diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..2386c0c --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,6 @@ +{ + "files.associations": { + "stdio.h": "c", + "mman.h": "c" + } +} \ No newline at end of file diff --git a/Makefile b/Makefile index 1cd28f8..59ab4ab 100644 --- a/Makefile +++ b/Makefile @@ -37,4 +37,4 @@ fclean: re: fclean make all -.PHONY : all clean fclean re +.PHONY : all clean fclean re \ No newline at end of file diff --git a/includes/woody.h b/includes/woody.h index c86a04a..7fc6f23 100644 --- a/includes/woody.h +++ b/includes/woody.h @@ -2,6 +2,7 @@ # define WOODY_H #include "../ft_printf/includes/ft_printf.h" +#include #include #include #include @@ -17,15 +18,17 @@ typedef struct efl_content long unsigned int file_size; char *file_path; char *file; + Elf64_Ehdr *Ehdr; + Elf64_Phdr *Phdr; char *extra_data; } t_efl_content; // utils.c -void *secure_access(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size); +void *secure_jump(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size); int ft_put_error(char *str); // woody.c -int woody(t_efl_content *file_content); +int inject(t_efl_content *woody); #endif \ No newline at end of file diff --git a/payload b/payload new file mode 100644 index 0000000..34879f8 Binary files /dev/null and b/payload differ diff --git a/print b/print new file mode 100755 index 0000000..5f16913 Binary files /dev/null and b/print differ diff --git a/print.s b/print.s new file mode 100644 index 0000000..3759956 --- /dev/null +++ b/print.s @@ -0,0 +1,27 @@ +bits 64 +default rel +global _start + +; rdi rsi rdx +; v v v +;write(fd, msg, len); + +_start: + xor eax, eax + cdq + mov dl, 10 ;3eme argument (rdx) + inc eax ;eax = 1 (syscall) + mov edi, eax ;1er argument rdi = 1 + lea rsi, [rel msg] ;2eme arg + syscall + mov dl, 42 ;petit registre pour enregistrer 42 sans 0x00 + xor eax, eax + inc eax + mul dl ;multiplier 42 * rax (rax = 1), resultat dans rax + mov edi, eax ;bouger la valeur 42 de rax à rdi + xor eax, eax + syscall + +msg db "..WOODY..",10 + + diff --git a/shell_test b/shell_test new file mode 100755 index 0000000..15ec415 Binary files /dev/null and b/shell_test differ diff --git a/shellcode_test.c b/shellcode_test.c new file mode 100644 index 0000000..6d164a5 --- /dev/null +++ b/shellcode_test.c @@ -0,0 +1,26 @@ +#include +#include +#include +#include + +// Define the shellcode +char code[] = "\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x12\x00\x00\x00\x0f\x05\xb2\x2a\x31\xc0\xff\xc0\xf6\xe2\x89\xc7\x31\xc0\xb0\x3c\x0f\x05\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a"; + +// Declare a function pointer with no arguments and no return value +typedef void (*ShellcodeFunc)(); + +int main() { + // Create a function pointer of the appropriate type and point it to the shellcode + ShellcodeFunc func = (ShellcodeFunc)code; + + // Make the memory containing the shellcode executable + // Using a reasonable default page size + size_t pagesize = 4096; // 4KB, a common page size + uintptr_t page_start = (uintptr_t)code & ~(pagesize - 1); + mprotect((void *)page_start, pagesize, PROT_READ | PROT_EXEC); + + // Call the shellcode + func(); + + return 0; +} diff --git a/srcs/main.c b/srcs/main.c index a5d84b1..3fd7078 100644 --- a/srcs/main.c +++ b/srcs/main.c @@ -1,29 +1,29 @@ #include "../includes/woody.h" -int get_elf_file(t_efl_content *file_content) +int get_elf_file(t_efl_content *woody) { int fd; off_t off; - fd = open(file_content->file_path, O_RDONLY); + fd = open(woody->file_path, O_RDONLY); if (fd < 0) { - ft_printf("Error: Failed to open \'%s\'\n", file_content->file_path); + ft_printf("Error: Failed to open \'%s\'\n", woody->file_path); return EXIT_FAILURE; } off = lseek(fd, 0, SEEK_END); if (off == -1) { close(fd); - ft_printf("Error: Failed to read file offset \'%s\'\n", file_content->file_path); + ft_printf("Error: Failed to read file offset \'%s\'\n", woody->file_path); return EXIT_FAILURE; } - file_content->file_size = off; - file_content->file = mmap(NULL, file_content->file_size, PROT_READ, MAP_PRIVATE, fd, 0); - if (file_content->file == MAP_FAILED) + woody->file_size = off; + woody->file = mmap(NULL, woody->file_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); + if (woody->file == MAP_FAILED) { close(fd); - ft_printf("Error: Failed to map file \'%s\'\n", file_content->file_path); + ft_printf("Error: Failed to map file \'%s\'\n", woody->file_path); return EXIT_FAILURE; } close(fd); @@ -32,15 +32,14 @@ int get_elf_file(t_efl_content *file_content) int main(int ac, char **av) { - t_efl_content file_content; + t_efl_content woody; if (ac != 2) { return ft_put_error("Woody_woodpacker take 1 argument\n"); } - file_content.file_path = av[1]; - int ret = get_elf_file(&file_content); + woody.file_path = av[1]; + int ret = get_elf_file(&woody); if (ret == EXIT_FAILURE) return ret; - - return woody(&file_content); + return inject(&woody); } \ No newline at end of file diff --git a/srcs/utils.c b/srcs/utils.c index 81a6e3c..84ca99a 100644 --- a/srcs/utils.c +++ b/srcs/utils.c @@ -1,6 +1,6 @@ #include "../includes/woody.h" -void *secure_access(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size) +void *secure_jump(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size) { if (file_size > offset_to_data && file_size >= (offset_to_data + supposed_data_size)) return (file + offset_to_data); diff --git a/srcs/woody.c b/srcs/woody.c index 7435bc1..a3ebdec 100644 --- a/srcs/woody.c +++ b/srcs/woody.c @@ -1,5 +1,7 @@ #include "../includes/woody.h" +#define CODE_MACRO "\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x10\x00\x00\x00\x0f\x05\xb2\x2a\x31\xc0\xff\xc0\xf6\xe2\x89\xc7\x31\xc0\x0f\x05\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a" + int elf_magic_numbers(char *str) { return (!ft_strncmp(str, ELFMAG, SELFMAG)); @@ -36,49 +38,122 @@ int save_elf(char *path, char *file, unsigned long int size) return EXIT_SUCCESS; } -int woody(t_efl_content *file_content) +int get_load_segment(t_efl_content *woody, int start, bool executable) { - Elf64_Ehdr *Ehdr = (Elf64_Ehdr *)secure_access(file_content->file, file_content->file_size, 0, sizeof(Elf64_Ehdr)); - - if (!Ehdr || !elf_magic_numbers(file_content->file) || Ehdr->e_ident[EI_CLASS] != 2) + for (int i = start; i < woody->Ehdr->e_phnum; i++) { - ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", file_content->file_path); + if (woody->Phdr[i].p_type == PT_LOAD) + { + if (executable) + { + if (woody->Phdr[i].p_flags & PF_X) + return i; + } + else + return i; + } + } + return -1; +} + +void find_cave(t_efl_content *woody) +{ + woody->Phdr = (Elf64_Phdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr)); + + int i = get_load_segment(woody, 0, true); + int j = get_load_segment(woody, i + 1, false); + + printf("%d %ld\n", i, woody->Phdr[i].p_align); + printf("%d %ld\n", j, woody->Phdr[j].p_align); + printf("code_cave_start = %lx, virtual adress = %lx\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_vaddr); + printf("code_cave_size = %lx\n", woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz)); + + +// static void inject(t_woody64 *woody, const t_patch *patch) { +// char payload[] = PAYLOAD; + + Elf64_Off payload_off = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz; + +// ft_memcpy((void *)woody->file + payload_off, payload, PAYLOAD_SIZE); +// ft_memcpy( +// (void *)woody->file + payload_off + (PAYLOAD_SIZE - sizeof(t_patch)), +// patch, sizeof(t_patch)); + +// woody->file->e_entry = woody->load_seg->p_vaddr + woody->load_seg->p_filesz; +// woody->load_seg->p_filesz += PAYLOAD_SIZE; +// woody->load_seg->p_memsz += PAYLOAD_SIZE; +// } + + size_t len = sizeof(CODE_MACRO) - 1; + ft_memcpy(woody->file + payload_off, CODE_MACRO, len); + + woody->Ehdr->e_entry = woody->Phdr[i].p_vaddr + woody->Phdr[i].p_filesz; + woody->Phdr[i].p_filesz += len; + woody->Phdr[i].p_memsz += len; +} + + +int inject(t_efl_content *woody) +{ + woody->Ehdr = (Elf64_Ehdr *)secure_access(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr)); + if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != 2) + { + ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path); return EXIT_FAILURE; } - Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff, sizeof(Elf64_Shdr)); - if (Shdr == NULL || !secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff, Ehdr->e_shnum * sizeof(Elf64_Shdr))) + printf("entry point = %ld\n", woody->Ehdr->e_entry); + Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr)); + if (Shdr == NULL || !secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr))) { return ft_put_error("Corrupted file"); } - if (file_content->file_size > Ehdr->e_shoff + Ehdr->e_shnum * sizeof(Elf64_Shdr)) + if (woody->file_size > woody->Ehdr->e_shoff + woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)) { - printf("extra_data !\n"); // save it in file_content->extra_data and append it to the end of the woody file ? Could be dangerous + printf("extra_data !\n"); // save it in woody->extra_data and append it to the end of the woody file ? Could be dangerous } Elf64_Shdr *symbols_table = NULL; - for (int i = 0; i < Ehdr->e_shnum; i++) { + for (int i = 0; i < woody->Ehdr->e_shnum; i++) { if (Shdr[i].sh_type == SHT_SYMTAB) { - symbols_table = secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)); + symbols_table = secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)); } } if (symbols_table == NULL) + return ft_put_error("No symbols"); + + if (!secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr))) return ft_put_error("Corrupted file"); - Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff + (symbols_table->sh_link * Ehdr->e_shentsize), sizeof(Elf64_Shdr)); + char *Sshstrtab = (char *)secure_access(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0); + if (Sshstrtab == NULL) + return ft_put_error("Corrupted file"); + + for (int i = 0; i < woody->Ehdr->e_shnum; i++) { + char *section_name = Sshstrtab + Shdr[i].sh_name; + printf("%s : Offset: %lx | Size: %lx | Virtual adress: %lx\n", section_name, Shdr[i].sh_offset, Shdr[i].sh_size, Shdr[i].sh_addr); + } + + // useless for now + Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr)); if (!strtab_header) return ft_put_error("Corrupted file"); + char *strtab = secure_access(woody->file, woody->file_size, strtab_header->sh_offset, 0); + if (strtab == NULL) + return ft_put_error("Corrupted file"); + Elf64_Sym *symbols = (Elf64_Sym *)secure_access(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym)); + if (symbols == NULL) + return ft_put_error("Corrupted file"); + // end useless woody->Ehdr->e_entry = - if (strtab_header->sh_offset + strtab_header->sh_size > file_content->file_size) - { - return ft_put_error("Encrypt after the end of the file"); - } + find_cave(woody); - char *woody = malloc(file_content->file_size); - ft_memcpy(woody, file_content->file, file_content->file_size); + char *woody_file = malloc(woody->file_size); - encrypt_zone(woody, strtab_header->sh_offset , strtab_header->sh_size); + ft_memcpy(woody_file, woody->file, woody->file_size); + + encrypt_zone(woody_file, strtab_header->sh_offset , strtab_header->sh_size); - return save_elf("woody", woody, file_content->file_size); + return save_elf("woody", woody_file, woody->file_size); } \ No newline at end of file