BOOT KIT: Custom boot sector based Windows 2000/XP/2003 Subversion

NVlabs | Analyzing Security

Sunday, February 4. 2007

BOOT KIT: Custom boot sector based Windows 2000/XP/2003 Subversion

BOOT KIT is a project related to custom boot sector code subverting
Windows NT Security Model.The sample presented currently keeps on
escalating cmd.exe to system privileges every 30 secs.


It has several features

  1. It's very small.The basic framework is just about 100 lines of assembly code.It supports 2000,XP,2003
  2. It patches the kernel at runtime(no files are patched on disk).
  3. BOOT KIT is PXE-compatible.
  4. It can even lead to first ever PXE virus
  5. It also enables you to load other root kits if you have physical
    access(Normally root kits can only be loaded by the administrator

The bootkit has been tested with a number of kernel mode shell codes such as Loading Native Applications and drivers from the shell code

another shellcode ,which periodically raises every CMD.EXE to system privileges.


The Source code will contain 4 levels of BOOT KITs(showcasing different payloads)

  1. Basic framework ( Kernel patching has to be done later on) ( available for download )
  2. Privilege escalation framework(demonstrates creating new system
    threads and how to escalate privileges easily) (available for download)
  3. Loading drivers and native applications from kernel mode without touching registry
  4. PXE compatible code(Basic framework).
Bootkit Basic framework Source Code
Boot Kit Advance Version(support Privilege escalation) Source Code
Posted by Administrator in Projects at 15:18

Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

No comments

The author does not allow comments to this entry

Navigation

Expand All | Collapse All

Syndicate This Blog

XML RSS 0.91 feed
XML RSS 1.0 feed
XML RSS 2.0 feed
ATOM/XML ATOM 0.3 feed
ATOM/XML ATOM 1.0 feed
XML RSS 2.0 Comments

Blog Administration

Open login screen