linux-root-kit

이 프로젝트 소개 이 프로젝트는 Technische Hochschule Deggendorf의 디지털 포렌식Digitale Forensik 과정의 일환으로 개발되었습니다. 다음을 포함하는 전체 포렌식 조사 및 공격 시뮬레이션을 보여줍니다: 악성 PyPI 패키지를 사용한 Python 종속성 혼동 공격 취약한 sudo 버전CVE-2025-32463을 통한 권한 상승 Sliver C2 비콘 배포 커널 모듈 로딩, 시스템 콜 후킹, udev 기반 지속성을 갖춘 커스텀 루트킷 Volatility, NetworkMiner, 수동 리버싱과 ...

USP

USP 기능 이 Go 프로그램은 지정된 페이로드바이너리 또는 스크립트의 실행을 트리거하는 udev 규칙을 만들어 Linux 시스템에 지속성을 설정합니다. 두 가지 트리거 옵션을 제공합니다: USB 지속성: USB 장치가 삽입될 때마다 페이로드가 실행됩니다. 부팅 지속성: /dev/random 장치를 활용하여 시스템 부팅 중에 페이로드가 실행됩니다. 또한 설정된 지속성을 제거하는 정리cleanup 옵션을 제공합니다. 사용법 1. Go 스크립트 컴파일: go build -o usp 2. 루트 권한sudo으로 스크립트 실행: sud...

AlmaLinux 9.2 [TuxCare] Security Update: sg3_utils / sg3_utils-devel / sg3_utils-libs (ALMALINUX9.2:CLSA-2026:1788364105)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788364105 advisory. - A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizi...

AlmaLinux 9.2 [TuxCare] Security Update: libinput / libinput-devel / libinput-test / libinput-utils (ALMALINUX9.2:CLSA-2026:1784017931)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784017931 advisory. - In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to...

Rocky Linux 9 [CIQ] Security Update: sg3_utils / sg3_utils-debuginfo / sg3_utils-debugsource / etc (crlsa-2026_50141)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202650141 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output conformance f...

Rocky Linux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786542017)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786542017 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

AlmaLinux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786542017)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786542017 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

AlmaLinux 9.2 [TuxCare] Security Update: systemd / systemd-boot-unsigned / systemd-container / systemd-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787064068)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787064068 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

Rocky Linux 9.6 [TuxCare] Security Update: libblkid / libblkid-devel / libfdisk / libfdisk-devel / libmount / etc (ALMALINUX9.6:CLSA-2026:1787813016)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787813016 advisory. - A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare...

mtechweek_04

mtechweek04 격리된 Metasploitable2 랩 VM에서 수행한 Metasploit 기반 침투 테스트 — DistCCCVE-2004-2687를 통한 원격 공격, udev netlinkCVE-2009-1185를 통한 권한 상승, vsftpd 2.3.4 백도어 분석CVE-2011-2523, 그리고 방화벽 완화 조치의 종단 간 검증을 포함합니다. 이 저장소는 사설 회사 서버를 시뮬레이션한 격리된 QEMU 랩에서 Metasploitable2를 대상으로 수행된 인가된 침투 테스트를 문서화합니다. 이 작업은 Metasploi...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

Important: Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update

An update for sg3utils is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

RHEL 10 : sg3_utils (RHSA-2026:69124)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69124 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

EulerOS 2.0 SP15 : libinput (EulerOS-SA-2026-3783)

According to the versions of the libinput packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary...

EulerOS Virtualization 2.12.1 : systemd (EulerOS-SA-2026-3622)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel...

EulerOS 2.0 SP10 : libinput (EulerOS-SA-2026-3747)

According to the versions of the libinput packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary...

EulerOS 2.0 SP10 : libinput (EulerOS-SA-2026-3699)

According to the versions of the libinput packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary...

EulerOS 2.0 SP15 : libinput (EulerOS-SA-2026-3808)

According to the versions of the libinput packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary...

EUVD-2026-80501

In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...

CVE-2026-89901: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...