mirror of
https://github.com/ZeroMemoryEx/Chaos-Rootkit.git
synced 2026-10-17 04:41:19 +08:00
Anas
63 lines
3.8 KiB
Markdown
63 lines
3.8 KiB
Markdown
# Chaos-Rootkit
|
||
|
||
<p align="center">
|
||
<img src="https://github.com/user-attachments/assets/c352d7c4-f444-453d-995a-65575d3c0e9a" alt="Image Description" width="320">
|
||
</p>
|
||
|
||
|
||
* Chaos-Rootkit is an x64 Ring 0 rootkit i wrote to better understand kernel internals and rootkit techniques.
|
||
|
||
* Gui version
|
||
|
||
<p align="center">
|
||
<img src="https://github.com/user-attachments/assets/e89ff29a-01f8-461c-ad29-5a0454763fcf" alt="image">
|
||
</p>
|
||
|
||
|
||
<p align="center">
|
||
<a href="https://www.buymeacoffee.com/ZeroMemoryEx" target="_blank">
|
||
<img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" alt="Buy Me A Coffee">
|
||
</a>
|
||
</p>
|
||
|
||
# Features
|
||
|
||
* Hide process: This feature allows you to hide processes from listing tools via DKOM.
|
||
|
||
* Elevate specific process privileges : This feature enables you to elevate specific processes privilege .
|
||
|
||
* Swap the driver on disk and in memory with a Microsoft driver: All credit for this implementation goes to [IDontCode](https://x.com/_xeroxz) [Back Engineering](https://back.engineering/) for his exceptional work, I've also handled the unload and shutdown routines for this feature so that the rootkits driver doesn’t get corrupted or crash at some point.
|
||
|
||
* Restrict file access for user-mode applications except for the provided process ID
|
||
|
||
* Spawn elevated process: launch command prompt with elevated privileges .
|
||
|
||
* Bypass the file integrity check and protect it against anti-malware : this work by redirecting file operations to a legitimate file, making our file appear authentic and signed with a valid certificate also if an anti-malware attempting to scan it, the rootkit will immediately kill the anti-malware process.
|
||
|
||
* Unprotect all processes
|
||
|
||
* Protect a specific process with any given protection level (WinSystem, WinTcb, Windows, Authenticode, Lsa, Antimalware) .
|
||
|
||
* Protect a specific file against anti-malware, when an anti malware tries to scan it the rootkit will shut it down this done by checking the caller EPROCESS protection member .
|
||
|
||
# Contribution
|
||
|
||
* Contributions are welcome, but when contributing, please pay attention to the implementation details of how the rootkit is designed. For example, see this [code](https://github.com/ZeroMemoryEx/Chaos-Rootkit/blob/1d38a4141fc5f958258af0f09a109454f59ec777/Chaos-Rootkit/Driver.c#L551). Ignoring this logic will break the driver. The last contribution did not follow this design, and I had to push several updates to fix it :(
|
||
|
||
# Writeup
|
||
* https://www.hackandhide.com/chaos-rootkit-internals-explained/
|
||
|
||
# CREDITS
|
||
|
||
* [Yassine Jerroudi](https://x.com/Jerroudi_Yass) : Helped significantly with the early version of the rootkit client GUI, since I was a complete noob with IMGUI. Deserves all the credit.
|
||
* [IDontCode](https://x.com/_xeroxz) [BackEngineerLab](https://x.com/BackEngineerLab): All credit for the implementation of swapping the driver on disk and in memory.
|
||
* [sixtyvividtails](https://x.com/sixtyvividtails) : Thanks to him for recommending probing ObjectAttributes->ObjectName->Buffer at all three levels, since we are hooking NtCreateFile and receive user-controlled pointers.
|
||
* [Pavel Yosifovich](https://x.com/zodiacon) : the author of Windows Kernel Programming, this book remains the single most valuable resource I rely on, without a solid understanding of kernel internals, you can’t just vibe-code drivers. real knowledge is the only thing that keeps you from getting completely cooked <img src="https://github.com/user-attachments/assets/fafe8039-9d47-4d6c-87e9-c11a5fcdc130"
|
||
alt="bsod"
|
||
style="width:30px;height:25px;vertical-align:middle;"> ..
|
||
* To contributors: Special thanks to [UncleJ4ck](https://x.com/UncleJa4ck), the first contributor, for implementing error handling, and to [staarblitz](https://github.com/staarblitz) for adding Windows 11 24H2 offsets and GUI protection.
|
||
|
||
|
||
|
||
|