臺灣博碩士論文加值系統

全球的網路正面臨不斷演變的攻擊威脅，而其中進階持續性威脅(Advanced Persistent Threat, APT)攻擊則是最具有防護與偵測挑戰，駭客集團針對特定的企業、國家單位設計精細的攻擊手法，企圖竊取商業機密、國家機敏資訊等，竟而從中獲利、導致國家威脅。
台灣APT資安實務人才需才孔亟，雖然國內外皆已發展眾多資安數位靶場與搶旗競賽(Capture the Flag, CTF)，然至今依然缺乏以APT網路攻擊鏈(Cyber Kill Chain)架構為基礎，所設計的攻擊鏈數位靶場(Cyber Kill Chain Range, kRange)，用以教授網路攻擊鏈各階段攻擊手法、技術工具與程序(Tactics, Techniques and Procedures, TTPs)的實務演練平台。
有鑑於此，實驗室已在多年前成功研發以APT網路攻擊鏈為基礎所設計的網路攻擊鏈數位靶場(kRange)與挑戰平台(kCTF)，但為希望能推廣至全國各大專校院，因此與國家高速網路與計算中心雲端資安攻防平台(Cyber Defense Exercise, CDX)團隊合作，將kCTF與kRange建置於CDX平台中運行，並達到推廣擴散之效(kCTF@CDX)。
本論文說明如何在跨部會合作、異質虛擬化平台、權限不足等眾多限制環境下，如何成功將kCTF與kRange建置於CDX平台中順利運行之方法，以及推廣應用於網路攻擊鏈實務培訓產生之實質擴散效益。
其次也使用kCTF挑戰平台作為基礎框架，透過真實案例所使用的手法、工具來設計更多元的攻擊情境與題目，並規劃出三個適合初階、中階、進階等難易度的挑戰題目，讓使用者在演練網路攻擊鏈數位靶場時，能夠有更多面向攻擊手法、技術工具與程序進行演練，給剛接觸資訊安全的人認識基礎資訊安全，且從中得知身邊的工具操作不當的危險性，讓使用者能夠以駭客的思維來進行演練，進而從中思考該如何抵禦駭客的入侵、駭客可能利用的入口、入侵後的駭客可能在主機上殘留哪些軌跡或日誌，也能藉由CDX平台至各大專校院推廣教學，提升資訊安全的意識。

The global network is facing an evolving attack threat. Advanced Persistent Threat (APT) attacks are the most protection and detection challenges. The hack group designed complex attack tactics for specific companies and government departments, to steal business secrets, information, etc., and actually profited from it, leading to the threat of the country.
In Taiwan, there are few talents who is good at security information. Although there are many Cyber Security Range and Capture the flag(CTF) platform. However, there is still a lack of cyber kill chain Range (kRange) designed based on the APT cyber kill chain, that be used by teaching attacking methods of cyber kill chain, Tactics, Techniques and Procedures(TTPs).
The laboratory was successfully research and development kRange based on APT cyber kill chain many years ago, but we are going to promote to university and students all over the country, so we build the kCTF and kRange on the CDX successfully with National Center for High-Performance Computing(NCHC) CDX. This achievement is very successful for promoting this project.
This Thesis will explain the solution about building kCTF and kRange on the CDX when we met the difficult challenge like how to work together in inter-organization, different visualization, permissions deny. And we promote kRange and kCTF to let more students learning knowledge about cyber kill chain.
Secondly, the kCTF challenge platform is also used as the basic framework to design more attack scenarios and Topic through real-world cases, and design three challenging level about basic, middle, advanced, and other difficulty levels so that users can have more tactics, techniques and procedures. People who lack knowledge about information security will understand basic information security when learning cyber kill chain in the cyber kill chain range. They will practice cyber kill chain from hacker point of view. Like entrance what hacker use, the logs or audit from destroyed victim and then know how to defense attack from hackers. We hope to teach and promote all over the world that will improve people awareness of information security.

摘　　要 i
Abstract iii
誌 謝 v
目 錄 vi
表目錄 ix
圖目錄 x
第一章 緒論 1
1.1 前言 1
1.2 研究動機 2
1.3 研究貢獻 3
1.4 論文架構 3
第二章　研究背景與技術回顧 4
2.1 網路攻擊鏈(Cyber Kill Chain) 4
2.2 oVirt虛擬化管理平台 6
2.3 網路攻擊鏈數位靶場(kRange) 6
2.4 網路攻擊鏈挑戰平台(kCTF) 7
2.5 國家高速網路中心雲端資安攻防平台 9
2.6 服務相關漏洞與利用 10
2.6.1 漏洞-ms17-010 10
2.6.2 遠端桌面協定 10
2.6.3 使用者帳戶控制 10
2.6.4 資料庫注入(SQL injection) 11
2.6.5 漏洞-Struts2 S2-045 11
2.7 滲透工具-Penetration Tools 11
2.7.1 DNSMap 11
2.7.2 Nmap 12
2.7.3 Metasploit 12
2.7.4 ChromePass 13
2.7.5 Medusa 13
2.7.6 Burp Suite 14
第三章　網路攻擊鏈數位靶場 15
3.1 網路攻擊鏈數位靶場建置於CDX平台 15
3.2 精簡架構的網路攻擊鏈數位靶場 17
第四章　情境設置 25
4.1 情境一之修改目標資料數據 25
4.1.1 情境一漏洞說明 25
4.1.2 情境一攻擊途徑 26
4.2 情境二之收集大量受害電腦 28
4.2.1 情境二漏洞說明 29
4.2.2 情境二攻擊途徑 29
4.3 情境三之竊取目標用戶資訊 30
4.3.1 情境三漏洞說明 31
4.3.2 情境三攻擊途徑 32
第五章　實驗結果 34
5.1 外網偵蒐 34
5.1.1 共通題目 34
5.1.2 情境一 34
5.1.3 情境二 35
5.1.4 情境三 35
5.2 準備與派送武器 36
5.2.1 情境一 36
5.2.2 情境二 37
5.2.3 情境三 38
5.3 獲得初始感染點並探測基本電腦資訊 38
5.3.1 共用題目 38
5.3.2 僅有情境二、三共用題目 39
5.4 內網偵蒐與提權 40
5.4.1 情境一 40
5.4.2 情境二 42
5.4.3 情境三 43
5.5 進行目的相關操作 44
5.5.1 情境一 44
5.5.2 情境二 45
5.5.3 情境三 46
5.6 清除軌跡 47
5.6.1 情境一 48
第六章　結論與未來展望 49
6.1 結論 49
6.2 未來展望 50
參考文獻 52
附錄 54

[1] Apache Struts2 S2-045, Retrieved from https://cwiki.apache.org/confluence/display/WW/S2-045. Accessed 23 June 2018.
[2] Burpsuite, Retrieved from https://portswigger.net/burp/help/suite_gettingstarted. Accessed 23 June 2018.
[3] Chromepass, Retrieved from https://www.nirsoft.net/utils/chromepass.html. Accessed 23 June 2018.
[4] Cyberbit(2016),Cyberbit Range, Retrieved from https://www.cyberbit.com/wp-content/resources/uploads/2016/12/27062048/Cyberbit-Range_Datasheet.pdf. Accessed 23 June 2018.
[5] E.M. Hutchins, M.J. Cloppert and R.M Amin PH.D., "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains", Proc. 6th Int''l Conf. Information Warfare and Security (ICIW 11), Academic Conferences Ltd., 2010, pp. 113–125, Retrieved from https://learningnetwork.cisco.com/servlet/JiveServlet/downloadBody/34123-102-1-145988/LM-White-Paper-Intel-Driven-Defense.pdf. Accessed 23 June 2018.
[6] Eva Mendis(2017), "Forensic Ways to Retrieve Saved Password in Google Chrome", Retrieved from http://blog.jobbole.com/30922/. Accessed 23 June 2018.
[7] Hacking Tools, Retrieved from https://wikileaks.org/ciav7p1/cms/page_20251107.html. Accessed 23 June 2018.
[8] HITCON CTF, Retrieved from http://ctf.hitcon.org/. Accessed 23 June 2018.
[9] MANDIANT(2015), "M-Trends 2015 Threat Report", Retrieved from https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf. Accessed 23 June 2018.
[10] Metasploit, Retrieved from https://www.rapid7.com/products/metasploit/. Accessed 23 June 2018.
[11] MS17-010, Retrieved from https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/ms17-010. Accessed 23 June 2018.
[12] Nmap, Retrieved from https://nmap.org/. Accessed 23 June 2018.
[13] noVNC, Retrieved from URL: https://github.com/novnc/noVNC. Accessed 23 June 2018.
[14] OpenNebula, Retrieved from https://opennebula.org/. Accessed 23 June 2018.
[15] Paul Qiu(2015), "Cisco Cyber Range Service", Retrieved from https://www.cisco.com/c/dam/global/en_hk/assets/event/cisco_connect_2015/pdf/4-3.pdf.
[16] Root Me, Retrieved from https://www.root-me.org/?lang=en. Accessed 23 June 2018.
[17] Sean T Malone (2016) Using an Expanded Cyber Kill Chain Model to Increase Attack Resiliency. Black hat USA 2016. Retrieved from https://www.blackhat.com/docs/us-16/materials/us-16-Malone-Using-An-Expanded-Cyber-Kill-Chain-Model-To-Increase-Attack-Resiliency.pdf. Accessed 23 June 2018.
[18] TrendMicro TrendLabs(2014), "Targeted Attack Trends -2014 Annual Report", Retrieved from https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/reports/rpt-targeted-attack-trends-annual-2014-report.pdf. Accessed 23 June 2018.
[19] TRY2HACK, Retrieved from http://www.try2hack.nl/. Accessed 23 June 2018.
[20] 安全外殼協定, Retrieved from https://zh.wikipedia.org/zh-tw/Secure_Shell. Accessed 23 June 2018.
[21]伺服器訊息區塊, Retrieved from https://zh.wikipedia.org/wiki/%E4%BC%BA%E6%9C%8D%E5%99%A8%E8%A8%8A%E6%81%AF%E5%8D%80%E5%A1%8A. Accessed 23 June 2018.
[22] 使用者帳戶控制, Retrieved from https://zh.wikipedia.org/wiki/%E4%BD%BF%E7%94%A8%E8%80%85%E5%B8%B3%E6%88%B6%E6%8E%A7%E5%88%B6. Accessed 23 June 2018.
[23] 許清雄、潘怡倫、葉永信，「應用國網中心Ezilla建置資安教學環境(Cyber Defense Exercise) 」，TANET 2016 臺灣網際網路研討會，第1001~1004頁，民國一零五年十一月一日。
[24] 結構化查詢語言, Retrieved from https://en.wikipedia.org/wiki/SQL. Accessed 23 June 2018.
[25] 黃柏清，「網路攻擊鏈為基礎之搶旗攻防賽CTF平台」健行科技大學，碩士論文，民國一百零五年。
[26] 跳脫字元, Retrieved from https://zh.wikipedia.org/wiki/%E8%BD%AC%E4%B9%89%E5%AD%97%E7%AC%A6. Accessed 23 June 2018.
[27] 網域名稱系統, Retrieved from https://zh.wikipedia.org/zh-tw/%E5%9F%9F%E5%90%8D%E7%B3%BB%E7%BB%9F. Accessed 23 June 2018.
[28] 遠端桌面協定, Retrieved from https://zh.wikipedia.org/wiki/%E9%81%A0%E7%AB%AF%E6%A1%8C%E9%9D%A2%E5%8D%94%E5%AE%9A. Accessed 23 June 2018.
[29] 暴力破解法, Retrieved from https://zh.wikipedia.org/zh-tw/%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3%E6%B3%95. Accessed 23 June 2018. Accessed 23 June 2018.