11

I am using CreateRemoteThread in Windows and would like to know if the same thing is possible in Linux. Is it possible to do this in Linux?

Mahmoud Al-Qudsi
  • 28,357
  • 12
  • 85
  • 125
CrazyC
  • 1,840
  • 6
  • 39
  • 60

2 Answers2

9

The traditional way of doing this on Linux would be to create a dynamic library (.so) with your code in it, then separately force the loading of your library into the running application. There is no one-stop shop as there is with CreateRemoteThread on Windows.

So here are the basic steps:

  1. Create and link a .so dynamic library (.dylib on macOS) that contains the code you wish to execute in the remote process.
  2. Write some very simple code in assembly that loads the specified so file (mainly copy and paste from this link, part 1).
  3. Embed said loader ASM as a binary payload in a buffer in a 2nd code file/app. Here you will use ptrace to run the binary payload written in step 2, which will trigger the target app to call _dl_open() on the .so created in step 1, which contains the actual code you wish to run. (Sample given in the same link, part 2.)

If you need your code to run in a separate thread from the main pump, then you should use pthread_create in the code in step 1.

Hope this answers your question. Yes, it's more involved than on Windows; but it should work equally well. Plus, you can reuse just about the entire code from steps 2 and 3 for future remote code injection projects.

Mahmoud Al-Qudsi
  • 28,357
  • 12
  • 85
  • 125
  • 2
    Create remote thread of windows creates the thread in an already running process. If you modify the executable image while the process is running, the process will still see the old version of the ELF until terminating. –  Apr 16 '18 at 11:53
  • 1
    It’s quite sad that all the links are dead in this answer. – ivaigult Jun 20 '21 at 17:54
  • 1
    The content of the links have been archived on https://web.archive.org/web/20150717110958/http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx – alecail Dec 20 '21 at 16:07
-7

`#include pthread.h

int pthread_create(pthread_t *thread, const pthread_attr_t *attr, void *(*start_routine) (void *), void *arg);` Compile and link with -pthread.

see man pthread_create for detail

Andrey Dmitriev
  • 80
  • 2