h3xduck
d7a9b0e777
Updated injection module to ensure shellcode fits in code cave. Added simple reverse shell in injection lib
2022-06-11 18:38:48 -04:00
h3xduck
78b3132687
Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular
2022-05-15 20:47:58 -04:00
h3xduck
4a292f0f7a
Merged master and develop, now all changes together. Fully tested and working.
2022-05-15 20:46:35 -04:00
h3xduck
57f3edd8fa
Fixed bug in client getting local ip
2022-05-15 19:09:04 -04:00
h3xduck
ff0f34c6a4
Included new library version with support for tcp src port paylaod injection
2022-05-09 18:57:23 -04:00
h3xduck
ce7d36371d
Finished encrypted interactive shell and encrypted protocol implementation, V2 rootkit now fully functional
2022-05-07 17:55:27 -04:00
h3xduck
cceca23478
Completed message sharing, starting with protocol now
2022-05-05 22:14:28 -04:00
h3xduck
213e30ba3b
Fixed keys of trigger packet V1, added sample servers, fixed client bug
2022-05-05 17:52:58 -04:00
h3xduck
e881502ffa
Now control flow is redirected back to the syscall after running the shared library constructor instead of skipping it
2022-04-09 14:17:09 -04:00
h3xduck
be5605db5f
Introduced shellcode and finished code cave writing and injection. RELRO working
2022-04-07 11:54:24 -04:00
h3xduck
3438f5846f
Finished injection module at userspace using /proc/<pid>/maps, enables to overwrite the GOT section with RELRO activated
2022-04-07 07:11:28 -04:00
h3xduck
671e2d671d
Added extraction of original jump instruction and opcodes
2022-03-15 18:36:59 -04:00
h3xduck
d5478ed7a0
Added more communication utils between userspace and kernel:
...
* Included maps and kernel ring buffer communication
* Extended the ebpf structure to include more modules
* New utils in both user and kernelspace
* Other changes
* This update precedes a great effort on researching and learning and linux kernel tracing and studing ebpfkit from defcon. More functionalities should come rather quickly now.
2021-12-29 14:44:09 -05:00
h3xduck
510fc89de0
FIltering the found filepaths now fully working. We can now detect opened file descriptors of all processes
2021-12-24 10:22:23 -05:00
h3xduck
be9cc95daa
Adapted makefile for user includes and new source files
2021-12-24 06:59:30 -05:00
