GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → mav8557 → Father

mav8557 / Father

Licence: Unlicense License
LD_PRELOAD rootkit

Programming Languages

c
50402 projects - #5 most used programming language
Makefile
30231 projects
assembly
5116 projects

Labels

linuxsecuritybackdoorrootkitmalwareld-preloadredteam

Projects that are alternatives of or similar to Father

Diamorphine
LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x (x86/x86_64 and ARM64)
Stars: ✭ 725 (+1128.81%)
Mutual labels:  backdoor, rootkit, malware, redteam
Umbra
A LKM rootkit targeting 4.x and 5.x kernel versions which opens a backdoor that can spawn a reverse shell to a remote host, launch malware and more.
Stars: ✭ 98 (+66.1%)
Mutual labels:  backdoor, rootkit, malware
Malware
Rootkits | Backdoors | Sniffers | Virus | Ransomware | Steganography | Cryptography | Shellcodes | Webshells | Keylogger | Botnets | Worms | Other Network Tools
Stars: ✭ 156 (+164.41%)
Mutual labels:  backdoor, rootkit, malware
MsfMania
Python AV Evasion Tools
Stars: ✭ 388 (+557.63%)
Mutual labels:  backdoor, malware, redteam
Emp3r0r
linux post-exploitation framework made by linux user
Stars: ✭ 419 (+610.17%)
Mutual labels:  rootkit, malware, redteam
rkorova
ld_preload userland rootkit
Stars: ✭ 34 (-42.37%)
Mutual labels:  rootkit, malware, ld-preload
Dr0p1t Framework
A framework that create an advanced stealthy dropper that bypass most AVs and have a lot of tricks
Stars: ✭ 1,132 (+1818.64%)
Mutual labels:  backdoor, malware
Phpsploit
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
Stars: ✭ 1,188 (+1913.56%)
Mutual labels:  backdoor, redteam
Networm
Python network worm that spreads on the local network and gives the attacker control of these machines.
Stars: ✭ 135 (+128.81%)
Mutual labels:  backdoor, malware
Ddoor
DDoor - cross platform backdoor using dns txt records
Stars: ✭ 168 (+184.75%)
Mutual labels:  backdoor, malware
Php Antimalware Scanner
AMWScan (PHP Antimalware Scanner) is a free tool to scan php files and analyze your project to find any malicious code inside it.
Stars: ✭ 181 (+206.78%)
Mutual labels:  backdoor, malware
Openssh Backdoor Kit
💣 just for fun ¯\_(ツ)_/¯
Stars: ✭ 211 (+257.63%)
Mutual labels:  backdoor, rootkit
Webshell
Webshell && Backdoor Collection
Stars: ✭ 1,056 (+1689.83%)
Mutual labels:  backdoor, rootkit
Njrat 0.7d Stub Csharp
njRAT C# Stub - Fixed For PowerShell
Stars: ✭ 28 (-52.54%)
Mutual labels:  backdoor, malware
Mass Rat
Basic Multiplatform Remote Administration Tool - Xamarin
Stars: ✭ 127 (+115.25%)
Mutual labels:  backdoor, malware
Unencrypted Backdoor With Process Cloaking
Unencrypted backdoor
Stars: ✭ 16 (-72.88%)
Mutual labels:  backdoor, malware
Vegile
This tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimited your session in metasploit and transparent. Even when it killed, it will re-run again. There always be a procces which while run another process,So we can assume that this procces is unstopable like a Ghost in The Shell
Stars: ✭ 601 (+918.64%)
Mutual labels:  backdoor, rootkit
Thefatrat
Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV softw…
Stars: ✭ 5,944 (+9974.58%)
Mutual labels:  backdoor, malware
Lime Rat
LimeRAT | Simple, yet powerful remote administration tool for Windows (RAT)
Stars: ✭ 663 (+1023.73%)
Mutual labels:  backdoor, malware
ToxicEye
👽 Program for remote control of windows computers via telegram bot. Written in C#
Stars: ✭ 305 (+416.95%)
Mutual labels:  backdoor, malware
View All Similar Projects ➔

Father

nil is goated

Overview

Father is a short LD_PRELOAD rootkit for Linux. It's designed to be used in a competition environment, and has various standard features:

  • Network hiding
  • File hiding
  • Process hiding
  • Local privilege escalation
  • Remote accept() hook backdoor
  • Time/logic bomb component
  • GnuPG signature interception
  • Anti-detection

Installation

Dependencies

To install Father, download the source code and change the configuration options to reflect your desired values. You can set the INSTALL_LOCATION to a file with the STRING prefix to hide the kit on disk.

To compile the kit you'll need to download libgcrypt on your computer. The dynamic linker will resolve all libgcrypt calls (like from GnuPG) to our dynamic library.

Operation

Priv-Esc

To escalate privileges, just run a setuid program like sudo or gpasswd from the command prompt with your specified environment variable set. While in the shell you'll possess your magic GID and rootkit functions will be disabled, giving you unrestricted access to the system. Any processes spawned will be hidden from utilities like ps. This should work for most binaries.

$ Father=a gpasswd

Enjoy the shell!

root@sectorv:~#

accept() backdoor

To use the accept backdoor, connect to a listening TCP socket on the system from the defined source port. If everything is working you'll be prompted to authenticate with your password and on complete will be presented with a bind shell. It will inherit the permissions of the running process, and if possible hide itself from the process list. This behavior can be changed to a reverse shell over the hidden port by uncommenting the relevant code block in the source.

root@kali:~# ncat $IP 22 -p $SOURCEPORT 


AUTHENTICATE: father

GnuPG Signature Tampering

This is very easy to implement, but meant moreso as a proof of concept. Since GnuPG is a dynamically linked program, we can intercept the calls it makes to its own library libgcrypt and change the return values. If you load the kit and then run any libgcrypt signature verification you'll receive a succcessful result, regardless of file or signature content. In theory this can be expanded to backdoor other operations like key reading and generation, or encryption/decryption.

remove_preload.asm

remove_preload.asm is a short assembly program that unlinks /etc/ld.so.preload. The kit can be removed from the backdoor shell, but this provides a smaller and more easily scripted way to do so. It can be run in a loop by a blue team to prevent installation of most LD_PRELOAD based malware.

IOCs

  • ssdeep: 192:RRhX15E5vzeV88cAgVrJbcvJuxI61ttgjnaJcac0tQCmOuJ/nwfoTnhawnh5HSh:FsvKrcAgrpAq/OaJcacK9BcnEwK
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].