Skip to content

Adding Linux sandbox detection capabilities - x64#21642

Open
litemars wants to merge 3 commits into
rapid7:masterfrom
litemars:add_linux_evasion_sandbox
Open

Adding Linux sandbox detection capabilities - x64#21642
litemars wants to merge 3 commits into
rapid7:masterfrom
litemars:add_linux_evasion_sandbox

Conversation

@litemars

@litemars litemars commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Description

This PR introduces a Linux x64 sandbox‑evasion module that performs lightweight runtime environment checks and aborts execution when a likely sandbox or VM is detected. The module runs before the payload and silently skips execution if the environment score crosses a suspicion threshold.

What is include:

  • Evasion sandbox_gate module
  • Mixin shellcode sandbox checks

Verification Steps

  1. use evasion/linux/x64/sandbox_gate
  2. set payload linux/x64/shell_reverse_tcp
  3. Set LPORT/LHOST - run

@litemars

litemars commented Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

Hi,

Let me know if you like the runtime checks, if you want I can expand it with other ideas that you might have, and later, I can expand it to x86 and arm64.

Cheers,
M

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

3 participants