truff
PHrack [61]
August 2003
Since a few years we have seen a lot of rootkits using loadable kernel modules. Is this a fashion ? not really, lkm's are widely used because they are powerfull: you can hide files, processes and do other nice things. The first rootkits using lkm's could be easily detected because they where listed when issuing a lsmod. We have seen lots of techniques to hide modules, like the one used in Plaguez's paper [1] or the more tricky used in the Adore Rootkit [2]. A few years later we have seen other techniques based on the modification of the kernel memory image using /dev/kmem [3]. Finally, a technique of static kernel patching was presented to us in [4]. This one solves an important problem: the rootkit will be reloaded after a reboot.
The goal of this paper is to describe a new technique used to hide lkm's and to ensure us that they will be reloaded after a reboot. We are going to see how to do this by infecting a kernel module used by the system. We will focus on Linux kernel x86 2.4.x series but this technique can be applied to other operating systems that use the ELF format. Some knowledge is necessary to understand this technique. Kernel modules are ELF object files, we will thus study the ELF format focusing on some particular parts related to the symbol naming in an ELF object file. After that, we will study the mechanisms wich are used to load a module to give us some knowledge on the technique which will permit to inject code into a kernel module. Finally, we will see how we can inject a module into another one in real life.