rkduck.md

rkduck rootkit details

https://github.com/QuokkaLight/rkduck

Environment

• x86, x86_64
• Linux kernel 4.x
• Debian/Ubuntu, RHEL/CentOS/Fedora

Persistency

Boot-time module loading using OS-specific startup files:

• /etc/modules (debian/ubuntu)
  • https://github.com/linux-rootkits/rkduck/blob/master/forever.sh#L29
• /etc/rc.modules (redhat/centos/fedora)
  • https://github.com/linux-rootkits/rkduck/blob/master/forever.sh#L32

Rootkit module runs forever.sh helper script at the moment of module unloading:

• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/duck.c#L47

Detection evasion

Rootkit is trying to evade from detection by:

• hiding rootkit files by name

Management interface

Implemented via in-kernel netlink server (NETLINK_USER) :

• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/crumbs_serv.c#L142

Supported commands are:

• hiding/unhiding files
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/crumbs_serv.c#L22
• hiding/unhiding processes
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/crumbs_serv.c#L32

Altering system behaviour

Hooking of system calls by patching syscall-handlers in sys_call_table[]:

• hook sys_call_table[__NR_write] (disabled)
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/duck.c#L17
• hook file->f_op->iterate for / and /proc dentries
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/duck.c#L25
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/duck.c#L29
• netfilter NF_INET_PRE_ROUTING/NF_IP_PRI_FIRST hook used for catching ICMP packets
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/backdoor.c#L454
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/backdoor.c#L379

Hiding of files and directories

Filtering of directory entries:

• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/vfs.c#L323 (vfs_hide_file)
• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/vfs.c#L346 (vfs_unhide_file)
• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/vfs.c#L97 (vfs_hijacked_iterate)
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/vfs.c#L59 (vfs_hijacked_filldir)
• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/vfs.c#L157 (vfs_hijacked_proc_iterate)
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/vfs.c#L78 (vfs_hijacked_proc_filldir)

Hiding of processes and process trees

Filtering PID-like numeric entries while listing /proc:

• based on hiding of files capabilty (vfs_hide_file)
  • https://github.com/linux-rootkits/rkduck/blob/master/rkduck/crumbs_serv.c#L30

Keylogger

Keylogger is implemented using register_keyboard_notifier():

• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/keylogger.c#L204
• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/keylogger.c#L72 (keylogger_notify)

Logged keystrokes are saved in file which periodically being sent to remote hos using scp:

• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/keylogger.c#L181 (keylogger_init)
• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/keylogger.c#L64 (writing to the file...)
• https://github.com/linux-rootkits/rkduck/blob/master/rkduck/keylogger.c#L32 (sending with scp)

Backdoor

...