Embed Size (px)
Citation preview
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
K-공유기씹고뜯고맛보고즐기기
perillamint
September 3, 2015
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 1 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
IndexK-공유기?취약점공략포인트데이터추출바이너리역공학익스플로잇왜털렸는가보너스결론
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 2 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x00. K-공유기?*NIX 셸스크립트두명타요
I 대부분의가정마다한대쯤은있는물건
I 하지만,대부분의소비자는공유기의품질에대해신경쓰지않음I 기업은원가를절감하기위해,하드웨어와소프트웨어에대한투자를줄임
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 3 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x00. K-공유기?*NIX 셸스크립트두명타요
I 대부분의가정마다한대쯤은있는물건I 하지만,대부분의소비자는공유기의품질에대해신경쓰지않음
I 기업은원가를절감하기위해,하드웨어와소프트웨어에대한투자를줄임
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 3 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x00. K-공유기?*NIX 셸스크립트두명타요
I 대부분의가정마다한대쯤은있는물건I 하지만,대부분의소비자는공유기의품질에대해신경쓰지않음I 기업은원가를절감하기위해,하드웨어와소프트웨어에대한투자를줄임
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 3 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x00. K-공유기?*NIX 셸스크립트두명타요
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 4 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x00. K-공유기?*NIX 셸스크립트두명타요
I 대부분의가정마다한대쯤은있는물건I 하지만,대부분의소비자는공유기의품질에대해신경쓰지않음I 기업은원가를절감하기위해,하드웨어와소프트웨어에대한투자를줄임I 저렴한개발자들은,시큐어코딩의필요성을잘못느낌.
I 털기쉬울것같다. 열어보자
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 5 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x00. K-공유기?*NIX 셸스크립트두명타요
I 대부분의가정마다한대쯤은있는물건I 하지만,대부분의소비자는공유기의품질에대해신경쓰지않음I 기업은원가를절감하기위해,하드웨어와소프트웨어에대한투자를줄임I 저렴한개발자들은,시큐어코딩의필요성을잘못느낌.I 털기쉬울것같다. 열어보자
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 5 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
IndexK-공유기?취약점공략포인트데이터추출바이너리역공학익스플로잇왜털렸는가보너스결론
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 6 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x01. 취약점공략포인트공격벡터가될수있을만한것은?
I 공유기, aka. 홈라우터의하는일은?
I 라우팅I Network Address TranslationI 웹관리인터페이스서빙
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 7 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x01. 취약점공략포인트공격벡터가될수있을만한것은?
I 공유기, aka. 홈라우터의하는일은?I 라우팅I Network Address TranslationI 웹관리인터페이스서빙
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 7 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x01. 취약점공략포인트Running everything as a root is a bad idea.
I 공유기의웹관리인터페이스는공유기의라우팅, NAT등의설정을건드릴수있다.
I HTTP데몬이루트권한으로동작한다면,쉽게 /proc /sys 의파일들을조작하고 iptables 명령을실행할수있을것이다.
I 아마도제조사들은이방식으로웹관리페이지를구현했을것이다.I HTTP데몬을공략하자.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 8 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x01. 취약점공략포인트Running everything as a root is a bad idea.
I 공유기의웹관리인터페이스는공유기의라우팅, NAT등의설정을건드릴수있다.
I HTTP데몬이루트권한으로동작한다면,쉽게 /proc /sys 의파일들을조작하고 iptables 명령을실행할수있을것이다.
I 아마도제조사들은이방식으로웹관리페이지를구현했을것이다.
I HTTP데몬을공략하자.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 8 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x01. 취약점공략포인트Running everything as a root is a bad idea.
I 공유기의웹관리인터페이스는공유기의라우팅, NAT등의설정을건드릴수있다.
I HTTP데몬이루트권한으로동작한다면,쉽게 /proc /sys 의파일들을조작하고 iptables 명령을실행할수있을것이다.
I 아마도제조사들은이방식으로웹관리페이지를구현했을것이다.I HTTP데몬을공략하자.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 8 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
IndexK-공유기?취약점공략포인트데이터추출바이너리역공학익스플로잇왜털렸는가보너스결론
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 9 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x02. 펌웨어언팩Let’s walk on the binary
I Firmware 분석툴 binwalk
I
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 10 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x02. 펌웨어언팩Let’s walk on the binary
I Firmware 분석툴 binwalkI Binwalk is a firmware analysis tool designed for analyzing,
reverse engineering and extracting data contained in firmwareimages.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 10 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x02. 펌웨어언팩Let’s walk on the binary
I Firmware 분석툴 binwalkI Binwalk is a firmware analysis tool designed for analyzing,
reverse engineering and extracting data contained in firmwareimages.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 10 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x02. 펌웨어언팩Let’s walk on the binary
펌웨어엔트로피&시그너쳐분석알수있는것들
I 펌웨어이미지안의주요한시그너쳐의위치 (sqsh, bzipped data,etc..)
I 펌웨어이미지안의기계어코드의위치 (Function prologue/epilogue)
I 펌웨어이미지의엔트로피분석
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 11 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x02. 펌웨어언팩Let’s walk on the binary
펌웨어엔트로피&시그너쳐분석알수있는것들
I 펌웨어이미지안의주요한시그너쳐의위치 (sqsh, bzipped data,etc..)
I 펌웨어이미지안의기계어코드의위치 (Function prologue/epilogue)
I 펌웨어이미지의엔트로피분석
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 11 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x02. 펌웨어언팩Let’s walk on the binary
WeVO K501의엔트로피,옵코드,시그너쳐스캔결과
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 12 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x02. 펌웨어언팩Let’s walk on the binary펌웨어추출. binwalk 의 -e 옵션을사용하여펌웨어의섹션들을추출.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 13 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
IndexK-공유기?취약점공략포인트데이터추출바이너리역공학익스플로잇왜털렸는가보너스결론
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 14 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x03. 대상바이너리는어디에Init is always the first process
/etc/init.d/ 에는 init script 들이존재한다.열어서살펴보도록하자.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 15 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x03. 대상바이너리는어디에Init is the first process
/etc/init.d/rcS의마지막줄에서webs바이너리가실행되는것을볼수있다.해당바이너리는 /bin/webs 에위치한다.해당바이너리를분석해보자.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 16 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x04. 바이너리를까보자0x7F, 0x45, 0x4C, 0x46readelf -h webs
MIPS32 Big endian ELF 바이너리이다.perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 17 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x05. 취약점을찾아보자Running everything as root is bad idea
IDA - Interactive DisAssembler
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 18 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x05. 취약점을찾아보자system(3) is TERRIBLE idea
공략대상라이브러리콜: (취약할것같은것들)I system(3)I sprintf(3)I 기타BoF혹은인젝션을일으킬수있는함수들
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 19 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x05. 취약점을찾아보자system(3) is TERRIBLE idea
모든길은 system(3) 으로?
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 20 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x05. 취약점을찾아보자system(3) is TERRIBLE idea
DAFUQ? 사용자입력에 sprintf(3) 과 system(3)?해당함수가취약할것같다.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 21 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
IndexK-공유기?취약점공략포인트데이터추출바이너리역공학익스플로잇왜털렸는가보너스결론
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 22 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x06. 익스플로잇Exploits of a Mom
입력을넣어보자.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 23 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x06. 익스플로잇Exploits of a Mom
POST dest_ip 필드에 IP어드레스말고; wget -O /dev/null <someurl>;# 을넣어보자.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 24 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x06. 익스플로잇Exploits of a Mom
결과:
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 25 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x07. 데모Little bobby shells here
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 26 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
IndexK-공유기?취약점공략포인트데이터추출바이너리역공학익스플로잇왜털렸는가보너스결론
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 27 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x08. How system(3) and sprintf(3) hack worksInsane user inputs
How system(3) works:I fork(2) 를실행한다.
I
I 셸스크립트인젝션이가능하다!
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 28 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x08. How system(3) and sprintf(3) hack worksInsane user inputs
How system(3) works:I fork(2) 를실행한다.I 자식프로세스는 /bin/sh 를실행해,인자를셸스크립트로실행한다.
I 셸스크립트인젝션이가능하다!
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 28 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x08. How system(3) and sprintf(3) hack worksInsane user inputs
How system(3) works:I fork(2) 를실행한다.I 자식프로세스는 /bin/sh를실행해,인자를셸스크립트로실행한다.
I 셸스크립트인젝션이가능하다!
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 28 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x08. How system(3) and sprintf(3) hack worksInsane user inputs
How system(3) works:I fork(2) 를실행한다.I 자식프로세스는 /bin/sh를실행해,인자를셸스크립트로실행한다.I 셸스크립트인젝션이가능하다!
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 28 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x08. How system(3) and sprintf(3) worksInsane user inputs
How sprintf(3) works:I 주어진템플릿에주어진데이터를채워넣은것을크기검사없이주어진버퍼에집어넣는다
I 버퍼오버플로우가가능해진다.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 29 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x08. How system(3) and sprintf(3) worksInsane user inputs
How sprintf(3) works:I 주어진템플릿에주어진데이터를채워넣은것을크기검사없이주어진버퍼에집어넣는다
I 버퍼오버플로우가가능해진다.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 29 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x09. 막아보자Defensive programming
I system(3) 대신 fork(2) & execve(2) 를사용해자식프로세스를만든다.
I snprintf(3) 을사용해,유저데이터가버퍼밖으로벗어나지않도록한다.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 30 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x09. 막아보자Defensive programming
I system(3) 대신 fork(2) & execve(2) 를사용해자식프로세스를만든다.
I snprintf(3) 을사용해,유저데이터가버퍼밖으로벗어나지않도록한다.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 30 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
IndexK-공유기?취약점공략포인트데이터추출바이너리역공학익스플로잇왜털렸는가보너스결론
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 31 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x09. 제조사가펌웨어를안공개했다면?Hardware sorcery
UART를이용한장치의셸접근
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 32 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x09. 제조사가펌웨어를안공개했다면?Hardware sorcery
I2C를이용한 EEPROM덤프
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 33 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0A. Hardcoded & Default passwordsOne password to rule them all
어처구니없는모빌트인홈라우터의하드코드된백도어패스워드
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 34 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0A. Hardcoded & Default passwordsOne password to rule them all
그리고... 기본루트암호로열려있는텔넷....
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 35 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0A. Hardcoded & Default passwordsOne password to rule them all
KT하이브리드에그의개발용인터페이스
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 36 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
IndexK-공유기?취약점공략포인트데이터추출바이너리역공학익스플로잇왜털렸는가보너스결론
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 37 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0B. 결론
I 프로그래밍을할때, Malicious input 에대비해야한다.
I 만약,인젝션공격을허용하지않을수있는방법이있다면,그방법을택한다.
I 하드코드된관리용백도어는,관리자뿐만아니라,공격자도이용할수있음을생각해야한다.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 38 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0B. 결론
I 프로그래밍을할때, Malicious input 에대비해야한다.I 만약,인젝션공격을허용하지않을수있는방법이있다면,그방법을
택한다.
I 하드코드된관리용백도어는,관리자뿐만아니라,공격자도이용할수있음을생각해야한다.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 38 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0B. 결론
I 프로그래밍을할때, Malicious input 에대비해야한다.I 만약,인젝션공격을허용하지않을수있는방법이있다면,그방법을
택한다.I 하드코드된관리용백도어는,관리자뿐만아니라,공격자도이용할수
있음을생각해야한다.
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 38 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0C. 소비자레벨에서의대안은?Stock firmware sucks
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 39 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0D. 끝FIN
Q & A
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 40 / 41
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
...
.
Section
0x0E. LicenseCopyright (C) 2015 perillamintPermission is granted to copy, distribute and/or modify thisdocument under the terms of the GNU Free DocumentationLicense, Version 1.3 or any later version published by the FreeSoftware Foundation;with no Invariant Sections, no Front-Cover Texts, and noBack-Cover Texts. A copy of the license is included in the sectionentitled ”GNU Free Documentation License”.
Repository address:https://github.com/perillamint/K-HomeWRT-hack
perillamint K-공유기씹고뜯고맛보고즐기기 September 3, 2015 41 / 41
