2018-07-02 15:20:13 +00:00
|
|
|
# Reptile kernel rootkit details
|
|
|
|
|
|
|
|
|
|
https://github.com/f0rb1dd3n/Reptile
|
2018-07-02 16:14:03 +00:00
|
|
|
|
|
|
|
|
## Environment
|
|
|
|
|
|
|
|
|
|
- Linux kernel 2.6.x/3.x/4.x
|
|
|
|
|
- x86 (`sys_call_table` search method is x86-only)
|
|
|
|
|
|
|
|
|
|
## Persistency
|
|
|
|
|
|
|
|
|
|
Boot-time module loading using OS-specific startup files:
|
|
|
|
|
- /etc/modules
|
|
|
|
|
- /etc/rc.modules
|
|
|
|
|
|
|
|
|
|
## Detection evasion
|
|
|
|
|
|
|
|
|
|
Rootkit is trying to evade from detection by:
|
|
|
|
|
- hiding of own files
|
|
|
|
|
- hiding of kernel module by unlinking from `module_list`
|
|
|
|
|
- tampering contents of startup files while reading
|
|
|
|
|
|
|
|
|
|
## Management interface
|
|
|
|
|
|
|
|
|
|
Implemented via `kill(2)` by hooking `sys_call_table[__NR_kill]` entry. Supported commands are:
|
|
|
|
|
- hiding/unhiding processes
|
|
|
|
|
- hiding/unhiding rootkit's module
|
|
|
|
|
- enabling/disabling of tampering file content function
|
|
|
|
|
- gaining root priveleges to calling process
|
|
|
|
|
|
|
|
|
|
## Altering system (library) behaviour
|
|
|
|
|
|
|
|
|
|
Hooking of system calls by patching syscall-handlers in `sys_call_table[]`.
|
|
|
|
|
|
|
|
|
|
To write to read-only page `CR0/WP` technique used (x86-only).
|
|
|
|
|
|
|
|
|
|
## Hiding (tampering) of file contents
|
|
|
|
|
|
|
|
|
|
Filtering of file content while reading by hooking:
|
|
|
|
|
- `sys_call_table[__NR_read]`.
|
|
|
|
|
|
|
|
|
|
## Hiding of files and directories
|
|
|
|
|
|
|
|
|
|
Filtering of directory entries by hoocking:
|
|
|
|
|
- `sys_call_table[__NR_getdents]`, `sys_call_table[__NR_getdents64]`
|
|
|
|
|
|
|
|
|
|
## Hiding of processes and process trees
|
|
|
|
|
|
|
|
|
|
Filtering PID-like numeric entries while listing `/proc`.
|
|
|
|
|
|
|
|
|
|
Hidden tasks are marked using `task->flags \| 0x10000000`.
|
|
|
|
|
|
|
|
|
|
Not able to hide all threads and children of hidden (parent) process.
|
