5th, system order defense:
The deletion, the migration, change the name or catalog Access Control Lists with the access control the (ACLs) control key system file, the order and
Folder:
the (1)th, hacker usually after the overflow obtains shell, uses such as net.exe, net1.exe, ipconfig.exe, user.exe, query.exe, regedit.exe, regsvr32.exe to achieve further controls server's goal. For example: Added the account number, to clone the manager and so on. We may delete these order program or the name change. 4 t (B+ L/O- y.
Prompt: When deletes and the name change stops the document copying to serve (FRS) first or the first %windir%system32dllcache under correspondence file delete or the name change. I love the computer technology community--Makes the best electricity
(2)th, also or moves these .exe document the folder which assigns to you, like this also facilitates later manager to use.
the (3)th, access control catalogs the ACLS control:
Found under %windir%system32 to find cmd.exe, cmd32.exe, net.exe, net1.exe, ipconfig.exe, tftp.exe, ftp.exe, user.exe, reg.exe, regedit.exe, regedt32.exe, the regsvr32.exe these hacker's commonly used document, -> “safe” carried on “the attribute” visit to them the ACLs user to carry on the definition, such as was only authorized to administrator to visit, if after needed to guard against some overflow attack, as well as overflowed successfully, to these document illegal use; Then we only need the system user to carry on ACLs refuse to visit then.
(4)th, if you think is too troublesome under GUI, you may also use the system order CACLS.EXE to come to these .exe document Acls to carry on the edition and the revision, or wrote him .bat the batch run document to carry out as well as carries on to these orders the revision.
(5)th, to floppy disk like C, D, E, F and so on carries on the safe ACLS establishment from the overall security to consider is also very necessary, moreover must specially to Windows, WinntSystem, folders and so on Document and Setting.
6th, group strategy disposition:
Wants to be forbid “cmd.exe”, the execution “starts -> the movement” to input gpedit.msc to open the group strategy, the choice “the user disposition -> manages the template -> system”, supposes “the impediment visit order prompt symbol” is “begins using”. Similarly may forbid other quite dangerous application procedure through the group strategy.
7th, service degradation:
Carries on degradation processing to some by the System jurisdiction movement's system service. For instance: Serv-U, Imail, IIS, Php, Mssql, Mysql and so on a series of change into other administrators by the System jurisdiction movement's service or the application procedure the member even users jurisdiction movement, like this will be much safer. But the premise is needs to these basic running status, to transfer related situations and so on API to understand.
Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * 6 * Next>>
|
You are here: hacking technology
> network management
> Content
Category: Home
> network management