跳到主要内容
知知仓学习社ZHICANG

implementing-memory-protection-with-dep-aslr

Implements memory protection mechanisms including DEP (Data Execution

执行命令写文件严重 0 · 高危 8mukul975/Anthropic-Cybersecurity-Skills

它会碰到什么

扫了多少8 个文本文件，25 KB
它会碰到什么执行命令写文件
命中总数10 处
命中统计严重 0 · 高 8 · 中 2 · 低 0
逐条看命中（8 条严重或高危）
  • 高 scripts/agent.py:18exec-spawn
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:32exec-spawn
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:55exec-spawn
    result = subprocess.run(["grep", "nx", "/proc/cpuinfo"], capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:62exec-spawn
    readelf_cmd = subprocess.run(["readelf", "-h", binary_path], capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:65exec-spawn
    readelf_d = subprocess.run(["readelf", "-d", binary_path], capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:70exec-spawn
    readelf_s = subprocess.run(["readelf", "-s", binary_path], capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:73exec-spawn
    readelf_l = subprocess.run(["readelf", "-l", binary_path], capture_output=True, text=True, timeout=120)
  • 高 scripts/process.py:15exec-spawn
    r = subprocess.run(["powershell", "-NoProfile", "-Command", ps_cmd],

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

Implementing Memory Protection with DEP and ASLR

When to Use

Use this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.

Prerequisites

  • Windows 10/11 or Windows Server 2016+ with administrative privileges
  • Group Policy management access for enterprise-wide deployment
  • Understanding of memory corruption attack techniques (buffer overflow, ROP chains)
  • Test environment for validating application compatibility with exploit mitigations

Workflow

Step 1: Configure System-Level Mitigations

# Enable system-wide DEP (Data Execution Prevention)
# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn
bcdedit /set nx AlwaysOn

# Verify ASLR status (enabled by default on modern Windows)
Get-ProcessMitigation -System
# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON

# Enable all system-level mitigations
Set-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy

Step 2: Configure Per-Application Mitigations

# Harden high-risk applications (browsers, Office, PDF readers)
Set-ProcessMitigation -Name "WINWORD.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "EXCEL.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "AcroRd32.exe" -Enable DEP,SEHOP,ForceRelocateImages,CFG
Set-ProcessMitigation -Name "chrome.exe" -Enable DEP,CFG,ForceRelocateImages
Set-ProcessMitigation -Name "msedge.exe" -Enable DEP,CFG,ForceRelocateImages

# Export configuration for deployment
Get-ProcessMitigation -RegistryConfigFilePath "C:\exploit_protection.xml"
# Deploy via Intune or GPO

Step 3: Deploy via Intune/GPO

Intune: Endpoint Security → Attack Surface Reduction → Exploit Protection
  Import exploit_protection.xml template

GPO: Computer Configuration → Admin Templates → Windows Components
  → Windows Defender Exploit Guard → Exploit Protection
  → "Use a common set of exploit protection settings" → Enabled
  → Point to XML file on network share

Key Concepts

| Term | Definition |

|------|-----------|

| DEP | Marks memory pages as non-executable to prevent shellcode execution in data regions |

| ASLR | Randomizes memory addresses of loaded modules to defeat hardcoded ROP gadgets |

| CFG | Validates indirect call targets at runtime to prevent control flow hijacking |

| SEHOP | Validates SEH chain integrity to prevent SEH-based exploitation |

Tools & Systems

  • Windows Exploit Protection: Built-in per-process mitigation management
  • EMET (legacy): Enhanced Mitigation Experience Toolkit (predecessor, now deprecated)
  • ProcessMitigations PowerShell: Get/Set-ProcessMitigation cmdlets

Common Pitfalls

  • DEP compatibility: Legacy 32-bit applications may crash with DEP AlwaysOn. Use OptOut with exceptions.
  • Mandatory ASLR breaking apps: Some applications are not ASLR-compatible. Test before enforcing ForceRelocateImages.
  • CFG limited to compiled-in support: CFG only works for applications compiled with /guard:cf. Cannot be retroactively applied.

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库mukul975/Anthropic-Cybersecurity-Skills
星标★ 32,865
本站分层T1
该仓技能数818
原文件路径skills/implementing-memory-protection-with-dep-aslr/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 818 个技能