Entries by Administrator

NVlabs | Analyzing Security

Monday, May 19. 2008

NVbit : Accessing Bitlocker volumes from linux

This projects details the Internals/Implementaion of BitLocker Encryption system for Vista.


NVbit is a linux fuse driver to access Windows Vista's Bitlocker Volumes from linux, provided you have the right keys.A white-paper and supporting presentation is also available.The research was done around an year ago.Work was stopped prematurely,Don't expect things in clean/finished shape.The code is in alpha state.
Both the paper and presentation are incomplete draft versions. However, missing things can be referred from nvbit source code.NVbit allows read-only access.(Though writing can be done just in reverse order but still it doesn't exist for now).


NVbit source sode
NVbit Bitlocker presentation
NVbit Bitlocker white_paper
Posted by Administrator in Bitlocker at 11:20

Thursday, April 26. 2007

"0wning Vista from the boot" interview at SecurityFocus

What is Vbootkit?


Nitin & Vipin: Vbootkit is much like a door or a shortcut to access vista's kernel.

A bootkit is a rootkit that is able to load from a boot-sectors (master
boot record, CD , PXE , floppies etc) and persist in memory all the way
through the transition to protected mode and the startup of the OS.


http://www.securityfocus.com/columnists/442


Posted by Administrator in Vbootkit at 17:14

Thursday, April 12. 2007

Black Hat Europe 2007 & HITB Conf. 2007

Vbootkit White-paper and presentation materials


The vbootkit white-paper and presentation slides are now online and can be downloaded below.



Vbootkit Presentation
Vbootkit White Paper

Posted by Administrator in Vbootkit at 15:39

Wednesday, April 11. 2007

Vbootkit in action : screenshots and videos






Vbootkit in action at BootMgr (Windows Vista Boot Manager)




Windows Vista CMD.exe screenshot privilege escalation


Process explorer  showing TCB Trusted Computing Base


nitin_vipin_vista_vbootkit_poc_RC1_edited_video.avi
nitin_vipin_vista_vbootkit_poc_RC2_video.avi
Posted by Administrator in Vbootkit at 09:39

Sunday, February 4. 2007

BOOT KIT: Custom boot sector based Windows 2000/XP/2003 Subversion

BOOT KIT is a project related to custom boot sector code subverting
Windows NT Security Model.The sample presented currently keeps on
escalating cmd.exe to system privileges every 30 secs.


It has several features

  1. It's very small.The basic framework is just about 100 lines of assembly code.It supports 2000,XP,2003
  2. It patches the kernel at runtime(no files are patched on disk).
  3. BOOT KIT is PXE-compatible.
  4. It can even lead to first ever PXE virus
  5. It also enables you to load other root kits if you have physical
    access(Normally root kits can only be loaded by the administrator

The bootkit has been tested with a number of kernel mode shell codes such as Loading Native Applications and drivers from the shell code

another shellcode ,which periodically raises every CMD.EXE to system privileges.


The Source code will contain 4 levels of BOOT KITs(showcasing different payloads)

  1. Basic framework ( Kernel patching has to be done later on) ( available for download )
  2. Privilege escalation framework(demonstrates creating new system
    threads and how to escalate privileges easily) (available for download)
  3. Loading drivers and native applications from kernel mode without touching registry
  4. PXE compatible code(Basic framework).
Bootkit Basic framework Source Code
Boot Kit Advance Version(support Privilege escalation) Source Code
Posted by Administrator in Projects at 15:18

Thursday, February 1. 2007

Loading drivers and Native applications from kernel mode, without touching registry

"How to load driver without touching registry from kernel mode", this is asked almost always.Today,
I will give you an insight into how Windows loads its driver and then will document a new method to load a driver without touching registry.


This is required because even if you exploit kernel vulnerabilities, you still cannot load any driver because almost all existing Antivirus solutions hijack the NTOSkrnl API's ( which let you write to specific registry locations, load drivers etc).



Continue reading "Loading drivers and Native applications from kernel mode, without touching registry"

Posted by Administrator in Vbootkit at 17:12
(Page 1 of 1, totaling 6 entries)

Navigation

Expand All | Collapse All

Syndicate This Blog

XML RSS 0.91 feed
XML RSS 1.0 feed
XML RSS 2.0 feed
ATOM/XML ATOM 0.3 feed
ATOM/XML ATOM 1.0 feed
XML RSS 2.0 Comments

Blog Administration

Open login screen