/FreeBSD-Rootkit-1

A FreeBSD Kernel Rootkit written in C and Golang

Primary LanguageCMIT LicenseMIT

A FreeBSD kernel rootkit and detector written in C and Golang

Features

  • Reboot Persistence
  • File and Kernel Stat Hiding
  • Keylogging and File Exfiltration
  • Reverse Shell

Methodology

A kernel module is loaded which hook the syscalls and make changes we need, it will communicate with a background program written in Golang via a block device to achieve certain features above. It will also look for ICMP packets with a magic sequence in order to perform actions to external network such as reverse shell and log file exfiltration.

Report

For more details please read
Final Report