Skip to content

Instantly share code, notes, and snippets.

@RC1140

RC1140/eBPFOverwrite

Created November 5, 2020 08:49
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save RC1140/f4b37aa11b8a28e06616df5258077529 to your computer and use it in GitHub Desktop.
Save RC1140/f4b37aa11b8a28e06616df5258077529 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
eBPFOverwrite
sudo bpftrace -e 'k:__x64_sys_getuid /comm == "id"/ { override(99); }' --unsafe -c /usr/bin/id
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment