evilBPF

an eBPF / XDP Playground

This repository contains a collection of eBPF / XDP programs that I've written while learning about eBPF and XDP. As security is my primary interest, most of these programs are security-related and are intended to be used for security research.

Disclaimer: I condemn the use of these programs for malicious purposes. I am not responsible for any damage caused by the use of these programs. These programs are intended for educational purposes only.

Programs

Type	Name	Description	Notes
XDP	icmp_pingback	Respond to ICMP echo requests with ICMP echo replies within the XDP layer.	multiple demo used to show the features offered by eBPF
TP	hide_pid	Hide a process (pid)/folder/file from the system	Heavily inspired by bad-bpf with some modifications
TP	hidden_ssh	Add sneaky backdoor to SSH	W.I.P but Auth_key injection is there

Requirements

For compiling eBPF programs, you'll need the following:

• Debian, Ubuntu, or other Debian-based Linux distribution

sudo apt install clang llvm libelf-dev gcc-multilib linux-headers-$(uname -r) build-essential

Make sure that the version of clang and llvm installed is >= 10.0.0.

Installation

Getting the source code

As we are using submodules, you'll need to clone this repository with the --recursive flag:

git clone https://github.com/rphang/ebpf-playground.git --recursive

If you've already cloned this repository without the --recursive flag, you can run the following command to clone the submodules:

git submodule update --init --recursive

Compiling the programs

Each program has its own directory, and each directory has its own Makefile. To compile a program, simply cd into the program's directory and run make:

cd <program>...
make

This will compile the program and generate the following files:

• <program>: The application that loads the eBPF program.
• <program>.bpf.o: The compiled eBPF program.
• <program>.skel.h: The skeleton code for the eBPF program.
• vmlinux.h: The kernel headers for the kernel version that you are running.

Known issues

On my dev machine, my vmlinux.h file is generated without the xdp_md struct. I for now have no idea why this is the case, but I've found a workaround by simply redifining the xdp_md struct in the application code. This is not ideal, but it works for now. (You may need to remove it if you are not facing this issue)

Roadmap & Ideas

• [2/x] Compatible with bpf CO-RE ?
• Steal nginx passwd, authorization header, and cookie with openssl support (uprobes)

Resources

Alot of the general resources I've used to learn about eBPF and XDP are listed below:

• libbpf-bootstrap: demo BPF applications by libbpf team
• xdp-tutorial by XDP-project team
• Simple eBPF CO-RE Application by Juraj Vijtiuk (Sartura)