search

juanschallibaum / Nuk3Gh0st

Universal Linux LKM rootkit, designed to work in any kernel version and both architectures (i686 and x86_64).
GNU General Public License v2.0
36 stars 12 forks source link

This is a good idea,i have some questions #1

Open EBWi11 opened 6 years ago

EBWi11 commented 6 years ago

1.this rootkit cannot make success on my centos7(3.10.0-862.el7.x86_64)

2.I recently tried to create HIDS,i consult some infomation(actually i am a rootkit rookie),I noticed that Linux audit is very good,audit can help me hook syscall like connect(),execve() etc.and my question is,Is it possible for Linux audit to be a source of data for HIDS,If audit starts at the very beginning, is there any risk of being circumvented?

thanks!!

juanschallibaum commented 6 years ago

Thanks for report! I'm also a rootkit rookie. The most part of this rootkit is mixed from another 3 rootkits, and i also did the work of making compatible with various systems. It's not very difficult, you only must to see what change in kernel structures from version to version. Follow the compiler errors, and check this page:

https://elixir.bootlin.com

to see how structures were changing. The rootkit neither works in openSUSE, since they keep the kernel version number low and uses structures of newest kernels, then my code fails, but it's easy to adapt. I suppose something similar must be happening with your CentOS. Regarding audit, i didn't experiment with it, but i can say you that when you have the privileges, you can do anything with the kernel. Any security system running in the compromised system can be circunvented, because you are the owner of the kernel. The rootkit should be detected outside the operating system, and i still need to encrypt communications, and other important anti-forensics stuffs, but i'm still in working with that. I hope that helps you at least a little. Bye

EBWi11 commented 6 years ago

thanks! and i will study and test audit for detection rootkie,and ...can I keep in touch with you? i cannot found your email or other contact information.