ืืืขื ืืืื ืืึธื ืืขืจ ืืึทืืขืืึธืก ืจืืืืึทื ืื ืงืฉืื: "ืคืืจืืืืก ืืึธื ืขืืืขืืข ืืขื ืืฉื ืืึธืื ืืืืึทื ืึทืงืกืขืก ืฆื ืื ืึทืจืืขื ืงืึธืืคึผืืืืขืจ, ืึธื ืืืงืืืขื ื ืึธื ืคึผืขืจืืืฉืึทื ื ืคึฟืึทืจ ื ืืฆื?"
ืื ืึทืจืืขื ืขืจืืืืึทื ืฆื "ืคืึทืจืืึทืื" ืื ืืืคึผืืึธืื.
ืขืก ืืขื ืขื ืคืืืข ืึทืคึผืืึทืงืืืฉืึทื ื ืคึฟืึทืจ ืืืืึทื ืงืึธื ืืจืึธื ืืืืขืจ ืื ื ืขืฅ: ืงืจืึธืื ืืืืึทื ืืขืกืงืืึทืคึผ, AmmyAdmin, LiteManager, TeamViewer, Anyplace ืงืึธื ืืจืึธื, ืืื"ื ื. ืคึฟืื ืื ื ืขืฅ ืืื ืืืืขืจื "ืฉืืึธืื ืืืืขืจ ืฆืืื" ืืื ืืืื ืึธืืขืจ ืื ืืขืจื ืืืขื "ืฉืืึทื ืขื" ืืื ืื ืึทืืืื ืืกืืจืึทืืึธืจืก, ืืขืืึธืื ืืขืจ ืืึทืืืื ืคืื ืคืืืข ืคึฟืึทืจ ืคึผืขืจืืขื ืืขื ื ืืฆื - AnyDesk ื ืึธื ืจืืงืืืืืขืจื ืกืคึผืขืฆืืขื ืืคืืขืจืงืืึทืืงืืื, ืกืคึผืขืฆืืขื ืืืื ืืขืจ ืืึทืืขืืึธืก ืืื ืืขืืืื "ื ืืื!"
ืืืื ืืืจ ืืืืกื ืืืึธืก ืืืึทืงืื ื ืึท ื ืขืฅ ืคึผืึทืงืึทื ืืืจื ืืืึทื ืืื ืืึทืื ืืื ืืืจ ืืขื ื ืฆืืคึฟืจืืื ืืื ืืื, ืื ืจืขืฉื ืคืื ืื ืืึทืืขืจืืึทื
ื ืื ืืืขื ืคืืจ ืืืจ.
ืืจืืื ื ืฆื ืืืื ืคืื ืื ืคืึทืจืงืขืจื, ืืื ืคืึทืงื ืขืก ืืืื ืืืึธืก ืืืื ืืืื ืขืจืืืืื ืคึฟืึทืจ ืื ืคึผืจืึธืืจืึทื ืฆื ืึทืจืืขืื; ืึทืงืึธืจืืื ืืื, ืื ืื ืก ืจืขืงืึธืจื ืืื ืืคืืขืฉืืขืื *.net.anydesk.com. ืึธืืขืจ AnyDesk ืืื ื ืืฉื ืคึผืฉืื; ืขืก ืืื ื ืืฉื ืืึธืจืื ืืืขืื ืืืึทืงืื ื ืึท ืคืขืื ื ืึธืืขื.
ืึทืืึธื, ืืื ืกืึทืืืื ืื ืคึผืจืึธืืืขื ืคืื ืืืึทืงืื ื "ืึทื ืืคึผืืึทืกืข ืงืึธื ืืจืึธื", ืืืึธืก ืืื ืืขืงืืืขื ืฆื ืืื ืื ืืื ืขืืืขืืข ืกืึธืคืขืงืืืง ืืืืืืืืืจื, ืืื ืขืก ืืื ืกืึทืืืื ืืืจื ืืืึทืงืื ื ืืืืื ืึท ืืืกื IPs (ืืื ืืึทืงื ืื ืึทื ืืืืืืจืืก). ืืขืจ ืคึผืจืึธืืืขื ืืื AnyDesk, ื ืึธื ืืื ืืึทื ืืืึทืื ืืขืืืืื ืืขืจ ืืื ืึท ืืืฅ IP ืึทืืจืขืกืขืก, ืืึธื ืืื ืึธื ืืขืืืืื ืืึทืงืืืขื ืึทืืืขืง ืคืื ืจืืืื ืืึทื ืืึทื ืึทืจืืขื.
ืขืก ืืื ืืืื ืืืกืงืึทืืืขืจื ืึทื ืืื "C: ProgramDataAnyDesk" ืขืก ืืขื ืขื ืึท ื ืืืขืจ ืคืื ืืขืงืขืก ืืื ืกืขืืืื ืืก, ืืื"ื ื, ืืื ืืื ืืขืจ ืืขืงืข. ad_svc.trace ืืขืฉืขืขื ืืฉื ืืืขืื ืงืึทื ืขืงืฉืึทื ื ืืื ืคืืืืืขืจื ืืขื ืขื ืืขืืืืื.
1. ืึธืืกืขืจืืืึทืฆืืข
ืืื ืฉืืื ืืขืจืืื ื, ืืืึทืงืื ื *.anydesk.com ืืื ื ืืฉื ืืขืื ืงืืื ืจืขืืืืืึทืื ืืื ืืขืจ ืึธืคึผืขืจืึทืฆืืข ืคืื โโืื ืคึผืจืึธืืจืึทื, ืขืก ืืื ืืึทืฉืืึธืกื ืฆื ืึทื ืึทืืืื ืคึผืจืึธืืจืึทื ื ืึทืืืจ ืืื ืกืืจืขืกืคืึทื ืกืืืืึทืืืึธื ืก. TCPView ืคึฟืื Sysinternals ืืื ืืืื ืืขื ื ืืื ืืืื!
1.1. ืืขื ืงืขื ืืขื ืึทื ืขืืืขืืข ืคึผืจืึทืกืขืกืึทื ืคืื ืืื ืืขืจืขืก ืฆื ืืื ืื ืืขื ืขื "ืืึทื ืืืื ื", ืืื ืืืืื ืืขืจ ืืืื ืขืจ ืืืึธืก ืงืึทืืืื ืึทืงืืืฅ ืืื ืื ืึทืืจืขืก ืคืื ืื ืึทืจืืืก ืืื ืคืื ืืื ืืขืจืขืก ืฆื ืืื ืื. ืื ืคึผืึธืจืฅ ืฆื ืืืึธืก ืขืก ืงืึทื ืขืงืฅ ืืขื ืขื ืืืืกืืขืงืืืื, ืคึฟืื ืืืึธืก ืืื ืืขืืขื: 80, 443, 6568. ๐ ืืืจ ืืืฉืืืื ืงืขื ืขื ื ืืฉื ืคืึทืจืฉืคึผืึทืจื 80 ืืื 443.
1.2. ื ืึธื ืืืึทืงืื ื ืื ืึทืืจืขืก ืืืจื ืื ืจืึทืืืขืจ, ืื ืื ืืขืจ ืึทืืจืขืก ืืื ืฉืืื ืืืืกืืขืงืืืื.
1.3. ืื ืงืึทื ืกืึธืื ืืื ืืื ืืืขืจ ืึทืืฅ! ืืืจ ืืึทืฉืืืกื ืื PID ืืื ืืขืืึธืื ืืื ืืื ืืขืืืขื ืึท ืืืกื ืืึทืืืืืง ืึทื AnyDesk ืืื ืืขืืืขื ืืื ืกืืึทืืืจื ืืืจื ืื ืกืขืจืืืืก, ืึทืืื ืื PID ืืืึธืก ืืืจ ืืขื ืขื ืงืืงื ืคึฟืึทืจ ืืื ืืขืืืขื ืืขืจ ืืืืื ืืืื ืขืจ.
1.4. ืืืจ ืืึทืฉืืืืขื ืื IP ืึทืืจืขืก ืคืื ืื ืกืขืจืืืืก ืกืขืจืืืขืจ ืคึฟืื ืืขื ืคึผืจืึธืฆืขืก PID.
2. ืฆืืืจืืืืื ื
ืืื ื ืื ืคึผืจืึธืืจืึทื ืคึฟืึทืจ ืืืืขื ืืึทืคืืืื ื IP ืึทืืจืขืกืขืก ืืืขื ืืืกืืึธืืข ื ืึธืจ ืึทืจืืขื ืืืืฃ ืืืื ืคึผืืกื, ืืื ืืึธืื ืงืืื ืจืืกืืจืืงืฉืึทื ื ืืืืฃ ืงืึทื ืืืื ืืึทื ืก ืืื ืคืืืืงืืึทื, ืึทืืื C #.
2.1. ืึทืืข ืืขืืืึธืืก ืฆื ืืืขื ืืืคืืฆืืจื ืื ืคืืจืืื ืื IP ืึทืืจืขืก ืืขื ืขื ืฉืืื ืืึทืืืืกื, ืขืก ืืืืืื ืฆื ืืืื ืืืคึผืืึทืืขื ืึทื.
string pid1_;//ัะทะฝะฐะตะผ PID ัะตัะฒะธัะฐ AnyDesk
using (var p = new Process())
{p.StartInfo.FileName = "cmd.exe";
p.StartInfo.Arguments = " /c "tasklist.exe /fi "imagename eq AnyDesk.exe" /NH /FO CsV | findstr "Services""";
p.StartInfo.UseShellExecute = false;
p.StartInfo.RedirectStandardOutput = true;
p.StartInfo.CreateNoWindow = true;
p.StartInfo.StandardOutputEncoding = Encoding.GetEncoding("CP866");
p.Start();
string output = p.StandardOutput.ReadToEnd();
string[] pid1 = output.Split(',');//ะฟะตัะตะฒะพะดะธะผ ะพัะฒะตั ะฒ ะผะฐััะธะฒ
pid1_ = pid1[1].Replace(""", "");//ะฑะตัะตะผ 2ะน ัะปะตะผะตะฝั ะฑะตะท ะบะฐะฒััะตะบ
}ืกืืืืืึทืจืื, ืืืจ ืืขืคึฟืื ืขื ืื ืืื ืกื ืึทื ืืขืืจืื ืืขื ืื ืงืฉืจ, ืืื ืืืขื ืืขืื ืืืืื ืื ืืืืคึผื ืฉืืจื
p.StartInfo.Arguments = "/c " netstat -n -o | findstr /I " + pid1_ + " | findstr "ESTABLISHED""";ืืขืจ ืจืขืืืืืึทื ืคืื ืืืึธืก ืืืขื ืืืื:
ืคืื ืื ืจืืืขืจื, ืกืืืืืึทืจืื ืฆื ืื ืคืจืืขืจืืืงืข ืฉืจืื, ืขืงืกืืจืึทืงื ืื 3 ืืืึทื ืืื ืึทืจืึธืคึผื ืขืืขื ืึทืืฅ ื ืึธื ืื ":". ืืื ืึท ืจืขืืืืืึทื, ืืืจ ืืึธืื ืืื ืืืขืจ ืืขืืืืื IP.
2.2. IP ืืืึทืงืื ื ืืื Windows. ืืืื ืืื ืืงืก ืืื ืืืึทืงืืึธืืข ืืื ืืคึผืืึทืืืขืก, ืืขืจ ืืืคึฟื ืคืื ืืืึทืงืื ื ืึท IP ืึทืืจืขืก ืืื ืืืื ืฉืืจื ืึธื ื ืืฆื ืึท ืคืืืจืืืึทื ืืื Windows ืืื ืืขืืืขื ืืืืขืืืืื ืืืขื,
ืึธืืขืจ ืืืึธืก ืืื ืคืื ืืืฉืืจืื ืืขื ืขื ืืึธืจื ...
route add ะฝะฐั_ะฝะฐะนะดะตะฝะฝัะน_IP_ะฐะดัะตั mask 255.255.255.255 10.113.113.113 if 1 -pืฉืืืกื ืคึผืึทืจืึทืืขืืขืจ "ืืืื 1"ืฉืืงื ืืขื ืืึทืจืฉืจืื ืฆื ืืึธืึธืคึผืืึทืงืง (ืืืจ ืงืขื ืขื ืึทืจืืืกืืืืึทืื ืคืึทืจืึทื ืขื ืื ืืขืจืคืืืกืื ืืืจื ืคืืืกื ืืืง ืืึทืจืฉืจืื ืืจืืงื). ืืื ืืืืืืืง! ืืืฆื ืื ืคึผืจืึธืืจืึทื ืืึทืจืฃ ืืืื ืืึธื ืืฉื. ืืื ืึทืืืื ืืกืืจืึทืืึธืจ ืจืขืื, ืืื ื ืืฉืึทื ืืื ื ืื ืืึทืจืฉืจืื ืจืืงืืืืืขืจื ืืืื.
2.3. ืืืืึทืื ืืืง ืืื ืฉืคึผืึธืจื ืืืืขื ืึทืคืืื IP ืึทืืจืขืกืขืก ืืื ืึท ื ืืฉืืืง ืึทืจืืขื ืืื ืืึทืจืฃ ืงืืื ืืขืจืงืืขืจืื ื. ืืืื ืืืจ ืืจืึทืืื ืืืขืื ืืื, ืืืจ ืงืขื ืขื ืคึผืจืึธืฆืขืก ืื ืืขืงืข ad_svc.trace AnyDesk ืืื, ืึธืืขืจ ืืื ืืื ื ืืฉื ืืจืึทืืื ืืืขืื ืืื ืืืืื + ืืึธืืขืจ ืขืก ืืื ืึท ืืึทืืจืขื ืขืฆืื ื ืืืืฃ ืขืก.
2.4. ืื ืืึธืื ืข ืึทื ืืืืึทื ื ืึทืืืจ ืคืื ืื ืคึผืจืึธืืจืึทื ืืื ืึทื ืืืขื "ืืึทืกืงืงืื ื" ืื ืกืขืจืืืืก ืคึผืจืึธืฆืขืก ืืื Windows 10, ืขืก ืจืืกืืึทืจื ืืืืืึธืืึทืืืฉ, ืืื Windows 8 ืขืก ืขื ืืก, ื ืึธืจ ืืึธืื ืื ืงืึทื ืกืึธืื ืคึผืจืึธืฆืขืก ืืื ืึธื ืจืืงืึทื ืขืงืืื ื, ืืื ืึทืืืขืืืื, ืขืก ืืื ืืืึทืืืฉืืงืึทื ืืื ืืึธืก ืืื ืืืคึผืื ืงืืืขื.
ืจืืืืืืื ื ืึท ืคึผืจืึธืฆืขืก ืืืึธืก ืืื ืงืึธื ื ืขืงืืขื ืฆื ืื ืกืขืจืืืขืจ ืึทืืึทืื ืืืจ ืฆื "ืงืจืึทืคื" ืจืืงืึทื ืขืงืฉืึทื ืฆื ืืขืจ ืืืืึทืืขืจ ืึทืืจืขืก. ืขืก ืืื ืืืคึผืืึทืืขื ืึทื ืืื ืื ืืขืืืข ืืืขื ืืื ืื ืคืจืืขืจืืืงืข ืงืึทืืึทื ืื, ืึทืืื ืืื ืืืขื ื ืึธืจ ืืขืื ืขืก:
p.StartInfo.Arguments = "/c taskkill /PID " + pid1_ + " /F";ืึทืืืืืืึธื ืึทืืื, ืงืึทืืขืจ ืื AnyDesk ืคึผืจืึธืืจืึทื.
//ะทะฐะฟััะบะฐะตะผ ะฟัะพะณัะฐะผะผั ะบะพัะพัะฐั ัะฐัะฟะพะปะพะถะตะฝะฐ ะฟะพ ะฟััะธ path_pro
if (File.Exists(path_pro)){
Process p1 = Process.Start(path_pro);}2.5. ืืืจ ืืืขืื ืงืึธื ืืจืึธืืืจื ืื ืกืืึทืืืก ืคืื AnyDesk ืึทืืึธื ืึท ืืื ืื (ืึธืืขืจ ืืขืจ ืึธืคื?), ืืื ืืืื ืขืก ืืื ืงืึธื ื ืขืงืืขื, ื.ื. ืงืฉืจ ESTABLISHED - ืคืึทืจืฉืคึผืึทืจื ืืขื IP, ืืื ืืืืืขืจ ืึทืืข ืืืืขืจ ืืืืืขืจ - ืืืึทืจืื ืืื ืขืก ืงืึทื ืขืงืฅ, ืคืึทืจืฉืคึผืึทืจื ืืื ืืืึทืจืื.
3. ืืึทืคืึทืื
ืืขืจ ืงืึธื ืืื "ืกืงืืืฉื" ืืื ืขืก ืืื ืืึทืฉืืึธืกื ืฆื ืืืืืฉืืืึทืืืื ืืขื ืคึผืจืึธืฆืขืก "+"ืึธื ืืืืึทืื ืื ืืขืคึฟืื ืขื ืืื ืืคืืขืฉืืขืื IP, ืืื"."- ืืืืขืจืืืจื ืื ืืฉืขืง ืึธื ืึท ืืฆืืื ืืืจ ืคึฟืึทืจืืื ืืื ื ืคึฟืื AnyDesk.
โ
ืืื ื ืจืขืืืืืืโฆ
ืืขืจ ืคืจืืืจืื ืืื ืืขืืจืืขื ืืืืฃ ืขืืืืืข ืงืืืคืืืืขืจืก ืืื ืคืืจืฉืืืืขื ืข ืืืื ืืืืก ืืกืื, ืืื ืืืขืจืกืืขืก ืคืื AnyDesk 5 ืืื 6. ืืืืขืจ 500 ืืืืขืจืืฆืืขืก, ืืขื ืขื ืืขืืืืื ืืขืืืืจื ืืขืจื 80 ืืืจืขืกื. ืคึฟืึทืจ 2500 - 87 ืืื ืึทืืื ืืืืฃ ...
ืืื ืฆืืื, ืื ื ืืืขืจ ืคืื ืืคืืขืฉืืขืื IPs ืจืืืฉื 100+.
ืืื ืง ืฆื ืืขืฆื ืืขืงืกื ืืขืงืข ืืื ืึทืืจืขืกืขืก: ะธ
ืขืก ืืื ืืขืฉืขื! ืื ืืขืงื ืคืื IP ืึทืืจืขืกืขืก ืืื ืืืกืืฃ ืฆื ืื ืึผืืืื ืคืื ืื ืืืืคึผื ืจืึทืืืขืจ ืืืจื ืื ืฉืจืืคื ืืื AnyDesk ืงืขื ื ืืฉื ืฉืึทืคึฟื ืึท ืคืื ืืจืืืกื ืืืง ืคึฟืึทืจืืื ืืื ื.
ืขืก ืืื ืึท ืืึธืื ืข ืคืื ื, ืคึฟืื ืื ืขืจืฉื ืืึธืืก ืขืก ืืื ืงืืึธืจ ืึทื ืื ืึทืืจืขืก ืืื ืื ืืืึทืืืื ืืื ืื ืึทืจืืืขืจืคืืจื ืคืื ืืื ืคึฟืึธืจืืึทืฆืืข boot-01.net.anydesk.com. ืคืื ืงืืจืก, ืืืจ ืืคืืขืฉืืขืื ืึทืืข *.net.anydesk.com ืืื ืืช ืืื ืึท ืืขื ืขืจืึทื ืืขืจืฉื, ืึธืืขืจ ืืึธืก ืืื ื ืืฉื ืื ืืึธืื ืข ืืึทื. ืืขืืขืจ ืืึธื ืืื ืึท ื ืึธืจืืึทื ืคึผืื ื ืคืื ืคืึทืจืฉืืืขื ืข ืงืึธืืคึผืืืืขืจืก, ืืขื ืคืขืื ื ืึธืืขื ืืื ืึท ืึทื ืืขืจืฉ IP. ืงืึธื ืืจืึธืืืจืื ื ืืืืฃ ืืื ืืงืก:
host boot-01.net.anydesk.com
ืืื DNSLookup ืืื ืืขืื ืืืืื ืืืื IP ืึทืืจืขืก, ืึธืืขืจ ืื ืึทืืจืขืก ืืื ืืืึทืืขืืืืืง. ืืืขื ืึทื ืึทืืืืืื ื ืึท TCPView ืงืฉืจ, ืืืจ ืืึทืงืืืขื PTR ืจืขืงืึธืจืืก ืคืื IP ืึทืืจืขืกืขืก ืคืื ืืขื ืืืคึผ relay-*.net.anydesk.com.
ืืขืึธืจืขืืืฉ: ืืื ื ืคึผืื ื ืืื ืืืื ืฆื ืึทื ืืืืืึทืงืึทื ื ืื ืืืึธืงืงืขื ืืึทืืขืืึธืก boot-01.net.anydesk.com ืืืจ ืงืขื ืขื ืืขืคึฟืื ืขื ืื ืืคึผืก ืืื ืคืึทืจืฉืคึผืึทืจื ืืื, ืืึทืื ืืขื ืืืคึผืืึทืืขื ืืืืฉืึทื ืึท ืจืขืืืืขืจ ืฉืจืืคื ืืื ืืขืจ ืืื ืืงืก ืึทืก, ืืึธ ืขืก ืืื ื ืื ืืึทืจืคึฟื ืฆื ืื ืกืืึทืืืจื AnyDesk. ืื ืึทื ืึทืืืกืืก ืืขืืืืื ืึทื ืื IPs ืึธืคื "ืื ืืขืจืกืขืงื"ืืื ืื ืืขืคืื ืขื ืคืื ืืื ืืืขืจ ืจืฉืืื. ืืึธืืขืจ ืขืก ืืื ื ืึธืจ ืืขื ืืึทืืขืืึธืก ืฆื ืืืึธืก ืื ืคึผืจืึธืืจืึทื ืงืึทื ืขืงืฅ ืืืืืขืจ ืขืก ืืืืื ืฆื "ืกืึธืจื ืืืืก" ืืืงืื ื IPs. ืืื ืืืขื ืืืกืืึธืืข ืฉืคึผืขืืขืจ ืืขืกืึธืคืข ืืขื ืึทืจืืืงื ืืื ืื 2 ืืืื ืคืื ืืึทืืขืืึธืก ืึธื ืคึฟืจืขืื, ืืึธืืฉ ืืขืจืืืืึทื ืคึผืจืึธืืจืึทื ืืื ืืื ื ืืฉื ืื ืกืืึทืืืจื ืื ืืขืจ ื ืขืฅ ืืืกืืืืื ืืงืกื ืคืึทืจืืื ืื ืืื ืึทืืืขืืืื.
ืืื ืืึธืคึฟื ืึทื ืืืจ ืืึธื ื ืืฉื ืืขืืขื ืขืคึผืขืก ืืืืขืืึทื ืืื ืื ืืืืื, ืืื ืื ืงืจืืืืืขืจื ืคืื AnyDesk ืืืขืื ืืืึทืื ืืืื ืึทืงืฉืึทื ื ืืืืฃ ืึท ืกืคึผืึธืจืฆืืึทื ืื ืฉืืืืืขืจ.
ืืงืืจ: www.habr.com