ClaudeがFreeBSDのカーネルRCE脆弱性CVE-2026-4747を完全自動生成。AIが実装した遠隔攻撃コード

# イメージダウンロード
wget https://download.freebsd.org/releases/VM-IMAGES/14.4-RELEASE/amd64/Latest/\
      FreeBSD-14.4-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2.xz
xz -d FreeBSD-14.4-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2.xz
cp FreeBSD-14.4-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2 freebsd-vuln.qcow2
qemu-img resize freebsd-vuln.qcow2 8G

# Cloud-init 設定
cat > user-data << 'EOF'
#cloud-config
chpasswd:
  list: |
    root:freebsd
  expire: False
ssh_pwauth: True
bootcmd:
  - rm -f /firstboot          # 自動パッチング無効化
  - rm -f /var/db/freebsd-update/*
runcmd:
  - echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config
  - service sshd restart
  - kldload kgssapi          # ← 脆弱モジュール
  - sysrc rpcbind_enable=YES nfs_server_enable=YES
  - echo '/export -network 0.0.0.0/0' > /etc/exports
  - mkdir -p /export
  - service rpcbind start && service nfsd start
EOF

cat > meta-data << 'EOF'
instance-id: cve-test
local-hostname: freebsd-vuln
EOF

genisoimage -output seed.iso -volid cidata -joliet -rock user-data meta-data

# QEMU 起動 (ポート転送: SSH/NFS/KDC)
qemu-system-x86_64 -enable-kvm -cpu host -m 2G -smp 2 \
  -drive file=freebsd-vuln.qcow2,format=qcow2,if=virtio \
  -cdrom seed.iso \
  -netdev user,id=net0,\
hostfwd=tcp::2222-:22,\
hostfwd=tcp::2049-:2049,\
hostfwd=tcp::8888-:88 \
  -device virtio-net-pci,netdev=net0 -nographic

# 1. Kerberos インストール
pkg install -y krb5

# 2. krb5.conf 作成
cat > /etc/krb5.conf << 'EOF'
[libdefaults]
default_realm = TEST.LOCAL

[realms]
TEST.LOCAL = {
    kdc = 127.0.0.1
    admin_server = 127.0.0.1
}
EOF

# 3. KDC データベース作成
/usr/local/sbin/kdb5_util create -s -P masterkey -r TEST.LOCAL

# 4. Kerberos principals 作成 (hostname = "test" の場合)
/usr/local/sbin/kadmin.local -q "addprinc -pw password [email protected]"
/usr/local/sbin/kadmin.local -q "addprinc -randkey nfs/[email protected]"
/usr/local/sbin/kadmin.local -q "addprinc -randkey host/[email protected]"
/usr/local/sbin/kadmin.local -q "ktadd -k /etc/krb5.keytab nfs/[email protected]"
/usr/local/sbin/kadmin.local -q "ktadd -k /etc/krb5.keytab host/[email protected]"

# 5. KDC 起動
/usr/local/sbin/krb5kdc

# 6. NFS 設定
mkdir -p /export
echo '/export -network 0.0.0.0/0' > /etc/exports

# 7. rc.conf 設定
sysrc rpcbind_enable=YES
sysrc nfs_server_enable=YES
sysrc nfsv4_server_enable=YES
sysrc nfsuserd_enable=YES
sysrc gssd_enable=YES
sysrc mountd_enable=YES
sysrc nfs_server_flags="-u -t"

# 8. サービス起動
service rpcbind start
service nfsuserd start
service gssd start
service mountd start
service nfsd start

# 9. 検証
sysctl vfs.nfsd.threads              # スレッド数確認
sockstat -l | grep 2049              # TCP リスン確認 (UDP のみはNG)
kldstat | grep gss                   # kgssapi.ko ロード確認

# 10. Kerberos ticket 取得テスト
echo 'password' | kinit [email protected]
klist

# システムパッケージインストール
# Ubuntu/Debian
sudo apt install krb5-user libkrb5-dev python3-gssapi

# Fedora/RHEL
sudo dnf install krb5-workstation krb5-devel python3-gssapi

# krb5.conf 設定 (FreeBSD VM IP に向ける)
sudo tee /etc/krb5.conf << EOF
[libdefaults]
default_realm = TEST.LOCAL
rdns = false                              # ← 重要: DNS逆引き無効化
dns_canonicalize_hostname = false         # ← 重要: hostname正規化無効化

[realms]
TEST.LOCAL = {
    kdc = 192.168.1.100:88                # FreeBSD VM IP
}
EOF

# /etc/hosts 設定
echo "192.168.1.100  test" | sudo tee -a /etc/hosts

# Kerberos ticket 取得
echo "password" | kinit [email protected]
klist