diff --git a/3_RootkitTechniques/3.0_hiding_lkm/README.md b/3_RootkitTechniques/3.0_hiding_lkm/README.md index 2e1d0cd..03b2ae6 100644 --- a/3_RootkitTechniques/3.0_hiding_lkm/README.md +++ b/3_RootkitTechniques/3.0_hiding_lkm/README.md @@ -14,4 +14,4 @@ > NOTE: Currently, you can't unload this kernel module without rebooting -> Inspired, in part, by [this](https://github.com/m0nad/Diamorphine) repo. +> Inspired, in part, by the [Diamorphine](https://github.com/m0nad/Diamorphine) repo. diff --git a/3_RootkitTechniques/3.2_kill_signalling/README.md b/3_RootkitTechniques/3.2_kill_signalling/README.md index 20609bf..808f689 100644 --- a/3_RootkitTechniques/3.2_kill_signalling/README.md +++ b/3_RootkitTechniques/3.2_kill_signalling/README.md @@ -18,3 +18,5 @@ * Send signal `64` to any pid again e.g. `kill -64 1' * Observe that the `rootkit` is back in the output of `lsmod` * Unload with `rmmod rootkit` + +> Inspired, in part, by the [Diamorphine](https://github.com/m0nad/Diamorphine) repo. diff --git a/3_RootkitTechniques/3.3_set_root/README.md b/3_RootkitTechniques/3.3_set_root/README.md index a89ebcf..6fe9328 100644 --- a/3_RootkitTechniques/3.3_set_root/README.md +++ b/3_RootkitTechniques/3.3_set_root/README.md @@ -20,3 +20,5 @@ * Note that the signal won't actually be sent to the pid you specify, so any number will do! * Check `whoami` again, and observe that you are now root! * Unload with `rmmod rootkit` + +> Inspired, in part, by the [Diamorphine](https://github.com/m0nad/Diamorphine) repo. diff --git a/3_RootkitTechniques/3.4_hiding_directories/README.md b/3_RootkitTechniques/3.4_hiding_directories/README.md index 56dba29..e5a9d6b 100644 --- a/3_RootkitTechniques/3.4_hiding_directories/README.md +++ b/3_RootkitTechniques/3.4_hiding_directories/README.md @@ -25,3 +25,5 @@ * List the directory contents of wherever you placed the "boogaloo" file, e.g. `ls` * Observe that the "boogaloo" file is missing! * Unload with `rmmod rootkit` + +> Inspired, in part, by the [Diamorphine](https://github.com/m0nad/Diamorphine) repo. diff --git a/3_RootkitTechniques/3.5_hiding_processes/README.md b/3_RootkitTechniques/3.5_hiding_processes/README.md index bd82ba1..dfad709 100644 --- a/3_RootkitTechniques/3.5_hiding_processes/README.md +++ b/3_RootkitTechniques/3.5_hiding_processes/README.md @@ -19,3 +19,5 @@ * Unload with `rmmod rootkit` > Note: Currently, only a single pid at a time can be hidden! Trying to hide another pid will work fine, but it will reveal the first one! + +> Inspired, in part, by the [Diamorphine](https://github.com/m0nad/Diamorphine) repo. diff --git a/3_RootkitTechniques/README.md b/3_RootkitTechniques/README.md index 48ad6a5..2fae847 100644 --- a/3_RootkitTechniques/README.md +++ b/3_RootkitTechniques/README.md @@ -9,3 +9,9 @@ The other more modern method is to use [ftrace](https://www.kernel.org/doc/html/latest/trace/ftrace.html). While it's meant to be used for debugging the kernel, we can use it to replace the arbitrary functions in memory with a hook instead. If you want to understand in detail what's going on with ftrace, then I suggest taking a look at the documentation linked. As far as the function hooking goes, it's quite simple. We give a function declaration for the original function, then we write the function hook. Then, we define the `hooks` array which contains `ftrace_hook` structs containing the name, hook function address and original function address. Once we enter the module initialization function, we just call the `fh_install_hooks()` function defined in `ftrace_helper.h` and pass the `hooks` array to it. This does all the heavy lifting for us. Likewise, when module exit function gets called, we just call the `fh_remove_hooks()` function. + +#### References/Further Reading + +* [Diamorphine](https://github.com/m0nad/Diamorphine) +* [Reptile](https://github.com/f0rb1dd3n/Reptile) +* [Ftrace](https://github.com/ilammy/ftrace-hook)