Skip to content

Conversation

@drgrussell
Copy link

I have updated inject_so.py to work with the current libc6, v2.37, as well as python 3.11.
It also gives you the error string if the ldopen should fail.
I did move some of the code into functions.

The fixes were needed, as:

  • Injecting code at the rip then calling libc is risky, as the injected code may rewrite the function you are calling if rip is in libc.
  • I found you needed your own stack when calling libc. Perhaps overwriting data on the stack is possible without this?
  • ldd is merging into libc, so __libc_dlopen_mode is probably replaced by dlopen
  • When finding the function offset in libc, you need to take into account the maps offset.
  • various differences between python 2 and 3

It works for many executables. I did notice it struggled injecting into /bin/bash. My theory is that this uses signal handling with a signal action which confuses the stack and rip, and so with int3 is never reached. Perhaps signal masking would solve this, but it is fine for my experiments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant