mncoppola / suterusu Goto Github PK

View Code? Open in Web Editor NEW

627.0 627.0 210.0 42 KB

An LKM rootkit targeting Linux 2.6/3.x on x86(_64), and ARM

License: MIT License

C 97.34% Makefile 2.66%

suterusu's People

Contributors

Stargazers

Watchers

Forkers

vnd shaded-enmity txsniper factionwars magshimim safe3 zouguangxian qunxyz chubbymaggie anthrax1 citypw gandalfblack dongpil baiqj kernux djh496812749 fortheswarm dsapoetra z3v2cicidi cainiaocome andlab xianlimei omgwtfun anhilo natedat team-firebugs lidawn djn3m0 matrix10 ch0pp3r steelcode luffyhwl larsx2 zigitax yd0str lubing521 alexpark07 johnniesong isafe anzhj diggold tvtritin gamehacker ssfang shekkbuilder mdabbagh88 cnbird1999 hurryon bhassani tangshiqiang rskkkzt lihungte96 jackywei1228 cngutierr koncode muellerberndt scyclzy logonmy bryonglodencissp hongyunnchen technoabh yarec yaoyi2008 yoramvandevelde cadelaren c0de3 idkwim kernullist ajgappmark kbahaxor geekgalaxy trevor3000 amaranth0203 blowfishj ycaihua fadetrack b0t0w1 taibaiyifeng 2you xuzeyuanfred qardeneden hazrasudip9 g5t4r thelongestusernameofall giang12 horacio fowum suidrewt usertm olivierh59500 sumanthneerumalla connlan sagittarius-a jiafenggit solertis shuixi2013 wonhongkwon avgirl jeperez thickforest

suterusu's Issues

can't insmod suterusu in ubuntu16.04_desktop(with 4.15.0-55-generic)

I use this command to compile:

make linux-x86_64 KDIR=/lib/modules/$(uname -r)/build

When i insmod suterusu.ko,i get this error in dmesg:

[  929.932188] ia32_sys_call_table obtained at           (null)
[  929.932202] sys_call_table obtained at           (null)
[  929.932219] Hooking function 0x          (null) with 0x00000000b54d3505
[  929.932230] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[  929.932247] IP: hijack_start+0x4d/0x110 [suterusu]
[  929.932251] PGD 0 P4D 0 
[  929.932260] Oops: 0000 [#2] SMP PTI
[  929.932264] Modules linked in: ipt_MASQUERADE nf_nat_masquerade_ipv4 nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype iptable_filter ip_tables xt_conntrack x_tables nf_nat nf_conntrack libcrc32c br_netfilter bridge stp llc rfcomm ccm aufs bbswitch(OE) overlay bnep nls_iso8859_1 rtsx_usb_ms memstick rtsx_usb_sdmmc rtsx_usb intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp btusb kvm_intel kvm irqbypass btrtl wmi_bmof crct10dif_pclmul crc32_pclmul ghash_clmulni_intel btbcm btintel pcbc uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core aesni_intel aes_x86_64 crypto_simd videodev media glue_helper cryptd bluetooth arc4 snd_hda_codec_realtek snd_hda_codec_generic intel_cstate nvidia_uvm(POE) intel_rapl_perf
[  929.932356]  rtl8723be snd_hda_intel btcoexist input_leds serio_raw snd_hda_codec rtl8723_common rtl_pci snd_hda_core snd_hwdep snd_pcm ecdh_generic snd_seq_midi snd_seq_midi_event rtlwifi mac80211 cfg80211 snd_rawmidi snd_seq mei_me snd_seq_device snd_timer wmi mei shpchp snd soundcore mac_hid lpc_ich parport_pc ppdev lp parport autofs4 hid_generic usbhid hid nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) i915 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops e1000e ahci drm libahci ptp pps_core video [last unloaded: lkm]
[  929.932434] CPU: 1 PID: 5193 Comm: insmod Tainted: P      D    OE    4.15.0-55-generic #60~16.04.2-Ubuntu
[  929.932439] Hardware name: LENOVO ThinkCentre M8250z-D102/SHARKBAY, BIOS FGKT35AUS 12/04/2014
[  929.932448] RIP: 0010:hijack_start+0x4d/0x110 [suterusu]
[  929.932453] RSP: 0018:ffffa2b841ef7c20 EFLAGS: 00010282
[  929.932459] RAX: 000000000000003b RBX: 0000000000000000 RCX: 0000000000000006
[  929.932463] RDX: 0000000000000000 RSI: 0000000000000096 RDI: ffff8ef9afa96490
[  929.932467] RBP: ffffa2b841ef7c58 R08: 00000000000e397b R09: 00000000000003ca
[  929.932472] R10: ffffdc5806ab3800 R11: ffffffffbf95380d R12: ffffffffc198b060
[  929.932476] R13: 0000000000000000 R14: 0000000000000001 R15: ffff8ef99adee840
[  929.932482] FS:  00007f3ac3c04700(0000) GS:ffff8ef9afa80000(0000) knlGS:0000000000000000
[  929.932487] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  929.932491] CR2: 0000000000000000 CR3: 00000001be412006 CR4: 00000000001606e0
[  929.932495] Call Trace:
[  929.932509]  ? filp_close+0x59/0x80
[  929.932518]  ? 0xffffffffc1991000
[  929.932528]  i_solemnly_swear_that_i_am_up_to_no_good+0x9b/0x1000 [suterusu]
[  929.932538]  do_one_initcall+0x55/0x1ac
[  929.932548]  ? _cond_resched+0x1a/0x50
[  929.932557]  ? kmem_cache_alloc_trace+0x10f/0x1d0
[  929.932567]  do_init_module+0x5f/0x219
[  929.932575]  load_module+0x1937/0x1d80
[  929.932586]  ? ima_post_read_file+0x83/0xa0
[  929.932595]  SYSC_finit_module+0xe5/0x120
[  929.932602]  ? SYSC_finit_module+0xe5/0x120
[  929.932612]  SyS_finit_module+0xe/0x10
[  929.932619]  do_syscall_64+0x73/0x130
[  929.932625]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[  929.932630] RIP: 0033:0x7f3ac37344d9
[  929.932635] RSP: 002b:00007fffd99fc4e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000139
[  929.932641] RAX: ffffffffffffffda RBX: 000055c9b6ceb250 RCX: 00007f3ac37344d9
[  929.932645] RDX: 0000000000000000 RSI: 000055c9b62d826b RDI: 0000000000000003
[  929.932649] RBP: 000055c9b62d826b R08: 0000000000000000 R09: 00007f3ac39f9ea0
[  929.932653] R10: 0000000000000003 R11: 0000000000000206 R12: 0000000000000000
[  929.932657] R13: 000055c9b6ceb210 R14: 0000000000000000 R15: 0000000000000000
[  929.932662] Code: 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 45 e0 31 c0 48 8b 05 fd 0c 00 00 48 89 45 d4 8b 05 fb 0c 00 00 89 45 dc e8 33 3e 76 fc <48> 8b 03 48 89 45 c8 8b 43 08 89 45 d0 e8 91 06 6e fc 66 90 48 
[  929.932754] RIP: hijack_start+0x4d/0x110 [suterusu] RSP: ffffa2b841ef7c20
[  929.932757] CR2: 0000000000000000
[  929.932763] ---[ end trace 7d90928f7494299f ]---

help

[root@localhost ~]# uname -a
Linux localhost 2.6.32-71.el6.x86_64 #1 SMP Fri May 20 03:51:51 BST 2011 x86_64 x86_64 x86_64 GNU/Linux

1.make linux-x86 KDIR=/lib/modules/$(uname -r)/build
2.insmod suterusu.ko
3.gcc sock.c -o sock

sock can not run

failed to cross_cmpile for ARM router's linux kernel 4.1.27, Could someone give me some suggests?

Before compiling the ASUS firmware, the ASUS kernel cannot perform certain environment preparation operations. And some files are missing in the kernel folder before the firmware is compiled.

After the firmware is compiled, prepare the environment first. this step is success

Asus router kernel Linux4.1.27 compiles suterusu, there is an error that sh_offset is too large

Go to the official website of kernel.org to download the same version of the ASUS kernel, and the compilation is successful.

Compare the md5 value of the file involved in the error, the ASUS kernel and the official 4.1.27 kernel. But they make no difference.

aarch64 linux 4.4.1 Frozen screen

make android-arm KDIR=/lib/modules/uname -r/build HOOKRW=1
insmod suterusu.ko
phenomenon:
Frozen screen,
dmesg --clear && dmesg --follow have not any output.

analyze:
inline void arm_write_hook ( void *target, char *code )
{
memcpy(target, code, HIJACK_SIZE);
cacheflush(target, HIJACK_SIZE);
}
memcpy is root cause.
I am comfused, Would you help me to fix it?

Couldn't be compiled on 4.x Linux(which I have expected)

Hi,
I'm trying it on the 4.4.0 arm linux and it couldn't be compiled, saying that

main.c:255:28: error: ‘struct file’ has no member named ‘f_dentry’
afinfo = PDE_DATA(filep->f_dentry->d_inode);

But I have expected this because the file structure could change from version to version. I'd like to know wether you plan to update this project to support the latest kernel. If you don't, could you provide me with some reference where I can find such examples?

BTW, since you can do hijackings, is there a way to defend such attacks? Take the keylogger as an example, you have registered a modified keyboad notifier, is there any method to prevent an unauthorized process from doing so?

Thanks

I use this command to compile:

I use this command to compile:
make android-arm CROSS_COMPILE=arm-buildroot-linux-gnueabi- KDIR=/home/dongzai/suterusu/linux-4.1.27/

I got the following error
make ARCH=arm EXTRA_CFLAGS="-D_CONFIG_ARM_ -fno-pic " -C /home/dongzai/suterusu/linux-4.1.27/ M=/home/dongzai/suterusu/suterusu-master modules
make[1]: Entering directory '/home/dongzai/suterusu/linux-4.1.27'
CC [M] /home/dongzai/suterusu/suterusu-master/main.o
In file included from include/asm-generic/int-ll64.h:10:0,
from ./arch/arm/include/asm/types.h:4,
from include/uapi/linux/types.h:4,
from include/linux/types.h:5,
from include/linux/list.h:4,
from include/linux/module.h:9,
from /home/dongzai/suterusu/suterusu-master/common.h:1,
from /home/dongzai/suterusu/suterusu-master/main.c:1:
include/uapi/asm-generic/int-ll64.h:11:29: fatal error: asm/bitsperlong.h: No such file or directory
compilation terminated.
scripts/Makefile.build:258: recipe for target '/home/dongzai/suterusu/suterusu-master/main.o' failed
make[2]: *** [/home/dongzai/suterusu/suterusu-master/main.o] Error 1
Makefile:1385: recipe for target 'module/home/dongzai/suterusu/suterusu-master' failed
make[1]: *** [module/home/dongzai/suterusu/suterusu-master] Error 2
make[1]: Leaving directory '/home/dongzai/suterusu/linux-4.1.27'
Makefile:74: recipe for target 'android-arm' failed
make: *** [android-arm] Error 2

Originally posted by @Mrdongzai in #12 (comment)

How to use ICMP modules

Hello:
How to use ICMP modules? I compile ICMP modules,but i don't know how to use it

success build suterusu.ko for asus ac86u. but it can't insmod successfully.The file attributes of suterusu.ko are correct.

I use the same way to cross-compile hello.ko, and it works.

but the suterusu.ko doesn't work.

Are there any suggestions? Thanks a lot!

3.10 kernel compilation error

procfs internals were removed from kernel include directory which results in compilation errors on recent kernels (>= 3.10), details are covered here https://lkml.org/lkml/2013/4/16/398.
(suterusu uses PDE for port hiding)

mncoppola / suterusu Goto Github PK

suterusu's People

Contributors

Stargazers

Watchers

Forkers

suterusu's Issues

can't insmod suterusu in ubuntu16.04_desktop(with 4.15.0-55-generic)

help

failed to cross_cmpile for ARM router's linux kernel 4.1.27, Could someone give me some suggests?

aarch64 linux 4.4.1 Frozen screen

Couldn't be compiled on 4.x Linux(which I have expected)

I use this command to compile:

How to use ICMP modules

success build suterusu.ko for asus ac86u. but it can't insmod successfully.The file attributes of suterusu.ko are correct.

3.10 kernel compilation error

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent