Marcos Bajo

icon indicating a website link h3xduck.github.io icon indicating an email [email protected]

icon location Dortmund, Germany icon location PhD student at CISPA and cybersecurity researcher. Likes malware, exploits and ducks.

Results 12 issues of Marcos Bajo

Library injection path error: Segfault simple_timer and simple_open

5 comment

`Illegal instruction (core dumped)` - when I run` ./simple_timer`. and a `segmentation fault (core dumped)` - when I run `./simple_open`? I have not been able to carry out a PoC...

bug
enhancement

Hide alert messages about bpf_probe_write_user at kernel buffer

enhancement
obfuscation

Activate the userspace runtime config for active ebpf modules from the remote client connected to the backdoor.

1 comment

enhancement
network

Rootkit self-destroying

1 comment

enhancement
research

We can issue a write syscall whenever we want via bpf_printk. This may lead somewhere

research

Explore uprobes

research

Protection of private and protected maps from foreign programs

enhancement
obfuscation

Allow for overwritten read calls to have different size (investigate on fstat modification)

1 comment

Screenshot with some hints attached

Research about what is TX

It is related to XDP and the packets can be redirected to it, but needs research on what can be done with it.

network
research

Capture the transmission answering

enhancement
network