Skip to content

improving zerosums smbdoor - a silent remote backdoor which abuses undoc. APIs in srvnet.sys

License

Notifications You must be signed in to change notification settings

loneicewolf/smbdoor

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

41 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

smbdoor

🟢 Fixed crash/shellcode not executing. see callbacks.c for more info.


"old" below

☢️ finally Win11 soon done

Windows 11 now works; but will need to do further testing

ExtraPulsar

The proof-of-concept smbdoor.sys driver is a silent remote backdoor that does not bind new sockets or perform function modification hooking. Instead it abuses undocumented APIs in srvnet.sys to register itself as a valid SMB handler. It then listens on the already-bound ports 139/445 for special packets in which to execute secondary shellcode. In several ways, it has similarities with DoublePulsar and DarkPulsar, as well as ToxicSerpent.

Of course, it comes with practical limitations that make it mostly an academic exploration, but I thought it might be interesting to share, and is possibly something EDR products should monitor.

Detection:

Releases

No releases published

Packages

No packages published

Languages

  • C 95.4%
  • Python 3.4%
  • Batchfile 1.2%