Hacker News Reader

mattbostockon Go LD_PRELOAD backdoor experiment

Thanks for the tips, I'll give these a try. Much appreciated.

mattbostockon Go LD_PRELOAD backdoor experiment

I've documented this limitation in the README: https://github.com/mattbostock/go-ldpreload-backdoor#limitat...

mattbostockon Go LD_PRELOAD backdoor experiment

That's right; the ones I tested were 'ps' and 'top'.

I did try hooking __libc_start_main, but had difficulty using dl.Sym() with it. I wasn't sure if I converted the function signature to Go incorrectly or if it's a limitation of dl.Sym().

This was the error I was hitting: https://github.com/rainycape/dl/blob/484344929c1867aec9517b5...

So I chose a method with a simpler function signature I found using ltrace, just to get it working as an experiment.

mattbostockon Go LD_PRELOAD backdoor experiment

The 'backdoor' just refers to the fact that it starts a TCP server that will execute commands sent to it. That's not really the point; the novelty aspect is that it uses the new 'c-shared' buildmode supported by Go version 1.5.

I think it also demonstrates how easy it is to write something similar to Telnet in Go.