search

bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
https://bytecode77.com/r77-rootkit
BSD 2-Clause "Simplified" License
1.55k stars 383 forks source link

testconsole won't work #73

Closed MaggieKong closed 3 months ago

MaggieKong commented 4 months ago

I download the latest source code and try to compile it with Microsoft Visual Studio Enterprise 2022,installer and uninstaller works fine,but testconsole.exe works on windows 10 but fail to run on Windows Server 2012 and Server 2016.

image I got this error on Windows server 2012

Server 2016 just won't show up the testconsole gui.

bytecode77 commented 4 months ago

That's strange. Is there any detail on the error, such as in the EventViewer? Is the .NET 4 runtime installed? If so, is only the .NET 4 client profile installed, or the full .NET 4.x runtime?

Note that you really only need to install the .NET runtime for the Test Console. The rootkit itself works with whatever ships with the operating system and there is no need to install anything.

MaggieKong commented 4 months ago

Windows Server 2012 image image

And Windows Server 2016 is the same .net framework installed

BTW,the testconsole.exe from binary zip has the same issue on both windows server 2012 and 2016,but works fine on Windows 10.

bytecode77 commented 4 months ago

One important question first: Is the rootkit running properly, though? I'm asking because I never tested on Windows Server.

As for the Test Console. That one requires .NET 4.7. Is this version installed? And is there any chance you could install Visual Studio on Windows Server to actually debug the Test Console to see where the error occurrs?

MaggieKong commented 4 months ago

1.Rootkit works perfectly on both server 2..NET 4.8X is installed but not .NET 4.7(I will try to install .NET 4.7 and test again)

my fault.Testconsole won't work because I forgot to copy two of the dll with tetconsole.exe.

bytecode77 commented 3 months ago

No problem. At least I now know that r77 works on Windows Server ;)