Skip to content

Instantly share code, notes, and snippets.

@toomanybananas
Created April 24, 2018 23:30
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save toomanybananas/de4dd7abca0e1ff6fa7b1313d70723b5 to your computer and use it in GitHub Desktop.
Save toomanybananas/de4dd7abca0e1ff6fa7b1313d70723b5 to your computer and use it in GitHub Desktop.
Shared library injection with the Witchcraft Compiler Collection
#define _GNU_SOURCE
#include <dlfcn.h>
int puts(const char* s)
{
int (*oputs)(const char*) = dlsym(RTLD_NEXT, "puts");
oputs("HOOKED!");
return oputs(s);
}
[~/rootkits/wcc-kit]$ gcc test.c -o test
[~/rootkits/wcc-kit]$ gcc -fPIC -c hook.c -o hook.o # could also use WCC to make an object file from a .so
[~/rootkits/wcc-kit]$ ./test
Am I hooked?
[~/rootkits/wcc-kit]$ wcc -c ./test -o test.o
[~/rootkits/wcc-kit]$ gcc test.o hook.o -ldl -o test-hooked
[~/rootkits/wcc-kit]$ ./test-hooked
HOOKED!
Am I hooked?
#include <stdio.h>
int main()
{
puts("Am I hooked?");
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment