search

unix-thrust / beurk

BEURK Experimental Unix RootKit
GNU General Public License v3.0
374 stars 96 forks source link

Failed to start Login Service on Debian 8.2 i386 #96

Open AbMaster opened 9 years ago

AbMaster commented 9 years ago

Hi,

I got "Failed to start Login Service" after rebooting my Debian 8.2 i386 VM (VMware Workstation 12 on Windows 10): Screenshot (http://hpics.li/a3f34e1). I did #make then #make infect, now I am unable to login to my box.

Any idea? Thanks

nil0x42 commented 9 years ago

Hi ! Thank you for giving a feedback !

First and foremost, BEURK is curently under stabilisation, and there is still a lot of work to do, due to the evident difficulty of debugging a program whose first purpose is to remain invisible. So, installing it before release 1.0 exposes you experience some kind of instabilities. Therefore, we will investigate in order to fix the problem on a future patch, by testing the rootkit under conditions close to yours.

In order to fix disable the rootkit, you need to mount the root partition of your Debian without running it, and remove the /lib/libselinux.so line from /etc/ld.so.preload file. It's the dirty equivalent of make uninstall command.

AnonBit commented 8 years ago

I have same problem.