Now You See Me, Now You Don't
Chaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes and ability to restrict access to files except for whitelisted process work seamlessly on the latest Windows versions.
Gui version
Hide process: This feature allows you to hide processes from listing tools via DKOM.
Elevate specific process privileges : This feature enables you to elevate specific processes privilege .
Restrict file access for user-mode applications except for the provided process ID
Spawn elevated process: launch command prompt with elevated privileges .
Unprotect all processes
Protect a specific process with any given protection level (WinSystem, WinTcb, Windows, Authenticode, Lsa, Antimalware) .
First, we locate the ActiveProcessLinks
, which is a pointer to the PLIST_ENTRY
structure. In our case, the ActiveProcessLinks
pointer is located at offset 0x448
within the EPROCESS
structure. It is important to note that this offset may vary across different windows versions .
x64 | x86 | ||
---|---|---|---|
0xE0 | (late 5.2) | 0xB4 | (3.10) |
0xE8 | (6.0) | 0x98 | (3.50 to 4.0) |
0x0188 | (6.1) | 0xA0 | (5.0) |
0x02E8 | (6.2 to 6.3) | 0x88 | (5.1 to early 5.2) |
0x02F0 | (10.0 to 1607) | 0x98 | (late 5.2) |
0x02E8 | (1703 to 1809) | 0xA0 | (6.0) |
0x02F0 | (1903) | 0xB8 | (6.1 to 1903) |
0x0448 | 0xE8 |
The PLIST_ENTRY
structure is a doubly linked list structure . It contains two members, Blink
and Flink
, which are pointers to the previous and next entries in the list, respectively, These pointers allow for efficient traversal of the linked list in both directions.
The flink member resides in offset 0x0
and the blink member resides in offset 0x8
. The flink address 0xffff9c8b\071e3488
points to the next process node, while the blink address 0xfffff805\5121e0a0
points to the previous process node
a diagram represents the PLIST_ENTRY
structure.
To hide our chosen process in a listing tool, we can use a technique where we modify the flink and blink pointers of the adjacent process nodes to point to each other, effectively removing our process from the linked list. Specifically, we make the next process node's blink pointer point to the previous node, and the previous process node's flink pointer point to the next node. This makes our process appear invisible in the listing tool's view of the linked list of processes
Note: After removing the node from PLIST_ENTRY
structure, it is important to set the corresponding pointer to NULL, Otherwise, when attempting to close the process, the PLIST_ENTRY structure will get sent to the PspDeleteProcess
API to free all its resources, after the API does not find the process in the structure, it will suspect that the process has already been freed, resulting in a Blue Screen of Death (BSOD), as shown below .
When a process is created, it inherits the token of the user who created it, The token is used by the system to determine what actions the process can perform, The token contains information about the user's security identifier (SID), group memberships, and privileges.
The Token member resides at offset 0x4b8
in the _EPROCESS
structure, which is a data structure that represents a process object. The Token member is defined in EX_FAST_REF
structure, which is a union type that can store either a pointer to a kernel object or a reference count, depending on the size of the pointer , The offset of the _EX_FAST_REF
structure within _EPROCESS
depends on the specific version of Windows being used, but it is typically located at an offset of 0x4b8
in recent versions of Windows..
Windows Build Number token Offsets for x64 and x86 Architectures
x64 offsets | x86 offsets |
---|---|
0x0160 (late 5.2) | 0x0150 (3.10) |
0x0168 (6.0) | 0x0108 (3.50 to 4.0) |
0x0208 (6.1) | 0x012C (5.0) |
0x0348 (6.2 to 6.3) | 0xC8 (5.1 to early 5.2) |
0x0358 (10.0 to 1809) | 0xD8 (late 5.2) |
0x0360 (1903) | 0xE0 (6.0) |
0x04B8 | 0xF8 (6.1) |
0xEC (6.2 to 6.3) | |
0xF4 (10.0 to 1607) | |
0xFC (1703 to 1903) | |
0x012C |
The _EX_FAST_REF
structure in Windows contains three members: Object
and RefCount
and Value
You can either spawn a privileged process or elevate an already existing process ID.
For the sake of this explanation, we will focus on the second option and use CMD as an example
CMD inherited Token
we send the Process ID to the driver through an IOCTL
after the driver receives the PID from the user mode application, it uses it to obtain a pointer to the _EPROCESS
structure for the target process. The driver then accesses the Token member of the _EPROCESS
structure to obtain a pointer to the process token, which it replaces with the system token, effectively changing the security context of the process to that of the system. However, if the driver does not correctly locate the Token member within the _EPROCESS
structure or if the offset of the Token is other than 0x4b8
, the driver may crash the system or the target process ,this problem will be fixed in the next updates .
cmd token after
the process privileges, groups, rights