bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
https://bytecode77.com/r77-rootkit
BSD 2-Clause "Simplified" License
1.59k stars 389 forks source link

One question #17

Closed Xienim closed 3 years ago

Xienim commented 3 years ago

so the r77 is really cool, but i couldn't find an option in it to run tasks as soon as windows starts, because when i have files with parameter $77 they are hidden, but they don't run when windows starts, because it doesn't can you find the file to run, is there any method in r77 to start processes with windows?

uncidal commented 3 years ago

If I am understanding you, r77 runs on startup, but its just your program that starts with $77 does not start? Are you sure it does not run? I am not the developer, but I am pretty sure it should run if you add it to regedit startup locations, or if you add it to task scheduler. Try to run task scheduler, on the right side click create basic task, when you select a name, you can start the name with $77 to hide the startup from a normal user (it will still startup, just hard to remove), in trigger select When the computer starts, in action select start a program, and in start a program write in the location to the file. You can also try changing the Userinit key, open regedit as admin, and go to this location: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon On the right you should see a list of many keys, you can change userinit and add the location to the file after the comma sign, and it will startup when the computer turns on. (So the value of Userinit should be something like "C:\Windows\system32\userinit.exe, C:*INSERT YOUR LOCATION TO FILE HERE*")

bytecode77 commented 3 years ago

Prefixed files cannot be "seen" by Windows and therefore don't start up. There have been several such reports and I can confirm this.

I'm currently considering a key under $77config where startup files can be defined. They could then even start up under the SYSTEM accont.

Currently, however, I can only offer a workaround. You could try to not use the prefix, but instead write the process ID to the list of hidden PID's after your process started. That way, at least the process is not visible, however the file is. In my previous attempts, hiding the parent directory unfortunately also prohibits startup of the containing file.

This issue is on the top of the ToDo list for the next release.

bytecode77 commented 3 years ago

Version 1.2.2 is available.

This issue was addressed in the new version that is now available for download.

Section 2.8 of the documentation:

The issue: If you set up a hidden file for startup, for example using the HKCU...\Run key, Windows cannot not find the file (because it is hidden) and therefore it does not start.

The solution: r77 is in charge of starting hidden files. This comes with several advantages:

  1. Your file will start under the SYSTEM account with system integrity.
  2. Your file will start before the first user is logged on.
  3. You can add files to startup with non-elevated privileges and they will start up with system integrity.

If you want your process to be run under a specific user account, you have to perform impersonation. This is required in case you need access to the user’s desktop.

Note: Just by adding the file to $77config\startup, it is not implicitly hidden. The same rules apply: The file has to have the prefix, or it has to be hidden by the configuration system. If you want the file to not be injected by r77, then writing the helper signature to the executable file will avoid injection (see section 4.1).

Xienim commented 3 years ago

Good morning mate. So I created the folder $77config/startup inside the path HKEY_LOCAL_MACHINE\SOFTWARE/$77config\startup. inside I created the hidden file type REG_SZ and passed its path in value. after that I installed r77 with install, restarted the machine, but it didn't start the program. I tested it with the path inside a hidden folder with $77 and without the $77. So what do you think about it? Best Regards Kenji.

Xienim commented 3 years ago

\ **

bytecode77 commented 3 years ago

Can you show me a screenshot of RegEdit that shows the entry? (You need to detach r77 from regedit.exe using the TestConsole to see the key.)

Xienim commented 3 years ago

test

Xienim commented 3 years ago

Notepad then runs but $77test.exe is not run

bytecode77 commented 3 years ago

I see two potential issues that could be causing this:

1.) The path is being redirected to C:\Windows\SysWOW64\.... You can verify whether this is the cause by using a path that does not have redirection, e.g. C:\. If that works, then redirection is at fault. In this case, you need to put your file into the SYSWOW64 directory. Note, that Windows path redirections can be very tricky and misleading.

2.) The executable is having trouble because it's run under the SYSTEM account. This can happen, if you try to access the desktop, etc... Can you try replacing $77test.exe with a very basic executable that just does Sleep(1000000)? If this works, then your executable does for some reason not work under the SYSTEM account. In this case, you could try to temporarily implement logging to see where exactly it crashes.

Yep, startup failures are impossible to debug... It's always this kind of trial and error ;)

Edit: One more thing: You could kill the r77 service process and then run Install.exe. It saves you a reboot.

Xienim commented 3 years ago

Good morning friend, this worked for me, After this update the bug was fixed. Thanks !