{"id":477880,"date":"2023-08-09T09:22:01","date_gmt":"2023-08-09T09:22:01","guid":{"rendered":""},"modified":"2023-09-05T11:15:36","modified_gmt":"2023-09-05T11:15:36","slug":"lolbin","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/lolbin\/","title":{"rendered":"LOLbin"},"content":{"rendered":"<p>LOLBin, vi\u1ebft t\u1eaft c\u1ee7a \u201cLiving Off the Land Binaries\u201d, l\u00e0 m\u1ed9t thu\u1eadt ng\u1eef \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong an ninh m\u1ea1ng \u0111\u1ec3 ch\u1ec9 c\u00e1c t\u1ec7p th\u1ef1c thi, c\u00f4ng c\u1ee5 ho\u1eb7c t\u1eadp l\u1ec7nh h\u1ee3p ph\u00e1p c\u00f3 tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows c\u00f3 th\u1ec3 b\u1ecb c\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda l\u1ea1m d\u1ee5ng \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i. C\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n n\u00e0y c\u00f3 ngu\u1ed3n g\u1ed1c t\u1eeb h\u1ec7 th\u1ed1ng v\u00e0 th\u01b0\u1eddng \u0111\u01b0\u1ee3c t\u1ed9i ph\u1ea1m m\u1ea1ng s\u1eed d\u1ee5ng \u0111\u1ec3 v\u01b0\u1ee3t qua c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt truy\u1ec1n th\u1ed1ng. B\u1eb1ng c\u00e1ch t\u1eadn d\u1ee5ng c\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t s\u1eb5n n\u00e0y, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n v\u00e0 khi\u1ebfn c\u00e1c c\u00f4ng c\u1ee5 b\u1ea3o m\u1eadt g\u1eb7p kh\u00f3 kh\u0103n trong vi\u1ec7c ph\u00e2n bi\u1ec7t gi\u1eefa ho\u1ea1t \u0111\u1ed9ng h\u1ee3p ph\u00e1p v\u00e0 ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i.<\/p>\n<h2>L\u1ecbch s\u1eed ngu\u1ed3n g\u1ed1c c\u1ee7a LOLBin v\u00e0 l\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u1ec1 c\u1eadp \u0111\u1ebfn n\u00f3<\/h2>\n<p>Kh\u00e1i ni\u1ec7m LOLbin \u0111\u00e3 tr\u1edf n\u00ean n\u1ed5i ti\u1ebfng trong c\u1ed9ng \u0111\u1ed3ng an ninh m\u1ea1ng v\u00e0o kho\u1ea3ng n\u0103m 2014 khi c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt b\u1eaft \u0111\u1ea7u quan s\u00e1t th\u1ea5y s\u1ef1 gia t\u0103ng c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p v\u00e0 c\u00e1c k\u1ef9 thu\u1eadt s\u1eed d\u1ee5ng c\u00e1c ti\u1ec7n \u00edch h\u1ec7 th\u1ed1ng h\u1ee3p ph\u00e1p cho m\u1ee5c \u0111\u00edch \u0111\u1ed9c h\u1ea1i. L\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u1ec1 c\u1eadp \u0111\u1ebfn LOLbins l\u00e0 trong m\u1ed9t b\u00e0i nghi\u00ean c\u1ee9u c\u00f3 t\u1ef1a \u0111\u1ec1 \u201cS\u1ed1ng xa \u0111\u1ea5t li\u1ec1n v\u00e0 b\u1ecb ph\u00e1t hi\u1ec7n tr\u1ed1n tr\u00e1nh - Kh\u1ea3o s\u00e1t v\u1ec1 c\u00e1c th\u1ef1c ti\u1ec5n ph\u1ed5 bi\u1ebfn\u201d c\u1ee7a Casey Smith v\u00e0o n\u0103m 2014. B\u00e0i vi\u1ebft n\u00e0y l\u00e0m s\u00e1ng t\u1ecf c\u00e1ch c\u00e1c \u0111\u1ed1i th\u1ee7 khai th\u00e1c c\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n Windows t\u00edch h\u1ee3p s\u1eb5n \u0111\u1ec3 che gi\u1ea5u ho\u1ea1t \u0111\u1ed9ng c\u1ee7a h\u1ecd v\u00e0 tr\u1ed1n tr\u00e1nh s\u1ef1 ph\u00e1t hi\u1ec7n.<\/p>\n<h2>Th\u00f4ng tin chi ti\u1ebft v\u1ec1 LOLbin: M\u1edf r\u1ed9ng ch\u1ee7 \u0111\u1ec1 LOLbin<\/h2>\n<p>LOLbins th\u1ec3 hi\u1ec7n m\u1ed9t chi\u1ebfn l\u01b0\u1ee3c th\u00f4ng minh \u0111\u01b0\u1ee3c c\u00e1c \u0111\u1ed1i th\u1ee7 m\u1ea1ng s\u1eed d\u1ee5ng \u0111\u1ec3 \u1ea9n n\u1ea5p. C\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t s\u1eb5n n\u00e0y cung c\u1ea5p cho k\u1ebb t\u1ea5n c\u00f4ng m\u1ed9t kho v\u0169 kh\u00ed phong ph\u00fa \u0111\u1ec3 th\u1ef1c thi c\u00e1c l\u1ec7nh kh\u00e1c nhau, t\u01b0\u01a1ng t\u00e1c v\u1edbi h\u1ec7 th\u1ed1ng v\u00e0 th\u1ef1c hi\u1ec7n trinh s\u00e1t m\u00e0 kh\u00f4ng c\u1ea7n ph\u1ea3i th\u1ea3 th\u00eam c\u00e1c t\u1ec7p \u0111\u1ed9c h\u1ea1i v\u00e0o m\u00e1y c\u1ee7a n\u1ea1n nh\u00e2n. Ch\u00fang th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p, trong \u0111\u00f3 cu\u1ed9c t\u1ea5n c\u00f4ng ch\u1ec9 di\u1ec5n ra trong b\u1ed9 nh\u1edb, \u0111\u1ec3 l\u1ea1i r\u1ea5t \u00edt ho\u1eb7c kh\u00f4ng c\u00f3 d\u1ea5u v\u1ebft tr\u00ean \u1ed5 c\u1ee9ng.<\/p>\n<p>Vi\u1ec7c s\u1eed d\u1ee5ng LOLBins th\u01b0\u1eddng \u0111\u01b0\u1ee3c k\u1ebft h\u1ee3p v\u1edbi c\u00e1c k\u1ef9 thu\u1eadt kh\u00e1c, ch\u1eb3ng h\u1ea1n nh\u01b0 chi\u1ebfn thu\u1eadt s\u1ed1ng ngo\u00e0i \u0111\u1ea5t li\u1ec1n, t\u1eadp l\u1ec7nh PowerShell v\u00e0 WMI (C\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd Windows) \u0111\u1ec3 t\u1ed1i \u0111a h\u00f3a hi\u1ec7u qu\u1ea3 c\u1ee7a ch\u00fang. LOLBin \u0111\u1eb7c bi\u1ec7t hi\u1ec7u qu\u1ea3 trong c\u00e1c t\u00ecnh hu\u1ed1ng sau khai th\u00e1c, v\u00ec ch\u00fang cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng tr\u00e0 tr\u1ed9n v\u00e0o ho\u1ea1t \u0111\u1ed9ng h\u1ee3p ph\u00e1p c\u1ee7a h\u1ec7 th\u1ed1ng, khi\u1ebfn c\u00e1c nh\u00e0 ph\u00e2n t\u00edch b\u1ea3o m\u1eadt kh\u00f3 ph\u00e2n bi\u1ec7t gi\u1eefa h\u00e0nh vi b\u00ecnh th\u01b0\u1eddng v\u00e0 h\u00e0nh vi \u0111\u1ed9c h\u1ea1i.<\/p>\n<h2>C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a LOLbin: C\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a LOLbin<\/h2>\n<p>LOLBin l\u00e0 c\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n Windows g\u1ed1c \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t s\u1eb5n tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh. Ch\u00fang c\u00f3 c\u00e1c ch\u1ee9c n\u0103ng h\u1ee3p ph\u00e1p v\u00e0 \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 h\u1ed7 tr\u1ee3 c\u00e1c nhi\u1ec7m v\u1ee5 qu\u1ea3n tr\u1ecb, b\u1ea3o tr\u00ec h\u1ec7 th\u1ed1ng v\u00e0 kh\u1eafc ph\u1ee5c s\u1ef1 c\u1ed1 kh\u00e1c nhau. Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng thao t\u00fang c\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n n\u00e0y \u0111\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c c\u00e1c m\u1ee5c ti\u00eau \u0111\u1ed9c h\u1ea1i m\u00e0 kh\u00f4ng g\u00e2y nghi ng\u1edd. C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a LOLBin gi\u1ed1ng v\u1edbi c\u1ea5u tr\u00fac c\u1ee7a b\u1ea5t k\u1ef3 h\u1ec7 th\u1ed1ng nh\u1ecb ph\u00e2n th\u00f4ng th\u01b0\u1eddng n\u00e0o, cho ph\u00e9p n\u00f3 ho\u1ea1t \u0111\u1ed9ng m\u00e0 kh\u00f4ng b\u1ecb c\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt ch\u00fa \u00fd.<\/p>\n<p>Qu\u00e1 tr\u00ecnh n\u00e0y th\u01b0\u1eddng bao g\u1ed3m vi\u1ec7c s\u1eed d\u1ee5ng c\u00e1c \u0111\u1ed1i s\u1ed1 d\u00f2ng l\u1ec7nh \u0111\u1ec3 g\u1ecdi c\u00e1c ch\u1ee9c n\u0103ng c\u1ee5 th\u1ec3, th\u1ef1c thi c\u00e1c l\u1ec7nh PowerShell ho\u1eb7c truy c\u1eadp c\u00e1c t\u00e0i nguy\u00ean h\u1ec7 th\u1ed1ng nh\u1ea1y c\u1ea3m. Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 khai th\u00e1c LOLbins \u0111\u1ec3 th\u1ef1c thi m\u00e3, t\u1ea1o ho\u1eb7c s\u1eeda \u0111\u1ed5i t\u1ec7p, truy v\u1ea5n s\u1ed5 \u0111\u0103ng k\u00fd h\u1ec7 th\u1ed1ng, giao ti\u1ebfp qua m\u1ea1ng v\u00e0 th\u1ef1c hi\u1ec7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng c\u1ea7n thi\u1ebft kh\u00e1c \u0111\u1ec3 ho\u00e0n th\u00e0nh m\u1ee5c ti\u00eau c\u1ee7a ch\u00fang.<\/p>\n<h2>Ph\u00e2n t\u00edch c\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a LOLbin<\/h2>\n<p>LOLbins cung c\u1ea5p m\u1ed9t s\u1ed1 t\u00ednh n\u0103ng ch\u00ednh khi\u1ebfn ch\u00fang tr\u1edf n\u00ean h\u1ea5p d\u1eabn \u0111\u1ed1i v\u1edbi c\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda:<\/p>\n<ol>\n<li>\n<p><strong>Xu\u1ea5t hi\u1ec7n h\u1ee3p ph\u00e1p<\/strong>: LOLB c\u00f3 ch\u1eef k\u00fd s\u1ed1 h\u1ee3p l\u1ec7 v\u00e0 th\u01b0\u1eddng \u0111\u01b0\u1ee3c Microsoft k\u00fd, khi\u1ebfn ch\u00fang c\u00f3 v\u1ebb \u0111\u00e1ng tin c\u1eady v\u00e0 b\u1ecf qua ki\u1ec3m tra b\u1ea3o m\u1eadt.<\/p>\n<\/li>\n<li>\n<p><strong>T\u00e0ng h\u00ecnh<\/strong>: V\u00ec ch\u00fang l\u00e0 c\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n c\u1ee7a h\u1ec7 th\u1ed1ng g\u1ed1c n\u00ean LOLBins c\u00f3 th\u1ec3 th\u1ef1c thi m\u00e3 \u0111\u1ed9c h\u1ea1i m\u00e0 kh\u00f4ng c\u1ea7n treo c\u1edd \u0111\u1ecf ho\u1eb7c k\u00edch ho\u1ea1t c\u1ea3nh b\u00e1o t\u1eeb c\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt.<\/p>\n<\/li>\n<li>\n<p><strong>Kh\u00f4ng c\u1ea7n lo\u1ea1i b\u1ecf ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i<\/strong>: LOLBins kh\u00f4ng y\u00eau c\u1ea7u k\u1ebb t\u1ea5n c\u00f4ng th\u1ea3 c\u00e1c t\u1ec7p b\u1ed5 sung v\u00e0o h\u1ec7 th\u1ed1ng c\u1ee7a n\u1ea1n nh\u00e2n, l\u00e0m gi\u1ea3m c\u01a1 h\u1ed9i b\u1ecb ph\u00e1t hi\u1ec7n.<\/p>\n<\/li>\n<li>\n<p><strong>L\u1ea1m d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 \u0111\u00e1ng tin c\u1eady<\/strong>: K\u1ebb t\u1ea5n c\u00f4ng t\u1eadn d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u01b0a v\u00e0o danh s\u00e1ch tr\u1eafng v\u00e0 \u0111\u01b0\u1ee3c coi l\u00e0 an to\u00e0n, \u0111i\u1ec1u n\u00e0y khi\u1ebfn c\u00e1c c\u00f4ng c\u1ee5 b\u1ea3o m\u1eadt kh\u00f3 ph\u00e2n bi\u1ec7t gi\u1eefa c\u00e1ch s\u1eed d\u1ee5ng h\u1ee3p ph\u00e1p v\u00e0 c\u00e1ch s\u1eed d\u1ee5ng \u0111\u1ed9c h\u1ea1i.<\/p>\n<\/li>\n<li>\n<p><strong>Th\u1ef1c thi kh\u00f4ng c\u1ea7n t\u1ec7p<\/strong>: LOLBins cho ph\u00e9p c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p, gi\u1ea3m d\u1ea5u v\u1ebft k\u1ef9 thu\u1eadt s\u1ed1 v\u00e0 t\u0103ng \u0111\u1ed9 ph\u1ee9c t\u1ea1p c\u1ee7a c\u00e1c cu\u1ed9c \u0111i\u1ec1u tra ph\u00e1p y.<\/p>\n<\/li>\n<\/ol>\n<h2>C\u00e1c lo\u1ea1i LOLbin<\/h2>\n<table>\n<thead>\n<tr>\n<th>Lo\u1ea1i th\u00f9ng LOL<\/th>\n<th>S\u1ef1 mi\u00eau t\u1ea3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>T\u1eadp l\u1ec7nh PowerShell<\/td>\n<td>S\u1eed d\u1ee5ng PowerShell, m\u1ed9t ng\u00f4n ng\u1eef k\u1ecbch b\u1ea3n m\u1ea1nh m\u1ebd trong Windows, \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i.<\/td>\n<\/tr>\n<tr>\n<td>C\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd Windows (WMI)<\/td>\n<td>Khai th\u00e1c WMI \u0111\u1ec3 th\u1ef1c thi t\u1eeb xa c\u00e1c t\u1eadp l\u1ec7nh v\u00e0 l\u1ec7nh tr\u00ean h\u1ec7 th\u1ed1ng \u0111\u00edch.<\/td>\n<\/tr>\n<tr>\n<td>D\u1ea5u nh\u1eafc l\u1ec7nh c\u1ee7a Windows (cmd.exe)<\/td>\n<td>T\u1eadn d\u1ee5ng tr\u00ecnh th\u00f4ng d\u1ecbch d\u00f2ng l\u1ec7nh g\u1ed1c c\u1ee7a Windows \u0111\u1ec3 th\u1ef1c thi c\u00e1c l\u1ec7nh v\u00e0 t\u1eadp l\u1ec7nh.<\/td>\n<\/tr>\n<tr>\n<td>M\u00e1y ch\u1ee7 t\u1eadp l\u1ec7nh Windows (wscript.exe, cscript.exe)<\/td>\n<td>Th\u1ef1c thi c\u00e1c t\u1eadp l\u1ec7nh \u0111\u01b0\u1ee3c vi\u1ebft b\u1eb1ng VBScript ho\u1eb7c JScript.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>C\u00e1c c\u00e1ch s\u1eed d\u1ee5ng LOLbin, c\u00e1c v\u1ea5n \u0111\u1ec1 v\u00e0 gi\u1ea3i ph\u00e1p li\u00ean quan \u0111\u1ebfn vi\u1ec7c s\u1eed d\u1ee5ng<\/h2>\n<h3>C\u00e1c c\u00e1ch s\u1eed d\u1ee5ng LOLbin<\/h3>\n<ol>\n<li>\n<p><strong>N\u00e2ng cao \u0111\u1eb7c quy\u1ec1n<\/strong>: LOLbin c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 n\u00e2ng cao \u0111\u1eb7c quy\u1ec1n tr\u00ean c\u00e1c h\u1ec7 th\u1ed1ng b\u1ecb x\u00e2m nh\u1eadp, gi\u00e0nh quy\u1ec1n truy c\u1eadp v\u00e0o th\u00f4ng tin v\u00e0 t\u00e0i nguy\u00ean nh\u1ea1y c\u1ea3m.<\/p>\n<\/li>\n<li>\n<p><strong>Thu th\u1eadp th\u00f4ng tin<\/strong>: C\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda s\u1eed d\u1ee5ng LOLbins \u0111\u1ec3 thu th\u1eadp th\u00f4ng tin v\u1ec1 h\u1ec7 th\u1ed1ng m\u1ee5c ti\u00eau, bao g\u1ed3m ph\u1ea7n m\u1ec1m \u0111\u00e3 c\u00e0i \u0111\u1eb7t, c\u1ea5u h\u00ecnh m\u1ea1ng v\u00e0 t\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng.<\/p>\n<\/li>\n<li>\n<p><strong>Chuy\u1ec3n \u0111\u1ed9ng b\u00ean<\/strong>: Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng LOLbin \u0111\u1ec3 di chuy\u1ec3n ngang trong m\u1ea1ng, nh\u1ea3y t\u1eeb h\u1ec7 th\u1ed1ng n\u00e0y sang h\u1ec7 th\u1ed1ng kh\u00e1c, trong khi v\u1eabn l\u00e9n l\u00fat.<\/p>\n<\/li>\n<li>\n<p><strong>Ki\u00ean tr\u00ec<\/strong>: LOLBin cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng thi\u1ebft l\u1eadp t\u00ednh b\u1ec1n v\u1eefng tr\u00ean h\u1ec7 th\u1ed1ng b\u1ecb x\u00e2m nh\u1eadp, \u0111\u1ea3m b\u1ea3o ch\u00fang c\u00f3 th\u1ec3 duy tr\u00ec quy\u1ec1n truy c\u1eadp trong m\u1ed9t th\u1eddi gian d\u00e0i.<\/p>\n<\/li>\n<\/ol>\n<h3>C\u00e1c v\u1ea5n \u0111\u1ec1 v\u00e0 gi\u1ea3i ph\u00e1p li\u00ean quan \u0111\u1ebfn vi\u1ec7c s\u1eed d\u1ee5ng<\/h3>\n<p>Vi\u1ec7c s\u1eed d\u1ee5ng LOLbins \u0111\u1eb7t ra nh\u1eefng th\u00e1ch th\u1ee9c \u0111\u00e1ng k\u1ec3 cho c\u00e1c chuy\u00ean gia an ninh m\u1ea1ng. M\u1ed9t s\u1ed1 v\u1ea5n \u0111\u1ec1 bao g\u1ed3m:<\/p>\n<ol>\n<li>\n<p><strong>Ph\u00e1t hi\u1ec7n<\/strong>: C\u00e1c c\u00f4ng c\u1ee5 b\u1ea3o m\u1eadt d\u1ef1a tr\u00ean ch\u1eef k\u00fd truy\u1ec1n th\u1ed1ng c\u00f3 th\u1ec3 g\u1eb7p kh\u00f3 kh\u0103n trong vi\u1ec7c ph\u00e1t hi\u1ec7n LOLBin do t\u00ednh ch\u1ea5t h\u1ee3p ph\u00e1p c\u1ee7a ch\u00fang v\u00e0 thi\u1ebfu c\u00e1c m\u1eabu ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i \u0111\u00e3 bi\u1ebft.<\/p>\n<\/li>\n<li>\n<p><strong>Hi\u1ec3n th\u1ecb<\/strong>: V\u00ec LOLbin ho\u1ea1t \u0111\u1ed9ng trong c\u00e1c quy tr\u00ecnh h\u1ec7 th\u1ed1ng h\u1ee3p ph\u00e1p n\u00ean ch\u00fang th\u01b0\u1eddng tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n d\u1ef1a tr\u00ean ph\u00e2n t\u00edch h\u00e0nh vi.<\/p>\n<\/li>\n<li>\n<p><strong>Danh s\u00e1ch tr\u1eafng<\/strong>: Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 l\u1ea1m d\u1ee5ng c\u00e1c c\u01a1 ch\u1ebf \u0111\u01b0a v\u00e0o danh s\u00e1ch tr\u1eafng cho ph\u00e9p c\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n \u0111\u00e3 bi\u1ebft ch\u1ea1y m\u00e0 kh\u00f4ng b\u1ecb h\u1ea1n ch\u1ebf.<\/p>\n<\/li>\n<li>\n<p><strong>Gi\u1ea3m nh\u1eb9<\/strong>: Vi\u1ec7c v\u00f4 hi\u1ec7u h\u00f3a ho\u1eb7c ch\u1eb7n ho\u00e0n to\u00e0n LOLbins l\u00e0 kh\u00f4ng kh\u1ea3 thi v\u00ec ch\u00fang ph\u1ee5c v\u1ee5 c\u00e1c ch\u1ee9c n\u0103ng thi\u1ebft y\u1ebfu c\u1ee7a h\u1ec7 th\u1ed1ng.<\/p>\n<\/li>\n<\/ol>\n<p>\u0110\u1ec3 gi\u1ea3i quy\u1ebft nh\u1eefng th\u00e1ch th\u1ee9c n\u00e0y, c\u00e1c t\u1ed5 ch\u1ee9c c\u1ea7n \u00e1p d\u1ee5ng ph\u01b0\u01a1ng ph\u00e1p b\u1ea3o m\u1eadt nhi\u1ec1u l\u1edbp bao g\u1ed3m:<\/p>\n<ul>\n<li><strong>Ph\u00e2n t\u00edch h\u00e0nh vi<\/strong>: S\u1eed d\u1ee5ng c\u00e1c ph\u01b0\u01a1ng ph\u00e1p ph\u00e1t hi\u1ec7n d\u1ef1a tr\u00ean h\u00e0nh vi \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh c\u00e1c ho\u1ea1t \u0111\u1ed9ng b\u1ea5t th\u01b0\u1eddng, ngay c\u1ea3 trong c\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n h\u1ee3p ph\u00e1p.<\/li>\n<li><strong>Ph\u00e1t hi\u1ec7n b\u1ea5t th\u01b0\u1eddng<\/strong>: S\u1eed d\u1ee5ng t\u00ednh n\u0103ng ph\u00e1t hi\u1ec7n b\u1ea5t th\u01b0\u1eddng \u0111\u1ec3 ph\u00e1t hi\u1ec7n nh\u1eefng sai l\u1ec7ch so v\u1edbi ho\u1ea1t \u0111\u1ed9ng b\u00ecnh th\u01b0\u1eddng c\u1ee7a h\u1ec7 th\u1ed1ng.<\/li>\n<li><strong>B\u1ea3o v\u1ec7 \u0111i\u1ec3m cu\u1ed1i<\/strong>: \u0110\u1ea7u t\u01b0 v\u00e0o c\u00e1c c\u00f4ng c\u1ee5 b\u1ea3o v\u1ec7 \u0111i\u1ec3m cu\u1ed1i n\u00e2ng cao c\u00f3 th\u1ec3 ph\u00e1t hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n d\u00f9ng t\u1ec7p v\u00e0 c\u00e1c ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c d\u1ef1a tr\u00ean b\u1ed9 nh\u1edb.<\/li>\n<li><strong>Gi\u00e1o d\u1ee5c ng\u01b0\u1eddi d\u00f9ng<\/strong>: Gi\u00e1o d\u1ee5c ng\u01b0\u1eddi d\u00f9ng v\u1ec1 c\u00e1c r\u1ee7i ro c\u1ee7a l\u1eeba \u0111\u1ea3o v\u00e0 k\u1ef9 thu\u1eadt x\u00e3 h\u1ed9i, v\u1ed1n l\u00e0 nh\u1eefng nguy\u00ean nh\u00e2n ph\u1ed5 bi\u1ebfn g\u00e2y ra c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng d\u1ef1a tr\u00ean LOLBin.<\/li>\n<\/ul>\n<h2>C\u00e1c \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh v\u00e0 so s\u00e1nh kh\u00e1c v\u1edbi c\u00e1c thu\u1eadt ng\u1eef t\u01b0\u01a1ng t\u1ef1<\/h2>\n<table>\n<thead>\n<tr>\n<th>Thu\u1eadt ng\u1eef<\/th>\n<th>S\u1ef1 mi\u00eau t\u1ea3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>LOLbin<\/td>\n<td>C\u00e1c h\u1ec7 th\u1ed1ng nh\u1ecb ph\u00e2n h\u1ee3p ph\u00e1p b\u1ecb khai th\u00e1c v\u00ec m\u1ee5c \u0111\u00edch \u0111\u1ed9c h\u1ea1i.<\/td>\n<\/tr>\n<tr>\n<td>T\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n file<\/td>\n<td>C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u1ef1a v\u00e0o vi\u1ec7c th\u1ea3 t\u1eadp tin v\u00e0o h\u1ec7 th\u1ed1ng m\u1ee5c ti\u00eau, ch\u1ec9 ho\u1ea1t \u0111\u1ed9ng trong b\u1ed9 nh\u1edb.<\/td>\n<\/tr>\n<tr>\n<td>\u0110\u1ebf ch\u1ebf PowerShell<\/td>\n<td>M\u1ed9t khu\u00f4n kh\u1ed5 sau khai th\u00e1c s\u1eed d\u1ee5ng PowerShell cho c\u00e1c ho\u1ea1t \u0111\u1ed9ng t\u1ea5n c\u00f4ng.<\/td>\n<\/tr>\n<tr>\n<td>Chi\u1ebfn thu\u1eadt s\u1ed1ng ngo\u00e0i \u0111\u1ea5t li\u1ec1n<\/td>\n<td>T\u1eadn d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 t\u00edch h\u1ee3p cho c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Quan \u0111i\u1ec3m v\u00e0 c\u00f4ng ngh\u1ec7 c\u1ee7a t\u01b0\u01a1ng lai li\u00ean quan \u0111\u1ebfn LOLBin<\/h2>\n<p>Khi c\u00f4ng ngh\u1ec7 ph\u00e1t tri\u1ec3n, c\u00e1c k\u1ef9 thu\u1eadt \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng b\u1edfi c\u1ea3 k\u1ebb t\u1ea5n c\u00f4ng v\u00e0 ng\u01b0\u1eddi ph\u00f2ng th\u1ee7 c\u0169ng v\u1eady. T\u01b0\u01a1ng lai c\u1ee7a LOLbins v\u00e0 c\u00e1c bi\u1ec7n ph\u00e1p \u0111\u1ed1i ph\u00f3 c\u1ee7a ch\u00fang c\u00f3 th\u1ec3 s\u1ebd li\u00ean quan \u0111\u1ebfn:<\/p>\n<ol>\n<li>\n<p><strong>Ph\u00e1t hi\u1ec7n d\u1ef1a tr\u00ean AI<\/strong>: C\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt \u0111\u01b0\u1ee3c h\u1ed7 tr\u1ee3 b\u1edfi AI s\u1ebd c\u1ea3i thi\u1ec7n kh\u1ea3 n\u0103ng ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng d\u1ef1a tr\u00ean LOLBin b\u1eb1ng c\u00e1ch ph\u00e2n t\u00edch l\u01b0\u1ee3ng d\u1eef li\u1ec7u kh\u1ed5ng l\u1ed3 v\u00e0 x\u00e1c \u0111\u1ecbnh c\u00e1c m\u1eabu bi\u1ec3u th\u1ecb h\u00e0nh vi \u0111\u1ed9c h\u1ea1i.<\/p>\n<\/li>\n<li>\n<p><strong>C\u1ea3i ti\u1ebfn ph\u00e2n t\u00edch h\u00e0nh vi<\/strong>: C\u00e1c c\u01a1 ch\u1ebf ph\u00e1t hi\u1ec7n d\u1ef1a tr\u00ean h\u00e0nh vi s\u1ebd tr\u1edf n\u00ean tinh vi h\u01a1n, ph\u00e2n bi\u1ec7t t\u1ed1t h\u01a1n gi\u1eefa c\u00e1c ho\u1ea1t \u0111\u1ed9ng h\u1ee3p ph\u00e1p v\u00e0 \u0111\u1ed9c h\u1ea1i.<\/p>\n<\/li>\n<li>\n<p><strong>Ki\u1ebfn tr\u00fac Zero Trust<\/strong>: C\u00e1c t\u1ed5 ch\u1ee9c c\u00f3 th\u1ec3 \u00e1p d\u1ee5ng nguy\u00ean t\u1eafc kh\u00f4ng tin c\u1eady, x\u00e1c minh t\u1eebng h\u00e0nh \u0111\u1ed9ng tr\u01b0\u1edbc khi cho ph\u00e9p th\u1ef1c thi, gi\u1ea3m t\u00e1c \u0111\u1ed9ng c\u1ee7a LOLBins.<\/p>\n<\/li>\n<li>\n<p><strong>B\u1ea3o m\u1eadt ph\u1ea7n c\u1ee9ng<\/strong>: C\u00e1c t\u00ednh n\u0103ng b\u1ea3o m\u1eadt d\u1ef1a tr\u00ean ph\u1ea7n c\u1ee9ng c\u00f3 th\u1ec3 gi\u00fap ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng LOLBin b\u1eb1ng c\u00e1ch th\u1ef1c thi c\u00e1c bi\u1ec7n ph\u00e1p ki\u1ec3m tra t\u00ednh to\u00e0n v\u1eb9n v\u00e0 c\u00e1ch ly m\u1ea1nh m\u1ebd h\u01a1n.<\/p>\n<\/li>\n<\/ol>\n<h2>C\u00e1ch s\u1eed d\u1ee5ng ho\u1eb7c li\u00ean k\u1ebft m\u00e1y ch\u1ee7 proxy v\u1edbi LOLbin<\/h2>\n<p>M\u00e1y ch\u1ee7 proxy \u0111\u00f3ng m\u1ed9t vai tr\u00f2 quan tr\u1ecdng trong vi\u1ec7c b\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng d\u1ef1a tr\u00ean LOLBin. Ch\u00fang c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng theo nh\u1eefng c\u00e1ch sau:<\/p>\n<ol>\n<li>\n<p><strong>Thanh tra giao th\u00f4ng<\/strong>: M\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 ki\u1ec3m tra l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp m\u1ea1ng \u0111\u1ec3 t\u00ecm c\u00e1c m\u1eabu \u0111\u00e1ng ng\u1edd, bao g\u1ed3m c\u1ea3 c\u00e1c th\u00f4ng tin li\u00ean l\u1ea1c th\u01b0\u1eddng \u0111\u01b0\u1ee3c li\u00ean k\u1ebft v\u1edbi LOLbins.<\/p>\n<\/li>\n<li>\n<p><strong>L\u1ecdc n\u1ed9i dung \u0111\u1ed9c h\u1ea1i<\/strong>: Proxy c\u00f3 th\u1ec3 ch\u1eb7n quy\u1ec1n truy c\u1eadp v\u00e0o c\u00e1c mi\u1ec1n v\u00e0 \u0111\u1ecba ch\u1ec9 IP \u0111\u1ed9c h\u1ea1i \u0111\u00e3 bi\u1ebft \u0111\u01b0\u1ee3c c\u00e1c nh\u00e0 khai th\u00e1c LOLbin s\u1eed d\u1ee5ng.<\/p>\n<\/li>\n<li>\n<p><strong>Gi\u1ea3i m\u00e3 SSL\/TLS<\/strong>: Proxy c\u00f3 th\u1ec3 gi\u1ea3i m\u00e3 v\u00e0 ki\u1ec3m tra l\u01b0u l\u01b0\u1ee3ng \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a \u0111\u1ec3 ph\u00e1t hi\u1ec7n v\u00e0 ch\u1eb7n c\u00e1c t\u1ea3i tr\u1ecdng \u0111\u1ed9c h\u1ea1i \u0111\u01b0\u1ee3c g\u1eedi qua LOLbins.<\/p>\n<\/li>\n<li>\n<p><strong>Ph\u00e1t hi\u1ec7n \u1ea9n danh<\/strong>: Proxy c\u00f3 th\u1ec3 x\u00e1c \u0111\u1ecbnh v\u00e0 ch\u1eb7n c\u00e1c n\u1ed7 l\u1ef1c s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt \u1ea9n danh \u0111\u1ec3 \u1ea9n l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp LOLbin.<\/p>\n<\/li>\n<\/ol>\n<h2>Li\u00ean k\u1ebft li\u00ean quan<\/h2>\n<p>\u0110\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin v\u1ec1 LOLBin v\u00e0 c\u00e1c ph\u01b0\u01a1ng ph\u00e1p hay nh\u1ea5t v\u1ec1 an ninh m\u1ea1ng, b\u1ea1n c\u00f3 th\u1ec3 tham kh\u1ea3o c\u00e1c t\u00e0i nguy\u00ean sau:<\/p>\n<ol>\n<li><a href=\"https:\/\/www.blackhat.com\/docs\/us-15\/materials\/us-15-Smith-Living-Off-The-Land-And-Evading-Endpoint-Security-For-Fun-And-Profit.pdf\" target=\"_new\" rel=\"noopener nofollow\">S\u1ed1ng ngo\u00e0i \u0111\u1ea5t li\u1ec1n v\u00e0 b\u1ecb ph\u00e1t hi\u1ec7n tr\u1ed1n tr\u00e1nh - Kh\u1ea3o s\u00e1t v\u1ec1 c\u00e1c th\u1ef1c ti\u1ec5n chung<\/a> \u2013 B\u00e0i nghi\u00ean c\u1ee9u c\u1ee7a Casey Smith, 2014.<\/li>\n<li><a href=\"https:\/\/attack.mitre.org\/techniques\/T1218\/\" target=\"_new\" rel=\"noopener nofollow\">MITER ATT&amp;CK \u2013 LOLBins<\/a> \u2013 Th\u00f4ng tin v\u1ec1 LOLbin trong khu\u00f4n kh\u1ed5 MITER ATT&amp;CK.<\/li>\n<li><a href=\"https:\/\/www.sans.org\/cyber-security-summit\/archives\/file\/summit-archive-1492182931.pdf\" target=\"_new\" rel=\"noopener nofollow\">B\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i LOLBAS<\/a> \u2013 S\u00e1ch tr\u1eafng v\u1ec1 vi\u1ec7c b\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i c\u00e1c t\u1eadp l\u1ec7nh v\u00e0 t\u1eadp l\u1ec7nh s\u1ed1ng ngo\u00e0i \u0111\u1ea5t li\u1ec1n.<\/li>\n<\/ol>\n<p>LOLbin \u0111\u1eb7t ra m\u1ed9t th\u00e1ch th\u1ee9c \u0111\u00e1ng k\u1ec3 trong b\u1ed1i c\u1ea3nh an ninh m\u1ea1ng ng\u00e0y c\u00e0ng ph\u00e1t tri\u1ec3n. Hi\u1ec3u c\u00e1c k\u1ef9 thu\u1eadt c\u1ee7a h\u1ecd v\u00e0 s\u1eed d\u1ee5ng c\u00e1c chi\u1ebfn l\u01b0\u1ee3c ph\u00f2ng th\u1ee7 ch\u1ee7 \u0111\u1ed9ng l\u00e0 r\u1ea5t quan tr\u1ecdng trong vi\u1ec7c b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng v\u00e0 d\u1eef li\u1ec7u kh\u1ecfi nh\u1eefng m\u1ed1i \u0111e d\u1ecda ng\u1ea5m ng\u1ea7m n\u00e0y.<\/p>","protected":false},"featured_media":477881,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477880","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>LOLBin: Living Off the Land Binaries for Cybersecurity<\/mark>","faq_items":[{"question":"What is LOLBin?","answer":"<p>LOLBin, short for \"Living Off the Land Binaries,\" refers to legitimate executables, tools, or scripts on a Windows operating system that cyber adversaries abuse for malicious activities. These pre-installed binaries allow attackers to evade detection and execute various commands without raising suspicion.<\/p>"},{"question":"How did LOLBin originate?","answer":"<p>The concept of LOLBins gained prominence around 2014 when researchers noticed an increase in fileless attacks and techniques using built-in Windows binaries for malicious purposes. The term was first mentioned in a research paper titled \"Living off the Land and Evading Detection - A Survey of Common Practices\" by Casey Smith in 2014.<\/p>"},{"question":"How do LOLBins work?","answer":"<p>LOLBins are native Windows binaries that come pre-installed on the system, designed for legitimate administrative tasks. Cybercriminals manipulate these binaries to perform malicious activities, leveraging their legitimate appearance and functionalities to avoid detection.<\/p>"},{"question":"What are the key features of LOLBins?","answer":"<p>LOLBins offer several key features that attract threat actors, including their legitimate appearance, invisibility, fileless execution, and abuse of trusted tools.<\/p>"},{"question":"What types of LOLBins exist?","answer":"<p>LOLBins come in various types, including PowerShell Scripts, Windows Management Instrumentation (WMI), Windows Command Prompt (cmd.exe), and Windows Script Host (wscript.exe, cscript.exe).<\/p>"},{"question":"How are LOLBins used, and what are the associated problems?","answer":"<p>LOLBins are used for privilege escalation, information gathering, lateral movement, and persistence. The associated problems include difficulty in detection, visibility, whitelisting abuse, and mitigation challenges.<\/p>"},{"question":"How can organizations counter LOLBin-based attacks?","answer":"<p>Organizations can adopt a multi-layered security approach involving behavioral analysis, anomaly detection, advanced endpoint protection, and user education to mitigate LOLBin threats effectively.<\/p>"},{"question":"What are the future perspectives and technologies related to LOLBins?","answer":"<p>The future of LOLBins may involve AI-driven detection, enhanced behavioral analysis, zero trust architecture, and hardware-based security features to combat these threats effectively.<\/p>"},{"question":"How can proxy servers help with LOLBin defense?","answer":"<p>Proxy servers can assist in LOLBin defense by inspecting traffic, filtering malicious content, decrypting SSL\/TLS traffic, and detecting anonymization attempts.<\/p>"},{"question":"Where can I find more information about LOLBins?","answer":"<p>For more information on LOLBins and cybersecurity best practices, refer to the provided related links, research papers, and the MITRE ATT&amp;CK framework.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477880\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media\/477881"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media?parent=477880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}