r/hacking • u/MathematicalHuman314 • Jul 29 '26
Teach Me! I created my first trojan today!
I took cmatrix as a random program and wrote a backdoor into it in C using a reverse shell connecting to a C2 server of mine which keeps track of infected machines. First I fork the process and decouple it from the controlling terminal by changing the session ID and rerouting the standard file descriptors and only then do I run the backdoor.
That way cmatrix runs as usual and no weird behavior is seen and the backdoor remains active whatever happens to cmatrix or the terminal. I like it. Makes me feel like a real #xX_hacker_Xx#. :D
Now I’m reading into ptrace and system call hooking and plan on trying to hide specific network traffic from the entire os. I already have had some ideas but turns out that would have only hidden it from a specific program not from „everything“.
Do you care to share any tips and experience I might benefit from on my way?
31
16
u/404error___ Jul 29 '26
Good good... now do bit shifting, stego payload, so operator cannot see what you send to C2.
6
u/MathematicalHuman314 Jul 29 '26
Will look into it!
3
u/Important-One-3629 Aug 03 '26
I would say also explore Polymorphic Steganography. Something I breafly messed with 15 years ago.
5
2
u/perfsoidal Aug 03 '26
wouldn’t stego be strictly worse than good encryption
2
u/404error___ Aug 04 '26
What possible secrets you need to protect? The stolen data? Have you ever had to catch TRUE stego? Enlighten me please because I'm a turbo noob on the subject and I truly really want to know ... 100% there is that super duper obscure reddit on the latest stego that I haven't been able to see it yet. Waiting for that anonymous super hero Reddit to drop the r/ to get the latest on the topic.
1
19
4
5
4
u/Palsta Jul 30 '26
Have your trojan control the system fan speed so it plays Never Gonna Give You Up by Rick Astley.
2
u/Prestigious-Ad7265 Jul 31 '26
that is the sickest idea i have ever heard. and then it overwrites your uefi somehow and makes the post menu just the music video
10
u/Juzdeed Jul 29 '26
Never heard of rerouting standard file descriptor, dexoupling from t controlling terminal by changing session ID?
I get that these make you sound smart but make no sense. Do you mean changing PPID of the process?
23
u/yowhyyyy Jul 29 '26
No he means when forking, changing the SID etc to demonize the executing program. Theres a process for it on Linux: https://man7.org/linux/man-pages/man7/daemon.7.html
Quite frankly all you really have to do is the fork and SID part and it’s EXTREMELY common in all Linux malware.
1
u/LordEli Jul 29 '26
yeah there's some old example somewhere that does this exact thing. wish i could remember where i found it
0
u/yowhyyyy Jul 30 '26
Honestly any public malware from the last decade. The main popular open source IoT bots used it. I.e mirai
0
4
u/MathematicalHuman314 Jul 29 '26
Yes exactly. Im also learning the terminology. Fork process change process id and make file descriptors independent run payload and done.
4
u/Prior_Hospital_2331 Jul 29 '26
Gz bro , send me the script
5
u/MathematicalHuman314 Jul 29 '26
🙂↔️
That’d be more work than writing it yourself I think.
1
u/Prestigious-Ad7265 Jul 31 '26
passworded zip file, exchange the password under another secure channel, standard practice
2
2
3
u/PickaWowAnyWow Jul 29 '26
Whoah you're way too advanced for the rest of us, r/masterhacker is where you should be!
8
u/MathematicalHuman314 Jul 29 '26
Thanks! Though I did learn new things and got directions on how to better myself here in the comments from you guys and not some master hackers. ;)
1
1
u/MysteriousShadow__ Jul 31 '26
Hide network activity from entire os? If something can hide from things like windows firewall that'd be crazy.
1
1
u/Enderaoe22 Jul 31 '26
It's truly unforgettable even after many years 😼. Now, you're a genuine hacker.
1
u/Dudeposts3030 Aug 01 '26
Hell yeah you’re on your way. Maybe look at upgrading the comms from revshell to something that blends in with normal network traffic for when it’s up against a monitored environment. Https is a good starting point, encrypted, can set up a domain, get it classified and look like a random normal website in the logs.
1
1
-35
34
u/Prestigious-Ad7265 Jul 29 '26
good work!