[TOOL] Patchfinder 2 - Windows Server Compromises Detector

From: SecuriTeam (support_at_securiteam.com)
Date: 01/20/04

  • Next message: SecuriTeam: "[NT] The Bat! Memory Corruption When Parsing Multipart PGP Signed Messages" 
    To: list@securiteam.com
Date: 20 Jan 2004 11:31:18 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Patchfinder 2 - Windows Server Compromises Detector
    ------------------------------------------------------------------------

    DETAILS

    Patchfinder (PF) is sophisticated diagnostic utility designed to detected
    system libraries and kernel compromises. Its primary use is to check if
    the given machine has been attacked with some modern rootkits, i.e.
    programs that tries to hide attacker's activity on the hacked system by
    cheating operating system about the list of active processes, files on
    file system, running services, registry contents, etc...

    New release (2.x) of PF is the first version, which is designed to be not
    only a proof of concept code for developers, but also to be useful tool
    for administrators. To make a proper use of the PF, every user should read
    this paper.

    With this tool you should be able to detect even the newest versions of
    such rootkits like: Hacker Defender, APX, Vaniquish, He4Hook, and many
    more...

    Due to its design, PF is not able to detect rootkits that exploits DKOM
    (Direct Kernel Object Manipulation) technology, first introduced by James
    Butler in his paper [2] and implemented in fu rootkit [1]. However, you
    can use klister [5] utility in order to detect such rootkits.

    ADDITIONAL INFORMATION

    [1] fuzen_op, fu_rootkit, <http://rootkit.com> http://rootkit.com.

    [2] James Butler et al., HIDDEN PROCESSES: The Implication for Intrusion
    Detection, Proceedings of the 2003 IEEE Workshop on Information Assurance
    United States Military Academy, West Point, NY, June, 2003.

    [5] Joanna Rutkowska, klister tool, <http://www.rootkit.com>
    http://www.rootkit.com.

    The complete guide can be found at: <http://rootkit.com/>
    http://rootkit.com/.

    The tool can be downloaded from: <http://rootkit.com/>
    http://rootkit.com/.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] The Bat! Memory Corruption When Parsing Multipart PGP Signed Messages"

    Relevant Pages