Legal Disclaimer

Hacking For Beginners – Manthan Desai 2010
cleaned correctly, a normal system administrator is unaware that the intrusion has even occurred until another site
contacts him or the disks fill because of the sniffer logs.
The most severe threat to system security that can be caused by a rootkit comes from those that deploy LKM (Loadable
Kernel Module) trojans. Loadable Kernel Modules are a mechanism for adding functionality to an operating-system kernel
without requiring a kernel recompilation. Even if an infected system is rebooted, the LKM process will reload the Trojan
during boot-up just like any other kernel module. Loadable Kernel Modules are used by many operating systems including
Linux, Solaris, and FreeBSD.
The LKM rootkits facilitate the subversion of system binaries. Knark, Adore, and Rtkit are just a few of many LKM rootkits
available today. As they run as part of the kernel, these rootkits are less detectable than conventional ones.
Let us see how a typical backdoor can be installed by an intruder.
The goal of backdoor is to give access to the hacker despite measures by the compromised system's administrator, with
least amount of time and visibility. The backdoor that gives local user root access can be: set uid programs, trojaned
system programs, cron job backdoor.
Set uid programs. The attacker may plant some set uid shell program in the file system, which when executed will grant
the root to the attacker.
Trojaned system programs. The attacker can alter some system programs, such as "login" that will give him root access.
Cron job backdoor. The attacker may add or modify the jobs of the cron while his program is running so that he can get
root access.
The backdoor that gives remote user root access can be: ".rhost" file ssh authorized keys, bind shell, trojaned service.
".rhosts" file. Once "+ +" is in some user's .rhosts file, anybody can log into that account from anywhere without
password.
ssh authorized keys. The attacker may put his public key into victims ssh configuration file "authorized_keys", so
that he can log into that account without password.
Bind shell. The attacker can bind the shell to certain TCP port. Anybody doing a telnet to that port will have an
interactive shell. More sophisticated backdoors of this kind can be UDP based, or unconnected TCP, or even ICMP
based.
Trojaned service. Any open service can be trojaned to give access to remote user. For example, trojaned the inetd
program creates a bind shell at certain port, or trojaned ssh daemon give access to certain password.
After the intruder plants and runs the backdoor, his attention turns to hiding his files and processes. However, these can
be easily detected by the system administrator - especially if the system is running tripwire.
Let us see how a LKM rootkit helps achieve the attacker's needs.
In the case of LKM trojaned rootkits, the attacker can put LKM in /tmp or /var/tmp, the directory that the system
administrator cannot monitor. Moreover, he can effectively hide files, processes, and network connections. Since he can
modify the kernel structures, he can replace the original system calls with his own version.
To hide files. Commands like "ls", "du" use sys_getdents() to obtain the information of a directory. The LKM will
just filter out files such that they are hidden.
To hide processes. In Linux implementations, process information is mapped to a directory in /proc file system. An
attacker can modify sys_getdents() and mark this process as invisible in the task structure. The normal
implementation is to set task's flag (signal number) to some unused value.
To hide network connections. Similar to process hiding, the attacker can try to hide something inside
/proc/net/tcp and /proc/net/udp files. He can trojan the sys_read () so that whenever the system reads these two
files and a line matching certain string, the system call will not reveal the network connection.
w w w . h a c k i n g t e c h . c o . t v Page 89