h3xduck
567d8d706c
Further completed the phantom shell routine and added more checks in TC, still not finished, payload rewriting remains, but the rest is fully ready
2022-05-10 23:04:19 -04:00
h3xduck
f2c3624e8b
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
h3xduck
ff0f34c6a4
Included new library version with support for tcp src port paylaod injection
2022-05-09 18:57:23 -04:00
h3xduck
5746ac5efb
Added new hidden packets, commands and rest of structure to activate and deactivate hooks from the backdoor
2022-05-07 19:16:33 -04:00
h3xduck
ce7d36371d
Finished encrypted interactive shell and encrypted protocol implementation, V2 rootkit now fully functional
2022-05-07 17:55:27 -04:00
h3xduck
cceca23478
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
h3xduck
213e30ba3b
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
h3xduck
0553ad777f
Completed message passing of commands to userspace via ebpf ringbuffer
2022-05-05 13:22:47 -04:00
h3xduck
b182ac1eeb
Added new TC module, updates to the exec hooking system and the userland module
2022-02-20 16:50:15 -05:00
h3xduck
edbaf09c06
Completed execve hijacking, as with special error cases that arise and that are documented in the code.
2022-02-14 17:45:07 -05:00
h3xduck
044c85f3ff
Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done
2022-02-06 14:15:57 -05:00
h3xduck
643783004a
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
h3xduck
2b50d376a6
Updated function and configurator manager names to the used hook.
2022-01-26 13:04:23 -05:00
h3xduck
3832d99af1
Updated file names and directory structure to the new multi-modules rootkit
2022-01-16 06:56:54 -05:00
h3xduck
945e2f2def
Added new probe to read the previously extracted params and overwrite user memory. Still now fully working, just a backup
2022-01-14 22:05:08 -05:00
h3xduck
106f141c7e
Added new kprobe to the filesystem ebpf section. Now receiving read events, and storing them in a map for later use, along with a reference to the user-space memory buffer
2022-01-14 21:18:51 -05:00
h3xduck
4882ce790c
[BUILD FAILING] Checkpoint for backup, added new hook for file system, tweaked makefile for real kernel header files inclusion, still not working. Commiting for periodic backup
2022-01-05 20:34:53 -05:00
h3xduck
f8774ac9cf
[BUILD IS FAILING] Added file system hooks and other improvements. Uploading because of needing to backup
2022-01-04 20:09:59 -05:00
h3xduck
74873dbca5
Completed configuration module which enables to change the running ebpf modules in the rootkit at runtime. Minor changes and updated code structure
2022-01-04 13:26:13 -05:00
h3xduck
40da6b300b
Capability of attaching/detaching as many times as we want is finished. Now rootkit is fully cusotmizable from the userland (and thus remotely throught the backdoor)
2022-01-02 16:02:23 -05:00
h3xduck
adaf909781
Completed detachment of probes, enabling to attach and detach at will. Work needs to be done with xdp tho
2022-01-02 06:28:45 -05:00
h3xduck
d18b0aa23c
Further improvements in the rootkit configuration by the user
2021-12-31 12:02:35 -05:00
h3xduck
0863566292
Included a global config struct for controlling which hooks and functions of the rootkit should be active. Still work to be done in the bpf side
2021-12-31 09:54:47 -05:00
h3xduck
d9a70f866c
Modularized the ebpf program loading and attaching.
2021-12-30 21:09:26 -05:00
h3xduck
d5478ed7a0
Added more communication utils between userspace and kernel:
...
* Included maps and kernel ring buffer communication
* Extended the ebpf structure to include more modules
* New utils in both user and kernelspace
* Other changes
* This update precedes a great effort on researching and learning and linux kernel tracing and studing ebpfkit from defcon. More functionalities should come rather quickly now.
2021-12-29 14:44:09 -05:00
h3xduck
510fc89de0
FIltering the found filepaths now fully working. We can now detect opened file descriptors of all processes
2021-12-24 10:22:23 -05:00
h3xduck
be9cc95daa
Adapted makefile for user includes and new source files
2021-12-24 06:59:30 -05:00
h3xduck
745ec4e395
Updated project structure, and added new list for the next incoming feature.
2021-12-21 20:08:49 -05:00
h3xduck
516e98748c
Finished adapting the client. Cleaned the user code and added getopt. The filter fully works now. Next step: return data to userspace via a map.
2021-11-22 20:02:47 -05:00
h3xduck
b04200526c
Finished xdp ebpf program, successfully showing packets received. Added client from Umbra, it will be the C&C client
2021-11-22 18:58:58 -05:00
h3xduck
23c7331d16
Continued working on first xdp filter, todo make bpf ring buffer work, check udp filter is up ans working
2021-11-21 20:00:43 -05:00
h3xduck
53da2d141d
Setup development environment with libbpf
2021-11-20 21:07:23 -05:00
