{"id":13840080,"url":"https://github.com/Esonhugh/sshd_backdoor","last_synced_at":"2025-07-11T07:32:11.501Z","repository":{"id":65600346,"uuid":"587665635","full_name":"Esonhugh/sshd_backdoor","owner":"Esonhugh","description":"/root/.ssh/authorized_keys evil file watchdog with ebpf tracepoint hook.","archived":false,"fork":false,"pushed_at":"2023-02-05T04:22:03.000Z","size":84,"stargazers_count":321,"open_issues_count":1,"forks_count":37,"subscribers_count":4,"default_branch":"Skyworship","last_synced_at":"2024-11-14T04:11:51.434Z","etag":null,"topics":["backdoor","ebpf","offensive-security"],"latest_commit_sha":null,"homepage":"https://www.youtube.com/watch?v=2BUbPzwaGdk","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Esonhugh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-01-11T09:42:53.000Z","updated_at":"2024-10-30T10:15:55.000Z","dependencies_parsed_at":"2023-02-16T16:46:53.273Z","dependency_job_id":null,"html_url":"https://github.com/Esonhugh/sshd_backdoor","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":"Esonhugh/ebpf_cilium_starter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Esonhugh%2Fsshd_backdoor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Esonhugh%2Fsshd_backdoor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Esonhugh%2Fsshd_backdoor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Esonhugh%2Fsshd_backdoor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Esonhugh","download_url":"https://codeload.github.com/Esonhugh/sshd_backdoor/tar.gz/refs/heads/Skyworship","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225705198,"owners_count":17511242,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["backdoor","ebpf","offensive-security"],"created_at":"2024-08-04T17:00:41.641Z","updated_at":"2024-11-21T09:30:53.330Z","avatar_url":"https://github.com/Esonhugh.png","language":"C","funding_links":[],"categories":["红队\u0026渗透测试","C"],"sub_categories":[],"readme":"## sshd_backdoor\n\nThis Project is based on BlackHat USA 2021 and Defcon 29.\n\nAbout Using ebpf technique, hijacking the process during sshd service getting the ~/.ssh/authorized_keys to authorize user logging and injecting our public key make our login successful.\n\n### Demo\n\n[![SSHD backdoor Demo](https://res.cloudinary.com/marcomontalbano/image/upload/v1674832434/video_to_markdown/images/youtube--2BUbPzwaGdk-c05b58ac6eb4c4700831b2b3070cd403.jpg)](https://youtu.be/2BUbPzwaGdk \"SSHD backdoor Demo\")\n\n### Main Process in ebpf program\n\n1. Hook OpenAt syscall enter: \n    check if the sshd process call this, log the pid of sshd.\n\n2. Hook OpenAt Syscall exit:\n    check the pid logged. logging the fd of pid, map pid-\u003efd.\n\n3. Hook Read Syscall enter:\n    check the pid logged. logging the user_space_char_buffer of pid.\n\n4. Hook Read Syscall exit:\n    check the pid logged. find the buffer and change the buffer into our Key. Then delete pid in map to avoid blocking administrators' keys be read.\n\n### Usage\n\n```\n$ make help\n\n|=======================================================================================================\n|usage:\n|       build:  build full sshd_backdoor cli tool. But full sshd_backdoor is just supoorted the demo only\n|       generate: Generate the ebpf prog in kernel with clang.\n|                         if you need you can set the CFLAGS to append\n|       test_ebpf: if you editing the ebpf-c c files and header files\n|                          to test the ebpf can be compiled and pass ebpf verifier when load\n|       tool_unload: bpftool unload progs.\n|       tool_load: bpftool load  progs.\n|       bpftrace_keylogging: logging sshd keys.Also it can catch the passwords when logging\n|\n```\n\n## By the way\n\n### sshd keylogging\n\n```\nmake bpftrace_keylogging\n```\n\nwhich logging all message in sshd process. Of Course the key log.\n\n## troubleshooting\n\nCommon Issue: https://github.com/Esonhugh/sshd_backdoor/issues/6\n\n## reference\n\nhttps://github.com/pathtofile/bad-bpf/blob/main/src/sudoadd.bpf.c\n\nhttps://www.youtube.com/watch?v=5zixNDolLrg\n\netc.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEsonhugh%2Fsshd_backdoor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FEsonhugh%2Fsshd_backdoor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEsonhugh%2Fsshd_backdoor/lists"}