injecso.c0000777000000000000000000001365611145676106011403 0ustar rootroot/** * \file injecso.c * * \brief InjecSO - Shared object injection into processes under Linux * \brief Main Program * \version 1.0 * * \author Emilien Girault (Trance) * \author www.emiliengirault.fr - www.ghostsinthestack.org * \date 2009/02/13 * */ #define VERSION "1.0" #include #include #include #include #include //Use on old Linux distributions #include //Delta between the end of shellcode and the old value of %eip. //Experimentally, any value >=2 seems working #define DELTA_SHELLCODE_EIP_BAK 4 //Import labels defined in shellcode.s void shellcode_code(void); void shellcode_code_end(void); /** * \brief Check parameters * \param argc Argument count * \param argv Argument array * \param pid Pointer to the variable that will receive the pid * \param libname Pointer to the pointer that will receive the address of the string containing the name of the library to inject * \param dlopen_addr Pointer to the int that will receive the address of __libc_dlopen_mode() */ void check_params(int argc, char **argv, int *pid, char **libname, int *dlopen_addr){ if(argc != 4){ printf("InjecSO - Shared object injection into processes under Linux - v" VERSION "\n"); printf("by Emilien Girault (Trance) - www.emiliengirault.fr - www.ghostsinthestack.org\n\n"); printf("Usage: %s pid lib.so dlopen_addr\n", basename(argv[0])); printf("pid - PID of the target process\n"); printf("lib.so - Absolute name of the library to inject\n"); printf("dlopen_addr - Address of __libc_dlopen_mode() function in target process.\n"); printf("\nIt's recommended to use the provided script 'injecso.sh' in order to compute automatically the last parameter.\n"); exit(0); } //Get the PID *pid = atoi(argv[1]); //Get the library name *libname = argv[2]; //Get the address of __libc_dlopen_mode() *dlopen_addr = (int) strtoul(argv[3], NULL, 0); } /** * \brief Inject a shellcode into a process * \param pid Target PID * \param shellcode shellcode to inject * \param shellcode_size size of the shellcode */ void inject(int pid, char * shellcode, int shellcode_size){ long res; struct user_regs_struct regs; char * addr_shellcode; int i; //Attach to the process printf("[+] Attaching...\n"); res = ptrace(PTRACE_ATTACH, pid, NULL, NULL); if(res == -1){ perror("Attaching"); } //Wait for the process printf("[+] Waiting for process...\n"); waitpid(pid, NULL, 0); //Set option for interrupted syscalls res = ptrace(PTRACE_SETOPTIONS, pid, NULL, PTRACE_O_TRACESYSGOOD); if(res == -1){ perror("Setting ptrace option"); } //Get the registers of the process res = ptrace(PTRACE_GETREGS, pid, NULL, ®s); if(res == -1){ perror("Getting registers"); } #ifdef DEBUG printf("[DEBUG] Process registers before: eip = 0x%x, esp = 0x%x\n", regs.eip, regs.esp); #endif //Compute the address where the shellcode will be copied //We keep 4 bytes for old eip and a delta between this and the end of the shellcode addr_shellcode = (char *) regs.esp - shellcode_size - DELTA_SHELLCODE_EIP_BAK - 4; //Save eip on the stack (esp orig - 4) #ifdef DEBUG printf("[DEBUG] esp-4 = 0x%x\n", regs.esp-4); #endif res = ptrace(PTRACE_POKEDATA, pid, regs.esp-4, regs.eip); if(res == -1){ perror("Saving eip"); } //Copy shellcode printf("[+] Copying shellcode to 0x%x...\n", (int) addr_shellcode); for(i = 0; i < shellcode_size/4; i++){ res = ptrace(PTRACE_POKEDATA, pid, &addr_shellcode[i*4], (int) *((int*) &shellcode[i*4])); //Copy 4 bytes each time if(res == -1){ perror("Copying shellcode"); } } if((shellcode_size % 4) != 0){ res = ptrace(PTRACE_POKEDATA, pid, &addr_shellcode[i*4], (int) *((int*) &shellcode[i*4])); //Copy the last 3- bytes if necessary if(res == -1){ perror("Copying shellcode"); } } //Make eip and esp point to the shellcode printf("[+] Setting eip and esp...\n"); regs.eip = (int) addr_shellcode+2; //just to be sure that is in the middle of nops regs.esp = (int) addr_shellcode; res = ptrace(PTRACE_SETREGS, pid, NULL, ®s); if(res == -1){ perror("Setting eip and esp"); } //printf("[DEBUG] Process registers after: eip = 0x%x, esp = 0x%x\n", regs.eip, regs.esp); //Detach from the process printf("[+] Detaching...\n"); res = ptrace(PTRACE_DETACH, pid, NULL, NULL); if(res == -1){ perror("Detaching"); } } /** * \brief Main program * \param argc Argument count * \param argv Argument array */ int main(int argc, char **argv){ char * shellcode; int shellcode_size, libname_size; char * ptr; int i; int pid; char * libname; int dlopen_addr; //Check parameters check_params(argc, argv, &pid, &libname, &dlopen_addr); //Compute the size of the library name and deduce the shellcode size libname_size = strlen(libname); shellcode_size = (char *) shellcode_code_end - (char *) shellcode_code + libname_size + 1; //Allocate the shellcode buffer shellcode = malloc(shellcode_size); //Copy the shellcode code into the buffer for(i = 0, ptr = (char *) shellcode_code; ptr != (char *) shellcode_code_end; ptr++, i++){ shellcode[i] = *ptr; } //Copy the library name at the end of the shellcode for(ptr = libname; *ptr != 0; ptr++, i++){ shellcode[i] = *ptr; } //Patch the shellcode by inserting the real address of __libc_dlopen_mode (replace 0x11111111 by dlopen_addr) *((int *) &(shellcode[12])) = dlopen_addr; //Patch the shellcode to include its own size *((int *) &(shellcode[27])) = shellcode_size + DELTA_SHELLCODE_EIP_BAK; #ifdef DEBUG //Print the shellcode printf("[DEBUG] char shellcode[] = \n\""); for(i = 0; i < shellcode_size; i++){ printf("\\x%.2x", shellcode[i] & 0xff); fflush(stdout); ptr++; } printf("\";\n"); #endif //Inject! inject(pid, shellcode, shellcode_size); //Unallocate the shellcode buffer free(shellcode); }injecso.sh0000777000000000000000000000427211145662514011563 0ustar rootroot#!/bin/bash ################################################################################ # File: injecso.sh # Version: 1.0 # InjecSO - Shared object injection into processes under Linux # Support script for computing the address of __libc_dlopen_mode() in a process ################################################################################ # Author: Emilien Girault (Trance) # Websites: www.emiliengirault.fr - www.ghostsinthestack.org # Date: 2009/02/13 ################################################################################ version="1.0" # Params checking if [ $# -ne 2 ]; then echo "InjecSO - Shared object injection into processes under Linux - v$version" echo "by Emilien Girault (Trance) - www.emiliengirault.fr - www.ghostsinthestack.org" echo echo "Usage: $(basename $0) pid lib.so" echo "pid - PID of the target process" echo "lib.so - Name of the library to inject (absolute or relative)" exit 0 fi # Param renaming pid=$1 lib=$2 # Test whether the pid is numeric expr $pid + 0 1>/dev/null 2>&1 if [ $? -ne 0 ]; then echo "Error: pid is not numeric." exit 1 fi if [ ! -d /proc/$pid ]; then echo "Error: The given PID is incorrect." exit 1 fi # Get the map of process and get the line that correspond to the executable section of libc line=$(cat /proc/$pid/maps | grep "libc\b" | grep r-x | head -n 1) if [ -z "$line" ]; then echo "Error: The given pid doesn't have libc.so loaded." exit 1 fi # Extract the base address of that section and the name of the library libc_baseaddr=$(echo "$line" | cut -d "-" -f1) libc_name=$(echo "$line" | perl -n -e '/(\S+$)/ && print $1') # extract the last field # Use readelf to find the offset of __libc_dlopen_mode dlopen_offset=$(readelf -s -D $libc_name | grep __libc_dlopen_mode | head -n 1 | perl -n -e '/^\s*\S+\s+\S+\s+(\S+)/ && print $1') # extract the 3rd field # Compute the actual addresses dlopen_addr=$(expr $(printf "%d" 0x$libc_baseaddr) + $(printf "%d" 0x$dlopen_offset)) dlopen_addr_hex=$(printf "0x%x" $dlopen_addr) echo "[+] Found __libc_dlopen_mode at $dlopen_addr_hex" echo "[+] Launching: injecso $pid $lib $dlopen_addr_hex" # Launch InjecSO $(dirname $0)/injecso $pid $(pwd)/$lib $dlopen_addr_hex Makefile0000777000000000000000000000123711145357636011241 0ustar rootroot################################################################################ # File: Makefile # InjecSO - Shared object injection into processes under Linux # Makefile for compiling the tool. ################################################################################ # Author: Emilien Girault (Trance) # Websites: www.emiliengirault.fr - www.ghostsinthestack.org # Date: 2009/02/13 ################################################################################ CC = gcc CFLAGS = -g all: injecso injecso: injecso.o shellcode.o injecso.o: injecso.c $(CC) -c $(CFLAGS) $< -o $@ shellcode.o: shellcode.s $(CC) -c $(CFLAGS) $< -o $@ clean: rm *.o injecso README.txt0000777000000000000000000000465611145617714011303 0ustar rootroot################################################################################ # InjecSO - Shared object injection into processes under Linux # # Author: Emilien Girault (Trance) # Websites: www.emiliengirault.fr - www.ghostsinthestack.org # Date: 2009/02/13 ################################################################################ What is it? =========== InjecSO is a tool that lets you inject a shared library (also called "shared object") into the memory of a running process. It is the equivalent to DLL injection under Microsoft Windows. The shared library can contain a constructor code that will be executed when it is loaded into memory (cf. the end of this README file). This can be used for reverse-enineering purposes: execution tracing, memory dumps, debugging... But it is more a proof of concept that showswhat can be done in Linux. How to compile? =============== Use the provided Makefile. Just run: make Note that you need gcc installed on your machine. How to run? =========== There are two tools available. injecso is the core of the program that is used for injection. It requires 3 parameters: the target pid, the absolute library name, and the address of a special function called __libc_dlopen_mode() in the target process address space. Sine this last parameter is not trivial to determine, there is a support script named injecso.sh that can compute this address. It uses the Bash shell, as well as Perl and Readelf (from the 'binutils' package). This script just requires the target pid and the name of the library to inject (which can be absolute or relative), and launches automatically the first tool with the correct parameter. Just launch one of the tool without parameter to get some help. How to execute a function when a library is loaded? =================================================== You can use a special GCC macro when defining your function: void __attribute__ ((constructor)) your_function(void); This will add the function to the constructor list of the library. When the library is loaded into memory (using dlopen() for example), the function will be called. How does it work? ================= InjecSO uses the ptrace() system call to inject a shellcode into the process that will load the library using a special libc function: __libc_dlopen_mode(). For more details about implementation, see the source code as well as the author's websites: www.emiliengirault.fr and www.ghostsinthestack.org. shellcode.s0000777000000000000000000000223211145672317011717 0ustar rootroot/** * \file shellcode.s * * \brief InjecSO - Shared object injection into processes under Linux * \brief Shellcode definition * \version 1.0 * * \author Emilien Girault (Trance) * \author www.emiliengirault.fr - www.ghostsinthestack.org * \date 2009/02/13 */ .text .globl shellcode_code .globl shellcode_code_end shellcode_code: /* Some nops */ nop nop nop nop nop nop nop /* Save all registers */ pushal /* Get the name of the library into ebx */ jmp libname call_dlopen: popl %ebx /* 0x11111111 will be later replaced by the address of __lib_dlopen_mode */ movl $0x11111111, %eax pushl $2 /* RTLD_NOW */ pushl %ebx /* name of the library */ call *%eax /* call __lib_dlopen_mode */ /* Clean args on the stack */ addl $8, %esp /* Restore all registers */ popal /* 0x12345678 will be later replaced by the size of the shellcode (+ delta) */ addl $0x12345678, %esp /* Return to where we were before */ ret libname: call call_dlopen shellcode_code_end: /* * End of shellcode * The string corresponding to the library name will be put here later */