jm33-m0 / emp3r0r

Linux/Windows post-exploitation framework made by linux user
https://infosec.exchange/@jm33
MIT License
1.24k stars 235 forks source link

loader.so: patched `ps` complains about `SIGCHLD` #244

Closed jm33-m0 closed 5 months ago

jm33-m0 commented 11 months ago

Describe the bug

When using get_persistence -> patcher, patched ps binary will run emp3r0r's agent every time it runs. Since agent runs in daemon mode (it exits and relaunches), ps catches SIGCHLD and complains.

To Reproduce

Steps to reproduce the behavior:

  1. use get_persistence
  2. set method patcher and run
  3. ps -ef | grep 123

Expected behavior

No error should show up, users should not notice anything wrong with ps

Screenshots

image

Your environment

emp3r0r.json

I suggest that you format your JSON with an online JSON formatter, for example https://codebeautify.org/jsonviewer

emp3r0r.json:
Paste emp3r0r.json here, you can redact sensitive information

CC

Linux distro name and version, use cat /etc/*release* to view, paste the result below

# cat /etc/*release*

C2 Transport

Agent

OS

CPU architecture

Additional context

github-actions[bot] commented 9 months ago

Stale issue message

jm33-m0 commented 9 months ago

Let me keep it open