📄 lkmlecture.html
字号:
<BR><Dustin> you do need root access first to do all this right?
<BR><Dustin> ok
<BR><snider> yeah, but then after you can hide files from the *right*
root of the box
<BR><Mikkkeee> yup
<BR><Dustin> ok
<BR><freakOVER> heehee
<BR><freakOVER> deviousness!
<BR><unknown> You can also spread it as a virus
<BR><unknown> but will get to that
<BR>*** snider sets mode: +m
<BR><unknown> SO lets continue
<BR><Mikkkeee> wait can you write a worm to do this for u?
<BR>*** Guy_SJS has joined #bsrf
<BR>*** ChanServ sets mode: +o Guy_SJS
<BR><unknown> you can intercept DCC or FTP sessions
<BR><unknown> and add code for executalbes
<BR><unknown> so it will be loaded when the file executed by root
<BR>*** SpiderMan has quit IRC (Ping timeout: 180 seconds)
<BR>*** DElTa_SquaD has joined #bsrf
<BR>*** SpiderMan has joined #bsrf
<BR>*** ChanServ sets mode: +o SpiderMan
<BR><unknown> u can c how to hide files on line 172 in _h_lkm.c
<BR>*** dataholic has joined #bsrf
<BR>*** ChanServ sets mode: +v dataholic
<BR><unknown> Some of the code there is used to hide processes i will
explain it later
<BR><unknown> I also replaced chdir system call so in order
<BR><unknown> to execute or read files from hidden folders
<BR><unknown> you must give full path.
<BR><unknown> Try to read it if you got questions ask
<BR><unknown> I commented most of the code so it will be easy to understand
<BR><unknown> questions?
<BR><Phr3k> i gotta go
<BR><mezzano> none yet...the code is pretty easy to read <IMHO>
<BR><Phr3k> someone send me log later
<BR>*** Phr3k has quit IRC (Quit: )
<BR><unknown> OK so lets continue
<BR><dataholic> wait wait
<BR>* dataholic lights up a cigg
<BR>* dataholic puts on a nice mp3
<BR><dataholic> ok go with tha flow!
<BR><dataholic> :)
<BR><unknown> As you know /proc contains a folder named with
<BR><unknown> the process id for each process.
<BR><unknown> To list process with 'ps' for example
<BR><unknown> ps goes through the /proc dir.
<BR><unknown> So If we want to hide a process
<BR><unknown> we check if a process goes through /proc
<BR><unknown> folder so we need to look for the pid of the process we
want to hide
<BR><unknown> and remove from the list getdents returns.
<BR><unknown> :)
<BR>* Guy_SJS bums a cig off dataholic
<BR><dataholic> lol
<BR><Mikkkeee> heh
<BR><unknown> the /proc folder contains PID's
<BR><unknown> To do it we need to get the inode in which getdents
<BR><unknown> is suppose to scan and if its /proc recover the task name
of
<BR><unknown> each pid and if it starts with _h_ remove it from the
list.
<BR><unknown> To get the inode we will use the 'current' pointer
<BR><unknown> which points to data of the current process (that issused
the call)
<BR><unknown> and its definition is 'struct task_struct *current'(to
see
<BR><unknown> struct task_struct look in linux/sched.h).
<BR><unknown> PROC_ROOT_INO is the inode of /proc and its defined in
linux/proc_fs.h.
<BR><unknown> The MAJOR and MINOR macros are used to check if it the
right device
<BR><unknown> I will explain more about major and minor numbers in
<BR><unknown> the 'coding LKM devices' lecture.
<BR><unknown> Go through the source if you got questions ask.
<BR>*** DElTa_SquaD has joined #bsrf
<BR><unknown> Questions?
<BR><Guy_SJS> ok
<BR>*** Mikkkeee sets mode: -m
<BR><Guy_SJS> wow
<BR><Guy_SJS> long lecture
<BR><Dustin> can you kill a process by rmdir /proc/911
<BR><h4x0r3d> when will the 'coding LKM devices' be?
<BR><Mikkkeee> next week
<BR><Mikkkeee> maybe
<BR><h4x0r3d> ok, =]
<BR><Dustin> if rmdir is a cmd ;0
<BR><h4x0r3d> heh
<BR>*** DElTa_SquaD has left #bsrf
<BR><Dustin> rm -r
<BR><h4x0r3d> well, thanx man, ima go now, peace all!
<BR><dataholic> y'all evil minded ppl :))))
<BR>*** h4x0r3d has quit IRC (Quit: i luv box.sk)
<BR><Dustin> suckup
<BR><Mikkkeee> lol
<BR><Guy_SJS> rm -rf /home/dataholc
<BR><freakOVER> he loves the server
<BR><freakOVER> i wanna hit him :(
<BR><Guy_SJS> hope u had a backup.
<BR><dataholic> lol
<BR><dataholic> to dev/null with you!
<BR><unknown> OK lets continue
<BR><Guy_SJS> lol
<BR>*** mezzano has quit IRC (Quit: )
<BR>*** Mikkkeee sets mode: +m
<BR><unknown> so we have hidden our files,folders and processes
<BR><unknown> but the admin can still see our lkm using lsmod
<BR><unknown> and remove it. There are several methods to
<BR><unknown> hide our modules.
<BR><unknown> One of them (suggested in Phrack 52) is
<BR><unknown> to manipulate struct module and set the size,refs and
<BR><unknown> the name of the module to 0. But when i tried it
<BR><unknown> it didnt work(I think it works only with old kernel,
<BR><unknown> other wise the kernel is loaded but when you lsmod
<BR><unknown> some errors occur).
<BR><unknown> Another way is to intercept sys_query_module system call
<BR><unknown> you can strace lsmod to see it.
<BR><unknown> Its easy to implement(almost like getdents).
<BR><unknown> Look at it in line 321 in _h_lkm.c.
<BR><unknown> To make it unremovable look intercept int delete_module(char
*name)
<BR><unknown> and if name is the matches the LKM name return -ENOENT
<BR><unknown> which means the module is not loaded.
<BR><unknown> Questions?
<BR><snider> brilliant
<BR>*** snider sets mode: -m
<BR><Dustin> devious little schemer you
<BR><unknown> No questions? so lets continue
<BR><freakOVER> RAWR
<BR><freakOVER> i'm hungry :(
<BR><freakOVER> but linux is sexier :\
<BR><dataholic> lol
<BR>*** Mikkkeee sets mode: +m
<BR><unknown> Another cool idea from phrack is redirection of execve
<BR><unknown> for example let say you what that every
<BR><unknown> time login is executed it will execute you login instead
<BR><unknown> so what you is replacing execve and each time login is
<BR><unknown> called you call /hiddenpath/my_login.
<BR><unknown> But ididnt implement it in this module
<BR><unknown> A few notes about execve.
<BR><unknown> To replace execve you must put it in some other
<BR><unknown> place in the sys_call_table(I put it in the end
<BR><unknown> but you can loop and look for the first NULL)
<BR><unknown> and modify the registers before calling it
<BR><unknown> since it expects the data in specific registers.
<BR><unknown> I wrote an asm code to do it in my LKM.
<BR><unknown> If anyone knows a better way to do it please
<BR><unknown> share.
<BR><unknown> I dont recall which line
<BR><unknown> look for it
<BR><snider> 260
<BR><unknown> What it does is wait till sh is executed and if the last
<BR><unknown> argument is ___h___ then it gives you root
<BR><unknown> Someother ideas could be preventing SYS_write from
<BR><unknown> writing certain IPs, make your file
<BR><unknown> totaly unaccessable by replacing open system calls
<BR><unknown> unless you have magic uid, record every thing
<BR><unknown> the admin does and many other things be creative!!!
<BR><unknown> TTY hijacking is a cool thing to do.
<BR><unknown> (I will show how to it in my next lecture)
<BR><unknown> Questions?
<BR>*** snider sets mode: -m
<BR><jacs> l
<BR><snider> i guess not
<BR>*** stenas has joined #bsrf
<BR><unknown> another important system call is socket(int call,unsigned
long *args)).
<BR><unknown> I didnt implemented it due to a lack of time but i will
<BR><unknown> explain how it works.
<BR><unknown> The socket system call handles all the socket operations
<BR><unknown> (recv,send,connect etc.). Its call argument is the type
<BR><unknown> of action.
<BR><unknown> One thing you can do with it is to intercept
<BR><unknown> RECVFROM call and wait for a packet with
<BR><unknown> magic size and magic content and then
<BR><unknown> open a shell on some port to get root.
<BR><unknown> This idea is implemented by plaguez in Phrack 52.
<BR><unknown> But this kind of backdoor will not work
<BR><unknown> if there a firewall on the system.
<BR><Dustin> unless oyu have physical access
<BR>*** royanee has quit IRC (Quit: )
<BR><unknown> Sure
<BR><unknown> but you can overcome this
<BR>*** stenas is now known as royanee
<BR><unknown> For example you can look for packet that contain
<BR><unknown> some string lets say <123Order321>
<BR><unknown> and remove it from the stream
<BR>*** insulted has joined #bsrf
<BR><unknown> This method
<BR><insulted> hi
<BR><unknown> can work without open connection
<BR><Dustin> ./mode #bsrf +m
<BR><unknown> because it will be removed from the stream anyway
<BR>*** wascy is now known as wascy|at|work|even|s
<BR><}{exadecimal> gtg, send me a log
<BR><unknown> you can hide the ip of these packets by replacing the
write system call
<BR><Mikkkeee> log will be on the bsrf site
<BR><Neophyte> 5-1
<BR>*** SpiderMan sets mode: +m
<BR><unknown> OK that it for now if got questions about the source
<BR><unknown> ask
<BR>*** SpiderMan sets mode: -m
<BR><snider> i have a kernel too old to load that helloworld module..
how can the system see that its been written for a newer kernel version
(even when it's as simple as helloworld.c)?
<BR><snider> thats my only question
<BR><Dustin> it uses a call not implemented in older kernels?
<BR>*** CoolMoDee has joined #bsrf
<BR><unknown> What is the messages?
<BR><unknown> What is the message?
<BR><snider> that the module was compiled for.. oh wait.. i replaced
my kernel src with the 2.4.7 one a while back
<BR><Mikkkeee> unknown would this work for bsd boxes?
<BR><snider> hehe.. nevermind
<BR>*** Saito has joined #bsrf
<BR><unknown> OK so you understood every thing?
<BR><unknown> I didnt try but i shouldnt be hard
<BR>*** BooTERROR has joined #bsrf
<BR><snider> okay, so the lecture is at end=
<BR><unknown> Well yes
<BR>--- End of Lecture---
</BODY>
</HTML>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -