search

bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
https://bytecode77.com/r77-rootkit
BSD 2-Clause "Simplified" License
1.59k stars 389 forks source link

Start program hidden with user's desktop access? #30

Closed 1mscar3d closed 2 years ago

1mscar3d commented 2 years ago

I have a C# program which installs rootkit and add itself in r77's autorun. After restarting my c# application starts as System and I can't access user's desktop and start files as user. Is in r77 a option, to start the file as user (or administrator (will be better)), not as system?

bytecode77 commented 2 years ago

When your program runs under the SYSTEM user, it doesn't have access to the desktop, or the user directory, etc. So, that's a limitation. However, under Windows, lot's of processes run under SYSTEM that need to interact with the current user account. I would suggest implementing impersonation - you can basically search for the right code snippet and use it.

As mentioned in the documentation, you need to impersonate the current user. Maybe this post could lead you into the right direction.

Hope it helps!