https://github.com/jermeyyy/rooty

Academic project of Linux rootkit made for Bachelor Engineering Thesis.
https://github.com/jermeyyy/rooty

academic bachelor-engineering-thesis kernel kernel-module linux linux-rootkit rootkit security thesis

Last synced: about 2 months ago
JSON representation

Academic project of Linux rootkit made for Bachelor Engineering Thesis.

• Host: GitHub
• URL: https://github.com/jermeyyy/rooty
• Owner: jermeyyy
• License: lgpl-3.0
• Created: 2017-07-23T21:58:21.000Z (over 8 years ago)
• Default Branch: master
• Last Pushed: 2024-07-29T18:51:56.000Z (over 1 year ago)
• Last Synced: 2024-07-30T01:06:16.574Z (over 1 year ago)
• Topics: academic, bachelor-engineering-thesis, kernel, kernel-module, linux, linux-rootkit, rootkit, security, thesis
• Language: C
• Size: 4.55 MB
• Stars: 82
• Watchers: 7
• Forks: 17
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# Important Legal Disclaimer

I do not condone any misuse of this code, I do not expect any liability for any misuse of this code. Using rooty to attack targets without their consent is illegal, it is the users responsibility to obey all applicable local, state and federal laws.

# rooty

Academic project of Linux rootkit made for Bachelor Engineering Thesis.

More about project can be found in actual [thesis](https://github.com/jermeyyy/rooty/blob/master/docs/Praca%20In%C5%BCynierska%20-%20Karol%20Celebi.pdf) or in [article](https://github.com/jermeyyy/rooty/blob/master/docs/3_PT1-2_41-s39_CELEBI_SUSKI.pdf) written by Zbigniew Suski (thesis supervisor).

Whole rootkit is implemented as LKM module and few user-space services.

## Functionalities

- root access

- hiding itself

- control via IOCTL interface (client included)

- keylogger

- hide files/dirs

- hide processes

- hide tcp/udp IPv4/IPv6 connections

- remote root shell activated by magic ICMP packet

- VNC protocol service (screen preview only)

## Screenshots

### rooty LKM initialization

![](/art/init.png?raw=true)

### IOCTL control interface

![](/art/ioctl-control.png?raw=true)

### keylogger

![](/art/keylogger.png?raw=true)

### sshd initialization

![](/art/ssh-init.png?raw=true)

### sshd initialized

![](/art/ssh-init2.png?raw=true)

### remote access

![](/art/ssh-access.png?raw=true)

### vncd initialization

![](/art/vncd-init.png?raw=true)

### vncd running

![](/art/vncd-running.png?raw=true)