͷڥΛਪଌ͢Δ
w ߈ܸࣄྫհ
w ·ͱΊ
3
Slide 4
Slide 4 text
8FC-PHJDͷ੬ऑੑ $7&
ͱ
w +7/J1FEJBΑΓ
l0SBDMF'VTJPO.JEEMFXBSFͷ0SBDMF8FC-PHJD
4FSWFSʹɺ8-44FDVSJUZʹؔ͢Δॲཧʹෆඋ͕͋
ΔͨΊɺػີੑɺશੑɺ͓ΑͼՄ༻ੑʹӨڹͷ͋Δ੬
ऑੑ͕ଘࡏ͠·͢ɻl
lϦϞʔτͷ߈ܸऀʹΑΓɺใΛऔಘ͞ΕΔɺใΛվ
͟Μ͞ΕΔɺ͓ΑͼαʔϏεӡ༻ %P4
߈ܸ͕ߦΘ
ΕΔՄೳੑ͕͋Γ·͢ɻl
4
JVNDB-2017-008734
Oracle Fusion Middleware ͷ Oracle WebLogic Server ʹ͓͚Δ WLS Security ʹؔ͢Δ੬ऑੑ
http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-008734.html
→ϦϞʔτ͔ΒҙͷίʔυΛ࣮ߦ(RCE)Մೳͳ
ެ։͞Εͨ߈ܸπʔϧ͕ެ։͞Εͨ
Slide 5
Slide 5 text
߈ܸϦΫΤεταϯϓϧ
5
Slide 6
Slide 6 text
λΠϜϥΠϯ
w ݄ɿ0SBDMF͔Βमਖ਼ϓϩάϥϜ͕ެ։
w ݄Լ०ɿ߈ܸίʔυ͕ެ։
w ݄ɿϋχʔϙοτͰ߈ܸΛݕ
w ݄ɿϒϩάهࣄެ։
w ݄࣌ɿ߈ܸܧଓதʜ
6
ϋχʔϙοτ؍ه(38)ʮWebLogic ͷ WLS Security ʹର͢ΔίϚϯυ࣮ߦͷࢼΈ(CVE-2017-10271)ʯ
http://www.morihi-soc.net/?p=910
Slide 7
Slide 7 text
ϋχʔϙολʔͷΈ ϩάެ։ج४
w ͳ݄ͥ࣌ͰπΠʔτͷΈ
7
w ໌֬ʹ߈ܸίʔυ͕ެ։͞Ε͍ͯΔͱ͍͏ใ͕
ಘΒΕͳ͔ͬͨɻϩάΛެ։͢Δ͜ͱͰɺ฿͠
ͨ߈ܸʹΑΔೋ࣍ඃͷࢭΛ༏ઌɻ
w ߈ܸΛݕ͍ͯ͠Δࣄ࣮͔͑ͨͬͨɻ
w ͦͷޙɺ(JU)VCͰ߈ܸπʔϧ͕ެ։͞Ε͍ͯΔ
͜ͱΛ֬ೝɻϒϩάެ։ʹࢸΔɻ
w ߈ܸϩάΛެ։͢Δ͜ͱͰɺύονద༻ͷۓٸੑɺ
͓Αͼ߈ܸੑͷߴ͞Λ͔͑ͨͬͨɻ
Slide 8
Slide 8 text
ηΩϡϦςΟͷใڞ༗͍͠
w ηΩϡϦςΟͷใڞ༗ͱ͍͑ɺ*1"+1$&35
$$ɺηΩϡϦςΟϕϯμʔΛ͡ΊɺॏཁΠϯϑϥ
Ͱ͋Ε/*4$ͷηϓλʔɺ*1"ͷαΠόʔใڞ
༗ΠχγΞςΟϒ +$4*1
ͳͲɺଟଘࡏ͢Δɻ
w ͨͩ͠߈ܸͷ࣮ମ͕Ұൠެ։͞ΕΔ͜ͱكɻ
w ߈ܸऀΞϯμʔάϥϯυͳͱ͜ΖͰɺ߈ܸใ
Λڞ༗͍ͯ͠ΔʹؔΘΒͣɺηΩϡϦςΟʹܞΘ
Δਓͨͪͷใڞ༗ʹλΠϜϥά͕͋Δɻ
8
ˠϋχʔϙοτͩͱใެ։͍͢͠ͷͰɺ
ݸਓతͳ׆ಈͱͯ͠ϒϩάΛॻ͍͍ͯ·͢ɻ
Slide 9
Slide 9 text
ࢀߟ
੬ऑੑใ͓͍ͬͯ͘Β
w ࠓճͷ੬ऑੑใ ߈ܸίʔυ
ͷஈɾɾɾ
9
Oracle WebLogic Server 10.3.6.0.0/12.1.3.0.0/12.2.1.1.0/12.2.1.2.0 WLS Security unknown vulnerability
https://vuldb.com/?id.108063
→0day ͷؒɺ1100ສԁ-5300ສԁͩͬͨ
Slide 10
Slide 10 text
ࠃ͝ͱͷ߈ܸݕճͷूܭ
w ੈք֤͔Β߈ܸͷϩά͕͍ͬͯͨɻ
10
352 தࠃ
331 ΞΠϧϥϯυ
324 ΞϝϦΧ߹ऺࠃ
168 ηΠγΣϧ
100 Χβϑελϯڞࠃ
89 ຊ
53 Χφμ
47 ߳ߓ
46 ΫϥΠφڞࠃ
44 υΠπ࿈ڞࠃ
24 ϋϯΨϦʔڞࠃ
20 γϯΨϙʔϧ
12 ίϩϯϏΞڞࠃ
11 ϧάΞΠڞࠃ
3 େؖຽࠃ
3 ϒϧΨϦΞڞࠃ
2 ϧʔϚχΞ
2 ΦϥϯμԦࠃ
1 ϩγΞ
1 εΣʔσϯԦࠃ
༻ͨ͠ GeoIP σʔλϕʔε(GeoLite2 Country: 20182݄ʹμϯϩʔυͨ͠ϑΝΠϧΛར༻)
https://dev.maxmind.com/ja/geolite2/
Slide 11
Slide 11 text
0
20
40
60
80
100
120
140
160
180
2017/12/24
2017/12/25
2017/12/26
2017/12/27
2017/12/28
2017/12/29
2017/12/30
2017/12/31
2018/1/1
2018/1/2
2018/1/3
2018/1/4
2018/1/5
2018/1/6
2018/1/7
2018/1/8
2018/1/9
2018/1/10
2018/1/11
2018/1/12
2018/1/13
2018/1/14
2018/1/15
2018/1/16
2018/1/17
2018/1/18
2018/1/19
2018/1/20
2018/1/21
2018/1/22
2018/1/23
2018/1/24
2018/1/25
2018/1/26
2018/1/27
2018/1/28
2018/1/29
2018/1/30
2018/1/31
2018/2/1
2018/2/2
2018/2/3
2018/2/4
2018/2/5
2018/2/6
2018/2/7
2018/2/8
2018/2/9
2018/2/10
2018/2/11
2018/2/12
2018/2/13
2018/2/14
2018/2/15
2018/2/16
2018/2/17
WebLogic (2017 12 24 -2018 2 17 )
߈ܸසΛੳ
w ϋχʔϙοτͰݕͨ͠߈ܸΛ͝ͱʹूܭ
w 8FC-PHJDͷௐࠪͱ߈ܸͷ྆ํΛؚΉ
11
156݅ͷ߈ܸ/͕࠷ଟ
શମͰ1,633݅
Slide 12
Slide 12 text
߈ܸରͷௐࠪͱ߈ܸ
w ߈ܸπʔϧʹΑͬͯɺ߈ܸରͰ8FC-PHJD͕
ಈ࡞͍ͯ͠Δ͔ௐࠪ͢Δ߹͕͋Γ·͢ɻ
12
ᶄWebLogic ͷِԠ
ᶃGET/HEAD ϦΫΤετ
WebLogic ͷՔಇঢ়گͷௐࠪ
ᶅPOST ϦΫΤετ
੬ऑੑΛૂͬͨ߈ܸ
߈ܸऀ
WOWHoneypot
Slide 13
Slide 13 text
߈ܸରͷௐࠪͱ߈ܸ
w ϦΫΤετຖʹूܭ
w ਪଌ
w (&5ϝιουɺίϯςϯπ༰Λௐࠪ
w )&"%ϝιουɺ4FSWFSϔομΛௐࠪ
w 1045ϝιουɺରͷڥʹؔͳ͘߈ܸ
13
ϝιουͷछྨ ߈ܸݕ݅
(&5
)&"%
1045
Slide 14
Slide 14 text
Ͳͷϙʔτ͕ૂΘΕͨͷ͔
w ߈ܸऀɺ߈ܸରͷڥΛඞͣ͠ߟྀ͍ͯ͠ͳ
͍ɻແࠩผʹ߈ܸ͍ͯ͠ΔՄೳੑ͕ߴ͍ɻ
w 8FC-PHJDͷཧ༻ϙʔτͱͦΕҎ֎ͷϙʔτ
߈ܸ͕͖͍ͯͨͷ͔
14
Oracle® Fusion Middleware Oracle Fusion Middlewareͷཧ 12c (12.1.2)
https://docs.oracle.com/cd/E50629_01/core/ASADM/portnums.htm#CHDIACEF
※WebLogic ͷཧ༻ϙʔτͷ෦ʹԼઢ
Slide 15
Slide 15 text
Ͳͷϙʔτ͕ૂΘΕͨͷ͔
w ߈ܸରͷϙʔτ൪߸Λूܭͨ͠ͱ͜Ζɺ߈ܸͷ
େଟ൪ϙʔτͩͬͨɻ
w 8FC-PHJDͷඪ४ཧ༻ϙʔτΛूதతʹ߈ܸͯ͠
͍ͨ͜ͱ͕Θ͔ͬͨɻ߈ܸπʔϧ͕)5514ʹରԠ
͓ͯ͠Βͣɺ͕݅গͳ͍Մೳੑ͕͋Δɻ
15
ϙʔτ൪߸ ߈ܸݕ݅
ͦͷଞ
※Host ϔομʹه͞Ε͍ͯͳ͍ͷूܭ͔Βআ֎
Slide 16
Slide 16 text
߈ܸऀͷڥΛਪଌ͢Δ
w ߈ܸϦΫΤετͷ6TFS"HFOUΛूܭͯ͠Έͨɻ
w ໌Β͔ʹෆ৹ͳͷͱɺ௨ৗൃੜ͠͏Δͷ͕ࠞࡏɻ
16
6TFS"HFOU ݅
.P[JMMB 8JOEPXT/5
"QQMF8FC,JU ,)5.-
MJLF(FDLP
$ISPNF4BGBSJ
.P[JMMB 8JOEPXT/5 8JO Y SW
(FDLP'JSFGPY
.FNFT
.P[JMMB
QZUIPOSFRVFTUT
.P[JMMB .BDJOUPTI *OUFM.BD049@@
"QQMF8FC,JU ,)5.-
MJLF(FDLP
$ISPNF4BGBSJ
QZUIPOSFRVFTUT
.P[JMMB 8JOEPXT/5 808
"QQMF8FC,JU ,)5.-
MJLF(FDLP
$ISPNF4BGBSJ$PSF
22#SPXTFS
.P[JMMB DPNQBUJCMF #BJEVTQJEFS IUUQXXXCBJEVDPNTFBSDITQJEFSIUNM
.P[JMMB 8JOEPXT/5 SW
(FDLP'JSFGPY
.P[JMMB 8JOEPXT/5
"QQMF8FC,JU ,)5.-
MJLF(FDLP
$ISPNF4BGBSJ
.P[JMMB DPNQBUJCMF .4*& 8JOEPXT/5 808 5SJEFOU
.P[JMMB 8JOEPXT/5 808 SW
(FDLP'JSFGPY
ͦͷଞ
→
→
→
→
Slide 17
Slide 17 text
߈ܸऀͷڥΛਪଌ͢Δ
w ߈ܸͷ1045σʔλ෦ΛΑ͘ݟΔͱɺ+BWBͷ
όʔδϣϯ͕ࢦఆ͞Ε͍ͯΔ͜ͱ͕͔Δɻ
w ߈ܸπʔϧʹґଘ͢Δ͕ɺ߈ܸऀ͕ͬͨ߈ܸ
πʔϧͷಛఆ+BWBͷόʔδϣϯ͕ѲͰ͖Δ͔ɻ
w ඞͣೖΔΘ͚Ͱͳ͍ʹҙɻ
17
Slide 18
Slide 18 text
߈ܸऀͷڥΛਪଌ͢Δ
w ͪΐͬͱݹ͍͕ɺ+%,ܥͷόʔδϣϯ͕ଟ͍ɻ
w ߈ܸπʔϧʹϋʔυίʔυ͞Ε͍ͯΔՄೳੑ͋Γɻ
18
+BWBόʔδϣϯ ݅
@
@
@
Java™ SE Development Kit 8, Update 151 (JDK 8u151)
October 17, 2017
http://www.oracle.com/technetwork/java/javase/8u151-relnotes-3850493.html
←201710݄ʹެ։
͞Εͨόʔδϣϯ
w 8FC-PHJDͷ੬ऑੑใ݄ʹެ։͞Ε
͍ͯͯɺπʔϧ͕࡞͞Εͨ࣌ظͱҰக͢Δɻ
Slide 19
Slide 19 text
ࢀՃऀͷΈʹެ։
19
আ
Slide 20
Slide 20 text
߈ܸࣄྫհ
w 1045ͷσʔλ෦ͷΈΛநग़ͨ͠ͱ͜Ζɺશ෦Ͱ
छྨͷ߈ܸύλʔϯ͕͋Γ·ͨ͠ɻ
w ͦͷத͔Βಛతͳ߈ܸΛϐοΫΞοϓͯ͠հ͠
·͢ɻ
w ߈ܸπʔϧ͕ެ։͞Ε͓ͯΓɺϋχʔϙοτͰݕ
ͨ͜͠ͱ͕͋ΔͨΊɺҰൠͷެ։αʔόʹରͯ͠
ಉ༷ͷ߈ܸΛड͚͍ͯΔՄೳੑ͕͋Γ·͢ɻ
20
Slide 21
Slide 21 text
߈ܸϦΫΤετ
w -JOVYڥΛૂͬͨ߈ܸɻ
w XHFUίϚϯυΛ࣮ߦ͠ɺKJCBϑΝΠϧͷμϯ
ϩʔυΛࢼΈ͍ͯΔɻ
21
Slide 22
Slide 22 text
߈ܸϦΫΤετ
w ߈ܸϦΫΤετͷଓ͖ɻ
w DINPEίϚϯυͰ࣮ߦݖݶΛ༩ͨ͠ͷͪɺ
ϑΝΠϧͷ࣮ߦΛࢼΈ͍ͯΔɻ
22
Slide 23
Slide 23 text
μϯϩʔυ͞ΕͨϑΝΠϧ
w 7JSVT5PUBMͷ݁Ռ͔ΒɺԾ௨՟ΛϚΠχϯά͢Δ
ϓϩάϥϜͱݟड͚ΒΕΔɻ
w 4)"BE⒎EEDFFDFCBGBCGEF⒎CGCFFECEGCB
23
Slide 24
Slide 24 text
߈ܸϦΫΤετ
w +BWBͷ1SJOU8SJUFSΫϥεΛར༻ͨ͠ɺ8FC4IFMM
࡞ͷࢼΈɻ
w KTQܗࣜͰɺΫΤϦύϥϝʔλʹ04ίϚϯυΛࢦ
ఆ࣮ͯ͠ߦ͢Δ͜ͱ͕Ͱ͖ΔػೳΛ࣋ͭɻ
24
Slide 25
Slide 25 text
߈ܸϦΫΤετ
w 8JOEPXTڥΛૂͬͨ߈ܸɻ
w DNEFYFͰɺ߈ܸऀ͕༻ҙͨ͠*1ΞυϨεʹ
ରͯ͠QJOHίϚϯυΛ࣮ߦ͍ͯ͠Δ DBMMCBDL
ɻ
w ߈ܸऀ͕DBMMCBDLͷ༗ແΛௐΕɺ੬ऑͳαʔ
όͷଘࡏΛΔ͜ͱ͕Ͱ͖Δɻ
25
Slide 26
Slide 26 text
߈ܸϦΫΤετ
w +BWBͷOFU63-ΫϥεͰɺ߈ܸऀ͕༻ҙͨ͠*1
ΞυϨεʹରͯ͠)551ϦΫΤετΛൃੜͤ͞Δ
DBMMCBDL
ɻ
w HPPEύϥϝʔλʹ߈ܸରͷάϩʔόϧ*1ΞυϨ
εΛࢦఆ͍ͯͨͨ͠Ίɺ߈ܸऀ͕ΞΫηεϩάΛݟ
Δͱ੬ऑͳαʔόͷଘࡏΛ֬ೝͰ͖Δɻ
26
Slide 27
Slide 27 text
߈ܸϦΫΤετ
w ߈ܸϦΫΤετͷଓ͖ɻ1ZUIPOͷVSMMJCΛར༻͠
ͯ߈ܸऀ͕༻ҙͨ͠*1ΞυϨεʹରͯ͠)551Ϧ
ΫΤετΛൃੜͤ͞Δ DBMMCBDL
ɻ
27
Slide 28
Slide 28 text
߈ܸϦΫΤετ
w ߈ܸϦΫΤετͷଓ͖ɻ1PXFSTIFMMͷXFCDMJFOU
Λར༻ͯ͠߈ܸऀ͕༻ҙͨ͠*1ΞυϨεʹରͯ͠
)551ϦΫΤετΛൃੜͤ͞Δ DBMMCBDL
ɻ
28
Slide 29
Slide 29 text
߈ܸϦΫΤετ
w 8JOEPXTڥΛૂͬͨ߈ܸɻ
w 1PXFSTIFMMͷXFCDMJFOUΛར༻ͯ͠ɺϑΝΠϧΛ
μϯϩʔυ͓Αͼ࣮ߦͤ͞Α͏ͱ͍ͯ͠Δɻ
29
SHA256: e080ee13da7371d1cbed9825540c19e94d8b2874adbe4c2d19c4d31a00c56ff8
Slide 30
Slide 30 text
߈ܸϦΫΤετ
w -JOVYڥΛૂͬͨ߈ܸɻ
w DVSMίϚϯυͰɺQBTUFCJO͔ΒεΫϦϓτϑΝΠ
ϧΛμϯϩʔυ͓Αͼ࣮ߦΛࢼΈΔɻ
30
Slide 31
Slide 31 text
QBTUFCJO͔Βμϯϩʔυ͢ΔϑΝΠϧ
w CBTIͷεΫϦϓτϑΝΠϧɻ
w 3FE)BUܥͷ04Λରʹ͓ͯ͠ΓɺZVNίϚϯ
υͰෳͷπʔϧΛΠϯετʔϧޙɺDQVNJOFSΛ
μϯϩʔυɺίϯύΠϧɺ࣮ߦ͍ͯ͠Δɻ
w Ծ௨՟ͷ.POFSPΛϚΠχϯά͍ͯ͠ΔΑ͏ͩɻ
31
Slide 32
Slide 32 text
߈ܸϦΫΤετ
w 8JOEPXTڥΛૂͬͨ߈ܸ
w 1PXFSTIFMMͰ%PXOMPBE4USJOHΛ͍CBUϑΝΠ
ϧΛμϯϩʔυɾ࣮ߦΛࢼΈΔɻ
w ϩάൃݟ࣌ʹɺ͢ͰʹCBUμϯϩʔυͰ͖ͣɻ
32
Slide 33
Slide 33 text
߈ܸϦΫΤετ
w 8JOEPXTڥΛૂͬͨ߈ܸ
w CBUϑΝΠϧΛ࡞࣮ͯ͠ߦ͠Α͏ͱ͍ͯ͠Δɻ
w GUQʹΞΫηε͢ΔͨΊͷΞΧϯτ໊ɾύεϫʔ
υؚ͕·Ε͓ͯΓɺϑΝΠϧͷऔಘɾௐࠪෆՄɻ
33
Slide 34
Slide 34 text
࡞͞ΕΔCBUϑΝΠϧ
w Λվߦʹஔͯ͠ՄಡੑΛ্͛ͨͷɻ
w '51αʔό͔ΒɺY[FYFΛμϯϩʔυ͢Δɻ
w Y[FYFΛ࣮ߦͨ͠ޙɺͯ͢ͷϑΝΠϧΛআ͢Δɻ
34
Slide 35
Slide 35 text
߈ܸϦΫΤετ
w -JOVYڥΛૂͬͨ߈ܸɻ
w QZUIPOΛͬͯ߈ܸऀͷ༻ҙͨ͠αʔόίωΫ
τόοΫ͢Δίʔυؚ͕·Ε͍ͯΔɻ
w QZUIPOͷύε͕௨͍ͬͯΕɺDNEFYFܦ༝Ͱ
8JOEPXTڥ߈ܸͰ͖Δͱߟ͑ΒΕΔɻ
35
Slide 36
Slide 36 text
߈ܸϦΫΤετ
w 8JOEPXTڥΛૂͬͨ߈ܸ
w CJUTBENJOίϚϯυΛͬͯϑΝΠϧΛμϯϩʔ
υ͢Δɻ
w μϯϩʔυͨ͠ϑΝΠϧͷ࣮ߦผͷϦΫΤετɻ
36
Slide 37
Slide 37 text
߈ܸϦΫΤετ
w ߈ܸϦΫΤετͷܸɻ
w TUBSUίϚϯυͰμϯϩʔυ͓͍ͯͨ͠ϑΝΠϧΛ
࣮ߦ͢Δ͚ͩɻܺΛੜ͡͵ೋஈߏ͑
w ϩάൃݟ࣌ʹɺEJTDV[FYFμϯϩʔυͰ͖ͣɻ
37
Slide 38
Slide 38 text
߈ܸϦΫΤετ
w 8JOEPXTڥΛૂͬͨ߈ܸ
w FYQMPSFSίϚϯυͰ8FCϖʔδΛ։͘ɻ
w DOIWDPɺϒϥβϚΠχϯάʹؔ͢ΔυϝΠϯ
ͰɺΞΫηε͍ͯ͠ΔϑΝΠϧʹ+BWB4DSJQU͕
ؚ·Ε͍ͯͨɻ
38
Slide 39
Slide 39 text
উखʹ։͔ΕΔ8FCϖʔδͷιʔε Ұ෦
39
Slide 40
Slide 40 text
߈ܸϦΫΤετ
w 8JOEPXTڥΛૂͬͨ߈ܸ
w DFSUVUJMίϚϯυͰϑΝΠϧΛμϯϩʔυ͢Δɻ
w อଘ͢ΔϑΝΠϧͷ֦ுࢠʮWCTʯ
w ϩάൃݟ࣌ʹɺVQUYUμϯϩʔυͰ͖ͣɻ
40
Slide 41
Slide 41 text
߈ܸϦΫΤετ
w ߈ܸϦΫΤετͷܸ
w DTDSJQUίϚϯυͰɺμϯϩʔυͨ͠εΫϦϓτ
ϑΝΠϧΛ࣮ߦ͢Δ͚ͩɻ
w ߈ܸϦΫΤετඇৗʹ͍͠Έ߹Θͤɻ
41
(certutil ࢀߟ)Ӵؔ࿈ͷϑΝΠϧΛ͏ϚΫϩϚϧΣΞͷ৽͍͠खޱ
(ϚΫχΧωοτϫʔΫε ηΩϡϦςΟݚڀηϯλʔϒϩά)
http://blog.macnica.net/blog/2017/12/post-8c22.html
Slide 42
Slide 42 text
߈ܸϦΫΤετ
w -JOVYڥΛૂͬͨ߈ܸɻ
w DVSMίϚϯυͰɺIUUQTͰγΣϧεΫϦϓτΛμ
ϯϩʔυ͠ɺ࣮ߦ͠Α͏ͱ͍ͯ͠Δɻ
w ߈ܸऀͷૂ͍͕ɺ͔ͳΓΤά͍ɻ
42
Slide 43
Slide 43 text
USBOTGFSTIͷத
43
linuxsyn→DoS πʔϧ
minerd→ϚΠχϯάπʔϧ
crontab ొͯ͠ɺ
ఆظతʹ࣮ߦ
߈ܸऀͷ ssh ͷ伴ొ
ෆਖ਼ૢ࡞ͷࠟͷফڈ
Slide 44
Slide 44 text
߈ܸ͕ޭ͢Δͱ
w %P4πʔϧͷར༻ʹΑΓɺωοτϫʔΫϦιʔεΛ
͍௵͞ΕΔՄೳੑ͕ߴ͍ɻ
w ϚΠχϯάπʔϧͷར༻ʹΑΓɺ$16ϦιʔεΛ
͍௵͞ΕΔՄೳੑ͕ߴ͍ɻ
w ఆظతʹ࣮ߦ͞Εɺͳ͓͔ͭ44)ʹΑΔϦϞʔτ
ϩάΠϯڐͯ͠͠·͏ɻ͔ࠟ͠ফ͞ΕΔɻ
w ৵ೖ͞Ε͕ͨ࠷ޙɺࠎͷ·Ͱ͠ΌͿΓͭ͘͞ΕΔ
44
Slide 45
Slide 45 text
·ͱΊ
w 0SBDMF8FC-PHJDͷ੬ऑੑ $7&
ʹ
͍ͭͯհ͠·ͨ͠ɻ
w ݄͔Β݄·ͰͷϩάΛੳ͠
ͨ݁Ռɺແࠩผʹ߈ܸ͍ͯ͠Δͱߟ͑ΒΕΔ௨৴͕
େଟͰͨ͠ɻ
w ੬ऑੑใͱ߈ܸπʔϧͷ࡞࣌ظΛਪଌ͢Δͱɺ
݄ΑΓલʹ߈ܸ͞Ε͍ͯͨՄೳੑ༗ɻ
w ੬ऑͳڥͩͬͨ߹ɺ$16Ϧιʔεωοτϫʔ
ΫϦιʔεͷෆਖ਼༻͚ͩͰͳ͘ɺෆਖ਼ϩάΠϯͳ
Ͳ༷ʑͳӨڹΛड͚ΔՄೳੑ͕ߴ͍ɻ
w ࠓճհͨ͠߈ܸϩάશମͷׂʹຬͨͳ͍ɻ
45
Slide 46
Slide 46 text
*P$
01ebeaf06f5a2fcbf14025a8e683293d cat.php
036b34853622f38c285babf1a8670b62 svchosx.exe
0a6f3934f53966e2bdd4721ba512bd1c weblogic.hta
0b156ec492ea45d282cf823415ecaf12 IPsecSrv.dll
0d91bd78bfb6eab168ebb697bd5d31a4 transfer-etn.sh
26198be2276b9d7a4cbf4dad4155995d kworker.sh
2874b491c166d3b3949b2f94182e1759 svvchost.exe
38535ff9e16902305e3d938a5f429879 mssql.exe
3acdb039179e120da05aa2c53542f944 paSmuRYy
3af4c8196fbb3ae1744291bfdeaa6f98 pool.zip
3fb41234895102be5c439132f85c0ef9 payload.py
5aeb79a353888fd552dc7cc129e696a6 dada.x86_64
5c53d65c44e5e7c05c743811487eecdb x32.exe
5ff51056a25c8b9a20842ea9d05c0495 minerd
8327245a8feb3290de39df5ceefd58bf start_xmr.ps1
8c8a30372e4fdba50cb2e6ffdb5af883 mssql.exe
929c9eeff262e198fd29f8c75edfc5fd xrun.exe
9ad4bd564978c1b5a8540b6b6f021bdb x64.exe
9cde0af2caa9fab7cb042487dfd9ab08 eblue.exe
9f0d6dce1e043858f3d239b101d0b19d 7001.exe
a2ac17c2bb6148b7e22c610964e398d2 rZhqDVLP
a2ce07681d158a13557928457c950ebe ex32.exe
a4f2b45c832257b5fd662b9eee2f82f1 linuxsyn
b29e0910573f96d8447801814dd2b73e xrun-etn.exe
b6657f348f5915ae6052e5f9c56343e8 loveby.exe
b8a107d8b0f1e582c86a6def628ab1f3 jiba
bf4ba4b0450a5a436a9ec9dc4b504d72 kefarbo.exe
c357a4ad84dd7c3d4de5f7ab3942a121 minerxmr.exe
c97b69f1bbf36ca94aaa664ea78e16dc pri.sh
d5aa5b2a023893460b9ef2584d0fa7a8 niao.exe
dbdac5198ffde5c15710176cbd79095c transfer.sh
df980ebae2a9a83409a3ccd03a5e3603 cross.exe
f50298bbe7226587bd641410849174df cloud
fdac6a6d0c98e45c3b93d478cd4d0042 18r4m
46
ෆ৹ͳϑΝΠϧͷϋογϡɾϑΝΠϧ໊
107.181.174.248
111.67.198.104
111.67.198.246
112.30.132.138:2323
120.132.17.180:66
123.249.24.175:8088
132.148.150.15:8080
133.242.163.81:4444
137.59.18.173
18.217.195.175:132
182.18.8.69:8088
185.216.117.85:11152
185.227.152.132:2124
190.60.206.11
190.60.206.11:8443
199.188.104.73:32135
199.188.104.75:32135
204.152.209.251:2114
204.152.209.251:21145
204.152.209.251:221
205.209.177.18
221.9.251.236
222.184.79.11:5317
222.184.79.11:5318
222.184.79.11:5319
222.184.79.11:5320
222.184.79.11:5329
222.186.150.175:8080
222.186.150.175:81
223.68.209.7:65510
27.148.157.89:8899
35.189.171.208:55555
43.226.35.42:2323
46.4.26.204
58.218.201.20:8088
67.218.135.178
80.82.70.234:6969
97.64.19.115
bbc.servehalflife.com
cnhv.co
get.fu2k.net:66
ipfs.fu2k.net
qwer.world
usa.neozju.com
www.kangnajiang.top:132
ϑΝΠϧμϯϩʔυݩɾcallback ͷ௨৴ઌ
※ίϩϯ(:)Ҏ߱ϙʔτ൪߸
Slide 47
Slide 47 text
*P$
w ߈ܸऀͷ44)ͷެ։ݤ
˞SPPUϢʔβͷTTIBVUIPSJ[FE@LFZTϑΝΠϧه
ΛࢼΈ͍ͯ·ͨ͠ɻ
w 1BTUFCJOͷϑΝΠϧ IUUQˠI99Q
IUUQTˠI99QT
w I99QQBTUFCJODPNSBXS;IR%7-1
w I99QTQBTUFCJODPNSBXQB4NV3:Z
47
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDV1VxPVZFUOOWZwMFVBwP/904lhAZNj2U5DPsZyIWw33jHeFRElM++XnUYmkMDiu
8KuJXnFDJMkyXxsq77fOpDhVGOoexll3+P6SmZWViWwnhOgvxhccgT72J+LPZEIwPqPZQVHR4ksdVSnMVreyZs+rQ7O+L2xychpqze
Irk4Q/08f5XreOnq4Rgxp9oKwSlf7vKmQ7tUWUxfMHHL1wQYZPmdKpgSi/JmokLpp5cKAT7r0gGOj1jV8ZAJc+z45Ts2JBH9JYscHB
ssh7MBWWymcjXANd9a6XaQnbnl6nOFFNyYm8dBuLkGpEUNCdMq/jc5YLfnAnbGVbBMhuWzaWUp root@host-10-10-10-26
Slide 48
Slide 48 text
)BQQZ)POFZQPU
48
←ϔϦΞϯϑΥϥͷؒ(৯২)
201710݄27 ເͷౡ ଳ২ؗͰࡱӨ
ೆΞϝϦΧͷΪΞφߴʹ͚ͩੜଉ͢Δɻ
͓͠·͍