网站 › 『病毒分析区』 › .NET Framework Rootkits – Backdoors Inside Your Framework

Hmily 发表于 2009-6-8 18:40

.NET Framework Rootkits – Backdoors Inside Your Framework

This paper introduces a new method that enables an attacker to change the .NET language.

The paper covers various ways to develop rootkits for the .NET framework, so that every EXE/DLL that runs on a modified Framework will behave differently than what it's supposed to do. Code reviews will not detect backdoors installed inside the Framework since the payload is not in the code itself, but rather it is inside the Framework implementation. Writing Framework rootkits will enable the attacker to install a reverse shell inside the framework, to steal valuable information, to fixate encryption keys, disable security checks and to perform other nasty things as described in this paper.

This paper also introduces ".Net-Sploit" - a new tool for building MSIL rootkits that will enable the user to inject preloaded/custom payload to the Framework core DLL.

52pjzy 发表于 2009-6-8 19:58

下了,学习一下!!!!!!!!!!!!!!!!!!!!!!!

zl0071981 发表于 2009-7-8 00:22

:shutup:?????/

wqaq1992 发表于 2009-7-24 11:50

什么东西 英文版

查看完整版本: .NET Framework Rootkits – Backdoors Inside Your Framework