The Adventures of Elusive Malware, Gawo V: Ngakhale Zambiri za DDE ndi COM Scriptlets

Nkhaniyi ndi gawo la mndandanda wa Fileless Malware. Magawo ena onse amndandanda:

• The Adventures of the Elusive Malware, Gawo I
• The Adventures of Elusive Malware, Gawo II: Secretive VBA Scripts
• The Adventures of the Elusive Malware, Gawo III: Zolemba za VBA Zosokoneza za Kuseka ndi Phindu
• The Adventures of the Elusive Malware, Gawo IV: DDE ndi Word Document Fields
• The Adventures of Elusive Malware, Gawo V: Ngakhale Zambiri za DDE ndi COM Scriptlets (tili pano)

M'nkhani zotsatizanazi, tikufufuza njira zowukira zomwe zimafuna khama lochepa kwa obera. M'mbuyomu nkhani Talemba kuti ndizotheka kuyika kachidindo kokha mu DDE autofield payload mu Microsoft Word. Potsegula chikalata chotere cholumikizidwa ndi imelo yachinyengo, wogwiritsa ntchito mosasamala amalola wowukirayo kuti adziwe pakompyuta yake. Komabe, kumapeto kwa 2017, Microsoft chatsekedwa njira iyi yowukira DDE.
Kukonzekera kumawonjezera cholembera cha registry chomwe chimalepheretsa Ntchito za DDE mu Mawu. Ngati mukufunikirabe izi, ndiye kuti mutha kubweza njirayi poyambitsa luso lakale la DDE.

Komabe, chigamba choyambiriracho chinangokhudza Microsoft Word. Kodi ziwopsezo za DDE izi zilipo muzinthu zina za Microsoft Office zomwe zitha kugwiritsidwanso ntchito mosagwiritsa ntchito ma code? Inde, zedi. Mwachitsanzo, mutha kuwapezanso mu Excel.

Usiku wa Living DDE

Ndikukumbukira kuti nthawi yomaliza ndinayima pofotokozera zolemba za COM. Ndikulonjeza kuti ndidzawapeza m’nkhani ino.

Pakadali pano, tiyeni tiwone mbali ina yoyipa ya DDE mu mtundu wa Excel. Monga mu Mawu, ena Zobisika za DDE mu Excel kukulolani kuti mugwiritse ntchito code popanda kuyesetsa kwambiri. Monga wogwiritsa ntchito Mawu amene anakulira, ndinkadziwa minda, koma osati za ntchito mu DDE.

Ndinadabwitsidwa kumva kuti ku Excel ndimatha kuyimbira chipolopolo kuchokera m'selo monga momwe zilili pansipa:

Kodi mumadziwa kuti izi zinali zotheka? Inemwini, sinditero

Kutha uku kukhazikitsa chipolopolo cha Windows ndi ulemu wa DDE. Mukhoza kuganizira zinthu zina zambiri
Mapulogalamu omwe mutha kulumikizana nawo pogwiritsa ntchito ntchito za DDE za Excel.
Kodi inunso mukuganiza zomwe ine ndikuganiza?

Lolani lamulo lathu la mkati mwa cell liyambitse gawo la PowerShell lomwe kenako limatsitsa ndikuchita ulalo - izi phwando, zomwe tazigwiritsa ntchito kale. Onani pansipa:

Ingoyikani PowerShell pang'ono kuti muyike ndikuyendetsa nambala yakutali mu Excel

Koma pali chogwira: muyenera kuyika izi mu cell kuti fomulayi igwire ntchito mu Excel. Kodi wowononga angachite bwanji lamulo la DDE ili patali? Chowonadi ndi chakuti tebulo la Excel litatsegulidwa, Excel idzayesa kusintha maulalo onse mu DDE. Makonda a Trust Center akhala akutha kuletsa izi kapena kuchenjeza posintha maulalo kuzinthu zakunja.

Ngakhale popanda zigamba zaposachedwa, mutha kuletsa kusinthidwa kwa ulalo wokha mu DDE

Microsoft poyambirira yokha analangiza Makampani mu 2017 akuyenera kuletsa zosintha zamalumikizidwe kuti ateteze chiwopsezo cha DDE mu Mawu ndi Excel. Mu Januware 2018, Microsoft idatulutsa zigamba za Excel 2007, 2010 ndi 2013 zomwe zimalepheretsa DDE mwachisawawa. Izi nkhani Computerworld imalongosola tsatanetsatane wa chigambacho.

Nanga bwanji zolemba za zochitika?

Microsoft idasiya DDE ya MS Word ndi Excel, pomaliza idazindikira kuti DDE ili ngati cholakwika kuposa magwiridwe antchito. Ngati pazifukwa zina simunayikepo zigambazi, mutha kuchepetsabe chiwopsezo cha DDE mwa kuletsa zosintha zamalumikizidwe odziwikiratu ndikupangitsa zosintha zomwe zimapangitsa ogwiritsa ntchito kusintha maulalo potsegula zikalata ndi maspredishithi.

Tsopano funso la miliyoni miliyoni: Ngati mwakhudzidwa ndi izi, kodi magawo a PowerShell omwe akhazikitsidwa kuchokera m'magawo a Mawu kapena ma cell a Excel adzawonekera mu chipikacho?

Funso: Kodi magawo a PowerShell adayambitsidwa kudzera pa DDE adalowa? Yankho: inde

Mukayendetsa magawo a PowerShell mwachindunji kuchokera pa cell ya Excel osati ngati macro, Windows idzalemba zochitika izi (onani pamwambapa). Panthawi imodzimodziyo, sindinganene kuti zidzakhala zosavuta kuti gulu lachitetezo ligwirizane ndi madontho onse pakati pa gawo la PowerShell, chikalata cha Excel ndi uthenga wa imelo ndikumvetsetsa komwe kuukira kunayambira. Ndibweranso ku izi m'nkhani yomaliza yankhani zanga zosatha za pulogalamu yaumbanda.

Kodi COM yathu ili bwanji?

M'mbuyomu nkhani Ndinakhudza mutu wa COM scriptlets. Iwo ndi abwino mwa iwo okha. luso, zomwe zimakulolani kuti mudutse code, nenani JScript, ngati chinthu cha COM. Koma ma scriptlets adapezeka ndi owononga, ndipo izi zidawalola kuti azitha kuyang'ana pakompyuta ya wozunzidwayo popanda kugwiritsa ntchito zida zosafunikira. Izi видео kuchokera ku Derbycon ikuwonetsa zida za Windows zomangidwira monga regsrv32 ndi rundll32 zomwe zimavomereza zolemba zakutali ngati mikangano, ndipo obera amawononga zida zawo popanda kugwiritsa ntchito pulogalamu yaumbanda. Monga ndidawonetsa komaliza, mutha kuyendetsa mosavuta malamulo a PowerShell pogwiritsa ntchito JScript scriptlet.

Zinapezeka kuti wina ndi wanzeru kwambiri wofufuza adapeza njira yoyendetsera COM scriptlet в Excel document. Anazindikira kuti akafuna kulowetsamo ulalo wa chikalata kapena chithunzi m’selo, amalowetsamo paketi inayake. Ndipo phukusili limavomereza mwakachetechete scriptlet yakutali ngati cholowetsa (onani pansipa).

Bomu! Njira ina yobisika, yopanda phokoso yotsegulira chipolopolo pogwiritsa ntchito zilembo za COM

Pambuyo poyang'ana kachidindo kakang'ono, wofufuzayo adapeza chomwe chiri cholakwika mu pulogalamu ya paketi. Sizinapangidwe kuti zigwiritse ntchito zolemba za COM, koma kungolumikizana ndi mafayilo. Sindikutsimikiza ngati pali kale chigamba cha kusatetezeka uku. Pakuwerenga kwanga pogwiritsa ntchito Amazon WorkSpaces yokhala ndi Office 2010 yoyikiratu, ndidatha kubwereza zotsatira. Komabe, nditayesanso pambuyo pake, sizinathandize.

Ndikukhulupirira kuti ndidakuuzani zinthu zambiri zosangalatsa ndipo nthawi yomweyo ndikuwonetsa kuti obera amatha kulowa mukampani yanu mwanjira ina. Ngakhale mutayika zigamba zonse zaposachedwa za Microsoft, obera akadali ndi zida zambiri kuti akhazikike m'dongosolo lanu, kuchokera ku VBA macros ndidayambitsa mndandandawu mpaka kumalipira oyipa mu Mawu kapena Excel.

M'nkhani yomaliza (ndikulonjeza) mu saga iyi, ndilankhula za momwe tingaperekere chitetezo chanzeru.

Source: www.habr.com