Closed chekamarue closed 6 years ago
Hi,
The installer, which is just for demonstration purposes, writes into AppInitDLLs and therefore, only application which are restarted are affected. As mentioned, in a productive scenario, you would additionally inject every already running process along with AppInitDLLs. I didn’t want to include this in the PoC installer. Do these files also show up when your other user restarts TaskMgr?
Regards, Martin
Hi Indeed when executed with elevated privilege ! it worked for all logged users after restarting explorer and taskmgr but doesn't affect disconnected users or new created users still, the rootkit help a lot ,thank you
Regards, yacine
Yes, installing a rootkit requires elevated privileges. Otherwise, you could only inject into medium IL processes.
To summarize the productive scenario: Installation usually requires high IL. Persistence can either be achieved through AppInitDLLs + Injection into every process, or, only injection as AppInitDLLs is not liked by AV software.
hi, when login with an other user the renamed files are clearly showing in (explorer/taskmgr)