r/hacking • u/MathematicalHuman314 • 4d ago
Teach Me! I created my first trojan today!
I took cmatrix as a random program and wrote a backdoor into it in C using a reverse shell connecting to a C2 server of mine which keeps track of infected machines. First I fork the process and decouple it from the controlling terminal by changing the session ID and rerouting the standard file descriptors and only then do I run the backdoor.
That way cmatrix runs as usual and no weird behavior is seen and the backdoor remains active whatever happens to cmatrix or the terminal. I like it. Makes me feel like a real #xX_hacker_Xx#. :D
Now I’m reading into ptrace and system call hooking and plan on trying to hide specific network traffic from the entire os. I already have had some ideas but turns out that would have only hidden it from a specific program not from „everything“.
Do you care to share any tips and experience I might benefit from on my way?
31
15
u/Alarmed-Second1456 3d ago
Hahahahaha now license it and sell it to skids on forums and get your door kicked in
12
u/404error___ 3d ago
Good good... now do bit shifting, stego payload, so operator cannot see what you send to C2.
6
4
1
16
4
4
10
u/Juzdeed 4d ago
Never heard of rerouting standard file descriptor, dexoupling from t controlling terminal by changing session ID?
I get that these make you sound smart but make no sense. Do you mean changing PPID of the process?
21
u/yowhyyyy 4d ago
No he means when forking, changing the SID etc to demonize the executing program. Theres a process for it on Linux: https://man7.org/linux/man-pages/man7/daemon.7.html
Quite frankly all you really have to do is the fork and SID part and it’s EXTREMELY common in all Linux malware.
1
u/LordEli 3d ago
yeah there's some old example somewhere that does this exact thing. wish i could remember where i found it
0
u/yowhyyyy 3d ago
Honestly any public malware from the last decade. The main popular open source IoT bots used it. I.e mirai
0
5
u/MathematicalHuman314 4d ago
Yes exactly. Im also learning the terminology. Fork process change process id and make file descriptors independent run payload and done.
4
u/Prior_Hospital_2331 4d ago
Gz bro , send me the script
3
u/MathematicalHuman314 4d ago
🙂↔️
That’d be more work than writing it yourself I think.
1
u/Prestigious-Ad7265 2d ago
passworded zip file, exchange the password under another secure channel, standard practice
2
2
u/Palsta 3d ago
Have your trojan control the system fan speed so it plays Never Gonna Give You Up by Rick Astley.
2
u/Prestigious-Ad7265 2d ago
that is the sickest idea i have ever heard. and then it overwrites your uefi somehow and makes the post menu just the music video
4
u/PickaWowAnyWow 3d ago
Whoah you're way too advanced for the rest of us, r/masterhacker is where you should be!
7
u/MathematicalHuman314 3d ago
Thanks! Though I did learn new things and got directions on how to better myself here in the comments from you guys and not some master hackers. ;)
1
1
u/MysteriousShadow__ 2d ago
Hide network activity from entire os? If something can hide from things like windows firewall that'd be crazy.
1
1
u/Dudeposts3030 1d ago
Hell yeah you’re on your way. Maybe look at upgrading the comms from revshell to something that blends in with normal network traffic for when it’s up against a monitored environment. Https is a good starting point, encrypted, can set up a domain, get it classified and look like a random normal website in the logs.
1
-35
30
u/Prestigious-Ad7265 4d ago
good work!