blob: 0e1e0098f0b6524ea74db71096a1534ce50f7443 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
Hooking on Linux Introduction
What is hooking?
@what_is_hooking.png
Relies on dynamically linked binaries
\
most binaries are dynamic.
$ file /usr/bin/* | grep dynamic | wc -l
1500
Hooking libc is an obvious choice
- open source
- everything uses libc
Picking a libc function to hook
\
strcmp:
compare two strings
Why? Because:
\
if strcmp("user password", saved_password) == 0
Access granted
else
Access denied
Goal:
print out saved password
Step 1:
Find the source Luke
Step 2:
Find the implementation
Step 3:
Code your goals, you can do it!
☢ Caveats ☢
Caveats
☢ retain the original implementation (or not)
Caveats
☢ retain the original implementation (or not)
☢ segfaults
Caveats
☢ retain the original implementation (or not)
☢ segfaults
☢ low level C can be hard
Caveats
☢ retain the original implementation (or not)
☢ segfaults
☢ low level C can be hard
☢ segfaults
Step 4:
isolate and compile as shared object
Step 5:
trick the linker
\
LD_PRELOAD is bae
Questions?
|
