h3xduck 80f334636a Changed the repository (and the rootkit!) name with TripleCross: https://dictionary.cambridge.org/dictionary/english/double-cross. This is 'triple' because it is a BPF program that betrays you at the userspace, at the kernel, and at the network.

2022-06-15 20:33:07 -04:00

..

.output

Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

bin

Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

client

Changed the repository (and the rootkit!) name with TripleCross: https://dictionary.cambridge.org/dictionary/english/double-cross. This is 'triple' because it is a BPF program that betrays you at the userspace, at the kernel, and at the network.

2022-06-15 20:33:07 -04:00

common

Continued with execve hijacking.

2022-06-13 22:16:34 -04:00

ebpf

Fixed a bug where tcpport mode in the multi-packet backdoor did not work if a previous trigger using seqnum mode was made

2022-05-18 12:45:35 -04:00

helpers

Changed the repository (and the rootkit!) name with TripleCross: https://dictionary.cambridge.org/dictionary/english/double-cross. This is 'triple' because it is a BPF program that betrays you at the userspace, at the kernel, and at the network.

2022-06-15 20:33:07 -04:00

libbpf

Setup development environment with libbpf

2021-11-20 21:07:23 -05:00

tools

Setup development environment with libbpf

2021-11-20 21:07:23 -05:00

user

Updated injection module to ensure shellcode fits in code cave. Added simple reverse shell in injection lib

2022-06-11 18:38:48 -04:00

vmlinux

Added new kprobe to the filesystem ebpf section. Now receiving read events, and storing them in a map for later use, along with a reference to the user-space memory buffer

2022-01-14 21:18:51 -05:00

Makefile

Merged master and develop, now all changes together. Fully tested and working.

2022-05-15 20:46:35 -04:00

tc.o

Added hide directory capabilities for the rootkit

2022-05-16 11:24:59 -04:00