[es] - Hide process u NT-jima

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

^{10.05.2002. u 07:38 - pre 267 meseci}

Hm, ovo pišem jer sam prije nekoliko dana uspješno napravio jedan "Revenge" program u VB.

Zašto hide process : Tako da proces nije vidan u TaskManager-u oz. kad stisnete Ctrl-Alt-Del.

Ovo pišem jer je došlo do nekompatibilnosti sa NT sustavom NT/2000/XP, jer naime program na NT mašinama ne nađe reference za RegisterServiceProcess u kernel32.dll, jer RegisterServiceProcess u NT-jima u kernel32.dll nema.

Gledao sam malo po searcherima, MSDN a nisam ništa našao. kako bi rješio ovo "nekompatibilnost" OS-a.
Kako bi na drug način to riješio u NT-jima.

Evo još malog koda, kog treba da malo modificiram za NT-je :

Code:

Public Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Public Declare Function GetCurrentProcess Lib "kernel32" () As Long
Public Declare Function RegisterServiceProcess Lib "kernel32" (ByVal dwProcessId As Long, ByVal dwType As Long) As Long
Public Const Make_System_Process = 1
Public Const Make_Normal_Process = 0

Public Sub HideProcess(HideProcess As Boolean)
'HideProcess(true)
'HideProcess(false)

Dim Process_Code As Long, Return_Service As Long

If HideProcess Then
Process_Code = GetCurrentProcessId()
Return_Service = RegisterServiceProcess(Process_Code, Make_System_Process)

ElseIf Not HideProcess Then
Process_Code = GetCurrentProcessId()
Return_Service = RegisterServiceProcess(Process_Code, Make_Normal_Process)
End If
End Sub

Help wanted, poz

Pozdrav StratOS
"Multitasking - ability to f##k up several things at once."
"It works better if you plug it in."
"As a rule, software systems do not work well until they have been used, and have failed repeatedly, in real applications."
"The one who is digging the hole for the other to fall in is allready in it."

Odgovor na temu

rivan
Ivan Radovanović

Član broj: 1901
Poruke: 71
*.matf.bg.ac.yu

ICQ: 212235650

Profil

Re: Hide process u NT-jima

^{12.05.2002. u 14:32 - pre 267 meseci}

Citat:

StratOS:
Hm, ovo pišem jer sam prije nekoliko dana uspješno napravio jedan "Revenge" program u VB.

Zašto hide process : Tako da proces nije vidan u TaskManager-u oz. kad stisnete Ctrl-Alt-Del.

Jel ovo da nije vidljiv znaci da nije vidljiv na Applications (ili kako se vec zove polje u tab-u) ili da nije uopste vidljiv ni na Processes polju?

Odgovor na temu

SEH

Član broj: 2215
Poruke: 94
*.net.hinet.hr

Profil

Re: Hide process u NT-jima

^{14.05.2002. u 21:43 - pre 267 meseci}

Registriranje service procesa na NT je malo zajebaniej nego na win9x. Tamo imas samo jedan API (RegisterServiceProcess), a na NT imas citavu proceduru: StartServiceCtrlDispatcher(), RegisterServiceCtrlHandler(), SetServiceStatus(), CloseServiceHandle() pa na OpenSCManager(), OpenService(), CreateService() i CloseServiceHandle(). Vidi MSDN za detalje. Sakrivanje procesa iz liste procesa se dakle moze lako ostvariti strvaranjem service procesa. Medjutim, proces ce se i dalje moci vidjeti preko toolhel32 funkcija za enumeriranje procesa (Pview95.exe koji dolazi sa Visual c++ to koristi npr.). Sakrivanje iz te liste bi zahtijevalo hookiranje nekih API-ja, a za to ti treba asm.

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: Hide process u NT-jima

^{15.05.2002. u 11:57 - pre 267 meseci}

hvala !

hm malo je i VB dobar, uspelo mi i to !

Odgovor na temu

SEH

Član broj: 2215
Poruke: 94
*.net.hinet.hr

Profil

Re: Hide process u NT-jima

^{15.05.2002. u 14:26 - pre 267 meseci}

Citat:

StratOS:
hm malo je i VB dobar, uspelo mi i to !

A jeli. U VB? Provjeri da li ti ga ovi alati detektiraju:
http://www.sysinternals.com/files/procexp9x.zip <- ovo za win9x
http://www.sysinternals.com/files/procexpnt.zip <- za winNT/win2k

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: Hide process u NT-jima

^{15.05.2002. u 15:14 - pre 267 meseci}

Da, znam da je CAD opcija u M$ OS-ima dio OS i naravno ovaj program "vidi" sve apliakcije/threade koji su trenutno aktivni i oni "nevidni" sistemski, no uspijelo mi je da se program ne vidi kao aplikacija/proces kod CAD, a sada trebam još kodu za NT, kako onemogučiti CAD shortcut sa tipkama, u 9x je to easy u NT-jima ... mislim malo teže ...

Citat:

SEH
Da znaš riješio sam još 2 veoma dobra programska puzzlea !!

Naučio sam nešto o ASM i disasemblanju ... moram reči, da je to nešto veoma dobro i poučno, počeo sam se baviti i sa VB malo bolje.

No onaj 2 exe problema kojeg sam ti poslao pa mailu još me stalno prati, pa te molim, dali ti je težko da mi napišeš što zapravo radi onaj (kako) source code, jer vidio sam, da ima unutra još jedan string "H4ck3d4ndCr4ck3d", što točno ne znam šta se sa njim događa jer ne znam C, dali bi bio tako dobar pa barem napišeš kako dođe do enkripcije, jer ja sam se uputio u samu enkripciju i u headere PCX grafičkog file-a.

pa i onaj puzz4.exe je jako (barem to ja mislim) strašan, uspijelo mi je da skužim "šta" radi, ali ne znam kako bi došao do prave sequencije odgovora zbog "the merory could not be read", probao sam se malo igrati i u w9x, no došao sam do zaključka, barem mislim, da je to moguče i zbog različitih OS-a.

Sa RCx8 processorom imam jadnih problema kod I/O portova !!!

evo i linkova :
1
2
3

im �u prstima' da bi se napi

Odgovor na temu

SEH

Član broj: 2215
Poruke: 94
*.net.vip.hr

Profil

Re: Hide process u NT-jima

^{15.05.2002. u 19:33 - pre 267 meseci}

Oki doki. Jos 2 dana i gotova mi skola, pa se strpi jos samo *malo* (ja cekam ovaj trenutak 4 godine :)

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: Hide process u NT-jima

^{15.05.2002. u 20:38 - pre 267 meseci}

OKI ...

I won't push no1

Odgovor na temu

Riste Pejov
Team Leader/Senior Software Developer @
Ein-Sof ltd Skopje
Skopje, Macedonia

Član broj: 128
Poruke: 571
212.110.78.*

Jabber: richie@bagra.net.mk
ICQ: 154236769
Sajt: riste.softver.org.mk

Profil

Re: Hide process u NT-jima

^{16.05.2002. u 14:45 - pre 267 meseci}

Kao prvo, 9x ne podrzava sistemske service, to je samo improvizacija.
a i kad pod NT registiras servis ipak taj isti postoji u Listi procesa
samo sto ne mozes da ga kill-ujes.

Na NT ne mozes sakriti proces !!!

e sad da se malo sam demantujem, ipak je moguce, ali to je samo workaround, a nije pravo sakrivanje procesam, vec ubacivanje stranog koda u vec postojeceg procesa. Za detalje pogledaj source BO2K, a ukratko to se radi uz CreateRemoteThread(), vidi ovaj link sa source kodom za VC6 http://www.mvps.org/win32/processes/remthread.html

People who think they know everything tend to irritate those of us who do.

Odgovor na temu

SEH

Član broj: 2215
Poruke: 94
*.net.vip.hr

Profil

Re: Hide process u NT-jima

^{16.05.2002. u 20:16 - pre 267 meseci}

Citat:

Riste Pejov:
Kao prvo, 9x ne podrzava sistemske service, to je samo improvizacija.
a i kad pod NT registiras servis ipak taj isti postoji u Listi procesa
samo sto ne mozes da ga kill-ujes.

Improvizacija ili ne, RegisterServiceProcess() funkcionira.

Citat:

Na NT ne mozes sakriti proces !!!

http://z0mbie.host.sk/stealth.zip

Citat:

e sad da se malo sam demantujem, ipak je moguce, ali to je samo workaround, a nije pravo sakrivanje procesam, vec ubacivanje stranog koda u vec postojeceg procesa. Za detalje pogledaj source BO2K, a ukratko to se radi uz CreateRemoteThread(), vidi ovaj link sa source kodom za VC6 http://www.mvps.org/win32/processes/remthread.html

Injektiranje u adresni prostor drugog programa je stara fora. Samo da kazem da ga koristi i WMFA ICQ trojan (iako ne na gore opisani nacin).

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: Hide process u NT-jima

^{17.05.2002. u 06:24 - pre 267 meseci}

These worms all have one thing in common: They use Microsoft Outlook to send email to all contacts in the Microsoft Outlook address book. Some variants also try to delete files or send themselves to IRC users.

Ali pogledao sam malo, zanimljivo ...

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: Hide process u NT-jima

^{17.05.2002. u 06:29 - pre 267 meseci}

Code:

                    NTDLL.DLL::NtQuerySystemInformation

winNT
B8{7C 00 00 00} mov eax, 7Ch
8D 54 24 04     lea edx, [esp+4]
CD 2E           int 2Eh
C2 10 00        retn 10h

win2K
B8{97 00 00 00} mov eax, 97h
8D 54 24 04     lea edx, [esp+4]
CD 2E           int 2Eh
C2 10 00        retn 10h

winXP
B8{AD 00 00 00} mov eax, ADh
BA 00 03 FE 7F  mov edx, 7FFE0300h
FF D2           call edx
C2 10 00        retn 10h

                         NTDLL.DLL::NtResumeThread

winNT
B8{95 00 00 00} mov eax, 95h
8D 54 24 04     lea edx, [esp+4]
CD 2E           int 2Eh
C2 08 00        retn 8

win2k
B8{B5 00 00 00} mov eax, 0B5h
8D 54 24 04     lea edx, [esp+4]
CD 2E           int 2Eh
C2 08 00        retn 8

winXP
B8{CE 00 00 00} mov eax, 0CEh
BA 00 03 FE 7F  mov edx, 7FFE0300h
FF D2           call edx
C2 08 00        retn 8

                         NTDLL.DLL::LdrGetDllHandle

winNT
64 A1 00 00 00 00   mov eax, fs:[0]
55                  push ebp
8B EC               mov ebp, esp

win2k
55     push ebp
8B EC  mov ebp, esp
6A FF  push -1

winXP
FF 74 24 10   push [esp+10h]
FF 74 24 10   push [esp+10h]

                       KERNEL32.DLL::FindFirstFileExW

winNT
55                 push ebp
8B EC              mov ebp, esp
81 EC{BC 02 00 00} sub esp, 2BCh

win2K
55                 push ebp
8B EC              mov ebp, esp
81 EC{B8 02 00 00} sub esp, 2B8h

winXP
55                 push ebp
8B EC              mov ebp, esp
81 EC{B4 02 00 00} sub esp, 2B4h

                        KERNEL32.DLL::FindNextFileW

winNT
64 A1 00 00 00 00   mov eax, fs:[0]
55     push ebp
8B EC  mov ebp, esp

win2k
55     push ebp
8B EC  mov ebp, esp
6A FF  push -1

winXP
6A 2C           push 2Ch
68{18 5B E9 77} push 77E95B18h

                     ADVAPI32.DLL::EnumServicesStatusA

winNT
64 A1 00 00 00 00   mov eax, fs:[0]
55                  push ebp
8B EC               mov ebp, esp

win2K
55     push ebp
8B EC  mov ebp, esp
6A FF  push -1

winXP
6A 34           push 34h
68{80 EF DE 77} push 77DEEF80h

                     ADVAPI32.DLL::EnumServicesStatusW

winNT,2K,XP
55     push ebp
8B EC  mov ebp, esp
6A 00  push 0

                        ADVAPI32.DLL::RegEnumKeyExW

winNT
55       push ebp
8B EC    mov ebp, esp
83 EC{10}sub esp, 10h

win2K,XP
55       push ebp
8B EC    mov ebp, esp
83 EC{14}sub esp, 14h

                         ADVAPI32.DLL::RegEnumKeyW

winNT
55                      push ebp
B8 06 00 00 00          mov eax, 6

win2K
55                      push ebp
8B EC                   mov ebp, esp
81 7D 08{04 00 00 80}   cmp dword ptr [ebp+8], 80000004h

winXP
55       push ebp
8B EC    mov ebp, esp
83 EC{14}sub esp, 14h

                     IPHLPAPI.DLL::GetTcpTableFromStack

win2K
55        push ebp
8B EC     mov ebp, esp
83 EC{2C} sub esp, 2Ch

winXP
55        push ebp
8B EC     mov ebp, esp
83 EC{28} sub esp, 28h

                     IPHLPAPI.DLL::GetUdpTableFromStack
win2K
55        push ebp
8B EC     mov ebp, esp
83 EC{2C} sub esp, 2Ch

winXP
55        push ebp
8B EC     mov ebp, esp
83 EC{28} sub esp, 28h

WinNT/2K/XP STEALTHER UTILITY v1.02
-----------------------------------

When executed on target machine (system or administrator rights required),
this program will copy itself to %SystemDirectory% as RPCXSS.EXE,
and create/start itself as system service.
This service will perform the following actions:

1. Stealth RPCX* files in the:

- taskmanager
- system service manager
- findfirst/findnext
- registry

2. Stealth in netstat by port 31337, TCP/UDP

3. Each second this service will check for new RPCX*.EXE files
in the %SystemRoot%\system32\ (except RPCXSS.EXE itself),
and execute them under SYSTEM privileges, once per session.

As such, to execute stealth processes on the target machine, you only
need to start there this program (dont forget to delete original file),
and then to put your own programs as RPCX*.EXE files into system32 directory.

3. Command line parameters

/yo passphrase, used to install/uninstall,
otherwise will work only as auto-executed service

/report show user name; then
show ++ if installed,
show -- if uninstalled,
or E1..E12 if error

KNOWN BUGS:

v1.02
- registry/netstat stealth doesnt works in NT4,
file stealth works partially in NT4

Odgovor na temu