mempodippy / vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
GNU General Public License v3.0
935 stars 193 forks source link

Installation fails on Debian 7/Ubuntu 14.04 because LibSSL package isn't multiarch. #17

Closed unixfox closed 7 years ago

unixfox commented 7 years ago

I'm facing to an issue because Debian 7 Wheezy doesn't want to keep the package libssl-dev (64 bits) and libssl-dev:i386 (32 bits) at the same time because libssl is not multiarch compatible.

root@vlany:~# apt-get --yes --force-yes install libssl-dev:i386
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libssl-doc zlib1g-dev
Use 'apt-get autoremove' to remove them.
Recommended packages:
  libssl-doc:i386
The following packages will be REMOVED:
  libssl-dev
The following NEW packages will be installed:
  libssl-dev:i386
0 upgraded, 1 newly installed, 1 to remove and 27 not upgraded.
Need to get 0 B/1,626 kB of archives.
After this operation, 1,411 kB disk space will be freed.
(Reading database ... 37977 files and directories currently installed.)
Removing libssl-dev ...
Selecting previously unselected package libssl-dev.
(Reading database ... 37892 files and directories currently installed.)
Unpacking libssl-dev (from .../libssl-dev_1.0.1t-1+deb7u2_i386.deb) ...
Setting up libssl-dev (1.0.1t-1+deb7u2) ...

So I ask you @mempodippy if it's needed to have the 32 bits libraries on a 64 bits system for vlany?

mempodippy commented 7 years ago

Yes. If not, 32 bit library symbols can be used to circumvent the kit. Just makes sure that everything that needs hooked is actually hooked.

unixfox commented 7 years ago

So it's better to have the package libssl-dev or libssl-dev:i386? Because Debian 7 and older versions of Ubuntu doesn't support multiarch for libssl. And when I install the package libssl-dev:i386, it removes essentials packages like gcc:

root@vlany:~# apt-get --yes --force-yes install libssl-dev:i386
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libgmp10:i386 libgomp1:i386 libitm1:i386 libmpc2:i386 libmpfr4:i386 libquadmath0:i386 libssl-doc libstdc++6:i386 zlib1g-dev
Use 'apt-get autoremove' to remove them.
The following extra packages will be installed:
  gcc-4.7-base:i386 libc6:i386 libc6-dev:i386 libc6-i686:i386 libgcc1:i386 libssl1.0.0:i386 linux-libc-dev:i386 zlib1g:i386 zlib1g-dev:i386
Suggested packages:
  glibc-doc:i386 locales:i386 manpages-dev:i386
Recommended packages:
  gcc:i386 c-compiler:i386 libssl-doc:i386
The following packages will be REMOVED:
  build-essential cpp g++ gcc gcc-multilib libssl-dev
The following NEW packages will be installed:
  gcc-4.7-base:i386 libc6:i386 libc6-dev:i386 libc6-i686:i386 libgcc1:i386 libssl-dev:i386 libssl1.0.0:i386 linux-libc-dev:i386 zlib1g:i386 zlib1g-dev:i386
0 upgraded, 10 newly installed, 6 to remove and 0 not upgraded.
Need to get 16.1 MB of archives.
After this operation, 39.2 MB of additional disk space will be used.
Get:1 http://security.debian.org/ wheezy/updates/main libc6 i386 2.13-38+deb7u11 [3,830 kB]
Get:2 http://security.debian.org/ wheezy/updates/main libssl1.0.0 i386 1.0.1t-1+deb7u2 [3,072 kB]
Get:3 http://security.debian.org/ wheezy/updates/main libc6-i686 i386 2.13-38+deb7u11 [1,265 kB]
Get:4 http://security.debian.org/ wheezy/updates/main linux-libc-dev i386 3.2.84-1 [862 kB] 
Get:5 http://security.debian.org/ wheezy/updates/main libc6-dev i386 2.13-38+deb7u11 [4,955 kB]
Get:6 http://mirrors.digitalocean.com/debian/ wheezy/main gcc-4.7-base i386 4.7.2-5 [143 kB]
Get:7 http://security.debian.org/ wheezy/updates/main libssl-dev i386 1.0.1t-1+deb7u2 [1,626 kB]
Get:8 http://mirrors.digitalocean.com/debian/ wheezy/main libgcc1 i386 1:4.7.2-5 [53.3 kB]
Get:9 http://mirrors.digitalocean.com/debian/ wheezy/main zlib1g i386 1:1.2.7.dfsg-13 [91.0 kB]
Get:10 http://mirrors.digitalocean.com/debian/ wheezy/main zlib1g-dev i386 1:1.2.7.dfsg-13 [212 kB]
Fetched 16.1 MB in 1s (9,704 kB/s)
Preconfiguring packages ...
(Reading database ... 37111 files and directories currently installed.)
Removing build-essential ...
Removing gcc-multilib ...
Removing g++ ...
Removing gcc ...
Removing cpp ...
Removing libssl-dev ...
Processing triggers for man-db ...
Selecting previously unselected package gcc-4.7-base:i386.
(Reading database ... 36994 files and directories currently installed.)
Unpacking gcc-4.7-base:i386 (from .../gcc-4.7-base_4.7.2-5_i386.deb) ...
Selecting previously unselected package libgcc1:i386.
Unpacking libgcc1:i386 (from .../libgcc1_1%3a4.7.2-5_i386.deb) ...
Selecting previously unselected package libc6:i386.
Unpacking libc6:i386 (from .../libc6_2.13-38+deb7u11_i386.deb) ...
Replacing files in old package libc6-i386 ...
Selecting previously unselected package zlib1g:i386.
Unpacking zlib1g:i386 (from .../zlib1g_1%3a1.2.7.dfsg-13_i386.deb) ...
Selecting previously unselected package libssl1.0.0:i386.
Unpacking libssl1.0.0:i386 (from .../libssl1.0.0_1.0.1t-1+deb7u2_i386.deb) ...
Setting up gcc-4.7-base:i386 (4.7.2-5) ...
Setting up libc6:i386 (2.13-38+deb7u11) ...
Setting up libgcc1:i386 (1:4.7.2-5) ...
Selecting previously unselected package libc6-i686:i386.
(Reading database ... 37321 files and directories currently installed.)
Unpacking libc6-i686:i386 (from .../libc6-i686_2.13-38+deb7u11_i386.deb) ...
Selecting previously unselected package linux-libc-dev:i386.
Unpacking linux-libc-dev:i386 (from .../linux-libc-dev_3.2.84-1_i386.deb) ...
Selecting previously unselected package libc6-dev:i386.
Unpacking libc6-dev:i386 (from .../libc6-dev_2.13-38+deb7u11_i386.deb) ...
Selecting previously unselected package zlib1g-dev:i386.
Unpacking zlib1g-dev:i386 (from .../zlib1g-dev_1%3a1.2.7.dfsg-13_i386.deb) ...
Selecting previously unselected package libssl-dev.
Unpacking libssl-dev (from .../libssl-dev_1.0.1t-1+deb7u2_i386.deb) ...
Processing triggers for man-db ...
Setting up zlib1g:i386 (1:1.2.7.dfsg-13) ...
Setting up libssl1.0.0:i386 (1.0.1t-1+deb7u2) ...
Setting up libc6-i686:i386 (2.13-38+deb7u11) ...
Setting up linux-libc-dev:i386 (3.2.84-1) ...
Setting up libc6-dev:i386 (2.13-38+deb7u11) ...
Setting up zlib1g-dev:i386 (1:1.2.7.dfsg-13) ...
Setting up libssl-dev (1.0.1t-1+deb7u2) ...
root@vlany:~# gcc
-bash: gcc: command not found

I tried to find a workaround but no solution. Source:

The bug has been fixed only on Debian 8 Jessie and newer versions of Ubuntu.

unixfox commented 7 years ago

I'll make a temporally patch to skip build for 32 bits support because Debian 7 fails to install vlany, are you ok ?

mempodippy commented 7 years ago

I'm alright, just stuff... Development will become more regularly frequent after this weekend for a length of time.