隐藏ps

时间:2019-02-22 03:38:08

标签: c fork exec ps unistd.h

如何在execl()之后隐藏/更改过程参数?还是我们如何隐藏/更改使用system() / execl()的子进程的参数?

正在SHC上工作(此应用程序的目的是将bash脚本编译为二进制文件),我正在使用execl()函数来执行sh脚本;问题是execl()参数暴露给ps;这个问题的目的是使SHC更加可靠,并解决用户报告的一些问题。

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc,char* argv[]){

    int runThis;

    //Create child process
    if(fork() == 0){ 
        printf("I'm the child\n");
        //runThis = system("echo test; sleep 30");
        runThis = execl("/bin/sh", "sh", "-c", "echo test; sleep 30", (char *) 0);
        exit(0);
    } else {
        printf("I'm the parent.\n");
    }

    printf("Continue main\n");

    return 0;
}

运行此代码时,sh -c echo test; sleep 30暴露于ps

解决方案尝试1:成功但不可靠

可以使用此solution或通过使用ld_preload来隐藏带有setenv("LD_PRELOAD","myLib.so",1);的命令参数(dlopen()不能与execl()一起使用),此解决方案要求确实正在向我们的应用程序加载库。

解决方案尝试2:半成功

__libc_start_main包裹ld --wrap=symbol,这对父项有效,但是在execl() / system()之后,代码没有包裹

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>
#include <unistd.h>

int __real___libc_start_main(int (*main) (int, char **, char **), int argc, char **ubp_av, void (*init) (void), void (*fini)(void), void (*rtld_fini)(void), void (*stack_end));

int __wrap___libc_start_main(int (*main) (int, char **, char **), int argc, char **ubp_av, void (*init) (void), void (*fini)(void), void (*rtld_fini)(void), void (*stack_end)) {    
    printf("Main called\n");
    //ubp_av[1] = "test";
    int result = __real___libc_start_main(main, argc, ubp_av, init, fini, rtld_fini, stack_end);
    return result;
}

构建命令:(wrap.c是上面的代码,example.c是第一个代码示例)

gcc -c example.c -o 1.o;
gcc -c wrap.c -o 2.o;  
gcc -Wl,-wrap,__libc_start_main -Wl,-wrap=__libc_start_main 1.o 2.o -o myapp

解决方案尝试3:半成功

类似于尝试2,它包括在构建时链接尝试1的代码...但这不适用于execl()

  • 以libfoo或其他名称gcc -Wall -O2 -fpic -shared -Wl,-soname,libfoo.so -ldl -o libfoo.so wrap.c构建库(wrap.c是尝试1的代码)
  • 安装sudo ln -s /path/libfoo.so /usr/lib64/libfoo.so
  • 链接gcc example.c -o myapp -L.. -lfoo

解决方案尝试4:相关但此处无用

execl() example-1 example-2

之后,可以从父进程使用Ptrace来修改子参数。

1 个答案:

答案 0 :(得分:0)

替代解决方案:

Bash内容可以通过管道传输,从而对ps隐藏

script="script goes here"
echo $script | bash

缓解的解决方案:

这不是一个完美的解决方案,但是它将回答问题,该代码将在/ tmp下创建一个shc_x.c,然后将其预加载环境变量。

shc_x.c,通过替换bash sh内容到********参数中,并更改子命令参数的位置,从而也将其隐藏在ps中。

shc_x.c:(此文件是使用第二个代码生成的)

/*
 * Copyright 2019 - Intika <intika@librefox.org>
 * Replace ******** with secret read from fd 21
 * Also change arguments location of sub commands (sh script commands)
 * gcc -Wall -fpic -shared -o shc_secret.so shc_secret.c -ldl 
 */

#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */
#define PLACEHOLDER "********"
#include <dlfcn.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>
#include <signal.h>

static char secret[128000]; //max size
typedef int (*pfi)(int, char **, char **);
static pfi real_main;

// copy argv to new location
char **copyargs(int argc, char** argv){
    char **newargv = malloc((argc+1)*sizeof(*argv));
    char *from,*to;
    int i,len;

    for(i = 0; i<argc; i++){
        from = argv[i];
        len = strlen(from)+1;
        to = malloc(len);
        memcpy(to,from,len);
        // zap old argv space
        memset(from,'\0',len);      
        newargv[i] = to;
        argv[i] = 0;
    }
    newargv[argc] = 0;
    return newargv;
}

static int mymain(int argc, char** argv, char** env) {
    //fprintf(stderr, "Inject main argc = %d\n", argc);
    return real_main(argc, copyargs(argc,argv), env);
}

int __libc_start_main(int (*main) (int, char**, char**),
                      int argc,
                      char **argv,
                      void (*init) (void),
                      void (*fini)(void),
                      void (*rtld_fini)(void),
                      void (*stack_end)){
    static int (*real___libc_start_main)() = NULL;
    int n;

    if (!real___libc_start_main) {
        real___libc_start_main = dlsym(RTLD_NEXT, "__libc_start_main");
        if (!real___libc_start_main) abort();
    }

    n = read(21, secret, sizeof(secret));
    if (n > 0) {
      int i;

    if (secret[n - 1] == '\n') secret[--n] = '\0'; 
      for (i = 1; i < argc; i++)
        if (strcmp(argv[i], PLACEHOLDER) == 0)
          argv[i] = secret;
    }

    real_main = main;

    return real___libc_start_main(mymain, argc, argv, init, fini, rtld_fini, stack_end);
}

在主c应用程序上:

static const char * shc_x[] = {
"/*",
" * Copyright 2019 - Intika <intika@librefox.org>",
" * Replace ******** with secret read from fd 21",
" * Also change arguments location of sub commands (sh script commands)",
" * gcc -Wall -fpic -shared -o shc_secret.so shc_secret.c -ldl",
" */",
"",
"#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */",
"#define PLACEHOLDER \"********\"",
"#include <dlfcn.h>",
"#include <stdlib.h>",
"#include <string.h>",
"#include <unistd.h>",
"#include <stdio.h>",
"#include <signal.h>",
"",
"static char secret[128000]; //max size",
"typedef int (*pfi)(int, char **, char **);",
"static pfi real_main;",
"",
"// copy argv to new location",
"char **copyargs(int argc, char** argv){",
"    char **newargv = malloc((argc+1)*sizeof(*argv));",
"    char *from,*to;",
"    int i,len;",
"",
"    for(i = 0; i<argc; i++){",
"        from = argv[i];",
"        len = strlen(from)+1;",
"        to = malloc(len);",
"        memcpy(to,from,len);",
"        // zap old argv space",
"        memset(from,'\\0',len);",
"        newargv[i] = to;",
"        argv[i] = 0;",
"    }",
"    newargv[argc] = 0;",
"    return newargv;",
"}",
"",
"static int mymain(int argc, char** argv, char** env) {",
"    //fprintf(stderr, \"Inject main argc = %d\\n\", argc);",
"    return real_main(argc, copyargs(argc,argv), env);",
"}",
"",
"int __libc_start_main(int (*main) (int, char**, char**),",
"                      int argc,",
"                      char **argv,",
"                      void (*init) (void),",
"                      void (*fini)(void),",
"                      void (*rtld_fini)(void),",
"                      void (*stack_end)){",
"    static int (*real___libc_start_main)() = NULL;",
"    int n;",
"",
"    if (!real___libc_start_main) {",
"        real___libc_start_main = dlsym(RTLD_NEXT, \"__libc_start_main\");",
"        if (!real___libc_start_main) abort();",
"    }",
"",
"    n = read(21, secret, sizeof(secret));",
"    if (n > 0) {",
"      int i;",
"",
"    if (secret[n - 1] == '\\n') secret[--n] = '\\0';",
"    for (i = 1; i < argc; i++)",
"        if (strcmp(argv[i], PLACEHOLDER) == 0)",
"          argv[i] = secret;",
"    }",
"",
"    real_main = main;",
"",
"    return real___libc_start_main(mymain, argc, argv, init, fini, rtld_fini, stack_end);",
"}",
"",
0};

#include <sys/stat.h>
#include <sys/types.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <signal.h>
#include <sys/prctl.h>
#define PR_SET_PTRACER 0x59616d61
#include <stddef.h>
#include <sys/syscall.h>
#include <sys/socket.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/audit.h>

void shc_x_file() {
    FILE *fp;
    int line = 0;

    if ((fp = fopen("/tmp/shc_x.c", "w")) == NULL ) {exit(1); exit(1);}
    for (line = 0; shc_x[line]; line++) fprintf(fp, "%s\n", shc_x[line]);
    fflush(fp);fclose(fp);
}

int make() {
    char * cc, * cflags, * ldflags;
    char cmd[4096];

    cc = getenv("CC");
    if (!cc) cc = "cc";

    sprintf(cmd, "%s %s -o %s %s", cc, "-Wall -fpic -shared", "/tmp/shc_x.so", "/tmp/shc_x.c -ldl");
    if (system(cmd)) {remove("/tmp/shc_x.c"); return -1;}
    remove("/tmp/shc_x.c"); return 0;
}

int main(int argc, char ** argv)
{

    shc_x_file();
    if (make()) {exit(1);}

    setenv("LD_PRELOAD","/tmp/shc_x.so",1);

    // rest of the code execl etc...
}

注意:参数总是可以通过多种方式恢复的,此代码仅使反向操作变得更加复杂。