reversePromedium

Kernel Monarch

hackthebox

Task: reverse a Linux kernel rootkit (malware.ko) that uses ftrace to hook syscalls and filter /dev/kmsg output. Solution: identify dentry-based filename check in hook_read, bypass by creating alternate device node with mknod to read unfiltered kernel logs revealing the flag.

$ ls tags/ techniques/
linuxx86_64rootkitlkmkernel_modulesyscall_hookingbypassftracedmesg_filteringdevice_nodemknod
syscall_hook_identificationftrace_hook_analysisdentry_name_bypassalternate_device_node_creationkernel_module_symbol_analysisrodata_string_extraction
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups