A collection of eBPF programs demonstrating bad behavior

Overview

Bad BPF

A collection of malicious eBPF programs that make use of eBPF's ability to read and write user data in between the usermode program and the kernel.

Overview

See my blog and my DEF CON talk for an overview on how thee programs work and why this is interesting.

Examples have been tested on:

  • Ubuntu 20.10
  • Fedora 34

Build

To use pre-build binaries, grab them from the Releases page.

To build from source, do the following:

Dependecies

To build and run all the examples, you will need a Linux kernel version of at least 4.7.

As this code makes use of CO-RE, it requires a recent version of Linux that has BTF Type information. See these notes in the libbpf README for more information. For example Ubuntu requries Ubuntu 20.10+.

To build it requires these dependecies:

  • zlib
  • libelf
  • libbfd
  • clang 11
  • make

On Ubuntu these can be installed by

sudo apt install build-essential clang-11 libelf-dev zlib1g-dev libbfd-dev libcap-dev libfd-dev

NOTE: Some examples fail to build on Clang 12. To install specifically clang 11 on Fedora 34+ you have to run:

# First install clang 12
sudo dnf install clang
# Then downgrade to Clag 11, which was in Fedora 33
sudo dnf downgrade --releasever=33 clang

Build

To Build from source, recusivly clone the respository the run make in the src directory to build:

git clone --recusrive https://github.com/pathtofile/bad-bpf.git
cd bad-bpf/src
make

The binaries will built into bad-bpf/src/bin.

Run

To run, launch each program as root. Every program has a --help option that has required arguemnts and examples.

Programs

Common Arguments

As well as --help, every program also has a --target-ppid/-t. This option restricts the programs' operation to only programs that are children of the process matching this PID. This demonstrates to how affect some programs, but not others.

BPF-Dos

sudo ./bpfdos

This program raises a SIG_KILL signal to any program attempting to use the ptrace syscall, e.g. strace. Once bpf-dos starts you can test it by running:

strace /bin/whoami

Exec-Hijack

sudo ./exechijack

This program intercepts all execve calls (used to create new processes) and instead makes then call /a. To run, first ensure there is a program in the root dir /a (probably best to make is executable by all). bad-bpf builds a simple program hijackee that simply prints out the uid and argv[0], so you can use that:

make
sudo cp ./bin/hijackee /a
sudo chmod ugo+rx /a

Then just run sudo ./bin/exechijack.

Pid-Hide

sudo ./pidhide --pid-to-hide 2222

This program hides the process matching this pid from tools such as ps.

It works by hooking the getdents64 syscall, as ps works by looking for every sub-folder of /proc/. PidHide unlinks the folder matching the PID, so ps only sees the folders before and after it.

Sudo-Add

sudo ./sudoadd --username lowpriv-user

This program allows a normally low-privledged user to use sudo to become root.

It works by intercepting sudo's reading of the /etc/sudoers file, and overwriting the first line with <username> ALL=(ALL:ALL) NOPASSWD:ALL #. This tricks sudo into thinking the user is allowed to become root. Other programs such as cat or sudoedit are unnafected, so to those programs the file is unchanged and the user does not have those privliges. The # at the end of the line ensures the rest of the line is trated as a comment, so it doesn't currup the file's logic.

Write-Blocker

sudo ./writeblocker --pid 508

This program intercepts all write syscall for a given process PID. Instead of passing the data to the actual write syscall, writeblocker will instead fake the call, returning the same number of bytes that the userspaceprogram expects to be written.

Only File Descriptors > 2 will be blocked, so stdin, stdout, and stderror still work.

For example, if you block the writes for the rsyslogd process, ssh logins will not be written to /var/log/auth.log.

Text-Replace

sudo ./textreplace --filename /path/to/file --input foo --replace bar

This program replaces all text matching input in the file with the replace text. This has a number of uses, for example:

To hide kernel module joydev from tools such as lsmod:

./textreplace -f /proc/modules -i 'joydev' -r 'cryptd'

Spoof the MAC address of the eth0 interface:

/textreplace -f /sys/class/net/eth0/address -i '00:15:5d:01:ca:05' -r '00:00:00:00:00:00'

Malware conducting anti-sandbox checks might check the MAC address to look for signs it is running inside a Virtual Machine or Sandbox, and not on a 'real' machine.

NOTE: Both input and replace must be the same length, to avoid adding NULL characters to the middle of a block of text. To enter a newline from a bash prompt, use $'\n', e.g. --replace $'text\n'.

Text-Replace2

This program works the same as Text-Replace, however it has two extra features:

  • The program's configuration is alterable at runtime using eBPF Maps.
  • The userspace loader can detach and exit

Altering Configuration

The filename is stored in the eBPF Map map_filename. The Key is always 0, and the value matches this struct:

struct tr_file {
    char filename[50];
    unsigned int filename_len;
};

That is, 50 ascii characters, then an unsigned int mathcing the length of the actual filename string.

The easiest way to view and alter eBPF maps is using bpftool:

# List current config
$> bpftool map dump name map_filename
[{
        "key": 0,
        "value": {
            "filename": "/proc/modules",
            "filename_len": 13
        }
    }
]

# Alter filename to be 'AAAA'
$> bpftool map update name map_filename \
    key hex 00 00 00 00 \
    value hex 61 61 61 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00

# Confirm change config
$> bpftool map dump name map_filename
[{
        "key": 0,
        "value": {
            "filename": "aaaa",
            "filename_len": 4
        }
    }
]

To alter the text to find and replace, alter the items in the Map map_text. The text to find is at key 0, and the text to replace is key 1. The values will each match this struct:

struct tr_text {
    char text[20];
    unsigned int text_len;
};

Running Detached

By running the program with --detach, the userspace loader can exit without stopping the eBPF Programs. Before running, first make sure the bpf filesystem is mounted:

sudo mount bpffs -t bpf /sys/fs/bpf

Then you can run text-replace2 detached:

./textreplace2 -f /proc/modules -i 'joydev' -r 'cryptd' --detach

This will create a number of eBPF Link files under /sys/fs/bpf/textreplace. Once loader has sucessfully run, you can check the logs by running:

sudo cat /sys/kernel/debug/tracing/trace_pipe
# confirm link files are there
sudo ls -l /sys/fs/bpf/textreplace

Then to stop, simply delete the link files:

sudo rm -r /sys/fs/bpf/textreplace
Issues
  • Is it possible to use it on CentOS 7.5

    Is it possible to use it on CentOS 7.5

    Hi, great project! I tried to use it under centos7.5 and it has been compiled successfully. This is my kernel information: 4.18.0-305.3.1.el8.x86_64 #1 SMP Tue Jun 1 16:14:33 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux. I try to run a process and hide it:

    sleep 1000
    sudo ./pidhide -p 29357
    

    Did not succeed (I know it was tested on Ubuntu 20.10 and Fedora 34, but I still want to try it on centos. Is there a way?):

    libbpf: loading object 'pidhide_bpf' from buffer
    libbpf: elf: section(2) tp/syscalls/sys_enter_getdents64, size 296, link 0, flags 6, type=1
    libbpf: sec 'tp/syscalls/sys_enter_getdents64': found program 'handle_getdents_enter' at insn offset 0 (0 bytes), code size 37 insns (296 bytes)
    libbpf: elf: section(3) tp/syscalls/sys_exit_getdents64, size 2248, link 0, flags 6, type=1
    libbpf: sec 'tp/syscalls/sys_exit_getdents64': found program 'handle_getdents_exit' at insn offset 0 (0 bytes), code size 146 insns (1168 bytes)
    libbpf: sec 'tp/syscalls/sys_exit_getdents64': found program 'handle_getdents_patch' at insn offset 146 (1168 bytes), code size 135 insns (1080 bytes)
    libbpf: elf: section(4) license, size 13, link 0, flags 3, type=1
    libbpf: license of pidhide_bpf is Dual BSD/GPL
    libbpf: elf: section(5) .rodata, size 22, link 0, flags 2, type=1
    libbpf: elf: section(6) .maps, size 144, link 0, flags 3, type=1
    libbpf: elf: section(7) .rodata.str1.1, size 66, link 0, flags 32, type=1
    libbpf: elf: skipping unrecognized data section(7) .rodata.str1.1
    libbpf: elf: section(8) .BTF, size 27248, link 0, flags 0, type=1
    libbpf: elf: section(9) .BTF.ext, size 2388, link 0, flags 0, type=1
    libbpf: elf: section(10) .eh_frame, size 112, link 0, flags 2, type=1
    libbpf: elf: skipping unrecognized data section(10) .eh_frame
    libbpf: elf: section(11) .symtab, size 696, link 18, flags 0, type=2
    libbpf: elf: section(12) .reltp/syscalls/sys_enter_getdents64, size 32, link 11, flags 0, type=9
    libbpf: elf: section(13) .reltp/syscalls/sys_exit_getdents64, size 288, link 11, flags 0, type=9
    libbpf: elf: section(16) .rel.eh_frame, size 48, link 11, flags 0, type=9
    libbpf: elf: skipping relo section(16) .rel.eh_frame for section(10) .eh_frame
    libbpf: looking for externs among 29 symbols...
    libbpf: collected 0 externs total
    libbpf: map 'map_buffs': at sec_idx 6, offset 0.
    libbpf: map 'map_buffs': found type = 1.
    libbpf: map 'map_buffs': found key [8], sz = 8.
    libbpf: map 'map_buffs': found value [11], sz = 8.
    libbpf: map 'map_buffs': found max_entries = 8192.
    libbpf: map 'map_bytes_read': at sec_idx 6, offset 32.
    libbpf: map 'map_bytes_read': found type = 1.
    libbpf: map 'map_bytes_read': found key [8], sz = 8.
    libbpf: map 'map_bytes_read': found value [2], sz = 4.
    libbpf: map 'map_bytes_read': found max_entries = 8192.
    libbpf: map 'map_prog_array': at sec_idx 6, offset 64.
    libbpf: map 'map_prog_array': found type = 3.
    libbpf: map 'map_prog_array': found key [23], sz = 4.
    libbpf: map 'map_prog_array': found value [23], sz = 4.
    libbpf: map 'map_prog_array': found max_entries = 5.
    libbpf: map 'map_to_patch': at sec_idx 6, offset 96.
    libbpf: map 'map_to_patch': found type = 1.
    libbpf: map 'map_to_patch': found key [8], sz = 8.
    libbpf: map 'map_to_patch': found value [11], sz = 8.
    libbpf: map 'map_to_patch': found max_entries = 8192.
    libbpf: map 'rb': at sec_idx 6, offset 128.
    libbpf: map 'rb': found type = 27.
    libbpf: map 'rb': found max_entries = 262144.
    libbpf: map 'pidhide_.rodata' (global data): at sec_idx 5, offset 0, flags 480.
    libbpf: map 5 is "pidhide_.rodata"
    libbpf: sec '.reltp/syscalls/sys_enter_getdents64': collecting relocation for section(2) 'tp/syscalls/sys_enter_getdents64'
    libbpf: sec '.reltp/syscalls/sys_enter_getdents64': relo #0: insn #3 against 'target_ppid'
    libbpf: prog 'handle_getdents_enter': found data map 5 (pidhide_.rodata, sec 5, off 0) for insn 3
    libbpf: sec '.reltp/syscalls/sys_enter_getdents64': relo #1: insn #31 against 'map_buffs'
    libbpf: prog 'handle_getdents_enter': found map 0 (map_buffs, sec 6, off 0) for insn #31
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': collecting relocation for section(3) 'tp/syscalls/sys_exit_getdents64'
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #0: insn #12 against 'map_buffs'
    libbpf: prog 'handle_getdents_exit': found map 0 (map_buffs, sec 6, off 0) for insn #12
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #1: insn #24 against 'map_bytes_read'
    libbpf: prog 'handle_getdents_exit': found map 1 (map_bytes_read, sec 6, off 32) for insn #24
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #2: insn #31 against 'pid_to_hide_len'
    libbpf: prog 'handle_getdents_exit': found data map 5 (pidhide_.rodata, sec 5, off 0) for insn 31
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #3: insn #39 against 'map_to_patch'
    libbpf: prog 'handle_getdents_exit': found map 3 (map_to_patch, sec 6, off 96) for insn #39
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #4: insn #59 against 'map_bytes_read'
    libbpf: prog 'handle_getdents_exit': found map 1 (map_bytes_read, sec 6, off 32) for insn #59
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #5: insn #64 against 'map_prog_array'
    libbpf: prog 'handle_getdents_exit': found map 2 (map_prog_array, sec 6, off 64) for insn #64
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #6: insn #102 against 'pid_to_hide'
    libbpf: prog 'handle_getdents_exit': found data map 5 (pidhide_.rodata, sec 5, off 0) for insn 102
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #7: insn #119 against 'map_bytes_read'
    libbpf: prog 'handle_getdents_exit': found map 1 (map_bytes_read, sec 6, off 32) for insn #119
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #8: insn #123 against 'map_buffs'
    libbpf: prog 'handle_getdents_exit': found map 0 (map_buffs, sec 6, off 0) for insn #123
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #9: insn #129 against 'map_prog_array'
    libbpf: prog 'handle_getdents_exit': found map 2 (map_prog_array, sec 6, off 64) for insn #129
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #10: insn #136 against 'map_bytes_read'
    libbpf: prog 'handle_getdents_exit': found map 1 (map_bytes_read, sec 6, off 32) for insn #136
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #11: insn #140 against 'map_buffs'
    libbpf: prog 'handle_getdents_exit': found map 0 (map_buffs, sec 6, off 0) for insn #140
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #12: insn #150 against 'map_to_patch'
    libbpf: prog 'handle_getdents_patch': found map 3 (map_to_patch, sec 6, off 96) for insn #4
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #13: insn #177 against 'pid_to_hide_len'
    libbpf: prog 'handle_getdents_patch': found data map 5 (pidhide_.rodata, sec 5, off 0) for insn 31
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #14: insn #185 against 'pid_to_hide_len'
    libbpf: prog 'handle_getdents_patch': found data map 5 (pidhide_.rodata, sec 5, off 0) for insn 39
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #15: insn #214 against 'pid_to_hide_len'
    libbpf: prog 'handle_getdents_patch': found data map 5 (pidhide_.rodata, sec 5, off 0) for insn 68
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #16: insn #253 against 'rb'
    libbpf: prog 'handle_getdents_patch': found map 4 (rb, sec 6, off 128) for insn #107
    libbpf: sec '.reltp/syscalls/sys_exit_getdents64': relo #17: insn #276 against 'map_to_patch'
    libbpf: prog 'handle_getdents_patch': found map 3 (map_to_patch, sec 6, off 96) for insn #130
    libbpf: loading kernel BTF '/sys/kernel/btf/vmlinux': 0
    libbpf: map 'map_buffs': created successfully, fd=4
    libbpf: map 'map_bytes_read': created successfully, fd=5
    libbpf: map 'map_prog_array': created successfully, fd=6
    libbpf: map 'map_to_patch': created successfully, fd=7
    libbpf: map 'rb': created successfully, fd=8
    libbpf: map 'pidhide_.rodata': created successfully, fd=9
    libbpf: sec 'tp/syscalls/sys_enter_getdents64': found 3 CO-RE relocations
    libbpf: prog 'handle_getdents_enter': relo #0: kind <byte_off> (0), spec is [46] struct task_struct.real_parent (0:57 @ offset 1184)
    libbpf: CO-RE relocating [0] struct task_struct: found target candidate [152] struct task_struct in [vmlinux]
    libbpf: prog 'handle_getdents_enter': relo #0: matching candidate #0 [152] struct task_struct.real_parent (0:61 @ offset 2320)
    libbpf: prog 'handle_getdents_enter': relo #0: patched insn #8 (ALU/ALU64) imm 1184 -> 2320
    libbpf: prog 'handle_getdents_enter': relo #1: kind <byte_off> (0), spec is [46] struct task_struct.tgid (0:55 @ offset 1172)
    libbpf: prog 'handle_getdents_enter': relo #1: matching candidate #0 [152] struct task_struct.tgid (0:59 @ offset 2308)
    libbpf: prog 'handle_getdents_enter': relo #1: patched insn #15 (ALU/ALU64) imm 1172 -> 2308
    libbpf: prog 'handle_getdents_enter': relo #2: kind <byte_off> (0), spec is [36] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24)
    libbpf: CO-RE relocating [0] struct trace_event_raw_sys_enter: found target candidate [5505] struct trace_event_raw_sys_enter in [vmlinux]
    libbpf: prog 'handle_getdents_enter': relo #2: matching candidate #0 [5505] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24)
    libbpf: prog 'handle_getdents_enter': relo #2: patched insn #25 (LDX/ST/STX) off 24 -> 24
    libbpf: sec 'tp/syscalls/sys_exit_getdents64': found 6 CO-RE relocations
    libbpf: prog 'handle_getdents_exit': relo #0: kind <byte_off> (0), spec is [315] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16)
    libbpf: CO-RE relocating [0] struct trace_event_raw_sys_exit: found target candidate [5506] struct trace_event_raw_sys_exit in [vmlinux]
    libbpf: prog 'handle_getdents_exit': relo #0: matching candidate #0 [5506] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16)
    libbpf: prog 'handle_getdents_exit': relo #0: patched insn #4 (LDX/ST/STX) off 16 -> 16
    libbpf: prog 'handle_getdents_exit': relo #1: kind <byte_off> (0), spec is [318] struct linux_dirent64.d_reclen (0:2 @ offset 16)
    libbpf: CO-RE relocating [0] struct linux_dirent64: found target candidate [31970] struct linux_dirent64 in [vmlinux]
    libbpf: prog 'handle_getdents_exit': relo #1: matching candidate #0 [31970] struct linux_dirent64.d_reclen (0:2 @ offset 16)
    libbpf: prog 'handle_getdents_exit': relo #1: patched insn #79 (ALU/ALU64) imm 16 -> 16
    libbpf: prog 'handle_getdents_exit': relo #2: kind <byte_off> (0), spec is [318] struct linux_dirent64.d_name (0:4 @ offset 19)
    libbpf: prog 'handle_getdents_exit': relo #2: matching candidate #0 [31970] struct linux_dirent64.d_name (0:4 @ offset 19)
    libbpf: prog 'handle_getdents_exit': relo #2: patched insn #86 (ALU/ALU64) imm 19 -> 19
    libbpf: prog 'handle_getdents_patch': relo #3: kind <byte_off> (0), spec is [318] struct linux_dirent64.d_reclen (0:2 @ offset 16)
    libbpf: prog 'handle_getdents_patch': relo #3: matching candidate #0 [31970] struct linux_dirent64.d_reclen (0:2 @ offset 16)
    libbpf: prog 'handle_getdents_patch': relo #3: patched insn #11 (ALU/ALU64) imm 16 -> 16
    libbpf: prog 'handle_getdents_patch': relo #4: kind <byte_off> (0), spec is [318] struct linux_dirent64.d_name (0:4 @ offset 19)
    libbpf: prog 'handle_getdents_patch': relo #4: matching candidate #0 [31970] struct linux_dirent64.d_name (0:4 @ offset 19)
    libbpf: prog 'handle_getdents_patch': relo #4: patched insn #29 (ALU/ALU64) imm 19 -> 19
    libbpf: prog 'handle_getdents_patch': relo #5: kind <byte_off> (0), spec is [318] struct linux_dirent64.d_name (0:4 @ offset 19)
    libbpf: prog 'handle_getdents_patch': relo #5: matching candidate #0 [31970] struct linux_dirent64.d_name (0:4 @ offset 19)
    libbpf: prog 'handle_getdents_patch': relo #5: patched insn #65 (ALU/ALU64) imm 19 -> 19
    libbpf: load bpf program failed: Permission denied
    libbpf: -- BEGIN DUMP LOG ---
    
    There is too much content here, I omitted it
    
    libbpf: -- END LOG --
    libbpf: failed to load program 'handle_getdents_exit'
    libbpf: failed to load object 'pidhide_bpf'
    libbpf: failed to load BPF skeleton 'pidhide_bpf': -4007
    Failed to load and verify BPF skeleton
    
    opened by yaoh3i 4
  • Get it work on Ubuntu20.10 smoothly

    Get it work on Ubuntu20.10 smoothly

    Hello, I'm a beginner in eBPF field and after several struggling, I managed to get it work on my Ubuntu 20.10. So I assume that there is some information needed for beginners like me, and it would be great if some of it can be added to README.md

    Clone the project

    First of all, to clone the project, the command worked for me is this:

    git clone  https://github.com/pathtofile/bad-bpf.git --recusrive
    

    the sequence of "--recursive" actually matters.

    Install needed libraries and tools first

    Install all these needed stuffs by this command

    apt install build-essential clang-11 libelf-dev zlib1g-dev libbfd-dev libcap-dev libbfd-dev  linux-tools-common linux-tools-generic
    

    I didn't find "libfd-dev" provided in README.md, so I guess it is "libbfd-dev"

    generate vmlinux.h locally with bpftool

    The vmlinux.h provided occurred erros during compiling if you use Ubuntu20.10 like me. So generating one locally is needed.

    cd bad-bpf/src/
    bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h
    

    change clang versions in Makefile

    This project work against clang-11, and I didn't find easy to to swtich clang version, so changing contents in Makefile while compiling might be a plausible option

    Change contents in Makefile from

    CLANG ?= clang
    LLVM_STRIP ?= llvm-strip
    

    to

    CLANG ?= clang-11
    LLVM_STRIP ?= llvm-strip-11
    

    happy compiling

    make
    
    opened by TomAPU 1
Source-code based coverage for eBPF programs actually running in the Linux kernel

bpfcov Source-code based coverage for eBPF programs actually running in the Linux kernel This project provides 2 main components: libBPFCov.so - an ou

elastic 109 May 24, 2022
libsinsp, libscap, the kernel module driver, and the eBPF driver sources

falcosecurity/libs As per the OSS Libraries Contribution Plan, this repository has been chosen to be the new home for libsinsp, libscap, the kernel mo

Falco 108 Aug 5, 2022
Linux Application Level Firewall based on eBPF and NFQUEUE.

eBPFSnitch eBPFSnitch is a Linux Application Level Firewall based on eBPF and NFQUEUE. It is inspired by OpenSnitch, and Douane, but utilizing modern

Harpo Roeder 649 Jul 26, 2022
eBPF bytecode assembler and compiler

An eBPF bytecode assembler and compiler that * Assembles the bytecode to object code. * Compiles the bytecode to C macro preprocessors. Symbolic

Emil Masoumi 6 Jan 23, 2022
Example how to run eBPF probes without a usermode process using fentry

Pinning eBPF Probes Simple example to demonstrate how to pin kernel function and syscall probes. Overview From my reading of the kernel code, KProbe a

pat_h/to/file 3 Jun 7, 2021
eBPF implementation that runs on top of Windows

eBPF for Windows eBPF is a well-known technology for providing programmability and agility, especially for extending an OS kernel, for use cases such

Microsoft 1.5k Jul 31, 2022
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

ebpfkit-monitor ebpfkit-monitor is an utility that you can use to statically analyse eBPF bytecode or monitor suspicious eBPF activity at runtime. It

Guillaume Fournier 63 Jul 26, 2022
A very basic eBPF Load Balancer in a few lines of C

An eBPF Load Balancer from scratch As seen at eBPF Summit 2021. This is not production ready :-) This uses libbpf as a git submodule. If you clone thi

Liz Rice 140 Jul 16, 2022
skbtracer on ebpf

skbtracer skbtracer 基于 ebpf 技术的 skb 网络包路径追踪利器, 实现代码基于 BCC (required Linux Kernel 4.15+) 使用样例 skbtracer.py # trace

DavadDi 45 Jun 18, 2022
some experiments with ebpf

Learning eBPF and some kernel tracing, probe DNS + TCP connection with portable bpf prog. DevEnv Ubuntu 20.04 Install go Install make, clang, llvm Ins

null 10 Jul 2, 2022
Small utility that leverages eBPF to dump the traffic of a unix domain socket

UnixDump UnixDump is a small eBPF powered utility that can be used to dump unix socket traffic. System requirements This project was developed on a Ub

Guillaume Fournier 5 Dec 1, 2021
Tool for Preventing Data Exfiltration with eBPF

bouheki: Tool for Preventing Data Exfiltration with eBPF bouheki is a KSRI implementation using LSM Hook by eBPF. Flexibility to apply restricted netw

mrtc0 44 Aug 3, 2022
The Beginner's Guide to eBPF Programming for Networking

The Beginner's Guide to eBPF Programming for Networking As seen at Cloud Native eBPF Day 2021. Setup Create a container that we can issue curl request

Liz Rice 71 Jul 28, 2022
pwru is an eBPF-based tool for tracing network packets in the Linux kernel with advanced filtering capabilities.

pwru (packet, where are you?) pwru is an eBPF-based tool for tracing network packets in the Linux kernel with advanced filtering capabilities. It allo

Cilium 832 Jul 29, 2022
Dectect syscall hooking using eBPF

BPF-HookDetect Detect Kernel Rootkits hooking syscalls Overview Details To Build To Run Example Test Resources Overview Kernel Rootkits such as Diamor

pat_h/to/file 82 Jul 31, 2022
bpflock - eBPF driven security for locking and auditing Linux machines

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. This is a Work In Progress: bpflock is currently

The Linux lock machine projects 81 Jul 28, 2022
A list of network measurement sketch algorithms implemented in eBPF

eBPF Sketches This repository contains a list of the most famous sketches implemented within the eBPF/XDP subsystem. In particular, we have: Count Ske

null 11 May 22, 2022
A Linux Host-based Intrusion Detection System based on eBPF.

eHIDS 介绍 eBPF内核技术实现的HIDS demo. 功能实现: TCP网络数据捕获 UDP网络数据捕获 uprobe方式的DNS信息捕获 进程数据捕获 uprobe方式实现JAVA的RASP命令执行场景事件捕获 eBPF的go框架实现,针对kprobe\uprobe挂载方式,多类型even

CFC4N 255 Aug 7, 2022
eBPF-based EDR for Linux

ebpf-edr A proof-of-concept eBPF-based EDR for Linux Seems to be working fine with the 20 basic rules implemented. Logs the alerts to stdout at the mo

null 16 May 6, 2022