h3xduck 3ec9175053 Continued with the state of the art section

2022-05-22 08:19:32 -04:00

..

.output

Continued with the state of the art section

2022-05-22 08:19:32 -04:00

bin

Fixed a bug where tcpport mode in the multi-packet backdoor did not work if a previous trigger using seqnum mode was made

2022-05-18 12:45:35 -04:00

client

Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

2022-05-15 20:47:58 -04:00

common

Added obfuscation for the persistance access using cron

2022-05-16 17:34:21 -04:00

ebpf

Fixed a bug where tcpport mode in the multi-packet backdoor did not work if a previous trigger using seqnum mode was made

2022-05-18 12:45:35 -04:00

helpers

Added obfuscation for the persistance access using cron

2022-05-16 17:34:21 -04:00

libbpf

Setup development environment with libbpf

2021-11-20 21:07:23 -05:00

tools

Setup development environment with libbpf

2021-11-20 21:07:23 -05:00

user

Added new deployer for preparing final files, messed up with the phantom shell, sometimes gives errors, but I don't think we can do much, the shared maps together with multi-hooks on network has some unexpected behaviours

2022-05-16 16:33:12 -04:00

vmlinux

Added new kprobe to the filesystem ebpf section. Now receiving read events, and storing them in a map for later use, along with a reference to the user-space memory buffer

2022-01-14 21:18:51 -05:00

Makefile

Merged master and develop, now all changes together. Fully tested and working.

2022-05-15 20:46:35 -04:00

tc.o

Added hide directory capabilities for the rootkit

2022-05-16 11:24:59 -04:00