当前位置:编程学习 > 网站相关 >>

内核层关机重启

现在HOOK越来越普遍,很多恶意程序通用hook用户进程的关机函数禁止关机,有些则是hook winlogon.exe的关机函数,因为进程的调用关机函数会最终给winlogon.exe发送关机消息。所以在用户层实现关机已经越来越不安全了。内核驱动禁止关机也不是很安全,通过windbg可以发现xuetr.exe禁止关机的原理是对NtShutdownSystem调用的SeSinglePrivilegeCheck(权限检查)函数进行call hook。不管了,毕竟玩驱的也不是等闲之辈。我们可以经常遇到在DriverEntry调用NtShutdownSystem可以正常关机重启,但是通过ioctl关机重启失效了,NtShutdownSystem的返回值是STATUS_PRIVILEGE_NOT_HELD,也就是权限不足,看来需要提权。提权函数如下:
void AdjustPriv(ULONG ulSe)
{
 NTSTATUS nts = 0;
 TOKEN_PRIVILEGES TokenPrivileges;
 HANDLE tokenHandle;
 nts = ZwOpenProcessToken(NtCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&tokenHandle);
 if (NT_SUCCESS(nts))
 {
  TokenPrivileges.PrivilegeCount = 1;
  TokenPrivileges.Privileges[0].Luid = RtlConvertUlongToLuid(ulSe);
  TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
  nts = ZwAdjustPrivilegesToken(tokenHandle, FALSE,  &TokenPrivileges, sizeof(TokenPrivileges), NULL,  NULL);
  ZwClose(tokenHandle);
 }
}
接下来是用户层通过DeviceIoControl发送ioctl,通知驱动程序关机:
NTSTATUS OnDeviceIoControl( PDEVICE_OBJECT pDeviceObject, PIRP Irp )
{
 NTSTATUS status;
 PIO_STACK_LOCATION IrpStack;
 PVOID InputBuffer;
 PVOID OutputBuffer;
 ULONG InputBufferLength;
 ULONG OutputBufferLength;
 ULONG IoControlCode;
 char* lpBuf = NULL;
 ULONG ulPid = 0;
 status = Irp->IoStatus.Status = STATUS_SUCCESS;
 Irp->IoStatus.Information = 0;
 IrpStack = IoGetCurrentIrpStackLocation( Irp );
 InputBuffer = IrpStack->Parameters.DeviceIoControl.Type3InputBuffer;
 InputBufferLength = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
 OutputBuffer = Irp->UserBuffer;
 OutputBufferLength = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;
 IoControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;
 switch( IoControlCode )
 {
 case IOCTL_SHUTDOWN_POWEROFF: 
  {
   AdjustPriv(SE_SHUTDOWN_PRIVILEGE);
   NtShutdownSystem(ShutdownPowerOff); //关闭电源
  }
  break;
 case IOCTL_SHUTDOWN_NOREBOOT:
  {
   AdjustPriv(SE_SHUTDOWN_PRIVILEGE);
   NtShutdownSystem(ShutdownNoReboot); //关机
  }
  break;
 case IOCTL_SHUTDOWN_REBOOT:
  {www.zzzyk.com
   AdjustPriv(SE_SHUTDOWN_PRIVILEGE);
   NtShutdownSystem(ShutdownReboot); //重启
  }
  break;
 default:
  status = STATUS_INVALID_DEVICE_REQUEST;
  break;
 }
 IoCompleteRequest( Irp, IO_NO_INCREMENT );
 return status;
}
 
当然这种关机还需要NtShutdownSystem没被inline hook,ssdt hook或者是call hook为前提的。
补充:综合编程 , 安全编程 ,
CopyRight © 2012 站长网 编程知识问答 www.zzzyk.com All Rights Reserved
部份技术文章来自网络,