cinno / rootkit Goto Github PK

/**********************************************************
	Last Updated: Nov 16, 2014
	CSE509 System Security 2014 Fall @CS SBU
	Written By: 
		Hyungjoon Koo ([email protected])
		Yaohui Chen ([email protected])
***********************************************************/

A. The Rootkit Framework
	Platform
		Tested at ubuntu linux 12.04 LTS kernel 3.2.0-29-generic
		Should be working 3.x kernel version with an appropriate syscall table addr

	Module name
		kcr.ko
		Koo-Chen-Rootkit
		Kernel Cracking Rootkit
		
	Directory structure
		src/kcr.c : 
			Define main function
			Does device registration 
			Hijack linux system call table

		src/dev.c : 
			Misc device operations
			read, write, open, etc

		src/helpers.c: 
			Define helper functions

		src/HJ_x.c:  
			Functions related to hijacking a ¡°x¡± system call 
			All hijackings follow the same patterns
				i.e HJ_ls.c, HJ_ps.c, HJ_read.c, etc.
		
		src/backdoor.c
			Allows a backdoor when having a specific seteuid

		headers/dev.h
		headers/helpers.h
		headers/HJ_ls.h
			Describe headers to the corresponding source code

		headers/all.h: 
			Describe common <linux/*> or <asm/*>  headers
			Include all src/*.c files just for convenience :)

		headers/config.h: 
			Include all.h, and global variables and macros


B. Features (http://securitee.org/teaching/cse509/files/projects/project1.html)
	Required implementation
		Hide specific files and directories from showing up when a user does "ls" and similar commands
			Hide defined prefixes (i.e hide_, bad_, )
			Support dynamically changed prefixes
		Modify the /etc/passwd and /etc/shadow file to add a backdoor account 
			while returning the original contents of the files (pre-attack) 
			when a normal user requests to see the file (sys_read)
		Hides processes from the process table when a user does a "ps"
	Additional implementation
		Key logging (Not yet)
			Either saving keystrokes to local file or sending it out to remote site
		Backdoor
			Allowing a normal program to have a root privilege
		Hide the connections (Not yet)
			Opening/listening ports
			i.e netstat
		Hide the rootkit module itself 
			i.e lsmod
			
C. Usage
	$ make && sudo insmod kcr.ko