detect ghost vulnerability in statically linked binaries..

ghost.go

package main

import (
	"bytes"
	"debug/elf"
	"fmt"
	"os"
)

func staticallyLinked(file *elf.File) bool {
	for _, prog := range file.Progs {
		if prog.Type == elf.PT_DYNAMIC {
			return false
		}
	}
	return true
}

func elfContainsSymbol(file *elf.File, symbol []byte) bool {

	if symbols, e := file.Symbols(); e == nil {
		for _, s := range symbols {
			if bytes.HasPrefix([]byte(s.Name), symbol) {
				return true
			}
		}
	}

	if importedSymbols, e := file.ImportedSymbols(); e == nil {
		for _, imp := range importedSymbols {
			if bytes.HasPrefix([]byte(imp.Name), symbol) {
				return true
			}
		}
	}
	return false
}

func main() {

	ghost := []string{
		"gethostbyname",
		"gethostbyname2",
	}

	for _, arg := range os.Args[1:] {
		if file, e := elf.Open(arg); e == nil {
			if staticallyLinked(file) {
				for sym := range ghost {
					if elfContainsSymbol(file, []byte(ghost[sym])) {
						fmt.Printf("%s statically links to %s\n", arg, ghost[sym])
					}
				}
			}
		} else {
			fmt.Printf("%s not a valid executable.\n", arg)
		}
	}
}