Azazel linux rootkit - anti-debugging - anti-detection

[CES]

Azazel is a userland rootkit written in C based off of the original LD_PRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily around anti-debugging and anti-detection. Features include log cleaning, pcap subversion, and more.

Anti-debugging

Avoids unhide, lsof, ps, ldd detection

Hides files and directories

Hides remote connections

Hides processes

Hides logins

PCAP hooks avoid local sniffing

Two accept backdoors with full PTY shells.

Crypthook encrypted accept() backdoor

Plaintext accept() backdoor

PAM backdoor for local privesc and remote entry

Log cleanup for utmp/wtmp entries based on pty

Uses xor to obfuscate static strings

Azazel - Security101 - Blackhat Techniques - Hacking Tutorials - Vulnerability Research - Security Tools

[John.Wayne.]

doar 3 posturi ? hmm

a testat cineva ?

[bilythekid]

l-am incercat eu si imi da asta:

root@WarHead:~/azazel# make

cc -fPIC -g -c azazel.c pam.c xor.c crypthook.c pcap.c

pam.c:8:31: fatal error: security/pam_appl.h: No such file or directory

compilation terminated.

make: *** [libselinux.so] Error 1

root@WarHead:~/azazel#

ce parere aveti?

[Gushterul]

Instaleaza pam-devel