search

mempodippy / vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
GNU General Public License v3.0
935 stars 193 forks source link

failes to install on Debian 8 3.16.43-2 x86_64 #26

Closed emptysec closed 7 years ago

emptysec commented 7 years ago

Vlany failes to install on a fresh Debian 8 3.16.43-2 x86_64 VM with a quick_install.sh. The installations works apparently: ...

Hidden directory: /lib/libc.so.xxx.92 Environment variable: DFUTUELYMIJR Installation finished.

but

  1. if you check the hidden directory: $> ls /lib/libc* ls: cannot access /lib/libc.so.xxx.92: No such file or directory

  2. the /boot/grub/grub.cfg wasn't patched at all.

  3. after the reboot the systems start the infinite loop:

    A start job is running for udev Kernel device ... etc.

Don't know if the post reboot messages are cause of non-patched grub.cfg or are these symptoms of some other error.

BTW vlany works like a charm on Ubuntu 14.04, kudos for a great job.

unixfox commented 7 years ago

It doesn't fail, vlany is correctly installed. You should try to connect using the ssh backdoor, it have to work because I successfully installed vlany multiple times on Debian 8. And for the infinite reboot, it's a known bug that udev fails to start because you are running on systemd. Actually the patch works only on grub legacy and not grub2.

unixfox commented 7 years ago

I'll close this issue because it's already reported here: https://github.com/mempodippy/vlany/issues/21

emptysec commented 7 years ago

Sorry for a improper formulation. Yes, i could connect to the box. I understand the grub issue now, thanks for pointing that out. But why does the ls /lib/libc* command show the error message just after the succesfull installation ? The /lib/libc.so.xxx.92 was hidden properly on a Ubuntu 14.04 box .

unixfox commented 7 years ago

I don't really know why but the goal is done : the files of the backdoor are inaccessible.

mempodippy commented 7 years ago

ls /lib/libc* shows that error message after the installation because you're still in the original bash shell. New shells spawned after installation won't have this issue.

emptysec commented 7 years ago

thanks, now it makes sense :) BTW I've replaced ro -> rw in a GRUB2 file /etc/grub.d/10linux and run update-grub as recommended in issues/21 but no luck, the box still bricks on reboot with a 'A start job is running'_ message.

unixfox commented 7 years ago

I've already tried too on the mentioned issue. Can you continue the discussion on the original issue: https://github.com/mempodippy/vlany/issues/21 ? Thank you.