Linux Backdoor Deep Dive (Part 2)

In this [RE]laxing new series, I fully reverse a Linux Backdoor (BPFDoor) from start to finish. In Part 2, we fix and label strings related to setting up socket connections, and even manage to find some IPTables shell commands!

These extensive "Deep Dive" segments concentrate on dissecting malware specimens and delving into the individual approaches employed to fully reverse them. Throughout the journey, I attempt to provide explanations of my techniques as much as possible, however, if any ambiguities arise, please feel free to post a comment below.

---

Timestamps:
00:00 Intro
00:50 Begin Ghidra Analysis
01:40 Socket Connections
04:15 htons
06:21 setscokopt
07:23 recvfrom
10:09 Forking
14:38 Swapping Values
16:20 INET_ntoa
18:26 justtryit
21:00 Working through the funtion
23:28 Fixing Incorrectly Typed Arrays
25:30 Setting IP Tables
27:03 Recap

---

Software Links Mentioned in Video:
---
Malware Examined in the video (BPFDoor):
sha256:fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a

MalwareBazaar Link:

---
laurieWIRED Twitter:

laurieWIRED Website:

laurieWIRED Github:

laurieWIRED HN:

laurieWIRED Reddit:

[fabioschmidt]

Just wanted to say, that I am really grateful to you for making these videos. It helps me a lot on my journey.

[directrix]

Hehe... backdoor deep dive... Hehe... Ok, I'll escort myself out. But this is neat seeing how this is done.

[HosRo]

Intriguing... much more fun than watching a generic gumshoe TV show! On to part 3...

[SIGSEGV]

it's like filling out a coloring book but with machine code

[frankjansson]

Thanks for another good and informative video. It is indeed exciting.

[ChristopherBruns-oo]

Her hair looks great in this video. Although distracting - Noice...

[JohanIdstam]

Could you make a video redoing this using your ghidraMCP? edit: thanks A LOT for your videos.