ืื; ืืจ: ืืื ืฉืจืืื ืึท ืงืขืจื ืืึธืืืืข ืืืึธืก ืืืขื ืืืืขื ืขื ืงืึทืืึทื ืื ืคืื ืื ICMP ืคึผืืืืึธืื ืืื ืืืกืคืืจื ืืื ืืืืฃ ืื ืกืขืจืืืขืจ ืืคืืื ืืืื ืืืื SSH ืงืจืึทืฉืื. ืคึฟืึทืจ ืื ืืขืจืกื ืืืืขืืืืืืง, ืึทืืข ืื ืงืึธื ืืื .
ืืืึธืจืขื ืขื ืืงืกืคึผืืจืืึทื ืกื C ืคึผืจืึธืืืจืึทืืขืจื ืจืืืืงืืจื ืืขืจืกืืื ื ืืื ืืจืขืจื ืคืื ืืืื! ืืื ืงืขื ืืคืืื ืืืื ืคืึทืืฉ ืืื ืื ืืขืจืืื ืึธืืึธืืืข, ืึธืืขืจ ืงืืื ืงืจืืืืง ืืื ืืึทืืจืืกื. ืืขืจ ืคึผืึธืกืื ืืื ืืืขื ืคึฟืึทืจ ืืขื ืข ืืืึธืก ืืึธืื ืึท ืืืืขืจ ืคึผืจืึธืกื ืืขืืึทื ืง ืคืื C ืคึผืจืึธืืจืึทืืืื ื ืืื ืืืืื ืฆื ืงืืงื ืืื ืื ืื ืคืื ืืื ืืงืก.
ืืื ืื ืืึทืืขืจืงืื ืืขื ืฆื ืืืื ืขืจืฉืืขืจ ืืขืจืืื ื SoftEther VPN, ืืืึธืก ืงืขื ืขื ื ืึธืืงืจืืืขื ืขืืืขืืข "ืจืขืืืืขืจ" ืคึผืจืึธืืึธืงืึธืืก, ืกืคึผืขืฆืืขื ืืืืคึผืก, ICMP ืืื ืืคืืื ืื ืก. ืืื ืงืขื ืืืึทืืืฉืึทื ืืืืื ืืขืจ ืขืจืฉืืขืจ ืคืื ืืื ืืจืืขืื, ืืืืึทื ืืื ืืื ืืืืขืจ ืืึทืงืึทื ื ืืื ืืืืคึผ (S), ืืื ืืื ืืึธืื ืฆื ืืขืจื ืขื ืืึทื ืึทืืื ื ืืืืขืจ ICMP ืืื DNS.
ืืึธ, ืืื 2020 ืืื ืืขืืขืจื ื ืึทื ืืืจ ืงืขื ืขื ืึทืจืืึทื ืืืืื ืึท ืึทืจืืืืจืึทืจืืฉ ืคึผืืืืึธืื ืืื ICMP ืคึผืึทืงืืฅ. ืึธืืขืจ ืืขืกืขืจ ืฉืคึผืขื ืืื ืงืืื ืืึธื! ืืื ืืืืืืื ืืขื ืงืขื ืขืคืขืก ืืื ืืขืจืืืขืื, ืืืจืฃ ืืขื ืขืก ืืื. ืืื ื ืืื ืืืื ืืขืืืขื ืืขืื ืืื ืจืืึฟ ืึธืคื ื ืืฆื ืื ืืึทืคึฟืขืื ืฉืืจื, ืึทืจืืึทื ืืขืจืขืื ื ืืืจื SSH, ืืขืจ ืืขืืึทื ืง ืคืื ืึท ICMP ืฉืึธื ืืขืงืืืขื ืฆื ืืืื ืืืื ืื ื ืขืจืฉืืขืจ. ืืื ืืื ืกืืจ ืฆื ืึทืกืขืืืึทื ืึท ืืึทื ืฅ ืืืืฉืืขืื ืืื ืืึธ, ืืื ืืึทืฉืืึธืกื ืฆื ืฉืจืืึทืื ืขืก ืืื ืึท ืืื ืืงืก ืืึธืืืืข ืืื ืึท ืฉืคึผืจืึทื ืืืึธืก ืืื ื ืึธืจ ืืึธืื ืึท ืคึผืจืึธืกื ืืขืืึทื ืง ืคืื. ืึทืืึท ืึท ืฉืึธื ืืืขื ื ืื ืืืื ืงืขื ืืืง ืืื ืืขืจ ืจืฉืืื ืคืื ืคึผืจืึทืกืขืกืึทื, ืืืจ ืงืขื ืขื ืืึธืื ืขืก ืืื ืื ืงืขืจื ืืื ืขืก ืืืขื ื ืืฉื ืืืื ืืืืฃ ืืขืจ ืืขืงืข ืกืืกืืขื, ืืืจ ืืืขื ื ืืฉื ืืขื ืขืคึผืขืก ืกืึทืกืคึผืืฉืึทืก ืืื ืืขืจ ืจืฉืืื ืคืื ืฆืืืขืืขืจื ืคึผืึธืจืฅ. ืืื ืืขืจืืื ืขื ืคืื ืืืึทื ืงืืืคึผืึทืืืืึทืืื, ืืึธืก ืืื ืึท ืคืื-ืคืืขืืืฉื ืจืึธืึธืืงืื, ืึธืืขืจ ืืื ืืึธืคึฟื ืฆื ืคึฟืึทืจืืขืกืขืจื ืขืก ืืื ื ืืฆื ืขืก ืืื ืึท ืฉืึธื ืคืื ืืขืฆืืข ืจืืืึธืจื ืืืขื ืื ืืึทืกืข ืืืจืืฉื ืืืืขื ืืื ืฆื ืืืื ืฆื ืงืืึธืฅ ืืื ืืืจื SSH ืืื ืืืกืคืืจื ืืคึผืืืช echo i > /proc/sysrq-triggerืฆื ืืืงืขืจื ืึทืงืกืขืก ืึธื ืจืขืืึธืึธืืื ื.
ืืืจ ื ืขืืขื ืึท ืืขืงืกื ืจืขืืึทืงืืึธืจ, ืืงืขืจืืืง ืคึผืจืึธืืจืึทืืืื ื ืกืงืืื ืืื Python ืืื C, Google ืืื ืืืึธืก ืืืจ ืืึธื ื ืื ืืึธืื ืฆื ืฉืืขืื ืืื ืืขืจ ืื ืืขืกืขืจ ืืืื ืึทืืฅ ืืจืืืงืก (ืึทืคึผืฉืึทื ืึทื - ืืืืข ืืืืจืืืึทืืืึธืงืก / ืงืืื / ืขืืง) ืืื ืืึธืื ืก ืืืื!
ืงืืืขื ื ืืืึทื
ืขืก ืืื ืืืจ ืืืืกืืขืืขื ืื ืคืืจ ืืขื ืงืืืขื ื ืืื ืืื ืืืจืคื ืฉืจืืืื ื ืฉืจืืคื ืืื ืืขืจื 80 ืฉืืจืืช, ืืืขืจ ืขืก ืืขื ืขื ืืขืืืขื ืืืืข ืืขื ืืฉื ืืืืก ืืืื ืืืก ืืขืืื ืคืืจ ืืืจ . ืืขืจ ืงืึธื ืืื ืืขืืืขื ืึทื ืืงืกืคึผืขืงืืืืื ืคึผืฉืื, ืคึผืึทืกืืง ืืื 10 ืืึทืืืืืืง ืฉืืจืืช:
import sys
from scapy.all import sr1, IP, ICMP
if len(sys.argv) < 3:
print('Usage: {} IP "command"'.format(sys.argv[0]))
exit(0)
p = sr1(IP(dst=sys.argv[1])/ICMP()/"run:{}".format(sys.argv[2]))
if p:
p.show()
ืืขืจ ืฉืจืืคื ื ืขืื ืฆืืืื ืึทืจืืืืขื ืื, ืึทื ืึทืืจืขืก ืืื ืึท ืคึผืืืืึธืื. ืืืืืขืจ ืฉืืงื, ืื ืคึผืืืืึธืื ืืื ืคึผืจืืกืืืึทื ืืืจื ืึท ืฉืืืกื run:, ืืืจ ืืืขืื ืืึทืจืคึฟื ืขืก ืฆื ืืืกืฉืืืกื ืคึผืึทืงืึทืืืฉืึทื ืืื ืืจืึทืค ืคึผืืืืึธืืื.
ืืขืจ ืงืขืจื ืจืืงืืืืืขืจื ืคึผืจืืืืืืึทืืืฉืึทื ืืื ืกืืจ ืฆื ืืึทืื ืคึผืึทืงืึทืืืฉืึทื, ืึทืืื ืื ืฉืจืืคื ืืืขื ืืืื ืืืืคื ืืื ืกืืคึผืขืจืืกืขืจ ืจืขืื. ืื ืืืืกื ื ืืฉื ืคืึทืจืืขืกื ืฆื ืืขืื ืืืจืืคืืจืื ื ืคึผืขืจืืืฉืึทื ื ืืื ืื ืกืืึทืืืจื ืกืงืึทืคึผื ืืื. ืืขืืืึทื ืืื ืึท ืคึผืขืงื ืืขืจืืคื python3-scapy. ืืืฆื ืืืจ ืงืขื ืขื ืงืึธื ืืจืึธืืืจื ืืื ืึทืืฅ ืึทืจืืขื.
ืืืืคื ืืื ืึทืจืืืกืคืืจื ืื ืืึทืคึฟืขื
morq@laptop:~/icmpshell$ sudo ./send.py 45.11.26.232 "Hello, world!"
Begin emission:
.Finished sending 1 packets.
*
Received 2 packets, got 1 answers, remaining 0 packets
###[ IP ]###
version = 4
ihl = 5
tos = 0x0
len = 45
id = 17218
flags =
frag = 0
ttl = 58
proto = icmp
chksum = 0x3403
src = 45.11.26.232
dst = 192.168.0.240
options
###[ ICMP ]###
type = echo-reply
code = 0
chksum = 0xde03
id = 0x0
seq = 0x0
###[ Raw ]###
load = 'run:Hello, world!
ืืึธืก ืืื ืืื ืขืก ืงืืงื ืืื ืืื ืื ืกื ืืคืขืจ
morq@laptop:~/icmpshell$ sudo tshark -i wlp1s0 -O icmp -f "icmp and host 45.11.26.232"
Running as user "root" and group "root". This could be dangerous.
Capturing on 'wlp1s0'
Frame 1: 59 bytes on wire (472 bits), 59 bytes captured (472 bits) on interface wlp1s0, id 0
Internet Protocol Version 4, Src: 192.168.0.240, Dst: 45.11.26.232
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0xd603 [correct]
[Checksum Status: Good]
Identifier (BE): 0 (0x0000)
Identifier (LE): 0 (0x0000)
Sequence number (BE): 0 (0x0000)
Sequence number (LE): 0 (0x0000)
Data (17 bytes)
0000 72 75 6e 3a 48 65 6c 6c 6f 2c 20 77 6f 72 6c 64 run:Hello, world
0010 21 !
Data: 72756e3a48656c6c6f2c20776f726c6421
[Length: 17]
Frame 2: 59 bytes on wire (472 bits), 59 bytes captured (472 bits) on interface wlp1s0, id 0
Internet Protocol Version 4, Src: 45.11.26.232, Dst: 192.168.0.240
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0xde03 [correct]
[Checksum Status: Good]
Identifier (BE): 0 (0x0000)
Identifier (LE): 0 (0x0000)
Sequence number (BE): 0 (0x0000)
Sequence number (LE): 0 (0x0000)
[Request frame: 1]
[Response time: 19.094 ms]
Data (17 bytes)
0000 72 75 6e 3a 48 65 6c 6c 6f 2c 20 77 6f 72 6c 64 run:Hello, world
0010 21 !
Data: 72756e3a48656c6c6f2c20776f726c6421
[Length: 17]
^C2 packets captured
ืื ืคึผืืืืึธืื ืืื ืื ืขื ืืคืขืจ ืคึผืขืงื ืืื ื ืืฉื ืืืืฉื.
ืงืขืจื ืขื ืืึธืืืืข
ืฆื ืืืืขื ืืื ืึท ืืขืืืึทื ืืืืจืืืึทื ืืึทืฉืื ืืืจ ืืืขื ืืึทืจืคึฟื ืืืึท ืืื ืืกืืขืจ make ะธ linux-headers-amd64, ืื ืื ืืื ืืืขื ืงืืืขื ืืื ืื ืคืึธืจืขื ืคืื ืืืคึผืขื ืืึทื ืกืื. ืืื ืืืขื ื ืืฉื ืฆืืฉืืขืื ืื ืืื ืฆืข ืงืึธื ืืื ืืขื ืึทืจืืืงื, ืืืจ ืงืขื ืขื ืงืืึธืื ืขืก ืืืืฃ Github.
ืงืจืืง ืกืขืืึทืคึผ
ืฆื ืึธื ืืืืื ืืื, ืืืจ ืืึทืจืคึฟื ืฆืืืื ืคืึทื ืืงืฉืึทื ื ืฆื ืืึธืื ืื ืืึธืืืืข ืืื ืึทื ืืึธืื ืขืก. ืื ืคืื ืงืฆืืข ืคึฟืึทืจ ืึทื ืืึธืืืื ื ืืื ื ืืฉื ืคืืจืืื ืื, ืึธืืขืจ ืืขืืึธืื rmmod ืขืก ืืืขื ื ืืฉื ืึทืจืืขืื, ืืขืจ ืืึธืืืืข ืืืขื ืืืื ืึทื ืืึธืืืื ืืืืื ืืืขื ืขืก ืืื ืึทืืืขืง.
#include <linux/module.h>
#include <linux/netfilter_ipv4.h>
static struct nf_hook_ops nfho;
static int __init startup(void)
{
nfho.hook = icmp_cmd_executor;
nfho.hooknum = NF_INET_PRE_ROUTING;
nfho.pf = PF_INET;
nfho.priority = NF_IP_PRI_FIRST;
nf_register_net_hook(&init_net, &nfho);
return 0;
}
static void __exit cleanup(void)
{
nf_unregister_net_hook(&init_net, &nfho);
}
MODULE_LICENSE("GPL");
module_init(startup);
module_exit(cleanup);ืืืืก ืืืื ืคืืจ ืื:
- ืฆืืืื ืืขืืขืจ ืืขืงืขืก ืืขื ืขื ืคึผืืื ืืื ืฆื ืืึทื ืืคึผืืืืจื ืื ืืึธืืืืข ืืื ืืื ืื ื ืขืืคืืืืขืจ.
- ืื ืึทืคึผืขืจืืืฉืึทื ื ืืืื ืืืจื ืึท ื ืขืืคืืืืขืจ, ืืืจ ืงืขื ืขื ืฉืืขืื ืืืงืก ืืื ืขืก. ืฆื ืืึธื ืืึธืก, ืืืจ ืืึทืจืคึฟื ืฆื ืืขืจืงืืขืจื ืื ืกืืจืืงืืืจ ืืื ืืืึธืก ืื ืงืจืืง ืืืขื ืืืื ืงืึทื ืคืืืืขืจื. ืื ืืขืจืกื ืืืืืืืง ืืึทื ืืื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืื ืคึฟืื ืงืฆืืข ืืืึธืก ืืืขื ืืืื ืขืงืกืึทืงืืืืึทื ืืื ืึท ืงืจืืง:
nfho.hook = icmp_cmd_executor;ืืื ืืืขื ืงืืืขื ืฆื ืื ืคึฟืื ืงืฆืืข ืืื ืฉืคึผืขืืขืจ.
ืืขืจื ืึธื ืืื ืฉืืขืื ืื ืคึผืจืึทืกืขืกืื ื ืฆืืื ืคึฟืึทืจ ืืขื ืคึผืขืงื:NF_INET_PRE_ROUTINGืกืคึผืขืฆืืคืืฆืืจื ืฆื ืคึผืจืึธืฆืขืก ืืขื ืคึผืขืงื ืืืขื ืขืก ืขืจืฉืืขืจ ืืืืก ืืื ืื ืงืขืจื. ืงืขื ืขื ืืืื ืืขืืืืื ืNF_INET_POST_ROUTINGืฆื ืคึผืจืึธืฆืขืก ืื ืคึผืึทืงืึทื ืืืขื ืขืก ืืืื ืึทืจืืืก ืื ืงืขืจื.
ืืื ืฉืืขืื ืื ืคืืืืขืจ ืฆื IPv4:nfho.pf = PF_INET;.
ืืื ืืขืื ืืืื ืงืจืืง ืื ืืขืืกืื ืืืืืขืจืงืืึทื:nfho.priority = NF_IP_PRI_FIRST;
ืืื ืืื ืคืึทืจืฉืจืืึทืื ืื ืืึทืื ืกืืจืืงืืืจ ืืื ืื ืคืึทืงืืืฉ ืคืึทืจืืฉืขืคึผืขื:nf_register_net_hook(&init_net, &nfho); - ืื ืืขืฆื ืคึฟืื ืงืฆืืข ืจืืืืืื ืื ืงืจืืง.
- ืื ืืขืจืืืืืขื ืืฉ ืืื ืงืืืจ ืื ืืขืืืืื ืึทืืื ืึทื ืืขืจ ืงืึทืืคึผืืืืขืจ ืงืขื ื ืืฉื ืืึทืงืืึธืื ืืื.
- ืคืึทื ืืงืฉืึทื ื
module_init()ะธmodule_exit()ืฉืืขืื ืื ืืขืจืข ืคืึทื ืืงืฉืึทื ื ืฆื ืื ืืฉืึทืืืื ืืื ืคืึทืจืขื ืืืงื ืืขื ืืึธืืืืข.
ืจืืืจืืืืื ื ืื ืคึผืืืืึธืื
ืืืฆื ืืืจ ืืึทืจืคึฟื ืฆื ืขืงืกืืจืึทืงื ืื ืคึผืืืืึธืื, ืืึธืก ืืื ืืขืืืขื ืื ืืขืจืกื ืฉืืืขืจ ืึทืจืืขื. ืืขืจ ืงืขืจื ืืื ื ืืฉื ืืึธืื ืึท ืืขืืืื-ืืื ืคืึทื ืืงืฉืึทื ื ืคึฟืึทืจ ืืจืืขืื ืืื ืคึผืืืืึธืืื, ืืืจ ืงืขื ืขื ืืืืื ืคึผืึทืจืก ืืขืืขืจื ืคืื ืคึผืจืึธืืึธืงืึธืืก ืืืืฃ ืืขืืขืจ ืืืจืื.
#include <linux/ip.h>
#include <linux/icmp.h>
#define MAX_CMD_LEN 1976
char cmd_string[MAX_CMD_LEN];
struct work_struct my_work;
DECLARE_WORK(my_work, work_handler);
static unsigned int icmp_cmd_executor(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)
{
struct iphdr *iph;
struct icmphdr *icmph;
unsigned char *user_data;
unsigned char *tail;
unsigned char *i;
int j = 0;
iph = ip_hdr(skb);
icmph = icmp_hdr(skb);
if (iph->protocol != IPPROTO_ICMP) {
return NF_ACCEPT;
}
if (icmph->type != ICMP_ECHO) {
return NF_ACCEPT;
}
user_data = (unsigned char *)((unsigned char *)icmph + (sizeof(icmph)));
tail = skb_tail_pointer(skb);
j = 0;
for (i = user_data; i != tail; ++i) {
char c = *(char *)i;
cmd_string[j] = c;
j++;
if (c == '')
break;
if (j == MAX_CMD_LEN) {
cmd_string[j] = '';
break;
}
}
if (strncmp(cmd_string, "run:", 4) != 0) {
return NF_ACCEPT;
} else {
for (j = 0; j <= sizeof(cmd_string)/sizeof(cmd_string[0])-4; j++) {
cmd_string[j] = cmd_string[j+4];
if (cmd_string[j] == '')
break;
}
}
schedule_work(&my_work);
return NF_ACCEPT;
}ืืืืก ืืื ืืื:
- ืืื ืืึธืื ืฆื ืึทืจืืึทื ื ืขืืขื ื ืึธื ืืขืืขืจ ืืขืงืขืก, ืืึธืก ืืึธื ืฆื ืืึทื ืืคึผืืืืจื IP ืืื ICMP ืืขืืขืจื.
- ืืื ืฉืืขืื ืื ืืึทืงืกืืืื ืฉืืจื ืืขื ื:
#define MAX_CMD_LEN 1976. ืคืืจืืืืก ืคึผืื ืงื ืืึธืก? ืืืืื ืืขืจ ืงืืืคืืืืขืจ ืงืืืื ืืื ืืขืจืืืฃ! ืืื ืืึธืื ืืืจ ืฉืืื ืกืึทืืืืฉืขืกืืื ืึทื ืืื ืืึทืจืคึฟื ืฆื ืคึฟืึทืจืฉืืืื ืื ืกืืึทืง ืืื ืงืืคึผืข, ืึทืืึธื ืืื ืืืขื ืืืฉืืืื ืืึธื ืืึธืก ืืื ืืคึฟืฉืจ ืืคืืื ืจืืืืืง ืื ืงืึธื. ืืื ืืืืื ืฉืืขืื ืื ืฉืืจื ืืืึธืก ืืืขื ืึทื ืืืึทืืื ืืขื ืืึทืคึฟืขื:char cmd_string[MAX_CMD_LEN];. ืขืก ืืึธื ืืืื ืงืขื ืืืง ืืื ืึทืืข ืคืึทื ืืงืฉืึทื ื, ืืื ืืืขื ืจืขืื ืืืขืื ืืขื ืืื ืืขืจ ืืขืืึทื ืืื ืคึผืึทืจืึทืืจืึทืฃ 9. - ืืืฆื ืืืจ ืืึทืจืคึฟื ืฆื ืื ืืฉืึทืืืื (
struct work_struct my_work;) ืกืืจืืงืืืจ ืืื ืคืึทืจืืื ืื ืขืก ืืื ืื ืื ืืขืจ ืคึฟืื ืงืฆืืข (DECLARE_WORK(my_work, work_handler);). ืืื ืืืขื ืืืื ืจืขืื ืืืขืื ืืืึธืก ืืึธืก ืืื ื ืืืืืง ืืื ืื ื ืืึทื ื ืคึผืึทืจืึทืืจืึทืฃ. - ืืืฆื ืืื ืืขืจืงืืขืจื ืึท ืคึฟืื ืงืฆืืข, ืืืึธืก ืืืขื ืืืื ืึท ืงืจืืง. ืื ืืืคึผ ืืื ืื ืืขื ืืืขื ืึทืจืืืืขื ืื ืืขื ืขื ืืืงืืืืืื ืืืจื ืื ื ืขืืคืืืืขืจ, ืืืจ ืืขื ืขื ืืืืื ืืื ืืขืจืขืกืืจื ืืื
skb. ืืึธืก ืืื ืึท ืืึธืืขื ืืึทืคืขืจ, ืึท ืคืื ืืึทืืขื ืืึทื ืืึทืื ืกืืจืืงืืืจ ืืืึธืก ืึผืืื ืึทืืข ืื ืืืฆื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืึท ืคึผืึทืงืึทื. - ืคึฟืึทืจ ืื ืคึฟืื ืงืฆืืข ืฆื ืึทืจืืขืื, ืืืจ ืืึทืจืคึฟื ืฆืืืื ืกืืจืึทืงืืฉืขืจื ืืื ืขืืืขืืข ืืืขืจืืึทืืึทืื, ืึทืจืืึทื ืืขืจืขืื ื ืฆืืืื ืืืขืจืืืืขืจื.
struct iphdr *iph; struct icmphdr *icmph; unsigned char *user_data; unsigned char *tail; unsigned char *i; int j = 0; - ืืืจ ืงืขื ืขื ืึธื ืืืืื ืืื ืืึธืืืง. ืคึฟืึทืจ ืื ืืึธืืืืข ืฆื ืึทืจืืขืื, ืงืืื ืคึผืึทืงืืฅ ืื ืืขืจืข ืืื ICMP Echo ืืขื ืขื ืืืจืฃ, ืึทืืื ืืืจ ืคึผืึทืจืก ืื ืืึทืคืขืจ ืืื ืืขืืืื-ืืื ืคืึทื ืืงืฉืึทื ื ืืื ืืืึทืจืคื ืึทืืข ื ืื-ICMP ืืื ื ืื-ืขืงืึธื ืคึผืึทืงืืฅ. ืฆืืจืืงืงืืืขื
NF_ACCEPTืืืื ืึทืงืกืขืคึผืืึทื ืก ืคืื ืืขื ืคึผืขืงื, ืึธืืขืจ ืืืจ ืงืขื ืขื ืืืื ืคืึทืื ืคึผืึทืงืึทืืืฉืึทื ืืืจื ืฆืืจืืงืงืืืขืNF_DROP.iph = ip_hdr(skb); icmph = icmp_hdr(skb); if (iph->protocol != IPPROTO_ICMP) { return NF_ACCEPT; } if (icmph->type != ICMP_ECHO) { return NF_ACCEPT; }ืืื ืืื ื ืืฉื ืืขืกืืขื ืืืึธืก ืืืขื ืคึผืึทืกืืจื ืึธื ืงืึธื ืืจืึธืืืจืื ื ืื IP ืืขืืขืจื. ืืืื ืืื ืืืึทื ืืืืกื ืคืื C ืืขืจืฆืืืื ืืืจ ืึทื ืึธื ื ืึธื ืืฉืขืงืก, ืขืคึผืขืก ืฉืจืขืงืืขื ืืื ืืขืืื ืื ืฆื ืคึผืึทืกืืจื. ืืื ืืืขื ืืืื ืฆืืคืจืืื ืืืื ืืืจ ืืืกืืื ืืืจ ืคืื ืืขื!
- ืืืฆื ืึทื ืืขืจ ืคึผืขืงื ืืื ืคืื ืื ืคึผืื ืืืขื ืืืคึผ ืืืจ ืืึทืจืคึฟื, ืืืจ ืงืขื ืขื ืขืงืกืืจืึทืงื ืื ืืึทืื. ืึธื ืึท ืืขืืืื-ืืื ืคึฟืื ืงืฆืืข, ืืืจ ืขืจืฉืืขืจ ืืึธืื ืฆื ืืึทืงืืืขื ืึท ืืืึทืื ืฆื ืื ืึธื ืืืื ืคืื ืื ืคึผืืืืึธืื. ืืึธืก ืืื ืืขืืื ืืื ืืืื ืึธืจื, ืืืจ ืืึทืจืคึฟื ืฆื ื ืขืืขื ืื ืืืึทืื ืฆื ืื ืึธื ืืืื ืคืื ืื ICMP ืืขืืขืจ ืืื ืืึทื ืขืก ืฆื ืื ืืจืืืก ืคืื ืืขื ืืขืืขืจ. ืึทืืฅ ื ืืฆื ืกืืจืืงืืืจ
icmph:user_data = (unsigned char *)((unsigned char *)icmph + (sizeof(icmph)));
ืืขืจ ืกืืฃ ืคืื ืื ืืขืืขืจ ืืืื ืืืืึทืื ืื ืกืืฃ ืคืื ืื ืคึผืืืืึธืื ืืืskb, ืืขืจืืืขืจ ืืืจ ืืึทืงืืืขื ืขืก ื ืืฆื ืืึธืืขืจ ืืืื ืคืื ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืกืืจืืงืืืจ:tail = skb_tail_pointer(skb);.
ืืืก ืืืื ืืื ืืขืื ืืขื ืืขืืืืจื , ืืืจ ืงืขื ืขื ืืืืขื ืขื ืืขืจ ืืืขืื ืื ืืึธืืขื ืืึทืคืขืจ. - ืึทืืึธื ืืืจ ืืึธืื ืคึผืืื ืืขืจื ืฆื ืื ืึธื ืืืื ืืื ืกืืฃ, ืืืจ ืงืขื ืขื ื ืึธืืืึทืื ืื ืืึทืื ืืื ืึท ืฉืืจืืงื
cmd_string, ืืฉืขืง ืขืก ืคึฟืึทืจ ืืขื ืืืึทืืืึทื ืคืื ืึท ืคึผืจืขืคืืงืกrun:ืืื, ืึธืืขืจ ืึทืืืขืงืืืึทืจืคื ืืขื ืคึผืขืงื ืืืื ืขืก ืืื ืคืขืื ืืืง, ืึธืืขืจ ืจืืจืืื ืื ืฉืืจื ืืืืืขืจ, ืจืืืืืืื ื ืืขื ืคึผืจืขืคืืงืก. - ืึทื ืก ืขืก, ืืืฆื ืืืจ ืงืขื ืขื ืจืืคื ืื ืื ืืขืจ ืืึทื ืืืขืจ:
schedule_work(&my_work);. ืืื ื ืขืก ืืืขื ื ืื ืืืื ืืขืืืขื ืฆื ืคืึธืจื ืึท ืคึผืึทืจืึทืืขืืขืจ ืฆื ืึทืืึท ืึท ืจืืคื, ืื ืฉืืจื ืืื ืื ืืึทืคึฟืขื ืืืื ืืืื ืืืืืืืข.schedule_work()ืืืขื ืฉืืขืื ืื ืคึฟืื ืงืฆืืข ืคึฟืึทืจืืื ืื ืืื ืื ืืืจืืืขืืื ืืขื ืกืืจืืงืืืจ ืืื ืืขืจ ืึทืืืขืืืื ืจืื ืคืื ืื ืึทืจืืขื ืกืงืขืืืฉืืืขืจ ืืื ืคืึทืจืขื ืืืงื, ืึทืืึทืืื ื ืืืจ ื ืืฉื ืฆื ืืืึทืจืื ืืื ืื ืืึทืคึฟืขื ืืื ืืขืขื ืืืงื. ืืึธืก ืืื ื ืืืืืง ืืืืึทื ืื ืงืจืืง ืืืื ืืืื ืืืืขืจ ืฉื ืขื. ืึทื ืืขืจืฉ, ืืืื ืืจืืจื ืืื ืึทื ืืึธืจื ืืฉื ืืืขื ืึธื ืืืืื ืึธืืขืจ ืืืจ ืืืขื ืืึทืงืืืขื ืึท ืงืขืจื ืคึผืึทื ืืง. ืคืึทืจืืึทืืื ืืื ืืื ืืืื! - ืึทื ืก ืขืก, ืืืจ ืงืขื ืขื ืึธื ื ืขืืขื ืืขื ืคึผืขืงื ืืื ืึท ืงืึธืจืึทืกืคึผืึทื ืืื ื ืฆืืจืืงืงืืืขื.
ืจืืคื ืึท ืคึผืจืึธืืจืึทื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ
ืืขื ืคึฟืื ืงืฆืืข ืืื ืื ืืขืจืกื ืคืึทืจืฉืืืืืง. ืืืื ื ืึธืืขื ืืื ืืขืืืขื ืืขืืขืื ืืื DECLARE_WORK(), ืื ืืืคึผ ืืื ืื ืืขื ืืืขื ืืขื ืืช ืืขื ืขื ื ืืฉื ืืฉืืงืึทืืืข. ืืืจ ื ืขืืขื ืื ืฉืืจื ืืื ืื ืืึทืคึฟืขื ืืื ืคืึธืจื ืขืก ืืื ืืื ืฆื ืฆื ืื ืฉืึธื. ืืึธืื ืืื ืืึทื ืืืขื ืืื ืคึผืึทืจืกืื ื, ืืืื ืคึฟืึทืจ ืืื ืึทืจืืขืก ืืื ืึทืืฅ ืึทื ืืขืจืฉ.
static void work_handler(struct work_struct * work)
{
static char *argv[] = {"/bin/sh", "-c", cmd_string, NULL};
static char *envp[] = {"PATH=/bin:/sbin", NULL};
call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
}- ืฉืืขืื ืื ืึทืจืืืืขื ืื ืฆื ืึท ืืขื ืืข ืคืื โโโโืกืืจืื ืืก
argv[]. ืืื ืืืขื ืื ื ืขืืขื ืื ืืขืืขืจ ืืืืืกื ืื ืคืจืืืจืืืขื ืืืขืจื ืืืงืข ืืืื ืืืจืืืขืคืืจื, ืืื ื ืืฉื ืืืก ื ืืกืืจืืืงืข ืฉืืจื ืืื ืกืคืืืก. - ืฉืืขืื ืกืืืืืืข ืืืขืจืืึทืืึทืื. ืืื ืื ืกืขืจืืึทื ืืืืื PATH ืืื ืึท ืืื ืืืื ืืึทื ื ืคืื ืคึผืึทืืก, ืืึธืืคึผืื ื ืึทื ืืื ืืขื ืขื ืึทืืข ืฉืืื ืงืึทืืืืื ื
/binั/usr/binะธ/sbinั/usr/sbin. ืื ืืขืจืข ืคึผืึทืืก ืจืึทืจืขืื ืขื ืื ืืื ืคืืจ. - ืคึฟืึทืจืืืง, ืืึธืืืจ ืขืก ืืึธื! ืงืขืจื ืขื ืคึฟืื ืงืฆืืข
call_usermodehelper()ืึทืงืกืขืคึผืฅ ืคึผืึธืืืฆืืข. ืืืขื ืฆื ืื ืืืื ืขืจื, ืืขื ืืข ืคืื โโืึทืจืืืืขื ืื, ืืขื ืืข ืคืื โโืกืืืืืืข ืืืขืจืืึทืืึทืื. ืืึธ ืืื ืืืื ืืืขืจื ืขืืขื ืึทื ืึทืืขืืขื ืคืืจืฉืืืื ืื ืืืึทืืฉ ืคืื ืคืึธืจื ืืขื ืืจื ืฆื ืื ืขืงืกืขืงืืืึทืืืข ืืขืงืข ืืื ืึท ืืึทืืื ืืขืจ ืึทืจืืืืขื ื, ืึธืืขืจ ืืืจ ืงืขื ืขื ืคืจืขืื. ืื ืืขืฆืืข ืึทืจืืืืขื ื ืกืคึผืขืฆืืคืืฆืืจื ืฆื ืฆื ืืืึทืจืื ืืื ืืขื ืคึผืจืึธืฆืขืก ืืื ืืขืขื ืืืงื (UMH_WAIT_PROC), ืคึผืจืึธืฆืขืก ืึธื ืืืื (UMH_WAIT_EXEC) ืึธืืขืจ ื ืืฉื ืืืึทืจืื ืืืึท ืึทืืข (UMH_NO_WAIT). ืืื ืขืก ืขืืืขืืข ืืขืจUMH_KILLABLE, ืืื ืืื ื ืืฉื ืืขืงืืงื ืืื ืืขื.
Assembly
ืื ืคึฟืึทืจืืึทืืืื ื ืคืื ืงืขืจื ืืึทืืืฉืืื ืืื ืืืจืืืขืงืึธืื ืืืจื ืื ืงืขืจื ืืึทืื-ืคืจืึทืืขืืืึธืจืง. ืืขืจืืคื make ืื ืึท ืกืคึผืขืฆืืขื ืืืขืืืืืึทืืขืจ ืืืื ืฆื ืื ืงืขืจื ืืืขืจืกืืข (ืืืคืืื ื ืืึธ: KERNELDIR:=/lib/modules/$(shell uname -r)/build), ืืื ืืขืจ ืึธืจื ืคืื ืื ืืึธืืืืข ืืื ืืืจืืืขืืื ืืขื ืฆื ืื ืืืึทืืขืืืืืง M ืืื ืื ืืขื ืืช. ืื icmpshell.ko ืืื ืจืืื ืืึทืจืืึทืฅ ื ืืฆื ืืขื ืคืจืืืืืืขืจืง ืืขืืึทืืจืข. ืืื obj-m ืื ืืืงืืืฅ ืื ืืืืคืขืฅ ืืขืงืข ืืืึธืก ืืืขื ืืืื ืงืึธื ืืืขืจืืขื ืืื ืึท ืืึธืืืืข. ืกืื ืืึทืงืก ืืืึธืก ืจืืืืืงืก main.o ะฒ icmpshell.o (icmpshell-objs = main.o) ืงืืงื ื ืืฉื ืืืืขืจ ืืึทืืืฉืืงืึทื ืฆื ืืืจ, ืึธืืขืจ ืึทืืื ืืืื ืขืก.
KERNELDIR:=/lib/modules/$(shell uname -r)/build
obj-m = icmpshell.o
icmpshell-objs = main.o
all: icmpshell.ko
icmpshell.ko: main.c
make -C $(KERNELDIR) M=$(PWD) modules
clean:
make -C $(KERNELDIR) M=$(PWD) clean
ืืืจ ืงืืืึทืื: make. ืืึธืื: insmod icmpshell.ko. ืืขืืื, ืืืจ ืงืขื ืขื ืงืึธื ืืจืึธืืืจื: sudo ./send.py 45.11.26.232 "date > /tmp/test". ืืืื ืืืจ ืืึธืื ืึท ืืขืงืข ืืืืฃ ืืืื ืืึทืฉืื /tmp/test ืืื ืขืก ืื ืืืืื ืื ืืืืื ืืืืก ืื ืคืืจืืื ื ืืื ืืขืฉืืงื ืืขืืืืจื, ืืืก ืืืื ื ืื ืื ืืืกื ืืืขืก ืืขืืื ืจืืืืื ืืื ืืื ืืื ืืืขืก ืืขืืื.
ืกืึธืฃ
ืืืึทื ืขืจืฉืืขืจ ืืขืจืคืึทืจืื ื ืืื ืืึธืืขืจ ืึทื ืืืืืงืืื ื ืืื ืืขืืืขื ืคืื ืืจืื ืืขืจ ืืื ืืื ืืขืจืืืึทืจื. ืืคืืื ืึธื ืืขืจืคืึทืจืื ื ืืขืืืขืืึธืคึผืื ื ืืื C, ืคืึธืืงืืกืื ื ืืืืฃ ืงืึทืืคึผืืืืขืจ ืืื ืฅ ืืื Google ืจืขืืืืืึทืื, ืืื ืืื ืืขืืืขื ืืืืืืช ืฆื ืฉืจืืึทืื ืึท ืืจืืขืื ืืึธืืืืข ืืื ืคืืื ืืื ืึท ืงืขืจื ืืขืงืขืจ, ืืื ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื ืึท ืฉืจืืคื ืงืืื. ืืื ืืขืจืฆื, ืืื ืืขืืื ืืขื ืฆื ืื Kernel Newbies ืงืึทื ืึทื, ืืื ืืื ืืขืจืฆืืืื ืืืจ ืฆื ื ืืฆื schedule_work() ืื ืฉืืื ืจืืคื call_usermodehelper() ืื ืืขืจ ืงืจืืง ืืื ืืื ืฉืึทืืขื ืืื, ืจืขืื ืกืึทืกืคึผืขืงืืื ืึท ืกืงืึทื. ื ืืื ืืขืจื ืฉืืจืืช ืคืื ืงืึธื ืงืึธืก ืืืจ ืืืขืื ืึท ืืืึธื ืคืื ืึทื ืืืืืงืืื ื ืืื ืืืื ืคืจืื ืฆืืื. ื ืืขืจืึธืื ืืขืจืคืึทืจืื ื ืืืึธืก ืืจืืึฟ ืืืื ืคืขืจืืขื ืืขืืข ืืืืึธืก ืืืขืื ืื ืึธืืืืขืจืืืขืืืื ื ืงืึทืืคึผืืขืงืกืืื ืคืื ืกืืกืืขื ืึทื ืืืืืงืืื ื.
ืืืื ืขืืขืฆืขืจ ืฉืืืืขื ืฆื ืืึธื ืึท ืงืึธื ืจืขืฆืขื ืืืข ืืืืฃ Github, ืืื ืืืขื ืืืื ืืึทื ืงืืึทืจ. ืืื ืืื ืืึทื ืฅ ืืืืขืจ ืึทื ืืื ืืขืืืื ืึท ืคึผืืึทืฅ ืคืื ื ืึทืจืืฉ ืืืกืืืืงืก, ืกืคึผืขืฆืืขื ืืืขื ืืื ืึทืจืืขื ืืื ืกืืจืื ืืก.
ืืงืืจ: www.habr.com