f0rb1dd3n / Reptile

LKM Linux rootkit
2.54k stars 571 forks source link

How to use the Hiding Files Function? #30

Closed Asuings closed 6 years ago

Asuings commented 6 years ago

Thanks for your nice work! I still can't understand how to use the Hiding Files Function. In readme: Hide/unhide files contents: kill -51 0 and all content between the tags will be hidden

content to hide

what i did(use all default setting) : [root@TEST ~]# cd Reptile [root@TEST Reptile]# ls installer.sh libpcap-1.5.3.tar.gz README.md sbin libpcap-1.5.3 Makefile rep_mod.c scripts [root@TEST Reptile]# # /root/Reptile/README.md # [root@TEST Reptile]# kill -51 0 [root@TEST Reptile]# kill -51 0 # /root/Reptile/README.md # [root@TEST Reptile]# ls installer.sh libpcap-1.5.3.tar.gz README.md sbin libpcap-1.5.3 Makefile rep_mod.c scripts [root@TEST Reptile]# # [root@TEST Reptile]# /root/Reptile/README.md -bash: /root/Reptile/README.md: Permission denied [root@TEST Reptile]# # [root@TEST Reptile]# ls installer.sh libpcap-1.5.3.tar.gz README.md sbin libpcap-1.5.3 Makefile rep_mod.c scripts [root@TEST Reptile]#

i just dont't know how to hide the file /root/Reptile/README.md.

corefx commented 6 years ago

Hi, if you used the default settings then you just create a file/folder called reptile and it should be hidden. Like this: mkdir /var/reptile

Asuings commented 6 years ago

Hey What if i want to hide a folder or any anyother files,like the /root/Reptile/README.md. or i need to add the code in a config file?

README.md # ?

f0rb1dd3n commented 6 years ago

@Asuings,

to hide folder or files you just need to name these folders or files with "reptile" in the name (or the name that you configured in installation). If you want to hide /root/Reptile/README.md, you need to rename README.md to reptile_README.md.

Automatically, reptile creates a folder /reptile that will be hidden and with files reptile_client, reptile_shell, reptile_start.sh, reptile.ko e reptile_r00t. These files will be hidden, but you still can exec: reptile_r00t to get privilege access if you are not root, and reptile_client is a remote client that you have to copy to remote access.

the feature kill -51 0 is for hide file CONTENTS, so all that will stay between tags will be hidden:

< reptile>

contents that will be hidden.

< /reptile>

you don't need to do kill -51 0 to activate, cause reptile start with that activated. But if you would see contents that is hidden, you need do do kill -51 0 to deactivate this feature and do this command again to re-activate.

note: if you use this feature, the syscall read will not read these contents and any software will load these bytes. So, you can't use that to hide pieces of scripts. I am using this hook to hide my persistence configuration after the system is rebooted and reptile is loaded.

I hope I helped,

403

f0rb1dd3n commented 6 years ago

@corefx thank you for your contribution man. You always is helping on issues, I appreciate that. Thank you!

Asuings commented 6 years ago

Thanks for your answer!!! :)