{"id":2784,"date":"2024-09-15T00:22:38","date_gmt":"2024-09-15T00:22:38","guid":{"rendered":"https:\/\/tastycounter.net\/index.php\/2024\/09\/15\/windows-powershell-co-the-cho-phep-virus-xam-nhap-ma-khong-bi-phat-hien\/"},"modified":"2024-09-15T00:22:38","modified_gmt":"2024-09-15T00:22:38","slug":"windows-powershell-co-the-cho-phep-virus-xam-nhap-ma-khong-bi-phat-hien","status":"publish","type":"post","link":"https:\/\/tastycounter.net\/index.php\/2024\/09\/15\/windows-powershell-co-the-cho-phep-virus-xam-nhap-ma-khong-bi-phat-hien\/","title":{"rendered":"Windows PowerShell c\u00f3 th\u1ec3 cho ph\u00e9p virus x\u00e2m nh\u1eadp m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n"},"content":{"rendered":"<\/p>\n
\n

B\u1ea5t c\u1ee9 khi n\u00e0o m\u1ed9t c\u00f4ng c\u1ee5 Windows c\u00f3 quy\u1ec1n truy c\u1eadp n\u00e2ng cao v\u00e0o m\u00e1y t\u00ednh, s\u1ebd c\u00f3 ng\u01b0\u1eddi truy \u0111u\u1ed5i r\u00e1o ri\u1ebft, c\u1ed1 g\u1eafng t\u00ecm c\u00e1ch khai th\u00e1c n\u00f3 \u0111\u1ec3 ch\u1ea1y ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a nh\u1eefng ng\u01b0\u1eddi d\u00f9ng kh\u00e1c. PowerShell c\u0169ng kh\u00f4ng ngo\u1ea1i l\u1ec7 v\u00e0 nh\u1eefng k\u1ebb x\u1ea5u \u0111\u00e3 t\u00ecm ra c\u00e1ch s\u1eed d\u1ee5ng n\u00f3 g\u00e2y h\u1ed7n lo\u1ea1n tr\u00ean m\u00e1y t\u00ednh c\u1ee7a m\u1ecdi ng\u01b0\u1eddi.<\/p>\n

Nh\u01b0ng PowerShell l\u00e0 g\u00ec v\u00e0 l\u00e0m th\u1ebf n\u00e0o \u0111\u1ec3 c\u00f3 th\u1ec3 l\u1ea1m d\u1ee5ng n\u00f3?<\/p>\n

PowerShell<\/a> tr\u00ean Windows l\u00e0 g\u00ec?<\/h2>\n
<\/figure>\n
<\/ins><\/div>\n

Windows PowerShell l\u00e0 m\u1ed9t c\u00f4ng c\u1ee5 t\u1ef1 \u0111\u1ed9ng h\u00f3a v\u00e0 c\u1ea5u h\u00ecnh n\u00e2ng cao. B\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng n\u00f3 \u0111\u1ec3 th\u1ef1c thi c\u00e1c l\u1ec7nh \u0111i\u1ec1u ch\u1ec9nh h\u1ec7 th\u1ed1ng c\u1ee7a m\u00ecnh ho\u1eb7c ch\u1ea1y c\u00e1c script t\u1ef1 \u0111\u1ed9ng th\u1ef1c hi\u1ec7n c\u00e1c t\u00e1c v\u1ee5 ph\u1ee9c t\u1ea1p cho b\u1ea1n.<\/p>\n

V\u00ec PowerShell c\u00f3 quy\u1ec1n h\u1ec7 th\u1ed1ng \u0111\u1ec3 thay \u0111\u1ed5i c\u00e1c c\u00e0i \u0111\u1eb7t quan tr\u1ecdng tr\u00ean PC ho\u1eb7c ch\u1ea1y c\u00e1c script nh\u1ea1y c\u1ea3m v\u1edbi h\u1ec7 th\u1ed1ng, n\u00ean nh\u1eefng k\u1ebb x\u1ea5u s\u1ebd t\u00ecm c\u00e1ch \u0111\u1ec3 n\u00f3 th\u1ef1c thi m\u00e3 \u0111\u1ed9c. Tuy nhi\u00ean, tr\u01b0\u1edbc khi \u0111i s\u00e2u v\u00e0o c\u00e1ch c\u00f3 th\u1ec3 l\u1ea1m d\u1ee5ng n\u00f3, c\u1ea7n l\u01b0u \u00fd r\u1eb1ng b\u1ea3n th\u00e2n PowerShell kh\u00f4ng ph\u1ea3i l\u00e0 m\u1ed9t \u1ee9ng d\u1ee5ng \u0111\u1ed9c h\u1ea1i. N\u00f3 l\u00e0 m\u1ed9t ph\u1ea7n c\u1ed1t l\u00f5i c\u1ee7a Windows kh\u00f4ng th\u1ec3 b\u1ecb v\u00f4 hi\u1ec7u h\u00f3a.<\/p>\n

\u0110i\u1ec1u g\u00ec khi\u1ebfn PowerShell tr\u1edf n\u00ean nguy hi\u1ec3m nh\u01b0 v\u1eady?<\/h2>\n
\"V\u00ed
V\u00ed d\u1ee5 v\u1ec1 code c\u1ee7a Peaklight<\/figcaption><\/figure>\n

Khi m\u1ed9t t\u00e1c nh\u00e2n x\u1ea5u mu\u1ed1n l\u1ee3i d\u1ee5ng PowerShell, ch\u00fang th\u01b0\u1eddng s\u1eed d\u1ee5ng m\u1ed9t trong hai c\u00e1ch sau: L\u1eeba m\u1ecdi ng\u01b0\u1eddi th\u1ef1c thi m\u00e3 \u0111\u1ed9c trong PowerShell ho\u1eb7c t\u1ea1o file ch\u1ea1y script \u0111\u1ed9c h\u1ea1i khi m\u1edf.<\/p>\n

C\u00e1c t\u00e1c nh\u00e2n \u0111\u1ed9c h\u1ea1i thuy\u1ebft ph\u1ee5c m\u1ecdi ng\u01b0\u1eddi ch\u1ea1y l\u1ec7nh<\/h3>\n

\u0110\u1ea7u ti\u00ean, ch\u00fang ta h\u00e3y t\u00ecm hi\u1ec3u khi m\u1ed9t t\u00e1c nh\u00e2n \u0111\u1ed9c h\u1ea1i l\u1eeba ai \u0111\u00f3 ch\u1ea1y l\u1ec7nh PowerShell. Th\u1ee7 thu\u1eadt n\u00e0y th\u01b0\u1eddng li\u00ean quan \u0111\u1ebfn vi\u1ec7c d\u1ecda n\u1ea1n nh\u00e2n tin r\u1eb1ng h\u1ecd c\u1ea7n ch\u1ea1y l\u1ec7nh PowerShell \u0111\u1ec3 kh\u1eafc ph\u1ee5c s\u1ef1 c\u1ed1 kh\u00f4ng t\u1ed3n t\u1ea1i.<\/p>\n

Theo The Register \u0111\u01b0a tin, m\u1ed9t trong nh\u1eefng th\u1ee7 thu\u1eadt nh\u01b0 v\u1eady li\u00ean quan \u0111\u1ebfn vi\u1ec7c c\u00e1c t\u00e1c nh\u00e2n x\u1ea5u x\u00e2m nh\u1eadp v\u00e0o nh\u1eefng trang web h\u1ee3p ph\u00e1p v\u00e0 thay \u0111\u1ed5i ch\u00fang \u0111\u1ec3 hi\u1ec3n th\u1ecb th\u00f4ng b\u00e1o l\u1ed7i gi\u1ea3. L\u1ed7i n\u00e0y cho bi\u1ebft c\u00f3 \u0111i\u1ec1u g\u00ec \u0111\u00f3 kh\u00f4ng \u1ed5n v\u1edbi b\u1ea3n sao Windows, Google Chrome, Office ho\u1eb7c OneDrive c\u1ee7a ng\u01b0\u1eddi d\u00f9ng. \u0110\u1ec3 kh\u1eafc ph\u1ee5c “s\u1ef1 c\u1ed1” n\u00e0y, l\u1ed7i gi\u1ea3 m\u1ea1o cho bi\u1ebft ng\u01b0\u1eddi d\u00f9ng n\u00ean ch\u1ea1y l\u1ec7nh PowerShell \u0111\u1ec3 kh\u1eafc ph\u1ee5c s\u1ef1 c\u1ed1.<\/p>\n

<\/ins><\/div>\n

T\u1ea5t nhi\u00ean, code \u0111\u01b0\u1ee3c cung c\u1ea5p kh\u00f4ng s\u1eeda ch\u1eefa b\u1ea5t c\u1ee9 th\u1ee9 g\u00ec. Thay v\u00e0o \u0111\u00f3, n\u00f3 y\u00eau c\u1ea7u PowerShell k\u1ebft n\u1ed1i v\u1edbi m\u00e1y ch\u1ee7, t\u1ea3i xu\u1ed1ng file th\u1ef1c thi \u0111\u1ed9c h\u1ea1i t\u1eeb m\u00e1y ch\u1ee7 b\u00ean ngo\u00e0i v\u00e0 ch\u1ea1y file \u0111\u00f3. M\u1ed9t tr\u01b0\u1eddng h\u1ee3p t\u1ea5n c\u00f4ng n\u00e0y s\u1eed d\u1ee5ng PowerShell \u0111\u1ec3 t\u1ea3i xu\u1ed1ng m\u1ed9t dropper, sau \u0111\u00f3 t\u1ea3i 5 ch\u1ee7ng ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i kh\u00e1c v\u00e0o PC m\u1ee5c ti\u00eau.<\/p>\n

M\u1ed9t bi\u1ebfn th\u1ec3 kh\u00e1c c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng PowerShell “do ng\u01b0\u1eddi d\u00f9ng k\u00edch ho\u1ea1t” n\u00e0y \u0111\u00e3 b\u1ecb ph\u00e1t hi\u1ec7n khi \u0111\u01b0\u1ee3c g\u1eedi qua email. Email bao g\u1ed3m m\u1ed9t file HTML \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf tr\u00f4ng gi\u1ed1ng nh\u01b0 Microsoft Word. Khi m\u1edf ra, n\u00f3 tuy\u00ean b\u1ed1 r\u1eb1ng n\u00f3 kh\u00f4ng th\u1ec3 hi\u1ec3n th\u1ecb th\u00f4ng tin trong t\u00e0i li\u1ec7u Word v\u00ec m\u1ed9t ti\u1ec7n \u00edch m\u1edf r\u1ed9ng \u0111\u00e3 ng\u1eebng ho\u1ea1t \u0111\u1ed9ng. Sau \u0111\u00f3, ng\u01b0\u1eddi d\u00f9ng \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u sao ch\u00e9p-d\u00e1n m\u00e3 \u0111\u1ed9c v\u00e0o PowerShell \u0111\u1ec3 s\u1eeda l\u1ed7i ho\u1eb7c t\u1ea3i xu\u1ed1ng m\u1ed9t file x\u1ea5u th\u1ef1c hi\u1ec7n c\u00f4ng vi\u1ec7c cho k\u1ebb x\u1ea5u.<\/p>\n

File \u0111\u1ed9c h\u1ea1i s\u1eed d\u1ee5ng PowerShell \u0111\u1ec3 ch\u1ea1y fileless malware<\/h3>\n

Phi\u00ean b\u1ea3n \u0111\u00e1ng s\u1ee3 h\u01a1n c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng PowerShell s\u1eed d\u1ee5ng fileless malware \u0111\u1ec3 t\u1ea5n c\u00f4ng m\u1ee5c ti\u00eau. \u0110i\u1ec1u n\u00e0y s\u1eed d\u1ee5ng PowerShell \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c t\u00e1c v\u1ee5 \u0111\u1ed9c h\u1ea1i m\u00e0 kh\u00f4ng c\u1ea7n t\u1ea3i xu\u1ed1ng file tr\u00ean PC c\u1ee7a n\u1ea1n nh\u00e2n. N\u1ebfu ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i kh\u00f4ng t\u1ea3i xu\u1ed1ng b\u1ea5t k\u1ef3 file n\u00e0o, n\u00f3 s\u1ebd ng\u0103n ph\u1ea7n m\u1ec1m di\u1ec7t virus ph\u00e1t hi\u1ec7n, khi\u1ebfn vi\u1ec7c t\u00ecm v\u00e0 x\u00f3a ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i tr\u1edf n\u00ean kh\u00f3 kh\u0103n.<\/p>\n

Ph\u01b0\u01a1ng ph\u00e1p t\u1ea5n c\u00f4ng n\u00e0y th\u01b0\u1eddng ng\u1ee5y trang file LNK ch\u1ee9a script \u0111\u1ed9c h\u1ea1i th\u00e0nh m\u1ed9t file kh\u00e1c. Trong v\u00ed d\u1ee5 v\u1ec1 phim b\u1ea5t h\u1ee3p ph\u00e1p, file LNK \u0111\u00e3 \u0111\u01b0\u1ee3c s\u1eeda \u0111\u1ed5i \u0111\u1ec3 tr\u00f4ng gi\u1ed1ng nh\u01b0 file video \u0111\u1ec3 \u0111\u00e1nh l\u1eeba m\u1ecdi ng\u01b0\u1eddi ch\u1ea1y n\u00f3.<\/p>\n

C\u00e1ch tr\u00e1nh c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng PowerShell<\/h2>\n

V\u1ea5n \u0111\u1ec1 v\u1edbi vi\u1ec7c th\u1ef1c hi\u1ec7n c\u00e1c b\u01b0\u1edbc \u0111\u1ec3 tr\u00e1nh c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng PowerShell l\u00e0 c\u00f3 nh\u1eefng b\u1ea3n s\u1eeda l\u1ed7i h\u1ee3p ph\u00e1p y\u00eau c\u1ea7u b\u1ea1n nh\u1eadp l\u1ec7nh v\u00e0o PowerShell. Do \u0111\u00f3, tr\u01b0\u1edbc khi nh\u1eadp l\u1ec7nh, b\u1ea1n n\u00ean d\u00e0nh th\u1eddi gian v\u00e0 c\u00e2n nh\u1eafc xem ngu\u1ed3n \u0111\u00e1ng tin c\u1eady \u0111\u1ebfn m\u1ee9c n\u00e0o.<\/p>\n

N\u1ebfu b\u1ea1n \u0111ang t\u00ecm ki\u1ebfm b\u1ea3n s\u1eeda l\u1ed7i v\u00e0 t\u00ecm th\u1ea5y m\u1ed9t trang web \u0111\u00e1ng tin c\u1eady v\u00e0 c\u00f3 uy t\u00edn n\u00eau r\u1eb1ng b\u1ea1n n\u00ean s\u1eed d\u1ee5ng l\u1ec7nh, th\u00ec b\u1ea1n c\u00f3 th\u1ec3 th\u1ef1c thi l\u1ec7nh \u0111\u00f3. N\u1ebfu l\u1ec7nh \u0111\u00f3 \u0111\u1ebfn v\u1edbi b\u1ea1n t\u1eeb m\u1ed9t th\u00f4ng b\u00e1o l\u1ed7i gi\u1ea3 m\u1ea1o \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 khi\u1ebfn b\u1ea1n ho\u1ea3ng s\u1ee3, th\u00ec n\u00f3 s\u1ebd g\u00e2y ra thi\u1ec7t h\u1ea1i.<\/p>\n

N\u1ebfu b\u1ea1n th\u1ea5y m\u1ed9t l\u1ec7nh v\u00e0 kh\u00f4ng ch\u1eafc l\u1ec7nh \u0111\u00f3 c\u00f3 t\u00e1c d\u1ee5ng g\u00ec, h\u00e3y th\u1eed t\u00ecm ki\u1ebfm l\u1ec7nh \u0111\u00f3 tr\u1ef1c tuy\u1ebfn. N\u1ebfu l\u1ec7nh \u0111\u00f3 h\u1eefu \u00edch, b\u1ea1n s\u1ebd th\u1ea5y k\u1ebft qu\u1ea3 t\u1eeb nh\u1eefng ng\u01b0\u1eddi kh\u00e1c \u0111\u1ec1 xu\u1ea5t l\u1ec7nh \u0111\u00f3. N\u1ebfu b\u1ea1n kh\u00f4ng t\u00ecm th\u1ea5y b\u1ea5t k\u1ef3 th\u1ee9 g\u00ec (ho\u1eb7c th\u1eadm ch\u00ed th\u1ea5y ai \u0111\u00f3 b\u00e1o c\u00e1o l\u1ec7nh \u0111\u00f3 l\u00e0 \u0111\u1ed9c h\u1ea1i), th\u00ec vi\u1ec7c ch\u1ea1y l\u1ec7nh \u0111\u00f3 kh\u00f4ng ph\u1ea3i l\u00e0 m\u1ed9t \u00fd ki\u1ebfn \u200b\u200bhay.<\/p>\n

N\u1ebfu v\u00f4 t\u00ecnh r\u01a1i v\u00e0o m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng PowerShell, b\u1ea1n c\u00f3 th\u1ec3 th\u1eed t\u00ecm ki\u1ebfm c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh di\u1ec7t virus t\u1ed1t nh\u1ea5t<\/a> \u0111\u1ec3 ti\u00eau di\u1ec7t ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i. Tuy nhi\u00ean, nh\u01b0 b\u00e0i vi\u1ebft \u0111\u00e3 \u0111\u1ec1 c\u1eadp tr\u01b0\u1edbc \u0111\u00f3, c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng PowerShell s\u1ebd c\u1ed1 g\u1eafng h\u1ebft s\u1ee9c \u0111\u1ec3 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n. N\u1ebfu b\u1ea1n nh\u1eadn th\u1ea5y c\u00f3 \u0111i\u1ec1u g\u00ec \u0111\u00f3 b\u1ea5t th\u01b0\u1eddng sau khi ch\u1ea1y l\u1ec7nh PowerShell, c\u00e1ch t\u1ed1t nh\u1ea5t l\u00e0 c\u00e0i \u0111\u1eb7t l\u1ea1i h\u1ec7 \u0111i\u1ec1u h\u00e0nh \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o m\u1ecdi th\u1ee9 \u0111\u00e3 b\u1ecb x\u00f3a.<\/p>\n

PowerShell l\u00e0 m\u1ed9t c\u00f4ng c\u1ee5 ti\u1ec7n d\u1ee5ng gi\u00fap b\u1ea1n ki\u1ec3m so\u00e1t n\u00e2ng cao PC c\u1ee7a m\u00ecnh. Tuy nhi\u00ean, m\u1ed9t s\u1ed1 k\u1ebb x\u1ea5u c\u1ed1 g\u1eafng l\u1eeba m\u1ecdi ng\u01b0\u1eddi s\u1eed d\u1ee5ng sai m\u1ee5c \u0111\u00edch. May m\u1eafn thay, n\u1ebfu gi\u1eef \u0111\u01b0\u1ee3c s\u1ef1 t\u1ec9nh t\u00e1o, b\u1ea1n c\u00f3 th\u1ec3 tr\u00e1nh b\u1ecb t\u1ea5n c\u00f4ng.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

B\u1ea5t c\u1ee9 khi n\u00e0o m\u1ed9t c\u00f4ng c\u1ee5 Windows c\u00f3 quy\u1ec1n truy c\u1eadp n\u00e2ng cao v\u00e0o m\u00e1y t\u00ednh, s\u1ebd c\u00f3 ng\u01b0\u1eddi truy \u0111u\u1ed5i r\u00e1o ri\u1ebft, c\u1ed1 g\u1eafng t\u00ecm c\u00e1ch khai th\u00e1c n\u00f3 \u0111\u1ec3 ch\u1ea1y ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a nh\u1eefng ng\u01b0\u1eddi d\u00f9ng kh\u00e1c. PowerShell c\u0169ng kh\u00f4ng ngo\u1ea1i l\u1ec7 v\u00e0 nh\u1eefng k\u1ebb x\u1ea5u \u0111\u00e3 […]<\/p>\n","protected":false},"author":1,"featured_media":2785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2784","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-khong-phan-loai"],"_links":{"self":[{"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/posts\/2784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/comments?post=2784"}],"version-history":[{"count":0,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/posts\/2784\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/media\/2785"}],"wp:attachment":[{"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/media?parent=2784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/categories?post=2784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tastycounter.net\/index.php\/wp-json\/wp\/v2\/tags?post=2784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}