f0rb1dd3n / Reptile

LKM Linux rootkit
2.53k stars 571 forks source link

centos compile error and some other issues #84

Open hackendltd opened 4 years ago

hackendltd commented 4 years ago

make[1]: Entering directory /root/Desktop/Reptile-master/userland' CC /root/Desktop/Reptile-master/output/shell CC /root/Desktop/Reptile-master/output/cmd make[1]: Leaving directory/root/Desktop/Reptile-master/userland' make[1]: Entering directory /usr/src/kernels/2.6.32-573.el6.x86_64' CC [M] /root/Desktop/Reptile-master/output/backdoor.o /root/Desktop/Reptile-master/kernel/backdoor.c: In function ‘magic_packet_parse’: /root/Desktop/Reptile-master/kernel/backdoor.c:126: error: implicit declaration of function ‘memzero_explicit’ make[2]: *** [/root/Desktop/Reptile-master/output/backdoor.o] Error 1 make[1]: *** [_module_/root/Desktop/Reptile-master/output] Error 2 make[1]: Leaving directory/usr/src/kernels/2.6.32-573.el6.x86_64' make: *** [module] Error 2

hackendltd commented 4 years ago

I have been using it for a long time and found that it uses a reverse shell. If I open the terminal through a reverse connection, I don't know what the reason is, and I will not reconnect after disconnecting, otherwise I need to restart to use it. This problem does not occur often, it is only some hosts.

hackendltd commented 4 years ago

Can you add an accept shell, such as ncat -vv target 22 -p srcport, enter the password and you will have a root terminal

The program cannot hide the tcp port and udp port that are listening. It can only hide ports that have a connection with an IP address. If a port is bound locally, how to hide it?

If you execute a background program in a reverse terminal, you need to force exit, sometimes it hangs, and you will not connect back afterwards.

centos 7 x86_64 no hiding [ata/0]

Thank you for writing the program

hackendltd commented 4 years ago

I used git new version reptile to crash the system when centos7 make install, the kernel is 3.10.0-1062.12.1.el7.x86_64

hackendltd commented 4 years ago

Do you need help? I can provide any system to test your program.

f0rb1dd3n commented 4 years ago

Hey man, sorry my late reply.

So, thank you for reporting that. I need to make some tests. I will reach you if I need some host to test it.

I ask just a little bit of patience, I will try to find time to see this

guiyue commented 4 years ago

ubuntu16.04 受害机和kali都无法安装该工具,到make install时系统报错 cp: cannot stat '/root/Reptile/scripts/../output/cmd': No such file or directory chmod: cannot access '/reptile/': No such file or directory Both the victim machine and kali cannot install the tool on ubuntu16.04, the system reports an error when make install cp: cannot stat '/root/Reptile/scripts/../output/cmd': No such file or directory chmod: cannot access '/reptile/': No such file or directory

hackendltd commented 4 years ago

ubuntu16.04 受害机和kali都无法安装该工具,到make install时系统报错 cp: cannot stat '/root/Reptile/scripts/../output/cmd': No such file or directory chmod: cannot access '/reptile/': No such file or directory Both the victim machine and kali cannot install the tool on ubuntu16.04, the system reports an error when make install cp: cannot stat '/root/Reptile/scripts/../output/cmd': No such file or directory chmod: cannot access '/reptile/': No such file or directory

You can try version 2.0

f0rb1dd3n commented 4 years ago

ubuntu16.04 受害机和kali都无法安装该工具,到make install时系统报错 cp: cannot stat '/root/Reptile/scripts/../output/cmd': No such file or directory chmod: cannot access '/reptile/': No such file or directory Both the victim machine and kali cannot install the tool on ubuntu16.04, the system reports an error when make install cp: cannot stat '/root/Reptile/scripts/../output/cmd': No such file or directory chmod: cannot access '/reptile/': No such file or directory

It seems Reptile is already loaded. You need to do make install with the rootkit unloaded, because the script will load it for you, and if the Reptile is already loaded it will hide some files in the output folder.