search

mempodippy / vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
GNU General Public License v3.0
935 stars 193 forks source link

Network hiding Issues. #29

Open mayankjoin opened 6 years ago

mayankjoin commented 6 years ago

HI,

I am new to rootkit testing and github. I tried your malware on UBuntu 15+ (15.04/16.04/16.10). I was able to connect to ssh via backdoor, but you said that vlany can hide its packets from the network sniffers like wireshark. I was running wireshark on the vlany system, and I saw all packets of ssh that were sent and received by the backdoor. Maybe they have patched Ubuntu, could you tell the most basic version of OS and kernel that I should try vlany so that I could connect via backdoor and wireshark does not detect the packet?

mempodippy commented 6 years ago

Hi The rootkit was originally created around the time of 12.04. The versions you mention could well have changed certain functions. Try 12.04 or anything around that time.