Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

请教一下安全性的问题 #167

Open
dunkeng opened this issue Jul 29, 2024 · 2 comments
Open

请教一下安全性的问题 #167

dunkeng opened this issue Jul 29, 2024 · 2 comments

Comments

@dunkeng
Copy link

dunkeng commented Jul 29, 2024

  • 操作系统: windows11
  • 浏览器:edge
  • 复现问题的操作:正常使用
  • 出现的具体问题:由于浏览器调用powershell,被杀毒软件判断为有风险,会拦截

所以,powershell做的事情,能不能在脚本里面做了?浏览器直接调用播放器这样子?
这样杀毒软件就不会拦截了,我实际试了,杀毒软件就是拦截powershell,确实这玩意直接调用是有风险

@LuckyPuppy514
Copy link
Owner

不可能,浏览器不能直接调用系统软件的,否则随便一个钓鱼网站就给你电脑整崩了

@dunkeng
Copy link
Author

dunkeng commented Jul 29, 2024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command "& {Add-Type -AssemblyName System.Web;$PARAMS=([System.Web.HTTPUtility]::UrlDecode('%1') -replace '^mpv://'); Start-Process -FilePath "E://Tools//mpv.net//mpvnet.exe" -ArgumentList $PARAMS}"

咱现在不是这么调用的吗?我不是很懂,火绒把这个给拦截了,我试着把命令行直接改成mpv就可以不拦截

下边是火绒日志,每次弹窗都是我点的允许才能执行:
防护项目:浏览器
操作目标:【执行】 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
操作目标参数:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "& {Add-Type -AssemblyName System.Web;$PARAMS=([System.Web.HTTPUtility]::UrlDecode('mpv://%22https://xy118x184x254x91xy.mcdn.bilivideo.cn:8082/v1/resource/1617541293-1-100111.m4s?agrr=1&build=0&buvid=03760912-8DFA-7934-6364-8972355EE1AD95626infoc&bvc=vod&bw=35690&cdnid=60908&deadline=1722249890&e=ig8euxZM2rNcNbdlhoNvNC8BqJIzNbfqXBvEqxTEto8BTrNvN0GvT90W5JZMkX_YN0MvXg8gNEV4NC8xNEV4N03eN0B5tZlqNxTEto8BTrNvNeZVuJ10Kj_g2UB02J0mN0B5tZlqNCNEto8BTrNvNC7MTX502C8f2jmMQJ6mqF2fka1mqx6gqj0eN0B599M%3D&f=u_0_0&gen=playurlv2&logo=80000000&mid=76577063&nbs=1&nettype=0&og=hw&oi=0&orderid=0%2C3&os=bcache&platform=pc&sign=5a68a4&traceid=trLuNuxHysMRhG_0_e_N&uipk=5&uparams=e%2Cuipk%2Cnbs%2Cdeadline%2Cgen%2Cos%2Coi%2Ctrid%2Cmid%2Cplatform%2Cog&upsig=900dab0c7ee553b073e323f43246c4f4%22%20--audio-file=%22https://cn-gdfs-ct-01-08.bilivideo.com/upgcxcode/93/12/1617541293/1617541293-1-30280.m4s?e=ig8euxZM2rNcNbdlhoNvNC8BqJIzNbfqXBvEqxTEto8BTrNvN0G
操作结果:已允许

保护进程路径:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
保护进程命令行:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants