Adding Linux sandbox detection capabilities - x64

[litemars]

Description

This PR introduces a Linux x64 sandbox‑evasion module that performs lightweight runtime environment checks and aborts execution when a likely sandbox or VM is detected. The module runs before the payload and silently skips execution if the environment score crosses a suspicion threshold.

What is include:

• Evasion sandbox_gate module
• Mixin shellcode sandbox checks

Verification Steps

1. use evasion/linux/x64/sandbox_gate
2. set payload linux/x64/shell_reverse_tcp
3. Set LPORT/LHOST - run

[litemars]

Hi,

Let me know if you like the runtime checks, if you want I can expand it with other ideas that you might have, and later, I can expand it to x86 and arm64.

Cheers,
M

[jbx81-1337]

Code looks good! I'll give it a shot and try it soon. Thanks for your PR! 🙏

[litemars]

Hi @jbx81-1337,

Did you have the chance to test it out? Shall I commit also the 32 bit version? And the arm64?

Cheers,
M

[dledda-r7]

by x64 convention, you need to make sure you are saving this registers:

RBX, RBP, RDI, RSI, or R12–R15

Pushing them on the start and popping them back should do the work.

[litemars]

Fair point, I have not added this functionally since this module is the first one called/run - but, yes, I can add it for completeness

[dledda-r7]

I have tested it but seems is having issue with big payloads.. is this a technique limitation?

i am having segault with linux/x64/meterpreter_reverse_tcp

[litemars]

I don't have any issue if I am using it with a big payload - would you mind proving me the error/stack trace?

[litemars]

@dledda-r7, it looks like the problem is that linux/x64/meterpreter_reverse_tcp payload is a full ELF, while other payloads, such as linux/x64/shell_reverse_tcp, are shellcode

[litemars]

The payloads that directly create an ELF use the in_memory_load module. An option is to jump directly to that function once one of these payloads is used. Note that in_memory_load contains the shellcode version, so it can be executed easily. I don't think it's the best option - but let me know what you think!

[litemars]

Hi @dledda-r7,

Now it looks much better, it works with all payloads. I think a 1 was missing in your previous commit.

The line is now set to:
'DefaultOptions' => { 'PayloadLinuxMinKernel' => '3.17' }