eversinc33/banshee

Experimental Windows x64 Kernel Rootkit.

                                                          o88                          ooooooo     ooooooo   
 ooooooooo8 oooo   oooo ooooooooo8 oo oooooo    oooooooo8 oooo  oo oooooo    ooooooo o88    888o o88    888o 
888oooooo8   888   888 888oooooo8   888    888 888ooooooo  888   888   888 888     888   88888o      88888o  
888           888 888  888          888                888 888   888   888 888       88o    o888 88o    o888 
  88oooo888     888      88oooo888 o888o       88oooooo88 o888o o888o o888o  88ooo888  88ooo88     88ooo88   
                                                                                      
Bird App: @eversinc33
Blog: https://eversinc33.com
XMR: 87ohrQtKaVWcwjRpcSvNEU2u9Spm9ny5tBQ3JQRjT8TPeEMhUTYxdUo7iPUxgLicyb4mgALcqPxVj7bHs2f2rX2e2TLKpqZ

Stats

banshee's Issues

Communication issue

Hello mate! Nice job!
I tested your project and found some troubles with communication.
Driver create objects:

BeCreateNamedEvent(&commandEvent, &commandEventName, FALSE);
BeCreateNamedEvent(&answerEvent, &answerEventName, FALSE);
BeCreateSharedMemory(&hSharedMemory, &pSharedMemory);

with SYSTEM token integrity.
So Client need to have SYSTEM token for communicate with driver.
Why I can't to use local administrator token for communication?
I think that is possible to make low integrity HANDLEs in Driver.
In user-space if Driver is load, you can open Driver's HANDLE with low integrity token.

Cannot open include file 'ntifs.h'

Hi, thanks for sharing the project, i can manage to compile fine the bansheeclient but i get this error with banshee

Error | C1083 | Cannot open include file: 'ntifs.h': No such file or directory | Banshee | C:\temp\Banshee\Banshee\Driver.cpp | 1 |  

using windows 10 22h2 build 19045.3086
and
Microsoft Visual Studio Community 2022
Version 17.6.3
VisualStudio.17.Release/17.6.3+33801.468
Microsoft .NET Framework
Version 4.8.04084
Installed Version: Community
Visual C++ 2022 00482-90000-00000-AA404
Microsoft Visual C++ 2022
ASP.NET and Web Tools 17.6.326.62524
ASP.NET and Web Tools
Azure App Service Tools v3.0.0 17.6.326.62524
Azure App Service Tools v3.0.0
C# Tools 4.6.0-3.23259.8+c3cc1d0ceeab1a65da0217e403851a1e8a30086a
C# components used in the IDE. Depending on your project type and settings, a different version of the compiler may be used.
Cookiecutter 17.0.23087.1
Provides tools for finding, instantiating and customizing templates in cookiecutter format.
Dotfuscator Community Edition 6.5.3+7f0b0a9d18
PreEmptive Protection - Dotfuscator CE
Microsoft JVM Debugger 1.0
Provides support for connecting the Visual Studio debugger to JDWP compatible Java Virtual Machines
NuGet Package Manager 6.6.0
NuGet Package Manager in Visual Studio. For more information about NuGet, visit https://docs.nuget.org/
Python - Profiling support 17.0.23087.1
Profiling support for Python projects.
Python with Pylance 17.0.23087.1
Provides IntelliSense, projects, templates, debugging, interactive windows, and other support for Python developers.
Syntax Visualizer 1.0
An extension for visualizing Roslyn SyntaxTrees.
Test Adapter for Boost.Test 1.0
Enables Visual Studio's testing tools with unit tests written for Boost.Test. The use terms and Third Party Notices are available in the extension installation directory.
Test Adapter for Google Test 1.0
Enables Visual Studio's testing tools with unit tests written for Google Test. The use terms and Third Party Notices are available in the extension installation directory.
TypeScript Tools 17.0.20329.2001
TypeScript Tools for Microsoft Visual Studio
Visual Basic Tools 4.6.0-3.23259.8+c3cc1d0ceeab1a65da0217e403851a1e8a30086a
Visual Basic components used in the IDE. Depending on your project type and settings, a different version of the compiler may be used.
Visual F# Tools 17.6.0-beta.23174.5+0207bea1afae48d9351ac26fb51afc8260de0a97
Microsoft Visual F# Tools
Visual Studio IntelliCode 2.2
AI-assisted development for Visual Studio.

any ideas ? i do something wrong ?
thanks