Awesome-Mirrors/awesome-linux-rootkits
1
0
Fork 0
mirror of https://github.com/milabs/awesome-linux-rootkits.git synced 2025-02-01 18:45:07 -05:00
Code Issues Packages Projects Releases Wiki Activity

Update reptile.md

Browse Source
This commit is contained in:
Ilya V. Matveychikov 2018-07-02 20:17:31 +04:00 committed by GitHub
parent 30806e974b
commit 7c30b030b7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
details/reptile.md
View File

@ -10,15 +10,15 @@ https://github.com/f0rb1dd3n/Reptile
## Persistency ## Persistency
Boot-time module loading using OS-specific startup files: Boot-time module loading using OS-specific startup files:
- /etc/modules - /etc/modules (debian/ubuntu)
- /etc/rc.modules - /etc/rc.modules (redhat/centos/fedora)
## Detection evasion ## Detection evasion
Rootkit is trying to evade from detection by: Rootkit is trying to evade from detection by:
- hiding of own files - hiding files by name
- hiding of kernel module by unlinking from `module_list`
- tampering contents of startup files while reading - tampering contents of startup files while reading
- hiding kernel module by unlinking from `module_list`
## Management interface ## Management interface
@ -30,19 +30,19 @@ Implemented via `kill(2)` by hooking `sys_call_table[__NR_kill]` entry. Supporte
## Altering system (library) behaviour ## Altering system (library) behaviour
Hooking of system calls by patching syscall-handlers in `sys_call_table[]`. Hooking of system calls by patching syscall-handlers in `sys_call_table[]`:
- to write to read-only page `CR0/WP` technique used (x86-only)
To write to read-only page `CR0/WP` technique used (x86-only).
## Hiding (tampering) of file contents ## Hiding (tampering) of file contents
Filtering of file content while reading by hooking: Filtering of file content while reading by hooking:
- `sys_call_table[__NR_read]`. - `sys_call_table[__NR_read]`
## Hiding of files and directories ## Hiding of files and directories
Filtering of directory entries by hoocking: Filtering of directory entries by hoocking:
- `sys_call_table[__NR_getdents]`, `sys_call_table[__NR_getdents64]` - `sys_call_table[__NR_getdents]`
- `sys_call_table[__NR_getdents64]`
## Hiding of processes and process trees ## Hiding of processes and process trees