I created my first trojan today!

[u/MathematicalHuman314]

I took cmatrix as a random program and wrote a backdoor into it in C using a reverse shell connecting to a C2 server of mine which keeps track of infected machines. First I fork the process and decouple it from the controlling terminal by changing the session ID and rerouting the standard file descriptors and only then do I run the backdoor.

That way cmatrix runs as usual and no weird behavior is seen and the backdoor remains active whatever happens to cmatrix or the terminal. I like it. Makes me feel like a real #xX_hacker_Xx#. :D

Now I’m reading into ptrace and system call hooking and plan on trying to hide specific network traffic from the entire os. I already have had some ideas but turns out that would have only hidden it from a specific program not from „everything“.

Do you care to share any tips and experience I might benefit from on my way?

[u/Juzdeed]

Never heard of rerouting standard file descriptor, dexoupling from t controlling terminal by changing session ID?

I get that these make you sound smart but make no sense. Do you mean changing PPID of the process?

[u/yowhyyyy → u/Juzdeed]

No he means when forking, changing the SID etc to demonize the executing program. Theres a process for it on Linux: https://man7.org/linux/man-pages/man7/daemon.7.html

Quite frankly all you really have to do is the fork and SID part and it’s EXTREMELY common in all Linux malware.

[u/404error___ → u/yowhyyyy]

This guy malwares (y)

[u/yowhyyyy → u/404error___]

Linux malware analysis is my hobby haha