Nidhogg

Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with your C2 framework.

Nidhogg can work on any version of x64 Windows 10 and Windows 11.

This repository contains a kernel driver with a C++ program to communicate with it.

If you want to know more, check out the wiki for a detailed explanation.

Current Features

[!IMPORTANT]
All the features have been fully tested up to Windows 11 25H2. If you encounter a problem, please open an issue after checking there isn't already an open issue.

• Process hiding and unhiding
• Process elevation
• Process protection (anti-kill and dumping)
• Bypass memory scanners (e.g. pe-sieve)
• Thread hiding and unhiding
• Thread protection (anti-kill)
• File protection (anti-deletion and overwriting)
• Registry keys and values protection (anti-deletion and overwriting)
• Registry keys and values hiding
• Listing currently protected or hidden processes, threads, files, ports, registry keys and values
• Function patching
• Built-in AMSI bypass
• Built-in ETW patch
• Process signature (PP/PPL) modification
• Can be reflectively loaded
• Shellcode Injection
  • APC
  • NtCreateThreadEx
• DLL Injection
  • APC
  • NtCreateThreadEx
• Listing kernel callbacks
  • ObCallbacks
  • Process and thread creation routines
  • Image loading routines
  • Registry callbacks
• Removing and restoring kernel callbacks
• Disabling / Enabling ETW providers (e.g. ETW-TI)
• Module hiding and unhiding
• Driver hiding and unhiding
• Credential Dumping
• Port hiding and unhiding
• Nidhogg Object File (NOF) for kernel-mode COFF execution

Reflective loading

[!WARNING]
When doing reflective loading, there are features that will be disabled by default and the automatic graceful unload of hidden modules and unhooking callbacks will not work as well. It is the user's responsibility to ensure to manually unload any hidden modules upon process termination and unhook any callbacks if the target driver is unloading. Failing to do so may lead to system instability or crashes.

Since version v0.3, Nidhogg can be reflectively loaded with kdmapper but because PatchGuard will be automatically triggered if the driver registers callbacks, Nidhogg will not register any callback. Meaning, that if you are loading the driver reflectively these features will be disabled by default:

• Process protection
• Thread protection
• Registry operations

Nidhogg Object File (NOF)

Since version v2.0, Nidhogg has a new capability named "Nidhogg Object File" (NOF) for kernel-mode COFF execution. This means, you can write your own kernel-mode code and compile it to a COFF file which has access to:

• Windows kernel (ntoskrnl) API
• Syscalls
• Nidhogg's API (coming in v2.1)

This feature is not compatible with Virtualization Based Security (VBS) as it violates both HVCI and kCFG.

Script Execution (DEPRECATED IN V2.0)

Since version v1.0, Nidhogg can execute NidhoggScripts - a tool that allows one to execute a couple of commands one after another, thus, creating playbooks for Nidhogg. To see how to write one check out the wiki.

Due to hard maintainability and the fact that it isn't a popular feature, it has been deprecated in version v2.0 and will be removed in the next major release. It will be replaced with another capability named "Nidhogg Object File" (NOF) for kernel-mode COFF execution, which will have access to Nidhogg's API.

Initial Operations (DEPRECATED IN V2.0)

Since version v1.0, Nidhogg can execute NidhoggScripts as initial operations as well. Meaning, that if it spots the file out.ndhg in the root of the project directory (the same directory as the Python file) it will execute the file each time the driver is running.

Due to hard maintainability and the fact that it isn't a popular feature, it has been deprecated in version v2.0 and will be removed in the next major release. It will be replaced with another capability named "Nidhogg Object File" (NOF) for kernel-mode COFF execution, which will have access to Nidhogg's API.

PatchGuard triggering features

[!CAUTION]
The following features are known to trigger PatchGuard, you can still use them at your own risk.

• Process hiding
• File protecting
• Driver hiding

Basic Usage

To see the available commands you can run NidhoggClient.exe or look at the wiki for detailed information regarding how to use each command, the parameters it takes and how it works.

NidhoggClient.exe

# Simple usage: Hiding a process
NidhoggClient.exe process hide 3110

Setup

Building the client

To compile the client, you will need to have Visual Studio 2022 installed and then just build the project like any other Visual Studio project.

Building the driver

To compile the project, you will need the following tools:

• Visual Studio 2022
• Windows Driver Kit

Clone the repository and build the project:

git clone https://github.com/Idov31/Nidhogg.git --recurse-submodules

Driver Testing

To test it in your testing environment run those commands with elevated cmd:

bcdedit /set testsigning on

After rebooting, create a service and run the driver:

sc create nidhogg type= kernel binPath= C:\Path\To\Driver\Nidhogg.sys
sc start nidhogg

Debugging

To debug the driver in your testing environment run this command with elevated cmd and reboot your computer:

bcdedit /debug on

After the reboot, you can see the debugging messages in tools such as DebugView.

Resources

• Windows Kernel Programming Book
• Kernel Structure Documentation
• Registry Keys Hiding
• Process Signatures
• NtCreateThreadEx Hotfix
• Credential Dumping
• Port Hiding
• Logo
• Termcolor

Contributions

Thanks a lot to those people who contributed to this project: