Skip to content

Instantly share code, notes, and snippets.

@olliencc
Created June 2, 2015 18:15
Show Gist options
  • Save olliencc/353ffa9eac363cd017df to your computer and use it in GitHub Desktop.
Save olliencc/353ffa9eac363cd017df to your computer and use it in GitHub Desktop.
dump the password used by an openssl client for its private key using LD_PRELOAD and hooking the callback registration functions
//
// based on https://git.lekensteyn.nl/peter/wireshark-notes/tree/src/
// Licensed under the terms of GPLv3 (or any later version) at your choice
//
// works for daemons which can be run in the foreground
//
// gcc nccsslpasswdlog.c -shared -o nccsslpasswdlog.so -fPIC -ldl
//
//
#define _GNU_SOURCE
#include <dlfcn.h>
#include <openssl/ssl.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#ifndef OPENSSL_SONAME
# define OPENSSL_SONAME "libssl.so"
#endif
typedef int sslCB(char *buf, int size, int rwflag, void *password);
sslCB* funcsslCB = 0;
void* userData = 0;
static inline void *lookup_symbol(const char *sym)
{
void *func = dlsym(RTLD_NEXT, sym);
/* Symbol not found, OpenSSL is not loaded (linked) so try to load it
* manually. This is error-prone as it depends on a fixed library name.
* Perhaps it should be an env name? */
if (!func) {
void *handle = dlopen(OPENSSL_SONAME, RTLD_LAZY);
if (!handle) {
fprintf(stderr, "Lookup error for %s: %s", sym, dlerror());
abort();
}
func = dlsym(handle, sym);
if (!func) {
fprintf(stderr, "Cannot lookup %s", sym);
abort();
}
dlclose(handle);
}
return func;
}
void doit(void *u){
char* strFoo=malloc(1024);
memset(strFoo,0x00,1024);
funcsslCB(strFoo,1024,0,u);
fprintf(stderr,"password is '%s'\n",strFoo);
}
void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
{
fprintf(stderr,"%s called\n",__func__);
static int (*func)();
if (!func) {
func = lookup_symbol(__func__);
}
funcsslCB = (sslCB*)cb;
doit(userData);
func(ctx,cb);
}
void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u)
{
fprintf(stderr,"%s called\n",__func__);
static int (*func)();
if (!func) {
func = lookup_symbol(__func__);
}
fprintf(stderr,"%08x\n",(int)u);
userData = u;
func(ctx, u);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment