Tweet
Tweet

Slide 1

Slide 1 text

ࢲͷେ޷͖ͳ
 'PSNBU4USJOH"UUBDL 2018/04/30 ͢ΈͩηΩϡϦςΟษڧձ @saiyuki1919 (ᴡ౻ ༔ر)

Slide 2

Slide 2 text

* 'PSNBU4USJOH"UUBDLͷ࢓૊Έ ** 'PSNBU4USJOH"UUBDLͰ&YQMPJU࡞੒ *** 'PSNBU4USJOH"UUBDLͰ&YQMPJUͷԠ༻

Slide 3

Slide 3 text

*'PSNBU4USJOH"UUBDLͷ࢓૊Έ

Slide 4

Slide 4 text

'PSNBU4USJOH"UUBDLͱ͸ Format String Attack(จࣈྻॻࣜܕ߈ܸ)͸ɺprintf() ΍ syslog() ౳ͷ ॻࣜࢦఆͷͰ͖Δؔ਺Λѱ༻͠ɺ %s ΍ %x ͱ͍ͬͨॻࣜτʔΫϯΛ ࢖͍ɺελοΫ΍ͦͷଞͷϝϞϦҐஔͷ಺༰Λσʔλͱͯ͠ग़ྗ͞ ͤͨΓɺ%n τʔΫϯΛ࢖ͬͯ೚ҙͷΞυϨεҐஔʹ೚ҙͷσʔλΛ ॻ͖ࠐ·ͤΔ͜ͱ͕Ͱ͖Δɻ ߈ܸ͕੒ޭ͢Ε͹࠷ѱͷ৔߹ɺίϯϐϡʔλͷ੍ޚΛୣΘΕΔɻ
 ͦ͏Ͱͳͯ͘΋ϓϩηε͕ҟৗऴྃ͢Δ౳ͷো֐͕ى͜ΓಘΔɻ

Slide 5

Slide 5 text

੬ऑੑͷ͋ΔϓϩάϥϜ JODMVEFTUEJPI JODMVEFTUSJOHI JOUNBJO JOUBSHD DIBS BSHW<>  \ DIBSCVG<> QSJOUG < >CVGQaO CVG  TUSODQZ CVG BSHW<>   QSJOUG CVG  QVUDIBS aO  SFUVSO ^ ࢀরɿ
 ΋΋͍ΖςΫϊϩδʔ
 GPSNBUTUSJOHBUUBDLʹΑΔ(05PWFSXSJUFΛ΍ͬͯΈΔ QSJOUG T CVG 

Slide 6

Slide 6 text

ίϯύΠϧ࣌ͷ஫ҙ w 441 4UBDL4NBTI1SPUFDUJPO ༗ޮ
 ؔ਺ͷݺͼग़࣌͠ʹελοΫʹDBOBSZ ΧφϦΞ ͱݺ͹ΕΔ஋ ͕ஔ͔Εɺ͜Ε͕ॻ͖׵͑ΒΕͨͱ͖ڧ੍ऴྃ͢ΔΑ͏ʹͳΔɻ w "4-3 "EESFTT4QBDF-BZPVU3BOEPNJ[BUJPO ແޮ
 ॏཁͳσʔλྖҬͷҐஔʢ௨ৗɺϓϩηεͷΞυϨεۭؒʹ͓͚Δ࣮ߦϑΝ ΠϧͷجఈͱϥΠϒϥϦɺώʔϓɺ͓ΑͼελοΫͷҐஔؚ͕·ΕΔʣΛແ࡞ ҝʹ഑ஔ͢ΔίϯϐϡʔληΩϡϦςΟͷٕज़ w %&1 %BUB&YFDVUJPO1SFWFOUJPO ແޮ
 %&1Λ༗ޮʹ͢Δͱ࣮ߦෆՄೳͳϝϞϦྖҬ͔ΒίʔυΛ࣮ߦ͢Δ͜ͱͷ๷ ࢭ͞ΕΔɻ

Slide 7

Slide 7 text

ॻࣜࢦఆ w ൪໨ͷελοΫͷ಺༰Λ֬ೝ͍ͨ͠৔߹͸YͰ֬ೝͰ͖Δɻ Φϑηοτ  BPVU""""YYYYYYYYYYY < >CVGYC⒎GF⒎
 """"C⒎⒎FEGC⒎C⒎⒎FDC⒎⒎C⒎⒎FC⒎⒎ 
 
 w OΛࢦఆ͢Δ͜ͱͰݱ࣌఺·ͰʹετϦʔϜ·ͨ͸όοϑΝʔʹਖ਼ৗʹॻ͖ࠐ·Εͨจ ࣈ਺ΛϝϞϦόΠτͷΞυϨεʹॻ͖׵͑Δ͜ͱ͕Ͱ͖Δɻ w DͰࢦఆͨ͠਺͕ग़ྗ͞ΕΔɻ YBBCCDDEE͔ΒͷόΠτͷΞυϨεΛ  ʹॻ͖׵͑Δ    BPVUbaYEEaYDDaYCCaYBBDO` """"Y

Slide 8

Slide 8 text

೚ҙͷΞυϨεΛॻ͖׵͑Δ YBBCCDDEEΛ̍όΠτͣͭYʹॻ͖׵͑Δ Φϑηοτ͕ͷ৔߹  laYEEaYDDaYCCaYBB aYEFaYDDaYCCaYBB aYEGaYDDaYCCaYBB aYFaYDDaYCCaYBBa YBBCCDDEEY Y  IIO
 YBBCCDDEFYY Y  Y&'  IIO
 YBBCCDDEGYY Y  Y&'  IIO
 YBBCCDDFYY Y  Y&'  IIO
 ˞όΠτͣͭॻ͖׵͑Δ৔߹͸IOɺόΠτͣͭॻ͖׵͍͑ͨ৔߹͸IIO

Slide 9

Slide 9 text

(MPCBM0⒎TFU5BCMF ίϯύΠϧ࣌ʹڞ༗ϥΠϒϥϦΛμΠφϛοΫϦϯΫͨ͠৔߹ɺڞ༗ϥΠϒϥϦͷؔ਺͸(05 (MPCBM 0⒎TFU5BCMF ͱݺ͹ΕΔδϟϯϓςʔϒϧΛհͯ͠ݺͼग़͞ΕΔɻ YG  QVTIYF YGF  DBMMYQSJOUG!QMU Y  BEEFTQ Y Y  NPWFBY %803%153 Y  BEEFBY Y YD  NPWFBY %803%153 YF  TVCFTQ Y Y  QVTIY Y  QVTIFBY Y  MFBFBY  Y  QVTIFBY Y  DBMMYCTUSODQZ!QMU YE  BEEFTQ Y Y  TVCFTQ YD Y  MFBFBY  Y  QVTIFBY Y  DBMMYQSJOUG!QMU YD  BEEFTQ Y YG  TVCFTQ YD Y QVTIYB Y DBMMYBQVUDIBS!QMU Y BEEFTQ Y EJTBTY %VNQPGBTTFNCMFSDPEFGPSGVODUJPOQSJOUG!QMU Y KNQ%803%153ETYBD Y QVTIY YC KNQY &OEPGBTTFNCMFSEVNQ SFBEFMG4BPVU
 4FDUJPO)FBEFST
 /BNF5ZQF"EES0⒎4J[F&4'MH
 <>HPUQMU130(#*54B8"
 
 ,FZUP'MBHT
 8 XSJUF " BMMPD 9 FYFDVUF . NFSHF 4 TUSJOHT 
 * JOGP - MJOLPSEFS ( HSPVQ 5 5-4 & FYDMVEF Y VOLOPXO 
 0 FYUSB04QSPDFTTJOHSFRVJSFE P 04TQFDJpD Q QSPDFTTPS TQFDJpD

Slide 10

Slide 10 text

** 'PSNBU4USJOH"UUBDLͰ&YQMPJU࡞੒

Slide 11

Slide 11 text

JNQPSUʜ
 BEES@HPUJOU TZTBSHW<>   BEES@CVGJOU TZTBSHW<>   JOEFYJOU TZTBSHW<>  CVǦ
 CJOTIͰγΣϧىಈ͢Δ TIFMMDPEFaYaYEaYaYaYGaYGaYaYaYaYG
 aYaYaYFaYaYFaYaYaYaYFaYEaYaYCaYDEaY GPSJJOSBOHF    CVG TUSVDUQBDL * BEES@HPU J  CVG TIFMMDPEF BNBQ PSE TUSVDUQBDL * BEES@CVG   B<> B<>B<> Y  B<> B<>B<> Y  B<> B<>B<> Y  B<> B<>MFO CVG Y  GPSJJOSBOHF    CVG EDEIIO B JOEFY J  Q1PQFO <BPVU CVG>  QXBJU ೚ҙͷΞυϨεʹॻ͖׵͑Δ (05ͷΞυϨε CVGͷΞυϨε ࢀরɿ
 ΋΋͍ΖςΫϊϩδʔ
 GPSNBUTUSJOHBUUBDLʹΑΔ(05PWFSXSJUFΛ΍ͬͯΈΔ

Slide 12

Slide 12 text

ΤΫεϓϩΠτͷશମͷྲྀΕ  ॻ͖׵͍͑ͨ(05ͷΞυϨεΛܾΊΔ  (05ͷ஋ΛTIFMMDPEF͕֨ೲ͞Ε͍ͯΔΞυϨεʹॻ͖׵͑Δ  (05ͷΞυϨε͕ݺ͹ΕΔͱTIFMMDPEFͷॻ͔Ε͍ͯΔΞυϨεʹ ඈ͹͞ΕͯɺTIFMMDPEF͕࣮ߦ͢Δ

Slide 13

Slide 13 text

࣮ࢪ QVUDIBSؔ਺͕ݺ͹Εͨ࣌ʹTIFMMDPEFΛ࣮ߦ͍ͨ͠ͱࢥ͍·͢ɻ BPVU""""YYYYYYYYYYY < >CVGYC⒎GF⒎ """"C⒎⒎FEGC⒎C⒎⒎FDC⒎⒎C⒎⒎FC⒎⒎ PCKEVNQEKQMUBPVU %JTBTTFNCMZPGTFDUJPOQMU BQVUDIBS!QMU B ⒎B KNQ YB B  QVTIY BC FC⒎⒎⒎ KNQ@JOJU YD γΣϧ͕ىಈ͢Δ (05ΞυϨε CVGΞυϨε JOEFY 
 QZUIPOFYQQZYB9C⒎GFGC
 < >CVGYC⒎GFGC
 

Slide 14

Slide 14 text

࣍ͷεςοϓ w %&1Λ༗ޮʹͨ͠৔߹Ͳ͏͢Δʁ
 ෮श %&1Λ༗ޮʹ͢Δͱ࣮ߦෆՄೳͳϝϞϦྖҬ͔ΒίʔυΛ࣮ߦ͢Δ ͜ͱͷ๷ࢭ͞Ε·͢ɻ
 ͱ͍͏͜ͱ͸ʂγΣϧίʔυ͕࣮ߦͰ͖ͳ͍ɻ w 3FUVSOUPMJCD
 ϓϩηε͕࣮ߦ͞ΕΔͱڞ༗ϥΠϒϥϦ͕ΞυϨεʹϩʔυ͞ΕΔɻ ͦͷϩʔυ͞ΕͨΞυϨεͷϕʔεΞυϨε͔ΒΦϑηοτΛݩʹؔ਺ Λݺͼग़ͤ·͢ɻ จࣈྻͳͲ΋Մೳ

Slide 15

Slide 15 text

࣍ͷεςοϓ w "4-3Λ༗ޮʹͨ͠৔߹Ͳ͏͢Δʁ
 ෮श ॏཁͳσʔλྖҬͷҐஔʢ௨ৗɺϓϩηεͷΞυϨεۭؒʹ͓͚Δ ࣮ߦϑΝΠϧͷجఈͱϥΠϒϥϦɺώʔϓɺ͓ΑͼελοΫͷҐஔؚ͕· ΕΔʣΛແ࡞ҝʹ഑ஔ͢ΔίϯϐϡʔληΩϡϦςΟͷٕज़ XJLJ͔Β  w ϒϧʔτϑΥʔε
 ໨తͷΞυϨεʹͳΔ·ͰϒϧʔϑΥʔε͢Δ w /PQTMFE
 "4-3ͷϥϯμϜ഑ஔʹ͸͋Δఔ౓ൣғ͕ܾ·͍ͬͯΔͷͰɺγΣϧ ίʔυલʹ/01Λͨ͘͞ΜڬΉ͜ͱͰϒϧʔτϑΥʔεΛ੒ޭͤ͞Δ

Slide 16

Slide 16 text

*** 'PSNBU4USJOH"UUBDLͰ&YQMPJUͷԠ༻

Slide 17

Slide 17 text

3FUVSOUPMJCD BEES@SFUBEESBEES@CVG P⒎TFU@SFUBEES CVGTUSVDUQBDL * BEES@SFUBEES  CVG TUSVDUQBDL * BEES@SFUBEES   CVG TUSVDUQBDL * BEES@SFUBEES   CVG TUSVDUQBDL * BEES@SFUBEES   CVG TUSVDUQBDL * BEES@SFUBEES   CVG TUSVDUQBDL * BEES@SFUBEES   CVG TUSVDUQBDL * BEES@SFUBEES   CVG TUSVDUQBDL * BEES@SFUBEES   CNBQ PSE TUSVDUQBDL * MJCD@CBTF P⒎TFU@CJOTI  BNBQ PSE TUSVDUQBDL * MJCD@CBTF P⒎TFU@TZTUFN  C<> C<>C<> Y  C<> C<>C<> Y  C<> C<>C<> Y  C<> C<>B<> Y  B<> B<>B<> Y  B<> B<>B<> Y  B<> B<>B<> Y  B<> B<>MFO CVG  Y ࢀরɿ
 ΋΋͍ΖςΫϊϩδʔ
 3&-30ͱGPSNBUTUSJOHBUUBDLʹΑΔϦλʔϯΞυϨεॻ͖׵͑ YC⒎⒎ Y TBWFEFCQ FCQ ɹYCFE NBJO͔ΒͷϦλʔϯΞυϨε  Y BSHD  YC⒎⒎G BSHW<> YC⒎⒎ Y TBWFEFCQ FCQ ɹYCFC 4ZTUFNؔ਺  Y SFUVSOΞυϨε  YC⒎⒎G ୈҰҾ਺

Slide 18

Slide 18 text

·ͱΊ * 'PSNBU4USJOH"UUBDLͷ࢓૊Έ
 ɾQSJOUG TZTMPHͳͲͷؔ਺ͷॻࣜτʔΫϯΛ࢖ͬͯ೚ҙͷΞυϨεҐஔ ʹ೚ҙͷσʔλΛॻ͖ࠐ·ͤΔ͜ͱ͕Ͱ͖Δɻ
 
 ** 'PSNBU4USJOH"UUBDLͰ&YQMPJU࡞੒
 ɾCVGʹTIFMMDPEFΛૠೖ͢Δ
 ɾ(05ʹ͋Δؔ਺ͷΞυϨεΛݺͼग़͍ͨ͠ઌͷCVGͷΞυϨεʹ 'PSNBU4USJOH"UUBDLͷ੬ऑੑΛ࢖ͬͯॻ͖׵͑Δɻ
 *** 'PSNBU4USJOH"UUBDLͰ&YQMPJUͷԠ༻
 ɾ3FUVSOUPMJCDΛ࢖ͬͨ&YQMPJUͷઆ໌