proxychains-ng 原理解析

dial tcp 224.0.0.1:80: connect: network is unreachable

lrwxrwxrwx   1 root root        19 Aug  7 00:22 libzmf-0.0.so -> libzmf-0.0.so.0.0.2                                                                                                                         
lrwxrwxrwx   1 root root        19 Aug  7 00:22 libzmf-0.0.so.0 -> libzmf-0.0.so.0.0.2

╰─(´・ω・)つ  readelf -a /usr/bin/curl | grep NEEDED
 0x0000000000000001 (NEEDED)             Shared library: [libcurl.so.4]
 0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]

╰─(´・ω・)つ  ldd /usr/bin/curl                                                                                                                                                                          1 ↵
        linux-vdso.so.1 (0x00007fffb9f6a000)
        libcurl.so.4 => /usr/lib/libcurl.so.4 (0x00007fd1cbbd6000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007fd1cbbb5000)
        libc.so.6 => /usr/lib/libc.so.6 (0x00007fd1cb9f1000)
        libnghttp2.so.14 => /usr/lib/libnghttp2.so.14 (0x00007fd1cb7cc000)
        libidn2.so.0 => /usr/lib/libidn2.so.0 (0x00007fd1cb5af000)
        libpsl.so.5 => /usr/lib/libpsl.so.5 (0x00007fd1cb39f000)
        libssl.so.1.1 => /usr/lib/libssl.so.1.1 (0x00007fd1cb133000)
        libcrypto.so.1.1 => /usr/lib/libcrypto.so.1.1 (0x00007fd1cacb6000)
        libgssapi\_krb5.so.2 => /usr/lib/libgssapi\_krb5.so.2 (0x00007fd1caa68000)
        libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00007fd1ca77f000)
        libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x00007fd1ca54c000)
        libcom\_err.so.2 => /usr/lib/libcom\_err.so.2 (0x00007fd1ca348000)
        libz.so.1 => /usr/lib/libz.so.1 (0x00007fd1ca12f000)
        /lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007fd1cc0e0000)
        libunistring.so.2 => /usr/lib/libunistring.so.2 (0x00007fd1c9daf000)
        libdl.so.2 => /usr/lib/libdl.so.2 (0x00007fd1c9daa000)
        libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x00007fd1c9b9d000)
        libkeyutils.so.1 => /usr/lib/libkeyutils.so.1 (0x00007fd1c9999000)
        libresolv.so.2 => /usr/lib/libresolv.so.2 (0x00007fd1c997e000)

//╰─(´・ω・)つ  cat libproxychains.c  | grep SETUP
#define SETUP\_SYM(X) do { if (! true\_ ## X ) true\_ ## X = load\_sym( # X, X ); } while(0)
        SETUP\_SYM(connect);
        SETUP\_SYM(sendto);
        SETUP\_SYM(gethostbyname);
        SETUP\_SYM(getaddrinfo);
        SETUP\_SYM(freeaddrinfo);
        SETUP\_SYM(gethostbyaddr);
        SETUP\_SYM(getnameinfo);
        SETUP\_SYM(close);
        SETUP\_SYM(\_\_xnet\_connect);

// src/core.h
extern connect\_t true\_connect;

#define SETUP\_SYM(X) do { if (! true\_ ## X ) true\_ ## X = load\_sym( # X, X ); } while(0)

 do { if (! true\_connect ) true\_connect = load\_sym( "connect", connect ); } while(0);

static void* load\_sym(char* symname, void* proxyfunc) {

	void *funcptr = dlsym(RTLD\_NEXT, symname);

	if(!funcptr) {
		fprintf(stderr, "Cannot load symbol '%s' %s\n", symname, dlerror());
		exit(1);
	} else {
		PDEBUG("loaded symbol '%s'" " real addr %p  wrapped addr %p\n", symname, funcptr, proxyfunc);
	}
	if(funcptr The content is recoverd from Wordpress Blog, for more details please check [HERE](recover-my-blog) proxyfunc) {
		PDEBUG("circular reference detected, aborting!\n");
		abort();
	}
	return funcptr;
}

	if(!((fam  The content is recoverd from Wordpress Blog, for more details please check [HERE](recover-my-blog) AF\_INET || fam The content is recoverd from Wordpress Blog, for more details please check [HERE](recover-my-blog) AF\_INET6) && socktype The content is recoverd from Wordpress Blog, for more details please check [HERE](recover-my-blog) SOCK\_STREAM))
		return true\_connect(sock, addr, len);

	ret = connect\_proxy\_chain(sock,
				  dest\_ip,
				  htons(port),
				  proxychains\_pd, proxychains\_proxy\_count, proxychains\_ct, proxychains\_max\_chain);

#define LD\_PRELOAD\_ENV "LD\_PRELOAD"
/* all historic implementations of BSD and linux dynlinkers seem to support
   space as LD\_PRELOAD separator, with colon added only recently.
   we use the old syntax for maximum compat */
#define LD\_PRELOAD\_SEP " "
#endif
	char *old\_val = getenv(LD\_PRELOAD\_ENV);
	snprintf(buf, sizeof(buf), LD\_PRELOAD\_ENV "=%s/%s%s%s",
	         prefix, dll\_name,
	         /* append previous LD\_PRELOAD content, if existent */
	         old\_val ? LD\_PRELOAD\_SEP : "",
	         old\_val ? old\_val : "");
	putenv(buf);
	execvp(argv[start\_argv], &argv[start\_argv]);
	perror("proxychains can't load process....");

*
 * Try to hook open function and disguise the system
 *
 */

#include <stdio.h>
#include <errno.h>
#include <sys/socket.h>

int open(const char *path, int oflag, ...) {
    printf("Hooked open!\n");
    return 1;
}

gcc -fPIE -c open.c && gcc -shared -o libopen.so open.o

dial tcp 224.0.0.1:80: connect: network is unreachable

package main

import (
	"bufio"
	"fmt"
	"io/ioutil"
	"net"
	"net/http"
)

func \_dial() {
	conn, err := net.Dial("tcp", "myip.ipip.net:80")
	if err != nil {
		fmt.Printf("dial error: %s\n", err)
		return
	}

	reqstr := "GET / HTTP/1.1\r\nHost: myip.ipip.net\r\nUser-Agent: curl/7.61.0\r\nAccept: */*\r\n\r\n"
	\_, err = fmt.Fprintf(conn, reqstr)
	if err != nil {
		fmt.Printf("read error: %s\n", err)
		return
	}
	b := make([]byte, 100000)
	\_, err = bufio.NewReader(conn).Read(b)
	if err != nil {
		fmt.Printf("read error: %s\n", err)
		return
	}

	fmt.Printf("%s\n", b)
}

func \_http() {
	resp, err := http.Get("http://myip.ipip.net")
	if err != nil {
		fmt.Printf("http.get: %s", err)
		return
	}
	defer resp.Body.Close()
	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		fmt.Printf("readall: %s", err)
		return
	}
	fmt.Printf("%s", body)
}

func main() {
	println("DIAL")
	\_dial()
	println("HTTP")
	\_http()
}

╰─(´・ω・)つ  ./proxychains4 -q ~/playground/go/go\_connect/go\_connect\_gc
DIAL
DBG: getaddrinfo
...
DBG: freeaddrinfo
dial error: dial tcp 224.0.0.1:80: connect: network is unreachable
HTTP
DBG: getaddrinfo
...
DBG: freeaddrinfo
http.get: Get http://myip.ipip.net: dial tcp 224.0.0.1:80: connect: network is unreachable%

DIAL
HTTP/1.1 200 OK
Date: Tue, 14 Aug 2018 13:09:06 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 67
Connection: keep-alive
X-Via-JSL: dca9b80,-
Set-Cookie: \_\_jsluid=xxxxxxxxxxxxxxxxxxxxxxxxxxx; max-age=31536000; path=/; HttpOnly
X-Cache: bypass

当前 IP：*.*.*.*  来自于：中国 XXXXXXXXXXXXXXXXXXX

HTTP
当前 IP：*.*.*.*  来自于：中国 XXXXXXXXXXXXXXXXXXX

DIAL
HTTP/1.1 200 OK
Date: Tue, 14 Aug 2018 13:10:09 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 73
Connection: keep-alive
Set-Cookie: \_\_cfduid=xxxxxxxxxxxxxxxxxxxxxxx; expires=Wed, 14-Aug-19 13:10:09 GMT; path=/; domain=.ipip.net; HttpOnly
Server: cloudflare
CF-RAY: 4xxxxxxxxxxxxxxx-NRT

当前 IP：*.*.*.*  来自于：日本  XXXXXXXXXXXXXXXXXX

HTTP 
当前 IP：*.*.*.*  来自于：日本 XXXXXXXXXXXXXXXXXX

╰─(´・ω・)つ  ldd go\_connect\_shared go\_connect\_gc 
go\_connect\_shared:
        linux-vdso.so.1 (0x00007ffdcdf00000)
        libgo.so.13 => /usr/lib/libgo.so.13 (0x00007f368872e000)
        libm.so.6 => /usr/lib/libm.so.6 (0x00007f36885a9000)
        libgcc\_s.so.1 => /usr/lib/libgcc\_s.so.1 (0x00007f368858f000)
        libc.so.6 => /usr/lib/libc.so.6 (0x00007f36883cb000)
        /lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007f3689fe6000)
        libz.so.1 => /usr/lib/libz.so.1 (0x00007f36881b4000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007f3688193000)
go\_connect\_gc:
        linux-vdso.so.1 (0x00007ffe4bf5f000)
        libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007fb99f7d6000)
        libc.so.6 => /usr/lib/libc.so.6 (0x00007fb99f612000)
        /lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007fb99f858000)

//sys	Statfs(path string, buf *Statfs\_t) (err error)
//sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
//sys	Truncate(path string, length int64) (err error)
//sys	accept(s int, rsa *RawSockaddrAny, addrlen *\_Socklen) (fd int, err error)
//sys	accept4(s int, rsa *RawSockaddrAny, addrlen *\_Socklen, flags int) (fd int, err error)
//sys	bind(s int, addr unsafe.Pointer, addrlen \_Socklen) (err error)
//sys	connect(s int, addr unsafe.Pointer, addrlen \_Socklen) (err error)
//sys	fstatat(fd int, path string, stat *Stat\_t, flags int) (err error) = SYS\_NEWFSTATAT
//sysnb	getgroups(n int, list *\_Gid\_t) (nn int, err error)
//sysnb	setgroups(n int, list *\_Gid\_t) (err error)
//sys	getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *\_Socklen) (err error)
//sys	setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error)
//sysnb	socket(domain int, typ int, proto int) (fd int, err error)
//sysnb	socketpair(domain int, typ int, proto int, fd *[2]int32) (err error)
//sysnb	getpeername(fd int, rsa *RawSockaddrAny, addrlen *\_Socklen) (err error)
//sysnb	getsockname(fd int, rsa *RawSockaddrAny, addrlen *\_Socklen) (err error)
//sys	recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *\_Socklen) (n int, err error)

func connect(s int, addr unsafe.Pointer, addrlen \_Socklen) (err error) {
        \_, \_, e1 := Syscall(SYS\_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
        if e1 != 0 {
                err = errnoErr(e1)
        }
        return
}

TEXT ·Syscall(SB),NOSPLIT,$0-56
	CALL	runtime·entersyscall(SB)
	MOVQ	a1+8(FP), DI
	MOVQ	a2+16(FP), SI
	MOVQ	a3+24(FP), DX
	MOVQ	$0, R10
	MOVQ	$0, R8
	MOVQ	$0, R9
	MOVQ	trap+0(FP), AX	// syscall entry
	SYSCALL
	CMPQ	AX, $0xfffffffffffff001
	JLS	ok
	MOVQ	$-1, r1+32(FP)
	MOVQ	$0, r2+40(FP)
	NEGQ	AX
	MOVQ	AX, err+48(FP)
	CALL	runtime·exitsyscall(SB)
	RET
ok:
	MOVQ	AX, r1+32(FP)
	MOVQ	DX, r2+40(FP)
	MOVQ	$0, err+48(FP)
	CALL	runtime·exitsyscall(SB)
	RET

//sys   bind(fd int, sa *RawSockaddrAny, len Socklen\_t) (err error)
//bind(fd \_C\_int, sa *RawSockaddrAny, len Socklen\_t) \_C\_int

//sys   connect(s int, addr *RawSockaddrAny, addrlen Socklen\_t) (err error)
//connect(s \_C\_int, addr *RawSockaddrAny, addrlen Socklen\_t) \_C\_int

// Automatically generated wrapper for connect/connect
//extern connect
func c\_connect(s \_C\_int, addr *RawSockaddrAny, addrlen Socklen\_t) \_C\_int
func connect(s int, addr *RawSockaddrAny, addrlen Socklen\_t) (err error) {
        Entersyscall()
        \_r := c\_connect(\_C\_int(s), addr, Socklen\_t(addrlen))
        var errno Errno
        setErrno := false
        if \_r < 0 {
                errno = GetErrno()
                setErrno = true
        }
        Exitsyscall()
        if setErrno {
                err = errno
        }
        return
}