prism - PRISM is an user space stealth reverse shell backd

项目说明

Prism backdoor

PRISM is an user space stealth reverse shell backdoor. The 代码 is a on GitHub.

It has been fully tested on:

* Linux
* Solaris
* AIX
* BSD/Mac
* Android

PRISM can works in two different ways: ICMP and STATIC mode.

ICMP mode

Using this operation mode the backdoor waits silently in background for a specific ICMP packet
containing the host/port to connect back and a private key to prevent third party access.

* First, run netcat on the attacker machine to wait for incoming connection from the backdoor:

* Using the sendPacket.py script (or another packet builder) send the acti packet to the backdoor:

192.168.0.1 is the machine running prism backdoor
p4ssw0rd is the key
192.168.0.10 is the attacker machine address
6666 is the attacker machine port

* The backdoor will connect back to netcat!

STATIC mode

Using this operation mode the backdoor try to connects to an hard-coded IP/PORT.
In this case, just run netcat listening on the hard-coded machine/port:

Features

* Two operating modes (ICMP and STATIC)
* Runtime process renaming
* No listening ports
* Automatic iptables rules flushing
* Written in pure C
* No library dependencies

Get the code

Configuration

Before building, you have to configure the backdoor editing the 源码 代码.
Following the configuration parameters description:

STATIC mode:
*RE*: Machine address to connect back
*RE*: Machine port to connect back
*RESPAWN_DELAY*: Time, in seconds, between each connection

ICMP mode:
*ICMP_KEY*: Key/Password to activate the backdoor

Generic parameters:
*MOTD*: Message to be printed at the backdoor connection
*SHELL*: Shell to execute
*PROCESS_NAME*: Fake process name

Building

gcc <..OPTIONS..> -Wall -s -o prism prism.c

A GCC options:
-DDETACH #Run the process in background
-DSTATIC #Enable STATIC mode (default is the ICMP mode)
-DNORENAME #Doesn't renames the process
-DIPTABLES #Try to flush all iptables rules

Example:
gcc -DDETACH -DNORENAME -Wall -s -o prism prism.c

Cross Compiling

* Linux 64bit (using a 32bit host system)
apt-get install libc6-de
gcc -DDETACH -m64 -Wall -s -o prism prism.c

* Linux 32bit (using a 64bit host system)
apt-get install libc6-de
gcc -DDETACH -m32 -Wall -s -o prism prism.c

Backdoor building information

The backdoor ignore any command line parameter, except the Inf0 (the last char is a digit).
This option allow you to see some information about the backdoor:

项目信息

开发语言：C

Star 数：488

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PRISM is an user space stealth reverse shell backdoor, written in pure C.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。