-
Notifications
You must be signed in to change notification settings - Fork 11
/
hash.py
executable file
·147 lines (141 loc) · 6.37 KB
/
hash.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
#!/usr/bin/python2.7
#=============================================================================#
# This script can detect hash collisions between exported API functions in
# multiple modules by either scanning a directory tree or just a single module.
# This script can also just output the correct hash value for any single API
# function for use with the 'api_call' function in 'block_api.asm'.
#
# Example: Detect fatal collisions against all modules in the C drive:
# >hash.py /dir c:\
#
# Example: List the hashes for all exports from kernel32.dll (As found in 'c:\windows\system32\')
# >hash.py /mod c:\windows\system32\ kernel32.dll
#
# Example: Simply print the correct hash value for the function kernel32.dll!WinExec
# >hash.py kernel32.dll WinExec
#
# Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
#=============================================================================#
from sys import path
import os, time, sys
# Modify this path to pefile to suit your machine...
pefile_path = "D:\\Development\\Frameworks\\pefile\\"
path.append( pefile_path )
import pefile
#=============================================================================#
collisions = [ ( 0x006B8029, "ws2_32.dll!WSAStartup" ),
( 0xE0DF0FEA, "ws2_32.dll!WSASocketA" ),
( 0x6737DBC2, "ws2_32.dll!bind" ),
( 0xFF38E9B7, "ws2_32.dll!listen" ),
( 0xE13BEC74, "ws2_32.dll!accept" ),
( 0x614D6E75, "ws2_32.dll!closesocket" ),
( 0x6174A599, "ws2_32.dll!connect" ),
( 0x5FC8D902, "ws2_32.dll!recv" ),
( 0x5F38EBC2, "ws2_32.dll!send" ),
( 0x5BAE572D, "kernel32.dll!WriteFile" ),
( 0x4FDAF6DA, "kernel32.dll!CreateFileA" ),
( 0x13DD2ED7, "kernel32.dll!DeleteFileA" ),
( 0xE449F330, "kernel32.dll!GetTempPathA" ),
( 0x528796C6, "kernel32.dll!CloseHandle" ),
( 0x863FCC79, "kernel32.dll!CreateProcessA" ),
( 0xE553A458, "kernel32.dll!VirtualAlloc" ),
( 0x300F2F0B, "kernel32.dll!VirtualFree" ),
( 0x0726774C, "kernel32.dll!LoadLibraryA" ),
( 0x7802F749, "kernel32.dll!GetProcAddress" ),
( 0x601D8708, "kernel32.dll!WaitForSingleObject" ),
( 0x876F8B31, "kernel32.dll!WinExec" ),
( 0x9DBD95A6, "kernel32.dll!GetVersion" ),
( 0xEA320EFE, "kernel32.dll!SetUnhandledExceptionFilter" ),
( 0x56A2B5F0, "kernel32.dll!ExitProcess" ),
( 0x0A2A1DE0, "kernel32.dll!ExitThread" ),
( 0x6F721347, "ntdll.dll!RtlExitUserThread" ),
( 0x23E38427, "advapi32.dll!RevertToSelf" )
]
collisions_detected = {}
modules_scanned = 0
functions_scanned = 0
#=============================================================================#
def ror( dword, bits ):
return ( dword >> bits | dword << ( 32 - bits ) ) & 0xFFFFFFFF
#=============================================================================#
def unicode( string, uppercase=True ):
result = "";
if uppercase:
string = string.upper()
for c in string:
result += c + "\x00"
return result
#=============================================================================#
def hash( module, function, bits=13, print_hash=True ):
module_hash = 0
function_hash = 0
for c in unicode( module + "\x00" ):
module_hash = ror( module_hash, bits )
module_hash += ord( c )
for c in str( function + "\x00" ):
function_hash = ror( function_hash, bits )
function_hash += ord( c )
h = module_hash + function_hash & 0xFFFFFFFF
if print_hash:
print "[+] 0x%08X = %s!%s" % ( h, module.lower(), function )
return h
#=============================================================================#
def scan( dll_path, dll_name, print_hashes=False, print_collisions=True ):
global modules_scanned
global functions_scanned
try:
dll_name = dll_name.lower()
modules_scanned += 1
pe = pefile.PE( os.path.join( dll_path, dll_name ) )
for export in pe.DIRECTORY_ENTRY_EXPORT.symbols:
if export.name is None:
continue
h = hash( dll_name, export.name, print_hash=print_hashes )
for ( col_hash, col_name ) in collisions:
if col_hash == h and col_name != "%s!%s" % (dll_name, export.name):
if h not in collisions_detected.keys():
collisions_detected[h] = []
collisions_detected[h].append( (dll_path, dll_name, export.name) )
break
functions_scanned += 1
except:
pass
#=============================================================================#
def scan_directory( dir ):
for dot, dirs, files in os.walk( dir ):
for file_name in files:
if file_name[-4:] == ".dll":# or file_name[-4:] == ".exe":
scan( dot, file_name )
print "\n[+] Found %d Collisions.\n" % ( len(collisions_detected) )
for h in collisions_detected.keys():
for (col_hash, col_name ) in collisions:
if h == col_hash:
detected_name = col_name
break
print "[!] Collision detected for 0x%08X (%s):" % ( h, detected_name )
for (collided_dll_path, collided_dll_name, collided_export_name) in collisions_detected[h]:
print "\t%s!%s (%s)" % ( collided_dll_name, collided_export_name, collided_dll_path )
print "\n[+] Scanned %d exported functions via %d modules.\n" % ( functions_scanned, modules_scanned )
#=============================================================================#
def main( argv=None ):
if not argv:
argv = sys.argv
try:
if len( argv ) == 1:
print "Usage: hash.py [/dir <path>] | [/mod <path> <module.dll>] | [<module.dll> <function>]"
else:
print "[+] Ran on %s\n" % ( time.asctime( time.localtime() ) )
if argv[1] == "/dir":
print "[+] Scanning directory '%s' for collisions..." % argv[2]
scan_directory( argv[2] )
elif argv[1] == "/mod":
print "[+] Scanning module '%s' in directory '%s'..." % ( argv[3], argv[2] )
scan( argv[2], argv[3], print_hashes=True )
else:
hash( argv[1], argv[2] )
except Exception, e:
print "[-] ", e
#=============================================================================#
if __name__ == "__main__":
main()
#=============================================================================#