search

f0rb1dd3n / Reptile

LKM Linux rootkit
2.53k stars 571 forks source link

is there gonna be kernel 5.X support? #100

Open cnilsecure opened 3 years ago

cnilsecure commented 3 years ago

Hi,

On the newer linux (centos 8 included) you cant compile this because of trojan because if kernel 5 is there gonna be a new version soon to support it? Best Regards

thau0x01 commented 3 years ago

Hi,

On the newer linux (centos 8 included) you cant compile this because of trojan because if kernel 5 is there gonna be a new version soon to support it? Best Regards

The most recent version of Reptile supports Kernel 5.X :)

cnilsecure commented 3 years ago

Make failing

make[1]: Entering directory '/usr/src/linux-headers-5.4.0-1030-kvm' CC [M] /root/reptile/output/module.o /root/reptile/kernel/module.c: In function ‘hide’: /root/reptile/kernel/module.c:16:19: error: ‘struct module’ has no member named ‘sect_attrs’ 16 | kfree(THIS_MODULE->sect_attrs); | ^~ /root/reptile/kernel/module.c:17:13: error: ‘struct module’ has no member named ‘sect_attrs’ 17 | THIS_MODULE->sect_attrs = NULL; | ^~ make[2]: [scripts/Makefile.build:275: /root/reptile/output/module.o] Error 1 make[1]: [Makefile:1757: /root/reptile/output] Error 2 make[1]: Leaving directory '/usr/src/linux-headers-5.4.0-1030-kvm'

thau0x01 commented 3 years ago

Make failing

make[1]: Entering directory '/usr/src/linux-headers-5.4.0-1030-kvm' CC [M] /root/reptile/output/module.o /root/reptile/kernel/module.c: In function ‘hide’: /root/reptile/kernel/module.c:16:19: error: ‘struct module’ has no member named ‘sect_attrs’ 16 | kfree(THIS_MODULE->sect_attrs); | ^~ /root/reptile/kernel/module.c:17:13: error: ‘struct module’ has no member named ‘sect_attrs’ 17 | THIS_MODULE->sect_attrs = NULL; | ^~ make[2]: [scripts/Makefile.build:275: /root/reptile/output/module.o] Error 1 make[1]: [Makefile:1757: /root/reptile/output] Error 2 make[1]: Leaving directory '/usr/src/linux-headers-5.4.0-1030-kvm'

@cnilsecure Which command did you ran?

cnilsecure commented 3 years ago

same as the manual: make

thau0x01 commented 3 years ago

same as the manual: make

@cnilsecure you must run make menuconfig :)

cnilsecure commented 3 years ago

obviously already did that you asked which command i ran to get this output so the command it failed on was make

thau0x01 commented 3 years ago

So, @cnilsecure i was looking at your issue and just realized why it is happening.

Looks like your kernel was not compiled with the option CONFIG_KALLSYMS enabled, and the attribute sect_attrs of the module struct is only defined when this setting is enabled.

Also, For security reasons, in recent releases of the kernel, some kernel functions like kallsyms_lookup_name() and kallsyms_on_each_symbol() and their related features are not exported by default anymore.

This means that you should rebuild the kernel you are compiling your reptile against with the CONFIG_KALLSYMS option enabled.

This setting will instruct the kernel to export such symbols.

Reference: Commit: 0bd476e6c67190b5eb7b6e105c8db8ff61103281