?? 管理員組獲取系統(tǒng)權(quán)限的完美解決方案.html
字號(hào):
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head><title>管理員組獲取系統(tǒng)權(quán)限的完美解決方案 </title><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><meta name="Keywords" content="安全焦點(diǎn), xfocus, 陷阱網(wǎng)絡(luò), honeynet, honeypot, 調(diào)查取證, forensic, 入侵檢測(cè), intrusion detection, 無(wú)線安全, wireless security, 安全論壇, security forums, 安全工具, security tools, 攻擊程序, exploits, 安全公告, security advisories, 安全漏洞, security vulnerabilities, 安全教程, security tutorials, 安全培訓(xùn), security training, 安全幫助, security help, 安全標(biāo)準(zhǔn), security standards, 安全代碼, security code, 安全資源, security resources, 安全編程, security programming, 加密, cryptography," /><link rel="stylesheet" href="../../css/plone.css" type="text/css"></head><body bgcolor="#FFFFFF" text="#000000"><div class="top"> <div class="searchBox"> <form name="searchform" action="http://www.google.com/search" method="get"> <input type="hidden" name="domains" value="www.xfocus.net"> <input type="hidden" name="sitesearch" value="www.xfocus.net"> <input type="text" name="q" size="20"> <input type="submit" name="btnG" value="Google Search"> </form> </div> <img src="../../images/logo.gif" border="0" width="180" height="80" alt="xfocus logo"> <img src="../../images/title.gif" border="0" width="230" height="20" alt="xfocus title"></div><div class="tabs"> <a href="../../index.html" class="plain">首頁(yè)</a> <a href="../../releases/index.html" class="plain">焦點(diǎn)原創(chuàng)</a> <a href="../../articles/index.html" class="selected">安全文摘</a> <a href="../../tools/index.html" class="plain">安全工具</a> <a href="../../vuls/index.html" class="plain">安全漏洞</a> <a href="../../projects/index.html" class="plain">焦點(diǎn)項(xiàng)目</a> <a href="https://www.xfocus.net/bbs/index.php?lang=cn" class="plain">焦點(diǎn)論壇</a> <a href="../../about/index.html" class="plain">關(guān)于我們</a></div><div class="personalBar"> <a href='https://www.xfocus.net/php/add_article.php'>添加文章</a> <a href='http://www.xfocus.org/'>English Version</a></div><table class="columns">
<tr>
<td class="left">
<div class="box">
<h5> 文章分類 </h5>
<div class="body">
<div class="content odd">
<div style="white-space: nowrap;">
<img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/4.html'><b>專題文章 <<</b></a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/2.html'>漏洞分析</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/3.html'>安全配置</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/1.html'>黑客教學(xué)</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/5.html'>編程技術(shù)</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/7.html'>工具介紹</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/6.html'>火墻技術(shù)</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/8.html'>入侵檢測(cè)</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/9.html'>破解專題</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/11.html'>焦點(diǎn)公告</a><br><img src='../../images/folder_icon.gif' border='0'> <a href='../../articles/12.html'>焦點(diǎn)峰會(huì)</a><br>
</div>
</div>
</div>
</div>
<div class="box">
<h5> 文章推薦 </h5>
<div class="body">
<div class="content odd">
<img src='../../images/document_icon.gif' border='0'> <a href='../../articles/200408/733.html'>補(bǔ)丁管理最佳安全實(shí)踐之資產(chǎn)評(píng)估</a><br><img src='../../images/document_icon.gif' border='0'> <a href='../../articles/200404/689.html'>國(guó)內(nèi)網(wǎng)絡(luò)安全風(fēng)險(xiǎn)評(píng)估市場(chǎng)與技術(shù)操作</a><br><img src='../../images/document_icon.gif' border='0'> <a href='../../articles/200410/743.html'>協(xié)作的信息系統(tǒng)風(fēng)險(xiǎn)評(píng)估</a><br>
</div>
</div>
</div>
</td>
<td class="main">
<h1>管理員組獲取系統(tǒng)權(quán)限的完美解決方案</h1><br>創(chuàng)建時(shí)間：2005-04-28<br>文章屬性：原創(chuàng)<br>文章提交：<a href='https://www.xfocus.net/bbs/index.php?lang=cn&act=Profile&do=03&MID=35303'>suei8423</a> (suei8423_at_163.com)<br><br>管理員組獲取系統(tǒng)權(quán)限的完美解決方案<br />
<br />
Author : ZwelL<br />
Blog : <a href='http://www.donews.net/zwell' target='_blank'>http://www.donews.net/zwell</a><br />
Date : 2005.4.28<br />
<br />
關(guān)于管理員組(administrators)獲取系統(tǒng)(SYSTEM)權(quán)限的方法其實(shí)已經(jīng)有很多種了.<br />
小四哥就提到了一些:"MSDN系列(3)--Administrator用戶直接獲取SYSTEM權(quán)限"和"遠(yuǎn)程線程注入版獲取SYSTEM權(quán)限".<br />
這里,我先踩在前輩的肩上列一些可行的方法:<br />
<br />
1. "利用ZwCreateToken()自己創(chuàng)建一個(gè)SYSTEM令牌(Token)" <br />
2. HOOK掉創(chuàng)建進(jìn)程的函數(shù)ZwCreateProcess(Ex),用winlogon ID 創(chuàng)建<br />
3. 遠(yuǎn)線程插入，插入線程到系統(tǒng)進(jìn)程，創(chuàng)建一新進(jìn)程<br />
<br />
這上面三種方法都是scz提到的,也存在一些問(wèn)題.其實(shí)除此這外,我們還可以:<br />
4. 將程序做成服務(wù)，帶參數(shù)運(yùn)行新進(jìn)程<br />
<br />
做為服務(wù)來(lái)講就是SYSTEM了,再創(chuàng)建的進(jìn)程也是SYSTEM權(quán)限.<br />
<br />
當(dāng)然,這里我都不會(huì)用到上面提到的方法.因?yàn)榫W(wǎng)上都能找到現(xiàn)成的實(shí)現(xiàn)代碼.而且考慮一些復(fù)雜性以及存在的一些問(wèn)題都不是很好的解決方案.<br />
<br />
這里,我拿出兩種新的方案來(lái)實(shí)現(xiàn)該功能:<br />
<br />
第一種方法.我們先來(lái)看一下系統(tǒng)是如何進(jìn)行權(quán)限檢測(cè)的，<br />
舉個(gè)例子,在調(diào)用了OpenProcessToken,我們知道會(huì)進(jìn)行權(quán)限的驗(yàn)證：<br />
OpenProcessToken->NtOpenProcessToken－>PsOpenTokenOfProcess->PsReferencePrimaryToken->找到這一句Token = Process->Token;<br />
|->ObOpenObjectByPointer調(diào)用上面返回的TOKEN進(jìn)行檢查<br />
<br />
也就是說(shuō)，系統(tǒng)在檢測(cè)權(quán)限時(shí)僅僅通過(guò)從進(jìn)程的EPROCESS結(jié)構(gòu)種拿出Token項(xiàng)進(jìn)行操作.因此我們不需要繼續(xù)往ObOpenObjectByPointer里面跟進(jìn)了。<br />
思路已經(jīng)很明顯：直接將System進(jìn)程的Token拿過(guò)來(lái)，放到我們進(jìn)程的Token位置。那么系統(tǒng)就認(rèn)為我們是SYSTEM權(quán)限.<br />
而這時(shí)我們的進(jìn)程創(chuàng)建的子進(jìn)程也就是SYSTEM權(quán)限了。(以上分析過(guò)程請(qǐng)參考WINDOWS源代碼...^_^)<br />
<br />
實(shí)現(xiàn)代碼:<br />
===========================================================================================================<br />
#include<windows.h><br />
#include<stdio.h><br />
#include<Accctrl.h><br />
#include<Aclapi.h><br />
<br />
#define TOKEN_OFFSET 0xc8 //In windows 2003, it's 0xc8, if others' version, change it<br />
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)<br />
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)<br />
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)<br />
<br />
typedef LONG NTSTATUS;<br />
typedef struct _IO_STATUS_BLOCK<br />
{<br />
NTSTATUS Status;<br />
ULONG Information;<br />
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;<br />
<br />
typedef struct _UNICODE_STRING<br />
{<br />
USHORT Length;<br />
USHORT MaximumLength;<br />
PWSTR Buffer;<br />
} UNICODE_STRING, *PUNICODE_STRING;<br />
<br />
#define OBJ_INHERIT 0x00000002L<br />
#define OBJ_PERMANENT 0x00000010L<br />
#define OBJ_EXCLUSIVE 0x00000020L<br />
#define OBJ_CASE_INSENSITIVE 0x00000040L<br />
#define OBJ_OPENIF 0x00000080L<br />
#define OBJ_OPENLINK 0x00000100L<br />
#define OBJ_KERNEL_HANDLE 0x00000200L<br />
#define OBJ_VALID_ATTRIBUTES 0x000003F2L<br />
<br />
typedef struct _OBJECT_ATTRIBUTES<br />
{<br />
ULONG Length;<br />
HANDLE RootDirectory;<br />
PUNICODE_STRING ObjectName;<br />
ULONG Attributes;<br />
PVOID SecurityDescriptor;<br />
PVOID SecurityQualityOfService;<br />
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; <br />
<br />
typedef struct _SYSTEM_MODULE_INFORMATION<br />
{<br />
ULONG Reserved[2];<br />
PVOID Base;<br />
ULONG Size;<br />
ULONG Flags;<br />
USHORT Index;<br />
USHORT Unknown;<br />
USHORT LoadCount;<br />
USHORT ModuleNameOffset;<br />
CHAR ImageName[256];<br />
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;<br />
<br />
typedef enum _SYSTEM_INFORMATION_CLASS<br />
{<br />
SystemBasicInformation,<br />
SystemProcessorInformation,<br />
SystemPerformanceInformation,<br />
SystemTimeOfDayInformation,<br />
SystemNotImplemented1,<br />
SystemProcessesAndThreadsInformation,<br />
SystemCallCounts,<br />
SystemConfigurationInformation,<br />
SystemProcessorTimes,<br />
SystemGlobalFlag,<br />
SystemNotImplemented2,<br />
SystemModuleInformation,<br />
SystemLockInformation,<br />
SystemNotImplemented3,<br />
SystemNotImplemented4,<br />
SystemNotImplemented5,<br />
SystemHandleInformation,<br />
SystemObjectInformation,<br />
SystemPagefileInformation,<br />
SystemInstructionEmulationCounts,<br />
SystemInvalidInfoClass1,<br />
SystemCacheInformation,<br />
SystemPoolTagInformation,<br />
SystemProcessorStatistics,<br />
SystemDpcInformation,<br />
SystemNotImplemented6,<br />
SystemLoadImage,<br />
SystemUnloadImage,<br />
SystemTimeAdjustment,<br />
SystemNotImplemented7,<br />
SystemNotImplemented8,<br />
SystemNotImplemented9,<br />
SystemCrashDumpInformation,<br />
SystemExceptionInformation,<br />
SystemCrashDumpStateInformation,<br />
SystemKernelDebuggerInformation,<br />
SystemContextSwitchInformation,<br />
SystemRegistryQuotaInformation,<br />
SystemLoadAndCallImage,<br />
SystemPrioritySeparation,<br />
SystemNotImplemented10,<br />
?? 快捷鍵說(shuō)明
復(fù)制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號(hào)
Ctrl + =
減小字號(hào)
Ctrl + -