检测并禁用隐藏服务-网络安全专区

检测并禁用隐藏服务

作者：佚名编辑：李莲 2007-06-25 15:48

   printf("adjust error\n");

           CloseHandle( hToken );

      }

}

int DumpServiceInfo()

{

      HKEY hService;

      EnablePriv(SE_BACKUP_NAME);

      if(RegOpenKeyEx(

           HKEY_LOCAL_MACHINE,         // handle to open key

           "SYSTEM\\ControlSet001\\Services", // subkey name

           NULL,   // reserved

           KEY_ALL_ACCESS, // security access mask

           &hService    // handle to open key

           ) != ERROR_SUCCESS)

      {    printf("can''t get key handle\n");

           return 0;

      }

      if(RegSaveKey(hService,"C:\\tmp.hiv",NULL) != ERROR_SUCCESS)

      {

           printf("Can''t dump Service info\n");

           CloseHandle(hService);

           return 0;

      }

      CloseHandle(hService);

      return 1;

}

void ShowHideService(struct hive *hdesc, char *path, int vofs, int type)

{

  struct nk_key *key;

  int nkofs;

  struct ex_data ex;

  int count = 0, countri = 0;

  //wHAT I ADD

  void *data;

  int nkofs_cat;

  int serviceno;



  serviceno = 1;

  nkofs = trav_path(hdesc, vofs, path, 0);

  if(!nkofs) {

    printf("nk_ls: Key <%s> not found\n",path);

    abort();

    return;

  }

  nkofs += 4;

  key = (struct nk_key *)(hdesc->buffer + nkofs);

  if (key->id != 0x6b6e) {

    printf("Error: Not a ''nk'' node!\n");

    debugit(hdesc->buffer,hdesc->size);

  }



   if (key->no_subkeys) {

        while ((ex_next_n(hdesc, nkofs, &count, &countri, &ex) > 0)) {

             if(!CompareHive(ex.name) )

             {

                   nohideservice = 0;

                   if(!(serviceno - 1))

                        printf("Hide Service List:\n");

                   printf("\n%d.------------------------------------------------------------\n",serviceno++ );

                   printf("Hide Service : %s\n", ex.name );

                   nkofs_cat = trav_path(hdesc, vofs, ex.name, 0);

                   printf("Image Path   : ");

                   ShowPathImage(hdesc, nkofs_cat + 4, "ImagePath");

                   data = (void *) get_val_data(hdesc, nkofs_cat + 4, "Start", 0 );

                   if( data != NULL)

                   {

                        printf("Start Type   : ");

                        switch(*(unsigned short *)data)

                         {

                        case 0:

                              printf("SERVICE_BOOT_START");

                              break;

                        case 1:

                              printf("SERVICE_SYSTEM_START");

                              break;

                        case 2:

                              printf("SERVICE_AUTO_START");

                              break;

                        case 3:

                              printf("SERVICE_DEMAND_START");

                              break;

                        case 4:

                              printf("SERVICE_DISABLED");

                              break;

                        default:

                              printf("UNKOWN START TYPE");

                        }



                        //disable the service



                        if( *(unsigned short *)data != 4 )

                        {

                              printf("(Will be set to Disabled)");

                              put_dword(hdesc, nkofs_cat + 4, "Start", 4);

                              ischange = 1;

                        }



                        printf("\n");



                   }



                   data = (void *) get_val_data(hdesc, nkofs_cat + 4, "Type", 0 );

                   printf("Service Type : ");

                   if( data != NULL)

                   {

                        if(*(unsigned short *)data & 1)

                             printf("SERVICE_KERNEL_DRIVER ");

                        if(*(unsigned short *)data & 2)

                             printf("SERVICE_FILE_SYSTEM_DRIVER " );

                        if(*(unsigned short *)data & 8)

                            printf("SERVICE_RECOGNIZER_DRIVER ");

                        if(*(unsigned short *)data & 16)

                              printf("SERVICE_WIN32_OWN_PROCESS ");

                        if(*(unsigned short *)data & 32)

                            printf("SERVICE_WIN32_SHARE_PROCESS ");

                        if(*(unsigned short *)data & 256)

                            printf("SERVICE_INTERACTIVE_PROCESS ");

                        printf("\n");

                   }

             }

             FREE(ex.name);

    }

  }

  if(nohideservice)

        printf("There are no hide services.\n");

  else

        printf("\nTotal Hide Services is %d\n\n",serviceno - 1);

}

int RestoreServiceInfo()

{

      HKEY hService;

      LONG tmp;

      EnablePriv(SE_RESTORE_NAME);



      if(RegOpenKeyEx(

           HKEY_LOCAL_MACHINE,         // handle to open key

           "SYSTEM\\ControlSet001\\Services", // subkey name

           NULL,   // reserved

           KEY_ALL_ACCESS,// security access mask

           &hService    // handle to open key

           ) != ERROR_SUCCESS)

      {

           printf("Can''t open Service key\n");

           return 0;

      }

      //The first time to Restore always fail even you set the Force flag

      //The second time will success.

      for(;;)

      {

           if((tmp = RegRestoreKey(hService,"C:\\tmp2.hiv", 8 ) ) == ERROR_SUCCESS )

           {

                 break;

           }

      }

      CloseHandle(hService);

      return 1;

}

int main(int argc, char* argv[])

{

      struct hive *pHive;

      char c;

      nohideservice = 1;

      ischange = 0;

      printf("KHS - kill hide services 0.1 by linux2linux, 2005/5/26.\n");

      printf("Take notes from knlsc and FHS.                         \n\n");



      if(!DumpServiceInfo())

           return 0;

      pHive = My_openHive("C:\\tmp.hiv",HMODE_RW);

      if(pHive == NULL)

      {

           printf("Open Hive fail\n");

           return 0;

      }

      GetPatterns();

      ShowHideService(pHive,"",pHive->rootofs + 4 , 0);

      CleanPatterns();

      if(!nohideservice && ischange )

      {

                 My_writeHive(pHive);

                 printf("Do you want Disable the hide Services ( Yes / No )? [ No ]:");

                 c = getchar();

                 if( ( c == ''Y'' )|| c == ''y'')

                 {

                      if( RestoreServiceInfo() )

                            printf("Success Restore\n");

                 }

                 else

                 {    printf("Quit without Restore.\n");

                 }

                 DeleteFile("C:\\tmp2.hiv");

      }

      DeleteFile("C:\\tmp.hiv");

      My_closeHive(pHive);



      return 0;

}

参考资源

１．The Offline NT Password Editor　源程序　- Petter Nordahl-Hagen

http://home.eunet.no/~pnordahl/ntpasswd/

２．<<Windows NT/2000 Native API Reference>> - Gary Nebbett

３．Knlsc, FHS, IceSword 使用说明
http://www.hack58.net/Article/60/63/2005/4272.htm

第1页：检测并禁用隐藏服务第2页：检测并禁用隐藏服务第3页：检测并禁用隐藏服务

关注我们