Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process?

Question

So lets say we have a rootkit on our system

can this rootkit write something inside a kernel process?

for example in windows, can a rootkit write to ntoskrnl process, changing some functions and creating a new one, therefor for example when an interupt occurs and operating system reads the corresponding function from IDT and tries to execute it in ntoskrnl process, the rookit replaces the first instruction of that function to jump to another location which the rootkit has written and therefore executing a malicious code instead?

is this possible?

I'm asking about windows and linux, if it is different for each of them please tell

Answer 1

On both Windows and Linux (and any other modern OS), the answer is yes if the rootkit is running in kernel mode (as a kernel-mode driver / kernel module). If the rootkit is merely running as Administrator/SYSTEM/root, but hasn't loaded anything into the kernel, it cannot directly write to kernel memory any more than any other user-mode application (which is to say, not at all). It will need to either load a kernel driver (which is trivial on Linux but slightly harder on Windows, mostly because modern Windows running in its default configurations insists that kernnel-mode drivers be signed with a trusted certificate).

The other option would be using a security vulnerability that allows writing to kernel memory. For a bug that requires already running as the super user (admin or root or whatever) to exploit it, the developer might not have prioritized the fix because at that point you basically have full control anyhow (and can load code into the kernel if you want to). However, a bug that merely allows writing to arbitrary locations in memory might not be sufficient, because you want to re-write instruction memory and - as in user-space - executable memory pages are mapped RX (Read-Execute, but not Write) by default. You'd need to re-map the page to allow writing, which is harder to find a vulnerability for.

If you don't mind forcing (or waiting for) a reboot, there are some more options. On Windows, you can disable the code signing requirement (though it puts visible text on the desktop and disables some DRM-related media functionality when you do so) via "testsigning" mode, or even configure the computer for kernel debugging (which also has the same effect as testsigning mode). Using a kernel debugger, you can directly tamper with the memory of any process, user or kernel mode. However, running a kernel debugger from the machine that is being debugged would be tricky, as if you ever hit a breakpoint you would not be able to continue because the (malicious, in this case) debugger would be halted along with all other code on the system.

Answer 2

In Linux is possible, if you have a rootkit that is installed as a kernel module then you have access to kernel memory as well as the user space, also because in general user space programs make system calls the rootkit can track them also, no idea about windows but probably is the same principal.