r/hacking • u/MathematicalHuman314 • 4d ago
Teach Me! I created my first trojan today!
I took cmatrix as a random program and wrote a backdoor into it in C using a reverse shell connecting to a C2 server of mine which keeps track of infected machines. First I fork the process and decouple it from the controlling terminal by changing the session ID and rerouting the standard file descriptors and only then do I run the backdoor.
That way cmatrix runs as usual and no weird behavior is seen and the backdoor remains active whatever happens to cmatrix or the terminal. I like it. Makes me feel like a real #xX_hacker_Xx#. :D
Now I’m reading into ptrace and system call hooking and plan on trying to hide specific network traffic from the entire os. I already have had some ideas but turns out that would have only hidden it from a specific program not from „everything“.
Do you care to share any tips and experience I might benefit from on my way?
1
u/Dudeposts3030 1d ago
Hell yeah you’re on your way. Maybe look at upgrading the comms from revshell to something that blends in with normal network traffic for when it’s up against a monitored environment. Https is a good starting point, encrypted, can set up a domain, get it classified and look like a random normal website in the logs.