¼¯ÍÅÁ½¿î²úÆ·ÈÙ»ñ¡°¹¤Òµ»¥ÁªÍø×°±¸Çå¾²ÄÜÁ¦²âÆÀÖ¤Ê顱

Ðû²¼Ê±¼ä 2021-08-05

ÌìÇ庺Âí¹¤Òµ·À»ðǽÓëÌìÇåÇå¾²¸ôÀëÓë½»Á÷ϵͳ £¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÕâÁ½¿î¹¤¿Ø²úƷ˫˫λÁÐÖйúÐÅϢͨѶÑо¿Ôº£¨ÒÔϼò³Æ¡°ÖйúÐÅͨԺ¡±£©Ðû²¼µÄÊ×Åú»ñµÃ¡°¹¤Òµ»¥ÁªÍø×°±¸Çå¾²ÄÜÁ¦²âÆÀÖ¤Ê顱µÄ×°±¸Ãûµ¥¡£


´Ë´ÎÆÀÑ¡ £¬ÌìÇ庺Âí¹¤Òµ·À»ðǽ¡¢ÌìÇåÇå¾²¸ôÀëÓë½»Á÷ϵͳ¾ùÒÀ¸½×ÔÉíÓÅÒìµÄÇå¾²ÄÜÁ¦ £¬ÔÚ34¼ÒÇå¾²³§É̹²58¿î¹¤Òµ»¥ÁªÍøÇå¾²×°±¸ÖÐÍÑÓ±¶ø³ö £¬Ë³Ëìͨ¹ýÆä¶ÔÇå¾²×°±¸µÄ·À»¤¹¦Ð§¡¢ÍøÂçͨѶÐÔÄܺÍ×ÔÉíÇå¾²ÐԵȷ½ÃæµÄÉî¶È²âÊÔ £¬ÈÙ»ñ¡°¹¤Òµ»¥ÁªÍø×°±¸Çå¾²ÄÜÁ¦²âÆÀÖ¤Ê顱¡£


1.png


ÌìÇ庺Âí¹¤Òµ·À»ðǽ


¹¤¿Ø·À»ðǽÊǹ¤Òµ¿ØÖÆÍøÂçÇøÓò¸ôÀëµÄÖ÷Ҫװ±¸ £¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼¯ÍÅÌìÇ庺Âí¹¤Òµ·À»ðǽÊÇÕë¶Ô¹¤¿ØÍøÂçÇ徲רÃÅÉè¼ÆµÄ·À»ðǽ²úÆ·¡£


ƾ֤¹¤ÒµÇéÐÎÖеĻúеҪÇó¡¢ÌìÆø±£»¤ÒªÇó¡¢ÇÖÈë±£»¤ÒªÇóÒÔ¼°µç´Å·øÉäºÍÃâÒßÒªÇó £¬ÌìÇ庺Âí¹¤Òµ·À»ðǽ½ÓÄÉ¿íΡ¢·À³¾¡¢¿¹µç´Å¡¢¿¹ÕðÉè¼Æ £¬Ìṩµ¼¹ìʽ¡¢»ú¼ÜʽÁ½ÖÖÐÎ̬ £¬²¢Ô¤ÖÃÉÏ°ÙÖÖ¹¤ÒµÐ­Òé £¬ÔÚÉîÌõÀíÓªÒµ·À»¤·½Ãæ £¬¿ÉʵÏÖ OPC¡¢Modbus¡¢S7¡¢EIP¡¢IEC104 µÈÖ¸Áʶ±ð¿ØÖÆ£»Í¬Ê±¸ßЧƥÅäÄÚÖÃÈëÇÖ¼ì²âÌØÕ÷¿â £¬¹ØÓÚľÂí¡¢Èä³æ¡¢shellcode¡¢exploit¡¢XSSµÈ¹¥»÷ÐÐΪ¾ß±¸¸ß¾«¶ÈµÄ¼ì²âÄÜÁ¦ £¬Ö§³ÖBYPASS¡¢Èȱ¸»úÖÆ¡¢½Ó¿ÚÁª¶¯¡¢¶Ë¿ÚÈßÓà¶àÖÖÊÖÒÕ £¬È«·½Î»°ü¹Ü×°±¸¿É¿¿ÔËÐС£


ÒÔ³¡¾°»¯Ç徲ͷÄÔΪָµ¼ £¬ÌìÇ庺Âí¹¤Òµ·À»ðǽÒÔÓû§ÓªÒµÐèÇóΪµ¼Ïò £¬ÊµÏÖÁË¡°È«ÐÎ̬×Ô¶¯»¯¹¤Òµ·À»ðǽ¡±ÊÖÒÕõ辶 £¬Æ¾Ö¤¿Í»§²î±ð»¯ÐèÇó £¬ÍƳöÁËһϵÁÐÇкÏÐÐÒµÇå¾²ÊôÐÔÒªÇóµÄ²úÆ· £¬ÔÚ¹ìµÀ½»Í¨¡¢Ê¯ÓÍʯ»¯¡¢µçÁ¦¡¢Ñ̲ݡ¢»¯¹¤¡¢ÏȽøÖÆÔìµÈÁìÓò¾ùʵÏÖÁ˹¤Òµ»¥ÁªÍøÈ«ÐÐÒµÁýÕÖ £¬ÓµÓÐÈ«ÐÐÒµÂäµØµÄ¸»ºñÂÄÀú £¬»ñµÃÁËÐÐÒµÓëÓû§µÄÒ»Á¬ÐÅÍÐÒ»¶¨¡£


ÌìÇåÇå¾²¸ôÀëÓëÐÅÏ¢½»Á÷ϵͳ


ÌìÇåÇå¾²¸ôÀëÓëÐÅÏ¢½»Á÷ϵͳ£¨¹¤ÒµÍøÕ¢£©Í¨¹ýÕ½ÂÔÉ趨 £¬Ö»ÔÊÐíÉú²ú¿ØÖÆÍøÊÕÂÞµÄÊý¾ÝÁ÷ÏòÉú²úÖÎÀíÍø £¬ÔÊÐíÇкϿØÖÆÍø´«ÊäЭÒéµÄÊý¾Ý·µ»Øµ½¿ØÖÆÍøÂç £¬²»ÔÊÐíÈκÎÆäËüÊý¾Ý·µ»Øµ½¿ØÖÆÍøÂ硣ͬʱ¶ÔÁ÷¾­µÄÊý¾Ý±¨ÎľÙÐÐÑÏ¿áЭÒéÃûÌüì²éºÍÄÚÈݹýÂË £¬¿ÉʵÏÖ¶ÔOPC¡¢Modbus/TCP¡¢IECµÈ¹¤ÒµÐ­Òé¾ÙÐÐÉî¶ÈµÄÆÊÎö¡¢ºÏ¹æÐÔ¼ì²é¡¢Ö¸Áî¹ýÂ˵ȲÙ×÷¡£


3.jpg


±ðµÄ £¬Çå¾²¸ôÀëÓëÐÅÏ¢½»Á÷ϵͳ»¹ÄܶÔÓû§ÇéÐÎÖб£´æµÄOPCÊý¾Ý¾ÙÐС°ÖÇÄÜѧϰ¡± £¬Í¨¹ýѧϰ»ñÈ¡Ä¿½ñÍøÂçÖÐÖ¸Áî²ÎÊýµÈÇéÐÎ £¬¿ÉÒÔ×ÊÖúÏÖ³¡¹¤³ÌʦÉèÖ÷À»¤Õ½ÂÔ £¬´ó´ó½µµÍÁË°²ÅÅÄÑ¶È £¬°ü¹ÜÁËÉú²ú¿ØÖÆÍøºÍÉú²úÖÎÀíÍøµÄͨѶÇå¾²¡£


ÌìÇ庺Âí¹¤Òµ·À»ðǽ¡¢ÌìÇåÇå¾²¸ôÀëÓë½»Á÷ϽµµÍ½¿î¿î²úÆ·´Ë´Î»ñµÃ¡°¹¤Òµ»¥ÁªÍø×°±¸Çå¾²ÄÜÁ¦²âÆÀÖ¤Ê顱 £¬ÊÇÐÐҵȨÍþ»ú¹¹¶Ô²úƷʵÁ¦µÄ¸ß¶ÈÈÏ¿É¡£³ý´ËÖ®Íâ £¬Á½¿î²úÆ·µÄÊг¡ÌåÏÖÒ²ÊÇÒ»Æï¾ø³¾ £¬´ËÇ°ÒÑÇ¿ÊÆÈëΧÖйúȨÍþµ÷Ñлú¹¹ÈüµÏÕÕÁÏCCIDÐû²¼µÄ¡¶¹¤¿ØÇå¾²Éú³¤°×ƤÊé¡· £¬ÊÐ԰ְλÎȾӵÚÒ» £¬ÁìÅܹ¤¿ØÇå¾²ÐÐÒµÉú³¤¡£


×÷ΪÐÐÒµÄÚ×îÔ翪չ¹¤Òµ»¥ÁªÍø½á¹¹µÄÇå¾²ÆóÒµ £¬×Ô2014ÄêÍ·ÖÁ½ñ £¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼¯ÍÅÒ»Á¬Éî¸û¹¤Òµ»¥ÁªÍøÇå¾² £¬½ÅÔúʵµØ³Áµí¶àÄêÂÄÀú £¬½á³öÀÛÀÛ˶¹û £¬¼ÓÈëÖƶ©½ü20ÏҵÐÅÏ¢Çå¾²¹ú¼Ò±ê×¼/ÐÐÒµ±ê×¼ £¬¼ç¸º¹ú¼ÒרÏî¿ÎÌâ´ï20¸ö £¬ÓëÖÚ¶àÐÐÒµ¿Í»§¿ªÕ¹ÁËÉî¶ÈÏàÖú £¬ÐγÉÁËÁýÕÖµçÁ¦¡¢½»Í¨¡¢Ê¯ÓÍʯ»¯¡¢ÖÇÄÜÖÆÔì¡¢Ñ̲ݡ¢¹ì½»¡¢ÊÐÕþµÈÐÐÒµ¹¤ÒµÐÅÏ¢Çå¾²²úÆ·Ï¢Õù¾ö¼Æ»® £¬ÒÑÓÐÁè¼Ýǧ¸öµÄÐÐÒµÓ¦Óð¸Àý £¬¶¥¼âÇ¿¾¢µÄÊÖÒÕʵÁ¦ºÍÔ¶³¬Ô¤ÆڵIJúÆ·ÌåÏÖ £¬Ó®µÃÐÐÒµÓë¿Í»§µÄÇàíù £¬³ÉΪ¹¤Òµ»¥ÁªÍøÇå¾²ÁìÓòµÄÏòµ¼ÕßÆ·ÅÆ¡£


Ä¿½ñ £¬»¥ÁªÍøÁ¢ÒìÉú³¤Óëй¤Òµ¸ïÃüÕý´¦ÓÚÀúÊ·½»»ãÆÚ £¬¹¤Òµ»¥ÁªÍøÉú³¤µÄ¹ú¼Ê¾ºÕùÈÕÇ÷Ç¿ÁÒ¡£


×÷ΪÃñ×åÐÅÏ¢Çå¾²Áì¾üÆóÒµ £¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼¯ÍŽ«Ò»Á¬Á¢Òì £¬ÇÀ×¥ÐÂÒ»ÂÖ¹¤Òµ¸ïÃü»úÔµ £¬¼ÓËÙÌáÉý¹¤Òµ»¥ÁªÍøÇå¾²×°±¸µÄ¹¦Ð§¡¢ÐÔÄܺÍ×ÔÉíÇå¾²ÐÔˮƽ £¬¸üºÃµØÖª×㹤ҵ³¡¾°ÏµÄÓû§Çå¾²ÐèÇó £¬¼ÓËÙ¹¹½¨Êý×ÖÇý¶¯µÄ¹¤ÒµÐÂÉú̬ £¬»¤º½ÎÒ¹ú¹¤ÒµÐÅÏ¢»¯½¨ÉèÓëÉú³¤¡£