src/helpers/execve_hijack.o

ELF><00>F@@UH<55><48>H<EFBFBD><48><EFBFBD>1<><31><EFBFBD><EFBFBD><00>E<EFBFBD><45>}<7D><><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD><00>}<7D><>H<>U<EFBFBD>1<EFBFBD><31><EFBFBD><EFBFBD><00><><EFBFBD><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>x1<><31><EFBFBD><EFBFBD><00>E<EFBFBD><45>}<7D><><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>VH<>E<EFBFBD>H<>E<EFBFBD><00>}<7D><>H<>U<EFBFBD>1<EFBFBD><31><EFBFBD><EFBFBD><00><><EFBFBD><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>=<00><00><00>E<EFBFBD><00>E<EFBFBD>H<EFBFBD>Ā]<5D>DUH<55><48>H<EFBFBD><48> H<>}<7D><><00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>H<EFBFBD>5<00>H<>E<EFBFBD>H<EFBFBD>}<7D><0F>H<>=<00><00>H<>H<>E<EFBFBD><45>\<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>U<EFBFBD><55><00>H<><48><0F>H<>}<7D>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD>=<00><00>H<>}<7D><>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48> ]<5D><1F>UH<55><48>H<EFBFBD><48> <00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>
<00><00>H<><48><00><><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>
<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><00>8<EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48> ]<5D>@UH<55><48>H<EFBFBD><48>P<00>E<EFBFBD><00>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>=<00><00><00>E<EFBFBD><00>E<EFBFBD>;E<><0F>+<00>u<EFBFBD>H<EFBFBD>E<EFBFBD>HcM<63>H<EFBFBD><14>H<EFBFBD>=<00><00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>}<7D><>H<>}<7D><>H<>E<EFBFBD>H<EFBFBD>}<7D><>H<>E<EFBFBD><45><00><><0F><><00>E<EFBFBD><45><EFBFBD><01><>H<EFBFBD><48>H<EFBFBD>E<EFBFBD>H<EFBFBD><14>H<><48><EFBFBD>H<EFBFBD><48>H)<29>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>M<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD>	H<><08>E<EFBFBD><00>E<EFBFBD>;E<><0F>.H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>HcU<63>H<EFBFBD>ыM<D18B><4D><EFBFBD>Hc<48>H<EFBFBD>ȋE<C88B><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>=<00><00><><0F>H<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00>B<00><><00><00><00>E<EFBFBD><45>}<7D><0F>H<>=<00><00>E<EFBFBD>H<>E<EFBFBD>HcM<63><0F><08><><0F>&<00>}<7D>H<EFBFBD>u<EFBFBD>HcE<63>Hƺ<00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>H<EFBFBD>5<00><00><00>E<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HcM<63><0F><08><><0F>)<00>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>0HcE<63>Hƺ<00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>H<EFBFBD>5<00><00><00>}<7D>H<EFBFBD>5<00>
<00>H<>}<7D>H<EFBFBD>5<00>H<>}<7D><0F> <00>}<7D>H<EFBFBD>5<00><00><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>}<7D>H<EFBFBD>5<00>	<00><00>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><48>H<><48>`<60><><EFBFBD><EFBFBD><00><00>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>=<00><00>H<><48>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>`<60><><EFBFBD>H<EFBFBD><48>8<EFBFBD><38><EFBFBD><EFBFBD>@<00>(#A<>H<>H<><48>H<>$<24>H<><48> H<><48>X<EFBFBD><58><EFBFBD>H<EFBFBD><48>H<EFBFBD>H <10>8<EFBFBD><38><EFBFBD><10>H<EFBFBD><48><EFBFBD>H<00>H<><48>0<EFBFBD><30><0F>(<00>}<7D>H<EFBFBD>5<00><00><00>}<7D><><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ǅ4<C785><34><EFBFBD><00><>4<EFBFBD><34><EFBFBD><0F><>4<EFBFBD><34><0F><00><>H<><48><08><><EFBFBD>H<EFBFBD>5<00>H<>=<00><00>H<><48><18><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD>5<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<EFBFBD><31><EFBFBD>H<EFBFBD>5<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>TH<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5<00><00><><0F>H<>=<00><00>ǅ4<C785><34><EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>`<60><><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00>(#A<>H<><48>H<>$<24>H<><48> H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>H <10><><EFBFBD><EFBFBD><EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD>H<00>H<><48>0<EFBFBD><30><0F>(<00>}<7D>H<EFBFBD>5<00><00><00>}<7D><><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00> <20><><EFBFBD><EFBFBD>}<7D><><00>E<EFBFBD><00>E<EFBFBD>H<EFBFBD><48>]<5D>Timer %i started, address sent %llx
rFailed to run command
COMMAND ERRORRESULT OF COMMAND: %s
Hello world from execve hijacker
Argument %i is %s
/usr/bin/sudoFailed to execve()/tmp/rootlogFailed to open log file	
Sniffing...
CC_SYNFailed to open rawsocket
Sniffed
IP: %s
CC_ACKCC_MSG#Received client message
#CC_FINConnection closed by request
Received request: %s
GNv<>}N_p_<00>v<>}%I:;($>I:;I:;	
I:;8
.@:;I?4:;I.@:;'I?
:;I4I44:;I<I!I7$>:;!I7&I
I:;
8
I:;8:;:;!I7
<00>?Q^	s!~<05>?*
<00>V<19><02>X<1B><03><><1B><03><><1C><03><><1C><03><><1C><03><><1D><03><><1E><03><><1E><03><><00>V=<3D>
<02>p=<3D><02>h?2<02>`@<40><03><>wA$
<00>VS<><03><>~T1<03><>}U<><03><>}V><03><>}W<>vVj<>
<02>xj<>
<02>pj<>
<02>hj<><02>Xr<><02>Ps<><02>Hw<><03><><06><><03><><06><><03><><06>4<03><>~<06><><03><>~<06><>	<03><>~<06>4<03><>~<06><>><02>dl<><00><03><>|<7C>	A<03><>~<7E><00><03><>~<06>4<03><>~<06><><03><>}<06><><03><>}Ŕ<03><>}Ɣ<03><>}<06>4<07> 	<00>
	<00>
	<00>	<00><05><03><05><03>
-'	M<05><03>7B<00>
1	<00>
3	<00>
6	<00>
7	<00>
8	<00>
9 	<00>
:(	<00>
;0	<00>
<8	<00>
=@	<00>
@H	<00>
AP	<00>
BX	<00>
D`	<00>
Fh	<00>
Hp	<00>
It	<00>
Jx	<00>
M<EFBFBD>	<00>
N<EFBFBD>	<00>
O<EFBFBD>	<00>
Q<EFBFBD>	<00>
Y<EFBFBD>	<00>
[<5B>	
\<5C>	<00>
]<5D>	X
^<5E>	
_<EFBFBD>	<00>
`<60>	
b<EFBFBD><07>B<05><03><12><13><07>
+<05><03><07>.<12><13><12><16><12><16>C 
b	<00>
d	<00>
e	<00>
f	<00>
g	<00>
h<07><05><07>8	<00>		<00>
	<00>	<00>	<00>
	<00>	<00>	<00>	<00> 	<00>(	*0/<17>?
(	<00>	O		<00>
	<00>	<00> <07>,?/?0	7	98	99	9:	;	<		9=
	~>	~?'2&D<05>(Tbdddpff	9h	9i	<00>	j	<00>	kmn	t
	9{	9|	9}<19>	9<12>	9<12>	~<12>	~<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>	9<12>	9<12>	9<12>~]<12><13><12><1C><00>Ubuntu clang version 12.0.0-3ubuntu1~21.04.2execve_hijack.c/home/osboxes/TFG/src/helpersunsigned intTFD_TIMER_ABSTIMETFD_TIMER_CANCEL_ON_SETlong long unsigned int__u64s_addr__uint32_tuint32_tin_addr_tin_addrtest_time_values_injectionintexecute_commandchargetLocalIpAddressmainnew_valueit_intervaltv_seclong int__time_ttv_nsec__syscall_slong_ttimespecit_valueitimerspecnew_value2max_expfdfd2nowexplong unsigned int__uint64_tuint64_ttot_exps__ssize_tssize_tcommandfp_flags_IO_read_ptr_IO_read_end_IO_read_base_IO_write_base_IO_write_ptr_IO_write_end_IO_buf_base_IO_buf_end_IO_save_base_IO_backup_base_IO_save_end_markers_IO_marker_chain_fileno_flags2_old_offset__off_t_cur_columnunsigned short_vtable_offsetsigned char_shortbuf__ARRAY_SIZE_TYPE___lock_IO_lock_t_offset__off64_t_codecvt_IO_codecvt_wide_data_IO_wide_data_freeres_list_freeres_buf__pad5size_t_mode_unused2_IO_FILEFILEresbufhostbufferIPbufferhost_entryh_nameh_aliasesh_addrtypeh_lengthh_addr_listhostenthostnameargcargvenvpiirawtimetime_ttimeinfotm_sectm_mintm_hourtm_mdaytm_montm_yeartm_wdaytm_ydaytm_isdsttm_gmtofftm_zonetmtimestr__vla_expr0packetipheaderihlversiontosunsigned char__uint8_tuint8_ttot_len__uint16_tuint16_tidfrag_offttlprotocolchecksaddrdaddriphdrtcpheaderth_sportth_dportth_seqtcp_seqth_ackth_x2th_offth_flagsth_winth_sumth_urpsourcedestseqack_seqres1dofffinsynrstpshackurgres2windowurg_ptrtcphdrpayloadpayload_lengthpacket_tlocal_ipremote_ippacket_ackconnection_closeppayload_bufpacket_resargsUbuntu clang version 12.0.0-3ubuntu1~21.04.2zRx<08><00>A<10>C
<02><<00>A<10>C
<02>\<00>A<10>C
<02>|vA<10>C
qi<00><01>
/usr/include/x86_64-linux-gnu/sys/usr/include/asm-generic/usr/include/x86_64-linux-gnu/bits/usr/include/netinet/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/lib/llvm-12/lib/clang/12.0.0/include./libtimerfd.hint-ll64.htypes.hstdint-uintn.hin.hexecve_hijack.cstruct_timespec.hstruct_itimerspec.hstdio.hstruct_FILE.hstddef.hFILE.hnetdb.htime_t.hstruct_tm.hip.hRawTCP.htcp.h	

	<09><06>=	Jg"<22>#<23><19>	<B 	<g<0B>	<06>
=	Jg#<23>$<24><19>	<D 	<g5<>9<J<06>u
<EFBFBD><06>M
J<08>KX	g<><05>X#tJ'<27>JgJ	tW'[J<06>JYJKM
<EFBFBD><06>xt<0E>gt	g <20>tXu<06>	g<0C>3<06>?t3J<Zt<06>
<08>
<0A>t<<'g+<	<09><06><06>\]<10><06>KJXMX<h<	<)t=t<	<<03>f<03>t<06><
<<"I	<06><03>X*<03>tJ/<2F><
g<><05>{	t
=J	g<>
uJJJ<g<J	t<06><05>\<
utJJ<g<t	t<06><05>]<<<18>Xg	<<0B><X!v+J3Jt<06>t=<06>Gtt+"0<g	<	<Y<><0B><06><06>	/ <20>tv
t<0B>
u<06>u<06>gt+<2B><g"<22>
<0A>2Yt-<06>tX%u<06>ut<06>%ttIYStdt't$.0<g<<Y<16>tYt	ZfXX<Yu<00><00><>o%<00>%<00><00><00><00><00><00>v<00>
Y<00><<00>)	!<00>(<00>'<00>0<00>I<00>KlROp<00>>cLFc"3<00> <00>
<00><00><00>
	W/<00>&<00><00><00>	*L<00>R<00><00><00>n|<00>}M<00><00>v<00>%v<00><00><00>E<00><00><00><00>Z=><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>N?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>l><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>B<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>e'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Y-<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h:<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>=<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>*<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>O<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Y@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>B.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>55<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>V;<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m;<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>


-

=3
h9
z@
[K
<00>R
<00>_
<00>g
<00>x
<00><00>
<00><00>
<00><00><00>
<00><00>
'<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00>)
<00>5<00>C
<00>Q
<00>_
<00>m
<00>|
<00><00><00><00>
<00>
<00><00>
<00><00>
<00><00>
$<00><00><00>
"<00>
-
2
7$
?2
N@
<00>O
<00>^
<m
<00>|
%<00>
.<00>
8<00>
C<00><00><00>
<<00><00>
<00><00>
<00>
m<00>X

<(
<00>7
F
TQ<00>b
<00>q
V<00>
b<00>
<00><00>
<00>
<00><00>
1<00>
y<00>
p<00>
=<00>
V<00>
M<00>
D<00>
^
<00>
<00>
<00>!
<00>,
<00><
<00>C
<00>K
<00>W
c
o
{
+<00>
:<00>
H<00>
V<00>
c<00>
o<00>
}<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00>#
<00>/
;
-G
>S
P_
ek
~w
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
3<00>
F<00>
Y	
p
<00>D
L
<00>X
<00>d
<00>p
|
<00>
G<00>
<00><00>
W<00>
^<00>
e<00>
m<00>
u<00>
|<00>
<00><00>
<00>
<00>
<00>
<00>9
@
H
<00>T
S`
l

x
<00><00>
M<00>
<00><00>
<00><00>
<00><00>
<00>
"<00>
%<00>
.<00>
2<00>
;
A
G!
<00>,
<00>3
<00>>
I
U
<00>u
]<00>
f<00>
o<00>
~<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>	
<00>	
<00>	
<00>$	
<00>0	
<00>?	
<00>N	
<00>]	
<00>l	
<00>{	
<00><00>	
<00><00>	
<00><00>	
<00><00>	
<00><00>	
;<00>	
<00><00>	
v @<00>`<00><00><00><00><>?5$"4'82),&+:-=/ *%31@7.!6#;9(strcpy.debug_abbrev.rela.text.commentexitbuild_standard_packetstrcatfgetsgetLocalIpAddress.debug_str.L.strperrorinet_ntopstrcmp.rela.debug_inforawsocket_sniff_patterntest_time_values_injectionmainpopenstrtok.note.GNU-stack.llvm_addrsigprintfexecvewritetimerfd_createpclose.rela.debug_linetimerfd_settimelocaltimeasctime.rela.eh_framegethostbynamegethostnamefreerawsocket_sendexecute_commandgeteuidcalloc.debug_locexecve_hijack.c.strtab.symtabinet_ntoa.L.str.19.L.str.9.L.str.18.L.str.8.L.str.17.L.str.7.L.str.16.L.str.6.L.str.15.L.str.5.L.str.24.L.str.14.L.str.4.L.str.23.L.str.13.L.str.3.L.str.22.L.str.12.L.str.2.L.str.21.L.str.11.L.str.1.rodata.str1.1.L.str.20.L.str.10<00>D<00>@<00>0(<00><00>26<00><00><00>	P
Y<00>e
<00><00>0<00>d0ir!0<00>.<00>	dp<00>_xC`1<00>m,<00>C<00>L<>o<00><00>C <00>"
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+								ELF><00>F@@UH<55><48>H<EFBFBD><48><EFBFBD>1<><31><EFBFBD><EFBFBD><00>E<EFBFBD><45>}<7D><><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD><00>}<7D><>H<>U<EFBFBD>1<EFBFBD><31><EFBFBD><EFBFBD><00><><EFBFBD><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>x1<><31><EFBFBD><EFBFBD><00>E<EFBFBD><45>}<7D><><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>VH<>E<EFBFBD>H<>E<EFBFBD><00>}<7D><>H<>U<EFBFBD>1<EFBFBD><31><EFBFBD><EFBFBD><00><><EFBFBD><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>=<00><00><00>E<EFBFBD><00>E<EFBFBD>H<EFBFBD>Ā]<5D>DUH<55><48>H<EFBFBD><48> H<>}<7D><><00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>H<EFBFBD>5<00>H<>E<EFBFBD>H<EFBFBD>}<7D><0F>H<>=<00><00>H<>H<>E<EFBFBD><45>\<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>U<EFBFBD><55><00>H<><48><0F>H<>}<7D>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD>=<00><00>H<>}<7D><>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48> ]<5D><1F>UH<55><48>H<EFBFBD><48> <00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>H<><48><00><><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+								<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><00>8<EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48> ]<5D>@UH<55><48>H<EFBFBD><48>P<00>E<EFBFBD><00>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>=<00><00><00>E<EFBFBD><00>E<EFBFBD>;E<><0F>+<00>u<EFBFBD>H<EFBFBD>E<EFBFBD>HcM<63>H<EFBFBD><14>H<EFBFBD>=<00><00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>}<7D><>H<>}<7D><>H<>E<EFBFBD>H<EFBFBD>}<7D><>H<>E<EFBFBD><45><00><><0F><><00>E<EFBFBD><45><EFBFBD><01><>H<EFBFBD><48>H<EFBFBD>E<EFBFBD>H<EFBFBD><14>H<><48><EFBFBD>H<EFBFBD><48>H)<29>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>M<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD>	H<><08>E<EFBFBD><00>E<EFBFBD>;E<><0F>.H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>HcU<63>H<EFBFBD>ыM<D18B><4D><EFBFBD>Hc<48>H<EFBFBD>ȋE<C88B><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>=<00><00><><0F>H<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00>B<00><><00><00><00>E<EFBFBD><45>}<7D><0F>H<>=<00><00>E<EFBFBD>H<>E<EFBFBD>HcM<63><0F><08><><0F>&<00>}<7D>H<EFBFBD>u<EFBFBD>HcE<63>Hƺ<00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>H<EFBFBD>5<00><00><00>E<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HcM<63><0F><08><><0F>)<00>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>0HcE<63>Hƺ<00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>H<EFBFBD>5<00><00><00>}<7D>H<EFBFBD>5<00>
<00>H<>}<7D>H<EFBFBD>5<00>H<>}<7D><0F> <00>}<7D>H<EFBFBD>5<00><00><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>}<7D>H<EFBFBD>5<00>	<00><00>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><48>H<><48>`<60><><EFBFBD><EFBFBD><00><00>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>=<00><00>H<><48>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>`<60><><EFBFBD>H<EFBFBD><48>8<EFBFBD><38><EFBFBD><EFBFBD>@<00>(#A<>H<>H<><48>H<>$<24>H<><48> H<><48>X<EFBFBD><58><EFBFBD>H<EFBFBD><48>H<EFBFBD>H <10>8<EFBFBD><38><EFBFBD><10>H<EFBFBD><48><EFBFBD>H<00>H<><48>0<EFBFBD><30><0F>(<00>}<7D>H<EFBFBD>5<00><00><00>}<7D><><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ǅ4<C785><34><EFBFBD><00><>4<EFBFBD><34><EFBFBD><0F><>4<EFBFBD><34><0F><00><>H<><48><08><><EFBFBD>H<EFBFBD>5<00>H<>=<00><00>H<><48><18><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD>5<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<EFBFBD><31><EFBFBD>H<EFBFBD>5<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>TH<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5<00><00><><0F>H<>=<00><00>ǅ4<C785><34><EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>`<60><><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00>(#A<>H<><48>H<>$<24>H<><48> H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>H <10><><EFBFBD><EFBFBD><EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD>H<00>H<><48>0<EFBFBD><30><0F>(<00>}<7D>H<EFBFBD>5<00><00><00>}<7D><><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00> <20><><EFBFBD><EFBFBD>}<7D><><00>E<EFBFBD><00>E<EFBFBD>H<EFBFBD><48>]<5D>Timer %i started, address sent %llx
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
+								rFailed to run command
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								COMMAND ERRORRESULT OF COMMAND: %s
 								Hello world from execve hijacker
 								Argument %i is %s
-												Corrected issues of opening directories without permission in execve helper

											
										
										
											2022-02-24 19:53:11 -05:00
+								/usr/bin/sudoFailed to execve()/tmp/rootlogFailed to open log file
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								Sniffing...
-												Corrected issues of opening directories without permission in execve helper

											
										
										
											2022-02-24 19:53:11 -05:00
+								CC_SYNFailed to open rawsocket
-												Now the execve hijacker works without needing a canalizer. Removed it. Also some additional tweaks to the c&c launching of the helper

											
										
										
											2022-02-19 11:57:32 -05:00
+								Sniffed
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								IP: %s
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								CC_ACKCC_MSG#Received client message
 								#CC_FINConnection closed by request
 								Received request: %s
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+								GNv<>}N_p_<00>v<>}%I:;($>I:;I:;	
I:;8
 								.@:;I?4:;I.@:;'I?
:;I4I44:;I<I!I7$>:;!I7&I
I:;
8
I:;8:;:;!I7
 								<00>?Q^	s!~<05>?*
 								<00>V<19><02>X<1B><03><><1B><03><><1C><03><><1C><03><><1C><03><><1D><03><><1E><03><><1E><03><><00>V=<3D>
<02>p=<3D><02>h?2<02>`@<40><03><>wA$
 								<00>VS<><03><>~T1<03><>}U<><03><>}V><03><>}W<>vVj<>
<02>xj<>
<02>pj<>
<02>hj<><02>Xr<><02>Ps<><02>Hw<><03><><06><><03><><06><><03><><06>4<03><>~<06><><03><>~<06><>	<03><>~<06>4<03><>~<06><>><02>dl<><00><03><>|<7C>	A<03><>~<7E><00><03><>~<06>4<03><>~<06><><03><>}<06><><03><>}Ŕ<03><>}Ɣ<03><>}<06>4<07> 	<00>
 									<00>
 									<00>	<00><05><03><05><03>
 								-'	M<05><03>7B<00>
 	<00>
 	<00>
 	<00>
 	<00>
 	<00>
 	<00>
 								:(	<00>
 								;0	<00>
 								<8	<00>
 								=@	<00>
 								@H	<00>
 								AP	<00>
 								BX	<00>
 								D`	<00>
 								Fh	<00>
 								Hp	<00>
 								It	<00>
 								Jx	<00>
 								M<EFBFBD>	<00>
 								N<EFBFBD>	<00>
 								O<EFBFBD>	<00>
 								Q<EFBFBD>	<00>
 								Y<EFBFBD>	<00>
 								[<5B>
 								\<5C>	<00>
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
+								]<5D>	X
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+								^<5E>
 								_<EFBFBD>	<00>
 								`<60>
 								b<EFBFBD><07>B<05><03><12><13><07>
 								+<05><03><07>.<12><13><12><16><12><16>C 
b	<00>
d	<00>
e	<00>
f	<00>
g	<00>
h<07><05><07>8	<00>		<00>
 									<00>	<00>	<00>
	<00>	<00>	<00>	<00> 	<00>(	*0/<17>?
(	<00>	O		<00>
 									<00>	<00> <07>,?/?0	7	98	99	9:	;	<		9=
 									~>	~?'2&D<05>(Tbdddpff	9h	9i	<00>	j	<00>	kmn	t
	9{	9|	9}<19>	9<12>	9<12>	~<12>	~<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>	9<12>	9<12>	9<12>~]<12><13><12><1C><00>Ubuntu clang version 12.0.0-3ubuntu1~21.04.2execve_hijack.c/home/osboxes/TFG/src/helpersunsigned intTFD_TIMER_ABSTIMETFD_TIMER_CANCEL_ON_SETlong long unsigned int__u64s_addr__uint32_tuint32_tin_addr_tin_addrtest_time_values_injectionintexecute_commandchargetLocalIpAddressmainnew_valueit_intervaltv_seclong int__time_ttv_nsec__syscall_slong_ttimespecit_valueitimerspecnew_value2max_expfdfd2nowexplong unsigned int__uint64_tuint64_ttot_exps__ssize_tssize_tcommandfp_flags_IO_read_ptr_IO_read_end_IO_read_base_IO_write_base_IO_write_ptr_IO_write_end_IO_buf_base_IO_buf_end_IO_save_base_IO_backup_base_IO_save_end_markers_IO_marker_chain_fileno_flags2_old_offset__off_t_cur_columnunsigned short_vtable_offsetsigned char_shortbuf__ARRAY_SIZE_TYPE___lock_IO_lock_t_offset__off64_t_codecvt_IO_codecvt_wide_data_IO_wide_data_freeres_list_freeres_buf__pad5size_t_mode_unused2_IO_FILEFILEresbufhostbufferIPbufferhost_entryh_nameh_aliasesh_addrtypeh_lengthh_addr_listhostenthostnameargcargvenvpiirawtimetime_ttimeinfotm_sectm_mintm_hourtm_mdaytm_montm_yeartm_wdaytm_ydaytm_isdsttm_gmtofftm_zonetmtimestr__vla_expr0packetipheaderihlversiontosunsigned char__uint8_tuint8_ttot_len__uint16_tuint16_tidfrag_offttlprotocolchecksaddrdaddriphdrtcpheaderth_sportth_dportth_seqtcp_seqth_ackth_x2th_offth_flagsth_winth_sumth_urpsourcedestseqack_seqres1dofffinsynrstpshackurgres2windowurg_ptrtcphdrpayloadpayload_lengthpacket_tlocal_ipremote_ippacket_ackconnection_closeppayload_bufpacket_resargsUbuntu clang version 12.0.0-3ubuntu1~21.04.2zRx<08><00>A<10>C
<02><<00>A<10>C
<02>\<00>A<10>C
<02>|vA<10>C
qi<00><01>
/usr/include/x86_64-linux-gnu/sys/usr/include/asm-generic/usr/include/x86_64-linux-gnu/bits/usr/include/netinet/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/lib/llvm-12/lib/clang/12.0.0/include./libtimerfd.hint-ll64.htypes.hstdint-uintn.hin.hexecve_hijack.cstruct_timespec.hstruct_itimerspec.hstdio.hstruct_FILE.hstddef.hFILE.hnetdb.htime_t.hstruct_tm.hip.hRawTCP.htcp.h
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+									<09><06>=	Jg"<22>#<23><19>	<B 	<g<0B>	<06>
=	Jg#<23>$<24><19>	<D 	<g5<>9<J<06>u
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
+								<EFBFBD><06>M
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+								J<08>KX	g<><05>X#tJ'<27>JgJ	tW'[J<06>JYJKM
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
+								<EFBFBD><06>xt<0E>gt	g <20>tXu<06>	g<0C>3<06>?t3J<Zt<06>
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+								<08>
<0A>t<<'g+<	<09><06><06>\]<10><06>KJXMX<h<	<)t=t<	<<03>f<03>t<06><
<<"I	<06><03>X*<03>tJ/<2F><
g<><05>{	t
 								=J	g<>
uJJJ<g<J	t<06><05>\<
utJJ<g<t	t<06><05>]<<<18>Xg	<<0B><X!v+J3Jt<06>t=<06>Gtt+"0<g	<	<Y<><0B><06><06>	/ <20>tv
t<0B>
u<06>u<06>gt+<2B><g"<22>
<0A>2Yt-<06>tX%u<06>ut<06>%ttIYStdt't$.0<g<<Y<16>tYt	ZfXX<Yu<00><00><>o%<00>%<00><00><00><00><00><00>v<00>
Y<00><<00>)	!<00>(<00>'<00>0<00>I<00>KlROp<00>>cLFc"3<00> <00>
<00><00><00>
	W/<00>&<00><00><00>	*L<00>R<00><00><00>n|<00>}M<00><00>v<00>%v<00><00><00>E<00><00><00><00>Z=><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>N?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>l><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>B<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>e'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Y-<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h:<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>=<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>*<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>O<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Y@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>B.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>55<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>V;<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m;<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>8<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								-
 								=3
 								h9
 								z@
 								[K
 								<00>R
 								<00>_
 								<00>g
 								<00>x
 								<00><00>
 								<00><00>
 								<00><00><00>
 								<00><00>
 								'<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								<00>)
 								<00>5<00>C
 								<00>Q
 								<00>_
 								<00>m
 								<00>|
 								<00><00><00><00>
 								<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								$<00><00><00>
 								"<00>
 								-
 
 $
 								?2
 								N@
 								<00>O
 								<00>^
 								<m
 								<00>|
 								%<00>
 								.<00>
 <00>
 								C<00><00><00>
 								<<00><00>
 								<00><00>
 								<00>
 								m<00>X
 								<(
 								<00>7
 								F
 								TQ<00>b
 								<00>q
 								V<00>
 								b<00>
 								<00><00>
 								<00>
 								<00><00>
 <00>
 								y<00>
 								p<00>
 								=<00>
 								V<00>
 								M<00>
 								D<00>
 								^
 								<00>
 								<00>
 								<00>!
 								<00>,
 								<00><
 								<00>C
 								<00>K
 								<00>W
 								c
 								o
 								{
 								+<00>
 								:<00>
 								H<00>
 								V<00>
 								c<00>
 								o<00>
 								}<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								<00>#
 								<00>/
 								;
 								-G
 								>S
 								P_
 								ek
 								~w
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 <00>
 								F<00>
 								Y
 								p
 								<00>D
 								L
 								<00>X
 								<00>d
 								<00>p
 								|
 								<00>
 								G<00>
 								<00><00>
 								W<00>
 								^<00>
 								e<00>
 								m<00>
 								u<00>
 								|<00>
 								<00><00>
 								<00>
 								<00>
 								<00>
 								<00>9
 								@
 								H
 								<00>T
 								S`
 								l
 x
 								<00><00>
 								M<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								"<00>
 								%<00>
 								.<00>
 <00>
 								;
 								A
 								G!
 								<00>,
 								<00>3
 								<00>>
 								I
 								U
 								<00>u
 								]<00>
 								f<00>
 								o<00>
 								~<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								<00>
 								<00>$
 								<00>0
 								<00>?
 								<00>N
 								<00>]
 								<00>l
 								<00>{
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								;<00>
 								<00><00>
 								v @<00>`<00><00><00><00><>?5$"4'82),&+:-=/ *%31@7.!6#;9(strcpy.debug_abbrev.rela.text.commentexitbuild_standard_packetstrcatfgetsgetLocalIpAddress.debug_str.L.strperrorinet_ntopstrcmp.rela.debug_inforawsocket_sniff_patterntest_time_values_injectionmainpopenstrtok.note.GNU-stack.llvm_addrsigprintfexecvewritetimerfd_createpclose.rela.debug_linetimerfd_settimelocaltimeasctime.rela.eh_framegethostbynamegethostnamefreerawsocket_sendexecute_commandgeteuidcalloc.debug_locexecve_hijack.c.strtab.symtabinet_ntoa.L.str.19.L.str.9.L.str.18.L.str.8.L.str.17.L.str.7.L.str.16.L.str.6.L.str.15.L.str.5.L.str.24.L.str.14.L.str.4.L.str.23.L.str.13.L.str.3.L.str.22.L.str.12.L.str.2.L.str.21.L.str.11.L.str.1.rodata.str1.1.L.str.20.L.str.10<00>D<00>@<00>0(<00><00>26<00><00><00>	P
 								Y<00>e
 								<00><00>0<00>d0ir!0<00>.<00>	dp<00>_xC`1<00>m,<00>C<00>L<>o<00><00>C <00>"