{"id":16209475,"url":"https://github.com/alichtman/gardening-starter-pack","last_synced_at":"2026-01-21T12:08:15.583Z","repository":{"id":69984645,"uuid":"172640499","full_name":"alichtman/gardening-starter-pack","owner":"alichtman","description":"Literally a rootkit. (LKM for Linux Kernels 4.14+)","archived":false,"fork":false,"pushed_at":"2019-06-17T04:52:41.000Z","size":200,"stargazers_count":1,"open_issues_count":15,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-07T19:46:39.215Z","etag":null,"topics":["linux-kernel-module","lkm","rootkit"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alichtman.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-02-26T04:55:22.000Z","updated_at":"2023-11-12T01:42:26.000Z","dependencies_parsed_at":"2023-05-01T02:01:52.484Z","dependency_job_id":null,"html_url":"https://github.com/alichtman/gardening-starter-pack","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/alichtman/gardening-starter-pack","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alichtman%2Fgardening-starter-pack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alichtman%2Fgardening-starter-pack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alichtman%2Fgardening-starter-pack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alichtman%2Fgardening-starter-pack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alichtman","download_url":"https://codeload.github.com/alichtman/gardening-starter-pack/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alichtman%2Fgardening-starter-pack/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28632781,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-21T04:47:28.174Z","status":"ssl_error","status_checked_at":"2026-01-21T04:47:22.943Z","response_time":86,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["linux-kernel-module","lkm","rootkit"],"created_at":"2024-10-10T10:29:50.590Z","updated_at":"2026-01-21T12:08:15.568Z","avatar_url":"https://github.com/alichtman.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Gardening-Starter-Pack\n\u003e Quite Literally a Rootkit\n\n\u003c!-- \u003ch1 align=\"center\"\u003e\n  \u003cimg src=\"img/Garden.png\" width=\"75%\" /\u003e\n  \u003cbr /\u003e\n\u003c/h1\u003e --\u003e\n\n### Disclaimer\n\nThis codebase was developed for purely educational reasons. It is illegal to run this code on a machine that is not your own, or you do not have permission to run this on.\n\n### Usage\n\nTo install, simply run `$ sudo python3 setup.py install`.\nTo remove, run `$ sudo python3 setup.py uninstall`\n\nIf you'd be more comfortable reading these same options in your terminal, run `$ python3 setup.py -h`.\n\n### Configuration Notes\n\n- The reverse shell is broken, and commented out at the moment. It causes a kernel panic whenver it is invoked. Still working on this problem.\n- No guarantees on things working if you use non-default configuration names. I have not tested every route through this code.\n\nA known good configuration sequence is:\n\n```bash\n$ sudo python3 setup.py install\n\u003cENTER\u003e\nY\nN\nY\n\u003cENTER\u003e\nY\n```\n\nYou'll know things have worked properly if you run `$ kill 31337` and are dropped into a root shell. The `/garden` binary should not be visible when you run `$ ls /`, even though the command `/garden` will work. The output for `lsmod` should not include `garden` if you've followed the config above.\n\n### Features\n\n1. Hide/unhide files/directories.\n2. Escalate priveleges to root.\n3. Listen for magic packets (will not be stopped by local firewall) to spawn reverse shell.\n4. Hide rootkit.\n5. Block uninstallation of rootkit.\n6. Reboot persistence.\n\nNOTE: Reverse shell is currently broken. I need to read / understand more about kernel-threads in order to implement that part of the rootkit. The magic packet listener is fully functional.\n\n### Tested Kernels\n\n- `4.15.0-15-generic`\n- `4.18.0-16-generic`\n- `4.18.0-17-generic`\n\nTheoretically, this rootkit will be compatible with every kernel above `4.14`, but these are the only kernels that have been tested.\n\n### Warning\n\nIf you choose to develop on real hardware, make sure you have a full system backup. If you install the rootkit with the \"block uninstallation\" option toggled, you **will not be able to uninstall it.** Your only choice for recovery is a full OS reinstall. (At least, that I am aware of / was able to figure out. I had to re-image my VM a few times...)\n\n### Setting Up the Development Environment\n\nDownload an `Ubuntu 18.04.2 Bionic Beaver` VirtualBox or VMWare image from [osboxes](https://www.osboxes.org/ubuntu/). This should come with the `4.18.0-15-generic` kernel.\n\nMake sure you have a version of `Python 3.X` installed. I wrote the build script in `Python 3.6.7`, but anything that's `3.0` or above should work.\n\n```bash\n$ sudo apt-get update\n$ sudo apt-get install gcc make libelf-dev git\n# This will not work without my private SSH key.\n$ git clone --recurse-submodules git@github.com:alichtman/gardening-starter-pack.git\n```\n\nThen, (for long-term development) add this line to your crontab to deal with the absurd number of debug logs created: `0 * * * * sudo ~/gardening-starter-pack/scripts/clean_vm.sh`\n\n### Technical Details\n\nSee the `docs/` directory.\n\n### Acknowledgements\n\nHere are some books, tutorials and projects that helped me as I was writing this.\n\n**Linux Kernel Development**\n\n1. [Intro to Kernel Modules](http://derekmolloy.ie/writing-a-linux-kernel-module-part-1-introduction/)\n2. [Character Devices](http://derekmolloy.ie/writing-a-linux-kernel-module-part-2-a-character-device/)\n3. [Linux Kernel Development 3rd Edition](https://smtebooks.com/book/1852/linux-kernel-development-3rd-pdf-1)\n4. [Linux Device Drivers 3rd Edition](https://www.oreilly.com/library/view/linux-device-drivers/0596005903/)\n\n**Rootkit Development**\n\n1. [Intro to Writing Kernel Rootkits](https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485)\n2. [Reptile Rootkit](https://github.com/f0rb1dd3n/Reptile)\n3. [How Reptile Works](https://github.com/milabs/awesome-linux-rootkits/blob/master/details/reptile.md)\n4. [mfontanini's Rootkit](https://github.com/mfontanini/Programs-Scripts/blob/master/rootkit/rootkit.c)\n5. [hanj0496's Rootkit](https://github.com/hanj4096/wukong/blob/master/lkm/rootkit.c)\n6. [a7vinx's Rootkit](https://github.com/a7vinx/liinux)\n7. [NoviceLive's Kernel Rootkit Tutorial/Analysis](https://github.com/NoviceLive/research-rootkit)\n8. [Bones-codes' Rootkit](https://github.com/bones-codes/the_colonel/)\n9. [Magic Packets](https://www.drkns.net/kernel-who-does-magic/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falichtman%2Fgardening-starter-pack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falichtman%2Fgardening-starter-pack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falichtman%2Fgardening-starter-pack/lists"}