Sample Rootkit for Linux
This is sample rootkit implementation for Linux. It is able to hide processes, files and grants root privileges. It also have stealth mode (enabled by default) that prevents it from detecting.
Just compile module (included Makefile does this against current kernel) and load it. There will be hidden file in
rtkit. It's not visible when listing content of proc directory.
cat /proc/rtkit to see available commands. You can use attached program to give orders or use
echo -n (don't forget
-n, there should be no tailing new line).
echo -n thf >> /proc/rtkit
To gain root you should give "My Pen Is Long" command (popculture reference, without spaces, small letters) and then fork some shell from writing process. rtcmd.py does that for you if second parameter is specified.
tools/rtcmd.py mypenislong /bin/bash
This code should run on Linux version 2.6.29 and higher, since before that
lookup_address symbol wasn't exported. Were tested against 3.1.0, 3.1.5 and 3.1.6 and is fully working (both x86 and x86_64).
Paper describing details of implementation (in polish) is available.
Dual licensed under BSD and GPL.
Ivyl and t3hknr.