- Chaos-Rootkit is a x64 kernel-mode rootkit that can hide processes or elevate their privileges, work on the latest Windows versions .
-
Hide process: This feature allows you to hide processes from listing tools via DKOM.
-
Elevate specific process privileges : This feature enables you to elevate specific processes privilege .
-
Spawn elevated process: launch command prompt with elevated privileges .
-
SSDT hook (soon)
-
TCP & UDP connections (soon)
-
First, we locate the
ActiveProcessLinks
, which is a pointer to thePLIST_ENTRY
structure. In our case, theActiveProcessLinks
pointer is located at offset0x448
within theEPROCESS
structure. It is important to note that this offset may vary across different windows versions .x64 x86 0xE0 (late 5.2) 0xB4 (3.10) 0xE8 (6.0) 0x98 (3.50 to 4.0) 0x0188 (6.1) 0xA0 (5.0) 0x02E8 (6.2 to 6.3) 0x88 (5.1 to early 5.2) 0x02F0 (10.0 to 1607) 0x98 (late 5.2) 0x02E8 (1703 to 1809) 0xA0 (6.0) 0x02F0 (1903) 0xB8 (6.1 to 1903) 0x0448 0xE8 -
The
PLIST_ENTRY
structure is a doubly linked list structure . It contains two members,Blink
andFlink
, which are pointers to the previous and next entries in the list, respectively, These pointers allow for efficient traversal of the linked list in both directions. -
The flink member resides in offset
0x0
and the blink member resides in offset0x8
. The flink address0xffff9c8b\
071e3488points to the next process node, while the blink address
0xfffff805`5121e0a0` points to the previous process node -
a diagram represents the
PLIST_ENTRY
structure. -
To hide our chosen process in a listing tool, we can use a technique where we modify the flink and blink pointers of the adjacent process nodes to point to each other, effectively removing our process from the linked list. Specifically, we make the next process node's blink pointer point to the previous node, and the previous process node's flink pointer point to the next node. This makes our process appear invisible in the listing tool's view of the linked list of processes
-
Note: After removing the node from PLIST_ENTRY structure, it is important to set the corresponding pointer to NULL, Otherwise, when attempting to close the process, the PLIST_ENTRY structure will get sent to the PspDeleteProcess API to free all its resources, after the API does not find the process in the structure, it will suspect that the process has already been freed, resulting in a Blue Screen of Death (BSOD), as shown below .
-
When a process is created, it inherits the token of the user who created it, The token is used by the system to determine what actions the process can perform, The token contains information about the user's security identifier (SID), group memberships, and privileges.
-
The Token member resides at offset
0x4b8
in the_EPROCESS
structure, which is a data structure that represents a process object. The Token member is defined in_EX_FAST_REF
structure, which is a union type that can store either a pointer to a kernel object or a reference count, depending on the size of the pointer , The offset of the_EX_FAST_REF
structure within_EPROCESS
depends on the specific version of Windows being used, but it is typically located at an offset of0x4b8
in recent versions of Windows.. -
Windows Build Number token Offsets for x64 and x86 Architectures
x64 offsets x86 offsets 0x0160 (late 5.2) 0x0150 (3.10) 0x0168 (6.0) 0x0108 (3.50 to 4.0) 0x0208 (6.1) 0x012C (5.0) 0x0348 (6.2 to 6.3) 0xC8 (5.1 to early 5.2) 0x0358 (10.0 to 1809) 0xD8 (late 5.2) 0x0360 (1903) 0xE0 (6.0) 0x04B8 0xF8 (6.1) 0xEC (6.2 to 6.3) 0xF4 (10.0 to 1607) 0xFC (1703 to 1903) 0x012C -
The
_EX_FAST_REF
structure in Windows contains three members:Object
andRefCount
andValue
-
You can either spawn a privileged process or elevate an already existing process ID.
-
For the sake of this explanation, we will focus on the second option and use CMD as an example
-
CMD inherited Token
-
we send the Process ID to the driver through an IOCTL
-
after the driver receives the PID from the user mode application, it uses it to obtain a pointer to the
_EPROCESS
structure for the target process. The driver then accesses the Token member of the_EPROCESS
structure to obtain a pointer to the process token, which it replaces with the system token, effectively changing the security context of the process to that of the system. However, if the driver does not correctly locate the Token member within the_EPROCESS
structure or if the offset of the Token is other than0x4b8
, the driver may crash the system or the target process ,this problem will be fixed in the next updates . -
cmd token after
-
the process privileges, groups, rights