ebpf-attacks

eBPF Post-Exploitation Methodology

eBPF (Extended Berkeley Packet Filter) enables kernel-level instrumentation without loading kernel modules. After gaining root on a Linux target, eBPF programs can intercept system calls, userspace function calls, and network traffic — operating below userland monitoring tools.

Prerequisites

Before deploying eBPF tools, verify:

1. Root access — all eBPF operations require CAP_SYS_ADMIN or CAP_BPF
2. Kernel version — Linux 4.18+ for full BPF features, 5.8+ for BPF ring buffer
3. BCC installed — python3 -c "from bcc import BPF" must succeed on target
4. No BPF LSM — check cat /sys/kernel/security/lsm for bpf restrictions

# Quick prerequisite check
uname -r                                    # kernel version
cat /proc/config.gz | zcat | grep CONFIG_BPF  # BPF config
ls /sys/fs/bpf/                             # BPF filesystem mounted
python3 -c "from bcc import BPF; print('OK')" # BCC available

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Understand the environment before deploying persistent hooks.

Phase 2 — Credential Harvesting

Intercept credentials at the kernel level — no file modification, no log entries.

PAM sniffing hooks pam_get_authtok in libpam.so via uprobe. Every authentication event (SSH login, sudo, su, screen unlock) passes through PAM — the cleartext password is captured before hashing.

SSL sniffing hooks SSL_write and SSL_read in libssl.so. Data is captured in plaintext before encryption (write) and after decryption (read). Use --pid to target a specific process (e.g., a web application handling API keys).

Keystroke logging hooks sys_read on TTY file descriptors (/dev/tty*, /dev/pts/*). Captures all interactive terminal input including passwords typed in non-echo mode.

Phase 3 — Stealth Operations

Hide your presence from system administrators and monitoring tools.

Process hiding hooks sys_getdents64 on /proc. When the kernel returns directory entries, entries matching the target PID are overwritten with . — the process becomes invisible to all userland tools that enumerate /proc.

File hiding uses the same sys_getdents64 hook but matches against a filename instead of a PID. Effective for hiding implants, scripts, and data exfiltration staging directories.

Connection hiding hooks sys_read on /proc/net/tcp and /proc/net/tcp6. When a monitoring tool reads the connection table, lines containing the target port are overwritten with spaces.

Phase 4 — Blind Spot Detection (20 monitors)

Detect attack primitives that bypass classical syscall hooks and operate through kernel subsystems invisible to standard monitoring.

io_uring sniffing monitors SQE submissions via io_uring_submit_sqe kprobe. Operations like CONNECT, READ, WRITE, OPENAT through io_uring bypass classical syscall hooks entirely — a reverse shell built on io_uring is invisible to execve/connect tracepoints.

Fileless execution detection correlates memfd_create → write → execveat(fd, "", AT_EMPTY_PATH) chains. The payload never touches disk — it exists only in memory via memfd. This is the primary technique for diskless implant delivery.

ptrace injection monitoring tracks the ATTACH → POKEDATA → SETREGS → CONT sequence that constitutes shellcode injection. Each ptrace operation is logged with target PID and memory addresses.

Cross-process memory monitoring captures process_vm_writev/process_vm_readv syscalls. These enable memory injection without ptrace — bypassing ptrace-based detection entirely.

userfaultfd monitoring detects creation of userfaultfd file descriptors. Legitimate use is rare (QEMU/KVM live migration); in exploit context, userfaultfd provides precise timing control for race condition exploitation.

BPF integrity verification takes a baseline of loaded BPF programs via bpftool and periodically verifies no CyberStrike programs have been detached or tampered with. Also monitors bpf() syscall for unauthorized program loads.

Netlink monitoring captures netlink socket messages for NEWROUTE, DELROUTE, NEWRULE, DELRULE operations — detecting stealthy routing table and firewall rule manipulation.

Seccomp/prctl monitoring captures PR_SET_SECCOMP, PR_SET_NO_NEW_PRIVS, PR_SET_NAME, PR_SET_DUMPABLE, and seccomp filter installation — detecting processes weakening their own security profiles or masquerading via name changes.

Phase 5 — Cleanup (MANDATORY)

Always run cleanup before exiting a target.

# List all CyberStrike eBPF programs on the system
ebpf cleanup

# Remove all CyberStrike eBPF programs
ebpf cleanup --remove --force

# Dry run — show what would be removed
ebpf cleanup --dry-run

The cleanup tool uses three detection methods:

1. bpftool prog list — enumerate all loaded BPF programs
2. /sys/fs/bpf/ — check for pinned programs
3. /sys/kernel/debug/tracing/ — check for registered kprobe/uprobe events

Detection Considerations

eBPF programs are detectable by:

• bpftool prog list — shows all loaded BPF programs
• /sys/kernel/debug/tracing/kprobe_events — shows registered kprobes
• /sys/kernel/debug/tracing/uprobe_events — shows registered uprobes
• auditd rules on bpf() syscall — auditctl -a always,exit -F arch=b64 -S bpf
• EDR agents with BPF LSM hooks (Falco, Tracee, Tetragon)

Program Reference