blindssl
is built as a static binary without any dependencies, and available on the release page.
Usage: blindssl [OPTION...]
blindssl
Uses eBPF to hijack libssl peer certificate verification
USAGE: ./blinssl -p $(/usr/sbin/ldconfig -p | grep libssl.so | cut -d ' ' -f4)
-d /var/log/trace.0
-d, --daemon Start blindssl in daemon mode
-p, --path=PATH Path to the libssl.so file
-v, --verbose Verbose mode
-?, --help Give this help list
--usage Give a short usage message
-V, --version Print program version
Mandatory or optional arguments to long options are also mandatory or optional
for any corresponding short options.
Report bugs to .
As blindssl
rely on libssl, we have to set the path where libssl is installed on your distribution. To find where libssl is installed you can run the following command :
> /usr/sbin/ldconfig -p | grep libssl.so | cut -d ' ' -f4
/lib/x86_64-linux-gnu/libssl.so.1.1
Once you get the path you can launch blindssl
:
> ./blindssl -p /lib/x86_64-linux-gnu/libssl.so.1.1
An easy way to launch blindssl
is to use the following command :
> ./blindssl -p $(/usr/sbin/ldconfig -p | grep libssl.so | cut -d ' ' -f4)
blindssl
can also be started as a daemon by providing an output file where credentials will be written:
./blindssl -p $(/usr/sbin/ldconfig -p | grep libssl.so | cut -d ' ' -f4) -d
To build the static binary, we need third-party program. For eBPF we need clang
to compile the C code into eBPF CO-RE code.
We also rely on bpftool
to create a skeleton from ebpf program to include it in our userland program. Then we need also libelf
to find the correct symbol in libpam.
sudo apt install make clang-11 gcc libelf-dev bpftool
Then just build!
git clone https://github.com/citronneur/blindssl --recursive
cd blindssl/src
make
blindssl
will load userland probes eBPF program to hook
SSL_new
function fromlibssl.so
to force the verify mode toSSL_VERIFY_NONE
SSL_get_verify_result
function that will overite the error code to set it to zero (everything is fine!)
This is a PoC with almost very few binaries as target, and just to show the power of eBPF !!!