Mar 15, 2016 12:18 AM
(This post was last modified: Mar 15, 2016 08:19 PM by LanMan.)
Hello everyone, today im releasing a System rootkit.
This can hide every process given from all user app, taskmanager, monitoring app, tasklist etc.
No need for an executable constantly running or system wide dll injection/AppInit there.
So, this is a kernel32 hook written in C++, it will replace every call and load modules in every process(Even the system pid0 & pid4 process, NtAuthority Power !)
I've decided to make this a public release for once, this is free.
You will need to put both of the dll inside System32, overwrite kernel32.dll by taking ownership and right first.
Thats all.
Kernel hook is UD 2/56, rootkit dll is FUD 0/56
Edit: This version hide every "server.exe".
Example screen:
Hidding all 13 svchost.exe system process.
![[Image: rjVm7o4.png]](https://i.imgur.com/rjVm7o4.png) 32BIT SUPPORT ONLY
Any Bad installation/missing dll, wrong architecture, or different/newer kernel32.dll will result in a BSOD during boot time, be warned.
Only tested in Windows 7.1 ultimate 32bits, kernel32 version 23338
If you need a custom, private or more advanced version, System NtAuthority level process elevation, Ultimate persistence watchdogs, or anything similar, hit me up and we will discuss about that.
-LanMan C/C++/C# developper
Thank you for this great post, though I have not test it, yet.
The thing is, I use WinXP SP3 (please do not blame me, instead, blame my Core2Duo processor w/ 2GB RAM!) :D
You've also mentioned the following:
Quote:If you need a custom, private or more advanced version, System NtAuthority level process elevation, Ultimate persistence watchdogs, ...
Actually, I do need actually all of those three items. I just want to know if you are charging for this, if so please inform me and get me a special deal. :)
You might want to change the text color of, "32BIT SUPPORT ONLY!" it's kind of hard to see in that dark red color.
Beware , the file is crypted.
This is LQ ... Original Coder: Menalix
http://menalix.com/?p=66
VB.NET Ring3 Rootkit (Hide the process from NtQuerySystemInformation & NtOpenProcess)
https://hackforums.net/showthread.php?tid=4794815
Mar 15, 2016 05:49 PM
(This post was last modified: Mar 15, 2016 08:51 PM by LanMan.)
(Mar 15, 2016 05:34 PM)Volty Wrote: You might want to change the text color of, "32BIT SUPPORT ONLY!" it's kind of hard to see in that dark red color. Yes you are right !
(Mar 15, 2016 05:34 PM)๖ۣۜOptimal Wrote: Beware , the file is crypted. What is crypted exactly ? Its native code, dont expect ilspy or reflector to give you mscil code
(Mar 15, 2016 05:38 PM)Ov3rFl0w_ Wrote: This is LQ ... Original Coder: Menalix
http://menalix.com/?p=66
VB.NET Ring3 Rootkit (Hide the process from NtQuerySystemInformation & NtOpenProcess)
https://hackforums.net/showthread.php?tid=4794815
Sure, try to get .net code into System 4 at bootime hahaha, tell me if you achieve it !
Btw this is userland not ring0, he use a different technic (open handle and writeprocessmemory with shellcodes) on my side i have direct access to memory of each process, no handle opened, and no readprocessmemory or writeprocessmemory are called
Please do some test/RE or at least research before calling me out, this has nothing to do with this userkit from manalix apart the substring "ring" and "rootkit" on the name ! Not even the same hook method used.
Edit: "Stealing other people work and copyrights and claims it for him self, Low Quality. DEAL WITH CAUTION." Is that a troll ? please elaborate on how much i did copy on this guy, im listening. (With any proof other than the 2 words in the thread title please)
You seems to have absolutely no idea of what you are talking about.
(Mar 15, 2016 05:33 PM)mods_3 Wrote: Thank you for this great post, though I have not test it, yet.
The thing is, I use WinXP SP3 (please do not blame me, instead, blame my Core2Duo processor w/ 2GB RAM!) :D
You've also mentioned the following:
Actually, I do need actually all of those three items. I just want to know if you are charging for this, if so please inform me and get me a special deal. :)
Please let me know when you have tested, if it is compatible with XP SP3. (It should be since xp version is older and all forwarded calls should be retroactive)
Any feedback are apreciated.
And yes i am charging for this, price will varie for each private features asked, this version is just a 'PoC'.
And right now i forgot to tell this version only hide "server.exe" process names in the post
DO NOT DEAL WITH THIS MEMBER
(Mar 15, 2016 05:38 PM)Ov3rFl0w_ Wrote: This is LQ ... Original Coder: Menalix
http://menalix.com/?p=66
VB.NET Ring3 Rootkit (Hide the process from NtQuerySystemInformation & NtOpenProcess)
https://hackforums.net/showthread.php?tid=4794815
Do some research man.
This is written in C++
Mar 20, 2016 07:43 PM
(This post was last modified: Mar 20, 2016 07:44 PM by LanMan.)
Updated Version 1.1:
LmRkt V1.1
VirusTotal
Changelog:
- Fixed a bug that could crash ProcessHacker time to time when the process was the last in the list.
- Did some changes in the algorithm.
Still FUD, 0/56.
Menalix's rootkit is shit so is this
WOW64 or x86 rootkits dont even have any use today
You are obviously inept and cant properly code a bootkit to disable KPP, let alone a proper ring0 rootkit working on x64 architectures. nice person coder.
(May 14, 2016 05:48 PM)warlock3329 Wrote: Menalix's rootkit is shit so is this
WOW64 or x86 rootkits dont even have any use today
You are obviously inept and cant properly code a bootkit to disable KPP, let alone a proper ring0 rootkit working on x64 architectures. nice person coder.
I have made 64 versions already. If you take the effort to read the thread, this is only a demo/poc.
Seems like you don't know what you are talking about anyway, PG only protect drivers.
Maybe if you learn some skill other than talking shit on the internet, it will be more usefull for the community.
DO NOT DEAL WITH THIS MEMBER
its useless as long as It drops the dll
(May 14, 2016 11:55 PM)_Devil Wrote: its useless as long as It drops the dll
It doesnt drop anything. Not sure what are you talking about 😧
(Mar 15, 2016 05:34 PM)๖ۣۜOptimal Wrote: Beware , the file is crypted.
Just because its crypted doesn't mean it's dangerous :\
OP probably just put lots of effort into this and does not want people to see the source code (I May be wrong..)
Anyway, good job OP :)
(May 15, 2016 02:57 PM)personuhpoizon Wrote: Just because its crypted doesn't mean it's dangerous :\
OP probably just put lots of effort into this and does not want people to see the source code (I May be wrong..)
Anyway, good job OP :)
Thanks ✌ . And no its not crypted nor obfuscated, since its native code. Feel free to reverse engine it 🤝
You might want to change the text color of, "32BIT SUPPORT ONLY!" it's kind of hard to see in that dark red color.
|
![[Image: giphy.gif]](https://media.giphy.com/media/xTiQyDH14rr308bghW/giphy.gif)
