{"id":299737,"date":"2024-01-05T19:00:00","date_gmt":"2024-01-05T11:00:00","guid":{"rendered":"https:\/\/www.idc.net\/help\/299737\/"},"modified":"2024-01-05T19:00:00","modified_gmt":"2024-01-05T11:00:00","slug":"%e5%ae%9e%e4%be%8b%e8%ae%b2%e8%a7%a3%e5%a6%82%e4%bd%95%e5%88%a9%e7%94%a8excel%e6%b8%85%e9%99%a4dll%e6%9c%a8%e9%a9%ac","status":"publish","type":"post","link":"https:\/\/idc.net\/help\/299737\/","title":{"rendered":"\u5b9e\u4f8b\u8bb2\u89e3\u5982\u4f55\u5229\u7528Excel\u6e05\u9664DLL\u6728\u9a6c"},"content":{"rendered":"

DLL\u6728\u9a6c\u662f\u4e00\u79cd\u7f51\u7edc\u9ed1\u5ba2\u7684\u60ef\u7528\u6728\u9a6c\uff0c\u5b83\u5728\u8fd0\u884c\u65f6\u53ef\u4ee5\u4f9d\u9644\u5728\u5f88\u591a\u7cfb\u7edf\u5173\u952e\u8fdb\u7a0b\u4e2d\uff0c\u800c\u4e0d\u51fa\u73b0\u65b0\u7684\u8fdb\u7a0b\u4fe1\u606f\uff0c\u6240\u4ee5\u5373\u4fbf\u662f\u88ab\u68c0\u6d4b\u51fa\u6765\u4e5f\u65e0\u6cd5\u67e5\u6740\u3002\u4f46\u5b9e\u9645\u4e0a\uff0c\u6211\u4eec\u901a\u8fc7Excel\u8f6f\u4ef6\uff0c\u5c31\u53ef\u4ee5\u5230\u7684\u6e05\u9664DLL\u6728\u9a6c\u7684\u76ee\u7684\u3002<\/p>\n

\u7b2c\u4e00\u6b65\uff1a\u67e5\u627e\u88ab\u611f\u67d3\u7684\u8fdb\u7a0b<\/strong><\/p>\n

\u8fd1\u65e5\u5f00\u673a\u4e0a\u7f51\u4e00\u6bb5\u65f6\u95f4\u540e\u5c31\u89c9\u5f97\u7f51\u901f\u7279\u522b\u7684\u6162\uff0c\u4e8e\u662f\u4fbf\u8fd0\u884c\u201cnetstat -a -n -o\u201d\u67e5\u770b\u5f00\u653e\u7684\u7aef\u53e3\u548c\u8fde\u63a5\uff0c\u5176\u4e2d\u8fdb\u7a0bPID\u4e3a580\u53d1\u8d77\u7684\u8fde\u63a5\u6781\u4e3a\u53ef\u7591\uff1a\u72b6\u6001\u4e3aESTABLISHED\uff0c\u8868\u793a\u4e24\u53f0\u673a\u5668\u6b63\u5728\u901a\u4fe1\uff08\u89c1\u56fe1\uff09\u3002\u901a\u8fc7\u4efb\u52a1\u7ba1\u7406\u5668\u53ef\u4ee5\u77e5\u9053\u8fd9\u4e2a\u8fdb\u7a0b\u4e3alsass.exe\uff0c\u6839\u636e\u8fdb\u7a0b\u7684\u89e3\u91ca\uff0clsass.exe\u662f\u7528\u4e8e\u5fae\u8f6fWindows\u7cfb\u7edf\u7684\u5b89\u5168\u673a\u5236\uff0c\u5b83\u7528\u4e8e\u672c\u5730\u5b89\u5168\u548c\u767b\u9646\u7b56\u7565\uff0c\u663e\u7136\u8fd9\u4e2a\u8fdb\u7a0b\u662f\u4e0d\u9700\u8981\u5f00\u653e\u7aef\u53e3\u548c\u5916\u90e8\u8fde\u63a5\u7684\uff0c\u636e\u6b64\u5224\u65ad\u8be5\u8fdb\u7a0b\u6781\u53ef\u80fd\u63d2\u5165DLL\u6728\u9a6c\u3002\u5982\u679c\u7267\u9a6c\u8005\u5f53\u524d\u6ca1\u6709\u8fdb\u884c\u8fde\u63a5\uff0c\u8fd8\u53ef\u4ee5\u901a\u8fc7\u7aef\u53e3\u72b6\u6001\u5224\u65ad\u662f\u5426\u4e2d\u62db\uff0c\u5982TIME_WAIT\u7684\u610f\u601d\u662f\u7ed3\u675f\u4e86\u8fd9\u6b21\u8fde\u63a5\uff0c\u8bf4\u660e\u7aef\u53e3\u66fe\u7ecf\u6709\u8fc7\u8bbf\u95ee\uff0c\u4f46\u8bbf\u95ee\u7ed3\u675f\u4e86\uff0c\u8868\u660e\u5df2\u7ecf\u6709\u9ed1\u5ba2\u5165\u4fb5\u8fc7\u672c\u673a\u3002 LISTENING\u8868\u793a\u5904\u4e8e\u4fa6\u542c\u72b6\u6001\uff0c\u7b49\u5f85\u8fde\u63a5\uff0c\u4f46\u8fd8\u6ca1\u6709\u88ab\u8fde\u63a5\uff0c\u4e0d\u8fc7\u53ea\u6709TCP\u534f\u8bae\u7684\u670d\u52a1\u7aef\u53e3\u624d\u80fd\u5904\u4e8eLISTENING\u72b6\u6001\u3002<\/p>\n

 <\/p>\n

\n

\u5c0f\u63d0\u793a\uff1a\u5224\u65ad\u662f\u5426\u4e2d\u62db\u7684\u524d\u63d0\u662f\u8981\u627e\u51fa\u88ab\u611f\u67d3\u7684\u8fdb\u7a0b\uff0c\u6309\u88ab\u63d2\u5165\u8fdb\u7a0b\u7684\u7c7b\u522b\u5206\uff0cDLL\u6728\u9a6c\u5927\u81f4\u53ef\u4ee5\u5206\u4e3a\uff1a<\/p>\n

1.\u63d2\u5165\u5e38\u7528\u8fdb\u7a0b\uff0c\u5982Notepad.exe\u3001Iexplorer.exe\uff08\u6b64\u7c7b\u6728\u9a6c\u7684\u5224\u65ad\u5f88\u7b80\u5355\uff0c\u5f00\u673a\u540e\u4e0d\u542f\u52a8\u4efb\u4f55\u7a0b\u5e8f\uff0c\u6253\u5f00\u4efb\u52a1\u7ba1\u7406\u5668\u5982\u679c\u53d1\u73b0\u4e0a\u8ff0\u8fdb\u7a0b\uff0c\u90a3\u5c31\u53ef\u4ee5\u5224\u65ad\u4e2d\u62db\u4e86\uff09\u3002<\/p>\n

2.\u63d2\u5165\u7cfb\u7edf\u8fdb\u7a0b\uff0c\u5982Explorer.exe\u3001lsass.exe\uff08\u7531\u4e8e\u6bcf\u53f0\u7535\u8111\u5f00\u673a\u540e\u90fd\u6709\u4e0a\u8ff0\u7684\u8fdb\u7a0b\uff0c\u5177\u4f53\u53ef\u4ee5\u901a\u8fc7\u67e5\u770b\u7aef\u53e3\u548c\u8fdb\u7a0b\u672c\u8eab\u7279\u6027\u52a0\u4ee5\u5224\u65ad\uff0c\u6bd4\u5982\u672c\u673a\u7684lsass.exe\u3001winlogon.exe\u3001explorer.exe\u5c31\u4e0d\u4f1a\u5f00\u653e\u7aef\u53e3\u8fde\u63a5\uff09\u3002<\/p>\n

3.\u5bf9\u4e8e\u63d2\u5165\u672c\u8eab\u5c31\u5f00\u653e\u7aef\u53e3\u8fdb\u7a0b\u5982alg.exe\u3001svchost.exe\uff0c\u9700\u8981\u901a\u8fc7\u8fde\u63a5\u72b6\u51b5\u3001\u8fde\u63a5IP\u3001\u8c03\u7528DLL\u7efc\u5408\u52a0\u4ee5\u5224\u65ad\u3002<\/p>\n

\u7b2c\u4e8c\u6b65\uff1a\u8ffd\u67e5\u6728\u9a6c\u771f\u51f6<\/strong><\/p>\n

\u77e5\u9053\u88ab\u63d2\u5165DLL\u6728\u9a6c\u7684\u8fdb\u7a0b\uff0c\u6211\u4eec\u5c31\u53ef\u4ee5\u901a\u8fc7\u6bd4\u8f83\u8fdb\u7a0b\u8c03\u7528\u7684DLL\u6a21\u5757\u6765\u7511\u522b\u3002<\/p>\n

1.\u5230\u5176\u5b83\u6b63\u5e38\u7535\u8111\u4e0a\u542f\u52a8\u547d\u4ee4\u63d0\u793a\u7b26\u8fd0\u884c\u201ctasklist \/m \/fo list >G\uff1a\\dll1.txt\u201d\uff0c\u5c06\u5f53\u524d\u8fdb\u7a0b\u52a0\u8f7d\u6240\u6709DLL\u6587\u4ef6\u4ee5\u5217\u8868\u5f62\u5f0f\u8f93\u51fa\uff0c\u7136\u540e\u6253\u5f00dll.txt\u5e76\u590d\u5236lsass.exe\u52a0\u8f7d\u7684DLL\u6587\u4ef6\u5217\u8868\u3002<\/p>\n

2\u2026\u2026\u6253\u5f00Excel\uff0c\u5c06\u6b63\u5e38\u7535\u8111\u548c\u4e2d\u62db\u7535\u8111lsass.exe\u52a0\u8f7d\u7684DLL\u6587\u4ef6\u590d\u5236\u5230A\u3001B\u5217\uff0c\u7531\u4e8eExcel\u6709\u5e8f\u53f7\uff0c\u901a\u8fc7\u5e8f\u53f7\u5c31\u53ef\u4ee5\u8f7b\u6613\u53d1\u73b0\u4e24\u4e2alsass.exe\u52a0\u8f7d\u7684DLL\u6587\u4ef6\u6570\u91cf\u4e0d\u540c\uff0864\u548c68\uff09\u3002\u73b0\u5728\u5c06B\u5217\u5b57\u4f53\u8bbe\u7f6e\u4e3a\u7ea2\u8272\uff0c\u526a\u5207B\u5217\u5185\u5bb9\u5e76\u7c98\u8d34\u5230A\u5217\uff0c\u5355\u51fbExcel\u7684\u201c\u6570\u636e\/\u6392\u5e8f\u201d\uff0c\u5c06\u6570\u636e\u91cd\u65b0\u6392\u5e8f\u540e\uff0c\u6728\u9a6c\u6587\u4ef6\u5c31\u5728\u8fde\u7eed\u7ea2\u8272\u4f46\u548c\u4e0a\u683c\u4e0d\u76f8\u540c\u7684DLL\u6587\u4ef6\u4e2d\uff0c\u5206\u522b\u662fmswsock.dll\u3001PSAPI.DLL\u3001 wshtcpip.dll\u3001share.dll<\/p>\n

\u5c0f\u63d0\u793a\uff1a<\/p>\n

\u5982\u679c\u65e0\u6cd5\u786e\u5b9a\u54ea\u4e2a\u8fdb\u7a0b\u88ab\u63d2\u5165\u6728\u9a6c\uff0c\u53ef\u4ee5\u5148\u8f93\u51fa\u6240\u6709DLL\u6587\u4ef6\uff0c\u7136\u540e\u5728Excel\u4e2d\u6392\u5e8f\u548c\u6b63\u5e38\u72b6\u6001DLL\u6587\u4ef6\u6bd4\u8f83\uff0c\u4f9d\u6b21\u627e\u51fa\u65b0\u589e\u7684DLL\u6587\u4ef6\u4e00\u4e00\u6392\u67e5\u3002<\/p>\n

\u7b2c\u4e09\u6b65\uff1a\u6e05\u9664DLL\u6728\u9a6c\u6587\u4ef6<\/strong><\/p>\n

\u4ece\u4e0a\u53ef\u4ee5\u77e5\u9053DLL\u6728\u9a6c\u5c31\u5728\u4e0a\u8ff0\u591a\u51fa\u76844\u4e2a\u6587\u4ef6\u4e2d\uff0c\u73b0\u5728\u901a\u8fc7\u641c\u7d22\u529f\u80fd\u627e\u5230\u8fd9\u4e9b\u6587\u4ef6\uff08DLL\u6587\u4ef6\u5927\u591a\u5728\u7cfb\u7edf\u76ee\u5f55\uff0c\u641c\u7d22\u8303\u56f4\u53ef\u9650\u5236\u5728\u6b64\uff09\uff0c\u5e76\u901a\u8fc7\u67e5\u770b\u5c5e\u6027\u6700\u7ec8\u627e\u5230\u771f\u51f6\u4e3ac\uff1a\\windows\\system32\\share.dll.\u73b0\u5728\u8fdb\u5165\u5b89\u5168\u6a21\u5f0f\u5c06share.dll\u5220\u9664\uff0c\u7136\u540e\u6839\u636e\u5b83\u7684\u521b\u5efa\u65f6\u95f4\u3001\u5927\u5c0f\u627e\u5230\u6728\u9a6c\u7684\u540c\u4f19\u5e76\u5220\u9664\u3002\u4e00\u822c\u5fae\u8f6f\u7cfb\u7edfDLL\u6587\u4ef6\u90fd\u6709\u7248\u672c\u6807\u7b7e\uff0c\u800c\u4e14\u6587\u4ef6\u65e5\u671f\u5927\u591a\u662f\u4e00\u6837\u7684\uff0c\u53ef\u4ee5\u901a\u8fc7\u8fd9\u4e9b\u5c5e\u6027\u5224\u65ad\u3002<\/p>\n

\u5c0f\u63d0\u793a\uff1a\u5bf9\u4e8e\u63d2\u5165notepad\u3001IE\u3001explorer.exe\u7b49\u8fdb\u7a0b\u7684dll\u6728\u9a6c\uff0c\u53ef\u4ee5\u5c06\u8fdb\u7a0b\u7ec8\u6b62\u540e\u76f4\u63a5\u6e05\u9664dll\u6728\u9a6c\u3002<\/p>\n

\u7b2c\u56db\u6b65\uff1a\u505a\u597d\u5907\u4efd\uff0c\u9632\u60a3\u4e8e\u672a\u7136<\/strong><\/p>\n

\u76f8\u5bf9\u6765\u8bf4\uff0c\u672c\u4f8b\u88ab\u63d2\u5165\u6728\u9a6c\u7684\u7cfb\u7edf\u8fdb\u7a0b\u6bd4\u8f83\u5bb9\u6613\u5224\u65ad\uff0c\u4f46\u662f\u5bf9\u63d2\u5165\u7cfb\u7edf\u672c\u8eab\u5c31\u5f00\u653e\u7aef\u53e3\u7684\u8fdb\u7a0b\u5982svchost.exe\uff0c\u5224\u65ad\u8d77\u6765\u5c31\u6bd4\u8f83\u56f0\u96be\u3002\u56e0\u6b64\u6211\u4eec\u5e73\u65f6\u8981\u7528Tasklist\u547d\u4ee4\u505a\u597d\u5e38\u89c1\u7cfb\u7edf\u8fdb\u7a0bDLL\u6587\u4ef6\u5907\u4efd\uff0c\u8fd9\u6837\u5c31\u53ef\u4ee5\u5728\u6000\u7591\u81ea\u5df1\u4e2d\u62db\u65f6\uff0c\u91cd\u542f\u5e76\u5173\u95ed\u4efb\u4f55\u65e0\u5173\u7a0b\u5e8f\uff0c\u7136\u540e\u901a\u8fc7Excel\u6392\u5e8f\u5feb\u901f\u627e\u5230\u6728\u9a6c\u771f\u51f6\uff01<\/p>\n

\u6ce8\u610f\uff1a\u7cfb\u7edf\u6709\u591a\u4e2asvchost.exe\u8fdb\u7a0b\uff0c\u4f46\u662f\u5b83\u4eec\u8fdb\u7a0bpid\u662f\u4e0d\u540c\u7684\uff0c\u9700\u8981\u5206\u5f00\u5907\u4efd\u3002<\/p>\n

 <\/p>\n

\u3010\u7f16\u8f91\u63a8\u8350\u3011<\/p>\n

    \n
  1. \u7b80\u5355\u4e94\u6b65\u6e05\u9664DLL\u6728\u9a6c<\/span><\/li>\n
  2. Windows\u5999\u7528Rundll32\u5378\u8f7d\u6280\u5de7\u7684\u8be6\u7ec6\u89e3\u6790<\/span><\/li>\n
  3. Windows\u7cfb\u7edf\u5de7\u7528Rundll32\u5378\u8f7d\u7684\u64cd\u4f5c\u6280\u5de7<\/span><\/li>\n
  4. \u6e05\u9664\u6b63\u5728\u8fd0\u884c\u7684EXE\u4e0eDLL\u75c5\u6bd2\u7684\u64cd\u4f5c\u65b9\u6848<\/span><\/li>\n
  5. \u5fae\u8f6f\u53d1\u5e03\u5173\u4e8eDLL load hijacking\u6f0f\u6d1e\u7684\u5b89\u5168\u54a8\u6587<\/span><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    DLL\u6728\u9a6c\u662f\u4e00\u79cd\u7f51\u7edc\u9ed1\u5ba2\u7684\u60ef\u7528\u6728\u9a6c\uff0c\u5b83\u5728\u8fd0\u884c\u65f6\u53ef\u4ee5\u4f9d\u9644\u5728\u5f88\u591a\u7cfb\u7edf\u5173\u952e\u8fdb\u7a0b\u4e2d\uff0c\u800c\u4e0d\u51fa\u73b0\u65b0\u7684\u8fdb\u7a0b\u4fe1\u606f\uff0c\u6240\u4ee5\u5373\u4fbf\u662f\u88ab […]<\/p>\n","protected":false},"author":1,"featured_media":299738,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[202645],"tags":[],"class_list":["post-299737","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-202645"],"_links":{"self":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts\/299737","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/comments?post=299737"}],"version-history":[{"count":0,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts\/299737\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/media\/299738"}],"wp:attachment":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/media?parent=299737"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/categories?post=299737"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/tags?post=299737"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}