TAS - A Tiny Framework For Easily Manipulate The Tty And Create Fake Binaries

A tiny framework for easily manipulate the tty and create fake binaries.

How it works?
The framework has three main functions, tas_execv, tas_forkpty, and tas_tty_loop.

• tas_execv: It is a function similar to execv, but it doesn't re-execute the current binary, something very useful for creating fake binaries.
  
• tas_forkpty: Is the same as forkpty, but it fills a custom structure, check forkpty man page for more details.
  
• tas_tty_loop: here is where the manipulation of the tty happen, you can set a hook function for the input and output, so it is possible to store the keys typed by the user or manipulate the terminal output. (see leet-shell).
  

This is a superficial overview, check the codes in tas/fakebins/fun folders to understand how it really works.

Fakebins
Through manipulation of the PATH environment variable, or by using bash's aliases (or any other shell that supports aliases), you can run another program instead of the program that the user usually runs. This makes it possible to capture keystrokes and modify the command line to change the original program behavior.
Change the command line of some programs, like sudo and su, can lead to privilege escalation.
I'd created three programs as an example of what you can do with the framework: sudo, su and generic-keylogger.

generic-keylogger
The generic-keylogger, as the name suggests, is a binary that acts like a keylogger, the main idea is to use it to get passwords of programs like ssh, mysql, etc.

sudo/su
It can be used as a keylogger, or you can run some of the modules as root, by manipulating the command line.

Step-by-step cmd change:
The user types sudo cmd
fakesudo cmd runs
The fakesudo executes sudo fakesudo cmd
After it is running as root, the fakesudo create a child process for executing some of the modules, and in the main PID, it runs the original command.

Note: fakesudo only changes the command if the user runs sudo cmd [args], if some additional flags are used, then the command isn't touched.

Almost the same process happens with the su:
The user types su -
fakesu - runs
The fakesu executes su - -c fakesu
After it is running as root, the fakesu create a child process for executing some of the modules, and in the main PID, it runs bash -i

Note: fakesu only changes the command if the user runs su or su -, if some additional flags are used, then the command isn't touched.

Modules
For now, there are only three modules:

• add-root-user - creates a root user with password in /etc/passwd.
• bind-shell - listen for incoming connections and spawn a tty shell.
• system - executes a command as root.

I can add more modules in the future, but if you are familiar with the C language, I believe that it is not very difficult to change the programs to run what you want as root, just modify a few lines of code and change the super() function.

Building
First, build the base library:
After that, you can build generic-keylogger, sudo or su, by running make [target-bin]
Example:

Examples

Creating a fakessh:
Compile:
Install:
In action:

Using the bind-shell module
Compile:
Install:
In action:

leet-shell
leet-shell is an example of how you can manipulate the tty output, it allows you to use the bash like a 1337 h4x0r.