I have been trying to find a tool that will log windows events that open and close on start up. Nothing in startup or nothing in the logs either. Any ideas

How and yeah AI or some diphit watching and listening to everything.

So here is the story. I'll be honest, it started with yours truly... mcshit for brains making....friends... with those distinctive group of people that coppied the name that Call of Duty invetrd IN GAME the AK-47. Don't ask.

So bam, I wake up to my windows 11 latitude compromised running a bunch of macros, my iPhone 15 had an ingenious combination of settings that felt like sprinting kind folded through a clown maze just to get the factory reset. Too late, my dumb as thought it worked then they left it "off". EEro modem fucked obv..bht vrt this. Starlink Routed off idk roofs (i tracked the ip after seeing the app installed), then rputing through my printer and pioneer mixer. Nieghbors network auto connecting and creating bluetooth nets when sim, wifi, eathearnet all off. Blue tooth off and airplane mode seemed like macro only activity. Until I fk n set an air tag next to my iPhone and it goes off and my phone triggers a fake shutdown. Bluetooth penetration going through my battle.beaver custom Xbox controller into my Xbox then ended up using my Xbox as a wifi modem as I'm trying to send sos messaging to my family. They r typing broken ilenglish and I'm raging.

When to sleep. Oh before that I took a bunch of video on my cannon power shot...until they figured out how to close the shutter and power it down over and over. Woke back up. Had three interviews, one w SpaceX the next week. Decided to microwave eveverything.

I'll spare the the rest but that was two months ago and I cannot get a windows, Mac, or chrome PC to last more then a day or two. I've gone through 5 new phone numbers probably 12 emails, 8 outlooks 3 clouds, 4 modems.....I work in aerospace and our IT guys have no answers. I'm buying fkn Faraday bags, ubikeys, grounding tape.....it's getting mental. What. The hell. Am. I. Doing. Wrong. I use like literally like 10 applications total. Why does all this shit come with 70 system apps.

Oh forgot the funniest part. After bbqing everything in the microwave, I had only my (what I thought) was off iphone device left. I walk outside to my car. Take two steps past a brand new SUV in an apt parking lot. Trunk beeps and pops open.

I stood there staring at it....nobody was in sight....just me and a crime scene for 5 minutes before I realized Jason Bourne had way more training then me and that's just not fair. So I left and ruined another brand new iPhone 2 hrs later.

Please help. And yes I typed this out in airplane mode. This guy is getting restocked.

So ya....don't buy used anything from best buy..........I stoped using the microwave. 60 days return.

And no I didn't get the job at SpaceRex. Bout to start using the US post office and fax emails.

I've been learning about using Anonymous File Handles in Linux. Wonder if its possible to hide a port using one like a root kit would. I'm not an expert, but it would seem one could do using syscalls. Is this possible? Or is there another way to do this without touching the disk?

Help my school has installed a root kit on my laptop. I am on Debian, is reinstalling Debian enough

Hi! I was wondering if anyone knows any site that I could find to buy a rootkit Thanks in advance

Here is the project https://github.com/h3xduck/triplecross, I'm looking for someone to research it together or someone who is proficient in eBPF rootkit technology. Can they answer a question for me: When using tc and XDP to control RX and TX traffic, what detection can be evaded? (such as Wireshark?) Also, regarding this project, I noticed that the eBPF program needs to be attached using the "tc" command during startup, but how is XDP loaded into it?

Will flashing a BIOS get rid of a rootkit? And if u have one is flashing the BIOS possible?

Hyperjacking/BluePill Attacks

So I know it's possible to install a VM within a operating system and fully take over the system but im wondering if its possible for such an attack to go totally undetected. I've read here are steps you can take to suggest virtualization but I dont think theres a 100% assurance to find out is there? Its kind of like the Matrix, youre completely unaware youre running one. hardware can be infected through something like a USB port....but that would require physical access?

How rare is something like this and once it's on your system and would a factory wipe make it go away? You would either be blissfully ignorant or go mad.

It sounds extremely complex to pull off but I was just reading about it and it sounds terrifying if pulled off correctly... thoughts?

We covered the boot2root challenge Athena from TryHackMe. We scanned the machine with Nmap and discovered SMB server from which we extracted a note that pointed us to a directory on the webserver where we discovered a ping tool running. We used command substitution to inject a bind shell and land the first foothold. We discovered a backup script running on a periodic basis as another user. We modified the script to execute reverse shell and opened another session as the user Athena. Upon enumeration, we found that the user Athena can load kernel modules as sudo using insmod without the need for root password. We downloaded the kernal module "venom.ko" and used Ghidra to reverse engineer the binary. We discovered that it's a rootkit and after code analysis we were able to interact with the module to call a function that escalated privileges from Athena to Root.

Video is here

Writeup is here

I have a galaxy note8 with a custom ROM. I was wondering if there was a way to get the same customization that good lock gives?

so i was in talkback mode just going deep into the web browser and managed to crack the son of a bitch by placing a working sim card halfway into its slot and causing it to wanna go check the number on the sim which was unlocked, it successfully caused the phone to get unlocked just thought i would share that tidbit with you kings

How could I cross compile, assemble and link an Windows Kernel Module/Driver to a SYS file over MingW and GCC compiler AR assembler and LD linker.

Alternatively maybe some other open source tool that runs on Linux for cross compiling assembling and linking that can produce Windows SYS files.

I know SYS files are similar to DLLs also flagged for native subsystem and have DriverEntry function referenced in DRIVER_INITIALIZE callback, but how could I create one from scratch without Windows Driver Kit.

Header files like ntddk.h and others are rewritten for MingW, but what else I need to have and to know to craft a driver.

I was able to find Frank Rysanek archive of an example Windows Driver for cross compiling over MingW but there are some problems.

Does anyone know if there are plans for a 3rd edition of the book "The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System" (ISBN: 144962636X) ? Or if it's perhaps even under way?

I've tried to look around but can't find any information if the author is working on it or not. Thanks!

I'm trying to learn how rootkit works (for educational purposes). I have the source code of Kbeast rootkit. To hide a process from the ps|| pstree etc. command it has the following function,

asmlinkage int h4x_write(unsigned int fd, const char __user *buf,size_t count)
{
   int r;
   char *kbuf=(char*)kmalloc(256,GFP_KERNEL);
   copy_from_user(kbuf,buf,255);
   if ((strstr(current->comm,"ps"))||(strstr(current->comm,"pstree"))||
        (strstr(current->comm,"top"))||(strstr(current->comm,"lsof"))){
            if(strstr(kbuf,_H4X0R_)||strstr(kbuf,KBEAST)){
                   kfree(kbuf);
                   return -ENOENT;
            }
   }
   r=(*o_write)(fd,buf,count);
   kfree(kbuf);
   return r;
}

This function override sys_call_table [__NR_write]. My understanding is *buf, contain the name of the process it is trying to hide. using copy_from_user(), buf is copied into a kernel buffer kbuf and then upon detecting the ps||pstree||... command using strstr(), it looks for the process_to_hide(H4X0R). It a match found then, free the kernel buffer kbuf. Is my understanding is correct?

I check the content of buf. It contains nothing, therefore it never works. Please help me understand this.

Hello. Do you know reason of closing rootkit.com? Do you have any archives from this website? I mean files

Hey, some days ago I bought a book “Rootkits” by Greg Hoglund and James Butler, and it made me really interested in developing own rootkits, but this book is outdated. Does anybody know good book/video/course to make own rootkits?

Hi all, I'd like to ask if the second edition is still relevant for those days and not out of date for any one who wants to start learning about rootkits.

Thanks.

Hi, I am a newbie about bios/uefi rootkit and I'd like to ask u your opinion.

Thus, my questions are:

• Are bios/uefi rootkits real ?

• How can I check my bios/uefi firmware ? are there some check integrity tools ?

• is technically possible to hijack the software bios dump to hide the rootkit it self ?

• is technically possible to infect othere devices like nic or video card to inject a kernel module in the os ?

• is there a way to write-protect bios/uefi reflashing ? maybe the old jumper way ?

• libreboot could be a solution to bios/uefi malware ?

Thank u.

I've been looking up various rootkits and reading about how they worked to try to gain an understanding of their activity, and one that's stumped me is phide2.

I understand that it uses DKOM to hide itself, that it unlinks itself from the EPROCESS list like the FU rootkit, that it unlinks itself from the ETHREAD list as well, and that it implements a private thread scheduler to keep its process running despite being unlinked from the thread lists the scheduler uses to determine process running time, but I'm not sure exactly how it implements that privae scheduler.

My current best guess is that it runs an additional, non-hidden thread which periodically tells the scheduler to execute the hidden threads and keeps those threads off the ETHREAD list for the rest of the time. But doesn't this break the rootkit? If it's running a thread that can't be hidden to implement a private scheduler, what's the point of hiding its hidden threads? There's still a non hidden thread running.

Also, is the Clock Locking Beats rootkit implemented by m0nk (see link, start at 22:00) related to this rootkit? They both seem to do the same thing.

https://youtu.be/gKUleWyfut0