DISCLAIMER: This is for educational purposes only. Do not use it for illegal activities. You are solely responsible for your actions!
This repository contains code for a simple ELF Virus that is capable of executing something malicious, infecting other ELF files, and executing the infected files normally in the foreground.
An ELF Virus is a malicious piece of code that targets ELF (Executable and Linkable Format) executeables. It infects these executables in such a way that after being affected, these executables carry out some things invisible to the user. If the ELF Virus is able to get root access, it can cause significant damage to the system.
- Something bad is executed.
- An ELF executeable that has not yet been infected is searched for in the current working directory. If found, the executable is infected, by adding the virus code before the execuatble, and a magic number or a signature at the end of the executable.
- If the object file that is being executed is the original virus file itself, a magic number or a signature is added at the end of the file. Otherwise, the original code of the executable is executed.
-
Clone the repository:
git clone https://github.com/shailrshah/ELF-Virus.git -
Go inside the repository:
cd ELF-Virus -
Change permission for the test:
chmod 755 test/virusCheck.sh -
Run the test:
test/virusCheck.sh -
View and edit the source code:
vim src/virus.c -
Compile the source code:
gcc -o virus src/virus.c -
Run the virus:
./virus
If you make changes to the code, make sure the value of SIZE in virus.c is the same as the size of the virus object file. You can get its size by running wc virus -c.