Windows Hacking Serisi #9 | Frida ile Uygulama İntrospeksiyonu

LONG WINAPI RegOpenKeyEx(
  _In_     HKEY    hKey,       // Handle to the open registry key (commonly the registry hive).
  _In_opt_ LPCTSTR lpSubKey,   // The name of the registry subkey to be opened.
  _In_     DWORD   ulOptions,  // REG_OPTION_OPEN_LINK/NULL.
  _In_     REGSAM  samDesired, // A mask that specifies the desired access rights to the key to be opened.
  _Out_    PHKEY   phkResult   // A pointer to a variable that receives a handle to the opened key.
);

/*
 * Auto-generated by Frida. Please modify to match the signature of RegOpenKeyExW.
 * This stub is currently auto-generated from manpages when available.
 *
 * For full API reference, see: http://www.frida.re/docs/javascript-api/
 */
 
{
  /**
   * Called synchronously when about to call RegOpenKeyExW.
   *
   *  @[URL="https://www.turkhackteam.org/member.php?u=592971"]this[/URL] {object} - Object allowing you to store state for use in onLeave.
   *  @[URL="https://www.turkhackteam.org/member.php?u=531255"]para[/URL]m {function} log - Call this function with a string to be presented to the user.
   *  @[URL="https://www.turkhackteam.org/member.php?u=531255"]para[/URL]m {array} args - Function arguments represented as an array of NativePointer objects.
   * For example use Memory.readUtf8String(args[0]) if the first argument is a pointer to a C string encoded as UTF-8.
   * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
   *  @[URL="https://www.turkhackteam.org/member.php?u=531255"]para[/URL]m {object} state - Object allowing you to keep state across function calls.
   * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
   * However, do not use this to store function arguments across onEnter/onLeave, but instead
   * use "this" which is an object for keeping state local to an invocation.
   */
  onEnter: function (log, args, state) {
    log("[+] RegOpenKeyExW");
    log("¦- hKey: " + args[0]);
    log("¦- lpSubKey: " + args[1]);
    log("¦- ulOptions: " + args[2]);
    log("¦- samDesired: " + args[3]);
    log("¦- PHKEY: " + args[4] + "\n");
  },
 
  /**
   * Called synchronously when about to return from RegOpenKeyExW.
   *
   * See onEnter for details.
   *
   *  @[URL="https://www.turkhackteam.org/member.php?u=592971"]this[/URL] {object} - Object allowing you to access state stored in onEnter.
   *  @[URL="https://www.turkhackteam.org/member.php?u=531255"]para[/URL]m {function} log - Call this function with a string to be presented to the user.
   *  @[URL="https://www.turkhackteam.org/member.php?u=531255"]para[/URL]m {NativePointer} retval - Return value represented as a NativePointer object.
   *  @[URL="https://www.turkhackteam.org/member.php?u=531255"]para[/URL]m {object} state - Object allowing you to keep state across function calls.
   */
  onLeave: function (log, retval, state) {
  }
}

onEnter: function (log, args, state) {
    log(Memory.readUtf16String(args[1]));
}

 onEnter: function (log, args, state) {
    this.SubKey = Memory.readUtf16String(args[1]); //  @[URL="https://www.turkhackteam.org/member.php?u=592971"]this[/URL] is available in onLeave
    if (this.SubKey) {                             // Make sure the value is not null
        if (this.SubKey.indexOf("CLSID") >= 0) {
            this.ContainsCLSID = 1;                // Bool -> contains substring
        }
    }
},
 
onLeave: function (log, retval, state) {
    if (this.ContainsCLSID) {                      // Check Bool
        if (retval != 0){                          // If return value is not ERROR_SUCCESS
            log(this.SubKey);                      // Print subkey
        }
    }
}

// The contents of the RegOpenKeyExW.js
//---------------------------------------------------------
 
onEnter: function (log, args, state) {
    this.SubKey = Memory.readUtf16String(args[1]); //  @[URL="https://www.turkhackteam.org/member.php?u=592971"]this[/URL] is available in onLeave
    if (this.SubKey) {                             // Make sure the value is not null
        if (this.SubKey.indexOf("CLSID") >= 0) {
            this.ContainsCLSID = 1;                // Bool -> contains substring
            this.hSubKey = args[4];
        }
    }
},
 
onLeave: function (log, retval, state) {
    if (this.ContainsCLSID) {                      // Check Bool
        if (retval == 0){                          // If return value is ERROR_SUCCESS
            state.HandleKey = new Array(Memory.readInt(this.hSubKey), this.SubKey);
        }                                          //  @[URL="https://www.turkhackteam.org/member.php?u=56213"]state[/URL] persists across API calls
                                                   // We create an array with the handle & path
    }
}
 
// The contents of the RegQueryValueExW.js
//---------------------------------------------------------
onEnter: function (log, args, state) {
    if (state.HandleKey) {                         // Check our array exists
        if (state.HandleKey[0] == args[0]) {       // Compare stored handle with the new handle
            if (Memory.readUtf16String(args[1])) { // Make sure the value is not null
                log("[+] hKey: " + state.HandleKey[0] + "; Path: " + state.HandleKey[1]);
                log("¦- KeyValue: " + Memory.readUtf16String(args[1]) + "\n");
                state.HandleKey = null;            // We null here to clear the array
            }
        }
    }
},
 
onLeave: function (log, retval, state) {
}

using System;
using System.Runtime.InteropServices;
using System.Windows.Forms;
 
namespace msgbox
{
    public partial class Form1 : Form
    {
        // Unmanaged MessageBoxA import
        [DllImport("user32.dll")]
        public static extern int MessageBox(
            IntPtr hWnd,
            String lpText,
            String lpCaption,
            UInt32 uType);
 
        public Form1()
        {
            InitializeComponent();
        }
 
        private **** button1_Click(object sender, EventArgs e)
        {
            // Grab our textbox inputs
            String lpText = textBox1.Text;
            String lpCaption = textBox2.Text;
            UInt32 uType = Convert.ToUInt32(textBox3.Text);
 
            MessageBox(IntPtr.Zero, lpText,lpCaption,uType);
        }
    }
}

onEnter: function (log, args, state) {
    log("[+] MessageBoxA");
    log("¦- hWnd: " + args[0]);
    log("¦- lpText: " + Memory.readAnsiString(args[1]));
    log("¦- lpCaption: " + Memory.readAnsiString(args[2]));
    log("¦- uType: " + args[3] + "\n");
},
 
onLeave: function (log, retval, state) {
}

onEnter: function (log, args, state) {
    log("");
    log("[+] MessageBoxA");
    log("¦- hWnd: " + args[0]);
    log("¦- lpText: " + Memory.readAnsiString(args[1]));
    log("¦- lpCaption: " + Memory.readAnsiString(args[2]));
    log("¦- uType: " + args[3] + "\n");
     
    // uType hook
    if (args[3] == 6) {
        log("[!] Hooking uType: 6 -> 0");
        args[3] = ptr(0); // Overwrite uType with NativePointer(0)
    }
     
    // lpText hook
    if (Memory.readAnsiString(args[1]) == "Bob") {
        log("[!] Hooking lpText: Bob -> Alice");
        this.lpText = Memory.allocAnsiString("Alice"); // Allocate new heap ANSI string
        args[1] = this.lpText; // Replace lpText pointer
    }
},
 
onLeave: function (log, retval, state) {
}

NTSTATUS WINAPI NtQuerySystemInformation(
  _In_      UINT   SystemInformationClass,  // SYSTEM_INFORMATION_CLASS
  _Inout_   P****  SystemInformation,       // A pointer to a buffer that receives the requested information
  _In_      ULONG  SystemInformationLength, // Byte count allocated for the request
  _Out_opt_ PULONG ReturnLength             // Pointer to the variable to receives the output size
);

SystemInformationClass => SystemProcessInformation = 0x5
SystemInformation => Pointer, eg 0x11223344556 -----------------------|
                                                                      |
                                                                      |
                                                                      |
                                           [Points at an array of SYSTEM_PROCESS_INFORMATION Structs]
                                                                      |
                                                                      |
                    |-------------------------------------------------|
                    |
 |--------------------------------------|
 | [Int]NextEntryOffset (eg:0x1fb)      |  -------------------->
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 | [UNICODE_STRING]ImageName            |                      |      [2nd Entry = 1st Entry + 0x1fb]
 |   |-> svchost.exe                    |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 | SYSTEM_THREAD_INFORMATION structs    |                      |
 |--------------------------------------|                      |
 | [Int]NextEntryOffset (eg:0x222)      |  <------------------->
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 | [UNICODE_STRING]ImageName            |                      |      [3rd Entry = 2nd Entry + 0x222]
 |   |-> powershell.exe                 |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 | SYSTEM_THREAD_INFORMATION structs    |                      |
 |--------------------------------------|                      |
 | [Int]NextEntryOffset (eg:0x3a0)      |  <------------------->
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 | [UNICODE_STRING]ImageName            |                      |      [4th Entry = 3rd Entry + 0x3a0]
 |   |-> notepad.exe                    |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 | SYSTEM_THREAD_INFORMATION structs    |                      |
 |--------------------------------------|                      |
                                           .....  <------------>

|--------------------------------------|
 | [Int]NextEntryOffset (eg:0x1fb 0x41d)|  -------------------->
 |                               I      |                      |
 |                               I      |                      |
 |                               I      |                      |
 |              .......          I==================================> [3nd Entry = 1st Entry + 0x1fb + 0x222
 |                                      |                      |       => 1st Entry + 0x41d]
 |                                      |                      |
 |                                      |                      |
 | [UNICODE_STRING]ImageName            |                      |
 |   |-> svchost.exe                    |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 | SYSTEM_THREAD_INFORMATION structs    |                      |
 |--------------------------------------|                      |
 | [Int]NextEntryOffset (eg:0x222)      |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 | [UNICODE_STRING]ImageName            |                      |
 |   |-> powershell.exe                 |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 | SYSTEM_THREAD_INFORMATION structs    |                      |
 |--------------------------------------|                      |
 | [Int]NextEntryOffset (eg:0x3a0)      |  <------------------->
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 | [UNICODE_STRING]ImageName            |                      |      [4th Entry = 3rd Entry + 0x3a0]
 |   |-> notepad.exe                    |                      |
 |                                      |                      |
 |                                      |                      |
 |                                      |                      |
 |              .......                 |                      |
 |                                      |                      |
 |                                      |                      |
 | SYSTEM_THREAD_INFORMATION structs    |                      |
 |--------------------------------------|                      |
                                           .....  <------------>

onEnter: function (log, args, state) {
    if (args[0] == 5) {
        log("NtQuerySystemInformation:");
        log("  --> Class : " + args[0] + " [SystemProcessInformation]");
        log("  --> Addr  : " + args[1]);
        log("  --> len   : " + args[2]);
        log("  --> Retlen: " + Memory.readInt(args[3]) + "\n");
         
        this.IsProcInfo = 1;
        this.Address = args[1];
    }
},
 
onLeave: function (log, retval, state) {
    if (this.IsProcInfo) {
        while (true) {
            // Get struct offsets
            var ImageOffset = ptr(this.Address).add(64); // ImageName->UNICODE_STRING->Buffer
            var ImageName = Memory.readPointer(ImageOffset); // Cast as ptr
            var ProcID = ptr(this.Address).add(80); // PID
             
            // If PowerShell, rewrite the linked list
            if (Memory.readUtf16String(ImageName) == "powershell.exe") {
                log("[!] Hooking to hide PowerShell..");
                log("  --> Rewriting linked list\n");
                this.PreviousStruct = ptr(this.Address).sub(NextEntryOffset);
                Memory.writeInt(this.PreviousStruct, (Memory.readInt(this.PreviousStruct)+Memory.readInt(this.Address)))
            }
     
            // Move pointer to next struct
            var NextEntryOffset = Memory.readInt(this.Address);
            this.Address = ptr(this.Address).add(NextEntryOffset);
            if (NextEntryOffset == 0) { // The last struct has a NextEntryOffset of 0
                break
            }
        }
         
        // Null
        this.IsProcInfo = 0;
    }
}