How nadavazari/accepttunneling works
This is a process-injection tool that hijacks a listening service’s accept() GOT entry to relay specially marked connections to a remote endpoint, with a magic sequence intended to unhook it. The main workflow is explicit in main.c and the README; sampled code supports process discovery, ELF resolution, ptrace injection and relay behavior. Several injection details and the unhook branch are documented but their full implementation was not sampled, so uncertain internal links are omitted.
Main entry points: hook.c Hook orchestration · main.c CLI workflow · accept_hook.c accept GOT hook · got.c GOT resolution
Components 17
Target discovery
- CLI workflow
main.c - Listener PID lookup
proc/pid.c - Executable lookup
proc/exe.c
ELF resolution
- GOT resolution
elf/got.c - Symbol resolution
elf/sym.c - ELF loading
elf/load.c - Process mappings
proc/maps.c
Hook injection
- Hook orchestration
inject/hook.c - Target process control
inject/ptrace.c - accept GOT hook
hook/accept_hook.c - Hook configuration
include/hook/accept_hook.h
Traffic relay
- TCP relay
hook/accept_hook.c - Magic unhook
hook/accept_hook.c
Other components
- Operator
- Target service
- Marked client
- Tunnel destination
Connections 22
- Operator → CLI workflow: runs
- CLI workflow → Listener PID lookup: finds listener
- Listener PID lookup → CLI workflow: returns PID
- CLI workflow → Executable lookup: resolves executable
- CLI workflow → GOT resolution: finds accept GOT
- GOT resolution → ELF loading: loads ELF
- GOT resolution → Process mappings: gets load base
- CLI workflow → Hook orchestration: requests injection
- Hook orchestration → Symbol resolution: resolves libc symbols
- Symbol resolution → ELF loading: loads ELF
- Hook orchestration → Target process control: attaches and patches
- Hook orchestration → Process mappings: reads mapped libraries
- Hook orchestration → accept GOT hook: copies hook blob
- Hook orchestration → Hook configuration: writes config
- Target process control → Target service: writes target memory
- Target service → accept GOT hook: dispatches accept
- Marked client → accept GOT hook: sends magic
- accept GOT hook → TCP relay: runs relay
- TCP relay → Tunnel destination: connects and relays
- accept GOT hook → Target service: returns ordinary fd
- Marked client → Magic unhook: sends kill magic
- Magic unhook → Target service: restores GOT entries