infobyte/cve-2023-21036Acropalypse Now - CVE-2023-21036에 대한 탐지 및 정화
Python 스크립트 acropalypse_detection.py 또는 Yara 규칙 acropalypse_detection.yar을 사용하여 acropalypse에 영향을 받은 자른 이미지를 탐지할 수 있습니다:
$ for i in test_imgs/*; do python3 acropalypse_detection.py $i; done
test_imgs/windows10_snipping_tool_1_cropped.png
test_imgs/windows10_snipping_tool_2_cropped.png
test_imgs/windows10_snipping_tool_3_cropped.jpg
test_imgs/windows11_1_cropped.png
test_imgs/windows11_2_cropped.png
test_imgs/windows11_3_cropped.jpg
$ yara acropalypse_detection.yar -r test_imgs/
warning: rule "acropalypse_jpeg" in acropalypse_detection.yar(31): string "$a" may slow down scanning
acropalypse_jpeg test_imgs//windows11_3_cropped.jpg
acropalypse_png test_imgs//windows10_snipping_tool_1_cropped.png
acropalypse_png test_imgs//windows10_snipping_tool_2_cropped.png
acropalypse_png test_imgs//windows11_2_cropped.png
acropalypse_png test_imgs//windows11_1_cropped.png
acropalypse_jpeg test_imgs//windows10_snipping_tool_3_cropped.jpg
자른 이미지는 IEND 청크로 끝나는 유효한 PNG 이미지입니다. 하지만 이 청크 이후에도 원본 이미지의 데이터가 남아 있습니다. 탐지 스크립트와 규칙은 파일 끝에서 원본 이미지에 해당하는 또 다른 IEND 청크를 찾습니다.
acropalypse_sanitizer.py를 사용하여 영향을 받은 이미지를 정화할 수 있습니다:
$ for i in test_imgs/*; do python3 acropalypse_sanitizer.py $i; done
Saving sanitized file as test_imgs/windows10_snipping_tool_1_cropped_sanitized.png
test_imgs/windows10_snipping_tool_1_cropped_sanitized.png has no trailing bytes or original IEND chunk!
This file is not affected by acropalypse.
test_imgs/windows10_snipping_tool_1.png has no trailing bytes or original IEND chunk!
This file is not affected by acropalypse.
Saving sanitized file as test_imgs/windows10_snipping_tool_2_cropped_sanitized.png
test_imgs/windows10_snipping_tool_2_cropped_sanitized.png has no trailing bytes or original IEND chunk!
This file is not affected by acropalypse.
test_imgs/windows10_snipping_tool_2.png has no trailing bytes or original IEND chunk!
This file is not affected by acropalypse.
Saving sanitized file as test_imgs/windows10_snipping_tool_3_cropped_sanitized.jpg
test_imgs/windows10_snipping_tool_3.jpg has no trailing bytes or original EOI marker!
This file is not affected by acropalypse.
Saving sanitized file as test_imgs/windows11_1_cropped_sanitized.png
test_imgs/windows11_1_cropped_sanitized.png has no trailing bytes or original IEND chunk!
This file is not affected by acropalypse.
test_imgs/windows11_1.png has no trailing bytes or original IEND chunk!
This file is not affected by acropalypse.
Saving sanitized file as test_imgs/windows11_2_cropped_sanitized.png
test_imgs/windows11_2_cropped_sanitized.png has no trailing bytes or original IEND chunk!
This file is not affected by acropalypse.
test_imgs/windows11_2.png has no trailing bytes or original IEND chunk!
This file is not affected by acropalypse.
Saving sanitized file as test_imgs/windows11_3_cropped_sanitized.jpg
test_imgs/windows11_3.jpg has no trailing bytes or original EOI marker!
This file is not affected by acropalypse.
이 스크립트는 자른 파일의 끝 이후에 남은 원본 데이터를 제거하여 원본 내용을 복구할 수 없게 만듭니다:
$ ls -la test_imgs/
total 1472
drwxrwxr-x 2 octa octa 4096 mar 23 15:08 .
drwxrwxr-x 4 octa octa 4096 mar 22 16:14 ..
-rw-rw-r-- 1 octa octa 45077 mar 22 09:44 windows10_snipping_tool_1_cropped.png
-rw-rw-r-- 1 octa octa 6886 mar 23 15:08 windows10_snipping_tool_1_cropped_sanitized.png
-rw-rw-r-- 1 octa octa 45077 mar 22 09:43 windows10_snipping_tool_1.png
-rw-rw-r-- 1 octa octa 34484 mar 22 09:44 windows10_snipping_tool_2_cropped.png
-rw-rw-r-- 1 octa octa 5065 mar 23 15:08 windows10_snipping_tool_2_cropped_sanitized.png
-rw-rw-r-- 1 octa octa 34484 mar 22 09:44 windows10_snipping_tool_2.png
-rw-rw-r-- 1 octa octa 226987 mar 23 10:18 windows10_snipping_tool_3_cropped.jpg
-rw-rw-r-- 1 octa octa 108791 mar 23 15:08 windows10_snipping_tool_3_cropped_sanitized.jpg
-rw-rw-r-- 1 octa octa 226987 mar 23 10:18 windows10_snipping_tool_3.jpg
-rw-rw-r-- 1 octa octa 195988 mar 22 11:18 windows11_1_cropped.png
-rw-rw-r-- 1 octa octa 5183 mar 23 15:08 windows11_1_cropped_sanitized.png
-rw-rw-r-- 1 octa octa 195988 mar 22 11:16 windows11_1.png
-rw-rw-r-- 1 octa octa 109834 mar 22 11:26 windows11_2_cropped.png
-rw-rw-r-- 1 octa octa 1365 mar 23 15:08 windows11_2_cropped_sanitized.png
-rw-rw-r-- 1 octa octa 109834 mar 22 11:24 windows11_2.png
-rw-rw-r-- 1 octa octa 46318 mar 23 15:02 windows11_3_cropped.jpg
-rw-rw-r-- 1 octa octa 13218 mar 23 15:08 windows11_3_cropped_sanitized.jpg
-rw-rw-r-- 1 octa octa 46318 mar 23 15:02 windows11_3.jpg
그것이 정화된 이미지의 크기가 훨씬 작고 자른 이미지가 원본과 같은 크기인 이유입니다.
이 스크립트는 https://gist.github.com/DavidBuchanan314/93de9d07f7fab494bcdf17c2bd6cef02 를 기반으로 합니다.
원본 스크린샷을 복구해보려면 https://acropalypse.app 을 사용하세요.