Do not test or run your rootkit on CSE systems, or against any programs on UNSW infrastucture

Project Specification

Rootkit (10 marks)

You will provide rootkit.tar which contains install, elevate, log, and remote.

log and remote can be stub programs if you are not attempting to obtain bonus marks.
rootkit.tar may also include any additional files required to install and run your rootkit. You are permitted to do anything you wish to achieve the following fundamental functionality:
Provide a method to escalate to uid(0) (root) by a low-privileged/non-root user/binary.
Attempt to hide itself from detection (e.g., concealing itself from kldstat, and userland components from find).

Note: Attempts to make a trivial “rootkit” that changes the root password or only installs a SUID binary to do your dirty work will be considered not completing the assignment.

Bonus Functionality

Your rootkit may also have bonus marks awarded for the following functionality. These marks will add to your marks and can go above the maximum mark for the course, such that they will supplement missing marks for any other assignment in the course. These marks will not count towards your pass/fail grade in the exam.

2 marks — Provide a method for a remote unauthenticated user to gain network root access.
2 marks — Keylog user’s input, and exfiltrate the data to an external network.
- This requires monitoring not only physical input, but also SSH input.
3 marks — Reboot persistence. Your final rootkit will be marked based on how many other students are able to detect your rootkit.

Rootkit Detection (10 marks)

Every group will be provided with the design documentation of every other group after the midpoint assessment. The design documents will be released at 12:01pm 30th September 2018 (Sunday of Midsem Break). This should assist in building your rootkit detector.

Design documents: https://webcms3.cse.unsw.edu.au/COMP6447/18s2/resources/21207
You will provide detection.tar (or detect.tar), which contains detect (your rootkit detector) as well as any other required files to run.
You must return status code 0 if no rootkit is detected, and return 1 if a rootkit is detected. You may print whatever output you wish during the script. Your detection script will be tested against a variety of clean and infected hosts:
-2 marks from your detection mark (10 marks) if you detect a false positive (claiming a rootkit on a clean host).
- At least 5 varied configurations of a clean host will be tested.
+1 mark if you correctly detect a rootkit.
-1 mark if you fail to detect your midpoint rootkit. You are not required to detect your final rootkit implementation.
Minimum mark of 0.

Final Rootkit Writeup (5 marks)

The final deadline will require you to submit a 4+ page (at least 4 pages) writeup (writeup.md) that details the following:

Everything required in the midpoint writeup.
What changes were made since the midpoint deadline.
Design decisions for rootkit detection:
- What methods are being detected and how.
Design decisions & justifications for rootkit & rootkit detector decisions.

How Your Rootkits Will Be Installed and Tested

$TARGET = The system that the rootkit will be installed on.
$REMOTE = A separate system with network access to $TARGET.
install, elevate, remote, and detect can all be either binaries or shell scripts so long as they can be executed with ./. Supply a tarball (rootkit.tar) containing the following binaries or scripts plus any additional contents:
install
elevate
remote
log The detector will also be a tarball (detect.tar / detection.tar) containing the following script or binary, plus any additional content:
detect

Step Specifications

Installation steps:
- rootkit.tar will be extracted and then all files inside provided to $TARGET.
- ./install <IP> will be run in a root shell on $TARGET, with <IP> being the address of $REMOTE.
Elevation steps:
- rootkit.tar will be extracted and then all files inside provided to $TARGET.
- ./elevate will be run in a non-root shell on $TARGET. It should spawn a root shell.
Remote steps:
- rootkit.tar will be copied to $REMOTE.
- rootkit.tar will be extracted and ./remote <target IP address> will be executed on $REMOTE. It should spawn a root shell on $TARGET.
Log steps:
- rootkit.tar will be copied to $REMOTE.
- ./log <IP> will be executed on $REMOTE, with <IP> being the address of $TARGET. It should log all data exfiltrated from $TARGET.
Detection steps:
- detect.tar will be extracted and then all files inside provided to $TARGET.
- ./detect may be renamed prior to being provided to $TARGET.
- ./detect will be run in a root shell.
- ./detect should return 0 if the system does not contain a rootkit. Otherwise it should return 1.

Order of Execution

The rootkit will be installed on $TARGET and provided with the IP address of $REMOTE.
The detector will be run on $TARGET.
The elevation program will be run on $TARGET with various commands.
The detector program will be run again on $TARGET.
The remote program will be run with various commands on $REMOTE, provided with the IP address of $TARGET.
The $TARGET system will be rebooted.
The detector will be run on $TARGET.
The elevation program will be run on $TARGET with various commands.
The detector program will be run on $TARGET.
The remote program will be run with various commands on $REMOTE, provided with the IP address of $TARGET.
The detector program will be run on $TARGET.

Testing Conditions

No exact details will be given about how the detector and rootkit are loaded onto the system, and you should not make assumptions.
At all points during testing, other applications may be running, simulating a real-world system.
We will wait for all commands to exit before running the next step in a linear order.
There will be multiple target systems in different configurations.
There may be fake detectors which always return true or always return false.