如何用 docker 快速建立高互動 honeypot 如何... · 如何用 docker 快速建立高互動...
TRANSCRIPT
![Page 1: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/1.jpg)
![Page 2: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/2.jpg)
徐千洋 (TIM HSU)
CHROOT 創辦人
HITCON 創辦人
網駭科技 創辦人
曾任:
台灣大哥大 資安部經理
現職:
VARMOUR 美商安連網路公司台灣分公司
![Page 3: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/3.jpg)
![Page 4: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/4.jpg)
![Page 5: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/5.jpg)
browser httpd php login.php
/bin/sh
![Page 6: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/6.jpg)
browser httpd php upload.php
webshell.php /bin/sh
![Page 7: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/7.jpg)
![Page 8: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/8.jpg)
•
•
•
![Page 9: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/9.jpg)
•
•
•
![Page 10: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/10.jpg)
UID=165536
UID=165537
dockremap:165536
/etc/subuid
UID=0
UID=1
root:0:XXXX
daemon:1:XXXX
/etc/passwd
![Page 11: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/11.jpg)
•
• SETUID-ROOT
• CAP_NET_RAW
# ls -al /bin/ping
-rwxr-xr-x 1 root root 44168 Mar 15
2014
# getcap /bin/ping
/bin/ping = cap_net_raw+p
![Page 12: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/12.jpg)
•
/usr/sbin/nginx {
#include <abstractions/apache2-common>
#include <abstractions/base>
capability dac_override,
capability net_bind_service,
capability setgid,
capability setuid,
/etc/passwd r,
/etc/group r,
deny /bin/sh mrwklx,
}
![Page 13: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/13.jpg)
![Page 14: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/14.jpg)
•
•
•
![Page 15: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/15.jpg)
•
•
•
![Page 16: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/16.jpg)
•
•
•
![Page 17: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/17.jpg)
•
•
•
![Page 18: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/18.jpg)
•
•
•
![Page 19: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/19.jpg)
![Page 20: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/20.jpg)
HTTP://GITHUB.COM/TIMHSUTW
![Page 21: 如何用 Docker 快速建立高互動 Honeypot 如何... · 如何用 Docker 快速建立高互動 Honeypot Author: Tim Hsu Created Date: 9/22/2016 2:39:36 PM](https://reader033.vdocuments.mx/reader033/viewer/2022061521/5ee23d65ad6a402d666ccd5a/html5/thumbnails/21.jpg)
1. AppArmor security profiles for Docker
https://docs.docker.com/engine/security/apparmor/
2. VulApps
https://hub.docker.com/r/medicean/vulapps/
https://github.com/Medicean/VulApps/
3. Pornhub bug bounty
https://hackerone.com/pornhub
4. Docker security
https://docs.docker.com/engine/security/security/
5. Critical: Remote Command Execution in WordPress Form Manager Plugin (CVE-
2015-7806)
http://appcheck-ng.com/remote-command-execution-in-wordpress-form-
manager-plugin-cve-2015-7806/
6. Struts2 RCE PoC
https://github.com/coffeehb/Some-PoC-oR-ExP/tree/master/Struts2