Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM?

Most common anti-rootkit software like rkhunter and chkrootkit don't find it.

share|improve this question
    
But is meterpreter a rootkit in the first place? Isn't it just ordinary malware? –  CodeInChaos May 21 '11 at 9:19
    
Migrating at request of OP. –  DMA57361 May 21 '11 at 11:21
add comment

migrated from superuser.com May 21 '11 at 11:22

This question came from our site for computer enthusiasts and power users.

3 Answers

Generally that sort of thing won't be found by a rootkit detector as it is only in RAM and rootkit detectors look for the obvious persistent elements a rootkit needs.

If this malware is RAM only then it can have the same ability to cause damage as other malware which resides in RAM. As @nealmcb pointed out, unless it can write to persistent storage, then a reboot will fix the issue entirely so generally it will not be much of a worry - it certainly won't be considered a rootkit.

However, as far as detecting a reboot, writing to disk and then moving back out to RAM and covering tracks goes - I wonder if Meterpreter based malware can do that. Theoretically it looks possible.

(feel free to flag your question for migration to security.stackexchange.com for a wider panel of answers)

share|improve this answer
1  
Hmmm - sounds like a worry to me - it can do a lot of damage until the next reboot. And wouldn't it be possible for malware using meterpreter to detect a reboot, and temporarily find a way to persist until the reboot, then erase those tracks and go back into memory? Not so robust as a rootkit, but harder to detect, it seems. –  nealmcb May 21 '11 at 1:53
    
+1 agreed - I originally was just looking at it from the perspective of a rootkit. Updated as per your comment. –  Rory Alsop May 21 '11 at 9:16
add comment

First of all 'meterpreter' is not malware. I gather you mean how to detectet open meterpreter sessions between a compromised machine and the attacker.

Most antivirus can detect meterpreter payloads in memory - they are public, and thats why metasploit has special polymorphic engines to try to hide the payloads. A nice factoid: Commercial tools like canvas exploitation framework make special agreements with antivirus companies to have them not detect their payloads.

Also, you can detect things on the network level if the session is not encrypted (defaults to ssl nowadays): most IDS can detect meterpreter, Snort has signatures for example. You can also detect the initial meterpreter dll upload.

Also, tools exist for the job: Antimeter - http://packetstormsecurity.org/Win/antimeter.zip - it can detect processes that have the malicious dll injected and kill them.

On the host, netstat and process explorer will show funny connections and dlls loaded.

Finally, it isn't true that nothing ever touches the disk: The script first uploads the malicious dll on disk and then injects it into a process.

share|improve this answer
1  
"A nice factoid: Commercial tools like canvas exploitation framework make special agreements with antivirus companies to have them not detect their payloads." Is it public knowledge or some private info? –  Nam Nguyen May 21 '11 at 13:20
    
I heard it from a very experienced pentester, on stage, during a talk in a recent conference.. So I guess it's semi-public. –  john May 21 '11 at 13:26
    
+1 for process explorer. –  user2213 May 21 '11 at 17:44
add comment

Avast! with full heuristics can find Meterpreter, as can many other AV solutions.

However, if the shellcode launcher in the Metasploit Framework is modified with shellcodeexec, then standard AV will no longer be able to detect Meterpreter.

You would need to go through every process on the system and look for suspicious entry points (unlikely) or suspicious IATs (Meterpreter uses VirtualAllocEx, CreateProcessA, WriteProcessMemory, CreateRemoteThread, ReadProcessMemory, OpenProcess, CreateServiceA, StartServiceA, and OpenProcessToken by default).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.