f0rb1dd3n / Reptile

LKM Linux rootkit
2.53k stars 571 forks source link

Missing cred.h file / 2.6.18-398.el5 RHEL 5.11 (Tikanga) #80

Closed mntauburn closed 4 years ago

mntauburn commented 4 years ago

Hello. I am trying to install the tool on a RedHat EL 5.11 ( Tikanga ) .

I get the following.

make EXTRA_CFLAGS="-Dx86_64" -C /lib/modules/2.6.18-398.el5/build M=/tmp/Reptile modules make[1]: Entering directory /usr/src/kernels/2.6.18-398.el5-x86_64' CC [M] /tmp/Reptile/rep_mod.o /tmp/Reptile/rep_mod.c:7:24: error: linux/cred.h: No such file or directory /tmp/Reptile/rep_mod.c: In function 'l33t_setreuid': /tmp/Reptile/rep_mod.c:415: error: implicit declaration of function 'commit_creds' /tmp/Reptile/rep_mod.c:415: error: implicit declaration of function 'prepare_kernel_cred' make[2]: *** [/tmp/Reptile/rep_mod.o] Error 1 make[1]: *** [_module_/tmp/Reptile] Error 2 make[1]: Leaving directory/usr/src/kernels/2.6.18-398.el5-x86_64' make: *** [all] Error 2

Is there anything that can be done , any help pls

mntauburn

f0rb1dd3n commented 4 years ago

what reptile version are you using? because I am not using l33t_setreud anymore for a long time.

mntauburn commented 4 years ago

Hello.

I used this one : Reptile-b5e6d078a398804a68e725b6a0e69b46bc86572c and the current one from github with errors like below:

make -C /lib/modules/2.6.18-398.el5/build M=$PWD make[1]: Entering directory /usr/src/kernels/2.6.18-398.el5-x86_64' CC [M] /tmp/Reptile-master/rep_mod.o /tmp/Reptile-master/rep_mod.c:10:24: error: linux/cred.h: No such file or directory In file included from /tmp/Reptile-master/rep_mod.c:36: /tmp/Reptile-master/khook/engine.c: In function 'khook_lookup_name': /tmp/Reptile-master/khook/engine.c:17: error: implicit declaration of function 'kallsyms_on_each_symbol' In file included from /tmp/Reptile-master/rep_mod.c:36: /tmp/Reptile-master/khook/engine.c: In function 'khook_unmap': /tmp/Reptile-master/khook/engine.c:103: error: implicit declaration of function 'stop_machine' /tmp/Reptile-master/rep_mod.c: In function 'hide': /tmp/Reptile-master/rep_mod.c:100: error: 'module_mutex' undeclared (first use in this function) /tmp/Reptile-master/rep_mod.c:100: error: (Each undeclared identifier is reported only once /tmp/Reptile-master/rep_mod.c:100: error: for each function it appears in.) /tmp/Reptile-master/rep_mod.c: In function 'show': /tmp/Reptile-master/rep_mod.c:115: error: 'module_mutex' undeclared (first use in this function) /tmp/Reptile-master/rep_mod.c: In function 'exec': /tmp/Reptile-master/rep_mod.c:199: error: 'UMH_WAIT_EXEC' undeclared (first use in this function) /tmp/Reptile-master/rep_mod.c: At top level: /tmp/Reptile-master/rep_mod.c:695: warning: 'struct pid_namespace' declared inside parameter list /tmp/Reptile-master/rep_mod.c:695: warning: its scope is only this definition or declaration, which is probably not what you want /tmp/Reptile-master/rep_mod.c:696: warning: 'struct pid_namespace' declared inside parameter list /tmp/Reptile-master/rep_mod.c:697: error: conflicting types for 'khook_next_tgid' /tmp/Reptile-master/rep_mod.c:695: error: previous declaration of 'khook_next_tgid' was here /tmp/Reptile-master/rep_mod.c: In function 'khook_next_tgid': /tmp/Reptile-master/rep_mod.c:699: warning: passing argument 1 of 'KHOOK_next_tgid.orig' from incompatible pointer type /tmp/Reptile-master/rep_mod.c:706: warning: passing argument 1 of 'KHOOK_next_tgid.orig' from incompatible pointer type /tmp/Reptile-master/rep_mod.c: At top level: /tmp/Reptile-master/rep_mod.c:950: error: 'copy_creds' undeclared here (not in a function) /tmp/Reptile-master/rep_mod.c:950: warning: type defaults to 'int' in declaration of 'khook_copy_creds' /tmp/Reptile-master/rep_mod.c:950: warning: variable 'khook_copy_creds' declared 'inline' /tmp/Reptile-master/rep_mod.c:950: warning: 'always_inline' attribute ignored /tmp/Reptile-master/rep_mod.c:950: error: initializer element is not constant /tmp/Reptile-master/rep_mod.c:950: error: (near initialization for 'KHOOK_copy_creds.fn') /tmp/Reptile-master/rep_mod.c:952: error: 'khook_copy_creds' redeclared as different kind of symbol /tmp/Reptile-master/rep_mod.c:950: error: previous declaration of 'khook_copy_creds' was here /tmp/Reptile-master/rep_mod.c: In function 'khook_copy_creds': /tmp/Reptile-master/rep_mod.c:955: warning: type defaults to 'int' in declaration of 'type name' /tmp/Reptile-master/rep_mod.c:955: error: called object 'KHOOK_copy_creds.orig' is not a function /tmp/Reptile-master/rep_mod.c: At top level: /tmp/Reptile-master/rep_mod.c:962: error: 'exit_creds' undeclared here (not in a function) /tmp/Reptile-master/rep_mod.c:962: warning: type defaults to 'int' in declaration of 'khook_exit_creds' /tmp/Reptile-master/rep_mod.c:962: warning: variable 'khook_exit_creds' declared 'inline' /tmp/Reptile-master/rep_mod.c:962: warning: 'always_inline' attribute ignored /tmp/Reptile-master/rep_mod.c:962: error: initializer element is not constant /tmp/Reptile-master/rep_mod.c:962: error: (near initialization for 'KHOOK_exit_creds.fn') /tmp/Reptile-master/rep_mod.c:964: error: 'khook_exit_creds' redeclared as different kind of symbol /tmp/Reptile-master/rep_mod.c:962: error: previous declaration of 'khook_exit_creds' was here /tmp/Reptile-master/rep_mod.c: In function 'khook_exit_creds': /tmp/Reptile-master/rep_mod.c:965: warning: type defaults to 'int' in declaration of 'type name' /tmp/Reptile-master/rep_mod.c:965: error: called object 'KHOOK_exit_creds.orig' is not a function /tmp/Reptile-master/rep_mod.c: At top level: /tmp/Reptile-master/rep_mod.c:983: error: 'find_task_by_vpid' undeclared here (not in a function) /tmp/Reptile-master/rep_mod.c:983: warning: type defaults to 'int' in declaration of 'khook_find_task_by_vpid' /tmp/Reptile-master/rep_mod.c:983: warning: variable 'khook_find_task_by_vpid' declared 'inline' /tmp/Reptile-master/rep_mod.c:983: warning: 'always_inline' attribute ignored /tmp/Reptile-master/rep_mod.c:983: error: initializer element is not constant /tmp/Reptile-master/rep_mod.c:983: error: (near initialization for 'KHOOK_find_task_by_vpid.fn') /tmp/Reptile-master/rep_mod.c:985: error: 'khook_find_task_by_vpid' redeclared as different kind of symbol /tmp/Reptile-master/rep_mod.c:983: error: previous declaration of 'khook_find_task_by_vpid' was here /tmp/Reptile-master/rep_mod.c: In function 'khook_find_task_by_vpid': /tmp/Reptile-master/rep_mod.c:988: warning: type defaults to 'int' in declaration of 'type name' /tmp/Reptile-master/rep_mod.c:988: error: called object 'KHOOK_find_task_by_vpid.orig' is not a function make[2]: *** [/tmp/Reptile-master/rep_mod.o] Error 1 make[1]: *** [_module_/tmp/Reptile-master] Error 2 make[1]: Leaving directory/usr/src/kernels/2.6.18-398.el5-x86_64' make: *** [all] Error 2

thnx

f0rb1dd3n commented 4 years ago

Now I see, you are trying to install in a too old Linux. I wrote Reptile to run in Linux versions from 2.6.32. So maybe you can get some issues in versions older than that. To be able to solve that you must debug Reptile on this version.

f0rb1dd3n commented 4 years ago

In old Reptile Version, try the follow:

comment the line with #include <linux/cred.h> replace the line with commit_creds(prepare_kernel_cred(0)) to:

#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 29)
            current->uid = 0;
            current->suid = 0;
            current->euid = 0;
            current->gid = 0;
            current->egid = 0;
            current->fsuid = 0;
            current->fsgid = 0;
            cap_set_full(current->cap_effective);
            cap_set_full(current->cap_inheritable);
            cap_set_full(current->cap_permitted);
#else
            commit_creds(prepare_kernel_cred(0));
#endif

Tell me if it is going to work, because if not, I will test it.

f0rb1dd3n commented 4 years ago

So, Reptile still doesnt support kernels older than 2.6.32. Maybe in the future I can add this, but for now I am closing this issue.

mntauburn commented 4 years ago

Thank You.

Sorry my late reply. Will test that and come back.

my best.