- [Instructor] Okay.
The first demonstration that we're gonna go through
is the ability to replace text within arbitrary files.
So we can see in this shell on the top right
that there is a folder with a file called file
and when we look inside this file,
we see the text "this is real data".
So now we're gonna go ahead and load up the first
of our eBPF rootkits into this shell on the left.
So this rootkit is going to look for any type of process
(indistinct)
and it's gonna replace any data
that contains the text real with the word fake.
But specifically it's not going to affect every process,
it's only going to affect children
of this specific person's ID,
which we can see that matches with our shell on the right.
So, we're gonna go ahead.
Our rootkit has now started,
and now, back to our shell,
when we go to read this file
we can see that the data has been changed
and it says "this is fake data".
And in fact, the log from the rootkit
actually says that it did detect that this process started,
which was cat,
and it replaced the text that that process read.
But what is interesting,
if we go to this shell now on the bottom right,
because this is a different shell
with a different person ID,
even though we're in the same folder,
and when you look at the same file
it sees the unaltered data.
So this is a technique that has many, many uses.
The example that we've used in the presentation
is this is a way that you can add a user
into the etc password file,
but only do that for an SSH process
and not for any auditing software or system administrator
having you look at that file.
Okay.
So, the next demonstration we're gonna go through
is the ability
to stealthily enable a user
to use sudo to recover it.
So typically on this machine,
if we have a look at this shell in the bottom right,
this is running as the user cold or proof
and if lowpriv wanted to become root using sudo,
well we can see,
oh, lowpriv is not allowed in the sudoers file.
And in fact,
if we use the root shell on the top right,
we can double and triply confirm
that lowpriv is not in this list.
So first off, we can use the sudo/l command to say
hey, what privileges does sudo believe this user to have?
And when we run it,
we see user lowpriv is not allowed to run.
And in fact, we can even at most basic level
just go and read the etc sudoers file
and look for the use of lowpriv
and sure enough, that user is not in there.
So this user, lowpriv,
is definitely not able to become root using sudo.
That is until we run the second of our eBPF rootkits
on the left.
So this one is going to look
for any time anything that is opening, specifically sudo,
is going to try to open the etc sudoers file
and it's just going to alter the text in that file to say,
Hey, lowpriv is actually in there
and they do actually have those privileges,
but it's only going to do this,
not only when just sudo is running,
but only when sudo is being run
specifically from lowpriv.
So now this rootkit has started,
if lowpriv were to use sudo again and say, who am I?
Well, look at this!
It can become route.
In fact, it didn't even need to enter its password.
So how does that work?
Well, so if as lowpriv, we now ask sudo to tell us,
hey, what privileges do you think I have?
Well, we can see that when sudo
is running as lowpriv it says,
hey, lowpriv has the ability
to do anything at once
without even needing to add in a password.
But even with this root kit running,
if we were to check these permissions as a different user,
it's still says,
Hey, lowpriv is no longer here.
And if we check that file, it still says
that lowpriv is not in there.
So this file is only altered,
not only when it's just a sudo process running,
but only when it is a sudo process
being run by that lowpriv user.
The last example that we're gonna go through
is the ability to kill arbitrary processes
as a sort of self protection idea.
So,
typically an administrator can use a cool tool
called BPF tool,
and this lists the running eBPF programs
that are running on that system.
And it's got the ability to see what programs are running,
so for example,
we can see a lot of eBPF programs
that actually relate to system D,
they're currently running on this system,
and BPF tool has the ability to list the running processes,
to dump out the instructions
and even seeing what process IDs
are actually related to that EBP program.
So, this is a good way for an administrator to see
what eBPF programs are running
to potentially discover something like an eBPF rootkit.
So what this,
so we're gonna load up a rootkit
that is running on the left
and now, if we attempt to use BPF tool
to list the processes,
oh, the process just gets killed
before that information happens.
So this is pretty extreme,
but this demonstrates that eBPF has the ability
to sort of protect itself by just killing any process
that it's attempting to do any sort of investigation.