Cymothoa

Cymothoa enables stealthy backdoors by injecting shellcode into running processes without creating new detectable processes. This makes it useful for post-exploitation scenarios where maintaining persistence discreetly is critical. The tool targets memory regions with specific permissions, ensuring the shellcode executes reliably within the host process.

Use cases include red team operations, penetration testing, and research into process injection techniques. It supports various shellcode payloads, such as reverse shells and bind shells, configurable via command-line arguments. Cymothoa is particularly effective on Linux systems due to ptrace availability.

The tool includes companion utilities like bgrep for binary pattern searching and udp_server for UDP-based interactions with certain payloads.

Cymothoa leverages the ptrace library to attach to a target process by PID, then injects shellcode into a memory region with 'r-xp' permissions (default /lib/ld). It allocates persistent memory in 'rw-p' regions for data storage. Payload execution can use threading, forking, or alarm scheduling, with options to customize behavior like timers, IP/port binds, and authentication.