From 0cbe7fef38d35310895da849d064432c1802ff1c Mon Sep 17 00:00:00 2001 From: pbonilla Date: Mon, 19 Feb 2024 11:35:40 +0100 Subject: [PATCH] chaos --- .vscode/settings.json | 6 +++ Makefile | 2 +- includes/woody.h | 7 ++- payload | Bin 0 -> 42 bytes print | Bin 0 -> 4704 bytes print.s | 27 ++++++++++ shell_test | Bin 0 -> 15824 bytes shellcode_test.c | 26 ++++++++++ srcs/main.c | 25 +++++---- srcs/utils.c | 2 +- srcs/woody.c | 115 ++++++++++++++++++++++++++++++++++-------- 11 files changed, 173 insertions(+), 37 deletions(-) create mode 100644 .vscode/settings.json create mode 100644 payload create mode 100755 print create mode 100644 print.s create mode 100755 shell_test create mode 100644 shellcode_test.c diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..2386c0c --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,6 @@ +{ + "files.associations": { + "stdio.h": "c", + "mman.h": "c" + } +} \ No newline at end of file diff --git a/Makefile b/Makefile index 1cd28f8..59ab4ab 100644 --- a/Makefile +++ b/Makefile @@ -37,4 +37,4 @@ fclean: re: fclean make all -.PHONY : all clean fclean re +.PHONY : all clean fclean re \ No newline at end of file diff --git a/includes/woody.h b/includes/woody.h index c86a04a..7fc6f23 100644 --- a/includes/woody.h +++ b/includes/woody.h @@ -2,6 +2,7 @@ # define WOODY_H #include "../ft_printf/includes/ft_printf.h" +#include #include #include #include @@ -17,15 +18,17 @@ typedef struct efl_content long unsigned int file_size; char *file_path; char *file; + Elf64_Ehdr *Ehdr; + Elf64_Phdr *Phdr; char *extra_data; } t_efl_content; // utils.c -void *secure_access(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size); +void *secure_jump(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size); int ft_put_error(char *str); // woody.c -int woody(t_efl_content *file_content); +int inject(t_efl_content *woody); #endif \ No newline at end of file diff --git a/payload b/payload new file mode 100644 index 0000000000000000000000000000000000000000..34879f8ac9ac77b81acde8357cc6b9c522b94b98 GIT binary patch literal 42 ycmXp!Fmn^v{{x-JJ$g+A7#JA%SvP4J9{7LY+oR6oh6ngr_4LC1{aqsU^tb?s1Q3w` literal 0 HcmV?d00001 diff --git a/print b/print new file mode 100755 index 0000000000000000000000000000000000000000..5f1691355d4c1278dcdd35bafcf14c2a8ee383a0 GIT binary patch literal 4704 zcmb<-^>JfjWMqH=CI&kOFi*e%ECeAL7!(9yDi|0X7%Ui=fFvse3s@}+LJG)&>44B1 zpmH#pK>#8EvV#@Ggz_1n_Q7Z^h%yEk4Oa&hAEib^U^E0qLtr!nMnhmU1V%$(Gz3ON zU^E0qLtr!nMnhmU1c(m-!vixnas5BgdEBGd6x0>xXWgV_c;NqmZ;v{U8y?_i)zb_2 z_jifZ)8oQ#Ca6Ep!tn7wx++ev03(9}tbY$xAOxfZK%)m};=C|%1qY}~2qlR_TmgqT zLqSnyUWr~YLvC?8LwtNvadCWcNn%k6LwssVVo4&9%1dEj&?~OYElErQ(j`R@Is?Wk zNv$Y>SWOWr4b%+^8#b6JF#kfwJ>cUTPoXAu7HX$18ETEfbu1v kG${N*;^^Q8RKF^k1js&Q02=nervEQgzap|?ARApj0JJPO2mk;8 literal 0 HcmV?d00001 diff --git a/print.s b/print.s new file mode 100644 index 0000000..3759956 --- /dev/null +++ b/print.s @@ -0,0 +1,27 @@ +bits 64 +default rel +global _start + +; rdi rsi rdx +; v v v +;write(fd, msg, len); + +_start: + xor eax, eax + cdq + mov dl, 10 ;3eme argument (rdx) + inc eax ;eax = 1 (syscall) + mov edi, eax ;1er argument rdi = 1 + lea rsi, [rel msg] ;2eme arg + syscall + mov dl, 42 ;petit registre pour enregistrer 42 sans 0x00 + xor eax, eax + inc eax + mul dl ;multiplier 42 * rax (rax = 1), resultat dans rax + mov edi, eax ;bouger la valeur 42 de rax à rdi + xor eax, eax + syscall + +msg db "..WOODY..",10 + + diff --git a/shell_test b/shell_test new file mode 100755 index 0000000000000000000000000000000000000000..15ec415a5e362e2036ebf2435a95193c15653010 GIT binary patch literal 15824 zcmeHOZEPGz8J;`m!=;JsBn|nbS(OHA8gK3#+X@9Y=h)}0!AVMDgMh-a_O0!c?!(;e zwRVBxDtuXKM37M72S`Aft|}?ezUN zbx>^~dsD#a@{9&5)#-Y2J+=zpLdbD@Inx9WYMNTm2|Z-wxQ){CW?ceQavdBO6p0NU zn3o2C;2Z53(qaUk6&e_hV{MkZw8L`$dh8TkQi6zMljD@B{b@LK60A!i= zGm0sx1{jT-k+>)hNgR;d;B@{KFZbWHcb~*Nv4QqKNI(vQ9KqhJ2lFJIX8+n3rq-gLb#sZT2?u$9j}KGIrX|xfORhU-jI|*y+JSx#W&H z69ukrx>znrb+&eG>c|Qvf`59X5@d6KF<)x?^S7|-JpY*c@mC%rnUnOy(+T%6?jK`^ z=2ztY2EQZ~wq|rWc-YrZXr9NAHA7ko@!@g55#lk&IA%G-^ZY?t3GqB%;uI?oD-bIX zD-bIXD-bIXD-bKd3jC%0_J3LzUTw85ZvORArL51_y`=x5b>Z38X99uz-Y1Cuvw!$o z1nq|cf3kiWSVKBK{l}5TYah23U$!p%e)+z!Y`UI)&brk9JXPTDu9D|pr_A<4p9|_E z{(Hn&mo{^~*1K1{-PH64IZsXB;xDxyT42X#1j&Cs@b9fKbgo*9%huC>I$=G%(qbj9 zSl3p)+o*!WQbDV~G}V5H`h|GDzJ-31idF6IaqB{VlC#$0E8aHiV*eI0Zgl#-eX%>h{dcg#(AMA= zusbQ+L!YOJ4~Vvo;kLc+Yrplu)&+H9|2^+Ic4zQ&A;)vOkHe4hoVZSpK95j8QcPsq zI=+w`+`eU+8fH6Au>!FIu>!FIu>!FIu>!FIu>!FIu>!FIO%=d?MeI++-b3u!+=eLG zzqnoO`(>ZwKC!V6@_^WQ7uzp3_Cxaf8z+?iZPhQc{iJMS#NNaie)*)N_p~Z?UCQ60 zY4s(+TLt$D?iK_{n5xVE$E{M3l7`Tay708wGf1fKcCq32hOhfeItA3K*uf@T@}*yf zgX@8g^qLyj%W^&c5F7oH>i>6u{o!x2M(j&X|0Z33GI4c5of;gx$GB^JqE_;1MmlBo znyIdIEils$cXykqo=&0vW6P||CiS`>bzjeE|MDlxf!g zjjoG#3nXYqcHKY?YuK!wD}g`F`pCGy5QOben~b%1&b>^ZgnDb^en9C8Wt!~+-%WxT za0+22;P)t%36Ydd6W^isH1tI2apHF-+ZCQ0;O`axXg%)_>W9}FeuVfP$vq156D8Bk zQ_ITGjNESO0pdGoe2ok|H4YKKlg2S4^Cb8`Dk}Pv_+vgG>WkvvDbKx>6g)~i_a|Ea z*NHa}9Ks(Fe@Dnh_A2o^lk_x;%-dfOzk~Gb$Y@VIpVaxuikCLawA0<0$lIPXt%#_4 zwW%p{QmyTZx4oi0$@}7~I8PxV%O+26oojW*EfglpIoI~wsz*Ju?cs9+r?YnU%#cm{ z@`pZrX5jS5AklQd!OmJzY7L!J_NmdcCkICDv%|yZvt#zyz{$}pMMTdDWN|C{M&p4$VpCcGKOJ2Er$*xu1oFW0}%buuKB{n#zVB2)| z09V9^5}KYgSbyN5(QQ7|5a>oDk#p&sPj$ZNITM6lMdJ)|`4Sy-m{n$}?78N2sb
)R`I62bAb0ct{ajG-Q%*~gm35{MwmptHBs`+whoncd1#Vt4- zpiCZFWzH7#mpNUgjOWhLH%|}pEC=$M?u<-`nHsODR4k7mkmf zr{ez)4<|gg!13Rwa6JA#0u49{M&mz3{NHKKf&OEi1w{K;XGQz(P&}`(5RY{j@Upba zePo>xkM&cYIR2B4c&zJy{C6{)xQ=l8BpJM>LOj+{K&(&EfA|3(rg&bX!Nxibi062; z|LDUd%CM%0$GQ<%7e}-oz5cIJIbRdX8_#!n&SSkS)dX!J&-hLHgyRi~1B%%Qfem~j z5}%R+ApB4PY~c4J@fj%q?u!f<;!xiYBk}nA55)Tf{G;>tClcRSn;7CL81;t@{F%gK z{IDJZ^0}^XLL9iOl;KN6e9F)zz^`hv@s05Z@hi%-(Ff~&tPgSiFzOE*_&bVi55;3W zy3$1?CHQG;%?AG(74Y0c`;B#?oF}cz`0@PbggA`jw~1pH#N$1xew4kH$^_qQUx)|t zx-uN!2uSG|yg#A_#KB&r40C87>#}_kkAA~nE(fM+A%Zz^Z}5n}yTRxT;=_os54&1Y x;U}bHd>`{1MgQ^q +#include +#include +#include + +// Define the shellcode +char code[] = "\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x12\x00\x00\x00\x0f\x05\xb2\x2a\x31\xc0\xff\xc0\xf6\xe2\x89\xc7\x31\xc0\xb0\x3c\x0f\x05\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a"; + +// Declare a function pointer with no arguments and no return value +typedef void (*ShellcodeFunc)(); + +int main() { + // Create a function pointer of the appropriate type and point it to the shellcode + ShellcodeFunc func = (ShellcodeFunc)code; + + // Make the memory containing the shellcode executable + // Using a reasonable default page size + size_t pagesize = 4096; // 4KB, a common page size + uintptr_t page_start = (uintptr_t)code & ~(pagesize - 1); + mprotect((void *)page_start, pagesize, PROT_READ | PROT_EXEC); + + // Call the shellcode + func(); + + return 0; +} diff --git a/srcs/main.c b/srcs/main.c index a5d84b1..3fd7078 100644 --- a/srcs/main.c +++ b/srcs/main.c @@ -1,29 +1,29 @@ #include "../includes/woody.h" -int get_elf_file(t_efl_content *file_content) +int get_elf_file(t_efl_content *woody) { int fd; off_t off; - fd = open(file_content->file_path, O_RDONLY); + fd = open(woody->file_path, O_RDONLY); if (fd < 0) { - ft_printf("Error: Failed to open \'%s\'\n", file_content->file_path); + ft_printf("Error: Failed to open \'%s\'\n", woody->file_path); return EXIT_FAILURE; } off = lseek(fd, 0, SEEK_END); if (off == -1) { close(fd); - ft_printf("Error: Failed to read file offset \'%s\'\n", file_content->file_path); + ft_printf("Error: Failed to read file offset \'%s\'\n", woody->file_path); return EXIT_FAILURE; } - file_content->file_size = off; - file_content->file = mmap(NULL, file_content->file_size, PROT_READ, MAP_PRIVATE, fd, 0); - if (file_content->file == MAP_FAILED) + woody->file_size = off; + woody->file = mmap(NULL, woody->file_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); + if (woody->file == MAP_FAILED) { close(fd); - ft_printf("Error: Failed to map file \'%s\'\n", file_content->file_path); + ft_printf("Error: Failed to map file \'%s\'\n", woody->file_path); return EXIT_FAILURE; } close(fd); @@ -32,15 +32,14 @@ int get_elf_file(t_efl_content *file_content) int main(int ac, char **av) { - t_efl_content file_content; + t_efl_content woody; if (ac != 2) { return ft_put_error("Woody_woodpacker take 1 argument\n"); } - file_content.file_path = av[1]; - int ret = get_elf_file(&file_content); + woody.file_path = av[1]; + int ret = get_elf_file(&woody); if (ret == EXIT_FAILURE) return ret; - - return woody(&file_content); + return inject(&woody); } \ No newline at end of file diff --git a/srcs/utils.c b/srcs/utils.c index 81a6e3c..84ca99a 100644 --- a/srcs/utils.c +++ b/srcs/utils.c @@ -1,6 +1,6 @@ #include "../includes/woody.h" -void *secure_access(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size) +void *secure_jump(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size) { if (file_size > offset_to_data && file_size >= (offset_to_data + supposed_data_size)) return (file + offset_to_data); diff --git a/srcs/woody.c b/srcs/woody.c index 7435bc1..a3ebdec 100644 --- a/srcs/woody.c +++ b/srcs/woody.c @@ -1,5 +1,7 @@ #include "../includes/woody.h" +#define CODE_MACRO "\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x10\x00\x00\x00\x0f\x05\xb2\x2a\x31\xc0\xff\xc0\xf6\xe2\x89\xc7\x31\xc0\x0f\x05\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a" + int elf_magic_numbers(char *str) { return (!ft_strncmp(str, ELFMAG, SELFMAG)); @@ -36,49 +38,122 @@ int save_elf(char *path, char *file, unsigned long int size) return EXIT_SUCCESS; } -int woody(t_efl_content *file_content) +int get_load_segment(t_efl_content *woody, int start, bool executable) { - Elf64_Ehdr *Ehdr = (Elf64_Ehdr *)secure_access(file_content->file, file_content->file_size, 0, sizeof(Elf64_Ehdr)); - - if (!Ehdr || !elf_magic_numbers(file_content->file) || Ehdr->e_ident[EI_CLASS] != 2) + for (int i = start; i < woody->Ehdr->e_phnum; i++) { - ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", file_content->file_path); + if (woody->Phdr[i].p_type == PT_LOAD) + { + if (executable) + { + if (woody->Phdr[i].p_flags & PF_X) + return i; + } + else + return i; + } + } + return -1; +} + +void find_cave(t_efl_content *woody) +{ + woody->Phdr = (Elf64_Phdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr)); + + int i = get_load_segment(woody, 0, true); + int j = get_load_segment(woody, i + 1, false); + + printf("%d %ld\n", i, woody->Phdr[i].p_align); + printf("%d %ld\n", j, woody->Phdr[j].p_align); + printf("code_cave_start = %lx, virtual adress = %lx\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_vaddr); + printf("code_cave_size = %lx\n", woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz)); + + +// static void inject(t_woody64 *woody, const t_patch *patch) { +// char payload[] = PAYLOAD; + + Elf64_Off payload_off = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz; + +// ft_memcpy((void *)woody->file + payload_off, payload, PAYLOAD_SIZE); +// ft_memcpy( +// (void *)woody->file + payload_off + (PAYLOAD_SIZE - sizeof(t_patch)), +// patch, sizeof(t_patch)); + +// woody->file->e_entry = woody->load_seg->p_vaddr + woody->load_seg->p_filesz; +// woody->load_seg->p_filesz += PAYLOAD_SIZE; +// woody->load_seg->p_memsz += PAYLOAD_SIZE; +// } + + size_t len = sizeof(CODE_MACRO) - 1; + ft_memcpy(woody->file + payload_off, CODE_MACRO, len); + + woody->Ehdr->e_entry = woody->Phdr[i].p_vaddr + woody->Phdr[i].p_filesz; + woody->Phdr[i].p_filesz += len; + woody->Phdr[i].p_memsz += len; +} + + +int inject(t_efl_content *woody) +{ + woody->Ehdr = (Elf64_Ehdr *)secure_access(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr)); + if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != 2) + { + ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path); return EXIT_FAILURE; } - Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff, sizeof(Elf64_Shdr)); - if (Shdr == NULL || !secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff, Ehdr->e_shnum * sizeof(Elf64_Shdr))) + printf("entry point = %ld\n", woody->Ehdr->e_entry); + Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr)); + if (Shdr == NULL || !secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr))) { return ft_put_error("Corrupted file"); } - if (file_content->file_size > Ehdr->e_shoff + Ehdr->e_shnum * sizeof(Elf64_Shdr)) + if (woody->file_size > woody->Ehdr->e_shoff + woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)) { - printf("extra_data !\n"); // save it in file_content->extra_data and append it to the end of the woody file ? Could be dangerous + printf("extra_data !\n"); // save it in woody->extra_data and append it to the end of the woody file ? Could be dangerous } Elf64_Shdr *symbols_table = NULL; - for (int i = 0; i < Ehdr->e_shnum; i++) { + for (int i = 0; i < woody->Ehdr->e_shnum; i++) { if (Shdr[i].sh_type == SHT_SYMTAB) { - symbols_table = secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)); + symbols_table = secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)); } } if (symbols_table == NULL) + return ft_put_error("No symbols"); + + if (!secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr))) return ft_put_error("Corrupted file"); - Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff + (symbols_table->sh_link * Ehdr->e_shentsize), sizeof(Elf64_Shdr)); + char *Sshstrtab = (char *)secure_access(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0); + if (Sshstrtab == NULL) + return ft_put_error("Corrupted file"); + + for (int i = 0; i < woody->Ehdr->e_shnum; i++) { + char *section_name = Sshstrtab + Shdr[i].sh_name; + printf("%s : Offset: %lx | Size: %lx | Virtual adress: %lx\n", section_name, Shdr[i].sh_offset, Shdr[i].sh_size, Shdr[i].sh_addr); + } + + // useless for now + Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr)); if (!strtab_header) return ft_put_error("Corrupted file"); + char *strtab = secure_access(woody->file, woody->file_size, strtab_header->sh_offset, 0); + if (strtab == NULL) + return ft_put_error("Corrupted file"); + Elf64_Sym *symbols = (Elf64_Sym *)secure_access(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym)); + if (symbols == NULL) + return ft_put_error("Corrupted file"); + // end useless woody->Ehdr->e_entry = - if (strtab_header->sh_offset + strtab_header->sh_size > file_content->file_size) - { - return ft_put_error("Encrypt after the end of the file"); - } + find_cave(woody); - char *woody = malloc(file_content->file_size); - ft_memcpy(woody, file_content->file, file_content->file_size); + char *woody_file = malloc(woody->file_size); - encrypt_zone(woody, strtab_header->sh_offset , strtab_header->sh_size); + ft_memcpy(woody_file, woody->file, woody->file_size); + + encrypt_zone(woody_file, strtab_header->sh_offset , strtab_header->sh_size); - return save_elf("woody", woody, file_content->file_size); + return save_elf("woody", woody_file, woody->file_size); } \ No newline at end of file