HackTricks-wiki · carlospolop · Sep 2, 2026
diff --git a/src/linux-hardening/post-exploitation/linux-post-exploitation/README.md b/src/linux-hardening/post-exploitation/linux-post-exploitation/README.md
@@ -150,6 +150,39 @@ Hardening
 - Overwrite the in-memory `argv[0]` buffer after reading `/proc/self/cmdline` length and the `argv[0]` pointer, padding with NULs so `/proc/<pid>/cmdline` and `ps` also show the fake label.
 - Hunt by comparing `Name:` in `/proc/<pid>/status` against the real executable path and looking for loopback mutex listeners owned by processes with tiny/blank cmdlines.
 
+## Process-event-driven credential interception with `ptrace`
+
+A post-root interceptor can subscribe to Linux process events through a netlink connector, select newly executed authentication programs, and attach a tracer only when a target appears. The open-source 3snake implementation traces `read`/`write` activity in `sshd` and `sudo`; the same pattern can cover `su`, `doas`, `ssh`, `ssh-add`, `passwd`, `kinit` and `login`, then extract candidate credentials from process memory before encrypting or exfiltrating them. Event-driven attachment is quieter and more reliable than continuously polling `/proc`.<sup>[[10]](#references)[[11]](#references)</sup>
+
+This requires root or suitable tracing capability/policy, a mounted procfs, and working `ptrace`. A restrictive `kernel.yama.ptrace_scope` reduces unprivileged tracing but does not protect a host from an interceptor that already has root or `CAP_SYS_PTRACE`.<sup>[[10]](#references)[[12]](#references)</sup>
+
+Hunt for both the process-event subscription and the short-lived attachments. `TracerPid` is only useful while a target is attached, so audit or eBPF telemetry for `ptrace(2)` is much stronger than a one-time snapshot.<sup>[[11]](#references)[[12]](#references)</sup>
+
+```bash
+sysctl kernel.yama.ptrace_scope
+ss -a -f netlink -p                         # Unexpected process-connector subscribers
+for p in /proc/[0-9]*/status; do awk '$1=="TracerPid:" && $2!=0 {print FILENAME, $0}' "$p"; done
+sudo auditctl -a always,exit -F arch=b64 -S ptrace -k ptrace_watch
+sudo auditctl -a always,exit -F arch=b32 -S ptrace -k ptrace_watch 2>/dev/null
+sudo ausearch -k ptrace_watch -i
+```
+
+Prioritize a tracer whose executable path does not match its displayed `comm`/`argv`, attaches to several authentication binaries, or runs under a kernel-thread-looking name from a normal user-space ELF.<sup>[[11]](#references)</sup>
+
+## Hiding a process by masking `/proc/<pid>`
+
+With mount privileges, an implant can bind-mount another directory over its own `/proc/<pid>` subtree. Tools that depend on that procfs entry may then fail to resolve the process executable, command line, maps or descriptors even though the task still runs. This can be combined with `prctl`/`argv` masquerading without loading a kernel module, but the mask is scoped to the mount namespace in which it was created.<sup>[[11]](#references)</sup>
+
+Inspect the current mount namespace first, then every accessible process mount namespace because `findmnt` alone does not reveal masks isolated elsewhere.<sup>[[11]](#references)</sup>
+
+```bash
+findmnt -rn -o TARGET,SOURCE,FSTYPE | awk '$1 ~ "^/proc/[0-9]+$"'
+grep -HEn ' /proc/[0-9]+ ' /proc/[0-9]*/mountinfo 2>/dev/null
+for ns in /proc/[0-9]*/ns/mnt; do readlink "$ns"; done 2>/dev/null | sort | uniq -c
+```
+
+A per-PID mount is highly unusual. Correlate it with the namespace owner, `readlink /proc/<pid>/exe`, cgroup/unit membership and kernel process telemetry before unmounting it for analysis.<sup>[[11]](#references)</sup>
+
 ## Kernel-resident passive backdoors via BPF (BPFDoor-style)
 
 Some Linux backdoors avoid exposing any listening port by attaching a malicious **BPF socket filter** to a raw or packet socket. The implant stays passive, inspects inbound traffic in the kernel path, and only spawns a bind/reverse shell when a controller sends the correct trigger. This means `netstat`, `ss`, and `nmap` can look normal until activation.<sup>[[6]](#references)</sup>
@@ -203,5 +236,8 @@ If the host supports `bpftool`, also baseline legitimate BPF usage. Unexpected p
 - [7] [Rapid7 Labs - Linux BPFDoor Detection Script](https://github.com/rapid7/Rapid7-Labs/tree/main/BPFDoor)
 - [8] [Embrace The Red – Post Exploitation: Sniffing Logon Passwords with PAM](https://embracethered.com/blog/posts/2022/post-exploit-pam-ssh-password-grabbing/)
 - [9] [Creating a Backdoor in PAM in 5 Line of Code](https://infosecwriteups.com/creating-a-backdoor-in-pam-in-5-line-of-code-e23e99579cd9)
+- [10] [3snake - dump sshd and sudo credential-related strings](https://github.com/blendin/3snake)
+- [11] [Gaming the System: How a Chinese-Speaking Actor Turned Brazilian Government Sites into an SEO Weapon](https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/)
+- [12] [`ptrace(2)` Linux manual page](https://man7.org/linux/man-pages/man2/ptrace.2.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/apache.md b/src/network-services-pentesting/pentesting-web/apache.md
@@ -45,6 +45,52 @@ curl -sk https://target/server-info?config | grep -E 'ProxyPass|ProxyPassMatch|S
 Remember that `server-info` doesn't list `.htaccess` directives, so missing rules there doesn't prove a directory is clean.
 If you can upload or edit `.htaccess`, `mod_status` and `mod_info` become interesting again when `AllowOverride FileInfo` lets you use `SetHandler`. For CGI or WebDAV follow-up, see [CGI Pentesting](cgi.md) and [WebDav](put-method-webdav.md).
 
+## Malicious Apache modules: trusted-origin proxying and response injection
+
+After gaining root, an attacker can use Apache's own `apxs -i -a -c module.c` workflow to compile a DSO, copy it into the module directory and add its `LoadModule` entry. A module registered in the name-translation phase can inspect every request and turn only selected URI prefixes into `proxy:` requests for an attacker-controlled upstream. The browser still addresses the compromised origin, while forwarding the original `Host` header makes the upstream request look consistent with that origin.<sup>[[12]](#references)[[13]](#references)</sup>
+
+A second implant pattern combines request hooks with an output filter: match on URI, referrer, User-Agent, arbitrary headers or client IP; retrieve remote content; then modify Apache bucket brigades before the response is sent. This supports crawler-only SEO content or HTML insertion near a marker such as `<body>`. The filter can also delete the legitimate `Content-Security-Policy` header and install a permissive replacement. This is **server-side policy removal**, not a browser CSP parsing bypass: the browser never receives the site's original policy.<sup>[[12]](#references)[[14]](#references)</sup>
+
+A practical deployment may enable legitimate dependencies such as `proxy`, `headers` and `rewrite`, delete source/build files, and copy timestamps from normal modules to both the malicious `.so` and its load configuration. Therefore, filenames and modification times alone are weak trust signals.<sup>[[12]](#references)</sup>
+
+### Module and artifact audit
+
+Dump the runtime module set first: `httpd -M` (or the distribution's `apachectl -M`) includes both statically and dynamically loaded modules. Then correlate each `LoadModule` entry with its binary, package ownership, hash and filesystem metadata.<sup>[[12]](#references)[[15]](#references)</sup>
+
+```bash
+apachectl -M 2>/dev/null || apache2ctl -M 2>/dev/null || httpd -M 2>/dev/null
+grep -RInE '^[[:space:]]*LoadModule' /etc/apache2 /etc/httpd /usr/local/apache2/conf 2>/dev/null
+find -L /usr/lib/apache2/modules /usr/lib64/httpd/modules /etc/httpd/modules /usr/local/apache2/modules -type f -name '*.so' -print0 2>/dev/null |
+  while IFS= read -r -d '' so; do
+    stat -c '%n | mode=%a uid=%u gid=%g | mtime=%y | ctime=%z' "$so"
+    sha256sum "$so"
+    dpkg-query -S "$so" 2>/dev/null || rpm -qf "$so" 2>/dev/null || echo "UNOWNED: $so"
+  done
+```
+
+Treat an old `mtime` paired with a much newer `ctime`, an unowned DSO, a package verification failure, or a new load file as a pivot—not standalone proof. For suspicious modules, imports/strings can expose HTTP clients, hardcoded upstreams, encrypted rule blobs and response-injection placeholders.<sup>[[12]](#references)</sup>
+
+```bash
+readelf -d /path/to/module.so | grep -E 'NEEDED|curl|ssl|crypto'
+strings -a /path/to/module.so | grep -Ei 'https?://|libcurl|RC4|proxy:|content-security-policy|\{host\}|\{url\}|<body'
+dpkg -V apache2 apache2-bin 2>/dev/null || rpm -V httpd 2>/dev/null
+grep -RInE '/wps|/bmw|/card|/jogos|/nova' /var/log/apache2 /var/log/httpd 2>/dev/null
+```
+
+### Detect conditional cloaking
+
+Fetch the same URL with different crawler/browser identities, referrers and—where possible—source networks; compare status, headers, body length and hashes. Differences in CSP, injected markup or upstream-themed content that cannot be explained by normal personalization are high-signal findings.<sup>[[12]](#references)</sup>
+
+```bash
+url='https://target/suspected-path'
+curl -skD browser.h -o browser.b -A 'Mozilla/5.0' -e 'https://target/' "$url"
+curl -skD crawler.h -o crawler.b -A 'Googlebot/2.1 (+http://www.google.com/bot.html)' "$url"
+sha256sum browser.b crawler.b
+wc -c browser.b crawler.b
+diff -u browser.h crawler.h
+diff -u browser.b crawler.b
+```
+
 ## CVE-2021-41773
 
 ```bash
@@ -434,5 +480,9 @@ If you find `AddType` instead of `SetHandler` / `AddHandler`, compare direct req
 - [9] [Apache 0day bug, which still nobody knows of, and which was fixed accidentally (Max Dmitriev, ZeroNights 2021)](https://web.archive.org/web/20210909012535/https://zeronights.ru/wp-content/uploads/2021/09/013_dmitriev-maksim.pdf)
 - [10] [Docker PHP LFI Summary (Phith0n)](https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp)
 - [11] [RFC 3875 section 6.2.2 – Local Redirect Response](https://datatracker.ietf.org/doc/html/rfc3875#section-6.2.2)
+- [12] [Gaming the System: How a Chinese-Speaking Actor Turned Brazilian Government Sites into an SEO Weapon](https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/)
+- [13] [Apache `apxs` - APache eXtenSion tool](https://httpd.apache.org/docs/2.4/programs/apxs.html)
+- [14] [Apache guide to writing output filters](https://httpd.apache.org/docs/2.4/developer/output-filters.html)
+- [15] [Apache `httpd` command-line options](https://httpd.apache.org/docs/2.4/programs/httpd.html)
 
 {{#include ../../banners/hacktricks-training.md}}