Comments (4)
here is the hook if you want to try to fix it https://github.com/cuckoosandbox/monitor/blob/7c5854fae12e1f01f56eab2db4008148c790cc7a/sigs/wmi.rst#iwbemservices_execmethod
from monitor.
I compiled a debug version of monitor and resubmitted the sample. In windows xp, I can find this record:
...
Entered IWbemServices_ExecMethod
...
Leaving IWbemServices_ExecMethod
...
That is normal. But it can not be found in windows 7.
I do not known whether the problem is in wmi.rst's hook. I will try to find the key point.
from monitor.
WMI hooks are explicitly enabled by the CoCreateInstance
hook when this api is called passing a CLSID related to the WbemLocator
object. Take a look to:
sigs/ole.rst
**CoCreateInstance
Parameters:
** REFCLSID rclsid clsid
* LPUNKNOWN pUnkOuter
** DWORD dwClsContext class_context
** REFIID riid iid
* LPVOID *ppv
Interesting:
b sizeof(CLSID), rclsid
i class_context
b sizeof(IID), riid
Post:
ole_enable_hooks(rclsid);
and
src/wmi.c
static CLSID our_CLSID_WbemAdministrativeLocator = {
0xcb8555cc, 0x9128, 0x11d1, {0xad,0x9b, 0x00,0xc0,0x4f,0xd8,0xfd,0xff},
};
static CLSID our_CLSID_WbemLocator = {
0x4590f811, 0x1d3a, 0x11d0, {0x89,0x1f, 0x00,0xaa,0x00,0x4b,0x2e,0x24},
};
[...]
void ole_enable_hooks(REFCLSID clsid)
{
if(memcmp(clsid, &our_CLSID_WbemLocator, sizeof(CLSID)) == 0) {
hook_library("__wmi__", NULL);
}
if(memcmp(clsid, &our_CLSID_WbemAdministrativeLocator,
sizeof(CLSID)) == 0) {
hook_library("__wmi__", NULL);
}
}
The execution flow is:
CoCreateInstance(clsid)
called and hooked- In the
Post::
section of the hook you'll find the callole_enable_hooks(clsid)
ole_enabled_hooks
compares the clsid argument with the interesting ones- Enable
__wmi__
hooks if the target clsid is interesting
If you're not finding the IWbemServices_ExecMethod
calls you should:
- Ensure that the
IWbemLocator
related CLSIDs are correct (check the reg keyHKCR/WbemScripting.SWbemLocator/CLSID
in your VM) - Ensure that the
CoCreateInstance
is marked as special in itsSignature::
section - Ensure that the WMI related hooks are marked as special too
The reason for the special marking of the above hooks is that if you're running Office 2010 the call chain should be:
vbe6_Invoke
CoCreateInstance
IWbemServices_ExecMethod
2 and 3 are likely happening as a result of the first call, so if you don't mark them as special the monitor won't hook.
About Special
marking the doc says:
Special:
Mark this API signature as special. Special API signatures are always executed, also when the monitor is already inside another hook. E.g., when executing the system() function we still want to follow the CreateProcessInternalW() function calls in order to catch the process identifier(s) of the child process(es), allowing the monitor to inject into said child process(es).
from monitor.
@baxitaurus Thanks.
This value is for Windows XP:
static CLSID our_CLSID_WbemLocator = {
0x4590f811, 0x1d3a, 0x11d0, {0x89,0x1f, 0x00,0xaa,0x00,0x4b,0x2e,0x24},
};
In Windows 7 x64, It should be:
static CLSID our_CLSID_WbemLocator = {
0x76A64158, 0xCB41, 0x11D1, 0x8B02, {0x8B, 0x02, 0x00, 0x60, 0x08, 0x06, 0xD9, 0xB6},
};
I try to change the win7's reg item value to xp's: {76A64158-CB41-11D1-8B02-00600806D9B6}
to {4590F811-1D3A-11D0-891F-00AA004B2E24}
, but it shows:
Error editing value
Unable to edit: An error occurred while writing the contents of the value
However I'm already an administrator. I'm stuck here.
from monitor.
Related Issues (20)
- Install monitor help HOT 4
- Internal Server Error for url: http:/192.168.56.101:800/mkdtemp HOT 5
- monitor crash. attachment unzip password:virus HOT 6
- Add hook for RtlQueryEnvironmentVariable_U
- Weird output when compiling
- Missing symbol SIG_vbscript_COleScript_Compile_0
- Cuckoo Monitor integration HOT 1
- COleScript::Compile hook not working HOT 4
- Error creating function stub for advapi32!RegOpenKeyExW.
- Inject issue to malware service process by CreateService API HOT 6
- insn hook bug
- Hooking additional functions HOT 3
- Virtual* function hook bug
- Change behaviour by cuckoo monitor HOT 4
- Debugging cuckoo monitor HOT 1
- Monitor leaks memory?
- Export the Sandbox results
- Configuring procmon filter
- Why does the RtlDispatchException function return true?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from monitor.