关注并星标🌟 一起学安全❤️
作者：coleak
首发于公号：渗透测试安全攻防
字数：8052
声明：仅供学习参考，请勿用作违法用途
目录
-
前记
-
blockdlls
-
ACG
-
结论
-
测试代码
-
reference
前记
许多EDR产品常见的操作是将他们的DLL注入到其想监测的进程中，寻找前辈们防注入思路发现大概有以下两种，分别是：
1、PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON会阻止不带微软签名的DLL加载
2、ProcessDynamicCodePolicy禁用了VirtualProtect和分配RWX内存可能会强制阻止一个带微软签名的DLL加载
于是分别测试实战效果(这里仅以普通dll注入，即远程LoadLibrary加载而非创建远程线程)
blockdlls
#include <Windows.h>
int main()
{
STARTUPINFOEXA si = {0};
PROCESS_INFORMATION pi = { 0 };
SIZE_T size = 0;
BOOL ret;
// Required for a STARTUPINFOEXA
si.StartupInfo.cb = sizeof(STARTUPINFOEXA);
// Get the size of our PROC_THREAD_ATTRIBUTE_LIST to be allocated
InitializeProcThreadAttributeList(NULL, 1, 0, &size);
// Allocate memory for PROC_THREAD_ATTRIBUTE_LIST
si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(
GetProcessHeap(),
HEAP_ZERO_MEMORY,
size
);
// Initialise our list
InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &size);
// Enable blocking of non-Microsoft signed DLLs
DWORD64 policy = PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON;
// Assign our attribute
UpdateProcThreadAttribute(si.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, &policy, sizeof(policy), NULL, NULL);
// Finally, create the process
ret = CreateProcessA(
NULL,
(LPSTR)"C:\Windows\System32\notepad.exe",
NULL,
NULL,
true,
EXTENDED_STARTUPINFO_PRESENT,
NULL,
NULL,
reinterpret_cast<LPSTARTUPINFOA>(&si),
&pi
);
}
这里通过UpdateProcThreadAttribute 添加lpAttributeList中PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY属性为PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON，然后创建的进程如图：Only Microsoft signatures are allowed.
有用但是用处不大，因为发现大多数EDR使用Microsoft签名来对抗该策略
ACG
ProcessDynamicCodePolicy is also sometimes called Arbitrary Code Guard (ACG)
ACG是Windows系统的另一个安全策略，具体如下
1、现有代码被修改（代码页不能变为可写）；2、在数据段上写入代码并执行（数据不能变为代码）。即不能申请和修改同时具有写入（W）和执行（X）的权限
#include <iostream>
#include <Windows.h>
#include <processthreadsapi.h>
int main()
{
STARTUPINFOEX si;
DWORD oldProtection;
PROCESS_MITIGATION_DYNAMIC_CODE_POLICY policy;
ZeroMemory(&policy, sizeof(policy));
policy.ProhibitDynamicCode = 1;
void* mem = VirtualAlloc(0, 1024, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (mem == NULL) {
printf("[!] Error allocating RWX memoryn");
}
else {
printf("[*] RWX memory allocated: %pn", mem);
}
printf("[*] Now running SetProcessMitigationPolicy to apply PROCESS_MITIGATION_DYNAMIC_CODE_POLICYn");
// Set our mitigation policy
if (SetProcessMitigationPolicy(ProcessDynamicCodePolicy, &policy, sizeof(policy)) == false) {
printf("[!] SetProcessMitigationPolicy failedn");
return 0;
}
// Attempt to allocate RWX protected memory (this will fail)
mem = VirtualAlloc(0, 1024, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (mem == NULL) {
printf("[!] Error allocating RWX memoryn");
}
else {
printf("[*] RWX memory allocated: %pn", mem);
}
void* ntAllocateVirtualMemory = GetProcAddress(LoadLibraryA("ntdll.dll"), "NtAllocateVirtualMemory");
// Let's also try a VirtualProtect to see if we can update an existing page to RWX
if (!VirtualProtect(ntAllocateVirtualMemory, 4096, PAGE_EXECUTE_READWRITE, &oldProtection)) {
printf("[!] Error updating NtAllocateVirtualMemory [%p] memory to RWXn", ntAllocateVirtualMemory);
}
else {
printf("[*] NtAllocateVirtualMemory [%p] memory updated to RWXn", ntAllocateVirtualMemory);
}
system("pause");
}
[*] RWX memory allocated: 0000018B24D70000
[*] Now running SetProcessMitigationPolicy to apply PROCESS_MITIGATION_DYNAMIC_CODE_POLICY
[!] Error allocating RWX memory
[!] Error updating NtAllocateVirtualMemory [00007FFA9248F660] memory to RWX
尝试本地注入失败，但是远程dll注入和远程创建新线程均可以成功，正如下面所言
But actually, ACG doesn’t block a remote processes ability to call a function such as
VirtualAllocEx.Unfortunately there doesn’t appear to be a way to set the Process Mitigation policy when calling CreateProcess either
看到有研究者说：
许多EDR产品常见的操作是将他们的DLL注入到其监测的进程中，围绕特定的API函数实现用户态hook技术（参考文章）。由于hook技术通常需要修改现有的可执行内存页以添加hook，因此EDR通常需要调用VirtualProtect来更新内存保护。如果我们在恶意软件设计上启用ProcessDynamicCodePolicy可能有助于保护其免受EDR hook的监测
然而并不现实，EDR通常在我们的进程刚启动的时候就已经完成注入和内存修改并进行hook，而我们后续的属性设定操作是在edr的dll注入之后才完成的，并且我们没法在创建之前就设定该属性
结论
签名策略和ACG不太可能帮助防止反病毒供应商的DLL注入，而考虑采取以下措施：
-
Reload the hooked DLL’s from disk -
Modify the injected DLL’s to make sure they don’t take action -
Attempt direct system calls to bypass the hooks
测试代码
a.dll
#include<windows.h>
#include "pch.h"
int a=10;
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
inject.exe
#include <windows.h>
#include <stdio.h>
#include <TlHelp32.h>
typedef FARPROC
(WINAPI
* pGetProcAddress)(
_In_ HMODULE hModule,
_In_ LPCSTR lpProcName
);
typedef HMODULE
(WINAPI
* pLoadLibraryA)(
_In_ LPCSTR lpLibFileName
);
BOOL mydllinject(DWORD pid, LPCTSTR szDllPath);
int main(int argc, char* argv[])
{
DWORD pid = (DWORD)atoi(argv[1]);
printf("%d", pid);
mydllinject(pid, L"a.dll");
system("pause");
return 0;
}
BOOL mydllinject(DWORD pid, LPCTSTR szDllPath)
{
HMODULE hMod = GetModuleHandle(L"kernel32.dll");
pGetProcAddress pThreadProc = (pGetProcAddress)GetProcAddress(hMod, "LoadLibraryW");
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
if (hProcess == NULL)
{
return FALSE;
}
DWORD size = (DWORD)(wcslen(szDllPath) + 1) * sizeof(TCHAR);
LPVOID conAddr = VirtualAllocEx(hProcess, NULL, size, MEM_COMMIT, PAGE_READWRITE);
if (conAddr == NULL)
{
return FALSE;
}
printf("add:%x", conAddr);
int writecon = WriteProcessMemory(hProcess, conAddr, (LPCVOID)szDllPath, size, NULL);
if (writecon == 0)
{
printf("WriteProcessMemory:%dn", GetLastError());
}
HANDLE thred = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pThreadProc, conAddr, 0, NULL);
if (thred == NULL)
{
printf("CreateRemoteThread:%dn", GetLastError());
}
WaitForSingleObject(thred, INFINITE);
}
reference
https://www.cnblogs.com/zha0gongz1/p/15391205.html
https://blog.xpnsec.com/protecting-your-malware/
原文始发于微信公众号（渗透测试安全攻防）：阻止EDR进行dll注入的探索
