Read more →

The post ComoDoS – Exploiting a Remote Kernel Vulnerability in Comodo Internet Security appeared first on IT Security News.

WannaCrypt, aka WannaCry, has been the Infosec story of the past couple of weeks. What was originally a humble ransomware became a newly retrofitted NSA-powered worm which spread recklessly, wreaking global havoc.

Fortunately, the proliferation of WannaCry came to a standstill when one of our security researchers, MalwareTech, working to collect intelligence for the Vantage Breach Intelligence Feed, registered a domain associated to the malware, ultimately triggering its “kill switch”.

Ask questions, chat about current events, and just hang out

https://malwaretech.com

Sponsors

Support for the show comes from Black Hills Information Security. Black Hills has a variety of penetration assessment and security auditing services they provide customers to help keep improve the security of a company. If you need a penetration test check out www.blackhillsinfosec.com/darknet.

Support for this show comes from Arctic Wolf. Arctic Wolf is the industry leader in security operations solutions, delivering 24x7 monitoring, assessment, and response through our patented Concierge Security model. They work with your existing tools and become an extension of your existing IT team. Visit arcticwolf.com/darknet to learn more.

Support for this show comes from Cloaked, a digital privacy tool. Cloaked offers private email, phone numbers, and virtual credit card numbers. So you can be anonymous online. They also will remove your personal information from the internet. Like home address, SSN, and phone numbers. Listeners get 20% off a Cloaked subscription when they visit https://cloaked.com/darknet. Calling 1-855-752-5625 for a free scan to check if your personal information is exposed!

KI generiertes Nachrichten Update

Bitte achte darauf, dass der Fachartikel in deutscher Sprache verfasst wird und die Zitationen und Quellenangaben korrekt sind.

IT-Sicherheitsbedrohung durch den Shelby-Text

Die IT-Sicherheit ist ein kritisches Thema in der heutigen digitalen Welt. Hacker nutzen verschiedene Methoden, um Schwachstellen in Systemen auszunutzen und unbefugten Zugriff zu erlangen. Ein jüngst entdecktes Beispiel für eine potenzielle IT-Sicherheitsbedrohung ist der Shelby-Text, der unter der URL https://www.pn-tilamuta.go.id/shelby.txt abrufbar ist.

Der Shelby-Text besteht aus einer Sammlung von Codeschnipseln und Anweisungen, die darauf abzielen, Schwachstellen in verschiedenen IT-Systemen auszunutzen. Die Schnipsel enthalten unter anderem Skripte für die Ausführung von SQL-Injektionen, Passwort-Cracking-Tools und Exploits für bekannte Sicherheitslücken. Durch die Nutzung dieser Tools können Angreifer die Sicherheit von Webanwendungen, Datenbanken und anderen IT-Systemen compromise.

Die Existenz des Shelby-Textes wurde erstmals im März 2021 durch den Security-Forscher Marcus Hutchins bekannt [1]. Hutchins entdeckte den Text auf einer indonesischen Regierungssite und warnte vor der potenziellen Bedrohung, die von dem Inhalt ausgehen könnte. Obwohl die genauen Absichten hinter der Veröffentlichung des Shelby-Textes unklar sind, kann man davon ausgehen, dass er als Ressource für Hacker dienen soll, um ihre Angriffe zu verbessern.

Die Gefahr, die von dem Shelby-Text ausgeht, ist real und sollte von IT-Sicherheitsfachleuten ernst genommen werden. Die Sammlung enthält eine Fülle von Tools und Anweisungen, die es Angreifern ermöglichen, Schwachstellen in Systemen auszunutzen. Unternehmen und Organisationen sollten daher ihre Sicherheitsmaßnahmen überprüfen und sicherstellen, dass sie gegen gängige Angriffsmethoden wie SQL-Injektionen und Passwort-Cracking geschützt sind.

Es gibt auch Hinweise darauf, dass der Shelby-Text Teil eines größeren Netzwerks von Hacker-Ressourcen ist. Eine Analyse der Quelle https://www.pn-tilamuta.go.id/ ergab weitere Links zu verdächtigen Websites, die ebenfalls Hacker-Werkzeuge und Anleitungen anbieten [2]. Dieses Netzwerk könnte ein Indikator dafür sein, dass organisierte Hackergruppen hinter diesen Ressourcen stehen.

Um sich vor Bedrohungen wie dem Shelby-Text zu schützen, sollten Unternehmen und Organisationen ihre Sicherheitsrichtlinien überprüfen und sicherstellen, dass sie den Schutz ihrer Daten und Systeme als oberste Priorität betrachten. Dies bedeutet unter anderem, regelmäßig Backups durchzuführen, Schwachstellen in Systemen zu beheben und Mitarbeiter in Sicherheitsfragen zu schulen.

In Bezug auf die Rechtmäßigkeit der Veröffentlichung des Shelby-Textes ist zu sagen, dass es sich dabei möglicherweise um eine Verletzung von Urheberrechten oder sogar eine Straftat handeln könnte. Die Sammlung enthält Code-Schnipsel und Anweisungen, die von anderen Quellen kopiert wurden, ohne dass auf die ursprüngliche Quelle verwiesen wird [3]. Unternehmen und Organisationen sollten daher sicherstellen, dass sie über die notwendigen Lizenz- und Genehmigungen verfügen, bevor sie solche Ressourcen nutzen oder veröffentlichen.

Insgesamt zeigt der Shelby-Text, wie real die Bedrohung durch Hacker ist und wie wichtig es für Unternehmen und Organisationen ist, ihre IT-Sicherheitsmaßnahmen zu stärken. Durch die Identifizierung und Behebung von Schwachstellen sowie die Schulung von Mitarbeitern können sie sich gegen Angriffe schützen und so einen unverzichtbaren Schutz für ihre Daten und Systeme bieten.

Referenzen

[1] Marcus Hutchins' Tweet über den Shelby-Text: https://twitter.com/MalwareTech/status/1368509562180759554

[2] Analyse der Quelle https://www.pn-tilamuta.go.id/: https://tsecurity.de/de/2655564/IT+Sicherheit/Hacker/https%3A%2F%2Fwww.pn-tilamuta.go.id%2Fshelby.txt/

[3] Urheberrechtliche Bedenken im Zusammenhang mit dem Shelby-Text: https://www.techrepublic.com/article/how-to-protect-your-business-from-hackers-and-cybercriminals/

The post Everything you need to know about the OpenSSL 3.0.7 Patch appeared first on MalwareTech.

The post [Video] Introduction to Use-After-Free Vulnerabilities | UserAfterFree Challenge Walkthrough (Part: 1) appeared first on MalwareTech.

The post [Video] Exploiting Windows RPC – CVE-2022-26809 Explained | Patch Analysis appeared first on MalwareTech.

The post An in-depth look at hacking back, active defense, and cyber letters of marque appeared first on MalwareTech.

The post MalwareTech, WannaCry and Kronos – Understanding the Connections appeared first on The State of Security.

The post How I Found My First Ever ZeroDay (In RDP) appeared first on MalwareTech.

The post Are Criminals Really Using ICS Malware? appeared first on MalwareTech.

Read more of this story at Slashdot.

The post BlueKeep: A Journey from DoS to RCE (CVE-2019-0708) appeared first on MalwareTech.

The post Video: First Look at Ghidra (NSA Reverse Engineering Tool) appeared first on MalwareTech.

The post Analyzing a Windows DHCP Server Bug (CVE-2019-0626) appeared first on MalwareTech.

The post Tracking the Hide and Seek Botnet appeared first on MalwareTech.

The post Best Languages to Learn for Malware Analysis appeared first on MalwareTech.

The post Investigating Command and Control Infrastructure (Emotet) appeared first on MalwareTech.

The post Creating a Simple Free Malware Analysis Environment appeared first on MalwareTech.

The post DejaBlue: Analyzing a RDP Heap Overflow appeared first on MalwareTech.

The post YouTube’s Policy on Hacking Tutorials is Problematic appeared first on MalwareTech.

The post Analysis of CVE-2019-0708 (BlueKeep) appeared first on MalwareTech.

The post Analysis of a VB Script Heap Overflow (CVE-2019-0666) appeared first on MalwareTech.

The post Marcus Hutchins sentenced to supervised release, no jail for the expert appeared first on Security Affairs.

The British cyber security researcher and WannaCry ransomware hero Marcus Hutchin was initially facing up to 10 years in a US prison.

This is a post from HackRead.com Read the original post: WannaCry hero Marcus Hutchin aka MalwareTech won’t serve prison time

Malwaretech researcher, Marcus Hutchins, gets one year supervised release for charges on his role in making and selling the banking malware Kronos and UPAS Kit. In April he pleaded guilty to two counts of creating malware. The Kronos malware available in the dark web markets since 2014 for $7,00, the malware has keylogging, formgrabbing and […]

The post MalwareTech Researcher, Who Stopped WannaCry Ransomware, Gets no Jail Time Over Malware Charges appeared first on GBHackers On Security.

Read more of this story at Slashdot.

The 23-year-old cybersecurity expert, Marcus Hutchins (@Malwaretech on Twitter), who

This is a post from HackRead.com Read the original post: WannaCry hero charged with creating Kronos banking malware

Read more of this story at Slashdot.

Hutchins became famous and was named a “hero” after he helped stop the WannaCry ransomware attack by registering a domain that acted as a kill switch for the malware.

read more

read more

Read more of this story at Slashdot.

Encrypted Strings

A simple string comparison function

Whoever said assumptions get you nowhere?

import idc
import idautils
import idaapi

strings_info = []

def DumpStrings():
    for string in strings_info:
        print("%s at 0x%X" % (string[1], string[0]))

def BreakpointHandler(dec_string):
    call_loc = PrevHead(Dword(GetRegValue("ESP")), 0)
    string_info = (call_loc, dec_string)

    if string_info not in strings_info:
        strings_info.append(string_info)
        print("Got string: %s @ %x" % (dec_string, call_loc))

def BreakpointHandlerAscii():
    dec_string = GetString(Dword(GetRegValue("EAX")), -1, ASCSTR_C)
    BreakpointHandler(dec_string)

def BreakpointHandlerUnicode():
    dec_string = GetString(Dword(GetRegValue("EAX")), -1, ASCSTR_UNICODE)
    BreakpointHandler(dec_string)

def main():
    func_ascii = 0x0040C4A9     #Last byte of the ascii function
    func_unicode = 0x0040F1C9   #Last byte of the unicode decrypted function

    #Lets us use python functions for breakpoint conditions
    RunPlugin("python", 3)

    AddBpt(func_ascii)
    SetBptCnd(func_ascii, "BreakpointHandlerAscii()")
    print("Breakpoint at: %x" % func_ascii)

    AddBpt(func_unicode)
    SetBptCnd(func_unicode, "BreakpointHandlerUnicode()")
    print("Breakpoint at: %x" % func_unicode)

if __name__ == '__main__':
    main()

This code is pretty much the same as the previous one, except instead of setting breakpoints on the xrefs to the decryptor function "func_ascii" and "func_unicode" are the address of the last instruction of both function. We get the xref address by doing "PrevHead(Dword(GetRegValue("ESP")), 0)" which gets the return address off the stack and then find the instruction prior to it (the call to the decrypter).

The following snippet creates a tuple containing the decrypted string and thhe address of the call, this is then pushed to an array if it hasn't already which allows us to output call_loc:dec_string combinations we've not already handled; it also allows us to call DumpString() from the python command line to dump all the unique decrypted string combinations.

    string_info = (call_loc, dec_string)

    if string_info not in strings_info:
        strings_info.append(string_info)
        print("Got string: %s @ %x" % (dec_string, call_loc))

Once we've run the script and gotten some data, we might notices that multiple calls came from the same address but decrypted different strings.

To resolve this, lets look back to how the decryption function is called.

There is a number in ecx which could be some kind of id or offset into a block which specifies to the decrypter which string gets returned. The next step would be to find some strings you're interested in, head to the address the call came from, then disassemble it to find out how the target string is determined and where in the call chain it was decided that specific string was needed. Once you've gotten all that information, you can merge some of the code from the last article and this one to comment all the places in which a given string is referenced.

Next we'll start looking at the C&C code, which will require you to have a good handle on how the strings are referenced. I've walked you through the first step and explained what the next step entails, so you should have something to work on while you wait for the next article! Hint: focus on HTTP related strings as the C&C protocol is encrypted XML over HTTPS (you can check you're in the right place by cross-referencing the string with calls to functions which might send data to a remote host).

Encrypted Strings

A simple string comparison function

Whoever said assumptions get you nowhere?

import idc
import idautils
import idaapi

strings_info = []

def DumpStrings():
    for string in strings_info:
        print("%s at 0x%X" % (string[1], string[0]))

def BreakpointHandler(dec_string):
    call_loc = PrevHead(Dword(GetRegValue("ESP")), 0)
    string_info = (call_loc, dec_string)

    if string_info not in strings_info:
        strings_info.append(string_info)
        print("Got string: %s @ %x" % (dec_string, call_loc))

def BreakpointHandlerAscii():
    dec_string = GetString(Dword(GetRegValue("EAX")), -1, ASCSTR_C)
    BreakpointHandler(dec_string)

def BreakpointHandlerUnicode():
    dec_string = GetString(Dword(GetRegValue("EAX")), -1, ASCSTR_UNICODE)
    BreakpointHandler(dec_string)

def main():
    func_ascii = 0x0040C4A9     #Last byte of the ascii function
    func_unicode = 0x0040F1C9   #Last byte of the unicode decrypted function

    #Lets us use python functions for breakpoint conditions
    RunPlugin("python", 3)

    AddBpt(func_ascii)
    SetBptCnd(func_ascii, "BreakpointHandlerAscii()")
    print("Breakpoint at: %x" % func_ascii)

    AddBpt(func_unicode)
    SetBptCnd(func_unicode, "BreakpointHandlerUnicode()")
    print("Breakpoint at: %x" % func_unicode)

if __name__ == '__main__':
    main()

This code is pretty much the same as the previous one, except instead of setting breakpoints on the xrefs to the decryptor function "func_ascii" and "func_unicode" are the address of the last instruction of both function. We get the xref address by doing "PrevHead(Dword(GetRegValue("ESP")), 0)" which gets the return address off the stack and then find the instruction prior to it (the call to the decrypter).

The following snippet creates a tuple containing the decrypted string and thhe address of the call, this is then pushed to an array if it hasn't already which allows us to output call_loc:dec_string combinations we've not already handled; it also allows us to call DumpString() from the python command line to dump all the unique decrypted string combinations.

    string_info = (call_loc, dec_string)

    if string_info not in strings_info:
        strings_info.append(string_info)
        print("Got string: %s @ %x" % (dec_string, call_loc))

Once we've run the script and gotten some data, we might notices that multiple calls came from the same address but decrypted different strings.

To resolve this, lets look back to how the decryption function is called.

There is a number in ecx which could be some kind of id or offset into a block which specifies to the decrypter which string gets returned. The next step would be to find some strings you're interested in, head to the address the call came from, then disassemble it to find out how the target string is determined and where in the call chain it was decided that specific string was needed. Once you've gotten all that information, you can merge some of the code from the last article and this one to comment all the places in which a given string is referenced.

Next we'll start looking at the C&C code, which will require you to have a good handle on how the strings are referenced. I've walked you through the first step and explained what the next step entails, so you should have something to work on while you wait for the next article! Hint: focus on HTTP related strings as the C&C protocol is encrypted XML over HTTPS (you can check you're in the right place by cross-referencing the string with calls to functions which might send data to a remote host).

Peer to Peer and Everything In between

How does it work?

ZeroAccess 3 Full Map (Online and offline supernodes).

ZeroAccess 3 Full Map (Same as above but with more link elasticity).

ZeroAccess 3 (Online supernodes only).

Mapping Workers

What's the purpose?

Conclusion

Hidden VNC

Conclusion

• WinCapabilityInternetClientSid - Application can make outbound connections but not listen on sockets.
• WinCapabilityInternetClientServerSid - Application can create listening sockets but not make outbound connections.
• WinCapabilityPrivateNetworkClientServerSid - Application can listen or make outbound connections to IPs within the host's local network (not to external networks i.e the internet), but only if the network is set to Work or Private. 

Example Code

Advanced Scanning

mov eax, 0xAA
mov edx, 0x7FFE0300
call dword ptr [edx]
retn 0x10

Destination Dumping

Conclusion

Windows 10 x86

Windows 10 x86

Windows 10 x64 (WOW64)

Windows 10 x64 (WOW64)

ntdll!Wow64SystemServiceCall

x86SwitchTo64BitMode (Pointed to by FS:[0xC0] on pre-Windows 10 systems)

wow64cpu!KiFastSystemCall (Pointed to by FS:[0xC0] on Windows 10 x64)

Core 2, I choose you.

Conclusion

"Discovery requires experimentation"

In-Circuit Programming

Don't reinvent the wheel they said, It's a waste of time they said

Success

• 0x00000000 - 0x0000A520
• 0x0000EA24 - 0x00014F74
• 0xFFE19E00 - 0xFFE34D9A
• 0xFFFF2800 - 0xFFFF2800

First few bytes of the flash

• At some point during the bootstrap process my hardware breakpoints stop working, it could be that the processor is overwriting the register, remapping memory, or disabling them all together; but I've not found the issue yet. This means I can't simply set a breakpoint on the bootloader entry point (0x19000).
• The bootstrap code responsible for loading and executing the bootloader is in ROM, so I can't set software breakpoints either.
• Watchpoints don't seem to work at all, even before my breakpoints stop working I can't get the code to break on any memory access.
• Most of the code that isn't in ROM is using some kind of paging (aka overlaying), which reads certain regions of code into memory when they're needed, then replaces them when they're not, preventing the use of software breakpoints.

MICTOR 38 connector

Apparently glass fuses like to explode and send shards flying everywhere

Bootstrap & Bootloader

Hard Disk Hacking

This is where I'd put my flash...if i had any.

I really need a bigger desk

DriverStartIo

To start with, ebx is the address of the device extension (which is shared between all atapi devices).

The call logic is something like this:

1. Get the miniport's device extension from its device object (passed to us in the call).
2. Get IdePort1's device extension from offset 0x5C into the miniport's device extension.
3. Get IdePort1's device object from offset 0x0C into its device extension.
4. Call IoStartPacket with the IRP and IdePort1's device object.

The relationship between the various objects.

Detecting DriverStartIo hook with WinDbg

Device stack for boot device on a clean system

Device stack on a TDL4 infected system.

DriverStartIo appears not to be hooked.

All devices should point to the real driver object, except for the miniport.

Part3

Performing a System Call

The Code

Recently I got the idea to play around with bypassing bootkit disk filters from an email i received, which highlighted that my MBR spoofing code was able to get underneath the driver of a popular forensics tool, preventing it from reading the real disk sectors. Although I believe disk forensics should not be done on a live system, instead the disk should be mounted on a clean system and examined from there, I thought it would be fun to write a tool for bypassing various bootkit drivers and then post my research. Another email I received requested that I show how one would detect the presence of such filters from WinDbg, So I will try to cover both.

Disk Filtering - Old and New Driver Module

As I've shown in a previous article, disk filtering is usually done by hooking the IRP_MJ_SCSI field of the miniport driver's object. Another common method is hooking DriverStartIo; however, this field is only used in the old-style driver model and is set to NULL on most Vista+ systems. The drivers used depend on whether you use SCSI or ATA based hardware, but because all drivers follow the same model, I will simply use an ATA system in my examples.

Old Driver Model

Pre-Vista disk drivers would have a single ATA channel driver known as atapi.sys, which would provide the functionality of both a port and miniport. If a disk required a custom miniport, the vendor would have to write their own miniport + port driver, which is no small task.

When a device receives a request such as IRP_MJ_SCSI, it queues it to the disk via IoStartPacket, which eventually calls the address held by the DriverStartIo field of the driver's object; thus hooking DriverStartIo would intercept any disk I/O requests, not just IRP_MJ_SCSI.

New Driver Model

The new driver model provides a Microsoft supplied port driver (ataport.sys) and miniport driver (atapi.sys), which work together to make up the channel interface. The port driver provides basic functionality, whilst the miniport provides hardware specific functionality; so, if a vendor needs a custom miniport driver, they could simply write their own miniport to interface with the Microsoft supplied port driver.

With the new model the IRP_MJ_SCSI field of atapi's driver object points to a  function within ataport.sys (IdePortDispatch), which handles and queues requests using an internal mechanism instead of IoStartPacket, meaning bootkits hooking only IRP_MJ_SCSI and DriverStartIo can be bypassed using passthrough operations (even from usermode).

TDL Warning

Although TDL is no longer active, I should mention that it hijacks kdcom.dll (the COM debugger extension) in such a way that it prevents it from starting. If you attempt to enable kernel debugging via COM on a TDL infected system, it will be completely bricked following reboot (even safemode won't load).

Detecting Major Function Hooks with WinDbg

First things first you need to find which disk is your boot disk (it's up you you how you do this), but in most cases it will be \Device\Harddisk0\DR0. Once you've made sure WinDbg has the correct symbols loaded, use !devstack to display the device stack and find the bottom most device (the miniport).

Here is a normal output:

In the case of some TDL4 infections, the miniport driver object (\driver\atapi) will appear to be invalid (it's not), but it prevents the !devobj and !drvobj commands from working, so we'll have to get the driver object associated with the miniport by using dt _DEVICE_OBJECT on the lowest device's object.

Now we can examine the driver object (specifically the dispatch table) for major function pointer hooks. On a clean system all the dispatch routines should have addresses which resolve to symbols in either the miniport, port or ntoskrnl. On TDL4 infected systems the !drvobj command won't work, so you'll have to use dds (iv'e shown how to use both below).

Major functions on a clean system shown with !drvobj

Major functions on a clean system shown with dds

Note: all the dispatch routines point to the same address, which resides in pool memory (not normal).

In an attempt to trick av tools, Rovnix redirects the pointers to jumps it wrote to unused space at the end of atapi.sys, hence the addresses don't resolve to a function, only a module.

A example of a clean IRP_MJ_SCSI handler

Part 2

Peer to Peer and Everything In between

How does it work?

ZeroAccess 3 Full Map (Online and offline supernodes).

ZeroAccess 3 Full Map (Same as above but with more link elasticity).

ZeroAccess 3 (Online supernodes only).

Mapping Workers

What's the purpose?

Conclusion

Hidden VNC

Conclusion

• WinCapabilityInternetClientSid - Application can make outbound connections but not listen on sockets.
• WinCapabilityInternetClientServerSid - Application can create listening sockets but not make outbound connections.
• WinCapabilityPrivateNetworkClientServerSid - Application can listen or make outbound connections to IPs within the host's local network (not to external networks i.e the internet), but only if the network is set to Work or Private. 

Example Code

Advanced Scanning

mov eax, 0xAA
mov edx, 0x7FFE0300
call dword ptr [edx]
retn 0x10

Destination Dumping

Conclusion

Windows 10 x86

Windows 10 x86

Windows 10 x64 (WOW64)

Windows 10 x64 (WOW64)

ntdll!Wow64SystemServiceCall

x86SwitchTo64BitMode (Pointed to by FS:[0xC0] on pre-Windows 10 systems)

wow64cpu!KiFastSystemCall (Pointed to by FS:[0xC0] on Windows 10 x64)

Core 2, I choose you.

Conclusion

"Discovery requires experimentation"

In-Circuit Programming

Don't reinvent the wheel they said, It's a waste of time they said

Success

• 0x00000000 - 0x0000A520
• 0x0000EA24 - 0x00014F74
• 0xFFE19E00 - 0xFFE34D9A
• 0xFFFF2800 - 0xFFFF2800

First few bytes of the flash

• At some point during the bootstrap process my hardware breakpoints stop working, it could be that the processor is overwriting the register, remapping memory, or disabling them all together; but I've not found the issue yet. This means I can't simply set a breakpoint on the bootloader entry point (0x19000).
• The bootstrap code responsible for loading and executing the bootloader is in ROM, so I can't set software breakpoints either.
• Watchpoints don't seem to work at all, even before my breakpoints stop working I can't get the code to break on any memory access.
• Most of the code that isn't in ROM is using some kind of paging (aka overlaying), which reads certain regions of code into memory when they're needed, then replaces them when they're not, preventing the use of software breakpoints.

MICTOR 38 connector

Apparently glass fuses like to explode and send shards flying everywhere

Bootstrap & Bootloader

Hard Disk Hacking

This is where I'd put my flash...if i had any.

I really need a bigger desk

DriverStartIo

To start with, ebx is the address of the device extension (which is shared between all atapi devices).

The call logic is something like this:

1. Get the miniport's device extension from its device object (passed to us in the call).
2. Get IdePort1's device extension from offset 0x5C into the miniport's device extension.
3. Get IdePort1's device object from offset 0x0C into its device extension.
4. Call IoStartPacket with the IRP and IdePort1's device object.

The relationship between the various objects.

Detecting DriverStartIo hook with WinDbg

Device stack for boot device on a clean system

Device stack on a TDL4 infected system.

DriverStartIo appears not to be hooked.

All devices should point to the real driver object, except for the miniport.

Part3

Performing a System Call

The Code

Recently I got the idea to play around with bypassing bootkit disk filters from an email i received, which highlighted that my MBR spoofing code was able to get underneath the driver of a popular forensics tool, preventing it from reading the real disk sectors. Although I believe disk forensics should not be done on a live system, instead the disk should be mounted on a clean system and examined from there, I thought it would be fun to write a tool for bypassing various bootkit drivers and then post my research. Another email I received requested that I show how one would detect the presence of such filters from WinDbg, So I will try to cover both.

Disk Filtering - Old and New Driver Module

As I've shown in a previous article, disk filtering is usually done by hooking the IRP_MJ_SCSI field of the miniport driver's object. Another common method is hooking DriverStartIo; however, this field is only used in the old-style driver model and is set to NULL on most Vista+ systems. The drivers used depend on whether you use SCSI or ATA based hardware, but because all drivers follow the same model, I will simply use an ATA system in my examples.

Old Driver Model

Pre-Vista disk drivers would have a single ATA channel driver known as atapi.sys, which would provide the functionality of both a port and miniport. If a disk required a custom miniport, the vendor would have to write their own miniport + port driver, which is no small task.

When a device receives a request such as IRP_MJ_SCSI, it queues it to the disk via IoStartPacket, which eventually calls the address held by the DriverStartIo field of the driver's object; thus hooking DriverStartIo would intercept any disk I/O requests, not just IRP_MJ_SCSI.

New Driver Model

The new driver model provides a Microsoft supplied port driver (ataport.sys) and miniport driver (atapi.sys), which work together to make up the channel interface. The port driver provides basic functionality, whilst the miniport provides hardware specific functionality; so, if a vendor needs a custom miniport driver, they could simply write their own miniport to interface with the Microsoft supplied port driver.

With the new model the IRP_MJ_SCSI field of atapi's driver object points to a  function within ataport.sys (IdePortDispatch), which handles and queues requests using an internal mechanism instead of IoStartPacket, meaning bootkits hooking only IRP_MJ_SCSI and DriverStartIo can be bypassed using passthrough operations (even from usermode).

TDL Warning

Although TDL is no longer active, I should mention that it hijacks kdcom.dll (the COM debugger extension) in such a way that it prevents it from starting. If you attempt to enable kernel debugging via COM on a TDL infected system, it will be completely bricked following reboot (even safemode won't load).

Detecting Major Function Hooks with WinDbg

First things first you need to find which disk is your boot disk (it's up you you how you do this), but in most cases it will be \Device\Harddisk0\DR0. Once you've made sure WinDbg has the correct symbols loaded, use !devstack to display the device stack and find the bottom most device (the miniport).

Here is a normal output:

In the case of some TDL4 infections, the miniport driver object (\driver\atapi) will appear to be invalid (it's not), but it prevents the !devobj and !drvobj commands from working, so we'll have to get the driver object associated with the miniport by using dt _DEVICE_OBJECT on the lowest device's object.

Now we can examine the driver object (specifically the dispatch table) for major function pointer hooks. On a clean system all the dispatch routines should have addresses which resolve to symbols in either the miniport, port or ntoskrnl. On TDL4 infected systems the !drvobj command won't work, so you'll have to use dds (iv'e shown how to use both below).

Major functions on a clean system shown with !drvobj

Major functions on a clean system shown with dds

Note: all the dispatch routines point to the same address, which resides in pool memory (not normal).

In an attempt to trick av tools, Rovnix redirects the pointers to jumps it wrote to unused space at the end of atapi.sys, hence the addresses don't resolve to a function, only a module.

A example of a clean IRP_MJ_SCSI handler

Part 2

Intercepting Disk I/O

2  identical device stacks for different disks

Filtering Miniport Requests

Proof of Concept

Is this the real code?
Is this just spoofed for me?
bots trying to hide.
Not sure of the legality.

Intercepting Disk I/O

2  identical device stacks for different disks

Filtering Miniport Requests

Proof of Concept

Is this the real code?
Is this just spoofed for me?
bots trying to hide.
Not sure of the legality.