 |
 |
 |
|
 |
||
|
||
|
 |
|
|
|
SIG^2 Secure Code Study Project Proof-Of-Concept Win2K/XP SDT Restore 0.2 (Proof-Of-Concept)by Tan Chew Keong
Released : 06 Jul 2004
Download Version 0.2 
IntroductionWin32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). Such modification ensures that a replacement (hook) function installed by a rootkit is called prior to the original native API. The replacement function usually calls the original native API and modifies the output before returning the results to the user-space program. This technique allows kernel rootkits to hide files, processes, and to prevent process termination.
This proof-of-concept tool demonstrates the possibility of defeating such rootkits by removing Kernel Native APIs
hooks and restoring the ServiceTable entries back to their original state.
1- MOV EAX, 0ED 2- LEA EDX, DWORD PTR SS:[ESP+4] 3- INT 2E 4- RETN 24The magic number 0ED in line 1 is the Service Number for ZwWriteFile. It will be used to offset into the ServiceTable (System Service Dispatch Table) in kernel-space to locate the address of the function that implements the writefile service. The address of the ServiceTable can be found within the Service Descriptor Table (SDT). The Service Descriptor Table can be referenced using the exported KeServiceDescriptorTable symbol. This is a structure with the following definition.
typedef struct ServiceDescriptorTable {
SDE ServiceDescriptor[4];
} SDT;
typedef struct ServiceDescriptorEntry {
PDWORD ServiceTable;
PDWORD CounterTableBase;
DWORD ServiceLimit;
PBYTE ArgumentTable;
} SDE;
The first member of the structure, SDT.ServiceDescriptor[0].ServiceTable, is an array of function pointers to the service functions. The DWORD value at ServiceTable[0xED] is a function pointer to NtWriteFile, which contains the actual code to write to files, pipes or devices. Hence, to modify the behaviour of the user-space WriteFile API, one simply needs to write a replacement function, load it into kernel space as a driver, and modify ServiceTable[0xED] to point to the replacement function. The replacement function needs to keep the original function pointer (original value of ServiceTable[0xED]) so that it can be called to perform the original defined function. Example One - Process Hiding by Hooking ZwQuerySystemInformation User-space programs can use the ToolHelp APIs to obtain a list of all running processes. The ToolHelp APIs in turn calls the ZwQuerySystemInformation native API exported by ntdll.dll to obtain the list. To hide processes, a kernel-space rootkit, which is loaded as a driver, can modify the function pointer at ServiceTable[0x97] (ZwQuerySystemInformation) to redirect the call to a replacement function. The replacement function first calls the original ZwQuerySystemInformation API to obtain an array containing information of all running process. The returned array is then modified to remove the entry containing the process to be hidden. Finally, the modified result is returned to the user-space program. This effectively prevents the user-space program from "seeing" the hidden process. Example Two - Driver/Module Hiding by Hooking ZwQuerySystemInformation
User-space programs can obtain a list of all loaded drivers using the ZwQuerySystemInformation native API,
specifying SystemModuleInformation as its first parameter. As mentioned earlier, ZwQuerySystemInformation is
exported by ntdll.dll and can be called directly by user-space programs. In kernel-space, the
ZwQuerySystemInformation native API obtains the list of loaded drivers by traversing the PsLoadedModuleList.
A kernel-space rootkit can manipulate the results returned by ZwQuerySystemInformation by modifying
ServiceTable[0x97] (ZwQuerySystemInformation) to point to a replacement fnuction. The replacement function will
first call the original ZwQuerySystemInformation to get an array of all loaded drivers. The driver to be hidden
(i.e. the rootkit) is then removed from the array. This manipulated array is returned to the user-space program.
This POC code restores the values of the ServiceTable entries by writing directly to \device\physicalmemory. Hence, it works entirely in user-space and do not need to load a driver. The following steps describe how the code works.
Screen Dump
This version is tested only on English Win2K SP2 and SP4, WinXP SP0 and SP1.
THIS IS EXPERIMENTAL CODE. FIXING THE SDT MAY HAVE GRAVE CONSEQUENCES, SUCH AS SYSTEM CRASH, DATA LOSS OR
SYSTEM CORRUPTION. IT IS RECOMMENDED THAT YOU USE THIS CODE ONLY ON A TEST SYSTEM. PROCEED AT YOUR OWN RISK.
ContactsFor further enquries or to submit malicious code for our analysis, email them to the following. Overall-in-charge: Tan Chew Keong
|
 |
