1. Isingeniso

Izinkampani ebezingenazo izinhlelo zokufinyelela kude ziwasebenzise ngokushesha ezinyangeni ezimbalwa ezedlule. Akubona bonke abalawuli abalungiselwe “ukushisa” okunjalo, okuholele ekuphelelweni kokuvikeleka: ukucushwa okungalungile kwezinsizakalo noma ngisho nokufakwa kwezinguqulo eziphelelwe yisikhathi zesofthiwe ezinobungozi obutholwe ngaphambilini. Kwabanye, lokhu okweqiwe sekuvele ku-boomerang, abanye babe nenhlanhla eyengeziwe, kodwa wonke umuntu kufanele afinyelele iziphetho. Ukwethembeka emsebenzini oqhelile kuye kwanda kakhulu, futhi izinkampani eziningi ngokwengeziwe zamukela umsebenzi okude njengefomethi eyamukelekayo ngokuqhubekayo.

Ngakho-ke, kunezinketho eziningi zokuhlinzeka ngokufinyelela kude: ama-VPN ahlukahlukene, i-RDS ne-VNC, i-TeamViewer nabanye. Abalawuli banokuningi abangakhetha kukho, ngokusekelwe kumininingwane yokwakha inethiwekhi yebhizinisi namadivayisi kuyo. Izixazululo ze-VPN zihlala zithandwa kakhulu, noma kunjalo, izinkampani eziningi ezincane zikhetha i-RDS (Izinsizakalo Zedeskithophu Ekude), zilula futhi ziyashesha ukuzisebenzisa.

Kulesi sihloko sizokhuluma kabanzi mayelana nokuphepha kwe-RDS. Asenze uhlolojikelele olufushane lobungozi obaziwayo, futhi siphinde sicabangele izimo ezimbalwa zokuqalisa ukuhlasela kwengqalasizinda yenethiwekhi okusekelwe ku-Active Directory. Sithemba ukuthi i-athikili yethu izosiza othile ukuthi asebenze kuziphazamisi futhi athuthukise ukuphepha.

2. Ukuba sengozini kwakamuva kwe-RDS/RDP

Noma iyiphi isofthiwe iqukethe amaphutha kanye nokuba sengozini okungase kusetshenziswe abahlaseli, futhi i-RDS injalo. I-Microsoft ibilokhu ibika njalo ubungozi obusha muva nje, ngakho-ke sinqume ukubanika umbono omfishane:

• I-CVE-2019-0787

Lokhu kuba sengozini kubeka abasebenzisi abaxhumeke kuseva esengozini engcupheni. Umhlaseli angakwazi ukulawula idivayisi yomsebenzisi noma athole indawo kusistimu ukuze abe nokufinyelela okukude unomphela.

• I-CVE-2019-1181 / I-CVE-2019-1182 / I-CVE-2020-0609

Leli qembu lobungozi livumela umhlaseli ongagunyaziwe ukuthi akhiphe ikhodi engafanele ekude kuseva esebenzisa i-RDS esebenzisa isicelo esiklanywe ngokukhethekile. Angaphinda asetshenziselwe ukudala izikelemu—uhlelo olungayilungele ikhompuyutha olungena ngokuzimele kumadivayisi angomakhelwane kunethiwekhi. Ngakho-ke, lobu buthakathaka bungafaka engozini yonke inethiwekhi yenkampani, futhi izibuyekezo ezifika ngesikhathi kuphela ezingabasindisa.

Isofthiwe yokufinyelela kude ithole ukunakwa okwengeziwe okuvela kubo bobabili abacwaningi nabahlaseli, ngakho-ke singase sizwe maduze mayelana nokuba sengozini okufanayo.

Izindaba ezinhle ukuthi akubona bonke ubuthakathaka obunokuxhashazwa komphakathi okutholakalayo. Izindaba ezimbi ukuthi ngeke kube nzima kumhlaseli onolwazi ukuthi abhale ukuxhashazwa kokuba sengozini ngokusekelwe encazelweni, noma asebenzise amasu afana ne-Patch Diffing (ozakwethu babhale ngakho isihloko). Ngakho-ke, sincoma ukuthi ubuyekeze njalo isofthiwe futhi uqaphe ukubukeka kwemilayezo emisha mayelana nokuba sengozini okutholiwe.

3. Ukuhlasela

Siqhubekela engxenyeni yesibili yesihloko, lapho sizobonisa khona ukuthi ukuhlaselwa kwengqalasizinda yenethiwekhi okusekelwe ku-Active Directory kuqala kanjani.

Izindlela ezichaziwe ziyasebenza kumodeli elandelayo yomhlaseli: umhlaseli one-akhawunti yomsebenzisi futhi okwazi ukufinyelela Isango Ledeskithophu Ekude - iseva yetheminali (ngokuvamile iyafinyeleleka, isibonelo, kunethiwekhi yangaphandle). Ngokusebenzisa lezi zindlela, umhlaseli uzokwazi ukuqhubeka nokuhlasela ingqalasizinda futhi ahlanganise ubukhona bakhe kunethiwekhi.

Ukucushwa kwenethiwekhi esimweni ngasinye kungase kuhluke, kodwa amasu achaziwe akhona yonke indawo.

Izibonelo zokushiya indawo enomkhawulo kanye namalungelo akhulayo

Lapho ufinyelela Isango Ledeskithophu Ekude, umhlaseli cishe uzohlangabezana nohlobo oluthile lwendawo ekhawulelwe. Uma uxhuma kuseva yetheminali, kwethulwa uhlelo kuyona: iwindi lokuxhuma nge-Remote Desktop protocol yezinsiza zangaphakathi, i-Explorer, amaphakheji ehhovisi nanoma iyiphi enye isofthiwe.

Umgomo womhlaseli kuzoba ukuthola ukufinyelela ekusebenziseni imiyalo, okungukuthi, ukwethula i-cmd noma i-powershell. Izindlela zokuphunyuka ze-Windows sandbox zakudala zingasiza kulokhu. Ake sizicabangele ngokuqhubekayo.

Inketho ye-1. Umhlaseli unokufinyelela ewindini lokuxhuma le-Remote Desktop ngaphakathi kweSango Ledeskithophu Ekude:

Imenyu ethi “Show Options” iyavula. Izinketho ziyavela zokukhohlisa amafayela okumisa ukuxhumana:

Kuleli windi ungakwazi ukufinyelela kalula ku-Explorer ngokuchofoza noma yiziphi izinkinobho "Vula" noma "Londoloza":

Isihloli siyavula. “Ibha yekheli” layo lenza kube nokwenzeka ukwethula amafayela asebenzisekayo avunyelwe, kanye nokufaka kuhlu uhlelo lwefayela. Lokhu kungaba usizo kumhlaseli ezimeni lapho amadrayivu esistimu efihliwe futhi engakwazi ukufinyelelwa ngokuqondile:

→ Ividiyo yedemo

Isimo esifanayo singenziwa kabusha, isibonelo, uma usebenzisa i-Excel ku-Microsoft Office suite njengesofthiwe ekude.

→ Ividiyo yedemo

Ngaphezu kwalokho, ungakhohlwa mayelana nama-macros asetshenziswe kule suite yehhovisi. Ozakwethu babheke inkinga yezokuphepha ezinkulu kulokhu isihloko.

Inketho ye-2. Esebenzisa okokufaka okufanayo njengakunguqulo yangaphambilini, umhlaseli uvula ukuxhumeka okumbalwa kudeskithophu yesilawuli kude ngaphansi kwe-akhawunti efanayo. Lapho uxhuma kabusha, eyokuqala izovalwa, futhi iwindi elinesaziso sephutha lizovela esikrinini. Inkinobho yosizo kuleli windi izoshayela i-Internet Explorer kuseva, ngemva kwalokho umhlaseli aye ku-Explorer.

→ Ividiyo yedemo

Inketho ye-3. Uma imikhawulo ekuqaliseni amafayela asebenzisekayo ilungiswa, umhlaseli angase ahlangabezane nesimo lapho izinqubomgomo zeqembu zivimbela umlawuli ekusebenziseni i-cmd.exe.

Kukhona indlela yokuzungeza lokhu ngokusebenzisa ifayela le-bat kudeskithophu ekude nokuqukethwe okufana ne-cmd.exe /K <command>. Iphutha uma uqala i-cmd kanye nesibonelo esiyimpumelelo sokwenza ifayela le-bat siboniswe esithombeni esingezansi.

Inketho ye-4. Ukwenqabela ukwethulwa kwezinhlelo zokusebenza kusetshenziswa izinhla ezivinjelwe ngokusekelwe egameni lamafayela asebenzisekayo akusona isixazululo; angagwenywa.

Cabangela lesi simo esilandelayo: sikhubaze ukufinyelela kulayini womyalo, savimbela ukwethulwa kwe-Internet Explorer kanye ne-PowerShell sisebenzisa izinqubomgomo zeqembu. Umhlaseli uzama ukucela usizo - akukho mpendulo. Izama ukuqalisa i-powershell ngemenyu yokuqukethwe yewindi le-modal, elibizwa ngokhiye we-Shift ocindezelwe - umlayezo obonisa ukuthi ukuqaliswa kwenqatshelwe umlawuli. Izama ukuqalisa i-powershell ngebha yekheli - futhi akukho mpendulo. Ungawudlula kanjani umkhawulo?

Kwanele ukukopisha i-powershell.exe kufolda ethi C:WindowsSystem32WindowsPowerShellv1.0 uyifake kufolda yomsebenzisi, uguqule igama libe kwenye into ngaphandle kwe-powershell.exe, bese kuvela inketho yokuqalisa.

Ngokuzenzakalelayo, lapho uxhumeka kudeskithophu ekude, ukufinyelela kumadiski endawo eklayenti kunikezwa, lapho umhlaseli engakopisha khona i-powershell.exe futhi ayiqhube ngemva kokuyiqamba kabusha.

→ Ividiyo yedemo

Sinikeze izindlela ezimbalwa kuphela zokudlula imikhawulo; ungaqhamuka nezinye izimo eziningi, kodwa zonke zinento eyodwa abafana ngazo: ukufinyelela ku-Windows Explorer. Kunezinhlelo zokusebenza eziningi ezisebenzisa amathuluzi ajwayelekile okukhohlisa ifayela le-Windows, futhi uma ebekwe endaweni elinganiselwe, amasu afanayo angasetshenziswa.

4. Izincomo nesiphetho

Njengoba sibona, ngisho nasendaweni elinganiselwe kukhona indawo yokuthuthukiswa kokuhlasela. Nokho, ungenza ukuphila kube nzima kakhulu kumhlaseli. Sinikeza izincomo ezijwayelekile ezizoba wusizo kukho kokubili izinketho esizicubungulile nakwezinye izimo.

• Uhlelo olukhawulelwe luqala ohlwini olumnyama/ olumhlophe kusetshenziswa izinqubomgomo zeqembu.
  Ezimweni eziningi, noma kunjalo, kusengenzeka ukusebenzisa ikhodi. Sincoma ukuthi uzijwayeze ngephrojekthi LOLBAS, ukuba nombono wezindlela ezingabhaliwe zokukhohlisa amafayela nokwenza ikhodi ohlelweni.
  Sincoma ukuhlanganisa zombili izinhlobo zemikhawulo: isibonelo, ungavumela ukwethulwa kwamafayela asebenzisekayo asayinwe yi-Microsoft, kodwa ukhawulele ukwethulwa kwe-cmd.exe.
• Khubaza amathebhu wezilungiselelo ze-Internet Explorer (kungenziwa endaweni ebhukwini).
• Khubaza usizo olakhelwe ngaphakathi lweWindows nge-regedit.
• Khubaza amandla okukhweza amadiski endawo ukuze uxhumeke kude uma umkhawulo onjalo ungabalulekile kubasebenzisi.
• Khawulela ukufinyelela kumadrayivu endawo omshini wesilawuli kude, ushiye ukufinyelela kumafolda abasebenzisi kuphela.

Sithemba ukuthi ukuthole kuthakazelisa okungenani, futhi ekugcineni, lesi sihloko sizosiza ukwenza umsebenzi okude wenkampani yakho uphephe.

Source: www.habr.com