Which Crypter here has both features?! The most has Hidden Startup but not Hidden Process, I need both features to make the server invisible from Windows and thirdy-party tools.
Crypter with Hidden Startup and Hidden Process features?! |
 (Nov 22, 2024 01:01 PM)aerohacker Wrote: Which Crypter here has both features?! The most has Hidden Startup but not Hidden Process, I need both features to make the server invisible from Windows and thirdy-party tools. I have no ide what Hidden Startup is, but process hiding requires a ring 3 kernel rootkit. You will need privilege escalation for this. (Nov 22, 2024 02:24 PM)DramaKing Wrote: I have no ide what Hidden Startup is, but process hiding requires a ring 3 kernel rootkit. You will need privilege escalation for this. Hidden Startup will run the server invisible from startup options in msconfig and task manager. (Nov 22, 2024 08:00 PM)aerohacker Wrote: Hidden Startup will run the server invisible from startup options in msconfig and task manager. And hidden from the Startup menu? It's probably using a Run registry key, not startup.
Nov 22, 2024 08:56 PM
(This post was last modified: Nov 23, 2024 02:21 PM by aerohacker.)
(Nov 22, 2024 08:46 PM)DramaKing Wrote: And hidden from the Startup menu? It's probably using a Run registry key, not startup. Or Task Scheduler. (Nov 22, 2024 08:46 PM)DramaKing Wrote: And hidden from the Startup menu? It's probably using a Run registry key, not startup. I can add the server to task scheduler manually or make this automatically, using a Crypter with Hidden Startup feature to hide the server from startup folder, msconfig and task manager options. And to hide the process, which Ring3 or Ring0 Rootkit do you recoomend?! I know the in Github has a lot of cool projects, but I want something compiled, run the Rootkit and hide the process from task manager or another process managers tools. The r77 Rootkit works like that, but after install it and rename the server using the prefix $77 it's hide all related with the server (Which is very cool, it's my intention), but after that the server don't run too.
Nov 23, 2024 05:03 AM
(This post was last modified: Nov 23, 2024 05:04 AM by DramaKing.)
(Nov 22, 2024 08:56 PM)aerohacker Wrote: Or Task Scheduler. You mean r77 rootkit. It's a common Ring 3 rootkit. Ring 0 rootkits have been practically unheard of since at least Windows Vista. Drivers need to be signed by EV certificates to run in kernel mode. These certificates can be revoked at any time by Microsoft. https://www.bleepingcomputer.com/news/se...-installs/
Nov 23, 2024 02:25 PM
(This post was last modified: Nov 23, 2024 02:27 PM by aerohacker.)
(Nov 23, 2024 05:03 AM)DramaKing Wrote: You mean r77 rootkit. It's a common Ring 3 rootkit. Ring 0 rootkits have been practically unheard of since at least Windows Vista. Drivers need to be signed by EV certificates to run in kernel mode. These certificates can be revoked at any time by Microsoft. https://www.bleepingcomputer.com/news/se...-installs/ Yeah, the r77 rootkit is what I found, compiled with the injector and etc, simple and works well, but the "problem" is, after install the r77 rootkit and rename the server using to $77server (example), everything related with the file disapear (Which is the function of the rootkit, but the same don't run too just be invisible). There's a way to use r77 rootkit buy only to hide the process server?! (Nov 23, 2024 12:16 PM)m0hx Wrote: If I remember hidden process was possible in windows 7 and below. Not sure if there’s any now :/ mayb private ones but I haven’t seen any recently. It's possible to hide process in new Windows versions too.
Nov 23, 2024 04:45 PM
(This post was last modified: Nov 23, 2024 04:48 PM by DramaKing.)
(Nov 23, 2024 02:25 PM)aerohacker Wrote: Yeah, the r77 rootkit is what I found, compiled with the injector and etc, simple and works well, but the "problem" is, after install the r77 rootkit and rename the server using to $77server (example), everything related with the file disapear (Which is the function of the rootkit, but the same don't run too just be invisible). Aren't you trying to hide the client? Why hide the C2 server? Open a GitHub issue. I don't know the code to be able to answer.
Nov 23, 2024 06:13 PM
(This post was last modified: Nov 23, 2024 06:15 PM by aerohacker.)
(Nov 23, 2024 04:45 PM)DramaKing Wrote: Aren't you trying to hide the client? Why hide the C2 server? Not the RAT client, but I want to hide the RAT server process. Example: I use a lot of RATs both: Native and .NET, and after install the server on Windows, I like to do the server as hidden possible from user and even computer tech, so I always make: - Hidden Installation - Install the server on Roaming/AppData and use attrib +h +s - Hidden Startup - Install the server on Task Scheduler and make invisible from Startup Folder and Startup tab/programs on MSConfig and Task Manager - Hidden Process - Hide the process server from Task Manager, Process Explorer, Process Hacker Using r77 Rootkit the program hide everything what is very cool, but for some reason the server does becomes functional after being invisible, so that a way to use r77 rootkit but only for hide the process and not then server itself or another compiled Rootkit to do that?! Or a free or paid Crypter with custom install, hidden startup and hidden process features to make all this things automatically?! (Nov 23, 2024 06:13 PM)aerohacker Wrote: Not the RAT client, but I want to hide the RAT server process. Install the server on the victim PC? I'm too confused at this point, except to suggest a fileless crypter, nothing to hide then. 
Its' better to use file less techniques along with abusing LOLBINS (https://lolbas-project.github.io/), other than that, you will have to escalate your privileges, move on to kernel and stay as a rootkit to hide network traffic along with your own process.
Takes a great feat to do so, due to the modern EDR blocking lots of user land and kernel activities if they seem to be suspicious. Numerous events are generated which are collected automatically and the target victim is notified of such activities, of course in an secure corporate environment.
Crypt/Protect files .NET [x64/x86] Native x86 WinDef Bypass - 0/26 AVCHECK.NET:
https://hackforums.net/showthread.php?tid=6285264 (Nov 23, 2024 08:14 PM)DramaKing Wrote: Install the server on the victim PC? I'm too confused at this point, except to suggest a fileless crypter, nothing to hide then. What I says is when I install a server on PC user physically or remotelly, I like to make the servers most hidden as possible from user. (Nov 24, 2024 12:13 PM)aerohacker Wrote: What I says is when I install a server on PC user physically or remotelly, I like to make the servers most hidden as possible from user. So what do you run the client or payload on? Your PC?
Nov 24, 2024 05:20 PM
(This post was last modified: Nov 24, 2024 05:25 PM by aerohacker.)
(Nov 24, 2024 01:45 PM)DramaKing Wrote: So what do you run the client or payload on? Your PC? The RAT client I run on my PC on a VM and the server on the user PC. The point is that once the server is installed on the user's machine, I like to do the server as hidden as possible on the OS, hidding files, process and etc... The question with the r77 rootkit is I installed the rootkit, renamed the server with prefix $77 and everything related to it disappeared (Which was expected), but at the same time while the file is invisible, it stops working too, and because of that I just want to use it to hide only the process. |
|
|
