mirror of https://github.com/takeshixx/redstar-tools synced 2025-07-17 20:43:21 +00:00

Go to file

takeshix 3a706c3f6a Automatically defuse malicious components

This script will run all the steps that are required to disable
malicious Red Star OS components like "virus scanning" and watermarking
of media files. This makes it easier for everyone to further research the system.

2016-01-07 22:03:50 +01:00

bin

Additional files added

2015-12-27 13:12:22 +01:00

crypto

Crypto modules added

2015-12-29 03:02:26 +01:00

libos

Additional files added

2015-12-27 13:12:22 +01:00

patterns

Additional files added

2015-12-27 13:12:22 +01:00

rtscan

Additional files added

2015-12-27 13:12:22 +01:00

screenshots

Screenshots added

2015-12-28 11:50:28 +01:00

watermarked

Watermarked DOCX added

2015-12-28 12:07:15 +01:00

defuse.sh

Automatically defuse malicious components

2016-01-07 22:03:50 +01:00

README.md

Added SELinux instructions

2016-01-02 15:38:14 +01:00

RedStar_OS_32c3.pdf

32c3 slides added

2015-12-27 19:13:00 +01:00

README.md

Tools for Red Star OS (붉은별)

This repository includes several binaries from and tools for Red Star OS. These can be used for further research work.

Disable malicious components

Get root privileges via /usr/sbin/rootsetting
Disable SELinux

SELinux protects several files an directories (e.g. /var/log). It should be disabled in order to make changes to some parts of the system.
```
 setenforce 0
```
In order to keep SELinux disabled after rebooting, append selinux=0 to the kernel line in the GRUB config file (/boot/grub/grub.conf).
Kill securityd

Killing securityd will prevent the system from rebooting when editing/deleting various protected files.
```
 killall -9 securityd
```

Disable rtscan kernel module

Either via resctl.py (see rtscan) or via a Python shell as follows:

 [root@localhost ~]# python
 Python 2.6 (r26:66714, Oct  7 2012, 13:39:47)
 [GCC 4.4.0 20090506 (Red Hat 4.4.0-4)] on linux2
 Type "help", "copyright", "credits" or "license" for more information.
 >>> import fcntl
 >>> fcntl.ioctl(open('/dev/res', 'wb'), 29187)
 0

After disabling rtscan protected processes like opprc will become killable.

Kill scnprc and opprc
```
 killall scnprc
 killall opprc
```
Replace /usr/lib/libos.so.0.0.0

See libos for further information. Replacing this file will prevent the system from rebooting via securityd after rebooting the system. It also will prevent reboot loops by kdm rendering the system unusable.
Delete /usr/share/autostart/scnprc.desktop

Deleting this file will prevent kdeinit from starting the framework after a system reboot.
Reboot the system

Disclaimer

All of the information is based on research dedicated to analyzing Red Star OS. The authors take no responsibility for the accuracy, completeness or quality of the information provided.