metaparanoid/odesk-ld-poc.md

## odesk-ld-poc.md

      
    Raw
  

              odesk-ld-poc.md
            
          
    oDesk Team shared library exploit POC

oDesk Team for contractors has some really nice features:

Keystroke logging
Watching the user's screen
Viewing the user's webcam

This simple hack notifies user before screenshot is taken. Yup. Get paid for watching porn.
    // libx11/src/GetIFocus.c
    int
    XGetInputFocus(
        register Display *dpy,
        Window *focus,
        int *revert_to)
    {
        // alert + delay
        system("mplayer ~/alert.mp3");

        xGetInputFocusReply rep;
        register xReq *req;
        ...
    }
$ LD_PRELOAD=/freshly/compiled/libX11.so odeskteam-qt4

Secure UNIX Programming FAQ
Reverse Engineering with LD_PRELOAD