·¢²¼Ê±¼ä£º2017-07-10
Ò»¡¢Ê¼þ±³¾°
±±¾©Ê±¼ä6ÔÂ27ÈÕÍí¼ä£¬¾Ý¹úÍâýÌåHackerNews±¬ÁÏ£¬Ò»ÖÖÀàËÆÓÚ“WannaCry”µÄÐÂÐÍÀÕË÷²¡¶¾Ï¯¾íÁËÅ·ÖÞ£¬ÎÚ¿ËÀ¼¾³ÄÚµØÌú¡¢µçÁ¦¹«Ë¾¡¢µçÐŹ«Ë¾¡¢Çжûŵ±´ÀûºËµçÕ¾¡¢ÒøÐÐϵͳµÈ¶à¸ö¹ú¼ÒÉèÊ©¾ùÔâ¸ÐȾµ¼ÖÂÔËÐÐÒì³£¡£¸Ã²¡¶¾Îª“Petya”±äÖÖ²¡¶¾£¬Í¨¹ýÓÊÏ丽¼þ´«²¥¡£Áí¾ÝÎÚ¿ËÀ¼CERT¹Ù·½ÏûÏ¢³Æ£¬ÓÊÏ丽¼þ±»È·ÈÏÊǸôβ¡¶¾¹¥»÷µÄ´«²¥Ô´Í·¡£¸ÃÀÕË÷²¡¶¾ÔÚÈ«Çò·¶Î§ÄÚ±¬·¢£¬Êܲ¡¶¾ÇÖÏ®µÄ¹ú¼Ò³ýÁËÎÚ¿ËÀ¼Í⣬»¹ÓжíÂÞ˹¡¢Î÷°àÑÀ¡¢·¨¹ú¡¢Ó¢¹úÒÔ¼°Å·ÖÞ¶à¸ö¹ú¼Ò£¬ºóÐø²»Åųý»á¼ÌÐøÂûÑÓµ½°üÀ¨ÖйúÔÚÄÚµÄÑÇÖÞ¹ú¼Ò¡£
¶þ¡¢²¡¶¾·ÖÎö
¾¹ý¹«º£²Ê´¬¡¤6600°²È«²úÆ·ÊÂÒµ²¿µÄȡ֤Ñо¿£¬Õâ´Î¹¥»÷ÊÇÀÕË÷²¡¶¾“Petya”µÄ±äÖÖ£¬²¡¶¾´«²¥¹ý³ÌÀûÓõ½windowsµÄÁ½¸ö©¶´¡£µÚÒ»²½ÊÇÀûÓÃCVE-2017-0199©¶´·¢ËÍÓʼþ£¬½«²¡¶¾Ìí¼ÓÔÚoffice¸½¼þÀPCÒ»µ©´ò¿ª¸½¼þ£¬µÚÒ»¸ö´«²¥µÄÔ´Í·±»¸ÐȾ³É¹¦¡£µÚ¶þ²½ÊÇͨ¹ýMS17-010£¨ÓÀºãÖ®À¶£©Â©¶´ºÍϵͳÈõ¿ÚÁî½øÐд«²¥¡£Â©¶´µÄÏêϸÀûÓÃÇé¿öÈçÏ£º
©¶´Ò»£ºCVE-2017-0199©¶´
©¶´ËµÃ÷£ºCVE-2017-0199ÔÊÐí¹¥»÷ÕßÀûÓôË©¶´ÓÕʹÓû§´ò¿ª´¦ÀíÌØÊâ¹¹ÔìµÄOfficeÎļþÔÚÓû§ÏµÍ³ÉÏÖ´ÐÐÈÎÒâÃüÁ´Ó¶ø¿ØÖÆÓû§ÏµÍ³¡£
ÀûÓ÷½·¨£ºÀûÓøÃ©¶´£¬ºÚ¿Í¿ÉÒÔ½«ÀÕË÷Èí¼þµÄ´úÂëǶÈëÁËofficeÎĵµÖУ¬ÀýÈçword¡¢PPT¡¢ExcelµÈ£¬×÷Ϊ¸½¼þαװ³ÉÇóÖ°¡¢¹ã¸æµÈͨ¹ýµç×ÓÓʼþ´«²¥¡£Óû§ÊÕµ½¾¹ýαװµÄÓʼþºó£¬Ò»µ©´ò¿ª£¬ÀÕË÷²¡¶¾ÊͷųɿÉÖ´ÐÐÎļþ¡£
©¶´¶þ£ºMS17-010£¨ÓÀºãÖ®À¶£©SMB©¶´
©¶´ËµÃ÷£ºMS17-010£¨ÓÀºãÖ®À¶£©SMB©¶´ÊǽñÄê4Ô·½³Ìʽ×é֯й¶µÄÖØÒªÂ©¶´Ö®Ò»¡£“ÓÀºãÖ®À¶”ÀûÓÃWindows SMBÔ¶³ÌÌáȨ©¶´£¬¿ÉÒÔ¹¥»÷¿ª·Å445 ¶Ë¿ÚµÄ Windows ϵͳ²¢ÌáÉýȨÏÞ¡£
ÀûÓ÷½·¨£ºÊ×ÏÈ£¬TCP ¶Ë¿Ú 445ÊÇÔÚWindows ϵͳÖÐÌṩ¾ÖÓòÍøÖÐÎļþ»ò´òÓ¡»ú¹²Ïí·þÎñ£¬ºÚ¿Í³¢ÊÔÓëµçÄÔ445¶Ë¿Ú½¨Á¢ÇëÇóÁ¬½Ó£¬Ò»µ©Á¬½Ó³É¹¦£¬¾ÍÄܹ»»ñµÃ¾ÖÓòÍøÄÚ¹²ÏíµÄÎļþ»òÐÅÏ¢¡£Í¨¹ýµÚÒ»¸ö©¶´¸ÐȾµÄµÚһ̨PC¼Ì¶øÀûÓÃMS17-010£¨ÓÀºãÖ®À¶£©SMB©¶´¸ÐȾ¾ÖÓòÍøÖпª·Å445¶Ë¿ÚµÄËùÓÐPC¡£
±¾´ÎÀÕË÷²¡¶¾¸²¸ÇµÄÖÕ¶ËÊÇwindows XP¼¶ÒÔÉϲÙ×÷ϵͳ£¬µçÄÔ¡¢·þÎñÆ÷¸ÐȾÕâÖÖ²¡¶¾ºó»á±»¼ÓÃÜÌØ¶¨ÀàÐÍÎļþ£¬µ¼ÖÂϵͳÎÞ·¨Õý³£ÔËÐС£²»Í¬ÓÚ´«Í³ÀÕË÷Èí¼þ¼ÓÃÜÎļþµÄÐÐΪ£¬“Petya”ÊÇÒ»¸ö²ÉÓôÅÅ̼ÓÃÜ·½Ê½£¬¼ÓÃܳɹ¦ºó£¬»áÏÔʾÀÕË÷ÐÅÏ¢µÄ½çÃæ£¬Èç¹ûÊܺ¦Õß²»Ö§¸¶Êê½ð£¬¸ù±¾ÎÞ·¨½øÈëϵͳ¡£

±»¼ÓÃܺóµÄÀÕË÷ÐÅÏ¢
Èý¡¢°²È«½¨Òé
1¡¢ ¶ñÒâÓʼþ·À·¶
¸ÃÀÕË÷Èí¼þÊ״δ«²¥ÊÇͨ¹ýÓʼþ½øÐеģ¬¹Ê´Ë£¬Óöµ½Ð¯´ø²»Ã÷office¸½¼þºÍ²»Ã÷Á´½ÓµÄÓʼþÇëÎðµã»÷¸½¼þ¡£
2¡¢ Õë¶ÔCVE-2017-0199¡¢MS-17-010Á½¸ö©¶´¼°Ê±°²×°Â©¶´²¹¶¡
£¨CVE-2017-0199) RTF©¶´²¹¶¡µØÖ·£º
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
S17-010£¨ÓÀºãÖ®À¶£©Â©¶´²¹¶¡µØÖ·£º
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
3¡¢ ½ûÓÃWMI·þÎñ
https://msdn.microsoft.com/en-us/library/aa826517(v=vs.85).aspx

4¡¢ ·À»ðǽ·À»¤
¹«º£²Ê´¬¡¤6600ÍøÂçÒѸüзÀ»¤ÌØÕ÷¿â£¬Èç¹ûÄúÊǹ«º£²Ê´¬¡¤6600È«ÐÂÏÂÒ»´ú·À»ðǽ²úÆ·µÄÓû§£¬Ç뼰ʱ¸üе½Èçϰ汾£º²¡¶¾Ñù±¾¿â£º49.00830£» IPSÌØÕ÷¿â£º11.00168

ËÄ¡¢×ܽ᣺
»Ø¹Ë“Petya”±äÖÖ²¡¶¾ºÍ“wannacry”ʼþ£¬ÀÕË÷²¡¶¾ËùʹÓõÄÊֶβ¢²»ÊǷdz£¸ß¼¶µÄ¹¥»÷·½·¨£¬ÀûÓõÄ©¶´Ò²²¢·Ç0-day©¶´£¬¶øÊÇ΢ÈíÔçÒÑ·¢²¼Í¨¸æµÄÒÑ֪©¶´£¬´«²¥µÄ¹Ø¼üÒòËØÔÚÓÚµçÄÔ»ò·þÎñÆ÷´æÔÚδ¼°Ê±¸üеĩ¶´ºÍÈõ¿ÚÁî¡£Òò´Ë£¬ÆóÒµºÍ¸öÈ˶¼Ó¦ÈÏÕæË¼¿¼°²È«Ìåϵ½¨ÉèµÄ»ù´¡¹¤×÷£¬¸öÈ˵çÄÔÓ¦¼°Ê±°²×°²Ù×÷ϵͳ²¹¶¡£¬¾Ü¾øÈõ¿ÚÁî²¢¶¨ÆÚ¸ü»»ÃÜÂ룬Óöµ½²»Ã÷È·µÄÓʼþ²»ÒªÇáÒ×´ò¿ª¡£ÆóÒµÓû§Ó¦ÔÚÍøÂç±ß½ç²¿Êð¿ÉÒÔ¼°Ê±ÌṩÏàÓ¦ÌØÕ÷¿âºÍ·À»¤²ßÂԵݲȫÉ豸£¬¾¡Ô翪Æô·À»¤²ßÂÔ²¢¼°Ê±¸üÐÂÌØÕ÷¿â¡£·À»¼ÓÚδȻ£¬×öºÃ°²È«£¬ÆóÒµ²ÅÄܸüºÃµØ·¢Õ¹¡£
