You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The configuration is stored in `HKEY_LOCAL_MACHINE\SOFTWARE\$77config` and is writable by any process without elevated privileges. The DACL of this key is set to grant full access to any user.
26
+
The configuration is located in `HKEY_LOCAL_MACHINE\SOFTWARE\$77config` and is writable by any process without elevated privileges. The DACL of this key is set to grant full access to any user.
29
27
30
28
The `$77config` key is hidden when RegEdit is injected with the rootkit.
31
29
32
30
## Installer
33
31
34
-
r77 is deployable using a single file `"Install.exe"`. It installs the r77 service that starts before the first user is logged on. This background process injects all currently running processes, as well as processes that spawn later. Two processes are needed to inject both 32-bit and 64-bit processes. Both processes are hidden by ID using the configuration system.
32
+
r77 is deployable using a single file `"Install.exe"`. The installer persists r77 and injects all currently running processes.
35
33
36
34
`Uninstall.exe` removes r77 from the system and gracefully detaches the rootkit from all processes.
37
35
36
+
`Install.shellcode` is the shellcode equivalent of the installer. This way, the installer can be integrated without dropping `Install.exe`. It can simply be loaded into memory, casted to a function pointer, and executed:
37
+
38
+
```
39
+
int main()
40
+
{
41
+
// 1. Load Install.shellcode from resources or from a BYTE[]
42
+
// Ideally, encrypt the file and decrypt it here to avoid scantime detection.
// 3. Cast the buffer to a function pointer and execute it.
50
+
((void(*)())shellCode)();
51
+
52
+
// This is the fileless equivalent to executing Install.exe.
53
+
54
+
return 0;
55
+
}
56
+
```
57
+
38
58
## Child process hooking
39
59
40
60
When a process creates a child process, the new process is injected before it can run any of its own instructions. The function `NtResumeThread` is always called when a new process is created. Therefore, it's a suitable target to hook. Because a 32-bit process can spawn a 64-bit child process and vice versa, the r77 service provides a named pipe to handle child process injection requests.
@@ -103,7 +123,7 @@ Please read the [technical documentation](https://docs.bytecode77.com/r77-rootki
0 commit comments