CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseContext CryptCATAdminAcquireContext • 验证文件的签名(主API) WinVerifyTrust // http://msdn.microsoft.com/en-us/library/windows/desktop/aa388208(v=vs.85).aspx ilRet := WinVerifyTrust WTrustData.hWVTStateData); // 释放 WTrustData.dwStateAction := WTD_STATEACTION_CLOSE; WinVerifyTrust
WinVerifyTrust+0x52 (FPO: [Non-Fpo]) 0452de94 76f7bd71 00000000 0452df80 0452df18 urlmon! Cwvt::WinVerifyTrust+0x1d (FPO: [Non-Fpo]) (CONV: thiscall) [d:\w7rtm\inetcore\urlmon\download\wvtp.h
这是通过利用跟踪为CVE-2013-3900的已知问题(一种 WinVerifyTrust 签名验证漏洞)实现的,该漏洞允许远程攻击者通过对文件进行足够细微的更改而通过特制的便携式可执行文件执行任意代码
ProgramData%\Microsoft\Windows Defender\Platform\10.18.3009.5-0\MpSvc.dll(mpsvc.dll 必须是一个目录,这样我们才能导致 WinVerifyTrust
OpenProcess(防止打开其他进程) CreateThread CreateProcess WinHttpOpen(禁用SSL) getaddrinfo(DNS攻击) DeleteFileW(防止用户删除文件) WinVerifyTrust
) KB3054205 https://support.microsoft.com/kb/3054205 After you install this update, SIPs enable the WinVerifyTrust
winTrustData.pFile = &fileInfo; GUID policyGUID = WINTRUST_ACTION_GENERIC_VERIFY_V2; LONG status = WinVerifyTrust (NULL, &policyGUID, &winTrustData); winTrustData.dwStateAction = WTD_STATEACTION_CLOSE; WinVerifyTrust
在我尝试弄明白这些文件能否被远程替换之前,Dnet建议我先植入一个使用非趋势公司签名的二进制文件,经过快速测试,我决定使用TotalCommander安装程序,它由一个默认被WinVerifyTrust
DLL签名验证: 验证加载的DLL是否有有效的数字签名 使用SigVerify或WinVerifyTrust API验证签名 只信任可靠的发布者 3.