Skip to content

Instantly share code, notes, and snippets.

@peanutwolf
Created March 11, 2020 07:32
Show Gist options
  • Save peanutwolf/53c5c8ae2505d38b1f289b173ea55838 to your computer and use it in GitHub Desktop.
Save peanutwolf/53c5c8ae2505d38b1f289b173ea55838 to your computer and use it in GitHub Desktop.
Simple executable args sniffer written in golang
package main
import (
"log"
"os"
"os/exec"
"path/filepath"
"strings"
ps "github.com/mitchellh/go-ps"
"gopkg.in/natefinch/lumberjack.v2"
)
const proxybinReadBinPostfix = "_realbin"
const proxybinUserDir = ".proxybin"
const proxybinDefaultLogFilename = "default.log"
var logger *log.Logger
func initLogger() {
userHomeDir, err := os.UserHomeDir()
if err != nil {
panic(err)
}
logFilePath := filepath.Join(userHomeDir, proxybinUserDir, proxybinDefaultLogFilename)
ljRotationLog := &lumberjack.Logger{
Filename: logFilePath,
MaxSize: 1, // megabytes after which new file is created
MaxBackups: 3, // number of backups
MaxAge: 28, //days
}
logger = log.New(ljRotationLog, "", log.Ldate|log.Ltime)
}
func main() {
initLogger()
pprocess, _ := ps.FindProcess(os.Getppid())
args := strings.Join(os.Args, ", ")
logger.Printf("uid=[%d], gid=[%d], pid=[%d], ppid=[%s(%d)], args=[%s]\n",
os.Getuid(), os.Getgid(), os.Getpid(), pprocess.Executable(), pprocess.Pid(), args)
realBinaryToRun := os.Args[0] + proxybinReadBinPostfix
cmd := exec.Command(realBinaryToRun, os.Args[1:]...)
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
cmd.Run()
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment