Upgrade to Pro — share decks privately, control downloads, hide ads and more …

オンラインCTFを支えるインフラ環境

 オンラインCTFを支えるインフラ環境

第1回 筑前情報セキュリティ勉強会

Shumpei Urabe

April 29, 2017
Tweet

More Decks by Shumpei Urabe

Other Decks in Programming

Transcript

  1. ΦϯϥΠϯ$5'Λࢧ͑Δ
    Πϯϑϥ؀ڥ
    $IJLVTFO*OGPSNBUJPO4FDVSJUZ
    1SFTFOUFECZ4IVNQFJ6SBCF

    View full-size slide

  2. ࣗݾ঺հ
    w ॴଐɿ෱Ԭ޻ۀେֶେֶ೥
    w झຯɿ-JOVYΧʔωϧͷղੳ ٯΞηϯϒϧ
    w ݚڀɿࣗવݴޠॲཧ ػցֶश
    w 08"41,ZVTIV$IBQUFS#PBSE.FNCFS
    w '*5)"$,Πϯϑϥ؅ཧϦʔμʔ

    View full-size slide

  3. ϋογϡλά
    w DIJLV@TFD
    w 5XJUUFS΍.BTUPEPOͳͲͰ৭ʑͳ͜ͱΛੋඇͭͿ΍͍
    ͍ͯͩ͘͞ʂ

    View full-size slide

  4. "HFOEB
    '*5)"$,$5'ͷ։࠵໨త
    είΞΞϓϦέʔγϣϯʹ͍ͭͯ
    είΞαʔόͷӡ༻ܗଶ
    ֤໰୊͝ͱͷӡ༻ܗଶ
    %%P4΁ͷରࡦํ๏
    ·ͱΊ

    View full-size slide

  5. '*5)"$,$5'ͷ։࠵໨త

    View full-size slide

  6. '*5)"$,$5'ͷ։࠵໨త
    $5'ͷࠃ಺ීٴਪਐ

    View full-size slide

  7. '*5)"$,$5'ͷ։࠵໨త

    View full-size slide

  8. '*5)"$,$5'ͷ։࠵໨త

    View full-size slide

  9. '*5)"$,$5'ͷ։࠵໨త
    w $5'ͱ͸ ৘ใηΩϡϦςΟΛςʔϚʹͨ͠ڝٕͷ૯শ
    w ຖि ΦϯϥΠϯ্Ͱ༷ʑͳେձ͕։͔Ε͍ͯΔ
    w ϑϥάͱݺ͹ΕΔจࣈྻΛ୳͠ग़͢͜ͱ͕໨త
    w ਖ਼͍͠ϑϥάΛखʹ͍ΕΔ͜ͱ͕ग़དྷΕ͹఺਺͕΋Β͑Δ
    w ࠷ऴతͳ૯߹఺਺Λڝ͍߹͏

    View full-size slide

  10. '*5)"$,$5'ͷ։࠵໨త
    $5'͕Կނྲྀߦ͍ͬͯΔͷ͔ʁ
    w ໰୊͕෼͔Βͳ͍࣌ͷࢼߦࡨޡ͍ͯ͠Δָ͕͍࣌ؒ͠
    w ଞͷνʔϜʹෛ͚ͨ͘ͳ͍ͱ͍͏ڝ૪৺͕਎ʹͭ͘
    w 8SJUF6Qͱݺ͹ΕΔղ๏Λޙ೔ެ։͢Δ׳श͕͋Δͷ
    Ͱ ਓͷղ͖ํΛݟͳ͕ΒֶͿ͜ͱ͕Ͱ͖Δ

    View full-size slide

  11. '*5)"$,$5'ͷ։࠵໨త
    $5'ʹऔΓ૊Έ͜ͱͷϝϦοτ
    w ήʔϜײ֮Ͱ*$5 ৘ใ௨৴ٕज़
    ʹ͍ͭͯ෯޿͍ٕज़ɾ
    ஌ࣝΛֶͿ͜ͱ͕Ͱ͖Δ
    w ߴ౓ͳηΩϡϦςΟٕज़ʹؔ͢Δؔ৺͕ਂ·Δ
    w ໰୊ղܾೳྗͷ޲্

    View full-size slide

  12. '*5)"$,$5'ͷ։࠵໨త
    ֶੜओମͷ$5'େձ
    w 5PLZP8FTUFSOT.."$5'OE
    w ిؾ௨৴େֶ౦ژ೶ۀେֶ
    w "J[V$5'
    w ձ௡େֶ
    w $QBX$5'
    w ๏੓େֶ޻ֶӃେֶ
    ͳͲͳͲ

    View full-size slide

  13. '*5)"$,$5'ͷ։࠵໨త
    ۝भͰ΋$5'ΛྲྀߦΒ͍ͤͨʂ

    View full-size slide

  14. '*5)"$,$5'ͷ։࠵໨త
    ࠓ·ͰऔΓ૊ΜͰ͖ͨ͜ͱ
    w ֶ಺Ͱ$5'ͷษڧձΛ࣮ࢪ
    w େࡕ΍౦ژͳͲͰߦΘΕΔେձʹੵۃతʹग़৔
    w தֶੜ΍ߴߍੜΛର৅ͱͨ͠৘ใηΩϡϦςΟͷߨ࿩Λ
    ։࠵

    View full-size slide

  15. '*5)"$,$5'ͷ։࠵໨త
    ࠓճ΍Γ͍ͨ͜ͱ
    w ৘ใηΩϡϦςΟॳ৺ऀͰ΋௅ઓग़དྷͯ ্ڃऀʹ΋ָ͠Μ
    Ͱ΋Β͑ΔେձΛ։࠵͍ͨ͠
    w ෱Ԭࢢ౦۠Λڌ఺ʹ શੈքʹ$5'ͷϜʔϒϝϯτΛ޿͛ͯ
    ߦ͖͍ͨ
    w ڠࢍͯ͘͠ΕΔஂମΛݟ͚͍ͭͨʂ

    View full-size slide

  16. '*5)"$,$5'ͷ։࠵໨త
    w ͜ͷΑ͏ͳࢥ͍͔Βࡢ೥ͷ݄ʹϓϩδΣΫτ͕࢝ಈ
    w ։࠵ܦݧ͕શ͘ͳ͍ͷͰ ͔̌Βελʔτͨ͠
    w ૯੎ϝϯόʔ໊ͱ͍͏গਓ਺Ͱ͋Δ͕ ͓ޓ͍͕ڠྗ
    ͠ͳ͕Βؤுͬͯ։࠵·Ͱ࣋ͪӽͤͨ

    View full-size slide

  17. είΞΞϓϦέʔγϣϯʹ͍ͭͯ

    View full-size slide

  18. είΞΞϓϦέʔγϣϯʹ͍ͭͯ
    w ΦʔϓϯιʔεͰ։ൃ͞Ε͍ͯΔʰ$5'EʱΛར༻
    w ೔ʹճίϛοτ͞Ε͍ͯΔ΄Ͳ։ൃεϐʔυ͕ૣ͍
    w "QBDIFW-JDFOTFͳͷͰɺ݁ߏࣗ༝ʹվมͯ͠΋େৎ෉
    w $5'είΞΞϓϦέʔγϣϯͷσϑΝΫτελϯμʔυʹ
    ͳΓͭͭ͋Δ

    View full-size slide

  19. είΞΞϓϦέʔγϣϯʹ͍ͭͯ
    w $5'E͸1ZUIPOͷܰྔͳ8FC"QQMJDBUJPO'SBNFXPSL
    Ͱ͋Δl'MBTLzͰ։ൃ͞Ε͍ͯΔ
    w %BUBCBTF෦෼͸42-"DBEFNZͰ࣮૷͞Ε͍ͯΔ
    w %#Ωϟογϡʹ'MBTL$BDIJOHΛར༻͍ͯ͠Δ
    w σϞαΠτˠIUUQTEFNPDUGEJP

    View full-size slide

  20. είΞΞϓϦέʔγϣϯʹ͍ͭͯ
    'MBTL
    w 1ZUIPOͷ਺͋Δ΢ΣϒΞϓϦέʔγϣϯϑϨʔϜϫʔ
    ΫͷதͰ΋ൺֱతܰྔ
    w σόοΨ͕༏ल
    w ςϯϓϨʔτΤϯδϯʹ+JOKBΛ࠾༻
    w ΊͬͪΌ؆୯ʹॻ͚Δʂ

    View full-size slide

  21. είΞΞϓϦέʔγϣϯʹ͍ͭͯ
    42-"DBEFNZ
    w 1ZUIPOͷΦϒδΣΫτؔ܎Ϛοϐϯάͱͯ͠Α͘࢖Θ
    ΕΔϥΠϒϥϦ
    w .Z42- 1PTUHSF42- 42-JUFͳͲ༷ʑͳϑΥʔϚοτ
    ʹରԠ͍ͯ͠Δ͕ͪΐͬͱ೉͕͋Δ
    w ࠓճ͸42-"DBEFNZΛར༻͠ .Z42-Λબ୒

    View full-size slide

  22. είΞΞϓϦέʔγϣϯʹ͍ͭͯ
    'MBTL$BDIJOH
    w 'MBTLʹ͓͍ͯΩϟογϡγεςϜΛ௥Ճͯ͘͠ΕΔ
    1ZUIPOϞδϡʔϧ
    w ࠓճ͸ηογϣϯ؅ཧͷͨΊʹར༻ͨ͠
    w ΩϟογϡγεςϜʹ3FEJT͕࢖͑ΔͷͰ͓ಘʂ

    View full-size slide

  23. είΞΞϓϦέʔγϣϯʹ͍ͭͯ
    4MBDLͱͷ࿈ܞ
    w ࠓճ $5'ͷϩάΛ4MBDLʹྲྀͯ͠ ۓٸ࣌ʹଈରԠ͕ग़དྷΔମ੍
    Λ੔͑·ͨ͠
    w TIJOLBO@LFZTࢀՃऀ͕ೖྗͨ͠ϑϥάͷϩά
    w TIJOLBO@MPHJOࢀՃऀͷϩάΠϯʹؔ͢Δϩά
    w TIJOLBO@SFHJTUFSνʔϜొ࿥͞Εͨ࣌ʹྲྀΕΔϩά

    View full-size slide

  24. είΞΞϓϦέʔγϣϯʹ͍ͭͯ

    View full-size slide

  25. είΞΞϓϦέʔγϣϯʹ͍ͭͯ
    ಈ࡞ը໘
    w ࣮ࡍʹ͓ݟͤ͠·͢ʂ

    View full-size slide

  26. είΞαʔόʔͷӡ༻ܗଶ

    View full-size slide

  27. είΞαʔόʔͷӡ༻ܗଶ
    είΞαʔόʔ
    ֶ಺

    ͘͞Βͷ΢ΣϒΞΫηϥ
    Ϩʔλʔ
    *OUFSOFU

    View full-size slide

  28. είΞαʔόʔͷӡ༻ܗଶ
    w ͘͞Βͷ΢ΣϒΞΫηϥϨʔλʔ
    w సૹྔ͕(J#·ͰແྉͰ࢖͑Δ
    w ౦ژͱେࡕͷ̎ڌ఺ʹ෼ࢄ͍ͯ͠ΔΒ͍͠
    w )551ରԠ
    w ಠࣗυϝΠϯ44-ূ໌ॻʹରԠʂ

    View full-size slide

  29. είΞαʔόʔͷӡ༻ܗଶ

    View full-size slide

  30. είΞαʔόʔͷӡ༻ܗଶ
    w "NB[PO4
    w ໰୊ϑΝΠϧɾ੩తϑΝΠϧ഑৴ʹར༻
    w ࠷ॳ͸ ͘͞ΒͷΦϒδΣΫτετϨʔδΛ࠾༻༧ఆ
    ͕ͩͬͨ ৭ʑͳ໰୊͕ൃੜͨ͠ͷͰऔΓফ͠
    w $5'Eͷ"NB[PO4ϓϥάΠϯ͕1ZUIPOܥʹඇର
    ԠͩͬͨͷͰ Ұ͔Βॻ͖௚ͨ͠

    View full-size slide

  31. είΞαʔόʔͷӡ༻ܗଶ

    View full-size slide

  32. είΞαʔόʔͷӡ༻ܗଶ
    w ֶ಺αʔόʔ
    w ݚڀࣨʹ୆ઃஔ
    w ୆͸είΞαʔόʔɺ࢒Γͷ୆͸;BCCJY؂ࢹ΍*3$
    ؂ࢹʹར༻
    w 04͸શͯ6CVOUVΛಋೖ

    View full-size slide

  33. είΞαʔόʔͷӡ༻ܗଶ
    w ߏ੒
    w "QQMJDBUJPO-PBE#BMBODFSº
    w "QQMJDBUJPO4FSWFSº
    w .Z42--PBE#BMBODFSº
    w .Z42-4FSWFSº

    View full-size slide

  34. είΞαʔόʔͷӡ༻ܗଶ

    View full-size slide

  35. είΞαʔόʔͷӡ༻ܗଶ
    "QQMJDBUJPO-PBE#BMBODFS /HJOY

    w /HJOYΛ࠾༻ɻѹ౗తͳ҆ఆੑ
    w ୆ͷ"QQMJDBUJPO4FSWFS $5'E
    Λ6QTUFBNͰެฏ෼ࢄ
    w ෛՙΛग़དྷΔݶΓগͳ͍ͨ͘͠ͷͰ τοϓϖʔδͳͲ͸
    DBDIF@QVSHFͰΩϟογϡͤͨ͞

    View full-size slide

  36. είΞαʔόʔͷӡ༻ܗଶ
    "QQMJDBUJPO4FSWFS $5'E3FEJT

    w 'MBTLͷඪ४8FCαʔόʔΛར༻
    w $5'Eͷެࣜ8JLJʹ͸ඇਪ঑ѻ͍͞Ε͍ͯΔ͕Ҋ֎༨༟Ͱಈ͘
    w ୆ͷαʔόʔͷηογϣϯΛ౷Ұ͍ͤͨ͞ͷͰ3FEJT$MVTUFSΛߏ੒
    w 3FEJT$MVTUFSΛߦ͏ࡍ ࣗϊʔυ͸MPDBMIPTUʹ͠ͳ͍ͱ͏·͘ΫϥελϦϯά͕
    ߦ͑ͳ͍
    w 1ZUIPOͷ3FEJTϥΠϒϥϦ͕ࣗϊʔυ͔͠ೝࣝ͠ͳ͍ͬΆ͍ͷͰύονΛ౰ͯͨ

    View full-size slide

  37. είΞαʔόʔͷӡ༻ܗଶ
    .Z42--PBE#BMBODFS .Z42-3PVUFS

    w .Z42-3PVUFSΛར༻
    w ಁաతͳϧʔςΟϯάΛߦͳͬͯ͘ΕΔͨΊɺΞϓϦέʔ
    γϣϯαʔόʔ͸Կ΋ઃఆͤͣʹউखʹ෼ࢄͯ͘͠ΕΔ
    w ͳͥϧʔςΟϯά͢Δඞཁ͕͋Δ͔͸࣍ͷεϥΠυͰઆ໌͠
    ·͢ʂ

    View full-size slide

  38. είΞαʔόʔͷӡ༻ܗଶ

    View full-size slide

  39. είΞαʔόʔͷӡ༻ܗଶ
    .Z42-4FSWFS .BSJB%#(BMFSB$MVTUFS

    w .BSJB%#(BMFSB$MVTUFS
    w .BSJB%#Ҏ্ʹೖ͍ͬͯΔ΍ͭɻଘࡏײ͕ബ͗ͯ͢୭΋
    ࢖͍ͬͯͳ͍ɻ
    w ཁ͸.BSJB%#ͷΫϥελϦϯάϞʔυ
    w ϊʔυʹॴଐ͢Δશͯͷ%#αʔόʔ͕.BTUFSߏ੒ʹͳ͍ͬͯΔ

    View full-size slide

  40. είΞαʔόʔͷӡ༻ܗଶ

    View full-size slide

  41. είΞαʔόʔͷӡ༻ܗଶ
    ։࠵ظؒதͷΞΫηε਺

    View full-size slide

  42. είΞαʔόʔͷӡ༻ܗଶ
    w ڝٕ։࢝௚ޙͱऴྃ௚લ͕Ұ൪ΞΫηε͕དྷͨ
    ͓ΑͦສΞΫηε

    View full-size slide

  43. είΞαʔόʔͷӡ༻ܗଶ
    w ·ͱΊ
    w ΦϯϓϨͰӡ༻͢Δͷਏ͗͢ɾɾɾ
    w ͪͳΈʹ։࠵͢Δिؒલʹߏங࢝Ί·ͨ͠
    w ։࠵ऴྃ·ͰҰ౓΋མͪΔ͜ͱ͕ͳ͘ӡ༻Ͱ͖ͯΑ͔ͬ
    ͨʂ

    View full-size slide

  44. ֤໰୊͝ͱͷӡ༻ܗଶ

    View full-size slide

  45. ֤໰୊͝ͱͷӡ༻ܗଶ
    ໰୊αʔό
    w ͘͞ΒͷΫϥ΢υɹ౦ژୈκʔϯ
    w 6CVOUV
    w ίΞ(#ΛϕʔεʹඞཁʹԠͯ͡"VUP4DBMJOH
    w ͭͷ໰୊ʹ͖ͭ ΠϯελϯεΛফඅ
    w ໰୊ߏங͸࡞໰ऀ͕୲౰ͨ͠ͷͰ ͲΜͳߏ੒͔͸͋·Γ෼͔Βͳ
    ͍ɾɾɾ

    View full-size slide

  46. ֤໰୊͝ͱͷӡ༻ܗଶ
    ͘͞ΒͷΫϥ΢υͰ"VUP4DBMJOH͢Δํ๏
    w ࠓճ͸TBLMJFOUΛར༻͠ɺ1ZUIPOͰ-"Λ؂ࢹ
    w ᮢ஋Λ௒͑Δͱɺ͋Β͔͡Ί࡞੒͞ΕͨΞʔΧΠϒ͔Β
    ৽نͰαʔόʔΛ࡞੒͠ɺ(4-#ʹ*1ΞυϨεΛ௥Ճ
    w ͓͔͛Ͱ΄΅མͪΔ͜ͱͳ͘ӡ༻Λଓ͚ΒΕͨ

    View full-size slide

  47. ֤໰୊͝ͱͷӡ༻ܗଶ
    8FC໰୊
    w /HJOY
    w 1)11)1Λ'BTU$(*Ͱ੾Γସ͑
    w 4&-JOVYΛ&OGPSDFEʹઃఆ

    View full-size slide

  48. %%P4΁ͷରࡦํ๏

    View full-size slide

  49. %%P4΁ͷରࡦํ๏
    w Πϯϑϥӡ༻ͰҰ൪ॏཁͳͷ͸%%P4߈ܸ
    w $5'ͷੑ্࣭ %%P4߈ܸΛආ͚ΒΕͳ͍
    w ࣙॻܕ߈ܸ /NBQ 42-.BQͳͲ
    w Լखʹ#"/Λ͢Δͱɺਖ਼نϓϨΠϠʔ·ͰӨڹ͕ग़ͯ
    ͠·͏

    View full-size slide

  50. %%P4΁ͷରࡦํ๏
    w είΞαʔόʔͰͷ%%P4ରࡦ
    w جຊతʹ$%/Λ௨͍ͯ͠ΔͨΊ Ұ൪ωοΫͳ෦෼͸
    ͘͞ΒΠϯλʔωοτଆ͕ؤு͍ͬͯΔͷͰେৎ෉
    w ϑϥάΛ૯౰ͨΓͯ͠աෛՙʹͳΔ͜ͱΛආ͚ΔͨΊ
    ʹ෼ؒͷ࠷େೖྗճ਺Λઃఆ 'MBTLͷϓϥάΠϯͰ
    ࣮૷

    View full-size slide

  51. %%P4΁ͷରࡦํ๏
    w είΞαʔόʔͰͷ%%P4ରࡦ
    w ֶ಺ଆͷରࡦ
    w 1BMP"MUP/FUXPSLTͷ1"
    w جຊతͳ8"'ػೳ΍%%P4߈ܸݕ஌͕౥ࡌ͞Ε͍ͯΔΒ͍͠


    w ·ͱΊɿେֶͷ͓ۚͰԥͬͨ

    View full-size slide

  52. %%P4΁ͷରࡦํ๏
    w ໰୊αʔόʔͰͷ%%P4ରࡦ
    w ΢Σϒ໰୊ͷ৔߹͸/HJOYΛར༻͍ͯ͠ΔͷͰɺॠؒಉ࣌Ϧ
    ΫΤετ਺Λݟͯɺ͋·Γʹ΋ଟ͍ͱΤϥʔΛฦ͢Ϟ
    δϡʔϧΛ࡞੒
    w 1XO໰୊ͷ৔߹͸-JOVYͷΧʔωϧϞδϡʔϧΛ࡞ͬͯ
    DISPPUΛಠࣗͰ࣮૷ɻ·ͨ࠷େίωΫγϣϯ਺΋੍ݶͨ͠ɻ

    View full-size slide

  53. ·ͱΊ
    w $5'Λ։࠵͢Δͱ͖͸աෛՙʹؾΛ͚ͭΑ͏
    w Ұ൪ωοΫͳͷ͕%#෦෼ͳͷͰ ΫϥελϦϯάͰѹ౗
    త੒௕
    w ৭ʑେมͰ͕ͨ͠ɺྑ͍ܦݧʹͳΓ·ͨ͠ʂ

    View full-size slide