[lola_mybb_import14421]

github repository: [hide]https://github.com/ring-1/zendar[/hide]

I programmed this rootkit in roughly one day. It uses the LD_PRELOAD trick to load as a shared library object file, and hides from 22 different calls.
This kit is userland, so it operates in ring3. I have programmed a ring0 rootkit. I'm currently selling a kit that works on x86 and x86_64 Linux kernels. It is much superior compared to Zendar honestly, you can contact me if you're interested.
Zendar works on both common architectures.

Most annoying thing about this is that you have to change your settings in install, and zendar.c. I could fix this, but I programmed this a while ago, and there weren't many requests to make the installation more efficient on user effort. I am however, writing another userland kit - but it won't be public - that fixes a lot of the inconsistencies that Zendar has in terms of deployment.
This was more just for other people to learn from, so I hope some of you enjoy this in some way.

Here's some articles on LD_PRELOAD if you're interested in learning about it.

[hide]http://jvns.ca/blog/2014/11/27/ld-preload-is-super-fun-and-easy/
https://rafalcieslak.wordpress.com/2013/...-programs/
http://www.linuxjournal.com/article/7795
http://mips42.altervista.org/ld_preload.php[/hide]

Also, credits to Azazel and Jynx2, both ring3 rootkits.
[hide]https://github.com/chokepoint/azazel
https://github.com/chokepoint/Jynx2[/hide]

Also, if you're interested in ring0 rootkits, this is a very good paper. It details the use of loadable kernel modules to intercept and overwrite Linux syscalls. The only downside is that some kernels are compiled with support of loadable kernel modules disabled, and the way to get around this is by writing to the kmem device file.
[hide]https://www.thc.org/papers/LKM_HACKING.html[/hide]

A paper on writing to /dev/kmem:
[hide]https://www.blackhat.com/presentations/bh-europe-09/Lineberry/BlackHat-Europe-2009-Lineberry-code-injection-via-dev-mem.pdf[/hide]

I kinda went on a huge tangent, but whatever. I hope the shit in this thread in this thread helps some of you, or develops your interest further.

[ɘxɘ]

This seems interesting, I haven't saw many Ring3 rootkits.

[3rd_Power]

I am going to take a guess that this is 32 bit?

[taku]

Mad respect; thank you very much for sharing this.

[lola_mybb_import14421]

I am going to take a guess that this is 32 bit?

the architecture of the machine is irrelevant, the kit is dynamic in relation to this
as long as the box uses glibc

[3rd_Power]

I am going to take a guess that this is 32 bit?

the architecture of the machine is irrelevant, the kit is dynamic in relation to this
as long as the box uses glibc

nvm, I re-read the post and saw this was for Linux, which in my opinion makes it useless.

[lola_mybb_import14421]

I am going to take a guess that this is 32 bit?

the architecture of the machine is irrelevant, the kit is dynamic in relation to this
as long as the box uses glibc

nvm, I re-read the post and saw this was for Linux, which in my opinion makes it useless.

"makes it useless"
LOL HAHA
okay man