關於windows上的lsass.exe程式

eygle發表於2019-06-16
Windows

關於windows上的lsass.exe程式

今天見到有人問lsass.exe程式，翻了點東西，記錄些東西在這裡。

lsass - lsass.exe - 程式資訊
程式檔案: lsass or lsass.exe
程式名稱: 本地安全許可權服務
描述: 本地安全許可權服務，控制Windows安全機制。
常見錯誤: N/A
是否為系統程式: 是

該程式為系統程式，不能在工作管理員裡終止，記得以前在命令列kill該程式，可能會導致系統藍屏（不確認了）。


微軟的說明如下:

Lsass.exe - You cannot end this process from Task Manager.
This is the local security authentication server, and it generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token.

Link

意思是說:
這是一個本地的安全授權服務，並且它會為使用winlogon服務的授權使用者生成一個程式。這個程式是通過使用授權的包，例如預設的msgina.dll來執行的。如果授權是成功的，lsass就會產生使用者的進入令牌，令牌別使用啟動初始的shell 。其他的由使用者初始化的程式會繼承這個令牌的。

但是適當的擔心是有必要的，已知的部分病毒跟lsass有關。
首先，微軟預設的lsass.exe位於c:windowsSystem32lsass.exe

我們應該清楚正常執行lsass需要的動態連結庫:



C:>tlist 720

 720 lsass.exe

   CWD:     C:WINDOWSsystem32

   CmdLine: C:WINDOWSsystem32lsass.exe

   VirtualSize:    43208 KB   PeakVirtualSize:    49040 KB

   WorkingSetSize:  1360 KB   PeakWorkingSetSize: 10640 KB

   NumberOfThreads: 19

    732 Win32StartAddr:0x74497f07 LastErr:0x00000000 State:Waiting

    736 Win32StartAddr:0x7c94798d LastErr:0x00000000 State:Waiting

    740 Win32StartAddr:0x7c930760 LastErr:0x00000000 State:Waiting

    744 Win32StartAddr:0x7c949fae LastErr:0x00000000 State:Waiting

    748 Win32StartAddr:0x0000028e LastErr:0x00000000 State:Waiting

    764 Win32StartAddr:0x7c930aca LastErr:0x00000000 State:Waiting

    792 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

    800 Win32StartAddr:0x00040d64 LastErr:0x00000000 State:Waiting

    812 Win32StartAddr:0x74488c23 LastErr:0x00000000 State:Waiting

   1700 Win32StartAddr:0x74488c23 LastErr:0x00000000 State:Waiting

    212 Win32StartAddr:0x77dbb479 LastErr:0x00000000 State:Waiting

    364 Win32StartAddr:0x77c0a341 LastErr:0x000003e5 State:Waiting

    376 Win32StartAddr:0x77c0a341 LastErr:0x00000000 State:Waiting

    380 Win32StartAddr:0x77c0a341 LastErr:0x00000000 State:Waiting

   3056 Win32StartAddr:0x759d8831 LastErr:0x00000000 State:Waiting

   1048 Win32StartAddr:0x77e56bf0 LastErr:0x0000006d State:Waiting

   2628 Win32StartAddr:0x00000000 LastErr:0x000003f0 State:Waiting

   3204 Win32StartAddr:0x00000000 LastErr:0x00000000 State:Waiting

   3032 Win32StartAddr:0x77e56bf0 LastErr:0x00000000 State:Waiting

  5.1.2600.2180 shp  0x01000000  lsass.exe

  5.1.2600.2180 shp  0x7c920000  ntdll.dll

  5.1.2600.2180 shp  0x7c800000  kernel32.dll

  5.1.2600.2180 shp  0x77da0000  ADVAPI32.dll

  5.1.2600.2180 shp  0x77e50000  RPCRT4.dll

  5.1.2600.2525 shp  0x74480000  LSASRV.dll

  5.1.2600.2180 shp  0x71a90000  MPR.dll

  5.1.2600.2180 shp  0x77d10000  USER32.dll

  5.1.2600.2180 shp  0x77ef0000  GDI32.dll

  5.1.2600.2180 shp  0x76db0000  MSASN1.dll

  7.0.2600.2180 shp  0x77be0000  msvcrt.dll

  5.1.2600.2180 shp  0x5fdd0000  NETAPI32.dll

  5.1.2600.2180 shp  0x76770000  NTDSAPI.dll

  5.1.2600.2180 shp  0x76ef0000  DNSAPI.dll

  5.1.2600.2180 shp  0x71a20000  WS2_32.dll

  5.1.2600.2180 shp  0x71a10000  WS2HELP.dll

  5.1.2600.2180 shp  0x76f30000  WLDAP32.dll

  5.1.2600.2180 shp  0x77fc0000  Secur32.dll

  5.1.2600.2180 shp  0x71b70000  SAMLIB.dll

  5.1.2600.2180 shp  0x743a0000  SAMSRV.dll

  5.1.2600.2180 shp  0x76760000  cryptdll.dll

  5.1.2600.2180 shp  0x5cc30000  ShimEng.dll

                     0x58fb0000  AcGenral.DLL

  5.1.2600.2180 shp  0x76b10000  WINMM.dll

  5.1.2600.2180 shp  0x76990000  ole32.dll

  5.1.2600.2180 shp  0x770f0000  OLEAUT32.dll

  5.1.2600.2180 shp  0x77bb0000  MSACM32.dll

  5.1.2600.2180 shp  0x77bd0000  VERSION.dll

  6.0.2900.2180 shp  0x773a0000  SHELL32.dll

  6.0.2900.2180 shp  0x77f40000  SHLWAPI.dll

  5.1.2600.2180 shp  0x759d0000  USERENV.dll

  6.0.2900.2180 shp  0x5adc0000  UxTheme.dll

  5.1.2600.2180 shp  0x76300000  IMM32.DLL

  5.1.2600.2180 shp  0x62c20000  LPK.DLL

 1.420.2600.2180 sh  0x73fa0000  USP10.dll

 5.82.2900.2180 shp  0x77180000  comctl32.dll

 5.82.2900.2180 shp  0x5d170000  comctl32.dll

  5.1.2600.2180 shp  0x20000000  msprivs.dll

  5.1.2600.2180 shp  0x71c70000  kerberos.dll

  5.1.2600.2180 shp  0x77c40000  msv1_0.dll

  5.1.2600.2180 shp  0x76d30000  iphlpapi.dll

  5.1.2600.2180 shp  0x74410000  netlogon.dll

  5.1.2600.2180 shp  0x76790000  w32time.dll

     6.0.8168.0 shp  0x75ff0000  MSVCP60.dll

  5.1.2600.2180 shp  0x767c0000  schannel.dll

 5.131.2600.2180 sh  0x765e0000  CRYPT32.dll

  5.1.2600.2180 shp  0x742e0000  wdigest.dll

  5.1.2600.2161 shp  0x0ffd0000  rsaenh.dll

  5.1.2600.2180 shp  0x74370000  scecli.dll

  5.1.2600.2180 shp  0x76060000  SETUPAPI.dll

  5.1.2600.2180 shp  0x74340000  ipsecsvc.dll

  5.1.2600.2180 shp  0x77fe0000  AUTHZ.dll

  5.1.2600.2180 shp  0x73ed0000  oakley.DLL

  5.1.2600.2180 shp  0x742d0000  WINIPSEC.DLL

  5.1.2600.2180 shp  0x74300000  pstorsvc.dll

                     0x43000000  GoogleDesktopNetwork1.dll

  5.1.2600.2180 shp  0x719c0000  mswsock.dll

  5.1.2600.2180 shp  0x60fd0000  hnetcfg.dll

  5.1.2600.2180 shp  0x71a00000  wshtcpip.dll

  5.1.2600.2180 shp  0x74320000  psbase.dll

  5.1.2600.2133 shp  0x68100000  dssenh.dll



大家可以看到，Google的桌面搜尋也需要在此註冊，這個程式是許可權控制所必需的。
有的軟體驗證和更新或驗證註冊資訊，會使用500埠通訊(Internet Key Exchange(IKE)-Internet金鑰交換用埠)，有時可能會被誤報為病毒或木馬。
通常我認為，只要對windows的程式有適當的認識，不依賴防病毒工具，我們仍然可以敏感的認識到異常程式或異常Dll，從而發現可疑程式，找出問題所在。
tlist這個簡單的小工具就曾經幫助我發現過幾個防毒軟體不能及時識別的病毒。
目前已知的和lsass相關的病毒有:
W32.HLLW.Lovgate.C@mm - Symantec Corporation
W32.Mydoom.L@mm - Symantec Corporation
W32.Nimos.Worm - Symantec Corporation
W32.Sasser.E.Worm (Lsasss.exe) - McAfee
所以大家還是應該適當的留意一下這個程式。





來自 “ ITPUB部落格 ” ，連結：http://blog.itpub.net/764/viewspace-120521/，如需轉載，請註明出處，否則將追究法律責任。







相關文章