启动项持久化 on Linux邪修https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96/Recent content in 启动项持久化 on Linux邪修Hugozh© 2024 Linux邪修启动项持久化基础知识https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/Mon, 01 Jan 0001 00:00:00 +0000https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/<h2 id="技术介绍">技术介绍<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bb%8b%e7%bb%8d">#</a></h2> <p>启动项持久化是一种利用系统启动机制进行持久化攻击的技术。攻击者通过在系统启动项中添加恶意程序或脚本，使系统在启动时自动执行恶意代码，从而实现持久化访问。本教程将详细介绍启动项持久化的基础知识、核心概念和技术方法，帮助安全人员理解和防御启动项持久化攻击。</p> <h3 id="启动项持久化核心概念">启动项持久化核心概念<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e6%a0%b8%e5%bf%83%e6%a6%82%e5%bf%b5">#</a></h3> <ul> <li><strong>启动项（Startup Item）</strong>：系统启动时自动执行的程序或脚本</li> <li><strong>启动项持久化（Startup Persistence）</strong>：利用启动项进行持久化攻击的技术</li> <li><strong>注册表启动项（Registry Startup）</strong>：通过注册表实现的启动项</li> <li><strong>启动文件夹（Startup Folder）</strong>：系统启动文件夹</li> <li><strong>服务启动（Service Startup）</strong>：通过服务实现的启动</li> <li><strong>计划任务启动（Scheduled Task Startup）</strong>：通过计划任务实现的启动</li> <li><strong>驱动启动（Driver Startup）</strong>：通过驱动实现的启动</li> <li><strong>WMI启动（WMI Startup）</strong>：通过WMI实现的启动</li> <li><strong>组策略启动（Group Policy Startup）</strong>：通过组策略实现的启动</li> <li><strong>启动项管理（Startup Management）</strong>：管理系统启动项</li> <li><strong>启动项监控（Startup Monitoring）</strong>：监控启动项活动</li> <li><strong>持久化（Persistence）</strong>：在系统中保持长期访问的技术</li> </ul> <h3 id="启动项持久化的特点">启动项持久化的特点<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e7%9a%84%e7%89%b9%e7%82%b9">#</a></h3> <ul> <li><strong>隐蔽性</strong>：启动项持久化攻击隐蔽性强</li> <li><strong>持久性</strong>：启动项持久化可以实现持久化访问</li> <li><strong>灵活性</strong>：启动项持久化技术灵活多样</li> <li><strong>依赖性</strong>：启动项持久化依赖系统启动机制</li> <li><strong>检测难度</strong>：启动项持久化检测难度较大</li> <li><strong>影响范围</strong>：启动项持久化影响范围广</li> </ul> <h3 id="启动项持久化的重要性">启动项持久化的重要性<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e7%9a%84%e9%87%8d%e8%a6%81%e6%80%a7">#</a></h3> <ul> <li><strong>攻击检测</strong>：检测启动项持久化攻击</li> <li><strong>系统加固</strong>：加固系统防止启动项持久化</li> <li><strong>安全防护</strong>：防护启动项持久化攻击</li> <li><strong>合规性</strong>：满足合规性要求</li> <li><strong>风险降低</strong>：降低安全风险</li> <li><strong>业务保护</strong>：保护业务连续性</li> </ul> <h2 id="技术体系">技术体系<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bd%93%e7%b3%bb">#</a></h2> <p>启动项持久化技术体系主要包括以下几个方面：</p> <h3 id="启动项持久化原理">启动项持久化原理<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e5%8e%9f%e7%90%86">#</a></h3> <ul> <li><strong>系统启动过程</strong>：系统的启动过程</li> <li><strong>启动项加载机制</strong>：启动项的加载机制</li> <li><strong>启动项类型</strong>：启动项的不同类型</li> <li><strong>启动项执行顺序</strong>：启动项的执行顺序</li> <li><strong>启动项权限</strong>：启动项的权限要求</li> </ul> <h3 id="启动项持久化技术">启动项持久化技术<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e6%8a%80%e6%9c%af">#</a></h3> <ul> <li><strong>注册表启动项持久化</strong>：通过注册表实现持久化</li> <li><strong>启动文件夹持久化</strong>：通过启动文件夹实现持久化</li> <li><strong>服务启动持久化</strong>：通过服务实现持久化</li> <li><strong>计划任务启动持久化</strong>：通过计划任务实现持久化</li> <li><strong>驱动启动持久化</strong>：通过驱动实现持久化</li> </ul> <h3 id="启动项持久化防御">启动项持久化防御<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e9%98%b2%e5%be%a1">#</a></h3> <ul> <li><strong>启动项监控</strong>：监控启动项活动</li> <li><strong>启动项管理</strong>：管理系统启动项</li> <li><strong>启动项白名单</strong>：使用启动项白名单</li> <li><strong>启动项黑名单</strong>：使用启动项黑名单</li> <li><strong>启动项权限管理</strong>：管理启动项权限</li> </ul> <h2 id="工具使用">工具使用<a class="anchor" href="#%e5%b7%a5%e5%85%b7%e4%bd%bf%e7%94%a8">#</a></h2> <h3 id="启动项持久化检测工具">启动项持久化检测工具<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e6%a3%80%e6%b5%8b%e5%b7%a5%e5%85%b7">#</a></h3> <ol> <li> <p><strong>Autoruns</strong>：</p> <ul> <li><strong>功能</strong>：启动项管理工具</li> <li><strong>用途</strong>：管理系统启动项</li> <li><strong>使用方法</strong>： <div class="highlight"><pre tabindex="0" style="color:#e2e4e5;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#78787e"># 下载Autoruns</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 从Sysinternals官网下载</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 运行Autoruns</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 查看所有启动项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 检查可疑启动项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 禁用可疑启动项</span></span></span></code></pre></div></li> </ul> </li> <li> <p><strong>CCleaner</strong>：</p>启动项持久化技术详解https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96%E6%8A%80%E6%9C%AF%E8%AF%A6%E8%A7%A3/Mon, 01 Jan 0001 00:00:00 +0000https://linuxiexiu.github.io/docs/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%8C%81%E4%B9%85%E5%8C%96%E6%8A%80%E6%9C%AF%E8%AF%A6%E8%A7%A3/<h1 id="启动项持久化技术详解">启动项持久化技术详解<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e6%8a%80%e6%9c%af%e8%af%a6%e8%a7%a3">#</a></h1> <h2 id="技术介绍">技术介绍<a class="anchor" href="#%e6%8a%80%e6%9c%af%e4%bb%8b%e7%bb%8d">#</a></h2> <p>启动项持久化是一种常见的系统持久化技术，攻击者通过修改系统的启动配置，使恶意代码在系统启动时自动执行。这种技术利用了操作系统的启动机制，具有操作简单、效果明显和难以完全防御等特点。本教程将详细介绍启动项持久化的核心概念、技术方法、防御措施和案例分析，帮助安全人员理解和防御这种持久化攻击。</p> <h3 id="启动项持久化核心概念">启动项持久化核心概念<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e6%a0%b8%e5%bf%83%e6%a6%82%e5%bf%b5">#</a></h3> <ul> <li><strong>启动项</strong>：操作系统启动时自动执行的程序或服务的配置项</li> <li><strong>持久化</strong>：使恶意代码在系统重启后仍然能够执行的技术</li> <li><strong>自启动</strong>：系统启动时自动执行的程序或服务</li> <li><strong>注册表</strong>：Windows系统中存储配置信息的数据库</li> <li><strong>启动脚本</strong>：系统启动时执行的脚本文件</li> <li><strong>服务</strong>：在后台运行的程序，通常在系统启动时自动启动</li> <li><strong>计划任务</strong>：按照预定时间执行的任务</li> <li><strong>权限提升</strong>：通过启动项获取更高的系统权限</li> <li><strong>横向移动</strong>：通过启动项在网络中从一个系统移动到另一个系统</li> <li><strong>防御规避</strong>：通过各种技术，逃避安全软件的检测</li> </ul> <h3 id="启动项持久化技术体系">启动项持久化技术体系<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e6%8a%80%e6%9c%af%e4%bd%93%e7%b3%bb">#</a></h3> <ul> <li><strong>注册表启动项</strong>：通过修改Windows注册表的启动项，实现自启动</li> <li><strong>启动文件夹</strong>：通过在启动文件夹中放置快捷方式或脚本，实现自启动</li> <li><strong>系统服务</strong>：通过创建系统服务，实现自启动</li> <li><strong>计划任务</strong>：通过创建计划任务，实现定期执行或系统启动时执行</li> <li><strong>启动脚本</strong>：通过修改系统启动脚本，实现自启动</li> <li><strong>引导过程</strong>：通过修改系统引导过程，实现自启动</li> </ul> <h3 id="启动项持久化防御技术">启动项持久化防御技术<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e9%98%b2%e5%be%a1%e6%8a%80%e6%9c%af">#</a></h3> <ul> <li><strong>启动项监控</strong>：监控启动项的创建和修改</li> <li><strong>注册表监控</strong>：监控注册表的修改，特别是启动相关的键值</li> <li><strong>服务监控</strong>：监控系统服务的创建和修改</li> <li><strong>计划任务监控</strong>：监控计划任务的创建和修改</li> <li><strong>启动文件夹监控</strong>：监控启动文件夹的文件变化</li> <li><strong>系统硬化</strong>：加强系统配置，减少启动项的攻击面</li> <li><strong>安全工具</strong>：使用专业的安全工具，检测和清除恶意启动项</li> </ul> <h2 id="入门级使用">入门级使用<a class="anchor" href="#%e5%85%a5%e9%97%a8%e7%ba%a7%e4%bd%bf%e7%94%a8">#</a></h2> <h3 id="启动项基础">启动项基础<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e5%9f%ba%e7%a1%80">#</a></h3> <p>了解启动项的基本概念和操作：</p> <div class="highlight"><pre tabindex="0" style="color:#e2e4e5;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#78787e"># 1. Windows启动项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 注册表启动项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 运行regedit.exe，查看以下注册表项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 启动文件夹</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 系统启动文件夹</span> </span></span><span style="display:flex;"><span>C:<span style="color:#5af78e">\P</span>rogramData<span style="color:#5af78e">\M</span>icrosoft<span style="color:#5af78e">\W</span>indows<span style="color:#5af78e">\S</span>tart Menu<span style="color:#5af78e">\P</span>rograms<span style="color:#5af78e">\S</span>tartUp </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 用户启动文件夹</span> </span></span><span style="display:flex;"><span>C:<span style="color:#5af78e">\U</span>sers<span style="color:#5af78e">\用</span>户名<span style="color:#5af78e">\A</span>ppData<span style="color:#5af78e">\R</span>oaming<span style="color:#5af78e">\M</span>icrosoft<span style="color:#5af78e">\W</span>indows<span style="color:#5af78e">\S</span>tart Menu<span style="color:#5af78e">\P</span>rograms<span style="color:#5af78e">\S</span>tartup </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 系统服务</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 运行services.msc，查看系统服务</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 计划任务</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 运行taskschd.msc，查看计划任务</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 2. Linux启动项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 系统服务</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># Systemd</span> </span></span><span style="display:flex;"><span>systemctl list-unit-files --type<span style="color:#ff6ac1">=</span>service </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># SysV</span> </span></span><span style="display:flex;"><span>service --status-all </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 启动脚本</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># Systemd</span> </span></span><span style="display:flex;"><span>/etc/systemd/system/ </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># SysV</span> </span></span><span style="display:flex;"><span>/etc/init.d/ </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 启动项配置</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># /etc/rc.local</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 用户启动项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># ~/.config/autostart/</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 3. macOS启动项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 系统偏好设置 -&gt; 用户与群组 -&gt; 登录项</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 启动脚本</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># /Library/LaunchDaemons/</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># /Library/LaunchAgents/</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># ~/Library/LaunchAgents/</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 4. 启动项安全风险</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 系统被恶意代码控制</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 系统性能下降</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 数据被窃取</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 系统成为跳板，攻击其他系统</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 系统被用于挖矿、发送垃圾邮件等恶意活动</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 5. 基础安全实践</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 定期检查启动项：查看系统启动项，移除可疑项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 限制启动项权限：使用最小权限运行启动项</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 及时更新系统：安装系统补丁，修复安全漏洞</span> </span></span><span style="display:flex;"><span><span style="color:#78787e"># 使用安全工具：使用杀毒软件、防火墙等安全工具</span></span></span></code></pre></div><h3 id="启动项持久化基础">启动项持久化基础<a class="anchor" href="#%e5%90%af%e5%8a%a8%e9%a1%b9%e6%8c%81%e4%b9%85%e5%8c%96%e5%9f%ba%e7%a1%80">#</a></h3> <p>了解启动项持久化的基本技术：</p>