Cloutain / Chaos-Rootkit

x64 ring0 Rootkit with Process Hiding and Privilege Escalation Capabilities

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Chaos-Rootkit

Image Description

  • Chaos-Rootkit is a x64 kernel-mode rootkit that can hide processes or elevate their privileges, work on the latest Windows versions .

Features

  • Hide process: This feature allows you to hide processes from listing tools via DKOM.

  • Elevate specific process privileges : This feature enables you to elevate specific processes privilege .

  • Spawn elevated process: launch command prompt with elevated privileges .

  • SSDT hook (soon)

  • TCP & UDP connections (soon)

Technical Details

  • First, we locate the ActiveProcessLinks, which is a pointer to the PLIST_ENTRY structure. In our case, the ActiveProcessLinks pointer is located at offset 0x448 within the EPROCESS structure. It is important to note that this offset may vary across different windows versions .

    image

    x64 x86
    0xE0 (late 5.2) 0xB4 (3.10)
    0xE8 (6.0) 0x98 (3.50 to 4.0)
    0x0188 (6.1) 0xA0 (5.0)
    0x02E8 (6.2 to 6.3) 0x88 (5.1 to early 5.2)
    0x02F0 (10.0 to 1607) 0x98 (late 5.2)
    0x02E8 (1703 to 1809) 0xA0 (6.0)
    0x02F0 (1903) 0xB8 (6.1 to 1903)
    0x0448 0xE8
  • The PLIST_ENTRY structure is a doubly linked list structure . It contains two members, Blink and Flink, which are pointers to the previous and next entries in the list, respectively, These pointers allow for efficient traversal of the linked list in both directions.

    image

  • The flink member resides in offset 0x0 and the blink member resides in offset 0x8. The flink address 0xffff9c8b\071e3488points to the next process node, while the blink address0xfffff805`5121e0a0` points to the previous process node

    Screenshot 2023-03-23 222046

  • a diagram represents the PLIST_ENTRY structure.

    Screenshot 2023-03-23 181753

  • To hide our chosen process in a listing tool, we can use a technique where we modify the flink and blink pointers of the adjacent process nodes to point to each other, effectively removing our process from the linked list. Specifically, we make the next process node's blink pointer point to the previous node, and the previous process node's flink pointer point to the next node. This makes our process appear invisible in the listing tool's view of the linked list of processes

    image

  • Note: After removing the node from PLIST_ENTRY structure, it is important to set the corresponding pointer to NULL, Otherwise, when attempting to close the process, the PLIST_ENTRY structure will get sent to the PspDeleteProcess API to free all its resources, after the API does not find the process in the structure, it will suspect that the process has already been freed, resulting in a Blue Screen of Death (BSOD), as shown below .

    image

Elevate process privileges

  • When a process is created, it inherits the token of the user who created it, The token is used by the system to determine what actions the process can perform, The token contains information about the user's security identifier (SID), group memberships, and privileges.

    image

  • The Token member resides at offset 0x4b8 in the _EPROCESS structure, which is a data structure that represents a process object. The Token member is defined in _EX_FAST_REF structure, which is a union type that can store either a pointer to a kernel object or a reference count, depending on the size of the pointer , The offset of the _EX_FAST_REF structure within _EPROCESS depends on the specific version of Windows being used, but it is typically located at an offset of 0x4b8 in recent versions of Windows..

  • Windows Build Number token Offsets for x64 and x86 Architectures

    x64 offsets x86 offsets
    0x0160 (late 5.2) 0x0150 (3.10)
    0x0168 (6.0) 0x0108 (3.50 to 4.0)
    0x0208 (6.1) 0x012C (5.0)
    0x0348 (6.2 to 6.3) 0xC8 (5.1 to early 5.2)
    0x0358 (10.0 to 1809) 0xD8 (late 5.2)
    0x0360 (1903) 0xE0 (6.0)
    0x04B8 0xF8 (6.1)
    0xEC (6.2 to 6.3)
    0xF4 (10.0 to 1607)
    0xFC (1703 to 1903)
    0x012C

    image

  • The _EX_FAST_REF structure in Windows contains three members: Object and RefCount and Value

    image

  • You can either spawn a privileged process or elevate an already existing process ID.

    image

  • For the sake of this explanation, we will focus on the second option and use CMD as an example

    image

  • CMD inherited Token

    image

  • we send the Process ID to the driver through an IOCTL

    image

  • after the driver receives the PID from the user mode application, it uses it to obtain a pointer to the _EPROCESS structure for the target process. The driver then accesses the Token member of the _EPROCESS structure to obtain a pointer to the process token, which it replaces with the system token, effectively changing the security context of the process to that of the system. However, if the driver does not correctly locate the Token member within the _EPROCESS structure or if the offset of the Token is other than 0x4b8 , the driver may crash the system or the target process ,this problem will be fixed in the next updates .

  • cmd token after

    image

  • the process privileges, groups, rights

    image

DEMO

2023-03-24.17-42-38.mp4

About

x64 ring0 Rootkit with Process Hiding and Privilege Escalation Capabilities


Languages

Language:C 73.2%Language:C++ 26.8%