Quake3World

This question might be a tad beyond this forum for reasons that'll be obvious to anyone who can answer it for me:

Can anyone outline a process to get an exe file running under root on a windows XP machine? I specifically need to run a program that will be invisible to a process running under a regular administrator account, and this is the only method I know to accomplish this.

In other words, I would like to learn how to deliberately rootkit my own PC with an application of my choosing.

You might want to take a look at http://www.rootkit.com/

^misantropia^ wrote:You might want to take a look at http://www.rootkit.com/

Thanks, been digging around there for a while. Looks like I'll need to roll my own from some of the supplied.

if it's corporate espionage you're looking to detect, what you really need is an inline usb keylogger.

Not at all. I rolled my own solution, and it worked pretty well.

I wanted to do some packet inspection on warrock, but since punkbuster is part of it you have to go a bit further to do it. I guess from the position I'm in now I could probably also inject packets, but I'm not so interested in that.

Correct me if I'm wrong, but that wouldn't be invisible to an administrator account, would it?

^misantropia^ wrote:Correct me if I'm wrong, but that wouldn't be invisible to an administrator account, would it?

No, but if you use a common name then it will most likely be overlooked.

zomg32 process

Foo wrote:Not at all. I rolled my own solution, and it worked pretty well.

I wanted to do some packet inspection on warrock, but since punkbuster is part of it you have to go a bit further to do it. I guess from the position I'm in now I could probably also inject packets, but I'm not so interested in that.

I smell horse shit. Why would you not want it visible to administrator on your own PC? Simple packet inspection can be done with ethereal or just about anything, for that matter. Yeah it's pretty obvious, you fucking hacking piece of dung beetle offal.

I'm emailing your work. I know right where it is, I saw a picture of it once.

Underpants? wrote:

Foo wrote:Not at all. I rolled my own solution, and it worked pretty well.

I wanted to do some packet inspection on warrock, but since punkbuster is part of it you have to go a bit further to do it. I guess from the position I'm in now I could probably also inject packets, but I'm not so interested in that.

I smell horse shit. Why would you not want it visible to administrator on your own PC? Simple packet inspection can be done with ethereal or just about anything, for that matter. Yeah it's pretty obvious, you fucking hacking piece of dung beetle offal.

Once more for the slow ones:

Foo wrote:I wanted to do some packet inspection on warrock, but since punkbuster is part of it you have to go a bit further to do it.

Underpants? wrote:I'm emailing your work. I know right where it is, I saw a picture of it once.

NOES!!!!