Hacker Defender Article in Hakin9 Magazine

Its been a year, might as well release to everyone else who hasn't bothered to just email me and ask for it :-)

from June 07 issue: http://www.hakin9.org/prt/view/back-issues/issue/690.html

Keep in mind

1. I wrote this over a year ago
&
2. I probably wont be rewriting it, so tailor comments accordingly

Hacker Defender: Rootkit for the Masses -- Link

Hacker Defender article now available on LSO

While not a total membership drive, my HackerDefender rootkit article is available over on LearnSecurityOnline for registered members

Link to article on hakin9
http://www.hakin9.org/en/haking/issues/6_2007.html

if someone has serious heartburn about not wanting to sign up, leave a comment and maybe i'll get motivated to put it on the carnal main site or email it to you.

Hacker Defender Rootkit article published in hakin9 magazine

I'm happy to announce that my Hacker Defender Article was published in this month's hakin9 magazine.

http://www.hakin9.org/en/haking/issues/6_2007.html



Premium LSO Members can see it on the site, and it will get posted on carnal0wnage after the magazine has done its run in the book stores.

Big thanks to MC for the 0day for the client side demo in the article

its basically a how-to on using the rootkit since i found the readme to not be enough detail to actually deploy it. we use metasploit to pop a meterpreter shell using a client side exploit, upload the rootkit, then we change some registry keys, show how Hacker Defender hides processes and we play with the backdoor client. Hopefully its useful...we'll let the hate mail decide :-)

Antivirus and Rootktis

So i was working on a article on using HackerDefender rootkit. Hopefully it will be published soon, i'll update on that when/if it happens. During the course of doing the demo for it i wanted to see how the metasploit killAV meterpeter script would do against mcaffee. it didnt do well at all, the mcaffee AV had something running that i couldnt turn it off using that script or with task manager, but if you turned off the "on protect" you could run the script and kill the rest of the AV on the box. of further interest and calls for more research is the stack overflow prevention that stopped a simple metasploit attack cold :-( i'm gonna play and see if there are ways around that either with encoding or if it protects against heap overflows.

anyway, assuming they dont have the stack protection on and you can get a shell, the easiest thing may be a vnc payload where you can just disable the AV by hand (virtual hand) and then upload your rootkit on the box. that brings the whole someone may see you doing it issue but will still get the job done.

more to follow if the ADD doesnt kick in too bad and i get off on a different tangent.

-CG