rootkit | Linux rootkit for Ubuntu | Security library

by nurupo C Version: Current License: GPL-2.0

X-Ray Key Features Code Snippets Community Discussions(10)Vulnerabilities Install Support

kandi X-RAY | rootkit Summary

rootkit is a C library typically used in Security applications. rootkit has no bugs, it has no vulnerabilities, it has a Strong Copyleft License and it has low support. You can download it from GitHub.

A simple Linux kernel rootkit written for fun, not evil.

Support

Quality

Security

License

Reuse

Support

rootkit has a low active ecosystem.

It has 713 star(s) with 205 fork(s). There are 32 watchers for this library.

It had no major release in the last 6 months.

There are 0 open issues and 3 have been closed. On average issues are closed in 21 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of rootkit is current.

Quality

rootkit has 0 bugs and 0 code smells.

Security

rootkit has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

rootkit code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

rootkit is licensed under the GPL-2.0 License. This license is Strong Copyleft.

Strong Copyleft licenses enforce sharing, and you can use them when creating open source projects.

Reuse

rootkit releases are not available. You will need to build from source code and install.

Installation instructions, examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of rootkit

Get all kandi verified functions for this library.

rootkit Key Features

No Key Features are available at this moment for rootkit.

rootkit Examples and Code Snippets

No Code Snippets are available at this moment for rootkit.

Community Discussions

Trending Discussions on rootkit

getdents() syscall implementation for rootkit

How to compile a linux kernel module for different linux kernel

how to delete .htaccess file recursive based on size or content

GNU `rename` - number pad multiple occurrences within the same file name

Imblearn SMOTE: How to set the sample_strategy parameter for a multiclass imbalance dataset?

Why a running cronjob causes a new random gpg-agent process running and causes cached passphrase in gpg-agent invalid?

How to replace a value in pandas?

Intercepting RDTSC instruction in KVM

What is the easiest way to create a raw disk image of a VMware guest?

Logs not getting sent to AWS Cloudwatch when docker in detached or foreground

QUESTION

getdents() syscall implementation for rootkit

Asked 2021-Dec-28 at 02:46

I plan to hook my own version of getdents() for my rootkit. Code is here:

...

ANSWER

Answered 2021-Dec-28 at 02:46

So the line should be something like this then: d = (struct linux_dirent *) ((dirp + bpos)/size(linux_dirent));

No - dirp / sizeof(linux_dirent) makes little sense, the offset of dirp from 0 has no relation to the size of the structure. Dividing memory address by the size of the structure... it's just some unrelated address.

You meant, like, to divide only the offset from the memory location, and then add the resulting pointer to the pointer. Well, along:

Source https://stackoverflow.com/questions/70502181

QUESTION

How to compile a linux kernel module for different linux kernel

Asked 2021-May-29 at 13:57

I am sort of new to kernel programming, but i have been struggling a ton with this issue for days now. I have a machine with linux kernel '5.10.0-kali7-amd64' and im using it for development of a linux kernel module for Ubutnu 16.04.4 '4.4.0-119-generic', but i can't figure out any way that i can compile it on my machine for that version and for it to actually work on the 4.4.0 kernel machine.

The closest i've got is this:

I downloaded source from https://launchpad.net/ubuntu/xenial/+package/linux-headers-4.4.0-119 and installed with dpkg
I then downloaded and installed the 4.4.0-119-generic from https://www.ubuntuupdates.org/package/core/xenial/main/updates/linux-image-4.4.0-119-generic
Both of them installed with no issue.
I compiled my module by using in my Makefile make -C /lib/modules/4.4.0-119-generic/build M=$(PWD) modules which also worked and compiled my hello world module.

However when uploaded to the 4.4.0 machine the insmod errored saying insmod: ERROR: could not insert module rootkitMy.ko: Invalid module format. The dmesg says: module: rootkit: Unknown rela relocation: 4 I then compiled my source code on the 4.4.0 machine and created a module with literally the exact same modinfo, but that one did work. here are the modinfos for both:

...

ANSWER

Answered 2021-May-29 at 13:57

I managed to resolve the issue. Unknown rela relocation: 4 is an insmod error you get due to a change in the way the kernel handles PLT, more specifically the R_X86_64_PC32 and R_X86_64_PLT32. With binutils >= 2.31, the linker has decided to use R_X86_64_PLT32 relocations, which aren't supported in the older kernel.

To fix this:

I downloaded an older version of binutils (2.26.1) from https://ftp.gnu.org/gnu/binutils/
extracted the folder from the archive
compiled the binutils to /usr/local/binutils-2.6 by running

Source https://stackoverflow.com/questions/67742807

QUESTION

how to delete .htaccess file recursive based on size or content

Asked 2021-Apr-23 at 09:05

Can someone help me with terminal / ssh command to recursively go through folder structures and either delete .htaccess files with permission of 0444 and/or if possible to match the first line in the file for a safety measure.

Had a few accounts compromised on a server, which cleared up the malware / rootkits but noticed it added .htaccess files inside every folder with the following content:

...

ANSWER

Answered 2021-Apr-23 at 08:53

You can use find to go recursively through multiple directories, search for files and execute a command like rm on the result.

Source https://stackoverflow.com/questions/67226131

QUESTION

GNU `rename` - number pad multiple occurrences within the same file name

Asked 2021-Apr-19 at 08:31

Advanced use of GNU utility rename

TLDR: Number pad every number occurrence delimited by a .
Example 11.2.7 to 11.02.07

Note: not incremental - I wish to preserve existing numbers as they reference chapters

Here we have a list of files ...

ANSWER

Answered 2021-Apr-19 at 04:18

I suggest:

Source https://stackoverflow.com/questions/67155763

QUESTION

Imblearn SMOTE: How to set the sample_strategy parameter for a multiclass imbalance dataset?

Asked 2021-Apr-01 at 14:58

I'm trying to process a dataset with network attacks that has the following shape:

...

ANSWER

Answered 2021-Apr-01 at 14:58

By default the sampling_strategy of SMOTE is not majority,

'not majority': resample all classes but the majority class

so, if the sample of the majority class is 812814, you'll have

Source https://stackoverflow.com/questions/66903468

QUESTION

Why a running cronjob causes a new random gpg-agent process running and causes cached passphrase in gpg-agent invalid?

Asked 2020-Oct-12 at 10:59

The below simple script is used to check a valid passphrase in gpg-agent cache. When a passphrase is valid, it will just print OK but if a passphrase invalid then it prints a Warning message.

...

ANSWER

Answered 2020-Oct-12 at 10:59

Finally I can reproduce this problem. When I run this script on cronjob:

Source https://stackoverflow.com/questions/64123311

QUESTION

How to replace a value in pandas?

Asked 2020-Sep-08 at 07:05

Trying to group 23 different labels in second last column of "KDDTest+.csv" into four groups. Please note, I have deleted the last column of the csv prior to doing this.

I have read the .csv file using

...

ANSWER

Answered 2020-Sep-08 at 05:01

Maybe you are using "neptune." instead of "neptune"

My tests seem to work with "neptune"

Source https://stackoverflow.com/questions/63787308

QUESTION

Intercepting RDTSC instruction in KVM

Asked 2020-Jul-28 at 15:00

I am trying to debug a rootkit in a virtual environment. From reversing I know that it uses super simple CPU timing checks, that look something like this (source pafish):

...

ANSWER

Answered 2020-Jul-19 at 12:01

Well... The code above that I posted works, but only on Intel CPUs. Sadly I did not notice that.

To make it work on AMD CPU, I needed to modify arch/x86/kvm/svm/svm.c:

Source https://stackoverflow.com/questions/62970242

QUESTION

What is the easiest way to create a raw disk image of a VMware guest?

Asked 2020-Jun-20 at 12:43

I have a Vmware guest and i want to create a raw disk image of it so i can do further forensics on it, the reason I don't want to create the image in a live matter from inside the VM is that there might be some kernel rootkits there and so it might change the real output

so what is the best approach here to create a disk image of a Vmware guest? i know its possible using virtual box, but what about Vmware?

...

ANSWER

Answered 2020-Jun-18 at 14:28

I'd probably download an official image from pages like https://www.osboxes.org/ubuntu/. I am to lazy to create an image myself.

Source https://stackoverflow.com/questions/62447500

QUESTION

Logs not getting sent to AWS Cloudwatch when docker in detached or foreground

Asked 2020-Jun-13 at 06:58

When I run the docker script in interactive mode it works. I can see the logs in the console and also in AWS CloudWatch Logs. The below docker script runs in interactive mode and I have added the awslogs configuration so the logs go into cloudwatch. docker awslogs configuration

...

ANSWER

Answered 2020-Jun-13 at 06:58

By default, Docker uses a json-file driver, which writes JSON-formatted logs to a container-specific file on the host where the container is running. Refer this docker logging

Giving -t option assigns pseudo tty through which main process of docker outputs logs to the virtual terminal. And aws log-driver looks for tty to capture logs. Look at this how -t option works and specifically answer number 3 in this post.

Source https://stackoverflow.com/questions/62191749

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install rootkit

Warm up your VM of choice.

Support

The rootkit was tested to work on Linux kernels 2.6.32-38 and 4.4.0-22 as provided by Ubuntu in Ubuntu 10.04.4 LTS and Ubuntu 16.04 LTS respectively, but it should be very easy to port to kernels in-between, as well as newer ones. There is some architecture-specific code in the rootkit which is implemented only for x86 and x86-64 architectures. That's the code for finding the system call table, disabling write-protected memory and one of the two function hooking methods. It should be very easy to port to a new architecture, and some of this code is not strictly necessary for the rootkit to function, e.g. the non-portable hooking method could be stripped away, though you must be a very boring person if you are willing to miss on the fun of function hooking that overwrites machine code of the target kernel function such that it calls our hook function instead. The rootkit was tested only with 1 CPU core, so it may or may not function correctly on a multi-core system. It likely won't run very well on a multi-core system as the rootkit was written expecting there to be only 1 thread executing anything at any given time, so it lacks atomic writes/reads and mutexes around list data structures.

Find more information at: