TL;DR

1. Use echo 'print __libc_dlopen_mode("/path/to/library.so", 2)' | gdb -p <PID> for process injection
2. Write a shared library to inject into sshd process
3. In the library, fork a child process to monitor sshd children then attach (PTRACE_ATTATCH) to them
4. For each ssh session, search its memory for …

View comments.

why do we inject

process injection can be useful when we need to hide our malware deeper, or when we want to add extra persistence to our malware

there are several ways of doing a process injection on linux. unlike Windows who provides many official APIs for this purpose, on …

View comments.