=== ch10.docx
[chap]10́@ZLeB̂߂̃pPbg

{̑唼̓pPbg͂𗘗plbg[ÑguV[eBOɊĂ܂Aɂ͂Ȃ̃pPbg͂ZLeBړIōsĂ܂B͕sN҂h߂Ƀlbg[NgtBbNAiXgA邢͐NꂽzXgł̃}EFA͈̔͂˂~߂tHWbN̎d肵܂BZLeB̂߂̃pPbg͂͑傫ȃe[}łA{PقǂłBł̓ZLeBɓIipPbg͂̂肾Љ܂B
̏͂ł̓ZLeB֌W҂̗ŁAlbg[Nxł̃VXeNQ܂܂Ȋpx猩Ă܂B܂lbg[N@AӂgtBbÑ_CNgAVXeGNXvCe[VȂǂɂĐ܂BɐNAiXgƂȂāANmVXeiIDSǰxƂɁAgtBbNׂ͂܂B{͂ǂ߂΁AZLeB֘ASĂȂĂAlbg[NZLeB̖{łł傤B

@
U҂ŏɍŝ́AWIƂVXe̓OIȃT[`łB̒iKʂɁutbgveBOvƂAWIƂƂWebTCgGoogleȂǁAJĂ邳܂܂ȃ\[X𗘗pčs܂BT[`ƁAU҂͊J|[gsĂT[rX邽߁AWIIPAhXi܂̓hCj̃XLJn܂B
U҂̓XLɂāAWIғĂāAANZXł邩ǂ𔻒f܂BƂ΋sACXg[g123Ԃɂsł̋v悵ĂƂ܂傤B͔Oȋv𗧂Ă̂́An֍sĂ݂ƁAs̓oCXg[g555ԂֈzĂ܂BƈP[XƁAԂ̉cƎԒɓkŋsɉāAɂ瓐ނł̂ɁAsxƓƂǂł傤BWIғĂāAANZXł邩ǂmF̂AŏɉzȂ΂ȂȂn[hȂ̂łB
XLɂЂƂ̏dvȐʂ́AWÎǂ̃|[g҂󂯂Ă邩邱ƂłBŝƂɖ߂āAs{݂̌}̒m܂Ȃ܂܂ɁAs։낤Ƃǂł傤BZLeB̎_mȂ킯łAN邱Ƃ͂ł܂B
̍ł́AzXgÅJ|[gA܂lbg[N̐Ǝ㐫ʂ̂ɎgAʓIȃXL@ɂĂ܂B

@܂łł́AM҂ƎMҁA邢̓NCAgƃT[o̐ڑɂĂ̂ݐGĂ܂B{͂ł͍U҂܂͔Q҂̑̒ʐMɂĐĂ܂B

SYNXL
VXeɑ΂čŏɍŝTCP SYNXLŁA̓XeXXL܂̓n[tI[vXLƂĂ΂܂BSYNXLƂ悭ĝɂ͗R܂B
EɑMB
ETCPX^bN̎Ɋւ炸AׂẴvbgtH[Őmɋ@\B
ẼXL@mCYȂB

TCP SYNXĹAWÎǂ̃|[gJĂ邩𔻒f̂ɁA3EFCnhVFCNvZXg܂BU҂̓|[gƐȒʐMmӂāAQ҂̃|[gTCP SYNpPbg𑗂܂BQ҂̃pPbg󂯎ƁA}10-1̂悤ȂƂN܂B

}10-1@TCP SYNXLɂċN\̂邱
Uҁ@Qҁ@80ԃ|[gJĂ
Uҁ@Qҁ@80ԃ|[gĂ
Uҁ@Qҁ@80ԃ|[gɃtB^Ă

Q҂̃}ṼT[rX|[gő҂󂯂ĂSYNpPbg󂯂ƂƁAU҂TCP SYN/ACKpPbgƂđ܂BƍU҂͂̃|[gJĂāAT[rX҂󂯂Ă邱Ƃm܂Bʏł΁AnhVFCN邽߂ɍŏITCP ACKpPbg܂ȀꍇU҂͂ȏzXgƒʐMCȂ߁ATCPnhVFCN܂B
XL|[gŃT[rX҂󂯂ĂȂꍇAU҂SYN/ACKpPbg󂯎܂BQ҂OS̐ݒɂẮAU҂̓|[gĂ邱ƂӖRSTpPbgƂĎ󂯎܂B邢͉̉Ȃꍇ܂B̓t@CAEH[zXggɂāA|[gɃtB^ĂƂӖłB邢͑M̓rŁAm܂Bʂɂ̓|[gĂƂƂłAIł͂܂B
t@Csynscan.pcaṕANMAPc[𗘗pSYNXL̂悢łBNMAṔAFyodorJASȃlbg[NXLAvP[VŁAǂȃXLłs邱Ƃł܂BNMAPhttp://www.nmap.com/download.html疳œ\łB
TṽLv`ɂ͖2000̃pPbgĂāÃXLKxȋK͂ł邱ƂĂ܂BXL͈̔͂mFŗǂ̕@̂ЂƂA[Conversations]EBhE邱Ƃłi}10-2jBɂ͍Uҁi172.16.0.8jƔQҁi63.13.134.52jԂIPv4̑ΘbЂƂ܂y1zB܂2̃zXgԂɁATCP̑Θb1994̂ɋCÂł傤y2zB

}10-2@܂܂TCPʐMsĂ邱Ƃ[Conversations]EBhE

XL͔ɑs邽߁AꂼSYNpPbg̉̂ɁALv`t@CXN[̂͂܂悢@Ƃ͂܂BpPbgւ̉󂯎OɁAɃpPbgĂ邩mȂłBKȂ̂́AK؂ȃgtBbN菕ƂȂtB^쐬ł邱ƂłB

SYNXLł̃tB^̎gp
tB^̈ƂāAQ҂443ԃ|[giHTTPSjɑꂽŏ̃pPbgASYNpPbgグ܂B̃pPbgɑ΂鉞邽߁A443ԃ|[go肷邷ׂẴgtBbN\tB^쐬܂Bvɍs@͎̒ʂłB

1DLv`t@C̍ŏ̃pPbgI܂B
2DpPbgڍׂ̃yCTCPwb_L܂B
3D[Destination Port]tB[hENbNA[Prepare as Filter]IA[Selected]NbN܂B
4D443ԃ|[g֌ׂẴpPbg̃tB^AtB^_CAOɒu܂B443ԃ|[g̃pPbgtB^̂ŁAtB^_CAÖԏNbNAdst܂B

ƍU҂Q҂֑2TCP SYNpPbgtB^܂i}10-3jB

}10-3@SYNpPbgł2̐ڑm̎

ǂ̃pPbgɂ͂Ȃ̂ŁAQ҂łzXgt@CAEH[ȂǂɂătB^ꂽA邢̓|[gĂ\܂B443ԃ|[gɑ΂XLł͔fł܂B
@ق̃pPbgłāAႤʂo邩ǂĂ݂܂傤B܂tB^̉[Clear]{^NbNAقǍ쐬tB^폜܂BɃXg9Ԗڂ̃pPbgIт܂B̓|[g53ԁAʂDNSɊ֘A|[g֑ꂽSYNpPbgłBقǂƓlɁÃ|[gɌpPbg̃tB^AdstāA|[g53Ԃʉ߂邷ׂĂTCPɓKp܂B̃tB^KpA5̃pPbg`FbN܂傤i}10-4jB

}10-4@|[gJĂ邱ƂĂ5̃pPbg

ŏ̃pPbǵALv`̏߂ɑISYNpPbgłB2Ԗڂ͔Q҂̉ŁA3EFCnhVFCNmƂɖ߂ĂׂTCP SYN/ACKpPbgłBʏł΁ÃpPbg͍ŏSYN𑗂zXgACKł͂łBł́AU҂͐ڑȂ̂ŁA𑗂܂B̌ʁAQ҂SYN/ACK3قǍđ܂B53ԃ|[gł̐ڑ݂SYN/ACK߂Ă̂ŁÃ|[gŃT[rX҂󂯂ĂƍlĂł傤B
̃vZX13Ԗڂ̃pPbgłxJԂĂ݂܂傤B113ԃ|[gA܂IRCʂF؂ɎgIdentvgRƊ֘A|[g֑ꂽASYNpPbgłB̃|[gɓ^CṽtB^KpƁA}10-5̂悤4̃pPbg\܂B

}10-5@SYN̂ƂRSTMA|[gĂ邱ƂĂ

ŏSYNpPbĝƁARSTQ҂瑗MĂ܂B͂̃|[gŐڑĂ炸AT[rXғĂȂƂӖĂ܂B

|[g̊Jɂ߂
SYNXLɑ΂鉞̈Ⴂ𗝉Ax͂ǂ̃|[gJĂāAǂꂪĂ̂𔻒fvȕ@T܂Bx̓[Conversations]EBhEɂ܂B̃EBhEł́ApPbgԍɂTCPΘb\[gAPacketsJ2NbNĐlɕׂ邱Ƃł܂i}10-6jB

}10-6@[Conversations]EBhEŊJĂ|[gT

3̃|[gXLʁAꂼ̑Θb5̃pPbg\܂y1zB5̃pPbgŏSYNAɉSYN/ACKAQ҂đꂽSYN/ACK\Ă̂ŁA53ԁA80ԁA22Ԃ̃|[gJĂ邱Ƃ܂B
̑5̃|[gł́A2̃pPbg\Ă܂y2zBP߂͍ŏSYNA2ԖڂRSTłB܂113ԁA25ԁA31337ԁA113ԁA70Ԃ͕Ă܂B
c̃Ggɂ1pPbg݂Ȃ̂ŁAQ҂̃zXgŏSYNɉȂƂɂȂ܂BĎc̃|[g͕Ăƍl܂Amł͂܂B

OStBK[vg
U҂͕WIOSm邽߂ɑȓw͂܂BOS΁AK؂ȍUd|邩łB܂OS肷邱ƂŁAdvȃt@CfBNgǂɂ邩̂ŁAVXeɃANZX₷Ȃ܂B
OStBK[vǵAۂɂ̃VXeɃANZX邱ƂȂAVXeŎsĂOS肷̂ɗpeNjbN̑̂łBOStBK[vgɂ́ApbVuƃANeBu2ނ܂B

pbVutBK[vg
pbVutBK[vgł́AWI瑗ꂽpPbg̓̃tB[h𒲍邱ƂɂāAOS𔻒f܂B̕@pbVui󓮓IjƂ̂́AWIMpPbg`FbN邾ŁA̓pPbg𑗐MȂ߂łBXeXɎsł邽߁AU҂ɂƂĂ͗zIȕ@łB
͂ĂAĂpPbg𒲂ׂ邾ŁAǂĕWIOSł̂ł傤B͔͂ɊȒPŁARFCŒ`ꂽvgR̎dl̂ŉ\ɂȂĂ̂łBTCPAUDPAIPwb_ɂ͂tB[h܂AftHglݒ肳Ă܂B܂TCP/IPX^bNꍇAeOS͂̃tB[h̃ftHgl`Kv܂B\10-1͈ʓIȃtB[hƁA܂܂OSł̃ftHglĂ܂B

\10-1@ʓIȃpbVutBK[vg̒l
vgRwb_@IP@IP@TCP@TCP@TCP
tB[h@ŏTTL@tOg֎~tO@őZOgTCY@EBhETCY@SackOK
ftHgl
OS

t@Cpassiveosfingerprinting.pcapɊ܂܂Ă2̃pPbg悢łBǂ80ԃ|[gɑꂽTCP SYNpPbgłAႤzXg瑗MĂ܂B̃pPbgɊ܂܂l\10-1ɏƍ邾ŁAꂼ̃zXgOSł͂łBepPbg̏ڍׂ͐}10-7Ɏ܂B

}10-7@pPbgOSł

\10-1QƂāApPbgʂɊ֘AtB[h̏ڍׁi\10-2j܂B

\10-2@pPbgʂOStBK[vg
vgRwb_@tB[h@pPbg1̒l@pPbg2̒l
IP@ŏTTL@
IP@tOg֎~tO@Zbg@Zbg
TCP@őZOgTCY@1440oCg@1460oCg
TCP@EBhETCY@64240oCg@2920oCg
TCP@SackOK@Zbg@Zbg

̒lɂāApPbg1Windowsڋ@ApPbg2Linuxڋ@瑗ꂽƌ_Â邱Ƃł܂B
\10-1̈ʓIȃpbVutBK[vg̃tB[h̃XǵASȂ̂ł͂܂BԈႢ̂ŁAlɋꍇł傤B̂߁ApbVuOStBK[vg瓾ꂽʂɑSʓIɗ邱Ƃ͂ł܂B

@OStBK[vg@Ɏgc[̂ЂƂp0fłB̃c[̓pPbgLv`Ŋ֘AtB[h͂A^킵OSAEgvbg܂Bp0f̂悤ȃc[gƁAOSłȂÃo[Wpb`܂łł܂Bp0fhttp://lcamtuf.coredump.cx/p0f.shtml_E[hł܂B

ANeButBK[vg
󓮓IɃgtBbNĎ邾ł͌ʂȂꍇA蒼ړIȃAv[`KvɂȂ܂BANeButBK[vgƌĂт܂BU҂OS肷鉞o߁AʂɍpPbgQ҂ɑM܂B̎@ł͔Q҂ƒڂŝŃXeXł͂܂񂪁AȂʂ͂܂B
t@Cactiveosfingerprinting.pcapɂ́ANmapXL[eBeBgAANeBuOStBK[vgXL̗Ⴊ܂܂Ă܂Bt@C̃pPbǵAOS肷鉞o悤݌vꂽv[uANmapʂɂ̂łBNmap͂v[uւ̉L^ătBK[vg쐬Af[^x[X̒lƔrOS肵܂B

@NmapANeBuOS肷邽߂ɗp@͂Ȃ蕡GłBNmapɂANeBuOStBK[vgǂ̂悤ɎsĂ邩ɊwԂɂ́ANmap̍҂łGordon gFyodorh LyonɂNmapKChuNmap Network ScanningvQƂĂB

GNXvCe[V
U҂݂͂ȁAGNXvCe[VړIƂĂ܂BT[`sAWI@AƎ㐫AWIɃANZX邽߂̃GNXvCg܂B̏͂̎c̕ł́AMicrosoft̐Ǝ㐫̃GNXvCgAARPLbV|C]jOɂgtBbÑ_CNgAf[^os郊[gANZX^gC̖ؔn܂ށA܂܂ȃGNXvCe[V@Ă܂傤B

Operation Aurora
2010N1AOperation AuroráA܂mĂȂInternet Explorer̐Ǝ㐫˂܂BU҂͂̐Ǝ㐫pAGoogle₻̑Ƃ̃}VA[gxŉu삵̂łB
[U[Internet ExplorerWebTCgK邾ŁAӂR[hsAU҂͊ǗҌgă[U[̃}VɃANZXł悤ɂȂ܂Bɂ͈ӂTCgւ̃N܂ރ[𑗐MXsAtBbVO̎g܂BXsAtBbVÕ[͐Mpł鑊肩瑗MĂ悤ɌĂ邽߁ÂłB
AuroráAWIƂꂽ[U[XsAtBbVÕ[̃NNbNƂn܂Ă܂Bt@Caurora.pcapɃt@CĂ܂B
Lv`́AQҁi192.168.100.206jƍUҁi192.168.100.202jƂ3EFCnhVFCNŎn܂Ă܂Bŏ̐ڑ80ԃ|[gōsĂ̂ŁAHTTPgtBbNƍlĂ悢ł傤B̐́A4Ԗڂ̃pPbgłA/infoHTTP GETNGXgy1zɂĊmFł܂i}10-8jB


}10-8@Q҂/infoGETNGXg𑗐M

U҂̃}VGETNGXg̎MmFA6Ԗڂ̃pPbgŉR[h302ĩAhX͈ꎞIɈړĂ܂jƕ񍐂܂B̃Xe[^XR[h͈ʂɁAʂ̃y[WɃ_CNgꍇɗp܂BXe[^XR[h302y1zƂƂɁA[Location]tB[hP[V/info?rFfWELUjLJHpPw肵܂i}10-9jB

}10-9@̃pPbgŃNCAg̃uEU_CNg

R[hHTTP 302̃pPbg󂯎ƁANCAg7Ԗڂ̃pPbgŁA/info?rFfWELUjLJHpP URLɂЂƂGETNGXg𑗂A8Ԗڂ̃pPbgACK󂯎܂BACKɑ̃pPbǵAU҂Q҂ւƓ]ꂽf[^łB̃f[^悭邽߁AXg[̂Ȃ9Ԗڂ̃pPbgENbNāA[Follow TCP Stream]I܂B̃Xg[̃AEgvbgɂ́AŏGETNGXgA302_CNgA2ԖڂGETNGXg\Ă܂i}10-10jB
̂Ƃɂ킩ɏ󋵂ȂĂ܂BU҂͔ɊȃRecGETNGXgɉĂ̂łB̃Rec̍ŏ̕}10-11Ɏ܂B
Rec<script>^OɈ͂܂ꂽAÃ_Ȑƕ̂悤Ɍ܂y1zBXNvggĂ邱Ƃ߂HTMLŎĝ<script>^OŁÃ^Oň͂܂ꂽɂ͒ʏ킳܂܂ȃXNvgXe[gg܂B̂ł߂ȕƐ́Ao邽߂ɈÍĂ邱ƂĂ܂Bł͂ꂪGNXvCgƕĂ̂ŁAeLXĝ܂ȕɂ̓pfBOAƎ㐫GNXvCg邽߂̃VFR[h܂܂ĂƍlĂł傤B

}10-10@NCAgɓ]f[^Xg[

}10-11@<script>^Oň͂܂ꂽRec͈ÍĂ

U҂瑗MꂽRec2Ԗڂ̕}10-12Ɏ܂BÍꂽeLXĝƂɁA悤₭ǂނƂłeLXg܂BvO~O̒mȂĂÃeLXg̕ϐƂɃXgOϊ̂̂悤Ɍ܂Bꂪ</script>^OŕÕeLXg̍Ō̕łB

}10-12@T[o瑗MꂽReĉ̕ɂ́Aǂ߂eLXgƋ^킵ACt[܂܂Ă

U҂NCAgɑMf[^̍Ō̕2ɕĂ܂Bŏ̃ZNV<span id="vhQYFCtoDnOzUOuxAflDSzVMIHYhjJojAOCHNZtQdlxSPFUeEthCGdRtiIY">y1złB2Ԗڂ̃ZNV<span></span>^Oɂ͂܂Ă<iframesrc="/infowTVeeGDYJWNfsrdrvXiYApnuPoCMjRrSZuKtbVgwuZCXwxKjtEclbPuJPPctcflhsttMRrSyxl.gif" onload="WisgEgTNEfaONekEqaMyAUALLMYW(event)" />y2złBJԂ܂ÃRec͕sRɒAǕs\ȃ_ȕłA킴Ƃ킩ɂĂ\_Aӂ銈̂邵ƍl܂B
<span>^OɈ͂܂ꂽR[h́̕uACt[vƂAU҂HTMLy[WɃRec𖄂ߍނƂɎg悭@łB<iframe>^O̓[U[ołȂCCt[쐬܂Bł<iframe>^O͊ȖOGIFt@CQƂĂ܂BQ҂̃uEŨt@C̎QƂ{ƁA21Ԗڂ̃pPbgGETNGXg𑗂y1zAƂɂGIF܂y2zi}10-13jBGIF͂炭AłɔQ҂̃}VɃ_E[hĂGNXvCgR[hgK̂ɗpƎv܂B

}10-13@Q҂̓ACt[Ŏw肳ꂽGIFvA_E[h

Q҂U҂4321ԃ|[gŐڑJnƂA25Ԗڂ̃pPbgŊȂƂNĂ܂B2Ԗڂ̒ʐMXg[pPbgڍׂ̃yCŌĂقƂǏ񂪂Ȃ̂ŁAēxTCPXg[āA肳Ăf[^悭ׂĂ݂܂傤B}10-14[Follow TCP Stream]EBhẼAEgvbgłB

}10-14@U҂R}hVFł肵Ă

WindowsR}hVFAxKvły1zB̃VF͔Q҂T[o֑ꂽ̂ŁAU҂̃GNXvCgAyC[hhbvꂽƂӖłBGNXvCgオƁANCAg̓R}hVFU҂ɖ߂܂B̃Lv`ł́AU҂dirR}h͂y2zAQ҂̃}ṼfBNgĂ邱Ƃ番܂BB
R}hVFɃANZXU҂́AQ҂̃}Vɑ΂ǗҌ̂ŁADł悤ɂȂ܂B1x́A킸b̃NbNŁAQ҂̃}V̊Ǘׂ͂čU҂ɓnĂ܂̂łB
̂悤ȃGNXvCǵAlbg[NIDSɌôh߁A肳ۂ͕Ȃ悤ɈÍĂ܂B̂߂̃GNXvCgɂĂ̎O̒mGNXvCgR[h̃TvȂƁAȂ͂ȂAQ҂̃VXeŉNĂ邩𐳊mɔĉ͍łBKɂ̃pPbgLv`ɂ́AӂR[h̖炩ȒA܂<script>^Oň͂܂ꂽǉꂽeLXgAȃACt[AăvCeLXgŏꂽR}hVF܂B
AuroraGNXvCgǂ̂悤ɍU邩܂Ƃ߂Ă݂܂傤B
EQ҂͐Młƌ[U҂󂯎ÂȂ̃NNbNƁAU҂̈ӂTCgGETNGXgM܂B
EU҂WebT[oQ҂302_CNg𑗐MAQ҂̃uEU̓_CNgꂽURLɁAIGETNGXg𑗐M܂B
EU҂WebT[óAGNXvCgƁAӂGIFC[Wւ̃N܂񂾃ACt[܂ފJavaScriptR[h̓Weby[WANCAgɕ\܂B
EQ҂͈ӂC[WGETNGXg𑗐MAT[o_E[h܂B
EɑMꂽJavaScriptR[hӂGIFɂĉǂAQ҂̃}VŃR[hsAInternet Explorer̐Ǝ㐫GNXvCg܂B
EƎ㐫GNXvCgƁAR[hɉBꂽyC[hsA4321ԃ|[gŔQ҂ƍUҊԂł̐VȃZbVJn܂B
EyC[hR}hVFAU҂֖߂AU҂R}hVF𑀂悤ɂȂ܂B

h̎_炢ƁÃLv`t@CIDS̃VOl`쐬΁Aケ̍UN̂h邩m܂BƂ΁A<script>^Oň͂܂ꂽeLXg̍ŌɂvCeLXĝ悤ɁAǉĂȂtB^邱Ƃ\łB邢URLɁuinfov܂܂TCgցA302Ń_CNgꂽׂĂHTTPgtBbNɂāAVOl`Lq邱Ƃl܂BVOl`Ŏgɂ͂ɒKv܂AȂACfBAłB

@ӂgtBbÑTvƂɃVOl`쐬̂́Am̋Ђlbg[N낤ƂlɂƂďdvȃXebvłBŐ悤ȃLv`́AVOl`쐬XL𖁂̂ɍœKłBNmƍUVOl`ɂĂɒm肽΁ASnortvWFNghttp://www.snort.org/QƂĂB

ARPLbV|C]jO
ARPLbV|C]jOɂẮA2͂Ő܂B̓lbg[NGWjAɂƂāAʓILvȃc[ƂȂ܂BȂAӂĎgpƁAԎҁiMITMjUƂĒvIȂ̂ɂȂ肤̂łB
ԎҍUł́AU҂͒ʐM̊荞݂܂͕ύXs߂ɁA2̃zXgԂ̃gtBbN_CNg܂BԎҍUɂ́AZbVnCWbNADNSXv[tBOASSLnCWbN܂ށA܂܂Ȍ`܂B
ARPLbV|C]jOł́AʂɍꂽARPpPbgA2̃zXg݂ɒʐMĂƎv܂܂Bۂɂ́AԎ҂ƂăpPbg]Ă3҂ƒʐMĂ̂łB
t@Carppoison.pcapɂ́AARPLbV|C]jO̗Ⴊ܂܂Ă܂Bt@CJƁA܂Q҂ł172.16.0.107Google{AĂ̂܂B̌ɂADNSNGHTTPgtBbNĂ܂B
ARPLbV|C]jO̓C2ŎgeNjbNȂ̂ŁApPbgꗗ̃yCŃpPbg𒲂ׂĂ݂܂Assׂ͓̂łBpPbgꗗ̃yCɂJǉāA킩₷Ă݂܂傤B

1D[Edit][Preferences]I܂B
2D[Preferences]EBhE̍[Columns]NbN܂B
3D[Add]NbN܂B
4DSource MACƓ͂A[Enter]܂B
5D[Field type]̃hbv_EXgŁA[Hw src addr (resolved)]I܂B
6Dǉ΂̃GgNbNA[Source]ĴƂɂ悤hbO܂B
7D[Add]NbN܂B
8DDest MACƓ͂A[Enter]܂B
9D[Field type]̃hbv_EXgŁA[Hw dest addr (resolved)]I܂B
10Dǉ΂̃GgNbNA[Destination]ĴƂɂ悤hbO܂B
11D[OK]NbN܂B

̃XebvƁA}10-15̂悤ȉʂɂȂ͂łBŃpPbg̑MƈMACAhX2̃Jǉł܂B

}10-15@MƈMACAhXVȃJǉꂽJݒ

MACAhX̖OIɂȂĂ΁AʐMĂʐM@킪DellCiscô̂ƕ͂łB͔ɏdvȂ̂ŊoĂ܂傤BȂƂƃLv`XN[ƂA54Ԗڂ̃pPbgŁADell̃zXgiQҁjƐVɓĂHP̃zXgiUҁjƂ̊ԂɁAςARPgtBbNĂ邩łi}10-16jB

}10-16@Dell@HP@Ԃ̊ARPgtBbN

ɐiޑOɁA̒ʐMɊւĂGh|CgĂ܂傤B\10-3ɂ܂Ƃ߂܂B

\10-3@ĎĂGh|Cg
@[J[@IPAhX@MACAhX
Qҁ@Dell
[^@Cisco
Uҁ@HP@s

ł͉̃gtBbNĂ̂ł傤B6͂ARPɂĂ̐voĂق̂łAARPpPbgɂ͎2̃^CvA܂胊NGXgƃX|X܂BNGXgpPbǵAIPAhXɌтMACAhX}V邽߁Albg[Nׂ̂ẴzXgɃu[hLXgƂđ܂BƃNGXg𑗐MʐM@ɉ`ŁA}VpPbgM܂BƂlƁA̒ʐMɂ͊ȓ_܂B
ЂƂɂ́A54Ԗڂ̃pPbǵAMACAhX00:25:b3:bf:91:ee̍U҂AMACAhX00:21:70:c0:56:f0̔Q҂ɒڑMꂽARPNGXgły1zB̎̃NGXǵAlbg[Nׂ̂ẴzXgɃu[hLXgׂȂ̂ɁAQ҂𒼐ڃ^[QbgɂĂ܂B܂̃pPbg͍U҂瑗Mꂽ̂ŁAARPwb_ɂ͍U҂MACAhX܂܂Ăɂւ炸AIPAhX̓[^̂̂ƂȂĂ܂B
̃pPbĝƂɂ́AMACAhX܂񂾔Q҂̃X|XU҂ɑĂ܂y2zB낵ƂNĂ̂56Ԗڂ̃pPbgłBU҂ARPX|X́AIPAhX172.16.0.1́AMACAhX00:25:b3:bf:91:eeƓ`Ă̂łBBȂ̂́A172.16.0.100:25:b3:bf:91:eeł͂ȂA00:26:0b:31:07:33ƂƂłB172.16.0.1̃[^pPbgLv`̍ŏ̂قŔQ҂Ƃ肵Ă̂ŁA̎Ă܂BARPvgR͈Sł͂Ȃ߁ĩAbvf[głARPe[uɔfjAQ҂̓[^ɍsׂgtBbNAU҂ɑĂ܂܂B

@̃pPbgLv`͔Q҂̃}V̂̂Ȃ̂ŁAS̑͌܂BۂɍUd|ɂ́AU҂Q҂ƃ[^Ɏv킹邽߁AÃpPbg[^ɑMȂ΂Ȃ܂B̃pPbgɂ́A[^i邢͍Uҁj̃pPbgLv`KvłB

܂܂ƁA}10-17̂悤ɁAQ҂ƃ[^Ԃ̒ʐMU҂ւƗ܂B

}10-17@ARPLbV|C]jOiԎҍUj
ARPXv[tBOݒiQ҂̎_j
[^iCiscoj
UҁiHPj
QҁiDellj

172.16.0.107172.16.0.1ƋU

172.16.0.10700:21:70:c0:56:f0ɂ

172.16.0.100:25:b3:bf:91:eeɂ

ARPXv[tBǑʁiU҂gtBbNɊ荞ށj
[^
U
Q

57Ԗڂ̃pPbgAU̐mFĂ܂B̃pPbgAARPgtBbNOɑpPbgi40ԖڂȂǁjƔׂƁi}10-18QƁjA[gT[oiGooglejIPAhX͓ły1zA^[QbgMACAhXςĂ܂y2zBMACAhXςƂA݃gtBbN̓[^ʉ߂OɁAU҂oRĂƕ܂B
̍U͖{ɖڗȂ̂ŁAoɓȂ܂BUpɐݒ肳ꂽIDS̏؂邩AARPe[uGg̋}ȕύXo悤݌vꂽ\tgEFAKvłB͂Ălbg[ÑpPbgLv`邽߂ARPLbV|C]jO𗘗p邱ƂȂł傤An̐nƂƂmĂׂłB

}10-18@^[QbgMACAhX̕ύX͍U̐

[gANZX^gC̖ؔn
܂ł́ALv`𒲂ׂOɁANĂ̂ĂZLeBĂ܂BUǂ̂悤ɍs邩wԂɂ͂悢@łA܂茻Ił͂܂BЉ̃ViIł́Albg[Nh̎dSlX́Albg[Ns邷ׂẴpPbg𒲂ׂ͂܂B̑ɁAIDSgāAlbg[NgtBbNɈُ킪Όx󂯂悤ɂA炩ߒ`UVOl`ƂɁAɒs悤ɂ܂B
̗ł́AẺ͂̂悤ɁAȒPȌxn߂܂B̃P[XłIDŜ͎悤Ȍxo܂B

[**] [1:132456789:2] CyberEYE RAT Session Establishment [**][Classification: A Network Trojan was detected] [Priority: 1]07/18-12:45:04.656854 172.16.0.111:4433 -> 172.16.0.114:6641TCP TTL:128 TOS:0x0 ID:6526 IpLen:20 DgmLen:54 DF***AP*** Seq: 0x53BAEB5E Ack: 0x18874922 Win: 0xFAF0  TcpLen: 20

̃Xebvł͂̌xNVOl`[܂B

alert tcp any any -> $HOME_NET any (msg:"CyberEYE RAT Session Establishment";content:"|41 4E 41 42 49 4C 47 49 7C|"; classtype:trojan-activity;sid:132456789; rev:2;)

̃[́A16ĩRec41 4E 41 42 49 4C 47 49 7C܂܂pPbglbg[NɐNĂAx𔭂悤ݒ肳Ă܂B̃Rec͐lԂǂ߂ASCIIƁuANA BILGIvƕϊ܂BoƌxACyberEYE[gANZX^gC̖ؔniRATj݂\m点܂BRAT͔Q҂̃Rs[^Ŕ閧ɎsAU҂ւƐڑ鈫ӂvOŁAU҂͔Q҂̃}Vu삷邱Ƃł܂B

@CyberEYERATst@C쐬AzXg𑀂邽߂́AgR܂̗Lȃc[łBɂAx𔭂悤ɐݒ肵uANA BILGIvƂ́AgRŁu{vƂӖłB

x̓t@Cratinfected.pcap̌xɊ֘AgtBbNĂ݂܂傤BSnortx́Aʏ͌xgKPƂ̃pPbĝ݂Lv`܂Ał̓zXgԂ̒ʐMV[PXŜւĂ܂B̂悤Snort[Œ߂16iXgO܂B

1D[Edit][Find Packet]I܂B
2D[Hex Value]WI{^Iт܂B
3DeLXg̕41 4E 41 42 49 4C 47 49 7C̒l͂܂B
4D[Find]NbN܂B

}10-19Ɏ悤ɁA4Ԗڂ̃pPbg̃f[^ŏL̃XgO܂͂ły1zB

}10-19@4Ԗڂ̃pPbgł܂Snortx̃XgO

[Edit][Find Next]̑IxJԂƁA5A10A32A156A280A405A531A652Ԗڂ̃pPbgł̃XgO܂B̃Lv`ׂ̂Ă̒ʐMUҁi172.16.0.111jƔQҁi172.16.0.114jƂ̊Ԃ̂̂łAXgÖꕔ̃CX^X͕ʂ̑ΘbŋNĂ悤łB4Ԗڂ5Ԗڂ̃pPbg4433Ԃ6641Ԃ̃|[ggĂ܂Aق̃CX^X̂قƂǂ4433ԃ|[gƂق̃_ɑIꂽGtF|[gŋNĂ܂B[Conversations]EBhETCP^u΁A畡̑Θb݂̑mFł܂i}10-20jB

}10-20@U҂ƔQ҂Ƃ̊Ԃ3̑Θb

F邱ƂɂāAႤΘbڂŕނ邱Ƃł܂B

1DpPbgꗗ̃yC̏ɂtB^_CAOŁAtB^(tcp.flags.syn ==1) && (tcp.flags.ack == 0)́A[Apply]NbN܂BŃgtBbN̊eΘb̍ŏSYNpPbgIł܂B
2Dŏ̃pPbgENbNA[Colorize Conversation]I܂B
3D[TCP]IAFIт܂B
4DcSYNpPbgɂĂvZXJԂAꂼɂĈႤFIт܂B
5DI[Clear]NbNAtB^폜܂B

ΘbFƁA݂ǂ֘AĂ邩ĕ悤ɂȂ̂ŁA2̃zXgԂ̒ʐMvZXǐՂ₷Ȃ܂B2̃zXgʐMn߂̂ŏ̑Θbi6641ԁ^4433ԃ|[gjȂ̂ŁAn߂̂ł傤BΘb̃pPbĝǂꂩENbNA[Follow TCP Stream]IāA]f[^܂i}10-21jB
܂U҂Q҂ɁAeLXgXgOANABILGI|556MĂ̂܂y1zBƔQ҂́ARs[^iCSANDERS-6F7F77jAgpĂOS(Windows XP Service Pack 3)Ȃǂ܂ފ{IȃVXeƂđy2zAU҂ɓXgOBAGLIMI?𑗐M܂BBU҂瑗ʐM̓XgOCAPSCREEN60Ĉ݂ŁA6񌻂Ă܂B
U҂߂CAPSCREEN60XgOCɂȂ̂ŁAǂւȂĂ̂ƌĂ݂܂傤Bɂ͂܂_CAOgA[String]IvVw肵āApPbgł̃eLXgXgO܂B

}10-21@ŏ̑Θbʔʂo

̌sƁA27Ԗڂ̃pPbg̃XgOōŏ̃CX^X܂B̏񂪋[̂́AXgOU҂NCAgɑƂANCAgpPbg̎󂯎mFāA29Ԗڂ̃pPbgŐVΘbn܂Ă邱ƂłB
̐VΘbTCPXg[AEgvbgǐՂƁi}10-22jAꂽXgOANABILGI|556ڂɓÂƂɃXgOSH|556AŌCAPSCREEN|C:\WINDOWS\jpgevhook.dat|84972Ă܂y1zBCAPSCREEN̂ƂɃt@CpXw肳ĂāÂƂɉǕs\ȃeLXĝɋCÂł傤BŖʔ̂́AǕs\ȃeLXgXgOJFIF̐擪ɒǉĂ邱ƂŁy2zAGoogleJPGt@C̐擪Ɍ̂łB
̎_ł́AU҂͂JPGC[W]邽߂ɑΘbJnƔfĂł傤BɏdvȂ̂́ÃgtBbNR}h\邱ƂłBCAPSCREEN͍U҂JPGC[W]邽߂ɋNR}ĥ悤łBCAPSCREENR}hMƁAʂ͓łB؂ɂ́AeΘb̃Xg[邩Â悤WiresharkIOOt@\g܂B

1D[Statistics][IO Graphs]I܂B
2DtB^tcp.stream eq 2Atcp.stream eq 3A tcp.stream eq 4Atcp.stream eq 5Atcp.stream eq 6A5̃tB^_CAOɂꂼ}܂B
3D[Graph 1][Graph 2][Graph 3][Graph 4][Graph 5]̃{^NbNAw肵tB^̃f[^|CgLɂ܂B
4DỸXP[[Byte/Tick]ɕύX܂B

}10-23̃OtłB

}10-22@U҂JPGt@C̃NGXgJn悤ƂĂ

}10-23@JԂ悤ƂĂ邱ƂOt

̃Otɂ΁AeΘbɓʂ̃f[^܂܂ĂāÂ悤łBł̊JԂĂƔfł܂B

]ꂽJPGC[W̃RecɂĂ͑zł傤AJPGt@C̒gۂɌ邩ǂĂ݂܂傤BWiresharkJPGf[^𒊏oɂ́ÃXebvs܂B

1D܂}10-22̑O͂̕Ő悤ɁApPbgTCPXg[ǐՂ܂B
2DʐM͕Ă̂ŁAQ҂U҂֑ꂽf[^Xg[݂̂͂łBsɂ[Entire Conversation (85033oCg)]Ƃhbv_Ẻ̖I܂B172.16.0.114:6643 --> 172.16.0.111:4433 (85020oCg)ƂȂ悤AgtBbNiǰɒӂ܂B
3D[Save As]{^Ńf[^ۑ܂Bgq.jpgƂ̂YȂ悤ɁB

C[Wt@CJƂĂJ܂B1iKcĂ邩łB8͂FTPgtBbNt@C𒊏ôƂ͈قȂÃgtBbN͎ۂ̃f[^ɃRecǉĂ܂B̏ꍇATCPXg[̍ŏ2s̓gC̖ؔñR}hV[PẌꕔŁAJPG\Ăf[^ł͂܂i}10-24jBXg[ۑƁÅOf[^ۑ܂B̌ʁAJPGt@Cwb_Tt@Cr[́ATĂ̂Ƃ͈vȂRec邱ƂƂȂ邽߁A摜JȂ̂łB

}10-24@gC̖ؔnǉOf[^At@CĴWĂ

̖̂͊ȒPȃvZXłAoCiGfB^gƂ삪KvłB̃vZXt@CJ[rOƂ܂B}10-25ł́AWinHexgJPGt@C̍ŏ̐oCgnCCgĂ܂BoCiGfB^gẴoCg폜A摜t@Cۑ܂傤B

}10-25@JPGt@CoCg菜

svȃf[^폜΁At@CJ͂łBgC̖ؔnQ҂̃fXNgbṽXN[Lv`AU҂ւƖ߂ĂƂł͂肵܂i}10-26jB

}10-26@]ꂽJPG͔Q҂̃Rs[^̃XN[Lv`

̒ʐMV[PXƁAʏTCPeBA_EɂĒʐMI܂B
̃ViÍAIDSɂxƂɃgtBbN͂ƂɁANAiXgǂvZẌłB

ExƌxNVOl`𒲂ׂ܂B
EVOl`ۂɃgtBbNɂ邱ƂmF܂B
EgtBbN𒲂ׁANꂽ}VōU҂s܂B
EQ҂炳ɏdvȏ񂪘RȂ悤A߂Jn܂B

܂Ƃ
ZLeB֘ÃViIł̃pPbgLv`̕AʓIȍỦ́AIDSɂxւ̉ɂĂŁA1̖{܂B̏͂ł͈ʓIȃXLjOƃGj[Ṽ^CvAԎҍUAVXẽGNXvCgɂĂ2̗A܂}VꂽꍇɉN邩ɂĐ܂B

