Huang Fei
All
NT下获得RING0的技术(二)
27 Aug 98  16:19:04
        NT下如何取到Ring0级执行权(2)

        黄飞
        98/8

        (注:引用本文请先征得作者同意,谢谢!)
===============================================
CALLGATE技术使用:
一个不留神,被感冒病毒袭击了,好在用康太克98杀了一通,总算
暂时喘了口气. :(
这些天老板看的太紧,抽空凑了几个字,各位不要奸笑. :)
OK,上次贴过了关键的3个Undocument API,想想在NT Driver
部分里另外一个要点是CallGate技术应用,下面是CallGate部分
程序原码:
注:我就不详细解释了,定义及使用原理见Matt在95奥秘
一书中的讲解.有兴趣者可以自己看看.
#pragma pack(1)
typedef struct
{
    unsigned short  limit_0_15;
    unsigned short  base_0_15;
    unsigned char   base_16_23;
    unsigned char   accessed    : 1;
    unsigned char   readable    : 1;
    unsigned char   conforming  : 1;
    unsigned char   code_data   : 1;
    unsigned char   app_system  : 1;
    unsigned char   dpl         : 2;
    unsigned char   present     : 1;
    unsigned char   limit_16_19 : 4;
    unsigned char   unused      : 1;
    unsigned char   always_0    : 1;
    unsigned char   seg_16_32   : 1;
    unsigned char   granularity : 1;
    unsigned char   base_24_31;
} CODE_SEG_DESCRIPTOR;

typedef struct
{
    unsigned short  offset_0_15;
    unsigned short  selector;
    unsigned char   param_count : 4;
    unsigned char   some_bits   : 4;
    unsigned char   type        : 4;
    unsigned char   app_system  : 1;
    unsigned char   dpl         : 2;
    unsigned char   present     : 1;
    unsigned short  offset_16_31;
} CALLGATE_DESCRIPTOR;
#pragma pack()
...
		ring0_desc.limit_0_15 = 0xFFFF;
		ring0_desc.base_0_15 = 0x0000;
		ring0_desc.base_16_23 = 0x00;
		ring0_desc.accessed = 0;
		ring0_desc.readable = 1;
		ring0_desc.conforming = 0;
		ring0_desc.code_data = 1;
		ring0_desc.app_system = 1;
		ring0_desc.dpl = 0;
		ring0_desc.present = 1;
		ring0_desc.limit_16_19 = 0xF;
		ring0_desc.unused = 0;
		ring0_desc.always_0 = 0;
		ring0_desc.seg_16_32 = 1;
		ring0_desc.granularity = 1;
		ring0_desc.base_24_31 = 0x00;
                callgate_desc.offset_16_31 = (USHORT) \
                        ((((ULONG)func_address) >> 16) & 0xFFFF);
                callgate_desc.offset_0_15 = (USHORT)func_address;
		callgate_desc.selector = extension->GdtSelectors[0];
                callgate_desc.param_count = Count;
		callgate_desc.some_bits = 0;
		callgate_desc.type = 0xC;
                callgate_desc.app_system = 0;
		callgate_desc.dpl = 3;
		callgate_desc.present = 1;
...
上面建立了一个RING0 CODE描述符和一个对应的CallGate描述符,
利用他们在加上(1)中介绍的3个Undocumented API,就可以提供一个
后门用以刺入NT的RING0级. ;)

2. NT Service部分
NT Service是NT提出的一个新概念(虽然95/98里有雏形),通过一个集中化的
SCM( Service Control Manager )管理各种重要的后台进程,例如RAS,DHCP,
后台打印,网络消息等等,有关Service的详细信息可以在MSDN中找到.
简便期间,我这里把NT Service部分和Win32 APP部分合二为一,省去Interface
部分,直接和RING0 Code连接就行了.当然,实际使用中最好以DLL方式提供Win32
的API接口.
下面是原码:

// cgateapp.c
//
#include <windows.h>

#define FILE_DEVICE_CALLGATE	0x00008300
#define CALLGATE_IOCTL_INDEX	0x830

// DDK micros
#define CTL_CODE( DeviceType, Function, Method, Access ) (                 \
    ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
)
#define METHOD_BUFFERED                 0
#define FILE_ANY_ACCESS                 0

// Driver control codes
#define IOCTL_CALLGATE_CREATE	CTL_CODE(	FILE_DEVICE_CALLGATE,	\
                                            METHOD_BUFFERED,		\
                                            FILE_ANY_ACCESS )
...
太长了,接下次吧. :)
===============================================(2) Over.

...     Huang Fei
...     =========
--- xMail 1.00
 * Origin: Shanghai Shake-River BBS.(021-59572197)  (6:654/1001)