2

I found this small rootkit source code implemented as a Linux kernel module.

https://github.com/mfontanini/Programs-Scripts/tree/master/rootkit

Basically, as you can see, it changes the file_operations structure from the file inode and overwrite the readdir function to hide itself from ls and lsmod.

In that case, how would be possible to detect this rootkit?

Improve this question
6
  • 1
    Run a pattern match for that code snippet? I'm not sure what you are asking. Detect before it infects or after?
    – schroeder
    Commented Feb 15, 2016 at 20:22
  • After infected. Pattern match would not work, since it's impossible to find the file using simple commands like cat, ls, grep, etc.
    – rootkit_newbie
    Commented Feb 15, 2016 at 22:55
  • Btw, I know that mounting the hard drive using another trusted machine would not load the module, and then it would be possible to find the module file. But why I would do this without a good reason (suspect)? I was wondering if I could check (somewhere) in memory for some kernel module code "without" a correspondent lsmod module file.
    – rootkit_newbie
    Commented Feb 15, 2016 at 22:59
  • 1
    so, you don't necessarily want to detect the rootkit, but this one setting - you might get great answers on the unix/linux SE site
    – schroeder
    Commented Feb 15, 2016 at 23:04
  • Rootkit - if you want, @schroeder can move it to that site, he has magical powers here. Just ask him if you're interested
    – Neil Smithline
    Commented Feb 16, 2016 at 1:49

1 Answer 1

Reset to default
0

View proc/kallsyms. It contains most of the kernel symbols and is updated dynamically as LKMs are added.

Improve this answer

You must log in to answer this question.