Rootkits: Subverting the Windows Kernel

Rootkits: Subverting the Windows Kernel

by Greg Hoglund, James Butler
Released July 2005
Publisher(s): Addison-Wesley Professional
ISBN: 0321294319

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

"It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits."
--Mark Russinovich, editor, Windows IT Pro / Windows & .NET Magazine

"This material is not only up-to-date, it defines up-to-date. It is truly cutting-edge. As the only book on the subject, Rootkits will be of interest to any Windows security researcher or security programmer. It's detailed, well researched and the technical information is excellent. The level of technical detail, research, and time invested in developing relevant examples is impressive. In one word: Outstanding."
--Tony Bautts, Security Consultant; CEO, Xtivix, Inc.

"This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors. At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month's security patches installed, Mr. Hoglund and Mr. Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system. Only by understanding these offensive techniques can you properly defend the networks and systems for which you are responsible."
--Jennifer Kolde, Security Consultant, Author, and Instructor

"What's worse than being owned? Not knowing it. Find out what it means to be owned by reading Hoglund and Butler's first-of-a-kind book on rootkits. At the apex the malicious hacker toolset--which includes decompilers, disassemblers, fault-injection engines, kernel debuggers, payload collections, coverage tools, and flow analysis tools--is the rootkit. Beginning where Exploiting Software left off, this book shows how attackers hide in plain sight.

"Rootkits are extremely powerful and are the next wave of attack technology. Like other types of malicious code, rootkits thrive on stealthiness. They hide away from standard system observers, employing hooks, trampolines, and patches to get their work done. Sophisticated rootkits run in such a way that other programs that usually monitor machine behavior can't easily detect them. A rootkit thus provides insider access only to people who know that it is running and available to accept commands. Kernel rootkits can hide files and running processes to provide a backdoor into the target machine.

"Understanding the ultimate attacker's tool provides an important motivator for those of us trying to defend systems. No authors are better suited to give you a detailed hands-on understanding of rootkits than Hoglund and Butler. Better to own this book than to be owned."
--Gary McGraw, Ph.D., CTO, Cigital, coauthor of Exploiting Software (2004) and Building Secure Software (2002), both from Addison-Wesley

"Greg and Jamie are unquestionably the go-to experts when it comes to subverting the Windows API and creating rootkits. These two masters come together to pierce the veil of mystery surrounding rootkits, bringing this information out of the shadows. Anyone even remotely interested in security for Windows systems, including forensic analysis, should include this book very high on their must-read list."
--Harlan Carvey, author of Windows Forensics and Incident Recovery (Addison-Wesley, 2005)

Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection.

Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. They teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.

After reading this book, readers will be able to

  • Understand the role of rootkits in remote command/control and software eavesdropping

  • Build kernel rootkits that can make processes, files, and directories invisible

  • Master key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objects

  • Work with layered drivers to implement keyboard sniffers and file filters

  • Detect rootkits and build host-based intrusion prevention software that resists rootkit attacks

    •

    Table of contents

    1. Copyright
      1. Dedication
    2. Praise for Rootkits
    3. Preface
      1. Historical Background
      2. Target Audience
      3. Prerequisites
      4. Scope
    4. Acknowledgments
    5. About the Authors
    6. About the Cover
    7. 1. Leave No Trace
      1. Understanding Attackers’ Motives
        1. The Role of Stealth
        2. When Stealth Doesn’t Matter
      2. What Is a Rootkit?
      3. Why Do Rootkits Exist?
        1. Remote Command and Control
        2. Software Eavesdropping
        3. Legitimate Uses of Rootkits
      4. How Long Have Rootkits Been Around?
      5. How Do Rootkits Work?
        1. Patching
        2. Easter Eggs
        3. Spyware Modifications
        4. Source-Code Modification
        5. The Legality of Software Modification
      6. What a Rootkit Is Not
        1. A Rootkit Is Not an Exploit
        2. A Rootkit Is Not a Virus
          1. The Virus Problem
      7. Rootkits and Software Exploits
        1. Why Exploits Are Still a Problem
      8. Offensive Rootkit Technologies
        1. HIPS
        2. NIDS
        3. Bypassing the IDS/IPS
        4. Bypassing Forensic Tools
      9. Conclusion
    8. 2. Subverting the Kernel
      1. Important Kernel Components
      2. Rootkit Design
      3. Introducing Code into the Kernel
      4. Building the Windows Device Driver
        1. The Device Driver Development Kit
        2. The Build Environments
        3. The Files
          1. The SOURCES File
          2. The MAKEFILE File
        4. Running the Build Utility
        5. The Unload Routine
      5. Loading and Unloading the Driver
      6. Logging the Debug Statements
      7. Fusion Rootkits: Bridging User and Kernel Modes
        1. I/O Request Packets
        2. Creating a File Handle
        3. Adding a Symbolic Link
      8. Loading the Rootkit
        1. The Quick-and-Dirty Way to Load a Driver
        2. The Right Way to Load a Driver
      9. Decompressing the .sys File from a Resource
      10. Surviving Reboot
      11. Conclusion
    9. 3. The Hardware Connection
      1. Ring Zero
      2. Tables, Tables, and More Tables
      3. Memory Pages
        1. Memory Access Check Details
        2. Paging and Address Translation
        3. Page-Table Lookups
        4. The Page-Directory Entry
        5. The Page-Table Entry
        6. Read-Only Access to Some Important Tables
        7. Multiple Processes, Multiple Page Directories
        8. Processes and Threads
      4. The Memory Descriptor Tables
        1. The Global Descriptor Table
        2. The Local Descriptor Table
        3. Code Segments
        4. Call Gates
      5. The Interrupt Descriptor Table
        1. Other Types of Gates
      6. The System Service Dispatch Table
      7. The Control Registers
        1. Control Register Zero (CR0)
        2. Other Control Registers
        3. The EFlags Register
      8. Multiprocessor Systems
      9. Conclusion
    10. 4. The Age-Old Art of Hooking
      1. Userland Hooks
        1. Import Address Table Hooking
        2. Inline Function Hooking
        3. Injecting a DLL into Userland Processes
          1. Injecting a DLL using the Registry
          2. Injecting a DLL using Windows Hooks
          3. Injecting a DLL using Remote Threads
      2. Kernel Hooks
        1. Hooking the System Service Descriptor Table
          1. Changing the SSDT Memory Protections
          2. Hooking the SSDT
          3. Example: Hiding Processes using an SSDT Hook
        2. Hooking the Interrupt Descriptor Table
          1. SYSENTER
        3. Hooking the Major I/O Request Packet Function Table in the Device Driver Object
          1. Finding the Driver IRP Function Table
          2. IRP Hook Function
          3. IRP Completion Routines
      3. A Hybrid Hooking Approach
        1. Getting into a Process’s Address Space
        2. Memory Space for Hooks
      4. Conclusion
    11. 5. Runtime Patching
      1. Detour Patching
        1. Rerouting the Control Flow Using MigBot
        2. Checking for Function Bytes
        3. Keeping Track of the Overwritten Instructions
        4. Using NonPagedPool Memory
        5. Runtime Address Fixups
      2. Jump Templates
        1. The Interrupt Hook Example
      3. Variations on the Method
      4. Conclusion
    12. 6. Layered Drivers
      1. A Keyboard Sniffer
        1. I/O Request Packet (IRP) and Stack Locations
      2. The KLOG Rootkit: A Walk-through
      3. File Filter Drivers
      4. Conclusion
    13. 7. Direct Kernel Object Manipulation
      1. DKOM Benefits and Drawbacks
      2. Determining the Version of the Operating System
        1. User-Mode Self-Determination
        2. Kernel-Mode Self-Determination
        3. Querying the Operating System Version in the Registry
      3. Communicating with the Device Driver from Userland
      4. Hiding with DKOM
        1. Process Hiding
        2. Device-Driver Hiding
        3. Synchronization Issues
      5. Token Privilege and Group Elevation with DKOM
        1. Modifying a Process Token
          1. Finding the Process Token
          2. Modifying the Process Token
          3. Adding Privileges to a Process Token
          4. Adding SIDs to a Process Token
        2. Faking out the Windows Event Viewer
      6. Conclusion
    14. 8. Hardware Manipulation
      1. Why Hardware?
      2. Modifying the Firmware
      3. Accessing the Hardware
        1. Hardware Addresses
        2. Accessing Hardware Is Not Like Accessing RAM
        3. Timing Considerations
        4. The I/O Bus
        5. Accessing the BIOS
        6. Accessing PCI and PCMCIA Devices
      4. Example: Accessing the Keyboard Controller
        1. The 8259 Keyboard Controller
        2. Changing the LED Indicators
        3. Hard Reboot
        4. Keystroke Monitor
      5. How Low Can You Go? Microcode Update
      6. Conclusion
    15. 9. Covert Channels
      1. Remote Command, Control, and Exfiltration of Data
      2. Disguised TCP/IP Protocols
        1. Beware of Traffic Patterns
        2. Don’t Send Data “in the Clear”
          1. Steganography
        3. Use Time to Your Advantage
        4. Hide Under DNS Requests
        5. “Stego” on ASCII Payloads
        6. Use Other TCP/IP Channels
      3. Kernel TCP/IP Support for Your Rootkit Using TDI
        1. Build the Address Structure
        2. Create a Local Address Object
        3. Create a TDI Endpoint with Context
        4. Associate an Endpoint with a Local Address
        5. Connect to a Remote Server (Send the TCP Handshake)
        6. Send Data to a Remote Server
      4. Raw Network Manipulation
        1. Implementing Raw Sockets on Windows XP
        2. Binding to an Interface
        3. Sniffing with Raw Sockets
        4. Promiscuous Sniffing with Raw Sockets
        5. Sending Packets with Raw Sockets
        6. Forging the Source
        7. Bouncing Packets
      5. Kernel TCP/IP Support for Your Rootkit Using NDIS
        1. Registering the Protocol
        2. The Protocol Driver Callbacks
        3. Moving Whole Packets
      6. Host Emulation
        1. Creating Your MAC Address
        2. Handling ARP
        3. The IP Gateway
        4. Sending a Packet
      7. Conclusion
    16. 10. Rootkit Detection
      1. Detecting Presence
        1. Guarding the Doors
        2. Scanning the “Rooms”
        3. Looking for Hooks
          1. Getting the Address Ranges of Kernel Modules
          2. Finding SSDT Hooks
          3. Finding Inline Hooks
          4. Finding IRP Handler Hooks
          5. Finding IAT Hooks
          6. Tracing Execution
      2. Detecting Behavior
        1. Detecting Hidden Files and Registry Keys
        2. Detecting Hidden Processes
          1. Hooking SwapContext
          2. Different Sources of Process Listings
      3. Conclusion

    Product information

    • Title: Rootkits: Subverting the Windows Kernel
    • Author(s): Greg Hoglund, James Butler
    • Release date: July 2005
    • Publisher(s): Addison-Wesley Professional
    • ISBN: 0321294319