CVE-2022-0847-eBPF

CVE-2022-0847-eBPF An eBPF program to detect and defense attacks on CVE-2022-0847. In the kernel space, the program detects splice system calls, if such a system call contains a pipe as the output fd, and the flags of the pipe buffer is set to PIPEBUFFLAGCANMERGE , then an event would be submitte...

tetragon

Cilium 新增的 Tetragon 组件实现了强大的、基于 eBPF 的实时安全可观测性与运行时执行。 Tetragon 能够检测并对安全重要事件作出反应，例如： 进程执行事件 系统调用活动 包括网络和文件访问在内的 I/O 活动 当在 Kubernetes 环境中使用时，Tetragon 具备 Kubernetes 感知能力——即，它理解命名空间、Pod 等 Kubernetes 标识——从而可以针对各个工作负载配置安全事件检测。 了解更多关于 Tetragon 如何使用 eBPF 的信息。 快速开始 请参阅 Tetragon 官方文档。 要开始使用 Tetragon，请查看...

tetragon

Cilium’s new Tetragon component enables powerful real-time, eBPF-based Security Observability and Runtime Enforcement. Tetragon detects and is able to react to security-significant events, such as Process execution events System call activity I/O activity including network & file access When used...

lockc

lockc is open source sofware for providing MAC Mandatory Access Control type of security audit for container workloads. The main reason why lockc exists is that containers do not contain. Containers are not as secure and isolated as VMs. By default, they expose a lot of information about host OS...

ebpf

기타 eBPF 도구...

nysm

nysm A stealth post-exploitation container. Table of Content 1. Introduction 2. Installation 2.1 Requirements 2.2 Linux headers 2.3 Build 3. Usage 3.1 Examples 4. How it works 4.1 In general 4.2 Hide eBPF objects 4.3 Hide Auditd logs 4.4 Hide PIDs 4.5 Hide sockets 5. Limitations Introduction...

nysm

nysm ステルスなポストエクスプロイテーションコンテナ。 目次 1. はじめに 2. インストール 2.1 要件 2.2 Linux ヘッダー 2.3 ビルド 3. 使用方法 3.1 例 4. 仕組み 4.1 全般 4.2 eBPF オブジェクトを隠す 4.3 Auditd ログを隠す 4.4 PID を隠す 4.5 ソケットを隠す 5. 制限事項 はじめに eBPF ベースの攻撃ツール（資格情報窃取ツールから自身の PID を隠すルートキットまで）の人気が高まるにつれ、ある疑問が浮かびました： eBPF を eBPF 自身から不可視にすることは可能だろうか？ そこから nysm...

kube-knark

Proyecto Kube-Knark ¡¡Trazado de tu runtime de Kubernetes!! Kube-Knark es un trazador de código abierto que utiliza tecnología pcap y ebpf para realizar trazado en tiempo de ejecución en un clúster de Kubernetes desplegado. Realiza un seguimiento de la ejecución de la API de Kubernetes y de los...

kerneleye

KernelEye Kernel-level traffic intelligence and threat remediation for Linux servers. KernelEye is a self-hosted security monitoring platform for Linux servers. It uses eBPF, TC, and XDP in a Go agent to observe network metadata, score suspicious activity, and apply remediation through kernel-lev...

dirtypipe-ebpf_detection

dirtypipe-ebpfdetection -- Herramienta de detección de Dirtypipe Este programa fue creado para detectar intentos de explotación de Dirty Pipe gracias a eBPF. También monitorea kernels no vulnerables y contenedores Docker. 🛫 Si desea más detalles sobre cómo funciona, lea la publicación del blog ! ...

ebpfmon

ebpfmon ebpfmon is a tool for monitoring eBPF programs. It is designed to be used with bpftool from the linux kernel. ebpfmon is a TUI terminal UI application written in Go that allows you to do real-time monitoring of eBPF programs. Installation eBPFmon can be built from source or there is a...

kprotect

🛡️ kprotect Overview kprotect is a kernel-level security engine designed to protect your sensitive data from supply-chain attacks like malicious Python or Node.js libraries. It stands as an independent security layer for the most sensitive files. eBPF-LSM Enforcement : Intercepts file access at th...

BPFDoor-controller-source

BPFDoor-controller-source Source code to recent BPFDoor's controller variant Original: 2eacc8d91b9829b9606a7945fc5311fb5876cfb42ffccc1b91f61841237b04c1 Fixed: bpfdoorcontroller.c Original to fixed helper: formatfix.py Compile: root@kitploit: $ apt install libssl-dev $ gcc...

ltm

ltm Machine-history debugger for Linux. Records process, file, network, memory, and block I/O via eBPF, stores metadata in SQLite, and answers timeline / diff / plain-English / SQL questions about what happened on the box. ⚠️ Tracepoint-only capture today — recording currently uses tracepoint...

rootkit-detection-ebpf-time-trace

Rootkit Detection with eBPF Time Tracing This repository contains code to collect time measurements of kernel functions that are manipulated by rootkits when they hide files, as well as a semi-supervised detection method that analyzes shifts of kernel function execution times. This implementation...

SunnyDayBPF

SunnyDayBPF SunnyDayBPF is an eBPF-based post-syscall user-buffer telemetry deception research technique originally proposed and researched by Azizcan Dastan. The technique investigates whether data observed by user-space security, logging, or telemetry agents can be altered after a read-like...

tarian

Tarian Protege tus aplicaciones ejecutándose en Kubernetes de ataques maliciosos pre-registrando tus procesos confiables y firmas de archivos confiables. Tarian detectará procesos desconocidos y cambios en los archivos registrados, luego enviará alertas y tomará una acción automatizada. ¡Protege ...

CVE-2022-23222-POC

CVE-2022-23222 के लिए प्रूफ ऑफ कॉन्सेप्ट एक्सप्लॉइट कोड यह CVE 2022-23222 के लिए एक POC है, जो एक Local Privilege Escalation भेद्यता है। यह POC Ubuntu 20.04 और कर्नेल संस्करण 5.13.0-27-generic के लिए लिखा गया था, लेकिन अन्य कर्नेल संस्करण भी असुरक्षित हैं। एक्सप्लॉइट के विस्तृत विश्लेषण के लिए,...

CVE-2025-39913

CVE-2025-39913 - Linux Kernel eBPF SOCKMAP UAF 저자: Byte Reaper 내 플랫폼 :https://www.bytrep.com/ 설명 이 리포지토리는 Linux 커널의 tcpbpfsendverdict 함수에서 발생하는 CVE-2025-39913에 대한 기술적 PoCProof-of-Concept를 포함합니다. bpfmsgcorkbytes가 psock-cork를 할당하지 못하면 커널이 skmsg 해제를 건너뛸 수 있으며, 이로 인해 메모리 관리 오류가 발생합니다. 특정 eBPF skmsg...

CVE-2020-27194

CVE-2020-27194 mon exploit pour CVE-2020-27194, testé sur le noyau linux 5.8.14. Plus de détails : https://ama2in9.top/2020/12/14/CVE-2020-27194/ référence CVE-2020-8835 pwn2own 2020 ebpf 提权漏洞分析 CVE-2020-8835 pwn2own 2020 ebpf 通过任意读写提权分析...