9. Additional code segments


Perfection is reached, not when there is no longer anything to add, but when there is no longer anything to take away.

 Antoine de Saint-Exupery

This is the platform dependent part of Additional code segments (i).

9.1. Scanning for NOTE

Using the scanner in Scanning for NOTE (i) we exercise a systematic search for targets. The scripts and intermediate steps are shown in Food for segment padding. Here come just the results:

Output: out/i386-redhat8.0-linux/scanner/additional_cs/find-ok
   1763 out/i386-redhat8.0-linux/scanner/additional_cs/big.dynamic.ok
     15 out/i386-redhat8.0-linux/scanner/additional_cs/big.static.ok
   1778 total

Output: out/i386-redhat8.0-linux/scanner/additional_cs/infect.filetype
/bin/bash:       ELF 32-bit LSB executable, Intel 80386, version 1
(SYSV), dynamically linked (uses shared libs), stripped
/bin/ash.static: ELF 32-bit LSB executable, Intel 80386, version 1
(SYSV), statically linked, not stripped
/bin/rpm:        ELF 32-bit LSB executable, Intel 80386, version 1
(SYSV), statically linked, not stripped

And this should give you an idea of minimum and maximum size of found segments.

Output: out/i386-redhat8.0-linux/scanner/additional_cs/big.dynamic
files=1763; ok=1763; detected=0; min=32; max=32

9.2. Give me NOTE

9.2.1. objdump

Before we overwrite the section we should take a close at what's in there. Both objdump and readelf can show the contents of sections, specified by name or index. There is no direct access according to section type. The name of the section differs between Linux and Solaris, however. Unfortunately the output of objdump -h does not include section types. As a work around we can search for a pattern matching both names. If more than one entry is found the first one will win.

objdump can disassemble sections specified by name. There is no similar support for segments. There is nothing like a plain old hexdump. And even the disassembly is refused if the executable has no symbol table. But don't let useless oddity stop our zeal.

9.2.3. Classic dump

Enough of that crap. To actually see the bytes of a segment we first have to retrieve the file offset. The following evil perl script could almost be implemented with even more evil sed. But I found no equally evil way to convert numbers from hexadecimal.

At this point the actual dump is just a variation on Strings and dumps. A classic byte-wise octal dump using only classic options of classic tools:

Command: pre/i386-redhat8.0-linux/additional_cs/note/od.sh
. out/i386-redhat8.0-linux/additional_cs/note/offset
/bin/dd if=${shell} bs=1 skip=${off} count=${filesz} \
| /usr/bin/od -c

Output: out/i386-redhat8.0-linux/additional_cs/note/od
0000000 004  \0  \0  \0 020  \0  \0  \0 001  \0  \0  \0   G   N   U  \0
0000020  \0  \0  \0  \0 002  \0  \0  \0 002  \0  \0  \0 005  \0  \0  \0

9.3. To serve & detect

This method works, but is not safe to strip. Well, let's compare the infected target with the the original.

Output: out/i386-redhat8.0-linux/additional_cs/readelf
-rwxrwxr-x    1 alba     alba       626218 Feb 15 23:49 bash_infected
-rwxr-xr-x    1 alba     alba       626188 Feb 15 23:49 strip_bash_infected
-rwxr-xr-x    1 root     root       626188 Aug 23 22:01 /bin/bash

Elf file type is EXEC (Executable file)
Entry point 0x8046e10
There are 7 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x08048034 0x08048034 0x000e0 0x000e0 R E 0x4
  INTERP         0x000114 0x08048114 0x08048114 0x00013 0x00013 R   0x1
      [Requesting program interpreter: /lib/ld-linux.so.2]
  LOAD           0x000000 0x08048000 0x08048000 0x9293c 0x9293c R E 0x1000
  LOAD           0x093000 0x080db000 0x080db000 0x05958 0x09bf4 RW  0x1000
  DYNAMIC        0x0985b0 0x080e05b0 0x080e05b0 0x000d8 0x000d8 RW  0x4
  LOAD           0x098e10 0x08046e10 0x08046e10 0x0001a 0x0001a R E 0x1000
  GNU_EH_FRAME   0x0928f0 0x080da8f0 0x080da8f0 0x0004c 0x0004c R   0x4

 Section to Segment mapping:
  Segment Sections...
   01     .interp 
   02     .interp .note.ABI-tag .hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr 
   03     .data .eh_frame .dynamic .ctors .dtors .jcr .got .bss 
   04     .dynamic 
   06     .eh_frame_hdr 

File size grew 626218 - 626188 = 30 bytes. This number is meaningless if the original target was stripped. In that case the additional bytes of the symbol table far outweigh the infection. Anyway, even an unmodified entry point is pointless in this case. Anybody can notice LOAD instead of NOTE.

Command: pre/i386-redhat8.0-linux/additional_cs/scan_segment.sh
export TEVWH_TMP
shell=$( /bin/sed 1q \
	out/i386-redhat8.0-linux/scanner/segment_padding/infect )

/bin/echo "${shell}
tmp/i386-redhat8.0-linux/additional_cs/e1i1/${shell##*/}_infected" \
| tmp/i386-redhat8.0-linux/scanner/segment_padding

Output: out/i386-redhat8.0-linux/additional_cs/scan
/bin/tcsh ... delta=0x1008, Ok
(2) No such file or directory
CHECK: additional_cs/e1i1/tcsh_infected
CHECK: src/one_step_closer/open_src.inc#9
CHECK: (0) <= (t->fd_src = open(t->src_file, 00))
CHECK: 0 <= -1; 0 <= 0xffffffff
files=2; ok=1; det_page=1; det_align=0; min=0x1008; max=0x1008

Case closed. Guilty of failure.