本帖最后由 BeneficialWeb 于 2021-11-19 11:14 编辑
PPL进程，一般都是杀软和微软某些进程独有的特征。
我们知道，内核中的对象类型有PsProcessType,PsThreadType,PsJobType等类型。
通过对ObDublicateObject、ObpFilterOperation、ObpCallPreOperationCallbacks、ObpCreateHandle的IDA查看，我们发现了如下类似的代码。
(a1->TypeInfo.ObjectTypeFlags & 0x40) != 0 && a1->CallbackList.Flink != &a1->CallbackList;
紧接着，我们查看一下进程对象的结构体。
0: kd> dt nt!_object_type ffffe78f`93ca8d20
+0x000 TypeList : _LIST_ENTRY [ 0xffffe78f`93ca8d20 - 0xffffe78f`93ca8d20 ]
+0x010 Name : _UNICODE_STRING "Process"
+0x020 DefaultObject : (null)
+0x028 Index : 0x7 ''
+0x02c TotalNumberOfObjects : 0x1f8
+0x030 TotalNumberOfHandles : 0x728
+0x034 HighWaterNumberOfObjects : 0x1f8
+0x038 HighWaterNumberOfHandles : 0x881
+0x040 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0b8 TypeLock : _EX_PUSH_LOCK
+0x0c0 Key : 0x636f7250
+0x0c8 CallbackList : _LIST_ENTRY [ 0xffffd105`77373e40 - 0xffffd105`77373e40 ]
0: kd> dx -id 0,0,ffffe78f93c5d080 -r1 (*((ntkrnlmp!_OBJECT_TYPE_INITIALIZER *)0xffffe78f93ca8d60))
(*((ntkrnlmp!_OBJECT_TYPE_INITIALIZER *)0xffffe78f93ca8d60)) [Type: _OBJECT_TYPE_INITIALIZER]
[+0x000] Length : 0x78 [Type: unsigned short]
[+0x002] ObjectTypeFlags : 0xca [Type: unsigned short]
[+0x002 ( 0: 0)] CaseInsensitive : 0x0 [Type: unsigned char]
[+0x002 ( 1: 1)] UnnamedObjectsOnly : 0x1 [Type: unsigned char]
[+0x002 ( 2: 2)] UseDefaultObject : 0x0 [Type: unsigned char]
[+0x002 ( 3: 3)] SecurityRequired : 0x1 [Type: unsigned char]
[+0x002 ( 4: 4)] MaintainHandleCount : 0x0 [Type: unsigned char]
[+0x002 ( 5: 5)] MaintainTypeList : 0x0 [Type: unsigned char]
[+0x002 ( 6: 6)] SupportsObjectCallbacks : 0x1 [Type: unsigned char] \\ This flag effect the callback function
[+0x002 ( 7: 7)] CacheAligned : 0x1 [Type: unsigned char]
[+0x003 ( 0: 0)] UseExtendedParameters : 0x0 [Type: unsigned char]
[+0x003 ( 7: 1)] Reserved : 0x0 [Type: unsigned char]
通过发现，SupportsObjectCallbacks决定了该内核对象是否支持内核对象回调。
由此，产生了一个想法，我们通过漏洞驱动读写内核，是否就可以绕过ObjectCallback hook 拿到PPL进程的句柄呢？最终通过加载Procexp152.sys和RTCore64.sys 配合使用实现了仓库里的代码。
备注：修改标志位，拿到句柄权限，再改回去，避免PG。
https://github.com/BeneficialCode/KPPL | 
发表于 2021-11-19 11:07
