m3wsec / saruman

ELF anti-forensics exec, for injecting full dynamic executables into process image (With thread injection)

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Saruman v0.1 (Ryan O'Neill) elfmaster@zoho.com

Type make to compile launcher (It will also try to compile a parasite.c file which is for you too supply). Make sure your parasite executable is compiled -fpic -pie

./launcher <parasite_executable> <parasite_args, [arg1, arg2, argN]>

NOTE: In this version Saruman doesn't yet support injecting a program that requires command line args because it is early POC. So <parasite_args> will not actually accept args yet.

./launcher --no-dlopen <parasite_executable>

When using --no-dlopen it uses a more stealth technique of loading the executable so that it doesn't show up as /path/to/parasite.exe in the /proc maps file. Currently this has some bugs and won't work with more complex parasites (To be fixed)

About

ELF anti-forensics exec, for injecting full dynamic executables into process image (With thread injection)


Languages

Language:C 99.7%Language:Makefile 0.3%