ebpf-attacks

eBPF-based post-exploitation for kernel-level credential harvesting, process hiding, and traffic interception on Linux

Repositorio: CyberStrikeus/CyberStrike
Última actividad en el origen: 23 de junio de 2026 a las 03:22
Idioma detectado de SKILL.md: inglés
Estrellas: 1653
Forks: 254

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/CyberStrikeus/CyberStrike --skill ebpf-attacks

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

name	ebpf-attacks
description	eBPF-based post-exploitation for kernel-level credential harvesting, process hiding, and traffic interception on Linux
category	post-exploitation
tags	["ebpf","bpf","kernel","post-exploitation","credential-access","defense-evasion","persistence","linux","rootkit"]
tech_stack	["linux","ebpf","kernel","bcc"]
cwe_ids	["CWE-269","CWE-522","CWE-693"]
chains_with	["T1014","T1055","T1556","T1205.002","T1003","T1059.004"]
prerequisites	["T1068","T1548"]
version	1.0

eBPF Post-Exploitation Methodology

eBPF (Extended Berkeley Packet Filter) enables kernel-level instrumentation without loading kernel modules. After gaining root on a Linux target, eBPF programs can intercept system calls, userspace function calls, and network traffic — operating below userland monitoring tools.

Prerequisites

Before deploying eBPF tools, verify:

Root access — all eBPF operations require CAP_SYS_ADMIN or CAP_BPF
Kernel version — Linux 4.18+ for full BPF features, 5.8+ for BPF ring buffer
BCC installed — python3 -c "from bcc import BPF" must succeed on target
No BPF LSM — check cat /sys/kernel/security/lsm for bpf restrictions

# Quick prerequisite check
uname -r                                    # kernel version
cat /proc/config.gz | zcat | grep CONFIG_BPF  # BPF config
ls /sys/fs/bpf/                             # BPF filesystem mounted
python3 -c "from bcc import BPF; print('OK')" # BCC available

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Understand the environment before deploying persistent hooks.

Action	Command	Purpose
Scan dependencies	`ebpf dep_scan`	Map all loaded libraries across all processes
Vuln check	`ebpf dep_scan --json-output`	Identify vulnerable library versions
Monitor executions	`ebpf execve_sniff --duration 30`	Understand what runs on the system — cron, services, monitoring
DNS baseline	`ebpf dns_sniff --duration 30`	Map DNS activity — identify internal services, C2 detection

Phase 2 — Credential Harvesting

Intercept credentials at the kernel level — no file modification, no log entries.

Action	Command	Purpose
PAM interception	`ebpf pam_sniff --duration 300`	Capture SSH, sudo, su, login passwords in cleartext
TLS interception	`ebpf ssl_sniff --pid <PID>`	Capture HTTPS plaintext for a specific service
Keystroke capture	`ebpf keylog --duration 120`	Capture interactive terminal input from TTY sessions

Action	Command	Purpose
Hide process	`ebpf proc_hide --pid <PID>`	Remove process from ps, top, htop, /proc listing
Hide files	`ebpf file_hide --name <NAME>`	Remove file/directory from ls, find, directory listings
Hide connections	`ebpf conn_hide --port <PORT>`	Remove network connection from netstat, ss, /proc/net/tcp

Action	Command	Purpose
io_uring bypass	`ebpf io_uring_sniff --duration 60`	Detect file/socket/connect operations via io_uring that bypass syscall hooks (kernel 5.1+)
Fileless execution	`ebpf memfd_exec --duration 60`	Detect memfd_create + execveat diskless payload delivery chains
ptrace injection	`ebpf ptrace_sniff --duration 60`	Monitor ATTACH → POKEDATA → SETREGS shellcode injection sequences
Cross-process memory	`ebpf crossmem_sniff --duration 60`	Detect stealthy process_vm_writev/readv memory injection
Race condition exploits	`ebpf userfaultfd_sniff --duration 60`	Detect userfaultfd-based timing control primitives
BPF integrity	`ebpf bpf_integrity --baseline --duration 300`	Verify CyberStrike hook integrity, detect unauthorized BPF program loads
Netlink manipulation	`ebpf netlink_sniff --duration 60`	Detect stealthy route/firewall rule manipulation via netlink
Sandbox weakening	`ebpf seccomp_sniff --duration 60`	Detect processes disabling their own seccomp/prctl security profiles
Shared memory IPC	`ebpf mmap_sniff --duration 60`	Detect covert IPC via mmap MAP_SHARED, shmget, shmat — data flows without syscalls
Zero-copy transfers	`ebpf zerocopy_sniff --duration 60`	Detect splice/tee/sendfile64 fd-to-fd transfers invisible to buffer profilers
VDSO tampering	`ebpf vdso_sniff --duration 60`	Detect timing side-channels and VDSO page modification attacks
Kernel keyring abuse	`ebpf keyring_sniff --duration 60`	Detect credential storage in kernel keyring (add_key/keyctl)
Namespace escape	`ebpf namespace_sniff --duration 60`	Detect container escape via setns/unshare namespace pivoting
Terminal injection	`ebpf ioctl_sniff --duration 60`	Detect TIOCSTI keystroke injection and terminal manipulation
Mount manipulation	`ebpf mount_sniff --duration 60`	Detect overlay/bind mounts hiding changes on sensitive paths
FUSE hijacking	`ebpf fuse_sniff --duration 60`	Detect userspace filesystem mounting that bypasses kernel VFS
Perf side-channel	`ebpf perf_sniff --duration 60`	Detect perf_event_open side-channel attacks via HW counters
BPF map covert channel	`ebpf bpfmap_sniff --duration 60`	Detect covert data sharing via BPF map create/update operations
LD_PRELOAD injection	`ebpf ldpreload_sniff --duration 60`	Detect library injection via LD_PRELOAD env and ld.so config
Futex covert channel	`ebpf futex_sniff --duration 60`	Detect timing-based covert channels via futex WAIT/WAKE

Program	Hook Type	Target	MITRE ATT&CK
pam_sniff	uprobe	`pam_get_authtok` in libpam.so	T1556 — Modify Authentication Process
ssl_sniff	uprobe	`SSL_write`/`SSL_read` in libssl.so	T1040 — Network Sniffing
dep_scan	procfs	`/proc/<pid>/maps`	T1518 — Software Discovery
proc_hide	kprobe	`sys_getdents64` on /proc	T1014 — Rootkit
file_hide	kprobe	`sys_getdents64`	T1014 — Rootkit
conn_hide	kprobe	`sys_read` on /proc/net/tcp	T1014 — Rootkit
execve_sniff	tracepoint	`sys_execve`	T1057 — Process Discovery
dns_sniff	kprobe	`udp_sendmsg` port 53	T1071.004 — DNS Application Layer Protocol
keylog	kprobe	`sys_read` on TTY fds	T1056.001 — Keylogging
cleanup	bpftool	BPF programs/maps	—
io_uring_sniff	kprobe	`io_uring_submit_sqe`	T1014 — Rootkit (syscall bypass)
memfd_exec	tracepoint	`memfd_create` + `execveat`	T1620 — Reflective Code Loading
ptrace_sniff	tracepoint	`sys_enter_ptrace`	T1055.008 — Ptrace System Calls
crossmem_sniff	tracepoint	`process_vm_writev`/`readv`	T1055.012 — Process Hollowing
userfaultfd_sniff	tracepoint	`sys_enter_userfaultfd`	T1068 — Exploitation for Privilege Escalation
bpf_integrity	tracepoint	`sys_enter_bpf` + bpftool	T1553 — Subvert Trust Controls
netlink_sniff	kprobe	`netlink_sendmsg`	T1562.004 — Disable or Modify System Firewall
seccomp_sniff	tracepoint	`sys_enter_prctl` + `sys_enter_seccomp`	T1562.001 — Disable or Modify Tools
mmap_sniff	tracepoint	`sys_enter_mmap` + `sys_enter_shmget` + `sys_enter_shmat`	T1055.009 — Proc Memory (shared memory IPC)
zerocopy_sniff	tracepoint	`sys_enter_splice` + `sys_enter_tee` + `sys_enter_sendfile64`	T1041 — Exfiltration Over C2 Channel
vdso_sniff	tracepoint	`sys_enter_clock_gettime` + `sys_enter_mprotect`	T1497.003 — Time Based Evasion
keyring_sniff	tracepoint	`sys_enter_add_key` + `sys_enter_keyctl` + `sys_enter_request_key`	T1003 — OS Credential Dumping
namespace_sniff	tracepoint	`sys_enter_setns` + `sys_enter_unshare`	T1611 — Escape to Host
ioctl_sniff	tracepoint	`sys_enter_ioctl` (TIOCSTI/TIOCLINUX/TIOCSCTTY)	T1056.001 — Keylogging
mount_sniff	tracepoint	`sys_enter_mount` + `sys_enter_umount`	T1006 — Direct Volume Access
fuse_sniff	tracepoint	`sys_enter_openat` (/dev/fuse) + `sys_enter_mount` (fuse)	T1014 — Rootkit
perf_sniff	tracepoint	`sys_enter_perf_event_open`	T1497.003 — Time Based Evasion
bpfmap_sniff	tracepoint	`sys_enter_bpf` (MAP_CREATE/UPDATE/LOOKUP/DELETE)	T1071 — Application Layer Protocol
ldpreload_sniff	tracepoint	`sys_enter_execve` (env scan) + `sys_enter_openat` (ld.so)	T1574.006 — Dynamic Linker Hijacking
futex_sniff	tracepoint	`sys_enter_futex` (WAIT/WAKE/BITSET/PI)	T1029 — Scheduled Transfer

ebpf-attacks

Opciones de instalación

Revisa los archivos de origen

eBPF Post-Exploitation Methodology

Prerequisites

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Phase 2 — Credential Harvesting

eBPF Post-Exploitation Methodology

Prerequisites

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Phase 2 — Credential Harvesting

Phase 3 — Stealth Operations

Phase 4 — Blind Spot Detection (20 monitors)

Phase 5 — Cleanup (MANDATORY)

Detection Considerations

Program Reference

ebpf-attacks

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

eBPF Post-Exploitation Methodology

Prerequisites

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Phase 2 — Credential Harvesting

eBPF Post-Exploitation Methodology

Prerequisites

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Phase 2 — Credential Harvesting

Phase 3 — Stealth Operations

Phase 4 — Blind Spot Detection (20 monitors)

Phase 5 — Cleanup (MANDATORY)

Detection Considerations

Program Reference