Lesson 2.73: Hidden kernel modules and system call hooks
The most powerful Linux rootkits are kernel modules. Once loaded, a module can unlink itself from the kernel's module list, so lsmod and /proc/modules stop showing it, and can redirect system calls such as getdents64 (directory listing) and kill (signals) into its own code. In memory both tricks leave traces: the module's other records are still there, and the system call table points outside the kernel. In the lab you check what the live host admits, then use Volatility to find the hidden module and the hooked calls, and record the finding.
17 min
You will learn to
- Explain how a module hides and hooks system calls
- Read the kernel taint value
- Compare linux.lsmod with linux.check_modules
- Find hooked system calls with linux.check_syscall
- Map system call numbers to names
Key terms
- Loadable kernel module
- Code added to the running kernel (.ko file) with full kernel privileges.
- Module unlinking
- Removing a module from the kernel's module list so lsmod doesn't show it.
- System call table
- The kernel's array of handlers indexed by system call number.
- Hook
- Redirecting a handler to attacker code that filters or changes results.
- kernel.tainted
- Bit flags recording unusual events since boot (4096 out-of-tree, 8192 unsigned module).
- linux.check_modules / check_syscall
- Volatility cross-view checks for unlinked modules and hooked system calls.
← Protecting the audit trail · All lessons · Hashes, reputation and variants →