上海交通大学
硕士学位论文
LINUX内核ROOTKIT的分析及实现
姓名：刘传
申请学位级别：硕士
专业：通信与信息系统
指导教师：薛质
20061201
LINUX内核ROOTKIT分析及实现
摘要
随着信息技术的迅猛发展，互联网和信息共享成为信息社会的主要趋势，越来越多的信息系统依赖于当
前的互联网，信息安全成为一个不可回避的话题逐渐摆在我们的面前。远程控制技术的研究成为网络安全研究中的热点之一，内核Rootkit（即用来保存和隐藏root权限）做为一种长期隐蔽控制计算机系统的有效工具，其相关技术是远程控制技术研究的重要组成部分。本文基于Linux系统环境下远程攻击控制平台，首先着重分析了Linux内核体系结构、系统启动过程、进程的管理调度和动态可加载模块，在此基础上，总结了基于系统调用替换实现内核Rootkit的方法，并做了逃避检测的改进；归纳了基于内核异常修复指针替换方法实现内核Rootkit的技术；提出并完成了基于Linux虚拟文件系统处理指针替换实现内核Rootkit的技术。虚拟文件系统处理指针的替换位于Linux系统的较低层次，很难被发现，并通过多种方式实现了文件隐藏、进程隐藏、网络连接隐藏、日志过滤、权限提升等功能模块。本文中的实现部分着重于隐蔽性和可用性方面，并在内核空间内，应用系统调用替换、隐藏模块、模块注入等多种方
I
linux内核设计与实现 pdf
法对Rootkit模块进行隐藏；在用户空间中采用内核模块启动用户空间程序、用户空间处理脚本替换等方法加强Rootkit的隐蔽性，最后提出了内核Rootkit存在的缺陷与检测方法，并给出了今后的研究方向。
关键词：远程控制，可加载模块，虚拟文件系统，内核木马
II
THE ANALYSIS AND REALIZATION OF
BACKDOOR BASED ON LINUX KERNEL
ABSTRACT
With the information technology developing rapidly, internet and information sharing become the trend of current information society. More and more information systems in diverse fields dependent on Internet currently. However, the information threats and security requirements is becoming the key of the problem which we have to be faced. Remote control techniques have become a focus in the studying of network security. Rootkit (which can be used to keep the root privilege) is a kind of tool used to control target's computer system permanently and secretly after successfully breaking into it, the correlation technical has become the important part of remote control technical. The article is based on the remote attack system, and firstly described the structure of linux Kernel , linux boot process, the management of task and LKM (loadable kernel module), then, summarized the method of realization kernel Rootkit which was based on replacing system call and make improvement on the hand of escaping check; sum up the technical of realization Rootkit based on exception fix pointe
r replacing; raised and finished the Rootkit, that is based on replacing the system call of VFS. The method of replacing the pointer of VFS was in the lower level so that it’s hard to be detected. The VFS backdoor can gain a very high privilege, such as hiding file, hiding process, hiding net connection, log filter and so on. The realization part in this article emphasize on concealment and useableness, furthermore, the hidden rootkit module technical used replacing system call, hidden module and module injection in kernel space, in user space, used the method kernel module started the program and replacing script. At last, some shortcomings were presented for the purpose of checking and raised the
III
studying direction.
Keywords: remote control, lkm vfs, rootkit, linux
IV

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。