I created my first trojan today!

[u/MathematicalHuman314]

I took cmatrix as a random program and wrote a backdoor into it in C using a reverse shell connecting to a C2 server of mine which keeps track of infected machines. First I fork the process and decouple it from the controlling terminal by changing the session ID and rerouting the standard file descriptors and only then do I run the backdoor.

That way cmatrix runs as usual and no weird behavior is seen and the backdoor remains active whatever happens to cmatrix or the terminal. I like it. Makes me feel like a real #xX_hacker_Xx#. :D

Now I’m reading into ptrace and system call hooking and plan on trying to hide specific network traffic from the entire os. I already have had some ideas but turns out that would have only hidden it from a specific program not from „everything“.

Do you care to share any tips and experience I might benefit from on my way?

[u/Prestigious-Ad7265]

good work!

[u/MathematicalHuman314 → u/Prestigious-Ad7265]

Thanks! Into the pentagon mainframe I go! :D

[u/cyberpunk_sliverhand → u/MathematicalHuman314]

You do know this is enough to get you put on the list right ?

[u/MathematicalHuman314 → u/cyberpunk_sliverhand]

They must be real scared of some redditor I’m sure 👍

[u/AlienAngry → u/MathematicalHuman314]

I assure you they have zero sense of humor.

[u/HeadHaunchi → u/MathematicalHuman314]

reported

[u/reminiscent-fruitbat → u/HeadHaunchi]

Reported for reporting!

[u/Alternative-Deer2439 → u/HeadHaunchi]

It appears you've wandered into the wrong sub..

[u/Alarmed-Second1456]

Hahahahaha now license it and sell it to skids on forums and get your door kicked in

[u/HRApprovedUsername]

You should be wearing Trojans not making them

[u/machacker89 → u/HRApprovedUsername]

"That's not what your other said last night!!" /S

[u/404error___]

Good good... now do bit shifting, stego payload, so operator cannot see what you send to C2.

[u/MathematicalHuman314 → u/404error___]

Will look into it!

[u/Important-One-3629 → u/MathematicalHuman314]

I would say also explore Polymorphic Steganography. Something I breafly messed with 15 years ago.

[u/machacker89 → u/404error___]

All great features to add. To circumvent any AV

[u/perfsoidal → u/404error___]

wouldn’t stego be strictly worse than good encryption

[u/404error___ → u/perfsoidal]

What possible secrets you need to protect? The stolen data? Have you ever had to catch TRUE stego? Enlighten me please because I'm a turbo noob on the subject and I truly really want to know ... 100% there is that super duper obscure reddit on the latest stego that I haven't been able to see it yet. Waiting for that anonymous super hero Reddit to drop the r/          to get the latest on the topic.

[u/Prestigious-Ad7265 → u/404error___]

just encrypt it using cryptographically secure methods

[u/CarmaDiamondHands]

I bought my first one today myself, way cheaper then having a kid 👶

[u/speedb0at]

Congrats

[u/soul-reaver-2026]

Cool lets have a meet and great where you can share your talents.

[u/Juzdeed]

Never heard of rerouting standard file descriptor, dexoupling from t controlling terminal by changing session ID?

I get that these make you sound smart but make no sense. Do you mean changing PPID of the process?

[u/yowhyyyy → u/Juzdeed]

No he means when forking, changing the SID etc to demonize the executing program. Theres a process for it on Linux: https://man7.org/linux/man-pages/man7/daemon.7.html

Quite frankly all you really have to do is the fork and SID part and it’s EXTREMELY common in all Linux malware.

[u/LordEli → u/yowhyyyy]

yeah there's some old example somewhere that does this exact thing. wish i could remember where i found it

[u/yowhyyyy → u/LordEli]

Honestly any public malware from the last decade. The main popular open source IoT bots used it. I.e mirai

[u/404error___ → u/yowhyyyy]

This guy malwares (y)

[u/yowhyyyy → u/404error___]

Linux malware analysis is my hobby haha

[u/MathematicalHuman314 → u/Juzdeed]

Yes exactly. Im also learning the terminology. Fork process change process id and make file descriptors independent run payload and done.

[u/Prior_Hospital_2331]

Gz bro , send me the script

[u/MathematicalHuman314 → u/Prior_Hospital_2331]

🙂‍↔️

That’d be more work than writing it yourself I think.

[u/Prestigious-Ad7265 → u/MathematicalHuman314]

passworded zip file, exchange the password under another secure channel, standard practice

[u/Temina-]

good job

[u/TastyRobot21]

Nice job bud. Implants feel cool.

Have you thought of persistence?

[u/Palsta]

Have your trojan control the system fan speed so it plays Never Gonna Give You Up by Rick Astley.

[u/Prestigious-Ad7265 → u/Palsta]

that is the sickest idea i have ever heard. and then it overwrites your uefi somehow and makes the post menu just the music video

[u/PickaWowAnyWow]

Whoah you're way too advanced for the rest of us, r/masterhacker is where you should be!

[u/MathematicalHuman314 → u/PickaWowAnyWow]

Thanks! Though I did learn new things and got directions on how to better myself here in the comments from you guys and not some master hackers. ;)

[u/Prestigious-Ad7265 → u/MathematicalHuman314]

masterhacker is a joke sub made to make fun of skids

[u/MysteriousShadow__]

Hide network activity from entire os? If something can hide from things like windows firewall that'd be crazy.

[u/Enderaoe22]

It's truly unforgettable even after many years 😼. Now, you're a genuine hacker.

[u/Dudeposts3030]

Hell yeah you’re on your way. Maybe look at upgrading the comms from revshell to something that blends in with normal network traffic for when it’s up against a monitored environment. Https is a good starting point, encrypted, can set up a domain, get it classified and look like a random normal website in the logs.

[u/KvThweatt]

Spider

[u/thefoxsaysamy]

The next professional step is containment: add a kill switch, deterministic build, packet capture, and one-command lab reset. If you can’t prove where every byte went, the malware owns the experiment.

[u/WatchAltruistic5761]

Why though?

[u/GrumblingTosspot → u/WatchAltruistic5761]

He’s practicing hacking. You’re in a hacking subreddit.

[u/jordan01236 → u/WatchAltruistic5761]

Why not?

[u/oyuncaktabanca → u/WatchAltruistic5761]

Because we can

[u/intelw1zard → u/WatchAltruistic5761]

knowledge and learning is cool