{"id":533,"date":"2023-04-08T14:53:20","date_gmt":"2023-04-08T06:53:20","guid":{"rendered":"http:\/\/pro369.com\/cht\/?p=533"},"modified":"2023-04-22T22:39:26","modified_gmt":"2023-04-22T14:39:26","slug":"%e9%97%9c%e9%96%89%e5%b8%b8%e8%a6%8b%e6%9c%a8%e9%a6%ac%e7%97%85%e6%af%92%e5%92%8c%e6%9c%aa%e6%8e%88%e6%ac%8a%e6%8e%a7%e5%88%b6%e8%bb%9f%e9%ab%94%e6%96%b9%e6%b3%95","status":"publish","type":"post","link":"https:\/\/por.tw\/cht\/%e9%97%9c%e9%96%89%e5%b8%b8%e8%a6%8b%e6%9c%a8%e9%a6%ac%e7%97%85%e6%af%92%e5%92%8c%e6%9c%aa%e6%8e%88%e6%ac%8a%e6%8e%a7%e5%88%b6%e8%bb%9f%e9%ab%94%e6%96%b9%e6%b3%95\/","title":{"rendered":"\u95dc\u9589\u5e38\u898b\u6728\u99ac\u75c5\u6bd2\u548c\u672a\u6388\u6b0a\u63a7\u5236\u8edf\u9ad4\u65b9\u6cd5"},"content":{"rendered":"

\u95dc\u9589\u5e38\u898b\u6728\u99ac\u75c5\u6bd2\u548c\u672a\u6388\u6b0a\u63a7\u5236\u8edf\u9ad4\u65b9\u6cd5<\/strong><\/font><\/p>\n

\u5982\u679c\u96fb\u8166\u88e1\u5b58\u5728\u8457\u6728\u99ac\u75c5\u6bd2\u548c\u672a\u7d93\u6388\u6b0a\u7684\u9060\u7aef\u63a7\u5236\u8edf\u9ad4\uff0c\u90a3\u5225\u4eba\u4e0d\u4f46\u80fd\u5f97\u5230\u4f60\u6240\u6709\u7684\u96b1\u79c1\u8a0a\u606f\u548c\u5e33\u865f\u5bc6\u78bc\uff0c\u66f4\u80fd\u96a8\u6642\u596a\u8d70\u96fb\u8166\u7684\u63a7\u5236\u6b0a\uff0c\u672c\u6587\u4e3b\u8981\u8b1b\u8ff0\u5982\u4f55\u95dc\u9589\u9019\u5169\u985e\u8edf\u9ad4\u3002<\/font><\/p>\n

\u9700\u8981\u8aaa\u660e\u7684\u4e00\u9ede\u662f\uff0c\u672c\u6587\u4ecb\u7d39\u7684\u5404\u7a2e\u6728\u99ac\u53ca\u672a\u6388\u6b0a\u88ab\u5b89\u88dd\u7684\u9060\u7aef\u63a7\u5236\u8edf\u9ad4\u5747\u662f\u7531\u65bc\u6c92\u6709\u6b63\u78ba\u7684\u8a2d\u5b9a\u7ba1\u7406\u54e1\u5bc6\u78bc\u5c0e\u81f4\u7cfb\u7d71\u88ab\u4fb5\u5165\u800c\u5b58\u5728\u7684\u3002
\u56e0\u6b64\u8acb\u5148\u6aa2\u67e5\u7cfb\u7d71\u4e2d\u6240\u6709\u5e33\u865f\u7684\u5bc6\u78bc\u662f\u5426\u8a2d\u5b9a\u7684\u8db3\u5920\u5b89\u5168\u3002<\/font><\/p>\n

\u5bc6\u78bc\u8a2d\u5b9a\u8981\u6c42\uff1a<\/font><\/p>\n

1.\u5bc6\u78bc\u61c9\u8a72\u4e0d\u5c11\u65bc8\u500b\u5b57\u5143;<\/font><\/p>\n

2.\u4e0d\u5167\u542b\u5b57\u5178\u88e1\u7684\u55ae\u8a5e\u3001\u4e0d\u5167\u542b\u59d3\u6c0f\u7684\u6f22\u8a9e\u62fc\u97f3;<\/font><\/p>\n

3.\u540c\u6642\u5167\u542b\u591a\u7a2e\u985e\u578b\u7684\u5b57\u5143\uff0c\u6bd4\u5982\u5927\u5beb\u5b57\u6bcd(A\uff0cB\uff0cC\uff0c..Z)\u3001\u5c0f\u5beb\u5b57\u6bcd(a\uff0cb\uff0cc..z)\u3001\u6578\u5b57(0\uff0c1\uff0c2\uff0c…9)\u3001\u6a19\u9ede\u7b26\u865f(@\uff0c#\uff0c!\uff0c$\uff0c%\uff0c& …)\u3002<\/font><\/p>\n

\u6ce8\u610f\uff1a\u4e0b\u6587\u4e2d\u63d0\u5230\u7684\u95dc\u806f\u8def\u5f91\u6839\u64da\u60a8\u7684\u64cd\u4f5c\u7cfb\u7d71\u7248\u672c\u4e0d\u540c\u6703\u6709\u6240\u4e0d\u540c\uff0c\u8acb\u6839\u64da\u81ea\u5df1\u7684\u7cfb\u7d71\u505a\u76f8\u61c9\u7684\u8abf\u6574<\/font><\/p>\n

Winnt\u548cWin2000\u7cfb\u7d71\uff1ac:Winnt\u3001c:Winntsystem32<\/font><\/p>\n

Winxp\u7cfb\u7d71\uff1ac:Windows\u3001c:Windowssystem32<\/font><\/p>\n

\u6839\u64da\u7cfb\u7d71\u5b89\u88dd\u7684\u8def\u5f91\u4e0d\u540c\uff0c\u76ee\u9304\u6240\u5728\u78c1\u789f\u7b26\u4e5f\u53ef\u80fd\u4e0d\u540c\uff0c\u5982\u7cfb\u7d71\u5b89\u88dd\u5728D\u78c1\u789f\uff0c\u8acb\u5c07C:Windows\u6539\u70baD:Windows\u4f9d\u6b64\u985e\u63a8\u3002<\/font><\/p>\n

\u5927\u90e8\u5206\u7684\u6728\u99ac\u7a0b\u5f0f\u90fd\u53ef\u4ee5\u6539\u8b8a\u9810\u8a2d\u7684\u670d\u52d9\u9023\u7dda\u57e0\uff0c\u6211\u5011\u61c9\u8a72\u6839\u64da\u5177\u9ad4\u7684\u60c5\u6cc1\u63a1\u53d6\u76f8\u61c9\u7684\u63aa\u65bd\uff0c\u4e00\u500b\u5b8c\u6574\u7684\u6aa2\u67e5\u548c\u522a\u9664\u904e\u7a0b\u5982\u4e0b\u4f8b\u6240\u793a\uff1a<\/font><\/p>\n

113\u9023\u7dda\u57e0\u6728\u99ac\u7684\u6e05\u9664(\u50c5\u9069\u7528\u65bcWindows\u7cfb\u7d71)\uff1a\u9019\u662f\u4e00\u500b\u57fa\u65bcirc\u804a\u5929\u5ba4\u63a7\u5236\u7684\u6728\u99ac\u7a0b\u5f0f\u3002<\/font><\/p>\n

1.\u9996\u5148\u4f7f\u7528netstat -an\u6307\u4ee4\u78ba\u5b9a\u81ea\u5df1\u7684\u7cfb\u7d71\u4e0a\u662f\u5426\u958b\u653e\u4e86113\u9023\u7dda\u57e0;<\/font><\/p>\n

2.\u4f7f\u7528fport\u6307\u4ee4\u5bdf\u770b\u51fa\u662f\u54ea\u500b\u7a0b\u5f0f\u5728\u76e3\u807d113\u9023\u7dda\u57e0;<\/font><\/p>\n

\u4f8b\u5982\u6211\u5011\u7528fport\u770b\u5230\u5982\u4e0b\u7d50\u679c\uff1a<\/font><\/p>\n

Pid\u3000 ProcessPort\u3000Proto Path<\/font><\/p>\n

392\u3000 svchost\u3000->\u3000113\u3000 TCP<\/font><\/p>\n

C:WinNTsystem32vhos.exe<\/font><\/p>\n

\u6211\u5011\u5c31\u53ef\u4ee5\u78ba\u5b9a\u5728\u76e3\u807d\u5728113\u9023\u7dda\u57e0\u7684\u6728\u99ac\u7a0b\u5f0f\u662fvhos.exe\u800c\u8a72\u7a0b\u5f0f\u6240\u5728\u7684\u8def\u5f91\u70bac:Winntsystem32\u4e0b\u3002<\/font><\/p>\n

3.\u78ba\u5b9a\u4e86\u6728\u99ac\u7a0b\u5f0f\u540d(\u5c31\u662f\u76e3\u807d113\u9023\u7dda\u57e0\u7684\u7a0b\u5f0f)\u5f8c\uff0c\u5728\u4efb\u52d9\u7ba1\u7406\u5668\u4e2d\u5c0b\u627e\u5230\u8a72\u7a0b\u5f0f\uff0c\u4e26\u4f7f\u7528\u7ba1\u7406\u5668\u7d50\u675f\u8a72\u7a0b\u5f0f\u3002<\/font><\/p>\n

4.\u5728\u958b\u59cb-\u904b\u884c\u4e2d\u9375\u5165regedit\u904b\u884c\u8a3b\u518a\u8868\u7ba1\u7406\u7a0b\u5f0f\uff0c\u5728\u8a3b\u518a\u8868\u88e1\u5c0b\u627e\u525b\u624d\u627e\u5230\u90a3\u500b\u7a0b\u5f0f\uff0c\u4e26\u5c07\u95dc\u806f\u7684\u9375\u503c\u5168\u90e8\u522a\u6389\u3002<\/font><\/p>\n

5.\u5230\u6728\u99ac\u7a0b\u5f0f\u6240\u5728\u7684\u76ee\u9304\u4e0b\u522a\u9664\u8a72\u6728\u99ac\u7a0b\u5f0f\u3002(\u901a\u5e38\u6728\u99ac\u9084\u6703\u5167\u542b\u5176\u4ed6\u4e00\u4e9b\u7a0b\u5f0f\uff0c\u5982rscan.exe\u3001psexec.exe\u3001ipcpass.dic\u3001 ipcscan.txt\u7b49\uff0c\u6839\u64da\u6728\u99ac\u7a0b\u5f0f\u4e0d\u540c\uff0c\u6a94\u6848\u4e5f\u6709\u6240\u4e0d\u540c\uff0c\u4f60\u53ef\u4ee5\u901a\u904e\u5bdf\u770b\u7a0b\u5f0f\u7684\u751f\u6210\u548c\u4fee\u6539\u7684\u6642\u9593\u4f86\u78ba\u5b9a\u8207\u76e3\u807d113\u9023\u7dda\u57e0\u7684\u6728\u99ac\u7a0b\u5f0f\u6709\u95dc\u7684\u5176\u4ed6\u7a0b\u5f0f)\u3002<\/font><\/p>\n

6.\u91cd\u65b0\u555f\u52d5\u96fb\u8166<\/font><\/p>\n

\u4ee5\u4e0b\u5217\u51fa\u7684\u9023\u7dda\u57e0\u50c5\u70ba\u95dc\u806f\u6728\u99ac\u7a0b\u5f0f\u9810\u8a2d\u60c5\u6cc1\u4e0b\u958b\u653e\u7684\u9023\u7dda\u57e0\uff0c\u8acb\u6839\u64da\u5177\u9ad4\u60c5\u6cc1\u63a1\u53d6\u76f8\u61c9\u7684\u64cd\u4f5c\uff1a<\/font><\/p>\n

707\u9023\u7dda\u57e0\u7684\u95dc\u9589\uff1a<\/font><\/p>\n

\u9019\u500b\u9023\u7dda\u57e0\u958b\u653e\u8868\u793a\u4f60\u53ef\u80fd\u611f\u67d3\u4e86nachi\u8815\u87f2\u75c5\u6bd2\uff0c\u8a72\u8815\u87f2\u7684\u6e05\u9664\u65b9\u6cd5\u5982\u4e0b\uff1a<\/font><\/p>\n

1\u3001\u505c\u6b62\u670d\u52d9\u540d\u70baWinS Client\u548cNetwork Connections Sharing\u7684\u5169\u9805\u670d\u52d9;<\/font><\/p>\n

2\u3001\u522a\u9664c:WinntSYSTEM32WinS\u76ee\u9304\u4e0b\u7684DLLHOST.EXE\u548cSVCHOST.EXE\u6a94\u6848;<\/font><\/p>\n

3\u3001\u7de8\u8f2f\u8a3b\u518a\u8868\uff0c\u522a\u9664HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices\u9805\u4e2d\u540d\u70baRpcTftpd\u548cRpcPatch\u7684\u5169\u500b\u9375\u503c\u3002<\/font><\/p>\n

1999\u9023\u7dda\u57e0\u7684\u95dc\u9589\uff1a<\/font><\/p>\n

\u9019\u500b\u9023\u7dda\u57e0\u662f\u6728\u99ac\u7a0b\u5f0fBackDoor\u7684\u9810\u8a2d\u670d\u52d9\u9023\u7dda\u57e0\uff0c\u8a72\u6728\u99ac\u6e05\u9664\u65b9\u6cd5\u5982\u4e0b\uff1a<\/font><\/p>\n

1\u3001\u4f7f\u7528\u7a0b\u5f0f\u7ba1\u7406\u5de5\u5177\u5c07notpa.exe\u7a0b\u5f0f\u7d50\u675f;<\/font><\/p>\n

2\u3001\u522a\u9664c:Windows\u76ee\u9304\u4e0b\u7684notpa.exe\u7a0b\u5f0f;<\/font><\/p>\n

3\u3001\u7de8\u8f2f\u8a3b\u518a\u8868\uff0c\u522a\u9664HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun\u9805\u4e2d\u5167\u542bc:Windowsotpa.exe \/o=yes\u7684\u9375\u503c\u3002<\/font><\/p>\n

2001\u9023\u7dda\u57e0\u7684\u95dc\u9589\uff1a<\/font><\/p>\n

\u9019\u500b\u9023\u7dda\u57e0\u662f\u6728\u99ac\u7a0b\u5f0f\u9ed1\u6d1e2001\u7684\u9810\u8a2d\u670d\u52d9\u9023\u7dda\u57e0\uff0c\u8a72\u6728\u99ac\u6e05\u9664\u65b9\u6cd5\u5982\u4e0b\uff1a<\/font><\/p>\n

1\u3001\u9996\u5148\u4f7f\u7528\u7a0b\u5f0f\u7ba1\u7406\u8edf\u9ad4\u5c07\u7a0b\u5f0fWindows.exe\u6bba\u6389;<\/font><\/p>\n

2\u3001\u522a\u9664c:Winntsystem32\u76ee\u9304\u4e0b\u7684Windows.exe\u548cS_Server.exe\u6a94\u6848;<\/font><\/p>\n

3\u3001\u7de8\u8f2f\u8a3b\u518a\u8868\uff0c\u522a\u9664HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices\u9805\u4e2d\u540d\u70baWindows\u7684\u9375\u503c;<\/font><\/p>\n

4\u3001\u5c07HKEY_CLASSES_ROOT\u548cHKEY_LOCAL_MACHINESoftwareCLASSES\u9805\u4e2d\u7684Winvxd\u9805\u522a\u9664;<\/font><\/p>\n

5\u3001\u4fee\u6539HKEY_CLASSES_ROOT xtfileshellopencommand\u9805\u4e2d\u7684c:Winntsystem32S_SERVER.EXE %1\u70baC:WinNTNOTEPAD.EXE %1;<\/font><\/p>\n

6\u3001\u4fee\u6539HKEY_LOCAL_MACHINESoftwareCLASSES xtfileshellopencommand\u9805\u4e2d\u7684c: Winntsystem32S_SERVER.EXE %1\u9375\u503c\u6539\u70baC:WinNTNOTEPAD.EXE %1\u3002<\/font><\/p>\n

2023\u9023\u7dda\u57e0\u7684\u95dc\u9589\uff1a<\/font><\/p>\n

\u9019\u500b\u9023\u7dda\u57e0\u662f\u6728\u99ac\u7a0b\u5f0fRipper\u7684\u9810\u8a2d\u670d\u52d9\u9023\u7dda\u57e0\uff0c\u8a72\u6728\u99ac\u6e05\u9664\u65b9\u6cd5\u5982\u4e0b\uff1a<\/font><\/p>\n

1\u3001\u4f7f\u7528\u7a0b\u5f0f\u7ba1\u7406\u5de5\u5177\u7d50\u675fsysrunt.exe\u7a0b\u5f0f;<\/font><\/p>\n

2\u3001\u522a\u9664c:Windows\u76ee\u9304\u4e0b\u7684sysrunt.exe\u57f7\u884c\u6a94;<\/font><\/p>\n

3\u3001\u7de8\u8f2fsystem.ini\u6a94\u6848\uff0c\u5c07shell=explorer.exe sysrunt.exe \u6539\u70bashell=explorer.exe\u5f8c\u5132\u5b58;<\/font><\/p>\n

4\u3001\u91cd\u65b0\u555f\u52d5\u7cfb\u7d71\u3002<\/font><\/p>\n

2583\u9023\u7dda\u57e0\u7684\u95dc\u9589\uff1a<\/font><\/p>\n

\u9019\u500b\u9023\u7dda\u57e0\u662f\u6728\u99ac\u7a0b\u5f0fWincrash v2\u7684\u9810\u8a2d\u670d\u52d9\u9023\u7dda\u57e0\uff0c\u8a72\u6728\u99ac\u6e05\u9664\u65b9\u6cd5\u5982\u4e0b\uff1a<\/font><\/p>\n

1\u3001\u7de8\u8f2f\u8a3b\u518a\u8868\uff0c\u522a\u9664HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun\u9805\u4e2d\u7684WinManager = "c:Windowsserver.exe"\u9375\u503c;<\/font><\/p>\n

2\u3001\u7de8\u8f2fWin.ini\u6a94\u6848\uff0c\u5c07run=c:Windowsserver.exe\u6539\u70barun=\u5f8c\u5132\u5b58\u96e2\u958b;<\/font><\/p>\n

3\u3001\u91cd\u65b0\u555f\u52d5\u7cfb\u7d71\u5f8c\u522a\u9664C:Windowssystem SERVER.EXE\u3002<\/font><\/p>\n

3389\u9023\u7dda\u57e0\u7684\u95dc\u9589\uff1a<\/font><\/p>\n

\u9996\u5148\u8aaa\u660e3389\u9023\u7dda\u57e0\u662fWindows\u7684\u9060\u7aef\u7ba1\u7406\u7d42\u7aef\u6240\u958b\u7684\u9023\u7dda\u57e0\uff0c\u5b83\u4e26\u4e0d\u662f\u4e00\u500b\u6728\u99ac\u7a0b\u5f0f\uff0c\u8acb\u5148\u78ba\u5b9a\u8a72\u670d\u52d9\u662f\u5426\u662f\u4f60\u81ea\u5df1\u958b\u653e\u7684\u3002\u5982\u679c\u4e0d\u662f\u5fc5\u9808\u7684\uff0c\u8acb\u95dc\u9589\u8a72\u670d\u52d9\u3002<\/font><\/p>\n

Win2000\u95dc\u9589\u7684\u65b9\u6cd5\uff1a<\/font><\/p>\n

1\u3001Win2000server<\/font><\/p>\n

\u958b\u59cb–>\u7a0b\u5f0f–>\u7ba1\u7406\u5de5\u5177–>\u670d\u52d9\u88e1\u627e\u5230Terminal Services\u670d\u52d9\u9805\uff0c\u9078\u4e2d\u5c6c\u6027\u9078\u9805\u5c07\u555f\u52d5\u985e\u578b\u6539\u6210\u624b\u52d5\uff0c\u4e26\u505c\u6b62\u8a72\u670d\u52d9\u3002<\/font><\/p>\n

2\u3001Win2000pro<\/font><\/p>\n

\u958b\u59cb–>\u8a2d\u5b9a–>\u63a7\u5236\u53f0–>\u7ba1\u7406\u5de5\u5177–>\u670d\u52d9\u88e1\u627e\u5230Terminal Services\u670d\u52d9\u9805\uff0c\u9078\u4e2d\u5c6c\u6027\u9078\u9805\u5c07\u555f\u52d5\u985e\u578b\u6539\u6210\u624b\u52d5\uff0c\u4e26\u505c\u6b62\u8a72\u670d\u52d9\u3002<\/font><\/p>\n

Winxp\u95dc\u9589\u7684\u65b9\u6cd5\uff1a<\/font><\/p>\n

\u5728\u6211\u7684\u96fb\u8166\u4e0a\u9ede\u53f3\u9375\u9078\u5c6c\u6027–>\u9060\u7aef\uff0c\u5c07\u88e1\u9762\u7684\u9060\u7aef\u5354\u52a9\u548c\u9060\u7aef\u684c\u9762\u5169\u500b\u9078\u9805\u6846\u88e1\u7684\u52fe\u53bb\u6389\u3002<\/font><\/p>\n","protected":false},"excerpt":{"rendered":"

\u95dc\u9589\u5e38\u898b\u6728\u99ac\u75c5\u6bd2\u548c\u672a\u6388\u6b0a\u63a7\u5236\u8edf\u9ad4\u65b9\u6cd5 \u5982\u679c\u96fb\u8166\u88e1\u5b58\u5728\u8457\u6728\u99ac\u75c5\u6bd2\u548c\u672a\u7d93\u6388\u6b0a\u7684\u9060\u7aef\u63a7\u5236\u8edf\u9ad4\uff0c\u90a3\u5225\u4eba\u4e0d\u4f46\u80fd\u5f97\u5230\u4f60\u6240\u6709<\/p>\n<\/div>","protected":false},"author":1,"featured_media":1787,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[34],"class_list":["post-533","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-6","tag-34"],"_links":{"self":[{"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/posts\/533","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/comments?post=533"}],"version-history":[{"count":1,"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/posts\/533\/revisions"}],"predecessor-version":[{"id":3271,"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/posts\/533\/revisions\/3271"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/media\/1787"}],"wp:attachment":[{"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/media?parent=533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/categories?post=533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/por.tw\/cht\/wp-json\/wp\/v2\/tags?post=533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}