search

chokepoint / azazel

Azazel is a userland rootkit based off of the original LD_PRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily around anti-debugging and anti-detection.
GNU General Public License v2.0
771 stars 177 forks source link

didnot spawn the shell #4

Open medozero opened 10 years ago

medozero commented 10 years ago

hi . i am trying this rk and after i compile it. i tried both ways to use it one with the LD_PRELOAD and the other with make install method . and both works . only to the point that it start to spawn the /bin/bash , it is just didn't . ex: [root@pxe ~]# ncat 192.168.1.74 22 -p 41 medo Welcome! Here's a shell:

and then what ever i try to do it will give me

Ncat: Broken pipe. i also tried with socat and same thing it just broke .

here it is the kernel Linux localhost.localdomain 2.6.32-358.el6.x86_64 #1 SMP Fri Feb 22 00:31:26 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

PS: tried other rk and they work fine like Jynx/Jynx2

chokepoint commented 9 years ago

You could try removing the debug hook and stracing the listening daemon to see which portion is failing. I just recompiled and ran it on a new box and had no issues.

LD_PRELOAD=./libselinux.so strace ncat -l 5000

ncat localhost 5000 -p 41

Also, which distro are you running?

medozero commented 9 years ago

CentOS 5 and 6 . yes a bit late to reply . but i think project was designed for debian .