绕过本机DNS缓存

--转载注明来源 http://www.cnblogs.com/sysnap/

0x1 背景

往HOST文件添加127.0.0.1  www.baidu.com， 可以劫持百度的域名。病毒经常篡改HOST文件来劫持域名，有没一种办法，不动HOST文件，又可以针对指定的域名使其不受HOST文件的影响？

0x02研究

通常进程调用gethostbyname来解析域名的IP，这个API内部会RPC到svchost里面去，由svchost来完成请求，最终调用R_ResolverQuery来完成解析工作，R_ResolverQuery的定义是int __stdcall R_ResolverQuery(unsigned __int16 *Handle, unsigned __int16 *pwsName, unsigned __int16 wType, unsigned int Flags, _DnsRecord **ppResultRecords)，注意Flags，跟DnsQuery的fOptions是一样的，只要HOOK R_ResolverQuery， 判断pwsName是不是要保护的域名，然后给Flags或上DNS_QUERY_BYPASS_CACHE就可以了

0x03 R_ResolverQuery定位

定位R_ResolverQuery，这个函数是RPC IDL文件里面定义的，接口GUID为45776b01-5956-4485-9f80-f428f7d60129， 搜索dnsrslvr，找到45776b01-5956-4485-9f80-f428f7d60129特征就可以定位，具体的结构如下图所示

0x04 实现

一下是DLL的代码(XP测试通过，没测其它系统)，需要找一个注入进程工具把DLL注入到svchost里面去，注意svchost是带-k NetWorkService的那个。HOOK函数会判断当前的域名解析请求是不是name_bypass_hostfile，是的话就不走缓存了

// dllmain.cpp : Defines the entry point for the DLL application.

#include "stdafx.h"

#include <windows.h>

#include <Rpc.h>

#include <rpcdcep.h>

#include <RpcNdr.h>

#define DNS_IF_GUID_LEN 16

unsigned char DNS_IF_GUID_[DNS_IF_GUID_LEN] = { 0x01, 0x6b, 0x77, 0x45, 0x56, 0x59, 0x85, 0x44, 0x9f, 0x80, 0xf4, 0x28, 0xf7, 0xd6, 0x01, 0x29};

static const wchar_t* name_bypass_hostfile = L"www.baidu.com";

typedef int (__stdcall * pfnR_ResolverQuery)(

unsigned __int16 *Handle,

unsigned __int16 *pwsName,

unsigned __int16 wType,

unsigned int Flags,

void **ppResultRecords

);

typedef long ( __stdcall * SERVER_ROUTINE)();

static pfnR_ResolverQuery g_old_pfnR_ResolverQuery = NULL;

static void** g_off = NULL;

void** get_R_ResolverQuery_off(void* Base, size_t Limit)

{

PRPC_SERVER_INTERFACE srv_if = NULL;

void** _R_ResolverQuery = NULL;

__try

{

unsigned char* s_ptr = (unsigned char*)Base;

for(size_t i = 0; i < Limit; i++, s_ptr++)

{

if( 0 == memcmp(DNS_IF_GUID_, s_ptr, DNS_IF_GUID_LEN) )

{

srv_if = (PRPC_SERVER_INTERFACE)(s_ptr - sizeof(unsigned int));

PMIDL_SERVER_INFO InterpreterInfo = (PMIDL_SERVER_INFO)srv_if->InterpreterInfo;

if(InterpreterInfo)

{

const SERVER_ROUTINE * DispatchTable = InterpreterInfo->DispatchTable;

_R_ResolverQuery = (void**)&DispatchTable[0x09];

}

break;

}

}

}__except(1)

{

;

}

return _R_ResolverQuery;

}

int __stdcall

fake_R_ResolverQuery(

unsigned __int16 *Handle,

unsigned __int16 *pwsName,

unsigned __int16 wType,

unsigned int Flags,

void **ppResultRecords

)

{

#define DNS_QUERY_BYPASS_CACHE 0x08

unsigned int _Flags = Flags;

if(_wcsicmp(name_bypass_hostfile, (const wchar_t *)pwsName) == 0)

{

OutputDebugStringW((LPCWSTR)pwsName);

OutputDebugStringW(L"\n");

_Flags |= DNS_QUERY_BYPASS_CACHE;

}

return g_old_pfnR_ResolverQuery(Handle, pwsName, wType, _Flags, ppResultRecords);

}

void** hook_R_ResolverQuery(void* Base, size_t Limit, void** oldptr, pfnR_ResolverQuery hookptr)

{

void** rs = NULL;

pfnR_ResolverQuery* p_R_ResolverQuery = (pfnR_ResolverQuery*)get_R_ResolverQuery_off(Base, Limit);

if(p_R_ResolverQuery)

{

DWORD lpflOldProtect = 0;

BOOL result = VirtualProtect((void*)p_R_ResolverQuery, sizeof(PVOID),

PAGE_EXECUTE_READWRITE, &lpflOldProtect);

if(result)

{

rs = (void**)p_R_ResolverQuery;

*oldptr = (void*)*p_R_ResolverQuery;

*p_R_ResolverQuery = hookptr;

VirtualProtect((void*)p_R_ResolverQuery, sizeof(PVOID),

lpflOldProtect, &lpflOldProtect);

}

}

return (void**)rs;

}

void unhook_R_ResolverQuery(void** off, void* Oldptr)

{

DWORD lpflOldProtect = 0;

BOOL result = VirtualProtect((void*)off, sizeof(PVOID),

PAGE_EXECUTE_READWRITE, &lpflOldProtect);

if(result)

{

*off = Oldptr;

VirtualProtect((void*)off, sizeof(PVOID),

lpflOldProtect, &lpflOldProtect);

}

}

DWORD WINAPI hook_worker(

LPVOID lpParameter

)

{

if(lpParameter == (PVOID)1)

{

HMODULE hmod = ::GetModuleHandleA("dnsrslvr.dll");

if(hmod)

{

void* oldptr = NULL;

void** off = hook_R_ResolverQuery((void*)hmod, 45568, &oldptr, fake_R_ResolverQuery);

g_old_pfnR_ResolverQuery = (pfnR_ResolverQuery)oldptr;

g_off = off;

}

}else

{

(void)unhook_R_ResolverQuery(g_off, g_old_pfnR_ResolverQuery);

}

return 0;

}

BOOL APIENTRY DllMain( HMODULE hModule,

DWORD  ul_reason_for_call,

LPVOID lpReserved

)

{

//

//DllMain创建线程，只要没任何等待线程的操作就是安全的，不会死锁.

//

switch (ul_reason_for_call)

{

case DLL_PROCESS_ATTACH:

{

DWORD lpThreadId;

CreateThread(NULL, 0, hook_worker, (PVOID)1, 0, &lpThreadId);

}

break;

case DLL_THREAD_ATTACH:

break;

case DLL_THREAD_DETACH:

break;

case DLL_PROCESS_DETACH:

{

//

//暴力卸载是不安全的.

//

DWORD lpThreadId;

CreateThread(NULL, 0, hook_worker, (PVOID)0, 0, &lpThreadId);

}

break;

}

return TRUE;

}