Once we have root access we can start our backdoor installation. Umbra has 2 modules, user and kernel mode.
Since we aspire to not have anything on disk we have two options:
- We can remotely take control of a process with root access and use it to bring and install Stage 2 on the target
- If we can infiltrate and run a file on the target, run a ELF binary that downloads and installs Stage 2
For now we'll implement 2.
We need to create a socket to our C&C so we can download Stage 2. The next part still requires some research, we need to run the user space process and kernel module without ever having any of them on disk. In order to run the kernel module we can use the syscall init_module which loads an ELF directly from memory, allowing us to easily load a kernel module without ever having it on disk.
The user mode part can be a little bit more tricky and will require more research, since there is no simple way to run a binary directly from memory (without having it on disk). We might try and transform our installation binary into the user space process (through mmap and mprotect and jumping to it ???). Or we can fork from the installation binary, take control of the child process (ptrace ???) and transforming it to the user space process.
On the end of this process we need to make the installation disappear from disk, so we'll need to remove the write the file with 0's, remove the file from the filesystems and kill ourselves.
Once we have root access we can start our backdoor installation. Umbra has 2 modules, user and kernel mode.
Since we aspire to not have anything on disk we have two options:
For now we'll implement 2.
We need to create a socket to our C&C so we can download Stage 2. The next part still requires some research, we need to run the user space process and kernel module without ever having any of them on disk. In order to run the kernel module we can use the syscall init_module which loads an ELF directly from memory, allowing us to easily load a kernel module without ever having it on disk.
The user mode part can be a little bit more tricky and will require more research, since there is no simple way to run a binary directly from memory (without having it on disk). We might try and transform our installation binary into the user space process (through mmap and mprotect and jumping to it ???). Or we can fork from the installation binary, take control of the child process (ptrace ???) and transforming it to the user space process.
On the end of this process we need to make the installation disappear from disk, so we'll need to remove the write the file with 0's, remove the file from the filesystems and kill ourselves.