I want to capture syscalls of malicious python packages. Is there any way to do this? Or can I capture syscalls in wireshark?
For reference: Typosquatted Python packages, much like StackOverlow copy/paste.
Asked
Active
Viewed 85 times
-2
-
1if you are running Linux you could use strace, in windows you could use ETW – zerocool Aug 18 '22 at 23:09
-
1Why are you running malicious packages in the first place? – Barmar Aug 18 '22 at 23:09
-
Wireshark captures network traffic, not system calls.[ – Barmar Aug 18 '22 at 23:10
-
or you could just hook SSDT dispatchers at the kernel level, – zerocool Aug 18 '22 at 23:10
-
other solutions would be to hook MSR register that direct the syscall to an entry point where you could just put your code there to evaluate which syscall is been called according to Cr3 and stack / registers – zerocool Aug 18 '22 at 23:11
-
a good solution is just to read the package source code and figure out what is doing, tracing syscalls is hard as there are a lot of calls from modules such as python – zerocool Aug 18 '22 at 23:15
-
Maybe write a eBPF program to capture the syscalls. – user2233706 Aug 18 '22 at 23:30
1 Answers
2
Wireshark does not trace syscalls, it traces the network traffic, two completely different thingsnote
Why are you even importing and/or installing such packages
You can use strace on any */Linux distribution
3.1. Though strace output is often hard to read, you're better off reading the src
Use a virtual machine, just in case you know
Note: Wireshark can trace USB as well as network traffic.
This is unlikely to solve your problem as read() is a function. If it reads /etc/passwd, it is different than /etc/python/debian_config. You would have to examine the arguments to the syscall.
artless noise
- 21,212
- 6
- 68
- 105
Ari157
- 95
- 4
- 16
-
Hey, I want to capture the syscalls of a malicious python package which proceed in a software supply chain attack. Can you tell me how can I strace any package? Thanks – Awaiz Khan Aug 19 '22 at 11:09
-
@AwaizKhan Read the `strace` command manual, it's very easy. But you won't get very far by tracing system calls (unless the python package is using mostly C code). Python is too high-level. I would investigate some debugging/sandbox solution specific to python (you can monkey-patch almost anything in python). – Margaret Bloom Aug 19 '22 at 12:21
-