Linux Rootkits Part 3: A Backdoor to Root

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

Now that you know how to make a Linux kernel module that can hook any exposed function in kernel memory (Part 1 and Part 2), let’s get down to writing a hook that does something interesting! In this first example, we’re going to make a rootkit that intercepts calls to sys_kill. 99% of the time, we only use sys_kill (the userspace tool we normally use is the familiar kill) to kill a…

Read on /posts/linux_rootkits_03/ ↗