Esempio n. 1
0
 def start(self):
     proc_info = PROCESSENTRY32()
     proc_info.dwSize = sizeof(PROCESSENTRY32)
     snapshot = KERNEL32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
     flag = KERNEL32.Process32First(snapshot, byref(proc_info))
     pid = 0
     while flag:
         if proc_info.sz_exeFile == b"lsass.exe":
             pid = proc_info.th32ProcessID
             log.info("lsass.exe found, pid %d", pid)
             flag = 0
         flag = KERNEL32.Process32Next(snapshot, byref(proc_info))
     if not pid:
         log.warning("Unable to find lsass.exe process")
         return
     try:
         p = Process(options=self.options, config=self.config, pid=pid)
         filepath = p.get_filepath()
         p.inject(injectmode=0, interest=filepath, nosleepskip=True)
     except CuckooError as e:
         if "process access denied" in e.message:
             log.warning("You're not running the Agent as Administrator")
         else:
             log.warning(
                 "An unknown error occurred while trying to inject into the lsass.exe process to dump TLS master secrets: %s",
                 e,
             )
     del self.options["tlsdump"]
Esempio n. 2
0
    def kernel_analyze(self):
        """zer0m0n kernel analysis
        """
        log.info("Starting kernel analysis")
        log.info("Installing driver")
        if is_os_64bit():
            sys_file = os.path.join(os.getcwd(), "dll", "zer0m0n_x64.sys")
        else:
            sys_file = os.path.join(os.getcwd(), "dll", "zer0m0n.sys")
        exe_file = os.path.join(os.getcwd(), "dll", "logs_dispatcher.exe")
        if not sys_file or not exe_file or not os.path.exists(
                sys_file) or not os.path.exists(exe_file):
            log.warning(
                "No valid zer0m0n files to be used for process with pid %d, injection aborted",
                self.pid)
            return False

        exe_name = service_name = driver_name = random_string(6)

        inf_data = ('[Version]\r\n'
                        'Signature = "$Windows NT$"\r\n'
                        'Class = "ActivityMonitor"\r\n'
                        'ClassGuid = {{b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}}\r\n'
                        'Provider = %Prov%\r\n'
                        'DriverVer = 22/01/2014,1.0.0.0\r\n'
                        'CatalogFile = %DriverName%.cat\r\n'
                    '[DestinationDirs]\r\n'
                        'DefaultDestDir = 12\r\n'
                        'MiniFilter.DriverFiles = 12\r\n'
                    '[DefaultInstall]\r\n'
                        'OptionDesc = %ServiceDescription%\r\n'
                        'CopyFiles = MiniFilter.DriverFiles\r\n'
                    '[DefaultInstall.Services]\r\n' \
                        'AddService = %ServiceName%,,MiniFilter.Service\r\n'
                    '[DefaultUninstall]\r\n'
                        'DelFiles = MiniFilter.DriverFiles\r\n'
                    '[DefaultUninstall.Services]\r\n'
                        'DelService = %ServiceName%,0x200\r\n'
                    '[MiniFilter.Service]\r\n'
                        'DisplayName = %ServiceName%\r\n'
                        'Description = %ServiceDescription%\r\n'
                        'ServiceBinary = %12%\\%DriverName%.sys\r\n'
                        'Dependencies = "FltMgr"\r\n'
                        'ServiceType = 2\r\n'
                        'StartType = 3\r\n'
                        'ErrorControl = 1\r\n'
                        'LoadOrderGroup = "FSFilter Activity Monitor"\r\n'
                        'AddReg = MiniFilter.AddRegistry\r\n'
                    '[MiniFilter.AddRegistry]\r\n'
                        'HKR,,"DebugFlags",0x00010001 ,0x0\r\n'
                        'HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance%\r\n'
                        'HKR,"Instances\\"%Instance1.Name%,"Altitude",0x00000000,%Instance1.Altitude%\r\n'
                        'HKR,"Instances\\"%Instance1.Name%,"Flags",0x00010001,%Instance1.Flags%\r\n'
                    '[MiniFilter.DriverFiles]\r\n'
                        '%DriverName%.sys\r\n'
                    '[SourceDisksFiles]\r\n'
                        '{driver_name}.sys = 1,,\r\n'
                    '[SourceDisksNames]\r\n'
                        '1 = %DiskId1%,,,\r\n'
                    '[Strings]\r\n'
                        'Prov = "{random_string8}"\r\n'
                        'ServiceDescription = "{random_string12}"\r\n'
                        'ServiceName = "{service_name}"\r\n'
                        'DriverName = "{driver_name}"\r\n'
                        'DiskId1 = "{service_name} Device Installation Disk"\r\n'
                        'DefaultInstance = "{service_name} Instance"\r\n'
                        'Instance1.Name = "{service_name} Instance"\r\n'
                        'Instance1.Altitude = "370050"\r\n'
                        'Instance1.Flags = 0x0'
                    ).format(
                        service_name=service_name, driver_name=driver_name, random_string8=random_string(8), random_string12=random_string(12)
                    )

        new_inf = os.path.join(os.getcwd(), "dll",
                               "{0}.inf".format(service_name))
        new_sys = os.path.join(os.getcwd(), "dll",
                               "{0}.sys".format(driver_name))
        copy(sys_file, new_sys)
        new_exe = os.path.join(os.getcwd(), "dll", "{0}.exe".format(exe_name))
        copy(exe_file, new_exe)
        log.info("[-] Driver name : " + new_sys)
        log.info("[-] Inf name : " + new_inf)
        log.info("[-] Application name : " + new_exe)
        log.info("[-] Service : " + service_name)

        fh = open(new_inf, "w")
        fh.write(inf_data)
        fh.close()

        os_is_64bit = is_os_64bit()
        if os_is_64bit:
            wow64 = c_ulong(0)
            KERNEL32.Wow64DisableWow64FsRedirection(byref(wow64))

        os.system(
            'cmd /c "rundll32 setupapi.dll, InstallHinfSection DefaultInstall 132 '
            + new_inf + '"')
        os.system("net start " + service_name)

        si = STARTUPINFO()
        si.cb = sizeof(si)
        pi = PROCESS_INFORMATION()
        cr = CREATE_NEW_CONSOLE

        ldp = KERNEL32.CreateProcessW(new_exe, None, None, None, None, cr,
                                      None, os.getenv("TEMP"), byref(si),
                                      byref(pi))
        if not ldp:
            if os_is_64bit:
                KERNEL32.Wow64RevertWow64FsRedirection(wow64)
            log.error("Failed starting " + exe_name + ".exe.")
            return False

        config_path = os.path.join(os.getenv("TEMP"), "%s.ini" % self.pid)
        with open(config_path, "w") as config:
            cfg = Config("analysis.conf")

            config.write("host-ip={0}\n".format(cfg.ip))
            config.write("host-port={0}\n".format(cfg.port))
            config.write("pipe={0}\n".format(PIPE))

        log.info("Sending startup information")
        hFile = KERNEL32.CreateFileW(PATH_KERNEL_DRIVER,
                                     GENERIC_READ | GENERIC_WRITE, 0, None,
                                     OPEN_EXISTING, 0, None)
        if os_is_64bit:
            KERNEL32.Wow64RevertWow64FsRedirection(wow64)
        if hFile:
            p = Process(pid=os.getpid())
            ppid = p.get_parent_pid()
            pid_vboxservice = 0
            pid_vboxtray = 0

            # get pid of VBoxService.exe and VBoxTray.exe
            proc_info = PROCESSENTRY32()
            proc_info.dwSize = sizeof(PROCESSENTRY32)

            snapshot = KERNEL32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
            flag = KERNEL32.Process32First(snapshot, byref(proc_info))
            while flag:
                if proc_info.sz_exeFile == "VBoxService.exe":
                    log.info("VBoxService.exe found !")
                    pid_vboxservice = proc_info.th32ProcessID
                    flag = 0
                elif proc_info.sz_exeFile == "VBoxTray.exe":
                    pid_vboxtray = proc_info.th32ProcessID
                    log.info("VBoxTray.exe found !")
                    flag = 0
                flag = KERNEL32.Process32Next(snapshot, byref(proc_info))
            bytes_returned = c_ulong(0)
            msg = str(self.pid) + "_" + str(ppid) + "_" + str(
                os.getpid()) + "_" + str(pi.dwProcessId) + "_" + str(
                    pid_vboxservice) + "_" + str(pid_vboxtray) + '\0'
            KERNEL32.DeviceIoControl(hFile, IOCTL_PID, msg, len(msg), None, 0,
                                     byref(bytes_returned), None)
            msg = os.getcwd() + '\0'
            KERNEL32.DeviceIoControl(hFile,
                                     IOCTL_CUCKOO_PATH, str(msg, 'utf-8'),
                                     len(str(msg, 'utf-8')), None, 0,
                                     byref(bytes_returned), None)
        else:
            log.warning("Failed to access kernel driver")

        return True