Skip to content

Latest commit

 

History

History
86 lines (66 loc) · 3.34 KB

reptile.md

File metadata and controls

86 lines (66 loc) · 3.34 KB

Reptile rootkit details

https://github.com/f0rb1dd3n/Reptile

Environment

  • x86, x86_64
  • Linux kernel 2.6.x/3.x/4.x
  • Debian/Ubuntu, RHEL/CentOS/Fedora

Persistency

Boot-time module loading using OS-specific startup files:

Detection evasion

Rootkit is trying to evade from detection by:

Management interface

Implemented via kill(2):

Supported commands are:

Altering system behaviour

Hooking of system calls by patching syscall-handlers in sys_call_table[]:

Hiding (tampering) of file contents

Filtering of file content while reading:

Hiding of files and directories

Filtering of directory entries:

Hiding of processes and process trees

Filtering PID-like numeric entries while listing /proc:

Backdoor/shell

Reverse shell spawning by port-knocking-like technique: