.NET Framework Rootkits

最新推荐文章于 2025-11-23 21:36:02 发布

原创最新推荐文章于 2025-11-23 21:36:02 发布 · 1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#.net #security

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

本文介绍了一种新技术，攻击者可通过此技术修改.NET语言并隐藏恶意代码于其核心中。通过为.NET框架开发rootkits，使得运行在其上的所有EXE/DLL表现出异常行为。由于恶意载荷被植入框架实现内部，传统的代码审查难以发现这些后门。

http://www.cgisecurity.net/2008/11/net-framework-r.html

"The paper introduces a new method that enables an attacker to change the
.NET language, and to hide malicious code inside its core.

It covers various ways to develop rootkits for the .NET framework, so
that every EXE/DLL that runs on a modified Framework will behave
differently than what it's supposed to do. Code reviews will not detect
backdoors installed inside the Framework since the payload is not in the
code itself, but rather it is inside the Framework implementation.
Writing Framework rootkits will enable the attacker to install a reverse
shell inside the framework, to steal valuable information, to fixate
encryption keys, disable security checks and to perform other nasty
things as described in this paper."

Paper Link: http://www.applicationsecurity.co.il/.NET-Framework-Rootkits.aspx