gbrochar
/
woody-woodpacker
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

rot1 #2

Merged
gbrochar merged 13 commits from rot1 into master 2024-08-20 13:52:23 +00:00
Conversation 1 Commits 13 Files Changed 16 +98 -195
3 changed files with 98 additions and 195 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 3dfc4c27d2 - Show all commits

6
includes/woody.h
View File

@ -25,7 +25,7 @@
typedef struct payload
{
char *payload;
size_t len;
int len;
} t_payload;
typedef struct elf_content
@ -51,7 +51,9 @@ int get_symbols_count(int sh_size, int sh_entsize);
char *get_section_name(t_elf_content *woody, int section_index);
// woody.c
int prepare_injection(t_elf_content *woody);
int inject(t_elf_content *woody);
int get_elf_sections(t_elf_content *woody);
// encrypt.c
void encrypt(char *file, unsigned long int offset, unsigned long int size);

57
srcs/main.c
View File

@ -8,14 +8,14 @@ int get_elf_file(t_elf_content *woody)
fd = open(woody->file_path, O_RDONLY);
if (fd < 0)
{
printf("Error: Failed to open \'%s\'\n", woody->file_path);
ft_printf("Error: Failed to open \'%s\'\n", woody->file_path);
return EXIT_FAILURE;
}
off = lseek(fd, 0, SEEK_END);
if (off == -1)
{
close(fd);
printf("Error: Failed to read file offset \'%s\'\n", woody->file_path);
ft_printf("Error: Failed to read file offset \'%s\'\n", woody->file_path);
return EXIT_FAILURE;
}
woody->file_size = off;
@ -23,13 +23,47 @@ int get_elf_file(t_elf_content *woody)
if (woody->file == MAP_FAILED)
{
close(fd);
printf("Error: Failed to map file \'%s\'\n", woody->file_path);
ft_printf("Error: Failed to map file \'%s\'\n", woody->file_path);
return EXIT_FAILURE;
}
close(fd);
return EXIT_SUCCESS;
}
int save_file(char *path, char *file, unsigned long int size)
{
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
if (fd == -1) {
printf("Error: Failed to create new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (write(fd, file, size) == -1) {
close(fd);
printf("Error: Failed to write new file \'%s\'\n", path);
return EXIT_FAILURE;
}
close(fd);
return EXIT_SUCCESS;
}
int save_woody(t_elf_content *woody)
{
char *woody_file = malloc(woody->file_size);
if (!woody_file)
return ft_put_error("Allocation error");
ft_memcpy(woody_file, woody->file, woody->file_size);
if (munmap(woody->file, woody->file_size))
return ft_put_error("Umapping error");
int save_error = save_file("woody", woody_file, woody->file_size);
if (save_error)
return save_error;
free(woody_file);
return EXIT_SUCCESS;
}
int main(int ac, char **av)
{
t_elf_content woody;
@ -38,9 +72,18 @@ int main(int ac, char **av)
return ft_put_error("Woody_woodpacker take 1 argument\n");
}
woody.file_path = av[1];
int ret = get_elf_file(&woody);
if (ret == EXIT_FAILURE)
return ret;
return prepare_injection(&woody);
int elf_error = get_elf_file(&woody);
if (elf_error)
return elf_error;
elf_error = get_elf_sections(&woody);
if (elf_error)
return elf_error;
int inject_error = inject(&woody);
if (!inject_error)
{
return save_woody(&woody);
}
return EXIT_SUCCESS;
}

230
srcs/woody.c
View File

@ -5,27 +5,6 @@ int elf_magic_numbers(char *str)
return (!ft_strncmp(str, ELFMAG, SELFMAG));
}
int save_elf(char *path, char *file, unsigned long int size)
{
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
if (fd == -1) {
printf("Error: Failed to create new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (write(fd, file, size) == -1) {
close(fd);
printf("Error: Failed to write new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (close(fd) == -1) {
printf("Error: Failed to close new file \'%s\'\n", path);
return EXIT_FAILURE;
}
return EXIT_SUCCESS;
}
int get_load_segment(t_elf_content *woody, int start, bool executable)
{
for (int i = start; i < woody->Ehdr->e_phnum; i++)
@ -44,114 +23,6 @@ int get_load_segment(t_elf_content *woody, int start, bool executable)
return -1;
}
void offset_sections(t_elf_content *woody, unsigned int from, unsigned int offset_ammount)
{
for (int i = 0; i < woody->Ehdr->e_shnum; i++)
{
if (woody->Shdr[i].sh_type == SHT_REL)
{
int num_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize;
Elf64_Rel *rel = (Elf64_Rel *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset, woody->Shdr[i].sh_size);
for (int j = 0; j < num_entries; j++)
{
rel[j].r_offset += offset_ammount;
printf(" Offset: 0x%lx, Info: 0x%lx, Type: %u, Symbol: %u\n",
(unsigned long)rel[j].r_offset, (unsigned long)rel[j].r_info,
(unsigned int)ELF64_R_TYPE(rel[j].r_info), (unsigned int)ELF64_R_SYM(rel[j].r_info));
}
}
else if (woody->Shdr[i].sh_type == SHT_RELA)
{
int num_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize;
Elf64_Rela *rela = (Elf64_Rela *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset , woody->Shdr[i].sh_size);
for (int j = 0; j < num_entries; j++)
{
rela[j].r_offset += offset_ammount;
if (rela[j].r_addend >= from)
rela[j].r_addend += offset_ammount;
// printf(" Offset: 0x%lx, Info: 0x%lx, Type: %u, Symbol: %u adden: 0x%lx\n",
// (unsigned long)rela[j].r_offset, (unsigned long)rela[j].r_info,
// (unsigned int)ELF64_R_TYPE(rela[j].r_info), (unsigned int)ELF64_R_SYM(rela[j].r_info), (unsigned long)rela[j].r_addend);
}
} else if (woody->Shdr[i].sh_type == SHT_DYNAMIC)
{
int num_dyn_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize;
Elf64_Dyn *dyn_entries = (Elf64_Dyn *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset , woody->Shdr[i].sh_size);
for (int j = 0; j < num_dyn_entries; j++)
{
// printf("dyn_entries[%d].d_tag = %lx ptr = %lx value = %lx\n",j, dyn_entries[j].d_tag, dyn_entries[j].d_un.d_ptr, dyn_entries[j].d_un.d_val);
if (dyn_entries[j].d_tag == DT_PLTGOT || dyn_entries[j].d_tag == DT_FINI || dyn_entries[j].d_tag == DT_INIT_ARRAY || dyn_entries[j].d_tag == DT_FINI_ARRAY)
{
dyn_entries[j].d_un.d_ptr += offset_ammount;
}
}
}
char *section_name = get_section_name(woody, i);
if (section_name && !ft_strcmp(".got", section_name))
{
int num_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize;
Elf64_Addr *got_entri = (Elf64_Addr *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset, woody->Shdr[i].sh_size);
for (int j = 0; j < num_entries; j++)
{
if (got_entri[j])
{
got_entri[j] += offset_ammount;
}
}
}
}
for (int i = 0; i < woody->Ehdr->e_phnum; i++)
{
if (woody->Phdr[i].p_offset >= from)
{
woody->Phdr[i].p_offset += offset_ammount;
woody->Phdr[i].p_vaddr += offset_ammount;
woody->Phdr[i].p_paddr += offset_ammount;
}
}
for (int i = 0; i < woody->Ehdr->e_shnum; i++)
{
if (woody->Shdr[i].sh_offset >= from)
{
woody->Shdr[i].sh_offset += offset_ammount;
woody->Shdr[i].sh_addr += offset_ammount;
}
}
for (int i = 1; i < woody->num_symbols; i++)
{
if (woody->symbols[i].st_value >= from)
{
woody->symbols[i].st_value += offset_ammount;
}
}
}
void create_codecave(t_elf_content *woody, t_payload *payload, size_t enlarge_position)
{
const unsigned int page_size = 4096; // getpagesize(); not authorized
unsigned int padding_size = ((payload->len / page_size) + 1) * page_size;
printf("padding size = %d\n", padding_size);
offset_sections(woody, enlarge_position, padding_size);
char *new_woody = malloc(woody->file_size + padding_size);
ft_bzero(new_woody, woody->file_size + padding_size);
if (!new_woody)
return ;
ft_memcpy(new_woody, woody->file, enlarge_position);
ft_memcpy(new_woody + enlarge_position + padding_size, woody->file + enlarge_position, woody->file_size - enlarge_position);
munmap(woody->file, woody->file_size);
woody->file = new_woody;
woody->file_size += padding_size;
woody->Ehdr = (Elf64_Ehdr *)new_woody;
woody->Ehdr->e_shoff += padding_size;
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
}
t_payload *get_payload()
{
t_payload *payload = malloc(sizeof(t_payload));
@ -160,12 +31,27 @@ t_payload *get_payload()
char buffer[1024];
int fd = open("payload", O_RDONLY);
if (fd == -1) {
perror("error opening payload");
ft_put_error("Failed to open payload");
free(payload);
exit(1);
close(fd);
return NULL;
}
payload->len = read(fd, buffer, 1024);
if (payload->len == -1)
{
ft_put_error("Failed to read payload");
free(payload);
close(fd);
return NULL;
}
close(fd);
payload->payload = malloc(sizeof(char) * payload->len);
if (!payload->payload)
{
ft_put_error("Allocation error");
free(payload);
return NULL;
}
ft_memcpy(payload->payload, buffer, payload->len);
return payload;
}
@ -188,45 +74,56 @@ int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_posi
ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));
int64_t section_index = ptr_section_size - payload->payload;
int64_t section_value = woody->Phdr[load_segment_index].p_memsz; //woody->text_section->sh_size;
int64_t section_value = woody->Phdr[load_segment_index].p_memsz;
ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));
ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
printf("Old entry : %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
printf("Code cave start = %ld (%lx)\n", payload_position, payload_position);
printf("Payload size = %ld (%lx)\n", payload->len, payload->len);
printf("Backward offset = %d (%x)(%x)\n", jump_value, jump_value, -jump_value);
return EXIT_SUCCESS;
}
return EXIT_FAILURE;
}
void inject(t_elf_content *woody)
int inject(t_elf_content *woody)
{
t_payload *payload = get_payload();
if (!payload)
return EXIT_FAILURE;
int i = get_load_segment(woody, 0, true);
int j = get_load_segment(woody, i + 1, false);
if (i == -1 || j != i + 1)
{
free(payload->payload);
free(payload);
return ft_put_error("PT_LOAD segment missing");
}
size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
size_t payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz;
if (code_cave_size < payload->len) // inverse here to test the other technique
if (code_cave_size < (size_t)payload->len)
{
printf("create code_Cave %ld\n", code_cave_size);
create_codecave(woody, payload, woody->Phdr[j].p_offset);
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, not enough space for code cave");
}
woody->Phdr[i].p_filesz += payload->len;
woody->Phdr[i].p_memsz += payload->len;
printf("%ld\n", woody->Phdr[i].p_align);
(void)payload_position;
insert_payload(woody, payload, payload_position, i);
if (insert_payload(woody, payload, payload_position, i))
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, please regenerate it");
}
woody->Ehdr->e_entry = payload_position;
printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
printf("Load segment p_filesz = %lx\n", woody->Phdr[i].p_filesz);
printf("Load segment p_memsz = %lx\n", woody->Phdr[i].p_memsz);
woody->Phdr[i].p_flags = PF_X | PF_W | PF_R;
free(payload->payload);
free(payload);
return EXIT_SUCCESS;
}
int get_elf_sections(t_elf_content *woody)
@ -242,44 +139,5 @@ int get_elf_sections(t_elf_content *woody)
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
if (!woody->Shdr|| !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
return EXIT_FAILURE;
for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
if (woody->Shdr[i].sh_type == SHT_SYMTAB) {
woody->symbols_table = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
}
if (woody->Shdr[i].sh_type == SHT_PROGBITS && (woody->Shdr[i].sh_flags & SHF_EXECINSTR) && (woody->Shdr[i].sh_flags & SHF_ALLOC)) {
woody->text_section = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
}
}
if (woody->symbols_table == NULL || woody->text_section == NULL)
return EXIT_FAILURE; //Not sure about this
woody->symbols = (Elf64_Sym *)fetch(woody->file, woody->file_size, woody->symbols_table->sh_offset, sizeof(Elf64_Sym));
if (woody->symbols == NULL)
return EXIT_FAILURE;//Not sure about this
woody->Sshstrtab = (char *)fetch(woody->file, woody->file_size, woody->Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
if (woody->Sshstrtab == NULL)
return EXIT_FAILURE; //Not sure about this
woody->num_symbols = get_symbols_count(woody->symbols_table->sh_size, woody->symbols_table->sh_entsize);
if (!fetch(woody->file, woody->file_size, woody->symbols_table->sh_offset + (sizeof(Elf64_Sym) * (woody->num_symbols)), 0))
return EXIT_FAILURE;
return EXIT_SUCCESS;
}
int prepare_injection(t_elf_content *woody)
{
int elf_statut = get_elf_sections(woody);
if (elf_statut)
return elf_statut;
inject(woody);
char *woody_file;
if (!(woody_file = malloc(woody->file_size)))
return ft_put_error("Allocation error");
ft_memcpy(woody_file, woody->file, woody->file_size);
munmap(woody_file, woody->file_size);
save_elf("woody", woody_file, woody->file_size);
free(woody_file);
return EXIT_SUCCESS;
}