README.md · Gitee 极速下载/Wukong-Rootkit

# Wukong: a LKM rootkit for Linux kernel 2.6.x, 3.x and 4.x

<h2>
	Note: 
</h2>
&nbsp;&nbsp;&nbsp;&nbsp;This kernel rootkit is just for educational purpose and it shouldn't be used for any illegal activities, use this at your own risk. 
 
 
 
<h2>
	Function
</h2>
&nbsp;&nbsp;&nbsp;&nbsp;1. Hide Linux Process. 
&nbsp;&nbsp;&nbsp;&nbsp;2. Hide TCP connection. 
&nbsp;&nbsp;&nbsp;&nbsp;3. Hide File/Directory. 
&nbsp;&nbsp;&nbsp;&nbsp;4. Hide wukong.ko. 
&nbsp;&nbsp;&nbsp;&nbsp;5. Redirect TCP connection to backdoor server by using the specific confidential password. 
 
<h2>
	Usage
</h2>
&nbsp;&nbsp;&nbsp;&nbsp;1. Environment: 
&nbsp;&nbsp;&nbsp;&nbsp;ubunt-14.04 (1.1.1.33) --- (1.1.1.1)ubunt-14.04 &nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp;(client)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (server) 
 
&nbsp;&nbsp;&nbsp;&nbsp;2. Test step: 
&nbsp;&nbsp;&nbsp;&nbsp;a. on server 
&nbsp;&nbsp;&nbsp;&nbsp;cd wukong/ 
&nbsp;&nbsp;&nbsp;&nbsp;sudo ./install.pl 
&nbsp;&nbsp;&nbsp;&nbsp;sudo nc -k -l 80 
 
&nbsp;&nbsp;&nbsp;&nbsp;b. on client 
&nbsp;&nbsp;&nbsp;&nbsp;nc 1.1.1.1 80 
&nbsp;&nbsp;&nbsp;&nbsp;http 
&nbsp;&nbsp;&nbsp;&nbsp;ifconfig 
&nbsp;&nbsp;&nbsp;&nbsp;PS：The connection will be redirected to bindshell 
 
&nbsp;&nbsp;&nbsp;&nbsp;nc 1.1.1.1 80 
&nbsp;&nbsp;&nbsp;&nbsp;111111 
&nbsp;&nbsp;&nbsp;&nbsp;PS: a rst will be received. 
 
&nbsp;&nbsp;&nbsp;&nbsp;nc 1.1.1.1 80 
&nbsp;&nbsp;&nbsp;&nbsp;111111 
&nbsp;&nbsp;&nbsp;&nbsp;aaaaaa 
&nbsp;&nbsp;&nbsp;&nbsp;PS: The connection will be connected with tcp 80. 
 
&nbsp;&nbsp;&nbsp;&nbsp;3. Result: 
&nbsp;&nbsp;&nbsp;&nbsp;a. Bindshell file is hidden. 
&nbsp;&nbsp;&nbsp;&nbsp;b. Tcp 8000 connection is hidden. 
&nbsp;&nbsp;&nbsp;&nbsp;c. Bindshell process is hidden 
&nbsp;&nbsp;&nbsp; d. wukong.ko is hidden 
&nbsp;&nbsp;&nbsp;&nbsp;e. If "http" is the first four bytes to TCP 80, connection will be established with bindshell. 
 
 
<h2>
	Tested OS:
</h2>
&nbsp;&nbsp;&nbsp;&nbsp;CentOS-5.5-i386-bin-DVD.iso 
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;Linux&nbsp; 2.6.18-408.el5 #1 SMP Tue Jan 19 09:13:33 EST 2016 i686 i686 i386 GNU/Linux 
&nbsp;&nbsp;&nbsp;&nbsp;CentOS-5.5-x86_64-bin-DVD 
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;Linux 2.6.18-194.el5 #1 SMP Fri Apr 2 14:58:14 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux 
&nbsp;&nbsp;&nbsp;&nbsp;ubuntu-14.04.2-desktop-i386.iso 
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;Linux&nbsp; 3.16.0-30-generic #40~14.04.1-Ubuntu SMP Thu Jan 15 17:45:15 UTC 2015 i686 i686 i686 GNU/Linux 
&nbsp;&nbsp;&nbsp;&nbsp;ubuntu-14.04.2-desktop-amd64.iso&nbsp; &nbsp; 
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;Linux&nbsp; 3.16.0-30-generic #40~14.04.1-Ubuntu SMP Thu Jan 15 17:43:14 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux 
&nbsp;&nbsp;&nbsp;&nbsp;ubuntu-14.04.3-desktop-i386.iso 
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;Linux&nbsp; 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:18:00 UTC 2015 i686 i686 i686 GNU/Linux 
&nbsp;&nbsp;&nbsp;&nbsp;ubuntu-14.04.3-desktop-amd64.iso 
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;Linux&nbsp; 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:16:20 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux 
 
 
<h2>
	ToDo:
</h2>
&nbsp;&nbsp;&nbsp; Do performance tuning, make it can work on Linux server with large traffic. 
&nbsp;&nbsp;&nbsp; Adding more features.

Gitee 极速下载/Wukong-Rootkit

简介

发行版

贡献者

近期动态

Gitee 极速下载/Wukong-Rootkit .gitee-modal { width: 500px !important; }

简介

发行版

开源评估指数源自 OSS-Compass 评估体系，评估体系围绕以下三个维度对项目展开评估：

贡献者

近期动态

搜索帮助

Gitee 极速下载/Wukong-Rootkit