MailEnable MailEnable <= Professional 1.73
MailEnable MailEnable <= Enterprise Edition 1.21
MailEnable MailEnable <= 1.91

1¡¢Ö÷»úA£º°²×°freebsd4.7£¬°²×°Èý¿éÍø¿¨fxp0¡¢xl0ºÍxl1¡£

fxp0Ϊ¶ÔÍâÍø¿¨£¬IP£ºx.x.x.x ISPΪÎÒÌṩµÄIPµØÖ·

xl0Ϊ¶ÔÄÚ¹«¹²ÇøÓòÍø¿¨£¬IP£º192.168.0.1

xl1Ϊ¶ÔÄÚ·þÎñÌṩÇøÓòÍø¿¨£¬IP£º192.168.80.1

2¡¢Ö÷»úB£º¶ÔÍâÌṩwww·þÎñÖ÷»ú£¬ipµØַΪ£º192.168.80.80

3¡¢Ö÷»úC£º¶ÔÍâÌṩftp·þÎñÖ÷»ú£¬ip£º192.168.80.3¡£

4¡¢ÆäËû¹¤×÷Õ¾N̨¡£

¶þ¡¢±àÒëÄÚºË

1¡¢

#cd /sys/i386/conf 
#cp GENERIC kernel_IPF

2¡¢±àÒëkernel_IPF,¼ÓÈëÒ»ÏÂÑ¡Ï

options IPFILTER 
options IPFILTER_LOG 
options IPFILTER_DEFAULT_BLOCK 
3¡¢ 
<CENTER><ccid_nobr>
<table width="400" border="1" cellspacing="0" cellpadding="2" 
 bordercolorlight = "black" bordercolordark = "#FFFFFF" align="center">
<tr>
    <td bgcolor="e6e6e6" class="code" style="font-size:9pt">
    <pre><ccid_code>
#/usr/sbin/config kernel_IPF 
#cd ../../compile/kernel_IPF 
#make kepend 
#make 
#make install

4¡¢±à¼­/etc/rc.rc.conf,´ò¿ªÒÔÏÂÑ¡Ï

defaultrouter="x.x.x.1" x.x.x.1ΪISPÌṩµÄÍø¹Ø 
gateway_enable="YES" 
ipfilter_enable£½"YES" 
ipnat_enable="YES"

5¡¢ÖØÐÂÆô¶¯ÏµÍ³£ºreboot

Èý¡¢ÅäÖ÷À»ðǽ

1¡¢ ÉèÖõØַת»»ipnat¡£ÔÚ/etcÏÂн¨Îļþipnat.rules,ÄÚÈÝΪ£º

map fxp0 192.168.0.0/16 -> 0/32 proxy port ftp ftp/tcp 
map fxp0 192.168.0.0/24 -> 0/32 portmap tcp/udp 10000:30000 
map fxp0 192.168.0.0/24 -> 0/32 
map fxp0 192.168.80.0/24 -> 0/32 portmap tcp/udp 300001:60000 
map fxp0 192.168.80.0/24 -> 0/32 portmap 
rdr fxp0 x.x.x.x/32 port 80 -> 192.168.0.2 port 80 
rdr fxp0 x.x.x.x/32 port ftp -> 192.168.0.3 port ftp 
rdr fxp0 x.x.x.x/32 port 30001-50000 -> 192.168.80.3 port 30001 tcp

2¡¢ÉèÖðü¹ýÂËipfilter¡£ÔÚ/etcÏÂн¨Îļþipf.rules,ÄÚÈÝΪ£º

block in log quick all with short 
block in log quick all with ipopts 
block in log quick all with frag 
block in log quick all with opt lsrr 
block in log quick all with opt ssrr

ÒÔÉÏÎå¾äΪ¹ýÂ˵ô¿ÉÄÜ»á´øÀ´°²È«ÎÊÌâµÄ¶ÌÊý¾Ý°ü»ò¾ß±¸Â·ÓÉÐÅÏ¢µÄÊý¾Ý°üÒÔ¼°·ÀÖ¹·Ç·¨É¨Ãè·þÎñÆ÷

pass out on xl0 all 
pass in on xlo all 
pass out on xl1 all 
pass in on xl1 all 
pass out quick on lo0 all 
pass in quick on lo0 all

ÒÔÉÏΪÄÚ²¿ÍøÂç½çÃæºÍloopbackÍøÂç½çÃæ¿ÉÒÔ×ÔÓÉ·¢ËͺͽÓÊÜÊý¾Ý°ü

block out on fxp0 all

ÒÔÉÏΪÆÁ±ÎÍⲿÍøÂç½çÃæÏòÍâ·¢ËÍÊý¾Ý°ü

block out log on fxp0 from any to 192.168.0.0/16 
block out log quick on fxp0 from any to 0.0.0.0/8 
block out log quick on fxp0 from any to 169.254.0.0/8 
block out log quick on fxp0 from any to 10.0.0.0/8 
block out log quick on fxp0 from any to 127.16.0.0/12 
block out log quick on fxp0 from any to 127.0.0.0/8 
block out log quick on fxp0 from any to 192.0.2.0/24 
block out log quick on fxp0 from any to 204.152.64.0/23 
block out log quick on fxp0 from any to 224.0.0.0/3

ÒÔÉÏΪÆÁ±Î²»ºÏ·¨µØÖ·µÄÊä³öÊý¾Ý

pass out log on fxp0 proto tcp/udp from any to any keep state 
pass out log on fxp0 proto icmp all keep state 
ÒÔÉÏΪÔÊÐíTCP ¡¢UDP¡¢ICMPÊý¾Ý°üÏòÍâ·¢ËͳöÈ¥£¬²¢ÇÒÔÊÐí»ØÓ¦Êý¾Ý°ü·¢Ëͻص½ÄÚ²¿ÍøÂç 
<CENTER><ccid_nobr>
<table width="400" border="1" cellspacing="0" cellpadding="2" 
 bordercolorlight = "black" bordercolordark = "#FFFFFF" align="center">
<tr>
    <td bgcolor="e6e6e6" class="code" style="font-size:9pt">
    <pre><ccid_code>
block in log on fxp0 from 192.168.0.0/16 to any 
block in log quick on fxp0 from 10.0.0.0/8 to any 
block in log quick on fxp0 from 172.16.0.0/12 to any 
block in log quick on fxp0 from 127.0.0.0/8 to any 
block in log quick on fxp0 from 192.0.2.0/24 to any 
block in log quick on fxp0 from 169.254.0.0/16 to any 
block in log quick on fxp0 from 224.0.0.0/3 to any 
block in log quick on fxp0 from 204.152.64.0/23 to any 
block in log quick on fxp0 from x.x.x.x/32 to any 
block in log quick on fxp0 from any to x.x.x.0/32 
block in log quick on fxp0 from any to x.x.x.255/32

ÒÔÉÏΪÆÁ±Î¾ß±¸ÄÚ²¿ÍøÂçµØÖ·µÄÊý¾Ý°ü±»×ª·¢µ½ÍⲿÍøÂç

pass in quick on fxp0 proto tcp from any to any port = 80 flags S/SA keep state
pass in quick on fxp0 proto tcp from any to any port = ftp flags S/SA keep state 
pass in quick on fxp0 proto tcp from any to any port = ftp-data flags S/SA keep state 
pass in quick on fxp0 proto tcp from any to any port 30000 >< 50001 flags S/SA keep state

ÒÔÉÏΪÔÊÐíwwwºÍftp½øÈ룬²¢ÇÒÔÊÐí¶ÔftpÊý¾Ý¶Ë¿ÚµÄÊý¾Ý½øÐÐת·¢

block in quick on fxp0 all

½ûÖ¹ÆäËûµÄÁ¬½Ó½øÈëfxp0

block in log quick on fxp0 proto icmp from any to any icmp-type redir 
block in log quick on fxp0 proto icmp from any to any 
block in log quick on fxp0 proto icmp from any to any icmp-type echo

ÒÔÉÏΪ½ûÖ¹±ðÈËpingÎÒµÃÍøÂç

block return-rst in log on fxp0 proto tcp from any to any flags S/SA 
block return-icmp(net-unr) in log on fxp0 proto udp from any to any

ÒÔÉ϶ÔÆäËûtcpÇëÇ󣬷À»ðǽ»ØÓ¦Ò»¸öRSTÊý¾Ý°ü¹Ø±ÕÁ¬½Ó¡£¶ÔUDPÇëÇ󣬷À»ðǽ»ØÓ¦ÍøÂç²»¿É´ïµ½µÄICMP°ü¡£

»òÕßÔÚ/etc/sysctl.confÖмÓÈ룺

net.inet.tcp.blackhole=2 
net.inet.udp.blackhole=1

Äܹ»ÓÐЧµØ±ÜÃâ¶Ë¿ÚɨÃè

3¡¢È»ºó±à¼­/etc/rc.conf£¬¼ÓÈëÒ»ÏÂÃüÁÈÃipfilterºÍipnatÔÚϵͳÆô¶¯µÄʱºò¿ÉÒÔ×Ô¶¯¼ÓÔØ£º

ipfilter_enables=¡±YES¡± 
ipf ¨CC ¨Cf /etc/ipf.rules 
ipfilter_flags=¡±-E¡± 
ipnat_enable=¡±YES¡± 
ipnat_program=¡±/sbin/ipnat ¨CCF -f¡± 
ipnat_rules=¡±/etc/ipnat.rules¡± 
ipmon_enable=¡±YES¡± 
ipmon_flags=¡±-D /var/log/ipfilter.log¡±

4¡¢ÔÚ/usr/log/½¨Á¢Îļþipfilter.log,²¢¸ü¸ÄÆäÊôÐÔΪ755£¬ÕâÑùÄãµÄ·À»ðǽÈÕÖ¾¾Í¼Ç¼µ½/var/log/ipfilter.logÎļþÖУ¬¿ÉÒÔËæʱ¶ÔÆä½øÐв鿴¡£

ËÄ¡¢ÉèÖÃFTP·þÎñÆ÷£¬Ê¹ÆäÖ§³Ö±»¶¯Á¬½Ó£¨pasv£©

1£®Proftpd£º±à¼­ÄãµÄproftpdµÄÅäÖÃÎļþproftpd.conf,¼ÓÈëÒ»ÏÂÄÚÈÝ£º

MasqueradeAddress x.x.x.x 
PassivePorts 30001 50000

2£®Pure-ftpd:±à¼­ÄãµÄFTPÅäÖÃÎļþ£¬¼ÓÈëÒ»ÏÂÄÚÈÝ£º

PassivePortRange 30001 50000 
ForcePassiveIP x.x.x.x

3£®Serv-U:

a¡¢ÔÚserv-UµÄ¡±±¾µØ·þÎñÆ÷¡±¨D¨D¨D¡±ÉèÖᱨD¨D¨D¡±¸ß¼¶¡±¨D¨D¨D¡±PASV¶Ë¿Ú·¶Î§¡±ÊäÈë30001 50000

b¡¢ÔÚserv-UµÄ¡±Óò¡±¨D¨D¨D¡±Äã×Ô¼º½¨Á¢µÄÓò¡±¨D¨D¨D¡±ÉèÖᱨD¨D¨D¡±¸ß¼¶¡±Ñ¡ÖС±ÔÊÐí±»¶¯Ä£Ê½´«ËÍ¡±£¬¡± ʹÓÃIP¡±ÊäÈ룺x.x.x.x

¡¡¡¡±¾ÖܶþÊг¡Ñо¿¹«Ë¾Gartner·¢±íÁËÒ»·Ý±¨¸æ£¬¾¯¸æ˵΢ÈíSMB(Server Message Block)Îļþ¹²ÏíЭÒéÖеÄÒ»¸ö©¶´¿ÉÄܻᱻÓÃÀ´·¢ÆðÐµĹ¥»÷¡£ÒòΪ°²È«¹©Ó¦ÉÌ·¢ÏÖSMBµÄĬÈ϶˿ڡª¡ªTCP/IP 445¶Ë¿ÚµÄ»î¶¯ÓÐËùÔö¼Ó£¬ËùÒÔGartnerµÃ³ö¿ÉÄÜÓÐÈËÕýÔڳﻮ¡°´ó¹æÄ£¹¥»÷¡±µÄ½áÂÛ¡£¶Ë¿ÚÊÇIPЭÒ齫ÐÅϢ·Óɵ½²»Í¬Ó¦ÓÃʱËùʹÓõÄÌØÊâµÄºÅÂë¡£Gartner½¨ÒéÓû§¾¡¿ì´òÉÏ΢ÈíµÄ²¹¶¡²¢Í¨¹ý·À»ðǽ½ûÓÃ445¶Ë¿Ú¡£

¡¡¡¡È»¶øÆäËûµÄ°²È«×¨¼Ò¶Ô¼´½«³öÏÖ445¶Ë¿Ú¹¥»÷±íʾ»³ÒÉ¡£NTBugtraq±à¼­¡¢CybertrustµÄ¸ß¼¶¿Æѧ¼ÒRuss Cooper±íʾ£¬ÒѾ­ÓÐSasserºÍNimdaÈä³æµÈÐí¶àÆäËü¹¥»÷ÀûÓÃÁË445¶Ë¿Ú£¬¼´Ê¹³öÏÖеÄÈä³æ¿ÉÄÜÒ²²»»áÓÐʲô±ä»¯¡£¡°ÄÇЩÒòΪ±©Â¶445¶Ë¿Ú¶øÒ×ÓÚ±»ÈËÀûÓÃÉÏÖܵÄ©¶´¹¥»÷µÄÈË¿ÉÄÜÔçÔÚ¹ýÈ¥ÈýÄêÖоÍÒѱ»Èä³æÇÖº¦ÁË¡£¡±ËûÔÚÖÜËıíʾ¡£Cooper¶Ô¿ÉÄܳöÏÖµÄ445¶Ë¿Ú¹¥»÷²»ÒÔΪȻ¡£ËûÈÏΪÕâ¸ö±¨¸æÊÇ¿ä´óÆä´Ê¡£

¡¡¡¡ÔÚÉÏÖÜÊ״η¢ÏÖ445»î¶¯²¨¶¯µÄÈüÃÅÌú¿ËÑо¿Ô±Ò²»ù±¾Í¬ÒâCooperµÄ¹Ûµã¡£¡°ÓÖ³öÏÖÁ˼¸¸ö©¶´£¬¡±ÈüÃÅÌú¿Ë°²È«ÏìÓ¦ÖÐÐĵŤ³Ì¸ß¼¶Ö÷¹ÜAlfred Huger±íʾ¡£¡°Õâ¸ö¿ÉÄÜÊÇÄÇЩ©¶´ÖÐÍþв×îСµÄ£¬Ò²ÊÇ×îÄÑÀûÓõġ£¡±Ëû±íʾÒѾ­Ó÷À»ðǽ»òÊÇ·ÓÉÆ÷½ûÖ¹¶Ô445¶Ë¿Ú·ÃÎʵÄÓû§¼´Ê¹Ã»Óа²×°Î¢ÈíµÄ×îв¹¶¡Ò²²»»áÊܵ½Õâ¸öSMB©¶´µÄÓ°Ïì¡£HugerÈÏΪÉÏÖܵÄÁíÒ»¸ö¹ØÓÚPNGͼÏñ¸ñʽµÄ©¶´¸ü¿ÉÄܳÉΪ¹ã·º¹¥»÷µÄÀ´Ô´¡£¿ÉÒÔÀûÓÃÕâ¸ö©¶´½«¶ñÒâ´úÂë²åÈë¹ã¸æÌõµÈÎÞº¦µÄÄÚÈÝÖУ¬Ëû±íʾ¡°ËüÃÇ¿ÉÄÜÔÚÄã²»ÖªµÀµÄÇé¿öÏÂÇÖÈëÄãµÄµçÄÔ¡£¡±

¡¡¡¡GartnerµÄ·ÖÎöÈËÔ±ÉÐδ¶Ô´Ë×ö³ö»ØÓ¦¡£

¡¡¡¡(1) Ô´µØÖ·ÆÛÆ­(Source Address Spoofing)¡¢IPÆÛÆ­(IP Spoofing)ºÍDNSÆÛÆ­(DNS Spoofing).Æä»ù±¾Ô­Àí:ÊÇÀûÓÃIPµØÖ·²¢²»Êdzö³§µÄʱºòÓëMAC¹Ì¶¨ÔÚÒ»ÆðµÄ£¬¹¥»÷Õßͨ¹ý×Ô·â°üºÍÐÞ¸ÄÍøÂç½ÚµãµÄIPµØÖ·£¬Ã°³äij¸ö¿ÉÐŽڵãµÄIPµØÖ·£¬½øÐй¥»÷¡£Ö÷ÒªÓÐÈýÖÖÊÖ·¨:

¡¡¡¡1. ̱»¾ÕæÕýÓµÓÐIPµÄ¿ÉÐÅÖ÷»ú£¬Î±×°¿ÉÐÅÖ÷»ú¹¥»÷·þÎñÆ÷;

¡¡¡¡2. ÖмäÈ˹¥»÷;

¡¡¡¡3. DNSÆÛÆ­(DNS Spoofing)ºÍ¡°»á»°½Ù³Ö¡±(Session Hijack);

¡¡¡¡(2) Դ·ÓÉÑ¡ÔñÆÛÆ­(Source Routing Spoofing)¡£Ô­Àí:ÀûÓÃIPÊý¾Ý°üÖеÄÒ»¸öÑ¡Ïî-IP Source RoutingÀ´Ö¸¶¨Â·ÓÉ£¬ÀûÓÿÉÐÅÓû§¶Ô·þÎñÆ÷½øÐй¥»÷£¬ÌرðÊÇ»ùÓÚUDPЭÒéµÄÓÉÓÚÆäÊÇÃæÏò·ÇÁ¬½ÓµÄ£¬¸üÈÝÒ×±»ÀûÓÃÀ´¹¥»÷;

¡¡¡¡(3) ·ÓÉÑ¡ÔñÐÅϢЭÒé¹¥»÷(RIP Attacks)¡£Ô­Àí:¹¥»÷ÕßÔÚÍøÉÏ·¢²¼¼ÙµÄ·ÓÉÐÅÏ¢£¬ÔÙͨ¹ýICMPÖض¨ÏòÀ´ÆÛÆ­·þÎñÆ÷·ÓÉÆ÷ºÍÖ÷»ú£¬½«Õý³£µÄ·ÓÉÆ÷±ê־ΪʧЧ£¬´Ó¶ø´ïµ½¹¥»÷µÄÄ¿µÄ¡£

¡¡¡¡(4) TCPÐòÁкÅÆÛÆ­ºÍ¹¥»÷(TCP Sequence Number Spoofing and Attack),»ù±¾ÓÐÈýÖÖ:

¡¡¡¡1. αÔìTCPÐòÁкţ¬¹¹ÔìÒ»¸öαװµÄTCP·â°ü£¬¶ÔÍøÂçÉÏ¿ÉÐÅÖ÷»ú½øÐй¥»÷;

¡¡¡¡2. SYN¹¥»÷(SYN Attack)¡£ÕâÀ๥»÷ÊÖ·¨»¨ÑùºÜ¶à£¬ÎµÎª´ó¹Û¡£µ«ÊÇÆäÔ­Àí»ù±¾Ò»Ö£¬ÈÃTCPЭÒéÎÞ·¨Íê³ÉÈý´ÎÎÕÊÖЭÒé;

¡¡¡¡3. Teardrop¹¥»÷(Teardrop Attack)ºÍLand¹¥»÷(Land Attack)¡£Ô­Àí:ÀûÓÃϵͳ½ÓÊÕIPÊý¾Ý°ü£¬¶ÔÊý¾Ý°ü³¤¶ÈºÍÆ«ÒƲ»ÑϸñµÄ©¶´½øÐеġ£

ÎÊ£ºÈëÇÖÕßÈçºÎ»ñÈ¡¿ÚÁ

¡¡¡¡1¡¢¼àÌýÃ÷ÎÄ¿ÚÁîÐÅÏ¢

¡¡¡¡´óÁ¿µÄͨѶЭÒé±ÈÈçTelnet¡¢Ftp¡¢»ù±¾HTTP¶¼Ê¹ÓÃÃ÷ÎÄ¿ÚÁÕâÒâζ×ÅËüÃÇÔÚÍøÂçÉÏÊdzàÂãÂãµØÒÔδ¼ÓÃܸñʽ´«ÊäÓÚ·þÎñÆ÷¶ËºÍ¿Í»§¶Ë£¬¶øÈëÇÖÕßÖ»ÐèʹÓÃЭÒé·ÖÎöÆ÷¾ÍÄܲ鿴µ½ÕâЩÐÅÏ¢£¬´Ó¶ø½øÒ»²½·ÖÎö³ö¿ÚÁ³ÉΪÕæÓû§µÄ¿Ë¡¡£

¡¡¡¡2¡¢¼àÌý¼ÓÃÜ¿ÚÁîÐÅÏ¢

¡¡¡¡µ±È»£¬¸ü¶àµÄͨѶЭÒéÊÇʹÓüÓÃÜÐÅÏ¢´«Êä¿ÚÁîµÄ¡£Õâʱ£¬ÈëÇÖÕß¾ÍÐèÒª½èÖú×Öµä»òÕß²ÉÓñ©Á¦¹¥»÷·¨À´½âÃÜÁË¡£×¢Ò⣬ÎÒÃDz¢²»Äܲì¾õµ½ÈëÇÖÕߵļàÌýÐÐΪ£¬ÒòΪËûÔÚ°µ´¦£¬ÊÇÍêÈ«±»¶¯µÄ£¬Ã»Óз¢ËÍÈκÎÐÅÏ¢µ½ÍøÂçÉÏ£¬ÈëÇÖÕߵĻúÆ÷½ö±»ÓÃÓÚ·ÖÎöÕâЩ¿ÚÁîÐÅÏ¢¡£

¡¡¡¡3¡¢ÖطŹ¥»÷£¨Replay attack£©

¡¡¡¡ÕâÓÖÊÇÒ»ÖÖ¼ä½ÓµÄ¹¥»÷·½Ê½£¬¾ÍÊÇ˵£ºÈëÇÖÕß²»±Ø¶Ô¿ÚÁî½øÐнâÃÜ£¬ÐèÒªµÄÊÇÖØбàд¿Í»§¶ËÈí¼þÒÔʹÓüÓÃÜ¿ÚÁîʵÏÖϵͳµÇ¼¡£

¡¡¡¡4¡¢ÇÔÈ¡¿ÚÁîÎļþ

¡¡¡¡¿ÚÁîÎļþͨ³£¶¼±£´æÔÚÒ»¸öµ¥¶ÀµÄÎļþÖУ¬ÀýÈçUNIXϵͳµÄ¿ÚÁîÎļþÊÇ/etc/passwd£¨Ò²¿ÉÄÜÊÇÄǸöÎļþµÄ¾µÏñ£©£¬WinNTϵͳµÄ¿ÚÁîÎļþÊÇ/winnt/system32/config/sam¡£ÈëÇÖÕßÒ»µ©»ñÈ¡ÁË¿ÚÁîÎļþ£¬¾Í¿ÉÒÔʹÓÃÆƽâ³ÌÐò·¢ÏÖÆäÖеÄÈõ¿ÚÁîÐÅÏ¢¡£

¡¡¡¡5¡¢¹Û²ì

¡¡¡¡Óû§¿ÉÄÜÓÉÓÚÉèÖõĿÚÁÔÓÄѼǶø½«ËüдÔÚÒ»ÕÅÖ½ÉÏѹÔÚ¼üÅÌÏÂËæʱ²é¿´£¬»òÕßÔÚÊäÈë¿ÚÁîµÄʱºò²»¹ÜÉíºóÓÐûÓÐÕ¾×Åһλ¡°¿´¿Í¡±¡£ÈëÇÖÕßµÄËÑË÷Á¦Óë¼ÇÒäÁ¦¶¼·Ç³£ºÃ£¬ÕâЩ²Ù×÷Ï°¹ß¶ÔËûÃÇÀ´Ëµ¼òÖ±¾ÍÊÇÇáËÉÁ·±ø¡£ËùÒÔ£¬±ðºöÊÓÈëÇÖÕßµÄÑÛ¾¦£¡

¡¡¡¡6¡¢Éç»á¹¤³Ì

¡¡¡¡Ç°ÃæÌáµ½¹ýÕâ¸öÎÊÌ⣬Éç»á¹¤³Ì¾ÍÊÇÖ¸²ÉÓ÷ÇÒþ±Î·½·¨µÁÓ÷ÇÊÚȨÕÊ»§½øÐеķǷ¨»î¶¯£¬±ÈÈçʹÓÃÆäËûÈ˵ĻúÆ÷¡¢Ã°³äÊÇ´¦³¤»ò¾Ö³¤Æ­È¡¹ÜÀíÔ±ÐÅÈεõ½¿ÚÁîµÈµÈ¡£¼Çס£ºÈç¹ûÓÐÈËÏëÒªÄãµÄ¿ÚÁÎÞÂÛËû˵ÊÇΪÁËʲô£¬Çë¼ÇסËû£¬Ò»µ©·¢ÉúÁ˹ØÓÚ¿ÚÁîµÄ°¸¼þ£¬ÄǸöÈ˾ÍÊÇÍ·ºÅÏÓÒÉ·¸£¡

¡¡¡¡ÎÊ£ºµäÐ͵ÄÈëÇÖ³¡¾°ÓÐÄÄЩ£¿

¡¡¡¡ËùνÈëÇÖ³¡¾°£¬¾ÍÊÇÖ¸ÈëÇÖÕ߶¼»á´ÓÄÄЩ·½Ãæ²ÉÈ¡ÄÄЩ²½Öè³¢ÊÔ¹¥»÷ϵͳ¡£µäÐ͵ÄÈëÇÖ»­ÃæÊÇÕâÑùһĻĻչ¿ªµÄ£º

¡¡¡¡1¡¢Íⲿµ÷ÑÐ

¡¡¡¡Öª¼ºÖª±Ë£¬°ÙÕ½²»´ù¡£ÈëÇÖÕß¹¥»÷µÄµÚÒ»²½¾ÍÊǾ¡Ò»ÇпÉÄܶԹ¥»÷Ä¿±ê½øÐе÷ÑÐÒÔ»ñÈ¡³ä×ãµÄ×ÊÁÏ¡£²ÉÈ¡µÄ·½·¨°üÀ¨£ºÊ¹ÓÃwhois¹¤¾ß»ñÈ¡ÍøÂç×¢²áÐÅÏ¢£»Ê¹ÓÃnslookup»òdig¹¤¾ßËÑË÷DNS±íÒÔÈ·¶¨»úÆ÷Ãû³Æ£»ËÑË÷¹ØÓÚ¹«Ë¾µÄ¹«¿ªÐÂÎÅ¡£ÕâÒ»²½¶ÔÓÚ±»¹¥»÷ÕßÊÇÍêÈ«²»ÖªµÄ¡£

¡¡¡¡2¡¢ÄÚ²¿·ÖÎö

¡¡¡¡È·¶¨Á˹¥»÷Ä¿±êµÄ»ù±¾ÊôÐÔ£¨Õ¾µãµØÖ·¡¢Ö÷»úÃû³Æ£©£¬ÈëÇÖÕß½«¶ÔËüÃǽøÐÐÉîÈëÆÊÎö¡£·½·¨ÓУº±éÀúÿ¸öWebÒ³ÃæËÑË÷ÊÇ·ñ´æÔÚCGI©¶´£»Ê¹ÓÃping¹¤¾ßһһ̽Ѱ¡°»î¡±×ŵĻúÆ÷£»¶ÔÄ¿±ê»úÆ÷Ö´ÐÐUDP/TCPɨÃèÒÔ·¢ÏÖÊÇ·ñÓпÉÓ÷þÎñ¡£ÕâЩÐÐΪ¶¼ÊôÓÚÕý³£µÄÍøÂç²Ù×÷£¬»¹²»ÄÜËã×÷ÈëÇÖÐÐΪ£¬µ«ÊÇNIDSϵͳ½«Äܹ»¸æËß¹ÜÀíÕß¡°ÓÐÈËÕýÔÚº³¶¯ÃÅ°ÑÊÖ¡­¡­¡±

¡¡¡¡3¡¢Â©¶´ÀûÓÃ

¡¡¡¡ÏÖÔÚµ½ÁË¿ªÊ¼¶¯ÊÖµÄʱºòÁË£¡ÆÆ»µ»¨ÑùʵÔÚ·±¶à£¬ÔÚ´ËÔñÓÅÁоÙÈçÏ£ºÍ¨¹ýÔÚÊäÈëÏîÄ¿ÖÐдÈë¿ÇÃüÁî×Ö·û´®£¨shell command£©À´¿¼ÑéCGI½Å±¾µÄ°²È«ÐÔ£»Í¨¹ý·¢ËÍ´óÁ¿Êý¾ÝÒÔÈ·¶¨ÊÇ·ñ´æÔÚ³ôÃûÕÑÖøµÄ»º³åÇøÒç³ö©¶´£»³¢ÊÔʹÓüòµ¥¿ÚÁîÆƽâµÇ¼ÕÏ°­¡£µ±È»£¬»ìºÏʹÓöàÖÖ·½Ê½Êǹ¥Õ¼³É¹¦µÄ²»¶þ·¨ÃÅ¡£

¡¡¡¡4¡¢Õ¾ÎȽŸú

¡¡¡¡¶ÔÓÚÈëÇÖÕ߶øÑÔ£¬Ò»µ©³É¹¦µØÈëÇÖÁËÍøÂçÖеÄһ̨»úÆ÷£¬¾Í¿ÉÒÔ˵ÊÇÕ¾ÎȽŸúÁË¡£ÈëÇÖÕßÏÖÔÚÒª×öµÄ¾ÍÊÇÒþ²ØÈëÇÖºÛ¼£²¢ÖÆÔìÈÕºóÔÙ¹¥µÄºóÃÅ£¬Õâ¾ÍÐèÒª¶ÔÈÕÖ¾Îļþ»òÆäËûϵͳÎļþ½øÐиÄÔ죬»òÕß°²×°ÉÏľÂí³ÌÐò¡¢»òÕßÌ滻ϵͳÎļþΪºóÃųÌÐò¡£Õâʱ£¬SIV£¨ÏµÍ³ÍêÕûÐÔ¼ì²â£©ÏµÍ³»á×¢Òâµ½ÕâЩÎļþµÄ±ä»¯¡£ÓÉÓÚÄÚ²¿ÍøÂçÖеݲȫ´ëʩͨ³£¶¼±È½ÏÉÙ£¬½øÒ»²½µØ£¬ÈëÇÖÕß½«ÒÔÕâµÚһ̨»úÆ÷×÷ΪÌø°å£¬¹¥»÷ÍøÂçÖеÄÆäËû»úÆ÷£¬Ñ°ÕÒÏÂÒ»¸ö°²ÉíÖ®¼Ò¡£

¡¡¡¡5¡¢ÏíÊܳɹû

¡¡¡¡µ½´Ë£¬ÈëÇÖÕß¿ÉÒÔ˵ÊÇÍê³ÉÁ˹¥»÷ÈÎÎñ£¬Ê£ÏµľÍÊÇÏíÊܳɹûÁË£º»òÕ߶ÔÇÔÈ¡µÄÃØÃÜÎļþËÁÒâʹÓᢻòÕßÀÄÓÃϵͳ×ÊÔ´¡¢»òÕß´Û¸ÄWebÒ³ÃæÄÚÈÝ£¬ÉõÖÁ½«ÄãµÄ»úÆ÷×÷ΪÌø°å¹¥»÷ÆäËû»úÆ÷¡£

¡¡¡¡ÒÔÉÏÌÖÂÛÊǵÄÓÐÄ¿µÄÈëÇÖÕßµÄͨ³£ÐÐΪ¡£»¹ÓÐÒ»ÖÖÈëÇÖ³¡¾°Í¨³£±»³ÆΪ¡°birthday attack¡±£¬ÎÒÏëÆ京ÒåÊÇÄ£ÄâÉúÈÕʱ½ÓÊÕµ½Ðí¶àÊìÈË»òÕßδ֪ÅóÓѵÄÀñÎï°É£¬²»¹ýÓÃÔÚÕâÀﻹҪÔÚÀñÎïÇ°¼ÓÉÏ¡°¹¥»÷¡±Á½×ÖÁË¡£Birthday attackµÄÒ»°ã²½ÖèÊÇ£ºËæ»úËÑË÷Ò»¸öInternetµØÖ·£»ËÑË÷ÆäÉÏÊÇ·ñÓÐÖ¸¶¨µÄ©¶´£»Èç¹ûÓУ¬¸ù¾ÝÒÑÖªµÄ©¶´ÀûÓ÷½·¨½øÐй¥»÷¡£

¡¡¡¡Ò»¡¢Á½ÖÖÉ豸²úÉúºÍ´æÔڵı³¾°²»Í¬

¡¡¡¡1¡¢Á½ÖÖÉ豸²úÉúµÄ¸ùÔ´²»Í¬

¡¡¡¡Â·ÓÉÆ÷µÄ ²úÉúÊÇ»ùÓÚ¶ÔÍøÂçÊý¾Ý°ü·Óɶø²úÉúµÄ¡£Â·ÓÉÆ÷ÐèÒªÍê³ÉµÄÊǽ«²»Í¬ÍøÂçµÄÊý¾Ý°ü½øÐÐÓÐЧµÄ·ÓÉ£¬ÖÁÓÚΪʲô·ÓÉ¡¢ÊÇ·ñÓ¦¸Ã·ÓÉ¡¢Â·ÓɹýºóÊÇ·ñÓÐÎÊÌâµÈ¸ù±¾²»¹ØÐÄ£¬Ëù¹ØÐĵÄÊÇ:ÄÜ·ñ½«²»Í¬µÄÍø¶ÎµÄÊý¾Ý°ü½øÐзÓÉ´Ó¶ø½øÐÐͨѶ¡£

¡¡¡¡·À»ðǽÊDzúÉúÓÚÈËÃǶÔÓÚ°²È«ÐÔµÄÐèÇó¡£Êý¾Ý°üÊÇ·ñ¿ÉÒÔÕýÈ·µÄµ½´ï¡¢µ½´ïµÄʱ¼ä¡¢·½ÏòµÈ²»ÊÇ·À»ðǽ¹ØÐĵÄÖص㣬ÖصãÊÇÕâ¸ö(һϵÁÐ)Êý¾Ý°üÊÇ·ñÓ¦¸Ãͨ¹ý¡¢Í¨¹ýºóÊÇ·ñ»á¶ÔÍøÂçÔì³ÉΣº¦¡£

¡¡¡¡2¡¢¸ù±¾Ä¿µÄ²»Í¬

¡¡¡¡Â·ÓÉÆ÷µÄ¸ù±¾Ä¿µÄÊÇ:±£³ÖÍøÂçºÍÊý¾ÝµÄ¡°Í¨¡±¡£

¡¡¡¡·À»ðǽ¸ù±¾µÄµÄÄ¿µÄÊÇ:±£Ö¤ÈκηÇÔÊÐíµÄÊý¾Ý°ü¡°²»Í¨¡±¡£

¡¡¡¡¶þ¡¢ºËÐļ¼ÊõµÄ²»Í¬

¡¡¡¡Cisco·ÓÉÆ÷ºËÐĵÄACLÁбíÊÇ»ùÓÚ¼òµ¥µÄ°ü¹ýÂË£¬´Ó·À»ðǽ¼¼ÊõʵÏֵĽǶÈÀ´Ëµ£¬NetEye·À»ðǽÊÇ»ùÓÚ״̬°ü¹ýÂ˵ÄÓ¦Óü¶ÐÅÏ¢Á÷¹ýÂË¡£

¡¡¡¡ÏÂͼÊÇÒ»¸ö×îΪ¼òµ¥µÄÓ¦ÓÃ:ÆóÒµÄÚÍøµÄһ̨Ö÷»ú£¬Í¨¹ý·ÓÉÆ÷¶ÔÄÚÍøÌṩ·þÎñ(¼ÙÉèÌṩ·þÎñµÄ¶Ë¿ÚΪtcp 1455)¡£ÎªÁ˱£Ö¤°²È«ÐÔ£¬ÔÚ·ÓÉÆ÷ÉÏÐèÒªÅäÖóÉ:Íâ-¡·ÄÚ Ö»ÔÊÐíclient·ÃÎÊ serverµÄtcp 1455¶Ë¿Ú£¬ÆäËû¾Ü¾ø¡£

¡¡¡¡Õë¶ÔÏÖÔÚµÄÅäÖ㬴æÔڵݲȫ´àÈõÐÔÈçÏÂ:

¡¡¡¡1¡¢IPµØÖ·ÆÛÆ­(ʹÁ¬½Ó·ÇÕý³£¸´Î»)

¡¡¡¡2¡¢TCPÆÛÆ­(»á»°ÖطźͽٳÖ)

´æÔÚÉÏÊöÒþ»¼µÄÔ­ÒòÊÇ£¬Â·ÓÉÆ÷²»Äܼà²âTCPµÄ״̬¡£Èç¹ûÔÚÄÚÍøµÄclientºÍ·ÓÉÆ÷Ö®¼ä·ÅÉÏNetEye·À»ðǽ£¬ÓÉÓÚNetEye·À»ðǽÄܹ»¼ì²âTCPµÄ״̬£¬²¢ÇÒ¿ÉÒÔÖØÐÂËæ»úÉú³ÉTCPµÄÐòÁкţ¬Ôò¿ÉÒÔ³¹µ×Ïû³ýÕâÑùµÄ´àÈõÐÔ¡£Í¬Ê±£¬NetEye ·À»ðǽµÄÒ»´ÎÐÔ¿ÚÁîÈÏÖ¤¿Í»§¶Ë¹¦ÄÜ£¬Äܹ»ÊµÏÖÔÚ¶ÔÓ¦ÓÃÍêȫ͸Ã÷µÄÇé¿öÏ£¬ÊµÏÖ¶ÔÓû§µÄ·ÃÎÊ¿ØÖÆ£¬ÆäÈÏÖ¤Ö§³Ö±ê×¼µÄRadiusЭÒéºÍ±¾µØÈÏÖ¤Êý¾Ý¿â£¬¿ÉÒÔÍêÈ«ÓëµÚÈý·½µÄÈÏÖ¤·þÎñÆ÷½øÐл¥²Ù×÷£¬²¢Äܹ»ÊµÏÖ½ÇÉ«µÄ»®·Ö¡£

¡¡¡¡ËäÈ»£¬Â·ÓÉÆ÷µÄ"Lock-and-Key"¹¦ÄÜÄܹ»Í¨¹ý¶¯Ì¬·ÃÎÊ¿ØÖÆÁбíµÄ·½Ê½£¬ÊµÏÖ¶ÔÓû§µÄÈÏÖ¤£¬µ«¸ÃÌØÐÔÐèҪ·ÓÉÆ÷ÌṩTelnet·þÎñ£¬Óû§ÔÚʹÓÃʹҲÐèÒªÏÈTelnetµ½Â·ÓÉÆ÷ÉÏ£¬Ê¹ÓÃÆðÀ´²»ºÜ·½±ã£¬Í¬Ê±Ò²²»¹»°²È«(¿ª·ÅµÄ¶Ë¿ÚΪºÚ¿Í´´ÔìÁË»ú»á)¡£

¡¡¡¡Èý¡¢°²È«²ßÂÔÖƶ¨µÄ¸´Ôӳ̶Ȳ»Í¬

¡¡¡¡Â·ÓÉÆ÷µÄĬÈÏÅäÖö԰²È«ÐԵĿ¼ÂDz»¹»£¬ÐèҪһЩ¸ß¼¶ÅäÖòÅÄܴﵽһЩ·À·¶¹¥»÷µÄ×÷Ó㬰²È«²ßÂÔµÄÖƶ¨¾ø´ó¶àÊý¶¼ÊÇ»ùÓÚÃüÁîÐеģ¬ÆäÕë¶Ô°²È«ÐԵĹæÔòµÄÖƶ¨Ïà¶Ô±È½Ï¸´ÔÓ£¬ÅäÖóö´íµÄ¸ÅÂʽϸߡ£

¡¡¡¡NetEye ·À»ðǽµÄĬÈÏÅäÖüȿÉÒÔ·ÀÖ¹¸÷ÖÖ¹¥»÷£¬´ïµ½¼ÈÓüȰ²È«£¬°²È«²ßÂÔµÄÖƶ¨ÊÇ»ùÓÚÈ«ÖÐÎĵÄGUIµÄ¹ÜÀí¹¤¾ß£¬Æ䰲ȫ²ßÂÔµÄÖƶ¨ÈËÐÔ»¯£¬ÅäÖüòµ¥¡¢³ö´íÂʵ͡£

¡¡¡¡ËÄ¡¢¶ÔÐÔÄܵÄÓ°Ï첻ͬ

¡¡¡¡Â·ÓÉÆ÷ÊDZ»Éè¼ÆÓÃÀ´×ª·¢Êý¾Ý°üµÄ£¬¶ø²»ÊÇרÃÅÉè¼Æ×÷ΪȫÌØÐÔ·À»ðǽµÄ£¬ËùÒÔÓÃÓÚ½øÐаü¹ýÂËʱ£¬ÐèÒª½øÐеÄÔËËã·Ç³£´ó£¬¶Ô·ÓÉÆ÷µÄCPUºÍÄÚ´æµÄÐèÒª¶¼·Ç³£´ó£¬¶ø·ÓÉÆ÷ÓÉÓÚÆäÓ²¼þ³É±¾±È½Ï¸ß£¬Æä¸ßÐÔÄÜÅäÖÃʱӲ¼þµÄ³É±¾¶¼±È½Ï´ó¡£

¡¡¡¡NetEye·À»ðǽµÄÓ²¼þÅäÖ÷dz£¸ß(²ÉÓÃͨÓõÄINTELоƬ£¬ÐÔÄܸßÇҳɱ¾µÍ)£¬ÆäÈí¼þҲΪÊý¾Ý°üµÄ¹ýÂ˽øÐÐÁËרÃŵÄÓÅ»¯£¬ÆäÖ÷Ҫģ¿éÔËÐÐÔÚ²Ù×÷ϵͳµÄÄÚºËģʽÏ£¬Éè¼Æ֮ʱÌرð¿¼ÂÇÁË°²È«ÎÊÌ⣬Æä½øÐÐÊý¾Ý°ü¹ýÂ˵ÄÐÔÄܷdz£¸ß¡£

¡¡¡¡ÓÉÓÚ·ÓÉÆ÷ÊǼòµ¥µÄ°ü¹ýÂË£¬°ü¹ýÂ˵ĹæÔòÌõÊýµÄÔö¼Ó£¬NAT¹æÔòµÄÌõÊýµÄÔö¼Ó£¬¶Ô·ÓÉÆ÷ÐÔÄܵÄÓ°Ï춼ÏàÓ¦µÄÔö¼Ó£¬¶øNetEye·À»ðǽ²ÉÓõÄÊÇ״̬°ü¹ýÂË£¬¹æÔòÌõÊý£¬NATµÄ¹æÔòÊý¶ÔÐÔÄܵÄÓ°Ïì½Ó½üÓÚÁã¡£

Îå¡¢Éó¼Æ¹¦ÄܵÄÇ¿Èõ²îÒì¾Þ´ó

¡¡¡¡Â·ÓÉÆ÷±¾ÉíûÓÐÈÕÖ¾¡¢Ê¼þµÄ´æ´¢½éÖÊ£¬Ö»ÄÜͨ¹ý²ÉÓÃÍⲿµÄÈÕÖ¾·þÎñÆ÷(Èçsyslog£¬trap)µÈÀ´Íê³É¶ÔÈÕÖ¾¡¢Ê¼þµÄ´æ´¢;·ÓÉÆ÷±¾ÉíûÓÐÉó¼Æ·ÖÎö¹¤¾ß£¬¶ÔÈÕÖ¾¡¢Ê¼þµÄÃèÊö²ÉÓõÄÊDz»Ì«ÈÝÒ×Àí½âµÄÓïÑÔ;·ÓÉÆ÷¶Ô¹¥»÷µÈ°²È«Ê¼þµÄÏàÓ¦²»ÍêÕû£¬¶ÔÓںܶàµÄ¹¥»÷¡¢É¨ÃèµÈ²Ù×÷²»Äܹ»²úÉú׼ȷ¼°Ê±µÄʼþ¡£Éó¼Æ¹¦ÄܵÄÈõ»¯£¬Ê¹¹ÜÀíÔ±²»Äܹ»¶Ô°²È«Ê¼þ½øÐм°Ê±¡¢×¼È·µÄÏìÓ¦¡£

¡¡¡¡NetEye·À»ðǽµÄÈÕÖ¾´æ´¢½éÖÊÓÐÁ½ÖÖ£¬°üÀ¨±¾ÉíµÄÓ²ÅÌ´æ´¢£¬ºÍµ¥¶ÀµÄÈÕÖ¾·þÎñÆ÷;Õë¶ÔÕâÁ½ÖÖ´æ´¢£¬NetEye ·À»ðǽ¶¼ÌṩÁËÇ¿´óµÄÉó¼Æ·ÖÎö¹¤¾ß£¬Ê¹¹ÜÀíÔ±¿ÉÒԷdz£ÈÝÒ×·ÖÎö³ö¸÷ÖÖ°²È«Òþ»¼;NetEye ·À»ðǽ¶Ô°²È«Ê¼þµÄÏìÓ¦µÄ¼°Ê±ÐÔ£¬»¹ÌåÏÖÔÚËûµÄ¶àÖÖ±¨¾¯·½Ê½ÉÏ£¬°üÀ¨·äÃù¡¢trap¡¢Óʼþ¡¢ÈÕÖ¾;NetEye ·À»ðǽ»¹¾ßÓÐʵʱ¼à¿Ø¹¦ÄÜ£¬¿ÉÒÔÔÚÏß¼à¿Øͨ¹ý·À»ðǽµÄÁ¬½Ó£¬Í¬Ê±»¹¿ÉÒÔ²¶×½Êý¾Ý°ü½øÐзÖÎö£¬·Ç·ÖÎöÍøÂçÔËÐÐÇé¿ö£¬ÅųýÍøÂç¹ÊÕÏÌṩÁË·½±ã¡£

¡¡¡¡Áù¡¢·À·¶¹¥»÷µÄÄÜÁ¦²»Í¬

¡¡¡¡¶ÔÓÚÏñCiscoÕâÑùµÄ·ÓÉÆ÷£¬ÆäÆÕͨ°æ±¾²»¾ßÓÐÓ¦ÓòãµÄ·À·¶¹¦ÄÜ£¬²»¾ßÓÐÈëÇÖʵʱ¼ì²âµÈ¹¦ÄÜ£¬Èç¹ûÐèÒª¾ßÓÐÕâÑùµÄ¹¦ÄÜ£¬¾ÍÐèÒªÉú¼¶Éý¼¶IOSΪ·À»ðǽÌØÐÔ¼¯£¬´Ëʱ²»µ¥Òª³Ðµ£Èí¼þµÄÉý¼¶·ÑÓã¬Í¬Ê±ÓÉÓÚÕâЩ¹¦Äܶ¼ÐèÒª½øÐдóÁ¿µÄÔËË㣬»¹ÐèÒª½øÐÐÓ²¼þÅäÖõÄÉý¼¶£¬½øÒ»²½Ôö¼ÓÁ˳ɱ¾£¬¶øÇҺܶ೧¼ÒµÄ·ÓÉÆ÷²»¾ßÓÐÕâÑùµÄ¸ß¼¶°²È«¹¦ÄÜ¡£¿ÉÒԵóö:

¡¡¡¡¡¤¾ßÓзÀ»ðǽÌØÐԵķÓÉÆ÷³É±¾ > ·À»ðǽ + ·ÓÉÆ÷

¡¡¡¡¡¤¾ßÓзÀ»ðǽÌØÐԵķÓÉÆ÷¹¦ÄÜ < ·À»ðǽ + ·ÓÉÆ÷

¡¡¡¡¡¤¾ßÓзÀ»ðǽÌØÐԵķÓÉÆ÷¿ÉÀ©Õ¹ÐÔ < ·À»ðǽ + ·ÓÉÆ÷

¡¡¡¡×ÛÉÏËùÊö£¬¿ÉÒԵóö½áÂÛ:Óû§µÄÍøÂçÍØÆ˽ṹµÄ¼òµ¥Ó븴ÔÓ¡¢Óû§Ó¦ÓóÌÐòµÄÄÑÒ׳̶Ȳ»ÊǾö¶¨ÊÇ·ñÓ¦¸ÃʹÓ÷À»ðǽµÄ±ê×¼£¬¾ö¶¨Óû§ÊÇ·ñʹÓ÷À»ðǽµÄÒ»¸ö¸ù±¾Ìõ¼þÊÇÓû§¶ÔÍøÂ簲ȫµÄÐèÇó!

¡¡¡¡¼´Ê¹Óû§µÄÍøÂçÍØÆ˽ṹºÍÓ¦Óö¼·Ç³£¼òµ¥£¬Ê¹Ó÷À»ðǽÈÔÈ»ÊDZØÐèµÄºÍ±ØÒªµÄ;Èç¹ûÓû§µÄ»·¾³¡¢Ó¦ÓñȽϸ´ÔÓ£¬ÄÇô·À»ðǽ½«Äܹ»´øÀ´¸ü¶àµÄºÃ´¦£¬·À»ðǽ½«ÊÇÍøÂ罨ÉèÖв»¿É»òȱµÄÒ»²¿·Ö£¬¶ÔÓÚͨ³£µÄÍøÂçÀ´Ëµ£¬Â·ÓÉÆ÷½«ÊDZ£»¤ÄÚ²¿ÍøµÄµÚÒ»µÀ¹Ø¿Ú£¬¶ø·À»ðǽ½«ÊǵڶþµÀ¹Ø¿Ú£¬Ò²ÊÇ×îΪÑϸñµÄÒ»µÀ¹Ø¿Ú¡£

    ˵Ã÷£ºPWSteal.Lemir.Gen ÊǶÔÒ»ÀàÇÔºÅľÂíµÄͳ³Æ£¬Õâ¸ö·½·¨Ö»ÊÊÓÃÓÚľÂíÖ÷±¾ÎļþΪ Expl0rer.exe µÄ PWSteal.Lemir.Gen Ä¾Âí£¬ÔÚʹÓô˷½·¨Ç°ÇëÏÈÈ·±£×Ô¼ºÓöµ½µÄÊÇÕâ¸öľÂí²Å¿ÉÒÔ¡£ Í¬ÑùµÄ£¬ÎÄÕÂÖÐËùÌáµ½µÄ·½·¨¼°ÆäÖÐËùÌáµ½µÄÓйطѶûÍÐ˹ÌØ°²È«¿ÉÒÔÇå³ý´ËľÂí/²¡¶¾µÄÄÚÈÝÊÇÌØÖ¸ÕâÒ»¸öľÂí/²¡¶¾µÄµ±Ç°ÕâÒ»°æ±¾£¬ ²¢²»±£Ö¤¶Ô´ËľÂí/²¡¶¾µÄÒÔÇ°¾É°æ±¾ºÍÒÔºóËùÓпÉÄܲúÉú³öµÄа汾¶¼Í¬ÑùÓÐЧ¡£  

    ÓÐÐí¶àÓû§·´Ó¦Ò»Ð©É±¶¾Èí¼þÔÚ·¢ÏÖ PWSteal.Lemir.Gen(SysModule32.DLL,SysModule64.DLL) Ä¾ÂíºóÓöµ½ÎÞ·¨¸ôÀ롢ɾ³ý»òÊÇÇå³ýºó·´¸´³öÏÖµÄÎÊÌâ¡£ÏÂÃæ¾Í¸æËß´ó¼ÒÒ»¸öÇå³ý´ËľÂí¼òµ¥ÓÐЧµÄ·½·¨£º  

    ÒòΪ´ËľÂí»á½«×Ô¼º×¢²áΪϵͳ Explorer ×é¼þ£¬¼´Ê¹É¾³ýºóÒ²»á×Ô¶¯Éú³É£¬ËùÒÔÒ»°ãµÄɱ¶¾Èí¼þ½ÏÄÑÖ±½ÓÇå³ýµôËü£¬µ«·Ñ¶ûÍÐ˹ÌØ°²È«¿ÉÒÔÍêÈ«³¹µ×Çå³ýµô´ËľÂí£¬²¢ÇÒɾ³ýºó²»»áÔٴγöÏÖ£¬ËùÒÔÈç¹ûÊÖÉÏÓзѶûÍÐ˹ÌØ°²È«µÄÕýʽ°æ¿ÉÒÔʹÓÃËüɾ³ý£¨½¨ÒéÏÈÉý¼¶µ½×îаæµÄ²¡¶¾¿â£©¡£Èç¹ûûÓÐÒ²¿ÉÒÔÓÃÏÂÃæµÄ·½·¨ÊÖ¹¤Çå³ýËü£¨×¢ÒâÒÔÏ·½·¨²âÊÔÓÚWindows2000/XP/2003/NT£¬9x/meÏ¿ÉÄÜÓÐЩÂÔÓв»Í¬£¬Õâʱ½¨ÒéʹÓ÷ѶûÍÐ˹ÌØ°²È«Çå³ý£©£º  

    Ò»¡¢ÇëÏÈÈ¥°ÑϵͳÉèÖÃΪ¡°ÏÔʾÒþ²ØÎļþ¡±£¬ÒòΪ²¡¶¾ÒÔÒþ²ØÊôÐÔαװ£¬²»×ö´ËÉèÖý«ÎÞ·¨¿´µ½Ëü£¬ÉèÖõķ½·¨ÈçÏ£¨Èç¹ûϵͳÒѾ­×öÁË´ËÉèÖÿÉÒÔÌø¹ýÕâÒ»²½£©£º

´ò¿ª¡°ÎҵĵçÄÔ¡±£» 
ÒÀ´Î´ò¿ª²Ëµ¥¡°¹¤¾ß/Îļþ¼ÐÑ¡Ï£» 
È»ºóÔÚµ¯³öµÄ¡°Îļþ¼ÐÑ¡Ï¶Ô»°¿òÖÐÇл»µ½¡°²é¿´¡±Ò³£» 
È¥µô¡°Òþ²ØÊܱ£»¤µÄ²Ù×÷ϵͳÎļþ(ÍƼö)¡±Ç°ÃæµÄ¶Ô¹³£¬ÈÃËü±äΪ²»Ñ¡×´Ì¬£» 
ÔÚÏÂÃæµÄ¡°¸ß¼¶ÉèÖá±Áбí¿òÖиı䡰²»ÏÔʾÒþ²ØµÄÎļþºÍÎļþ¼Ð¡±Ñ¡ÏîΪ¡°ÏÔʾËùÓÐÎļþºÍÎļþ¼Ð¡±Ñ¡Ï 
È¥µô¡°Òþ²ØÒÑÖªÎļþÀàÐ͵ÄÀ©Õ¹Ãû¡±Ç°ÃæµÄ¶Ô¹³£¬Ò²ÈÃËü±äΪ²»Ñ¡×´Ì¬£» 
×îºóµã»÷¡°È·¶¨¡±¡£

    ¶þ¡¢°´¡°Ctrl+Alt+Del¡±¼üµ¯³öÈÎÎñ¹ÜÀíÆ÷£¬ÕÒµ½EXPL0RER.EXE½ø³Ì£¨×¢ÒâµÚ5¸ö×ÖĸÊÇÊý×Ö0²»ÊÇ×ÖĸO£©£¬ÕÒµ½ËüºóÑ¡ÖÐËü²¢µã»÷¡°½áÊø½ø³Ì¡±ÒÔ½áÊøµôľÂí½ø³Ì¡£È»ºóѸËÙ×öÏÂÃæÒ»²½£¬Ö»ËùÒÔҪѸËÙÊÇÒòΪÈç¹û¶¯×÷ÂýµÄ»°£¬Ä¾Âí¿ÉÄÜ»á×Ô¶¯»Ö¸´¶øÔÙ´ÎÔËÐÐÆðÀ´£¬ÕâÑù¾ÍÎÞ·¨É¾³ýµôÆäËûľÂíÎļþÁË£¨Èç¹ûEXPL0RER.EXE½ø³ÌÔÙ´ÎÔËÐÐÆðÀ´ÐèÒªÖØ×öÕâÒ»²½£©£»  

    Èý¡¢´ò¿ª×ÊÔ´¹ÜÀíÆ÷½øÈëµ½ ¡°ÏµÍ³Ä¿Â¼\Winnt\System32¡±Ï£¨Èç¹ûÄúµÄwin2000/nt/xp°²×°ÔÚCÅÌÔò¾ÍÊÇ C:\Winnt\System32£©¡£ÕÒµ½EXPL0RER.EXEÎļþ£¨×¢ÒâµÚ5¸ö×ÖĸÊÇÊý×Ö0²»ÊÇ×ÖĸO£©¡¢SysModule32.dllÎļþ£¬È»ºóÖ±½Óɾ³ýËüÃÇ¡£Èç¹ûÕâʱ±¨¸æ¡°ÎļþÕýÔÚʹÓÃÎÞ·¨É¾³ý¡±µÄÀàËÆÌáʾÔò˵Ã÷ľÂíÒѾ­Ôٴλָ´ÁË£¬ÐèÒª´ÓµÚ¶þ²½¿ªÊ¼Öظ´×ö£¬²¢ÇÒ´ÓµÚ¶þ²½µ½µÚÈý²½Ò»¶¨ÒªÑ¸ËÙ£¬ÕâÀｨÒé¿ÉÒÔÏÈ´ò¿ª×ÊÔ´¹ÜÀíÆ÷Ñ¡ÖÐÕ⼸¸ö´ýɾ³ýµÄÎļþ£¬ÔÚ×öµÚ¶þ²½¼´¸Õ½áÊøµôEXPL0RER.EXE½ø³ÌºóÂíÉÏת¹ýÀ´É¾³ýÕâ2¸öÎļþ£¬ÕâÑùÒ»°ã¾Í¿ÉÒԳɹ¦ÁË£»  

    ËÄ¡¢Í¬ÑùÔÚ ¡°ÏµÍ³Ä¿Â¼\Winnt\System32¡±Ä¿Â¼ÏÂÕÒµ½ SysModule64.dll Îļþ£¬³¢ÊÔɾ³ýËü£¬²»¹ýÈç¹ûÕâʱ±¨¸æ¡°´ËÎļþÕýÔÚʹÓÃÖÐÎÞ·¨É¾³ý¡±µÈÀàËÆÌáʾҲûÓйØϵ£¬ÉÔºóÔÚµÚÆß²½½«½éÉÜÈçºÎɾ³ý´ËÎļþ£»  

    Îå¡¢´ò¿ª×ÊÔ´¹ÜÀíÆ÷½øÈëµ½ ¡°ÏµÍ³Ä¿Â¼\Winnt¡±Ï£¬ÕÒµ½Ò»¸ö MFCD3O.DLL Îļþ£¬ÊÖ¹¤É¾³ýËü£»  

    Áù¡¢´ò¿ª¡°¿ªÊ¼/ÔËÐС±£¬ÊäÈë¡°regedit¡±ºó¡°È·¶¨¡±ÒÔ´ò¿ª×¢²á±í±à¼­Æ÷£¬ÕÒµ½¡°HKEY_CLASSES_ROOT\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}¡±¼ü£¬°ÑÕû¸ö¡°{081FE200-A103-11D7-A46D-C770E4459F2F}¡±¼üÈ«²¿É¾³ý¡£  

    Æß¡¢×¢Ïúµ±Ç°Óû§»òÖØеǼ»òÖØÆôµçÄÔ¡£Ö®ºóÔÙ°´µÚËIJ½µÄ·½·¨É¾³ýµô SysModule64.dll Îļþ£¬Èç¹ûÒ»ÇÐÕý³£´ËʱӦ¸Ã¿ÉÒÔɾ³ýµôËüÁË¡£  

    ÖÁ´Ë£¬Èç¹ûÒ»ÇÐ˳Àû PWSteal.Lemir.Gen Ä¾Âí¾ÍÓ¦¸ÃÍêÈ«´ÓÄúϵͳÖÐÇå³ý¸É¾»ÁË¡£

1ÔÂ30ÈÕÏûÏ¢£¬¹ú¼Ò¼ÆËã»úÍøÂçÓ¦¼±¼¼Êõ´¦ÀíЭµ÷ÖÐÐÄ(CNCERT)·¢²¼°²È«¹«¸æ£¬Ë¼¿ÆϵͳÖдæÔÚµÄÈý¸ö°²È«Â©¶´£¬´Ë´Î©¶´Ó°ÏìËùÓÐÔËÐÐIOSµÄ˼¿ÆÉ豸¡£CNCERT¼¼Êõר¼ÒÖ¸³ö£º¡°ÓÉÓÚÎÒ¹úµçÐÅ¡¢Íøͨ¡¢Òƶ¯¡¢ÁªÍ¨¡¢ÌúͨµÈÎå´ó»ù´¡ÔËÓªÉ̺ËÐÄ·ÓÉÆ÷¾ùʹÓÃ˼¿Æ²úÆ·£¬Òò´Ë©¶´¶ÔÎÒ¹úµÄ¹Ç¸ÉÍø°²È«´æÔÚDZÔÚÍþв¡£Îª±£ÕϹ«¹²»¥ÁªÍø°²È«£¬ÇëÏà¹ØÓû§¼°Ê±ÐÞ²¹Â©¶´¡£¡±

ÕâÊǼÌ2004Äê4ÔÂ˼¿ÆTCP©¶´ºó£¬ÈýÄêÀ´CNCERTµÚÒ» ´Î·¢²¼Ë¼¿ÆÉ豸©¶´¡£CNCERT½üÈýÄêµÄËùÓй«¸æ£¬ÒÔ΢Èí¾Ó¶à£¬É漰˼¿Æ½ö´ËÁ½´Î¡£

˼¿Æ¹«Ë¾ÔÚ1ÔÂ25ÈÕ·¢²¼ÁËÆäIOSÖеÄÈý¸ö©¶´¹«¸æ£¬°üÀ¨Cisco IOS TCP°ü´¦Àí©¶´¡¢Cisco IOS IPv4αÔì°ü©¶´¡¢Cisco IOS IPv6αÔì°ü©¶´¡£Ô¶³Ì¹¥»÷Õß¿ÉÒÔÀûÓÃIOSÖеÄ©¶´ÈÃÊÜÓ°ÏìµÄÉ豸ÖØÔزÙ×÷ϵͳ¡£ÔÚÖØÔØÆڼ䣬ÓÉÓÚÊý¾Ý°ü²»Äܹ»±»ÕýÈ·´¦Àí£¬Êµ¼ÊÉÏÏ൱Óھܾø·þÎñ¹¥»÷£¬³ÖÐøÀûÓ鶴×ÔÈ»»áÔì³É³ÖÐøµÄ¾Ü¾ø·þÎñ¹¥»÷¡£

˼¿ÆÒѾ­ÌṩÁËÐÞ¸´È«²¿Â©¶´µÄÈí¼þ£¬¿É´ÓÆä¹Ù·½ÍøÕ¾ÏÂÔØ¡£

2¡¢NbtScan 1.5.1Èí¼þÏÂÔØ

ÓйØARP²¡¶¾ÎÊÌâµÄ´¦Àí˵Ã÷:

¹ÊÕÏÏÖÏó £º»úÆ÷ÒÔÇ°¿ÉÕý³£ÉÏÍøµÄ£¬Í»È»³öÏÖ¿ÉÈÏÖ¤£¬²»ÄÜÉÏÍøµÄÏÖÏó£¨ÎÞ·¨pingͨÍø¹Ø£©£¬ÖØÆô»úÆ÷»òÔÚMSDOS´°¿ÚÏÂÔËÐÐÃüÁîARP -dºó£¬Óֿɻָ´ÉÏÍøÒ»¶Îʱ¼ä¡£

¹ÊÕÏÔ­Òò£ºÕâÊÇAPR²¡¶¾ÆÛÆ­¹¥»÷Ôì³ÉµÄ¡£
¡¡¡¡
ÒýÆðÎÊÌâµÄÔ­ÒòÒ»°ãÊÇÓÉ´«ÆæÍâ¹ÒЯ´øµÄARPľÂí¹¥»÷¡£µ±ÔÚ¾ÖÓòÍøÄÚʹÓÃÉÏÊöÍâ¹Òʱ£¬Íâ¹ÒЯ´øµÄ²¡¶¾»á½«¸Ã»úÆ÷µÄMACµØÖ·Ó³Éäµ½Íø¹ØµÄIPµØÖ·ÉÏ£¬Ïò¾ÖÓòÍøÄÚ´óÁ¿·¢ËÍARP°ü£¬´Ó¶øÖÂʹͬһÍø¶ÎµØÖ·ÄÚµÄÆäËü»úÆ÷Îó½«Æä×÷ΪÍø¹Ø£¬Õâ¾ÍÊÇΪʲôµôÏßʱÄÚÍøÊÇ»¥Í¨µÄ£¬¼ÆËã»úÈ´²»ÄÜÉÏÍøµÄÔ­Òò¡£

ÁÙʱ´¦Àí¶Ô²ß£º
¡¡¡¡²½ÖèÒ». ÔÚÄÜÉÏÍøʱ£¬½øÈëMS-DOS´°¿Ú£¬ÊäÈëÃüÁarp ¨Ca ²é¿´Íø¹ØIP¶ÔÓ¦µÄÕýÈ·MACµØÖ·£¬½«Æä¼Ç¼ÏÂÀ´¡£
      ×¢£ºÈç¹ûÒѾ­²»ÄÜÉÏÍø£¬ÔòÏÈÔËÐÐÒ»´ÎÃüÁîarp ¨Cd½«arp»º´æÖеÄÄÚÈÝɾ¿Õ£¬¼ÆËã»ú¿ÉÔÝʱ»Ö¸´ÉÏÍø£¨¹¥»÷Èç¹û²»Í£Ö¹µÄ»°£©£¬Ò»µ©ÄÜÉÏÍø¾ÍÁ¢¼´½«ÍøÂç¶Ïµô£¨½ûÓÃÍø¿¨»ò°ÎµôÍøÏߣ©£¬ÔÙÔËÐÐarp ¨Ca¡£

²½Öè¶þ. Èç¹ûÒѾ­ÓÐÍø¹ØµÄÕýÈ·MACµØÖ·£¬ÔÚ²»ÄÜÉÏÍøʱ£¬ÊÖ¹¤½«Íø¹ØIPºÍÕýÈ·MAC°ó¶¨£¬¿ÉÈ·±£¼ÆËã»ú²»ÔÙ±»¹¥»÷Ó°Ïì¡£ÊÖ¹¤°ó¶¨¿ÉÔÚMS-DOS´°¿ÚÏÂÔËÐÐÒÔÏÂÃüÁ arp ¨Cs Íø¹ØIP Íø¹ØMAC

ÀýÈ磺¼ÙÉè¼ÆËã»úËù´¦Íø¶ÎµÄÍø¹ØΪ218.197.192.254£¬±¾»úµØַΪ218.197.192.1ÔÚ¼ÆËã»úÉÏÔËÐÐarp ¨CaºóÊä³öÈçÏ£º

C:\Documents and Settings>arp -a
Interface: 218.197.192.1 --- 0x2
Internet Address Physical Address Type
218.197.192.254 00-01-02-03-04-05 dynamic

ÆäÖÐ00-01-02-03-04-05¾ÍÊÇÍø¹Ø218.197.192.254¶ÔÓ¦µÄMACµØÖ·£¬ÀàÐÍÊǶ¯Ì¬£¨dynamic£©µÄ£¬Òò´ËÊǿɱ»¸Ä±ä¡£
±»¹¥»÷ºó£¬ÔÙÓøÃÃüÁî²é¿´£¬¾Í»á·¢ÏÖ¸ÃMACÒѾ­±»Ìæ»»³É¹¥»÷»úÆ÷µÄMAC£¬Èç¹û´ó¼ÒÏ£ÍûÄÜÕÒ³ö¹¥»÷»úÆ÷£¬³¹µ×¸ù³ý¹¥»÷£¬¿ÉÒÔÔÚ´Ëʱ½«¸ÃMAC¼Ç¼ÏÂÀ´£¬ÎªÒÔºó²éÕÒ×ö×¼±¸¡£

ÊÖ¹¤°ó¶¨µÄÃüÁîΪ£º
arp ¨Cs 218.197.192.254 00-01-02-03-04-05

°ó¶¨Í꣬¿ÉÔÙÓÃarp ¨Ca²é¿´arp»º´æ£¬
C:\Documents and Settings>arp -a
Interface: 218.197.192.1 --- 0x2
Internet Address Physical Address Type
218.197.192.254 00-01-02-03-04-05 static

Õâʱ£¬ÀàÐͱäΪ¾²Ì¬£¨static£©£¬¾Í²»»áÔÙÊܹ¥»÷Ó°ÏìÁË¡£µ«ÊÇ£¬ÐèҪ˵Ã÷µÄÊÇ£¬ÊÖ¹¤°ó¶¨ÔÚ¼ÆËã»ú¹Ø»úÖØ¿ª»úºó¾Í»áʧЧ£¬ÐèÒªÔٰ󶨡£ËùÒÔ£¬Òª³¹µ×¸ù³ý¹¥»÷£¬Ö»ÓÐÕÒ³öÍø¶ÎÄÚ±»²¡¶¾¸ÐȾµÄ¼ÆËã»ú£¬ÁîÆäɱ¶¾£¬·½¿É½â¾ö¡£ÕÒ³ö²¡¶¾¼ÆËã»úµÄ·½·¨£º

Èç¹ûÒÑÓв¡¶¾¼ÆËã»úµÄMACµØÖ·£¬¿ÉʹÓÃNBTSCANÈí¼þÕÒ³öÍø¶ÎÄÚÓë¸ÃMACµØÖ·¶ÔÓ¦µÄIP£¬¼´²¡¶¾¼ÆËã»úµÄIPµØÖ·£¬È»ºó¿É±¨¸æУÍøÂçÖÐÐĶÔÆä½øÐвé·â¡£

NBTSCANµÄʹÓ÷½·¨£º
ÏÂÔØnbtscan.rarµ½Ó²Å̺ó½âѹ£¬È»ºó½«cygwin1.dllºÍnbtscan.exeÁ½Îļþ¿½±´µ½c:\windows\system32(»òsystem)Ï£¬½øÈëMSDOS´°¿Ú¾Í¿ÉÒÔÊäÈëÃüÁ

nbtscan -r 218.197.192.0/24 £¨¼ÙÉè±¾»úËù´¦µÄÍø¶ÎÊÇ218.197.192£¬ÑÚÂëÊÇ255.255.255.0£»Êµ¼ÊʹÓøÃÃüÁîʱ£¬Ó¦½«Ð±Ìå×Ö²¿·Ö¸ÄΪÕýÈ·µÄÍø¶Î£© ¡£

×¢£ºÊ¹ÓÃnbtscanʱ£¬ÓÐʱÒòΪÓÐЩ¼ÆËã»ú°²×°·À»ðǽÈí¼þ£¬nbtscanµÄÊä³ö²»È«£¬µ«ÔÚ¼ÆËã»úµÄarp»º´æÖÐÈ´ÄÜÓÐËù·´Ó¦£¬ËùÒÔʹÓÃnbtscanʱ£¬»¹¿Éͬʱ²é¿´arp»º´æ£¬¾ÍÄܵõ½±È½ÏÍêÈ«µÄÍø¶ÎÄÚ¼ÆËã»úIPÓëMACµÄ¶ÔÓ¦¹Øϵ¡£
²¹³äһϣº
Anti ARP Sniffer ʹÓÃ˵Ã÷

Ò»¡¢¹¦ÄÜ˵Ã÷:

    ʹÓÃAnti ARP Sniffer¿ÉÒÔ·ÀÖ¹ÀûÓÃARP¼¼Êõ½øÐÐÊý¾Ý°ü½ØÈ¡ÒÔ¼°·ÀÖ¹ÀûÓÃARP¼¼Êõ·¢Ë͵ØÖ·³åÍ»Êý¾Ý°ü¡£

¶þ¡¢Ê¹ÓÃ˵Ã÷£º

    1¡¢ARPÆÛÆ­£º

     ÌîÈëÍø¹ØIPµØÖ·£¬µã»÷£Û»ñÈ¡Íø¹ØmacµØÖ·£Ý½«»áÏÔʾ³öÍø¹ØµÄMACµØÖ·¡£µã»÷[×Ô¶¯·À»¤]¼´¿É±£»¤µ±Ç°Íø¿¨Óë¸ÃÍø¹ØµÄͨÐŲ»»á±»µÚÈý·½¼àÌý¡£

    ×¢Ò⣺Èç³öÏÖARPÆÛÆ­Ìáʾ£¬Õâ˵Ã÷¹¥»÷Õß·¢ËÍÁËARPÆÛÆ­Êý¾Ý°üÀ´»ñÈ¡Íø¿¨µÄÊý¾Ý°ü£¬Èç¹ûÄúÏë×·×Ù¹¥»÷À´Ô´Çë¼Çס¹¥»÷ÕßµÄMACµØÖ·£¬ÀûÓÃMACµØַɨÃèÆ÷¿ÉÒÔÕÒ³öIP ¶ÔÓ¦µÄMACµØÖ·¡£

Fortify Software¹«Ë¾½øÐÐÁË6¸ö¶àÔµÄËѼ¯»ã±à²ÅµÃ³ö´Ë±¨¸æ£¬ËùÓÃÊý¾ÝÀ´Ô´ÓÚÆäÓ¦Ó÷ÀÓùϵͳ£¨Application Defense£©µÄÓû§£¬±¨¸æÖ¸³ö£¬ÓëÒÑÈ·¶¨µÄ¹¥»÷£¨È粡¶¾¡¢ÍøÂç¹¥»÷¡¢¹«¹²È±Ïݹ«²¼¡¢À¬»øÓʼþ»òÍøÂçµöÓãÆóͼµÈ£©Ïà±È£¬ÓйØWebÓ¦ÓÃÎÊÌâµÄÊý¾Ý»¹ºÜȱ·¦¡£

ÔÚFortify¸ø³öµÄ¸÷ÀàÓ¦Óù¥»÷ÁбíÖУ¬ ÅÅÔÚ×îÇ°ÃæµÄÊǸ÷ÖÖ×Ô¶¯¡°»úÆ÷È˹¥»÷£¨bots storms£©¡±£¬ÕâÀ๥»÷ͨ³£Õ¼Õë¶ÔWebÓ¦ÓõÄËùÓй¥»÷µÄ50£¥ÖÁ70£¥¡£ÕâЩ¹¥»÷ÄÜËæ»úËÑË÷ÒÑÖª»òδ֪µÄȱÏÝ£¬¶ø²»ÐèÒªÈ˹¤¸ÉÔ¤£¬µ¼ÖÂÆäÔ½À´Ô½Á÷ÐС£

ÓÐЩÀàÐ͵Ĺ¥»÷ÊýÁ¿½ÏÉÙ£¬µ«¸ü¼ÓΣÏÕ£¬Èç¿çÕ¾µã½Å±¾¡¢SQL×¢È루SQL injection£©£¬ÒÔ¼°±ê×¼»º³åÇøÒç³ö¡£Fortify¹«Ë¾µÄBrian Chess˵£¬ÆóÒµ±ØÐëÈÏʶµ½×Ô¼ºµÄ¸÷ÖÖÓ¦ÓõķçÏÕ£¬²¢²ÉÈ¡±ØÒªµÄÊÖ¶ÎÀ´±ÜÃâΣÏյݲȫ¹¥»÷¡£ÓÐÐí¶àµ÷²éÑо¿ÂÛ¼°Á˲¡¶¾¡¢ÍøÂç¹¥»÷¡¢¹«¹²È±Ïݹ«²¼¡¢À¬»øÓʼþºÍÍøÂçµöÓãÆóͼ£¬µ«ºÜÉÙ¹ØעλÓÚ·À»ðǽºÍ´«Í³ÍøÂ簲ȫ·¶³ëÖ®ÍâµÄ»ùÓÚWebµÄÓ¦Óá£

¡¡¡¡ÆäÃüÁîÐÐϵÄʹÓ÷½·¨Îª:Rundll32.exe DLLname,Functionname [Arguments]

¡¡¡¡Void CALLBACK FunctionName (

¡¡¡¡HWND hwnd,

¡¡¡¡HINSTANCE hinst,

¡¡¡¡LPTSTR lpCmdLine,

¡¡¡¡Int nCmdShow

¡¡¡¡);

¡¡¡¡DLLnameΪÐèÒªÖ´ÐеÄDLLÎļþÃû;FunctionnameΪǰ±ßÐèÒªÖ´ÐеÄDLLÎļþµÄ¾ßÌåÒý³öº¯Êý;[Arguments]ΪÒý³öº¯ÊýµÄ¾ßÌå²ÎÊý¡£

¡¡¡¡(2)£¬Ì滻ϵͳÖеÄDLLÎļþ

¡¡¡¡ÕâÀàºóÞͱÈÉϱߵÄÏȽøÁËһЩ£¬Ëü°ÑʵÏÖÁ˺óÃŹ¦ÄܵĴúÂë×ö³ÉÒ»¸öºÍϵͳƥÅäµÄDLLÎļþ£¬²¢°ÑÔ­À´µÄDLLÎļþ¸ÄÃû¡£Óöµ½Ó¦ÓóÌÐòÇëÇóÔ­À´µÄDLLÎļþʱ£¬ DLLºóÞÍÆôÒ»¸öת·¢µÄ×÷Ó㬰Ñ"²ÎÊý"´«µÝ¸øÔ­À´µÄDLLÎļþ;Èç¹ûÓöµ½ÌØÊâµÄÇëÇóʱ(±ÈÈç¿Í»§¶Ë)£¬DLLºóÞͿªÊ¼£¬Æô¶¯²¢ÔËÐÐÁË¡£¶ÔÓÚÕâÀàºóÃÅ£¬°ÑËùÓвÙ×÷¶¼ÔÚDLLÎļþÖÐʵÏÖ×îΪ°²È«£¬µ«ÐèÒªµÄ±à³Ì֪ʶҲ·Ç³£¶à£¬Ò²·Ç³£²»ÈÝÒ×±àд¡£ËùÒÔ£¬ÕâÀàºóÃÅÒ»°ã¶¼ÊÇ°ÑDLLÎļþ×ö³ÉÒ»¸ö"Æô¶¯"Îļþ£¬ÔÚÓöµ½ÌØÊâµÄÇé¿öÏÂ(±ÈÈç¿Í»§¶ËµÄÇëÇó)£¬¾ÍÆô¶¯Ò»¸öÆÕͨµÄEXEºóÃÅ;ÔÚ¿Í»§¶Ë½áÊøÁ¬½ÓÖ®ºó£¬°ÑEXEºóÃÅÍ£Ö¹£¬È»ºóDLLÎļþ½øÈë"ÐÝÏ¢"״̬£¬ÔÚÏ´οͻ§¶ËÁ¬½Ó֮ǰ£¬¶¼²»»áÆô¶¯¡£µ«Ëæ×Å΢ÈíµÄ"Êý×ÖÇ©Ãû"ºÍ"Îļþ»Ö¸´"µÄ¹¦Äܳǫ̈£¬ÕâÖÖºóÃÅÒѾ­Öð²½Ë¥Âä¡£

¡¡¡¡Ìáʾ:

¡¡¡¡ÔÚWINNT\system32Ŀ¼Ï£¬ÓÐÒ»¸ödllcacheÎļþ¼Ð£¬Àï±ß´æ·Å×ÅÖÚ¶àDLLÎļþ(Ò²°üÀ¨Ò»Ð©ÖØÒªµÄEXEÎļþ)£¬ÔÚDLLÎļþ±»·Ç·¨ÐÞ¸ÄÖ®ºó£¬ÏµÍ³¾Í´ÓÕâÀïÀ´»Ö¸´±»Ð޸ĵÄDLLÎļþ¡£Èç¹ûÒªÐÞ¸Äij¸öDLLÎļþ£¬Ê×ÏÈÓ¦¸Ã°ÑdllcacheĿ¼ÏµÄͬÃûDLLÎļþɾ³ý»ò¸üÃû£¬·ñÔòϵͳ»á×Ô¶¯»Ö¸´¡£

¡¡¡¡(3)£¬¶¯Ì¬Ç¶Èëʽ

¡¡¡¡Õâ²ÅÊÇDLLºóÃÅ×î³£Óõķ½·¨¡£ÆäÒâÒåÊǽ«DLLÎļþǶÈëµ½ÕýÔÚÔËÐеÄϵͳ½ø³Ìµ±ÖС£ÔÚWindowsϵͳÖУ¬Ã¿¸ö½ø³Ì¶¼ÓÐ×Ô¼ºµÄ˽ÓÐÄÚ´æ¿Õ¼ä£¬µ«»¹ÊÇÓÐÖÖÖÖ·½·¨À´½øÈëÆä½ø³ÌµÄ˽ÓÐÄÚ´æ¿Õ¼ä£¬À´ÊµÏÖ¶¯Ì¬Ç¶Èëʽ¡£ÓÉÓÚϵͳµÄ¹Ø¼ü½ø³ÌÊDz»ÄÜÖÕÖ¹µÄ£¬ËùÒÔÕâÀàºóÃŷdz£Òþ±Î£¬²éɱҲ·Ç³£À§ÄÑ¡£³£¼ûµÄ¶¯Ì¬Ç¶ÈëʽÓÐ:"¹Ò½ÓAPI""È«¾Ö¹³×Ó(HOOK)""Ô¶³ÌÏß³Ì"µÈ¡£

¡¡¡¡Ô¶³ÌÏ̼߳¼ÊõÖ¸µÄÊÇͨ¹ýÔÚÒ»¸ö½ø³ÌÖд´½¨Ô¶³ÌÏ̵߳ķ½·¨À´½øÈëÄǸö½ø³ÌµÄÄÚ´æµØÖ·¿Õ¼ä¡£µ±EXEÔØÌå(»òRundll32.exe)ÔÚÄǸö±»²åÈëµÄ½ø³ÌÀï´´½¨ÁËÔ¶³ÌỊ̈߳¬²¢ÃüÁîËüÖ´ÐÐij¸öDLLÎļþʱ£¬ÎÒÃǵÄDLLºóÞ͹ÒÉÏÈ¥Ö´ÐÐÁË£¬ÕâÀï²»»á²úÉúеĽø³Ì£¬ÒªÏëÈÃDLLºóÃÅÍ£Ö¹£¬Ö»ÓÐÈÃÕâ¸öÁ´½ÓDLLºóÃŵĽø³ÌÖÕÖ¹¡£µ«Èç¹ûºÍijЩϵͳµÄ¹Ø¼ü½ø³ÌÁ´½Ó£¬ÄǾͲ»ÄÜÖÕÖ¹ÁË£¬Èç¹ûÄãÖÕÖ¹ÁËϵͳ½ø³Ì£¬ÄÇWindowsÒ²Ëæ¼´±»ÖÕÖ¹!!!

¡¡¡¡3£¬DLLºóÃŵÄÆô¶¯ÌØÐÔ

¡¡¡¡Æô¶¯DLLºóÃŵÄÔØÌåEXEÊDz»¿ÉȱÉٵģ¬Ò²ÊǷdz£ÖØÒªµÄ£¬Ëü±»³ÆΪ:Loader¡£Èç¹ûûÓÐLoader£¬ÄÇÎÒÃǵÄDLLºóÃÅÈçºÎÆô¶¯ÄØ?Òò´Ë£¬Ò»¸öºÃµÄDLLºóÃŻᾡÁ¦±£»¤×Ô¼ºµÄLoader²»±»²éɱ¡£LoaderµÄ·½Ê½Óкܶ࣬¿ÉÒÔÊÇΪÎÒÃǵÄDLLºóÃŶøרÃűàдµÄÒ»¸öEXEÎļþ;Ò²¿ÉÒÔÊÇϵͳ×Ô´øµÄRundll32.exe£¬¼´Ê¹Í£Ö¹ÁËRundll32.exe£¬DLLºóÃŵÄÖ÷Ì廹ÊÇ´æÔڵġ£3721ÍøÂçʵÃû¾ÍÊÇÒ»¸öÀý×Ó£¬ËäÈ»Ëü²¢²»ÊÇ"ÕæÕý"µÄºóÃÅ¡£

¡¡¡¡ºóÃŵÄLoader°ÑSvchostDLL.dll²åÈëSvchost½ø³Ìµ±ÖУ¬ËùÒÔ£¬ÎÒÃÇÏÈ´ò¿ªWindowsÓÅ»¯´óʦÖеÄWindows½ø³Ì¹ÜÀí2.5£¬²é¿´Svchost½ø³ÌÖеÄÄ£¿éÐÅÏ¢£¬SvchostDLL.dllÒѾ­²åÈëµ½Svchost½ø³ÌÖÐÁË£¬ÔÚ¸ù¾Ý"Ö±½ÓʹÓÃÏÖÓÐ×éÀïµÄÒ»¸ö·þÎñÃû£¬µ«ÊDZ¾»úûÓа²×°µÄ·þÎñ"µÄÌáʾ£¬ÎÒÃÇ¿ÉÒԶ϶¨£¬ÔÚ"¹ÜÀí¹¤¾ß"¡ª"·þÎñ"ÖлáÓÐÒ»ÏîеķþÎñ¡£´Ë·þÎñÃû³ÆΪ:IPRIP£¬ÓÉSvchostÆô¶¯£¬-k netsvcs±íʾ´Ë·þÎñ°üº¬ÔÚnetsvcs·þÎñ×éÖС£

¡¡¡¡ÎÒÃǰѸ÷þÎñÍ£µô£¬È»ºó´ò¿ª×¢²á±í±à¼­Æ÷(¿ªÊ¼¡ªÔËÐÐ--regedit)£¬À´µ½HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPRIPÏ£¬²é¿´ÆäParameters×Ó¼ü¡£Program¼üµÄ¼üÖµSvcHostDLL.exeΪºóÃŵÄLoader;ServiceDllµÄ¼üÖµC:\WINNT\system32\svchostdll.dllΪµ÷ÓõÄDLLÎļþ£¬ÕâÕýÊǺóÃŵÄDLLÎļþ¡£ÏÖÔÚÎÒÃÇɾ³ýIPRIP×Ó¼ü(»òÕßÓÃSCÀ´É¾³ý)£¬È»ºóÔÚÀ´µ½HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvchostÏ£¬±à¼­netsvcs·þÎñ×飬°Ñ49 00 70 00 72 00 69 00 70 00 00 00ɾ³ý£¬ÕâÀï¶ÔÓ¦µÄ¾ÍÊÇIPRIPµÄ·þÎñÃû£¬¾ßÌåÈçͼ6Ëùʾ¡£È»ºóÍ˳ö£¬ÖØÆô¡£ÖØÆôÖ®ºóɾ³ýWINNT\system32Ŀ¼ÏµĺóÃÅÎļþ¼´¿É¡£

¡¡¡¡2£¬BITS.dll

¡¡¡¡ÕâÊÇéŸçµÄ×÷Æ·£¬Ò²ÊÇDLLºóÃÅ£¬ºÍSvchostDLL.dllÔ­Àí»ù±¾Ò»Ñù£¬²»¹ýÕâÀïʹÓõÄÊÇÉϱ߽éÉܵĵÚËÄÖÖ·½·¨£¬¼´"ÐÞ¸ÄÏÖÓÐ×éÀïµÄÏÖÓзþÎñ£¬°ÑËüµÄServiceDllÖ¸Ïò×Ô¼ºµÄDLLºóÃÅ"¡£»»¾ä»°Ëµ£¬¸ÃºóÃÅÐÞ¸ÄÏÖÓеÄijһ¸ö·þÎñ£¬°ÑÆäÔ­ÓзþÎñµÄDLLÖ¸Ïò×Ô¼º(Ò²¾ÍÊÇBITS.dll)£¬ÕâÑù¾Í´ïµ½ÁË×Ô¶¯¼ÓÔصÄÄ¿µÄ;Æä´Î£¬¸ÃºóÃÅûÓÐ×Ô¼ºµÄLoader£¬¶øÊÇʹÓÃϵͳ×Ô´øµÄRundll32.exeÀ´¼ÓÔØ¡£ÎÒÃÇ»¹ÊÇÓÃWindows ½ø³Ì¹ÜÀí2.5À´²é¿´£¬´Óͼ7ÖУ¬ÎÒÃÇ¿ÉÒÔ¿´µ½bits.dllÒѾ­²åÈëµ½Svchost½ø³Ìµ±ÖС£

¡¡¡¡ºÃ£¬ÏÖÔÚÎÒÃÇÀ´¿´¿´¾ßÌåµÄÇå³ý·½·¨£¬ÓÉÓڸúóÃÅÊÇÐÞ¸ÄÏÖÓзþÎñ£¬¶øÎÒÃDz¢²»ÖªµÀ¾ßÌåÊÇÐÞ¸ÄÁËÄĸö·þÎñ£¬ËùÒÔ£¬ÔÚ×¢²á±íÖÐËÑË÷bits.dll£¬×îºóÔÚHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAutoÏÂËÑË÷µ½ÁËbits.dll£¬²é¿´Parameters×Ó¼üϵÄServiceDll£¬Æä¼üֵΪC:\WINNT\system32\bits.dll¡£Ô­À´£¬¸ÃºóÃÅ°ÑRasAuto·þÎñÔ­À´µÄDLLÎļþÌ滻Ϊbits.dllÁË£¬ÕâÑùÀ´ÊµÏÖ×Ô¶¯¼ÓÔØ¡£ÖªµÀÁËÔ­Òò¾ÍºÃ°ìÁË£¬ÏÖÔÚÎÒÃÇ°ÑServiceDllµÄ¼üÖµÐÞ¸ÄΪRasAuto·þÎñÔ­ÓеÄDLLÎļþ£¬¼´%SystemRoot%\System32\rasauto.dll£¬Í˳ö£¬ÖØÆô¡£Ö®ºóɾ³ýWINNT\system32Ŀ¼ÏµÄbits.dll¼´¿É¡£

¡¡¡¡3£¬NOIR--QUEEN

¡¡¡¡NOIR--QUEEN(ÊØ»¤Õß)ÊÇÒ»¸öDLLºóÃÅ&ľÂí³ÌÐò£¬·þÎñ¶ËÒÔDLLÎļþµÄÐÎʽ²åÈ뵽ϵͳµÄLsass.exe½ø³ÌÀÓÉÓÚLsass.exeÊÇϵͳµÄ¹Ø¼ü½ø³Ì£¬ËùÒÔ²»ÄÜÖÕÖ¹¡£ÔÚÀ´½éÉÜÇå³ý·½·¨Ö®Ç°£¬ÎÒÏȽéÉÜÒ»ÏÂLsass.exe½ø³Ì:

¡¡¡¡ÕâÊÇÒ»¸ö±¾µØµÄ°²È«ÊÚȨ·þÎñ£¬²¢ÇÒËü»áΪʹÓÃWinlogon·þÎñµÄÊÚȨÓû§Éú³ÉÒ»¸ö½ø³Ì£¬Èç¹ûÊÚȨÊdzɹ¦µÄ£¬Lsass¾Í»á²úÉúÓû§µÄ½øÈëÁîÅÆ£¬ÁîÅÆʹÓÃÆô¶¯³õʼ µÄShell¡£ÆäËûµÄÓÉÓû§³õʼ»¯µÄ½ø³Ì»á¼Ì³ÐÕâ¸öÁîÅÆ¡£

¡¡¡¡´ÓÉϱߵĽéÉÜÎÒÃǾͿÉÒÔ¿´³öLsass¶ÔϵͳµÄÖØÒªÐÔ£¬ÄǾßÌåÔõôÇå³ýÄØ?Çë¿´ÏÂÎÄ¡£

¡¡¡¡ºóÃÅÔÚ°²×°³É¹¦ºó£¬»áÔÚ·þÎñÖÐÌí¼ÓÒ»¸öÃûΪQoSserverµÄ·þÎñ£¬²¢°ÑQoSserver.dllºóÃÅÎļþ²åÈëµ½Lsass½ø³Ìµ±ÖУ¬Ê¹Æä¿ÉÒÔÒþ²Ø½ø³Ì²¢×Ô¶¯Æô¶¯¡£ÏÖÔÚÎÒÃÇ´ò¿ª×¢²á±í£¬À´µ½HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QoSserver£¬Ö±½Óɾ³ýQoSserver¼ü£¬È»ºóÖØÆô¡£ÖØÆôÖ®ºó£¬ÎÒÃÇÔÚÀ´µ½·þÎñÁбíÖУ¬»á¿´µ½QoSserver·þÎñ»¹ÔÚ£¬µ«Ã»ÓÐÆô¶¯£¬Àà±ðÊÇ×Ô¶¯£¬ÎÒÃÇ°ÑËûÐÞ¸ÄΪ"ÒѽûÓÃ";È»ºóÍùÉÏ¿´£¬»á·¢ÏÖÒ»¸ö·þÎñÃûΪAppCPIµÄ·þÎñ£¬Æä¿ÉÖ´ÐгÌÐòÖ¸ÏòQoSserver.exe(Ô­Òòºó±ßÎÒ»á˵µ½)¡£ÎÒÃÇÔٴδò¿ª×¢²á±í£¬À´µ½HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppCPI£¬É¾³ýAppCPI¼ü£¬ÖØÆô£¬ÔÙɾ³ýQoSserver£¬×îºóɾ³ýWINNT\system32Ŀ¼ÏµĺóÃÅÎļþ¡£

ÓÉÓÚаæµÄKV¡¢½ðɽ¡¢ÈðÐǶ¼¼ÓÈëÁ˶ÔÍøÒ³¡¢²å¼þ¡¢ÓʼþµÄËæ»ú¼à¿Ø£¬ÎÞÒÉÔö´óÁËϵͳ¸ºµ£¡£´¦Àí·½Ê½£º»ù±¾ÉÏûÓкÏÀíµÄ´¦Àí·½Ê½£¬¾¡Á¿Ê¹ÓÃ×îÉٵļà¿Ø·þÎñ°É£¬»òÕߣ¬Éý¼¶ÄãµÄÓ²¼þÅ䱸¡£

2¡¢Çý ¶¯Ã»Óо­¹ýÈÏÖ¤£¬Ôì³ÉCPU×ÊÔ´Õ¼ÓÃ100%

´óÁ¿µÄ²âÊÔ°æµÄÇý¶¯ÔÚÍøÉÏ·ºÀÄ£¬Ôì³ÉÁËÄÑÒÔ·¢ÏֵĹÊÕÏÔ­Òò¡£ ´¦Àí·½Ê½£ºÓÈÆäÊÇÏÔ¿¨Çý¶¯ÌرðҪעÒ⣬½¨ÒéʹÓÃ΢ÈíÈÏÖ¤µÄ»òÓɹٷ½·¢²¼µÄÇý¶¯£¬²¢ÇÒÑϸñºË¶ÔÐͺš¢°æ±¾¡£

3¡¢²¡¶¾¡¢Ä¾ÂíÔì³É

´óÁ¿µÄÈä³æ²¡¶¾ÔÚϵͳÄÚ²¿Ñ¸ËÙ¸´ÖÆ£¬Ôì³ÉCPUÕ¼ÓÃ×ÊÔ´Âʾݸ߲»Ï¡£½â¾ö°ì·¨£ºÓÿɿ¿µÄɱ¶¾Èí¼þ³¹µ×ÇåÀíϵͳÄÚ´æºÍ±¾µØÓ²ÅÌ£¬²¢ÇÒ´ò¿ªÏµÍ³ÉèÖÃÈí¼þ£¬²ì¿´ÓÐÎÞÒì³£Æô¶¯µÄ³ÌÐò¡£¾­³£ÐÔ¸üÐÂÉý¼¶É±¶¾Èí¼þºÍ·À»ðǽ£¬¼ÓÇ¿·À¶¾Òâʶ£¬ÕÆÎÕÕýÈ·µÄ·Àɱ¶¾ÖªÊ¶¡£

4¡¢ÏµÍ³·þÎñ

¿ØÖÆÃæ°å¡ª¹ÜÀí¹¤¾ß¡ª·þÎñ¡ªRISING REALTIME MONITOR SERVICEµãÊó±êÓÒ¼ü£¬¸ÄΪÊÖ¶¯¡£

5¡¢Æô¶¯Ïî

¿ªÊ¼->£»ÔËÐÐ->£»msconfig->£»Æô¶¯£¬¹Ø±Õ²»±ØÒªµÄÆô¶¯ÏÖØÆô¡£

6¡¢²é¿´¡°Svchost¡±½ø³Ì

Svchost.exeÊÇWindows XPϵͳµÄÒ»¸öºËÐĽø³Ì¡£svchost.exe²»µ¥µ¥Ö»³öÏÖÔÚWindows XPÖУ¬ÔÚʹÓÃNTÄں˵ÄWindowsϵͳÖж¼»áÓÐsvchost.exeµÄ´æÔÚ¡£Ò»°ãÔÚWindows 2000ÖÐsvchost.exe½ø³ÌµÄÊýĿΪ2¸ö£¬¶øÔÚWindows XPÖÐsvchost.exe½ø³ÌµÄÊýÄ¿¾ÍÉÏÉýµ½ÁË4¸ö¼°4¸öÒÔÉÏ¡£

7¡¢²é¿´ÍøÂçÁ¬½Ó

Ö÷ÒªÊÇÍø¿¨¡£

8¡¢²é¿´ÍøÂçÁ¬½Ó

µ±°²×°ÁËWindows XPµÄ¼ÆËã»ú×ö·þÎñÆ÷µÄʱºò£¬ÊÕµ½¶Ë¿Ú 445 ÉϵÄÁ¬½ÓÇëÇóʱ£¬Ëü½«·ÖÅäÄÚ´æºÍÉÙÁ¿µØµ÷Åä CPU×ÊÔ´À´ÎªÕâЩÁ¬½ÓÌṩ·þÎñ¡£µ±¸ººÉ¹ýÖصÄʱºò£¬CPUÕ¼ÓÃÂÊ¿ÉÄܹý¸ß£¬ÕâÊÇÒòΪÔÚ¹¤×÷ÏîµÄÊýÄ¿ºÍÏìÓ¦ÄÜÁ¦Ö®¼ä´æÔÚ¹ÌÓеÄȨºâ¹Øϵ¡£ÄãҪȷ¶¨ºÏÊ浀 MaxWorkItems ÉèÖÃÒÔÌá¸ßϵͳÏìÓ¦ÄÜÁ¦¡£Èç¹ûÉèÖõÄÖµ²»ÕýÈ·£¬·þÎñÆ÷µÄÏìÓ¦ÄÜÁ¦¿ÉÄÜ»áÊܵ½Ó°Ï죬»òÕßij¸öÓû§¶Àռ̫¶àϵͳ×ÊÔ´¡£

Òª½â¾ö´ËÎÊÌ⣬ÎÒÃÇ¿ÉÒÔͨ¹ýÐÞ¸Ä×¢²á±íÀ´½â¾ö£ºÔÚ×¢²á±í±à¼­Æ÷ÖÐÒÀ´ÎÕ¹¿ª[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver ]·ÖÖ§£¬ÔÚÓҲര¿ÚÖÐн¨Ò»¸öÃûΪ¡°maxworkitems¡±µÄDWORDÖµ¡£È»ºóË«»÷¸ÃÖµ£¬ÔÚ´ò¿ªµÄ´°¿ÚÖмüÈëÏÂÁÐÊýÖµ²¢±£´æÍ˳ö£º

Èç¹û¼ÆËã»úÓÐ512MBÒÔÉϵÄÄڴ棬¼üÈë¡°1024¡±£»Èç¹û¼ÆËã»úÄÚ´æСÓÚ512 MB£¬¼üÈë¡°256¡±¡£

9¡¢¿´¿´ÊDz»ÊÇWindows XPʹÓÃÊó±êÓÒ¼üÒýÆðCPUÕ¼ÓÃ100%£º

Ç°²»¾ÃµÄ±¨µ½ËµÔÚ×ÊÔ´¹ÜÀíÆ÷ÀïÃæʹÓÃÊó±êÓÒ¼ü»áµ¼ÖÂCPU×ÊÔ´100%Õ¼Óã¬ÎÒÃÇÀ´¿´¿´ÊÇÔõô»ØÊ£¿

Õ÷Õ×£º

ÔÚ×ÊÔ´¹ÜÀíÆ÷ÀïÃ棬µ±ÄãÓÒ¼üµã»÷Ò»¸öĿ¼»òÒ»¸öÎļþ£¬Ä㽫ÓпÉÄܳöÏÖÏÂÃæËùÁÐÎÊÌ⣺

ÈκÎÎļþµÄ¿½±´²Ù×÷ÔÚÄǸöʱ¼ä½«ÓпÉÄÜÍ£Ö¹ÏàÓ¦

ÍøÂçÁ¬½ÓËٶȽ«ÏÔÖøÐԵĽµµÍ

ËùÓеÄÁ÷ÊäÈë/Êä³ö²Ù×÷ÀýÈçʹÓÃWindows Media PlayerÌýÒôÀÖ½«ÓпÉÄÜÊÇÒôÀÖʧÕæ³ÉÒò£º

µ±ÄãÔÚ×ÊÔ´¹ÜÀíÆ÷ÀïÃæÓÒ¼üµã»÷Ò»¸öÎļþ»òĿ¼µÄʱºò£¬µ±¿ì½Ý²Ëµ¥ÏÔʾµÄʱºò£¬CPUÕ¼ÓÃÂʽ«Ôö¼Óµ½100%£¬µ±Äã¹Ø±Õ¿ì½Ý²Ëµ¥µÄʱºò²Å·µ»ØÕý³£Ë®Æ½¡£

½â¾ö·½·¨£º

·½·¨Ò»£º¹Ø±Õ¡°Îª²Ëµ¥ºÍ¹¤¾ßÌáʾʹÓùý¶ÉЧ¹û¡±

1¡¢µã»÷¡°¿ªÊ¼¡±--¡°¿ØÖÆÃæ°å¡±

2¡¢ÔÚ¡°¿ØÖÆÃæ°å¡±ÀïÃæË«»÷¡°ÏÔʾ¡±

3¡¢ÔÚ¡°ÏÔʾ¡±ÊôÐÔÀïÃæµã»÷¡°Íâ¹Û¡±±êÇ©Ò³

4¡¢ÔÚ¡°Íâ¹Û¡±±êÇ©Ò³ÀïÃæµã»÷¡°Ð§¹û¡±

5¡¢ÔÚ¡°Ð§¹û¡±¶Ô»°¿òÀïÃ棬Çå³ý¡°Îª²Ëµ¥ºÍ¹¤¾ßÌáʾʹÓùý¶ÉЧ¹û¡±Ç°ÃæµÄ¸´Ñ¡¿ò½Ó×ŵã»÷Á½´Î¡°È·¶¨¡±°´Å¥¡£

·½·¨¶þ£ºÔÚʹÓÃÊó±êÓÒ¼üµã»÷Îļþ»òĿ¼µÄʱºòÏÈʹÓÃÊó±ê×ó¼üÑ¡ÔñÄãµÄÄ¿±êÎļþ»òĿ¼¡£È»ºóÔÙʹÓÃÊó±êÓÒ¼üµ¯³ö¿ì½Ý²Ëµ¥¡£

¡¡¡¡Ëæ×ÅÍøÂçÈä³æµÈ×Ô¶¯¹¥»÷µÄ·ºÀÄ,Ò»ÖÖ©¶´»á±»¶àÖÖ²¡¶¾ËùÀûÓá£Òò´ËÔÚ¹æÔò¿âÖйâ¼ì²âµ½Ò»ÖÖ©¶´ÒѾ­Ô¶Ô¶²»ÄÜÂú×ãÓû§µÄÐèÇó£¬Óû§ ÐèÒª¿´µ½ÄÄÖÖÈä³æ»òºóÃÅľÂí¡£

¡¡¡¡Õâ¾ÍÐèÒª³§ÉÌÔÚ¹æÔò¿âµÄ¸üкÍά»¤ÉÏͶÈë¸ü¶àµÄ×ÊÔ´£¬²»¹âÊǸú×ٹٷ½¹«²¼µÄ©¶´ºÍ×î³£¼ûµÄ¹¥»÷³ÌÐòµÈ£¬»¹Òª¶ÔÍøÂçÉÏÁ÷´«µÄÖÖÖÖ²¡¶¾¡¢Ä¾ÂíµÈ³ÌÐò×ö·ÖÎö¡£¹æÔò¿âµÄÌõÊýÒª´ïµ½¼¸ÍòÌõÒÔÉÏ£¬¸üÐÂËÙ¶ÈÒª´ïµ½Ã¿Ìì¸üУ¬ÏÖÓеÄIDS¹æÔò¸üÐÂÌåϵÒѾ­Âú×ã²»ÁËIPSÒªÇó¡£

¡¡¡¡Íþв´¥Ä¿¾ªÐÄ

¡¡¡¡¸ù¾Ý¹«°²²¿Ò»·ÝÐÅÏ¢ÍøÂ簲ȫ״¿öµ÷²éÏÔʾ£¬ÔÚ±»µ÷²éµÄ7072¼ÒÕþ¸®¡¢½ðÈÚ֤ȯ¡¢½ÌÓý¿ÆÑС¢µçÐÅ¡¢¹ãµç¡¢ÄÜÔ´½»Í¨¡¢¹ú·ÀºÍÉÌóÆóÒµµÈÐÅÏ¢ÍøÂçÖУ¬·¢ÉúÍøÂ簲ȫʼþµÄ±ÈÀýΪ58£¥¡£

¡¡¡¡ÆäÖУ¬¼ÆËã»ú²¡¶¾¡¢Èä³æºÍľÂí³ÌÐòÔì³ÉµÄ°²È«Ê¼þÕ¼·¢Éú°²È«Ê¼þµ¥Î»×ÜÊýµÄ79£¥£¬¾Ü¾ø·þÎñ¡¢¶Ë¿ÚɨÃèºÍ´Û¸ÄÍøÒ³µÈÍøÂç¹¥»÷ʼþÕ¼43£¥£¬´ó¹æÄ£À¬»øÓʼþ´«²¥Ôì³ÉµÄ°²È«Ê¼þÕ¼36£¥¡£ÌرðµØ£¬¼ÆËã»ú²¡¶¾µÄ¸ÐȾÂÊΪ87.9£¥£¬±ÈÉÏÒ»ÄêÔö¼ÓÁË2£¥¡£

¡¡¡¡ÉÏÊöµ÷²é¶ÔÏó¶¼ÊǹúÄÚÐÅÏ¢°²È«Í¶Èë±È½Ï¸ßµÄ´óÐÐÒµ£¬·À»ðǽ¡¢ÈëÇÖ¼ì²â¡¢·À²¡¶¾µÈ³£¼û°²È«²úÆ·»ù±¾¶¼ÒѲ¿Ê𣬵«ÈÔÈ»ÔâÊÜÁË´¥Ä¿¾ªÐĵݲȫΣº¦¡£

¡¡¡¡¾ÍÏñ¡°911¡±Ö®ºóµÄÃÀ¹ú£¬ÈËÃÇͻȻ·¢ÏÖ£¬ÒÔÇ°´ó¼Ò¶Ô°²È«ÎÊÌâµÄ¿´·¨ÒѾ­²»ÊʺÏÐÂÐÎÊƵÄÐèÒªÁË£¬Ô­±¾ÈËÃÇÈÏΪ¹ÌÈô½ðÌÀµÄÃÀ¹ú±¾ÍÁ£¬±»ÐµĹ¥»÷ÊÖ¶ÎÕ¨µÃǧ´¯°Ù¿×¡£Ä¿Ç°µÄ»¥ÁªÍøºÍÍøÂ簲ȫ²¿Êð´ó¼ÒÔ­±¾ºÜÀÖ¹Û£¬µ«ÉÏÃæÁоٵÄÕâЩ´¥Ä¿¾ªÐĵÄΣº¦Çå³þµØ±íÃ÷£¬ÔÚ²ã³ö²»ÇîµÄ¹¥»÷ÊÖ¶ÎÃæÇ°£¬ÎÒÃǵÄÍøÂ簲ȫ±£»¤´ëÊ©ÒѾ­ÂäºóÁË¡£

¡¡¡¡ÏÖÓм¼Êõ²»¹»Óã¡

¡¡¡¡ÊÂʵÉÏ£¬¡°911¡±ÃÀ¹úÔâÊÜ¿Ö²ÀÖ÷ÒåÏ®»÷ºó£¬ÔÚ·À»¤Êֶη½ÃæµÄ±ä»¯£¬Ò²Ó³Éä³öÍøÂ簲ȫ²úÆ··¢Õ¹µÄÂöÂç¡£

¡¡¡¡ÔÚ¡°911¡±Ç°£¬»ú³¡ÔÚ°²È«·½Ãæ²»ÊÇÒ»µãÊÖ¶ÎûÓС£ÔڵǻúÇ°ÒªÑéÖ¤Âÿ͵ÄÉí·ÝÖ¤¼þ£¬²¢Í¨¹ý½ðÊô̽²âÃÅ£¬·ÀÖ¹Âÿʹø¹ÜÖƵ¶¾ßÉÏ»ú¡£ÕâÖÖ¼ì²éÊֶκͷÀ»ðǽÔÚÍøÂçÉÏËùÆðµÄ×÷ÓÃÏàËÆ¡£

¡¡¡¡Í¨³££¬ÈËÃÇÈÏΪ·À»ðǽ¿ÉÒÔ±£»¤´¦ÓÚËüÉíºóµÄÍøÂç²»ÊÜÍâ½çµÄÇÖÏ®ºÍ¸ÉÈÅ¡£µ«Ëæ×ÅÍøÂç¼¼ÊõµÄ·¢Õ¹£¬ÍøÂç½á¹¹ÈÕÇ÷¸´ÔÓ£¬´«Í³·À»ðǽÔÚʹÓõĹý³ÌÖб©Â¶³öÒÔϵIJ»×ãºÍÈõµã£º

¡¡¡¡ÈëÇÖÕß¿ÉÒÔαÔìÊý¾ÝÈƹý·À»ðǽ»òÕßÕÒµ½·À»ðǽÖпÉÄܳ¨¿ªµÄºóÃÅ£¬¾ÍÏñ¿Ö²À·Ö×Ó¿ÉÒÔαÔìÉí·ÝÖ¤¼þÉÏ·É»úÒ»Ñù£»

¡¡¡¡·À»ðǽ²»ÄÜ·ÀÖ¹À´×ÔÍøÂçÄÚ²¿µÄÏ®»÷£¬Í¨¹ýµ÷²é·¢ÏÖ£¬½«½ü65%µÄ¹¥»÷¶¼À´×ÔÍøÂçÄÚ²¿£¬¶ÔÓÚÄÇЩ¶ÔÆóÒµÐÄ»³²»Âú»ò¼ÙÒâÎÔµ×µÄÔ±¹¤À´Ëµ£¬·À»ðǽÐÎͬÐéÉ裬¾ÍÏñ¿Ö²À·Ö×Ó¿ÉÒÔÊÕÂò»ú³¡ÈËÔ±Ò»Ñù£»

¡¡¡¡´«Í³·À»ðǽ²»¾ß±¸¶ÔÓ¦ÓòãЭÒéµÄ¼ì²é¹ýÂ˹¦ÄÜ£¬ÎÞ·¨¶ÔWeb¹¥»÷¡¢FTP¹¥»÷µÈ×ö³öÏìÓ¦£¬·À»ðǽ¶ÔÓÚ²¡¶¾Èä³æµÄÇÖϮҲÊÇÊøÊÖÎ޲ߣ¬¾ÍÏñ½ðÊô̽²âÆ÷¼ì²â²»³öÀ´·Ç½ðÊôµÄ¹¥»÷ÎäÆ÷£¬Ò×ȼÒ×±¬Æ·Ò»Ñù¡£

¡¡¡¡ÕýÒòÈç´Ë£¬ÔÚÍøÂçÊÀ½çÀÈËÃÇ¿ªÊ¼Á˶ÔÈëÇÖ¼ì²â¼¼ÊõµÄÑо¿¼°¿ª·¢¡£ÈëÇÖ¼ì²â¼¼ÊõºÜÏñÔÚ»ú³¡°²×°Á˶ą̀ÉãÏñÍ·£¬ÊµÊ±¹Û²ìÂÿ͵ÄÐÐΪ£¬ÒÔ·¢ÏÖ°²È«ÎÊÌâ¡£IDS¿ÉÒÔÃÖ²¹·À»ðǽµÄ²»×㣬ΪÍøÂçÌṩʵʱµÄ¼à¿Ø£¬²¢ÇÒÔÚ·¢ÏÖÈëÇֵijõÆÚ²ÉÈ¡ÏàÓ¦µÄ·À»¤ÊֶΡ£

¡¡¡¡µ«ÊÇ£¬ÈËÃÇÒ²Öð½¥Òâʶµ½IDSËùÃæÁÙµÄÎÊÌâ¡£

¡¡¡¡½Ï¸ßµÄ©±¨ÂʺÍÎó±¨ÂÊ¡£ÕâÒѾ­ÊÇÊÀ½çÐÔÄÑÌ⣬¾ÍÏñ»ú³¡µÄ¼à¿Ø¼Ïñ²»Äܼà¿Øµ½Ã¿¸ö½ÇÂ䣬²»ÄÜ´ÓÈ˵ÄÐÐΪ¾ÙÖ¹Íêȫ׼ȷµØÅжϳöÆäÊÇ·ñΪ¿Ö²À·Ö×ÓÒ»Ñù¡£

¡¡¡¡IDSÊÇÒÔ±»¶¯µÄ·½Ê½¹¤×÷£¬Ö»Äܼì²â¹¥»÷£¬¶ø²»ÄÜ×öµ½ÕæÕýʵʱµØ×èÖ¹¹¥»÷¡£»ú³¡µÄ¼à¿Ø¼Ïñ×îÓмÛÖµµÄµØ·½ÆäʵÊÇÔÚ¿Ö²Àʼþ·¢Éúºó£¬¾¯²ìͨ¹ý±¸·ÝµÄ¼à¿Ø¼Ïñ²éÕÒ¿ÉÒÉ·Ö×Ó£¬ÎªÆÆ°¸ÌṩÏßË÷¡£

¡¡¡¡IPSÌî²¹ÁË¿Õ°×

¡¡¡¡ÔÚºó¡°911¡±Ê±´ú£¬ÈËÃÇ·¢ÏÖ»ú³¡µÄ°²¼ì´ëÊ©±äÁË£¬¶ÔµÇ»úµÄÂÿͳýÁ˼ì²éÉí·ÝÖ¤¼þÍ⣬»¹Òª¼ì²éÖ¸ÎÆ£¬×ÐϸËÑÉí£¬Á¬Ð¬×Ó¶¼ÒªÍÑÁ˼ì²é£»ÉõÖÁÁ¬ÒûÁÏÆ¿¶¼ÒªÂÿͺÈÒ»¿Ú£¬ÒÔÈ·±£ÄDz»ÊÇÆûÓÍ¡£ÕâÐÂÔö¼ÓµÄ¼ì²éÊÖ¶ÎÈÿֲÀ·Ö×ÓÃÉ»ì¹ý¹ØµÄ¼¸ÂÊ´óΪ¼õÉÙ¡£

¡¡¡¡°²¼ì´ëÊ©µÄ¸Ä½ø£¬¶ÔÓ¦ÓÚÍøÂ簲ȫ·À·¶£¬¾ÍÊǼÓÇ¿ÏÖÓеķÀ»ðǽºÍIDSµÈ±£»¤¹¦ÄÜ£¬Í¬Ê±¶Ô¾­¹ýµÄÊý¾Ý°ü½øÐиüΪÑϸñµÄ¼ì²é´ëÊ©¡£ÓÚÊǵ®ÉúÁËIPS¼¼Êõ£¬ÎÒÃdzÆ֮ΪÈëÇÖ·ÀÓùϵͳ¡£

¡¡¡¡IPSÊÇÔÚÓ¦ÓòãµÄÄÚÈݼì²â»ù´¡ÉϼÓÉÏÖ÷¶¯ÏìÓ¦ºÍ¹ýÂ˹¦ÄÜ£¬ÃÖ²¹ÁË´«Í³µÄÖ÷Á÷ÍøÂ簲ȫ¼¼Êõ²»ÄÜÍê³É¸ü¶àÄÚÈݼì²éµÄ²»×㣬Ìî²¹ÁËÍøÂ簲ȫ²úÆ·ÏߵĻùÓÚÄÚÈݵݲȫ¼ì²éµÄ¿Õ°×¡£IPS¹¤×÷Ô­ÀíÈçͼ1Ëùʾ¡£

¡¡¡¡IPSÉè¼Æ×ÚÖ¼ÊÇÔ¤ÏȶÔÈëÇֻºÍ¹¥»÷ÐÔÍøÂçÁ÷Á¿½øÐÐÀ¹½Ø£¬±ÜÃâÆäÔì³ÉËðʧ£¬¶ø²»ÊǼòµ¥µØÔÚ¶ñÒâÁ÷Á¿´«ËÍʱ»ò´«Ëͺó²Å·¢³ö¾¯±¨¡£

¡¡¡¡IPSÊÇͨ¹ýÖ±½ÓǶÈëµ½ÍøÂçÁ÷Á¿ÖÐʵÏÖÕâÒ»¹¦Äܵģ¬¼´Í¨¹ýÒ»¸öÍøÂç¶Ë¿Ú½ÓÊÕÀ´×ÔÍⲿϵͳµÄÁ÷Á¿£¬¾­¹ý¼ì²éÈ·ÈÏÆäÖв»°üº¬Òì³£»î¶¯»ò¿ÉÒÉÄÚÈݺó£¬ÔÙͨ¹ýÁíÍâÒ»¸ö¶Ë¿Ú½«Ëü´«Ë͵½ÄÚ²¿ÏµÍ³ÖС£ÕâÑùÒ»À´£¬ÓÐÎÊÌâµÄÊý¾Ý°ü£¬ÒÔ¼°ËùÓÐÀ´×ÔͬһÊý¾ÝÁ÷µÄºóÐøÊý¾Ý°ü£¬¶¼ÄÜÔÚIPSÉ豸Öб»Çå³ýµô¡£

¡¡¡¡IPSʵÏÖʵʱ¼ì²éºÍ×èÖ¹ÈëÇÖµÄÔ­ÀíÔÚÓÚIPSÓµÓÐÊýÄ¿ÖÚ¶àµÄ¹ýÂËÆ÷£¬Äܹ»·ÀÖ¹¸÷ÖÖ¹¥»÷¡£µ±ÐµĹ¥»÷Êֶα»·¢ÏÖÖ®ºó£¬IPS¾Í»á´´½¨Ò»¸öеĹýÂËÆ÷¡£IPSÊý¾Ý°ü´¦ÀíÒýÇæÊÇרҵ»¯¶¨ÖƵļ¯³Éµç·£¬¿ÉÒÔÉî²ã¼ì²éÊý¾Ý°üµÄÄÚÈÝ¡£

¡¡¡¡Èç¹ûÓй¥»÷ÕßÀûÓÃLayer2£¨½éÖÊ·ÃÎÊ¿ØÖÆ£©ÖÁLayer7£¨Ó¦Ó㩵ĩ¶´·¢Æð¹¥»÷£¬IPSÄܹ»´ÓÊý¾ÝÁ÷Öмì²é³öÕâЩ¹¥»÷²¢¼ÓÒÔ×èÖ¹¡£´«Í³µÄ·À»ðǽֻÄܶÔLayer3»òLayer4½øÐмì²é£¬²»Äܼì²âÓ¦ÓòãµÄÄÚÈÝ¡£

¡¡¡¡·À»ðǽµÄ°ü¹ýÂ˼¼Êõ²»»áÕë¶Ôÿһ×Ö½Ú½øÐмì²é£¬Òò¶øÒ²¾ÍÎÞ·¨·¢ÏÖ¹¥»÷»î¶¯£¬¶øIPS¿ÉÒÔ×öµ½ÖðÒ»×ֽڵؼì²éÊý¾Ý°ü¡£

¡¡¡¡ËùÓÐÁ÷¾­IPSµÄÊý¾Ý°ü¶¼±»·ÖÀ࣬·ÖÀàµÄÒÀ¾ÝÊÇÊý¾Ý°üÖеı¨Í·ÐÅÏ¢£¬ÈçÔ´IPµØÖ·ºÍÄ¿µÄIPµØÖ·¡¢¶Ë¿ÚºÅºÍÓ¦ÓÃÓò¡£Ã¿ÖÖ¹ýÂËÆ÷¸ºÔð·ÖÎöÏà¶ÔÓ¦µÄÊý¾Ý°ü¡£