rkduck has to interpret the commands Crumbs sends to it.

Command format : cmd_number:argument

Add the ssh key of the attacker into ~/.ssh/authorized_keys with root user.
The key should be provide in the script that copy the key.

Also the config of the backdoor allow to enable ssh backdoor or no.

If a user accesses a hidden directory, the content still has to be hidden.
At the moment, it works as follows :
if /root/rkduck is hidden and contains the files file1 and file2.
ls /root won't display rkduck, but ls /root/rkduck will display file1 and file2.

Activation of the backdoor remotely by the attacker.

Potential techniques :

• port knocking
• icmp with payload

Listen the keyboard and save the result into a file.

A program running in userland is used to control the rootkit.
What this program will control needs to be defined.

• /root/rkduck
• /lib/modules/$KERNEL/kernel/drivers/$DRIVER/rkduck
• /etc/modules
• /etc/rc.modules

Adding a linked list storing the files to hide

Currently, the syscall table is modified to redirect to the malicious syscalls versions.
Look for a stealthier way to hijack the system.

The current version of vfs_get_iterate in vfs.c grabs the iterate function from file->f_ops. On Ubuntu systems (and maybe others), this should grab iterate_shared instead, as iterate is a null pointer.

Creation of a listening server which will wait for a connection to be initiated by the attacker.

Add persistence on reboot to the rootkit check c3a5ac0 457e66c

The comunications between the rootkit and the attacker will be encrypted.

Crumbs is the userland program controlling rkduck.

Features to add:

• hide a file
• unhide a file
• hide a process
• unhide a process
• change the backdoor's mode
• change the remote ip when in reverse-shell mode.

Other features will be added later.

Configuration file for the rootkit

Provides config options such as the remote attacker's machine ip or domain name, etc...

The rootkit will initiate the connection.

Methods :

• Every min/hour/day ?
• ...