|
|
|---|---|
|
|
|
|
|
只有样本没有源码，应该是挂接\RPC Control\DNDResolver接管系统所有DNS解析的消息
然后修改的 禁止DNSCache是禁止DNS缓存，让所有解析都到他那里去 已经搞定了，只要\RPC Control\DNDResolver这个对象，关闭所有打开的句柄就行了  NTSTATUS status;
UNICODE_STRING ustrDns;
PFILE_OBJECT fileObj;
PVOID pLpcObject;
PLPCP_PORT_OBJECT pLpcObj = NULL;
RtlInitUnicodeString(&ustrDns, L"\\RPC Control\\DNSResolver");
UNICODE_STRING ustrLPC;
RtlInitUnicodeString(&ustrLPC, L"LpcPortObjectType");
PVOID pLpcPortObjectType = MmGetSystemRoutineAddress(&ustrLPC);
if ( pLpcPortObjectType != NULL )
{
status = ObReferenceObjectByName(&ustrDns,
OBJ_CASE_INSENSITIVE,
NULL,
FILE_ALL_ACCESS,
(POBJECT_TYPE)pLpcPortObjectType,
KernelMode,
NULL,
&pLpcObject);
pLpcObj = (PLPCP_PORT_OBJECT)pLpcObject;
if ( MmIsAddressValid(pLpcObj) )
{
//获取宿主进程ID
HANDLE hProcId = PsGetProcessId(pLpcObj->ServerProcess);
//获取进程句柄
HANDLE hProcess = NULL;
status = ObOpenObjectByPointer((PVOID)pLpcObj->ServerProcess,
0,
NULL,
PROCESS_ALL_ACCESS,
*PsProcessType,
KernelMode,
&hProcess);
//枚举系统所有句柄
ULONG uRetLength = 0;
PVOID pBuffer = kmalloc(0x100);
PSYSTEM_HANDLE_INFORMATION pHandleInfo = NULL;
ULONG HandleCount = 0;
status = ZwQuerySystemInformation(SystemHandleInformation, pBuffer, 0x100, &uRetLength);
if ( !NT_SUCCESS(status) )
{
kfree(pBuffer);
pBuffer = kmalloc(uRetLength);
if ( pBuffer )
{
RtlZeroMemory(pBuffer, uRetLength);
status = ZwQuerySystemInformation(SystemHandleInformation, pBuffer, uRetLength, &uRetLength);
if ( NT_SUCCESS(status) )
{
//句柄数量
HandleCount = *((ULONG *)pBuffer);
pHandleInfo = (PSYSTEM_HANDLE_INFORMATION)((ULONG)pBuffer + sizeof(ULONG));
}
}
}
POBJECT_TYPE_INFORMATION ObjTypeInfo = (POBJECT_TYPE_INFORMATION)kmalloc(MAX_PATH * 10);
PVOID ObjName = (PVOID)kmalloc(MAX_PATH * 10);
if ( ObjTypeInfo && ObjName )
{
RtlZeroMemory(ObjTypeInfo, MAX_PATH * 10);
RtlZeroMemory(ObjName, MAX_PATH * 10);
}
if ( HandleCount >0 && pHandleInfo != NULL )
{
ULONG i;
for ( i = 0; i < HandleCount; i ++ )
{
if ( pHandleInfo[i].ProcessId == (ULONG)hProcId )
{
HANDLE hObject;
status = ZwDuplicateObject(hProcess,
(HANDLE)pHandleInfo[i].Handle,
NtCurrentProcess(),
&hObject,
0,
0,
DUPLICATE_SAME_ACCESS);
if (!NT_SUCCESS(status))
continue;
//Query the object type
status = ZwQueryObject(hObject,
ObjectTypeInformation,
ObjTypeInfo,
MAX_PATH * 10,
&uRetLength);
if (!NT_SUCCESS(status))
{
ZwClose(hObject);
continue;
}
status = ZwQueryObject(hObject,
(OBJECT_INFORMATION_CLASS)1,
ObjName,
MAX_PATH * 10,
&uRetLength);
if (!NT_SUCCESS(status))
{
ZwClose(hObject);
continue;
}
UNICODE_STRING ustrType;
UNICODE_STRING win7_ALPC_PORT;
RtlInitUnicodeString(&ustrType, L"Port");
RtlInitUnicodeString(&win7_ALPC_PORT, L"ALPC Port");
if ( 0 == RtlCompareUnicodeString(&ustrType, &ObjTypeInfo->Name, TRUE) ||
0 == RtlCompareUnicodeString(&win7_ALPC_PORT, &ObjTypeInfo->Name, TRUE) )
{
if ( 0 == RtlCompareUnicodeString(&ustrDns,(PUNICODE_STRING)ObjName, TRUE) )
{
KAPC_STATE k_apc;
KeStackAttachProcess(pLpcObj->ServerProcess, &k_apc);
ZwClose((HANDLE)pHandleInfo[i].Handle);//草泥马
KeUnstackDetachProcess(&k_apc);
ZwClose(hObject);//必须关闭自己复制来的句柄 不然无法上网了
ZwTerminateProcess(hProcess, 0);
}
}
}
}
}
if ( pBuffer )
{
kfree(pBuffer);
pBuffer = NULL;
}
if ( ObjTypeInfo )
{
kfree(ObjTypeInfo);
ObjTypeInfo = NULL;
}
if ( ObjName )
{
kfree(ObjName);
ObjName = NULL;
}
if ( hProcess )
{
ZwClose(hProcess);
}
}
}
if ( pLpcObject )
{
ObDereferenceObject(pLpcObject);
}
if ( MmIsAddressValid(pLpcObj) )
{
ObDereferenceObject(pLpcObj->ServerProcess);
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
