░▒▓██████████████▓▒░░▒▓█▓▒░▒▓███████▓▒░ ░▒▓██████▓▒░ ░▒▓█▓▒░░▒▓█▓▒░░▒▓██████▓▒░
░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓████████▓▒░ ░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓██▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓██▓▒░▒▓█▓▒░░▒▓█▓▒░░▒▓██████▓▒░
[[[ === THE MINA ROOTKIT [--- written by djnn for fun ---] version 0.0.1 === ]]]
~ source code: https://evil.djnn.sh/mina.ko/log.html
1. Motivations
The goal of this project is to increase my understanding of the Linux Operating System
by writing a Loadable Kernel Module. Most of the code you will see here is not particularly
innovative or new. It is just my own implementation, and take on it.
You can find many cool projects if you browse online. They are probably more stealthy, stable,
or feature more capabilities. It's likely something else out there fits your needs better, this
is just a learning project that I am doing for fun.
2. Basic design
The rootkit works by intercepting the `kill` syscall and interpreting commands based on the signal sent.
Additionally, it provides a `/proc` command channel for more complex interactions like executing shell commands
or managing module blocking. Initial bugs have been resolved for improved stability.
3. Instructions
3.1 Compiling and run
Tested on:
- Linux Debian 6.12.41-1
[+] Compile with: make compile
[+] Run with: make load
3.2 Commands
The rootkit responds to specific signals sent to `MAGIC_PID` (currently 1337) and commands written to `/proc/mina_cmd`.
**Signal-based Commands (kill -SIGNAL MAGIC_PID):**
[*] Install persistence: kill -50 1337
[*] Toggle module hide: kill -60 1337
[*] Toggle file hiding: kill -70 1337
[*] Hide process (PID): kill -90 <PID_TO_HIDE>
[*] Unhide process (PID): kill -91 <PID_TO_UNHIDE>
[*] Escalate process to root: kill -95 <PID_TO_ESCALATE>
**`/proc/mina_cmd` based Commands:**
These commands are sent by writing a string to `/proc/mina_cmd` and reading the response.
A client (`client/mina-cli`) is provided for easier interaction.
Example usage with client:
```bash
# Execute a command
./client/mina-cli "id"
./client/mina-cli "ls -la /root"
# Block a module from loading
./client/mina-cli "block my_evil_module"
# Unblock a module
./client/mina-cli "unblock my_evil_module"
```
Magic features:
[+] => If you create a file called "minamina", it can't be seen by directory listing.
This only works if file hiding is enabled (kill -70 1337)
[+] => Processes hidden with `kill -90 <PID>` will not appear in `ps aux` or `/proc/<PID>`.
3.3 Development instructions
I use QEMU to run my local virtual machine. If you're using something else, instruction may very.
You can use the Virtual Machine Manager if you want to manage it using a GUI.
Create a new machine using Debian 12 LTS iso. Don't forget to add your current user to sudoers file.
Then, you can simply run the following on your Host machine:
$ ./local-serve.sh
Instructions are within the script, copy and paste.
3.3.a Installing dependencies
You might have to install dependencies to build the rootkit locally.
If you have the zip archive downloaded on your guest machine, you can simply run:
$ make deps