alichtman / gardening-starter-pack

Literally a rootkit. (LKM for Linux Kernels 4.14+)
GNU General Public License v3.0
1 stars 0 forks source link

Add TCP Reverse Shell #7

Open alichtman opened 5 years ago

alichtman commented 5 years ago

Make userspace calls from kernel space.

If we want to do that, first read this.

alichtman commented 5 years ago

Implementation

Still need to figure out how this will actually be called.

alichtman commented 5 years ago

Decided to go with the magic packet approach.

Kernel panic somewhere in the process after the rootkit detects a reverse shell request.

Good tutorials:

  1. Execute usermode helper within a syscall
  2. Magic Packets, almost exactly what I'm trying to do but a bit outdated
  3. Kernel Workqueues 1
  4. Kernel Workqueues 2

Or debug with vmss2core.

How to generate a crash dump for VMware.