Upgrade to Pro — share decks privately, control downloads, hide ads and more …

DNSトンネリングの手法 / A technique of DNS tunneling (#ssmjp)

DNSトンネリングの手法 / A technique of DNS tunneling (#ssmjp)

2018/05 の #ssmjp で発表した時の資料。
@shutingrz

shutingrz

May 24, 2018
Tweet

More Decks by shutingrz

Other Decks in Technology

Transcript

  1. %/4τϯωϦϯάͷख๏
    ͠Ύʔͱ
    !TIVUJOHS[

    View full-size slide

  2. ࣗݾ঺հ
    w ͱ͋ΔηΩϡϦςΟձࣾͷ40$ΤϯδχΞ
    w %/4 #(1ͳͲΠϯλʔωοτج൫͕޷͖
    w ۀ຿ʹ͸͋·Γؔ܎ͳ͍ɾɾɾ
    w ઌ݄͕TTNKQॳࢀՃʢਓ਺͍͢͝

    View full-size slide

  3. ΍ͬͯΔ͜ͱ
    w "4ͱϐΞϦϯά
    w ͱϑϧϧʔτΛ໯ͬͯ·͢
    w ࠷ۙ6αʔόΛखʹೖΕͨͷͰ
    ਓݖΛಘΒΕͨ

    View full-size slide

  4. ΍ͬͯΔ͜ͱ
    w %/4ΩϟογϡϙΠζχϯάΛ
    ߦ͏.FUBTQMPJUϞδϡʔϧͱ͔
    ࡞ͬͯ·ͨ͠
    w ͕͢͞ʹඇެ։Ͱ͢

    View full-size slide

  5. υϝΠϯϩοΫ͞Εͨ
    '#*ʢ'FEFSBM#VSFBVPG*OWFTUJHBUJPOʣ

    ͔ΒͷࢦࣔʹΑΓɺ

    View full-size slide

  6. %/4τϯωϦϯά

    View full-size slide

  7. %/4τϯωϦϯάͱ͸
    w %/4௨৴ʹผͷ໨తΛ࣋ͬͨ৘ใΛؚΊΔ͜ͱ
    w ِ૷௨৴ͷҰछ

    View full-size slide

  8. ҉߸Խ௨৴ͱͷҧ͍
    w ҉߸Խ௨৴
    w ͲͷΑ͏ͳσʔλ͔֬ೝͰ͖ͳ͍Α͏ʹ͢Δ
    w ௨৴͕ߦΘΕ͍ͯΔ͜ͱ͸ೝ஌͞Εͯ΋Α͍
    w ِ૷௨৴
    w ҙຯͷ͋ΔσʔλΛૹ৴͍ͯ͠Δ͜ͱΛ

    ஌ΒΕͳ͍Α͏ʹ͢Δ

    View full-size slide

  9. %/4τϯωϦϯάͷར༻ྫ
    w ϑΟϧλϦϯά؀ڥԼͰͷ71/
    w VEQ UDQ͸։͍͍ͯΔՄೳੑ͕ߴ͍
    w Ϛϧ΢ΣΞ
    w )551ʹൺ΂ͯϩΪϯά͞Ε͍ͯͳ͍

    View full-size slide

  10. %/4τϯωϦϯάͷར༻ྫ
    w ϑΟϧλϦϯά؀ڥԼͰͷ71/
    w VEQ UDQ͸։͍͍ͯΔՄೳੑ͕ߴ͍
    w Ϛϧ΢ΣΞ
    w )551ʹൺ΂ͯϩΪϯά͞Ε͍ͯͳ͍

    View full-size slide

  11. Ϛϧ΢ΣΞͷ)551௨৴
    w Ϛϧ΢ΣΞ͕)551௨৴Λར༻͢Δཧ༝
    ΄ͱΜͲͷ04Ͱ)551௨৴͕ՄೳͰ͋Δ
    ϓϩΩγαʔό͕ଘࡏ͍ͯ͠Δ৔߹Ͱ΋ɺ

    ΫϥΠΞϯτͷ௨৴͕΄΅ͦͷ··Ͱ֎෦
    ʹൈ͚ग़ͤΔΑ͏ʹͳ͍ͬͯΔ
    ༷ʑͳσʔλΛॊೈʹදݱͰ͖Δ

    View full-size slide

  12. Ϛϧ΢ΣΞͷ)551௨৴
    w Ϛϧ΢ΣΞ͕)551௨৴Λར༻͢Δཧ༝
    ΄ͱΜͲͷ04Ͱ)551௨৴͕ՄೳͰ͋Δ
    ϓϩΩγαʔό͕ଘࡏ͍ͯ͠Δ৔߹Ͱ΋ɺ

    ΫϥΠΞϯτͷ௨৴͕΄΅ͦͷ··Ͱ֎෦
    ʹൈ͚ग़ͤΔΑ͏ʹͳ͍ͬͯΔ
    ༷ʑͳσʔλΛॊೈʹදݱͰ͖Δ
    %/4
    ϑϧϦκϧό
    %/4
    %/4

    View full-size slide

  13. %/4τϯωϦϯά
    Ϛϧ΢ΣΞͷ௨৴ྫ

    View full-size slide

  14. Ϛϧ΢ΣΞ໊ ϗετ໊ͷنଇ 33
    1MVH9 YB
    <Կ͔ͷنଇ>TVCEPNBJO 595
    1MVH9 Y
    TVCEPNBJO 595
    .6-5*(3"*/ MPHTVCEPNBJO 595
    QJTMPBEFS <Կ͔ͷنଇ>TVCEPNBJO 595
    'FFEFSCPU
    <CZUFT><$)6/,*%>
    TVCEPNBJO
    595
    %/4.FTTFOHFS <҉߸Խ\σʔλ>^>TVCEPNBJO 595
    'SBNFXPSL104 <Τϯίʔυ>EPNBJO """""
    $1303"$$00/ EPNBJO $/".&
    )FMNJOUI
    < SBOEPN
    >
    <%"5">EPNBJO
    "
    %FOJT <">EPNBJO ಠࣗ
    ݁ߏଟ͍ʂ

    View full-size slide

  15. Ϛϧ΢ΣΞͷಛ௃͔ΒΘ͔Δ
    %/4τϯωϦϯάͷख๏
    w αʔό͔ΒΫϥΠΞϯτ΁ͷ໋ྩ͸595͕ଟ͍
    w 595͸೚ҙͷσʔλΛؚΊΒΕΔͨΊ
    w ΫϥΠΞϯτ͔Βͷ৘ใૹ৴͸ROBNFΛ࢖͏
    w Ωϟογϡαʔό͸ROBNFͷΈΛར༻͢ΔͨΊ
    w ROBNF͕௕͍
    w ؚΊΒΕΔσʔλྔͷؔ܎ͱɺΩϟογϡ͞ΕΔͨΊ

    View full-size slide

  16. ٙࣅϚϧ΢ΣΞʹΑΔ
    %/4τϯωϦϯάσϞ
    w "ϨίʔυΛ༻͍ͨ$௨৴
    w )FMNJOUIΛղੳͯ͠࡞੒ͨ͠$αʔό
    w 595ϨίʔυΛ༻͍ͨ$௨৴

    View full-size slide

  17. Ϛϧ΢ΣΞ࡞੒ऀΛ
    ग़͠ൈ͚Δ͔

    View full-size slide

  18. छͷΞϓϩʔν
    w ௚઀௨৴Ͱ͖Δ৔߹
    ΫϥΠΞϯτ͔Βαʔό
    αʔό͔ΒΫϥΠΞϯτ
    w ϑϧϦκϧόΛܦ༝͢Δ৔߹
    ΫϥΠΞϯτ͔Βαʔό
    αʔό͔ΒΫϥΠΞϯτ

    View full-size slide

  19. 4UVCSFTPMWFS

    XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ
    DBDIF
    'VMM 'VMMTFSWJDF
    SFTPMWFS
    BSPPUTFSWFSTOFU
    BHUMETFSWFSTOFU
    OTTIVUJOHS[DPN
    "VUIPSJUBUJWFTFSWFS
    "VUIPSJUBUJWFTFSWFS
    "VUIPSJUBUJWFTFSWFS


    ௚઀௨৴͢Δ৔߹

    View full-size slide

  20. 4UVCSFTPMWFS

    XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ
    DBDIF
    'VMM 'VMMTFSWJDF
    SFTPMWFS

    XXXTIVUJOHS[DPN*/"

    Ωϟογϡ֬ೝ
    BSPPUTFSWFSTOFU
    BHUMETFSWFSTOFU
    OTTIVUJOHS[DPN
    "VUIPSJUBUJWFTFSWFS
    "VUIPSJUBUJWFTFSWFS
    "VUIPSJUBUJWFTFSWFS

    XXXTIVUJOHS[DPN*/"ʁ

    DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ

    TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ

    XXXTIVUJOHS[DPN*/"ʁ

    XXXTIVUJOHS[DPN*/"ʁ




    `
    XXXTIVUJOHS[DPN*/"



    ΩϟογϡαʔόΛܦ༝͢Δ৔߹

    View full-size slide

  21. ௚઀௨৴Ͱ͖Δ৔߹

    View full-size slide

  22. ௚઀௨৴Ͱ͖Δ৔߹
    w ͳΜͰ΋Ͱ͖Δ
    w ϑΥϨϯδοΧʔʹόϨͳ͍Α͏ʹ

    View full-size slide

  23. ϔομ
    2VFTUJPOηΫγϣϯ
    ϦιʔεϨίʔυ

    View full-size slide

  24. &%/4
    w &%/4ͷσʔλ෦Λར༻
    w σʔλ͕ROBNFʹݱΕͳ͍
    w σʔλྔ͸όΠτ͕࠷େ
    w ࣮ࡍ͸όΠτ͘Β͍͡Ό
    ͳ͍ͱόϨͦ͏

    View full-size slide

  25. ৭ʑͳ&%/4Φϓγϣϯ
    w &%/4$MJFOU4VCOFU &$4

    w ΫϥΠΞϯτ৘ใΛݖҖαʔόʹૹ৴͢Δ
    w %/4$PPLJF
    w ࠮শ๷ࢭ༻ʹݖҖαʔόʹૹ৴͢Δ

    View full-size slide

  26. ৭ʑͳ&%/4Φϓγϣϯ
    w $)"*/
    w ݕূࡁΈκʔϯ৘ใΛϑϧϦκϧόʹૹ৴͢Δ
    w 1BEEJOH
    w ҉߸Խ௨৴ͷฏจਪଌ๷ࢭͷͨΊύσΟϯά
    ΛؚΊΔ

    View full-size slide

  27. &%/4Λ࢖ͬͨ
    %/4τϯωϦϯάσϞ
    w ROBNFʹσʔλ͕ೖΒͳ͍ͱ͜Ζ͕ಛ௃
    w ޙड़͢ΔROBNFݕ஌ख๏͕શ͘໾ʹཱͨͳ͍

    View full-size slide

  28. ϑϧϦκϧόΛ
    ܦ༝͢Δ৔߹

    View full-size slide

  29. ϑϧϦκϧόΛܦ༝͢Δ৔߹
    w ҎԼͷ੍ݶ͕͋Δ
    w ࠶ؼ໰͍߹Θͤʹෆཁͳσʔλ͸࡟আ͞ΕΔ
    w ಉ͡ROBNFͱ33͸55-ඵΩϟογϡ͞ΕΔ

    View full-size slide

  30. αʔό͔ΒΫϥΠΞϯτ

    View full-size slide

  31. 595
    w ৭ΜͳݕূͷͨΊʹαʔό͕໰͍߹ΘͤΔ
    w σʔλ͸?όΠτ 3%"5"ͷ࠷େ஋

    w ͕͢͞ʹେ͖͗͢ΔͱόϨΔ
    w ݩʑΪϦڐ͕ͤͨ͜͏΋࢖ΘΕͯ͸΋͏μϝ

    View full-size slide

  32. 334*(
    w %/44&$ݕূʹ༻͍Δ33
    w ֤334FUʹ෇༩͞ΕΔ
    w σʔλ͸όΠτ͘Β͍͕ݱ࣮త
    w ྲྀΕ͍ͯͯ΋ΪϦڐ͞Εͦ͏ʢࠓޙΛߟ͑Δͱ
    w /8಺෦ͷόϦσʔλ͸͕͢͞ʹ͓͔͍͠ʁ

    View full-size slide

  33. $/".&
    w $%/͕ϝδϟʔʹͳͬͨࠓɺվΊͯΦεεϝ
    w σʔλྔ͸MFO EPNBJO
    όΠτ
    w RUZQF͕"ͳͷʹจࣈྻ͕ฦ͖ͬͯͯΑ͍
    w ࣗκʔϯͷ໊લΛࣔͯ͠XJMEDBSE͢Ε͹

    ໊લղܾ͕Ͱ͖ɺෆ৹ੑΛ཈͑Δ͜ͱ͕Մೳ

    View full-size slide

  34. ΫϥΠΞϯτ͔Βαʔό

    View full-size slide

  35. ROBNF͔͠ͳ͍

    View full-size slide

  36. %/4ͷ࢓༷ͱ࣮૷
    w ϑϧϦκϧό͸ελϒϦκϧόͷ26&45*0/
    4&$5*0/ͷΈΛ࠶ؼ໰͍߹Θͤʹίϐʔ͢Δ
    w ͭ·ΓɺROBNF RDMBTT RUZQFͷΈ͕

    %/4τϯωϦϯάʹ࢖͑Δ
    w ݁ՌɺROBNFʹσʔλΛೖΕΔ͔͠ͳ͍
    ˠROBNFʹ͑͞ؾΛ͚ͭΕ͹ݕ஌Ͱ͖Δʂ

    View full-size slide

  37. %/4τϯωϦϯάͷݕग़

    View full-size slide

  38. ௚઀௨৴͢Δ৔߹
    w ߟ͑͏Δύλʔϯ͕ଟ͘ݕ஌͸೉͍͠
    w ΫΤϦϩάʹ࢒Βͳ͍΋ͷ΋ͨ͘͞Μ͋Δ
    w ݕ஌ͤ͞ΔΑΓɺϑϧϦκϧό͔ΒҎ֎ͷ

    UDQ VEQΛϑΟϧλ͢Ε͹
    'VMM

    View full-size slide

  39. ϑϧϦκϧόΛܦ༝͢Δ৔߹
    w αʔό͔ΒΫϥΠΞϯτ
    w ීஈ࢖Θͳ͍33͔
    w αΠζ͕େ͖͘ͳ͍͔
    w 3$0%&͕/0&3303Ҏ֎
    w 55-͕খ͘͞ͳ͍͔

    View full-size slide

  40. ϑϧϦκϧόΛܦ༝͢Δ৔߹
    w ΫϥΠΞϯτ͔Βαʔό
    w ROBNFͷ௕͞
    w υϝΠϯʹର͢Δϗετ໊ͷ਺
    w ROBNFͷෆ৹͞

    View full-size slide

  41. ROBNFͷෆ৹͞
    w จࣈ୯ޠͷϥϯμϜੑɾූ߸Խݕ஌
    w EOVGL͸UFTUUFTUΑΓ΋zෳࡶz
    w ୯ޠͷؔ࿈ੑΛείΞϦϯά
    w ͜͜Β΁Μ͸JOGPCMPY͕ಛڐ࣋ͬͯΔΒ͍͠

    View full-size slide

  42. ·ͱΊ
    w %/4τϯωϦϯά͸ͻͬͦΓͱ࢖ΘΕ͍ͯΔ
    w ϩΪϯά͞Εͳ͍͔Βඪతܕ߈ܸʹ࢖ΘΕΔ
    w ௚઀௨৴Ͱ͖Δ৔߹͸ݕ஌͸ඇৗʹ೉͍͠
    w ϑϧϦκϧό͔ΒҎ֎ΛϑΟϧλ͢Ε͹0,
    w ͋ͱ͸ROBNF͚ͩݟΕ͹ΞϊϚϦݕ஌Ͱ͖Δ
    w ద੾ͳઃఆ͕Ͱ͖Ε͹ࢥͬͨΑΓ΋୯७

    View full-size slide

  43. Ϛϧ΢ΣΞ%/4τϯωϦϯάɹɹ

    View full-size slide