f0rb1dd3n / Reptile

LKM Linux rootkit
2.54k stars 572 forks source link

Kernel Crash after unloading module #8

Closed ghost closed 6 years ago

ghost commented 6 years ago

I get a crash after unloading module looks like memory corruption "BUG: unable to handle kernel paging request at ffffffffc06e69bb" It has something to do with file content hiding feature it doesn't crash after commenting all related functions this is on CentOS 7 3.10.0-693.5.2.el7.x86_64

f0rb1dd3n commented 6 years ago

hello, I did various tests on most recent CentOS version, and I didnt get this crash. Could you give more information about that? Thank you very much

ghost commented 6 years ago

It's weird I was testing on CentOS VM with Vmware-Tools packaged version now on a clean install with open-vm-tools installed it's working fine and no memory corruption

f0rb1dd3n commented 6 years ago

very nice man! I am glad your test doesn't crash anymore. May you close this issue?

greetings

ghost commented 6 years ago

Now I'm sure about this bug if you disabled kdump you won't notice it but it exist in file content hiding functions

edit: actually with kdump disabled it's even more disastrous the system completely hangs and became unresponsive after unloading the module and you have to hard reboot / shutdown also same behavior on CentOS 6.9 but system hangs when you reboot / poweroff after unloading the kernel module

On CentOS 7.4 with kdump disabled or enabled (systemctl status kdump)

./installer install

and then unhide & unload

kill -50 0 && rmmod reptile_mod

wait a few seconds and your shell will crash and when you open a new ssh connection you get ABRT has detected 1 problem(s). For more info run: abrt-cli list

abrt-cli list

id e2891116ff93c3977b553dd4166eb019ae36ca4c reason: BUG: unable to handle kernel paging request at ffffffffc06ba9bb time: Sat 16 Dec 2017 02:36:05 PM EET uid: 0 (root) count: 1 Directory: /var/spool/abrt/vmcore-127.0.0.1-2017-12-16-14:35:45 Reported: cannot be reported

f0rb1dd3n commented 6 years ago

Hello man,

I did some updates about bugs. Can you test if you will get this error again?

thanks

f0rb1dd3n commented 6 years ago

Hello @mrunc, is this bug fixed? Can we close this issue?

thx

ghost commented 6 years ago

yes the crash is fixed now Thanks