TripleCross

aslr_bypass_example.png

Further advanced with the library injection, almost finished. Multiple enhancements

2022-06-12 22:34:50 -04:00

aslr_offset.jpg

Continued with library injection attack

2022-06-09 22:57:25 -04:00

bpf_address_mode.png

ALmost completed cbpf explantion

2022-05-23 06:17:21 -04:00

bpf_instructions.png

ALmost completed cbpf explantion

2022-05-23 06:17:21 -04:00

buffer_overflow_shellcode.jpg

Finished buffer overflow subsection

2022-06-07 12:52:51 -04:00

buffer_overflow.jpg

Finished buffer overflow subsection

2022-06-07 12:52:51 -04:00

c2_summ_example.png

Completed command and control

2022-06-15 12:45:59 -04:00

c2_summ_infra.png

Completed command and control

2022-06-15 12:45:59 -04:00

c2_summ_tc.png

Completed backdoor and c2 section

2022-06-15 15:40:08 -04:00

c2_summ_xdp.png

Completed backdoor and c2 section

2022-06-15 15:40:08 -04:00

cBPF_prog_ex_sol.png

Fixed some diagrams

2022-05-23 08:47:39 -04:00

cBPF_prog.jpg

ALmost completed cbpf explantion

2022-05-23 06:17:21 -04:00

classic_bpf.jpg

ALmost completed cbpf explantion

2022-05-23 06:17:21 -04:00

creativecommons.png

Updating documentation, preparing document with sections and comments

2022-04-27 21:59:56 -04:00

ebpf_arch.jpg

Continued with architecture, finished JIT, remodelled the second section of sSOTA

2022-05-25 22:00:28 -04:00

execve_hijack_overall_malware.png

Completed execution hijacking, completed first subsection of backdoor

2022-06-14 15:44:21 -04:00

execve_hijack_overall.png

Completed execution hijacking, completed first subsection of backdoor

2022-06-14 15:44:21 -04:00

flow_lib_injection_compact.png

New explanation for the injection technique (alternative scanning process) and added flow diagram with full process.

2022-06-13 10:57:32 -04:00

frame.jpg

Finished analysis of offensive capailities (techniques from defcon finally not included, at least for now)

2022-06-06 20:50:28 -04:00

getdents_firstentry.png

Completed chapter 4

2022-06-16 20:38:15 -04:00

getdents_summ.png

Completed chapter 4

2022-06-16 20:38:15 -04:00

getdents_technique.png

Completed chapter 4

2022-06-16 20:38:15 -04:00

kprobe_format.png

Continued with offensive capabilities, incorporated security features and started with tracing program features

2022-06-02 19:00:10 -04:00

libbpf_prog.jpg

Finished SotA

2022-05-28 09:23:41 -04:00

mem_arch_pages.jpg

Continued with memory corruption study

2022-06-04 08:55:45 -04:00

mem_major_page_fault.jpg

Continued with memory corruption study

2022-06-04 08:55:45 -04:00

mem_minor_page_fault.jpg

Continued with memory corruption study

2022-06-04 08:55:45 -04:00

memory.jpg

Finished buffer overflow subsection

2022-06-07 12:52:51 -04:00

packet_examples_bvp47_trigger.png

Completed execution hijacking, completed first subsection of backdoor

2022-06-14 15:44:21 -04:00

packet_examples_hive_data.png

Completed execution hijacking, completed first subsection of backdoor

2022-06-14 15:44:21 -04:00

packet_examples_hive_seqnum.png

Completed execution hijacking, completed first subsection of backdoor

2022-06-14 15:44:21 -04:00

packet_examples_hive_srcport.png

Completed execution hijacking, completed first subsection of backdoor

2022-06-14 15:44:21 -04:00

packet_examples_keyword_trigger.png

Completed execution hijacking, completed first subsection of backdoor

2022-06-14 15:44:21 -04:00

persistence_after.png

Completed chapter 4

2022-06-16 20:38:15 -04:00

persistence_before.png

Completed chapter 4

2022-06-16 20:38:15 -04:00

plt_got_glibc_flow.jpg

Further advanced with the library injection, almost finished. Multiple enhancements

2022-06-12 22:34:50 -04:00

Portada_Logo.png

Updating documentation, preparing document with sections and comments

2022-04-27 21:59:56 -04:00

privilege_esc_module.png

Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

rootkit_files.jpg

New diagrams, completed rootkit architecture

2022-06-12 08:16:59 -04:00

rootkit.jpg

Added new rootkit overall diagram for architecture section

2022-06-11 22:20:27 -04:00

rootkit.png

Further advanced with the library injection, almost finished. Multiple enhancements

2022-06-12 22:34:50 -04:00

rop_evil_ebpf_1.jpg

Finished ROP by jeff dileo

2022-06-08 08:59:32 -04:00

rop_evil_ebpf_2.jpg

Finished ROP by jeff dileo

2022-06-08 08:59:32 -04:00

rop_evil_ebpf_3.jpg

Finished ROP by jeff dileo

2022-06-08 08:59:32 -04:00

ROPcompound.jpg

Finished rop explanation

2022-06-07 15:38:42 -04:00

sch_client_help.png

Modified terminal names in the client

2022-06-15 19:09:58 -04:00

sch_enc_shell_comm_ex.png

Completed rootkit client and rootkit user program ring buffer

2022-06-15 22:54:20 -04:00

sch_enc_shell.png

Completed rootkit client and rootkit user program ring buffer

2022-06-15 22:54:20 -04:00

sch_firstcall.png

Continued with library injection attack

2022-06-09 22:57:25 -04:00

sch_gdb_got_after.png

Continued with library injection attack

2022-06-09 22:57:25 -04:00

sch_gdb_got_prev.png

Continued with library injection attack

2022-06-09 22:57:25 -04:00

sch_gdb_plt.png

Continued with library injection attack

2022-06-09 22:57:25 -04:00

sch_glibc_func.png

Continued with library injection attack

2022-06-09 22:57:25 -04:00

sch_groupfile.png

Almost completed section about privilege escalation

2022-06-13 15:44:37 -04:00

sch_plt_clang.png

Further advanced with the library injection, almost finished. Multiple enhancements

2022-06-12 22:34:50 -04:00

sch_plt_gcc.png

Further advanced with the library injection, almost finished. Multiple enhancements

2022-06-12 22:34:50 -04:00

sch_proc_maps_sample.png

Further advanced with the library injection, almost finished. Multiple enhancements

2022-06-12 22:34:50 -04:00

sch_settime_glibc.png

Further advanced with the library injection, almost finished. Multiple enhancements

2022-06-12 22:34:50 -04:00

sch_sudoers.png

Almost completed section about privilege escalation

2022-06-13 15:44:37 -04:00

sch_sudol.png

Almost completed section about privilege escalation

2022-06-13 15:44:37 -04:00

stack_before.jpg

Continued with memory corruption. Only attacks remaining

2022-06-05 09:01:09 -04:00

stack_ops.jpg

Continued with memory corruption. Only attacks remaining

2022-06-05 09:01:09 -04:00

stack_pres.jpg

Continued with memory corruption. Only attacks remaining

2022-06-05 09:01:09 -04:00

stack_ret_hij_simple.jpg

Finished buffer overflow subsection

2022-06-07 12:52:51 -04:00

stack_scan_write_tech.jpg

Completed memory corruption and continued with networking programs.

2022-06-05 21:20:23 -04:00

stack.jpg

Continued with memory corruption. Only attacks remaining

2022-06-05 09:01:09 -04:00

summ_execve_hijack.png

Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

tcp_conn.jpg

Finished analysis of offensive capailities (techniques from defcon finally not included, at least for now)

2022-06-06 20:50:28 -04:00

tcp_exfiltrate_retrans.jpg

Finished analysis of offensive capailities (techniques from defcon finally not included, at least for now)

2022-06-06 20:50:28 -04:00

tcp_retransmission.jpg

Finished analysis of offensive capailities (techniques from defcon finally not included, at least for now)

2022-06-06 20:50:28 -04:00

tcpdump_example.png

Completed bpf in the history section

2022-05-23 07:08:46 -04:00

ups_packet_struct.png

Continued with c2, bit i didnt like the structure, so it needs to be reformatted

2022-06-14 20:31:57 -04:00

ups_transmission.png

Continued with c2, bit i didnt like the structure, so it needs to be reformatted

2022-06-14 20:31:57 -04:00

xdp_diag.jpg

Continued with eBPF program types

2022-05-26 21:47:28 -04:00