search

krisnova / boopkit

Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.
Apache License 2.0
1.57k stars 170 forks source link

eBPF Pinning #5

Open krisnova opened 2 years ago

krisnova commented 2 years ago

We want to pin the eBPF probe such that it will persist across reboot. This will allow us to hide the userspace component in clever ways.

Source: https://lwn.net/Articles/664688/

cfc4n commented 2 years ago

I think that BPFFS is a Virtual File System, just a memory file system. write by other process, not load data from device. So, pin the eBPF probe cant do that. cant across reboot.

via: https://facebookmicrosites.github.io/bpf/blog/2018/08/31/object-lifetime.html