HORSE PILL
A New Kind ofLinux Rootkit

Blackhat USA 2016

$ whoami
Michael Leibowitz(@r00tkillah)●●●

Blackhat USA 2016

Intel Red TeamNSA Playset
stuffOverview
●
●
●
●
●
●
●
●
●
●
Blackhat USA 2016

What is a rootkit
History of rootkits
How your computer boots
What is/isn’t protected
Containers
Putting it together
DemoProperties
Detection
Mitigation

What is a rootkit?
●●●

Post Exploitation
Persistent AccessCovert AccessBlackhat USA 2016

Historical Rootkits - backdoored commands
1.
2.

Backdoor inetd
Blind all tools to see rootkit
○○○○
○○

3.
4.
5.

pssum
topfindlosf
netstatConnect to shell served by inetd???
PROFIT!

Blackhat USA 2016

Historical Rootkits - LD_PRELOAD
1.
2.

Add malicious library to ld.so.preload, backdoor binary
Hooka.
b.
c.
d.
e.

3.
4.
5.

stat()
open()
opendir()
readdir()
unlink()Enjoy your shell???
Profit!!!

Blackhat USA 2016

Historical Rootkits - Kernel Module
1.
2.

Insert malicious kernel module
Make invisible
a.
b.
c.
d.
e.

3.
4.
5.

Network connections
Files
Processes
Module itselfDesirable Other Evil

Enjoy your shell???
Profit!!!

Blackhat USA 2016

Historical Rootkits - /dev/mem
1.
2.

Open memory and shove in malicious code
Make invisible
a.
b.
c.
d.

3.
4.
5.

Network connections
Files
Processes
Desirable Other Evil

Enjoy your shell???
Profit!!!

Blackhat USA 2016

What is a container?
Namespaces and cgroups
Hierarchies and non-hierarchies

Blackhat USA 2016

Clone, man. Man clone(2).
●Namespace creation controlled with unshare(2) and clone(2)●namespaces traversed with setns(2)root@gtfo:~# ls -l /proc/1/ns
total 0lrwxrwxrwx 1 root root 0 Jul 8 16:47 ipc -> ipc:[4026531839]
lrwxrwxrwx 1 root root 0 Jul 8 16:47 mnt -> mnt:[4026531840]
lrwxrwxrwx 1 root root 0 Jul 8 16:47 net -> net:[4026531969]
lrwxrwxrwx 1 root root 0 Jul 8 16:47 pid -> pid:[4026531836]
lrwxrwxrwx 1 root root 0 Jul 8 16:47 user -> user:[4026531837]
lrwxrwxrwx 1 root root 0 Jul 8 16:47 uts -> uts:[4026531838]

Blackhat USA 2016

Namespace Magic Numbers
root@gtfo:/usr/src/linux# cat -n include/linux/proc_ns.h | grep -A2 -B8
PROC_PID_INIT_INO
31/*32* We always define these enumerators
33*/34
enum {
35
PROC_ROOT_INO= 1,
36
PROC_IPC_INIT_INO= 0xEFFFFFFFU,
37
PROC_UTS_INIT_INO= 0xEFFFFFFEU,
38
PROC_USER_INIT_INO = 0xEFFFFFFDU,
39
PROC_PID_INIT_INO= 0xEFFFFFFCU,
40
PROC_CGROUP_INIT_INO= 0xEFFFFFFBU,
41};

Blackhat USA 2016

Process Hierarchies
Pid Eins

Pid 2

Pid 3

Blackhat USA 2016

Pid 4

Pid 5

Pid 6

Pid 7Pid 8

Pid 9

Pid 10
Pid 1

Pid 11
Pid 2

Pid 12
Pid 3

Pid 13
Pid 4

How Your Computer Boots
1.
2.
3.
4.
5.
6.

UEFI
Shim
GummibootKernelinitrdsystemd

Blackhat USA 2016

How Your Computer Boots

UEFI
Runtimeshim
cert

Variable
Store
Blackhat USA 2016

Gummibootorgrublinooks

How Your Computer Boots

UEFI
Runtimeshim
cert

Variable
Store
Blackhat USA 2016

Gummibootor
grub

linooks

initrdsystemd

Your
Stuff

Protected / Not protected
Bootloader
KernelModules
InitrdRootfsBlackhat USA 2016

Anatomyof aRamdisk

Blackhat USA 2016

What Your Ramdisk is Supposed to do
1.
2.
3.
4.
5.
6.
7.

Load necessary modules/respond to hotplug events
Cryptsetup <optional>
Find and mount rootfs
Clean up initrd
Exec init???
Profit!!!

Blackhat USA 2016

Anatomyof aRamdisk(now)Blackhat USA 2016

What Your Ramdisk Does Now
1.
2.
3.
4.

Load modules/hotplug events
Cryptsetup
Find and mount rootfs
Enumerate kernel threads

Blackhat USA 2016

What Your Ramdisk Does Now
1.
2.
3.
4.
5.

Load modules/hotplug events
Cryptsetup
Find and mount rootfs
Enumerate kernel threads
Clone (CLONE_NEWPID, CLONE_NEWNS)Blackhat USA 2016

1.
2.
3.
4.

Remount proc
Make fake kernel threads
Clean up initrd
Exec init

What Your Ramdisk Does Now
1.
2.
3.
4.
5.
6.
7.

Load modules/hotplug events
Cryptsetup
Find and mount rootfs
Enumerate kernel threads
Clone (CLONE_NEWPID, CLONE_NEWNS)Remount root
Mount scratch spaceBlackhat USA 2016

1.
2.
3.
4.

Remount proc
Make fake kernel threads
Clean up initrd
Exec init

What Your Ramdisk Does Now
1.
2.
3.
4.
5.
6.
7.
8.

9.
10.

Load modules/hotplug events
Cryptsetup
Find and mount rootfs
Enumerate kernel threads
Clone (CLONE_NEWPID, CLONE_NEWNS)Remount root
Mount scratch spacefork()a. Hook initrd updatesb. Backdoor shell
waitpid()
shutdown/reboot

Blackhat USA 2016

1.
2.
3.
4.

Remount proc
Make fake kernel threads
Clean up initrd
Exec initKernel Threads
root@gtfo:~# ps auxf | head -n 20
USER
PID %CPU %MEM
VSZ
RSS TTYroot
2 0.0 0.000 ?
root
3 0.0 0.000 ?
root
5 0.0 0.000 ?
root
7 0.0 0.000 ?
root
8 0.0 0.000 ?
root
9 0.0 0.000 ?
root
10 0.0 0.000 ?
root
11 0.0 0.000 ?
root
12 0.0 0.000 ?
root
13 0.0 0.000 ?
root
14 0.0 0.000 ?
root
15 0.0 0.0
00 ?

Blackhat USA 2016

STAT START
S
Jul09
S
Jul09
S<Jul09
S
Jul09
S
Jul09
S
Jul09
S
Jul09
S
Jul09
S
Jul09
S
Jul09
S
Jul09
S
Jul09

TIME COMMAND
0:00 [kthreadd]
0:00 \_ [ksoftirqd/0]
0:00 \_ [kworker/0:0H]
0:29 \_ [rcu_sched]
0:00 \_ [rcu_bh]
0:16 \_ [rcuos/0]
0:00 \_ [rcuob/0]
0:00 \_ [migration/0]
0:00 \_ [watchdog/0]
0:00 \_ [watchdog/1]
0:00 \_ [migration/1]
0:00 \_ [ksoftirqd/1]

prctl/setting process nameprctl_map = (struct prctl_mm_map) {...
.arg_start = arg_start,.arg_end = arg_end,...
};ret = prctl(PR_SET_MM, PR_SET_MM_MAP, (long) &prctl_map, sizeof(prctl_map), 0);

prctl(PR_SET_NAME, (unsigned long)buf, 0, 0, 0) < 0);Blackhat USA 2016

Putting it Together: Covertness
Goal
A.
B.
C.

Processes Invisibility
Storage Invisibility
Networking Invisibility

Blackhat USA 2016

Hiding Network Traffic
root@gtfo:~# head -n1 /proc/net/tcp ; cat /proc/net/tcp | grep 0101007F:0035
sllocal_address

3: 0101007F:0035

rem_addres

…

inode

…

00000000:0000 …

20041

…

root@gtfo:~# ls -l /proc/1894/fd | grep 20041
lrwx------ 1 root root 64 Jul 17 10:23 5 -> socket:[20041]

Blackhat USA 2016

Putting it together: Persistence
How do we get our malicious binary into ramdisks on upgrade?
1.
2.
3.
4.
5.

Assemble initrd contents into tmpdir
Splatover run-init
Archive and compress tmpdir???
Profit!!!!

Blackhat USA 2016

DemoBlackhat USA 2016

Properties
Covert●●●Processes
Networking
Storage

PersistentBlackhat USA 2016

Detection●●●●/proc/<pid>/ns links
Kernel threads proc entries (ppid != 0)
Audit
External examination

Blackhat USA 2016

What we cando to fix thisSTOP
assemblingramdisks onsystems!

Blackhat USA 2016

Conclusion
●
●
●
●
●
●
●
●
●
●
Blackhat USA 2016

What is a rootkit
History of rootkits
How your computer boots
What is/isn’t protected
Containers
Putting it together
DemoProperties
Detection
Mitigation

Questions?
Michael Leibowitz(@r00tkillah)

Blackhat USA 2016

Illustrations by Cyrene Domogalla