KnotResolverへの毒入れ~世にも珍しいKashpureff型攻撃~ / Hack_to_KnotResolver

PoC動画: https://twitter.com/shutingrz/status/1053577766593998848
PoC: https://github.com/shutingrz/CVE-2018-10920_PoC
(DO NOT ABUSE!)

Transcript

1. ,OPU3FTPMWFS΁ͷಟೖΕ
   ͠Ύʔͱ
   !TIVUJOHS[
   
   dੈʹ΋௝͍͠,BTIQVSF⒎ܕ߈ܸd
   

   View Slide

2. ࣗݾ঺հ
   w ͠Ύʔͱ !TIVUJOHS[
   
   w ηΩϡϦςΟΤϯδχΞ೥໨
   w ͣͬͱωοτϫʔΫηΩϡϦςΟ 40$
   ΍͚ͬͯͨͲ

   ࠓ೥͔Βಥવ*P5ηΩϡϦςΟΛ΍Γ࢝ΊΔ
   

   View Slide

3. ࠷ۙͷझຯ
   

   View Slide

4. ֓ཁ
   w ,OPU3FTPMWFS d
   ʹಟೖΕͷ੬ऑੑ
   w $7&
   w $/".&࿈࠯ͷΩϟογϡաఔͰCBJMJXJDLνΣοΫ͕ແ͔ͬͨ
   w ࠓճͷΑ͏ͳ%/4ಟೖΕ੬ऑੑ͸ۃΊͯϨΞέʔε
   w 1P$Λࣗ࡞͠੒ޭΛ֬ೝ
   w ͜ͷ੬ऑੑΛ௨ͯ͠ɺ%/4ಟೖΕͷ࠷΋جૅతͳ֓೦
   ʮCBJMJXJDLʯͷॏཁੑΛઆ໌͠·͢
   

   View Slide

5. ಟೖΕͷݪཧ
   

   View Slide

6. 4UVCSFTPMWFS
   
   XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ
   ͍ΘΏΔ1$
   DBDIF
   'VMMTFSWJDFSFTPMWFS
   
   XXXTIVUJOHS[DPN*/"
   ` `
   Ωϟογϡ֬ೝ
   BSPPUTFSWFSTOFU
   BHUMETFSWFSTOFU
   OTTIVUJOHS[DPN
   "VUIPSJUBUJWFTFSWFS
   "VUIPSJUBUJWFTFSWFS
   "VUIPSJUBUJWFTFSWFS
   
   XXXTIVUJOHS[DPN*/"ʁ
   
   DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ
   
   TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ
   
   XXXTIVUJOHS[DPN*/"ʁ
   
   XXXTIVUJOHS[DPN*/"ʁ
   
   
   
   
   `
   XXXTIVUJOHS[DPN*/"
   
   
   
   ˞Ұ෦؆ུԽ͍ͯ͠·͢
   ࢀߟ
   ໊લղܾͷಈ࡞
   

   View Slide

7. 4UVCSFTPMWFS
   
   XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ
   ͍ΘΏΔ1$
   DBDIF
   'VMMTFSWJDFSFTPMWFS
   
   XXXTIVUJOHS[DPN*/"
   BSPPUTFSWFSTOFU
   BHUMETFSWFSTOFU
   OTTIVUJOHS[DPN
   "VUIPSJUBUJWFTFSWFS
   "VUIPSJUBUJWFTFSWFS
   "VUIPSJUBUJWFTFSWFS
   
   XXXTIVUJOHS[DPN*/"ʁ
   
   DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ
   
   TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ
   
   XXXTIVUJOHS[DPN*/"ʁ
   
   XXXTIVUJOHS[DPN*/"ʁ
   
   
   
   
   `
   XXXTIVUJOHS[DPN*/"
   
   
   
   %/4ΩϟογϡϙΠζχϯάͷݪཧ
   
   `
   
   ߈ܸऀ
   ` `
   Ωϟογϡ֬ೝ
   

   View Slide

8. ಟೖΕͷ৚݅
   w ਖ਼نͷԠ౴ΑΓ΋ૣ͘Ϧκϧόʹ౸ୡ͢Δ͜ͱ
   w Ԡ౴͕໰͍߹Θͤͱ੔߹ੑ͕औΕ͍ͯΔ͜ͱ
   

   View Slide

9. ͜Ε͕ಟೖΕͷݪཧ
   

   View Slide

10. ͜Ε͕ಟೖΕͷݪཧ
    

    View Slide

11. ͜Ε͕ಟೖΕͷݪཧ
    ͜Ε͚ͩ͡Ό͋Γ·ͤΜʂ
    

    View Slide

12. ,BTIQVSF⒎ܕ߈ܸ
    

    View Slide

13. ಟೖΕ͸छྨʹେผ͞ΕΔ
    w ِ૷Ԡ౴ܕ
    w ΈΜͳ͕஌͍ͬͯΔ%/4ΩϟογϡϙΠζχϯά
    w ϓϩτίϧʹର͢Δ߈ܸ 3'$४ڌͰݪཧ্๷͛ͳ͍
    w ,BNJOTLZܕ߈ܸख๏ ୈҰϑϥάϝϯτศ৐߈ܸ΋ຊ࣭͸͜Ε
    w ,BTIQVSF⒎ܕ
    w CBJMJXJDLνΣοΫෆඋʹΑΔΩϟογϡͱ͍͏࣮૷Λಥ͍ͨ߈ܸ

    3'$ҧ൓ͳͷͰमਖ਼Մೳ
    

    View Slide

14. ࣮ྫ
    FYQMPJUಈը
    
    

    View Slide

15. IUUQTUXJUUFSDPNTIVUJOHS[TUBUVT
    

    View Slide

16. ͜ͷԠ౴ͷԿ͕حົͳͷ͔ʁ
    ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU
    

    

    26&45*0/4&$5*0/

    BUUBDLFSDPN*/"

    "/48&34&$5*0/

    BUUBDLFSDPN*/$/".&HPPHMFDPN

    "%%*5*0/"-4&$5*0/

    HPPHMFDPN*/"
    

    View Slide

17. ͜ͷԠ౴ͷԿ͕حົͳͷ͔ʁ
    ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU
    

    

    26&45*0/4&$5*0/

    BUUBDLFSDPN*/"

    "/48&34&$5*0/

    BUUBDLFSDPN*/$/".&HPPHMFDPN

    "%%*5*0/"-4&$5*0/

    HPPHMFDPN*/"
    "%%*5*0/"-4&$5*0/ʹ
    PVUPGCBJMJXJDLͳԠ౴͕͋Δͷ͕حົ
    

    View Slide

18. CBJMJXJDL
    w ௚༁ͰʮͳΘ͹Γʯ
    w ֤κʔϯʹ͸ͦΕͧΕͷʮͳΘ͹Γʯ͕ଘࡏ͢Δ
    w κʔϯͷݖҖαʔό͕ฦͨ͠ʮͳΘ͹ΓʯͰ͸ͳ͍Ԡ౴͸
    Ωϟογϡͯ͠͸͍͚ͳ͍
    w ਌κʔϯͷݖҖαʔό͕ฦͨ͠ɺࢠκʔϯͷͳΘ͹ΓͰ͋Δ
    Ԡ౴Λɺඞཁͳ৔߹Λআ͍ͯແࢹ͢Δ΂͖ 3'$
    
    w ͋ΔκʔϯͷͳΘ͹ΓͰ͋Δ෦෼ΛʮJOCBJMJXJDLʯ

    ͳΘ͹ΓͰͳ͍෦෼ΛʮPVUPGCBJMJXJDLʯͱݺͿ
    

    View Slide

19. CBJMJXJDL
    w ௚༁ͰʮͳΘ͹Γʯ
    w ֤κʔϯʹ͸ͦΕͧΕͷʮͳΘ͹Γʯ͕ଘࡏ͢Δ
    w κʔϯͷݖҖαʔό͕ฦͨ͠ʮͳΘ͹ΓʯͰ͸ͳ͍Ԡ౴͸
    Ωϟογϡͯ͠͸͍͚ͳ͍
    w ਌κʔϯͷݖҖαʔό͕ฦͨ͠ɺࢠκʔϯͷͳΘ͹ΓͰ͋Δ
    Ԡ౴Λɺඞཁͳ৔߹Λআ͍ͯແࢹ͢Δ΂͖ 3'$
    
    w ͋ΔκʔϯͷͳΘ͹ΓͰ͋Δ෦෼ΛʮJOCBJMJXJDLʯ

    ͳΘ͹ΓͰͳ͍෦෼ΛʮPVUPGCBJMJXJDLʯͱݺͿ
    ˠྫ֎HMVFϨίʔυ ࠓճ͸ׂѪ
    
    %/4ಟೖΕରࡦͰ࠷΋ॏཁͳ֓೦
    

    View Slide

20. CBJMJXJDLͷྫ
    
    w લఏ

    ɾFYBNQMFDPNκʔϯ͸DPNκʔϯͱͷؒͰ

    κʔϯΧοτ͞Ε͍ͯΔ

    ɾXXXFYBNQMFDPNκʔϯ͸ଘࡏ͠ͳ͍
    w ྫ

    XXXFYBNQMFDPN
    OVMM
    
    DPN
    FYBNQMFDPN
    

    View Slide

21. CBJMJXJDLͷྫ
    
    w લఏ

    ɾKQSTDPKQκʔϯ͸KQκʔϯͱͷؒͰκʔϯΧοτ
    ͞Ε͍ͯΔ

    ɾXXXKQSTDPKQκʔϯ͸ଘࡏ͠ͳ͍
    w ྫ

    XXXKQSTDPKQ
    OVMM
    
    KQ
    KQSTDPKQ
    ˞υοτ
    ͷ֤Ґஔͱκʔϯ͸ରԠ͠ͳ͍͜ͱʹཹҙ
    

    View Slide

22. CBJMJXJDLͷྫ
    
    w લఏ

    ɾOJTDHPKQκʔϯ͸KQκʔϯͱͷؒͰκʔϯΧοτ͞Εͯ
    ͍Δ

    ɾXXXOJTDHPKQκʔϯ͸OJTDHPKQκʔϯͱͷؒͰκʔϯ
    Χοτ͞Ε͍ͯΔ

    ɹ XXXOJTDHPKQκʔϯͷ/4͸OT<>XXXOJTDHPKQ
    
    w ྫ
    XXXOJTDHPKQ
    OVMM
    
    KQ
    OJTDHPKQ
    XXXOJTDHPKQ
    

    View Slide

23. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫFYBNQMFDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴

    

    26&45*0/4&$5*0/

    XXXFYBNQMFDPN*/"

    "/48&34&$5*0/

    XXXFYBNQMFDPN*/"

    "65)03*5:4&$5*0/

    FYBNQMFDPN*//4OTFYBNQMFDPN

    "%%*5*0/"-4&$5*0/

    OTFYBNQMFDPN*/"
    w
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
    

    View Slide

24. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫFYBNQMFDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴

    

    26&45*0/4&$5*0/

    XXXFYBNQMFDPN*/"

    "/48&34&$5*0/

    XXXFYBNQMFDPN*/"

    "65)03*5:4&$5*0/

    FYBNQMFDPN*//4OTFYBNQMFDPN

    "%%*5*0/"-4&$5*0/

    OTFYBNQMFDPN*/"
    JOCBJMJXJDL
    PVUPGCBJMJXJDL
    JOCBJMJXJDL
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
    

    View Slide

25. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫKQSTDPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴

    

    26&45*0/4&$5*0/

    XXXKQSTDPKQ*/"

    "/48&34&$5*0/

    XXXKQSTDPKQ*/"

    "65)03*5:4&$5*0/

    KQSTDPKQ*//4OTKQSTDPKQ

    "%%*5*0/"-4&$5*0/

    OTKQSTDPKQ*/"
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
    

    View Slide

26. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    JOCBJMJXJDL
    JOCBJMJXJDL
    JOCBJMJXJDL
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
    ྫKQSTDPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴

    

    26&45*0/4&$5*0/

    XXXKQSTDPKQ*/"

    "/48&34&$5*0/

    XXXKQSTDPKQ*/"

    "65)03*5:4&$5*0/

    KQSTDPKQ*//4OTKQSTDPKQ

    "%%*5*0/"-4&$5*0/

    OTKQSTDPKQ*/"
    

    View Slide

27. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫXXXOJTDHPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴

    

    26&45*0/4&$5*0/

    XXXOJTDHPKQ*/"

    "/48&34&$5*0/

    XXXOJTDHPKQ*/"

    "65)03*5:4&$5*0/

    OJTDHPKQ*//4OTOJTDHPKQ

    "%%*5*0/"-4&$5*0/

    OTOJTDHPKQ*/"
    w
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
    

    View Slide

28. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫXXXOJTDHPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴

    

    26&45*0/4&$5*0/

    XXXOJTDHPKQ*/"

    "/48&34&$5*0/

    XXXOJTDHPKQ*/"

    "65)03*5:4&$5*0/

    OJTDHPKQ*//4OTOJTDHPKQ

    "%%*5*0/"-4&$5*0/

    OTOJTDHPKQ*/"
    w
    PVUPGCBJMJXJDL
    PVUPGCBJMJXJDL
    JOCBJMJXJDL
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
    

    View Slide

29. ࿩Λ໭ͯ͠
    

    View Slide

30. ,OPU3FTPMWFSͷ੬ऑੑ
    ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU
    

    

    26&45*0/4&$5*0/

    BUUBDLFSDPN*/"

    "/48&34&$5*0/

    BUUBDLFSDPN*/$/".&HPPHMFDPN

    "%%*5*0/"-4&$5*0/

    HPPHMFDPN*/"
    PVUPGCBJMJXJDLͳԠ౴ΛΩϟογϡͯ͠͸͍͚ͳ͍
    ʢ౰ͨΓલͰ͸ɾɾɾʣ
    

    View Slide

31. ,BTIQVSF⒎ܕ߈ܸͷ੒ཱ৚݅
    w Ωϟογϡαʔό͕CBJMJXJDLνΣοΫෆඋͷ੬ऑੑΛ࣋ͭ
    w ߈ܸऀ͕༻ҙͨ͠υϝΠϯ໊ʹΞΫηεͤ͞Δ
    

    View Slide

32. ,BTIQVSF⒎ܕ߈ܸͷ੒ཱ৚݅
    w Ωϟογϡαʔό͕CBJMJXJDLνΣοΫෆඋͷ੬ऑੑΛ࣋ͭ
    w ߈ܸऀ͕༻ҙͨ͠υϝΠϯ໊ʹΞΫηεͤ͞Δ
    w Ωϟογϡαʔόͷར༻ऀʹ߈ܸυϝΠϯͷ63-Λ౿·
    ͤΔʁ
    

    View Slide

33. 
    w $SPVE'MBSF͕ఏڙ͢Δ1VCMJD%/4αʔϏε
    w ,OPU3FTPMWFSΛ࢖ͬͯΔ
    w ͭ·Γ౰࣌Λ%/4αʔόʹઃఆͯͨ͠ਓ͸ɾɾɾ
    

    View Slide

34. ͓ΘΓ
    

    View Slide