福大锐捷更新了新版的。。。也有个linux版rjsupplicant rjsupplicant这个程序分x86和x64两个版本,启动时通过sh判断版本运行。 通过IDA加载x86的试试看,发现有带调试信息。。。一切就简单了。 先试试把多网卡处理掉,有调试信息的话先试试直接找函数看看。 尝试搜索字符串,多网卡就搜索multi试试,发现一个CAdapterDetectThread::MultipleAdaptesOrIPCheck函数 看下F5的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
int __cdecl CAdapterDetectThread::MultipleAdaptesOrIPCheck(int a1)
{
int v1; // [email protected]
int v2; // [email protected]
int v3; // [email protected]
signed int v4; // [email protected]
char v5; // [email protected]
int v6; // [email protected]
int *v8; // [email protected]
int v9; // [email protected]
int v11; // \[sp+8h\] \[bp-60h\]@16
int v12; // \[sp+Ch\] \[bp-5Ch\]@16
const char *s1; // \[sp+24h\] \[bp-44h\]@2
void *ptr; // \[sp+28h\] \[bp-40h\]@1
char dest; // \[sp+30h\] \[bp-38h\]@19
int *v16; // \[sp+40h\] \[bp-28h\]@19
int v17; // \[sp+50h\] \[bp-18h\]@19
int v18; // \[sp+54h\] \[bp-14h\]@19
int v19; // \[sp+58h\] \[bp-10h\]@15
v1 = get\_nics\_info(0);
ptr = (void *)v1;
if ( !v1 )
return free\_nics\_info(ptr);
v2 = v1;
s1 = (const char *)(a1 + 360);
while ( !strcmp(s1, (const char *)v2) )
{
v3 = v2 + 16;
CLogFile::AppendText(g\_log\_Wireless, "nic name:%s", s1);
v4 = 6;
v5 = a1 == -884;
v6 = a1 + 884;
do
{
if ( !v4 )
break;
v5 = *(\_BYTE *)v3++ == *(\_BYTE *)v6++;
--v4;
}
while ( v5 );
if ( !v5 )
{
CLogFile::AppendText(g\_log\_Wireless, "mac chagedn");
v12 = 0;
v11 = 30;
goto FindMul;
}
CLogFile::AppendText(g\_log\_Wireless, "ipv4 count:%d", *(_DWORD *)(v2 + 48));
for ( i = *(\_DWORD *)(v2 + 52); i; i = *(\_DWORD *)(i + 8) )
CLogFile::AppendText(
g\_log\_Wireless,
(const char *)&unk_810ED8E,
*(_BYTE *)(i + 3),
*(_BYTE *)(i + 2),
*(_BYTE *)(i + 1),
*(_BYTE *)i);
if ( *(\_DWORD *)(v2 + 48) > 1 && *(\_BYTE *)(a1 + 890) )
{
CLogFile::AppendText(g\_log\_Wireless, "multiple ipsn");
v12 = 0;
v11 = 21;
goto FindMul;
}
v8 = *(int **)(v2 + 52);
if ( !v8 )
{
CLogFile::AppendText(g\_log\_Wireless, "ip chaged - no ipn");
v12 = 0;
v11 = 31;
goto FindMul;
}
v9 = *v8;
v19 = v9;
LOWORD(v9) = \_\_ROR\_\_(v9, 8);
v9 = \_\_ROR\_\_(v9, 16);
LOWORD(v9) = \_\_ROR\_\_(v9, 8);
v5 = *(_DWORD *)(a1 + 880) == v9;
v19 = v9;
if ( !v5 )
{
CLogFile::AppendText(g\_log\_Wireless, "ip chagedn");
v12 = 0;
v11 = 31;
goto FindMul;
}
LABEL_4:
v2 = *(_DWORD *)(v2 + 64);
if ( !v2 )
return free\_nics\_info(ptr);
}
if ( !*(_BYTE *)(a1 + 890) )
goto LABEL_4;
CLogFile::AppendText(g\_log\_Wireless, (const char *)&unk_810EDC9, v2);
memset(&dest, 0, 0x20u);
strncpy(&dest, (const char *)v2, 0xFu);
v16 = &v17;
v17 = 10;
v18 = 0;
if ( ioctl(*(_DWORD *)(a1 + 900), 0x8913u, &dest) < 0 )
{
if ( ioctl(*(_DWORD *)(a1 + 900), 0x8946u, &dest) >= 0 && v18 == 1 )
{
CLogFile::AppendText(g\_log\_Wireless, "multiple adaptersn");
v12 = 0;
v11 = 20;
goto FindMul;
}
goto LABEL_4;
}
if ( !((unsigned \_\_int8)v16 & 1) || !((unsigned \_\_int8)v16 & 0x40) )
{
CLogFile::AppendText(g\_log\_Wireless, "SIOCGIFFLAGS flags:%4x", (signed __int16)v16);
goto LABEL_4;
}
CLogFile::AppendText(g\_log\_Wireless, "multiple adapters flags:%4x", (signed __int16)v16);
v12 = 0;
v11 = 20;
FindMul:
PostThreadMessage(*(\_DWORD *)(a1 + 872), *(\_DWORD *)(a1 + 876), v11, v12);
return free\_nics\_info(ptr);
}

真好。。还有输出调试,可以看出如果发现多网卡多IP等情况会跳转到FindMul这个label然后PostMessage,应该是判断出多网卡之后向线程发送一个通知信息。把这个函数nop掉就Patch掉多网卡限制了。 ————割———— 之后是Network-manager服务 查找跟service有关的,找到一个stop_service函数

1
2
3
4
5
6
7
8
9
int \_\_cdecl service\_stop(int a1)
{
char s; // \[sp+10h\] \[bp-208h\]@1
memset(&s, 0, 0x200u);
sprintf(&s, "service %s stop 2>&-", a1);
system(&s);
return service_stop2(a1);
}

这个函数作用是通过传入的服务名调用system关闭服务。 查看xrefs引用

都是在EnvironmentCheck中引用。 查看下这个函数发现第一处的引用是关闭Network-Manager的。nop掉他,结束。 x64的也是类似的,就不重复了

Comment and share

  • page 1 of 1
Author's picture

Eadom

NO PWN NO FUN


@Alibaba


Hangzhou