?? 創建svchost_exe調用的服務原理與實踐.htm
字號:
pop
ebx<BR>.text:0100157F
pop
ecx<BR>.text:01001580
retn 8<BR>.text:01001580 FuncServiceMain endp ; sp
= -8<BR>; ============================== FuncServiceMain() end
========================================<BR><BR><BR>由于svchost已經調用了StartServiceCtrlDispatcher來服務調度函數，因此我們在實現DLL實現時就不用了，這主要是因為一個進程只能調用一次StartServiceCtrlDispatcher
API。但是需要用 RegisterServiceCtrlHandler
來注冊響應控制請求的函數。最后我們的DLL接收的都是unicode字符串。<BR><BR>由于這種服務啟動后由svchost加載，不增加新的進程，只是svchost的一個DLL，而且一般進行審計時都不會去HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Svchost
檢查服務組是否變化，就算去檢查，也不一定能發現異常，因此如果添加一個這樣的DLL后門，偽裝的好，是比較隱蔽的。<BR><BR><BR>4.
安裝服務與設置<BR>要通過svchost調用來啟動的服務，就一定要在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Svchost下有該服務名，這可以通過如下方式來實現：<BR>1）
添加一個新的服務組，在組里添加服務名<BR>2） 在現有組里添加服務名<BR>3）
直接使用現有服務組里的一個服務名，但本機沒有安裝的服務<BR>4）
修改現有服務組里的現有服務，把它的ServiceDll指向自己<BR><BR>其中前兩種可以被正常服務使用，如使用第1種方式，啟動其服務要創建新的svchost進程；第2種方式如果該組服務已經運行，安裝后不能立刻啟動服務，因為svchost啟動后已經把該組信息保存在內存里，并調用API
StartServiceCtrlDispatcher()
為該組所有服務注冊了調度處理函數，新增加的服務不能再注冊調度處理函數，需要重起計算機或者該組的svchost進程。而后兩種可能被后門使用，尤其是最后一種，沒有添加服務，只是改了注冊表里一項設置，從服務管理控制臺又看不出來，如果作為后門還是很隱蔽的。比如EventSystem服務，缺省是指向es.dll，如果把ServiceDll改為EventSystem.dll就很難發現。<BR><BR>因此服務的安裝除了調用CreateService()創建服務之外，還需要設置服務的ServiceDll，如果使用前2種還要設置svchost的注冊表選項，在卸載時也最好刪除增加的部分。<BR><BR>具體代碼參見后邊的附例（使用的是方法3）。<BR><BR>注：
ImagePath 和ServiceDll
是ExpandString不是普通字符串。因此如果使用.reg文件安裝時要注意。<BR><BR><BR>5.
DLL服務實現<BR>DLL程序的編寫比較簡單，只要實現一個ServiceMain()函數和一個服務控制程序，在ServiceMain()函數里用RegisterServiceCtrlHandler()注冊服務控制程序，并設置服務的運行狀態就可以了。<BR><BR>另外，因為此種服務的安裝除了正常的CreateService()之外，還要進行其他設置，因此最好實現安裝和卸載函數。
<BR><BR>為了方便安裝，實現的代碼提供了InstallService()函數進行安裝，這個函數可以接收服務名作為參數（如果不提供參數，就使用缺省的iprip），如果要安裝的服務不在svchost的netsvcs組里安裝就會失敗；如果要安裝的服務已經存在，安裝也會失敗；安裝成功后程序會配置服務的ServiceDll為當前Dll。提供的UninstallService()函數，可以刪除任何函數而沒有進行任何檢查。<BR><BR>為了方便使用rundll32.exe進行安裝，還提供了RundllInstallA()和RundllUninstallA()分別調用InstallService()及UninstallService()。因為rundll32.exe使用的函數原型是：<BR>void
CALLBACK FunctionName(<BR> HWND
hwnd, // handle to owner
window<BR> HINSTANCE hinst, // instance handle for
the DLL<BR> LPTSTR lpCmdLine, // string the DLL will
parse<BR> int nCmdShow //
show state<BR>);<BR>對應的命令行是rundll32 DllName,FunctionName [Arguments]
<BR><BR>DLL服務本身只是創建一個進程，該程序命令行就是啟動服務時提供的第一個參數，如果未指定就使用缺省的svchostdll.exe。啟動服務時如果提供第二個參數，創建的進程就是和桌面交互的。<BR><BR>具體代碼參見后邊的附例8，源代碼和DLL文件請到<A
href="http://www.binglesite.net/"
target=_blank>http://www.binglesite.net/</A>下載。<BR><BR>//main service
process function<BR>void __stdcall ServiceMain( int argc, wchar_t* argv[]
);<BR>//report service stat to the service control manager<BR>int TellSCM(
DWORD dwState, DWORD dwExitCode, DWORD dwProgress );<BR>//service control
handler, call back by service control manager<BR>void __stdcall
ServiceHandler( DWORD dwCommand );<BR>//RealService just create a process
<BR>int RealService(char *cmd, int bInteract);<BR><BR>//Install this dll
as a Service host by svchost.exe, service name is given by caller<BR>int
InstallService(char *name);<BR>//unInstall a Service, be CARE FOR call
this to delete a service<BR>int UninstallService(char *name);<BR>//Install
this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to
call<BR>void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char
*param, int nCmdShow);<BR>//unInstall a Service used by RUNDLL32.EXE to
call, be CARE FOR call this to delete a service<BR>void CALLBACK
RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int
nCmdShow);<BR><BR>//output the debug infor into log file(or stderr if a
console program call me) & DbgPrint<BR>void OutputString( char *lpFmt,
... );<BR><BR><BR>6. 代碼使用<BR>C:\>tlist -s<BR> 0 System
Process<BR> 8 System<BR>240
services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation,
LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi<BR>504
svchost.exe Svcs: RpcSs<BR>1360
svchost.exe
Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv<BR><BR>C:\>rundll32
svchostdll.dll,RundllInstall abcd<BR>SvcHostDLL: DllMain called
DLL_PROCESS_ATTACH<BR>you specify service name not in Svchost\netsvcs,
must be one of following:<BR>- EventSystem<BR>- Ias<BR>- Iprip<BR>-
Irmon<BR>- Netman<BR>- Nwsapagent<BR>- Rasauto<BR>- Rasman<BR>-
Remoteaccess<BR>- SENS<BR>- Sharedaccess<BR>- Tapisrv<BR>- Ntmssvc<BR>-
wzcsvc<BR><BR>C:\>rundll32 svchostdll.dll,RundllInstall
IPRIP<BR>SvcHostDLL: DllMain called
DLL_PROCESS_ATTACH<BR>CreateService(IPRIP) SUCCESS. Config it<BR>Config
service IPRIP ok.<BR><BR>C:\>sc start iprip "cmd /k whoami" 1<BR>NT
AUTHORITY\SYSTEM<BR><BR>SvcHostDLL: ServiceMain(3, IPRIP)
called<BR>SvcHostDLL: RealService called 'cmd /k whoami'
Interact<BR>SvcHostDLL: CreateProcess(cmd /k whoami) to
640<BR><BR>C:\>tlist -s<BR> 0 System
Process<BR> 8 System<BR>240
services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation,
LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi<BR>504
svchost.exe Svcs: RpcSs<BR>640
cmd.exe Title:
C:\WINNT\System32\cmd.exe<BR>1360 svchost.exe
Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv,IPRIP<BR><BR>C:\>net
stop iprip<BR>The IPRIP service was stopped
successfully.<BR><BR>C:\>rundll32 svchostdll.dll,RundllUninstall
iprip<BR>DeleteService(IPRIP) SUCCESS.<BR><BR><BR>7. 參考<BR><BR>Platform
SDK: Tools - Rundll32<BR>1） Inside Win32 Services, Part 2 by: Mark
Russinovich, at: <A
href="http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3"
target=_blank>http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3</A><BR>2）
Platform SDK: Tools - Rundll32, at: <A
href="http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp"
target=_blank>http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp</A><BR><BR> 2003/8<BR><BR><BR>8.
代碼<BR>// SvcHostDLL.cpp : Demo for a service dll used by svchost.exe to
host it.<BR>//<BR>// for detail comment see articles.<BR>// by
bingle_at_email.com.cn<BR>// <A
href="http://www.binglesite.net/"
target=_blank>http://www.binglesite.net/</A><BR>//<BR>/* save following as
a .def file to export function, only ServiceMain is needed.<BR>other used
to install & uninstall service.<BR>or use /EXPORT: link option to
export
them.<BR><BR>EXPORTS<BR> ServiceMain<BR> InstallService<BR> UninstallService<BR> RundllUninstallA<BR> RundllInstallA<BR>*/<BR>/*<BR>To
compile & link: <BR>cl /MD /GX /LD svchostdll.cpp /link advapi32.lib
/DLL /base:0x71000000 /export:ServiceMain /EXPORT:RundllUninstallA
/EXPORT:RundllInstallA /EXPORT:InstallService
/EXPORT:UninstallService<BR>*/<BR><BR>//<BR>// Articles:<BR>//
1. HOWTO Create a service dll used by svchost.exe by bingle, at: <A
href="http://www.binglesite.net/article/svchost-dll-service.html"
target=_blank>http://www.BingleSite.net/article/svchost-dll-service.html</A><BR>//
2. Inside Win32 Services, Part 2 by: Mark Russinovich, at: <A
href="http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3"
target=_blank>http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3</A><BR>//
3. Platform SDK: Tools - Rundll32, at: <A
href="http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp"
target=_blank>http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp</A><BR><BR>#include
<stdio.h><BR>#include <time.h><BR>#include
<assert.h><BR>#include <windows.h><BR><BR>#define
DEFAULT_SERVICE "IPRIP"<BR>#define MY_EXECUTE_NAME
"SvcHostDLL.exe"<BR><BR>//main service process function<BR>void __stdcall
ServiceMain( int argc, wchar_t* argv[] );<BR>//report service stat to the
service control manager<BR>int TellSCM( DWORD dwState, DWORD dwExitCode,
DWORD dwProgress );<BR>//service control handler, call back by service
control manager<BR>void __stdcall ServiceHandler( DWORD dwCommand
);<BR>//RealService just create a process <BR>int RealService(char *cmd,
int bInteract);<BR><BR>//Install this dll as a Service host by
svchost.exe, service name is given by caller<BR>int InstallService(char
*name);<BR>//unInstall a Service, be CARE FOR call this to delete a
service<BR>int UninstallService(char *name);<BR>//Install this dll as a
Service host by svchost.exe, used by RUNDLL32.EXE to call<BR>void CALLBACK
RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int
nCmdShow);<BR>//unInstall a Service used by RUNDLL32.EXE to call, be CARE
FOR call this to delete a service<BR>void CALLBACK RundllUninstallA(HWND
hwnd, HINSTANCE hinst, char *param, int nCmdShow);<BR><BR>//output the
debug infor into log file(or stderr if a console program call me) &
DbgPrint<BR>void OutputString( char *lpFmt, ... );<BR><BR><BR>//dll module
handle used to get dll path in InstallService<BR>HANDLE hDll =
NULL;<BR>//Service HANDLE & STATUS used to get service
state<BR>SERVICE_STATUS_HANDLE hSrv;<BR>DWORD dwCurrState;<BR><BR><BR>BOOL
APIENTRY DllMain( HANDLE hModule,
<BR>
DWORD ul_reason_for_call,
<BR>
LPVOID
lpReserved<BR>
)<BR>{<BR> switch
(ul_reason_for_call)<BR> {<BR> case
DLL_PROCESS_ATTACH:<BR> hDll
= hModule;<BR>#ifdef
_DEBUG<BR> AllocConsole();<BR> OutputString("SvcHostDLL:
DllMain called
DLL_PROCESS_ATTACH");<BR> break;<BR><BR> case
DLL_THREAD_ATTACH:<BR> OutputString("SvcHostDLL:
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -