Aller au contenu principal

Privilege Escalation

Epirootkit provides two independent paths for escalating privileges to root: a local method via /proc and a remote method via the C2 connection.

Local Escalation via /proc/epirootkit​

On module load, a virtual file is created at /proc/epirootkit. Any process that writes the correct password to this file gets its credentials elevated to root (UID 0).

How to Use It​

Write the SHA-256 hex digest (64 characters) to /proc/epirootkit. For example:

PASSWORD_HASH=$(echo -n "your_password" | sha256sum | cut -d' ' -f1)
echo "$PASSWORD_HASH" | sudo tee /proc/epirootkit

If the hash matches, the shell process that executed the command will run as root. Verify with whoami or id.

How It Works Internally​

  1. The rootkit_write() function is registered as the write handler for /proc/epirootkit.
  2. When a process writes to the file, the function copies the data from user-space to kernel-space using copy_from_user().
  3. The input is validated against the stored SHA-256 hash via check_password().
  4. If the password matches and escalation hasn't already occurred in this session, prepare_kernel_cred(NULL) creates a new set of root credentials.
  5. commit_creds() applies these credentials to the calling process.

Kernel Version Compatibility​

The /proc file uses different handler structures depending on the kernel version:

  • Kernel >= 5.6.0: Uses struct proc_ops with .proc_write
  • Kernel < 5.6.0: Uses struct file_operations with .write

This is handled at compile time with a #if LINUX_VERSION_CODE preprocessor directive.

Session Tracking​

The is_root global flag prevents duplicate escalation within the same module session. Once a process has been elevated, subsequent writes with the correct password will log a message but not re-escalate.

remarque

The is_root flag is global to the module, not per-process. Once any process triggers escalation, the flag is set for the entire module lifetime.

Remote Escalation via C2​

When an attacker authenticates through the network connection (see C2 Connection), the rootkit also elevates the kernel thread's credentials to root. This ensures that all commands executed remotely run with full root privileges.

The mechanism is the same (prepare_kernel_cred + commit_creds), but applied to the network thread's context rather than a local process.

Cleanup​

When the module is unloaded, clean_elevation_system() removes the /proc/epirootkit entry. This is critical: leaving a dangling /proc entry after module unload would cause a kernel panic if the file is accessed.