Kali Linux

Chain-Reactor : An Open Source Framework For Composing Executables

Chain Reactor is an open-source tool for testing detection and response coverage on Linux machines. The tool generates executables that simulate sequences of actions like process creation and network connection. Chain Reactor assumes no prior engineering experience; the tool consumes JSON, so customizing its behavior is as simple as editing a file.

Install musl

Chain Reactor requires musl, which is an implementation of the C standard libary. To install musl on Debian-like operating systems, run the following from the command line:

sudo apt install musl-tools

To install musl from the RPM package manager:

sudo yum install musl-tools

To build musl from source:

git clone git://git.musl-libc.org/musl
cd musl && ./configure && sudo make install

Install Chain Reactor

To install Chain Reactor, run the following from the command line:

git clone https://github.com/redcanaryco/chain-reactor.git
cd chain-reactor && make

Run a simple reaction

Test your build by creating and executing a simple reaction. Open a text editor and save the following file as reaction.json:

{
“name”: “simple_reaction”,
“atoms”: [
“HIDDEN-PROCESS-EXEC”
]
}

Reactions are made of objectives called “atoms.” This file defines a reaction—simple_reaction—comprising a single atom called HIDDEN-PROCESS-EXEC.

Next, we need to define HIDDEN-PROCESS-EXEC. Save the following file as atoms.json:

[
{
“name” : “HIDDEN-PROCESS-EXEC”,
“execve” : [ “mkdir”, “-p”, “/tmp/.hidden” ],
“copy” : [ “/proc/self/exe”, “/tmp/.hidden/.chain_reactor_hidden” ],
“execveat” : [ “/tmp/.hidden/.chain_reactor_hidden”, “exit” ],
“remove” : [ “/tmp/.hidden” ]
}
]

Atoms are made of actions called “quarks.” The atoms.json file defines HIDDEN-PROCESS-EXEC as a sequence of four quarks:

  • Use the execve system call to create a hidden directory.
  • Copy the current Chain Reactor process to the hidden directory.
  • Use the execveat system call to execute the hidden Chain Reactor binary and exit without doing anything else.
  • Delete the hidden directory.

To build the reaction executable, run the following from the command line:

python3 compose_reaction atoms.json reaction.json simple-reaction

You can run the output file as you would any other executable:

+ymmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmy+
:dmmhsssssssssssssssssssssssssssssssssssssssshmmd/
dmm++mmm
mmm: :+oss+: :mmm
mmm: :oyyyyyyyys/ :mmm
mmm: .:oyyyyyyyyys::mmm mmm: -syyyyyyyyyyo: :mmm
mmm: -yyyyyyyyyyyyy+. :mmm
mmm: .syyyyyyyyyyyyyy/:mmm mmm:oyyyyyyyyyyyyyyys. :mmm
mmm: :yyyyyyyyyyyyyyyys- :mmm
mmm: +yyyyyyyyyyyyyyyyy: :mmm mmm:oyyyyyyyyyyyyyyyyy- :mmm
mmm: /yyyyyyyyyyyyyyyys- :mmm mmm: ./yyyyyyyyyyyyyyys /mmm mmm:/yysyyyyyyyyyyy+.:+oydmmmmm
mmm: ç-o- ...osyyyyyoydmmmmmmdyymmm mmm: :: `-:syhdhyyyyyhyo+:.` :mmm mmm: -o//+shdmmhhmdhyo/syyyo. :mmm mmm: `.-/oyyyddmmmdhyo/-.` `/yyys. :mmm mmm+:/oyhdmmmmmhys+/-.` -syys- :mmm mmmmmmmmdhs+:- .sy+-:mmm dmmd+:- .ss. +mmm :dmmhssssssssssssssssssssssssssssssssssyssssshmmd/ +hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmh+`
chain reaction “simple_reaction” 1001 1001
atom: HIDDEN-PROCESS-EXEC
quark: execve(“mkdir -p /tmp/.hidden”)
quark: copy src=”/proc/self/exe” dst=”/tmp/.hidden/.chain_reactor_hidden”
quark: execveat(“/tmp/.hidden/.chain_reactor_hidden exit”)
quark: remove(“/tmp/.hidden”)
chain reaction complete

R K

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

5 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

5 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

6 days ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

6 days ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

6 days ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

6 days ago