ç§ãã¡ã¯ãããã«ãŒãã©ã®ããã«æªçšã«äŸåããŠãããã«ã€ããŠå®æçã«æžããŠããŸãã
äžæ¹ã§ãåŸæ¥å¡ãæªè
æ±ãããã€ããã¯ãããŸããã1984 幎ã®ãªãŒãŠã§ã«ã®æ代ãã®ãŸãŸã®ããžãã¹ç°å¢ã§åããã人ã¯ããªãããã§ãã 幞ããªããšã«ãå
éšé¢ä¿è
ã®ç掻ãããå°é£ã«ããå¯èœæ§ã®ããå®çšçãªæé ãã©ã€ãããã¯ãæ°å€ããããŸãã æ€èšãããŠããã ããŸã ç§å¯ã®æ»ææ¹æ³ãæè¡çèæ¯ãæã€åŸæ¥å¡ãããã«ãŒã«ãã£ãŠäœ¿çšãããŸãã ãããŠããã®ãããªãªã¹ã¯ã軜æžããããã®ãªãã·ã§ã³ã«ã€ããŠããå°ãè°è«ããŸããæè¡çãªãã·ã§ã³ãšçµç¹çãªãã·ã§ã³ã®äž¡æ¹ãæ€èšããŸãã
PsExec ã®äœãåé¡ãªã®ã§ãããã?
ãšãã¯ãŒãã»ã¹ããŒãã³ã¯ãè¯ããæªãããã€ã³ãµã€ããŒã«ããããŒã¿çªçã®ä»£åè©ãšãªã£ãŠããŸãã ã¡ãªã¿ã«ãå¿ããã«ã芧ãã ãã
代ããã«ãã¹ããŒãã³æ°ã¯ãœãŒã·ã£ã« ãšã³ãžãã¢ãªã³ã°ãå°ã䜿çšããã·ã¹ãã 管çè
ãšããŠã®ç«å Žãå©çšããŠãã¹ã¯ãŒããåéããè³æ Œæ
å ±ãäœæããŸããã äœãè€éãªããšã¯ãããŸãã - ãªã
çµç¹ã®åŸæ¥å¡ãåžžã«ã¹ããŒãã³æ°ãšåããããªç«å Žã«ããããã§ã¯ãããŸãããããæŸç§ã«ããçåããšããæŠå¿µããåŠã¶ã¹ãæèšã¯æ°å€ããããŸãã泚æãã¹ãããšã¯ãæ€åºãããå¯èœæ§ã®ããæªæã®ãã掻åã«ã¯é¢äžããªãããšãç¹ã«æ³šæãã¹ãããšã§ããè³æ Œæ å ±ã®äœ¿çšã«ã¯æ³šæããŠãã ããã ãã®èããæãåºããŠãã ããã
Mimikatz ã¯ãLSASS ããã»ã¹ãã NTLM ããã·ã¥ãã€ã³ã¿ãŒã»ããããããŒã¯ã³ãŸãã¯è³æ Œæ å ±ãæž¡ããŸã (ãããã)ã ãããã·ã¥ãæž¡ããæ»æ â psexec ã§ã¯ãæ»æè ãå¥ã®ãµãŒããŒã«ãã°ã€ã³ã§ããããã«ãªããŸãã å¥ã® ãŠãŒã¶ãŒã ãããŠããã®åŸæ°ãããµãŒããŒã«ç§»åãããã³ã«ãæ»æè ã¯è¿œå ã®èªèšŒæ å ±ãåéããå©çšå¯èœãªã³ã³ãã³ããæ€çŽ¢ããèœåã®ç¯å²ãæ¡å€§ããŸãã
åã㊠psexec ã䜿ãå§ãããšããããã¯éæ³ã®ããã«æããŸãã - ããããšã
psexec ã«é¢ããæåã®èå³æ·±ãäºå®ã¯ãéåžžã«è€éãªæ©èœã䜿çšããŠããããšã§ãã SMBãããã¯ãŒã¯ãã¡ã€ã«ãããã³ã« ãã€ã¯ããœããããã SMB ã䜿çšãããšãpsexec ã®è»¢ééã¯å°ãããªããŸã ãã€ã㪠ãã¡ã€ã«ãã¿ãŒã²ãã ã·ã¹ãã ã«ã³ããŒããC:Windows ãã©ã«ãã«çœ®ããŸãã
次ã«ãpsexec ã¯ãã³ããŒãããã€ããªã䜿çšã㊠Windows ãµãŒãã¹ãäœæããéåžžã«ãäºæããªããåå PSEXECSVC ã§å®è¡ããŸãã åæã«ãç§ãšåãããã«ããªã¢ãŒã ãã·ã³ãç£èŠããããšã§ãããããã¹ãŠãå®éã«èŠãããšãã§ããŸã (以äžãåç §)ã
Psexec ã®ãã¬ãã³ã«ãŒã:ãPSEXECSVCããµãŒãã¹ã SMB çµç±ã§ C:Windows ãã©ã«ããŒã«é 眮ããããã€ã㪠ãã¡ã€ã«ãå®è¡ããŸãã
æåŸã®ã¹ããããšããŠãã³ããŒããããã€ã㪠ãã¡ã€ã«ãéããŸãã RPCæ¥ç¶ ã¿ãŒã²ãã ãµãŒããŒã«éä¿¡ããå¶åŸ¡ã³ãã³ãã (ããã©ã«ãã§ã¯ Windows cmd ã·ã§ã«çµç±ã§) åãå ¥ããŠèµ·åããå ¥åãšåºåãæ»æè ã®ããŒã ãã·ã³ã«ãªãã€ã¬ã¯ãããŸãã ãã®å Žåãæ»æè ã«ã¯çŽæ¥æ¥ç¶ãããŠããå Žåãšåãããã«ãåºæ¬çãªã³ãã³ã ã©ã€ã³ã衚瀺ãããŸãã
ã³ã³ããŒãã³ãããããããããéåžžã«éšã ããããã»ã¹ã§ãã
psexec ã®è€éãªå éšæ§é ã¯ãæ°å¹Žåã®æåã®ãã¹ãäžã«ç§ãå°æãããã¡ãã»ãŒãžãStarting PSEXECSVC...ãã®åŸã«ã³ãã³ã ããã³ããã衚瀺ãããåã«äžæåæ¢ããã¡ãã»ãŒãžã説æããŠããŸãã
Impacket ã® Psexec ã¯å®éã«å éšã§äœãèµ·ãã£ãŠãããã瀺ããŸãã
åœç¶ã®ããšã§ãããpsexec ã¯å
éšã§èšå€§ãªéã®äœæ¥ãè¡ã£ãŠããŸããã ããã«è©³ãã説æãæ°ã«ãªãæ¹ã¯ãã¡ããã芧ãã ãã
æããã«ãã·ã¹ãã 管çããŒã«ãšããŠäœ¿çšãããå Žåã æ¬æ¥ã®ç®ç psexec ãããããã¹ãŠã® Windows ã¡ã«ããºã ã®ããã¶ãŒé³ãã«ã¯äœãåé¡ã¯ãããŸããã ããããæ»æè ã«ãšã£ãŠ psexec ã¯è€éãªåé¡ãåŒãèµ·ããå¯èœæ§ããããã¹ããŒãã³ã®ãããªæ éã§ç¡çŸãªå éšé¢ä¿è ã«ãšã£ãŠãpsexec ãŸãã¯åæ§ã®ãŠãŒãã£ãªãã£ã¯ãªã¹ã¯ã倧ããããŸãã
ãããŠSmbexecãç»å ŽããŸã
SMB ã¯ããµãŒããŒéã§ãã¡ã€ã«ã転éããããã®å·§åŠãã€ç§å¯ã®æ¹æ³ã§ãããããã«ãŒã¯äœäžçŽã«ãããã£ãŠ SMB ã«çŽæ¥äŸµå
¥ããŠããŸããã 䟡å€ããªãããšã¯ãã誰ããç¥ã£ãŠãããšæããŸã
Defcon 2013 ã§ããšãªãã¯ã»ãã«ãã³ (
psexecãsmexec ãšã¯ç°ãªããŸãã é¿ãã æ€åºãããå¯èœæ§ã®ãããã€ã㪠ãã¡ã€ã«ãã¿ãŒã²ãã ãã·ã³ã«è»¢éããŸãã 代ããã«ããã®ãŠãŒãã£ãªãã£ã¯æŸç§ããç«ã¡äžããŸã§å®å šã«åç¶ããŸãã ããŒã«ã« Windowsã®ã³ãã³ãã©ã€ã³ã
ãã®åäœã¯æ¬¡ã®ãšããã§ããSMB çµç±ã§æ»æãã·ã³ããã®ã³ãã³ããç¹å¥ãªå ¥åãã¡ã€ã«ã«æž¡ããLinux ãŠãŒã¶ãŒã«ã¯éŠŽæã¿ã®ããè€éãªã³ãã³ã ã©ã€ã³ (Windows ãµãŒãã¹ã®ãããª) ãäœæããŠå®è¡ããŸãã ã€ãŸãããã€ãã£ã Windows cmd ã·ã§ã«ãèµ·åããåºåãå¥ã®ãã¡ã€ã«ã«ãªãã€ã¬ã¯ãããSMB çµç±ã§æ»æè ã®ãã·ã³ã«éãè¿ããŸãã
ãããç解ããæè¯ã®æ¹æ³ã¯ãã³ãã³ã ã©ã€ã³ã確èªããããšã§ããã³ãã³ã ã©ã€ã³ã¯ã€ãã³ã ãã°ããå ¥æã§ããŸãã (以äžãåç §)ã
ãã㯠I/O ããªãã€ã¬ã¯ãããããã®æè¯ã®æ¹æ³ã§ã¯ãªãã§ãããã? ã¡ãªã¿ã«ãµãŒãã¹äœæã¯ã€ãã³ãIDã7045ã§ãã
psexec ãšåæ§ã«ããã¹ãŠã®äœæ¥ãå®è¡ãããµãŒãã¹ãäœæããŸããããã®åŸã®ãµãŒãã¹ã¯ åé€ãããŸãã â ã³ãã³ããå®è¡ããããã«äžåºŠã ã䜿çšããããã®åŸã¯æ¶ããŠããŸããŸãã 被害è ã®ãã·ã³ãç£èŠããŠããæ å ±ã»ãã¥ãªãã£æ åœè ã¯ããããæ€åºããããšã¯ã§ããŸããã æãã æ»æã®å å: æªæã®ãããã¡ã€ã«ãèµ·åãããããšã¯ãªããæ°žç¶çãªãµãŒãã¹ãã€ã³ã¹ããŒã«ãããããšããããŸãããSMB ãããŒã¿è»¢éã®å¯äžã®æ段ã§ãããããRPC ã䜿çšããã圢跡ããããŸããã çŽ æŽãããïŒ
æ»æè åŽããèŠããšãã³ãã³ãã®éä¿¡ãšå¿çã®åä¿¡ã®éã«é 延ããããæ¬äŒŒã·ã§ã«ããå©çšå¯èœã«ãªããŸãã ããããæ»æè (å éšé¢ä¿è ãŸãã¯ãã§ã«è¶³å Žãç¯ããŠããå€éšããã«ãŒ) ãèå³æ·±ãã³ã³ãã³ããæ¢ãå§ããã«ã¯ãããã§ååã§ãã
ã¿ãŒã²ãããã·ã³ããæ»æè
ã®ãã·ã³ã«ããŒã¿ãåºåããããã«äœ¿çšãããŸãã
äžæ©äžãã£ãŠããããåŸæ¥å¡ã«äœãã§ããããèããŠã¿ãŸãããã ç§ã®æ¶ç©ºã®ã·ããªãªã§ã¯ãããã¬ãŒãéèã¢ããªã¹ãããŸãã¯é«çµŠåãã®ã»ãã¥ãªã㣠ã³ã³ãµã«ã¿ã³ããä»äºã§ç§çšã®ã©ãããããã䜿çšããããšãèš±å¯ãããŠãããšããŸãã éæ³ã®ãããªããã»ã¹ã®çµæã圌女ã¯äŒç€Ÿã«è ¹ãç«ãŠãããã¹ãŠãæªåãããŸãã ã©ãããããã®ãªãã¬ãŒãã£ã³ã° ã·ã¹ãã ã«å¿ããŠãImpact ã® Python ããŒãžã§ã³ããŸã㯠.exe ãã¡ã€ã«ãšã㊠Windows ããŒãžã§ã³ã® smbexec ãŸã㯠smbclient ã䜿çšãããŸãã
ã¹ããŒãã³ãšåãããã«ã圌女ãè©è¶ãã«å¥ã®ãŠãŒã¶ãŒã®ãã¹ã¯ãŒããèŠã€ãããã幞éã«ããã¹ã¯ãŒããèšèŒãããããã¹ã ãã¡ã€ã«ãèŠã€ãããããŸãã ãããŠããããã®è³æ Œæ å ±ãå©çšããŠãæ°ããã¬ãã«ã®æš©éã§ã·ã¹ãã ã調æ»ãå§ããŸãã
DCC ã®ãããã³ã°: ãæããªãããã«ããã¯å¿ èŠãããŸãã
䟵å
¥ãã¹ãã«é¢ãã以åã®æçš¿ã§ã¯ãmimikatz ãé »ç¹ã«äœ¿çšããŸããã ããã¯ãã©ãããããå
ã«é ããã䜿çšãããã®ãåŸ
ã£ãŠãã NTLM ããã·ã¥ãã¯ãªã¢ããã¹ã ãã¹ã¯ãŒããªã©ãè³æ Œæ
å ±ãååããããã®åªããããŒã«ã§ãã
æãå€ãã£ãã ç£èŠããŒã«ã¯ãmimikatz ã®æ€åºãšãããã¯ã«ãããŠããåªããŠããŸãã æ
å ±ã»ãã¥ãªãã£ç®¡çè
ã«ã¯ãã㹠㶠ããã·ã¥ (PtH) æ»æã«é¢é£ãããªã¹ã¯ã軜æžããããã®ãªãã·ã§ã³ãå¢ããŸããã
ã§ã¯ãè³¢ãåŸæ¥å¡ã mimikatz ã䜿çšããã«è¿œå ã®èªèšŒæ
å ±ãåéããã«ã¯ã©ãããã°ããã§ãããã?
Impacket ã®ãããã«ã¯ããšåŒã°ãããŠãŒãã£ãªãã£ãå«ãŸããŠããŸã
DCC ããã·ã¥ã¯ã NTML ããã·ã¥ã§ã¯ãªã ãããŠããã® PtHæ»æã«ã¯äœ¿çšã§ããŸãã.
ãŸããå
ã®ãã¹ã¯ãŒããååŸããããã«ãããããããã³ã°ããããšããããšãã§ããŸãã ããããMicrosoft 㯠DCC ã«é¢ããŠããè³¢ããªã£ãŠãããDCC ããã·ã¥ã解èªããã®ã¯éåžžã«å°é£ã«ãªã£ãŠããŸãã ã¯ããæã£ãŠããŸã
代ããã«ãã¹ããŒãã³ã®ããã«èããŠã¿ãŸãããã åŸæ¥å¡ã¯å¯Ÿé¢ã§ãœãŒã·ã£ã« ãšã³ãžãã¢ãªã³ã°ãå®è¡ãããã¹ã¯ãŒãã解èªããã人ç©ã«é¢ããæ å ±ãèŠã€ããããšãã§ããå¯èœæ§ããããŸãã ããšãã°ããã®äººã®ãªã³ã©ã€ã³ ã¢ã«ãŠã³ãããããã³ã°ãããããšããããã©ããã調ã¹ãã¯ãªã¢ããã¹ãã®ãã¹ã¯ãŒãã«æãããããªãã調ã¹ãŸãã
ãããŠããããç§ãæ¡çšããããšã«æ±ºããã·ããªãªã§ãã å éšé¢ä¿è ããäžåžã® Cruella ãããŸããŸãª Web ãªãœãŒã¹ã§æ°åãããã³ã°ãããããšãç¥ã£ããšä»®å®ããŸãã ãããã®ãã¹ã¯ãŒãã®ããã€ããåæããåŸã圌ã¯ãã¯ã«ãšã©ãéçããŒã åãã€ã³ããŒã¹ãã®åŸã«çŸåšã®å¹Žã®ãã€ã³ããŒã¹ 2015ããšãã圢åŒã䜿çšããããšã奜ãã§ããããšã«æ°ä»ããŸããã
ãããèªå®
ã§åçŸãããå Žåã¯ãå°ããªãCããããŠã³ããŒãããŠãã ããã
å éšé¢ä¿è ã®åœ¹å²ãè£ ããããã€ãã®ç°ãªãçµã¿åãããè©Šããçµæãæçµçã«ã¯ã«ãšã©ã®ãã¹ã¯ãŒãããYankees2019ãã§ããããšãçºèŠããããšãã§ããŸãã (äžèšãåç §)ã äœæŠå®äºïŒ
å°ãã®ãœãŒã·ã£ã« ãšã³ãžãã¢ãªã³ã°ãå°ãã®å ãããããŠå°ãã® Maltego ã䜿ãã°ãDCC ããã·ã¥ã®è§£èªã«åããŠé 調ã«é²ãã§ããŸãã
ããã§çµããã«ããããšããå§ãããŸãã ä»ã®æçš¿ã§ãã®ãããã¯ã«æ»ããImpacket ã®åªãããŠãŒãã£ãªã㣠ã»ãããåºã«ããŠãããã«äœéã§ã¹ãã«ã¹ãªæ»ææ¹æ³ãæ€èšããŠãããŸãã
åºæïŒ habr.com