ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ

ื“ืขืจ ืžืขื ื˜ืฉ, ื•ื•ื™ ืื™ืจ ื•ื•ื™ืกืŸ, ืื™ื– ืึท ืคื•ื™ืœ ื‘ืึทืฉืขืคืขื ื™ืฉ.
ืื•ืŸ ืืคื™ืœื• ืžืขืจ ืึทื–ื•ื™ ื•ื•ืขืŸ ืขืก ืงื•ืžื˜ ืฆื• ื˜ืฉื•ื–ื™ื ื’ ืึท ืฉื˜ืึทืจืง ืคึผืึทืจืึธืœ.

ืื™ืš ื˜ืจืึทื›ื˜ืŸ ื™ืขื“ืขืจ ืึทื“ืžื™ื ื™ืกื˜ืจืึทื˜ืึธืจ ื”ืื˜ ืืœืฅ ืคื™ื™ืกื˜ ื“ื™ ืคึผืจืึธื‘ืœืขื ืคื•ืŸ ื ื™ืฆืŸ ืœื™ื›ื˜ ืื•ืŸ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื–. ื“ื™ ื“ืขืจืฉื™ื™ื ื•ื ื’ ืึทืงืขืจื– ืึธืคื˜ ืฆื•ื•ื™ืฉืŸ ื“ื™ ื”ืขื›ืขืจ ืขืงืœืึทื ื– ืคื•ืŸ ืคื™ืจืžืข ืคืึทืจื•ื•ืึทืœื˜ื•ื ื’. ื™ืึธ, ื™ืึธ, ื“ื•ื•ืงื ืฆื•ื•ื™ืฉืŸ ื“ื™ ื•ื•ืืก ื”ืึธื‘ืŸ ืฆื•ื˜ืจื™ื˜ ืฆื• ืกื•ื“ ืึธื“ืขืจ ื’ืขืฉืขืคื˜ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืื•ืŸ ืขืก ื•ื•ืึธืœื˜ ื–ื™ื™ืŸ ื’ืึธืจ ืึทื ื“ื™ื–ื™ื™ืจืึทื‘ืึทืœ ืฆื• ืขืœื™ืžื™ื ื™ืจืŸ ื“ื™ ืงืึทื ืกืึทืงื•ื•ืขื ืกืึทื– ืคื•ืŸ ืคึผืึทืจืึธืœ ืœื™ืงืก / ื›ืึทืงื™ื ื’ ืื•ืŸ ื•ื•ื™ื™ึทื˜ืขืจ ื™ื ืกืึทื“ืึทื ืฅ.

ืื™ืŸ ืžื™ื™ืŸ ืคื™ืจ, ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ืึท ืคืึทืœ ื•ื•ืขืŸ, ืื™ืŸ ืึทืŸ ืึทืงื˜ื™ื•ื•ืข Directory ืคืขืœื“ ืžื™ื˜ ืึท ืคึผืึทืจืึธืœ ืคึผืึธืœื™ื˜ื™ืง ืขื ื™ื™ื‘ืึทืœื“, ืึทืงืึทื•ื ื˜ืึทื ืฅ ื™ื ื“ื™ืคึผืขื ื“ืึทื ื˜ืœื™ ื’ืขืงื•ืžืขืŸ ืฆื• ื“ืขืจ ื’ืขื“ืึทื ืง ืึทื– ืึท ืคึผืึทืจืึธืœ ื•ื•ื™ "Pas$w0rd1234" ืคึผืึทืกื™ืง ื“ื™ ืคึผืึธืœื™ื˜ื™ืง ืจืขืงื•ื•ื™ืจืขืžืขื ืฅ ื‘ื™ืฉืœื™ื™ืžืขืก. ื“ื™ ืงืึทื ืกืึทืงื•ื•ืึทื ืก ืื™ื– ื’ืขื•ื•ืขืŸ ื“ื™ ื•ื•ื™ื™ื“ืกืคึผืจืขื“ ื ื•ืฆืŸ ืคื•ืŸ ื“ืขื ืคึผืึทืจืึธืœ ืื•ืžืขื˜ื•ื. ื˜ืฒืœืžื ืœ ื”ื ื˜ ืข ืจ ื–ื™ ืš ืื•ื ื˜ืขืจืฉืฒื“ ืŸ ื‘ืœื•ื™ ื– ืื™ ืŸ ื–ืฒ ืŸ ืฆื ืœ ืฆืืœืŸ .

ืื™ืš ื˜ืึทืงืข ื’ืขื•ื•ืืœื˜ ืฆื• ืงืขื ืขืŸ ื ื™ืฉื˜ ื‘ืœื•ื™ื– ื’ืขื‘ืŸ ืึท ืคึผืึทืจืึธืœ ืคึผืึธืœื™ื˜ื™ืง ืื•ืŸ ื“ืขืคื™ื ื™ืจืŸ ืึท ื›ืึทืจืึทืงื˜ืขืจ ืฉื˜ืขืœืŸ, ืึธื‘ืขืจ ืื•ื™ืš ืคื™ืœื˜ืขืจ ื“ื•ืจืš ื•ื•ืขืจื˜ืขืจื‘ื•ืš. ืฆื• ื•ื™ืกืฉืœื™ืกืŸ ื“ื™ ืžืขื’ืœืขื›ืงื™ื™ื˜ ืคื•ืŸ ื ื™ืฆืŸ ืึทื–ืึท ืคึผืึทืกื•ื•ืขืจื“ื–.

ืžื™ื™ืงืจืึธืกืึธืคึฟื˜ ื™ื ืคืึธืจืžื– ืื•ื ื“ื– ืœื™ื‘ ื“ื•ืจืš ื“ืขื ืœื™ื ืง ืึทื– ื•ื•ืขืจ ืขืก ื™ื– ื•ื•ืืก ื•ื•ื™ื™ืกื˜ ื•ื•ื™ ืฆื• ื”ืึทืœื˜ืŸ ืึท ืงืึทืžืคึผื™ื™ืœืขืจ, IDE ืจื™ื›ื˜ื™ืง ืื™ืŸ ื“ื™ ื”ืขื ื˜ ืื•ืŸ ื•ื•ื™ื™ืกื˜ ื•ื•ื™ ืฆื• ืึทืจื•ื™ืกืจืขื“ืŸ C++ ืจื™ื›ื˜ื™ืง, ืื™ื– ื‘ื™ื›ื•ืœืช ืฆื• ืฆื•ื ื•ื™ืคื ืขืžืขืŸ ื“ื™ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ื•ื•ืึธืก ื–ื™ื™ ื“ืึทืจืคึฟืŸ ืื•ืŸ ื ื•ืฆืŸ ืขืก ืœื•ื™ื˜ ื–ื™ื™ืขืจ ืคืืจืฉื˜ืื ื“. ื“ื™ื™ืŸ ืึทื ื™ื•ื•ืขืกื“ื™ืง ื“ื™ื ืขืจ ืื™ื– ื ื™ืฉื˜ ื‘ื™ื›ื•ืœืช ืฆื• ื“ืขื, ืึทื–ื•ื™ ืื™ืš ื’ืขื”ืื˜ ืฆื• ืงื•ืงืŸ ืคึฟืึทืจ ืึท ืคืึทืจื˜ื™ืง ืœื™ื™ื–ื•ื ื’.

ื ืึธืš ืึท ืœืึทื ื’ ืฉืขื” ืคื•ืŸ ื–ื•ื›ืŸ, ืฆื•ื•ื™ื™ ืึธืคึผืฆื™ืขืก ืคึฟืึทืจ ืกืึทืœื•ื•ื™ื ื’ ื“ืขื ืคึผืจืึธื‘ืœืขื ื–ืขื ืขืŸ ืื ื˜ืคืœืขืงื˜. ืื™ืš ื‘ื™ืŸ, ืคื•ืŸ ืงื•ืจืก, ื’ืขืจืขื“ื˜ ื•ื•ืขื’ืŸ ื“ื™ OpenSource ืœื™ื™ื–ื•ื ื’. ื ืึธืš ืึทืœืข, ืขืก ื–ืขื ืขืŸ ื‘ืึทืฆืึธืœื˜ ืึธืคึผืฆื™ืขืก - ืคื•ืŸ ืึธื ื”ื™ื™ื‘ ืฆื• ืขื ื“ื™ืงืŸ.

ืึธืคึผืฆื™ืข #1. OpenPasswordFilter

ืขืก ื–ืขื ืขืŸ ื’ืขื•ื•ืขืŸ ืงื™ื™ืŸ ืงืึทืžื™ืฅ ืคึฟืึทืจ ื•ื•ืขื’ืŸ 2 ื™ืืจ ืื™ืฆื˜. ื“ืขืจ ื’ืขื‘ื•ื™ืจืŸ ื™ื ืกื˜ืึทืœืœืขืจ ืึทืจื‘ืขื˜ ื™ืขื“ืขืจ ืื™ืฆื˜ ืื•ืŸ ื“ืขืžืึธืœื˜, ืื™ืจ ืžื•ื–ืŸ ืคืึทืจืจื™ื›ื˜ืŸ ืขืก ืžืึทื ื™ื•ืึทืœื™. ืงืจื™ื™ื™ืฅ ื–ื™ื™ึทืŸ ืื™ื™ื’ืŸ ื‘ืึทื–ื•ื ื“ืขืจ ื“ื™ื ืกื˜. ื•ื•ืขืŸ ืึทืคึผื“ื™ื™ื˜ื™ื ื’ ืึท ืคึผืึทืจืึธืœ ื˜ืขืงืข, ื“ื™ ื“ืœืœ ื˜ื•ื˜ ื ื™ืฉื˜ ืื•ื™ื˜ืึธืžืึทื˜ื™ืฉ ืงืœื™ื™ึทื‘ืŸ ื“ื™ ื’ืขื‘ื™ื˜ืŸ ืื™ื ื”ืึทืœื˜; ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื”ืึทืœื˜ืŸ ื“ื™ ื“ื™ื ืกื˜, ื•ื•ืึทืจื˜ืŸ ืึท ื˜ื™ื™ืžืึทื•ื˜, ืจืขื“ืึทื’ื™ืจืŸ ื“ื™ ื˜ืขืงืข ืื•ืŸ ืึธื ื”ื™ื™ื‘ืŸ ื“ื™ ื“ื™ื ืกื˜.

ืงื™ื™ืŸ ืื™ื™ื–!

ืึธืคึผืฆื™ืข #2. PassFiltEx

ื“ื™ ืคึผืจื•ื™ืขืงื˜ ืื™ื– ืึทืงื˜ื™ื•ื•, ืœืขื‘ืขื“ื™ืง ืื•ืŸ ืขืก ืื™ื– ื ื™ื˜ ื“ืึทืจืคึฟืŸ ืฆื• ืืคื™ืœื• ื‘ืจื™ืง ื“ื™ ืงืึทืœื˜ ื’ื•ืฃ.
ื™ื ืกื˜ืึธืœื™ื ื’ ื“ื™ ืคื™ืœื˜ืขืจ ื™ื ื•ื•ืึทืœื•ื•ื– ืงืึทืคึผื™ื™ื ื’ ืฆื•ื•ื™ื™ ื˜ืขืงืขืก ืื•ืŸ ืงืจื™ื™ื™ื˜ื™ื ื’ ืขื˜ืœืขื›ืข ืจืขื’ื™ืกื˜ืจื™ ืื™ื™ื ืกืŸ. ื“ื™ ืคึผืึทืจืึธืœ ื˜ืขืงืข ืื™ื– ื ื™ืฉื˜ ืื™ืŸ ืึท ืฉืœืึธืก, ื“ืึธืก ืื™ื–, ืขืก ืื™ื– ื‘ืืจืขื›ื˜ื™ื’ื˜ ืคึฟืึทืจ ืขื“ื™ื˜ื™ื ื’ ืื•ืŸ, ืœื•ื™ื˜ ื“ื™ ื’ืขื“ืึทื ืง ืคื•ืŸ ื“ืขืจ ืžื—ื‘ืจ ืคื•ืŸ ื“ื™ ืคึผืจื•ื™ืขืงื˜, ืขืก ืื™ื– ืคืฉื•ื˜ ืœื™ื™ืขื ืขืŸ ืึทืžืึธืœ ืึท ืžื™ื ื•ื˜. ืื•ื™ืš, ืžื™ื˜ ื ืึธืš ืจืขื’ื™ืกื˜ืจื™ ืื™ื™ื ืกืŸ, ืื™ืจ ืงืขื ืขืŸ ืงืึทื ืคื™ื’ื™ืขืจ ื‘ื™ื™ื“ืข ื“ื™ ืคื™ืœื˜ืขืจ ื–ื™ืš ืื•ืŸ ืืคื™ืœื• ื“ื™ ื ื•ืึทื ืกื™ื– ืคื•ืŸ ื“ื™ ืคึผืึทืจืึธืœ ืคึผืึธืœื™ื˜ื™ืง.

ืื–ื•ื™.
ื’ืขื’ืขื‘ืŸ: Active Directory ืคืขืœื“ test.local
Windows 8.1 ืคึผืจื•ื‘ื™ืจืŸ ื•ื•ืขืจืงืกื˜ื™ื™ืฉืึทืŸ (ื ื™ื˜ ื•ื•ื™ื›ื˜ื™ืง ืคึฟืึทืจ ื“ื™ ืฆื™ืœ ืคื•ืŸ ื“ืขื ืคึผืจืึธื‘ืœืขื)
ืคึผืึทืจืึธืœ ืคื™ืœื˜ืขืจ PassFiltEx

  • ืืจืืคืงืืคื™ืข ื“ื™ ืœืขืฆื˜ืข ืžืขืœื“ื•ื ื’ ืคึฟื•ืŸ ื“ื™ ืœื™ื ืง PassFiltEx
  • ืงืึธืคึผื™ PassFiltEx.dll ะฒ C: WindowsSystem32 (ืึธื“ืขืจ % ืกื™ืกื˜ืขืืจื•ื˜% ืกื™ืกื˜ืขื32).
    ืงืึธืคึผื™ PassFiltExBlacklist.txt ะฒ C: WindowsSystem32 (ืึธื“ืขืจ % ืกื™ืกื˜ืขืืจื•ื˜% ืกื™ืกื˜ืขื32). ืื•ื™ื‘ ื ื™ื™ื˜ื™ืง, ืžื™ืจ ื”ืขืกืึธืคืข ืขืก ืžื™ื˜ ืื•ื ื“ื–ืขืจ ืื™ื™ื’ืขื ืข ื˜ืขืžืคึผืœืึทื˜ืขืก
    ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ
  • ืขื“ื™ื˜ื™ื ื’ ื“ื™ ืจืขื’ื™ืกื˜ืจื™ ืฆื•ื•ื™ื™ึทื’: HKLMSYSTEMCurrentControlSetControlLsa => ืึธื ื–ืึธื’ ืคึผืึทืงืงืึทื’ืขืก
    ืœื™ื™ื’ PassFiltEx ืฆื• ื“ื™ ืกื•ืฃ ืคื•ืŸ ื“ืขืจ ืจืฉื™ืžื”. (ื“ื™ ืคืึทืจืœืขื ื’ืขืจื•ื ื’ ื“ืึทืจืฃ ื ื™ื˜ ื–ื™ื™ืŸ ืกืคึผืขืกื™ืคื™ืขื“.) ื“ื™ ื’ืึทื ืฅ ืจืฉื™ืžื” ืคื•ืŸ ืคึผืึทืงืึทื“ื–ืฉืึทื– ื’ืขื ื™ืฆื˜ ืคึฟืึทืจ ืกืงืึทื ื™ื ื’ ื•ื•ืขื˜ ืงื•ืงืŸ ื•ื•ื™ ื“ืึธืก "rassfm secli PassFiltEx".
    ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ
  • ืจืขื‘ืึธืึธื˜ ื“ื™ ืคืขืœื“ ืงืึทื ื˜ืจืึธื•ืœืขืจ.
  • ืžื™ืจ ืื™ื‘ืขืจื—ื–ืจืŸ ื“ื™ ืื•ื™ื‘ืŸ ืคึผืจืึธืฆืขื“ื•ืจ ืคึฟืึทืจ ืึทืœืข ืคืขืœื“ ืงืึทื ื˜ืจืึธื•ืœืขืจื–.

ืื™ืจ ืงืขื ื˜ ืื•ื™ืš ืœื™ื™ื’ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ืจืขื’ื™ืกื˜ืจื™ ืื™ื™ื ืกืŸ, ื•ื•ืึธืก ื’ื™ื˜ ืื™ืจ ืžืขืจ ื‘ื™ื™ื’ื™ืงื™ื™ื˜ ืื™ืŸ ื ื™ืฆืŸ ื“ืขื ืคื™ืœื˜ืขืจ:

ืึธืคึผื˜ื™ื™ืœื•ื ื’: HKLMSOFTWAREPassFiltEx - ืื™ื– ื‘ืืฉืืคืŸ ืื•ื™ื˜ืึธืžืึทื˜ื™ืฉ.

  • HKLMSOFTWAREPassFiltExBlacklistFileName, REG_SZ, ืคืขืœื™ืงื™ื™ึทื˜: PassFiltExBlacklist.txt

    ื‘ืœืึทืงืœื™ืกื˜ ื˜ืขืงืข ื ืึธืžืขืŸ - ืึทืœืึทื•ื– ืื™ืจ ืฆื• ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ืึท ืžื ื”ื’ ื“ืจืš ืฆื• ืึท ื˜ืขืงืข ืžื™ื˜ ืคึผืึทืจืึธืœ ื˜ืขืžืคึผืœืึทื˜ืขืก. ืื•ื™ื‘ ื“ื™ ืจืขื’ื™ืกื˜ืจื™ ืคึผืึธื–ื™ืฆื™ืข ืื™ื– ืœื™ื™ื“ื™ืง ืึธื“ืขืจ ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ, ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ื“ืจืš ืื™ื– ื’ืขื ื™ืฆื˜, ื•ื•ืึธืก ืื™ื– - % ืกื™ืกื˜ืขืืจื•ื˜% ืกื™ืกื˜ืขื32. ืื™ืจ ืงืขื ืขืŸ ืืคื™ืœื• ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ืึท ื ืขืฅ ื“ืจืš, ืึธื‘ืขืจ ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื’ืขื“ืขื ืงืขืŸ ืึทื– ื“ื™ ืžื•ืกื˜ืขืจ ื˜ืขืงืข ืžื•ื–ืŸ ื”ืึธื‘ืŸ ืงืœืึธืจ ืคึผืขืจืžื™ืฉืึทื ื– ืคึฟืึทืจ ืœื™ื™ืขื ืขืŸ, ืฉืจื™ื™ึทื‘ืŸ, ื•ื™ืกืžืขืงืŸ, ื˜ื•ื™ืฉืŸ.

  • HKLMSOFTWAREPassFiltExTokenPercentageOfPassword, REG_DWORD, ืคืขืœื™ืงื™ื™ึทื˜: 60

    TokenPercentageOfPassword - ืึทืœืึทื•ื– ืื™ืจ ืฆื• ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ื™ ืคึผืจืึธืฆืขื ื˜ ืคื•ืŸ ื“ื™ ืžืึทืกืงืข ืื™ืŸ ื“ื™ ื ื™ื™ึทืข ืคึผืึทืจืึธืœ. ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ื•ื•ืขืจื˜ ืื™ื– 60%. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืื•ื™ื‘ ื“ืขืจ ืคึผืจืึธืฆืขื ื˜ ืคึผืึทืกื™ืจื•ื ื’ ืื™ื– 60 ืื•ืŸ ื“ื™ ืฉื˜ืจื™ืงืœ ืกื˜ืึทืจื•ื•ืึทืจืก ืื™ื– ืื™ืŸ ื“ื™ ืžื•ืกื˜ืขืจ ื˜ืขืงืข, ื“ื™ ืคึผืึทืจืึธืœ Starwars1! ื•ื•ืขื˜ ื–ื™ื™ืŸ ืคืืจื•ื•ืืจืคืŸ ื‘ืฉืขืช ื“ื™ ืคึผืึทืจืึธืœ starwars1!DarthVader88 ื•ื•ืขื˜ ื–ื™ื™ืŸ ืื ื’ืขื ื•ืžืขืŸ ื•ื•ื™ื™ึทืœ ื“ืขืจ ืคึผืจืึธืฆืขื ื˜ ืคื•ืŸ ื“ื™ ืฉื˜ืจื™ืงืœ ืื™ืŸ ื“ื™ ืคึผืึทืจืึธืœ ืื™ื– ื•ื•ื™ื™ื ื™ืงืขืจ ื•ื•ื™ 60%

  • HKLMSOFTWAREPassFiltExRequireCharClasses, REG_DWORD, ืคืขืœื™ืงื™ื™ึทื˜: 0

    RequireCharClasses - ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื™ืงืกืคึผืึทื ื“ ื“ื™ ืคึผืึทืจืึธืœ ืจืขืงื•ื•ื™ืจืขืžืขื ืฅ ืงืึทืžืคึผืขืจื“ ืžื™ื˜ ื“ื™ ื ืึธืจืžืึทืœ ืึทืงื˜ื™ื•ื•ืขื“ื™ืจืขืงื˜ืึธืจื™ ืคึผืึทืจืึธืœ ืงืึทืžืคึผืœืขืงืกื™ื˜ื™ ืจืขืงื•ื•ื™ืจืขืžืขื ืฅ. ื“ื™ ื’ืขื‘ื•ื™ื˜-ืื™ืŸ ืงืึทืžืคึผืœืขืงืกื™ื˜ื™ ืจืขืงื•ื•ื™ืจืขืžืขื ืฅ ื“ืึทืจืคืŸ 3 ืคื•ืŸ ื“ื™ 5 ืžืขื’ืœืขืš ืคืึทืจืฉื™ื“ืขื ืข ื˜ื™ื™ืคึผืก ืคื•ืŸ ืื•ืชื™ื•ืช: ื•ืคึผืคึผืขืจืงืึทืกืข, ืœืึธื•ื•ืขืจืงืึทืกืข, ืฆื™ืคึฟืขืจ, ืกืคึผืขืฆื™ืขืœืข ืื•ืŸ ืื•ื ื™ืงืึธื“. ื ื™ืฆืŸ ื“ืขื ืจืขื’ื™ืกื˜ืจื™ ืคึผืึธื–ื™ืฆื™ืข, ืื™ืจ ืงืขื ืขืŸ ืฉื˜ืขืœืŸ ื“ื™ื™ืŸ ืคึผืึทืจืึธืœ ืงืึทืžืคึผืœืขืงืกื™ื˜ื™ ืจืขืงื•ื•ื™ืจืขืžืขื ืฅ. ื“ื™ ื•ื•ืขืจื˜ ื•ื•ืึธืก ืงืขื ืขืŸ ื–ื™ื™ืŸ ืกืคึผืขืกื™ืคื™ืขื“ ืื™ื– ืึท ืกื›ื•ื ืคื•ืŸ ื‘ื™ื˜ืŸ, ื™ืขื“ืขืจ ืคื•ืŸ ื•ื•ืึธืก ืื™ื– ืึท ืงืึธืจืึทืกืคึผืึทื ื“ื™ื ื’ ืžืึทื›ื˜ ืคื•ืŸ ืฆื•ื•ื™ื™.
    ืึทื– ืื™ื– - 1 = ื ื™ื“ืขืจื™ืง-ืงื•ื•ืึทืœื™ื˜ืขื˜, 2 = ื•ืคึผืคึผืขืจืงืึทืกืข, 4 = ืฆื™ืคึฟืขืจ, 8 = ืกืคึผืขืฆื™ืขืœืข ื›ืึทืจืึทืงื˜ืขืจ, ืื•ืŸ 16 = ืื•ื ื™ืงืึธื“ ื›ืึทืจืึทืงื˜ืขืจ.
    ืึทื–ื•ื™ ืžื™ื˜ ืึท ื•ื•ืขืจื˜ ืคื•ืŸ 7 ื“ื™ ืจืขืงื•ื•ื™ืจืขืžืขื ืฅ ื•ื•ืึธืœื˜ ื–ื™ื™ืŸ "Upper Case" ืื•ืŸ ืงืœื™ื™ืŸ ืื•ืชื™ื•ืช ืื•ืŸ ืฆื™ืคึฟืขืจ", ืื•ืŸ ืžื™ื˜ ืึท ื•ื•ืขืจื˜ ืคื•ืŸ 31 - "ืื•ื™ื‘ืขืจืฉื˜ืขืจ ืคืึทืœ ืื•ืŸ ื ื™ื“ืขืจื™ืงืขืจ ืคืึทืœ ืื•ืŸ ืฆื™ืคึฟืขืจ ืื•ืŸ ืกืคึผืขืฆื™ืขืœืข ืกื™ืžื‘ืึธืœ ืื•ืŸ ืื•ื ื™ืงืึธื“ ื›ืึทืจืึทืงื˜ืขืจ."
    ืื™ืจ ืงืขื ืขืŸ ืืคื™ืœื• ืคืึทืจื‘ื™ื ื“ืŸ - 19 = "ืื•ื™ื‘ืขืจืฉื˜ืขืจ ืคืึทืœ ืื•ืŸ ื ื™ื“ืขืจื™ืงืขืจ ืคืึทืœ ืื•ืŸ ืื•ื ื™ืงืึธื“ ื›ืึทืจืึทืงื˜ืขืจ."

  • ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ

ื ื ื•ืžืขืจ ืคื•ืŸ ื›ึผืœืœื™ื ื•ื•ืขืŸ ืงืจื™ื™ื™ื˜ื™ื ื’ ืึท ืžื•ืกื˜ืขืจ ื˜ืขืงืข:

  • ื˜ืขืžืคึผืœืึทื˜ืขืก ื–ืขื ืขืŸ ืคืึทืœ ื™ื ืกืขื ืกื™ื˜ื™ื•ื•. ื“ืขืจื™ื‘ืขืจ, ื“ืขืจ ื˜ืขืงืข ืคึผืึธื–ื™ืฆื™ืข ืกื˜ืึทืจื•ื•ืึทืจืก ะธ ืกื˜ืึทืจื•ื•ืึทืจืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ื‘ืืฉืœืืกืŸ ืฆื• ื–ื™ื™ืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ื•ื•ืขืจื˜.
  • ื“ื™ ื‘ืœืึทืงืœื™ืกื˜ ื˜ืขืงืข ืื™ื– ืฉื™ื™ึทืขืš-ืœื™ื™ืขื ืขืŸ ื™ืขื“ืขืจ 60 ืกืขืงื•ื ื“ืขืก, ืึทื–ื•ื™ ืื™ืจ ืงืขื ืขืŸ ืœื™ื™ื›ื˜ ืจืขื“ืึทื’ื™ืจืŸ ืขืก; ื ืึธืš ืึท ืžื™ื ื•ื˜, ื“ื™ ื ื™ื™ึทืข ื“ืึทื˜ืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ื“ื•ืจืš ื“ื™ ืคื™ืœื˜ืขืจ.
  • ืขืก ืื™ื– ื“ืขืจื•ื•ื™ื™ึทืœ ืงื™ื™ืŸ ืื•ื ื™ืงืึธื“ ืฉื˜ื™ืฆืŸ ืคึฟืึทืจ ืžื•ืกื˜ืขืจ ื•ื•ืึธืก ืจื™ื›ื˜ืŸ ื–ื™ืš. ื“ืึธืก ืื™ื–, ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ืื•ื ื™ืงืึธื“ ืื•ืชื™ื•ืช ืื™ืŸ ืคึผืึทืกื•ื•ืขืจื“ื–, ืึธื‘ืขืจ ื“ื™ ืคื™ืœื˜ืขืจ ื•ื•ืขื˜ ื ื™ืฉื˜ ืึทืจื‘ืขื˜ืŸ. ื“ืึธืก ืื™ื– ื ื™ืฉื˜ ืงืจื™ื˜ื™ืฉ ื•ื•ื™ื™ึทืœ ืื™ืš ื”ืึธื‘ืŸ ื ื™ืฉื˜ ื’ืขื–ืขืŸ ื™ื•ื–ืขืจื– ื•ื•ืึธืก ื ื•ืฆืŸ ืื•ื ื™ืงืึธื“ ืคึผืึทืกื•ื•ืขืจื“ื–.
  • ืขืก ืื™ื– ืงืขื“ื™ื™ึทื™ืง ืฆื• ื ื™ืฉื˜ ืœืึธื–ืŸ ืœื™ื™ื“ื™ืง ืฉื•ืจื•ืช ืื™ืŸ ื“ื™ ืžื•ืกื˜ืขืจ ื˜ืขืงืข. ืื™ืŸ ื“ื™ ื“ื™ื‘ืึทื’ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ืึท ื˜ืขื•ืช ื•ื•ืขืŸ ืœืึธื•ื“ื™ื ื’ ื“ืึทื˜ืŸ ืคื•ืŸ ืึท ื˜ืขืงืข. ื“ืขืจ ืคื™ืœื˜ืขืจ ืึทืจื‘ืขื˜, ืึธื‘ืขืจ ื•ื•ืึธืก ื“ื™ ืขืงืกื˜ืจืข ืื•ื™ืกื ืขืžืขืŸ?

ืคึฟืึทืจ ื“ื™ื‘ืึทื’ื™ื ื’, ื“ืขืจ ืึทืจืงื™ื™ื•ื• ื›ึผื•ืœืœ ืคึผืขืงืœ ื˜ืขืงืขืก ื•ื•ืึธืก ืœืึธื–ืŸ ืื™ืจ ืฆื• ืฉืึทืคึฟืŸ ืึท ืงืœืึธืฅ ืื•ืŸ ื“ืขืจื ืึธืš ืคึผืึทืจืก ืขืก ืžื™ื˜, ืœืžืฉืœ, ืžื™ืงืจืึธืกืึธืคื˜ ืึธื ื–ืึธื’ ืึทื ืึทืœื™ื–ืขืจ.
ื“ืขื ืคึผืึทืจืึธืœ ืคื™ืœื˜ืขืจ ื ื™ืฆื˜ ืขื•ื•ืขื ื˜ ื˜ืจื™ื™ืกื™ื ื’ ืคึฟืึทืจ Windows.

ื“ืขืจ ETW ืฉืคึผื™ื™ึทื–ืขืจ ืคึฟืึทืจ ื“ืขื ืคึผืึทืจืึธืœ ืคื™ืœื˜ืขืจ ืื™ื– 07d83223-7594-4852-babc-784803fdf6c5. ืึทื–ื•ื™, ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืื™ืจ ืงืขื ืขืŸ ืงืึทื ืคื™ื’ื™ืขืจ ื’ืขืฉืขืขื ื™ืฉ ื˜ืจื™ื™ืกื™ื ื’ ื ืึธืš ื“ื™ ืคืืœื’ืขื ื“ืข ืจืขื‘ืึธืึธื˜:
logman create trace autosessionPassFiltEx -o %SystemRoot%DebugPassFiltEx.etl -p "{07d83223-7594-4852-babc-784803fdf6c5}" 0xFFFFFFFF -ets

ื˜ืจื™ื™ืกื™ื ื’ ื•ื•ืขื˜ ืึธื ื”ื™ื™ื‘ืŸ ื ืึธืš ื“ืขืจ ื•ื•ื™ื™ึทื˜ืขืจ ืกื™ืกื˜ืขื ืจืขื‘ืึธืึธื˜. ืื•ื™ืฃ ื”ืขืจืŸ:
logman stop PassFiltEx -ets && logman delete autosessionPassFiltEx -ets
ืึทืœืข ื“ื™ ืงืึทืžืึทื ื“ื– ื–ืขื ืขืŸ ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ื™ ืกืงืจื™ืคึผืก StartTracingAtBoot.cmd ะธ StopTracingAtBoot.cmd.

ืคึฟืึทืจ ืึท ืื™ื™ืŸ-ืฆื™ื™ึทื˜ ื˜ืฉืขืง ืคื•ืŸ ื“ื™ ืคื™ืœื˜ืขืจ ืึธืคึผืขืจืึทืฆื™ืข, ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ StartTracing.cmd ะธ StopTracing.cmd.
ืื™ืŸ ืกื“ืจ ืฆื• ืงืึทื ื•ื•ื™ื ื™ืึทื ื˜ืœื™ ืœื™ื™ืขื ืขืŸ ื“ื™ ื“ื™ื‘ืึทื’ ื•ื™ืกืžืึทื˜ืขืจืŸ ืคื•ืŸ ื“ืขื ืคื™ืœื˜ืขืจ ืžื™ืงืจืึธืกืึธืคื˜ ืžืขืกืขื“ื–ืฉ ืึทื ืึทืœื™ื–ืขืจ ืขืก ืื™ื– ืจืขืงืึทืžืขื ื“ื™ื“ ืฆื• ื ื•ืฆืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ืกืขื˜ื˜ื™ื ื’ืก:

ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ

ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ

ื•ื•ืขืŸ ืกื˜ืึธืคึผืคึผื™ื ื’ ืœืึธื’ื™ื ื’ ืื•ืŸ ืคึผืึทืจืกื™ื ื’ ืื™ืŸ ืžื™ืงืจืึธืกืึธืคื˜ ืžืขืกืขื“ื–ืฉ ืึทื ืึทืœื™ื–ืขืจ ืึทืœืฅ ืงื•ืงื˜ ืขืคึผืขืก ื•ื•ื™ ื“ืึธืก:

ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ

ื“ืึธ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ืึทื– ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ืึทืŸ ืคึผืจื•ื•ื•ืŸ ืฆื• ืฉื˜ืขืœืŸ ืึท ืคึผืึทืจืึธืœ ืคึฟืึทืจ ื“ื™ ื‘ืึทื ื™ืฆืขืจ - ื“ื™ ืžืึทื’ื™ืฉ ื•ื•ืึธืจื˜ ื“ืขืจืฆื™ื™ืœื˜ ืื•ื ื“ื– ื“ืขื ืฉื˜ืขืœืŸ ืื™ืŸ ื“ื™ื‘ืึทื’. ืื•ืŸ ื“ื™ ืคึผืึทืจืึธืœ ืื™ื– ืคืืจื•ื•ืืจืคืŸ ืจืขื›ื˜ ืฆื• ื–ื™ื™ืŸ ื‘ื™ื™ึทื–ื™ื™ึทืŸ ืื™ืŸ ื“ืขืจ ืžื•ืกื˜ืขืจ ื˜ืขืงืข ืื•ืŸ ืžืขืจ ื•ื•ื™ 30% ื’ืœื™ื™ึทื›ืŸ ืื™ืŸ ื“ื™ ืืจื™ื™ืŸ ื˜ืขืงืกื˜.

ืื•ื™ื‘ ืึท ื’ืขืจืึธื˜ืŸ ืคึผืึทืจืึธืœ ื˜ื•ื™ืฉืŸ ืคึผืจื•ื•ื•ืŸ ืื™ื– ื’ืขืžืื›ื˜, ืžื™ืจ ื–ืขืŸ ื“ื™ ืคืืœื’ืขื ื“ืข:

ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ

ืขืก ืื™ื– ืขื˜ืœืขื›ืข ื™ื ืงืึทื ื•ื•ื™ื ื™ืึทื ืก ืคึฟืึทืจ ื“ื™ ืกื•ืฃ ื‘ืึทื ื™ืฆืขืจ. ื•ื•ืขืŸ ืื™ืจ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื˜ื•ื™ืฉืŸ ืึท ืคึผืึทืจืึธืœ ื•ื•ืึธืก ืื™ื– ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ืื™ืŸ ื“ืขืจ ืจืฉื™ืžื” ืคื•ืŸ ื˜ืขืžืคึผืœืึทื˜ืขืก ื˜ืขืงืข, ื“ืขืจ ืึธื ื–ืึธื’ ืื•ื™ืฃ ื“ืขื ืขืงืจืึทืŸ ืื™ื– ื ื™ื˜ ืึทื ื“ืขืจืฉ ืคื•ืŸ ื“ื™ ื ืึธืจืžืึทืœ ืึธื ื–ืึธื’ ื•ื•ืขืŸ ื“ื™ ืคึผืึทืจืึธืœ ืคึผืึธืœื™ื˜ื™ืง ืื™ื– ื ื™ืฉื˜ ื“ื•ืจื›ื’ืขื’ืื ื’ืขืŸ.

ื•ื•ื™ ืฆื• ืคืึทืจื‘ืึธื˜ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื•ืŸ ืžืึทื›ืŸ ืึทืœืขืžืขืŸ ื”ืึทืกืŸ ืื™ืจ

ื“ืขืจื™ื‘ืขืจ, ื–ื™ื™ืŸ ืฆื•ื’ืขื’ืจื™ื™ื˜ ืคึฟืึทืจ ืจื•ืคื˜ ืื•ืŸ ืฉืึทื•ืฅ: "ืื™ืš ืืจื™ื™ืŸ ื“ื™ ืคึผืึทืจืึธืœ ืจื™ื›ื˜ื™ืง, ืึธื‘ืขืจ ืขืก ื˜ื•ื˜ ื ื™ืฉื˜ ืึทืจื‘ืขื˜ืŸ."

ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜.

ื“ื™ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืึทืœืึทื•ื– ืื™ืจ ืฆื• ืคืึทืจื•ื•ืขืจืŸ ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ ืคึผืฉื•ื˜ ืึธื“ืขืจ ื ืึธืจืžืึทืœ ืคึผืึทืกื•ื•ืขืจื“ื– ืื™ืŸ ืึทืŸ ืึทืงื˜ื™ื•ื•ืข Directory ืคืขืœื“. ืœืืžื™ืจ ื–ืื’ืŸ "ื ื™ื™ืŸ!" ืคึผืึทืกื•ื•ืขืจื“ื– ื•ื•ื™: "P@ssw0rd", "Qwerty123", "ADm1n098".
ื™ืึธ, ืคื•ืŸ ืงื•ืจืก, ื™ื•ื–ืขืจื– ื•ื•ืขืœืŸ ืœื™ื‘ ืื™ืจ ืืคื™ืœื• ืžืขืจ ืคึฟืึทืจ ื’ืขื ื•ืžืขืŸ ืึทื–ืึท ื–ืึธืจื’ืŸ ืคื•ืŸ ื–ื™ื™ืขืจ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืื•ืŸ ื“ื™ ื ื•ื™ื˜ ืฆื• ืงื•ืžืขืŸ ืึทืจื•ื™ืฃ ืžื™ื˜ ืžื™ื™ื ื•ื ื’-ื‘ืœืึธื•ื™ื ื’ ืคึผืึทืกื•ื•ืขืจื“ื–. ืื•ืŸ, ื˜ืึธืžืขืจ, ื“ื™ ื ื•ืžืขืจ ืคื•ืŸ ืงืึทืœืœืก ืื•ืŸ ืจื™ืงื•ื•ืขืก ืคึฟืึทืจ ื”ื™ืœืฃ ืžื™ื˜ ื“ื™ื™ืŸ ืคึผืึทืจืึธืœ ื•ื•ืขื˜ ืคืึทืจื’ืจืขืกืขืจืŸ. ืื‘ืขืจ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืงื•ืžื˜ ืฆื• ืึท ืคึผืจื™ื™ึทื–.

ืœื™ื ืงืก ืฆื• ืจืขืกื•ืจืกืŸ ื’ืขื ื™ืฆื˜:
ืžื™ืงืจืึธืกืึธืคื˜ ืึทืจื˜ื™ืงืœ ื•ื•ืขื’ืŸ ืึท ืžื ื”ื’ ืคึผืึทืจืึธืœ ืคื™ืœื˜ืขืจ ื‘ื™ื‘ืœื™ืึธื˜ืขืง: ืฉืคึผืจื™ื›ื•ื•ืึธืจื˜ ืคื™ืœื˜ืขืจืก
PassFiltEx: PassFiltEx
ืžืขืœื“ื•ื ื’ ืœื™ื ืง: ืœืขืฆื˜ ืžืขืœื“ื•ื ื’
ืฉืคึผืจื™ื›ื•ื•ืึธืจื˜ ืจืฉื™ืžื•ืช:
DanielMiessler ืจืฉื™ืžื”: ืœื™ื ืง.
ื•ื•ืึธืจื“ืœื™ืกื˜ ืคึฟื•ืŸ weakpass.com: ืœื™ื ืง.
ื•ื•ืึธืจื“ืœื™ืกื˜ ืคื•ืŸ berzerk0 ืจืขืคึผืึธ: ืœื™ื ืง.
Microsoft Message Analyzer: ืžื™ืงืจืึธืกืึธืคื˜ ืึธื ื–ืึธื’ ืึทื ืึทืœื™ื–ืขืจ.

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’