3 ms·
Remote proctor software is nothing but security theatre. It's so laughable the little effort they put at all to prevent any sort of cheating whatsoever. I crea
by gzer0 4y ago
Remote proctor software is nothing but security theatre. It's so laughable the little effort they put at all to prevent any sort of cheating whatsoever.
I created my own ring 3 rootkit (user land) and infected my own system to modify registry values to hide remote software to allow complete and total pwnage of the exam itself.
TerminateBlacklist:
mov [esp-4], esi
lea esp, [esp-4]
push offset loc_C81CF9
push ds:TerminateProcess
jmp locret_6CCBD5
EnumerateBlacklist:
mov edx, g_Globals
mov ecx, [edx+0C904h]
mov eax, [edx+0C8FCh]
mov esi, [edx+0C91Ch]
mov eax, [ecx+eax]
mov [esi+edi+28h], eax
add edi, 2Ch
The pointer ‘g_Globals’ is a 4-byte pointer- seen multiple times in the main module.
Opening ‘g_Globals’ in memory and browsing through the pointers accessed above such as 0x0C91C brings us to a custom array type containing hundreds of strings.
Taking a look through the struct type and looking back at the array iteration code, wrote a basic structure and dumped all blacklisted processes:
class BlacklistedProcess
{
public:
PCHAR window_name;
PCHAR process_name;
char pad[0x24];
};
Here's a list of all current blacklisted processes:
https://pastebin.com/raw/bidPLAU7 https://pastebin.com/raw/bidPLAU7