Genesis – Generic file (rootkit) dropper

I just wrote this simple rootkit dropper using the curl library which is extremely easy to customize to fit many needs.  Currently there are only three defines to change to specify the file you want to download and run.  Right now I’ve tested it grabbing the file via HTTP and executing it, works very nice.  However the CURL library should allow you to change the protocol define to support many common protocols like FTP.   I plan on trying to reduce the file size of the curl library and adding support for SSL and SSH in the next version.

You can download Genesis at http://www.leetsys.com/programs/genesis/
You can downlaod the curl library at http://curl.haxx.se/download.html.  To Download and compile to work with Dev-CPP follow these steps:

add c:\dev-cpp\bin\ to path
run mingw32-make mingw32 in root curl path
Copy include\curl to dev-cpp include path
If you want to use Dynamic Library (DLL) and greatly reduce the size of Genesis:
copy libcurl.dll to c:\windows\system32
If you want to statically compile Set these options under Linker
#####
add the library - libcurl.a
-lws2_32
-lwldap32
####
Compiler Options set -DCURL_STATICLIB (or #define CURL_STATICLIB within main c file )

I had been programming HTTP communications by hand before and curl has greatly reduced the effort to integrate this functionality into a program.  I’m definitely looking forward to porting over existing programs to use curl.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: