0 The Art of Rootkits: EVERYTHING ABOUT ROOTKITS Posted by R@hUl | at 12:19 AM

"ALMOST" EVERYTHING ABOUT ROOTKITS

1 - What is a root kit?A rootkit is a program. Rootkits come in all different shapes and styles, some more advance than others. Rootkits are basically programs that help attackers keep their position as root. Notice it's called a "rootkit". 'root' meaning the highest level of administration on *nix based systems and 'kit' meaning a collection of tools. Rootkits contain tools which help attackers hide their presence as well as give the attacker full control of the server or host continuously without being noticed.
Rootkits are usually installed on systems when they have been successfully compromised and the highest level of access has been given (usually root) Some rootkits refuse to be installed until the attacker has root access, due to read and write permission to certain files. Once the system has been successfully compromised and the attacker has root, he\she may then install the rootkit, allowing them to cover their tracks and wipe the log files.

A typical rootkit consists of the following utilities (Note: We will look at these in a lot more detail later on):

• Backdoor Programs - login backdoors, telnetd etc
• Packet Sniffers - Sniff network traffic such as FTP, TELNET,POP3
• Log-Wiping Utilities - Bash the logs to cover tracks
• DDoS Programs - Turn the box into a DDoS client (Remember trinoo?)
• IRC\Bots - Bots used to take over IRC channels (Lame and annoying)
• Miscellaneous programs - May contain exploit, log editor

(Don't worry to much if you don't understand any of the above, as I said were look at this all in a lot more detail further down)

2 - Hacker Jargon Definition

Oh Hail the mighty hacker jargon!

This is what the "Hacker Jargon" says about the word "rootkit"...

"rootkit: /root�kit/, n.
[very common] A kit for maintaining root; an automated cracking tool. What script kiddies use. After a cracker has first broken in and gained root access, he or she will install modified binaries such as a modified version login with a backdoor, or a version of ps that will not report the cracker's processes). This is a rootkit."

Wow! that's amazing! We worship you hacker jargon! Thank you ever so much for explaining to me what a rootkit is!

Remember kidz, all you have to do is read out some cool urban HaX@r words out the jargon to your friends and they will think your really c00l! and 1337! ;-)

3 - Hackers or the Kids?

Now the question you are probably asking yourself is "Is a rootkit a hackers tool or just another script kiddies tool?" (Well, you may not be thinking that, maybe I just suck and my psychology skills are as good as yours..) Well, the "Hacker Jargon" defines a rootkit and a script kiddies tool and to some extend he\she\they\IT is right (The jargon is always right)

Rootkits don't really require that much skill to run or use. Most rootkits can be compiled like this...

gcc t0rn.c -o rootkit

then...

./rootkit

(Now obviously when compiling all "hacker" tools you need to chose a name which disguises it's purpose, so rootkit would be a really stupid choice)

However there are some rootkits that require more skill to run and use. Some rootkits require you to edit the source code before it's compiled and some even need you to edit the iptables and kernel. (Very advance ones, they used one at the "Black Hat Conference" in 2002)

So, rootkits are used by both hackers and script kiddies. I personally believe that a hacker would have to write his own rootkit to call himself a hacker not just run and use someone else code. (However that�s just my opinion, so don't hold me to that!)

4 - Who uses rootkits and why?

I have already really covered this in the previous sections, however for the forgetful types I shall explain again, just to summaries up what we have learnt so far...