Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Security
Guides - Privacy & Security Tips
Windows processes which are significantly important
Message
<blockquote data-quote="Deleted member 65228" data-source="post: 689262"><p>Makes sense IMO. They made csrss.exe a protected process but I am pretty sure when they did this, they adapted lsass.exe to be more responsible with some things probably. I am not sure about older versions of Windows, but lsass.exe now has open handles to running processes just like csrss.exe originally did with sufficient access rights for virtual memory operations.</p><p></p><p><img src="https://snag.gy/iBzomN.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </p><p></p><p>That can be exploited if you can inject into lsass.exe (under circumstances I mentioned earlier you can do it freely) for shell-code injection, no thread creation needed (the handles don't have PROCESS_CREATE_THREAD rights anyway).</p><p></p><p>1. NtAllocateVirtualMemory - allocate memory for shell-code.</p><p>2. NtWriteVirtualMemory - write to the allocated memory to store the shell-code.</p><p></p><p>The injected shell-code would need to:</p><p>1. Execute whatever you needed to execute (instructions).</p><p>2. Return with a trampoline.</p><p></p><p>"Trampoline"? Remotely hook an API. You can find the address of a target API which would be called frequently by lsass.exe -> remotely hook it by pointing execution flow to the address of your shell-code (JMP shellcode_address) -> return for the original call afterwards. The shell-code would handle the memory allocation and byte copy for the trampoline. </p><p></p><p>Targeting NtOpenProcess (NTDLL) would be sufficient because lsass.exe will call it anyway to open handles to processes. It has an open handle to my IDA process and a VMWare process right now (which are active processes of course).</p><p></p><p>No Data Execution Prevention (DEP) exploitation required because you are doing it all remotely, Windows will handle the memory allocation for you with the PAGE_EXECUTE_READWRITE (specify in NtAllocateVirtualMemory). </p><p></p><p>I think this would work. This is just estimation but I think it is interesting and don't see why there'd be an issue with it IMHO.</p></blockquote><p></p>
[QUOTE="Deleted member 65228, post: 689262"] Makes sense IMO. They made csrss.exe a protected process but I am pretty sure when they did this, they adapted lsass.exe to be more responsible with some things probably. I am not sure about older versions of Windows, but lsass.exe now has open handles to running processes just like csrss.exe originally did with sufficient access rights for virtual memory operations. [IMG]https://snag.gy/iBzomN.jpg[/IMG] That can be exploited if you can inject into lsass.exe (under circumstances I mentioned earlier you can do it freely) for shell-code injection, no thread creation needed (the handles don't have PROCESS_CREATE_THREAD rights anyway). 1. NtAllocateVirtualMemory - allocate memory for shell-code. 2. NtWriteVirtualMemory - write to the allocated memory to store the shell-code. The injected shell-code would need to: 1. Execute whatever you needed to execute (instructions). 2. Return with a trampoline. "Trampoline"? Remotely hook an API. You can find the address of a target API which would be called frequently by lsass.exe -> remotely hook it by pointing execution flow to the address of your shell-code (JMP shellcode_address) -> return for the original call afterwards. The shell-code would handle the memory allocation and byte copy for the trampoline. Targeting NtOpenProcess (NTDLL) would be sufficient because lsass.exe will call it anyway to open handles to processes. It has an open handle to my IDA process and a VMWare process right now (which are active processes of course). No Data Execution Prevention (DEP) exploitation required because you are doing it all remotely, Windows will handle the memory allocation for you with the PAGE_EXECUTE_READWRITE (specify in NtAllocateVirtualMemory). I think this would work. This is just estimation but I think it is interesting and don't see why there'd be an issue with it IMHO. [/QUOTE]
Insert quotes…
Verification
Post reply
Top