{"id":84702,"date":"2020-06-10T01:43:04","date_gmt":"2020-06-09T23:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/remote-desktop-glazami-atakuyushhego"},"modified":"2020-06-10T01:43:04","modified_gmt":"2020-06-09T23:43:04","slug":"remote-desktop-glazami-atakuyushhego","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/remote-desktop-glazami-atakuyushhego","title":{"rendered":"Oddaljena namizja skozi o\u010di napadalca","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1 id=\"1-vvedenie\">1. Uvod<\/h1>\n<p><\/p>\n<p>Podjetja, ki niso imela vzpostavljenih sistemov za oddaljeni dostop, so jih v nujnih primerih uvedla pred nekaj meseci. Ne vsi skrbniki so bili pripravljeni na tak\u0161no \"vro\u010dino\", kar je privedlo do pomanjkljivosti v varnosti: napa\u010dna konfiguracija storitev ali celo name\u0161\u010danje zastarelih razli\u010dic programske opreme z znanimi ranljivostmi. Nekaterim so te pomanjkljivosti \u017ee prinesle povratni udarec, drugim je \u0161lo bolje, toda zaklju\u010dke si zagotovo velja narediti vsi. Zvestoba oddaljenemu delu je drasti\u010dno narasla, vse ve\u010d podjetij sprejema oddaljeno delo kot dopusten format na dolgi rok.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Torej, mo\u017enosti za zagotavljanje oddaljenega dostopa je mnogo: razli\u010dni VPN, RDS in VNC, TeamViewer in drugi. Skrbniki imajo izbiro, ki temelji na specifi\u010dni zgradbi korporativne mre\u017ee in napravah v njej. Najbolj priljubljene so re\u0161itve VPN, vendar pa \u0161tevilna manj\u0161a podjetja izbirajo RDS (Remote Desktop Services), saj so enostavnej\u0161e in hitrej\u0161e za uvajanje.<\/p>\n<p><\/p>\n<p>V tem \u010dlanku bomo podrobneje govorili o varnosti RDS. Naredili bomo kratek pregled znanih ranljivosti ter preu\u010dili nekaj scenarijev za\u010detka napada na omre\u017eno infrastrukturo, osnovano na Active Directory. Upamo, da bo na\u0161 \u010dlanek nekaterim pomagal pri odpravi napak in pove\u010danju varnosti.<\/p>\n<p><\/p>\n<h1 id=\"2-nedavnie-uyazvimosti-rdsrdp\">2. Nedavne ranljivosti RDS\/RDP<\/h1>\n<p><\/p>\n<p>Vsaka programska oprema vsebuje napake in ranljivosti, ki jih izkori\u0161\u010dajo napadalci, in RDS ni izjema. V zadnjem \u010dasu je Microsoft pogosto poro\u010dal o novih ranljivostih, zato smo se odlo\u010dili, da naredimo njihov kratek pregled:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-us\/security-guidance\/advisory\/CVE-2019-0787\">CVE-2019-0787<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Ta ranljivost ogro\u017ea uporabnike, ki se povezujejo na kompromitiran stre\u017enik. Napadalec lahko pridobi nadzor nad uporabnikovim napravom ali se ustali v sistemu, da ima stalni oddaljeni dostop.<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-1181\">CVE-2019-1181<\/a><\/noindex> \/ <noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-1182\">CVE-2019-1182<\/a><\/noindex> \/ <noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0609\">CVE-2020-0609<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Ta skupina ranljivosti omogo\u010da nepoobla\u0161\u010denemu napadalcu, da oddaljeno izvr\u0161i poljuben kodek na stre\u017eniku z RDS s pomo\u010djo posebej oblikovane zahteve. Lahko jih uporabijo tudi za ustvarjanje \u010drvov \u2014 zlonamerne programske opreme, ki samodejno oku\u017ei sosednje naprave v omre\u017eju. Tako lahko te ranljivosti ogrozijo celotno omre\u017eje podjetja, pred njimi pa lahko za\u0161\u010diti le pravo\u010dasno posodobitev.<\/p>\n<p><\/p>\n<p>Programi za daljinski pristup su privukli pove\u0107anu pa\u017enju kako istra\u017eiva\u010da, tako i napada\u010da, tako da \u0107emo uskoro mo\u017eda \u010duti o novim sli\u010dnim ranjivostima.<\/p>\n<p><\/p>\n<p>Dobra vest je da javni eksploatatori nisu dostupni za sve ranjivosti. Lo\u0161a vest je da napada\u010du sa potrebnim znanjem ne\u0107e biti te\u0161ko da napi\u0161e eksploatator za ranjivost prema opisu, ili koriste\u0107i tehnike poput Patch Diffinga (o \u010demu su pisali na\u0161i kolege u <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/479972\/\">\u010dlanku<\/a><\/noindex>). Zato preporu\u010dujemo redovno a\u017euriranje softvera i pra\u0107enje novih izve\u0161taja o otkrivenim ranjivostima.<\/p>\n<p><\/p>\n<h1 id=\"3-ataki\">3. Napadi<\/h1>\n<p><\/p>\n<p>Prelazimo na drugi deo \u010dlanka, gde \u0107emo pokazati kako zapo\u010dinju napadi na mre\u017enu infrastrukturu zasnovanu na Active Directory. <\/p>\n<p><\/p>\n<p>Opisane metode su primenljive za slede\u0107i model napada\u010da: napada\u010d koji ima korisni\u010dki nalog i pristup Remote Desktop Gateway - terminal serveru (\u010desto dostupan iz spoljne mre\u017ee). Koriste\u0107i ove metode, napada\u010d \u0107e mo\u0107i da nastavi napad na infrastrukturu i u\u010dvrsti svoje prisustvo u mre\u017ei.<\/p>\n<p><\/p>\n<p>Konfiguracija mre\u017ee mo\u017ee se razlikovati u svakom pojedina\u010dnom slu\u010daju, ali opisane tehnike su prili\u010dno univerzalne.<\/p>\n<p><\/p>\n<h2 id=\"primery-vyhoda-iz-ogranichennogo-okruzheniya-i-povysheniya-privilegiy\">Primeri izlaska iz ograni\u010denog okru\u017eenja i pove\u0107anja privilegija<\/h2>\n<p><\/p>\n<p>Kada pristupi Remote Desktop Gateway, napada\u010d \u0107e se verovatno suo\u010diti sa nekim ograni\u010denim okru\u017eenjem. Pri povezivanju sa terminal serverom pokre\u0107e se aplikacija: prozor za povezivanje pomo\u0107u Remote Desktop protokola za interne resurse, Explorer, kancelarijski paketi ili bilo koji drugi softver. <\/p>\n<p><\/p>\n<p>Cilj napada\u010da bi\u0107e sticanje pristupa izvr\u0161avanju komandi, odnosno pokretanje cmd ili powershell. U ovom mogu pomo\u0107i nekoliko klasi\u010dnih tehnika bekstva iz \"sandbox-a\" za Windows. Razmotri\u0107emo ih dalje.<\/p>\n<p><\/p>\n<p><strong>Mo\u017enost 1<\/strong>. Napada\u010d ima pristup prozoru za povezivanje Remote Desktop u okviru Remote Desktop Gateway:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Oddaljena namizja skozi o\u010di napadalca\" src=\"\/wp-content\/uploads\/2020\/06\/10a6e31c6b674a3654d267d503a980cb.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Otvara se meni \"Show Options\". Pojavljuju se opcije za manipulaciju datotekama konfiguracije veze:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Oddaljena namizja skozi o\u010di napadalca\" src=\"\/wp-content\/uploads\/2020\/06\/5751713ae2c4708844dbfe6275b6dd60.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Iz ovog prozora mogu\u0107e je neometano oti\u0107i u Explorer pritiskom na bilo koju od dugmadi \"Open\" ili \"Save\":<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Oddaljena namizja skozi o\u010di napadalca\" src=\"\/wp-content\/uploads\/2020\/06\/22ffb81cb03cef358b308a4198d5df91.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>\u041e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u041f\u0440\u043e\u0432\u043e\u0434\u043d\u0438\u043a. \u0415\u0433\u043e \"\u0430\u0434\u0440\u0435\u0441\u043d\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430\" \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d\u043d\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0434\u0438\u0441\u043a\u0435. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430, \u0435\u0441\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0434\u0438\u0441\u043a\u0438 \u0441\u043a\u0440\u044b\u0442\u044b \u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043d\u0438\u043c \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u0435\u043d:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Oddaljena namizja skozi o\u010di napadalca\" src=\"\/wp-content\/uploads\/2020\/06\/57a0ede0267cac05f43ee7d75293b733.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>\u2192 <strong><noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/L6kTjr-5w9M\">Demonstracijska video posnetek<\/a><\/noindex><\/strong><\/p>\n<p><\/p>\n<p>\u0422\u0430\u043a\u043e\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Excel \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u0430 Microsoft Office. <\/p>\n<p><\/p>\n<p>\u2192 <strong><noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/m8pkTJpP6wY\">Demonstracijska video posnetek<\/a><\/noindex><\/strong><\/p>\n<p><\/p>\n<p>\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043d\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0437\u0430\u0431\u044b\u0432\u0430\u0442\u044c \u043e \u043c\u0430\u043a\u0440\u043e\u0441\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u044d\u0442\u043e\u043c \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435. \u041d\u0430\u0448\u0438 \u043a\u043e\u043b\u043b\u0435\u0433\u0438 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043c\u0430\u043a\u0440\u043e\u0441\u043e\u0432 \u0432 \u044d\u0442\u043e\u0439 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/353800\/\">\u010dlanku<\/a><\/noindex>.<\/p>\n<p><\/p>\n<p><strong>Mo\u017enost 2<\/strong>. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0442\u0435 \u0436\u0435 \u0432\u0432\u043e\u0434\u043d\u044b\u0435, \u0447\u0442\u043e \u0438 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0435, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0440\u0430\u0431\u043e\u0447\u0435\u043c\u0443 \u0441\u0442\u043e\u043b\u0443 \u0441 \u043e\u0434\u043d\u0438\u043c \u0438 \u0442\u0435\u043c \u0436\u0435 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u043c. \u041f\u0440\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0437\u0430\u043a\u0440\u044b\u0442\u043e, \u0438 \u043d\u0430 \u044d\u043a\u0440\u0430\u043d\u0435 \u043f\u043e\u044f\u0432\u0438\u0442\u0441\u044f \u043e\u043a\u043d\u043e \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435\u043c \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435. \u041a\u043d\u043e\u043f\u043a\u0430 \u043f\u043e\u043c\u043e\u0449\u0438 \u0432 \u044d\u0442\u043e\u043c \u043e\u043a\u043d\u0435 \u0432\u044b\u0437\u043e\u0432\u0435\u0442 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Internet Explorer, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u041f\u0440\u043e\u0432\u043e\u0434\u043d\u0438\u043a.<\/p>\n<p><\/p>\n<p>\u2192 <strong><noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/yBKt6TZggxc\">Demonstracijska video posnetek<\/a><\/noindex><\/strong><\/p>\n<p><\/p>\n<p><strong>Mo\u017enost 3<\/strong>. \u041f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0437\u0430\u043f\u0443\u0441\u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0437\u0430\u043f\u0440\u0435\u0449\u0430\u044e\u0442 \u0437\u0430\u043f\u0443\u0441\u043a cmd.exe \u0434\u043b\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.<\/p>\n<p><\/p>\n<p>\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u043e\u0439\u0442\u0438 \u044d\u0442\u043e, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432 bat \u0444\u0430\u0439\u043b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c \u0440\u0430\u0431\u043e\u0447\u0435\u043c \u0441\u0442\u043e\u043b\u0435 \u0441 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435\u043c \u0432\u0438\u0434\u0430 cmd.exe \/K . \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 cmd \u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f bat \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u044b \u043d\u0430 \u0440\u0438\u0441\u0443\u043d\u043a\u0435 \u043d\u0438\u0436\u0435.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Oddaljena namizja skozi o\u010di napadalca\" src=\"\/wp-content\/uploads\/2020\/06\/3cc118158345110d82461c9133a048c6.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>\u0412\u0430\u0440\u0438\u0430\u043d\u0442 4<\/strong>. \u0417\u0430\u043f\u0440\u0435\u0442 \u043d\u0430 \u0437\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0447\u0451\u0440\u043d\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u043f\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f\u043c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0430\u043d\u0430\u0446\u0435\u0435\u0439, \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438. <\/p>\n<p><\/p>\n<p>\u0420\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439: \u043c\u044b \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435, \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0441\u043a Internet Explorer \u0438 PowerShell \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0441\u043f\u0440\u0430\u0432\u043a\u0443 \u2014 \u043d\u0438\u043a\u0430\u043a\u043e\u0439 \u0440\u0435\u0430\u043a\u0446\u0438\u0438. \u041f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c PowerShell \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u043d\u044e \u043c\u043e\u0434\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u043a\u043d\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u043d\u0430\u0436\u0430\u0442\u043e\u0439 \u043a\u043b\u0430\u0432\u0438\u0448\u0435\u0439 Shift \u2014 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0434\u043b\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u041f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c PowerShell \u0447\u0435\u0440\u0435\u0437 \u0430\u0434\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u2014 \u0441\u043d\u043e\u0432\u0430 \u043d\u0438\u043a\u0430\u043a\u043e\u0439 \u0440\u0435\u0430\u043a\u0446\u0438\u0438. \u041a\u0430\u043a \u0436\u0435 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435? <\/p>\n<p><\/p>\n<p>\u0414\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c powershell.exe \u0438\u0437 \u043f\u0430\u043f\u043a\u0438 C:\\Windows\\System32\\WindowsPowerShell\\v1.0 \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0443\u044e \u043f\u0430\u043f\u043a\u0443, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043c\u044f \u043d\u0430 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0435 \u043e\u0442 powershell.exe, \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u043e\u044f\u0432\u0438\u0442\u0441\u044f.<\/p>\n<p><\/p>\n<p>\u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0440\u0430\u0431\u043e\u0447\u0435\u043c\u0443 \u0441\u0442\u043e\u043b\u0443 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0438\u0441\u043a\u0430\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0430, \u043e\u0442\u043a\u0443\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c powershell.exe \u0438 \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c.<\/p>\n<p><\/p>\n<p>\u2192 <strong><noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/nLdxEbr4Gk8\">Demonstracijska video posnetek<\/a><\/noindex><\/strong><\/p>\n<p><\/p>\n<p>Predstavili smo samo nekoliko na\u010dina za zaobila\u017eenje ograni\u010denja; postoji mnogo dodatnih scenarija koji se mogu osmisliti, ali svi imaju zajedni\u010dku ta\u010dku u Windows Exploreru. Postoji mnogo aplikacija koje koriste standardne Windows alate za rad s datotekama, a kada se smeste u ograni\u010deno okru\u017eenje, mogu se primeniti sli\u010dne tehnike.<\/p>\n<p><\/p>\n<h1 id=\"4-rekomendacii-i-zaklyuchenie\">4. Preporuke i zaklju\u010dak<\/h1>\n<p><\/p>\n<p>Kao \u0161to vidimo, \u010dak i u ograni\u010denom okru\u017eenju postoji prostor za razvoj napada. Me\u0111utim, \u017eivot napada\u010dima mo\u017ee postati slo\u017eeniji. Donosimo op\u0161te preporuke koje \u0107e biti korisne kako u situacijama koje smo razmatrali, tako i u drugim slu\u010dajevima.<\/p>\n<p><\/p>\n<ul>\n<li>Ograni\u010dite pokretanje programa crnim\/belim listama, koriste\u0107i grupne politike.<br \/>\nU ve\u0107ini slu\u010dajeva ostaje mogu\u0107nost pokretanja koda. Preporu\u010dujemo da se upoznate sa projektom <noindex><a rel=\"nofollow\" href=\"https:\/\/lolbas-project.github.io\/\">LOLBAS<\/a><\/noindex>, kako biste imali predstavu o nedokumentovanim na\u010dinima manipulacije datotekama i izvr\u0161ne koda u sistemu.<br \/>\nPreporu\u010dujemo kombinovanje oba tipa ograni\u010denja: na primer, mo\u017eete dozvoliti pokretanje izvr\u0161nih datoteka potpisanih od strane Microsoft-a, ali ograni\u010diti pokretanje cmd.exe.<\/li>\n<li>Onemogu\u0107ite kartice pode\u0161avanja Internet Explorer-a (mo\u017ee se uraditi lokalno u registru). <\/li>\n<li>Onemogu\u0107ite putem regedit-a poziv ugra\u0111ene pomo\u0107i Windowsa.<\/li>\n<li>Onemogu\u0107ite mogu\u0107nost montiranja lokalnih diskova za daljinske veze, ako ovo ograni\u010denje nije kriti\u010dno za korisnike.<\/li>\n<li>Ograni\u010dite pristup lokalnim diskovima udaljenog ra\u010dunara, ostavite pristup samo korisni\u010dkim folderima.<\/li>\n<\/ul>\n<p><\/p>\n<p>Nadamo se da vam je barem bilo zanimljivo, a u najboljem slu\u010daju \u2014 da \u0107e ovaj \u010dlanak pomo\u0107i u pove\u0107anju bezbednosti remote rada va\u0161e kompanije.<\/p>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/505600\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>1. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0438 \u0438\u0445 \u043f\u0430\u0440\u0443 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u043d\u0430\u0437\u0430\u0434. \u041d\u0435 \u0432\u0441\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0431\u044b\u043b\u0438 \u0433\u043e\u0442\u043e\u0432\u044b \u043a \u0442\u0430\u043a\u043e\u0439 \u201c\u0436\u0430\u0440\u0435\u201d, \u043a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435 \u2014 \u0443\u043f\u0443\u0449\u0435\u043d\u0438\u044f \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438\u043b\u0438 \u0434\u0430\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u041f\u041e \u0441 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0440\u0430\u043d\u0435\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438. \u041e\u0434\u043d\u0438\u043c \u044d\u0442\u0438 \u0443\u043f\u0443\u0449\u0435\u043d\u0438\u044f \u0443\u0436\u0435 \u0432\u0435\u0440\u043d\u0443\u043b\u0438\u0441\u044c \u0431\u0443\u043c\u0435\u0440\u0430\u043d\u0433\u043e\u043c, \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u043e\u0432\u0435\u0437\u043b\u043e \u0431\u043e\u043b\u044c\u0448\u0435, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84703,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-84702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"1. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0438 \u0438\u0445 \u043f\u0430\u0440\u0443 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u043d\u0430\u0437\u0430\u0434.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/remote-desktop-glazami-atakuyushhego\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Remote Desktop \u0433\u043b\u0430\u0437\u0430\u043c\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"1. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0438 \u0438\u0445 \u043f\u0430\u0440\u0443 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u043d\u0430\u0437\u0430\u0434.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/remote-desktop-glazami-atakuyushhego\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-09T23:43:04+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-09T23:43:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Remote Desktop kroz o\u010di napada\u010da | ProHoster","description":"1. Uvod Kompanije koje nisu imale organizovane sisteme za daljinski pristup hitno su ih uspostavljale pre nekoliko meseci.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/remote-desktop-glazami-atakuyushhego","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Remote Desktop \u0433\u043b\u0430\u0437\u0430\u043c\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e | ProHoster","og:description":"1. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0438 \u0438\u0445 \u043f\u0430\u0440\u0443 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u043d\u0430\u0437\u0430\u0434.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/remote-desktop-glazami-atakuyushhego","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:43:04+00:00","article:modified_time":"2020-06-09T23:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84702","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:52:37","updated":"2022-10-02 20:30:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/84702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=84702"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/84702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/84703"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=84702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=84702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=84702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}