+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: µProtect - Kernel injection [Ring0 Rootkit] (/showthread.php?tid=2231220)
µProtect - Kernel injection [Ring0 Rootkit] - Novelty - Feb 20, 2012
Hey all, I'm working on secret project calld µProtect.
It injects into the kernel and do a man-in-the-middle attack of the PC.
This is really dangerous though so i just wanted to hear your guys suggestions and like what price you would pay for it
* - van1lle - Feb 20, 2012
Seems like your project is not that secret.
What does it do exactly?
* - Novelty - Feb 20, 2012
It binds your program or virus to itself and run in kernel-mode, ring0, infects drivers, so forth, basically this is what is used to create huge botnets.
i don´t knwo if its allwoed to be sold here though since its blackhat, and people can use it with a spreader that spreads ring0 as well, GG internet
* - deadaccount01 - Feb 20, 2012
One of these things infected my old laptop, thing is god damn deadly. I hate russians. Its pretty much impossible to remove it without wiping the drive.
* - +Xenon - Feb 20, 2012
Based on your thread and your most recent reply, I would venture to say you haven't the slightest clue what you are doing. First of all, "huge botnets" are a 2 part deal: the bot and the owner. You can't rely 100% on your bot doing all the work for you, you have to put in a little effort too. Also, I am definitely not a bot coder (in any language really), but as far as I know, all these features have shown up in nearly every worthwhile bot on HF...
* - van1lle - Feb 20, 2012
(Feb 20, 2012 09:14 AM)Novelty Wrote: It binds your program or virus to itself and run in kernel-mode, ring0, infects drivers, so forth, basically this is what is used to create huge botnets.
How would you run your virus in ring0, since are only able to use the native api? And who creates a bot using only the native api? :3
(Feb 20, 2012 09:18 AM)Query Wrote: One of these things infected my old laptop, thing is god damn deadly. I hate russians. Its pretty much impossible to remove it without wiping the drive.
Why don't you boot a linux live cd/usb and remove dat shit?
* - Novelty - Feb 20, 2012
@van1lle it basically runs in ring0 mode.
Nothing else to it!
* - FuckYouAllCuntz - Feb 20, 2012
> "It injects into the Kernel and does a man in the middle attack"..
Seriously gtfo now. Where does a MITM attack come into this process? Do you even know what an MITM attack is?
* - Pineapple - Feb 20, 2012
No way do you even have any chance of coding Ring0 rootkit or even close. You'll need 0day exploits for it, and any REAL hardcore rootkits like that aren't going to be sold on HF, and will also cost thousands.
Just give up. 🤦♂
* - Skep - Feb 20, 2012
There's already public Ring0 Rootkits that allow kernel hooking.
* - eXero - Feb 20, 2012
I guess it's not a secret anymore. But honestly I have never heard of this, anyone care to link me to the wikipedia link about it?
* - Skep - Feb 20, 2012
http://en.wikipedia.org/wiki/Rootkit
Spoiler (Click to View)
* - B00b5_ - Feb 20, 2012
everyone on hf is fucking stupid
the op has no idea what's he's talking about. a man in the middle attack is across a fucking network, not intercepting api calls from the fucking kernel.