nccgroup/windowsfirewallhookdriverenumerationWindows 2000, XP 및 2003에서 Windows 방화벽 후크 드라이버를 열거하는 도구
Windows 2000, XP 및 2003에서 Windows Firewall 후크 드라이버를 열거하는 도구입니다.
이 기법을 사용하는 악성 코드 샘플을 확인했습니다.
XP/2003의 Windows Firewall 후크 기능 기법 [1][2][3][4][5]은 \Device\Ip로 전송되는 IOCTL_IP_SET_FIREWALL_HOOK라는 IOCTL을 사용합니다.
#define FSCTL_IP_BASE FILE_DEVICE_NETWORK
#define _IP_CTL_CODE(function, method, access)
CTL_CODE(FSCTL_IP_BASE, function, method, access)
#define IOCTL_IP_SET_FIREWALL_HOOK
_IP_CTL_CODE(12, METHOD_BUFFERED, FILE_WRITE_ACCESS)
[1] https://briolidz.wordpress.com/2011/12/20/network-traffic-filtering-technologies-for-windows/
[2] http://kosh.la/?p=28
[3] http://www.codeproject.com/Articles/8675/An-Adventure-How-to-implement-a-Firewall-Hook-Driv
[4] http://www.openrce.org/blog/view/453/function.session-start
[5] http://msdn.microsoft.com/en-us/library/windows/hardware/ff546499%28v=vs.85%29.aspx
이러한 후크를 열거하기 위해 Volatility 플러그인을 제작했습니다. 아래는 예시입니다:
[FWHook] Found tcpip.sys at offset 0x17b7098 with DllBase 0xf117d000
[FWHook] PE Header Offset: 0x0000d8
[FWHook] Image Base Address: 0x010000
[FWHook] FQ Block Address: 0xf11be860
[FWHook] FQ Counter Address: 0xf11be880
[FWHook] FQ Counter Value: 16 0x000010
[FWHook] Final FQ Block Address: 0xf11be870
[FWHook] Total hooks registered 3
[FWHook] -----------------------------------------------------------------------------------
[FWHook] Call Out Address: 0xf0582246
[FWHook] Module Base Address: 0xf0580000
[FWHook] Module DLL Name dump_dumpfve.sys
[FWHook] Module Binary Path \??\C:\WINDOWS\system32\drivers\dump_dumpfve.sys
[FWHook] -----------------------------------------------------------------------------------
[FWHook] Call Out Address: 0xf103c6dc
[FWHook] Module Base Address: 0xf1027000
[FWHook] Module DLL Name ipnat.sys
[FWHook] Module Binary Path \SystemRoot\system32\DRIVERS\ipnat.sys
[FWHook] -----------------------------------------------------------------------------------
[FWHook] Call Out Address: 0xf0582270
[FWHook] Module Base Address: 0xf0580000
[FWHook] Module DLL Name dump_dumpfve.sys
[FWHook] Module Binary Path \??\C:\WINDOWS\system32\drivers\dump_dumpfve.sys
Windows 네이티브 드라이버와 명령줄 유틸리티도 제작했습니다.
이것은 releases 탭에서 다운로드할 수 있습니다 - https://github.com/nccgroup/WindowsFirewallHookDriverEnumeration/releases