Class 09 · KP 24 / 25

Lab 5: Build a Linux LKM Rootkit

SSDT hook: redirect a syscall (e.g. NtQueryDirectoryFile) to hide artifacts.

Write a loadable kernel module that:
hides itself from lsmod / /proc/modules (list_del),
hides files/processes by an ftrace-based hook on getdents64,
grants root to a triggering process via prepare_creds / commit_creds.
Then detect it: compare ls vs a raw directory read; use dmesg, module-list scans, and cross-view thinking.
Stuxnet questions: which certs were stolen, which drivers hid files, why it was the first PLC rootkit, and which modern defense would have blocked each stage.

Key Takeaway

Build the stealth, then break it — understanding rootkits from both sides is the point of Lab 5. Do this only in the provided VM.