search

bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
https://bytecode77.com/r77-rootkit
BSD 2-Clause "Simplified" License
1.59k stars 389 forks source link

WErFault errors #8

Closed TheDarkMythos closed 3 years ago

TheDarkMythos commented 3 years ago

After installing it, I get these errors on task manager, any idea how to fix this? Screenshot_1

bytecode77 commented 3 years ago

Looks like some injected application is crashing and maybe restarting each time it crashes, causing this "WerFault loop".

Could you check the EventVwr to see which application it is? If you could provide some details on that and the info from EventVwr, I could try to reproduce the issue.

Also, just to keep in mind: If you are implementing r77 in your application, make sure that your application isn't injected by r77. You can do this by using the $77 prefix.

TheDarkMythos commented 3 years ago

Yes, I know which app it is!! ok, thank you very much! That error comes any time I create a new file with the prefix name. I will now install a new VM and try to reproduce this error and i will let you know.

TheDarkMythos commented 3 years ago

can I use the old installer C# to install it?

bytecode77 commented 3 years ago

The old installer writes to AppInit_DLLs, but I did not use this technique in the new version, because:

  1. It is simply ignored, when secure boot is enabled
  2. It only loads, into processes, where kernel32.dll is loaded
  3. It requires the DLL to be stored as a file. This file sooner or later gets detected and deleted
  4. This registry value is highly suspicious and monitored

You can use it, thought, but I don't recommend it. I would rather investivate in your issue further.

If the app that's crashing is one of your own projects, then please make sure, that:

If the crashing app is a Windows component, then it is a bug that should be fixed. In this case, I need info about the process, the OS and the EventVwr log entry.

TheDarkMythos commented 3 years ago

Thank you very much for this info!!

bytecode77 commented 3 years ago

A question: Do you have the errors in your initial post with the old installer, or with the new installer (1.0.x)? I never tested the new DLL's with the old AppInit_DLL installer.

Regarding C#: Yes, it is possible and very trivial. Have a look at Intall.cpp. All it does is this:

  1. Read the stager executable from the resources and write it to two registry keys
  2. Create two scheduled tasks, and run both

(on Windows x86, do each task only once)

Install.cpp has source code comments that explain how the installation is implemented.

I won't port it to C#, but it should be fairly trivial to implement the installer as a C# method in your project. The file InstallStager.exe contains both DLL's and the r77 service. I'd also recommend you to read my documentation as it describes the complete process and what exactly to consider when using the rootkit.

You can basically write a downloader for InstallStub.exe.

TheDarkMythos commented 3 years ago

Yes, I got the error with the old version of the installer, but the dll's I use is from the new version .!! thank you for taking the time to answer me!! You have done great work here!! I will take a look yes!

bytecode77 commented 3 years ago

Glad to hear everything is working as expected :)

I've also updated the documentation with best practices for implemenation. It's not yet on the website as a PDF. But the dev-branch contains the current Documentation.docx