Upgrade to Pro — share decks privately, control downloads, hide ads and more …

KnotResolverへの毒入れ~世にも珍しいKashpureff型攻撃~ / Hack_to_KnotResolver

8d3265a12fbbe91f75742b54647f659b?s=47 shutingrz
September 07, 2019

KnotResolverへの毒入れ~世にも珍しいKashpureff型攻撃~ / Hack_to_KnotResolver

8d3265a12fbbe91f75742b54647f659b?s=128

shutingrz

September 07, 2019
Tweet

Transcript

  1. ,OPU3FTPMWFS΁ͷಟೖΕ ͠Ύʔͱ !TIVUJOHS[ dੈʹ΋௝͍͠,BTIQVSF⒎ܕ߈ܸd

  2. ࣗݾ঺հ w ͠Ύʔͱ !TIVUJOHS[  w ηΩϡϦςΟΤϯδχΞ೥໨ w ͣͬͱωοτϫʔΫηΩϡϦςΟ 40$

    ΍͚ͬͯͨͲ
 ࠓ೥͔Βಥવ*P5ηΩϡϦςΟΛ΍Γ࢝ΊΔ
  3. ࠷ۙͷझຯ

  4. ֓ཁ w ,OPU3FTPMWFS d ʹಟೖΕͷ੬ऑੑ w $7& w $/".&࿈࠯ͷΩϟογϡաఔͰCBJMJXJDLνΣοΫ͕ແ͔ͬͨ w

    ࠓճͷΑ͏ͳ%/4ಟೖΕ੬ऑੑ͸ۃΊͯϨΞέʔε w 1P$Λࣗ࡞͠੒ޭΛ֬ೝ w ͜ͷ੬ऑੑΛ௨ͯ͠ɺ%/4ಟೖΕͷ࠷΋جૅతͳ֓೦ ʮCBJMJXJDLʯͷॏཁੑΛઆ໌͠·͢
  5. ಟೖΕͷݪཧ

  6. 4UVCSFTPMWFS  XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ ͍ΘΏΔ1$ DBDIF 'VMMTFSWJDFSFTPMWFS  XXXTIVUJOHS[DPN*/"  `

    ` Ωϟογϡ֬ೝ BSPPUTFSWFSTOFU BHUMETFSWFSTOFU OTTIVUJOHS[DPN "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS  XXXTIVUJOHS[DPN*/"ʁ  DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ  TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ  XXXTIVUJOHS[DPN*/"ʁ  XXXTIVUJOHS[DPN*/"ʁ     ` XXXTIVUJOHS[DPN*/"    ˞Ұ෦؆ུԽ͍ͯ͠·͢ ࢀߟ ໊લղܾͷಈ࡞
  7. 4UVCSFTPMWFS  XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ ͍ΘΏΔ1$ DBDIF 'VMMTFSWJDFSFTPMWFS  XXXTIVUJOHS[DPN*/" BSPPUTFSWFSTOFU BHUMETFSWFSTOFU

    OTTIVUJOHS[DPN "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS  XXXTIVUJOHS[DPN*/"ʁ  DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ  TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ  XXXTIVUJOHS[DPN*/"ʁ  XXXTIVUJOHS[DPN*/"ʁ     ` XXXTIVUJOHS[DPN*/"    %/4ΩϟογϡϙΠζχϯάͷݪཧ  `  ߈ܸऀ  ` ` Ωϟογϡ֬ೝ
  8. ಟೖΕͷ৚݅ w ਖ਼نͷԠ౴ΑΓ΋ૣ͘Ϧκϧόʹ౸ୡ͢Δ͜ͱ w Ԡ౴͕໰͍߹Θͤͱ੔߹ੑ͕औΕ͍ͯΔ͜ͱ

  9. ͜Ε͕ಟೖΕͷݪཧ

  10. ͜Ε͕ಟೖΕͷݪཧ

  11. ͜Ε͕ಟೖΕͷݪཧ ͜Ε͚ͩ͡Ό͋Γ·ͤΜʂ

  12. ,BTIQVSF⒎ܕ߈ܸ

  13. ಟೖΕ͸छྨʹେผ͞ΕΔ w ِ૷Ԡ౴ܕ w ΈΜͳ͕஌͍ͬͯΔ%/4ΩϟογϡϙΠζχϯά w ϓϩτίϧʹର͢Δ߈ܸ 3'$४ڌͰݪཧ্๷͛ͳ͍ w ,BNJOTLZܕ߈ܸख๏

    ୈҰϑϥάϝϯτศ৐߈ܸ΋ຊ࣭͸͜Ε w ,BTIQVSF⒎ܕ w CBJMJXJDLνΣοΫෆඋʹΑΔΩϟογϡͱ͍͏࣮૷Λಥ͍ͨ߈ܸ
 3'$ҧ൓ͳͷͰमਖ਼Մೳ
  14. ࣮ྫ FYQMPJUಈը

  15. IUUQTUXJUUFSDPNTIVUJOHS[TUBUVT

  16. ͜ͷԠ౴ͷԿ͕حົͳͷ͔ʁ ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU 
 
 26&45*0/4&$5*0/
 BUUBDLFSDPN*/"
 "/48&34&$5*0/
 BUUBDLFSDPN*/$/".&HPPHMFDPN
 "%%*5*0/"-4&$5*0/


    HPPHMFDPN*/"
  17. ͜ͷԠ౴ͷԿ͕حົͳͷ͔ʁ ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU 
 
 26&45*0/4&$5*0/
 BUUBDLFSDPN*/"
 "/48&34&$5*0/
 BUUBDLFSDPN*/$/".&HPPHMFDPN
 "%%*5*0/"-4&$5*0/


    HPPHMFDPN*/" "%%*5*0/"-4&$5*0/ʹ PVUPGCBJMJXJDLͳԠ౴͕͋Δͷ͕حົ
  18. CBJMJXJDL w ௚༁ͰʮͳΘ͹Γʯ w ֤κʔϯʹ͸ͦΕͧΕͷʮͳΘ͹Γʯ͕ଘࡏ͢Δ w κʔϯͷݖҖαʔό͕ฦͨ͠ʮͳΘ͹ΓʯͰ͸ͳ͍Ԡ౴͸ Ωϟογϡͯ͠͸͍͚ͳ͍ w ਌κʔϯͷݖҖαʔό͕ฦͨ͠ɺࢠκʔϯͷͳΘ͹ΓͰ͋Δ

    Ԡ౴Λɺඞཁͳ৔߹Λআ͍ͯແࢹ͢Δ΂͖ 3'$  w ͋ΔκʔϯͷͳΘ͹ΓͰ͋Δ෦෼ΛʮJOCBJMJXJDLʯ
 ͳΘ͹ΓͰͳ͍෦෼ΛʮPVUPGCBJMJXJDLʯͱݺͿ
  19. CBJMJXJDL w ௚༁ͰʮͳΘ͹Γʯ w ֤κʔϯʹ͸ͦΕͧΕͷʮͳΘ͹Γʯ͕ଘࡏ͢Δ w κʔϯͷݖҖαʔό͕ฦͨ͠ʮͳΘ͹ΓʯͰ͸ͳ͍Ԡ౴͸ Ωϟογϡͯ͠͸͍͚ͳ͍ w ਌κʔϯͷݖҖαʔό͕ฦͨ͠ɺࢠκʔϯͷͳΘ͹ΓͰ͋Δ

    Ԡ౴Λɺඞཁͳ৔߹Λআ͍ͯແࢹ͢Δ΂͖ 3'$  w ͋ΔκʔϯͷͳΘ͹ΓͰ͋Δ෦෼ΛʮJOCBJMJXJDLʯ
 ͳΘ͹ΓͰͳ͍෦෼ΛʮPVUPGCBJMJXJDLʯͱݺͿ ˠྫ֎HMVFϨίʔυ ࠓճ͸ׂѪ %/4ಟೖΕରࡦͰ࠷΋ॏཁͳ֓೦
  20. CBJMJXJDLͷྫ  w લఏ
 ɾFYBNQMFDPNκʔϯ͸DPNκʔϯͱͷؒͰ
 κʔϯΧοτ͞Ε͍ͯΔ
 ɾXXXFYBNQMFDPNκʔϯ͸ଘࡏ͠ͳ͍ w ྫ
 XXXFYBNQMFDPN

     OVMM DPN FYBNQMFDPN
  21. CBJMJXJDLͷྫ  w લఏ
 ɾKQSTDPKQκʔϯ͸KQκʔϯͱͷؒͰκʔϯΧοτ ͞Ε͍ͯΔ
 ɾXXXKQSTDPKQκʔϯ͸ଘࡏ͠ͳ͍ w ྫ
 XXXKQSTDPKQ

     OVMM KQ KQSTDPKQ ˞υοτ  ͷ֤Ґஔͱκʔϯ͸ରԠ͠ͳ͍͜ͱʹཹҙ
  22. CBJMJXJDLͷྫ  w લఏ
 ɾOJTDHPKQκʔϯ͸KQκʔϯͱͷؒͰκʔϯΧοτ͞Εͯ ͍Δ
 ɾXXXOJTDHPKQκʔϯ͸OJTDHPKQκʔϯͱͷؒͰκʔϯ Χοτ͞Ε͍ͯΔ
 ɹ XXXOJTDHPKQκʔϯͷ/4͸OT<>XXXOJTDHPKQ

     w ྫ XXXOJTDHPKQ  OVMM KQ OJTDHPKQ XXXOJTDHPKQ
  23. ໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫFYBNQMFDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴
 
 26&45*0/4&$5*0/
 XXXFYBNQMFDPN*/"
 "/48&34&$5*0/
 XXXFYBNQMFDPN*/"
 "65)03*5:4&$5*0/
 FYBNQMFDPN*//4OTFYBNQMFDPN
 "%%*5*0/"-4&$5*0/


    OTFYBNQMFDPN*/" w ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
  24. ໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫFYBNQMFDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴
 
 26&45*0/4&$5*0/
 XXXFYBNQMFDPN*/"
 "/48&34&$5*0/
 XXXFYBNQMFDPN*/"
 "65)03*5:4&$5*0/
 FYBNQMFDPN*//4OTFYBNQMFDPN
 "%%*5*0/"-4&$5*0/


    OTFYBNQMFDPN*/" JOCBJMJXJDL PVUPGCBJMJXJDL JOCBJMJXJDL ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
  25. ໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫKQSTDPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴
 
 26&45*0/4&$5*0/
 XXXKQSTDPKQ*/"
 "/48&34&$5*0/
 XXXKQSTDPKQ*/"
 "65)03*5:4&$5*0/
 KQSTDPKQ*//4OTKQSTDPKQ
 "%%*5*0/"-4&$5*0/


    OTKQSTDPKQ*/" ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
  26. ໰୊Ͳ͕͜CBJMJXJDLͩʁ JOCBJMJXJDL JOCBJMJXJDL JOCBJMJXJDL ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ ྫKQSTDPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴
 
 26&45*0/4&$5*0/
 XXXKQSTDPKQ*/"
 "/48&34&$5*0/


    XXXKQSTDPKQ*/"
 "65)03*5:4&$5*0/
 KQSTDPKQ*//4OTKQSTDPKQ
 "%%*5*0/"-4&$5*0/
 OTKQSTDPKQ*/"
  27. ໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫXXXOJTDHPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴
 
 26&45*0/4&$5*0/
 XXXOJTDHPKQ*/"
 "/48&34&$5*0/
 XXXOJTDHPKQ*/"
 "65)03*5:4&$5*0/
 OJTDHPKQ*//4OTOJTDHPKQ
 "%%*5*0/"-4&$5*0/


    OTOJTDHPKQ*/" w ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
  28. ໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫXXXOJTDHPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴
 
 26&45*0/4&$5*0/
 XXXOJTDHPKQ*/"
 "/48&34&$5*0/
 XXXOJTDHPKQ*/"
 "65)03*5:4&$5*0/
 OJTDHPKQ*//4OTOJTDHPKQ
 "%%*5*0/"-4&$5*0/


    OTOJTDHPKQ*/" w PVUPGCBJMJXJDL PVUPGCBJMJXJDL JOCBJMJXJDL ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
  29. ࿩Λ໭ͯ͠

  30. ,OPU3FTPMWFSͷ੬ऑੑ ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU 
 
 26&45*0/4&$5*0/
 BUUBDLFSDPN*/"
 "/48&34&$5*0/
 BUUBDLFSDPN*/$/".&HPPHMFDPN
 "%%*5*0/"-4&$5*0/


    HPPHMFDPN*/" PVUPGCBJMJXJDLͳԠ౴ΛΩϟογϡͯ͠͸͍͚ͳ͍ ʢ౰ͨΓલͰ͸ɾɾɾʣ
  31. ,BTIQVSF⒎ܕ߈ܸͷ੒ཱ৚݅ w Ωϟογϡαʔό͕CBJMJXJDLνΣοΫෆඋͷ੬ऑੑΛ࣋ͭ w ߈ܸऀ͕༻ҙͨ͠υϝΠϯ໊ʹΞΫηεͤ͞Δ

  32. ,BTIQVSF⒎ܕ߈ܸͷ੒ཱ৚݅ w Ωϟογϡαʔό͕CBJMJXJDLνΣοΫෆඋͷ੬ऑੑΛ࣋ͭ w ߈ܸऀ͕༻ҙͨ͠υϝΠϯ໊ʹΞΫηεͤ͞Δ w Ωϟογϡαʔόͷར༻ऀʹ߈ܸυϝΠϯͷ63-Λ౿· ͤΔʁ

  33.  w $SPVE'MBSF͕ఏڙ͢Δ1VCMJD%/4αʔϏε w ,OPU3FTPMWFSΛ࢖ͬͯΔ w ͭ·Γ౰࣌Λ%/4αʔόʹઃఆͯͨ͠ਓ͸ɾɾɾ

  34. ͓ΘΓ