内核层关机重启
现在HOOK越来越普遍,很多恶意程序通用hook用户进程的关机函数禁止关机,有些则是hook winlogon.exe的关机函数,因为进程的调用关机函数会最终给winlogon.exe发送关机消息。所以在用户层实现关机已经越来越不安全了。内核驱动禁止关机也不是很安全,通过windbg可以发现xuetr.exe禁止关机的原理是对NtShutdownSystem调用的SeSinglePrivilegeCheck(权限检查)函数进行call hook。不管了,毕竟玩驱的也不是等闲之辈。我们可以经常遇到在DriverEntry调用NtShutdownSystem可以正常关机重启,但是通过ioctl关机重启失效了,NtShutdownSystem的返回值是STATUS_PRIVILEGE_NOT_HELD,也就是权限不足,看来需要提权。提权函数如下:void AdjustPriv(ULONG ulSe)
{
NTSTATUS nts = 0;
TOKEN_PRIVILEGES TokenPrivileges;
HANDLE tokenHandle;
nts = ZwOpenProcessToken(NtCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&tokenHandle);
if (NT_SUCCESS(nts))
{
TokenPrivileges.PrivilegeCount = 1;
TokenPrivileges.Privileges[0].Luid = RtlConvertUlongToLuid(ulSe);
TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
nts = ZwAdjustPrivilegesToken(tokenHandle, FALSE, &TokenPrivileges, sizeof(TokenPrivileges), NULL, NULL);
ZwClose(tokenHandle);
}
}
接下来是用户层通过DeviceIoControl发送ioctl,通知驱动程序关机:
NTSTATUS OnDeviceIoControl( PDEVICE_OBJECT pDeviceObject, PIRP Irp )
{
NTSTATUS status;
PIO_STACK_LOCATION IrpStack;
PVOID InputBuffer;
PVOID OutputBuffer;
ULONG InputBufferLength;
ULONG OutputBufferLength;
ULONG IoControlCode;
char* lpBuf = NULL;
ULONG ulPid = 0;
status = Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0;
IrpStack = IoGetCurrentIrpStackLocation( Irp );
InputBuffer = IrpStack->Parameters.DeviceIoControl.Type3InputBuffer;
InputBufferLength = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
OutputBuffer = Irp->UserBuffer;
OutputBufferLength = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;
IoControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;
switch( IoControlCode )
{
case IOCTL_SHUTDOWN_POWEROFF:
{
AdjustPriv(SE_SHUTDOWN_PRIVILEGE);
NtShutdownSystem(ShutdownPowerOff); //关闭电源
}
break;
case IOCTL_SHUTDOWN_NOREBOOT:
{
AdjustPriv(SE_SHUTDOWN_PRIVILEGE);
NtShutdownSystem(ShutdownNoReboot); //关机
}
break;
case IOCTL_SHUTDOWN_REBOOT:
{www.zzzyk.com
AdjustPriv(SE_SHUTDOWN_PRIVILEGE);
NtShutdownSystem(ShutdownReboot); //重启
}
break;
default:
status = STATUS_INVALID_DEVICE_REQUEST;
break;
}
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return status;
}
当然这种关机还需要NtShutdownSystem没被inline hook,ssdt hook或者是call hook为前提的。
补充:综合编程 , 安全编程 ,