emptymonkey / mimic Goto Github PK

When issued with revsh running as root:

/home/code/mimic/mimic -b -e "/home/code/revsh/revsh -k"

it gets stuck at "Searching for main()..."

Launching child... Success!
Waiting for child to attach... Success!
Initializing ptrace_do... Success!
Determining stack state... Success!
Politely requesting name change... Success!
Searching for main()...

On controller side connection won't complete and it will even crash after Ctrl+C the stuck mimic instance

sudo revsh -vvv -k -c

Controller: Listening on 192.168.11.33:443.
Controller: Connected from 192.168.11.72:47440.
init_io_control(): SSL_accept(1f42a00): Success
do_control(): init_io_control(1f24120): Success

After installing mimic via instructions shown in REAME, when I simply run /mimic -e "/usr/bin/bash" , after few seconds I get this error:

/usr/sbin/apache2: start: File or directory doesn't exist
!WIFSTOPPED()
Error: libc register setup not detected. Aborting!
mimic: ptrace(13, 1901, 0, 7ffd7e4caad0): No such process
mimic: ptrace_do_syscall(16c5ca0, 11, 7f5862303000, 8, 0, 0, 0, 0): Operation not permitted
mimic: ptrace(13, 1901, 0, 16c5cb0): No such process
mimic: ptrace(17, 1901, 0, 0): No such process

I'm using Fedora 35, kernel 5.16.14-200 with SELinux in permissive mode.

Thanks!

PD: On the other hand, I've seen that before breaking, mimic itself is shown in ps -e/top, shouldn't it be hidden? Maybe this is worthy for another issue...

sirius@blackb0x:~/sploits/PID-HIDER/mimic/mimic$ make
gcc -std=gnu99 -Wall -Wextra -Os -c -o string_to_vector.o string_to_vector.c
gcc -std=gnu99 -Wall -Wextra -Os -c -o wordexp_t_to_vector.o wordexp_t_to_vector.c
gcc -std=gnu99 -Wall -Wextra -Os -I../ptrace_do -L../ptrace_do string_to_vector.o wordexp_t_to_vector.o -o mimic mimic.c -lptrace_do
mimic.c:50:26: fatal error: libptrace_do.h: No such file or directory
#include "libptrace_do.h"
^
compilation terminated.
make: *** [mimic] Error 1

Any help would be very appreciated :)

Just wanted to say this tool is amazing!!!
It works perfectly against /proc and sys based monitoring tools such as ps, htop, and even unhide, which is pretty nuts. And I got essays on pentesting, so I would lovely to integrate this within my scripts.

Anyway, is there any possible feature to use commands without it's binary path, since all i use is based on my system's environment variable. For now, I think I'll create a new branch so that i can support this version of mimic. Hope the development still continues, carry on !