{"id":22913748,"url":"https://github.com/ait-aecid/caraxes","last_synced_at":"2025-05-12T13:25:09.844Z","repository":{"id":263638771,"uuid":"877893378","full_name":"ait-aecid/caraxes","owner":"ait-aecid","description":"Academic research rootkit using ftrace-hooking to hide files and processes via magic word or user/group. Tested until Linux 6.11.","archived":false,"fork":false,"pushed_at":"2025-04-22T12:24:16.000Z","size":126,"stargazers_count":16,"open_issues_count":1,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-22T12:26:55.342Z","etag":null,"topics":["file-hiding","ftrace-hooking","kernel-module","linux","linux-kernel","rootkit","stealthkit"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ait-aecid.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-10-24T12:30:15.000Z","updated_at":"2025-04-10T07:01:57.000Z","dependencies_parsed_at":"2024-12-12T22:30:04.990Z","dependency_job_id":"8f034658-6520-4f72-8ef8-49eef4d22887","html_url":"https://github.com/ait-aecid/caraxes","commit_stats":null,"previous_names":["ait-aecid/caraxes"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ait-aecid%2Fcaraxes","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ait-aecid%2Fcaraxes/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ait-aecid%2Fcaraxes/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ait-aecid%2Fcaraxes/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ait-aecid","download_url":"https://codeload.github.com/ait-aecid/caraxes/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253746157,"owners_count":21957509,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["file-hiding","ftrace-hooking","kernel-module","linux","linux-kernel","rootkit","stealthkit"],"created_at":"2024-12-14T05:11:26.817Z","updated_at":"2025-05-12T13:25:09.838Z","avatar_url":"https://github.com/ait-aecid.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CARAXES - Linux Kernel Module Rootkit\n\nCARAXES - ***C**yber **A**nalytics **R**ootkit for **A**utomated and **X**ploratory **E**valuation **S**cenarios* - is a Linux Kernel Module (LKM) rootkit.\nThe purpose is to hide processes and files on a system, this can be done via user/group ownership or a magic-string in the filename.\nCaraxes was developted for Linux versions 6 and up, and has been tested for 5.14-6.11,\nit uses [ftrace-hooking](https://github.com/ilammy/ftrace-hook) at its core.\nThe rootkit was born to evaluate anomaly detection approaches based on kernel function timings - check out [this repository](https://github.com/ait-aecid/rootkit-detection-ebpf-time-trace) for details.\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"https://raw.githubusercontent.com/ait-aecid/caraxes/refs/heads/main/caraxes_logo.svg\" width=25% height=25%\u003e\u003c/p\u003e\n\n\u003cins\u003e__Important Disclaimer__\u003c/ins\u003e: Caraxes is purely for educational and academic purposes. The software is provided \"as is\" and the authors are not responsible for any damage or mishaps that may occur during its use. Do not attempt to use Caraxes to violate the law. Misuse of the provided software and information may result in criminal charges.\n\nIf you use any of the resources provided in this repository, please cite the following publication:\n* Landauer, M., Alton, L., Lindorfer, M., Skopik, F., Wurzenberger, M., \u0026 Hotwagner, W. (2025). Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity. Under Review.\n\n## Compilation\n\nInstall the kernel headers (`apt install linux-headers-$(uname -r)` / `yum install kernel-headers` / `pacman -S linux-headers`).\n\n```sh\n$ git clone https://github.com/ait-aecid/caraxes.git\n$ cd caraxes/\n$ make\n```\n\nThis gives you the `caraxes.ko` koernelobject file, which can be loaded via `insmod caraxes.ko`.\nRemove it via `rmmod caraxes` , given it is not hidden (see `hide_module()`).\n\n### Try it out\n\nIf you loaded the rootkit on your local system in your current working directory, try listing the files - many of them should be gone,\nbecause the standard magic-string for files to hide is \"caraxes\".\n\n## Configuration\n\nThe magic word that determines whether a file is hidden by the rootkit or not is defined in variable `MAGIC_WORD` in the file `rootkit.h`; by default, the magic word is \"caraxes\". This file also allows to set the variables `USER_HIDE` and `GROUP_HIDE`, which can be used to hide files or processes that belong to the specified user or group. By default, files and processes of user `1001` and group `21` (fax) are hidden.\n\nOptionally, uncomment the `hide_module()` in `caraxes.c` to unlink the module from the modules list. Note that the name of the module that you load (`caraxes.ko`) has to contain the magic word (it does by default), otherwise it will show up under `/sys/modules`.\nIf it is hidden like this, it can not be unloaded via `rmmod` anymore.\nYou have to make sure to be able to trigger a `show_module()` [somehow](https://codeberg.org/sw1tchbl4d3/generic-linux-rootkit/src/branch/main/examples).\n\nAnother option is to switch from `getdents` hooking to `filldir` hooking by commenting and uncommenting the respective lines in `hooks.h`.\nThose are different functions inside the kernel, that can be wrapped to get rootkit functionality.\nWe implemented different versions to test our [rootkit detection](https://github.com/ait-aecid/rootkit-detection-ebpf-time-trace).\n\n## Troubleshooting\n\nKeep in mind that if you unlink the module from the modules list (uncommenting of `hide_module()`), then `rmmod` will not find it and you will have to somehow signal to the rootkit to unhide itself with `show_module()`. If you get into that situation and the unhide does not work, or the kernel module crashed on `rmmod` or similar, a system restart should always do the trick.\n\nIf you want to extend the code, the easiest way is to debug the code is to uncomment the calls to `rk_info` and `printk` or add your own, then monitor dmesg on insert / remove with `sudo dmesg -w`.\n\n## Missing Features: Open Ports\n\n`/proc/net/{tcp,udp}` list open ports in a single file instead of one by port.\nThis can be addressed either by mangling with the `read*` syscalls or `tcp4_seq_show()`, which fills the content of this file.\nAdditionally, `/sys/class/net` shows statistics of network activity, which could hint to an open port.\nAlso `getsockopt` would fail when trying to bind to an open port - we would kind of have to flee, give up our port,\nand start using a different one.\n\n## Credits\n- **sw1tchbl4d3/generic-linux-rootkit**: forked from https://codeberg.org/sw1tchbl4d3/generic-linux-rootkit\n- **Diamorphine**: `linux_dirent` element removal code from [Diamorphine](https://github.com/m0nad/Diamorphine)\n- `ftrace_helper.h`: https://github.com/ilammy/ftrace-hook, edited to fit as a library instead of a standalone rootkit.\n- https://xcellerator.github.io/posts/linux_rootkits_01/, got me into rootkits and helped me gain most of the knowledge to make this. Much of the code is inspired by the code found here.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fait-aecid%2Fcaraxes","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fait-aecid%2Fcaraxes","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fait-aecid%2Fcaraxes/lists"}