Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Goなどで作る脆弱性対策ゲーム / go-bigbridge

Goなどで作る脆弱性対策ゲーム / go-bigbridge

KONDO Uchio

June 14, 2018
Tweet

More Decks by KONDO Uchio

Other Decks in Technology

Transcript

  1. 6DIJP,POEP
    'VLVPLBHP
    (PͳͲͰ࡞Δ੬ऑੑରࡦήʔϜ

    View Slide

  2. (.0ϖύϘγχΞϓϦϯγύϧ
    ۙ౻͏͓ͪ!VE[VSB
    044ϓϩμΫτ
    w NSVCZͷίϯςφϥϯλΠϜ)BDPOJXB
    w 3VCZͷ ZFU"OPUIFS
    0QFO4UBDLDMJFOU:BP
    3VCZ͸೥΄Ͳɺ(P͸೥͙Β͍ʁ
    ޷͖ͳϥΠϒϥϦIBTIJDPSQIDM
    ར༻ϒΩϓϥΠϜγϡʔλʔίϥϘ
    ηΩϡϦςΟ͸ษڧ࢝͠Ίͨ͹͔ΓͰ͢

    View Slide

  3. "MTPB3VCZJTU

    View Slide

  4. 13

    View Slide

  5. 'VLVPLBSC
    !
    ԙϖύες

    View Slide

  6. 8FCΞϓϦέʔγϣϯͷ
    ੬ऑੑ

    View Slide

  7. 944

    View Slide

  8. $43'

    View Slide

  9. 42-
    *OKFDUJPO

    View Slide

  10. ߈ܸ͞Εͨ͜ͱ
    ͋Γ·͔͢ʁ

    View Slide

  11. ߈ܸΛ஌Γ͍ͨ
    ๷ޚ͍ͨ͠

    View Slide

  12. ࿅शʢʁʣ͠Α͏

    View Slide

  13. DG%78"
    w%BNO7VMOFSBCMF8FC"QQMJDBUJPO
    w͋͑ͯ੬ऑͳ࡞Γʹͨ͠΢ΣϒΞϓϦέʔγϣϯ
    w༷ʑͳ߈ܸΛ࣮ࡍʹߦ͏͜ͱͰɺ߈ܸଆͷؾ࣋ͪʹͳΓ

    ͦΕ͕։ൃʹ͓͍ͯ΋໾ʹཱͭ
    wΞϓϦέʔγϣϯͷ੬ऑ౓߹͍ΛઃఆͰ͖ͯศརʢʁʣ
    IUUQXXXEWXBDPVL

    View Slide

  14. ߈ܸΛͯ͠ΈΔͱ

    View Slide

  15. View Slide

  16. ͜ΕΛࣗಈԽ͢Δͱ

    View Slide

  17. ๷ޚଆͷ
    ࿅शʹ΋࢖͑ΔͷͰ͸ʁ

    View Slide

  18. CJHCSJEHFϓϩδΣΫτʢԾʣ
    wೋͭͷίϯςφΛ࡞Δ߈ܸଆɺ๷ޚଆ
    w߈ܸଆ͸όΠφϦͰϒϥοΫϘοΫεͷϓϩάϥϜ
    w๷ޚଆ͸"[email protected]ͳ੬ऑͳΞϓϦέʔγϣϯ

    TTIͰௐࠪՄೳͳΑ͏ɺγεςϜίϯςφʹͳ͍ͬͯΔ

    View Slide

  19. CJHCSJEHF
    IUUQTDTLZVTIVVBDKQFOQJUQSP

    View Slide

  20. ߏ੒
    Binary
    Apache MySQL
    App

    (PHP)
    SSHD
    Attacker Defender

    View Slide

  21. ๷ޚଆ͔ΒৄࡉΛɻ
    wTPWFSMBZͱ͍͏ɺ%PDLFS΍ίϯςφʹಛԽͨ͠γϯϓϧͳJOJUͷ࢓
    ૊ΈΛ࢖ͬͯγεςϜίϯςφΛ࡞Δɻ
    wTTIE ϩάͷͨΊSTZTMPH
    ɺBQBDIFɺ.Z42-Λࣂ͍ͬͯΔ
    wPDUPQBTTͰTTIϩάΠϯपΓΛ؆୯ʹ
    IUUQTHJUIVCDPNKVTUDPOUBJOFSTTPWFSMBZ

    View Slide

  22. ߈ܸଆɻ
    wṖͷόΠφϦ͕͋Δ
    wઃఆʹ͸ɺ߈ܸઌͷΞυϨεͳͲͷ৘ใ͔͠౉ͤͳ͘ɺͲ͏͍͏߈ܸ
    Λ͍ͯ͠Δ͔͸Θ͔Βͳ͍
    wىಈ͢Δͱɺର৅΁ͷ߈ܸͷ੒ޭࣦഊ͚͕ͩΘ͔Δ
    wˠ๷ޚଆͷϩάͳͲΛ֬ೝ͠ɺΞϓϦΛվमͯ͠

    View Slide

  23. ߈ܸϕϯνϚʔΫͷྲྀΕ
    w߈ܸଆͰόΠφϦىಈˠ๷ޚଆͰϩάͳͲΛ֬ೝ
    wˠ๷ޚଆͷઃఆΛมߋͨ͠ΓɺΞϓϦΛվम
    wˠ࠶౓߈ܸΛ͠ɺࣦഊͨ͠Β๷Ӵ੒ޭʂʂʂ̍

    View Slide

  24. ṖͷόΠφϦ

    View Slide

  25. ͦ͜ͰɺΛ࢖͏

    View Slide

  26. ࣮૷ͷྫ

    View Slide

  27. ໾ʹཱͭ΋ͷ
    wIFBE[PPTVSG
    wঢ়ଶΛอͭ͜ͱ͕Ͱ͖Δ΢ΣϒεΫϨΠύʔϥΠϒϥϦ
    IUUQTHJUIVCDPNIFBE[PPTVSG

    View Slide

  28. EFNP
    wʢतۀͰ࢖͏ͱ͍͏͜ͱͰɺৄࡉ͸·ͩφΠγϣʣ

    View Slide

  29. ࠓޙ΍Γ͍ͨ͜ͱ
    w߈ܸͷόϦΤʔγϣϯΛ૿΍͢
    w؆୯ͳରࡦͰ͋ͬͨΒ߈ܸଆͰݟൈ͔Εͯ͢Γൈ͚Δ΍ͭͱ͔
    w߈ܸόΠφϦΛ΋ͬͱ೉ಡԽ͢Δ
    w๷ޚଆɺ1)1Ҏ֎ͷݴޠϑϨʔϜϫʔΫΛ૿΍͢

    View Slide

  30. จࣈྻΛӅ͍ͨ͠
    w(Pݴޠ੡ͷόΠφϦͰ΋ɺ΋ͪΖΜTUSJOHT
    ͳͲͰ߈ܸख๏ʹؔ
    ܎͢Δจࣈྻ͸ݟ͑ͯ͠·͏ɻ
    wจࣈσʔλΛ·ͱΊͯ֎෦͔Βఏڙͭͭɺ҉߸Խ͞ΕͨܗͰόΠφϦ
    ؚΉΑ͏ͳπʔϧΛ࡞ΕΔͱྑͦ͞͏ʁ
    wʢ΋ͪΖΜɺҰൠతͳ࿩ͰόΠφϦ಺ͷจࣈྻΛ҉߸Խͯ͠΋

    ɹͦΜͳʹηΩϡϦςΟରࡦʹ͸ͳΒͳ͍ɻΫΠζͷ೉қ౓తͳ࿩Ͱʣ

    View Slide

  31. View Slide

  32. PT&YJU

    View Slide