search

mempodippy / vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
GNU General Public License v3.0
935 stars 193 forks source link

Snodew installation fails #12

Closed corefx closed 7 years ago

corefx commented 7 years ago

Hi,

When testing Vlany I noticed that Snodew installation fails.

Installation has finished. Would you like to setup the experimental snodew root reverse shell backdoor? (YES/NO) (case-sensitive) [YES]: cat: magic_gid: No such file or directory --2016-12-25 19:30:48-- https://github.com/mempodippy/snodew/archive/master.tar.gz Resolving github.com (github.com)... 192.30.253.112, 192.30.253.113 Connecting to github.com (github.com)|192.30.253.112|:443... connected. HTTP request sent, awaiting response... 302 Found Location: https://codeload.github.com/mempodippy/snodew/tar.gz/master [following] --2016-12-25 19:30:48-- https://codeload.github.com/mempodippy/snodew/tar.gz/master Resolving codeload.github.com (codeload.github.com)... 192.30.253.121, 192.30.253.120 Connecting to codeload.github.com (codeload.github.com)|192.30.253.121|:443... connected. HTTP request sent, awaiting response... 200 OK Length: unspecified [application/x-gzip] master.tar.gz: No such file or directory

Cannot write to ‘master.tar.gz’ (No such file or directory). rm: cannot remove ‘master.tar.gz’: No such file or directory Error: master.tar.gz doesn't exist. Exiting.

mempodippy commented 7 years ago

Strange... For some reason, it seems like magic_gid doesn't exist and additionally, wget doesn't save the tarball after connecting (or rather, it can't). Almost seems like vlany's obstructing the setup.. What operating system were you attempting this on? What directory are you executing this from?

corefx commented 7 years ago

I'm running Debian 8 (on virtualbox) and executing the install script from /root/vlany. It seems that magic_gid file is never created (I checked the source code) Maybe you forgot to commit that change?

mempodippy commented 7 years ago

https://github.com/mempodippy/vlany/blob/master/config.py#L463 It's definitely there, or should be... config.py writes it specifically for the snodew section of the installation script, and it also gets removed on the same line (since it's no longer needed). On a side note, config.py is executed way before the snodew setup, so anything created by config.py is definitely present at this time. Try installing vlany with the oneliner in README.md. Might just be some rude little thing.

corefx commented 7 years ago

My bad. I didn't check config.py properly. I installed Vlany with the oneliner and it worked fine. Something was wrong with my previous install. I'm closing this now.

corefx commented 7 years ago

I have found the culprit of this problem: Installation directory was removed before installing snodew. I used cli installation method and I accidentally selected YES (the default option) when installation script asked if I wanted to remove the installation directory. I think that it could be wise to change that default option to NO.

mempodippy commented 7 years ago

Done. Closing.