[feat] more powerful modules
This commit is contained in:
rootacite
@@ -1,15 +1,11 @@
|
||||
mod map;
|
||||
mod processes;
|
||||
mod asm;
|
||||
mod injectors;
|
||||
mod elf;
|
||||
|
||||
pub use map::is_address_in_range;
|
||||
pub use processes::get_pid_by_name;
|
||||
pub use processes::read_memory_vm;
|
||||
pub use processes::write_memory_vm;
|
||||
pub use processes::write_memory_ptrace;
|
||||
pub use map::first_rw_segment;
|
||||
pub use map::module_base_address;
|
||||
pub use map::first_exec_segment;
|
||||
pub use map::*;
|
||||
pub use asm::assemble;
|
||||
pub use processes::find_remote_proc;
|
||||
pub use processes::wait;
|
||||
pub use processes::*;
|
||||
pub use injectors::*;
|
||||
pub use elf::*;
|
||||
111
01/project-hbj-attacker/src/helper/elf.rs
Normal file
111
01/project-hbj-attacker/src/helper/elf.rs
Normal file
@@ -0,0 +1,111 @@
|
||||
use anyhow::{Context, bail};
|
||||
use goblin::elf::{Elf, ProgramHeader, Sym, program_header::PT_DYNAMIC, program_header::PT_LOAD, reloc::R_X86_64_JUMP_SLOT, Reloc};
|
||||
use memmap2::Mmap;
|
||||
use std::fs::File;
|
||||
use std::ops::Deref;
|
||||
use ouroboros::self_referencing;
|
||||
|
||||
fn open_mem_map(path: &str) -> Result<Mmap, Box<dyn std::error::Error>> {
|
||||
let file = File::open(path)?;
|
||||
unsafe { Ok(Mmap::map(&file)?) }
|
||||
}
|
||||
|
||||
#[self_referencing]
|
||||
pub struct ExecuteLinkFile {
|
||||
data: Vec<u8>,
|
||||
|
||||
#[borrows(data)]
|
||||
#[covariant]
|
||||
elf: Elf<'this>
|
||||
}
|
||||
|
||||
impl ExecuteLinkFile {
|
||||
pub fn prase(path: &str) -> Result<Self, Box<dyn std::error::Error>> {
|
||||
let data = open_mem_map(path)?.deref().to_owned();
|
||||
let s = ExecuteLinkFileTryBuilder {
|
||||
data,
|
||||
elf_builder: |data_ref| {
|
||||
Elf::parse(&data_ref)
|
||||
}
|
||||
}.try_build()?;
|
||||
|
||||
Ok(s)
|
||||
}
|
||||
|
||||
pub fn get_loads(&self) -> Result<Vec<ProgramHeader>, Box<dyn std::error::Error>> {
|
||||
let loads = self.borrow_elf()
|
||||
.program_headers
|
||||
.iter()
|
||||
.filter_map(|ph| match ph.p_type {
|
||||
PT_LOAD => Some(ph.to_owned()),
|
||||
_ => None,
|
||||
})
|
||||
.collect::<Vec<ProgramHeader>>();
|
||||
|
||||
Ok(loads)
|
||||
}
|
||||
|
||||
pub fn get_dynamic(&self) -> Result<ProgramHeader, Box<dyn std::error::Error>> {
|
||||
let dynamic = self.borrow_elf()
|
||||
.program_headers
|
||||
.iter()
|
||||
.find(|ph| ph.p_type == PT_DYNAMIC)
|
||||
.context("No PT_DYNAMIC segment found")?;
|
||||
|
||||
Ok(dynamic.clone())
|
||||
}
|
||||
|
||||
pub fn get_rela_sym(&self, name: &str) -> Result<Reloc, Box<dyn std::error::Error>> {
|
||||
let rela_plt = self.borrow_elf().pltrelocs.iter();
|
||||
|
||||
let sym = rela_plt
|
||||
.filter(|rela| {
|
||||
matches!(rela.r_type, R_X86_64_JUMP_SLOT) // R_X86_64_JUMP_SLOT
|
||||
})
|
||||
.filter_map(|rela| {
|
||||
let sym_index = rela.r_sym;
|
||||
let Ok(sym) = self.get_dyn_sym(sym_index) else {
|
||||
return None;
|
||||
};
|
||||
let Ok(sym_name) = self.get_dyn_str(sym.st_name) else {
|
||||
return None;
|
||||
};
|
||||
|
||||
if sym_name == name { Some(rela) } else { None }
|
||||
})
|
||||
.collect::<Vec<Reloc>>();
|
||||
|
||||
let first = sym
|
||||
.first()
|
||||
.context(format!("No symbol found with name {}", name))?;
|
||||
|
||||
Ok(first.clone())
|
||||
}
|
||||
|
||||
pub fn get_dyn_sym(&self, location: usize) -> Result<Sym, Box<dyn std::error::Error>> {
|
||||
let dyn_sym = self.borrow_elf()
|
||||
.dynsyms
|
||||
.get(location)
|
||||
.context(format!("No symbol found at location {}", location))?;
|
||||
|
||||
Ok(dyn_sym.clone())
|
||||
}
|
||||
|
||||
pub fn prase_dyn_sym(&self, name: &str) -> Result<Sym, Box<dyn std::error::Error>> {
|
||||
let dyn_sym = self.borrow_elf()
|
||||
.dynsyms.iter()
|
||||
.find(|sym| self.get_dyn_str(sym.st_name).ok().as_deref() == Some(name))
|
||||
.context(format!("No symbol found with name {}", name))?;
|
||||
|
||||
Ok(dyn_sym.clone())
|
||||
}
|
||||
|
||||
pub fn get_dyn_str(&self, location: usize) -> Result<String, Box<dyn std::error::Error>> {
|
||||
let str = self.borrow_elf()
|
||||
.dynstrtab
|
||||
.get_at(location)
|
||||
.context(format!("Could not get dynstr at location {}", location))?;
|
||||
|
||||
Ok(str.to_owned())
|
||||
}
|
||||
}
|
||||
248
01/project-hbj-attacker/src/helper/injectors.rs
Normal file
248
01/project-hbj-attacker/src/helper/injectors.rs
Normal file
@@ -0,0 +1,248 @@
|
||||
use std::ffi::CString;
|
||||
use std::fs;
|
||||
use iced_x86::code_asm::{eax, r10, r8, r9, rax, rbp, rcx, rdi, rdx, rsi, rsp};
|
||||
use nix::sys::ptrace;
|
||||
use nix::sys::wait::{waitpid, WaitPidFlag};
|
||||
use nix::unistd::Pid;
|
||||
use crate::helper::{assemble, Process};
|
||||
|
||||
|
||||
const GREEN: &str = "\x1b[32m";
|
||||
const RESET: &str = "\x1b[0m";
|
||||
|
||||
pub fn inject1(proc: &Process, seg_rw: (u64, u64)) -> Result<(), Box<dyn std::error::Error>> // Simple injection
|
||||
{
|
||||
let regs = ptrace::getregs(proc.get_pid())?;
|
||||
let injected_data = "You are injected. \r\n";
|
||||
proc.write_memory_vm(seg_rw.0 as usize, &injected_data.as_bytes())?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write \"{}\" to {:#016x}",
|
||||
injected_data, seg_rw.0
|
||||
);
|
||||
|
||||
let injected_inst = assemble(regs.rip as u64, |asm| {
|
||||
asm.mov(rax, 1u64)?; // Syscall 1 (write)
|
||||
asm.mov(rdi, 1u64)?; // Fd 1 (STDOUT)
|
||||
asm.mov(rsi, seg_rw.0)?; // Buffer pointer (Here is rw segment in target)
|
||||
asm.mov(rdx, injected_data.as_bytes().len() as u64)?; // Buffer length
|
||||
asm.syscall()?; // Syscall interrupt
|
||||
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
|
||||
Ok(())
|
||||
})?;
|
||||
|
||||
proc.write_memory_ptrace(regs.rip as usize, &injected_inst)?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
|
||||
regs.rip
|
||||
);
|
||||
|
||||
// Continue target
|
||||
ptrace::cont(proc.get_pid(), None)?;
|
||||
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
|
||||
proc.wait();
|
||||
|
||||
let regs = ptrace::getregs(proc.get_pid())?;
|
||||
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn inject2(proc: &Process, seg_rw: (u64, u64)) -> Result<(), Box<dyn std::error::Error>> // ld injection
|
||||
{
|
||||
let regs = ptrace::getregs(proc.get_pid())?;
|
||||
// Get the absolute path to our shared library
|
||||
let lib_path = fs::canonicalize("./target/debug/libproject_hbj_attacker.so")?
|
||||
.to_string_lossy()
|
||||
.into_owned();
|
||||
|
||||
// Start Inject
|
||||
let c_lib_path = CString::new(lib_path).unwrap();
|
||||
proc.write_memory_vm(seg_rw.0 as usize, c_lib_path.as_bytes_with_nul())?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write {} to {:#016x}",
|
||||
&c_lib_path.to_string_lossy(),
|
||||
seg_rw.0
|
||||
);
|
||||
|
||||
let Some(target_dlopen_addr) = proc.find_remote_proc("/usr/lib/libc.so.6", "dlopen") else {
|
||||
return Err(Box::new(std::io::Error::new(
|
||||
std::io::ErrorKind::Other,
|
||||
"first rw segment not found",
|
||||
)));
|
||||
};
|
||||
|
||||
let injected_inst = assemble(regs.rip as u64, |asm| {
|
||||
asm.mov(rdi, seg_rw.0)?; // Param 1: Filename
|
||||
asm.mov(rsi, 2u64)?; // Param 2: Flag, 2(RTLD_NOW)
|
||||
asm.call(target_dlopen_addr)?; // Syscall interrupt
|
||||
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
|
||||
Ok(())
|
||||
})?;
|
||||
|
||||
proc.write_memory_ptrace(regs.rip as usize, &injected_inst)?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
|
||||
regs.rip
|
||||
);
|
||||
|
||||
// Continue target
|
||||
ptrace::cont(proc.get_pid(), None)?;
|
||||
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
|
||||
proc.wait();
|
||||
|
||||
let regs = ptrace::getregs(proc.get_pid())?;
|
||||
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn inject3(proc: &Process, seg_rw: (u64, u64)) -> Result<i32, Box<dyn std::error::Error>> // thread inject
|
||||
{
|
||||
let regs = ptrace::getregs(proc.get_pid())?;
|
||||
// Alloc rwx memory
|
||||
|
||||
let injected_inst = assemble(regs.rip as u64, |asm| {
|
||||
asm.mov(rax, 9u64)?; // Syscall 9 (mmap)
|
||||
|
||||
asm.mov(rdi, 0u64)?; // Addr
|
||||
asm.mov(rsi, 4096u64)?; // Length, we alloc a page (4K)
|
||||
asm.mov(
|
||||
rdx,
|
||||
(libc::PROT_READ | libc::PROT_WRITE | libc::PROT_EXEC) as u64,
|
||||
)?; // Set protect to rwx
|
||||
asm.mov(r10, (libc::MAP_PRIVATE | libc::MAP_ANONYMOUS) as u64)?; // Private and anonymous
|
||||
asm.mov(r8, 01i64)?; // Fd (-1 because we want anonymous)
|
||||
asm.mov(r9, 0u64)?; // Offset
|
||||
|
||||
asm.syscall()?; // Syscall interrupt
|
||||
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
|
||||
Ok(())
|
||||
})?;
|
||||
|
||||
proc.write_memory_ptrace(regs.rip as usize, &injected_inst)?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
|
||||
regs.rip
|
||||
);
|
||||
|
||||
// Continue target
|
||||
ptrace::cont(proc.get_pid(), None)?;
|
||||
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
|
||||
proc.wait();
|
||||
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} int3 at {:#016x}",
|
||||
ptrace::getregs(proc.get_pid())?.rip
|
||||
);
|
||||
|
||||
let regs_after_map = ptrace::getregs(proc.get_pid())?;
|
||||
let page_addr = regs_after_map.rax as usize;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} allocated page is at {:#016x}",
|
||||
page_addr
|
||||
);
|
||||
|
||||
let injected_data = "[%d] I am the injected thread, I am running... \r\n";
|
||||
proc.write_memory_vm(
|
||||
page_addr + 0x200,
|
||||
&CString::new(injected_data).unwrap().as_bytes_with_nul(),
|
||||
)?;
|
||||
proc.write_memory_vm(page_addr + 0x300, &1i64.to_le_bytes())?;
|
||||
proc.write_memory_vm(page_addr + 0x308, &0u64.to_le_bytes())?;
|
||||
|
||||
let printf = proc.find_remote_proc("/usr/lib/libc.so.6", "printf").unwrap();
|
||||
|
||||
// Construct inject payload
|
||||
let injected_payload = assemble(page_addr as u64, |asm| {
|
||||
let mut target_label = asm.create_label();
|
||||
|
||||
asm.mov(rbp, rsp)?;
|
||||
asm.mov(rcx, 0u64)?;
|
||||
asm.set_label(&mut target_label)?;
|
||||
|
||||
asm.add(rcx, 1i32)?;
|
||||
asm.push(rcx)?;
|
||||
|
||||
asm.mov(rdi, (page_addr + 0x200) as u64)?;
|
||||
asm.mov(rsi, rcx)?;
|
||||
asm.call(printf)?;
|
||||
|
||||
asm.mov(rax, 35u64)?; // Syscall 35 (nano sleep)
|
||||
asm.mov(rdi, (page_addr + 0x300) as u64)?; // Req
|
||||
asm.mov(rsi, 0u64)?; //Rem
|
||||
asm.syscall()?; // Syscall interrupt
|
||||
|
||||
asm.pop(rcx)?;
|
||||
asm.jmp(target_label)?; // Jmp back to loop
|
||||
Ok(())
|
||||
})?;
|
||||
proc.write_memory_vm(page_addr, &injected_payload)?;
|
||||
println!("{GREEN}[trace]{RESET} write payload to {:#016x}", page_addr);
|
||||
|
||||
// Start Trigger
|
||||
// let regs = ptrace::getregs(proc.get_pid())?;
|
||||
ptrace::setregs(proc.get_pid(), regs)?;
|
||||
|
||||
let injected_trigger = assemble(regs.rip as u64, |asm| {
|
||||
asm.mov(rax, 56u64)?; // Syscall 56 (clone)
|
||||
|
||||
asm.mov(
|
||||
rdi,
|
||||
(libc::CLONE_VM
|
||||
| libc::CLONE_FS
|
||||
| libc::CLONE_FILES
|
||||
| libc::CLONE_SIGHAND
|
||||
| libc::CLONE_THREAD) as u64,
|
||||
)?; // Flags
|
||||
asm.mov(rsi, (page_addr + 0x1000) as u64)?; // Stack top
|
||||
|
||||
asm.mov(rdx, 0u64)?; // parent_tid = NULL
|
||||
asm.mov(r10, 0u64)?; // child_tid = NULL
|
||||
asm.mov(r8, 0u64)?; // tls = NULL
|
||||
|
||||
asm.syscall()?; // Syscall interrupt
|
||||
asm.test(eax, eax)?; // Syscall returns zero?
|
||||
asm.jz(page_addr as u64)?;
|
||||
|
||||
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
|
||||
|
||||
Ok(())
|
||||
})?;
|
||||
|
||||
proc.write_memory_ptrace(regs.rip as usize, &injected_trigger)?;
|
||||
println!("{GREEN}[trace]{RESET} write trigger to {:#016x}", regs.rip);
|
||||
|
||||
ptrace::cont(proc.get_pid(), None)?;
|
||||
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
|
||||
proc.wait();
|
||||
|
||||
let regs = ptrace::getregs(proc.get_pid())?;
|
||||
let pid_new_thread = Pid::from_raw(regs.rax as i32);
|
||||
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} new thread is {}, which will be suspend.",
|
||||
pid_new_thread
|
||||
);
|
||||
|
||||
ptrace::attach(pid_new_thread)?;
|
||||
waitpid(pid_new_thread, Some(WaitPidFlag::WUNTRACED))?;
|
||||
println!("{GREEN}[trace]{RESET} attached new thread.");
|
||||
|
||||
loop {
|
||||
let regs = ptrace::getregs(pid_new_thread)?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} rip in new thread is {:#016x}.",
|
||||
regs.rip
|
||||
);
|
||||
|
||||
if regs.rip >= page_addr as u64 && regs.rip < (page_addr + 0x1000) as u64 {
|
||||
println!("{GREEN}[trace]{RESET} rip in new thread return to inject payload.");
|
||||
break;
|
||||
}
|
||||
|
||||
ptrace::step(pid_new_thread, None)?;
|
||||
waitpid(pid_new_thread, Some(WaitPidFlag::WUNTRACED))?;
|
||||
}
|
||||
|
||||
Ok(pid_new_thread.as_raw())
|
||||
}
|
||||
@@ -1,90 +1,109 @@
|
||||
|
||||
pub fn is_address_in_range(addr: u64, range_strings: &Vec<&str>) -> bool {
|
||||
for range_str in range_strings {
|
||||
if let Some((start, end)) = parse_address_range(range_str) {
|
||||
if addr >= start && addr < end {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
false
|
||||
use crate::helper::ExecuteLinkFile;
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct MemoryRegion {
|
||||
pub start_addr: u64,
|
||||
pub end_addr: u64,
|
||||
pub perms: String,
|
||||
pub offset: Option<u64>,
|
||||
pub dev: Option<String>,
|
||||
pub inode: Option<u64>,
|
||||
pub pathname: Option<String>,
|
||||
}
|
||||
|
||||
fn parse_address_range(range_str: &str) -> Option<(u64, u64)> {
|
||||
let parts: Vec<&str> = range_str.split_whitespace().collect();
|
||||
if parts.is_empty() {
|
||||
return None;
|
||||
}
|
||||
|
||||
let range_part = parts[0];
|
||||
|
||||
let range_parts: Vec<&str> = range_part.split('-').collect();
|
||||
if range_parts.len() != 2 {
|
||||
return None;
|
||||
}
|
||||
|
||||
let start_addr = u64::from_str_radix(range_parts[0], 16).ok()?;
|
||||
let end_addr = u64::from_str_radix(range_parts[1], 16).ok()?;
|
||||
|
||||
Some((start_addr, end_addr))
|
||||
}
|
||||
|
||||
pub fn first_rw_segment(range_strings: &Vec<&str>) -> Option<(u64, u64)> {
|
||||
for range_str in range_strings {
|
||||
let parts: Vec<&str> = range_str.split_whitespace().collect();
|
||||
impl MemoryRegion {
|
||||
pub fn parse(line: &str) -> Option<Self> {
|
||||
let parts: Vec<&str> = line.split_whitespace().collect();
|
||||
if parts.len() < 2 {
|
||||
continue;
|
||||
return None;
|
||||
}
|
||||
|
||||
let perms = parts[1];
|
||||
if perms.starts_with("rw") {
|
||||
if let Some((start, end)) = parse_address_range(range_str) {
|
||||
return Some((start, end));
|
||||
}
|
||||
let range_part = parts[0];
|
||||
let range_parts: Vec<&str> = range_part.split('-').collect();
|
||||
if range_parts.len() != 2 {
|
||||
return None;
|
||||
}
|
||||
}
|
||||
None
|
||||
}
|
||||
let start_addr = u64::from_str_radix(range_parts[0], 16).ok()?;
|
||||
let end_addr = u64::from_str_radix(range_parts[1], 16).ok()?;
|
||||
|
||||
pub fn first_exec_segment(range_strings: &Vec<&str>) -> Option<(u64, u64)> {
|
||||
for range_str in range_strings {
|
||||
let parts: Vec<&str> = range_str.split_whitespace().collect();
|
||||
if parts.len() < 2 {
|
||||
continue;
|
||||
}
|
||||
let perms = parts[1].to_string();
|
||||
|
||||
let perms = parts[1];
|
||||
if perms.contains('x') {
|
||||
if let Some((start, end)) = parse_address_range(range_str) {
|
||||
return Some((start, end));
|
||||
}
|
||||
}
|
||||
}
|
||||
None
|
||||
}
|
||||
let offset = parts.get(2).and_then(|s| u64::from_str_radix(s, 16).ok());
|
||||
let dev = parts.get(3).map(|s| s.to_string());
|
||||
let inode = parts.get(4).and_then(|s| s.parse::<u64>().ok());
|
||||
let pathname = parts.get(5).map(|s| s.to_string());
|
||||
|
||||
pub fn module_base_address(range_strings: &Vec<&str>, module_name: &str) -> Option<u64> {
|
||||
let mut base_addr: Option<u64> = None;
|
||||
|
||||
for range_str in range_strings {
|
||||
let parts: Vec<&str> = range_str.split_whitespace().collect();
|
||||
if parts.len() < 6 {
|
||||
continue;
|
||||
}
|
||||
|
||||
let path = parts.last().unwrap();
|
||||
|
||||
if let Some(filename) = std::path::Path::new(path).file_name().and_then(|f| f.to_str()) {
|
||||
if filename.contains(module_name) {
|
||||
if let Some((start, _)) = parse_address_range(range_str) {
|
||||
base_addr = match base_addr {
|
||||
Some(current_min) => Some(current_min.min(start)),
|
||||
None => Some(start),
|
||||
};
|
||||
}
|
||||
}
|
||||
}
|
||||
Some(Self {
|
||||
start_addr,
|
||||
end_addr,
|
||||
perms,
|
||||
offset,
|
||||
dev,
|
||||
inode,
|
||||
pathname,
|
||||
})
|
||||
}
|
||||
|
||||
base_addr
|
||||
pub fn is_read_write(&self) -> bool {
|
||||
self.perms.starts_with("rw")
|
||||
}
|
||||
|
||||
pub fn is_executable(&self) -> bool {
|
||||
self.perms.contains('x')
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct MemoryMap {
|
||||
regions: Vec<MemoryRegion>,
|
||||
}
|
||||
|
||||
impl MemoryMap {
|
||||
pub fn new(lines: &Vec<&str>) -> Self {
|
||||
let regions = lines
|
||||
.iter()
|
||||
.filter_map(|line| MemoryRegion::parse(line))
|
||||
.collect();
|
||||
Self { regions }
|
||||
}
|
||||
|
||||
pub fn first_rw_segment(&self, module: &str) -> Option<(u64, u64)> {
|
||||
self.regions
|
||||
.iter()
|
||||
.find(|r| r.is_read_write() && r.pathname.as_deref() == Some(module))
|
||||
.map(|r| (r.start_addr, r.end_addr))
|
||||
}
|
||||
|
||||
pub fn first_exec_segment(&self, module: &str) -> Option<(u64, u64)> {
|
||||
self.regions
|
||||
.iter()
|
||||
.find(|r| r.is_executable() && r.pathname.as_deref() == Some(module))
|
||||
.map(|r| (r.start_addr, r.end_addr))
|
||||
}
|
||||
|
||||
pub fn module_base_address(&self, module: &str) -> Option<u64> {
|
||||
let elf = ExecuteLinkFile::prase(&module).ok()?;
|
||||
let loads = elf.get_loads().ok()?;
|
||||
let Some(first_load) = loads.first() else {
|
||||
return None;
|
||||
};
|
||||
|
||||
let Some(map_item) = self.regions.iter().find(|r| {
|
||||
r.offset.unwrap_or(0) == first_load.p_offset && r.pathname.as_deref() == Some(module)
|
||||
}) else {
|
||||
return None;
|
||||
};
|
||||
|
||||
Some(map_item.start_addr - first_load.p_vaddr)
|
||||
}
|
||||
|
||||
pub fn collect_module(&self, module: &str) -> Vec<MemoryRegion>
|
||||
{
|
||||
let r = self.regions.iter()
|
||||
.filter_map(|r| if r.pathname.as_deref() == Some(module) { Some(r.clone()) } else { None })
|
||||
.collect::<Vec<MemoryRegion>>();
|
||||
|
||||
r
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,41 +7,16 @@ use std::error::Error;
|
||||
use std::ffi::CString;
|
||||
use std::io::{IoSliceMut, IoSlice};
|
||||
use nix::sys::ptrace;
|
||||
use std::mem;
|
||||
|
||||
use libc::{dlsym, RTLD_NEXT};
|
||||
use crate::helper::module_base_address;
|
||||
use nix::sys::wait::{waitpid, WaitPidFlag, WaitStatus};
|
||||
|
||||
use crate::helper::ExecuteLinkFile;
|
||||
use crate::helper::map::MemoryMap;
|
||||
|
||||
const GREEN: &str = "\x1b[32m";
|
||||
const RESET: &str = "\x1b[0m";
|
||||
|
||||
pub fn wait(pid: Pid) -> Option<WaitStatus>
|
||||
{
|
||||
let f = waitpid(pid, Some(WaitPidFlag::WUNTRACED)).ok()?;
|
||||
|
||||
match f {
|
||||
WaitStatus::Stopped(stopped_pid, signal) => {
|
||||
println!("[DEBUG] PID {} stopped by signal: {:?}", stopped_pid, signal);
|
||||
}
|
||||
WaitStatus::Exited(exited_pid, status) => {
|
||||
println!("[DEBUG] PID {} exited with status: {}", exited_pid, status);
|
||||
}
|
||||
WaitStatus::Signaled(signaled_pid, signal, core_dump) => {
|
||||
println!("[DEBUG] PID {} killed by signal: {:?} (core dump: {})",
|
||||
signaled_pid, signal, core_dump);
|
||||
}
|
||||
WaitStatus::Continued(continued_pid) => {
|
||||
println!("[DEBUG] PID {} continued", continued_pid);
|
||||
}
|
||||
WaitStatus::StillAlive => {
|
||||
println!("[DEBUG] PID {} still alive", pid);
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
|
||||
Some(f)
|
||||
}
|
||||
|
||||
fn list_processes() -> Result<HashMap<String, i32>, std::io::Error>
|
||||
{
|
||||
let mut processes = HashMap::<String, i32>::new();
|
||||
@@ -64,7 +39,6 @@ fn list_processes() -> Result<HashMap<String, i32>, std::io::Error>
|
||||
|
||||
if let Some(name) = name_path.split("/").last() {
|
||||
processes.insert(name.to_string(), pid);
|
||||
println!("{} -> {}", name, dir);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -77,169 +51,211 @@ pub fn get_pid_by_name(name: &str) -> Result<i32, std::io::Error>
|
||||
Ok(ps[name])
|
||||
}
|
||||
|
||||
pub fn read_memory_vm(pid: Pid, start_addr: usize, size: usize) -> Result<Vec<u8>, Box<dyn Error>> {
|
||||
let mut buffer = vec![0u8; size];
|
||||
|
||||
let mut local_iov = [IoSliceMut::new(&mut buffer)];
|
||||
|
||||
let remote_iov = [RemoteIoVec {
|
||||
base: start_addr,
|
||||
len: size,
|
||||
}];
|
||||
|
||||
let bytes_read = process_vm_readv(pid, &mut local_iov, &remote_iov)?;
|
||||
|
||||
if bytes_read == size {
|
||||
Ok(buffer)
|
||||
} else {
|
||||
buffer.truncate(bytes_read);
|
||||
Ok(buffer)
|
||||
}
|
||||
pub struct Process
|
||||
{
|
||||
pid: Pid,
|
||||
map: MemoryMap,
|
||||
}
|
||||
|
||||
pub fn write_memory_vm(pid: Pid, mut start_addr: usize, mut data: &[u8]) -> Result<usize, Box<dyn Error>> {
|
||||
let mut total_written = 0usize;
|
||||
while !data.is_empty() {
|
||||
let local_iov = [IoSlice::new(data)];
|
||||
let remote_iov = [RemoteIoVec {
|
||||
base: start_addr,
|
||||
len: data.len(),
|
||||
}];
|
||||
impl Process
|
||||
{
|
||||
fn write_unaligned_head(
|
||||
pid: Pid,
|
||||
addr: usize,
|
||||
data: &[u8],
|
||||
word_size: usize,
|
||||
) -> Result<usize, Box<dyn Error>>
|
||||
{
|
||||
let head_offset = addr % word_size;
|
||||
let aligned_addr = addr - head_offset;
|
||||
let orig_word = ptrace::read(pid, aligned_addr as *mut libc::c_void)?;
|
||||
let mut bytes = orig_word.to_ne_bytes();
|
||||
|
||||
let written = process_vm_writev(pid, &local_iov, &remote_iov)?;
|
||||
let copy_len = usize::min(word_size - head_offset, data.len());
|
||||
bytes[head_offset..head_offset + copy_len].copy_from_slice(&data[..copy_len]);
|
||||
let new_word = libc::c_long::from_ne_bytes(bytes);
|
||||
|
||||
if written == 0 {
|
||||
return Err(format!("process_vm_writev returned 0 (no progress) after writing {} bytes", total_written).into());
|
||||
ptrace::write(pid, aligned_addr as *mut libc::c_void, new_word)?;
|
||||
Ok(copy_len)
|
||||
}
|
||||
|
||||
fn write_full_word(
|
||||
pid: Pid,
|
||||
addr: usize,
|
||||
data: &[u8]
|
||||
) -> Result<usize, Box<dyn Error>>
|
||||
{
|
||||
let mut arr = [0u8; size_of::<libc::c_long>()];
|
||||
arr.copy_from_slice(data);
|
||||
let val = libc::c_long::from_ne_bytes(arr);
|
||||
ptrace::write(pid, addr as *mut libc::c_void, val)?;
|
||||
Ok(size_of::<libc::c_long>())
|
||||
}
|
||||
|
||||
fn write_unaligned_tail(
|
||||
pid: Pid,
|
||||
addr: usize,
|
||||
data: &[u8],
|
||||
_word_size: usize,
|
||||
) -> Result<usize, Box<dyn Error>>
|
||||
{
|
||||
let orig_word = ptrace::read(pid, addr as *mut libc::c_void)?;
|
||||
let mut bytes = orig_word.to_ne_bytes();
|
||||
bytes[..data.len()].copy_from_slice(data);
|
||||
let new_word = libc::c_long::from_ne_bytes(bytes);
|
||||
|
||||
ptrace::write(pid, addr as *mut libc::c_void, new_word)?;
|
||||
Ok(data.len())
|
||||
}
|
||||
|
||||
pub fn new(pid: Pid) -> Result<Self, Box<dyn Error>>
|
||||
{
|
||||
let maps = fs::read_to_string(format!("/proc/{}/maps", pid))?;
|
||||
let map = MemoryMap::new(&maps.lines().filter(|&line| !line.is_empty()).collect::<Vec<&str>>());
|
||||
|
||||
Ok(Self { pid, map, })
|
||||
}
|
||||
|
||||
pub fn wait(&self) -> Option<WaitStatus>
|
||||
{
|
||||
let f = waitpid(self.pid, Some(WaitPidFlag::WUNTRACED)).ok()?;
|
||||
|
||||
match f {
|
||||
WaitStatus::Stopped(stopped_pid, signal) => {
|
||||
println!("[DEBUG] PID {} stopped by signal: {:?}", stopped_pid, signal);
|
||||
}
|
||||
WaitStatus::Exited(exited_pid, status) => {
|
||||
println!("[DEBUG] PID {} exited with status: {}", exited_pid, status);
|
||||
}
|
||||
WaitStatus::Signaled(signaled_pid, signal, core_dump) => {
|
||||
println!("[DEBUG] PID {} killed by signal: {:?} (core dump: {})",
|
||||
signaled_pid, signal, core_dump);
|
||||
}
|
||||
WaitStatus::Continued(continued_pid) => {
|
||||
println!("[DEBUG] PID {} continued", continued_pid);
|
||||
}
|
||||
WaitStatus::StillAlive => {
|
||||
println!("[DEBUG] PID {} still alive", self.pid);
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
|
||||
total_written += written;
|
||||
start_addr = start_addr.wrapping_add(written);
|
||||
data = &data[written..];
|
||||
Some(f)
|
||||
}
|
||||
|
||||
Ok(total_written)
|
||||
}
|
||||
pub fn get_pid(&self) -> Pid { self.pid.clone() }
|
||||
|
||||
pub fn write_memory_ptrace(pid: Pid, start_addr: usize, data: &[u8]) -> Result<usize, Box<dyn Error>> {
|
||||
let word_size = size_of::<libc::c_long>();
|
||||
if word_size == 0 {
|
||||
return Err("invalid word size".into());
|
||||
pub fn get_exe(&self) -> Result<String, Box<dyn Error>>
|
||||
{
|
||||
let r = fs::read_link(format!("/proc/{}/exe", self.pid))?
|
||||
.to_string_lossy()
|
||||
.into_owned();
|
||||
|
||||
Ok(r)
|
||||
}
|
||||
|
||||
let mut addr = start_addr;
|
||||
let mut remaining = data;
|
||||
let mut written = 0usize;
|
||||
pub fn get_map_str(&self) -> Result<String, Box<dyn Error>>
|
||||
{
|
||||
let r = fs::read_to_string(format!("/proc/{}/maps", self.pid))?;
|
||||
|
||||
if addr % word_size != 0 && !remaining.is_empty() {
|
||||
let n = write_unaligned_head(pid, addr, remaining, word_size)?;
|
||||
addr += n;
|
||||
remaining = &remaining[n..];
|
||||
written += n;
|
||||
Ok(r)
|
||||
}
|
||||
|
||||
while remaining.len() >= word_size {
|
||||
let n = write_full_word(pid, addr, &remaining[..word_size])?;
|
||||
addr += n;
|
||||
remaining = &remaining[n..];
|
||||
written += n;
|
||||
pub fn read_memory_vm(&self, start_addr: usize, size: usize) -> Result<Vec<u8>, Box<dyn Error>>
|
||||
{
|
||||
let mut buffer = vec![0u8; size];
|
||||
|
||||
let mut local_iov = [IoSliceMut::new(&mut buffer)];
|
||||
|
||||
let remote_iov = [RemoteIoVec {
|
||||
base: start_addr,
|
||||
len: size,
|
||||
}];
|
||||
|
||||
let bytes_read = process_vm_readv(self.pid, &mut local_iov, &remote_iov)?;
|
||||
|
||||
if bytes_read == size {
|
||||
Ok(buffer)
|
||||
} else {
|
||||
buffer.truncate(bytes_read);
|
||||
Ok(buffer)
|
||||
}
|
||||
}
|
||||
|
||||
if !remaining.is_empty() {
|
||||
let n = write_unaligned_tail(pid, addr, remaining, word_size)?;
|
||||
written += n;
|
||||
pub fn write_memory_vm(&self, mut start_addr: usize, mut data: &[u8]) -> Result<usize, Box<dyn Error>>
|
||||
{
|
||||
let mut total_written = 0usize;
|
||||
while !data.is_empty() {
|
||||
let local_iov = [IoSlice::new(data)];
|
||||
let remote_iov = [RemoteIoVec {
|
||||
base: start_addr,
|
||||
len: data.len(),
|
||||
}];
|
||||
|
||||
let written = process_vm_writev(self.pid, &local_iov, &remote_iov)?;
|
||||
|
||||
if written == 0 {
|
||||
return Err(format!("process_vm_writev returned 0 (no progress) after writing {} bytes", total_written).into());
|
||||
}
|
||||
|
||||
total_written += written;
|
||||
start_addr = start_addr.wrapping_add(written);
|
||||
data = &data[written..];
|
||||
}
|
||||
|
||||
Ok(total_written)
|
||||
}
|
||||
|
||||
Ok(written)
|
||||
}
|
||||
pub fn write_memory_ptrace(&self, start_addr: usize, data: &[u8]) -> Result<usize, Box<dyn Error>>
|
||||
{
|
||||
let word_size = size_of::<libc::c_long>();
|
||||
if word_size == 0 {
|
||||
return Err("invalid word size".into());
|
||||
}
|
||||
|
||||
fn write_unaligned_head(
|
||||
pid: Pid,
|
||||
addr: usize,
|
||||
data: &[u8],
|
||||
word_size: usize,
|
||||
) -> Result<usize, Box<dyn Error>> {
|
||||
let head_offset = addr % word_size;
|
||||
let aligned_addr = addr - head_offset;
|
||||
let orig_word = ptrace::read(pid, aligned_addr as *mut libc::c_void)?;
|
||||
let mut bytes = orig_word.to_ne_bytes();
|
||||
let mut addr = start_addr;
|
||||
let mut remaining = data;
|
||||
let mut written = 0usize;
|
||||
|
||||
let copy_len = usize::min(word_size - head_offset, data.len());
|
||||
bytes[head_offset..head_offset + copy_len].copy_from_slice(&data[..copy_len]);
|
||||
let new_word = libc::c_long::from_ne_bytes(bytes);
|
||||
if addr % word_size != 0 && !remaining.is_empty() {
|
||||
let n = Self::write_unaligned_head(self.pid, addr, remaining, word_size)?;
|
||||
addr += n;
|
||||
remaining = &remaining[n..];
|
||||
written += n;
|
||||
}
|
||||
|
||||
ptrace::write(pid, aligned_addr as *mut libc::c_void, new_word)?;
|
||||
Ok(copy_len)
|
||||
}
|
||||
while remaining.len() >= word_size {
|
||||
let n = Self::write_full_word(self.pid, addr, &remaining[..word_size])?;
|
||||
addr += n;
|
||||
remaining = &remaining[n..];
|
||||
written += n;
|
||||
}
|
||||
|
||||
fn write_full_word(pid: Pid, addr: usize, data: &[u8]) -> Result<usize, Box<dyn Error>> {
|
||||
let mut arr = [0u8; size_of::<libc::c_long>()];
|
||||
arr.copy_from_slice(data);
|
||||
let val = libc::c_long::from_ne_bytes(arr);
|
||||
ptrace::write(pid, addr as *mut libc::c_void, val)?;
|
||||
Ok(size_of::<libc::c_long>())
|
||||
}
|
||||
if !remaining.is_empty() {
|
||||
let n = Self::write_unaligned_tail(self.pid, addr, remaining, word_size)?;
|
||||
written += n;
|
||||
}
|
||||
|
||||
fn write_unaligned_tail(
|
||||
pid: Pid,
|
||||
addr: usize,
|
||||
data: &[u8],
|
||||
_word_size: usize,
|
||||
) -> Result<usize, Box<dyn Error>> {
|
||||
let orig_word = ptrace::read(pid, addr as *mut libc::c_void)?;
|
||||
let mut bytes = orig_word.to_ne_bytes();
|
||||
bytes[..data.len()].copy_from_slice(data);
|
||||
let new_word = libc::c_long::from_ne_bytes(bytes);
|
||||
|
||||
ptrace::write(pid, addr as *mut libc::c_void, new_word)?;
|
||||
Ok(data.len())
|
||||
}
|
||||
|
||||
pub fn find_remote_proc(module: &str, symbol: &str, pid: Pid) -> Option<u64>
|
||||
{
|
||||
// Read our own process memory maps to find module base address
|
||||
let self_maps = fs::read_to_string("/proc/self/maps").ok()?;
|
||||
let self_map_lines = self_maps.lines().collect::<Vec<&str>>();
|
||||
let symbol_offset: u64;
|
||||
|
||||
// Find module base address in our own process
|
||||
let Some(module_base_local) = module_base_address(&self_map_lines, module) else {
|
||||
return None;
|
||||
};
|
||||
|
||||
println!("{GREEN}[local]{RESET} {module} base: {:#016x}", module_base_local);
|
||||
|
||||
// Use dlsym to get the address of symbol in our own process
|
||||
unsafe {
|
||||
let symbol_addr_local = dlsym(RTLD_NEXT, CString::new(symbol).unwrap().as_bytes_with_nul().as_ptr() as *const _);
|
||||
// Calculate offset of symbol from module base in our process
|
||||
symbol_offset = symbol_addr_local as u64 - module_base_local;
|
||||
Ok(written)
|
||||
}
|
||||
|
||||
println!(
|
||||
"{GREEN}[local]{RESET} {symbol} offset = {:#016x}",
|
||||
symbol_offset
|
||||
);
|
||||
pub fn find_remote_proc(&self, module: &str, symbol: &str) -> Option<u64>
|
||||
{
|
||||
let target_maps = fs::read_to_string(format!("/proc/{}/maps", self.pid)).ok()?;
|
||||
let base = MemoryMap::new(&target_maps.lines().collect::<Vec<&str>>()).module_base_address(module)?;
|
||||
|
||||
// Read target process memory maps to find its module base address
|
||||
let target_maps = fs::read_to_string(format!("/proc/{}/maps", pid)).ok()?;
|
||||
let target_map_lines = target_maps.lines().collect::<Vec<&str>>();
|
||||
let elf = ExecuteLinkFile::prase(module).ok()?;
|
||||
let sym = elf.prase_dyn_sym(symbol).ok()?;
|
||||
|
||||
// Find module base address in target process
|
||||
let Some(module_base_target) = module_base_address(&target_map_lines, module) else {
|
||||
return None;
|
||||
};
|
||||
Some(sym.st_value + base)
|
||||
}
|
||||
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} {module} base = {:#016x}",
|
||||
module_base_target
|
||||
);
|
||||
pub fn find_got_pointer_plt(&self, symbol: &str) -> Option<u64>
|
||||
{
|
||||
let exe = self.get_exe().ok()?;
|
||||
let elf = ExecuteLinkFile::prase(&exe).ok()?;
|
||||
|
||||
// Calculate symbol address in target process using the same offset
|
||||
let target_symbol_addr = module_base_target + symbol_offset;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} {symbol} address = {:#016x}",
|
||||
target_symbol_addr
|
||||
);
|
||||
|
||||
Some(target_symbol_addr)
|
||||
let r_sym = elf.get_rela_sym(symbol).ok()?;
|
||||
Some(r_sym.r_offset + self.map.module_base_address(&exe)?)
|
||||
}
|
||||
}
|
||||
@@ -18,269 +18,29 @@ use std::io::BufRead;
|
||||
const GREEN: &str = "\x1b[32m";
|
||||
const RESET: &str = "\x1b[0m";
|
||||
|
||||
fn inject1(pid: Pid, seg_rw: (u64, u64)) -> Result<(), Box<dyn std::error::Error>> // Simple injection
|
||||
{
|
||||
let regs = ptrace::getregs(pid)?;
|
||||
let injected_data = "You are injected. \r\n";
|
||||
write_memory_vm(pid, seg_rw.0 as usize, &injected_data.as_bytes())?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write \"{}\" to {:#016x}",
|
||||
injected_data, seg_rw.0
|
||||
);
|
||||
|
||||
let injected_inst = assemble(regs.rip as u64, |asm| {
|
||||
asm.mov(rax, 1u64)?; // Syscall 1 (write)
|
||||
asm.mov(rdi, 1u64)?; // Fd 1 (STDOUT)
|
||||
asm.mov(rsi, seg_rw.0)?; // Buffer pointer (Here is rw segment in target)
|
||||
asm.mov(rdx, injected_data.as_bytes().len() as u64)?; // Buffer length
|
||||
asm.syscall()?; // Syscall interrupt
|
||||
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
|
||||
Ok(())
|
||||
})?;
|
||||
|
||||
write_memory_ptrace(pid, regs.rip as usize, &injected_inst)?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
|
||||
regs.rip
|
||||
);
|
||||
|
||||
// Continue target
|
||||
ptrace::cont(pid, None)?;
|
||||
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
|
||||
wait(pid);
|
||||
|
||||
let regs = ptrace::getregs(pid)?;
|
||||
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn inject2(pid: Pid, seg_rw: (u64, u64)) -> Result<(), Box<dyn std::error::Error>> // ld injection
|
||||
{
|
||||
let regs = ptrace::getregs(pid)?;
|
||||
// Get the absolute path to our shared library
|
||||
let lib_path = fs::canonicalize("./target/debug/libproject_hbj_attacker.so")?
|
||||
.to_string_lossy()
|
||||
.into_owned();
|
||||
|
||||
// Start Inject
|
||||
let c_lib_path = CString::new(lib_path).unwrap();
|
||||
write_memory_vm(pid, seg_rw.0 as usize, c_lib_path.as_bytes_with_nul())?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write {} to {:#016x}",
|
||||
&c_lib_path.to_string_lossy(),
|
||||
seg_rw.0
|
||||
);
|
||||
|
||||
let Some(target_dlopen_addr) = find_remote_proc("libc.so", "dlopen", pid) else {
|
||||
return Err(Box::new(std::io::Error::new(
|
||||
std::io::ErrorKind::Other,
|
||||
"first rw segment not found",
|
||||
)));
|
||||
};
|
||||
|
||||
let injected_inst = assemble(regs.rip as u64, |asm| {
|
||||
asm.mov(rdi, seg_rw.0)?; // Param 1: Filename
|
||||
asm.mov(rsi, 2u64)?; // Param 2: Flag, 2(RTLD_NOW)
|
||||
asm.call(target_dlopen_addr)?; // Syscall interrupt
|
||||
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
|
||||
Ok(())
|
||||
})?;
|
||||
|
||||
write_memory_ptrace(pid, regs.rip as usize, &injected_inst)?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
|
||||
regs.rip
|
||||
);
|
||||
|
||||
// Continue target
|
||||
ptrace::cont(pid, None)?;
|
||||
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
|
||||
wait(pid);
|
||||
|
||||
let regs = ptrace::getregs(pid)?;
|
||||
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn inject3(pid: Pid, seg_rw: (u64, u64)) -> Result<i32, Box<dyn std::error::Error>> // thread inject
|
||||
{
|
||||
let regs = ptrace::getregs(pid)?;
|
||||
// Alloc rwx memory
|
||||
|
||||
let injected_inst = assemble(regs.rip as u64, |asm| {
|
||||
asm.mov(rax, 9u64)?; // Syscall 9 (mmap)
|
||||
|
||||
asm.mov(rdi, 0u64)?; // Addr
|
||||
asm.mov(rsi, 4096u64)?; // Length, we alloc a page (4K)
|
||||
asm.mov(
|
||||
rdx,
|
||||
(libc::PROT_READ | libc::PROT_WRITE | libc::PROT_EXEC) as u64,
|
||||
)?; // Set protect to rwx
|
||||
asm.mov(r10, (libc::MAP_PRIVATE | libc::MAP_ANONYMOUS) as u64)?; // Private and anonymous
|
||||
asm.mov(r8, 01i64)?; // Fd (-1 because we want anonymous)
|
||||
asm.mov(r9, 0u64)?; // Offset
|
||||
|
||||
asm.syscall()?; // Syscall interrupt
|
||||
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
|
||||
Ok(())
|
||||
})?;
|
||||
|
||||
write_memory_ptrace(pid, regs.rip as usize, &injected_inst)?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
|
||||
regs.rip
|
||||
);
|
||||
|
||||
// Continue target
|
||||
ptrace::cont(pid, None)?;
|
||||
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
|
||||
wait(pid);
|
||||
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} int3 at {:#016x}",
|
||||
ptrace::getregs(pid)?.rip
|
||||
);
|
||||
|
||||
let regs_after_map = ptrace::getregs(pid)?;
|
||||
let page_addr = regs_after_map.rax as usize;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} allocated page is at {:#016x}",
|
||||
page_addr
|
||||
);
|
||||
|
||||
let injected_data = "[%d] I am the injected thread, I am running... \r\n";
|
||||
write_memory_vm(
|
||||
pid,
|
||||
page_addr + 0x200,
|
||||
&CString::new(injected_data).unwrap().as_bytes_with_nul(),
|
||||
)?;
|
||||
write_memory_vm(pid, page_addr + 0x300, &1i64.to_le_bytes())?;
|
||||
write_memory_vm(pid, page_addr + 0x308, &0u64.to_le_bytes())?;
|
||||
|
||||
let printf = find_remote_proc("libc.so", "printf", pid).unwrap();
|
||||
|
||||
// Construct inject payload
|
||||
let injected_payload = assemble(page_addr as u64, |asm| {
|
||||
let mut target_label = asm.create_label();
|
||||
|
||||
asm.mov(rbp, rsp)?;
|
||||
asm.mov(rcx, 0u64)?;
|
||||
asm.set_label(&mut target_label)?;
|
||||
|
||||
asm.add(rcx, 1i32)?;
|
||||
asm.push(rcx)?;
|
||||
|
||||
asm.mov(rdi, (page_addr + 0x200) as u64)?;
|
||||
asm.mov(rsi, rcx)?;
|
||||
asm.call(printf)?;
|
||||
|
||||
asm.mov(rax, 35u64)?; // Syscall 35 (nano sleep)
|
||||
asm.mov(rdi, (page_addr + 0x300) as u64)?; // Req
|
||||
asm.mov(rsi, 0u64)?; //Rem
|
||||
asm.syscall()?; // Syscall interrupt
|
||||
|
||||
asm.pop(rcx)?;
|
||||
asm.jmp(target_label)?; // Jmp back to loop
|
||||
Ok(())
|
||||
})?;
|
||||
write_memory_vm(pid, page_addr, &injected_payload)?;
|
||||
println!("{GREEN}[trace]{RESET} write payload to {:#016x}", page_addr);
|
||||
|
||||
// Start Trigger
|
||||
// let regs = ptrace::getregs(pid)?;
|
||||
ptrace::setregs(pid, regs)?;
|
||||
|
||||
let injected_trigger = assemble(regs.rip as u64, |asm| {
|
||||
asm.mov(rax, 56u64)?; // Syscall 56 (clone)
|
||||
|
||||
asm.mov(
|
||||
rdi,
|
||||
(libc::CLONE_VM
|
||||
| libc::CLONE_FS
|
||||
| libc::CLONE_FILES
|
||||
| libc::CLONE_SIGHAND
|
||||
| libc::CLONE_THREAD) as u64,
|
||||
)?; // Flags
|
||||
asm.mov(rsi, (page_addr + 0x1000) as u64)?; // Stack top
|
||||
|
||||
asm.mov(rdx, 0u64)?; // parent_tid = NULL
|
||||
asm.mov(r10, 0u64)?; // child_tid = NULL
|
||||
asm.mov(r8, 0u64)?; // tls = NULL
|
||||
|
||||
asm.syscall()?; // Syscall interrupt
|
||||
asm.test(eax, eax)?; // Syscall returns zero?
|
||||
asm.jz(page_addr as u64)?;
|
||||
|
||||
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
|
||||
|
||||
Ok(())
|
||||
})?;
|
||||
|
||||
write_memory_ptrace(pid, regs.rip as usize, &injected_trigger)?;
|
||||
println!("{GREEN}[trace]{RESET} write trigger to {:#016x}", regs.rip);
|
||||
|
||||
ptrace::cont(pid, None)?;
|
||||
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
|
||||
wait(pid);
|
||||
|
||||
let regs = ptrace::getregs(pid)?;
|
||||
let pid_new_thread = Pid::from_raw(regs.rax as i32);
|
||||
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} new thread is {}, which will be suspend.",
|
||||
pid_new_thread
|
||||
);
|
||||
|
||||
ptrace::attach(pid_new_thread)?;
|
||||
wait(pid_new_thread);
|
||||
println!("{GREEN}[trace]{RESET} attached new thread.");
|
||||
|
||||
loop {
|
||||
let regs = ptrace::getregs(pid_new_thread)?;
|
||||
println!(
|
||||
"{GREEN}[trace]{RESET} rip in new thread is {:#016x}.",
|
||||
regs.rip
|
||||
);
|
||||
|
||||
if regs.rip >= page_addr as u64 && regs.rip < (page_addr + 0x1000) as u64 {
|
||||
println!("{GREEN}[trace]{RESET} rip in new thread return to inject payload.");
|
||||
break;
|
||||
}
|
||||
|
||||
ptrace::step(pid_new_thread, None)?;
|
||||
wait(pid_new_thread);
|
||||
}
|
||||
|
||||
Ok(pid_new_thread.as_raw())
|
||||
}
|
||||
|
||||
fn main() -> Result<(), Box<dyn std::error::Error>> {
|
||||
// Find our target program
|
||||
let pid = Pid::from_raw(get_pid_by_name("target")?);
|
||||
let proc = Process::new(pid)?;
|
||||
|
||||
let target = fs::read_link(format!("/proc/{}/exe", pid))?
|
||||
.to_string_lossy()
|
||||
.into_owned();
|
||||
let content = fs::read_to_string(format!("/proc/{}/maps", pid))?;
|
||||
let lines: Vec<&str> = content
|
||||
.lines()
|
||||
.filter(|&line| !line.is_empty() && line.contains(&target))
|
||||
.collect();
|
||||
let exe = proc.get_exe()?;
|
||||
let maps = proc.get_map_str()?;
|
||||
let lines: Vec<&str> = maps.lines().filter(|&line| !line.is_empty()).collect();
|
||||
|
||||
for line in &lines {
|
||||
println!("{GREEN}[memory map]{RESET} {}", line);
|
||||
}
|
||||
|
||||
let Some(seg_rw) = first_rw_segment(&lines) else {
|
||||
let map = MemoryMap::new(&lines);
|
||||
|
||||
let Some(seg_rw) = map.first_rw_segment(&exe) else {
|
||||
return Err(Box::new(std::io::Error::new(
|
||||
std::io::ErrorKind::Other,
|
||||
"first rw segment not found",
|
||||
)));
|
||||
};
|
||||
|
||||
let Some(seg_x) = first_exec_segment(&lines) else {
|
||||
let Some(seg_x) = map.first_exec_segment(&exe) else {
|
||||
return Err(Box::new(std::io::Error::new(
|
||||
std::io::ErrorKind::Other,
|
||||
"first exec segment not found",
|
||||
@@ -288,18 +48,18 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
|
||||
};
|
||||
|
||||
ptrace::attach(pid)?;
|
||||
wait(pid);
|
||||
proc.wait();
|
||||
ptrace::step(pid, None)?;
|
||||
wait(pid);
|
||||
proc.wait();
|
||||
|
||||
// Save context
|
||||
let regs = ptrace::getregs(pid)?; // Save current registers
|
||||
let buffer = read_memory_vm(pid, seg_x.0 as usize, 4096)?; // Save current memory context
|
||||
let buffer_rw = read_memory_vm(pid, seg_rw.0 as usize, 4096)?; // Save current rw memory
|
||||
let buffer = proc.read_memory_vm(seg_x.0 as usize, 4096)?; // Save current memory context
|
||||
let buffer_rw = proc.read_memory_vm(seg_rw.0 as usize, 4096)?; // Save current rw memory
|
||||
|
||||
println!("{GREEN}[trace]{RESET} Seg_x.0 is {:#016x}", seg_x.0);
|
||||
|
||||
write_memory_ptrace(pid, seg_x.0 as usize, &[0x90u8; 4096])?;
|
||||
proc.write_memory_ptrace(seg_x.0 as usize, &[0x90u8; 4096])?;
|
||||
ptrace::setregs(
|
||||
pid,
|
||||
user_regs_struct {
|
||||
@@ -310,22 +70,17 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
|
||||
|
||||
// Do inject here
|
||||
|
||||
let c = inject3(pid, seg_rw)?;
|
||||
let c = inject3(&proc, seg_rw)?;
|
||||
|
||||
// End inject logics
|
||||
|
||||
// Restore context
|
||||
ptrace::setregs(pid, regs)?;
|
||||
write_memory_ptrace(pid, seg_x.0 as usize, &buffer)?;
|
||||
write_memory_vm(pid, seg_rw.0 as usize, &buffer_rw)?;
|
||||
proc.write_memory_ptrace(seg_x.0 as usize, &buffer)?;
|
||||
proc.write_memory_vm(seg_rw.0 as usize, &buffer_rw)?;
|
||||
|
||||
ptrace::detach(pid, None)?;
|
||||
ptrace::detach(Pid::from_raw(c), None)?;
|
||||
|
||||
let mut input = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut input)
|
||||
.expect("Failed to read line");
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user