diff --git a/3_RootkitTechniques/3.3_set_root/README.md b/3_RootkitTechniques/3.3_set_root/README.md index 8a39ccf..a89ebcf 100644 --- a/3_RootkitTechniques/3.3_set_root/README.md +++ b/3_RootkitTechniques/3.3_set_root/README.md @@ -4,6 +4,8 @@ > Updated to use [ftrace](https://www.kernel.org/doc/html/latest/trace/ftrace.html) instead of directly modifying kernel memory +> There is now a blog post explaining this module in more detail! Check it out [here](https://xcellerator.github.io/posts/linux_rootkits_03/)! + Similar to [Section 3.2](../3.2_kill_signalling/), we can abuse hooking `sys_kill` to trigger a function that gives root to any process that sends a `64` signal to a process (as before, signal `64` is normally unused). According to [credentials.rst](https://github.com/torvalds/linux/blob/master/Documentation/security/credentials.rst#altering-credentials), we can only modify the `cred` struct of our own process, and not that of any other process. This means that we can't give an already running process root privileges unless we send the `64` signal from that process! Quite a clever security feature!