search

alichtman / gardening-starter-pack

Literally a rootkit. (LKM for Linux Kernels 4.14+)
GNU General Public License v3.0
1 stars 0 forks source link

Write Kbuild script and Makefile to build Kernel Module #12

Closed alichtman closed 5 years ago

alichtman commented 5 years ago

Docs

What is KBuild, really: https://stackoverflow.com/a/29243761 Kbuild Docs: https://www.kernel.org/doc/Documentation/kbuild/modules.txt Makefiles for Kernel Modules: https://unix.stackexchange.com/questions/288540/makefile-installing-external-linux-kernel-module Compiling Kernel Modules: https://wiki.archlinux.org/index.php/Compile_kernel_module

We'll need to compile the khooks library, the rootkit itself, and any plugins we create, which will live in rootkit/plugins/.

alichtman commented 5 years ago

An extra control script that uses these Makefiles is probably the best solution to the build problem. The script should should be implemented in either a Python 3 or Bash. My vote is for Python since it's both easier to write and understand, in my opinion.

There are two important processes we need to script: installation and removal.

Installation

The install process should go something like this:

  1. Check for Linux, root, and the SELinux module.

    • If not Linux, throw exception
    • If not root, throw exception
    • If SELinux is detected, try to disable / work around it. If that fails, throw exception.

  2. Get inputs for installation-specific config (IP for reverse shell, name of rootkit, folders to hide, etc) and generate a config.h file to be compiled along with the kernel module.

  3. Compile rootkit kernel module. The Makefile should be set up such that $ make all is the only call needed for this step.

  4. Install the commands for controlling the rootkit behavior in some directory defined in Step 2. Make them executable, and give only a certain backdoor user access, etc.

  5. Prompt the user to see if they want to nuke the evidence of rootkit installation.

Removal

While in early development stages, a removal that will work is simply: $ sudo rmmod ROOTKIT_MODULE_NAME. After we implement the anti-removal and rootkit hiding features, this will become a bit more complex. We'll dig into this when we're there.

alichtman commented 5 years ago

Here's the build error I'm stuck on:

make -C /lib/modules/4.18.0-16-generic/build M=$PWD
make[1]: Entering directory '/usr/src/linux-headers-4.18.0-16-generic'
  CC [M]  /home/osboxes/gardening-starter-pack/rootkit/rootkit.o
In file included from /home/osboxes/gardening-starter-pack/rootkit/rootkit.c:8:0:
./include/linux/module.h:130:42: error: redefinition of ‘__inittest’
  static inline initcall_t __maybe_unused __inittest(void)  \
                                          ^
/home/osboxes/gardening-starter-pack/rootkit/rootkit.c:75:1: note: in expansion of macro ‘module_init’
 module_init(rootkit_exit);
 ^~~~~~~~~~~
./include/linux/module.h:130:42: note: previous definition of ‘__inittest’ was here
  static inline initcall_t __maybe_unused __inittest(void)  \
                                          ^
/home/osboxes/gardening-starter-pack/rootkit/rootkit.c:74:1: note: in expansion of macro ‘module_init’
 module_init(rootkit_init);
 ^~~~~~~~~~~
./include/linux/module.h:132:6: error: redefinition of ‘init_module’
  int init_module(void) __attribute__((alias(#initfn)));
      ^
/home/osboxes/gardening-starter-pack/rootkit/rootkit.c:75:1: note: in expansion of macro ‘module_init’
 module_init(rootkit_exit);
 ^~~~~~~~~~~
./include/linux/module.h:132:6: note: previous definition of ‘init_module’ was here
  int init_module(void) __attribute__((alias(#initfn)));
      ^
/home/osboxes/gardening-starter-pack/rootkit/rootkit.c:74:1: note: in expansion of macro ‘module_init’
 module_init(rootkit_init);
 ^~~~~~~~~~~
scripts/Makefile.build:325: recipe for target '/home/osboxes/gardening-starter-pack/rootkit/rootkit.o' failed
make[2]: *** [/home/osboxes/gardening-starter-pack/rootkit/rootkit.o] Error 1
Makefile:1534: recipe for target '_module_/home/osboxes/gardening-starter-pack/rootkit' failed
make[1]: *** [_module_/home/osboxes/gardening-starter-pack/rootkit] Error 2
make[1]: Leaving directory '/usr/src/linux-headers-4.18.0-16-generic'
Makefile:2: recipe for target 'all' failed
make: *** [all] Error 2

Edit: I apologize for my incompetence. This speaks for itself: module_init(rootkit_exit);