Bind Rootkits with Trojan servers??

greenguyy2 · Post by **greenguyy2** » 02 Feb 2009, 17:05

hello the point of root kits are to bind them with trojans to make them undetectable?

Post by **DNR** » 02 Feb 2009, 17:11

Trojans are used to drop a payload, whether its a rootkit or some simple malware.

the point of a rootkit is to allow a backdoor - so you can get back into the computer/server.

If you have already gained access to a server, you don't need a trojan to install the rootkit.

Check the forum for binder/rootkit threads

DNR

greenguyy2 · Post by **greenguyy2** » 02 Feb 2009, 17:15

Yea i mean for instants a RAT program like poison ivy say you have made a server.. can you use a binder to bind the root kit with it to make it undetectable?

Swan · Post by **Swan** » 02 Feb 2009, 17:16

of course....what they do, and how they do it, is (as I referred to previously in your other thread) entirely contingent on the author.

Post by **DNR** » 02 Feb 2009, 17:18

watch the area you are trying to understand - Undetectable is a general term - somethings are UD under only certain circumstances. Undetectable under what circumstance? - it might pass a AVP screen, but under scrutiny under Process Explorer - and a experienced eye - maybe not..

DNR

greenguyy2 · Post by **greenguyy2** » 02 Feb 2009, 17:27

im saying in general is the point of a root kit to bind with something to make it undetectable

Post by **DNR** » 02 Feb 2009, 17:53

no.

The rootkit is UD based on where you hide it, what processes have been corrupted to allow your backdoor to exist.

Rootkits depend on the OS, as they are specific to where to hide or what processes it needs to attach to.

You can install a rootkit without a trojan.
rootkits like trojans and viruses, do have a signature or heuristic behavior that can be detected by Firewalls or AVPs. So the idea is to alter its behavior to make it UD, to have it attach to a legit process that has been validated by a AVP or firewall.

DNR

greenguyy2 · Post by **greenguyy2** » 10 Feb 2009, 19:53

i still not getting it

Post by **bad_brain** » 11 Feb 2009, 14:20

many people confuse this a little, a rootkit is usually that is used to compromise a system in first place....it is used when the system is compromised already to grant stealth access to the system in the future.
so it's nothing you can send, the "victim" clicks on it and voila: system compromised! you need system access first in order to install it...