Forum Replies Created
-
Posts
-
Since the dissassembler can’t locate the functions in the dissassembly, please suggest some other way of reversing the dll ?
The DLL can be packed and disassembler can’t decode it without additional effort. However, many things depends from the disassembler you use and particular BHO.
Any further info on this method of attack, that is, how can someone remotely inject BHOs(browser helper objects) into my browser ?
BHO is an in-process COM object and it should be registered as any normal COM object plus it has to create several registry entries specific to BHO. So if the particular BHO was not installed by you, then someone has managed to remotely execute installation code on your system.
Hmm, you mean that HL server reports its IP addresses to master server? If so then probably VirtNet adapter with assigned external IP address is a solution. In any case you will also need the correct port mapping on NAT device.
The problem may appear if HL server reports only one IP address (from which it communicate to master server).
– Must i set MAC address identical to physical network card ? i think yes
I think no, MAC address for VirtNet does not really makes sense because this adapter never really sends/receives packets.
– How frames are routed/dispatch between the 2 addresses
If you have got configured port mapping on NAT device you will receive packets to 192.168.2.200 and you don’t really need to care about routing.
– Is the Virtual IP is knowne from router. In this case have i to forward incoming frames to Virtual IP rather than 192.168.2.200
Don’t understand what you mean.
– Have i set new routes on server and/or router
I have already mentioned port mapping required on NAT device.
And the wwwcensor.exe doesn’t works in my computer to block a url. It doens’t stop the navigate.
It worked fine for me and not only for me. Do other samples work fine on your system? How do you actually use use it?
Could you send me a sample how to do this?
wwwcensor demonstrates URL/content filtering for HTTP protocol. It blocks any HTTP packets containing the command line specified keyword. An example, to block access to yahoo.com it should be used as below:
D:…dsntkvpnsamplesMSVCbinamd64>wwwcensor.exe
Command line syntax:
wwwcensor.exe pattern
pattern – phrase or word to block HTTP packets with.D:…dsntkvpnsamplesMSVCbinamd64>wwwcensor.exe yahoo
TCP 192.168.1.179:29627 -> 87.248.113.14:80 pattern found & packet dropped
TCP 192.168.1.179:29627 -> 87.248.113.14:80 pattern found & packet dropped
TCP 192.168.1.179:29627 -> 87.248.113.14:80 pattern found & packet dropped
TCP 192.168.1.179:29627 -> 87.248.113.14:80 pattern found & packet droppedNote, that it also blocks any packet containing “yahoo” word, not only packets to/from yahoo.com.
If ONLY URL filtering is required then you have two options:
1) Block DNS requests for the forbidden sites (this does not allow your system to figure out the IP address and access the site).
2) Parse HTTP packets for GET request and block packet if it requests the forbidden URL.An example, every registered COM DLL have a relative registry entry. It may happen that the COM DLL is removed from disk but the registry entry still exists. So you take the registry entry and check if it points to the existing DLL, if not then this registry entry is invalid.
Probably you are right and the mentioned tool monitors the process behavior and imported/used Win32 API. An example, not every normal process uses CreateRemoteThread.
Hmm, you can bypass Win32 and use native API. You can even rewrite some Winn32 APIs through another ones. However, there is no way for user mode application to do anything without somehow calling the kernel.
Though you don’t really need to import ntdll.dll functions, but use INT 2E (SYSCALL/SYSENTER) directly to call kernel services. Probably this is what mentioned in the quote you posted.
If the file was opened in non shared mode then you won’t be able to access it from another process using Win32 API. However, you still can open the volume device in raw mode (bypassing the filesystem) and read sectors containing file data.
You can use file system filter driver to monitor all file operations. However, in case of Windows message you have mentioned – it rather implemented in the Windows Explorer and you will be able to remove those files through the command line or another file manager.
Since officially MS does provide tools for extending Windows with new subsystems the task looks very non trivial (if possible at all without having the access to the complete source code).
Among VB samples in WinpkFilter package you can find PassThru. This is basic sample to filter (drop, pass, modify) the network packets.
May be the reason is in the loopback packet indication. You see packet twice, one time when it is sent and second time when it is indicated back by NDIS (loopback indication) to installed protocols. This is just a version, because I have no idea how you emulate packets on VirtNet.
Internet Gateway can be installed on Windows XP in two variants, with NDIS hooking driver or NDIS IM driver. As I can see from log you have chosen to install NDIS IM driver, however have not you installed WinpkFilter run time before on this system? Or Internet Gateway with NDIS hooking driver selected?
Testing WinpkFilter 3.0.4 on Windows Vista x64 SP1 have not discovered any problems.
Probably you have experienced some software conflict or installation went wrong because of Driver Signing policy.
What do you actually mean under “access”? Address? If so then you have to parse PE header as usual to get imports table address.
