摘要： 通过一个基于网络驱动程序接口规范中间层的驱动，在Windows网络协议栈下建立一个隐蔽通道，使应用程序可利用其直接与外界通信。该通道的作用位置相比防火墙对于协议栈的控制更为底层，可直接从网卡读写数据进行网络通信。分析防火墙由于未对网络进行完整防护而被穿透的原因，探讨抵御该类攻击的方法。

关键词: Rootkit工具, 防火墙穿透, 隐蔽通道, 网络驱动程序接口规范, 中间层驱动程序

Abstract: This paper builds up a covert channel under Windows network protocol stack based on Network Driver Interface Specification(NDIS) Intermediate Driver(IMD) technology. Application program can communicate with outward by this channel whose position is lower than control of firewall, and it can read and write data directly from NIC. It analyzes the reason the firewall may be bypassed, which is caused by lack of protection for the network, and discusses how to prevent this kind of attacks.

Key words: Rootkit tool, firewall penetrating, covert channel, Network Driver Interface Specification(NDIS), Intermediate Driver(IMD)

中图分类号: 

• TP393