v0.11.1

What's Changed

• Update dependencies by @kpcyrd in #46
• Fix clippy, update dependencies by @kpcyrd in #47
• Update dependencies, fix openssl 4.0 build by @kpcyrd in #49

Full Changelog: v0.11.0...v0.11.1

v0.11.0

What's Changed

• Improve sq compatibility in unit tests, make external binaries configurable by @kpcyrd in #43
• Update dependencies
  • Fix RUSTSEC-2025-0004
  • Fix RUSTSEC-2025-0009

Release binary SHA256

8c6820be405a054c484cbee68c2644bba93c3867ecebb8343c58464cd29c6240

Reproduce release binary from source

git clone https://github.com/kpcyrd/sh4d0wup
cd sh4d0wup
git checkout v0.11.0
make build
sha256sum target/x86_64-unknown-linux-musl/release/sh4d0wup

Thanks

We'd like to thank @repi for their support on github sponsors.

v0.10.0

What's Changed

• Add options to configure x509 keypair signature algorithm
• Add support for generating RSA x509 keys
• Update Dockerfile base image to Alpine 3.20
• Drop nettle dependency
• Add vendored cargo feature for static sh4d0wup binaries
• Add windows support
• Update dependencies
  • Fix RUSTSEC-2024-0344
  • Fix RUSTSEC-2024-0332
  • Fix RUSTSEC-2024-0357
  • Fix RUSTSEC-2024-0336
  • Fix RUSTSEC-2024-0345

Release binary SHA256

4863ad04d042216a09d021b4d391824e5deb2d21538de203f5445bac187be3de

Reproduce release binary from source

git clone https://github.com/kpcyrd/sh4d0wup
cd sh4d0wup
git checkout v0.10.0
make build
sha256sum target/x86_64-unknown-linux-musl/release/sh4d0wup

Thanks

We'd like to thank @SantiagoTorres and @repi for their support on github sponsors.

v0.9.3

• Bump mio from 0.8.10 to 0.8.11 by @dependabot in #22
• Update dependencies by @kpcyrd in #23
• Update dependencies by @kpcyrd in #24

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

v0.9.2

• Support new application/x-bzip2 mime-type
• Update dependencies
  • RUSTSEC-2024-0003 - Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
  • RUSTSEC-2024-0006 - shlex: Multiple issues involving quote API
  • RUSTSEC-2023-0065 - Tungstenite allows remote attackers to cause a denial of service
  • RUSTSEC-2023-0052 - webpki: CPU denial of service in certificate path building
  • RUSTSEC-2023-0072 - openssl: X509StoreRef::objects is unsound
  • RUSTSEC-2023-0075 - unsafe-libyaml: Unaligned write of u64 on 32-bit and 16-bit platforms

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

v0.9.1

• Fix build issues with Rust 1.72.0
• Add a default key type for ssh keys (ed25519) and default key sizes for each key type (rsa => 4096, dsa => 1024, ecdsa => 256, ed25519 => 256)
  • It's now sufficient to run sh4d0wup keygen ssh to generate a burner ssh key
• Add --secret-key-only and --public-key-only flags to sh4d0wup keygen to ease scripting
• Updated dependencies

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

v0.9.0

• Add -n switch to sh4d0wup build to dump deserialized plot with no processing
• Support generating git tag objects as binary artifact
• Support auto-detecting package urls for apt, pacman and apk by parsing the database object of the respective package repository
• Detect SHA512 fields in apt files and update them accordingly during tampering
• Improved Rust payload generation (including libc-free binaries)
• Fix -Wunused-result warning in generated C code
• Do not leave empty files on failed builds

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

v0.8.0

• Add a --keep option for the check subcommand
• Improve apt compatibility
• Fix a bug with the pre-built items not being used, add better tests
• Refactor codegen to target more compilers to generate backdoors with

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

v0.7.1

• Fix build for MacOS

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

v0.7.0

• Add sh4d0wup front command to spawn a zero-config reverse proxy. This is useful for reverse engineering or if you quickly want to test something without starting a plot first.
• Add sh4d0wup infect elf-fwd-stdin command to generate elf binaries that spawn a subprocess and then forward some data that gets embedded at a build time. This can be used to execute shell or python scripts without writing them to disk.
• Re-introduce the shell script patching code as sh4d0wup infect sh. It allows to hook functions. Shell parsing is provided by yash-syntax which is experimental. Only shorthand functions like foo() { echo hello world; } are supported but not function foo() { echo hello world; }. This feature is available over the cli, in plot files for artifacts and to transform http responses.
• Git commit bruteforce was refactored from normal threads to tokio.
• Improve compatibility with http2 and non-root container images. It's now possible to easily match the host/authority of a request (this feature is sometimes refered to as vhosts).
• Allow more complex elf payload configurations, see contrib/plot-elf-galore.yaml

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.