[ZanGetsu]

• Laptop left turned off with FDE turned on
  
• Attacker boots from USB/CD/Network
  
• Script executes and backdoors initrd
  
• User returns to laptop, boots as normal
  
• Backdoored initrd loads:
  
• (Debian/Ubuntu/Kali) .so file into /sbin/init on boot, dropping a shell
  
• (Fedora/CentOS) LD_PRELOAD .so into DefaultEnviroment, loaded globally, dropping a shell.
  

Supported Distros

• Ubuntu 14.04.3
  
• Debian 8.2.0
  
• Kali 2.0
  
• Fedora 23
  
• CentOS 7
  
• Current Features
  

python/meterpreter/reverse_https to compile time LHOST
FDE decryption password stored in meterpreter environment (getenv PASSWORD)

Download