私の大好きなFormat String Attack

by Yuki Saito

Slide 1

Slide 1 text

ࢲͷେ޷͖ͳ  'PSNBU4USJOH"UUBDL 2018/04/30 ͢ΈͩηΩϡϦςΟษڧձ @saiyuki1919 (ᴡ౻ ༔ر)

Slide 2

Slide 2 text

* 'PSNBU4USJOH"UUBDLͷ࢓૊Έ ** 'PSNBU4USJOH"UUBDLͰ&YQMPJU࡞੒ *** 'PSNBU4USJOH"UUBDLͰ&YQMPJUͷԠ༻

Slide 3

Slide 3 text

*'PSNBU4USJOH"UUBDLͷ࢓૊Έ

Slide 4

Slide 4 text

'PSNBU4USJOH"UUBDLͱ͸ Format String Attack(จࣈྻॻࣜܕ߈ܸ)͸ɺprintf() ΍ syslog() ౳ͷ ॻࣜࢦఆͷͰ͖Δؔ਺Λѱ༻͠ɺ %s ΍ %x ͱ͍ͬͨॻࣜτʔΫϯΛ ࢖͍ɺελοΫ΍ͦͷଞͷϝϞϦҐஔͷ಺༰Λσʔλͱͯ͠ग़ྗ͞ ͤͨΓɺ%n τʔΫϯΛ࢖ͬͯ೚ҙͷΞυϨεҐஔʹ೚ҙͷσʔλΛ ॻ͖ࠐ·ͤΔ͜ͱ͕Ͱ͖Δɻ ߈ܸ͕੒ޭ͢Ε͹࠷ѱͷ৔߹ɺίϯϐϡʔλͷ੍ޚΛୣΘΕΔɻ  ͦ͏Ͱͳͯ͘΋ϓϩηε͕ҟৗऴྃ͢Δ౳ͷো֐͕ى͜ΓಘΔɻ

Slide 5

Slide 5 text

੬ऑੑͷ͋ΔϓϩάϥϜ JODMVEFTUEJPI JODMVEFTUSJOHI JOUNBJO JOUBSHD DIBSBSHW<> \ DIBSCVG<> QSJOUG <>CVGQaO CVG TUSODQZ CVG BSHW<> QSJOUG CVG QVUDIBS aO SFUVSO ^ ࢀরɿ  ΋΋͍ΖςΫϊϩδʔ  GPSNBUTUSJOHBUUBDLʹΑΔ(05PWFSXSJUFΛ΍ͬͯΈΔ QSJOUG T CVG

Slide 6

Slide 6 text

ίϯύΠϧ࣌ͷ஫ҙ w 441 4UBDL4NBTI1SPUFDUJPO ༗ޮ  ؔ਺ͷݺͼग़࣌͠ʹελοΫʹDBOBSZ ΧφϦΞ ͱݺ͹ΕΔ஋ ͕ஔ͔Εɺ͜Ε͕ॻ͖׵͑ΒΕͨͱ͖ڧ੍ऴྃ͢ΔΑ͏ʹͳΔɻ w "4-3 "EESFTT4QBDF-BZPVU3BOEPNJ[BUJPO ແޮ  ॏཁͳσʔλྖҬͷҐஔʢ௨ৗɺϓϩηεͷΞυϨεۭؒʹ͓͚Δ࣮ߦϑΝ ΠϧͷجఈͱϥΠϒϥϦɺώʔϓɺ͓ΑͼελοΫͷҐஔؚ͕·ΕΔʣΛແ࡞ ҝʹ഑ஔ͢ΔίϯϐϡʔληΩϡϦςΟͷٕज़ w %&1 %BUB&YFDVUJPO1SFWFOUJPO ແޮ  %&1Λ༗ޮʹ͢Δͱ࣮ߦෆՄೳͳϝϞϦྖҬ͔ΒίʔυΛ࣮ߦ͢Δ͜ͱͷ๷ ࢭ͞ΕΔɻ

Slide 7

Slide 7 text

ॻࣜࢦఆ w ൪໨ͷελοΫͷ಺༰Λ֬ೝ͍ͨ͠৔߹͸YͰ֬ೝͰ͖Δɻ Φϑηοτ BPVU""""YYYYYYYYYYY <>CVGYC⒎GF⒎  """"C⒎⒎FEGC⒎C⒎⒎FDC⒎⒎C⒎⒎FC⒎⒎     w OΛࢦఆ͢Δ͜ͱͰݱ࣌఺·ͰʹετϦʔϜ·ͨ͸όοϑΝʔʹਖ਼ৗʹॻ͖ࠐ·Εͨจ ࣈ਺ΛϝϞϦόΠτͷΞυϨεʹॻ͖׵͑Δ͜ͱ͕Ͱ͖Δɻ w DͰࢦఆͨ͠਺͕ग़ྗ͞ΕΔɻ YBBCCDDEE͔ΒͷόΠτͷΞυϨεΛ ʹॻ͖׵͑Δ BPVUbaYEEaYDDaYCCaYBBDO` """"Y

Slide 8

Slide 8 text

೚ҙͷΞυϨεΛॻ͖׵͑Δ YBBCCDDEEΛ̍όΠτͣͭYʹॻ͖׵͑Δ Φϑηοτ͕ͷ৔߹ laYEEaYDDaYCCaYBBaYEFaYDDaYCCaYBBaYEGaYDDaYCCaYBBaYFaYDDaYCCaYBBa YBBCCDDEEY Y IIO  YBBCCDDEFYYY Y&' IIO  YBBCCDDEGYYY Y&' IIO  YBBCCDDFYYY Y&' IIO  ˞όΠτͣͭॻ͖׵͑Δ৔߹͸IOɺόΠτͣͭॻ͖׵͍͑ͨ৔߹͸IIO

Slide 9

Slide 9 text

(MPCBM0⒎TFU5BCMF ίϯύΠϧ࣌ʹڞ༗ϥΠϒϥϦΛμΠφϛοΫϦϯΫͨ͠৔߹ɺڞ༗ϥΠϒϥϦͷؔ਺͸(05 (MPCBM 0⒎TFU5BCMF ͱݺ͹ΕΔδϟϯϓςʔϒϧΛհͯ͠ݺͼग़͞ΕΔɻ YG QVTIYF YGF DBMMYQSJOUG!QMU Y BEEFTQ Y Y NPWFBY %803%153 Y BEEFBY Y YD NPWFBY %803%153 YF TVCFTQ Y Y QVTIY Y QVTIFBY Y MFBFBY Y QVTIFBY Y DBMMYCTUSODQZ!QMU YE BEEFTQ Y Y TVCFTQ YD Y MFBFBY Y QVTIFBY Y DBMMYQSJOUG!QMU YD BEEFTQ Y YG TVCFTQ YD YQVTIYB YDBMMYBQVUDIBS!QMU YBEEFTQ Y EJTBTY %VNQPGBTTFNCMFSDPEFGPSGVODUJPOQSJOUG!QMU YKNQ%803%153ETYBD YQVTIY YCKNQY &OEPGBTTFNCMFSEVNQ SFBEFMG4BPVU  4FDUJPO)FBEFST  /BNF5ZQF"EES0⒎4J[F&4'MH  <>HPUQMU130(#*54B8"    ,FZUP'MBHT  8 XSJUF " BMMPD 9 FYFDVUF . NFSHF 4 TUSJOHT   * JOGP - MJOLPSEFS ( HSPVQ 5 5-4 & FYDMVEF Y VOLOPXO   0 FYUSB04QSPDFTTJOHSFRVJSFE P 04TQFDJpD Q QSPDFTTPS TQFDJpD

Slide 10

Slide 10 text

** 'PSNBU4USJOH"UUBDLͰ&YQMPJU࡞੒

Slide 11

Slide 11 text

JNQPSUʜ  BEES@HPUJOU TZTBSHW<> BEES@CVGJOU TZTBSHW<> JOEFYJOU TZTBSHW<> CVǦ  CJOTIͰγΣϧىಈ͢Δ TIFMMDPEFaYaYEaYaYaYGaYGaYaYaYaYG  aYaYaYFaYaYFaYaYaYaYFaYEaYaYCaYDEaY GPSJJOSBOHF CVGTUSVDUQBDL * BEES@HPUJ CVGTIFMMDPEF BNBQ PSE TUSVDUQBDL * BEES@CVG B<> B<>B<> Y B<> B<>B<> Y B<> B<>B<> Y B<> B<>MFO CVG Y GPSJJOSBOHF CVGEDEIIO B JOEFYJ Q1PQFO <BPVU CVG> QXBJU ೚ҙͷΞυϨεʹॻ͖׵͑Δ (05ͷΞυϨε CVGͷΞυϨε ࢀরɿ  ΋΋͍ΖςΫϊϩδʔ  GPSNBUTUSJOHBUUBDLʹΑΔ(05PWFSXSJUFΛ΍ͬͯΈΔ

Slide 12

Slide 12 text

ΤΫεϓϩΠτͷશମͷྲྀΕ ॻ͖׵͍͑ͨ(05ͷΞυϨεΛܾΊΔ (05ͷ஋ΛTIFMMDPEF͕֨ೲ͞Ε͍ͯΔΞυϨεʹॻ͖׵͑Δ (05ͷΞυϨε͕ݺ͹ΕΔͱTIFMMDPEFͷॻ͔Ε͍ͯΔΞυϨεʹ ඈ͹͞ΕͯɺTIFMMDPEF͕࣮ߦ͢Δ

Slide 13

Slide 13 text

࣮ࢪ QVUDIBSؔ਺͕ݺ͹Εͨ࣌ʹTIFMMDPEFΛ࣮ߦ͍ͨ͠ͱࢥ͍·͢ɻ BPVU""""YYYYYYYYYYY <>CVGYC⒎GF⒎ """"C⒎⒎FEGC⒎C⒎⒎FDC⒎⒎C⒎⒎FC⒎⒎ PCKEVNQEKQMUBPVU %JTBTTFNCMZPGTFDUJPOQMU BQVUDIBS!QMU B ⒎B KNQYB B QVTIY BC FC⒎⒎⒎ KNQ@JOJUYD γΣϧ͕ىಈ͢Δ (05ΞυϨε CVGΞυϨε JOEFY   QZUIPOFYQQZYB9C⒎GFGC  <>CVGYC⒎GFGC 

Slide 14

Slide 14 text

࣍ͷεςοϓ w %&1Λ༗ޮʹͨ͠৔߹Ͳ͏͢Δʁ  ෮श %&1Λ༗ޮʹ͢Δͱ࣮ߦෆՄೳͳϝϞϦྖҬ͔ΒίʔυΛ࣮ߦ͢Δ ͜ͱͷ๷ࢭ͞Ε·͢ɻ  ͱ͍͏͜ͱ͸ʂγΣϧίʔυ͕࣮ߦͰ͖ͳ͍ɻ w 3FUVSOUPMJCD  ϓϩηε͕࣮ߦ͞ΕΔͱڞ༗ϥΠϒϥϦ͕ΞυϨεʹϩʔυ͞ΕΔɻ ͦͷϩʔυ͞ΕͨΞυϨεͷϕʔεΞυϨε͔ΒΦϑηοτΛݩʹؔ਺ Λݺͼग़ͤ·͢ɻ จࣈྻͳͲ΋Մೳ

Slide 15

Slide 15 text

࣍ͷεςοϓ w "4-3Λ༗ޮʹͨ͠৔߹Ͳ͏͢Δʁ  ෮श ॏཁͳσʔλྖҬͷҐஔʢ௨ৗɺϓϩηεͷΞυϨεۭؒʹ͓͚Δ ࣮ߦϑΝΠϧͷجఈͱϥΠϒϥϦɺώʔϓɺ͓ΑͼελοΫͷҐஔؚ͕· ΕΔʣΛແ࡞ҝʹ഑ஔ͢ΔίϯϐϡʔληΩϡϦςΟͷٕज़ XJLJ͔Β w ϒϧʔτϑΥʔε  ໨తͷΞυϨεʹͳΔ·ͰϒϧʔϑΥʔε͢Δ w /PQTMFE  "4-3ͷϥϯμϜ഑ஔʹ͸͋Δఔ౓ൣғ͕ܾ·͍ͬͯΔͷͰɺγΣϧ ίʔυલʹ/01Λͨ͘͞ΜڬΉ͜ͱͰϒϧʔτϑΥʔεΛ੒ޭͤ͞Δ

Slide 16

Slide 16 text

*** 'PSNBU4USJOH"UUBDLͰ&YQMPJUͷԠ༻

Slide 17

Slide 17 text

3FUVSOUPMJCD BEES@SFUBEESBEES@CVGP⒎TFU@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES CNBQ PSE TUSVDUQBDL * MJCD@CBTFP⒎TFU@CJOTI BNBQ PSE TUSVDUQBDL * MJCD@CBTFP⒎TFU@TZTUFN C<> C<>C<> Y C<> C<>C<> Y C<> C<>C<> Y C<> C<>B<> Y B<> B<>B<> Y B<> B<>B<> Y B<> B<>B<> Y B<> B<>MFO CVG Y ࢀরɿ  ΋΋͍ΖςΫϊϩδʔ  3&-30ͱGPSNBUTUSJOHBUUBDLʹΑΔϦλʔϯΞυϨεॻ͖׵͑ YC⒎⒎ Y TBWFEFCQ FCQ ɹYCFE NBJO͔ΒͷϦλʔϯΞυϨε Y BSHD YC⒎⒎G BSHW<> YC⒎⒎ Y TBWFEFCQ FCQ ɹYCFC 4ZTUFNؔ਺ Y SFUVSOΞυϨε YC⒎⒎G ୈҰҾ਺

Slide 18

Slide 18 text

·ͱΊ * 'PSNBU4USJOH"UUBDLͷ࢓૊Έ  ɾQSJOUG TZTMPHͳͲͷؔ਺ͷॻࣜτʔΫϯΛ࢖ͬͯ೚ҙͷΞυϨεҐஔ ʹ೚ҙͷσʔλΛॻ͖ࠐ·ͤΔ͜ͱ͕Ͱ͖Δɻ    ** 'PSNBU4USJOH"UUBDLͰ&YQMPJU࡞੒  ɾCVGʹTIFMMDPEFΛૠೖ͢Δ  ɾ(05ʹ͋Δؔ਺ͷΞυϨεΛݺͼग़͍ͨ͠ઌͷCVGͷΞυϨεʹ 'PSNBU4USJOH"UUBDLͷ੬ऑੑΛ࢖ͬͯॻ͖׵͑Δɻ  *** 'PSNBU4USJOH"UUBDLͰ&YQMPJUͷԠ༻  ɾ3FUVSOUPMJCDΛ࢖ͬͨ&YQMPJUͷઆ໌