The article analyzes BPFDoor-derived implants (icmpShell/httpShell and multiple Rapid7 variants) that use custom BPF filters, protocol sniffing, and protocol-tunneling C2 to achieve stealthy remote shells and persistence. It highlights key artifacts such as the RC4 key “icmp”, hardcoded ICMP Sequence Number 1234, and active beaconing domains that masquerade as NTP-over-SSL. #BPFDoor #icmpShell
Keypoints
- icmpShell implements an ICMP-based PTY tunnel where attacker commands are sent in cleartext prefixed with “X:” and victim PTY output is RC4-encrypted with the hardcoded key “icmp”.
- Rapid7 identified multiple new BPFDoor variants (F–L) that introduce new magic bytes, BPF filters, multi-protocol sniffing, timestomping, FD wipes, and directory/filename hiding under /var/run/user/0.
- Variant G uses a three-thread, protocol-specific raw-socket design (TCP/UDP/ICMP) with identical BPF filters to ensure trigger redundancy and C2 resiliency across transport protocols.
- Variant H implements an active beacon that resolves and connects to dynamic DNS C2 domains (e.g., ntpussl.instanthq.com) over port 443, masquerading as NTP-over-SSL to bypass stateful firewalls.
- Several operational stealth techniques were observed: process name masquerading (e.g., cmathreshd, hpasmlited), unsetenv(“LD_PRELOAD”) to evade user-mode hooks, AF_PACKET/SOCK_DGRAM use for kernel-decapsulated parsing, and magic-byte traffic signaling.
- Detection guidance emphasizes monitoring for structural/network markers (hardcoded ICMP seq=1234, invalid ICMP Code 1, AF_PACKET socket creation, active BPF filters) rather than payload content alone.
- Some variants support ICMP relay and proxying to enable lateral movement and bidirectional PTY tunnels without embedding C2 IPs in packet payloads; icmpShell also self-terminates after 12s of inactivity for surgical access.
MITRE Techniques
- [T1059.004 ] Unix Shell – Hijacks a pseudo-terminal (PTY) utilizing fork() and dup2(). (‘Hijacks a pseudo-terminal (PTY) utilizing fork() and dup2().’)
- [T1036.004 ] Masquerading – Alters process arguments and process name to mimic benign daemons (e.g., cmathreshd, qmgr, hpasmlited) to avoid detection. (‘Alters process arguments to mimic benign daemons like qmgr.’)
- [T1070.003 ] Clear History – Removes or redirects shell history by setting HISTFILE=/dev/null to avoid leaving command traces. (‘Injects HISTFILE=/dev/null into environment variables.’)
- [T1027 ] Obfuscated Files or Information – Uses stack strings and other packing/obfuscation to hide passwords, paths, and static markers from simple static analysis. (‘Stack strings for passwords and paths prevent static extraction.’)
- [T1564 ] Hide Artifacts – Employs AF_PACKET sniffing and FD wiping/timestomping to hide network hooks and filesystem artifacts from local inspection. (‘Uses AF_PACKET sniffing to remain invisible to local netstat/ss.’ )
- [T1205 ] Traffic Signaling – Uses magic bytes and flags (e.g., 0xFFFFFFFF, custom magic bytes) as wake-up triggers and signaling for implant activation. (‘Employs magic bytes and flags like 0xFFFFFFFF as wake-up triggers.’)
- [T1573.001 ] Symmetric Cryptography – Encrypts PTY output with RC4 using a hardcoded ICMP key and enforces an “X:” plaintext tag for commands. (‘Enforces the X: plaintext tag and encrypts the underlying PTY output via an RC4 cipher (using the hardcoded ICMP key).’)
- [T1071.001 ] Application Layer Protocol: Web Protocols – Some variants use formatted HTTP POSTs with hardcoded URIs and large hex bodies to blend C2 in HTTP traffic (httpShell). (‘Blends in by utilizing formatted HTTP POST requests with hardcoded URIs up to 100-byte hexadecimal bodies.’)
- [T1095 ] Non-Application Layer Protocol – Uses crafted ICMP Echo Requests/Echo Replies to exfiltrate and tunnel shell sessions (icmpShell). (‘Transmits exfiltration via crafted ICMP Echo Requests.’)
- [T1090 ] Proxy – Implements ICMP relay and proxying to bounce traffic through internal segments and uses cross-protocol BPF sniffing to fall back between TCP/UDP/ICMP. (‘Uses ICMP relay to bounce traffic through internal segments.’ / ‘The BPF filter concurrently sniffs TCP, UDP, and ICMP…the attacker can seamlessly utilize an alternate protocol to trigger the shell.’)
- [T1001 ] Data Obfuscation – Encodes session metadata inside network-layer fields (e.g., PID in ICMP Identifier, hardcoded ICMP Sequence Number 1234) to hide tracking data. (‘icmpShell hides its tracking mechanisms directly inside the network layer headers…injecting it into the 16-bit ICMP Identifier field, and hardcoding the ICMP Sequence Number to 1234.’)
- [T1572 ] Protocol Tunneling – Implements ICMP tunneling to carry interactive shell traffic and to tunnel other protocol sessions. (‘ICMP tunneling’)
Indicators of Compromise
- [Hashes ] sample binaries and implants – 2cc90edd9bc085f54851bed101f95ce2bace7c9a963380cfd11ea0bc60e71e0c, de472ed37e33b79e1aa37e67a680ee3a9d74628438c209543a06e916a0a86fba, and several other hashes (e.g., ed768dd9…, ca5662…, 9ee77e…) referenced in samples.
- [Domains ] active beacon and masquerade C2s – ntpussl.instanthq.com, ntpupdate.ddnsgeek.com, and other DDNS domains like ntpupdate.ygto.com, ntpd.casacam.net.
- [File paths ] local hiding and persistence – /var/run/user/0 (BPFDoor runs hidden here), /var/run/cma.lock (HPE variant checks/kills HP agent if present).
- [Process names ] masqueraded or spoofed services – cmathreshd (HPE masquerade), hpasmlited (process name spoofing), and other common daemon names like qmgr used as decoys.
- [Network markers ] protocol/packet artifacts – hardcoded ICMP Sequence Number 1234, ICMP plaintext tag “X:”, technically invalid ICMP Code 1 in heartbeat, and RC4 key “icmp”.
- [Credentials/magic values ] trigger/password artifacts – magic password dP7sRa3XwLm29E (variant I), magic bytes such as 0xA9F205C3 and flags like 0xFFFFFFFF used in BPF/trigger logic.
- [Ports & sockets ] network endpoints and socket types – TCP port 443 (active beacon), TCP port 9999 (variant I handshake), and creation of raw sockets (SOCK_RAW/SOCK_DGRAM AF_INET sockets) / AF_PACKET usage monitored on hosts.
Read more: https://www.rapid7.com/blog/post/tr-new-whitepaper-stealthy-bpfdoor-variants