kernel rootkit module to hide connections from attacker ip (ssh, reverse shells, etc...).
The base source of this code is from Xcellerator/linux-kernel-hacking project, a kernel module to hide connections of certain tcp port, I have addapted the code adding a function and remove/edit some lines in the kernel hooked function to hide connections from an attacker ip address and not from tcp port connection as the original base source do.
- Edit the
IP_ADDRESS_TO_HIDEvariable in rootkit.c file at line 10 - Build with
make - Load with
insmod rootkit.ko - At this moment any tcp connection from/to the attacker ip dissapear in "netstat" output command
