Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM?
Most common anti-rootkit software like
chkrootkit don't find it.
migrated from superuser.com May 21 '11 at 11:22
This question came from our site for computer enthusiasts and power users.
With meterpreter (some) common activities of an attack may include:
Some AV will pick up a plain meterpreter exe dropped on a system, if for example it's sent as part of a malicious document. (virus total link) But that can be quickly overcome with the use of the encoding framework.
As noted by others network based IDS such as Snort has signitures for Meterpreter (assuming the author didn't significantly modify the payload).
To detect this behavior you may want to look more towards a host based IDS. There is a better chance of detection with this type of system since HIDS look specifically for the behavior that I listed rather than file AV signatures. One very well known HIDS is OSSEC. I haven't tested it specifically with meterpreter but I would imagine that it would give a lot of alerts should the above activities be taken.
Avast! with full heuristics can find Meterpreter, as can many other AV solutions.
However, if the shellcode launcher in the Metasploit Framework is modified with shellcodeexec, then standard AV will no longer be able to detect Meterpreter.
You would need to go through every process on the system and look for suspicious entry points (unlikely) or suspicious IATs (Meterpreter uses VirtualAllocEx, CreateProcessA, WriteProcessMemory, CreateRemoteThread, ReadProcessMemory, OpenProcess, CreateServiceA, StartServiceA, and OpenProcessToken by default).
First of all 'meterpreter' is not malware. I gather you mean how to detectet open meterpreter sessions between a compromised machine and the attacker.
Most antivirus can detect meterpreter payloads in memory - they are public, and thats why metasploit has special polymorphic engines to try to hide the payloads. A nice factoid: Commercial tools like canvas exploitation framework make special agreements with antivirus companies to have them not detect their payloads.
Also, you can detect things on the network level if the session is not encrypted (defaults to ssl nowadays): most IDS can detect meterpreter, Snort has signatures for example. You can also detect the initial meterpreter dll upload.
Also, tools exist for the job: Antimeter - http://packetstormsecurity.org/Win/antimeter.zip - it can detect processes that have the malicious dll injected and kill them.
On the host, netstat and process explorer will show funny connections and dlls loaded.
Finally, it isn't true that nothing ever touches the disk: The script first uploads the malicious dll on disk and then injects it into a process.
Generally that sort of thing won't be found by a rootkit detector as it is only in RAM and rootkit detectors look for the obvious persistent elements a rootkit needs.
If this malware is RAM only then it can have the same ability to cause damage as other malware which resides in RAM. As @nealmcb pointed out, unless it can write to persistent storage, then a reboot will fix the issue entirely so generally it will not be much of a worry - it certainly won't be considered a rootkit.
However, as far as detecting a reboot, writing to disk and then moving back out to RAM and covering tracks goes - I wonder if Meterpreter based malware can do that. Theoretically it looks possible.
(feel free to flag your question for migration to security.stackexchange.com for a wider panel of answers)