Hack Like a Pro: Linux Basics for the Aspiring Hacker, Part 12 (Loadable Kernel Modules) « Null Byte :: WonderHowTo

Welcome back, my budding hackers!In my continuing series onLinux basics for aspiring hackers, I now want to address Loadable kernel modules (LKMs), which are key to the Linux administrator because they provide us the capability to add functionality to the kernel without having to recompile the kernel. Things like video and other device drivers can now be added to the kernel without shutting down the system, recompiling, and rebooting.Loadable kernel modules are critical to the hacker because if we can get the Linux admin to load a new module to their kernel, we not only own their system, but because we are at the kernel level of their operating system, we can control even what their system is reporting to them in terms of processes, ports, services, hard drive space, etc.So, if we can offer the Linux user/admin a "new and improved" video driver with ourrootkitembedded in it, we can take control of his system and kernel. This is the way some of the most insidious rootkits take advantage of the Linux OS.So, I hope it's clear that understanding LKMs is key to being an effective Linux admin and being a VERY effective and stealthy hacker.Step 1: What Is a Kernel Module?The kernel is a core component of any Linux operating system, including ourBackTrack System. The kernel is the central nervous system of our operating system, controlling everything an operating system does, including managing the interactions between the hardware components and starting the necessary services. The kernel operates between user applications and the hardware such as the CPU, memory, the hard drive, etc.As the kernel manages all that is taking place with the operating system, sometimes it needs updates. These updates might include new device drivers (such as video card or USB devices), file system drivers, and even system extensions. This is where LKMs come in. We can now simply load and unload kernel modules as we need them without recompiling the kernel.Step 2: Checking the KernelThe first thing we want to do is check to see what kernel our system is running. There are at least two ways to do this. We can type:uname -aNote that the kernel tells us its kernel build (2.6.39.4), but also the architecture it is built for (x86_64). We can also get this info by "catting" the /proc/version file, which actually gives up even more info.cat /proc/versionStep 3: Kernel Tuning with SysctlSometimes, a Linux admin will want to "tune" the kernel. This might include changing memory allocations, enabling networking feature, and even hardening the kernel from hackers.With modern Linux kernels, we have thesysctlcommand to tune kernel options. All changes you make with the sysctl remain in effect only until you reboot the system. To make any changes permanent, the configuration file for sysctl must be edited at /etc/sysctl.conf.Be careful in using systctl because without the proper knowledge and experience, you can easily make your system unbootable and unusable. Let's take a look at the contents of sysctl now.sysctl -a |lessTo view the configuration file for sysctl, we can get it at /etc/sysctl.conf.less /etc/sysctl.confOne of the ways we may want to use sysctl for hacking is to enable ipforwarding (net.ipv4.conf.default.forwarding) forman-in-the-middle attacks. From a hardening perspective, we can disable ICMP echo requests (net.ipv4.icmp_echo_ignore_all) so as to make more difficult, but not impossible, for hackers to find our system.Step 4: Kernel ModulesTo manage our kernels, Linux has at least two ways to do it. The older way is to use a group of commands built around theinsmodcommand. Here we use one of those—lsmod—to list the installed modules in kernel.lsmodWe can load or insert a module withinsmodand remove a module withrmmod.Step 5: ModprobeMost newer distributions of Linux, including our BackTrack 5v3, have converted to themodprobecommand for LKM management. To see what modules are installed in our kernel, we can type:modprobe -lTo remove a module, we simply use the -r switch with modprobe.modprobe -rA major advantage of modprobe is that understands dependencies, options, and installation and removal procedures for our kernel modules.To see configuration files for the installed modules, we list the contents of the /etc/modprobe.d/ directory.ls -l /etc/modprobe.d/Remember, the LKM modules are a convenience to a Linux user/admin, but are a major security weakness of Linux and one the professional hacker should be familiar with. As I said before, the LKM can be the perfect vehicle to get your rootkit into the kernel and wreak havoc!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePenguin imagevia ShutterstockRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 24 (The Linux Philosophy)Hack Like a Pro:Python Scripting for the Aspiring Hacker, Part 1How to Hack Like a Pro:Getting Started with MetasploitCompile a Linux Kernel Part 1:Theory...a Lot of Theory (1/2)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)News:Even Microsoft Acknowledges the Superiority of the Bash Shell NowHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPNews:Linux Kernel Exploits Aren't Really an Android ProblemHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 23 (Logging)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 25 (Inetd, the Super Daemon)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)How To:Find Exploits & Get Root with Linux Exploit SuggesterHow To:Get Packet Injection Capable Drivers in LinuxGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHow To:Get Your AMD Graphics, Sound & Other Drivers to Work in Linux on Your LaptopHow To:Fix the Channel -1 Glitch in Airodump on the Latest KernelCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:How Hackers Take Your Encrypted Passwords & Crack ThemNews:Backtrack 5 R2, 3.2.6 Linux KernalGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker Training