👍 [Concept] Application Execution via Memory Stacking * Buffer Overflow

Hey guys it's me once again to itch your brain on a *hopefully interesting topic.

This might seem far fetched and way beyond my capability of creation, but I always wondered. Is it possible to create an application that can target a specified process and toss a "universal bad memory stack" at a "universal addy (Memory Address *no floaters :P)" if not possible mabe a "live list of addy's to select from" mabe an integration of memory scanning. Why the hell would you want that? Again, it is just a concept. I would love to try to use this method to kill hidden rootkits, malware hooked via dll's or even virus hooked into system processes which are kind of a bugger because they are the ones that are unremovable by limited user permissions.

Case scenerio *hopefully I can enlighten you with a nice image* A user calls "Hey buddy, I got a virus on my computer can you remove it?" Standard methods scan then tag and bag. Malware which usually scanning is a waste of time. Repetitive drop locations are fundamental such as application data, locals~1\applic~1, locals~1\temp or locals~1\tempor~1 etc etc..

Task Manager shows a process named "1541515151521251515151.exe". tied to blah.dll in \windows\system32

Let's say we make the application I was talking about. Select the process, run a memory scan and kind of like a brute force nature punt it with buffers until it crashes. Eliminate the application by unhooking the dll from any process it lingers onto and eliminate the suspicious process.

All of this done under the user login remotely from my desk! I wouldn't even need to log off to log back onto an administrator where I await a risk of infecting my profile with actual administrator permissions.

Let me know what you think about it. Is it possible? Yes? If so let's try something. It doesn't even have to be a win32 application it can even be a console application. Any input is accepted!

It certainly is possible, but it just makes no sense. You can crash programs in nearly infinite ways from closing all their handles to triggering interrupts in their context.

You want to use this to kill-off rootkits and malware or even viruses, I know a bit or too about these kinds of programs and here's what inhibits anti-virus/anti-rootkit/anti-malware software from just 'crashing' the party so to speak

First, to use it to kill rootkits you'll have to find and then target these rootkits. Rootkits are among the hardest pieces of software to remove, this is because a rootkit's purpose is to remain undetected. This is the main problem with rootkits: they just can't be found. If you actually found one the problem of removing it still remains. Rootkits -while there are ring 3 rootkits- usually reside in kernel memory (ring 0) usermode programs can't access kernel memory, so you'd have to write a kernel driver to crash the rootkit. This brings with it the risk of crashing the entire system, because in the kernel there's no goofing around like there is in usermode: faults and exceptions if not caught always result in a BSOD or bugcheck. Next, a rootkit does not play by the rules. It may have hooked kernel-mode functions so that it's handle is never exposed to other programs, and certain kernel functions -like psTerminateProcess- may not work even if you found the correct handle. You'd have to code these on your own. If you do that however your code will not be portable, and it won't be very safe either unless you have expert knowledge of each and every thing that happens in the windows kernel, which btw differs in each version of windows.

Next malware, malware is very easy to remove if it doesn't have any other -rootkit or viral- components attached. Just boot into livecd -be it windows, osx or linux- and remove it from there.

Next viruses, viruses are again a big problem, like rootkits one of the purposes of a virus is to remain hidden, it does this by hiding and infecting legit programs. This is of itself a reason why you can't just 'crash' a program infected by a virus: it's still the same program with maybe 0.01% of it's code altered (yes viruses can be that small). Crashing or just removing the entire program would be a real waste (even if it's often the only thing that can be done). Another thing that is problematic about a virus infection is that it doesn't stop at just one single infected program. A very aggressive virus can infect every singe file on your system. Killing and deleting all the programs will leave you with... exactly nothing. So that's no option either. A virus may not even use a stack or buffers that you can use to corrupt, it may work with its own calling scheme as to make it easier to make itself offset independent.

Once you've found a way to find, and deal with a threat like this. You don't crash the program, you just call exit process -your own or the real function- on it's handle and be done.

You're basically looking for a third-party remote administration tool(rat) then? I don't know very much about windows related workstation clusters, but I'm guessing that they have a way to install a single program on all workstations at once right?

Basically you're looking for a rat which you can run with administrator or NT AUTHORITY\SYSTEM privileges(one step above the admins) or one which has a kernel module so that you can close and f*ck other processes on remote computers. These things exists and some are even be free. But I'd warn you (if you work at a government institution) that installing third party applications may not be the best of options. You never know if the author of these pieces of software can be trusted. Even respected and big corporations might include backdoors or loopholes if find out that their software is being used by a government institute.

just reimage the machine they are on. try something like FOG.