Architecture Overview

Epirootkit is a Linux kernel module (LKM) that provides remote access to a target machine through a Command and Control (C2) architecture. It is composed of several subsystems that work together to establish persistence, authenticate an attacker, and execute commands remotely.

High-Level Components

┌──────────────────────────────────────────────────┐
│                  module.c                        │
│            (Module entry point)                  │
│                                                  │
│  ┌───────────────────┐  ┌─────────────────────┐  │
│  │  Elevation System │  │   Network Thread    │  │
│  │  (elevate-perms)  │  │   (connection)      │  │
│  │                   │  │                     │  │
│  │  /proc/epirootkit │  │  TCP client to C2   │  │
│  │  Local privilege  │  │  Auto-reconnect     │  │
│  │  escalation       │  │  ROT64 encryption   │  │
│  └────────┬──────────┘  └──────────┬──────────┘  │
│           │                        │             │
│  ┌────────┴──────────┐  ┌──────────┴──────────┐  │
│  │  check-password   │  │       exec          │  │
│  │  SHA-256 auth     │  │  Command execution  │  │
│  │  Constant-time    │  │  via /bin/sh        │  │
│  │  comparison       │  │  Output relay to C2 │  │
│  └───────────────────┘  └─────────────────────┘  │
│                                                  │
│  ┌───────────────────────────────────────────┐   │
│  │                debug                      │   │
│  │  Conditional logging (debug_mode param)   │   │
│  └───────────────────────────────────────────┘   │
└──────────────────────────────────────────────────┘

Module Parameters

The rootkit accepts four parameters at load time, passed via the install script:

Parameter	Type	Description
ip	string	IP address of the C2 server
port	int	Port of the C2 server
password_hash	string	SHA-256 hash of the authentication password
debug_mode	bool	Enables or disables kernel log output

These parameters are set with permission 0400 (read-only by root), meaning they cannot be changed after the module is loaded.

Lifecycle

Initialization (epirootkit_init)

1. The privilege elevation system is initialized, creating the /proc/epirootkit virtual file.
2. A kernel thread (epirootkit_net) is spawned to handle the C2 network connection.

Protocol and Ports

• The module establishes an outbound TCP connection to the C2 server specified by the ip and port parameters (default port: 4242).
• All data exchanged over the TCP connection is obfuscated with a simple byte-wise ROT64 transform (each byte is incremented by 64 mod 256 before sending, and decremented by 64 on receive). The project refers to this as "ROT64" or "rot64".
• Authentication is performed by sending a 64-hex-character SHA-256 digest to the module. The module compares the received hash to the password_hash parameter using a constant-time comparison.

See the C2 protocol and attacker UI bridge in detail in the API reference: ../api/attacker-ui-protocol

Runtime

The module operates through two independent access paths:

• Local access: writing the correct password hash to /proc/epirootkit escalates the current process to root.
• Remote access: connecting to the C2 server, authenticating with the password, and sending shell commands over the encrypted TCP connection.

Cleanup (epirootkit_exit)

1. The /proc/epirootkit entry is removed.
2. The network thread is stopped cleanly via kthread_stop().

Source Files

File	Purpose
module.c	Module entry/exit, thread management
utils/connection.c	C2 TCP client, ROT64 encryption, reconnect logic
utils/elevate-perms.c	/proc file creation, local privilege escalation
utils/check-password.c	SHA-256 password validation, constant-time compare
utils/exec.c	Shell command execution, output relay to C2
utils/debug.c	Conditional logging macro
Makefile	Kernel module build configuration
install.sh	Automated install/uninstall script