home

forums
    Show me new threads!

bookmarks

post article

view blogs

vault

downloads

Rootkit Collection

Vanquish

post a message Show all posts in this forum view options: unpacked threads | collapsed threads | old style view

how many threads to display: 15305075100300800 search board (text+titles):

---

finding vanquish? (by killachains82 (Untrusted stranger) Apr 07 2009, 10:38 (UTC+0) ) I ran setup.cmd and went to c:\WINDOWS. but then I ran it, and everything staring with vanquish was hidden, which is good. but now I cant find setup because I left it in the vanquish folder. how do I remove it? reply to this message

---

Can you help me? (by michaelwu (Untrusted stranger) Dec 11 2008, 11:29 (UTC+0) ) how can i use this rootkit? thanks!!! reply to this message

---

Compiling Error (by thygamer (Normal user) Dec 29 2007, 17:28 (UTC+0) ) C:\Documents and Settings\Guy\Desktop\vanquish-0.2.1\bin\vanquish-0.2.1-src\injec.cpp(197) : error C2065: 'OpenThread' : undeclared identifier C:\Documents and Settings\Guy\Desktop\vanquish-0.2.1\bin\vanquish-0.2.1-src\injec.cpp(197) : error C2440: '=' : cannot convert from 'int' to 'void *' Conversion from integral type to pointer type requires reinterpret_cast, C-style cast or function-style cast Utils.cpp Whenever i compile i get this error, hThread = OpenThread(THREAD_SET_CONTEXT | THREAD_GET_CONTEXT | THREAD_SUSPEND_RESUME, 0, dwThreadId); I'm using C++, I have VS C++ 2005, and the .net framework sdk. reply to this message

---

Blue Screen (by rootkit_xu (Untrusted stranger) Jul 11 2007, 10:56 (UTC+0) ) Vanquish will not work properly in Windows XP Pro SP2 with IE7 and a lot of KB Patches.System will appear blue screen when user try loging into Windows after Windows is restarted,and also when Windows is shutdowning (It is Intermittent issue not appear every time).And many applications work unstable include Explorer.EXE. Dear XShadow,do you have any update on Vanquish v0.2.1?If yes, could you please send a copy to me via E-Mail:nift@163.com. Thanks in advance. All,sorry for my poor english,I am a chinese. reply to this message

---

Fails to inject into most processes including explorer! (XP2) (by encpx (Untrusted stranger) May 08 2007, 15:13 (UTC+0) ) Running vanquish -install from the windows directory causes the dll to only be injected to a few processes. It is then hidden from those processes only. The remove command then fails to remove the module from most processes. It appears to be loaded many times into each one, or is this part of the attempt to hide it? How should I begin debugging this problem? I'm using vanq compiled from source with no changes. reply to this message      Re: Fails to inject into most processes including explorer! (XP2) (by encpx (Untrusted stranger) May 08 2007, 15:21 (UTC+0) ) Ah, is this DEP in action? I hope so, now I just need to find some information on disabling it. reply to this message

---

Having some problems... (by mistic0017 (Untrusted stranger) Apr 02 2007, 12:52 (UTC+0) ) I'm testing Vanquish on a XP (No SP) VM and I'm having a little trouble getting things to work (that or I'm entirely incompetent). It's entirely possible that I missed what I needed to read... but here goes. I'm building a drive for a forensic investigation class and I need to get a root kit up and running. I've got Vanquish (dl'd off of this site) and I put it up on my VM. I need to hide some processes and files but I suppose I'm failing to understand how to get them to be hidden. I read this line in the ReadMe.txt "Hide files/folders containing the magic string "vanquish"" but failed to understand exactly what I needed to do to get it working. Should I open up the file in a Hex Editor and randomly choose a place to insert the string "vanquish" or do I need to do something far more complicated? Additionally when trying to hide processes I again failed to notice what the "magic string" was. Is it "vanquish" like it is for hiding files? Is it something else entirely? I'd appreciate any help that I can get. Thanks. reply to this message      Re: Having some problems... (by michaelwu (Untrusted stranger) Dec 11 2008, 11:22 (UTC+0) ) the same to you. who can help us? reply to this message

---

Monitoring Software Work-around? (by brodyh (Untrusted stranger) Feb 22 2007, 21:38 (UTC+0) ) I tried to use this rootkit on a computer with CybraryN monitoring software, which is supposed to block the Start menu. However, since Vanquish overwrote the API (right?) the Start menu is re-enabled. Is there a way around this? reply to this message

---

Remove and Re-Install (by Sting3r11 (Untrusted stranger) Dec 01 2006, 02:04 (UTC+0) ) Having a few troubles. Was fooling around with Vanquish earlier, testing some of it capabilities and all the cmds etc. And I "setup do remove" and then did a reboot later on. I then attempt to Re-install as I did want to use it, now I get the msg that its already installed when i try and install it, and get the msg that its removed if I try and remove it... Any ideas? reply to this message      Re: Remove and Re-Install (by Sting3r11 (Untrusted stranger) Dec 01 2006, 02:08 (UTC+0) ) err.. a little clarification; Exact MSG is Removing: Checking for previous installation... Vanquish is not installed. Nothing to remove. Press any key to continue reply to this message      Re: Remove and Re-Install (by BlackBlade (Normal user) Jan 31 2007, 07:16 (UTC+0) ) I got it! If it sais that it is already installed type in command promt (in the setup.cmd) setup do remove It will say its installed in C:\WINDOWS type y them press enter. Then it will say thats its removed and you dont need to restart system! reply to this message      Re: Remove and Re-Install (by kevii (Untrusted stranger) Jun 06 2007, 00:13 (UTC+0) ) What he means is that when he tries to install it says: Previous vanquish already installed so remove And when he tries to remove it says that there is no vanquish SO you cant remove or install Happening to me. sucks reply to this message      Re: Remove and Re-Install (by rootkit_xu (Untrusted stranger) Jul 05 2007, 22:25 (UTC+0) ) Copy vanquish.exe to C:\Windows,and then try again. reply to this message      Re: Remove and Re-Install (by p1p0 (Untrusted stranger) Apr 15 2008, 21:12 (UTC+0) ) That one solved the problem reply to this message

---

Suggesting to improve (by yytg (Normal user) Nov 21 2006, 14:46 (UTC+0) ) Cold be a bug wane hooking a fast "multi thread" process because for a moment the bits you overwrite are changed back ---In that time(almost none) a different thread cold run outside the hook--- I thinking about a idea like this instead of restoring the bits copy them plus a jump I mean like this copy the original bits you need to save to a different location and put a jump in the end of them Example: char firstBitsFunction[10];copybits - to 0-9 in the 10 a - jmp to continue the original function sorry on my bad English reply to this message      Re: Suggesting to improve (by SC_Modder (Rootkit Contributor) Mar 31 2007, 18:47 (UTC+0) ) The problem with that is that ASM opcodes aren't going to be perfectly even on 5 bytes. For example, say you hooked GetCurrentProcessId: GetCurren> 64:A1 18000000 MOV EAX,DWORD PTR FS:[18] 7C809926 8B40 20 MOV EAX,DWORD PTR DS:[EAX+20] 7C809929 C3 RETN Copying the first 5 bytes of that instruction into a buffer and having a JMP after could change that entirely to look like this: GetCurren> 64:A1 180000E9 MOV EAX,DWORD PTR FS:[E9000018] 7C809926 0000 ADD BYTE PTR DS:[EAX],AL 7C809928 0000 ADD BYTE PTR DS:[EAX],AL Which obviously would crash. reply to this message

---

great kit man! could you help me tweak and clear a few bugs up? (by c0w (Untrusted stranger) Jul 18 2006, 10:24 (UTC+0) ) xshadow, Great job on this rootkit man! Just 1 problem (actually 3...) Running Windows xp pro SP2 (v 2002) on a laptop as a test machine. Machine is not on a domain or network. run setup.cmd do install, installs fine. If I log out and log back in again I can see everything and cannot restart the hiding functionality. the 2nd problem is that it does not log usernames and passwords to vanquish.log the 3rd problem is when you remove it the dll file does not delete itself (cus it is in use) take a look at the following: "Checking for previous installation... Vanquish found in C:\WINDOWS Are you sure you want to remove? Press CTRL+C now to abort. Removing... C:\WINDOWS\vanquish.dll Access is denied. Vanquish removed. To complete process you do NOT need to reboot. Press any key to continue." so I have to reboot, then manually remove it. Hope this information helps. Great kit tho man all the way! if I can be of any assistance reply back. reply to this message

---

Win 2k3 Server SP 1 (by fourton (Normal user) May 28 2006, 14:12 (UTC+0) ) I just tested Vanquish on 2003 Server with SP1. setup do install worked fine as usual, but it does not actually hide anything. Can anyone confirm this or give me a hint? Thanks! reply to this message

---

Compile Error! (by toni93 (Normal user) May 09 2006, 13:32 (UTC+0) ) Hello! When i try to compile the source i get the following errors: ----------------------------------------------------------- Deleting intermediate files and output files for project 'DebugV - Win32 Release'. Deleting intermediate files and output files for project 'Vanquish_dll - Win32 Release'. --------------------Configuration: DebugV - Win32 Release-------------------- Compiling... DebugV.cpp Linking... LINK : warning LNK4089: all references to "USER32.dll" discarded by /OPT:REF --------------------Configuration: Vanquish_dll - Win32 Release-------------------- Compiling resources... Compiling... Injector.cpp Injector.cpp(264) : error C2065: 'OpenThread' : undeclared identifier Injector.cpp(264) : error C2440: '=' : cannot convert from 'int' to 'void *' Conversion from integral type to pointer type requires reinterpret_cast, C-style cast or function-style cast Utils.cpp Vanquish_dll.cpp vDllUtils.cpp vHideFiles.cpp vHideReg.cpp vHideServices.cpp vPwdLog.cpp vSourceProtect.cpp Error executing cl.exe. vanquish.dll - 2 error(s), 1 warning(s) ------------------------------------------------------------ Any help would be great! reply to this message      Re: Compile Error! (by deros68x (Normal user) Jul 18 2006, 00:14 (UTC+0) ) add the following line of definitions HANDLE OpenThread(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwThreadId); reply to this message

---

Vanquish v0.2.1 (by xshadow (Project Leader) Nov 04 2005, 17:54 (UTC+0) ) As the subject says :) The new version is out. A bunch of minor bug fixes and *unload* support. Yes, you heard it right... no need to restart computer now to remove Vanquish because it is done dynamically ('vaquish -remove'). Please test it out throughly and let me know if there are are problems as I don't have much free time lately. -XShadow reply to this message      Re: Vanquish v0.2.1 (by helpmsg (Normal user) Mar 27 2007, 21:52 (UTC+0) ) hello xshadow ! If you can, please send me a copy of source.. plz.. e-mail:helpmsg@gmail.com Thank you very much! reply to this message      Re: Vanquish v0.2.1 (by jskk123 (Untrusted stranger) May 17 2006, 02:53 (UTC+0) ) hello xshadow ! If you can, please send me a copy of source.. plz.. e-mail:jskkk123@empal.com Thank you very much! reply to this message      Re: Vanquish v0.2.1 (by junkie213 (Untrusted stranger) May 08 2006, 02:37 (UTC+0) ) I did setup do remove but it said vanquish not installed, nothing to do. BUT i have named a folder vanquish and it disappeares... HELP! reply to this message      Re: Vanquish v0.2.1 (by 0macro0 (Untrusted stranger) Aug 03 2006, 07:23 (UTC+0) ) Yeah, I installed vanquish v0.2.1 on my windows 2003 advanceded server. I did setup.cmd do install and it was installing but it said something along the lines as 'bind' was not an operable command or something of the sort. then it said vanquish had been installed. Now if i name a folder vanquish it just stays as the previous folder name and I cant change its name, delete it, or open it. So I went back and did setup.cmd do uninstall and it said it wasnt a valid command, so then restarted cmd.exe and navigated to the directory the setup.cmd is in and did the command ls and it said that wasnt a valid command. So its messed up and I cant Unistall it. reply to this message      Re: Vanquish v0.2.1 (by banme (Normal user) Apr 16 2007, 18:48 (UTC+0) ) First off ur a moron... second off know when to use ls command and when to use DIR deee dee deeee... bind isnt a operable command cause the bind.exe FILE prolly wasnt in the same Direcory as the setup.cmd file or the startup directory of setup.cmd wasnt set properly or well w.e u get the point do some of ur own footwork and go about things with a more inquisitive attitude and a more in depth research as to why. reply to this message      Re: Vanquish v0.2.1 (by smiller (Untrusted stranger) Aug 20 2008, 17:58 (UTC+0) ) First off, I need to say sorry that I'm a rootkit beginner so please have sympathy, but after I installed Vanquish I wasn't sure what to do next. I'm trying to hide some processes (i.e. netcat and the cmd when I telnet it) and possibly hide the folder that it resides in but I'm not sure what I need to do or how to use this rootkit. I was able to use FU but I always needed the PID for those processes, so I was hoping that Vanquish did it automatically and kept it hidden without intervention on each server 2003 reboot. Help? reply to this message

---

Source is back (by xshadow (Project Leader) Apr 30 2005, 07:35 (UTC+0) ) By popular request, the source is back. Expect a brand-new vanquish release in a few weeks (hopefully). -XShadow reply to this message      Re: Source is back (by Metahuman (Normal user) May 28 2005, 16:31 (UTC+0) ) Hey! Thats great news... Am waiting for the new release! Already been 4 weeks now! reply to this message      Re: Source is back (by banaan (Normal user) Oct 21 2005, 20:13 (UTC+0) ) Just to let you know I'm allso interested in the new source code... Or is it cancelled?! Thanks reply to this message      Re: Source is back (by myth123 (Normal user) Dec 24 2005, 07:14 (UTC+0) ) expecting reply to this message

---

where is src? (by Kilo.XIE (Normal user) Jan 07 2005, 13:40 (UTC+0) ) Vanquish is a good utility. You said that src and bin is in your vault. But i couldn't find src. Can you give me a copy of src? EMAIL: milstone@126.com Kilo.XIE reply to this message      Re: where is src? (by forc1 (Normal user) Nov 13 2006, 02:59 (UTC+0) ) downloads -> xshadow's vault -> vanquish-0.2.1-src.zip reply to this message