3.端口隐藏 很多人检查自己中没中木马或后门,都会一些方法来查看自己本机所开的端口来判断是否有木马监听,而有些rootkit就开始想如何隐藏端口了。 最简单的枚举当前所开放的端口信息是调用iphlpapi.dll中的AllocateAndGetTcpTableFromStack和AllocateAndGetUdpTableFromStack函数,或者AllocateAndGetTcpExTableFromStack和AllocateAndGetUdpExTableFromStack函数。 DWORD WINAPI AllocateAndGetTcpTableFromStack( OUT PMIB_TCPTABLE *pTcpTable, IN BOOL bOrder, IN HANDLE hAllocHeap, IN DWORD dwAllocFlags, IN DWORD dwProtocolVersion; );
DWORD WINAPI AllocateAndGetUdpTableFromStack( OUT PMIB_UDPTABLE *pUdpTable, IN BOOL bOrder, IN HANDLE hAllocHeap, IN DWORD dwAllocFlags, IN DWORD dwProtocolVersion; );
DWORD WINAPI AllocateAndGetTcpExTableFromStack( OUT PMIB_TCPTABLE_EX *pTcpTableEx, IN BOOL bOrder, IN HANDLE hAllocHeap, IN DWORD dwAllocFlags, IN DWORD dwProtocolVersion; );
DWORD WINAPI AllocateAndGetUdpExTableFromStack( OUT PMIB_UDPTABLE_EX *pUdpTableEx, IN BOOL bOrder, IN HANDLE hAllocHeap, IN DWORD dwAllocFlags, IN DWORD dwProtocolVersion; ); 还有另外一种方法。当程序创建了一个套接字并开始监听时,它就会有一个为它和打开端口的打开句柄。我们在系统中枚举所有的打开句柄并通过NtDeviceIoControlFile把它们发送到一个特定的缓冲区中,来找出这个句柄是否是一个打开端口的。这样也能给我们有关端口的信息。因为打开句柄太多了,所以我们只检测类型是File并且名字是\Device\Tcp或\Device\Udp的。打开端口只有这种类型和名字。 而通过察看iphlpapi.dll的代码。就会发现这些函数同样都是调用NtDeviceIoControlFile并发送到一个特定缓冲区来获得系统中所有打开端口的列表。也就是说,我们挂接NtDeviceIoControlFile函数就可以隐藏端口。 我们来看看NtDeviceIoControlFile的原型 NTSTATUS NtDeviceIoControlFile( IN HANDLE FileHandle IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength );
我们来看看《The Undocumented Functions-Microsoft Windows NT_2000》中对这些参数的描述 FileHandle HANDLE to Device Object opened as a file. Event Optional HANDLE to Event Object signalled on the end of processing request. ApcRoutine Optional pointer to user's APC Routine called on the end of processing request. ApcContext User's parameter to ApcRoutine. IoStatusBlock IO result of call. IoControlCode IO Control code [IOCTL_*]. InputBuffer User's allocated buffer with input data. InputBufferLength Length of InputBuffer, in bytes. OutputBuffer User's allocated buffer for result data. OutputBufferLength Length of OutputBuffer, in bytes. 主要的就是FileHandle,IoStatusBlock,IoControlCode,IoControlCode,InputBufferLength,OutputBuffer, OutputBufferLength。 摘自《在NT系列操作系统里让自己“消失”》。 还有关于端口隐藏的技术就不提了 因为在我说的文章中已经说的很清楚了,所以在写就是浪费篇幅了。 jiurl也曾经提到过了一种隐藏端口的方法,并且给出了代码。在参考资料中有文章URL。 4 文件隐藏。 在WINNT里在某些目录中寻找某个文件的方法是枚举它里面所有的文件和它的子目录下的所有文件。文件的枚举是使用NtQueryDirectoryFile函数。 NTSTATUS NtQueryDirectoryFile( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG FileInformationLength, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileName OPTIONAL, IN BOOLEAN RestartScan );
在《The Undocumented Functions-Microsoft Windows NT_2000》中对这些参数的描述 FileHandle HANDLE to File Object opened with FILE_DIRECTORY_FILE option and FILE_LIST_DIRECTORY access. Event Optional HANDLE to Event Object signaled after query complete. ApcRoutine Optinal pointer to user's APC routine queued after query complete. ApcContext Parameter for ApcRoutine. IoStatusBlock IO result of call. FileInformation User's allocated buffer for output data. Length Length of FileInformation buffer, in bytes. FileInformationClass Information class. Can be one of: FileDirectoryInformation FileFullDirectoryInformation FileBothDirectoryInformation FileNamesInformation FileOleDirectoryInformation ReturnSingleEntry If set, only one entry is returned. FileMask If specified, only information about files matches this wildchar mask will be returned. RestartScan Used with ReturnSingleEntry parameter. If set, NtQueryDirectoryFile continue enumeration after last enumerated element in previous call. If no, returns the first entry in directory.