h3xduck
f2c3624e8b
Added test on tc clasiffier, added pinned maps, and obtaining the fd from other maps in order to synchronize between programs
2022-05-10 19:09:52 -04:00
h3xduck
073a911f74
Included new version of custom lib. Added checks for backdoor triggering
2022-05-04 04:40:25 -04:00
h3xduck
b182ac1eeb
Added new TC module, updates to the exec hooking system and the userland module
2022-02-20 16:50:15 -05:00
h3xduck
643783004a
Added new hooks and updated map fields to support new sudo module.
2022-02-05 13:49:20 -05:00
h3xduck
3832d99af1
Updated file names and directory structure to the new multi-modules rootkit
2022-01-16 06:56:54 -05:00
h3xduck
fc0d30f06f
Completed output modification of sys_read. Created a simple PoC
2022-01-16 06:45:45 -05:00
h3xduck
106f141c7e
Added new kprobe to the filesystem ebpf section. Now receiving read events, and storing them in a map for later use, along with a reference to the user-space memory buffer
2022-01-14 21:18:51 -05:00
h3xduck
193d9ec28f
Fixed the whole header setup, now correctly using the kernel headers instead of normal development ones. Ready to go on with original plan of file system hooking
2022-01-06 13:31:52 -05:00
h3xduck
4882ce790c
[BUILD FAILING] Checkpoint for backup, added new hook for file system, tweaked makefile for real kernel header files inclusion, still not working. Commiting for periodic backup
2022-01-05 20:34:53 -05:00
h3xduck
f8774ac9cf
[BUILD IS FAILING] Added file system hooks and other improvements. Uploading because of needing to backup
2022-01-04 20:09:59 -05:00
h3xduck
74873dbca5
Completed configuration module which enables to change the running ebpf modules in the rootkit at runtime. Minor changes and updated code structure
2022-01-04 13:26:13 -05:00
h3xduck
0863566292
Included a global config struct for controlling which hooks and functions of the rootkit should be active. Still work to be done in the bpf side
2021-12-31 09:54:47 -05:00
h3xduck
d9a70f866c
Modularized the ebpf program loading and attaching.
2021-12-30 21:09:26 -05:00
h3xduck
d5478ed7a0
Added more communication utils between userspace and kernel:
...
* Included maps and kernel ring buffer communication
* Extended the ebpf structure to include more modules
* New utils in both user and kernelspace
* Other changes
* This update precedes a great effort on researching and learning and linux kernel tracing and studing ebpfkit from defcon. More functionalities should come rather quickly now.
2021-12-29 14:44:09 -05:00
h3xduck
745ec4e395
Updated project structure, and added new list for the next incoming feature.
2021-12-21 20:08:49 -05:00
