内核线程注入(x64)
阅读BlackBone源码从里面扣出来的关于内核线程注入方法的使用。
经过自己修改后做成的Demo，功能主要通过Ring0层驱动Attach到目标进程(目标进程可以是32位进程也可以是64位进程，使用不同的ShellCode进行注入操作)，然后调用NtCreateThreadEx来执行ShellCode，ShellCode做了一个注入Dll的简单行为(加载Dll使用的是Ntdll模块下的LdrLoadDll函数)。
关键函数如下：
//切换到目标进程创建内核线程进行注入
NTSTATUS AttachAndInjectProcess(IN HANDLE ProcessID)
{
PEPROCESS EProcess = NULL;
KAPC_STATE ApcState;
NTSTATUS Status = STATUS_SUCCESS;
if (ProcessID == NULL)
{
Status = STATUS_UNSUCCESSFUL;
return Status;
}
//获取EProcess
Status = PsLookupProcessByProcessId(ProcessID, &EProcess);
if (Status != STATUS_SUCCESS)
{
DbgPrint(("PsLookupProcessByProcessId函数失败\n"));
return Status;
}
//判断目标进程x86 or x64
BOOLEAN IsWow64 = (PsGetProcessWow64Process(EProcess) != NULL) ? TRUE : FALSE;
//KeStackAttachProcess例程 将当前线程连接到目标进程的地址空间。
KeStackAttachProcess((PRKPROCESS)EProcess, &ApcState);
__try
{
PVOID NtdllAddress = NULL;
PVOID LdrLoadDll = NULL;
UNICODE_STRING NtdllUnicodeString = { 0 };
UNICODE_STRING DllFullPath = { 0 };
//获取ntdll模块基地址
RtlInitUnicodeString(&NtdllUnicodeString, L"Ntdll.dll");
NtdllAddress = GetUserModule(EProcess, &NtdllUnicodeString,IsWow64);
if (!NtdllAddress)
{
DbgPrint("%s: Failed to get Ntdll base\n", __FUNCTION__);
Status = STATUS_NOT_FOUND;
}
//获取LdrLoadDll
if (NT_SUCCESS(Status))
{
LdrLoadDll = GetModuleExport(NtdllAddress, "LdrLoadDll", EProcess, NULL);
/*
64位LdrLoadDll
kd> u 0x00000000`77c77ac0
00000000`77c77ac0 48895c2410 mov qword ptr [rsp+10h],rbx
00000000`77c77ac5 48896c2418 mov qword ptr [rsp+18h],rbp
00000000`77c77aca 56 push rsi
00000000`77c77acb 57 push rdi
00000000`77c77acc 4154 push r12
00000000`77c77ace 4883ec50 sub rsp,50h
00000000`77c77ad2 f605b72e110009 test byte ptr [00000000`77d8a990],9
00000000`77c77ad9 498bf1 mov rsi,r9
*/
if (!LdrLoadDll)
{
DbgPrint("%s: Failed to get LdrLoadDll address\n", __FUNCTION__);
Status = STATUS_NOT_FOUND;
}
}
PINJECT_BUFFER InjectBuffer = NULL;
if (IsWow64)
{
RtlInitUnicodeString(&DllFullPath, L"C:\\Windows\\Dllx86.dll");
InjectBuffer = GetWow64Code(LdrLoadDll, &DllFullPath);
}
else
{
RtlInitUnicodeString(&DllFullPath, L"C:\\Windows\\Dllx64.dll");
InjectBuffer = GetNativeCode(LdrLoadDll, &DllFullPath);
}
/*
kd> u 0x00000000`002b0000
00000000`002b0000 4883ec28 sub rsp,28h
00000000`002b0004 4831c9 xor rcx,rcx
00000000`002b0007 4831d2 xor rdx,rdx
00000000`002b000a 49b800022b0000000000 mov r8,2B0200h
00000000`002b0014 49b9e0052b0000000000 mov r9,2B05E0h
00000000`002b001e 48b8c07ac77700000000 mov rax,77C77AC0h
00000000`002b0028 ffd0 call rax
00000000`002b002a 48bae8052b0000000000 mov rdx,2B05E8h
*/
ExecuteInNewThread(InjectBuffer, NULL, THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER, TRUE, &Status);
if (!NT_SUCCESS(Status))
{
DbgPrint(("ExecuteInNewThread函数失败\n"));
}
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
Status = STATUS_UNSUCCESSFUL;
}
//将当前线程返回原进程的地址空间。
KeUnstackDetachProcess(&ApcState);
//释放EProcess
ObDereferenceObject(EProcess);
return Status;
}这个代码与我之前所写的内核线程注入x86的代码相差不大，附加的主要是对目标进程作了判断是否位32位进程，然后根据是32位还是64位选择构建不同的ShellCode。
构建ShellCode的代码如下:
//创建注入代码 64位目标进程
PINJECT_BUFFER GetNativeCode(IN PVOID LdrLoadDll, IN PUNICODE_STRING DllFullPath)
{
NTSTATUS Status = STATUS_SUCCESS;
PINJECT_BUFFER InjectBuffer = NULL;
SIZE_T Size = PAGE_SIZE;
UCHAR Code[] =
{
0x48, 0x83, 0xEC, 0x28, // sub rsp, 0x28
0x48, 0x31, 0xC9, // xor rcx, rcx
0x48, 0x31, 0xD2, // xor rdx, rdx
0x49, 0xB8, 0, 0, 0, 0, 0, 0, 0, 0, // mov r8, ModuleFileName offset +12
0x49, 0xB9, 0, 0, 0, 0, 0, 0, 0, 0, // mov r9, ModuleHandle offset +28
0x48, 0xB8, 0, 0, 0, 0, 0, 0, 0, 0, // mov rax, LdrLoadDll offset +32
0xFF, 0xD0, // call rax
0x48, 0xBA, 0, 0, 0, 0, 0, 0, 0, 0, // mov rdx, COMPLETE_OFFSET offset +44
0xC7, 0x02, 0x7E, 0x1E, 0x37, 0xC0, // mov [rdx], CALL_COMPLETE
0x48, 0xBA, 0, 0, 0, 0, 0, 0, 0, 0, // mov rdx, STATUS_OFFSET offset +60
0x89, 0x02, // mov [rdx], eax
0x48, 0x83, 0xC4, 0x28, // add rsp, 0x28
0xC3 // ret
};
Status = ZwAllocateVirtualMemory(ZwCurrentProcess(), &InjectBuffer, 0, &Size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (NT_SUCCESS(Status))
{
PUNICODE_STRING UserPath = &InjectBuffer->Path;
UserPath->Length = 0;
UserPath->MaximumLength = sizeof(InjectBuffer->Buffer);
UserPath->Buffer = InjectBuffer->Buffer;
RtlUnicodeStringCopy(UserPath, DllFullPath);
// Copy code
memcpy(InjectBuffer, Code, sizeof(Code));
// Fill stubs
*(ULONGLONG*)((PUCHAR)InjectBuffer + 12) = (ULONGLONG)UserPath;
*(ULONGLONG*)((PUCHAR)InjectBuffer + 22) = (ULONGLONG)&InjectBuffer->ModuleHandle;
*(ULONGLONG*)((PUCHAR)InjectBuffer + 32) = (ULONGLONG)LdrLoadDll;
*(ULONGLONG*)((PUCHAR)InjectBuffer + 44) = (ULONGLONG)&InjectBuffer->Complete;
*(ULONGLONG*)((PUCHAR)InjectBuffer + 60) = (ULONGLONG)&InjectBuffer->Status;
return InjectBuffer;
}
UNREFERENCED_PARAMETER(DllFullPath);
return NULL;
}
//创建注入代码 32位目标进程
PINJECT_BUFFER GetWow64Code(IN PVOID LdrLoadDll, IN PUNICODE_STRING DllFullPath)
{
NTSTATUS Status = STATUS_SUCCESS;
PINJECT_BUFFER InjectBuffer = NULL;
SIZE_T Size = PAGE_SIZE;
// Code
UCHAR Code[] =
{
0x68, 0, 0, 0, 0, // push ModuleHandle offset +1
0x68, 0, 0, 0, 0, // push ModuleFileName offset +6
0x6A, 0, // push Flags
0x6A, 0, // push PathToFile
0xE8, 0, 0, 0, 0, // call LdrLoadDll offset +15
0xBA, 0, 0, 0, 0, // mov edx, COMPLETE_OFFSET offset +20
0xC7, 0x02, 0x7E, 0x1E, 0x37, 0xC0, // mov [edx], CALL_COMPLETE
0xBA, 0, 0, 0, 0, // mov edx, STATUS_OFFSET offset +31
0x89, 0x02, // mov [edx], eax
0xC2, 0x04, 0x00 // ret 4
};
Status = ZwAllocateVirtualMemory(ZwCurrentProcess(), &InjectBuffer, 0, &Size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (NT_SUCCESS(Status))
{
// Copy path
PUNICODE_STRING32 pUserPath = &InjectBuffer->Path32;
pUserPath->Length = DllFullPath->Length;
pUserPath->MaximumLength = DllFullPath->MaximumLength;
pUserPath->Buffer = (ULONG)(ULONG_PTR)InjectBuffer->Buffer;
// Copy path
memcpy((PVOID)pUserPath->Buffer, DllFullPath->Buffer, DllFullPath->Length);
// Copy code
memcpy(InjectBuffer, Code, sizeof(Code));
// Fill stubs
*(ULONG*)((PUCHAR)InjectBuffer + 1) = (ULONG)(ULONG_PTR)&InjectBuffer->ModuleHandle;
*(ULONG*)((PUCHAR)InjectBuffer + 6) = (ULONG)(ULONG_PTR)pUserPath;
*(ULONG*)((PUCHAR)InjectBuffer + 15) = (ULONG)((ULONG_PTR)LdrLoadDll - ((ULONG_PTR)InjectBuffer + 15) - 5 + 1);
*(ULONG*)((PUCHAR)InjectBuffer + 20) = (ULONG)(ULONG_PTR)&InjectBuffer->Complete;
*(ULONG*)((PUCHAR)InjectBuffer + 31) = (ULONG)(ULONG_PTR)&InjectBuffer->Status;
return InjectBuffer;
}
UNREFERENCED_PARAMETER(DllFullPath);
return NULL;
}
构建完shellcode之后，我们便从SSDT中获取NtCreateThreadEx函数来创建新的线程执行ShellCode。
NTSTATUS ExecuteInNewThread(
IN PVOID BaseAddress,
IN PVOID Parameter,
IN ULONG Flags,
IN BOOLEAN Wait,
OUT PNTSTATUS ExitStatus
)
{
HANDLE ThreadHandle = NULL;
OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
//指定一个对象句柄的属性 句柄只能在内核模式访问。
InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
//创建线程
NTSTATUS Status = SeCreateThreadEx(
&ThreadHandle, THREAD_QUERY_LIMITED_INFORMATION, &ObjectAttributes,
ZwCurrentProcess(), BaseAddress, Parameter, Flags,
0, 0x1000, 0x100000, NULL
);
// 等待线程完成
if (NT_SUCCESS(Status) && Wait != FALSE)
{
//60s
LARGE_INTEGER Timeout = { 0 };
Timeout.QuadPart = -(60ll * 10 * 1000 * 1000);
Status = ZwWaitForSingleObject(ThreadHandle, TRUE, &Timeout);
if (NT_SUCCESS(Status))
{
//查询线程退出码
THREAD_BASIC_INFORMATION ThreadBasicInfo = { 0 };
ULONG ReturnLength = 0;
Status = ZwQueryInformationThread(ThreadHandle, ThreadBasicInformation, &ThreadBasicInfo, sizeof(ThreadBasicInfo), &ReturnLength);
if (NT_SUCCESS(Status) && ExitStatus)
{
*ExitStatus = ThreadBasicInfo.ExitStatus;
}
else if (!NT_SUCCESS(Status))
{
DbgPrint("%s: ZwQueryInformationThread failed with status 0x%X\n", __FUNCTION__, Status);
}
}
else
DbgPrint("%s: ZwWaitForSingleObject failed with status 0x%X\n", __FUNCTION__, Status);
}
else
{
DbgPrint("%s: ZwCreateThreadEx failed with status 0x%X\n", __FUNCTION__, Status);
}
if (ThreadHandle)
{
ZwClose(ThreadHandle);
}
return Status;
}
NTSTATUS
NTAPI
SeCreateThreadEx(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN PVOID ObjectAttributes,
IN HANDLE ProcessHandle, //目标进程句柄
IN PVOID StartAddress, //线程起始地址
IN PVOID Parameter, //线程参数
IN ULONG Flags,
IN SIZE_T StackZeroBits,
IN SIZE_T SizeOfStackCommit,
IN SIZE_T SizeOfStackReserve,
IN PNT_PROC_THREAD_ATTRIBUTE_LIST AttributeList
)
{
NTSTATUS Status = STATUS_SUCCESS;
//从SSDT中获取NtCreateThreadEx函数地址
//Windows7 64位 NtCreateThdIndex = 0x0A5
/*Windows7 32位 NtCreateThdIndex = 0x058
0:001> u ntdll!NtCreateThreadEx
ntdll!ZwCreateThreadEx:
77a35768 b858000000 mov eax,58h
77a3576d ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
77a35772 ff12 call dword ptr [edx]
77a35774 c22c00 ret 2Ch
77a35777 90 nop
*/
LPFN_NTCREATETHREADEX NtCreateThreadEx = (LPFN_NTCREATETHREADEX)(ULONG_PTR)GetSSDTEntry(0xA5);
/*
kd> u 0xfffff800`041c730c l 20
nt!NtCreateThreadEx:
fffff800`041c730c fff3 push rbx
fffff800`041c730e 56 push rsi
fffff800`041c730f 57 push rdi
fffff800`041c7310 4154 push r12
fffff800`041c7312 4155 push r13
fffff800`041c7314 4156 push r14
fffff800`041c7316 4157 push r15
fffff800`041c7318 4881ec10070000 sub rsp,710h
fffff800`041c731f 488b05bab6e8ff mov rax,qword ptr [nt!_security_cookie (fffff800`040529e0)]
fffff800`041c7326 4833c4 xor rax,rsp
……
fffff800`041c735d e82e2ad1ff call nt!memset (fffff800`03ed9d90)
……
fffff800`041c737a e8112ad1ff call nt!memset (fffff800`03ed9d90)
……
fffff800`041c738e 0f859a1b0600 jne nt! ?? ::NNGAKEGL::`string'+0x3c040 (fffff800`04228f2e)
fffff800`041c739d 3898f6010000 cmp byte ptr [rax+1F6h],bl
*/
if (NtCreateThreadEx)
{
//如果之前的模式是用户模式，地址传递到ZwCreateThreadEx必须在用户模式空间
//切换到内核模式允许使用内核模式地址
//Windows7 PrevMode = 0x1F6
PUCHAR pPrevMode = (PUCHAR)PsGetCurrentThread() + 0x1F6;
//64位 pPrevMode = 01
UCHAR prevMode = *pPrevMode;
*pPrevMode = KernelMode;//内核模式
//创建线程
Status = NtCreateThreadEx(
ThreadHandle, DesiredAccess, ObjectAttributes,
ProcessHandle, StartAddress, Parameter,
Flags, StackZeroBits, SizeOfStackCommit,
SizeOfStackReserve, AttributeList
);
//恢复之前的线程模式
*pPrevMode = prevMode;
}
else
Status = STATUS_NOT_FOUND;
return Status;
}获取NtCreateThreadEx函数需要知道它在SSDT中的索引号，并且获取SSDT基地址，64位下SSDT并没有导出，需要从Kernel模块中手动获取，代码在此就不列出，可以从下面分享的源码中查看。
源码下载地址：https://download.csdn.net/download/qq_37957965/10800753