h3xduck 163f923c55 Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

..

.output

Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

bin

Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

client

Updated some files for eveything to work now that it is all together. Execve hijacker and clients in particular

2022-05-15 20:47:58 -04:00

common

Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

ebpf

Fixed a bug where tcpport mode in the multi-packet backdoor did not work if a previous trigger using seqnum mode was made

2022-05-18 12:45:35 -04:00

helpers

New explanation for the injection technique (alternative scanning process) and added flow diagram with full process.

2022-06-13 10:57:32 -04:00

libbpf

Setup development environment with libbpf

2021-11-20 21:07:23 -05:00

tools

Setup development environment with libbpf

2021-11-20 21:07:23 -05:00

user

Updated injection module to ensure shellcode fits in code cave. Added simple reverse shell in injection lib

2022-06-11 18:38:48 -04:00

vmlinux

Added new kprobe to the filesystem ebpf section. Now receiving read events, and storing them in a map for later use, along with a reference to the user-space memory buffer

2022-01-14 21:18:51 -05:00

Makefile

Merged master and develop, now all changes together. Fully tested and working.

2022-05-15 20:46:35 -04:00

tc.o

Added hide directory capabilities for the rootkit

2022-05-16 11:24:59 -04:00