This page introduces application level rootkit attacks on Java JVM environment, enabling an attacker to change the language runtime implementation, and to hide malicious code inside its core. 

Java Rootkits, injected into the upper level class level code will influence the bytecode and make the application behave differently than what it's supposed to do. Code reviews will not detect application level backdoors since the payload is not in the code itself, but rather it is inside the JVM implementation. 

Java rootkits also enables the attacker to install reverse shells, to steal valuable information, to fixate encryption keys, disable security checks and to perform other nasty things.

Overview of Java JVM modification steps

 

Locate the class (usually in rt.jar) and extract it:

jar xf rt.jar java/io/PrintStream.class

 

Dissassemble it (using Jasper disassembler)

Java –jar jasper.jar PrintStream.class

 

	Modify the bytecode
	Assemble it (using Jasmin assembler)

 

Java –jar jasmin.jar PrintStream.j

 

Deploy the modified class back to its location:

jar uf rt.jar java/io/PrintStream.class

Besides performing direct modification of the JVM in order to hide the presence of the rootkit from the application layer, it is possible to achieve similar rootkit-like behavior using Non evasive, “by design” techniques such as:

	AOP - Aspect programming (dynamic weaving)
	Configuration modification
	Setting an alternative evil ClassLoader
	Loading a malicious agent   “-javaagent:MyEvilAgent.jar” (Java)

 

Proof-Of-Concept

Example #1:

the following code was injected into PrintStream.class, at ".method  public println(Ljava/lang/String;)V":

 

   aload_0               
   aload_1               
   invokevirtual            java/io/PrintStream/print(Ljava/lang/String;)V
   aload_0               
   invokespecial         java/io/PrintStream/newLine()V
   aload_2               

 

It will make each application level code to println("value") to print the string "value" twice.

 

Steps:

1.  Download the modified PrintStream.class (PrintStream.class contains the println method)

2.  Go to the JRE directory containg rt.jar

3.  Create a temp directory "java/io", and copy the PrintStream.class to this directory

4.  Deploy the modified class using the "jar"command:

     jar uf rt.jar java/io/PrintStream.class

5.  Download the HelloWorld Demo. It contains one line of code:   System.out.println("Hello World!");

6.  Run HelloWorld, using:

    java HelloWorld 

 

Now you should see that the string "Hello World!" was printed twice.