{"id":3062,"date":"2024-03-19T13:35:18","date_gmt":"2024-03-19T05:35:18","guid":{"rendered":"https:\/\/blog.billows.com.tw\/?p=3062"},"modified":"2024-03-19T13:36:59","modified_gmt":"2024-03-19T05:36:59","slug":"%e4%b8%ad%e5%9c%8bapt%e9%a7%ad%e5%ae%a2earth-krahang-%e9%8e%96%e5%ae%9a%e5%85%a8%e7%90%83%e6%94%bf%e5%ba%9c%e5%af%a6%e9%ab%94-%e5%85%a5%e4%be%b5%e4%ba%8623-%e5%80%8b%e5%9c%8b%e5%ae%b6%e7%9a%8470","status":"publish","type":"post","link":"https:\/\/blog.billows.com.tw\/?p=3062","title":{"rendered":"\u4e2d\u570bAPT\u99ed\u5ba2Earth Krahang \u9396\u5b9a\u5168\u7403\u653f\u5e9c\u5be6\u9ad4 \u5165\u4fb5\u4e8623 \u500b\u570b\u5bb6\u768470 \u500b\u7d44\u7e54"},"content":{"rendered":"\n

Earth Krahang\u5229\u7528\u653f\u5e9c\u9593\u4fe1\u4efb\u767c\u52d5\u8de8\u653f\u5e9c\u653b\u64ca\uff0c\u91dd\u5c0d\u5168\u7403\u591a\u500b\u653f\u5e9c\u5be6\u9ad4\u7684APT\u6d3b\u52d5\uff0c\u99ed\u5ba2\u91cd\u9ede\u95dc\u6ce8\u6771\u5357\u4e9e\uff0c\u4f46\u4e5f\u767c\u73fe\u91dd\u5c0d\u6b50\u6d32\u3001\u7f8e\u6d32\u548c\u975e\u6d32<\/p>\n\n\n\n

\u4e2d\u570b APT \u99ed\u5ba2Earth Krahang \u5c07\u5168\u7403\u653f\u5e9c\u5be6\u9ad4\u4f5c\u70ba\u76ee\u6a19\uff0c\u5df2\u6210\u529f\u4fb5\u5165 23 \u500b\u570b\u5bb6\u7684\u81f3\u5c11 70 \u500b\u7d44\u7e54\uff0c\u5176\u4e2d\u5305\u62ec 48 \u500b\u653f\u5e9c\u9818\u57df\u7684\u7d44\u7e54\u3002\u64da\u76e3\u6e2c\u8a72\u6d3b\u52d5\u7684Trend Micro<\/a>\u7814\u7a76\u54e1\u7a31\uff0c\u8a72\u6d3b\u52d5\u81ea 2022 \u5e74\u521d\u4ee5\u4f86\u4e00\u76f4\u5728\u9032\u884c\uff0c\u4e3b\u8981\u91dd\u5c0d\u653f\u5e9c\u7d44\u7e54\u3002\u8a72\u7814\u7a76\u5831\u544a\u6df1\u5165\u63a2\u8a0e\u4e86 Earth Krahang \u7684\u7b56\u7565\u3001\u6280\u8853\u548c\u7a0b\u5e8f (Tactics, Techniques, and Procedures -TTP)\uff0c\u63ed\u793a\u4e86Earth Krahang\u904b\u4f5c\u53ca\u5176\u5c0d\u5168\u7403\u7db2\u8def\u5b89\u5168\u7684\u5f71\u97ff\u3002<\/p>\n\n\n\n

\u7b56\u7565\u8207\u6280\u8853<\/strong><\/p>\n\n\n\n

Earth Krahang \u7684\u4f5c\u6848\u624b\u6cd5\u5305\u62ec\u5229\u7528\u9762\u5411\u516c\u773e\u7684\u4f3a\u670d\u5668\u4e2d\u7684\u6f0f\u6d1e\u4ee5\u53ca\u5229\u7528\u9b5a\u53c9\u5f0f\u7db2\u8def\u91e3\u9b5a\u96fb\u5b50\u90f5\u4ef6\u4f86\u63d0\u4f9b\u65b0\u7a4e\u7684\u5f8c\u9580\u3002\u8a72\u6d3b\u52d5\u986f\u793a\u51fa\u4e00\u7a2e\u50be\u5411\uff0c\u5373\u5fb5\u7528\u653f\u5e9c\u57fa\u790e\u8a2d\u65bd\u4f86\u767c\u52d5\u9032\u4e00\u6b65\u7684\u653b\u64ca\uff0c\u5229\u7528\u9019\u7a2e\u5b58\u53d6\u6b0a\u9650\u4f86\u8a17\u7ba1\u60e1\u610f\u8ca0\u8f09\u4e26\u4fc3\u9032\u7db2\u8def\u9593\u8adc\u6d3b\u52d5\u3002\u5728\u516c\u5171\u4f3a\u670d\u5668\u4e0a\u5efa\u7acb\u7acb\u8db3\u9ede\u5f8c\uff0c\u8a72\u7d44\u7e54\u4f7f\u7528\u66f4\u591a\u7684\u958b\u6e90\u8edf\u9ad4\u5305\u62ec sqlmap\u3001nuclei\u3001xray\u3001vscan\u3001pocsuite \u548c wordpressscan\u4f86\u6383\u63cf\u654f\u611f\u6a94\u6848\u3001\u5bc6\u78bc\uff08\u7279\u5225\u662f\u96fb\u5b50\u90f5\u4ef6\uff09\u548c\u5176\u4ed6\u6709\u7528\u7684\u8cc7\u6e90\uff0c\u4f8b\u5982\u53ef\u80fd\u6307\u5411\u9032\u4e00\u6b65\u7121\u4eba\u7dad\u8b77\u7684\u4f3a\u670d\u5668\u7684\u5b64\u7368\u5b50\u7db2\u57df\u3002\u5b83\u9084\u63a1\u7528\u4e86\u8a31\u591a\u66b4\u529b\u653b\u64ca\uff0c\u4f8b\u5982\uff0c\u4f7f\u7528\u5e38\u7528\u5bc6\u78bc\u6e05\u55ae\u900f\u904e Outlook \u7db2\u9801\u7248\u7834\u89e3 Microsoft Exchange \u4f3a\u670d\u5668<\/p>\n\n\n\n

\"\"
Earth Krahang\u7684\u653b\u64ca\u93c8 Photo Credit: Trend Micro<\/figcaption><\/figure>\n\n\n\n

\u503c\u5f97\u6ce8\u610f\u7684\u662f\uff0cEarth Krahang \u7279\u5225\u559c\u6b61\u653b\u64ca\u7684\u5169\u500b\u6f0f\u6d1e\u662f CVE-2023-32315\uff08CVSS \u8a55\u7d1a\u70ba 7.5\u5206\u7684\u5373\u6642\u5354\u4f5c\u4f3a\u670d\u5668 Openfire \u4e2d\u7684\u547d\u4ee4\u57f7\u884c\u6f0f\u6d1e\uff09\u548c CVE-2022-21587\uff08\u8a55\u7d1a\u70ba 9.8\u5206\u7684\u56b4\u91cd\u547d\u4ee4\u57f7\u884c\u6f0f\u6d1e\uff09\u4f7f\u7528Oracle \u96fb\u5b50\u5546\u52d9\u5957\u4ef6\u4e2d\u7684Web \u61c9\u7528\u7a0b\u5f0f\u684c\u9762\u6574\u5408\u5668\uff0c\u85c9\u4ee5\u4f86\u7372\u5f97\u672a\u7d93\u6388\u6b0a\u7684\u5b58\u53d6\u4e26\u90e8\u7f72\u60e1\u610f\u8edf\u9ad4\u3002\u53e6\u5916\uff0c\u9b5a\u53c9\u5f0f\u7db2\u8def\u91e3\u9b5a\u4ecd\u7136\u662f Earth Krahang \u7684\u4e00\u500b\u91cd\u8981\u5a92\u4ecb\u3002\u70ba\u5f15\u8a98\u76ee\u6a19\u57f7\u884c\u60e1\u610f\u6587\u4ef6\u800c\u88fd\u4f5c\u7684\u96fb\u5b50\u90f5\u4ef6\u901a\u5e38\u4f7f\u7528\u5730\u7de3\u653f\u6cbb\u4e3b\u984c\u4f86\u88fd\u4f5c\uff0c\u8868\u660e\u8a98\u990c\u7684\u6230\u7565\u9078\u64c7\u3002Earth Krahang \u900f\u904e Outlook \u7db2\u9801\u7248\u3001\u6f0f\u6d1e\u6383\u63cf\u5c0b\u627e Web \u4f3a\u670d\u5668\u6f0f\u6d1e\u4ee5\u53ca\u6ce8\u5165\u5f8c\u9580\u5c0d Exchange \u4f3a\u670d\u5668\u9032\u884c\u66b4\u529b\u653b\u64ca\u3002\u6839\u64da\u8da8\u52e2\u79d1\u6280\u7684\u5831\u544a\uff0c\u8a72\u6d3b\u52d5\u7684\u5075\u5bdf\u5de5\u4f5c\u975e\u5e38\u5fb9\u5e95\uff0c\u5ee3\u6cdb\u6536\u96c6\u4e86\u76ee\u6a19\u5be6\u9ad4\u7684\u96fb\u5b50\u90f5\u4ef6\u5730\u5740\uff0c\u4ee5\u6700\u5927\u9650\u5ea6\u5730\u64f4\u5927\u5176\u7db2\u8def\u91e3\u9b5a\u5617\u8a66\u7684\u7bc4\u570d\u3002<\/p>\n\n\n\n

\u5728\u7372\u5f97\u521d\u59cb\u5b58\u53d6\u6b0a\u9650\u5f8c\uff0cEarth Krahang \u4f7f\u7528\u5404\u7a2e\u5de5\u5177\u548c\u6280\u8853\u4f86\u7dad\u6301\u5b58\u5728\u4e26\u5229\u7528\u53d7\u611f\u67d3\u7684\u7db2\u8def\u3002\u5728\u9762\u5411\u5927\u773e\u7684\u4f3a\u670d\u5668\u4e0a\u4f7f\u7528 SoftEther VPN \u662f\u4e00\u7a2e\u503c\u5f97\u6ce8\u610f\u7684\u7b56\u7565\uff0c\u53ef\u8b93\u5a01\u8105\u884c\u70ba\u8005\u6df1\u5165\u6ef2\u900f\u53d7\u5bb3\u8005\u7db2\u8def\u3002\u5f8c\u8105\u8feb\u6d3b\u52d5\u5305\u62ec\u555f\u7528\u9060\u7aef\u684c\u9762\u9023\u7dda\u3001\u6191\u8b49\u8f49\u5132\u4ee5\u53ca\u7db2\u8def\u5167\u7684\u6a6b\u5411\u79fb\u52d5\u4ee5\u5b58\u53d6\u654f\u611f\u8cc7\u8a0a\u3002<\/p>\n\n\n\n

Earth Krahang \u7684<\/a>\u5de5\u5177\u5305\u5305\u62ec\u591a\u500b\u60e1\u610f\u8edf\u9ad4\u5bb6\u65cf\uff0c\u5176\u4e2dCobalt Strike\u3001RESHELL \u548c XDealer \u6700\u70ba\u7a81\u51fa\u3002 RESHELL\uff08\u4e00\u500b\u7c21\u55ae\u7684 .NET \u5f8c\u9580\uff09\u548c XDealer\uff08\u4e00\u500b\u66f4\u8907\u96dc\u7684\u5f8c\u9580\uff0c\u5177\u6709 Windows \u548c Linux \u7684\u7248\u672c\uff09\u662f\u8a72\u6d3b\u52d5\u5728\u76ee\u6a19\u7cfb\u7d71\u4e2d\u6700\u521d\u7acb\u8db3\u7684\u95dc\u9375\u3002XDealer \u7684\u6f14\u8b8a\uff08\u900f\u904e\u8b58\u5225\u7684\u5404\u7a2e\u7248\u672c\u8b49\u660e\uff09\u8868\u660e\u5a01\u8105\u884c\u70ba\u8005\u6b63\u5728\u7a4d\u6975\u958b\u767c\u548c\u81ea\u8a02\u3002<\/p>\n\n\n\n

\u53d7\u5bb3\u8005\u548c\u6b78\u56e0<\/strong><\/strong><\/p>\n\n\n\n

\u6839\u64da\u7814\u7a76\uff0c\u8a72\u6d3b\u52d5\u91dd\u5c0d 23 \u500b\u570b\u5bb6\u7684\u7d04 70 \u540d\u53d7\u5bb3\u8005\uff0c\u4e3b\u8981\u91dd\u5c0d\u653f\u5e9c\u7d44\u7e54\u3002\u76ee\u6a19\u7684\u5ee3\u6cdb\u5730\u7406\u5206\u4f48\u7a81\u986f\u4e86 Earth Krahang \u5c0d\u5168\u7403\u7684\u91ce\u5fc3\u3002\u96d6\u7136\u76f4\u63a5\u6b78\u56e0\u5177\u6709\u6311\u6230\u6027\uff0c\u4f46\u8207\u4e2d\u570b\u95dc\u4fc2\u5a01\u8105\u7d44\u7e54 Earth Lusca \u7684\u806f\u7e6b\u4ee5\u53ca\u8207\u4e2d\u570b\u516c\u53f8\u5b89\u6d35\u8cc7\u8a0a\u79d1\u6280\uff08I-SOON\uff09\u7684\u6f5b\u5728\u806f\u7e6b\uff0c\u8868\u660e\u53ef\u80fd\u6709\u570b\u5bb6\u7d1a\u652f\u6301\u7684\u7d44\u7e54\u5728\u5354\u8abf\u884c\u52d5\u3002Earth Krahang \u4ee3\u8868\u4e86\u4e00\u7a2e\u8907\u96dc\u4e14\u6301\u7e8c\u7684\u7db2\u8def\u5a01\u8105\uff0c\u5176\u91cd\u9ede\u660e\u986f\u662f\u653f\u5e9c\u5be6\u9ad4\u548c\u5229\u7528\u653f\u5e9c\u57fa\u790e\u8a2d\u65bd\u9032\u884c\u7db2\u8def\u9593\u8adc\u6d3b\u52d5\u3002\u8a72\u6d3b\u52d5\u7368\u7279\u7684\u60e1\u610f\u8edf\u9ad4\u5bb6\u65cf\u548c\u7b56\u7565\u7a81<\/a>\u986f\u4e86\u5c0d\u5f37\u5927\u7db2\u8def\u5b89\u5168\u9632\u79a6\u548c\u610f\u8b58\u7684\u9700\u6c42\u3002\u5efa\u8b70\u7d44\u7e54\uff0c\u7279\u5225\u662f\u653f\u5e9c\u90e8\u9580\u5167\u7684\u7d44\u7e54\uff0c\u63a1\u53d6\u56b4\u683c\u7684\u5b89\u5168\u63aa\u65bd\uff0c\u5305\u62ec\u5b9a\u671f\u8edf\u9ad4\u66f4\u65b0\u3001\u54e1\u5de5\u6709\u95dc\u793e\u6703\u5de5\u7a0b\u653b\u64ca\u7684\u6559\u80b2\u4ee5\u53ca\u5be6\u65bd\u591a\u56e0\u7d20\u8eab\u4efd\u9a57\u8b49\u4ee5\u964d\u4f4e\u5165\u4fb5\u98a8\u96aa\u3002Earth Krahang \u4e0d\u65b7\u767c\u5c55\u7684\u7b56\u7565\u548c\u5de5\u5177\u8981\u6c42\u7db2\u8def\u5b89\u5168\u7b56\u7565\u4e0d\u65b7\u4fdd\u6301\u8b66\u60d5\u548c\u9069\u61c9\uff0c\u4ee5\u4fdd\u8b77\u654f\u611f\u8cc7\u8a0a\u548c\u57fa\u790e\u8a2d\u65bd\u514d\u53d7\u9019\u4e9b\u9ad8\u7d1a\u5a01\u8105\u7684\u5f71\u97ff\u3002<\/p>\n\n\n\n

Earth Krahang\u7684\u90e8\u5206\u5165\u4fb5\u6307\u6a19(Indicator of compromise -IOCs):<\/p>\n\n\n\n

244c32c4809a5ea72dfd2a53d0c535f17ba3b33e4c3ee6ed229858d687a2563a<\/p>\n\n\n\n

35f16e469047cf4ef78f87a616d26ec09e3d6a3d7a51415ea34805549a41dcfa<\/p>\n\n\n\n

3f0aa01ed70bc2ab29557521a65476ec2ff2c867315067cc8a5937d63bcbe815<\/p>\n\n\n\n

50cdd2397836d33a8dc285ed421d9b7cc69e38ba0421638235206fd466299dab<\/p>\n\n\n\n

57f64f170dfeaa1150493ed3f63ea6f1df3ca71ad1722e12ac0f77744fb1a829<\/p>\n\n\n\n

6fd7697efc137faf2d3ad5d63ffe4743db70f905a71dbed76207beeeb04732f2<\/p>\n\n\n\n

898a7527c065454ba9fad0e36469e12b214f5a3bd40a5ec7fcaf9b75afc34dce<\/p>\n\n\n\n

c14f6ac5bcd8645eb80a612a6bf6d58c31b0e28e50be871f278c341ed1fa8c7c<\/p>\n\n\n\n

d17fe5bc3042baf219e81cbbf991749dfcd8b6d73cf6506a8228e19910da3578<\/p>\n\n\n\n

23[.]106[.]122[.]5<\/p>\n\n\n\n

207[.]148[.]69[.]1<\/p>\n\n\n\n

45[.]76[.]157[.]92<\/p>\n\n\n\n

50[.]7[.]61[.]26<\/p>\n\n\n\n

50[.]7[.]61[.]27<\/p>\n\n\n\n

50[.]7[.]61[.]28<\/p>\n\n\n\n

\u6b32\u4e86\u89e3\u66f4\u591a\uff0c\u8acb\u53c3\u8003: \u00a0https:\/\/www.trendmicro.com\/en_us\/research\/24\/c\/earth-krahang.html<\/p>\n\n\n\n

\u201c\u8f49\u8cbc\u3001\u5206\u4eab\u6216\u5f15\u7528\u6587\u7ae0\u5167\u5bb9\uff0c\u8acb\u8a3b\u660e\u51fa\u8655\u70ba\u7ae3\u76df\u79d1\u6280https:\/\/www.billows.tech\/, \u4ee5\u514d\u89f8\u6cd5\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

Earth Krahang\u5229\u7528\u653f\u5e9c\u9593\u4fe1\u4efb\u767c\u52d5\u8de8\u653f\u5e9c\u653b\u64ca\uff0c\u91dd\u5c0d\u5168\u7403\u591a\u500b\u653f\u5e9c\u5be6\u9ad4\u7684APT\u6d3b\u52d5\uff0c\u99ed\u5ba2\u91cd\u9ede\u95dc\u6ce8\u6771\u5357\u4e9e\uff0c READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[174,165],"class_list":["post-3062","post","type-post","status-publish","format-standard","hentry","category-6","tag-news","tag-apt"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/3062","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3062"}],"version-history":[{"count":1,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/3062\/revisions"}],"predecessor-version":[{"id":3064,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/3062\/revisions\/3064"}],"wp:attachment":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}