Hooking exec system call

DISCUSSION Abhijit Pawar 5 participants 15 messages Sep 22, 2011 – Sep 26, 2011

lore

Share & tools

lore

Abhijit Pawar

author

2011-09-22 08:23 UTC #0 lore raw

hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?

Regards,
Abhijit Pawar

Christophe Hauser

2011-09-22 08:50 UTC #1 lore raw

Quoted 6 lines · Abhijit Pawar

hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Regards,
Abhijit Pawar

Hi,

you can do that with LSM (CONFIG_SECURITY) using the bprm_set_creds hook (see include/linux/security.h).

Signature · 1 line

Christophe

rohan puri

2011-09-22 09:44 UTC #2 lore raw

In reply to Abhijit Pawar

Quoted 4 lines · Abhijit Pawar

hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?

Quoted 8 lines

Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Tidy way : -

You can do that from LSM (Linux security module).

Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in the same way you can hook the load_binary & load_library function pointers of the already registered binary format handlers.

Rajat Sharma

2011-09-23 07:31 UTC #3 lore raw

Quoted 5 lines

Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in the same way you can hook the load_binary & load_library function pointers of the already registered binary format handlers.

Challenge with this untidy way is to identify the correct format, for example if you are interested in only hooking ELF format, there is no special signature withing the registered format handler to identify that, however if one format handler recognizes the file header, its load_binary will return 0. This can give you the hint that you are sitting on top of correct file format. Long time back I had written the similar module in Linux to do the same, but can't share the code :)

-Rajat

Quoted 36 lines · rohan puri

Quoted 5 lines · Abhijit Pawar
hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Quoted 7 lines
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in the same way you can hook the load_binary & load_library function pointers of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Abhijit Pawar

author

2011-09-23 08:30 UTC #4 lore raw

Quoted 14 lines · Rajat Sharma

Quoted 5 lines
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in the same way you can hook the load_binary& load_library function pointers of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for example if you are interested in only hooking ELF format, there is no special signature withing the registered format handler to identify that, however if one format handler recognizes the file header, its load_binary will return 0. This can give you the hint that you are sitting on top of correct file format. Long time back I had written the similar module in Linux to do the same, but can't share the code :)

Quoted 36 lines

-Rajat
Quoted 33 lines · rohan puri
Quoted 11 lines · Abhijit Pawar
hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in the same way you can hook the load_binary& load_library function pointers of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

So If I use the binary format handler, then I can hook the exec call. however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?

Regards,
Abhijit Pawar

rohan puri

2011-09-23 08:34 UTC #5 lore raw

Quoted 61 lines · Abhijit Pawar

Quoted 59 lines · Rajat Sharma
Untidy way : -
Quoted 7 lines
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for example if you are interested in only hooking ELF format, there is no special signature withing the registered format handler to identify that, however if one format handler recognizes the file header, its load_binary will return 0. This can give you the hint that you are sitting on top of correct file format. Long time back I had written the similar module in Linux to do the same, but can't share the code :)
-Rajat
Quoted 37 lines · rohan puri
Quoted 4 lines · Abhijit Pawar
hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Quoted 8 lines
Regards,
Abhijit Pawar
______________________________**_________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.**org <[email protected]>
http://lists.kernelnewbies.**org/mailman/listinfo/**kernelnewbies<http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies>
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
______________________________**_________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.**org <[email protected]>
http://lists.kernelnewbies.**org/mailman/listinfo/**kernelnewbies<http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies>

Quoted 8 lines

Quoted 1 line
Quoted 1 line
So If I use the binary format handler, then I can hook the exec call.
however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?
Regards,
Abhijit Pawar
Read this, http://www.linux.it/~rubini/docs/binfmt/binfmt.html this might

help

Abhijit Pawar

author

2011-09-23 09:13 UTC #6 lore raw

Quoted 84 lines · rohan puri

On Fri, Sep 23, 2011 at 2:00 PM, Abhijit Pawar <[email protected] <mailto:[email protected]>> wrote:
On 09/23/2011 01:01 PM, Rajat Sharma wrote:
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for
example if you are interested in only hooking ELF format, there is no
special signature withing the registered format handler to identify
that, however if one format handler recognizes the file header, its
load_binary will return 0. This can give you the hint that you are sitting on top of correct file format. Long time back I had written
the similar module in Linux to do the same, but can't share the code
:)
-Rajat
On Thu, Sep 22, 2011 at 3:14 PM, rohan puri<rohan.puri15 at gmail.com <mailto:[email protected]>>
wrote:
On Thu, Sep 22, 2011 at 1:53 PM, Abhijit Pawar<apawar.linux at gmail.com <mailto:[email protected]>> wrote:
hi list,
Is there any way to hook the exec system call on Linux box apart from
replacing the call in System Call table?
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list Kernelnewbies at kernelnewbies.org <mailto:[email protected]>
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list Kernelnewbies at kernelnewbies.org <mailto:[email protected]>
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
So If I use the binary format handler, then I can hook the exec call. however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?

Quoted 8 lines

Regards,
Abhijit Pawar
Read this, http://www.linux.it/~rubini/docs/binfmt/binfmt.html
<http://www.linux.it/%7Erubini/docs/binfmt/binfmt.html> this might help
Regards,
Rohan Puri

Thanks Rohan. I tried creating a hooking module on the similar line. I am able to load the module but whenever I am launching any application , its load_binary is not being called.
here is the source for the module attached.

Regards,
Abhijit Pawar

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20110923/572dbc71/attachment.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Hook.c
Type: text/x-csrc
Size: 1425 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20110923/572dbc71/attachment.bin

rohan puri

2011-09-23 09:41 UTC #7 lore raw

Quoted 82 lines · Abhijit Pawar

On 09/23/2011 02:04 PM, rohan puri wrote:
Quoted 63 lines · Abhijit Pawar
Quoted 61 lines · Rajat Sharma
Untidy way : -
Quoted 8 lines
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for example if you are interested in only hooking ELF format, there is no special signature withing the registered format handler to identify that, however if one format handler recognizes the file header, its load_binary will return 0. This can give you the hint that you are sitting on top of correct file format. Long time back I had written the similar module in Linux to do the same, but can't share the code :)
-Rajat
Quoted 38 lines · rohan puri
Quoted 4 lines · Abhijit Pawar
hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Quoted 8 lines
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Quoted 8 lines
Quoted 1 line
Quoted 1 line
So If I use the binary format handler, then I can hook the exec call.
however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?
Regards,
Abhijit Pawar
Read this, http://www.linux.it/~rubini/docs/binfmt/binfmt.html this
might help
Regards,
Rohan Puri

Quoted 10 lines

Thanks Rohan. I tried creating a hooking module on the similar line. I am able to load the module but whenever I am launching any application , its load_binary is not being called.
here is the source for the module attached.
Regards,
Abhijit Pawar

Hi Abhijit,

I have made the change, try to compile and execute this code, it works.

Also, I am just curious enough to know that where do you need to do this hooking.

Regards,
Rohan Puri
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20110923/e525206b/attachment-0001.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Hook.c
Type: text/x-csrc
Size: 1422 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20110923/e525206b/attachment-0001.bin

Abhijit Pawar

author

2011-09-26 06:32 UTC #8 lore raw

Quoted 113 lines · rohan puri

On Fri, Sep 23, 2011 at 2:43 PM, Abhijit Pawar <[email protected] <mailto:[email protected]>> wrote:
    On 09/23/2011 02:04 PM, rohan puri wrote:
Quoted 89 lines
On Fri, Sep 23, 2011 at 2:00 PM, Abhijit Pawar <apawar.linux at gmail.com <mailto:[email protected]>> wrote:
On 09/23/2011 01:01 PM, Rajat Sharma wrote:
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary&
load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for
example if you are interested in only hooking ELF format, there is no
special signature withing the registered format handler to identify
that, however if one format handler recognizes the file header, its
load_binary will return 0. This can give you the hint that you are
sitting on top of correct file format. Long time back I had written
the similar module in Linux to do the same, but can't share the code
:)
-Rajat
On Thu, Sep 22, 2011 at 3:14 PM, rohan puri<[email protected] <mailto:[email protected]>> wrote:
On Thu, Sep 22, 2011 at 1:53 PM, Abhijit Pawar<[email protected] <mailto:[email protected]>> wrote:
hi list,
Is there any way to hook the exec system call on Linux box apart from
replacing the call in System Call table?
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list Kernelnewbies at kernelnewbies.org <mailto:[email protected]>
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary&
load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list Kernelnewbies at kernelnewbies.org <mailto:[email protected]>
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
So If I use the binary format handler, then I can hook the exec call. however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?
Regards,
Abhijit Pawar
Quoted 6 lines
Read this, http://www.linux.it/~rubini/docs/binfmt/binfmt.html
<http://www.linux.it/%7Erubini/docs/binfmt/binfmt.html> this might help
Regards,
Rohan Puri
Thanks Rohan. I tried creating a hooking module on the similar line. I am able to load the module but whenever I am launching any application , its load_binary is not being called.
here is the source for the module attached.
Regards,
Abhijit Pawar
Hi Abhijit,

Quoted 7 lines

I have made the change, try to compile and execute this code, it works.
Also, I am just curious enough to know that where do you need to do this hooking.
Regards,
Rohan Puri

Hi Rohan,
I have been looking at Windows worlds ability to support DLL Injection and API hooking. I was just wondering if this could be something to be done in Linux as well. I am not sure if there is any special use of this module apart from learning the binary handler. May be it could be used as a security module for your own binary handler.

Regards,
Abhijit Pawar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20110926/08ab6ea5/attachment.html

rohan puri

2011-09-26 06:56 UTC #9 lore raw

Quoted 115 lines · Abhijit Pawar

On 09/23/2011 03:11 PM, rohan puri wrote:
Quoted 82 lines · Abhijit Pawar
On 09/23/2011 02:04 PM, rohan puri wrote:
Quoted 63 lines · Abhijit Pawar
Quoted 61 lines · Rajat Sharma
Untidy way : -
Quoted 8 lines
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for example if you are interested in only hooking ELF format, there is no special signature withing the registered format handler to identify that, however if one format handler recognizes the file header, its load_binary will return 0. This can give you the hint that you are sitting on top of correct file format. Long time back I had written the similar module in Linux to do the same, but can't share the code :)
-Rajat
Quoted 38 lines · rohan puri
Quoted 4 lines · Abhijit Pawar
hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Quoted 8 lines
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Quoted 8 lines
Quoted 1 line
Quoted 1 line
So If I use the binary format handler, then I can hook the exec
call. however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?
Regards,
Abhijit Pawar
Read this, http://www.linux.it/~rubini/docs/binfmt/binfmt.html this
might help
Regards,
Rohan Puri
Quoted 10 lines
Thanks Rohan. I tried creating a hooking module on the similar line. I
am able to load the module but whenever I am launching any application , its load_binary is not being called.
here is the source for the module attached.
Regards,
Abhijit Pawar
Hi Abhijit,
I have made the change, try to compile and execute this code, it works.
Also, I am just curious enough to know that where do you need to do this hooking.
Regards,
Rohan Puri
Hi Rohan,
I have been looking at Windows worlds ability to support DLL Injection and API hooking. I was just wondering if this could be something to be done in Linux as well. I am not sure if there is any special use of this module apart from learning the binary handler. May be it could be used as a security module for your own binary handler.

Quoted 3 lines

Regards,
Abhijit Pawar

Hi Abhijit,

I am not familiar with windows. Special use-case of this hacking is for security companies whitelisting software solutions, where they want to control execution of only authorized binaries on the system and deny the execution of others.

Although this approach is untidy, since there is available LSM hooks in linux kernel which needs to be made use of for doing this.

Abhijit Pawar

author

2011-09-26 06:59 UTC #10 lore raw

Quoted 148 lines · rohan puri

On Mon, Sep 26, 2011 at 12:02 PM, Abhijit Pawar <apawar.linux at gmail.com <mailto:[email protected]>> wrote:
    On 09/23/2011 03:11 PM, rohan puri wrote:
Quoted 114 lines
    On Fri, Sep 23, 2011 at 2:43 PM, Abhijit Pawar
    <apawar.linux at gmail.com <mailto:[email protected]>> wrote:

        On 09/23/2011 02:04 PM, rohan puri wrote:
Quoted 89 lines
On Fri, Sep 23, 2011 at 2:00 PM, Abhijit Pawar <apawar.linux at gmail.com <mailto:[email protected]>> wrote:
On 09/23/2011 01:01 PM, Rajat Sharma wrote:
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary&
load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for
example if you are interested in only hooking ELF format, there is no
special signature withing the registered format handler to identify
that, however if one format handler recognizes the file header, its
load_binary will return 0. This can give you the hint that you are
sitting on top of correct file format. Long time back I had written
the similar module in Linux to do the same, but can't share the code
:)
-Rajat
On Thu, Sep 22, 2011 at 3:14 PM, rohan puri<[email protected] <mailto:[email protected]>> wrote:
On Thu, Sep 22, 2011 at 1:53 PM, Abhijit Pawar<[email protected] <mailto:[email protected]>> wrote:
hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list Kernelnewbies at kernelnewbies.org <mailto:[email protected]>
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary&
load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list Kernelnewbies at kernelnewbies.org <mailto:[email protected]>
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
So If I use the binary format handler, then I can hook the exec call. however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?
Regards,
Abhijit Pawar
Quoted 7 lines
Read this,
http://www.linux.it/~rubini/docs/binfmt/binfmt.html
<http://www.linux.it/%7Erubini/docs/binfmt/binfmt.html> this might help
Regards,
Rohan Puri
Thanks Rohan. I tried creating a hooking module on the similar line. I am able to load the module but whenever I am launching any application , its load_binary is not being called. here is the source for the module attached.
Regards,
Abhijit Pawar
Hi Abhijit,
Quoted 8 lines
I have made the change, try to compile and execute this code, it works.
Also, I am just curious enough to know that where do you need to do this hooking.
Regards,
Rohan Puri
Hi Rohan,
I have been looking at Windows worlds ability to support DLL Injection and API hooking. I was just wondering if this could be something to be done in Linux as well. I am not sure if there is any special use of this module apart from learning the binary handler. May be it could be used as a security module for your own binary handler.
Regards,
Abhijit Pawar
Hi Abhijit,
I am not familiar with windows. Special use-case of this hacking is for security companies whitelisting software solutions, where they want to control execution of only authorized binaries on the system and deny the execution of others.

Quoted 5 lines

Although this approach is untidy, since there is available LSM hooks in linux kernel which needs to be made use of for doing this.
Regards,
Rohan Puri

Hi Rohan,
Yes, this is a backdoor approach and I agree with you. I am learning more on LSM and their APIs so as to get insight into what goes on internally. May be you can refer me to some details as well.

Thanks for all of your help on this.

rohan puri

2011-09-26 07:27 UTC #11 lore raw

Quoted 145 lines · Abhijit Pawar

On 09/26/2011 12:26 PM, rohan puri wrote:
Quoted 116 lines · Abhijit Pawar
On 09/23/2011 03:11 PM, rohan puri wrote:
Quoted 83 lines · Abhijit Pawar
On 09/23/2011 02:04 PM, rohan puri wrote:
Quoted 64 lines · Abhijit Pawar
Quoted 62 lines · Rajat Sharma
Untidy way : -
Quoted 8 lines
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for example if you are interested in only hooking ELF format, there is no special signature withing the registered format handler to identify that, however if one format handler recognizes the file header, its load_binary will return 0. This can give you the hint that you are sitting on top of correct file format. Long time back I had written the similar module in Linux to do the same, but can't share the code :)
-Rajat
Quoted 39 lines · rohan puri
On Thu, Sep 22, 2011 at 1:53 PM, Abhijit Pawar<[email protected]
Quoted 1 line
Quoted 4 lines · wrote:
hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Quoted 8 lines
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Quoted 8 lines
Quoted 1 line
Quoted 1 line
So If I use the binary format handler, then I can hook the exec
call. however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?
Regards,
Abhijit Pawar
Read this, http://www.linux.it/~rubini/docs/binfmt/binfmt.html this
might help
Regards,
Rohan Puri
Quoted 10 lines
Thanks Rohan. I tried creating a hooking module on the similar line. I
am able to load the module but whenever I am launching any application , its load_binary is not being called.
here is the source for the module attached.
Regards,
Abhijit Pawar
Hi Abhijit,
I have made the change, try to compile and execute this code, it works.
Also, I am just curious enough to know that where do you need to do this hooking.
Regards,
Rohan Puri
Hi Rohan,
I have been looking at Windows worlds ability to support DLL Injection and API hooking. I was just wondering if this could be something to be done in Linux as well. I am not sure if there is any special use of this module apart from learning the binary handler. May be it could be used as a security module for your own binary handler.
Quoted 3 lines
Regards,
Abhijit Pawar
Hi Abhijit,
I am not familiar with windows. Special use-case of this hacking is for security companies whitelisting software solutions, where they want to control execution of only authorized binaries on the system and deny the execution of others.
Although this approach is untidy, since there is available LSM hooks in linux kernel which needs to be made use of for doing this.
Regards,
Rohan Puri
Hi Rohan,
Yes, this is a backdoor approach and I agree with you. I am learning more on LSM and their APIs so as to get insight into what goes on internally. May be you can refer me to some details as well.

Quoted 5 lines

Thanks for all of your help on this.
Regards,
Abhijit Pawar

Hi Abhijit,

There is one whitepaper of lsm available on internet by Greg Kroah-Hartman and others, its good to start with.

Also, I am keen to now, do all these things you are studying are part of any project or just for knowledge.

Abhijit Pawar

author

2011-09-26 07:30 UTC #12 lore raw

Quoted 182 lines · rohan puri

On Mon, Sep 26, 2011 at 12:29 PM, Abhijit Pawar <apawar.linux at gmail.com <mailto:[email protected]>> wrote:
    On 09/26/2011 12:26 PM, rohan puri wrote:
Quoted 154 lines
    On Mon, Sep 26, 2011 at 12:02 PM, Abhijit Pawar
    <apawar.linux at gmail.com <mailto:[email protected]>> wrote:

        On 09/23/2011 03:11 PM, rohan puri wrote:
Quoted 120 lines
        On Fri, Sep 23, 2011 at 2:43 PM, Abhijit Pawar
        <apawar.linux at gmail.com <mailto:[email protected]>> wrote:

            On 09/23/2011 02:04 PM, rohan puri wrote:
Quoted 94 lines
On Fri, Sep 23, 2011 at 2:00 PM, Abhijit Pawar <[email protected] <mailto:[email protected]>> wrote:
On 09/23/2011 01:01 PM, Rajat Sharma wrote:
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in the same way you can hook the load_binary&
load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for
example if you are interested in only hooking ELF format, there is no
special signature withing the registered format handler to identify
that, however if one format handler recognizes the file header, its
load_binary will return 0. This can give you the hint that you are
sitting on top of correct file format. Long time back I had written
the similar module in Linux to do the same, but can't share the code
:)
-Rajat
On Thu, Sep 22, 2011 at 3:14 PM, rohan puri<[email protected] <mailto:[email protected]>> wrote:
On Thu, Sep 22, 2011 at 1:53 PM, Abhijit Pawar<[email protected] <mailto:[email protected]>> wrote:
hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list Kernelnewbies at kernelnewbies.org <mailto:[email protected]>
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever exec is called, a list of registered binary format handlers is scanned, in the same way you can hook the load_binary&
load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list Kernelnewbies at kernelnewbies.org <mailto:[email protected]>
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
So If I use the binary format handler, then I can hook the exec call. however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?
Regards,
Abhijit Pawar
Quoted 7 lines
Read this,
http://www.linux.it/~rubini/docs/binfmt/binfmt.html
<http://www.linux.it/%7Erubini/docs/binfmt/binfmt.html>
this might help
Regards,
Rohan Puri
Thanks Rohan. I tried creating a hooking module on the similar line. I am able to load the module but whenever I am launching any application , its load_binary is not being called.
here is the source for the module attached.
Regards,
Abhijit Pawar
Hi Abhijit,
Quoted 8 lines
I have made the change, try to compile and execute this code, it works.
Also, I am just curious enough to know that where do you need to do this hooking.
Regards,
Rohan Puri
Hi Rohan,
I have been looking at Windows worlds ability to support DLL Injection and API hooking. I was just wondering if this could be something to be done in Linux as well. I am not sure if there is any special use of this module apart from learning the binary handler. May be it could be used as a security module for your own binary handler.
Regards,
Abhijit Pawar
Hi Abhijit,
I am not familiar with windows. Special use-case of this hacking is for security companies whitelisting software solutions, where they want to control execution of only authorized binaries on the system and deny the execution of others.
Quoted 5 lines
Although this approach is untidy, since there is available LSM hooks in linux kernel which needs to be made use of for doing this.
Regards,
Rohan Puri
Hi Rohan,
Yes, this is a backdoor approach and I agree with you. I am learning more on LSM and their APIs so as to get insight into what goes on internally. May be you can refer me to some details as well.
Thanks for all of your help on this.
Regards,
Abhijit Pawar
Hi Abhijit,
There is one whitepaper of lsm available on internet by Greg Kroah-Hartman and others, its good to start with.

Quoted 5 lines

Also, I am keen to now, do all these things you are studying are part of any project or just for knowledge.
Regards,
Rohan Puri

Thanks Rohan. I will take a look at this paper. I am learning LSM and hooking for Windows and its counterpart in Linux. this is purely for getting knowledge but it would be good if i can do something with this may be in future. :) .

rohan puri

2011-09-26 07:32 UTC #13 lore raw

Quoted 170 lines · Abhijit Pawar

On 09/26/2011 12:57 PM, rohan puri wrote:
Quoted 146 lines · Abhijit Pawar
On 09/26/2011 12:26 PM, rohan puri wrote:
Quoted 117 lines · Abhijit Pawar
On 09/23/2011 03:11 PM, rohan puri wrote:
Quoted 84 lines · Abhijit Pawar
On 09/23/2011 02:04 PM, rohan puri wrote:
Quoted 65 lines · Abhijit Pawar
Quoted 63 lines · Rajat Sharma
Untidy way : -
Quoted 8 lines
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Challenge with this untidy way is to identify the correct format, for example if you are interested in only hooking ELF format, there is no special signature withing the registered format handler to identify that, however if one format handler recognizes the file header, its load_binary will return 0. This can give you the hint that you are sitting on top of correct file format. Long time back I had written the similar module in Linux to do the same, but can't share the code :)
-Rajat
Quoted 40 lines · rohan puri
Quoted 5 lines · Abhijit Pawar
hi list,
Is there any way to hook the exec system call on Linux box apart from
replacing the call in System Call table?
Quoted 8 lines
Regards,
Abhijit Pawar
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Tidy way : -
You can do that from LSM (Linux security module).
Untidy way : -
Yes, you can do that by registering a new binary format handler. Whenever
exec is called, a list of registered binary format handlers is scanned, in
the same way you can hook the load_binary& load_library function pointers
of the already registered binary format handlers.
Regards,
Rohan Puri
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies at kernelnewbies.org
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Quoted 8 lines
Quoted 1 line
Quoted 1 line
So If I use the binary format handler, then I can hook the exec
call. however I need to register this. Does that mean that I need to return the negative value so as to have actual ELF handler to be loaded?
Regards,
Abhijit Pawar
Read this, http://www.linux.it/~rubini/docs/binfmt/binfmt.html this
might help
Regards,
Rohan Puri
Quoted 10 lines
Thanks Rohan. I tried creating a hooking module on the similar line. I
am able to load the module but whenever I am launching any application , its load_binary is not being called.
here is the source for the module attached.
Regards,
Abhijit Pawar
Hi Abhijit,
I have made the change, try to compile and execute this code, it works.
Also, I am just curious enough to know that where do you need to do this hooking.
Regards,
Rohan Puri
Hi Rohan,
I have been looking at Windows worlds ability to support DLL Injection and API hooking. I was just wondering if this could be something to be done in Linux as well. I am not sure if there is any special use of this module apart from learning the binary handler. May be it could be used as a security module for your own binary handler.
Quoted 3 lines
Regards,
Abhijit Pawar
Hi Abhijit,
I am not familiar with windows. Special use-case of this hacking is for security companies whitelisting software solutions, where they want to control execution of only authorized binaries on the system and deny the execution of others.
Although this approach is untidy, since there is available LSM hooks in linux kernel which needs to be made use of for doing this.
Regards,
Rohan Puri
Hi Rohan,
Yes, this is a backdoor approach and I agree with you. I am learning more on LSM and their APIs so as to get insight into what goes on internally. May be you can refer me to some details as well.
Quoted 5 lines
Thanks for all of your help on this.
Regards,
Abhijit Pawar
Hi Abhijit,
There is one whitepaper of lsm available on internet by Greg Kroah-Hartman and others, its good to start with.
Also, I am keen to now, do all these things you are studying are part of any project or just for knowledge.
Regards,
Rohan Puri

Quoted 8 lines

Thanks Rohan. I will take a look at this paper. I am learning LSM and hooking for Windows and its counterpart in Linux. this is purely for getting knowledge but it would be good if i can do something with this may be in future. :) .
Regards,
Abhijit Pawar

Cool!!!

Mulyadi Santosa

2011-09-22 16:57 UTC #14 lore raw

In reply to Abhijit Pawar

Quoted 3 lines · Abhijit Pawar

hi list,
Is there any way to hook the exec system call on Linux box apart from replacing the call in System Call table?

Try SystemTap....

Signature · 7 lines

regards,

Mulyadi Santosa
Freelance Linux trainer and consultant

blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com