A method and system for attacker IP and command execution echo without container awareness

Abstract

The present invention discloses a container-insensitive attacker IP and command recording and echoing method and system. The method comprises the following steps: establishing a Kprobe module in a Linux system kernel, mounting a network function in the Kprobe module, recording a network function calling process, and obtaining an IP corresponding to a socketfd and a dictionary corresponding to a pid, ns_pid, socketfd, and IP; mounting an execve function in the Kprobe module, and obtaining a process tree by calling the execve function; establishing a Bash secret module, and saving the pid, execution content, and execution echo in a current Bash container in a log file in the container; performing namespace mapping conversion on the obtained pid in the container to generate a pid visible to a host machine layer outside the container, and comparing the pid visible to the host machine layer outside the container with a pid in a process tree to obtain an ancestor process pid; comparing the ancestor process pid with a dictionary corresponding to the pid, socketfd, ns_pid, and IP, obtaining a corresponding IP after matching, and obtaining a bash execution log imperceptibly according to the mapping relationship of the namespace.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for displaying the attacker's IP address and command execution without the need for a container. Background Art

[0002] With the development of the internet, network security has become increasingly important. Existing host monitoring and defense in Linux systems primarily utilizes bash monitoring, primarily using sudosh and the official cmd_log module of bash. Sudosh is specifically designed to be used in conjunction with sudo or as a standalone login shell. Sudosh allows the execution of root or user shells with logging. Every command typed and output by the user in the root shell is recorded. However, existing sudosh technologies have the following drawbacks: 1. sudosh cannot log the IP address of the attacker executing bash. 2. sudosh cannot log the execution and output of bash commands in bash -c mode, a common bash command execution method via webshells in network attacks. 3. sudosh cannot log the execution and output of rebound shells, another common command execution method in network attacks. 4. sudosh cannot log the process that created bash, meaning it cannot trace the origin of bash. 4. sudosh cannot log the PID of bash on the actual host machine when it runs in a container. In addition, the Bash log_cmd module has the following issues: 1. The log_cmd module cannot record the IP address of the attacker executing bash. 2. The log_cmd module cannot record the echo of bash commands. 3. The log_cmd module cannot record the PID of the real host machine when bash is running in a container. Summary of the Invention

[0003] One of the main invention objectives of the present invention is to provide a container-insensitive attacker IP and command recording and echoing method and system. The method and system use Bash secret codes to record the commands executed by the attacker and the echo after execution, and solve the problem of "the host machine cannot correctly retrieve the bash execution log" caused by the PID seen by the bash in the container being different from the PID seen by the host machine through namespace conversion.

[0004] Another object of the present invention is to provide a container-insensitive attacker IP and command record echo method and system. The method and system mount a network function in the Linux system, mount an execve function to return a process tree, and track the ancestor process according to the process tree, and obtain the attacker's IP according to the tracked ancestor process.

[0005] Another object of the present invention is to provide a container-unaware attacker IP and command record echo method and system. The method and system establish a mapping relationship between files inside and outside the container through the namespace mapping relationship. The files inside the container can be directly read outside the container (host host) according to the namespace mapping relationship, making the container unaware.

[0006] To achieve at least one of the above-mentioned objectives, the present invention further provides a container-insensitive attacker IP and command record echo method, comprising the following steps:

[0007] Establish a Kprobe module in the Linux system kernel, mount the network function in the Kprobe module, record the network function call process, obtain the IP corresponding to the socketfd and the dictionary corresponding to pid, ns_pid, socketfd, and ip;

[0008] Mounting the execve function in the Kprobe module, and obtaining the process tree by calling the execve function;

[0009] Create a Bash secret module to save the PID, execution content, and execution echo of the current Bash container in the log file in the container;

[0010] Perform namespace mapping on the acquired PID in the container to generate a PID visible to the host layer outside the container. Compare the PID visible to the host layer outside the container with the PID in the process tree to obtain the ancestor process PID.

[0011] Compare the ancestor process pid with the dictionary corresponding to the pid, socketfd, ns_pid, and ip, obtain the corresponding IP after matching, and obtain the bash execution log unconsciously according to the mapping relationship of the namespace.

[0012] According to one preferred embodiment of the present invention, the method for obtaining the pid in the current Bash container includes: the Kprobe module intercepts the corresponding process, and after intercepting the process, executes the task_pid_vnr function, and the task_pid_vnr function obtains the pid of the current process in the container.

[0013] According to another preferred embodiment of the present invention, the method includes:

[0014] Determine whether there is a network function event for the current pid. If so, trace the ancestor process by calling the execve function and obtain the corresponding IP;

[0015] Check if the current pid is equal to ns_pid. If so, return the process tree, visitor IP, bash command and echo.

[0016] According to another preferred embodiment of the present invention, the method includes:

[0017] Determine whether there is a network function event for the current pid. If so, trace the ancestor process by calling the execve function and obtain the corresponding IP;

[0018] Determine whether the current pid is equal to ns_pid. If not, convert the path in the namespace mapping container into a host path outside the container to generate ns_pid;

[0019] According to the ns_pid, the bash log is retrieved from the path outside the bash log host;

[0020] Returns the process tree, visitor IP, and bash commands and output based on the retrieved bash log.

[0021] According to another preferred embodiment of the present invention, the method obtains the pid in the container through the monitor, and executes a bash secret module in the container, and the bash secret module indexes and saves the pid in the container in the form of a log in the file system in the container.

[0022] According to another preferred embodiment of the present invention, the method for mapping the PID inside the container and the PID of the host machine outside the container by namespace conversion includes the following steps:

[0023] Driving the docker file system via devicemapper in the container;

[0024] Get the host fixed directory of the docker file system;

[0025] Get the directory parameter containing the container id mapping according to the DeviceName in the docker container;

[0026] The host machine fixed directory and the mapped directory parameters constitute a complete host machine mapping directory.

[0027] According to another preferred embodiment of the present invention, the method for mapping the PID inside the container and the PID of the host machine outside the container by namespace conversion includes the following steps:

[0028] Driving the docker file system via overlay2 within the container;

[0029] Get the host fixed directory in the docker file system;

[0030] Get the directory parameter containing the container ID mapping according to the WorkDir in the docker container;

[0031] The host machine fixed directory and the mapped directory parameters constitute a complete host machine mapping directory.

[0032] According to another preferred embodiment of the present invention, the method for constructing the bash secret code module includes the following steps:

[0033] Insert hidden functions at the positions of bash-c and bash-i;

[0034] Create a pseudo terminal with a parent-child relationship;

[0035] Creating a parent-child process in the pseudo terminal, wherein the parent process monitors the main device and the child process records the attacker's input;

[0036] The recorded status of the child process is executed based on the readable status of the master device by the master process.

[0037] In order to achieve at least one of the above-mentioned objects, the present invention further provides a container-insensitive attacker IP and command record echo system, which executes the above-mentioned container-insensitive attacker IP and command record echo method.

[0038] The present invention further provides a computer-readable storage medium storing a computer program. The computer program can be executed by a processor to implement the above-mentioned container-insensitive attacker IP and command record echoing method. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 Shown is a flowchart of a container-insensitive attacker IP and command recording and echoing method according to the present invention.

[0040] Figure 2 Shown is a specific flow chart of combining IP tracing and namespace conversion in the present invention.

[0041] Figure 3 Shown is a schematic diagram of the construction and execution flow of the secret code module in the present invention. DETAILED DESCRIPTION

[0042] The following description is intended to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are for illustrative purposes only, and those skilled in the art will readily appreciate other obvious variations. The basic principles of the present invention defined in the following description may be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the present invention.

[0043] It is to be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the elements may be multiple, and the term "one" should not be understood as a limitation on the quantity.

[0044] Please combine Figure 1-Figure 3 The present invention discloses a container-insensitive attacker IP and command record echo method and system. The present invention is based on process chain, socket chain, bash secret module and namespace conversion module to solve the problem that the host machine cannot correctly retrieve the bash execution log due to the difference between the PID visible to bash in the container and the PID seen in the host machine outside the container. In the process of combining process chain and socket chain, the attacker's IP and operation behavior can be accurately traced.

[0045] Specifically, the present invention needs to mount a Kprobe module in the Linux system. It should be noted that the Kprobe module is a lightweight kernel debugging module for tracking the execution status of kernel functions. The Kprobe module is mounted in the kernel of the Linux system, and network functions including but not limited to the accept function and the recvfrom function are mounted in the Kprobe module, and the execve function is mounted in the Kprobe module. Since the execve function is a key function in the Linux kernel, the call of all process functions will use the execve function. Therefore, the calling process of all processes can be obtained by calling the execve function, and the process tree can be returned according to the calling process of the execve function. The network functions such as the accept function and the recvfrom function are run in the Kprobe module. The Kprobe module can record the calling process and pid of the network function, further obtain the socket (socketfd) that executes the network function and the ip corresponding to the socket value, and obtain a dictionary corresponding to the pid, socketfd and ip. The dictionary is used for matching and comparison to obtain the ip of the corresponding function call. It should be noted that the above dictionary is based on the existing technology of network functions, and the present invention will not describe in detail how to compare and match.

[0046] Furthermore, it is necessary to modify the kernel code to build a bash secret code module. The specific method includes: inserting a secret code function at a key position in the Linux kernel, where the key position is the command entry point to be executed by bash-c and bash-i, and further creating a pair of pseudo terminals. The pair of pseudo terminals includes a master device master and a slave device slave. It should be noted that the above pair of pseudo terminals is a pair of character devices, and the method for obtaining the pair of pseudo terminals includes: establishing a process and opening the kernel's / dev / ptmx directory to obtain a master file descriptor (file descriptor), and at the same time creating a slave device file in the / dev / pts directory.

[0047] It should be noted that, please combine Figure 3 , the writes of the master device can be read from the slave device, and the writes of the slave device can be read from the master device. A parent-child process is further constructed, wherein the parent process holds the master device and the child process holds the slave device. When the parent process closes the input, the output and error echo remain unchanged; the child process input remains unchanged, and the output and error echo are changed to the slave device. The child process is used to receive the attacker's input and record the attacker's input. After exiting the secret function, the echo is automatically output to the slave device. The parent process enters an infinite loop, which is used to cyclically monitor whether the master device is readable. If the master device is readable, it means that the child device has an echo output. The echo output of the child device is recorded and returned to the attacker. Therefore, the attacker can be unaware through the master-slave device and the master-slave process. If the master device reads an error, it means that the child process has ended and the parent process exits. The secret function is F1.

[0048] The method for tracing the attacker's IP address according to the process chain of the network function includes: obtaining the ancestor process through the execve function, and judging whether the ancestor process has network functions such as the accept function and the recvfrom function mounted in the Kprobe module; if so, executing the sockfd_lookup function when the above network function is running; the sockfd_lookup function converts the socketfd into a sock structure; since the sock structure contains a five-tuple (source IP address, source port, destination IP address, destination port and transport layer protocol), the attacker's source IP address can be parsed after obtaining the sock structure; it should be noted that the above five-tuple cannot be changed, and the attacker's IP address can be traced.

[0049] During the process and IP tracing process, it is necessary to determine whether the pid of the current process obtained by parsing the attacker's IP is ns_pid. If so, the process tree, the attacker's IP, and the bash command echo are directly returned. If the pid of the current process obtained by parsing the attacker's IP is not ns_pid, the internal path of the container is directly converted into a host path outside the container through the namespace conversion, and the pid of the current process obtained by parsing the attacker's IP, the bash command echo, etc. recorded by the secret module are saved in the directory of the host path, thereby constructing an ns_pid with a mapping relationship with the pid in the container. The method for obtaining the pid in the container includes: when the network function is running, the process is intercepted by the Kprobe module, and the task_pid_vnr function is executed after the process is intercepted. The task_pid_vnr function obtains the pid of the current process in the container.

[0050] It is worth mentioning that the namespace mapping relationship refers to the mapping relationship of the container to the file system. For the observation process inside the container, the files outside the container cannot be seen; for the observation process outside the container, the file systems inside and outside the container can be seen. Since most containers are mainly driven by devicemapper and overlay2, the present invention uses docker containers and devicemapper and overlay2 drivers as examples to illustrate the namespace mapping relationship:

[0051] Take the file system driven by devicemapper as an example:

[0052] The fixed directory of the host outside the container is obtained through the file system driven by the devicemapper, where the fixed directory can be: / var / lib / docker / devicemapper / mnt, and the host mapping directory parameter containing the container id is further obtained according to the DeviceName of the docker container, where the host mapping directory parameter can be: ac54ea3fc91e53879314c69b4b58679c5f752906511dd364201f07a4d8ee107b, which comes from the DeviceName of the docker container and is obtained through the following instruction parameters: docker inspect CONTAINER ID|grepDeviceName, where CONTAINER ID represents the unique ID of the container, and the following mapping result is obtained: "DeviceName":"docker-253:0-101088745-ac54ea3fc91e53879314c69b4b58679c5f752906511dd364201f07a4d8ee107b".

[0053] Take the overlay2-driven file system as an example:

[0054] The fixed directory of the host outside the container is obtained through the overlay2-driven file system, where the fixed directory can be: / var / lib / docker / overlay2 / , and the host mapping directory parameter containing the container ID is further obtained according to the WorkDir of the docker container, where the host mapping directory parameter in the overlay2-driven file system can be: 7070cd892db3ae37f98a81e76b8732548400a5e2e4e9acd52af227c06b451ee6, where the host mapping directory in the overlay2-driven file system comes from the WorkDir of the docker container and is obtained through the following instruction parameters: docker inspect CONTAINER ID | grep WorkDir, where CONTAINER ID represents the unique identifier of the container. The above-mentioned devicemapper and overlay2 drivers can achieve the technical effect of searching by map.

[0055] Since the namespace conversion directly reads files inside the container from outside the container, an imperceptible technical effect of reading inside the container can be achieved.

[0056] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part, and / or installed from a removable medium. When the computer program is executed by the central processing unit (CPU), the above-mentioned functions defined in the method of the present application are executed. It should be noted that the computer-readable medium mentioned above in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of an electrical, magnetic, optical, electromagnetic, infrared segment, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more wire segments, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, an electromagnetic signal, an optical signal, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, electrical wire, optical fiber cable, RF, etc., or any suitable combination thereof.

[0057] The flow charts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0058] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functional and structural principles of the present invention have been demonstrated and explained in the embodiments. Without departing from the principles, the implementation methods of the present invention may be subject to any deformation or modification.

Claims

1. A container-insensitive attacker IP and command record echo method, characterized in that: The method comprises the following steps: Establish a Kprobe module in the Linux system kernel, mount the network function in the Kprobe module, record the network function call process, obtain the IP corresponding to the socketfd and the dictionary corresponding to pid, ns_pid, socketfd, and ip; Mounting the execve function in the Kprobe module, and obtaining the process tree by calling the execve function; Create a Bash secret module to save the PID, execution content, and execution echo of the current Bash container in the log file in the container; Perform namespace mapping on the acquired PID in the container to generate a PID visible to the host layer outside the container. Compare the PID visible to the host layer outside the container with the PID in the process tree to obtain the ancestor process PID. The namespace mapping relationship refers to the mapping relationship between the container and the file system. Compare the ancestor process pid with the dictionary corresponding to the pid, socketfd, ns_pid, and ip, obtain the corresponding IP after matching, and obtain the bash execution log unconsciously according to the mapping relationship of the namespace.

2. According to a container-insensitive attacker IP and command record echo method according to claim 1, it is characterized in that: The method for obtaining the pid in the current Bash container includes: the Kprobe module intercepting the corresponding process, executing the task_pid_vnr function after intercepting the process, and the task_pid_vnr function obtaining the pid of the current process in the container.

3. The container-insensitive attacker IP and command record echo method according to claim 1 is characterized in that: The method comprises: Determine whether there is a network function event for the current pid. If so, trace the ancestor process by calling the execve function and obtain the corresponding IP; Check if the current pid is equal to ns_pid. If so, return the process tree, visitor IP, bash command and echo.

4. The container-insensitive attacker IP and command record echo method according to claim 1 is characterized in that: The method comprises: Determine whether there is a network function event for the current pid. If so, trace the ancestor process by calling the execve function and obtain the corresponding IP; Determine whether the current pid is equal to ns_pid. If not, convert the path in the container to the host path outside the container according to the namespace mapping relationship to generate ns_pid; Based on the ns_pid, the Bash secret module retrieves the bash log through the host path outside the container; Returns the process tree, visitor IP, bash command, and echo based on the retrieved bash log.

5. The container-insensitive attacker IP and command record echo method according to claim 1 is characterized in that: The method obtains the PID in the container through a monitor, and executes a bash secret module in the container. The bash secret module indexes and saves the PID in the container in the form of a log in the file system in the container.

6. The container-insensitive attacker IP and command record echo method according to claim 1 is characterized in that: The method for mapping the internal PID of the container and the external host PID of the container by namespace mapping conversion includes the following steps: Driving the docker file system via devicemapper in the container; Get the host fixed directory of the docker file system; Get the directory parameter containing the container id mapping according to the DeviceName in the docker container; The host machine fixed directory and the mapped directory parameters constitute a complete host machine mapping directory.

7. The container-insensitive attacker IP and command record echo method according to claim 1 is characterized in that: The method for mapping the internal PID of the container and the external host PID of the container by namespace mapping conversion includes the following steps: Driving the docker file system via overlay2 within the container; Get the host fixed directory in the docker file system; Get the directory parameter containing the container id mapping according to the WorkDir in the docker container; The host machine fixed directory and the mapped directory parameters constitute a complete host machine mapping directory.

8. The container-insensitive attacker IP and command record echo method according to claim 1 is characterized in that: The method for constructing the bash secret code module includes the following steps: Insert secret functions at the positions of bash –c and bash –i; Create a pseudo terminal with a parent-child relationship; Creating a parent-child process in the pseudo terminal, wherein the parent process monitors the main device and the child process records the attacker's input; The recorded status of the child process is executed based on the readable status of the master device by the master process.

9. A container-insensitive attacker IP and command record echo system, characterized by: The system executes any one of the container-insensitive attacker IP and command recording and echoing methods described in claims 1-8.

10. A computer-readable storage medium, characterized in that A computer-readable storage medium stores a computer program, and the computer program can be executed by a processor to implement any container-unaware attacker IP and command recording and echoing method described in claims 1-8.

Images