Download as PDF, PPTX
Uploaded byChia-Hao Tsai
Rootkit 102 - Kernel-Based Rootkit
This document discusses kernel-level rootkits in Linux. It explains that kernel-level rootkits are more robust than user-space rootkits because they can hide processes and prevent system crashes or reboots from revealing the intrusion. It then provides steps for creating a trivial kernel-based rootkit, including loading a kernel module, hooking a system call like getdent64, and overcoming challenges around locating the sys_call_table and modifying kernel memory. The document suggests some new techniques rootkits could use beyond just syscall hooking, and concludes by thanking the reader.
Rootkit 102 - Kernel-Based Rootkit
- 1. Rootkit 102 cmj @2015 1
- 2.
- 3. concept Cheat and Robustenough 3
- 4. Program Bugs User-Space rootkit •process hand, not workable or dead • no one find abnormal Kernel-Space rootkit • system crash • reboot • … etc 4
- 5. Robust is moreimportant than you expected 5
- 6. Otherwise, you areattacking the system 6
- 7. Linux Kernel from linux-2.6.xto linux-3.17.x 1. You should know the target kernel version 2. method may significant difference between version and platform 7
- 8.
- 9. Flow 1. Create aloadable-kernel-module) 2. Decide which syscall you what to hook 3. Implement and debug 9
- 10. Flow 1. Create aloadable-kernel-module) - Overcome by yourself 2. Decide which syscall you what to hook 3. Implement and debug - Overcome by yourself 10
- 11. Hook Syscall Concept 1. Findthe address of the sys_call_table or syscall 2. Replace the registered syscall 11
- 12. sys_call_table 1. Easily way 2.Normal way 3. Violent way 12
- 13. sys_call_table 1. Easily way- Find it out in System.map 2. Normal way 3. Violent way 13
- 14.
- 15. sys_call_table 1. Easily way- Find it out in System.map 2. Normal way - Dump on /proc/kallsyms 3. Violent way 15
- 16.
- 17. sys_call_table 1. Easily way- Find it out in System.map 2. Normal way - Dump on /proc/kallsyms 3. Violent way - Force search all kernel-level memory 17
- 18.
- 19. Memory usage inkernel-space • 0xC0000000 - 0xF0000000 • Using export syscall function • Not always, need to consider the linux version … 19
- 20.
- 21. MileStone • Should wealways need to replace the syscall - clue in kallsyms • Should LKM can modified the memory - write protect 21
- 22.
- 23. You also canhijack • callback fn - syscall hijack • data - link-list struct used in kernel • memory - direct modify data online • … etc 23
- 24. Thanks for yourattention ~ 24