\n| \u9690\u85cf\u6027<\/td>\n | \u8d26\u6237\u53ef\u89c1\u4e8e lusrmgr.msc<\/td>\n | \u6ce8\u518c\u8868\u9690\u85cf\u3001\u514b\u9686\u5408\u6cd5\u8d26\u6237 SID<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 💡 \u56db\u4e2a\u7ef4\u5ea6\u5bf9\u5e94\u56db\u79cd\u6392\u67e5\u624b\u6bb5：\u770b\u540d\u5b57 \u2192 \u770b\u6743\u9650 \u2192 \u770b\u767b\u5f55\u65e5\u5fd7（\u7b2c 03 \u7bc7\u7684 4624\/4625）\u2192 \u770b\u6ce8\u518c\u8868\u3002\u7b2c\u56db\u79cd\u6700\u96be\u67e5，\u5c31\u662f\u4e0b\u9762\u7684\u5f71\u5b50\u8d26\u6237\u3002<\/p>\n 2.2 \u81ea\u542f\u52a8\u4e0e\u8d26\u6237\u7684\u5feb\u901f\u6392\u67e5<\/h5>\n\u542f\u52a8\u4f4d\u7f6e：<\/p>\n \u6ce8\u518c\u8868：HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run
\n\u8ba1\u5212\u4efb\u52a1：schtasks \/query \/fo LIST \u00a0 \u00a0 \u00a0 （\u68c0\u67e5\u5f02\u5e38\u811a\u672c\u8def\u5f84）
\n\u670d\u52a1： \u00a0 sc query state=all \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 （\u7b5b\u9009\u672a\u77e5\u670d\u52a1） <\/p>\n \u68c0\u6d4b\u5de5\u5177：D \u76fe \u2014\u2014 \u68c0\u6d4b\u4f2a\u88c5\u6210\u7cfb\u7edf\u670d\u52a1\u7684\u6076\u610f\u8fdb\u7a0b\u3002<\/p>\n 2.3 \u9690\u85cf\u8d26\u6237\u4e0e\u5f71\u5b50\u8d26\u6237\u6392\u67e5（\u6838\u5fc3）<\/h5>\n\u80cc\u666f（\u7b14\u8bb0\u8865\u5145）：net user \u770b\u4e0d\u5230\u4ee5 $ \u7ed3\u5c3e\u7684\u8d26\u6237（\u5982 admin$），\u8fd9\u5c31\u662f"\u9690\u85cf\u8d26\u6237"； \u5f71\u5b50\u8d26\u6237\u66f4\u9690\u853d\u2014\u2014\u628a\u4e00\u4e2a\u666e\u901a\u8d26\u6237\u5728\u6ce8\u518c\u8868\u91cc\u7684 F \u503c（\u6743\u9650\u6307\u7eb9）\u6539\u6210 Administrator \u7684，lusrmgr.msc \u91cc\u770b\u5230\u7684\u662f\u666e\u901a\u8d26\u6237，\u5b9e\u9645\u6743\u9650\u5374\u662f\u7ba1\u7406\u5458\u3002<\/p>\n \u6b65\u9aa4 1：\u6ce8\u518c\u8868\u6df1\u5ea6\u68c0\u6d4b<\/p>\n \u6253\u5f00 SAM \u6ce8\u518c\u8868\u8def\u5f84（\u9700\u5148\u7ed9 Administrators \u8d4b\u8bfb\u53d6\u6743\u9650）：
\nregedit \u2192 HKEY_LOCAL_MACHINE\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users
\n\u68c0\u67e5 Names \u9879：\u5bf9\u6bd4\u672c\u5730\u7528\u6237\u5217\u8868，\u53d1\u73b0\/\u5220\u9664\u672a\u77e5\u8d26\u6237\u952e\u503c <\/p>\n \u6b65\u9aa4 2：\u514b\u9686\u8d26\u6237\u8bc6\u522b<\/p>\n :: \u4f7f\u7528 D \u76fe\u5de5\u5177 \u2192 "\u8d26\u6237\u514b\u9686"\u68c0\u6d4b\u529f\u80fd
\n:: \u6216\u624b\u52a8\u6bd4\u5bf9\u6ce8\u518c\u8868 F \u503c：
\nreg query "HKLM\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\000001F4" \/v F \u00a0 \u00a0 \u00a0:: \u7ba1\u7406\u5458\u6b63\u5e38 F \u503c
\nreg query "HKLM\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\<\u53ef\u7591SID>" \/v F \u00a0 \u00a0 :: \u4e0d\u4e00\u81f4\u5219\u4e3a\u514b\u9686 <\/p>\n 💡 \u7b14\u8bb0\u8865\u5145：000001F4 \u662f\u5341\u516d\u8fdb\u5236\u7684 RID 500 = \u5185\u7f6e Administrator\u3002 \u5f71\u5b50\u8d26\u6237\u7684\u539f\u7406\u5c31\u662f\u628a\u53ef\u7591 SID \u7684 F \u503c\u6539\u6210 000001F4 \u7684 F \u503c\u2014\u2014F \u503c\u76f8\u540c = \u6743\u9650\u76f8\u540c，\u6240\u4ee5\u6bd4\u5bf9 F \u503c\u5c31\u80fd\u63ea\u51fa\u514b\u9686\u3002<\/p>\n \u6b65\u9aa4 3：\u65e5\u5fd7\u5173\u8054\u5206\u6790<\/p>\n # \u7b5b\u9009\u5f02\u5e38\u767b\u5f55\u4e8b\u4ef6（\u91cd\u70b9：RDP \u767b\u5f55）
\nGet-WinEvent -FilterHashtable @{LogName='Security';ID=4624} |
\nWhere-Object { $_.Properties[8].Value -eq 10 } | \u00a0 # LogonType=10（RDP）
\nSelect-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='IP';e={$_.Properties[18].Value}} <\/p>\n \u6b65\u9aa4 4：\u5f3a\u5236\u6e05\u9664<\/p>\n net user <\u9690\u85cf\u8d26\u6237\u540d> \/delete \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0:: \u5148\u5c1d\u8bd5\u5e38\u89c4\u5220\u9664
\nwmic useraccount where "name='<\u9690\u85cf\u8d26\u6237\u540d>'" delete \u00a0:: WMIC \u5f3a\u5236\u5220\u9664 <\/p>\n \u26a0\ufe0f \u7b14\u8bb0\u63d0\u9192：WMIC \u5728\u65b0\u7248 Windows \u5df2\u5f03\u7528，\u66ff\u4ee3\u65b9\u6848：<\/p>\n Remove-LocalUser -Name "<\u9690\u85cf\u8d26\u6237\u540d>" <\/p>\n \u4e14\u5f71\u5b50\u8d26\u6237\u5fc5\u987b\u5220\u6ce8\u518c\u8868\u952e\u503c\u624d\u5220\u5f97\u5e72\u51c0\u2014\u2014net user \u5220\u4e0d\u6389\u6ce8\u518c\u8868\u91cc\u5df2"\u65ad\u94fe"\u7684\u5f71\u5b50\u8d26\u6237\u6b8b\u7559\u3002<\/p>\n
\n🔌 \u4e09\u3001\u5f02\u5e38\u7aef\u53e3\u4e0e\u8fdb\u7a0b\u6392\u67e5<\/h4>\n3.1 \u7aef\u53e3\u4e0e\u8fde\u63a5\u6392\u67e5<\/h5>\nnetstat \u9ad8\u7ea7\u7528\u6cd5：<\/p>\n netstat -ano | findstr ESTABLISHED :: \u7b5b\u9009\u6d3b\u8dc3\u8fde\u63a5
\nnetstat -anob :: \u663e\u793a\u5173\u8054\u8fdb\u7a0b\u53ca\u8def\u5f84（\u9700\u7ba1\u7406\u5458\u6743\u9650）<\/p>\n \u534f\u8bae \u672c\u5730\u5730\u5740 \u5916\u90e8\u5730\u5740 \u72b6\u6001 PID
\nTCP 0.0.0.0:80 0.0.0.0:0 LISTENING 37464
\nTCP 0.0.0.0:135 0.0.0.0:0 LISTENING 2032
\nTCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
\nTCP 0.0.0.0:902 0.0.0.0:0 LISTENING 6744
\nTCP 0.0.0.0:912 0.0.0.0:0 LISTENING 6744
\nTCP 0.0.0.0:3306 0.0.0.0:0 LISTENING 114548
\nTCP 0.0.0.0:5040 0.0.0.0:0 LISTENING 13632
\nTCP 0.0.0.0:6850 0.0.0.0:0 LISTENING 27544
\nTCP 0.0.0.0:7680 0.0.0.0:0 LISTENING 12096
\nTCP 0.0.0.0:9012 0.0.0.0:0 LISTENING 12672
\nTCP 0.0.0.0:9013 0.0.0.0:0 LISTENING 12672
\nTCP 0.0.0.0:27036 0.0.0.0:0 LISTENING 24072
\nTCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 1772
\nTCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 1688
\nTCP 0.0.0.0:49670 0.0.0.0:0 LISTENING 2560 <\/p>\n \u5173\u952e\u5206\u6790\u70b9（\u539f\u6587）：<\/p>\n \n- \n
\u5f02\u5e38\u5916\u90e8 IP（\u5c24\u5176\u5883\u5916 IP）\u3001\u975e\u5e38\u7528\u7aef\u53e3（\u5982 55555）\u3001\u65e0\u7b7e\u540d\u8fdb\u7a0b\u7684\u7aef\u53e3\u5360\u7528；<\/p>\n<\/li>\n - \n
\u7ed3\u5408 tasklist | findstr "PID" \u5b9a\u4f4d\u8fdb\u7a0b\u3002<\/p>\n<\/li>\n<\/ul>\n \u56fe\u5f62\u5316\u5de5\u5177：D \u76fe \u2014\u2014 \u67e5\u770b\u7aef\u53e3-\u8fdb\u7a0b\u6620\u5c04，\u8bc6\u522b\u65e0\u7b7e\u540d\u8fdb\u7a0b\u3002<\/p>\n 💡 \u7b14\u8bb0\u8865\u5145\u8bfb\u6cd5：0.0.0.0:xxx \u662f\u672c\u673a\u76d1\u542c，\u91cd\u70b9\u770b ESTABLISHED \u4e14\u5bf9\u7aef\u662f\u964c\u751f\u5916\u7f51 IP \u7684\u884c\u2014\u2014\u90a3\u624d\u662f"\u6d3b\u7740\u7684\u5916\u8054"\u3002 \u53e6\u5916 445（PID 4 = System，SMB）\u30013306（MySQL）\u8fd9\u7c7b\u80fd\u5bf9\u4e0a\u4e1a\u52a1\u7684\u7aef\u53e3\u76f4\u63a5\u8df3\u8fc7，\u5bf9\u4e0d\u4e0a\u4e1a\u52a1\u7684\u7aef\u53e3\u624d\u662f\u5acc\u7591\u4eba\u3002<\/p>\n 3.2 \u8fdb\u7a0b\u6392\u67e5<\/h5>\n\u8fdb\u7a0b\u4f2a\u88c5\u7279\u5f81（\u539f\u6587）：<\/p>\n \u2460 \u540d\u79f0\u4eff\u7cfb\u7edf\u8fdb\u7a0b：svch0st.exe（0 \u4ee3\u66ff o）\u3001explore.exe（\u5c11\u4e86 r）
\n\u2461 \u8def\u5f84\u4f4d\u4e8e\u975e\u7cfb\u7edf\u76ee\u5f55：\u5982 C:\\\\Windows\\\\Temp\\\\ <\/p>\n 💡 \u5224\u522b\u5fc3\u6cd5：\u771f svchost.exe \u53ea\u4f1a\u5728 C:\\\\Windows\\\\System32\u3002\u540d\u5b57\u5bf9\u3001\u8def\u5f84\u4e0d\u5bf9 = \u4f2a\u88c5；\u8def\u5f84\u5bf9\u3001\u540d\u5b57\u62fc\u9519 = \u4f2a\u88c5\u3002\u4e24\u4e2a\u7ef4\u5ea6\u4e00\u8d77\u770b\u3002<\/p>\n \u56db\u6b3e\u5de5\u5177\u5bf9\u6bd4<\/p>\n \n\u5de5\u5177\/\u65b9\u6cd5\u64cd\u4f5c\u91cd\u70b9\u68c0\u6d4b\u80fd\u529b<\/tr>\n \n\n| \u4efb\u52a1\u7ba1\u7406\u5668<\/td>\n | \u68c0\u67e5 CPU\/\u5185\u5b58\u5360\u7528\u7387 > 90%\u3001\u65e0\u63cf\u8ff0\/\u5c5e\u4e3b\u4fe1\u606f\u7684\u8fdb\u7a0b<\/td>\n | \u57fa\u7840\u5f02\u5e38\u8fdb\u7a0b\u8bc6\u522b<\/td>\n<\/tr>\n | \n| D \u76fe\u8fdb\u7a0b\u67e5\u770b<\/td>\n | \u5173\u6ce8\u65e0\u6570\u5b57\u7b7e\u540d\u3001\u8def\u5f84\u5f02\u5e38（\u5982 Temp \u76ee\u5f55）\u7684\u8fdb\u7a0b<\/td>\n | \u7b7e\u540d\u9a8c\u8bc1 + \u8def\u5f84\u5408\u6cd5\u6027<\/td>\n<\/tr>\n | \n| Process Explorer<\/td>\n | \u5206\u6790\u8fdb\u7a0b\u6811，\u68c0\u6d4b\u5b50\u8fdb\u7a0b\u6ce8\u5165（\u5982 explorer.exe \u52a0\u8f7d\u5f02\u5e38 DLL）<\/td>\n | \u8fdb\u7a0b\u8840\u7f18\u5173\u7cfb\u8ffd\u8e2a<\/td>\n<\/tr>\n | \n| \u5fae\u6b65\u4e91\u6c99\u7bb1<\/td>\n | \u4e0a\u4f20\u53ef\u7591\u8fdb\u7a0b\u6587\u4ef6，\u68c0\u6d4b\u6076\u610f\u884c\u4e3a（\u5982\u8fdc\u63a7\u3001\u6316\u77ff）<\/td>\n | \u4e91\u7aef\u52a8\u6001\u884c\u4e3a\u5206\u6790<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 💡 \u5de5\u5177\u7684\u5206\u5de5：\u4efb\u52a1\u7ba1\u7406\u5668\u635e\u3001D \u76fe\u9a8c\u3001Process Explorer \u8ffd\u8840\u7f18\u3001\u6c99\u7bb1\u5b9a\u8c33\u3002 \u5176\u4e2d"\u8fdb\u7a0b\u8840\u7f18"\u6700\u503c\u94b1：\u6b63\u5e38 svchost.exe \u7236\u8fdb\u7a0b\u662f services.exe，\u5982\u679c\u662f Word \u62c9\u8d77\u6765\u7684 cmd.exe \u518d\u62c9 powershell.exe，\u8840\u7f18\u94fe\u672c\u8eab\u5c31\u662f\u5b9e\u9524\u3002<\/p>\n
\n🚀 \u56db\u3001\u542f\u52a8\u9879\u6df1\u5ea6\u6392\u67e5<\/h4>\n4.1 \u6ce8\u518c\u8868\u542f\u52a8\u9879<\/h5>\n\u68c0\u67e5\u5173\u952e\u8def\u5f84（\u9700\u7ba1\u7406\u5458\u6743\u9650）：<\/p>\n HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run
\nHKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run
\nHKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce <\/p>\n \u5f02\u5e38\u7279\u5f81（\u539f\u6587）：<\/p>\n \n- \n
\u6307\u5411\u975e\u5e38\u89c1\u8def\u5f84（\u5982 .bat \u811a\u672c\u3001\u4e34\u65f6\u76ee\u5f55）；<\/p>\n<\/li>\n - \n
\u952e\u503c\u540d\u79f0\u4f2a\u88c5（\u5982 "Windows Update"）；<\/p>\n<\/li>\n - \n
\u53d1\u73b0\u53ef\u7591\u7a0b\u5e8f \u2192 \u4e22\u5230\u6c99\u7bb1\u6d4b\u4e00\u6d4b\u3002<\/p>\n<\/li>\n<\/ul>\n 4.2 \u7528\u6237\u81ea\u542f\u52a8\u6587\u4ef6\u5939<\/h5>\nshell:startup :: \u5f53\u524d\u7528\u6237\u542f\u52a8\u9879（%AppData%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup）
\nshell:common startup :: \u6240\u6709\u7528\u6237\u542f\u52a8\u9879 <\/p>\n \u6392\u67e5\u70b9：\u975e\u4e1a\u52a1\u7a0b\u5e8f\u5feb\u6377\u65b9\u5f0f\u3001\u5f02\u5e38\u811a\u672c\u6587\u4ef6\u3002 （\u5728"\u8fd0\u884c"\u6846\u76f4\u63a5\u8f93\u5165 shell:startup \u5373\u53ef\u8df3\u8f6c\u3002）<\/p>\n 4.3 \u955c\u50cf\u52ab\u6301（IFEO）<\/h5>\n\u68c0\u67e5\u6ce8\u518c\u8868\u8def\u5f84：<\/p>\n HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options <\/p>\n \u52ab\u6301\u7279\u5f81：\u5408\u6cd5\u7a0b\u5e8f（\u5982 taskmgr.exe）\u88ab\u91cd\u5b9a\u5411\u5230\u6076\u610f\u8def\u5f84\u3002<\/p>\n 💡 \u539f\u7406（\u7b14\u8bb0\u8865\u5145）：IFEO \u672c\u662f\u7ed9\u8c03\u8bd5\u5668\u7528\u7684\u2014\u2014\u5728\u76ee\u6807\u7a0b\u5e8f\u540d\u4e0b\u5199\u4e00\u4e2a Debugger \u952e\u503c\u540e，\u6bcf\u6b21\u8fd0\u884c\u8be5\u7a0b\u5e8f\u90fd\u4f1a\u5148\u542f\u52a8 Debugger \u6307\u5411\u7684\u7a0b\u5e8f\u3002 \u653b\u51fb\u8005\u5229\u7528\u5b83\u505a\u4e24\u4ef6\u4e8b：\u52ab\u6301\u6740\u8f6f\/\u4efb\u52a1\u7ba1\u7406\u5668（\u4f60\u4e00\u70b9\u5f00\u5c31\u88ab\u9876\u6389）\u548c\u501f\u5408\u6cd5\u7a0b\u5e8f\u540d\u6267\u884c\u6076\u610f\u4ee3\u7801\u3002 \u6392\u67e5\u70b9：\u6b63\u5e38\u8f6f\u4ef6\u51e0\u4e4e\u4e0d\u4f1a\u5728 IFEO \u4e0b\u7559\u952e\u503c，\u8fd9\u4e2a\u76ee\u5f55\u91cc\u6709 Debugger \u952e\u503c\u7684\u57fa\u672c\u90fd\u662f\u52ab\u6301\u3002<\/p>\n
\n\u23f0 \u4e94\u3001\u8ba1\u5212\u4efb\u52a1\u6392\u67e5<\/h4>\n\u68c0\u6d4b\u65b9\u6cd5：<\/p>\n schtasks \/query \/fo LIST \/v :: \u67e5\u770b\u8be6\u7ec6\u4efb\u52a1\u5c5e\u6027
\nGet-ScheduledTask | Where State -eq "Ready" | Format-Table TaskName, Actions <\/p>\n \u56fe\u5f62\u754c\u9762：control schedtasks \u2192 \u68c0\u67e5\u53ef\u7591\u4efb\u52a1（\u5982\u968f\u673a\u547d\u540d\u3001\u9ad8\u9891\u89e6\u53d1）\u3002<\/p>\n \u6076\u610f\u4efb\u52a1\u7279\u5f81（\u539f\u6587）：<\/p>\n \n\u7ef4\u5ea6\u53ef\u7591\u8868\u73b0<\/tr>\n \n\n| \u89e6\u53d1\u6761\u4ef6<\/td>\n | \u7cfb\u7edf\u542f\u52a8\/\u7a7a\u95f2\u65f6\u6267\u884c\u3001\u6bcf\u5206\u949f\u89e6\u53d1（\/sc minute \/mo 1）<\/td>\n<\/tr>\n | \n| \u64cd\u4f5c\u8def\u5f84<\/td>\n | \u6307\u5411\u975e\u5e38\u89c4\u76ee\u5f55（\u5982 C:\\\\PowerShell.exe）<\/td>\n<\/tr>\n | \n| \u8fd0\u884c\u8eab\u4efd<\/td>\n | SYSTEM \u6216\u9ad8\u6743\u9650\u8d26\u6237<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 💡 C:\\\\PowerShell.exe \u8fd9\u79cd\u4f8b\u5b50\u503c\u5f97\u8bb0\u4f4f：PowerShell \u771f\u8eab\u5728 System32\\\\WindowsPowerShell\\\\v1.0\\\\，\u6839\u76ee\u5f55\u51fa\u73b0\u526f\u672c = \u6389\u5305\u3002\u548c\u8fdb\u7a0b\u6392\u67e5\u4e00\u4e2a\u9053\u7406\u2014\u2014\u8def\u5f84\u4e0d\u5bf9，\u540d\u5b57\u518d\u5bf9\u4e5f\u662f\u5047\u7684\u3002<\/p>\n
\n\u2699\ufe0f \u516d\u3001\u5f02\u5e38\u670d\u52a1\u6392\u67e5<\/h4>\n\u68c0\u6d4b\u6b65\u9aa4：<\/p>\n sc query state= all :: \u67e5\u770b\u6240\u6709\u670d\u52a1\u72b6\u6001
\nsc qc "\u670d\u52a1\u540d" :: \u67e5\u770b\u670d\u52a1\u4f9d\u8d56\u5173\u7cfb
\nGet-WmiObject Win32_Service | Where {$_.StartMode -eq "Auto"} :: \u7b5b\u9009\u81ea\u542f\u52a8\u670d\u52a1 <\/p>\n \u91cd\u70b9\u6392\u67e5\u9879（\u539f\u6587）：<\/p>\n \n- \n
\u65e0\u63cf\u8ff0\/\u516c\u53f8\u540d\u7684\u670d\u52a1；<\/p>\n<\/li>\n - \n
\u4e8c\u8fdb\u5236\u8def\u5f84\u6307\u5411\u4e34\u65f6\u76ee\u5f55（\u5982 C:\\\\Windows\\\\Temp\\\\）；<\/p>\n<\/li>\n - \n
\u670d\u52a1\u540d\u79f0\u4e0e\u663e\u793a\u540d\u79f0\u4e0d\u4e00\u81f4（\u5982\u4f2a\u88c5\u6210 "Windows Update Service"）\u3002<\/p>\n<\/li>\n<\/ul>\n \u4f9d\u8d56\u670d\u52a1\u5206\u6790：sc qc "\u670d\u52a1\u540d" \u2014\u2014 \u5f02\u5e38\u73b0\u8c61：\u4f9d\u8d56\u4e0d\u5b58\u5728\u670d\u52a1\u3001\u6216\u5faa\u73af\u4f9d\u8d56\u3002<\/p>\n \u26a0\ufe0f \u7b14\u8bb0\u63d0\u9192：Get-WmiObject \u57fa\u4e8e WMI，\u65b0\u7248\u7cfb\u7edf\u6b63\u88ab\u6dd8\u6c70，\u66ff\u4ee3\u5199\u6cd5：<\/p>\n Get-CimInstance Win32_Service | Where StartMode -eq "Auto" <\/p>\n
\n🧭 \u516d-B\u3001\u7b14\u8bb0\u8865\u5145：\u5e94\u6025\u54cd\u5e94\u7684\u7b2c\u4e00\u539f\u5219\u662f\u300c\u5b9a\u6027\u300d<\/h4>\n\u524d\u9762 1.1 \u7ed9\u4e86\u4e8b\u4ef6\u5206\u7c7b\u8868，\u8fd9\u91cc\u8865\u4e00\u5f20\u300c\u73b0\u8c61 \u2192 \u5b9a\u6027 \u2192 \u67e5\u4ec0\u4e48\u300d\u7684\u5bf9\u7167\u8868，\u63a5\u5230\u544a\u8b66\u65f6\u6309\u56fe\u7d22\u9aa5：<\/p>\n \n\u5b9a\u6027\u5178\u578b\u73b0\u8c61\u4e3b\u67e5\u5bf9\u8c61\u4e00\u53e5\u8bdd\u5224\u65ad<\/tr>\n \n\n| Web \u5165\u4fb5<\/td>\n | \u7f51\u9875\u6302\u9a6c\u3001\u4e3b\u9875\u88ab\u7be1\u6539\u3001Webshell<\/td>\n | \u7f51\u7ad9\u76ee\u5f55 + \u4e2d\u95f4\u4ef6\u65e5\u5fd7（\u7b2c\u4e8c\u7bc7\u7b2c\u4e00\u7ae0）<\/td>\n | \u653b\u51fb\u662f\u4ece HTTP\/HTTPS \u7aef\u53e3\u8fdb\u6765\u7684<\/td>\n<\/tr>\n | \n| \u7cfb\u7edf\u5165\u4fb5<\/td>\n | CPU \u5f02\u5e38\u98d9\u9ad8（\u6316\u77ff）\u3001\u964c\u751f\u8fdb\u7a0b\u3001RDP\/SSH \u7206\u7834\u6210\u529f<\/td>\n | \u8fdb\u7a0b\u3001\u8d26\u6237\u3001\u7cfb\u7edf\u65e5\u5fd7（\u7b2c\u4e8c\u7bc7\u7b2c\u4e8c\u7ae0）<\/td>\n | \u653b\u51fb\u8005\u5df2\u62ff\u5230\u4e3b\u673a\u63a7\u5236\u6743<\/td>\n<\/tr>\n | \n| \u7f51\u7edc\u653b\u51fb<\/td>\n | \u7f51\u901f\u9aa4\u964d\u3001\u57df\u540d\u88ab\u52ab\u6301\u3001\u5185\u7f51 ARP \u544a\u8b66<\/td>\n | \u9632\u706b\u5899 \/ \u8def\u7531\u5668 \/ DNS \/ \u90ae\u4ef6\u7f51\u5173<\/td>\n | \u653b\u51fb\u8005\u6ca1\u8fdb\u4e3b\u673a，\u662f\u5728\u4f20\u8f93\u8def\u4e0a\u641e\u7834\u574f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 💡 \u4e3a\u4ec0\u4e48"\u5b9a\u6027"\u6392\u7b2c\u4e00 \u5b9a\u6027\u9519\u4e86，\u540e\u9762\u5168\u767d\u5e72\u3002\u628a DDoS \u5f53\u5165\u4fb5\u53bb\u67e5\u8fdb\u7a0b，\u628a Webshell \u5f53\u75c5\u6bd2\u53bb\u6740\u6bd2\u2014\u2014\u65b9\u5411\u9519\u4e86\u8d8a\u52aa\u529b\u8d8a\u7cdf\u3002 \u5b9a\u6027\u4e4b\u540e\u518d\u51b3\u5b9a\u53d6\u8bc1\u5bf9\u8c61，\u8fd9\u662f\u5e94\u6025\u54cd\u5e94\u548c"\u968f\u4fbf\u70b9\u70b9"\u7684\u5206\u754c\u7ebf\u3002<\/p>\n 👤 \u516d-C\u3001\u7b14\u8bb0\u8865\u5145：\u63ea\u51fa\u540e\u95e8\u8d26\u6237\u7684\u300c\u56db\u770b\u300d\u53e3\u8bc0<\/h4>\n\u524d\u9762 2.1 \u7ed9\u4e86\u5bf9\u7167\u8868，\u8fd9\u91cc\u538b\u7f29\u6210\u80fd\u80cc\u4e0b\u6765\u7684\u56db\u53e5：<\/p>\n \n\u770b\u4ec0\u4e48\u5177\u4f53\u52a8\u4f5c\u547d\u4e2d\u5373\u9ad8\u5ea6\u53ef\u7591<\/tr>\n \n\n| \u2460 \u770b\u540d\u5b57<\/td>\n | net user + \u6ce8\u518c\u8868 SAM \u6bd4\u5bf9<\/td>\n | \u5e26 $ \u7684\u9690\u85cf\u8d26\u6237（\u547d\u4ee4\u884c\u9ed8\u8ba4\u770b\u4e0d\u89c1）\u3001\u4e71\u7801\u540d\u3001\u4f2a\u88c5\u540d（$backup\u3001svchost1）<\/td>\n<\/tr>\n | \n| \u2461 \u770b\u6743\u9650<\/td>\n | \u67e5 Administrators \u7ec4\u6210\u5458<\/td>\n | \u4e0d\u8ba4\u8bc6\u7684\u8d26\u53f7\u5728\u7ba1\u7406\u5458\u7ec4\u91cc（\u9ed1\u5ba2\u5efa\u53f7\u5fc5\u7ed9\u81ea\u5df1\u6700\u9ad8\u6743\u9650）<\/td>\n<\/tr>\n | \n| \u2462 \u770b\u65f6\u95f4<\/td>\n | \u4e8b\u4ef6\u67e5\u770b\u5668\u67e5\u8be5\u8d26\u53f7\u7684 4624<\/td>\n | \u51cc\u6668\u767b\u5f55\u3001\u5883\u5916 IP\u3001\u767b\u5f55\u524d\u6709\u9ad8\u9891 4625 \u5931\u8d25<\/td>\n<\/tr>\n | \n| \u2463 \u7528\u5de5\u5177<\/td>\n | D \u76fe \/ \u5fae\u6b65 \/ \u6ce8\u518c\u8868 SAM \u539f\u59cb\u6570\u636e<\/td>\n | \u7cfb\u7edf\u9762\u677f\u88ab\u7be1\u6539\u65f6，\u56fe\u5f62\u754c\u9762\u4e0d\u53ef\u4fe1，\u5fc5\u987b\u770b\u539f\u59cb\u6570\u636e<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 💡 \u4e24\u4e2a\u8865\u5145\u539f\u7406<\/p>\n \n- \n
$ \u7ed3\u5c3e\u7684\u8d26\u6237\u4e3a\u4ec0\u4e48"\u9690\u8eab"：Windows \u7ea6\u5b9a\u4ee5 $ \u7ed3\u5c3e\u7684\u662f\u8ba1\u7b97\u673a\u8d26\u6237\/\u670d\u52a1\u8d26\u6237，net user \u9ed8\u8ba4\u4e0d\u5217\u51fa\u3002\u653b\u51fb\u8005\u6b63\u662f\u5229\u7528\u8fd9\u4e00\u70b9\u3002<\/p>\n<\/li>\n - \n
\u514b\u9686\u8d26\u6237\u7684\u672c\u8d28：\u628a\u53ef\u7591 SID \u7684\u6ce8\u518c\u8868 F \u503c\u6539\u6210\u5185\u7f6e Administrator \u7684 F \u503c（000001F4 = \u5341\u516d\u8fdb\u5236 RID 500）\u3002F \u503c\u76f8\u540c = \u6743\u9650\u76f8\u540c，\u7cfb\u7edf\u5728\u6743\u9650\u5224\u5b9a\u4e0a\u5c31"\u8ba4\u8138\u4e0d\u8ba4\u4eba"\u4e86\u3002<\/p>\n<\/li>\n<\/ul>\n 🔬 \u516d-D\u3001\u7b14\u8bb0\u8865\u5145：\u6076\u610f\u8fdb\u7a0b\u6392\u67e5\u300c\u56db\u6b65\u8d70\u300d<\/h4>\n\u524d\u9762 3.2 \u5217\u4e86\u5de5\u5177，\u8fd9\u91cc\u7ed9\u4e00\u6761\u4ece\u6d45\u5230\u6df1\u7684\u64cd\u4f5c\u987a\u5e8f（\u522b\u4e00\u4e0a\u6765\u5c31\u4f20\u6c99\u7bb1）：<\/p>\n \u2460 \u4e00\u773c\u770b \u4efb\u52a1\u7ba1\u7406\u5668：\u8c01 CPU\/\u5185\u5b58\u5f02\u5e38\u9ad8？\u8c01\u6ca1\u6709\u63cf\u8ff0\u548c\u53d1\u884c\u5546？
\n \u2193 \u53d1\u73b0\u53ef\u7591
\n\u2461 \u4e8c\u8def\u770b D \u76fe：\u6709\u6ca1\u6709\u6570\u5b57\u7b7e\u540d？\u8def\u5f84\u5bf9\u4e0d\u5bf9？
\n \u2193 \u8def\u5f84\/\u7b7e\u540d\u53ef\u7591
\n\u2462 \u67e5\u6237\u53e3 Process Explorer：\u770b\u8fdb\u7a0b\u6811（\u8c01\u751f\u51fa\u4e86\u8c01）+ \u67e5 DLL \u6ce8\u5165
\n \u2193 \u4ecd\u62ff\u4e0d\u51c6
\n\u2463 \u9001\u5916\u68c0 \u5fae\u6b65\/\u4e91\u6c99\u7bb1：\u9694\u79bb\u73af\u5883\u8dd1\u4e00\u904d，\u770b\u5b83\u8fde\u4ec0\u4e48\u3001\u6539\u4ec0\u4e48 <\/p>\n \n\u6b65\u9aa4\u6838\u5fc3\u5224\u636e\u5178\u578b\u547d\u4e2d<\/tr>\n \n\n| \u2460 \u4efb\u52a1\u7ba1\u7406\u5668<\/td>\n | \u8d44\u6e90\u5360\u7528\u5f02\u5e38\u3001\u65e0\u63cf\u8ff0\/\u65e0\u53d1\u884c\u5546<\/td>\n | \u6316\u77ff\u6728\u9a6c（CPU \u957f\u671f 90%+）<\/td>\n<\/tr>\n | \n| \u2461 D \u76fe<\/td>\n | \u65e0\u6570\u5b57\u7b7e\u540d\u3001\u8def\u5f84\u5728 Temp \/ \u56de\u6536\u7ad9 \/ AppData<\/td>\n | \u4ece\u4e34\u65f6\u76ee\u5f55\u542f\u52a8\u7684\u9a6c<\/td>\n<\/tr>\n | \n| \u2462 Process Explorer<\/td>\n | \u7236\u8fdb\u7a0b\u4e0d\u5bf9（svchost.exe \u7684\u7239\u4e0d\u662f services.exe）\u3001explorer.exe \u52a0\u8f7d\u964c\u751f DLL<\/td>\n | \u8fdb\u7a0b\u4f2a\u88c5\u3001DLL \u6ce8\u5165<\/td>\n<\/tr>\n | \n| \u2463 \u6c99\u7bb1<\/td>\n | \u8fde\u63a5 C2\u3001\u52a0\u5bc6\u6587\u4ef6\u3001\u521b\u5efa\u8ba1\u5212\u4efb\u52a1<\/td>\n | \u5b9a\u6027\u5e76\u4ea7\u51fa IOC<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 💡 \u8fdb\u7a0b\u6811\u4e3a\u4ec0\u4e48\u8fd9\u4e48\u91cd\u8981 \u6b63\u5e38 svchost.exe \u4e00\u5b9a\u7531 services.exe \u542f\u52a8\u3002\u5982\u679c\u5b83\u7239\u662f Word \u6216\u6d4f\u89c8\u5668\u2014\u2014\u8fd9\u5c31\u662f\u4f2a\u88c5\u7684\u95f4\u8c0d\u3002 \u653b\u51fb\u8005\u53ef\u4ee5\u6539\u8fdb\u7a0b\u540d，\u4f46\u6539\u4e0d\u4e86"\u8c01\u542f\u52a8\u4e86\u5b83"\u8fd9\u6761\u8840\u7f18\u5173\u7cfb\u3002<\/p>\n 🧰 \u516d-E\u3001\u7b14\u8bb0\u8865\u5145：\u522b\u5fd8\u4e86 Autoruns \u548c WMI<\/h4>\n\u524d\u9762\u56db\u3001\u4e94\u3001\u516d\u7ae0\u5206\u522b\u624b\u5de5\u7ffb\u4e86\u6ce8\u518c\u8868 Run\u3001\u8ba1\u5212\u4efb\u52a1\u3001\u670d\u52a1\u3002\u6548\u7387\u66f4\u9ad8\u7684\u505a\u6cd5\u662f\u7528 Sysinternals \u7684 Autoruns \u4e00\u952e\u679a\u4e3e\u5168\u90e8\u6301\u4e45\u5316\u70b9\u2014\u2014\u5b83\u8986\u76d6\u7684\u542f\u52a8\u4f4d\u7f6e\u8fdc\u6bd4\u624b\u5de5\u7ffb\u7684\u5168（\u5305\u62ec IE \u63d2\u4ef6\u3001\u9a71\u52a8\u3001Winsock \u63d0\u4f9b\u8005\u3001\u6620\u50cf\u52ab\u6301\u7b49）\u3002<\/p>\n \u26a0\ufe0f \u4e00\u4e2a Autoruns \u4e5f\u626b\u4e0d\u5230\u7684\u89d2\u843d：WMI \u4e8b\u4ef6\u8ba2\u9605 __EventFilter + __EventConsumer + __FilterToConsumerBinding \u4e09\u4ef6\u5957\u53ef\u4ee5\u505a\u5230\u65e0\u6587\u4ef6\u3001\u65e0\u6ce8\u518c\u8868\u3001\u65e0\u670d\u52a1\u7684\u6301\u4e45\u5316，\u53ea\u5728\u6ee1\u8db3\u6761\u4ef6（\u5982\u7279\u5b9a\u65f6\u95f4\u3001\u7279\u5b9a\u8fdb\u7a0b\u542f\u52a8）\u65f6\u89e6\u53d1\u3002 \u5e38\u89c4\u542f\u52a8\u9879\u68c0\u67e5\u770b\u4e0d\u5230\u5b83，\u5fc5\u987b\u5355\u72ec\u67e5：<\/p>\n Get-WMIObject -Namespace root\\\\Subscription -Class __EventFilter
\nGet-WMIObject -Namespace root\\\\Subscription -Class __FilterToConsumerBinding
\nGet-WMIObject -Namespace root\\\\Subscription -Class __CommandLineEventConsumer <\/p>\n
\n🧾 \u4e03\u3001\u672c\u7ae0\u603b\u7ed3<\/h4>\n7.1 \u5341\u6761\u8981\u70b9<\/h5>\n- \n
\u5148\u5b9a\u6027\u518d\u52a8\u624b：Web \u5165\u4fb5\u7ffb\u4e2d\u95f4\u4ef6\u65e5\u5fd7\u3001\u7cfb\u7edf\u5165\u4fb5\u505a\u4e3b\u673a\u6392\u67e5\u3001\u7f51\u7edc\u653b\u51fb\u770b\u6d41\u91cf\u2014\u2014\u4e09\u7bc7\u7b14\u8bb0\u6b63\u597d\u5404\u7ba1\u4e00\u7ebf\u3002<\/p>\n<\/li>\n - \n
\u6392\u67e5\u5c31\u662f\u7ffb\u516d\u4e2a\u85cf\u8eab\u5904：\u8d26\u6237\u3001\u8fdb\u7a0b\/\u7aef\u53e3\u3001\u542f\u52a8\u9879\u3001\u8ba1\u5212\u4efb\u52a1\u3001\u670d\u52a1\u2014\u2014\u6076\u610f\u4ee3\u7801\u60f3\u6d3b\u4e0b\u6765，\u9003\u4e0d\u51fa\u8fd9\u51e0\u5904\u3002<\/p>\n<\/li>\n - \n
\u9ed1\u5ba2\u8d26\u6237\u56db\u4e2a\u7834\u7efd：\u540d\u5b57\u602a\u3001\u6743\u9650\u9ad8\u3001\u767b\u5f55\u65f6\u95f4\/\u5730\u70b9\u4e0d\u5bf9\u3001\u60f3\u9690\u85cf\u3002<\/p>\n<\/li>\n - \n
\u9690\u85cf\u8d26\u6237\u8ba4 $ \u7ed3\u5c3e：net user \u770b\u4e0d\u5230，\u8981\u5230 HKLM\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names \u91cc\u5bf9\u3002<\/p>\n<\/li>\n - \n
\u514b\u9686\u8d26\u6237\u6bd4 F \u503c：000001F4（RID 500 = Administrator）\u7684 F \u503c\u662f\u57fa\u51c6，\u76f8\u540c\u5373\u514b\u9686；D \u76fe\u53ef\u81ea\u52a8\u68c0\u6d4b\u3002<\/p>\n<\/li>\n - \n
\u5220\u5f71\u5b50\u8d26\u6237\u8981\u5220\u6ce8\u518c\u8868：net user \/delete \u6e05\u4e0d\u6389\u6ce8\u518c\u8868\u6b8b\u7559；WMIC \u5df2\u5f03\u7528，\u7528 Remove-LocalUser\u3002<\/p>\n<\/li>\n - \n
\u8fdb\u7a0b\u770b"\u540d\u5b57 + \u8def\u5f84 + \u7b7e\u540d + \u8840\u7f18"：svch0st.exe\u3001C:\\\\Windows\\\\Temp\\\\\u3001\u65e0\u7b7e\u540d\u3001services.exe \u4ee5\u5916\u7684\u7239\u2014\u2014\u4e2d\u4e00\u6761\u5c31\u53ef\u7591\u3002<\/p>\n<\/li>\n - \n
IFEO \u662f\u6700\u5bb9\u6613\u88ab\u6f0f\u7684\u6301\u4e45\u5316\u70b9：Image File Execution Options \u4e0b\u51fa\u73b0 Debugger \u952e\u503c\u57fa\u672c\u5c31\u662f\u52ab\u6301，\u4e13\u5751\u6740\u8f6f\u548c\u4efb\u52a1\u7ba1\u7406\u5668\u3002<\/p>\n<\/li>\n - \n
\u8ba1\u5212\u4efb\u52a1\u76ef\u4e09\u4e2a\u7279\u5f81：\u9ad8\u9891\u89e6\u53d1\u3001\u8def\u5f84\u975e\u5e38\u89c4\u3001SYSTEM \u8eab\u4efd\u3002<\/p>\n<\/li>\n - \n
\u670d\u52a1\u7684\u5224\u636e\u4e5f\u662f\u8def\u5f84：\u4e8c\u8fdb\u5236\u6307\u5411 Temp \u4e34\u65f6\u76ee\u5f55\u3001\u65e0\u63cf\u8ff0\u65e0\u516c\u53f8\u540d\u3001\u540d\u79f0\u4e0e\u663e\u793a\u540d\u4e0d\u4e00\u81f4，\u518d\u52a0\u4e00\u6761\u2014\u2014\u4f9d\u8d56\u4e0d\u5b58\u5728\u7684\u670d\u52a1\u3002<\/p>\n<\/li>\n 7.2 \u547d\u4ee4\u901f\u67e5\u5361<\/h5>\n\n\u76ee\u7684\u547d\u4ee4<\/tr>\n \n\n| \u6d3b\u8dc3\u5916\u8054\u8fde\u63a5<\/td>\n | netstat -ano \\\\| findstr ESTABLISHED<\/td>\n<\/tr>\n | \n| \u8fde\u63a5\u5173\u8054\u8fdb\u7a0b（\u9700\u7ba1\u7406\u5458）<\/td>\n | netstat -anob<\/td>\n<\/tr>\n | \n| PID \u5b9a\u4f4d\u8fdb\u7a0b<\/td>\n | tasklist \\\\| findstr "PID"<\/td>\n<\/tr>\n | \n| \u9690\u85cf\u8d26\u6237\u6ce8\u518c\u8868<\/td>\n | HKLM\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users<\/td>\n<\/tr>\n | \n| \u514b\u9686\u6bd4\u5bf9<\/td>\n | reg query "HKLM\\\\SAM\\\\…\\\\Users\\\\000001F4" \/v F<\/td>\n<\/tr>\n | \n| \u5f3a\u5236\u5220\u8d26\u6237<\/td>\n | Remove-LocalUser -Name "xxx"<\/td>\n<\/tr>\n | \n| \u8ba1\u5212\u4efb\u52a1\u8be6\u67e5<\/td>\n | schtasks \/query \/fo LIST \/v<\/td>\n<\/tr>\n | \n| \u81ea\u542f\u52a8\u670d\u52a1<\/td>\n | Get-CimInstance Win32_Service \\\\| Where StartMode -eq "Auto"<\/td>\n<\/tr>\n | \n| \u670d\u52a1\u4f9d\u8d56<\/td>\n | sc qc "\u670d\u52a1\u540d"<\/td>\n<\/tr>\n | \n| \u542f\u52a8\u6587\u4ef6\u5939<\/td>\n | shell:startup \/ shell:common startup<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n7.3 \u4e00\u53e5\u8bdd\u6536\u5c3e<\/h5>\n\u6eaf\u6e90\u67e5\u65e5\u5fd7\u56de\u7b54"\u53d1\u751f\u4e86\u4ec0\u4e48"，\u5165\u4fb5\u6392\u67e5\u56de\u7b54"\u5b83\u73b0\u5728\u8fd8\u5728\u4e0d\u5728"\u3002 \u516d\u4e2a\u85cf\u8eab\u5904\u7ffb\u5b8c\u6ca1\u6709，\u6bd4\u4efb\u4f55\u5de5\u5177\u7684"\u4e00\u952e\u4f53\u68c0"\u90fd\u53ef\u9760\u2014\u2014\u56e0\u4e3a\u6e05\u5355\u4e0d\u4f1a\u6f0f，\u800c\u4eba\u4f1a\u3002<\/p>\n 7.4 \u5de5\u5177\u4e0e\u8d44\u6599<\/h5>\n\n\u8d44\u6e90\u8bf4\u660e<\/tr>\n \n\n| D \u76fe<\/td>\n | \u8d26\u6237\u514b\u9686\u68c0\u6d4b\u3001Webshell \u67e5\u6740\u3001\u8fdb\u7a0b\/\u7aef\u53e3\u6620\u5c04（\u514d\u8d39）<\/td>\n<\/tr>\n | \n| \u5fae\u6b65\u4e91\u6c99\u7bb1<\/td>\n | s.threatbook.com，\u53ef\u7591\u6587\u4ef6\u4e91\u7aef\u52a8\u6001\u884c\u4e3a\u5206\u6790<\/td>\n<\/tr>\n | \n| Process Explorer<\/td>\n | Sysinternals \u51fa\u54c1，\u8fdb\u7a0b\u6811\/\u8840\u7f18\u8ffd\u8e2a<\/td>\n<\/tr>\n | \n| Autoruns（\u7b14\u8bb0\u8865\u5145）<\/td>\n | Sysinternals \u51fa\u54c1，\u4e00\u952e\u679a\u4e3e\u5168\u90e8\u6301\u4e45\u5316\u70b9（\u542b IFEO\/\u8ba1\u5212\u4efb\u52a1\/\u670d\u52a1），\u6bd4\u624b\u5de5\u7ffb\u6ce8\u518c\u8868\u5feb\u5f97\u591a<\/td>\n<\/tr>\n | \n| \u539f\u6587<\/td>\n | shining.blog.csdn.net\/article\/details\/148354778<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n📕 \u7b2c\u4e8c\u7ae0 \u00b7 Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90<\/h3>\n📌 \u672c\u7ae0\u6574\u7406\u81ea\u6587\u7ae0 \u300a\u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d\u2014Linux\u5165\u4fb5\u6392\u67e5\u300b（CSDN @\u4e00\u53ea\u67b7\u9501）\u3002 \u5b83\u662f\u7b2c 04 \u7bc7\u7684 Linux \u7248：\u540c\u6837\u7684\u516d\u4e2a\u85cf\u8eab\u5904\u6362\u6210 Linux \u7684\u73a9\u6cd5\u2014\u2014\/etc\/passwd\u3001UID=0\u3001\/proc\u3001iptables\u2014\u2014\u540e\u534a\u7bc7\u518d\u5f80\u4e0a\u8d70\u4e00\u5c42：\u4ece"\u6392\u67e5\u4e3b\u673a"\u5230"\u6eaf\u6e90\u653b\u51fb\u8005"\u3002<\/p>\n \u4e00\u53e5\u8bdd\u6982\u62ec：Windows \u6392\u67e5\u9760"\u6ce8\u518c\u8868\u4e00\u5bb6\u4eb2"，Linux \u6392\u67e5\u9760"\/etc + \/proc \u4e24\u5144\u5f1f"\u3002 \u4e00\u5207\u8d26\u6237\u4fe1\u606f\u5728 \/etc\/passwd，\u4e00\u5207\u8fdb\u7a0b\u771f\u76f8\u5728 \/proc\u2014\u2014\u4e24\u4e2a\u76ee\u5f55\u7ffb\u5e72\u51c0，Linux \u7684\u85cf\u8eab\u5904\u5c31\u8986\u76d6\u4e86\u5927\u534a\u3002<\/p>\n 🗺\ufe0f \u3007\u3001\u672c\u7ae0\u901f\u89c8<\/h4>\n\n#\u7ae0\u8282\u4f60\u4f1a\u62ff\u5230\u4ec0\u4e48<\/tr>\n \n\n| 1<\/td>\n | \u8d26\u6237\u5b89\u5168<\/td>\n | \/etc\/passwd \u4e03\u6bb5\u5f0f\u5168\u89e3 \u00b7 UID=0 \u7279\u6743\u6392\u67e5 \u00b7 sudo \u5ba1\u67e5 \u00b7 \u9501\u5b9a\u4e0e\u5220\u9664<\/td>\n<\/tr>\n | \n| 2<\/td>\n | \u5386\u53f2\u547d\u4ee4<\/td>\n | .*_history \u8bfb\u53d6 + history \u7684\u53cd\u53d6\u8bc1\u9677\u9631<\/td>\n<\/tr>\n | \n| 3<\/td>\n | \u7aef\u53e3\u4e0e\u8fdb\u7a0b<\/td>\n | netstat\/ss\/lsof \u4e09\u4ef6\u5957 \u00b7 \/proc \u6df1\u6316 \u00b7 \u9690\u85cf\u8fdb\u7a0b\u6bd4\u5bf9 \u00b7 Rootkit \u68c0\u6d4b<\/td>\n<\/tr>\n | \n| 4<\/td>\n | \u6eaf\u6e90\u5206\u6790<\/td>\n | \u5a01\u80c1\u60c5\u62a5 \u00b7 IP \u5b9a\u4f4d \u00b7 \u7aef\u53e3\u626b\u63cf \u00b7 \u793e\u5de5\u56db\u677f\u65a7 + \u8054\u52a8\u6846\u67b6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n🐧 \u4e00\u3001Linux \u5165\u4fb5\u6392\u67e5<\/h4>\n1.1 \u8d26\u6237\u5b89\u5168<\/h5>\n\u2460 \u7528\u6237\u4fe1\u606f\u6587\u4ef6 \/etc\/passwd<\/h6>\ncat \/etc\/passwd<\/p>\n root:x:0:0:root:\/root:\/usr\/bin\/zsh \u2190 UID=0 \u7684\u53ea\u6709 root
\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin
\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin
\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin
\nsync:x:4:65534:sync:\/bin:\/bin\/sync
\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin
\n… <\/p>\n \u4e03\u6bb5\u5f0f\u683c\u5f0f：account:password:UID:GID:GECOS:directory:shell<\/p>\n \n\u5b57\u6bb5\u5b9e\u9645\u5b57\u6bb5\u542b\u4e49\u8bf4\u660e\u793a\u4f8b\/\u6ce8\u610f\u4e8b\u9879<\/tr>\n \n\n| \u7528\u6237\u540d<\/td>\n | account<\/td>\n | \u7cfb\u7edf\u767b\u5f55\u6807\u8bc6<\/td>\n | root\u3001www-data<\/td>\n<\/tr>\n | \n| \u5bc6\u7801<\/td>\n | password<\/td>\n | x \u8868\u793a\u5bc6\u7801\u5360\u4f4d\u7b26（\u5b9e\u9645\u5bc6\u7801\u5b58 \/etc\/shadow）<\/td>\n | \u666e\u901a\u7528\u6237\u65e0\u6743\u67e5\u770b\u52a0\u5bc6\u5bc6\u7801<\/td>\n<\/tr>\n | \n| \u7528\u6237 ID<\/td>\n | UID<\/td>\n | \u7528\u6237\u552f\u4e00\u6807\u8bc6（0 \u4e3a root，1\u2013999 \u7cfb\u7edf\u7528\u6237，1000+ \u666e\u901a\u7528\u6237）<\/td>\n | root \u7684 UID=0<\/td>\n<\/tr>\n | \n| \u7ec4 ID<\/td>\n | GID<\/td>\n | \u7528\u6237\u4e3b\u7ec4\u7684\u6807\u8bc6\u53f7<\/td>\n | \u540c \/etc\/group \u4e2d\u7684\u7ec4 ID \u5bf9\u5e94<\/td>\n<\/tr>\n | \n| \u7528\u6237\u8bf4\u660e<\/td>\n | GECOS<\/td>\n | \u7528\u6237\u5907\u6ce8\u4fe1\u606f（\u5982\u5168\u540d\u3001\u8054\u7cfb\u65b9\u5f0f）<\/td>\n | \u53ef\u7559\u7a7a<\/td>\n<\/tr>\n | \n| \u5bb6\u76ee\u5f55<\/td>\n | directory<\/td>\n | \u7528\u6237\u4e13\u5c5e\u5b58\u50a8\u8def\u5f84<\/td>\n | root \u2192 \/root；\u666e\u901a\u7528\u6237 \u2192 \/home\/\u7528\u6237\u540d；\u670d\u52a1\u7528\u6237 \u2192 \/var\/www<\/td>\n<\/tr>\n | \n| \u767b\u5f55 Shell<\/td>\n | shell<\/td>\n | \u7528\u6237\u767b\u5f55\u540e\u9ed8\u8ba4\u4f7f\u7528\u7684\u547d\u4ee4\u89e3\u91ca\u5668<\/td>\n | \/bin\/bash\u3001\/bin\/zsh\u3001\/usr\/sbin\/nologin<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u793a\u4f8b\u6570\u636e\u8868（\u4e09\u884c\u770b\u61c2\u4e09\u7c7b\u8d26\u6237）：<\/p>\n \n\u7528\u6237\u540dUIDdirectoryshell\u8d26\u6237\u7c7b\u578b<\/tr>\n \n\n| root<\/td>\n | 0<\/td>\n | \/root<\/td>\n | \/bin\/bash<\/td>\n | \u8d85\u7ea7\u7ba1\u7406\u5458<\/td>\n<\/tr>\n | \n| alice<\/td>\n | 1000<\/td>\n | \/home\/alice<\/td>\n | \/bin\/zsh<\/td>\n | \u666e\u901a\u7528\u6237<\/td>\n<\/tr>\n | \n| www-data<\/td>\n | 33<\/td>\n | \/var\/www<\/td>\n | \/usr\/sbin\/nologin<\/td>\n | \u670d\u52a1\u7528\u6237<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u6587\u4ef6\u89c4\u5219\u901f\u8bb0（\u8f6c\u5f55\u81ea\u539f\u6587\u56fe\u7247）：<\/p>\n \n\u89c4\u5219\u7c7b\u578b\u5177\u4f53\u5185\u5bb9<\/tr>\n \n\n| \u6587\u4ef6\u6743\u9650<\/td>\n | \/etc\/passwd \u6240\u6709\u7528\u6237\u53ef\u8bfb，\u4ec5 root \u53ef\u4fee\u6539<\/td>\n<\/tr>\n | \n| \u7981\u6b62\u767b\u5f55<\/td>\n | Shell \u4e3a \/usr\/sbin\/nologin \u65f6：\u65e0\u6cd5\u56fe\u5f62\u754c\u9762\/SSH \u767b\u5f55\u3001\u65e0\u6cd5 su \u5207\u6362（\u5e38\u89c1\u4e8e www-data \u7b49\u670d\u52a1\u8d26\u6237）<\/td>\n<\/tr>\n | \n| \u5bb6\u76ee\u5f55\u89c4\u8303<\/td>\n | root \u2192 \/root；\u666e\u901a\u53ef\u767b\u5f55\u7528\u6237 \u2192 \/home\/\u7528\u6237\u540d；\u670d\u52a1\u7528\u6237 \u2192 \u4e13\u5c5e\u76ee\u5f55（www-data \u2192 \/var\/www）<\/td>\n<\/tr>\n | \n| \u5e38\u89c1\u767b\u5f55 Shell<\/td>\n | \/bin\/bash\u3001\/bin\/zsh\u3001\/bin\/sh\u3001\/usr\/bin\/bash（\u5e26\u524d\u7f00\u8def\u5f84）<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u6392\u67e5\u601d\u8def：\u662f\u5426\u5b58\u5728\u53ef\u7591\u7528\u6237\u2014\u2014\u9664\u4e86 root \u4ee5\u5916，\u662f\u5426\u8fd8\u6709 UID=0 \u7684\u7528\u6237\u3002<\/p>\n \u2461 \u7279\u6743\u7528\u6237\u6392\u67e5（UID=0）<\/h6>\nawk -F: '($3 == 0) {print $1}' \/etc\/passwd # \u5217\u51fa\u6240\u6709 UID=0 \u7684\u7528\u6237 <\/p>\n \u5206\u6790\u91cd\u70b9：<\/p>\n \n- \n
\u9664 root \u5916，\u82e5\u5b58\u5728\u5176\u4ed6 UID=0 \u8d26\u6237（\u5982 toor\u3001admin \u7b49），\u7acb\u5373\u9501\u5b9a\u5e76\u8c03\u67e5；<\/p>\n<\/li>\n - \n
\u653b\u51fb\u8005\u5e38\u521b\u5efa\u9690\u85cf\u7279\u6743\u8d26\u6237\u7ef4\u6301\u6743\u9650\u3002<\/p>\n<\/li>\n<\/ul>\n \u9a8c\u8bc1\u8d26\u6237\u5408\u6cd5\u6027：<\/p>\n grep '\u7528\u6237\u540d' \/etc\/passwd # \u68c0\u67e5\u8d26\u6237 Shell\u3001\u5bb6\u76ee\u5f55\u7b49\u5c5e\u6027
\nls -l \/home\/\u7528\u6237\u540d # \u786e\u8ba4\u5bb6\u76ee\u5f55\u662f\u5426\u5b58\u5728\u5f02\u5e38\u6587\u4ef6 <\/p>\n \u53ef\u7591\u7279\u5f81（\u539f\u6587）：<\/p>\n \n- \n
Shell \u4e3a \/sbin\/nologin \u5374\u53ef\u767b\u5f55；<\/p>\n<\/li>\n - \n
\u5bb6\u76ee\u5f55\u542b\u975e\u5e38\u89c4\u9690\u85cf\u6587\u4ef6（\u5982 .ssh\/authorized_keys \u4e2d\u51fa\u73b0\u5f02\u5e38\u516c\u94a5\u2014\u2014\u90a3\u5c31\u662f\u514d\u5bc6\u540e\u95e8）\u3002<\/p>\n<\/li>\n<\/ul>\n \u2462 sudo \u6743\u9650\u5ba1\u67e5<\/h6>\n# \u63d0\u53d6\u975e root \u7684 sudo \u7528\u6237
\ngrep -v '^#\\\\|^root' \/etc\/sudoers | grep 'ALL=(ALL)'<\/p>\n # \u5ba1\u8ba1 sudo \u547d\u4ee4\u6267\u884c\u8bb0\u5f55
\ngrep sudo \/var\/log\/auth.log <\/p>\n \u98ce\u9669\u70b9：<\/p>\n \n- \n
\u666e\u901a\u4e1a\u52a1\u8d26\u6237\u4e0d\u5e94\u62e5\u6709 ALL=(ALL) \u6743\u9650，\u9700\u6309\u6700\u5c0f\u6743\u9650\u539f\u5219\u8c03\u6574；<\/p>\n<\/li>\n - \n
\u805a\u7126\u975e\u8fd0\u7ef4\u65f6\u6bb5\u6216\u5f02\u5e38\u547d\u4ee4（\u5982 sudo su -\u3001sudo vim \/etc\/passwd\u2014\u2014\u7528 vim \u76f4\u63a5\u6539\u8d26\u6237\u6587\u4ef6，\u610f\u56fe\u660e\u663e）\u3002<\/p>\n<\/li>\n<\/ul>\n \u2463 \u8d26\u6237\u7ba1\u7406\u64cd\u4f5c<\/h6>\n# \u64cd\u4f5c\u524d\u52a1\u5fc5\u5907\u4efd
\ncp -p \/etc\/passwd \/etc\/passwd.bak
\ncp -p \/etc\/shadow \/etc\/shadow.bak<\/p>\n # \u9501\u5b9a\u53ef\u7591\u8d26\u6237
\nusermod -L \u7528\u6237\u540d # \u9501\u5b9a（\/etc\/shadow \u5bc6\u7801\u680f\u9996\u52a0 !）
\npasswd -l \u7528\u6237\u540d # \u7b49\u6548\u547d\u4ee4<\/p>\n # \u5f7b\u5e95\u5220\u9664\u8d26\u6237
\nuserdel -r \u7528\u6237\u540d # \u5220\u9664\u8d26\u6237\u5e76\u79fb\u9664\u5bb6\u76ee\u5f55 <\/p>\n \u26a0\ufe0f \u7b14\u8bb0\u8865\u5145：usermod -L \u53ea\u9501\u4e86\u5bc6\u7801\u767b\u5f55，SSH \u516c\u94a5\u767b\u5f55\u4e0d\u53d7\u5f71\u54cd\u2014\u2014\u5982\u679c .ssh\/authorized_keys \u91cc\u6709\u653b\u51fb\u8005\u7684\u516c\u94a5，\u9501\u5b9a\u8d26\u6237\u4e5f\u62e6\u4e0d\u4f4f\u3002\u6e05\u540e\u95e8\u65f6\u5fc5\u987b\u8fde\u516c\u94a5\u4e00\u8d77\u5220\u3002<\/p>\n 1.2 \u67e5\u770b\u5386\u53f2\u547d\u4ee4<\/h5>\ncat \/root\/.*_history | more <\/p>\n 📌 \u4e0b\u56fe\u4e3a\u539f\u6587\u793a\u4f8b（\u5df2\u7528\u56fe\u50cf\u8bc6\u522b\u8f6c\u5f55）：<\/p>\n q \/ sdadad \/ q
\nls \/ ls \/ \/ ls -a \/ ls -l
\ncd desktop \/ cd Desktop \/ ls -l
\nexit
\ncp \/etc\/apt\/sources.list \/etc\/apt\/sources.list.bak
\nvim \/etc\/apt\/sources.list
\napt clean
\n… <\/p>\n \u4e3b\u8981\u5206\u6790\u6076\u610f\u64cd\u4f5c：\u4e0b\u8f7d\u547d\u4ee4（wget\/curl）\u3001\u7f16\u8bd1\u6267\u884c\u3001\u6539\u914d\u7f6e\u3001\u5220\u65e5\u5fd7\u3002<\/p>\n \u26a0\ufe0f \u7b14\u8bb0\u8865\u5145：history \u6709\u4e09\u4e2a\u53cd\u53d6\u8bc1\u9677\u9631，\u6392\u67e5\u65f6\u522b\u628a"\u6ca1\u6709\u8bb0\u5f55"\u5f53"\u6ca1\u505a\u8fc7"：<\/p>\n - \n
bash \u9ed8\u8ba4\u9000\u51fa\u65f6\u624d\u5199\u5165 history \u6587\u4ef6\u2014\u2014\u4f1a\u8bdd\u8fd8\u5728\u65f6\u5185\u5b58\u91cc\u6709\u3001\u6587\u4ef6\u91cc\u6ca1\u6709；<\/p>\n<\/li>\n - \n
\u653b\u51fb\u8005\u53ef unset HISTFILE \/ HISTSIZE=0 \/ history -c \u76f4\u63a5\u4e0d\u7559\u75d5；<\/p>\n<\/li>\n - \n
\u9760\u8c31\u7684\u66ff\u4ee3\u662f auditd（\u5185\u6838\u7ea7\u5ba1\u8ba1），\u4e0d\u4f9d\u8d56 shell \u914d\u5408\u3002 \u53e6\u5916 .*_history \u53ea\u7ffb\u4e86 root，\u6bcf\u4e2a\u7528\u6237\u5bb6\u76ee\u5f55\u90fd\u8981\u7ffb\u4e00\u904d（\/home\/*\/.bash_history）\u3002<\/p>\n<\/li>\n 1.3 \u5f02\u5e38\u7aef\u53e3\u4e0e\u8fdb\u7a0b<\/h5>\n\u2460 \u7aef\u53e3\u6392\u67e5<\/h6>\nnetstat -anltup <\/p>\n 📌 \u4e0b\u56fe\u4e3a\u539f\u6587\u793a\u4f8b（\u5df2\u7528\u56fe\u50cf\u8bc6\u522b\u8f6c\u5f55）：<\/p>\n Proto Recv-Q Send-Q Local Address Foreign Address State PID\/Program name
\ntcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1032\/sshd: \/usr\/sbi
\ntcp 0 0 192.168.234.128:54162 34.107.243.93:443 ESTABLISHED 2017\/firefox-esr
\ntcp6 0 0 :::22 :::* LISTEN 1032\/sshd: \/usr\/sbi
\nudp 0 0 192.168.234.128:68 192.168.234.254:67 ESTABLISHED 755\/NetworkManager <\/p>\n \u5e38\u7528\u547d\u4ee4（\u8f6c\u5f55\u81ea\u539f\u6587\u56fe\u7247）：<\/p>\n \n\u547d\u4ee4\u4f5c\u7528\u5173\u952e\u53c2\u6570\u89e3\u6790<\/tr>\n \n\n| netstat -tulnp<\/td>\n | \u67e5\u770b\u6240\u6709 TCP\/UDP \u76d1\u542c\u7aef\u53e3\u53ca\u5173\u8054\u8fdb\u7a0b<\/td>\n | -t(TCP) -u(UDP) -l(\u76d1\u542c) -n(\u6570\u5b57\u683c\u5f0f) -p(\u663e\u793a PID)<\/td>\n<\/tr>\n | \n| ss -tunlp<\/td>\n | \u66f4\u9ad8\u6548\u7684\u66ff\u4ee3\u547d\u4ee4（\u63a8\u8350）<\/td>\n | \u53c2\u6570\u540c netstat，\u6027\u80fd\u66f4\u4f18<\/td>\n<\/tr>\n | \n| lsof -i :\u7aef\u53e3\u53f7<\/td>\n | \u7cbe\u51c6\u5b9a\u4f4d\u5360\u7528\u7aef\u53e3\u7684\u8fdb\u7a0b<\/td>\n | \u8f93\u51fa\u8fdb\u7a0b\u540d\u3001PID\u3001\u7528\u6237\u53ca\u6587\u4ef6\u63cf\u8ff0\u7b26<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u68c0\u6d4b\u7aef\u53e3\u5360\u7528：<\/p>\n sudo ss -tunlp | grep ':80'
\nsudo lsof -i :80 <\/p>\n \u5f02\u5e38\u7aef\u53e3\u7279\u5f81（\u539f\u6587）：<\/p>\n \n- \n
\u975e\u5e38\u7528\u7aef\u53e3\u76d1\u542c（\u5982 10000 \u4ee5\u4e0a\u968f\u673a\u7aef\u53e3）；<\/p>\n<\/li>\n - \n
\u5916\u90e8 IP \u8fde\u63a5（netstat -anp | grep ESTABLISHED）；<\/p>\n<\/li>\n - \n
\u65e0\u5173\u8054\u8fdb\u7a0b\u6216\u8fdb\u7a0b\u540d\u5f02\u5e38（\u5982 [deleted] \u63d0\u793a\u2014\u2014\u53ef\u80fd\u4e3a\u65e0\u6587\u4ef6\u8fdb\u7a0b）\u3002<\/p>\n<\/li>\n<\/ul>\n \u9632\u706b\u5899\u4e0e\u7f51\u7edc\u914d\u7f6e：<\/p>\n sudo iptables -L -n # \u67e5\u770b iptables \u89c4\u5219
\nsudo firewall-cmd –list-all # firewalld \u89c4\u5219（CentOS\/RHEL）<\/p>\n telnet \u76ee\u6807IP \u7aef\u53e3\u53f7 # \u6d4b\u8bd5 TCP \u7aef\u53e3
\nnc -zv \u76ee\u6807IP \u7aef\u53e3\u53f7 # \u5feb\u901f\u68c0\u6d4b（\u63a8\u8350） <\/p>\n 💡 \u7b14\u8bb0\u8865\u5145：\u9632\u706b\u5899\u89c4\u5219\u672c\u8eab\u4e5f\u8981\u5ba1\u2014\u2014\u653b\u51fb\u8005\u62ff\u5230 root \u540e\u4f1a\u52a0\u4e00\u6761\u653e\u884c\u89c4\u5219\u7ed9\u81ea\u5df1\u7559\u95e8（\u5982\u653e\u884c 8888 \u7aef\u53e3）\u3002iptables -L -n \u91cc\u51fa\u73b0"\u4e1a\u52a1\u8bf4\u4e0d\u51fa\u540d\u5802"\u7684\u653e\u884c\u6761\u76ee，\u5c31\u662f\u7ebf\u7d22\u3002<\/p>\n \u2461 \u8fdb\u7a0b\u6392\u67e5<\/h6>\n\u57fa\u7840\u8fdb\u7a0b\u5206\u6790（\u8f6c\u5f55\u81ea\u539f\u6587\u56fe\u7247）：<\/p>\n \n\u547d\u4ee4\u7528\u9014<\/tr>\n \n\n| ps aux –forest<\/td>\n | \u663e\u793a\u8fdb\u7a0b\u6811（\u8bc6\u522b\u5f02\u5e38\u7236\u5b50\u5173\u7cfb）<\/td>\n<\/tr>\n | \n| top \/ htop<\/td>\n | \u5b9e\u65f6\u76d1\u63a7\u8d44\u6e90\u5360\u7528（CPU\/\u5185\u5b58\u6392\u5e8f）<\/td>\n<\/tr>\n | \n| pstree<\/td>\n | \u6811\u72b6\u56fe\u5c55\u793a\u8fdb\u7a0b\u5c42\u7ea7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u6df1\u5ea6\u8fdb\u7a0b\u68c0\u67e5：<\/p>\n # \u68c0\u67e5\u8fdb\u7a0b\u771f\u5b9e\u8def\u5f84（\u82e5\u8fd4\u56de "deleted" \u53ef\u80fd\u4e3a\u6076\u610f\u8fdb\u7a0b）
\nls -l \/proc\/<PID>\/exe
\n# \u67e5\u770b\u542f\u52a8\u547d\u4ee4\u53ca\u53c2\u6570
\ncat \/proc\/<PID>\/cmdline <\/p>\n \u9690\u85cf\u8fdb\u7a0b\u68c0\u6d4b（\u5bf9\u6bd4 ps \u4e0e \/proc \u7684\u5dee\u5f02）：<\/p>\n ps -ef | awk '{print $2}' | sort -n > ps_pids.txt
\nls \/proc | grep -E '^[0-9]+$' | sort -n > proc_pids.txt
\ndiff ps_pids.txt proc_pids.txt # \u5dee\u5f02\u9879\u53ef\u80fd\u662f\u9690\u85cf\u8fdb\u7a0b <\/p>\n 💡 \u539f\u7406（\u7b14\u8bb0\u8865\u5145）：ps \u8bfb\u7684\u662f\u7cfb\u7edf\u8c03\u7528\u8fd4\u56de，\/proc \u662f\u5185\u6838\u76f4\u63a5\u66b4\u9732\u7684\u771f\u5b9e\u8fdb\u7a0b\u8868\u3002 Loadable Kernel Module（LKM）Rootkit \u6302\u94a9\u7cfb\u7edf\u8c03\u7528\u540e，ps \u770b\u4e0d\u5230\u7684\u8fdb\u7a0b\u5728 \/proc \u91cc\u4ecd\u5728\u2014\u2014\u4e24\u8fb9\u4e00 diff \u5c31\u73b0\u5f62\u3002\u8fd9\u4e5f\u662f\u4e0b\u6587 unhide proc \u7684\u539f\u7406\u3002<\/p>\n Rootkit \u68c0\u6d4b：<\/p>\n sudo chkrootkit # \u626b\u63cf\u5e38\u89c1\u540e\u95e8
\nsudo unhide proc # \u4e13\u67e5\u9690\u85cf\u8fdb\u7a0b <\/p>\n
\n🔎 \u4e8c\u3001\u6eaf\u6e90\u5206\u6790<\/h4>\n📌 \u524d\u534a\u7bc7\u56de\u7b54"\u4e3b\u673a\u54ea\u91cc\u810f\u4e86"，\u8fd9\u4e00\u7ae0\u56de\u7b54"\u810f\u662f\u8c01\u5f04\u7684"\u2014\u2014\u56db\u677f\u65a7\u4ece\u75d5\u8ff9\u8d70\u5411\u8eab\u4efd\u3002<\/p>\n 2.1 \u5a01\u80c1\u60c5\u62a5（Threat Intelligence）<\/h5>\n\u5b9a\u4e49：\u901a\u8fc7\u6536\u96c6\u3001\u5206\u6790\u7f51\u7edc\u653b\u51fb\u6570\u636e（IP\u3001\u57df\u540d\u3001\u6076\u610f\u6587\u4ef6\u54c8\u5e0c\u7b49），\u5f62\u6210\u53ef\u884c\u52a8\u7684\u5a01\u80c1\u4fe1\u606f\u3002\u6838\u5fc3\u4ef7\u503c：\u628a\u788e\u7247\u5316\u653b\u51fb\u75d5\u8ff9\u8f6c\u5316\u4e3a\u653b\u51fb\u8005\u753b\u50cf\u3001\u6218\u672f\u94fe\u6761\u548c\u9632\u5fa1\u7b56\u7565\u3002<\/p>\n \u4e3b\u6d41\u5e73\u53f0：<\/p>\n \n\u5e73\u53f0\u5730\u5740\u7279\u8272<\/tr>\n \n\n| \u5947\u5b89\u4fe1\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3<\/td>\n | https:\/\/ti.qianxin.com\/<\/td>\n | APT \u7ec4\u7ec7\u8ffd\u8e2a\u3001\u653b\u51fb\u94fe\u8def\u8fd8\u539f\u3001AI \u9a71\u52a8\u5206\u6790<\/td>\n<\/tr>\n | \n| \u5fae\u6b65\u5728\u7ebf ThreatBook<\/td>\n | https:\/\/x.threatbook.com\/<\/td>\n | \u6697\u7f51\u76d1\u63a7\u3001ATT&CK \u6218\u672f\u5339\u914d\u3001\u591a\u7ef4\u5ea6\u62d3\u7ebf\u5206\u6790<\/td>\n<\/tr>\n | \n| \u817e\u8baf\u5b89\u5168\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3<\/td>\n | https:\/\/tix.qq.com\/<\/td>\n | \u57fa\u7840\u60c5\u62a5 + \u4e1a\u52a1\u60c5\u62a5\u6574\u5408\u3001IOC \u7814\u5224<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u2705 \u5e94\u7528\u573a\u666f：\u5feb\u901f\u7814\u5224\u6076\u610f IP\u3001\u5206\u6790\u9493\u9c7c\u90ae\u4ef6\u6765\u6e90\u3001\u5173\u8054 APT \u653b\u51fb\u56e2\u4f19\u6d3b\u52a8\u3002<\/p>\n 2.2 IP \u5b9a\u4f4d（IP Geolocation）<\/h5>\nASN \u5b9a\u4f4d（\u81ea\u6cbb\u7cfb\u7edf\u53f7\u5b9a\u4f4d）：\u901a\u8fc7 ASN（\u5982 AS4538）\u5173\u8054 IP \u6240\u5c5e\u8fd0\u8425\u5546\u53ca\u5730\u7406\u533a\u57df（\u4f8b：\u4e2d\u56fd\u6559\u80b2\u7f51\u8986\u76d6\u9ad8\u6821\u8303\u56f4）\u3002<\/p>\n whois 58.192.55.255 # \u67e5\u770b ASN \u53ca\u5f52\u5c5e\u673a\u6784 <\/p>\n \u516c\u5f00\u5b9a\u4f4d\u63a5\u53e3（\u8f6c\u5f55\u81ea\u539f\u6587\u56fe\u7247）：<\/p>\n \n\u670d\u52a1\u5546\u63a5\u53e3\u5730\u5740\u7cbe\u5ea6<\/tr>\n \n\n| \u57c3\u6587\u79d1\u6280<\/td>\n | https:\/\/www.ipuu.net\/<\/td>\n | \u516c\u5b89\u7248 \u2264200 \u7c73<\/td>\n<\/tr>\n | \n| IP138<\/td>\n | https:\/\/www.ip138.com\/<\/td>\n | \u57ce\u5e02\u7ea7<\/td>\n<\/tr>\n | \n| MaxMind<\/td>\n | https:\/\/www.maxmind.com\/<\/td>\n | \u56fd\u5bb6\/\u57ce\u5e02\u7ea7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u26a0\ufe0f \u539f\u6587\u63d0\u9192：\u5883\u5916 IP \u5b9a\u4f4d\u7cbe\u5ea6\u53d7\u9650，\u56fd\u5185\u63a5\u53e3\u5bf9\u672c\u571f IP \u652f\u6301\u66f4\u4f18\u3002 \u7b14\u8bb0\u8865\u5145：\u6eaf\u6e90\u65f6 IP \u672c\u8eab\u53ea\u662f\u7ebf\u7d22\u2014\u2014\u4ee3\u7406\u3001VPN\u3001\u8df3\u677f\u673a\u4f1a\u8ba9"IP \u5f52\u5c5e\u5730"\u5b8c\u5168\u5931\u771f，\u5b9a\u4f4d\u7ed3\u679c\u53ea\u80fd\u5f53\u53c2\u8003，\u4e0d\u80fd\u5f53\u7ed3\u8bba\u3002<\/p>\n 2.3 \u7aef\u53e3\u626b\u63cf（Port Scanning）<\/h5>\n\u4f5c\u7528：\u63a2\u6d4b\u4e3b\u673a\u5f00\u653e\u7aef\u53e3，\u8bc6\u522b\u6f5c\u5728\u670d\u52a1\u6f0f\u6d1e（\u5982\u672a\u6388\u6743\u7684 Redis \u7aef\u53e3 6379）\u3002<\/p>\n \u5e38\u7528\u5de5\u5177：<\/p>\n nmap -sV 192.168.1.1 # \u7efc\u5408\u626b\u63cf：\u68c0\u6d4b\u670d\u52a1\u7248\u672c
\nmasscan # \u9ad8\u901f\u5168\u7f51\u626b\u63cf，\u9002\u7528\u4e8e\u5927\u89c4\u6a21\u8d44\u4ea7\u666e\u67e5 <\/p>\n \u9632\u5fa1\u5173\u8054：\u7ed3\u5408\u5a01\u80c1\u60c5\u62a5\u5e73\u53f0（\u5982\u5fae\u6b65\u5728\u7ebf），\u5c06\u626b\u63cf\u53d1\u73b0\u7684\u5f02\u5e38 IP \u4e0e\u9ed1\u540d\u5355\u5e93\u6bd4\u5bf9，\u5feb\u901f\u5224\u5b9a\u98ce\u9669\u3002<\/p>\n \u26a0\ufe0f \u5408\u89c4\u8fb9\u754c（\u7b14\u8bb0\u5f3a\u8c03）：nmap\/masscan \u5c5e\u4e3b\u52a8\u63a2\u6d4b，\u53ea\u80fd\u7528\u4e8e\u81ea\u6709\u8d44\u4ea7\u6216\u53d6\u5f97\u4e66\u9762\u6388\u6743\u7684\u76ee\u6807\u3002\u62a4\u7f51\u573a\u666f\u4e0b\u5b83\u662f\u84dd\u961f\u7684"\u81ea\u67e5\u5de5\u5177"\u2014\u2014\u626b\u81ea\u5df1\u7684\u8d44\u4ea7\u627e 6379 \u672a\u6388\u6743\u8fd9\u7c7b\u4f4e\u7ea7\u5931\u8bef，\u800c\u4e0d\u662f\u53bb\u626b\u522b\u4eba\u3002<\/p>\n 2.4 \u793e\u4f1a\u5de5\u7a0b\u5b66（Social Engineering）<\/h5>\n\u653b\u51fb\u539f\u7406：\u5229\u7528\u4eba\u6027\u5f31\u70b9（\u4fe1\u4efb\u3001\u597d\u5947\u3001\u6050\u60e7）\u8bf1\u9a97\u6cc4\u9732\u4fe1\u606f\u6216\u6267\u884c\u6076\u610f\u64cd\u4f5c\u2014\u2014\u975e\u6280\u672f\u6027\u7a81\u7834\u9632\u7ebf\u7684\u5178\u578b\u624b\u6bb5\u3002<\/p>\n \u6eaf\u6e90\u5e38\u7528\u6e20\u9053（\u539f\u6587）：<\/p>\n \n\u6e20\u9053\u5730\u5740\u7528\u9014<\/tr>\n \n\n| \u6ce8\u518c\u7f51\u7ad9\u68c0\u6d4b<\/td>\n | https:\/\/www.reg007.com\/search<\/td>\n | \u7528\u624b\u673a\u53f7\/\u90ae\u7bb1\u53cd\u67e5\u6ce8\u518c\u8fc7\u54ea\u4e9b\u7f51\u7ad9<\/td>\n<\/tr>\n | \n| \u7f51\u7ad9\u5386\u53f2<\/td>\n | https:\/\/archive.org\/web\/<\/td>\n | \u7f51\u9875\u5386\u53f2\u5feb\u7167，\u627e\u653b\u51fb\u8005\u5220\u6389\u7684\u4fe1\u606f<\/td>\n<\/tr>\n | \n| \u793e\u4ea4\u8f6f\u4ef6<\/td>\n | https:\/\/checkusernames.com\/<\/td>\n | \u7528\u6237\u540d\u5728\u5404\u5e73\u53f0\u7684\u5360\u7528\u60c5\u51b5（\u62d3\u7ebf）<\/td>\n<\/tr>\n | \n| \u793e\u4ea4\u5a92\u4f53<\/td>\n | \u5404\u7c7b\u793e\u4ea4\u5e73\u53f0<\/td>\n | \u8eab\u4efd\u753b\u50cf\u3001\u6d3b\u52a8\u8f68\u8ff9<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u5e38\u89c1\u624b\u6cd5\u4e0e\u9632\u5fa1（\u8f6c\u5f55\u81ea\u539f\u6587\u56fe\u7247）：<\/p>\n \n\u653b\u51fb\u7c7b\u578b\u6848\u4f8b\u9632\u5fa1\u63aa\u65bd<\/tr>\n \n\n| \u9493\u9c7c\u90ae\u4ef6<\/td>\n | \u4f2a\u88c5\u6210 IT \u90e8\u95e8\u8981\u6c42"\u5bc6\u7801\u91cd\u7f6e"<\/td>\n | \u9a8c\u8bc1\u53d1\u4ef6\u4eba\u57df\u540d\u3001\u7981\u7528\u81ea\u52a8\u52a0\u8f7d\u8fdc\u7a0b\u5185\u5bb9<\/td>\n<\/tr>\n | \n| \u4f2a\u88c5\u6280\u672f\u652f\u6301<\/td>\n | \u58f0\u79f0"\u7cfb\u7edf\u6545\u969c"\u8bf1\u5bfc\u5b89\u88c5\u8fdc\u63a7\u8f6f\u4ef6<\/td>\n | \u62d2\u7edd\u5916\u90e8\u4e3b\u52a8\u534f\u52a9，\u8054\u7cfb\u5185\u90e8\u786e\u8ba4<\/td>\n<\/tr>\n | \n| \u5c3e\u968f\u8fdb\u5165<\/td>\n | \u5192\u5145\u8bbf\u5ba2\u6df7\u5165\u529e\u516c\u533a\u7a83\u53d6\u6570\u636e<\/td>\n | \u4e25\u683c\u6267\u884c\u95e8\u7981\u5237\u5361\u5236\u5ea6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 💡 \u6eaf\u6e90\u5e94\u7528（\u539f\u6587）： \u5206\u6790\u9493\u9c7c\u90ae\u4ef6\u5934\u83b7\u53d6\u53d1\u9001 IP \u2192 \u7ed3\u5408\u5a01\u80c1\u60c5\u62a5\u5b9a\u4f4d\u653b\u51fb\u56e2\u4f19 \u2192 \u5173\u8054\u5386\u53f2\u653b\u51fb\u6a21\u5f0f\u3002<\/p>\n 2.5 \u6eaf\u6e90\u6280\u672f\u8054\u52a8\u6846\u67b6<\/h5>\n\u7aef\u53e3\u626b\u63cf\u53d1\u73b0\u5f02\u5e38IP \u2500\u2500\u25b6 \u5a01\u80c1\u60c5\u62a5\u6bd4\u5bf9
\n \u2502
\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
\n \u25bc \u25bc
\n \u547d\u4e2d\u9ed1\u540d\u5355 \u672a\u77e5 IP
\n \u2502 \u2502
\n \u25bc \u25bc
\n IP\u5b9a\u4f4d \u2192 \u7269\u7406\u5730\u5740 \u793e\u4f1a\u5de5\u7a0b\u5b66\u7ebf\u7d22\u5206\u6790
\n \u2502 \u2502
\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
\n \u25bc
\n \u653b\u51fb\u8005\u753b\u50cf：\u8eab\u4efd\/\u5de5\u5177\/\u610f\u56fe <\/p>\n \u5de5\u5177\u94fe\u63a8\u8350（\u539f\u6587）： nmap（\u626b\u63cf）+ \u5fae\u6b65\u5728\u7ebf（\u60c5\u62a5）+ \u57c3\u6587 IP \u5b9a\u4f4d（\u5730\u7406\u8ffd\u8e2a）+ \u5458\u5de5\u5b89\u5168\u610f\u8bc6\u57f9\u8bad（\u9632\u793e\u5de5）\u3002<\/p>\n 💡 \u7cbe\u9ad3：\u901a\u8fc7\u6280\u672f + \u4eba\u6027\u53cc\u7ef4\u5ea6\u6eaf\u6e90，\u5b9e\u73b0\u4ece"\u653b\u51fb\u75d5\u8ff9"\u5230"\u653b\u51fb\u8005\u8eab\u4efd"\u7684\u95ed\u73af\u3002<\/p>\n
\n🐧 \u4e8c-B\u3001\u7b14\u8bb0\u8865\u5145：\u4e09\u79cd\u8d26\u6237\u7c7b\u578b\u4e0e\u300c\u540e\u95e8\u4e09\u677f\u65a7\u300d<\/h4>\n\u7406\u89e3 \/etc\/passwd \u7684\u5173\u952e\u662f\u5148\u5206\u6e05\u7cfb\u7edf\u91cc\u672c\u6765\u8be5\u6709\u54ea\u4e09\u7c7b\u8d26\u6237：<\/p>\n \n\u7c7b\u578b\u4f8b\u5b50UIDShell\u8bf4\u660e<\/tr>\n \n\n| \u8d85\u7ea7\u7ba1\u7406\u5458<\/td>\n | root<\/td>\n | 0<\/td>\n | \/bin\/bash<\/td>\n | \u5168\u573a\u53ea\u8be5\u6709\u8fd9\u4e00\u4e2a UID=0<\/td>\n<\/tr>\n | \n| \u666e\u901a\u7528\u6237<\/td>\n | alice<\/td>\n | \u2265 1000<\/td>\n | \/bin\/bash<\/td>\n | \u5bb6\u76ee\u5f55\u5728 \/home\/alice<\/td>\n<\/tr>\n | \n| \u670d\u52a1\u8d26\u6237<\/td>\n | www-data<\/td>\n | \u901a\u5e38 < 1000<\/td>\n | \/usr\/sbin\/nologin<\/td>\n | \u8dd1 Apache\/Nginx\/DB \u7528，\u88ab\u5265\u593a\u767b\u5f55\u80fd\u529b<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 💡 \u4e3a\u4ec0\u4e48\u670d\u52a1\u8d26\u6237\u8981\u8bbe\u6210 nologin \u8fd9\u662f\u7eb5\u6df1\u9632\u5fa1\u7684\u7ecf\u5178\u8bbe\u8ba1：\u5373\u4f7f\u653b\u51fb\u8005\u901a\u8fc7\u7f51\u7ad9\u62ff\u4e0b www-data \u7684\u6743\u9650，\u4ed6\u4e5f\u767b\u4e0d\u8fdb\u7cfb\u7edf\u3001\u6267\u884c\u4e0d\u4e86\u547d\u4ee4\u3002 \u6240\u4ee5\u6392\u67e5\u65f6\u770b\u5230"\u540d\u5b57\u50cf\u670d\u52a1\u8d26\u6237\u4f46 Shell \u662f \/bin\/bash"\u2014\u2014\u8fd9\u672c\u8eab\u5c31\u662f\u5f02\u5e38\u3002<\/p>\n \u540e\u95e8\u8d26\u6237\u4e09\u677f\u65a7：<\/p>\n # \u2460 \u6709\u6ca1\u6709"\u4f2a\u9020\u7684\u8001\u677f"：\u9664\u4e86 root，\u8fd8\u6709\u8c01 UID=0
\nawk -F: '$3==0 {print $1}' \/etc\/passwd<\/p>\n # \u2461 \u6709\u6ca1\u6709"\u80fd\u767b\u5f55\u7684\u670d\u52a1\u8d26\u6237"：Shell \u4e0d\u662f nologin\/false \u7684\u975e root \u8d26\u6237
\nawk -F: '$1!="root" && $7!~\/nologin|false\/ {print $1, $3, $7}' \/etc\/passwd<\/p>\n # \u2462 \u6709\u6ca1\u6709"\u51ed\u7a7a\u51fa\u73b0\u7684\u5458\u5de5"：\u6700\u8fd1\u65b0\u5efa\u7684\u8d26\u6237
\nawk -F: '$3>=1000 {print $1, $3}' \/etc\/passwd <\/p>\n \u26a0\ufe0f \u522b\u5fd8\u4e86 \/etc\/shadow \u548c authorized_keys<\/p>\n \n- \n
\/etc\/passwd \u91cc\u7684 x \u53ea\u662f\u5360\u4f4d\u7b26，\u771f\u6b63\u7684\u5bc6\u7801\u54c8\u5e0c\u5728 \/etc\/shadow（\u53ea\u6709 root \u53ef\u8bfb）\u3002<\/p>\n<\/li>\n - \n
\u653b\u51fb\u8005\u66f4\u5e38\u7528\u7684\u662f\u5f80 ~\/.ssh\/authorized_keys \u585e\u81ea\u5df1\u7684\u516c\u94a5 \u2014\u2014 \u8fd9\u6761\u4e0d\u770b passwd \u662f\u53d1\u73b0\u4e0d\u4e86\u7684\u3002<\/p>\n<\/li>\n - \n
\u547c\u5e94\u524d\u6587\u63d0\u9192：usermod -L \u53ea\u9501\u5bc6\u7801\u767b\u5f55，\u9501\u4e0d\u4f4f SSH \u516c\u94a5\u540e\u95e8，\u6e05\u540e\u95e8\u5fc5\u987b\u8fde\u516c\u94a5\u4e00\u8d77\u5220\u3002<\/p>\n<\/li>\n<\/ul>\n 🐧 \u4e8c-C\u3001\u7b14\u8bb0\u8865\u5145：\u5e94\u6025\u54cd\u5e94\u7684\u987a\u5e8f \u2014\u2014 \u5148\u6613\u5931，\u540e\u6301\u4e45<\/h4>\n💡 \u8fd9\u662f\u6392\u67e5\u91cc\u6700\u5bb9\u6613\u88ab\u5ffd\u7565\u3001\u4e5f\u6700\u4e0d\u53ef\u9006\u7684\u4e00\u6761\u539f\u5219\u3002 \u5185\u5b58\u91cc\u7684\u4e1c\u897f（\u5f53\u524d\u8fde\u63a5\u3001\u8fdb\u7a0b\u3001\u767b\u5f55\u4f1a\u8bdd）\u91cd\u542f\u5373\u6d88\u5931，\u800c\u6301\u4e45\u5316（cron\u3001authorized_keys）\u7559\u5728\u78c1\u76d8\u4e0a\u968f\u65f6\u80fd\u67e5\u3002 \u987a\u5e8f\u53cd\u4e86，\u653b\u51fb\u8005\u6700\u5173\u952e\u7684\u75d5\u8ff9\u5c31\u6c38\u4e45\u6ca1\u4e86\u3002<\/p>\n # \u2460 \u6613\u5931\u6570\u636e（\u5fc5\u987b\u5148\u505a，\u4e14\u5c3d\u91cf\u522b\u7528\u88ab\u611f\u67d3\u673a\u5668\u4e0a\u7684\u547d\u4ee4）
\nw # \u5f53\u524d\u8c01\u5728\u7ebf
\nlast # \u6700\u8fd1\u7684\u767b\u5f55\u5386\u53f2
\nps auxf # \u5168\u91cf\u8fdb\u7a0b（\u542b\u7236\u5b50\u5173\u7cfb）
\nss -tnpu # \u5168\u91cf\u7f51\u7edc\u8fde\u63a5 + \u5bf9\u5e94\u8fdb\u7a0b
\nlsof -i -n -P # \u6253\u5f00\u7684\u7f51\u7edc\u6587\u4ef6
\ncat \/proc\/net\/tcp # \u6700\u5e95\u5c42\u7684\u8fde\u63a5\u8868（\u8fde ss \u90fd\u88ab\u66ff\u6362\u65f6\u7528\u5b83）<\/p>\n # \u2461 \u6301\u4e45\u5316\u6392\u67e5
\ncat \/etc\/crontab; ls -la \/etc\/cron.d\/; crontab -l -u root
\nls -la ~\/.ssh\/authorized_keys
\nsystemctl list-unit-files –state=enabled
\ncat ~\/.bashrc ~\/.profile # \u770b\u6709\u6ca1\u6709\u88ab\u8ffd\u52a0\u6076\u610f\u547d\u4ee4<\/p>\n # \u2462 \u65e5\u5fd7\u4e0e\u6587\u4ef6（\u89c1\u7b2c\u4e8c\u7bc7） <\/p>\n \u26a0\ufe0f \u4e24\u4e2a\u5b9e\u64cd\u7ec6\u8282<\/p>\n \n- \n
\u6253\u5305\u547d\u4ee4\u5efa\u8bae\u7528\u9759\u6001\u7f16\u8bd1\u7684 busybox \u6216\u4ece\u6551\u63f4\u76d8\u542f\u52a8\u3002\u653b\u51fb\u8005\u82e5\u66ff\u6362\u4e86 ps\/netstat（Rootkit \u5e38\u89c1\u624b\u6cd5），\u4f60\u770b\u5230\u7684\u8f93\u51fa\u662f\u5047\u7684\u3002<\/p>\n<\/li>\n - \n
\u522b\u6025\u7740\u91cd\u542f\u3002\u9664\u975e\u4e1a\u52a1\u5fc5\u987b\u6062\u590d，\u5426\u5219\u5148\u505a\u5b8c\u5185\u5b58\u53d6\u8bc1（avml\u3001dd if=\/dev\/mem）\u3002<\/p>\n<\/li>\n<\/ul>\n 🐧 \u4e8c-D\u3001\u7b14\u8bb0\u8865\u5145：Webshell \u4e13\u9879\u68c0\u6d4b<\/h4>\nWebshell \u662f Linux \u670d\u52a1\u5668\u88ab\u5165\u4fb5\u540e\u6700\u5e38\u89c1\u7684\u843d\u811a\u70b9，\u51e0\u6761\u547d\u4ee4\u5c31\u80fd\u626b\u51fa\u5927\u90e8\u5206：<\/p>\n # \u7279\u5f81\u51fd\u6570\u626b\u63cf（\u6700\u7ecf\u5178\u7684\u4e00\u7c7b\u9a6c）
\ngrep -r –include='*.php' -l 'eval\\\\|base64_decode\\\\|system\\\\|passthru\\\\|shell_exec' \/var\/www\/ 2>\/dev\/null
\ngrep -r –include='*.php' 'eval(base64_decode' \/var\/www\/ 2>\/dev\/null<\/p>\n # \u8fd1\u671f\u65b0\u589e \/ \u88ab\u6539\u52a8\u7684\u811a\u672c\u6587\u4ef6
\nfind \/var\/www -mtime -7 -name '*.php' -ls 2>\/dev\/null<\/p>\n # \u6743\u9650\u5f02\u5e38（\u4e16\u754c\u53ef\u5199）\u4e0e\u9690\u85cf\u6587\u4ef6
\nfind \/var\/www -name '*.php' -perm \/o+w -ls 2>\/dev\/null
\nfind \/var\/www -name '.*' -not -name '.htaccess' -ls 2>\/dev\/null<\/p>\n # \u6728\u9a6c\u626b\u63cf\u5668
\nclamscan -r –infected \/var\/www\/ 2>\/dev\/null <\/p>\n 💡 \u914d\u5408\u8bbf\u95ee\u65e5\u5fd7\u4e8c\u6b21\u786e\u8ba4 \u626b\u51fa\u53ef\u7591\u6587\u4ef6\u540e，\u4e00\u5b9a\u8981\u56de\u67e5 Web \u8bbf\u95ee\u65e5\u5fd7\u91cc\u8c01 POST \u8fc7\u8fd9\u4e2a\u6587\u4ef6\u2014\u2014\u8fd9\u80fd\u76f4\u63a5\u7ed9\u51fa\u653b\u51fb\u8005 IP \u548c\u4e0a\u4f20\u6210\u529f\u7684\u786e\u5207\u65f6\u95f4，\u662f\u65f6\u95f4\u7ebf\u7684\u5173\u952e\u951a\u70b9\u3002 \u811a\u672c\u7c7b UA（curl\u3001python-requests\u3001wget）\u76f4\u63a5\u8bbf\u95ee\u4e00\u4e2a .php \u5e76\u62ff\u5230 200，\u57fa\u672c\u53ef\u4ee5\u5b9a\u6027\u3002<\/p>\n 🐧 \u4e8c-E\u3001\u7b14\u8bb0\u8865\u5145：Rootkit \u4e0e\u9690\u85cf\u8fdb\u7a0b\u68c0\u6d4b<\/h4>\n# \u2460 \u5df2\u77e5 Rootkit \u7279\u5f81\u626b\u63cf
\nchkrootkit -q
\nrkhunter –check –sk<\/p>\n # \u2461 LD_PRELOAD \u52ab\u6301（\u6700\u5e38\u89c1\u7684\u7528\u6237\u6001 Rootkit）
\ncat \/etc\/ld.so.preload # \u6b63\u5e38\u5e94\u4e3a\u7a7a
\nenv | grep LD_PRELOAD<\/p>\n # \u2462 \/proc vs ps \u5dee\u5206 \u2014\u2014 \u63ea\u51fa\u88ab\u85cf\u8d77\u6765\u7684\u8fdb\u7a0b
\nls \/proc\/ | grep -E '^[0-9]+$' | sort -n > \/tmp\/proc_pids.txt
\nps aux | awk '{print $2}' | tail -n +2 | sort -n > \/tmp\/ps_pids.txt
\ndiff \/tmp\/proc_pids.txt \/tmp\/ps_pids.txt<\/p>\n # \u2463 \u5185\u6838\u6a21\u5757\u4e0e\u5185\u6838\u6c61\u67d3\u6807\u8bb0
\nlsmod
\ndmesg | grep -i taint
\nsha256sum \/boot\/vmlinuz-$(uname -r) # \u4e0e\u5b98\u65b9\u6e90\u54c8\u5e0c\u6bd4\u5bf9 <\/p>\n \u26a0\ufe0f \u8bfb\u61c2 diff \u7ed3\u679c：\u51fa\u73b0\u5728 \/proc \u4f46\u4e0d\u5728 ps \u8f93\u51fa\u91cc\u7684 PID，\u5c31\u662f\u88ab Rootkit \u9690\u85cf\u7684\u8fdb\u7a0b\u3002 \u539f\u7406\u662f：ps \u8d70\u7684\u662f\u88ab\u6302\u94a9\u7684\u7cfb\u7edf\u8c03\u7528（\u5047\u8d26\u672c），\u800c \/proc \u662f\u5185\u6838\u76f4\u63a5\u66b4\u9732\u7684（\u771f\u8d26\u672c），\u4e24\u8fb9\u4e00\u5bf9\u5c31\u73b0\u5f62\u3002<\/p>\n 🐧 \u4e8c-F\u3001\u7b14\u8bb0\u8865\u5145：auditd \u4e0e\u5b8c\u6574\u6027\u6821\u9a8c<\/h4>\n\u524d\u9762\u7684\u6392\u67e5\u90fd\u4f9d\u8d56"\u65e5\u5fd7\u8fd8\u5728"\u3002\u4f46\u653b\u51fb\u8005\u53ef\u4ee5\u6e05\u65e5\u5fd7\u3001\u6539 history\u2014\u2014auditd \u662f\u5185\u6838\u7ea7\u7684，\u4e0d\u4f9d\u8d56 shell \u914d\u5408，\u662f\u76ee\u524d\u6700\u53ef\u9760\u7684\u786c\u5ba1\u8ba1\u624b\u6bb5：<\/p>\n # \u76d1\u63a7\u5173\u952e\u6587\u4ef6\u88ab\u4fee\u6539
\nauditctl -w \/etc\/passwd -p wa -k passwd_changes
\nauditctl -w \/etc\/crontab -p wa -k cron_changes<\/p>\n # \u76d1\u63a7 \/tmp \u4e0b\u7684\u6267\u884c\u884c\u4e3a（\u9a6c\u5e38\u9a7b\u7559\u4e8e\u6b64）
\nauditctl -w \/tmp -p x -k tmp_exec<\/p>\n # \u8bb0\u5f55\u6240\u6709\u7f51\u7edc\u8fde\u63a5\u7cfb\u7edf\u8c03\u7528（\u80fd\u6293\u5230"\u53ea\u8fd0\u884c\u4e86\u51e0\u79d2"\u7684\u8fdb\u7a0b）
\nauditctl -a always,exit -F arch=b64 -S connect -k network_connect<\/p>\n # \u67e5\u8be2
\nausearch -k passwd_changes -ts today
\nausearch -k network_connect -ts today <\/p>\n \u7cfb\u7edf\u6587\u4ef6\u5b8c\u6574\u6027\u6821\u9a8c：<\/p>\n rpm -Va | grep '^..5' # RPM \u7cfb：\u7b2c 3 \u4f4d\u662f 5 \u8868\u793a MD5 \u53d8\u4e86
\naide –check # \u9700\u63d0\u524d\u521d\u59cb\u5316\u6570\u636e\u5e93
\ndpkg –verify # Debian \u7cfb <\/p>\n 💡 \u6700\u5b9e\u7528\u7684\u4e00\u6761：\u5148\u7b97\u54c8\u5e0c，\u518d\u5220\u6587\u4ef6\u3002 sha256sum \u4e4b\u540e\u9001 VirusTotal \/ \u5fae\u6b65\u6bd4\u5bf9\u2014\u2014\u65e2\u80fd\u786e\u8ba4\u662f\u4e0d\u662f\u6076\u610f\u6837\u672c，\u53c8\u80fd\u7559\u4f5c\u8bc1\u636e\u3002 \u76f4\u63a5 rm \u662f\u6700\u7cdf\u7684\u505a\u6cd5：\u65e2\u4e22\u8bc1\u636e，\u53c8\u65e0\u6cd5\u5224\u65ad\u5b83\u662f\u4e0d\u662f\u8fd8\u6709\u522b\u7684\u526f\u672c\u3002<\/p>\n
\n🧾 \u4e09\u3001\u672c\u7ae0\u603b\u7ed3<\/h4>\n3.1 \u5341\u6761\u8981\u70b9<\/h5>\n - \n
\/etc\/passwd \u662f\u8d26\u6237\u603b\u8d26：\u4e03\u6bb5\u5f0f \u7528\u6237\u540d:\u5bc6\u7801:UID:GID:GECOS:\u5bb6\u76ee\u5f55:Shell，\u5bc6\u7801\u771f\u5b9e\u5b58\u653e\u5730\u5728 \/etc\/shadow\u3002<\/p>\n<\/li>\n - \n
UID=0 \u662f\u7ea2\u7ebf：awk -F: '($3==0)' \u67e5\u51fa root \u4e4b\u5916\u7684\u7279\u6743\u8d26\u6237，\u7acb\u5373\u9501\u5b9a\u8c03\u67e5\u3002<\/p>\n<\/li>\n - \n
\u540e\u95e8\u4e0d\u6b62\u5728\u8d26\u6237\u91cc：.ssh\/authorized_keys \u7684\u5f02\u5e38\u516c\u94a5\u662f\u514d\u5bc6\u540e\u95e8；usermod -L \u9501\u4e0d\u4f4f\u516c\u94a5\u767b\u5f55\u3002<\/p>\n<\/li>\n - \n
sudo \u5ba1\u67e5\u770b\u4e24\u6761：\u4e1a\u52a1\u8d26\u6237\u4e0d\u5e94\u6709 ALL=(ALL)；\u65e5\u5fd7\u91cc\u76ef\u975e\u8fd0\u7ef4\u65f6\u6bb5\u7684 sudo su -\u3002<\/p>\n<\/li>\n - \n
history \u4f1a\u9a97\u4eba：\u9ed8\u8ba4\u9000\u51fa\u624d\u843d\u76d8\u3001\u53ef\u88ab unset HISTFILE \u6e05\u96f6\u2014\u2014\u786c\u5ba1\u8ba1\u8981\u4e0a auditd，\u4e14\u6bcf\u4e2a\u7528\u6237\u5bb6\u76ee\u5f55\u90fd\u7ffb\u3002<\/p>\n<\/li>\n - \n
\u7aef\u53e3\u6392\u67e5 ss \u4f18\u5148：ss -tunlp \u66ff\u4ee3 netstat；\u91cd\u70b9\u6293 10000+ \u968f\u673a\u7aef\u53e3\u3001ESTABLISHED \u5916\u8054\u3001[deleted] \u8fdb\u7a0b\u3002<\/p>\n<\/li>\n - \n
\/proc\/<PID>\/exe \u8fd4\u56de deleted = \u65e0\u6587\u4ef6\u9a7b\u7559\u5acc\u7591：\u8fdb\u7a0b\u8fd8\u6d3b\u7740，\u6587\u4ef6\u5df2\u88ab\u5220\u3002<\/p>\n<\/li>\n - \n
\u9690\u85cf\u8fdb\u7a0b\u9760 diff \/proc：ps \u88ab\u5185\u6838 Rootkit \u6302\u94a9\u65f6\u4f1a\u6f0f\u62a5，\/proc \u662f\u5185\u6838\u7684"\u771f\u8d26\u672c"，\u4e24\u8fb9\u6bd4\u5bf9\u5373\u53ef\u73b0\u5f62（unhide proc \u5c31\u662f\u8fd9\u4e48\u505a\u7684）\u3002<\/p>\n<\/li>\n - \n
\u6eaf\u6e90\u56db\u677f\u65a7：\u5a01\u80c1\u60c5\u62a5（\u5b9a\u6027）\u2192 IP \u5b9a\u4f4d（\u5730\u7406）\u2192 \u7aef\u53e3\u626b\u63cf（\u81ea\u67e5\u6388\u6743\u8d44\u4ea7）\u2192 \u793e\u5de5（\u62d3\u7ebf\u5230\u4eba）\u3002<\/p>\n<\/li>\n - \n
\u60c5\u62a5\u5148\u884c：\u5947\u5b89\u4fe1\/\u5fae\u6b65\/\u817e\u8baf\u4e09\u5e73\u53f0\u5148\u67e5\u4e00\u904d\u6076\u610f IP \u548c\u6587\u4ef6\u54c8\u5e0c，\u547d\u4e2d\u9ed1\u540d\u5355\u80fd\u7701\u6389\u6574\u4e2a\u62d3\u7ebf\u8fc7\u7a0b\u3002<\/p>\n<\/li>\n 3.2 \u547d\u4ee4\u901f\u67e5\u5361<\/h5>\n\n\u76ee\u7684\u547d\u4ee4<\/tr>\n \n\n| \u67e5 UID=0 \u7279\u6743\u8d26\u6237<\/td>\n | awk -F: '($3 == 0) {print $1}' \/etc\/passwd<\/td>\n<\/tr>\n | \n| \u975e root \u7684 sudo \u7528\u6237<\/td>\n | grep -v '^#\\\\|^root' \/etc\/sudoers \\\\| grep 'ALL=(ALL)'<\/td>\n<\/tr>\n | \n| sudo \u6267\u884c\u8bb0\u5f55<\/td>\n | grep sudo \/var\/log\/auth.log<\/td>\n<\/tr>\n | \n| \u9501\u5b9a \/ \u5220\u9664\u8d26\u6237<\/td>\n | usermod -L \u7528\u6237\u540d \/ userdel -r \u7528\u6237\u540d<\/td>\n<\/tr>\n | \n| \u5386\u53f2\u547d\u4ee4<\/td>\n | cat \/root\/.*_history（\u6bcf\u4e2a\u7528\u6237\u90fd\u8981\u770b）<\/td>\n<\/tr>\n | \n| \u76d1\u542c\u7aef\u53e3（\u63a8\u8350）<\/td>\n | ss -tunlp<\/td>\n<\/tr>\n | \n| \u7aef\u53e3\u5b9a\u4f4d\u8fdb\u7a0b<\/td>\n | lsof -i :80<\/td>\n<\/tr>\n | \n| \u8fdb\u7a0b\u771f\u5b9e\u8def\u5f84<\/td>\n | ls -l \/proc\/<PID>\/exe<\/td>\n<\/tr>\n | \n| \u9690\u85cf\u8fdb\u7a0b\u6bd4\u5bf9<\/td>\n | diff <(ps -ef \\\\| awk '{print $2}' \\\\| sort -n) <(ls \/proc \\\\| grep -E '^[0-9]+$' \\\\| sort -n)<\/td>\n<\/tr>\n | \n| Rootkit \u68c0\u6d4b<\/td>\n | chkrootkit \/ unhide proc<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n3.3 \u4e00\u53e5\u8bdd\u6536\u5c3e<\/h5>\n\u6392\u67e5\u662f\u628a"\u810f\u4e1c\u897f"\u627e\u51fa\u6765，\u6eaf\u6e90\u662f\u628a"\u810f\u624b"\u627e\u51fa\u6765\u3002 \/proc \u548c \/etc \u4e0d\u4f1a\u8bf4\u8c0e\u2014\u2014\u8bf4\u8c0e\u7684\u662f\u88ab\u6302\u94a9\u7684\u7cfb\u7edf\u8c03\u7528\u548c\u88ab unset \u7684 HISTFILE，\u6240\u4ee5\u771f\u6b63\u53ef\u9760\u7684\u5ba1\u8ba1，\u6c38\u8fdc\u6bd4\u653b\u51fb\u8005\u591a\u60f3\u4e00\u5c42\u3002<\/p>\n 3.4 \u5de5\u5177\u4e0e\u8d44\u6599<\/h5>\n\n\u8d44\u6e90\u8bf4\u660e<\/tr>\n \n\n| \u5947\u5b89\u4fe1\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3<\/td>\n | ti.qianxin.com<\/td>\n<\/tr>\n | \n| \u5fae\u6b65\u5728\u7ebf ThreatBook<\/td>\n | x.threatbook.com<\/td>\n<\/tr>\n | \n| \u817e\u8baf\u5b89\u5168\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3<\/td>\n | tix.qq.com<\/td>\n<\/tr>\n | \n| \u57c3\u6587\u79d1\u6280 IP \u5b9a\u4f4d<\/td>\n | www.ipuu.net（\u516c\u5b89\u7248\u7cbe\u5ea6 \u2264200 \u7c73）<\/td>\n<\/tr>\n | \n| chkrootkit \/ unhide<\/td>\n | Linux Rootkit \/ \u9690\u85cf\u8fdb\u7a0b\u68c0\u6d4b<\/td>\n<\/tr>\n | \n| auditd（\u7b14\u8bb0\u8865\u5145）<\/td>\n | \u5185\u6838\u7ea7\u547d\u4ee4\u5ba1\u8ba1，\u4e0d\u4f9d\u8d56 shell \u7684 history<\/td>\n<\/tr>\n | \n| \u539f\u6587<\/td>\n | shining.blog.csdn.net\/article\/details\/148356432<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n🔗 \u7cfb\u5217\u5bfc\u822a<\/h3>\n\u672c\u7cfb\u5217\u5171\u56db\u7bc7，\u6784\u6210\u4e00\u6761\u5b8c\u6574\u7684\u84dd\u961f\u8bc1\u636e\u94fe：<\/p>\n \u2460 \u6d41\u91cf\u7279\u5f81 \u2500\u2500 \u8c01\u5728\u6253
\n \u2193
\n\u2461 \u65e5\u5fd7\u5206\u6790 \u2500\u2500 \u600e\u4e48\u8fdb\u6765\u7684 \/ \u5e72\u4e86\u4ec0\u4e48
\n \u2193
\n\u2462 \u4e3b\u673a\u6392\u67e5 \u2500\u2500 \u4e1c\u897f\u85cf\u5728\u54ea \/ \u5b83\u662f\u8c01
\n \u2193
\n\u2463 \u9632\u5fa1\u4f53\u7cfb \u2500\u2500 \u600e\u4e48\u9632 \/ \u6253\u7a7f\u4e86\u4e5f\u80fd\u6551 <\/p>\n \n\u7bc7\u4e3b\u9898\u4e00\u53e5\u8bdd<\/tr>\n \n\n| 1<\/td>\n | C2 \u8fdc\u63a7\u4e0e Webshell \u6d41\u91cf\u7279\u5f81<\/td>\n | \u4ece\u6d41\u91cf\u91cc\u8ba4\u51fa\u300c\u8c01\u5728\u6253\u4f60\u300d<\/td>\n<\/tr>\n | \n| 2<\/td>\n | \u4e2d\u95f4\u4ef6\u4e0e\u4e3b\u673a\u65e5\u5fd7\u5206\u6790<\/td>\n | \u4ece\u65e5\u5fd7\u91cc\u8fd8\u539f\u300c\u53d1\u751f\u4e86\u4ec0\u4e48\u300d<\/td>\n<\/tr>\n | \n| 3 \u2b05<\/td>\n | Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90<\/td>\n | \u4ece\u4e3b\u673a\u4e0a\u627e\u51fa\u300c\u5b83\u85cf\u5728\u54ea\u300d<\/td>\n<\/tr>\n | \n| 4<\/td>\n | \u5b89\u5168\u8bbe\u5907\u3001\u5185\u7f51\u5904\u7f6e\u4e0e\u4e91\u4e0a\u9632\u62a4<\/td>\n | \u4ece\u4f53\u7cfb\u4e0a\u505a\u5230\u300c\u9632\u5f97\u4f4f\u300d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n🙏 \u81f4\u8c22\u4e0e\u58f0\u660e<\/h3>\n\n- \n
\u5185\u5bb9\u6765\u6e90：CSDN @\u4e00\u53ea\u67b7\u9501 \u7684 HW \u7cfb\u5217\u6587\u7ae0（\u5177\u4f53\u94fe\u63a5\u89c1\u5404\u7ae0\u5f00\u5934）\u3002\u672c\u6587\u4e3a\u5b66\u4e60\u7b14\u8bb0\u6574\u7406，\u975e\u539f\u521b\u3002<\/p>\n<\/li>\n - \n
\u672c\u6587\u6539\u52a8：\u7ed3\u6784\u91cd\u6392\u3001\u539f\u7406\u8865\u5168\u3001\u9519\u8bef\u4fee\u6b63（\u8865\u5145\u5904\u6807 💡，\u4fee\u6b63\u5904\u6807 \u26a0\ufe0f），\u5e76\u8865\u5145\u4e86\u516c\u5f00\u8d44\u6599\u4e2d\u7684\u6307\u7eb9\u6570\u636e\u3001\u6392\u67e5\u987a\u5e8f\u4e0e\u843d\u5730\u6e05\u5355\u3002<\/p>\n<\/li>\n - \n
\u5408\u89c4\u58f0\u660e：\u672c\u6587\u6240\u6709\u7279\u5f81\u3001\u89c4\u5219\u4e0e\u547d\u4ee4\u4ec5\u7528\u4e8e\u9632\u5b88\u4fa7\u68c0\u6d4b\u3001\u62a4\u7f51\u503c\u5b88\u4e0e\u6388\u6743\u6e17\u900f\u6d4b\u8bd5\/\u5e94\u6025\u54cd\u5e94\u3002 \u672a\u7ecf\u6388\u6743\u5bf9\u4ed6\u4eba\u7cfb\u7edf\u5b9e\u65bd\u8fdc\u63a7\u3001\u690d\u5165 Webshell\u3001\u5efa\u7acb C2 \u901a\u9053\u3001\u5185\u7f51\u6a2a\u5411\u79fb\u52a8\u3001\u65e5\u5fd7\u7be1\u6539\u6216\u672a\u6388\u6743\u7aef\u53e3\u626b\u63cf，\u5747\u5c5e\u8fdd\u6cd5\u3002<\/p>\n<\/li>\n - \n
\u5982\u9700\u8f6c\u8f7d\u8bf7\u6ce8\u660e\u539f\u4f5c\u8005\u4e0e\u672c\u6587\u51fa\u5904；\u5982\u6709\u4fb5\u6743\u8bf7\u8054\u7cfb\u5220\u9664\u3002<\/p>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":" \u4ece\u4e3b\u673a\u4e0a\u627e\u51fa\u300c\u5b83\u85cf\u5728\u54ea\u300d\u2014\u2014\u8d26\u6237\u3001\u8fdb\u7a0b\u3001\u7aef\u53e3\u3001\u542f\u52a8\u9879\u3001\u8ba1\u5212\u4efb\u52a1\u3001\u670d\u52a1\u516d\u4e2a\u85cf\u8eab\u5904\u6328\u4e2a\u7ffb 📌 \u6765\u6e90\u58f0\u660e｜\u672c\u6587\u4e3a\u5b66\u4e60\u7b14\u8bb0\u6574\u7406，\u975e\u539f\u521b \u4e3b\u4f53\u5185\u5bb9\u6574\u7406\u81ea CSDN \u535a\u4e3b \u4e00\u53ea\u67b7\u9501 \u7684\u4e24\u7bc7 HW \u7cfb\u5217\u6587\u7ae0，\u539f\u6587\u94fe\u63a5： \u300a\u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d\u2014Windows\u5165\u4fb5\u6392\u67e5\u300b \u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d\u2014Windows\u5165\u4fb5\u6392\u67e5_d\u76fe\u662f\u6c99\u7bb1\u4e48-CSDN\u535a\u5ba2（\u5bf9\u5e94\u7b2c\u4e00\u7ae0） \u300a\u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[58,149,305,122],"topic":[],"class_list":["post-117272","post","type-post","status-publish","format-standard","hentry","category-server","tag-linux","tag-windows","tag-305","tag-122"],"yoast_head":"\n \u84dd\u961f\u7b14\u8bb0\u6574\u740603 Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/117272.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u84dd\u961f\u7b14\u8bb0\u6574\u740603 Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u4ece\u4e3b\u673a\u4e0a\u627e\u51fa\u300c\u5b83\u85cf\u5728\u54ea\u300d\u2014\u2014\u8d26\u6237\u3001\u8fdb\u7a0b\u3001\u7aef\u53e3\u3001\u542f\u52a8\u9879\u3001\u8ba1\u5212\u4efb\u52a1\u3001\u670d\u52a1\u516d\u4e2a\u85cf\u8eab\u5904\u6328\u4e2a\u7ffb 📌 \u6765\u6e90\u58f0\u660e｜\u672c\u6587\u4e3a\u5b66\u4e60\u7b14\u8bb0\u6574\u7406，\u975e\u539f\u521b \u4e3b\u4f53\u5185\u5bb9\u6574\u7406\u81ea CSDN \u535a\u4e3b \u4e00\u53ea\u67b7\u9501 \u7684\u4e24\u7bc7 HW \u7cfb\u5217\u6587\u7ae0，\u539f\u6587\u94fe\u63a5： \u300a\u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d\u2014Windows\u5165\u4fb5\u6392\u67e5\u300b \u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d\u2014Windows\u5165\u4fb5\u6392\u67e5_d\u76fe\u662f\u6c99\u7bb1\u4e48-CSDN\u535a\u5ba2（\u5bf9\u5e94\u7b2c\u4e00\u7ae0） \u300a\u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/117272.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-24T07:29:39+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/117272.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/117272.html\",\"name\":\"\u84dd\u961f\u7b14\u8bb0\u6574\u740603 Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-10-24T07:29:39+00:00\",\"dateModified\":\"2026-10-24T07:29:39+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/117272.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/117272.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/117272.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u84dd\u961f\u7b14\u8bb0\u6574\u740603 Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u84dd\u961f\u7b14\u8bb0\u6574\u740603 Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/117272.html","og_locale":"zh_CN","og_type":"article","og_title":"\u84dd\u961f\u7b14\u8bb0\u6574\u740603 Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u4ece\u4e3b\u673a\u4e0a\u627e\u51fa\u300c\u5b83\u85cf\u5728\u54ea\u300d\u2014\u2014\u8d26\u6237\u3001\u8fdb\u7a0b\u3001\u7aef\u53e3\u3001\u542f\u52a8\u9879\u3001\u8ba1\u5212\u4efb\u52a1\u3001\u670d\u52a1\u516d\u4e2a\u85cf\u8eab\u5904\u6328\u4e2a\u7ffb 📌 \u6765\u6e90\u58f0\u660e｜\u672c\u6587\u4e3a\u5b66\u4e60\u7b14\u8bb0\u6574\u7406，\u975e\u539f\u521b \u4e3b\u4f53\u5185\u5bb9\u6574\u7406\u81ea CSDN \u535a\u4e3b \u4e00\u53ea\u67b7\u9501 \u7684\u4e24\u7bc7 HW \u7cfb\u5217\u6587\u7ae0，\u539f\u6587\u94fe\u63a5： \u300a\u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d\u2014Windows\u5165\u4fb5\u6392\u67e5\u300b \u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d\u2014Windows\u5165\u4fb5\u6392\u67e5_d\u76fe\u662f\u6c99\u7bb1\u4e48-CSDN\u535a\u5ba2（\u5bf9\u5e94\u7b2c\u4e00\u7ae0） \u300a\u3010HW\u7cfb\u5217\u3011\u2014\u6eaf\u6e90\u4e0e\u5b9a\u4f4d","og_url":"https:\/\/www.wsisp.com\/helps\/117272.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-10-24T07:29:39+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"14 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/117272.html","url":"https:\/\/www.wsisp.com\/helps\/117272.html","name":"\u84dd\u961f\u7b14\u8bb0\u6574\u740603 Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-10-24T07:29:39+00:00","dateModified":"2026-10-24T07:29:39+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/117272.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/117272.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/117272.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u84dd\u961f\u7b14\u8bb0\u6574\u740603 Windows \/ Linux \u5165\u4fb5\u6392\u67e5\u4e0e\u6eaf\u6e90"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/117272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=117272"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/117272\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=117272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=117272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=117272"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=117272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} | | | | | | | | | | | | | | | | | | | | | |