216 lines
7.1 KiB
C
216 lines
7.1 KiB
C
#include "../includes/woody.h"
|
|
|
|
|
|
int elf_magic_numbers(char *str)
|
|
{
|
|
return (!ft_strncmp(str, ELFMAG, SELFMAG));
|
|
}
|
|
|
|
int save_elf(char *path, char *file, unsigned long int size)
|
|
{
|
|
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
|
|
if (fd == -1) {
|
|
ft_printf("Error: Failed to create new file \'%s\'\n", path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
if (write(fd, file, size) == -1) {
|
|
close(fd);
|
|
ft_printf("Error: Failed to write new file \'%s\'\n", path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
if (close(fd) == -1) {
|
|
ft_printf("Error: Failed to close new file \'%s\'\n", path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
return EXIT_SUCCESS;
|
|
}
|
|
|
|
int get_load_segment(t_elf_content *woody, int start, bool executable)
|
|
{
|
|
for (int i = start; i < woody->Ehdr->e_phnum; i++)
|
|
{
|
|
if (woody->Phdr[i].p_type == PT_LOAD)
|
|
{
|
|
if (executable)
|
|
{
|
|
if (woody->Phdr[i].p_flags & PF_X)
|
|
return i;
|
|
}
|
|
else
|
|
return i;
|
|
}
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
void offset_sections(t_elf_content *woody, unsigned int from, unsigned int offset_ammount)
|
|
{
|
|
for (int i = 0; i < woody->Ehdr->e_phnum; i++)
|
|
{
|
|
if (woody->Phdr[i].p_offset > from)
|
|
woody->Phdr[i].p_offset += offset_ammount;
|
|
}
|
|
for (int i = 0; i < woody->Ehdr->e_shnum; i++)
|
|
{
|
|
if (woody->Shdr[i].sh_offset > from)
|
|
woody->Shdr[i].sh_offset += offset_ammount;
|
|
}
|
|
}
|
|
|
|
size_t create_codecave(t_elf_content *woody, Elf64_Phdr *load_segment, t_payload *payload)
|
|
{
|
|
const unsigned int page_size = 4096; // getpagesize(); not authorized
|
|
unsigned int padding_size = ((payload->len / page_size) + 1) * page_size;
|
|
unsigned int codecave_start = load_segment->p_offset + load_segment->p_filesz;
|
|
offset_sections(woody, codecave_start, padding_size);
|
|
char *new_woody = malloc(woody->file_size + padding_size);
|
|
if (!new_woody)
|
|
return 0;
|
|
ft_memcpy(new_woody, woody->file, codecave_start);
|
|
ft_bzero(new_woody + codecave_start, padding_size);
|
|
ft_memcpy(new_woody + codecave_start + padding_size, woody->file + codecave_start, woody->file_size - codecave_start);
|
|
munmap(woody->file, woody->file_size);
|
|
woody->file = new_woody;
|
|
woody->file_size += padding_size;
|
|
woody->Ehdr = (Elf64_Ehdr *)new_woody;
|
|
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
|
|
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
|
|
return codecave_start;
|
|
}
|
|
|
|
t_payload *get_payload()
|
|
{
|
|
t_payload *payload = malloc(sizeof(t_payload));
|
|
if (!payload)
|
|
return NULL;
|
|
char buffer[1024];
|
|
int fd = open("payload", O_RDONLY);
|
|
payload->len = read(fd, buffer, 1024);
|
|
payload->payload = malloc(sizeof(char) * payload->len);
|
|
ft_memcpy(payload->payload, buffer, payload->len);
|
|
return payload;
|
|
}
|
|
|
|
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position)
|
|
{
|
|
char *ptr = ft_strnstr_nullterminated(payload->payload, JUMP, payload->len);
|
|
if (ptr)
|
|
{
|
|
int32_t jmp_index = ptr - payload->payload;
|
|
int32_t jump_value = ((payload_position + payload->len) - woody->Ehdr->e_entry) * -1;
|
|
|
|
ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value));
|
|
ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
|
|
|
|
printf("Old entry : %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
|
|
printf("Code cave start = %ld (%lx)\n", payload_position, payload_position);
|
|
printf("Payload size = %ld (%lx)\n", payload->len, payload->len);
|
|
printf("Backwar d offset = %d (%x)\n", jump_value, jump_value);
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
void inject(t_elf_content *woody)
|
|
{
|
|
t_payload *payload = get_payload();
|
|
|
|
int i = get_load_segment(woody, 0, true);
|
|
int j = get_load_segment(woody, i + 1, false);
|
|
|
|
size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
|
|
size_t payload_position;
|
|
printf("load position = : %ld (%lx)\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_offset);
|
|
printf("load size = : %ld (%lx)\n", woody->Phdr[i].p_filesz, woody->Phdr[i].p_filesz);
|
|
|
|
if (code_cave_size > payload->len) // inverse here to test the other technique
|
|
{
|
|
payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_memsz;
|
|
printf("Code_cave_size = %ld (%lx)\n", code_cave_size, code_cave_size);
|
|
}
|
|
else
|
|
{
|
|
payload_position = create_codecave(woody, &woody->Phdr[i], payload);
|
|
}
|
|
insert_payload(woody, payload, payload_position);
|
|
|
|
woody->Ehdr->e_entry = payload_position;
|
|
woody->Phdr[i].p_filesz += payload->len;
|
|
woody->Phdr[i].p_memsz += payload->len;
|
|
|
|
printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
|
|
}
|
|
|
|
int get_elf_sections(t_elf_content *woody)
|
|
{
|
|
woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
|
|
if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != ELFCLASS64)
|
|
{
|
|
ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
|
|
|
|
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
|
|
if (woody->Shdr == NULL || !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
|
|
{
|
|
return ft_put_error("Corrupted file");
|
|
}
|
|
|
|
|
|
|
|
// Elf64_Shdr *symbols_table = NULL;
|
|
// for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
|
|
// if (Shdr[i].sh_type == SHT_SYMTAB) {
|
|
// symbols_table = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
|
|
// }
|
|
// }
|
|
// if (symbols_table == NULL)
|
|
// return ft_put_error("No symbols");
|
|
|
|
// if (!fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
|
|
// return ft_put_error("Corrupted file");
|
|
|
|
// char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
|
|
// if (Sshstrtab == NULL)
|
|
// return ft_put_error("Corrupted file");
|
|
|
|
// Elf64_Shdr *strtab_header = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr));
|
|
// if (!strtab_header)
|
|
// return ft_put_error("Corrupted file");
|
|
|
|
// char *strtab = fetch(woody->file, woody->file_size, strtab_header->sh_offset, 0);
|
|
// if (strtab == NULL)
|
|
// return ft_put_error("Corrupted file");
|
|
// Elf64_Sym *symbols = (Elf64_Sym *)fetch(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym));
|
|
// if (symbols == NULL)
|
|
// return ft_put_error("Corrupted file");
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|
|
|
|
int prepare_injection(t_elf_content *woody)
|
|
{
|
|
int elf_statut = get_elf_sections(woody);
|
|
if (elf_statut)
|
|
return elf_statut;
|
|
|
|
inject(woody);
|
|
|
|
char *woody_file;
|
|
if (!(woody_file = malloc(woody->file_size)))
|
|
return ft_put_error("Allocation error");
|
|
|
|
ft_memcpy(woody_file, woody->file, woody->file_size);
|
|
|
|
// encrypt(woody_file, strtab_header->sh_offset , strtab_header->sh_size);
|
|
munmap(woody_file, woody->file_size);
|
|
save_elf("woody", woody_file, woody->file_size);
|
|
free(woody_file);
|
|
return EXIT_SUCCESS;
|
|
}
|
|
|