How to Hide From root and Detect Userland Rootkits
•
0 likes•337 views
https://skillsmatter.com/skillscasts/9845-an-introduction-to-userland-rootkits-how-they-work-and-what-we-can-learn-from-them
Recommended
More Related Content
What's hot
Viewers also liked
Similar to How to Hide From root and Detect Userland Rootkits
Similar to How to Hide From root and Detect Userland Rootkits (14)
Recently uploaded
Recently uploaded (20)
How to Hide From root and Detect Userland Rootkits
- 7. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 7 Agenda • What is a root kit? • The LD_PRELOAD technique • How to detect a root kit • How to remove a root kit
- 10. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 10 What is a root kit? •Essentially a MitM, sitting between users and the kernel •Used to hide the presence of users/processes •Used to maintain access to a box
- 11. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 11 What is a root kit? •The initial entry point on to your box •A virus. It is NOT:
- 12. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 12 What is a root kit? # strace ls /tmp ... stat("/tmp", {st_mode=S_IFDIR|S_ISVTX|0777,...}) = 0 open("/tmp", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3 ...
- 13. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 13 What is a root kit? Call open() Interrupt descriptor table (IDT) syscall table Choose interrupt handler Choose system call sys_open()
- 14. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 14 What is a root kit? Call open() Interrupt descriptor table (IDT) syscall table Choose interrupt handler Choose system call sys_open() User mode
- 15. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 15 What is a root kit? Call open() Interrupt descriptor table (IDT) syscall table Choose interrupt handler Choose system call sys_open() User mode kernel mode
- 17. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 17 What is a root kit? The root kits of yesteryear #!/bin/bash mv /bin/ls /bin/.ls.bak echo <<EOF > /bin/ls #!/bin/bash /bin/.ls.bak $@ | grep -v greg EOF chmod 0755 /bin/ls
- 19. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 19 The LD_PRELOAD technique LD_PRELOAD=/my/file.so ls -al export LD_PRELOAD=/my/file.so
- 20. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 20 The LD_PRELOAD technique LD_PRELOAD=/my/file.so ls -al export LD_PRELOAD=/my/file.so echo /my/file.so > /etc/ld.so.preload
- 21. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 21 The LD_PRELOAD technique LD_PRELOAD=/my/file.so ls -al export LD_PRELOAD=/my/file.so echo /my/file.so > /etc/ld.so.preload WHY?!?!?!
- 22. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 22 The LD_PRELOAD technique So why dynamically link? •Much smaller file size •You can update libraries while maintaining backwards compatibility •Essentially we get much the same benefits as we do with micro services
- 23. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 23 Detecting a root kit Look at what is being linked by standard system tools •strace •ltrace •ldd
- 24. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 24 Removing a rootkit There are tools out there that are good at removing certain types of root kit •rkhunter