=== ch10.docx
[chap]10́@ZLeB̂߂̃pPbg

{̑唼̓pPbg͂𗘗plbg[ÑguV[eBOɊĂ܂Aɂ͂Ȃ̃pPbg͂ZLeBΉƂčsĂ܂B͕sN҂h߂Ƀlbg[NgtBbNmFAiXgANꂽzXgł̃}EFA͈̔͂˂~߂tHWbN̎d肵܂BZLeBΉ̃pPbg͂͑傫ȃe[}łA{قǂłBł̓ZLeBɓIipPbg͂̂肾Љ܂B
̏͂ł̓ZLeB֌W҂̗ŁAlbg[Nxł̃VXeN܂܂Ȋpx猩ĂA܂̓lbg[N̒@AӂgtBbÑ_CNgAVXeւ̐NȂǂɂĐ܂BɐNAiXgƂȂāANmVXeiIDSǰxƂɁAgtBbNׂ͂܂B{͂ǂ߂΁AZLeBSĂȂĂAlbg[NZLeB̖{łł傤B

@
U҂ŏɍŝ́AWIƂVXe̓OIȒłB̒iKʂɁutbgveBOvƂAWIƂƂWebTCgGoogleł̌ȂǁAJĂ邳܂܂ȏ𗘗pčs܂BƁAU҂͊JĂ|[gsĂT[rX邽߁AWIIPAhXi܂̓hCj̃XLJn܂B
U҂̓XLɂāAWIғĂ邩AANZXł邩𔻒f܂BsACXg[g123Ԃɂsł̋v悵ĂƂ܂傤BOȋv𗧂ĂČn֍sĂ݂ƂAs̓oCXg[g555ԂֈzĂ邩m܂BƈP[XlƁAԂ̉cƎԒɓkŋsɉāAɂ瓐ނł̂ɁAsxƓƂǂł傤BWIғĂāAANZXł邩mF̂AŏɉzȂ΂ȂȂn[hȂ̂łB
XLɂЂƂ̏dvȐʂ́AWÎǂ̃|[g҂󂯂Ă邩邱ƂłBŝƂɖ߂āAs{݂̌}̒m܂Ȃ܂܂ɁAs։낤Ƃǂł傤BZLeB̎_mȂ킯łAN@vȂł傤B
̍ł́AzXgAJĂ|[gAlbg[N̐Ǝ㐫mF̂ɎgAʓIȃXL@ɂĂ܂B

@܂ł́AM҂ƎMҁA邢̓NCAgƃT[oƂď̂ŃRlNV̗[ɂČyĂ܂A{͂ł͍U҂єQ҂Ƃď̂p܂B

SYNXL
VXeɑ΂čŏɍŝTCP SYNXLŁA̓XeXXL܂̓n[tI[vXLƂĂ΂܂BSYNXLƂ悭ĝɂ͗R܂B
EɑMB
ETCPX^bN̎Ɋւ炸AׂẴvbgtH[œK؂ɋ@\B
ẼXL@mCYȂB

TCP SYNXĹAWÎǂ̃|[gJĂ邩𔻒fŁA3EFCnhVFCNp܂BU҂̓|[gƐȒʐMmӂāAQ҂̃|[gTCP SYNpPbg𑗂܂BQ҂̃pPbg󂯎ƁA}10-1̂悤ȂƂN܂B

}10-1@TCP SYNXLɂċN\̂邱
Uҁ@Qҁ@80ԃ|[gJĂ
Uҁ@Qҁ@80ԃ|[gĂ
Uҁ@Qҁ@80ԃ|[gɃtB^Ă

Q҂̃zXg̃T[rXSYNpPbg󂯎|[gő҂󂯂ĂƁATCPnhVFCN̑iKƂāAU҂TCP SYN/ACKpPbgX|XƂđ܂BƍU҂͂̃|[gJĂāAT[rX҂󂯂Ă邱Ƃ܂Bʏł΁AnhVFCN邽߂ɍŏITCP ACKpPbg܂ȀꍇU҂͂ȏzXgƒʐMCȂ߁ATCPnhVFCN܂B
XL|[gŃT[rX҂󂯂ĂȂꍇAU҂SYN/ACKpPbg󂯎܂BQ҂OS̐ݒɂẮAU҂̓|[gĂ邱ƂӖRSTpPbgƂĎ󂯎܂B邢͉̉Ȃꍇ܂B̓t@CAEH[zXggɂāA|[gɃtB^|ĂƂӖłB邢͑M̓rŁAX|Xm܂Bʂɂ̓|[gĂƂƂłAIȏ؋ł͂܂B

t@Csynscan.pcaṕANmapc[𗘗pSYNXL̍DłBNmaṕAFyodorJSȃlbg[NXLAvP[VŁAǂȃXLłs邱Ƃł܂BNmaphttp://www.nmap.com/download.html疳œ\łB
TṽLv`ɂ͖2000̃pPbgĂ܂̂ŁA荠ȃTCYł傤BXL͈̔͂mFŗǂ̕@̂ЂƂ́A[Conversations]EBhE邱Ƃłi}10-2jBɂ͍Uҁi172.16.0.8jƔQҁi63.13.134.52jԂIPv4̑ΘbЂƂ܂y1zA2̃zXgԂɁATCP̑Θb1994邱Ƃ܂y2zB

}10-2@܂܂TCPʐMsĂ邱Ƃ[Conversations]EBhE

XL͔ɑs邽߁AꂼSYNpPbg̉̂ɁALv`t@CXN[̂͂܂悢@Ƃ͂܂BpPbgւ̉󂯎OɁAɃpPbgĂ邩mȂłBKȂƂɁAtB^쐬邱ƂœK؂ȃgtBbNmF邱Ƃł܂B

SYNXLł̃tB^̎gp
tB^̈ƂāAQ҂443ԃ|[giHTTPSjɑꂽŏ̃pPbgASYNpPbgグ܂B̃pPbgɑ΂鉞邽߁A443ԃ|[go肷邷ׂẴgtBbN\tB^쐬܂Bvɍs@͎̒ʂłB

1DLv`t@C̍ŏ̃pPbgI܂B
2DPacket DetailsyCTCPwb_WJ܂B
3D[Destination Port]tB[hENbNA[Prepare as Filter]IA[Selected]NbN܂B
4D443ԃ|[gƂ邷ׂẴpPbgȂtB^AtB^_CAOɕ\܂B443ԃ|[g𑗐MƂpPbg\̂ŁAʂ̏㕔ɂtB^_CAONbNAudstv܂B

̃tB^ɂU҂Q҂֑ꂽ2TCP SYNpPbg\܂i}10-3jB

}10-3@SYNpPbgɂ2̃RlNVm̎s

ǂ̃pPbgɂ͂Ȃ̂ŁAQ҂̃zXgԂɂ@ȂǂŃtB^ꂽA邢̓|[gĂ\܂B443ԃ|[gɑ΂XLł͔fł܂B
@ق̃pPbgłāAႤʂo邩ǂĂ݂܂傤B܂tB^̉[Clear]{^NbNAقǍ쐬tB^폜܂BɃXg9Ԗڂ̃pPbgIт܂B̓|[g53ԁAʏDNSɊ蓖ĂĂ|[g֑ꂽSYNpPbgłBقǂƓlɁÃ|[gɌpPbg̃tB^AudstvāA|[g53Ԃʉ߂邷ׂĂTCP𒊏o܂B̃tB^KpA5̃pPbgmFł͂łi}10-4jB

}10-4@|[gJĂ邱Ƃ5̃pPbg

ŏ̃pPbǵALv`̐擪̕ɂISYNpPbgłB2Ԗڂ͔Q҂̉ŁA3EFCnhVFCN̊msۂɕԋpׂTCP SYN/ACKpPbgłBʏł΁ÃpPbg͍ŏSYN𑗂zXgACKł͂łBł́AU҂̓RlNVmȂ̂ŁA𑗂܂B̌ʁAQ҂SYN/ACK3قǍđ܂B53ԃ|[gł̐ڑ݂SYN/ACK߂Ă̂ŁÃ|[gŃT[rX҂󂯂ĂƍlĂ悢ł傤B
̃vZX13Ԗڂ̃pPbgłxJԂĂ݂܂傤B113ԃ|[gAIRCł̎ʂF؃T[rXɎgIdentvgRɊ蓖ĂĂ|[g֑ꂽSYNpPbgłB̃|[gɓ^CṽtB^KpƁA}10-5̂悤4̃pPbg\܂B

}10-5@SYN̂ƂRSTMA|[gĂ邱ƂĂ

ŏSYNpPbĝƁAQ҂͂RSTMĂ܂B͂̃|[gŃRlNVĂ炸AT[rXғĂȂƂӖĂ܂B

|[g̊Jɂ߂
SYNXLɑ΂鉞̈Ⴂ𗝉Ax͂ǂ̃|[gJĂāAǂꂪĂ̂vɔf@lĂ݂܂傤Bx̓[Conversations]EBhEɂ܂B̃EBhEł́ApPbgԍɂTCPΘb\[gAPacketsJ2NbNĐl傫ɕׂ邱Ƃł܂i}10-6jB

}10-6@[Conversations]EBhEŊJĂ|[gT

3̃|[ǵAΘb5̃pPbg\܂y1zB5̃pPbg͍ŏSYNAɉSYN/ACKAQ҂đꂽSYN/ACK\Ă̂ŁA53ԁA80ԁA22Ԃ̃|[gJĂ邱Ƃ܂B
̑5̃|[gł́A2̃pPbg\Ă܂y2zBP߂͍ŏSYNA2ԖڂRSTłB܂113ԁA25ԁA31337ԁA113ԁA70Ԃ͕Ă܂B
c̃Ggɂ1pPbg݂Ȃ̂ŁAQ҂̃zXgŏSYNɉȂƂɂȂ܂BĎc̃|[g͕Ăƍl܂A肩ł͂܂B

OStBK[vg
U҂͕WIOSm邽߂ɑȓw͂s܂BOSΓK؂ȍUd|邩łB܂OS肷邱Ƃŏdvȃt@CfBNgǂɂ邩̂ŁAVXeɃANZX₷Ȃ܂B
OStBK[vǵAۂɂ̃VXeɃANZX邱ƂȂAVXeŎsĂOS肷̂ɗpeNjbN̑̂łBOStBK[vgɂ́ApbVuƃANeBu2ނ܂B

pbVutBK[vg
pbVutBK[vgł́AWI瑗ꂽpPbg̓̃tB[h𒲍邱ƂɂāAOS𔻒f܂B̕@pbVui󓮓IjƂ̂́AWIMpPbg`FbN邾ŁA̓pPbg𑗐MȂ߂łBBɎsł邽߁AU҂ɂƂĂ͗zIȕ@łB
͂ĂAĂpPbg𒲂ׂ邾ŁAǂĕWIOSł̂ł傤B͔͂ɊȒPŁARFCŒ`ꂽvgR̎dl̂ŉ\ɂȂĂ̂łBTCPAUDPAIPwb_ɂ͂tB[h܂AftHglݒ肳Ă܂B܂TCP/IPX^bNꍇAeOS͂̃tB[h̃ftHgl`Kv܂B\10-1͈ʓIȃtB[hƁA܂܂OSł̃ftHglĂ܂B

\10-1@ʓIȃpbVutBK[vg̒l
vgRwb_@IP@IP@TCP@TCP@TCP
tB[h@TTL@tOg֎~tO@őZOgTCY@EBhETCY@SackOK
ftHgl
OS

t@Cpassiveosfingerprinting.pcapɊ܂܂Ă2̃pPbg悢TvłBǂ80ԃ|[gɑꂽTCP SYNpPbgłAႤzXg瑗MĂ܂B̃pPbgɊ܂܂l\10-1ɏƍ邾ŁAꂼ̃zXgOSł͂łBepPbg̏ڍׂ͐}10-7Ɏ܂B

}10-7@pPbgOSł

\10-1QƂāApPbgʂɊ֘AtB[h̏ڍׁi\10-2j܂B

\10-2@pPbgʂOStBK[vg
vgRwb_@tB[h@pPbg1̒l@pPbg2̒l
IP@TTL@
IP@tOg֎~tO@Zbg@Zbg
TCP@őZOgTCY@1440oCg@1460oCg
TCP@EBhETCY@64240oCg@2920oCg
TCP@SackOK@Zbg@Zbg

̒lɂāApPbg1Windows@킩ApPbg2Linux@킩瑗ꂽƌ_Â邱Ƃł܂B
\10-1̈ʓIȃpbVutBK[vg̃tB[hꗗ́AԗIȂ̂ł͂܂B܂܂ȗvɂAlɋꍇ܂B̂߁ApbVuOStBK[vg瓾ꂽʂɑSʓIɗ邱Ƃ͂ł܂B

@OStBK[vg@Ɏgc[̂ЂƂp0fłB̃c[̓pPbgLv`etB[h͂A\̂OSo͂܂Bp0f̂悤ȃc[gƁAOS̎ނłȂÃo[Wpb`܂łłꍇ܂Bp0fhttp://lcamtuf.coredump.cx/p0f.shtml_E[hł܂B

ANeButBK[vg
󓮓IɃgtBbNĎ邾ł͌ʂȂꍇA蒼ړIȃAv[`KvɂȂ܂BANeButBK[vgƌĂт܂BU҂OS肷鉞o߁AʂɍpPbgQ҂ɑM܂B̎@ł͔Q҂ƒڂŝŔ铽͂܂񂪁AȂ̌ʂ܂B
t@Cactiveosfingerprinting.pcapɂ́ANmapXL[eBeBgANeBuOStBK[vgXL̃Tv܂܂Ă܂Bt@C̃pPbǵAOS肷鉞o悤݌vꂽv[uANmapʂłBNmap͂v[uւ̉L^ătBK[vg쐬Af[^x[X̒lƔrOS肵܂B

@NmapANeBuOS肷邽߂ɗp@͂Ȃ蕡GłBNmapɂANeBuOStBK[vgǂ̂悤ɎsĂ邩ɊwԂɂ́ANmap̍҂łGordon "Fyodor" LyonɂNmapKChuNmap Network ScanningvQƂĂB

N
U҂݂͂ȁANړIƂĂ܂BsAWI@AƎ㐫AWIɃANZX邽߂̍UvO܂B̏͂̎c̕ł́AMicrosoft̂ƑO̐Ǝ㐫ɑ΂UvOAARPLbV|C]jOɂgtBbÑ_CNgAf[^̔s[gANZX^gC̖ؔnƂA܂܂ȐN@Ă܂傤B

Operation Aurora
2010N1AOperation Aurora͓܂mĂȂInternet Explorer̐Ǝ㐫U܂BU҂͂̐Ǝ㐫pAGoogle͂߂ƂƂ̃}Vrootŉu삵̂łB
[UƎ㐫̂Internet ExplorerWebTCgK邾ŁÄӂ̂R[hsAU҂͊ǗҌŃ[ŨzXgɃANZXł悤ɂȂ܂Bɂ͈ӂTCgւ̃N܂ރ[𑗐MXsA^U̎g܂B
XsA^Ũ[͐Mpł鑊肩瑗MĂ悤ɌĂ邽߁ÂłB
AuroráAWIƂꂽ[UXsA^Ũ[̃NNbNƂn܂Ă܂Bt@Caurora.pcapɌʂ̃pPbgĂ܂B
Lv`́AQҁi192.168.100.206jƍUҁi192.168.100.202jƂ3EFCnhVFCNŎn܂Ă܂Bŏ̐ڑ80ԃ|[gōsĂ̂ŁAHTTPgtBbNƍlĂ悢ł傤B̐́A4Ԗڂ̃pPbgłA/infoHTTP GETNGXgy1zɂĊmFł܂i}10-8jB


}10-8@Q҂/infoGETNGXg𑗐M

U҂GETNGXgACKԋpA6Ԗڂ̃pPbgŃXe[^XR[h302iMoved Temporarilyjԋp܂B̃Xe[^XR[h͈ʂɁAʂ̃y[WɃ_CNgꍇɗp܂BXe[^XR[h302y1zƂƂɁA[Location]tB[h/info?rFfWELUjLJHpP_CNgƂĎw肳Ă܂i}10-9jB

}10-9@̃pPbgŃNCAg̃uEU_CNg

HTTPXe[^XR[h302̃pPbg󂯎ƁANCAg7Ԗڂ̃pPbgŁA/info?rFfWELUjLJHpPƂURLɕʂGETNGXg𑗂A8Ԗڂ̃pPbgACK󂯎܂BACKɑ̃pPbǵAU҂Q҂ւƓ]ꂽf[^łB̃f[^悭邽߁AXg[̂Ȃ9Ԗڂ̃pPbgENbNāA[Follow TCP Stream]I܂B̃Xg[̏o͂ɂ́AŏGETNGXgA302̃_CNgA2ԖڂGETNGXg\Ă܂i}10-10jB
̂Ƃɂ킩ɏ󋵂ȂĂ܂BU҂͔ɊȃRecGETNGXgɉĂ̂łB̃Rec̍ŏ̕}10-11Ɏ܂B
Rec<script>^OɈ͂܂ꂽAÃ_Ȑƕ̂悤Ɍ܂y1zBXNvggĂ邱Ƃ߂HTMLŎĝ<script>^OŁÃ^Oň͂܂ꂽɂ͒ʏ킳܂܂ȃXNvg̃Xe[gg܂܂܂̂ŁÂł߂ȕƐ猟o邽߂ɃGR[hĂ炵Ƃ܂Bł͂ꂪUvOƕĂ̂ŁÄӖsȃeLXgɂ́ApfBOƎ㐫U邽߂̃VFR[h܂܂ĂƍlĂ悢ł傤B

}10-10@NCAgɓ]ꂽf[^Xg[

}10-11@<script>^Oň͂܂ꂽRec̓GR[hĂ悤Ɍ

U҂瑗MꂽRec̖̕}10-12Ɏ܂BGR[hꂽeLXĝƂɁA悤₭ǂނƂłeLXg܂BxȃvO~O̒mȂĂÃeLXg̕ϐ當𕜌悤ƂĂ̂̂悤Ɍ܂Bꂪ</script>^OŕÕeLXg̍Ō̕łB

}10-12@T[o瑗MꂽRec̖ɂ́AǂłeLXgƉiframe܂܂Ă

U҂NCAgɑMf[^̍Ō̕2ɕĂ܂Bŏ̃ZNV<span id="vhQYFCtoDnOzUOuxAflDSzVMIHYhjJojAOCHNZtQdlxSPFUeEthCGdRtiIY">y1zŁA2Ԗڂ̃ZNV<span></span>^Oɂ͂܂Ă<iframesrc="/infowTVeeGDYJWNfsrdrvXiYApnuPoCMjRrSZuKtbVgwuZCXwxKjtEclbPuJPPctcflhsttMRrSyxl.gif" onload="WisgEgTNEfaONekEqaMyAUALLMYW(event)" />y2złBJԂ܂ÃRec͕sRɒAǕs\ȃ_ȕłA킴Ƃ킩ɂĂ\_Aӂ銈̏؋ƍl܂B
<span>^OɈ͂܂ꂽR[h́̕uiframevƂAU҂HTMLy[WɃRec𖄂ߍނƂɎg悭@łB<iframe>^O̓[UmFłȂCCt[쐬܂Bł<iframe>^O͊ȖOGIFt@CQƂĂ܂BQ҂̃uEŨt@Cւ̎QƂ{悤ƂƁA}10-13̂悤ɁA21Ԗڂ̃pPbgGETNGXgy1zAɂGIFM܂y2zBGIF͂炭AłɔQ҂̃}VɃ_E[hĂUvON̂ɗpƎv܂B

}10-13@Q҂iframeŎw肳ꂽGIFNGXgA_E[h

̃Lv`łƂȕ25Ԗڂ̃pPbgŁAQ҂U҂4321ԃ|[gŃRlNVJn悤ƂĂ܂B2Ԗڂ̒ʐMXg[Packet DetailsyCŌĂقƂǏ񂪂Ȃ̂ŁAēxTCPXg[āA肳Ăf[^悭ׂĂ݂܂傤B}10-14[Follow TCP Stream]EBhȄo͂łB

}10-14@U҂ARlNVŃR}hVFgĂ

WindowsR}hVFmFłAxKvły1zB̃VF͔Q҂U҂̃T[o֑ꂽ̂ŁAU҂̐NAyC[h̓WJɂĂ܂ƂӖ̂łBUvONƁAQ҂̓R}hVFU҂ɕԋp܂B̃Lv`ł́AU҂dirR}h͂y2zAQ҂̃zXg̃fBNgĂ邱Ƃ܂y3zB
R}hVFɃANZXU҂́AQ҂̃zXg̊ǗҌ̂ŁADł悤ɂȂ܂B1x́A킸b̃NbNŁAQ҂̃zXg̊Ǘׂ͂čU҂ɓnĂ܂̂łB
̂悤ȍUvÓAlbg[NIDSɌôh߁A肳ۂ͕Ȃ悤ɒʏGR[hĂ܂B̂߂̍UvOɂĂ炩ߒmĂ邩AUvÕR[h̗ႪȂꍇ́AȂ͂ȂAQ҂̃VXeŉNĂ邩𐳊mɔĉ͍łBKɂ̃pPbgLv`ɂ́AӂR[h̖炩ȒA܂<script>^Oň͂܂ꂽǉꂽeLXgAiframeAĕ̃R}hVF܂B
Aurora̍UvOǂ̂悤ɍU邩܂Ƃ߂Ă݂܂傤B
EQ҂͐Młƌ[U҂󂯎ÂȂ̃NNbNƁAU҂̈ӂTCgGETNGXgM܂B
EU҂WebT[oQ҂302_CNg𑗐MAQ҂̃uEU̓_CNgꂽURLɁAIGETNGXg𑗐M܂B
EU҂WebT[óAUvOƁAӂGIFC[Wւ̃N܂iframe܂މJavaScriptR[h̓Weby[WNCAgɕ\܂B
EQ҂͈ӂC[WGETNGXg𑗐MAT[o_E[h܂B
EɑMꂽJavaScriptR[hӂGIFɂĉǂAQ҂̃}VŃR[hsAInternet Explorer̐Ǝ㐫ɐN܂B
EƎ㐫ɂNƁAR[hɉBꂽyC[hsA4321ԃ|[gŔQ҂ƍUҊԂ̐VȃZbVJn܂B
EyC[hR}hVFāAU҂֕ԋpAU҂R}hVF𑀂悤ɂȂ܂B

h䑤̎_炢ƁÃLv`t@CIDS̃VOl`쐬΁Aケ̍UN̂h邩m܂BƂ΁A<script>^Oň͂܂ꂽeLXg̍Ōɂ镽̂̕悤ɁAǉĂȂtB^邱Ƃ\łB邢URLɁuinfov܂܂TCg302Ń_CNgꂽׂĂHTTPgtBbNɂāAVOl`Lq邱Ƃl܂BVOl`Ŏgɂ͂ɒKv܂AȂACfBAłB

@ӂgtBbÑTvƂɃVOl`쐬̂́Am̋Ђlbg[N낤ƂlɂƂďdvȃXebvłBŐ悤ȃLv`́AVOl`쐬XL𖁂̂ɍœKłBNmƍUVOl`ɂĂɒm肽΁ASnortvWFNghttp://www.snort.org/QƂĂB

ARPLbV|C]jO
ARPLbV|C]jOɂẮAɐApPbg͂@킩̃gtBbNɊ荞ޕ@Ƃ2͂Ő܂B̓lbg[NGWjAɂƂāAʓILvȃc[ƂȂ܂BȂAӂĎgpƁAԎҁiMITMjUƂĒvIȂ̂ɂȂ肤̂łB
ԎҍUł́AU҂͒ʐM̊荞݂₂s߂ɁA2̋@Ԃ̃gtBbN_CNg܂BԎҍUɂ́AZbVnCWbNADNSXv[tBOASSLnCWbN܂ށA܂܂ȕ@܂B
ARPLbV|C]jOł́AʂɍꂽARPpPbgɂA2̋@Ɍ݂ɒʐMĂƎv܂܂Aۂɂ́AԂɈʒuăpPbg]Ă3҂ƒʐM܂B
t@Carppoison.pcapɂ́AARPLbV|C]jÕTv܂܂Ă܂Bt@CJƁAꌩ̕ϓNȂ悤ɌAQ҂ł172.16.0.107Google{AĂ̂܂B̌ɂADNSNGHTTPgtBbNĂ܂B
ARPLbV|C]jO͑2wŎgeNjbNȂ̂ŁAPacket ListsyCŃpPbg𒲂ׂĂ݂邱Ƃł܂Assׂ͓̂łBPacket ListsyCɂJǉāA킩₷Ă݂܂傤B

1D[Edit][Preferences]I܂B
2D[Preferences]EBhE̍[Columns]NbN܂B
3D[Add]NbN܂B
4DSource MACƓ͂A[Enter]܂iĖ󒍁FǉꂽsɂNew ColumnƂ̂̕NbNāÂύX\ɂōL̍Ƃs܂jB
5D[Field type]̃hbv_EXgŁA[Hw src addr (resolved)]I܂B
6Dǉ΂̃GgNbNA[Source]ĴƂɂ悤hbO܂iĖ󒍁Fes[Field type]J̕NbNKv܂jB
7D[Add]NbN܂B
8DDest MACƓ͂A[Enter]܂B
9D[Field type]̃hbv_EXgŁA[Hw dest addr (resolved)]I܂B
10Dǉ΂̃GgNbNA[Destination]ĴƂɂ悤hbO܂B
11D[OK]NbN܂B

̈A̍ƂƁiĖ󒍁Fmɂ11[OK]NbNO̎_ŁjA}10-15̂悤ȉʂɂȂ͂łBŃpPbg̑MƈMACAhX2̃Jǉł܂B

}10-15@MƈMACAhXVȃJǉꂽJݒ
(Figure10-15.tiff)

MACAhX̖OLɂȂĂ΁AʐMĂ@킪DellCiscô̂ƕ͂łB͔ɏdvȂ̂ŊoĂ܂傤BȂƂƁALv`XN[ĂƁA54Ԗڂ̃pPbgŁADell̋@iQҁjƐVɓĂHP̋@iUҁjƂ̊ԂɁAARPgtBbNĂ邩łi}10-16jB

}10-16@Dell̋@HP̋@Ԃ̊ARPgtBbN

ɐiޑOɁA̒ʐMɊւĂGh|CgĂ܂傤B\10-3ɂ܂Ƃ߂܂B

\10-3@֘AGh|Cg
@x_@IPAhX@MACAhX
Qҁ@Dell
[^@Cisco
Uҁ@HP@s

ł͉̃gtBbNɂĂ̂ł傤B6͂ARPɂĂ̐voĂق̂łAARPpPbgɂ2̃^CvA܂胊NGXgƃX|X܂BNGXgpPbǵAIPAhXɑΉtꂽMACAhX}V邽߁Albg[Nׂ̂Ă̋@Ƀu[hLXgƂđ܂Bɂ胊NGXg𑗐MʐM@ɉ@킩pPbgM܂BƂlƁA̒ʐMɂ͊ȓ_܂B
ЂƂ́A54Ԗڂ̃pPbgMACAhX00:25:b3:bf:91:ee̍U҂AMACAhX00:21:70:c0:56:f0̔Q҂ɒڑMꂽARPNGXgł邱Ƃły1zB̎̃NGXǵAlbg[Nׂ̂ẴzXgɃu[hLXgׂȂ̂ɁAQ҂𒼐ڃ^[QbgɂĂ܂B܂̃pPbg͍U҂瑗Mꂽ̂ŁAARPwb_ɂ͍U҂MACAhX܂܂Ăɂւ炸AIPAhX̓[^̂̂ƂȂĂ܂B
̃pPbĝƂɂ́AMACAhX܂񂾔Q҂̃X|XU҂ɑĂ܂y2zB낵ƂNĂ̂56Ԗڂ̃pPbgłBU҂ARPX|X́AIPAhX172.16.0.1MACAhX00:25:b3:bf:91:eeƓ`Ă̂ły3zBȂ̂́A172.16.0.1MACAhX00:25:b3:bf:91:eeł͂ȂA00:26:0b:31:07:33ƂƂłB172.16.0.1̃[^pPbgLv`̍ŏ̂قŔQ҂Ƃ肵Ă̂ŁA̎Ă܂BARPvgR̓ZLAłȂ߁iIɑꂽARPNGXgARPe[uɔfjAQ҂̓[^ɍsׂgtBbNAU҂ɑĂ܂悤ɂȂ܂B

@̃pPbgLv`͔Q҂̃zXĝ̂Ȃ̂ŁAS̑͌܂BۂɍUd|ɂ́AU҂̋@킪Q҂̋@łƃ[^Ɏv܂邽߂ɁAÃpPbg[^ɑMȂ΂Ȃ܂B̃pPbgmFɂ́A[^i邢͍Uҁj̃pPbgLv`KvłB

҂܂\ƁA}10-17̂悤ɁAQ҂ƃ[^Ԃ̒ʐMU҂ւƗ܂B

}10-17@ARPLbV|C]jOɂ钆ԎҍU
ARPXv[tBOݒiQ҂̎_j
[^iCiscoj
UҁiHPj
QҁiDellj

󂳂ȂBWireshark̉ʕ\ê

ARPXv[tBǑʁiU҂gtBbNɊ荞ށj
[^
U
Q

57Ԗڂ̃pPbgɂU̐mFł܂B̃pPbgAARPgtBbNOɑpPbgi40ԖڂȂǁjƔׂƁi}10-18QƁjA[g̃T[oiGooglejIPAhX͓ły1zAMACAhXςĂ܂y2zBMACAhXςƂA݃gtBbN̓[^ʉ߂OɁAU҂oRĂ邱Ƃ܂B
̍U͖{ɖڗȂ̂ŁAoɓȂ܂BUpɐݒ肳ꂽIDS̏؂邩AARPe[uGg̋}ȕύXo悤݌vꂽ\tgEFAKvłB͂Ălbg[ÑpPbgLv`邽߂ARPLbV|C]jO𗘗p邱ƂȂł傤An̐nƂƂmĂׂłB

}10-18@MACAhX̕ωU̐

[gANZX^̃gC̖ؔn
܂ł́ALv`𒲂ׂOɁANĂ̂ĂZLeB̃guĂ܂BUǂ̂悤ɍs邩wԂɂ͂悢@łA܂茻Ił͂܂Bۂ̃ViIł́Albg[Nh̎dSlXAlbg[Ns邷ׂẴpPbg𒲂ׂ肷邱Ƃ͂܂B̑A炩IDSgălbg[NgtBbNɈُ킪Όx悤ɂ邱ƂŁA炩ߒ`UVOl`ƂɁAȂ钲s悤ɂĂ܂B
̃ViIł́Aۂ̉͂̂悤ɁAȒPȌxn߂܂傤BłIDSiSnortĵ悤ȌxoĂ܂B

[**] [1:132456789:2] CyberEYE RAT Session Establishment [**][Classification: A Network Trojan was detected] [Priority: 1]07/18-12:45:04.656854 172.16.0.111:4433 -> 172.16.0.114:6641TCP TTL:128 TOS:0x0 ID:6526 IpLen:20 DgmLen:54 DF***AP*** Seq: 0x53BAEB5E Ack: 0x18874922 Win: 0xFAF0  TcpLen: 20

̒iKƂāǍxNVOl`[mF܂B

alert tcp any any -> $HOME_NET any (msg:"CyberEYE RAT Session Establishment";content:"|41 4E 41 42 49 4C 47 49 7C|"; classtype:trojan-activity;sid:132456789; rev:2;)

̃[́A16ĩRec41 4E 41 42 49 4C 47 49 7C܂܂pPbglbg[NɐNĂAx𔭂悤ݒ肳Ă܂B̃Rec͉ǉ\ASCIIƁuANA BILGIvƂȂ܂BꂪoƌxACyberEYEɂ郊[gANZX^̃gC̖ؔniRAT/Remote-access Trojanj݂\m点܂BRAT͔Q҂̃zXgŔ閧ɎsAU҂ւƐڑ鈫ӂvOŁAɂU҂͔Q҂̃}V[g삷邱Ƃ\ƂȂ܂B

@CyberEYERATst@C쐬AzXg𑀂邽߂́AgR܂̗Lȃc[łBɂASnort̃[Ŕx𔭂悤ݒ肵uANA BILGIvƂ́AgRŁu{vƂӖłB

x̓t@Cratinfected.pcap̌xɊ֘AgtBbNĂ݂܂傤BSnorťx́Aʏ͌x̌_@ƂȂpPbg1Lv`܂AKȂƂɁAł̓zXgԂ̒ʐMV[PXŜmFł܂B̂悤Snort̃[Œ߂16i܂B

1D[Edit][Find Packet]I܂B
2D[Hex Value]WI{^Iт܂B
3DeLXg̕41 4E 41 42 49 4C 47 49 7C̒l͂܂B
4D[Find]NbN܂B

}10-19Ɏ悤ɁA܂4Ԗڂ̃pPbg̃f[^ŏL̕񂪌͂ły1zB

}10-19@4Ԗڂ̃pPbgSnorťxɂ񂪌

[Edit][Find Next]̑IxJԂƁA5A10A32A156A280A405A531A652Ԗڂ̃pPbgł̕񂪌܂B̃Lv`ׂ̂Ă̒ʐMUҁi172.16.0.111jƔQҁi172.16.0.114jƂ̊Ԃ̂̂łA񂪂pPbg͕̑Θbɂ܂Ă悤łB4Ԗڂ5Ԗڂ̃pPbg4433Ԃ6641Ԃ̃|[ggĂ܂Aق̃pPbĝقƂǂ4433ԃ|[gƃ_ɑIꂽGtF|[ggĂ܂B[Conversations]EBhETCP^u΁ȂΘb݂̑mFł܂i}10-20jB

}10-20@U҂ƔQ҂̊Ԃ3̑Θb݂ĂiĖ󒍁FΘb̐8̌肾Ǝv܂j

F邱ƂɂāAeX̑Θb𕪗ނ邱Ƃł܂B

1DPacket ListsyC̏ɂtB^_CAOŁA(tcp.flags.syn ==1) && (tcp.flags.ack == 0) ƂtB^͂A[Apply]NbN܂BŃgtBbN̊eΘb̍ŏSYNpPbgIł܂B
2Dŏ̃pPbgENbNA[Colorize Conversation]I܂B
3D[TCP]IAFIт܂B
4DcSYNpPbgɂĂvZXJԂAꂼɂĈႤFIт܂B
5DI[Clear]NbNAtB^폜܂B

ΘbFƁA݂ǂ֘AĂ邩ĕ悤ɂȂ̂ŁA2̃zXgԂ̒ʐMǐՂ₷Ȃ܂Bŏ̑Θbi6641ԁ^4433ԃ|[gj2̃zXgʐMn܂Ă̂ŁAn߂̂悢ł傤BΘb̃pPbĝǂꂩENbNA[Follow TCP Stream]IāAƂ肳Ăf[^QƂ܂i}10-21jB
܂U҂Q҂ɁAANABILGI|556ƂeLXg񂪑MĂ̂܂y1zBŔQ҂́ARs[^iCSANDERS-6F7F77jAgpĂOS(Windows XP Service Pack 3)Ȃǂ܂ފ{IȃVXeX|XƂđĂy2zAU҂BAGLIMI?Ƃ𑗐M܂y3zBU҂ԋpꂽʐMCAPSCREEN60Ƃy4ẑ݂ŁA6񌻂Ă܂B
U҂ԋpꂽCAPSCREEN60Ƃ񂪋CɂȂ̂ŁAӖ̂AƌĂ݂܂傤Bēx_CAOgA[String]IvVw肵āApPbgł̃eLXg܂B

}10-21@ŏ̑Θbʔʂo
(Figure10-21.tiff)

̌sƁAŏ27Ԗڂ̃pPbgŕ񂪌܂B̏񂪋[̂́A񂪍U҂NCAgɑƂANCAgpPbg̎󂯎mFāA29Ԗڂ̃pPbgŐVΘbn܂Ă邱ƂłB
̐VΘbTCPXg[̏o͂ǐՂƁi}10-22jAꂽłANABILGI|556ڂɓÂƂSH|556ƂAŌCAPSCREEN|C:\WINDOWS\jpgevhook.dat|84972ƑĂ܂y1zBCAPSCREEN̂ƂɃt@CpXw肳ĂāÂƂɉǕs\ȃeLXg邱ƂɋCÂł傤BŖʔ̂́AǕs\ȃeLXgJFIFƂ̐擪ɒǉĂ邱ƂŁy2zAGoogleJPGt@C̐擪ɑ݂̂łB
̎_ł́AU҂͂JPGC[W]邽߂ɑΘbJnƔfĂł傤BɏdvȂ̂́ÃgtBbNR}h̍\邱ƂłBCAPSCREEN͍U҂JPGC[W]邽߂ɋNR}ĥ悤łBCAPSCREENR}hMƁAʂ͓łB؂ɂ́AeΘb̃Xg[邩Â悤WiresharkIOOt@\g܂B

1D[Statistics][IO Graphs]I܂B
2DtB^tcp.stream eq 2Atcp.stream eq 3A tcp.stream eq 4Atcp.stream eq 5Atcp.stream eq 6A5̃tB^_CAOɂꂼ}܂B
3D[Graph 1][Graph 2][Graph 3][Graph 4][Graph 5]̃{^NbNAw肵tB^̃f[^|CgLɂ܂B
4DỸXP[[Byte/Tick]ɕύX܂B

}10-23̃OtłB

}10-22@U҂JPGt@C̃NGXgJn悤ƂĂ
(Figure10-22.tiff)

}10-23@JԂĂ邱ƂOt
(Figure10-23.tiff)

̃Otɂ΁AeΘbɓʂ̃f[^܂܂ĂāÂ悤łBł̊JԂĂƔfł܂B

]ꂽJPGC[W̃RecɂĂ͑zł傤AJPGt@C̒gۂɌ邩ǂĂ݂܂傤BWiresharkJPGf[^𒊏oɂ́ÃXebvs܂B

1D܂}10-22̑O͂̕Ő悤ɁApPbgTCPXg[ǐՂ܂B
2DʐM𕪊āAQ҂U҂֑ꂽf[^Xg[݂̂QƂ邱Ƃł܂Bsɂ[Entire Conversation (85033oCg)]Ƃhbv_Ẻ̖IA172.16.0.114:6643 --> 172.16.0.111:4433 (85020oCg)ƂȂ悤ɂ܂BgtBbNiǰɒӂĂB
3D[Save As]{^Ńf[^ۑ܂Bgq.jpgƂ̂YȂ悤ɁB

̃C[Wt@CJƂĂJȂ̂ōQĂ邩m܂񂪁A1iKcĂ܂B8͂FTPgtBbNt@C𒊏oƂƂ͈قȂÃgtBbN͖{̓eɃf[^ǉĂ܂BTCPXg[̍ŏ2s̓gC̖ؔñR}hV[PẌꕔŁAJPG\Ăf[^ł͂܂i}10-24jBXg[ۑƁÅOf[^ۑ܂B̌ʁAJPGt@Cwb_Tt@Cr[́ATĂwb_Ƃ͈vȂeO͂邱ƂƂȂA摜JȂ̂łB

}10-24@gC̖ؔnǉOf[^At@CJƂWĂ
]ȃf[^

̖Ĉ͊ȒPȍƂłAoCiGfB^gƂ삪KvłB̍Ƃt@CJ[rOifile carvingjƌĂт܂B}10-25ł́AWinHexgJPGt@C̐擪̃oCgnCCgĂ܂BoCiGfB^gẴoCg폜A摜t@Cۑ܂傤B

}10-25@JPGt@C]ȃoCg菜

]ȃf[^폜΁At@CJ͂łBgC̖ؔnQ҂̃fXNgbṽXN[Lv`AU҂ւƕԋpĂƂł͂肵܂i}10-26jB

}10-26@]ꂽJPG͔Q҂̃zXg̃XN[Lv`

̒ʐMV[PXƁAʐḾAʏTCPeBA_EɂďI܂B
̃ViÍAIDSɂxƂɃgtBbN͂ۂɁANAiXgǂƂ̈łB

ExƌxNVOl`𒲂ׂ܂B
EVOl`ۂɃgtBbNɑ݂邱ƂmF܂B
EgtBbN𒲍ANꂽzXgōU҂s܂B
EQ҂炳ɏdvȏ񂪘ROɁȂΏJn܂B

܂Ƃ
ZLeBɊւViIɂpPbgLv`̍i荞݁AʓIȍỦ́AIDSɂxւ̑ΉŁA1̖{܂B̏͂ł͈ʓIȃXLƗ񋓂̕@AԎҍUAVXeւ̐NɊւ2̎AzXgUďĂ܂ꍇɉN邩ɂĐ܂B

