rootisnaked

Simple root privilege escalation detection using eBPF

rootisnaked

Table of Contents generated with mtoc

• rootisnaked
• Running rootisnaked
  • Install system dependencies
  • Compile and run
  • Using docker
• Simulate
• What's next?
• License

[2025-02-01 19:16:16] INFO uid changed or capabilities changed for process new_caps=[CAP_NET_RAW CAP_SYS_MODULE ......] pid=206493 exe_path=/usr/bin/sudo cmd_line=sudo su -  user=dcr old_uid=1000 new_uid=0 old_caps=[CAP_NET_RAW CAP_SYS_MODULE .....]

Rootisnaked is a simple eBPF program designed to monitor changes in user credentials (specifically, the UID) on a Linux system. It hooks into the commit_creds kernel function, which is called when a process's credentials are updated. The program detects when a process's UID changes to 0 (root) and logs this event to a ring buffer for further analysis in user space. It can be used, for example, to detect possible Linux privilege escalation.

The eBPF program (kernel space) is written in C and compiled using cilium-ebpf library. The code in user space is entirely written in Go.

Caution

This is an introduction of eBPF. This tool probably does not cover all possible attack vectors for escalating privileges.

To extend this tool, you probably need to detect:

• Gaining capabilities (CAP_SYS_ADMIN...): Right now it shows when the capabilities of a process change
• Changing group IDS (gid): no timplemented
• Manipulating file permissions (chmod, setuid...): not implemented
• Track parent process ID (ppid) and process hierarchy: not implemented
• Others

Running rootisnaked

Install system dependencies

Tested on debian12 with kernel version 6.1.0-30-amd64

• Dependencies:

sudo apt install -y linux-headers-$(uname -r) gcc git make clang llvm libbpf-dev libbpf-tools bpftool bpftrace

• Install Golang: https://go.dev/doc/install (Do not install Golang from the APT repository if using Debian, since it does not have the latest versions)

This page can be helpful https://ebpf-go.dev/guides/getting-started/#ebpf-c-program

Compile and run

make build-run GOARCH=amd64 # if using arm, GOARCH=arm64

Using docker

docker build -t rootisnaked/rootisnaked:latest .

eBPF code needs to be run under a privileged user.

docker run -it --rm --name rootisnaked --privileged rootisnaked/rootisnaked:latest

Simulate

sudo su -
sudo capsh --caps="cap_sys_admin+eip" -- -c "/path/to/some_process"

What's next?

• Implement more features
• Log too much verbose when capabilities changes
• Send notifications to systray (notify-send)
• Implement testing
• Others

License

rootisnaked is distributed under the terms of the AGPL3 license.