[Concept] Application Execution via Memory Stacking * Buffer Overflow
[Concept] Application Execution via Memory Stacking * Buffer Overflow
Hey guys it's me once again to itch your brain on a *hopefully interesting topic.
This might seem far fetched and way beyond my capability of creation, but I always wondered. Is it possible to create an application that can target a specified process and toss a "universal bad memory stack" at a "universal addy (Memory Address *no floaters :P)" if not possible mabe a "live list of addy's to select from" mabe an integration of memory scanning. Why the hell would you want that? Again, it is just a concept. I would love to try to use this method to kill hidden rootkits, malware hooked via dll's or even virus hooked into system processes which are kind of a bugger because they are the ones that are unremovable by limited user permissions.
Case scenerio *hopefully I can enlighten you with a nice image* A user calls "Hey buddy, I got a virus on my computer can you remove it?" Standard methods scan then tag and bag. Malware which usually scanning is a waste of time. Repetitive drop locations are fundamental such as application data, locals~1\applic~1, locals~1\temp or locals~1\tempor~1 etc etc..
Task Manager shows a process named "1541515151521251515151.exe". tied to blah.dll in \windows\system32
Let's say we make the application I was talking about. Select the process, run a memory scan and kind of like a brute force nature punt it with buffers until it crashes. Eliminate the application by unhooking the dll from any process it lingers onto and eliminate the suspicious process.
All of this done under the user login remotely from my desk! I wouldn't even need to log off to log back onto an administrator where I await a risk of infecting my profile with actual administrator permissions.
Let me know what you think about it. Is it possible? Yes? If so let's try something. It doesn't even have to be a win32 application it can even be a console application. Any input is accepted!
This might seem far fetched and way beyond my capability of creation, but I always wondered. Is it possible to create an application that can target a specified process and toss a "universal bad memory stack" at a "universal addy (Memory Address *no floaters :P)" if not possible mabe a "live list of addy's to select from" mabe an integration of memory scanning. Why the hell would you want that? Again, it is just a concept. I would love to try to use this method to kill hidden rootkits, malware hooked via dll's or even virus hooked into system processes which are kind of a bugger because they are the ones that are unremovable by limited user permissions.
Case scenerio *hopefully I can enlighten you with a nice image* A user calls "Hey buddy, I got a virus on my computer can you remove it?" Standard methods scan then tag and bag. Malware which usually scanning is a waste of time. Repetitive drop locations are fundamental such as application data, locals~1\applic~1, locals~1\temp or locals~1\tempor~1 etc etc..
Task Manager shows a process named "1541515151521251515151.exe". tied to blah.dll in \windows\system32
Let's say we make the application I was talking about. Select the process, run a memory scan and kind of like a brute force nature punt it with buffers until it crashes. Eliminate the application by unhooking the dll from any process it lingers onto and eliminate the suspicious process.
All of this done under the user login remotely from my desk! I wouldn't even need to log off to log back onto an administrator where I await a risk of infecting my profile with actual administrator permissions.
Let me know what you think about it. Is it possible? Yes? If so let's try something. It doesn't even have to be a win32 application it can even be a console application. Any input is accepted!
It certainly is possible, but it just makes no sense. You can crash programs in nearly infinite ways from closing all their handles to triggering interrupts in their context.
You want to use this to kill-off rootkits and malware or even viruses, I know a bit or too about these kinds of programs and here's what inhibits anti-virus/anti-rootkit/anti-malware software from just 'crashing' the party so to speak
First, to use it to kill rootkits you'll have to find and then target these rootkits. Rootkits are among the hardest pieces of software to remove, this is because a rootkit's purpose is to remain undetected. This is the main problem with rootkits: they just can't be found. If you actually found one the problem of removing it still remains. Rootkits -while there are ring 3 rootkits- usually reside in kernel memory (ring 0) usermode programs can't access kernel memory, so you'd have to write a kernel driver to crash the rootkit. This brings with it the risk of crashing the entire system, because in the kernel there's no goofing around like there is in usermode: faults and exceptions if not caught always result in a BSOD or bugcheck. Next, a rootkit does not play by the rules. It may have hooked kernel-mode functions so that it's handle is never exposed to other programs, and certain kernel functions -like psTerminateProcess- may not work even if you found the correct handle. You'd have to code these on your own. If you do that however your code will not be portable, and it won't be very safe either unless you have expert knowledge of each and every thing that happens in the windows kernel, which btw differs in each version of windows.
Next malware, malware is very easy to remove if it doesn't have any other -rootkit or viral- components attached. Just boot into livecd -be it windows, osx or linux- and remove it from there.
Next viruses, viruses are again a big problem, like rootkits one of the purposes of a virus is to remain hidden, it does this by hiding and infecting legit programs. This is of itself a reason why you can't just 'crash' a program infected by a virus: it's still the same program with maybe 0.01% of it's code altered (yes viruses can be that small). Crashing or just removing the entire program would be a real waste (even if it's often the only thing that can be done). Another thing that is problematic about a virus infection is that it doesn't stop at just one single infected program. A very aggressive virus can infect every singe file on your system. Killing and deleting all the programs will leave you with... exactly nothing. So that's no option either. A virus may not even use a stack or buffers that you can use to corrupt, it may work with its own calling scheme as to make it easier to make itself offset independent.
Once you've found a way to find, and deal with a threat like this. You don't crash the program, you just call exit process -your own or the real function- on it's handle and be done.
You want to use this to kill-off rootkits and malware or even viruses, I know a bit or too about these kinds of programs and here's what inhibits anti-virus/anti-rootkit/anti-malware software from just 'crashing' the party so to speak
First, to use it to kill rootkits you'll have to find and then target these rootkits. Rootkits are among the hardest pieces of software to remove, this is because a rootkit's purpose is to remain undetected. This is the main problem with rootkits: they just can't be found. If you actually found one the problem of removing it still remains. Rootkits -while there are ring 3 rootkits- usually reside in kernel memory (ring 0) usermode programs can't access kernel memory, so you'd have to write a kernel driver to crash the rootkit. This brings with it the risk of crashing the entire system, because in the kernel there's no goofing around like there is in usermode: faults and exceptions if not caught always result in a BSOD or bugcheck. Next, a rootkit does not play by the rules. It may have hooked kernel-mode functions so that it's handle is never exposed to other programs, and certain kernel functions -like psTerminateProcess- may not work even if you found the correct handle. You'd have to code these on your own. If you do that however your code will not be portable, and it won't be very safe either unless you have expert knowledge of each and every thing that happens in the windows kernel, which btw differs in each version of windows.
Next malware, malware is very easy to remove if it doesn't have any other -rootkit or viral- components attached. Just boot into livecd -be it windows, osx or linux- and remove it from there.
Next viruses, viruses are again a big problem, like rootkits one of the purposes of a virus is to remain hidden, it does this by hiding and infecting legit programs. This is of itself a reason why you can't just 'crash' a program infected by a virus: it's still the same program with maybe 0.01% of it's code altered (yes viruses can be that small). Crashing or just removing the entire program would be a real waste (even if it's often the only thing that can be done). Another thing that is problematic about a virus infection is that it doesn't stop at just one single infected program. A very aggressive virus can infect every singe file on your system. Killing and deleting all the programs will leave you with... exactly nothing. So that's no option either. A virus may not even use a stack or buffers that you can use to corrupt, it may work with its own calling scheme as to make it easier to make itself offset independent.
Once you've found a way to find, and deal with a threat like this. You don't crash the program, you just call exit process -your own or the real function- on it's handle and be done.
I totally agree with you. A few things though, I work in a gov environment with like 10,000 end users that have pretty much extreme limited access. I am trying to find a way to fix an issue without having to log them off or run down 6 floors and pop a cd into their computer to boot up in linux mode just to remove a virus, even out in the field the school custodians love to watch their videos and end up getting viruses and it would be alot of time to spend cleaning up their computers especially when their network is saturated from other people watch videos in the same building. I really appreciate the description on rootkits I had a very vague idea on how they work, most appreciated. As for standard malware where they like to hook onto multiple processes ya you can kill the processes, but as a standard user with limited access when i view their screen via remote assistance I can't kill system processes unless I run as local administrator or my domain admin id. I just find it a bit prolonging to have to keep running as each layer just to remove a process etc. The idea I thought of which does seem a bit illogical could come in handle to bypass simple layers of security such as run as to kill tighty processes. Plus, for job security I would be the only one to handle this at my job, the only one to understand how the program works LOL. This is a huge place I work at and basically I am their security pen dude that believe it or not they give me immunity to fuck around and/or test their switches without eyes over my shoulder. That is why I kinda like this idea. No I can't create the program, however it is an open sourced concept we can all work on as a team project so we all can own a copy and can have this form of job security over any other regular employees that rely on their "Sysinternals Utilities" :P.
You're basically looking for a third-party remote administration tool(rat) then? I don't know very much about windows related workstation clusters, but I'm guessing that they have a way to install a single program on all workstations at once right?
Basically you're looking for a rat which you can run with administrator or NT AUTHORITY\SYSTEM privileges(one step above the admins) or one which has a kernel module so that you can close and f*ck other processes on remote computers. These things exists and some are even be free. But I'd warn you (if you work at a government institution) that installing third party applications may not be the best of options. You never know if the author of these pieces of software can be trusted. Even respected and big corporations might include backdoors or loopholes if find out that their software is being used by a government institute.
Basically you're looking for a rat which you can run with administrator or NT AUTHORITY\SYSTEM privileges(one step above the admins) or one which has a kernel module so that you can close and f*ck other processes on remote computers. These things exists and some are even be free. But I'd warn you (if you work at a government institution) that installing third party applications may not be the best of options. You never know if the author of these pieces of software can be trusted. Even respected and big corporations might include backdoors or loopholes if find out that their software is being used by a government institute.
You're right about that, not the best type of program to run in a business environment. I was hoping more in the line of a new creation with my idea. It should work I just don't have the brains just yet to build it. Especially the memory scan integration. Hoping we some brainstormers and develop it as an open sourced program. Even if you build it privately I would even buy it. lol It's a unique tool! I love unique tools!
just reimage the machine they are on. try something like FOG.
