C-如何将execl()参数隐藏在ps中

如何在execl()之后隐藏/更改进程参数？或我们如何隐藏/更改使用system()/execl()的子进程的参数？

在SHC上工作（本应用程序的目的是将bash脚本编译为二进制文件），我正在使用 execl()函数执行SH脚本；问题是execl()参数暴露于ps；这个问题的目的是使SHC更加可靠，并解决用户报告的一些问题。

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main(int argc,char* argv[]){
    int runThis;
    //Create child process
    if(fork() == 0){ 
        printf("I'm the childn");
        //runThis = system("echo test; sleep 30");
        runThis = execl("/bin/sh", "sh", "-c", "echo test; sleep 30", (char *) 0);
        exit(0);
    } else {
        printf("I'm the parent.n");
    }
    printf("Continue mainn");
    return 0;
}

运行此代码时，sh -c echo test; sleep 30暴露于ps

解决方案尝试1：成功但不是可靠的

使用ld_preload的隐藏命令参数可以使用此解决方案或使用setenv("LD_PRELOAD","myLib.so",1);（dlopen()都无法使用execl()），此解决方案确实需要将库加载到我们的应用程序中。

解决方案尝试2：半成功

用ld --wrap=symbol包装__libc_start_main，这适用于父级，但是在execl()/system()

之后，代码未包装

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>
#include <unistd.h>
int __real___libc_start_main(int (*main) (int, char **, char **), int argc, char **ubp_av, void (*init) (void), void (*fini)(void), void (*rtld_fini)(void), void (*stack_end));
int __wrap___libc_start_main(int (*main) (int, char **, char **), int argc, char **ubp_av, void (*init) (void), void (*fini)(void), void (*rtld_fini)(void), void (*stack_end)) {    
    printf("Main calledn");
    //ubp_av[1] = "test";
    int result = __real___libc_start_main(main, argc, ubp_av, init, fini, rtld_fini, stack_end);
    return result;
}

构建命令：（wrap.c是上面的代码，example.c是第一个代码示例）

gcc -c example.c -o 1.o;
gcc -c wrap.c -o 2.o;  
gcc -Wl,-wrap,__libc_start_main -Wl,-wrap=__libc_start_main 1.o 2.o -o myapp

解决方案尝试3：半成功

类似于尝试2，它包括在构建时间链接尝试1的代码...但这与execl()

不起作用

将图书馆构建为libfoo或其他名称 gcc -Wall -O2 -fpic -shared -Wl,-soname,libfoo.so -ldl -o libfoo.so wrap.c（wrap.c是尝试1的代码）
安装sudo ln -s /path/libfoo.so /usr/lib64/libfoo.so
链接它gcc example.c -o myapp -L.. -lfoo

解决方案尝试4：相关但在这里无用

PTRACE可以从父进程使用execl()示例1示例2

在父程进程中修改子参数

替代解决方案：

bash含量可以被管道管道，从而隐藏在ps

中

script="script goes here"
echo $script | bash

缓解解决方案：

这不是一个完美的解决方案，但是它将回答这个问题，该代码将在/TMP下创建一个shc_x.c，然后使用环境变量进行预加载。

shc_x.c，通过更换bash sh的内容将bash sh的内容替换并更改儿童命令参数的位置，从而将其隐藏在PS中。

SHC_X.C：（此文件是使用第二个代码生成的）

/*
 * Copyright 2019 - Intika <intika@librefox.org>
 * Replace ******** with secret read from fd 21
 * Also change arguments location of sub commands (sh script commands)
 * gcc -Wall -fpic -shared -o shc_secret.so shc_secret.c -ldl 
 */
#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */
#define PLACEHOLDER "********"
#include <dlfcn.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>
#include <signal.h>
static char secret[128000]; //max size
typedef int (*pfi)(int, char **, char **);
static pfi real_main;
// copy argv to new location
char **copyargs(int argc, char** argv){
    char **newargv = malloc((argc+1)*sizeof(*argv));
    char *from,*to;
    int i,len;
    for(i = 0; i<argc; i++){
        from = argv[i];
        len = strlen(from)+1;
        to = malloc(len);
        memcpy(to,from,len);
        // zap old argv space
        memset(from,'',len);      
        newargv[i] = to;
        argv[i] = 0;
    }
    newargv[argc] = 0;
    return newargv;
}
static int mymain(int argc, char** argv, char** env) {
    //fprintf(stderr, "Inject main argc = %dn", argc);
    return real_main(argc, copyargs(argc,argv), env);
}
int __libc_start_main(int (*main) (int, char**, char**),
                      int argc,
                      char **argv,
                      void (*init) (void),
                      void (*fini)(void),
                      void (*rtld_fini)(void),
                      void (*stack_end)){
    static int (*real___libc_start_main)() = NULL;
    int n;
    if (!real___libc_start_main) {
        real___libc_start_main = dlsym(RTLD_NEXT, "__libc_start_main");
        if (!real___libc_start_main) abort();
    }
    n = read(21, secret, sizeof(secret));
    if (n > 0) {
      int i;
    if (secret[n - 1] == 'n') secret[--n] = ''; 
      for (i = 1; i < argc; i++)
        if (strcmp(argv[i], PLACEHOLDER) == 0)
          argv[i] = secret;
    }
    real_main = main;
    return real___libc_start_main(mymain, argc, argv, init, fini, rtld_fini, stack_end);
}

在主C应用程序上：

static const char * shc_x[] = {
"/*",
" * Copyright 2019 - Intika <intika@librefox.org>",
" * Replace ******** with secret read from fd 21",
" * Also change arguments location of sub commands (sh script commands)",
" * gcc -Wall -fpic -shared -o shc_secret.so shc_secret.c -ldl",
" */",
"",
"#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */",
"#define PLACEHOLDER "********"",
"#include <dlfcn.h>",
"#include <stdlib.h>",
"#include <string.h>",
"#include <unistd.h>",
"#include <stdio.h>",
"#include <signal.h>",
"",
"static char secret[128000]; //max size",
"typedef int (*pfi)(int, char **, char **);",
"static pfi real_main;",
"",
"// copy argv to new location",
"char **copyargs(int argc, char** argv){",
"    char **newargv = malloc((argc+1)*sizeof(*argv));",
"    char *from,*to;",
"    int i,len;",
"",
"    for(i = 0; i<argc; i++){",
"        from = argv[i];",
"        len = strlen(from)+1;",
"        to = malloc(len);",
"        memcpy(to,from,len);",
"        // zap old argv space",
"        memset(from,'\0',len);",
"        newargv[i] = to;",
"        argv[i] = 0;",
"    }",
"    newargv[argc] = 0;",
"    return newargv;",
"}",
"",
"static int mymain(int argc, char** argv, char** env) {",
"    //fprintf(stderr, "Inject main argc = %d\n", argc);",
"    return real_main(argc, copyargs(argc,argv), env);",
"}",
"",
"int __libc_start_main(int (*main) (int, char**, char**),",
"                      int argc,",
"                      char **argv,",
"                      void (*init) (void),",
"                      void (*fini)(void),",
"                      void (*rtld_fini)(void),",
"                      void (*stack_end)){",
"    static int (*real___libc_start_main)() = NULL;",
"    int n;",
"",
"    if (!real___libc_start_main) {",
"        real___libc_start_main = dlsym(RTLD_NEXT, "__libc_start_main");",
"        if (!real___libc_start_main) abort();",
"    }",
"",
"    n = read(21, secret, sizeof(secret));",
"    if (n > 0) {",
"      int i;",
"",
"    if (secret[n - 1] == '\n') secret[--n] = '\0';",
"    for (i = 1; i < argc; i++)",
"        if (strcmp(argv[i], PLACEHOLDER) == 0)",
"          argv[i] = secret;",
"    }",
"",
"    real_main = main;",
"",
"    return real___libc_start_main(mymain, argc, argv, init, fini, rtld_fini, stack_end);",
"}",
"",
0};
#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <signal.h>
#include <sys/prctl.h>
#define PR_SET_PTRACER 0x59616d61
#include <stddef.h>
#include <sys/syscall.h>
#include <sys/socket.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/audit.h>
void shc_x_file() {
    FILE *fp;
    int line = 0;
    if ((fp = fopen("/tmp/shc_x.c", "w")) == NULL ) {exit(1); exit(1);}
    for (line = 0; shc_x[line]; line++) fprintf(fp, "%sn", shc_x[line]);
    fflush(fp);fclose(fp);
}
int make() {
    char * cc, * cflags, * ldflags;
    char cmd[4096];
    cc = getenv("CC");
    if (!cc) cc = "cc";
    sprintf(cmd, "%s %s -o %s %s", cc, "-Wall -fpic -shared", "/tmp/shc_x.so", "/tmp/shc_x.c -ldl");
    if (system(cmd)) {remove("/tmp/shc_x.c"); return -1;}
    remove("/tmp/shc_x.c"); return 0;
}
int main(int argc, char ** argv)
{
    shc_x_file();
    if (make()) {exit(1);}
    setenv("LD_PRELOAD","/tmp/shc_x.so",1);
    // rest of the code execl etc...
}

注意：参数始终可以通过多种方式恢复，此代码只是使逆转更加复杂。

相关内容

最新更新

热门标签：