Architecture Overview
Epirootkit is a Linux kernel module (LKM) that provides remote access to a target machine through a Command and Control (C2) architecture. It is composed of several subsystems that work together to establish persistence, authenticate an attacker, and execute commands remotely.
C2 Connection
The C2 (Command and Control) connection is the core of epirootkit's remote access capability. It runs as a kernel thread and maintains a persistent TCP connection to an attacker-controlled server.
Privilege Escalation
Epirootkit provides two independent paths for escalating privileges to root: a local method via /proc and a remote method via the C2 connection.
Command Execution
Once authenticated through the C2 connection, the attacker can send arbitrary shell commands to the target machine. The rootkit executes them and relays the output back over the encrypted connection.
Authentication
Epirootkit uses SHA-256 password hashing with constant-time comparison to authenticate access, both locally and remotely.
Reverse Shell
The Reverse Shell module allows the attacker to gain full interactive access (a Bash terminal) on the victim machine directly from the C2 Web interface. Unlike standard stateless command execution, the reverse shell keeps the session open, allowing folder navigation (via cd) or the use of interactive tools.
Debug Mode
Epirootkit includes a conditional logging system controlled by the debug_mode module parameter. When enabled, internal events are printed to the kernel log via printk.