KoviD - Red-Team LKM

项目说明

!KoviD Logo

---

⚠️ IMPORTANT DISCLAIMER - EDUCATIONAL & DEFENSI RESEARCH ONLY ⚠️

This project is strictly for educational purposes and defensi research.

Our Mission

Rootkits are typically closed-源码 threats that operate in shadows, making them difficult to understand and defend against. Ko to change this paradigm by pro an open-源码 implementation that:

Empowers security researchers to understand rootkit techniques in a transparent, controlled en

Helps system administrators learn how to detect and defend against real-world threats

Educates students and professionals about kernel-le

Contributes to making Linux more secure by exposing potential attack for defensi

Why Open 源码 Rootkit Research Matters

Most rootkits in the wild are closed-源码, leaving defenders at a disad. By pro an open-源码 implementation:

Security professionals can study real rootkit techniques without re malware

Defensi can be tested against known rootkit behaviors

The security community can collaborate on detection and pre methods

Organizations can prepare their defenses against sophisticated kernel-le

Legal and Ethical Use Only

WARNING: This software is provided for authorized security testing and educational purposes ONLY.

DO NOT use this software on systems you do not own or lack explicit permission to test

DO NOT use this software for any illegal or malicious purposes

ALWAYS comply with all applicable laws and regulations in your jurisdiction

REMEMBER: Unauthorized access to computer systems is illegal and unethical

By using this software, you agree to use it responsibly and solely for improving security posture and understanding.

---

Educational & Research Objectives

Ko as a comprehensi platform for:

For Security Researchers

Analyze rootkit behavior in a controlled, observable en

Develop detection signatures for security tools and IDS/IPS systems

Test defensi against known rootkit techniques

Research kernel security and mitigation strategies

For System Administrators

Learn to identify signs of rootkit infection

Understand attack to better secure production systems

Test incident response procedures in safe en

security tools effecti against rootkit techniques

For Students & Educators

Hands-on learning about kernel-le concepts

Practical demonstrations of theoretical security

Research projects on Linux kernel security

Thesis work on rootkit detection and pre methods

How This Helps Impro Security

1. Transparency: Open-源码 代码 allows the community to understand threats better
2. Collaboration: Researchers can work together on detection methods
3. Inno: Dri of better security tools and kernel hardening
4. Preparation: Helps organizations prepare defenses before encountering real threats

---

1 - About Ko Research Tool

KoviD is an open-源码 Loadable Kernel Module (LKM) security research 工具
designed to help security professionals understand and defend against rootkit
techniques in Linux Kernel 5 and later.

This educational 工具 demonstrates rootkit capabilities to help defenders:
• Understand how rootkits hide from detection systems
• Test security monitoring and detection tools
• Learn kernel-le
• Develop better defensi

Research capabilities demonstrated include:
• Module concealment techniques from SysFS
• Process hiding mechanisms in proc filesystem
• Log manipulation and e techniques
• CPU usage concealment methods
• Pri escalation
• File and directory hiding approaches
• Network connection concealment

By understanding these techniques, security professionals can better protect systems.

1.1 Ko and influence

KoviD has influenced the security‑research community: it is cited in numerous
papers and analyses, and later tools ha technical ideas from it.

#### 1.1.1 Articles and Researches

• Phrack magazine
Where g1inko works on some challenges posed by KoviD

• Black Hat Arsenal 2025
wetw0rk's awesome Sickle Payload 框架,
KoviD is deployed without touching the disk!

• Sandfly Security
Sandfly Agentless Linux Security and stealth rootkit detection technics

• Thalium
Linux kernel Rust module for rootkit detection

• Uni de Bordeaux
Master SCI Ko case-study by Charbonnier Elouan & Raphel Elsa

• Phrack magazine
Where g1inko works on some challenges posed by KoviD

• Bloo
Inside KoviD: The Stealthy Linux Kernel Rootkit Threat

#### 1.1.2 Influence on other LKM researches

We also inspire other LKM rootkits, with
some unique set of features, to name a few:

• Ftrace disabling call interception
• TTY session logging
• tainted mask manipulation
• Process handling
• BPF introspection operations
• SysFS entries re-addition - Essential for debugging and de

The APT Down leak contains a rootkit that appears to reuse parts of KoviD,
notably the SysFS hide/unhide implementation and helper
routines — see links below.

ENKI Whitehat

APT Down - The North Korea Files, leak

A number of public‑domain projects ha inspiration from KoviD.
In some cases de adapted concepts or reused small,
代码 fragments recreate features that were distinctive to our project:

blackbox-ave

basilisk rootkit

Singularity rootkit

1.2 Build from source

We propose building it via docker, e.g.:

For more info, check out docs/Automated-Build-With-Docker.md.

1.3 Mostly tested against

6.x: Linux 6.8.0-52-generic #53~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC x86_64 x86_64 x86_64 GNU/Linux
gcc-12 (Ubuntu 12.3.0-1ubuntu1~22.04) 12.3.0

5.x: Ubuntu 22.04.1 LTS
Linux hash- 5.19.0-41-generic #42~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC
UTC 2 x86_64 x86_64 x86_64 GNU/Linux

5.x: Linux Standard-PC-Q35-ICH9-2009 5.15.0-43-generic #46-Ubuntu
SMP x86_64 x86_64 x86_64 GNU/Linux

5.x: Ubuntu 22.04 LTS
Linux 5.15.0-43-generic #46-Ubuntu SMP Tue Jul 12 10:30:17 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0

5.x: Ubuntu 20.10
Linux ubuntu 5.8.0-55-generic #62-Ubuntu SMP Tue Jun 1 08:21:18 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
gcc (Ubuntu 10.3.0-1ubuntu1~20.10) 10.3.0

5.x: Ubuntu 18.04.5 LTS
Linux ubuntu 5.4.0-89-generic #100~18.04.1-Ubuntu SMP Wed Sep 29 10:59:42 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0

4.x: Debian GNU/Linux 10
Linux debian10teste 4.19.0-18-amd64 #1 SMP Debian 4.19.208-1 (2021-09-29) x86_64 GNU/Linux
gcc (Debian 8.3.0-6) 8.3.0

4.x: CentOS Linux release 8.3.2011
4.18.0-240.22.1.el8_3.x86_64 #1 SMP Thu Apr 8 19:01:30 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
gcc (GCC) 8.3.1 20191121 (Red Hat 8.3.1-5)

2 - Features

2.1 Hide itself (module)

Ko itself, making it challenging to detect. It customizes kernel
代码 to evade anti-rootkit detectors and disappears
from /sys/module listings.

2.2 Hide files and directories

Ko files and directories effectively by hijacking filldir and
filldir64 kernel functions, significantly simplifying the process.

2.3 Function and syscall hijacking: Ftrace

Ko Ftrace, a legitimate method for
function and syscall hijacking in Kernel v5+.
This approach offers greater stability compared
to traditional hooking techniques.

2.4 Backdoors

Ko popular and reliable methods for backdooring systems,
such as port-knocking with custom packets.
These open connections to Netcat, OpenSSL, and Socat sessions.

2.5 Firewall E

Ko magic packets and establishes reverse shell connections.
These packets trigger netfilter hooks and instruct KoviD to create a
reverse shell connection. These outgoing packets bypass iptables rules,
ensuring effecti.

2.6 Tasks

Hiding processes is a crucial feature, giving KoviD the
ability to run undetected. It provides full support for
children processes, ensuring that no hanging processes are left behind.

2.7 Logs

KoviD's hidden tasks result in missing logs, making it
even more challenging for administrators to detect its
presence. It eliminates logs generated by userland tools
like w, lsmod, ps, who, ls.

2.8 TCP/UDP logs

Ko 网络 connections and manipulates 网络 logs
to maintain stealth for back-doors. Libpcap+recvmsg.
(ss, tcpdump, netstat...)

2.9 r00t

Gain root pri easily with kill -SIGCONT 666.

2.10 CPU - hiding/mining

Ko CPU consumption, making its processes in
as hea. However, be cautious not to max out the CPU,
as this can lead to unusual usage patterns.

2.11 Persistence

Ko persistence . It can infect executables,
like SSHD, to ensure Ko on reboot. You can also use your
preferred 工具, use here is just a suggestion.

2.12 Base address

Ko for the retrieval of base addresses of other executables
without needing to open /proc/<pid>/maps.

2.13 BPF

KoviD can evade few anti-rootkit tools that rely on BPF
(Berkeley Packet Filter) for detecting rootkits.

Tested against:

2.14 Tainted

$ sudo insmod ./kovid.ko
$ cat /proc/sys/kernel/tainted
0

3 - Usage

Before compiling and loading KoviD, edit the Makefile to choose a unique
name for /proc/<name>. Compile and load Ko sudo insmod kovid.
Ensure the chosen name for /proc/<name> is not easily predictable.

3.1 /proc/<name> interface

To enable the /proc/mytest interface, use the command:
$ kill -SIGCONT 31337.
The interface will disable itself after 120 seconds and can be
reactivated using the same command.

3.2 Command retcode

Some commands can return a status code.
Enable status code:
$ echo output-enable >/proc/mytest
$ cat /proc/mytest
1
$ echo output-disable >/proc/mytest
$ cat /proc/mytest
0

0 disabled
1 enabled

Command example after output-enable:
$ echo hide-lkm >/proc/mytest
$ cat /proc/mytest
0

3.3 Tasks

You can hide/unhide processes using the /proc/mytest interface.
For example, to hide a task, run: $ echo 14886 >/proc/mytest.
If a task is a backdoor that needs tcp hiding, run:
$ echo hide-task-backdoor=<pid> >/proc/mytest
Unhiding is the same as for regular tasks:
$ echo "<PID>" >/proc/mytest

3.4 Hide module

To hide the Ko, use the command: $ echo hide-lkm >/proc/mytest.
In release mode, the module is hidden by default,
and a key can be displayed by running $ cat /proc/mytest.

3.5 Hide/unhide/list files and directories

To hide a file or directory, use:
$ echo hide-file=/tmp/README.txt >/proc/mytest
To unhide, use:
$ echo unhide-file=README.txt >/proc/mytest
You can list hidden files
and directory names with:
$ echo list-hidden-file >/proc/mytest.

3.6 SSH/FTP TTY sniffer

KoviD can snoop SSH sessions via tty keystrokes and steal passwords
and commands effectively.

3.7 Backdoors

For instructions, run 'scripts/bdclient.sh' and a help list is displayed.

4 - Bugs

As with any software, KoviD may have bugs.
If you encounter issues or oopses, please report them in detail for
potential fixes. Test Ko, preferably in a VM that
mimics the target en.

Disclaimer: The use of KoviD in a real target is discouraged

项目信息

开发语言：C

Star 数：658

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Red-Team LKM展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。