📄 创建svchost_exe调用的服务原理与实践.htm
字号:
pop
ebx<BR>.text:0100157F
pop
ecx<BR>.text:01001580
retn 8<BR>.text:01001580 FuncServiceMain endp ; sp
= -8<BR>; ============================== FuncServiceMain() end
========================================<BR><BR><BR>由于svchost已经调用了StartServiceCtrlDispatcher来服务调度函数，因此我们在实现DLL实现时就不用了，这主要是因为一个进程只能调用一次StartServiceCtrlDispatcher
API。但是需要用 RegisterServiceCtrlHandler
来注册响应控制请求的函数。最后我们的DLL接收的都是unicode字符串。<BR><BR>由于这种服务启动后由svchost加载，不增加新的进程，只是svchost的一个DLL，而且一般进行审计时都不会去HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Svchost
检查服务组是否变化，就算去检查，也不一定能发现异常，因此如果添加一个这样的DLL后门，伪装的好，是比较隐蔽的。<BR><BR><BR>4.
安装服务与设置<BR>要通过svchost调用来启动的服务，就一定要在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Svchost下有该服务名，这可以通过如下方式来实现：<BR>1）
添加一个新的服务组，在组里添加服务名<BR>2） 在现有组里添加服务名<BR>3）
直接使用现有服务组里的一个服务名，但本机没有安装的服务<BR>4）
修改现有服务组里的现有服务，把它的ServiceDll指向自己<BR><BR>其中前两种可以被正常服务使用，如使用第1种方式，启动其服务要创建新的svchost进程；第2种方式如果该组服务已经运行，安装后不能立刻启动服务，因为svchost启动后已经把该组信息保存在内存里，并调用API
StartServiceCtrlDispatcher()
为该组所有服务注册了调度处理函数，新增加的服务不能再注册调度处理函数，需要重起计算机或者该组的svchost进程。而后两种可能被后门使用，尤其是最后一种，没有添加服务，只是改了注册表里一项设置，从服务管理控制台又看不出来，如果作为后门还是很隐蔽的。比如EventSystem服务，缺省是指向es.dll，如果把ServiceDll改为EventSystem.dll就很难发现。<BR><BR>因此服务的安装除了调用CreateService()创建服务之外，还需要设置服务的ServiceDll，如果使用前2种还要设置svchost的注册表选项，在卸载时也最好删除增加的部分。<BR><BR>具体代码参见后边的附例（使用的是方法3）。<BR><BR>注：
ImagePath 和ServiceDll
是ExpandString不是普通字符串。因此如果使用.reg文件安装时要注意。<BR><BR><BR>5.
DLL服务实现<BR>DLL程序的编写比较简单，只要实现一个ServiceMain()函数和一个服务控制程序，在ServiceMain()函数里用RegisterServiceCtrlHandler()注册服务控制程序，并设置服务的运行状态就可以了。<BR><BR>另外，因为此种服务的安装除了正常的CreateService()之外，还要进行其他设置，因此最好实现安装和卸载函数。
<BR><BR>为了方便安装，实现的代码提供了InstallService()函数进行安装，这个函数可以接收服务名作为参数（如果不提供参数，就使用缺省的iprip），如果要安装的服务不在svchost的netsvcs组里安装就会失败；如果要安装的服务已经存在，安装也会失败；安装成功后程序会配置服务的ServiceDll为当前Dll。提供的UninstallService()函数，可以删除任何函数而没有进行任何检查。<BR><BR>为了方便使用rundll32.exe进行安装，还提供了RundllInstallA()和RundllUninstallA()分别调用InstallService()及UninstallService()。因为rundll32.exe使用的函数原型是：<BR>void
CALLBACK FunctionName(<BR> HWND
hwnd, // handle to owner
window<BR> HINSTANCE hinst, // instance handle for
the DLL<BR> LPTSTR lpCmdLine, // string the DLL will
parse<BR> int nCmdShow //
show state<BR>);<BR>对应的命令行是rundll32 DllName,FunctionName [Arguments]
<BR><BR>DLL服务本身只是创建一个进程，该程序命令行就是启动服务时提供的第一个参数，如果未指定就使用缺省的svchostdll.exe。启动服务时如果提供第二个参数，创建的进程就是和桌面交互的。<BR><BR>具体代码参见后边的附例8，源代码和DLL文件请到<A
href="http://www.binglesite.net/"
target=_blank>http://www.binglesite.net/</A>下载。<BR><BR>//main service
process function<BR>void __stdcall ServiceMain( int argc, wchar_t* argv[]
);<BR>//report service stat to the service control manager<BR>int TellSCM(
DWORD dwState, DWORD dwExitCode, DWORD dwProgress );<BR>//service control
handler, call back by service control manager<BR>void __stdcall
ServiceHandler( DWORD dwCommand );<BR>//RealService just create a process
<BR>int RealService(char *cmd, int bInteract);<BR><BR>//Install this dll
as a Service host by svchost.exe, service name is given by caller<BR>int
InstallService(char *name);<BR>//unInstall a Service, be CARE FOR call
this to delete a service<BR>int UninstallService(char *name);<BR>//Install
this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to
call<BR>void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char
*param, int nCmdShow);<BR>//unInstall a Service used by RUNDLL32.EXE to
call, be CARE FOR call this to delete a service<BR>void CALLBACK
RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int
nCmdShow);<BR><BR>//output the debug infor into log file(or stderr if a
console program call me) & DbgPrint<BR>void OutputString( char *lpFmt,
... );<BR><BR><BR>6. 代码使用<BR>C:\>tlist -s<BR> 0 System
Process<BR> 8 System<BR>240
services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation,
LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi<BR>504
svchost.exe Svcs: RpcSs<BR>1360
svchost.exe
Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv<BR><BR>C:\>rundll32
svchostdll.dll,RundllInstall abcd<BR>SvcHostDLL: DllMain called
DLL_PROCESS_ATTACH<BR>you specify service name not in Svchost\netsvcs,
must be one of following:<BR>- EventSystem<BR>- Ias<BR>- Iprip<BR>-
Irmon<BR>- Netman<BR>- Nwsapagent<BR>- Rasauto<BR>- Rasman<BR>-
Remoteaccess<BR>- SENS<BR>- Sharedaccess<BR>- Tapisrv<BR>- Ntmssvc<BR>-
wzcsvc<BR><BR>C:\>rundll32 svchostdll.dll,RundllInstall
IPRIP<BR>SvcHostDLL: DllMain called
DLL_PROCESS_ATTACH<BR>CreateService(IPRIP) SUCCESS. Config it<BR>Config
service IPRIP ok.<BR><BR>C:\>sc start iprip "cmd /k whoami" 1<BR>NT
AUTHORITY\SYSTEM<BR><BR>SvcHostDLL: ServiceMain(3, IPRIP)
called<BR>SvcHostDLL: RealService called 'cmd /k whoami'
Interact<BR>SvcHostDLL: CreateProcess(cmd /k whoami) to
640<BR><BR>C:\>tlist -s<BR> 0 System
Process<BR> 8 System<BR>240
services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation,
LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi<BR>504
svchost.exe Svcs: RpcSs<BR>640
cmd.exe Title:
C:\WINNT\System32\cmd.exe<BR>1360 svchost.exe
Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv,IPRIP<BR><BR>C:\>net
stop iprip<BR>The IPRIP service was stopped
successfully.<BR><BR>C:\>rundll32 svchostdll.dll,RundllUninstall
iprip<BR>DeleteService(IPRIP) SUCCESS.<BR><BR><BR>7. 参考<BR><BR>Platform
SDK: Tools - Rundll32<BR>1） Inside Win32 Services, Part 2 by: Mark
Russinovich, at: <A
href="http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3"
target=_blank>http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3</A><BR>2）
Platform SDK: Tools - Rundll32, at: <A
href="http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp"
target=_blank>http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp</A><BR><BR> 2003/8<BR><BR><BR>8.
代码<BR>// SvcHostDLL.cpp : Demo for a service dll used by svchost.exe to
host it.<BR>//<BR>// for detail comment see articles.<BR>// by
bingle_at_email.com.cn<BR>// <A
href="http://www.binglesite.net/"
target=_blank>http://www.binglesite.net/</A><BR>//<BR>/* save following as
a .def file to export function, only ServiceMain is needed.<BR>other used
to install & uninstall service.<BR>or use /EXPORT: link option to
export
them.<BR><BR>EXPORTS<BR> ServiceMain<BR> InstallService<BR> UninstallService<BR> RundllUninstallA<BR> RundllInstallA<BR>*/<BR>/*<BR>To
compile & link: <BR>cl /MD /GX /LD svchostdll.cpp /link advapi32.lib
/DLL /base:0x71000000 /export:ServiceMain /EXPORT:RundllUninstallA
/EXPORT:RundllInstallA /EXPORT:InstallService
/EXPORT:UninstallService<BR>*/<BR><BR>//<BR>// Articles:<BR>//
1. HOWTO Create a service dll used by svchost.exe by bingle, at: <A
href="http://www.binglesite.net/article/svchost-dll-service.html"
target=_blank>http://www.BingleSite.net/article/svchost-dll-service.html</A><BR>//
2. Inside Win32 Services, Part 2 by: Mark Russinovich, at: <A
href="http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3"
target=_blank>http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3</A><BR>//
3. Platform SDK: Tools - Rundll32, at: <A
href="http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp"
target=_blank>http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp</A><BR><BR>#include
<stdio.h><BR>#include <time.h><BR>#include
<assert.h><BR>#include <windows.h><BR><BR>#define
DEFAULT_SERVICE "IPRIP"<BR>#define MY_EXECUTE_NAME
"SvcHostDLL.exe"<BR><BR>//main service process function<BR>void __stdcall
ServiceMain( int argc, wchar_t* argv[] );<BR>//report service stat to the
service control manager<BR>int TellSCM( DWORD dwState, DWORD dwExitCode,
DWORD dwProgress );<BR>//service control handler, call back by service
control manager<BR>void __stdcall ServiceHandler( DWORD dwCommand
);<BR>//RealService just create a process <BR>int RealService(char *cmd,
int bInteract);<BR><BR>//Install this dll as a Service host by
svchost.exe, service name is given by caller<BR>int InstallService(char
*name);<BR>//unInstall a Service, be CARE FOR call this to delete a
service<BR>int UninstallService(char *name);<BR>//Install this dll as a
Service host by svchost.exe, used by RUNDLL32.EXE to call<BR>void CALLBACK
RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int
nCmdShow);<BR>//unInstall a Service used by RUNDLL32.EXE to call, be CARE
FOR call this to delete a service<BR>void CALLBACK RundllUninstallA(HWND
hwnd, HINSTANCE hinst, char *param, int nCmdShow);<BR><BR>//output the
debug infor into log file(or stderr if a console program call me) &
DbgPrint<BR>void OutputString( char *lpFmt, ... );<BR><BR><BR>//dll module
handle used to get dll path in InstallService<BR>HANDLE hDll =
NULL;<BR>//Service HANDLE & STATUS used to get service
state<BR>SERVICE_STATUS_HANDLE hSrv;<BR>DWORD dwCurrState;<BR><BR><BR>BOOL
APIENTRY DllMain( HANDLE hModule,
<BR>
DWORD ul_reason_for_call,
<BR>
LPVOID
lpReserved<BR>
)<BR>{<BR> switch
(ul_reason_for_call)<BR> {<BR> case
DLL_PROCESS_ATTACH:<BR> hDll
= hModule;<BR>#ifdef
_DEBUG<BR> AllocConsole();<BR> OutputString("SvcHostDLL:
DllMain called
DLL_PROCESS_ATTACH");<BR> break;<BR><BR> case
DLL_THREAD_ATTACH:<BR> OutputString("SvcHostDLL:
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -