Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
typo
  • Loading branch information
ldpreload authored May 25, 2023
1 parent 98d4bcd commit eb255a4
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
</p>

# &lceil;**Description**&rceil;
Medusa is a powerful, stealthy, verastile, and, modular rootkit designed to give attackers complete control over Linux systems. Medusa is compiled and ready to be executed as a small ELF executable file, which no means extra building or configuration requirements! Medusa is larger than a few hundred kilobytes in size. Once installed, the rootkit sets up a dynamic linker that modifies the way applications are loaded and executed on the system. At this point the Medusa hooks a plethora of API system calls, library functions and signal handlers to achieve imbreakable and uninterceptable persistence. Medusa intercepts a plethoa of system calls made by all applications on the Medusa infected machine.. Hooking these system calls allows a Medusa to control and modify the behavior when system call is made. For example, with `stat()` family calls, a user can specify what information should be returned when those calls are made, or make changes to the permissions of files and directories. With `access()`, the user can control who has permission to what areas of the system. With `write()`, `read()`, `open()`, and their derivatives, Medusa can control what files and directories are accessed by the system, and what data is written to them. Truncate and `chmod()` / `chown()` allows for control over how files and directories are manipulated. Pututxline, updwtmp, and pututline are used for managing user logins and account information.
Medusa is a powerful, stealthy, versatile, and, modular rootkit designed to give attackers complete control over Linux systems. Medusa is compiled and ready to be executed as a small ELF executable file, which no means extra building or configuration requirements! Medusa is larger than a few hundred kilobytes in size. Once installed, the rootkit sets up a dynamic linker that modifies the way applications are loaded and executed on the system. At this point the Medusa hooks a plethora of API system calls, library functions and signal handlers to achieve imbreakable and uninterceptable persistence. Medusa intercepts a plethoa of system calls made by all applications on the Medusa infected machine.. Hooking these system calls allows a Medusa to control and modify the behavior when system call is made. For example, with `stat()` family calls, a user can specify what information should be returned when those calls are made, or make changes to the permissions of files and directories. With `access()`, the user can control who has permission to what areas of the system. With `write()`, `read()`, `open()`, and their derivatives, Medusa can control what files and directories are accessed by the system, and what data is written to them. Truncate and `chmod()` / `chown()` allows for control over how files and directories are manipulated. Pututxline, updwtmp, and pututline are used for managing user logins and account information.

# &lceil;**Features**&rceil;
- **PAM Backdoor**
Expand Down

0 comments on commit eb255a4

Please sign in to comment.