存档

文章标签 ‘Malware’

代码注入技术

2012年6月2日 8 条评论

代码注入相对DLL注入来说更加隐蔽,但是对技术的要求要更高,个人以为代码注入最好注入稳定的Shellcode。

代码注入需要用到的API有VirtualAllocEx、WriteProcessMemory、CreateRemoteThread,类似于DLL注入。通常VirtualAllocEx和WriteProcessMemory会被调用两次,分别是处理线程函数以及线程函数参数,然后通过调用CreateRemoteThread来执行代码。当然如果是注入Shellcode就只要调用一次就够了,如果是注入线程函数,需要正确的计算函数的大小,通过#pragma check_stack指令来实现(静态函数、同时关闭增量链接、Release版本)。

下面的代码是一个演示弹出MessageBox的代码注入:[......]

Windows NT WinLogon Notify

2012年5月31日 没有评论

在NT系列Windows操作系统中,恶意软件可以通过关联Winlogon特定的事件来使自身被启动,如Lock,Logoff,Logon,Shutdown,StartScreenSaver,StartShell,Startup,StopScreenSaver,Unlock等,这甚至能够使得恶意软件在安全模式下被加载。WinLogon的通知事件在注册表的位置是:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

当WinLogon.exe产生一个事件通知的时候,Windows会检查注册表里面指定的DLL并调用DLL指定的导出函数。示例(当屏幕锁定时调用WinLogonDemo.dll导出的LockFun函数)。

从Windows Vista开始,这项特性被取消了。可以通过注册一个服务来监听相应的事件(部分事件不支持),参见Using Service Control Manager (SCM) Notifications[......]

Windows NT’s GINA Interception

2012年5月30日 2 条评论

On Windows XP, Microsoft’s Graphical Identification and Authentication (GINA) interception is a technique that malware uses to steal user credentials. The GINA system was intended to allow legitimate third parties to customize the logon process by adding support for things like authentication with hard-ware radio-frequency identification (RFID) tokens or smart cards. Malware authors take advantage of this third-party support to load their credential stealers.

GINA is implemented in a DLL, msgina.dll, and is loaded by the Win-logon executable during the login process. Winlogon also works for third-party customizations implemented in DLLs by loading them in between Winlogon and the GINA DLL (like a man-in-the-middle attack). Windows conveniently provides the following registry location where third-party DLLs will be found and loaded by Winlogon:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL[......]

分类: 恶意代码 标签: , ,