LD_PRELOAD libc hooking using Go
This is an experiment to use Go in a shared library to wrap a libc function and start a TCP server (a 'backdoor') allowing arbitrary commands to be run from a client such as telnet or netcat.
This is a toy intended for educational purposes to demonstrate some of Go's capabilities.
Works on Linux only and requires Go version 1.5 or above in order to build the shared library.
In writing this, I have four aims:
to try out Go's new build modes, which allow Go to be compiled to a shared library that can be called from C
to experiment with
to experiment with calling C from Go
to learn some C ;)
As this is an experiment, the backdoor will only listen on localhost.
GO15VENDOREXPERIMENT=1 go build -buildmode=c-shared -o backdoor.so main.go LD_PRELOAD=./backdoor.so top
In a separate console, while
top is running:
nc localhost 4444 [...type your commands here...]
- Only works on Linux
- Only works with binaries that call libc's
strrchrfunction. I'd ideally like to hook
__libc_start_maininstead. The binaries I tested with are
topas provided by Ubuntu Trusty LTS.