search

mvrozanti / RAT-via-Telegram

Windows Remote Administration Tool via Telegram
MIT License
646 stars 347 forks source link

Hide process(es) from task manager #61

Open mvrozanti opened 5 years ago

mvrozanti commented 5 years ago

This hides a process in some Windows versions. May be worth implementing even if it's not generic.

dudeisbrendan03 commented 5 years ago

This requires the RAT to launch with administrative privileges. Sorry I haven't done anything, lots of work lately and after it's done I'll get back to this.

dudeisbrendan03 commented 5 years ago

Need to exploit something to obtain administrative privileges if the user doesn't have them (as we're installing driver's). Also the driver won't be signed so it will not install on most machines, you'll need to disable driver signing (and that will only apply after a reboot).

mvrozanti commented 5 years ago

I hadn't seen that, thanks for pointing that out @dudeisbrendan03 Maybe that funcionality could be enabled/disabled on compile time (i.e.: if the user knows he's got admin priv.)

In case the user has admin priviledges, couldn't we install the drivers, persist the RAT and then wait for the reboot (using only one reboot) before activation?

It may be a cost some users are willing to take on

dudeisbrendan03 commented 5 years ago

We would have to disable signed driver enforcement (which requires elevated permissions)

mvrozanti commented 5 years ago

For Windows 7 I think it's something like that:

bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit.exe -set TESTSIGNING [ON|OFF?]

For Windows 10:

bcdedit.exe /set nointegritychecks on
dudeisbrendan03 commented 5 years ago

bcdedit.exe -set TESTSIGNING ON

dudeisbrendan03 commented 5 years ago

Also requires admin ^

Another idea, try and embed into another process. I've seen RATs that can embed themselves into another process without privilege escalation.

Maybe worth looking into it?

mvrozanti commented 5 years ago

Definitely, but is it possible to maintain? That is, hasn't micro$oft patched this yet??

dudeisbrendan03 commented 5 years ago

It's not something that Microsoft would look into solving. It's up to the process rather than the OS.

Electron apps are usually easy to inject into and are pretty common (e.g. Discord).

mvrozanti commented 5 years ago

I didn't know. I thought it was the other way around. Great idea though, definitely worth looking into