1. Intshayelelo

Iinkampani ebezingenazo iinkqubo zofikelelo kude zisasazeke ngokungxamisekileyo kwiinyanga ezimbalwa ezidlulileyo. Ayingabo bonke abalawuli abalungiselelwa “ubushushu” obunjalo, nto leyo ekhokelele ekuphelelweni kokhuseleko: ulungelelwaniso olungachanekanga lweenkonzo okanye nokufakela iinguqulelo eziphelelwe lixesha zesoftware enobuthathaka obufunyenwe ngaphambili. Kwabanye, ezi zinto zishiyiweyo sele ziboomerang, abanye babenethamsanqa ngakumbi, kodwa wonke umntu kufuneka enze izigqibo. Ukunyaniseka kumsebenzi okude kuye kwanda ngokukhawuleza, kwaye iinkampani ezininzi ziyamkela umsebenzi okude njengefomathi eyamkelekileyo ngokuqhubekayo.

Ke, kukho iinketho ezininzi zokubonelela ukufikelela kude: iiVPN ezahlukeneyo, i-RDS kunye neVNC, iTeamViewer kunye nabanye. Abalawuli banokuninzi abanokukhetha kuzo, ngokusekelwe kwiinkcukacha zokwakha inethiwekhi yenkampani kunye nezixhobo kuyo. Izisombululo ze-VPN zihlala zithandwa kakhulu, nangona kunjalo, iinkampani ezininzi ezincinci zikhetha i-RDS (IiNkonzo zeDesktop ezikude), zilula kwaye zikhawuleza ukuzisebenzisa.

Kweli nqaku siza kuthetha ngakumbi malunga nokhuseleko lwe-RDS. Masenze amagqabantshintshi ngobuthathaka obaziwayo, kwaye siphinde siqwalasele iimeko ezininzi zokuqalisa uhlaselo lweziseko zothungelwano ezisekelwe kwi-Active Directory. Siyathemba ukuba inqaku lethu liya kunceda umntu ukuba asebenze kwiimpazamo kwaye aphucule ukhuseleko.

2. Ubuthathaka bakutshanje be-RDS/RDP

Nayiphi na isoftware iqulethe iimpazamo kunye nobuthathaka obunokuthi buxhatshazwe ngabahlaseli, kwaye i-RDS ayinjalo. IMicrosoft ibisoloko inika ingxelo ngobuthathaka obutsha mva nje, sigqibe kwelokuba sibanike amagqabantshintshi amafutshane:

• I-CVE-2019-0787

Obu buthathaka bubeka abasebenzisi abaqhagamshela kwiseva esengozini emngciphekweni. Umhlaseli unokufumana ulawulo lwesixhobo somsebenzisi okanye afumane unyawo kwisistim ukuze abe nokufikelela ngokusisigxina kude.

• I-CVE-2019-1181 / I-CVE-2019-1182 / I-CVE-2020-0609

Eli qela lobuthathaka livumela umhlaseli ongavunywanga ukuba enze ekude ikhowudi engenasizathu kumncedisi osebenzisa i-RDS esebenzisa isicelo esenziwe ngokukodwa. Zingasetyenziselwa ukwenza iimpethu-i-malware echaphazela ngokuzimeleyo izixhobo ezingabamelwane kwinethiwekhi. Ke, obu buthathaka bunokubeka esichengeni inethiwekhi yenkampani yonke, kwaye luhlaziyo olusexesheni kuphela olunokubasindisa.

Isoftware yofikelelo olukude ifumene ingqwalasela eyongeziweyo kubo bobabini abaphandi kunye nabahlaseli, ke sinokuva kungekudala malunga nobuthathaka obufanayo.

Iindaba ezimnandi zezokuba ayizizo zonke izinto ezibuthathaka ezinokuxhaphaka koluntu ezikhoyo. Iindaba ezimbi kukuba akuyi kuba nzima kumhlaseli onobuchule ukuba abhale i-exploit yokuba sesichengeni ngokusekelwe kwinkcazo, okanye ukusebenzisa ubuchule obufana nePatch Diffing (oogxa bethu babhale ngayo nqaku). Ke ngoko, sicebisa ukuba uhlaziye rhoqo isoftware kwaye ubeke iliso kwimbonakalo yemiyalezo emitsha malunga nobuthathaka obufunyenweyo.

3. Uhlaselo

Siqhubela phambili kwinxalenye yesibini yenqaku, apho siza kubonisa indlela ukuhlaselwa kweziseko zonxibelelwano ezisekelwe kwi-Active Directory.

Iindlela ezichazwe zisebenza kule modeli ilandelayo yomhlaseli: umhlaseli oneakhawunti yomsebenzisi kwaye unokufikelela kwiSango leDesktop elikude - umncedisi we-terminal (ngokuqhelekileyo ufikeleleke, umzekelo, kwinethiwekhi yangaphandle). Ngokusebenzisa ezi ndlela, umhlaseli uya kukwazi ukuqhubeka nokuhlaselwa kweziseko ezingundoqo kunye nokudibanisa ubukho bakhe kwinethiwekhi.

Ubume bothungelwano kwimeko nganye ethile bunokwahluka, kodwa ubuchule obuchaziweyo buyinto yonke jikelele.

Imizekelo yokushiya indawo enemiqathango kunye nokwandisa amalungelo

Xa ufikelela kwiSango leDesktop ekude, umhlaseli uya kudibana nohlobo oluthile lwemeko ethintelweyo. Xa uqhagamshela kwiseva yesiphelo, kuphehlelelwa usetyenziso kuyo: ifestile yokuqhagamshela ngeRemote Desktop protocol yezibonelelo zangaphakathi, uMhloli, iipakethe zeofisi okanye nayiphi na enye isoftware.

Injongo yomhlaseli iya kuba kukufumana ukufikelela ekwenzeni imiyalelo, oko kukuthi, ukuqalisa i-cmd okanye i-powershell. Iindlela ezininzi zokubaleka zebhokisi yesanti yeWindows zinokunceda kule nto. Makhe siziqwalasele ngakumbi.

Ikhetho 1. Umhlaseli unokufikelela kwi-Remote Desktop yefestile ngaphakathi kweSango seDesktop ekude:

Imenyu ethi “Ukhetho lokuBonisa” iyavula. Iinketho zivela ukwenza iifayile zoqwalaselo loqhagamshelo:

Kule festile unokufikelela ngokulula kwi-Explorer ngokucofa nawaphi na amaqhosha athi “Vula” okanye “Gcina”:

Umhloli uyavula. "Ibha yedilesi" yayo yenza kube lula ukuqalisa iifayile ezisebenzayo ezivumelekileyo, kunye nokudwelisa inkqubo yefayile. Oku kunokuba luncedo kumhlaseli kwiimeko apho iinkqubo zokuqhuba zifihliwe kwaye azinakufikelelwa ngokuthe ngqo:

→ Ividiyo yedemo

Imeko efanayo inokuphinda iveliswe, umzekelo, xa usebenzisa i-Excel kwi-Microsoft Office suite njenge-software ekude.

→ Ividiyo yedemo

Ukongeza, musa ukulibala malunga neemacros ezisetyenziswa kule ofisi suite. Oogxa bethu bajonge ingxaki yokhuseleko olukhulu kule nto nqaku.

Ikhetho 2. Ukusebenzisa amagalelo afanayo nanjengoko kuguqulelo lwangaphambili, umhlaseli uqalisa uqhagamshelo oluninzi kwidesktop ekude phantsi kweakhawunti efanayo. Xa udibanisa kwakhona, eyokuqala iya kuvalwa, kwaye iwindow enesaziso sempazamo iya kuvela kwiscreen. Iqhosha loncedo kule festile liyakubiza i-Internet Explorer kwiseva, emva koko umhlaseli angaya kuMhloli.

→ Ividiyo yedemo

Ikhetho 3. Ukuba izithintelo ekundululeni iifayile eziphunyeziweyo zibunjiwe, umhlaseli angadibana nemeko apho iinkqubo zeqela zithintela umlawuli ekusebenziseni i-cmd.exe.

Kukho indlela yokujikeleza oku ngokusebenzisa ifayile yelulwane kwidesktop ekude enomxholo onje cmd.exe /K <command>. Impazamo xa uqala i-cmd kunye nomzekelo oyimpumelelo wokuphumeza ifayile ye-bat iboniswe kumzobo ongezantsi.

Ikhetho 4. Ukuthintela ukuqaliswa kwezicelo kusetyenziswa uluhlu lwabamnyama olusekwe kwigama leefayile eziphunyezwayo ayilonyango, zinokuthintelwa.

Qwalasela le meko ilandelayo: sikhubaze ukufikelela kumgca womyalelo, sithintele ukuqaliswa kwe-Internet Explorer kunye ne-PowerShell kusetyenziswa imigaqo-nkqubo yeqela. Umhlaseli uzama ukubiza uncedo - akukho mpendulo. Ukuzama ukundulula iqokobhe lamandla ngemenu yemeko yefestile yemodal, ebizwa ngeqhosha le Shift licinezelwe - umyalezo obonisa ukuba ukuqaliswa akuvumelekanga ngumlawuli. Izama ukuqalisa i-powershell ngebar yedilesi - kwakhona akukho mpendulo. Udlula njani uthintelo?

Kwanele ukukopa i-powershell.exe kwi-C:WindowsSystem32WindowsPowerShellv1.0 ifolda kwifolda yomsebenzisi, tshintsha igama kwenye into ngaphandle kwe-powershell.exe, kwaye ukhetho lokuqaliswa luya kuvela.

Ngokungagqibekanga, xa uqhagamshela kwidesktop ekude, ukufikelela kwiidiski zasekhaya zomxhasi kunikezelwa, ukusuka apho umhlaseli unokukopa powershell.exe kwaye ayiqhube emva kokuyiqamba kwakhona.

→ Ividiyo yedemo

Sinike kuphela iindlela ezimbalwa zokudlula izithintelo; unokuza nezinye iimeko ezininzi, kodwa zonke zinento enye efanayo: ukufikelela kwiWindows Explorer. Zininzi izicelo ezisebenzisa izixhobo eziqhelekileyo zokuguqula iifayile zeWindows, kwaye xa zibekwe kwindawo elinganiselweyo, iindlela ezifanayo zinokusetyenziswa.

4. Iingcebiso kunye nesiphelo

Njengoko sibona, nakwindawo elinganiselweyo kukho indawo yophuhliso lohlaselo. Nangona kunjalo, unokwenza ubomi bube nzima ngakumbi kumhlaseli. Sinikezela ngeengcebiso ngokubanzi eziya kuba luncedo kokubini kwiinketho esiziqwalaseleyo nakwezinye iimeko.

• Ukuqaliswa kwenkqubo yokunciphisa kuluhlu olumnyama/ olumhlophe kusetyenziswa imigaqo-nkqubo yeqela.
  Kwiimeko ezininzi, nangona kunjalo, kuhlala kunokwenzeka ukuqhuba ikhowudi. Sincoma ukuba uziqhelanise neprojekthi LOLBAS, ukuba nombono weendlela ezingabhalwanga zokulawula iifayile kunye nokwenza ikhowudi kwinkqubo.
  Sincoma ukudibanisa zombini iindidi zezithintelo: umzekelo, unokuvumela ukuqaliswa kweefayile eziphunyeziweyo ezisayinwe nguMicrosoft, kodwa uthintele ukuqaliswa kwe-cmd.exe.
• Khubaza i-Internet Explorer iisetingi iithebhu (inokwenziwa ekuhlaleni kwirejista).
• Khubaza uncedo olwakhelwe ngaphakathi lweWindows ngeregedit.
• Khubaza ukukwazi ukunyusa iidiski zobulali zodibaniso olukude ukuba uthintelo olunjalo alubalulekanga kubasebenzisi.
• Nciphisa ufikelelo kwiidrive zasekhaya zomatshini okude, ushiya ufikelelo kuphela kwiifolda zabasebenzisi.

Siyathemba ukuba uyifumene inomdla ubuncinci, kwaye ubuninzi, eli nqaku liza kunceda ukwenza umsebenzi okude wenkampani yakho ukhuseleke.

umthombo: www.habr.com