sleepall

Trojan based on the CVE-2024-28085 vulnerability (https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt) which is still unpatched anywhere. Essence: bash supports escape codes and we can control the appearance of the line in the terminal. The trojan listens to processes and looks for the PID of the sudo command, finds its parent and kills the root one, substituting a fake SUDO prompt.

The user on the terminal executes the sudo <...> command and the trojan modifies his process, forcing the password to be entered not into sudo, but into the terminal. After which the password is sent to the server.

The code was created for testing and educational purposes, and the author is not responsible for your further actions with it.

Build:

g++ -static sleepall.cpp -o sleepall
gcc server.c -o server

Photo of the fake prompt:

Photo of what actually happens in the terminal:

Process manipulation is allowed on:

• arch
• alt 8 sp 10

Prohibited on:

• Centos 7

P.S.: Wheee, but only works in bash (not zsh)