Questions about this topic? Sign up to ask in the talk tab.
Difference between revisions of "LKM"
From NetSec
| Line 5: | Line 5: | ||
$ lsmod | $ lsmod | ||
$ cat /proc/modules | $ cat /proc/modules | ||
| + | </source> | ||
| + | }} | ||
| + | |||
| + | You can (as root) add new modules to your kernel with the <i>insmod</i> and <i>rmmod</i> commands: | ||
| + | |||
| + | {{code|text= | ||
| + | <source lang="bash"> | ||
| + | $ insmod modname.ko | ||
| + | $ rmmod modname | ||
</source> | </source> | ||
}} | }} | ||
Revision as of 21:49, 21 June 2016
LKM stands for "Linux Kernel Module" or "Loadable Kernel Module". As the name implies, it is a way to allow code to interact directly with the kernel, in the kernel. In essence, it is a way to extend the kernel and add functionality to it. Although it goes without saying that you need root to modify the kernel, this opens up an interesting way to backdoor a box. You can see a list of currently loaded kernel modules in two ways:
$ lsmod $ cat /proc/modules |
You can (as root) add new modules to your kernel with the insmod and rmmod commands:
$ insmod modname.ko $ rmmod modname |
