awesome-linux-rootkits/details/reptile.md

# Reptile rootkit details

https://github.com/f0rb1dd3n/Reptile

## Environment

- x86, x86_64
- Linux kernel 2.6.x/3.x/4.x
- Debian/Ubuntu, RHEL/CentOS/Fedora

## Persistency

Boot-time module loading using OS-specific startup files:
 - /etc/modules (debian/ubuntu)
   - https://github.com/linux-rootkits/Reptile/blob/master/setup.sh#L296
 - /etc/rc.modules (redhat/centos/fedora)
   - https://github.com/linux-rootkits/Reptile/blob/master/setup.sh#L298

## Detection evasion

Rootkit is trying to evade from detection by:
 - hiding files by name
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L575
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L619
 - tampering contents of startup files while reading
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L638
 - hiding kernel module by unlinking from `modules`-list
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L145
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L157

## Management interface

Implemented via `kill(2)`:
 - hook`sys_call_table[__NR_kill]`
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L509
 
Supported commands are:
 - hiding/unhiding processes
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L518
 - hiding/unhiding rootkit's module
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L514
 - enabling/disabling of tampering file content function
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L524
 - gaining root priveleges to calling process
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L528

## Altering system behaviour

Hooking of system calls by patching syscall-handlers in `sys_call_table[]`:
 - to write to read-only page `CR0/WP` technique used (x86-only)
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L681
 - netfilter hook (`NF_IP_PRI_FIRST`)
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L356
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L687

## Hiding (tampering) of file contents

Filtering of file content while reading:
 - hook `sys_call_table[__NR_read]`
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L282
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L638

## Hiding of files and directories

Filtering of directory entries:
 - hook `sys_call_table[__NR_getdents]`
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L594
 - hook `sys_call_table[__NR_getdents64]`
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L550

## Hiding of processes and process trees

Filtering PID-like numeric entries while listing `/proc`:
 - getdents/getdents64 hook used
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L619
 - hidden tasks are marked using `task->flags` (bit `0x10000000`)
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L189

## Backdoor/shell

Reverse shell spawning by port-knocking-like technique:
 - magic packet with token used (`ICMP/UDP/TCP`)
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L356
 - spawning root-shell connection to remote host
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L328
   - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L210