Process injection backdoor tool Cymothoa
Process injection backdoor tool Cymothoa
Cymothoa is a secret backdoor tool. It gets the same permissions as the original process by injecting malicious code into the active process of the target host. The biggest advantage of this tool is that it does not create new processes and is not easy to find. Because the tool is based on ptrace library, it is suitable for all kinds of Unix systems. The tool provides 14 attack payloads and can implement a variety of attacks and backdoors. Because the backdoor is based on process injection, when the original process ends, the backdoor will also be closed. Therefore, penetration testing must be combined with self-startup scripts and injected into self-startup services (such as Web services) in order to make Cymothoa scripts permanent.
