38 lines
3.4 KiB
JSON
38 lines
3.4 KiB
JSON
{
|
|
"ld_preload": "/tmp/global.so\n/opt/second.so",
|
|
"listener_baseline": [],
|
|
"suid_baseline": ["/usr/bin/sudo"],
|
|
"suid_binaries": ["/tmp/evil", "/usr/bin/sudo", "/usr/local/bin/newtool"],
|
|
"persist_since": 100,
|
|
"persistence_files": {"/etc/cron.d/evil": 101},
|
|
"first_seen_initialized": true,
|
|
"first_seen_public_destinations": {"bash": ["1.1.1.1:443"]},
|
|
"first_seen_listener_ports": {"nc": ["22"]},
|
|
"processes": [
|
|
{"pid": 100, "comm": "bash", "cmdline": "bash -i", "exe": "/usr/bin/bash", "fd_targets": {"0": "socket:[999]"}},
|
|
{"pid": 200, "comm": "sleep", "cmdline": "sleep", "exe": "/usr/bin/sleep", "environ": {"LD_PRELOAD": "/tmp/evil.so"}},
|
|
{"pid": 201, "comm": "safe", "cmdline": "safe", "exe": "/usr/bin/safe", "environ": {"LD_PRELOAD": "/usr/lib/libfoo.so"}},
|
|
{"pid": 300, "comm": "tmpdrop", "cmdline": "tmpdrop", "exe": "/tmp/x (deleted)"},
|
|
{"pid": 301, "comm": "memdrop", "cmdline": "memdrop", "exe": "/memfd:foo (deleted)"},
|
|
{"pid": 302, "comm": "upgrade", "cmdline": "upgrade", "exe": "/usr/bin/x (deleted)"},
|
|
{"pid": 303, "comm": "normal", "cmdline": "normal", "exe": "/usr/bin/x"},
|
|
{"pid": 350, "comm": "hoxha", "cmdline": "hoxha", "exe": "/usr/bin/hoxha", "memory_maps": [{"start": 4096, "end": 8192, "perms": "r-xp", "path": "/memfd:stage (deleted)"}]},
|
|
{"pid": 351, "comm": "packer", "cmdline": "packer", "exe": "/usr/bin/packer", "memory_maps": [{"start": 12288, "end": 16384, "perms": "rwxp", "path": ""}]},
|
|
{"pid": 352, "comm": "bash", "cmdline": "bash", "exe": "/usr/bin/bash", "memory_maps": [{"start": 20480, "end": 24576, "perms": "r-xp", "path": "/usr/lib/libhide.so"}]},
|
|
{"pid": 353, "comm": "node", "cmdline": "node", "exe": "/usr/bin/node", "memory_maps": [{"start": 28672, "end": 32768, "perms": "rwxp", "path": ""}]},
|
|
{"pid": 354, "comm": "node", "cmdline": "node", "exe": "/usr/bin/node", "memory_maps": [{"start": 36864, "end": 40960, "perms": "r-xp", "path": "/tmp/libhide.so"}]},
|
|
{"pid": 355, "comm": "sshd", "cmdline": "sshd", "exe": "/usr/sbin/sshd", "memory_maps": [{"start": 45056, "end": 49152, "perms": "r-xp", "path": "/tmp/libinject.so"}]},
|
|
{"pid": 320, "comm": "hoxha", "cmdline": "hoxha", "exe": "/tmp/hoxha", "fd_targets": {"7": "/dev/input/event3"}},
|
|
{"pid": 321, "comm": "Xorg", "cmdline": "Xorg", "exe": "/usr/bin/Xorg", "fd_targets": {"8": "/dev/hidraw0"}},
|
|
{"pid": 330, "comm": "hoxha", "cmdline": "hoxha", "exe": "/tmp/hoxha", "fd_targets": {"4": "/etc/shadow"}},
|
|
{"pid": 331, "comm": "collector", "cmdline": "collector", "exe": "/tmp/collector", "fd_targets": {"5": "/home/luna/.ssh/id_ed25519"}},
|
|
{"pid": 332, "comm": "firefox", "cmdline": "firefox", "exe": "/usr/lib/firefox/firefox", "fd_targets": {"8": "/home/luna/.mozilla/firefox/a/key4.db"}}
|
|
],
|
|
"sockets": [
|
|
{"state": "ESTAB", "local": "127.0.0.1:55", "peer": "9.9.9.9:443", "inode": 999, "comm": "bash", "pid": 100, "kind": "tcp"},
|
|
{"state": "ESTAB", "local": "10.0.0.2:5000", "peer": "8.8.8.8:4443", "inode": 1, "comm": "hoxha", "pid": 340, "kind": "sctp"},
|
|
{"state": "UNCONN", "local": "*:eth0", "peer": "*", "inode": 2, "comm": "tcpdump", "pid": 341, "kind": "packet"},
|
|
{"state": "ESTAB", "local": "10.0.0.2:6000", "peer": "10.0.0.5:443", "inode": 3, "comm": "python3", "pid": 342, "kind": "tcp"}
|
|
,{"state": "LISTEN", "local": "0.0.0.0:31337", "peer": "0.0.0.0:*", "inode": 4, "comm": "nc", "pid": 500, "kind": "tcp"}
|
|
]
|
|
}
|