A method, device and equipment for obtaining bash execution information based on hook technology

Abstract

Embodiments of the present application provide a method, device and equipment for obtaining Bash execution information based on Hook technology, which constructs a plug-in function and a socket, analyzes Bash source code logic, finds a suitable function insertion position, inserts a corresponding plug-in function, uses the plug-in function to obtain Bash command execution information of each node in real time, and sends the Bash command execution information to the socket, waiting for an external program to obtain. Embodiments of the present application can obtain detailed information of user (may be a normal user or a malicious user) operating in a Bash terminal in real time without user awareness, can provide convenience for subsequent audit and other demand scenarios of Bash commands, and thus better guarantee user safety.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method, apparatus, and device for obtaining Bash execution information based on Hook technology. Background Technology

[0002] Essentially, the shell is a macro processor that executes commands. The term macro processor refers to the ability to expand text and symbols to create larger expressions.

[0003] The Unix shell is both a command interpreter and a programming language. As a command interpreter, the shell provides a user interface for a rich set of GNU utilities. The shell can be used in interactive or non-interactive modes. In interactive mode, it accepts commands entered from the keyboard; in non-interactive mode, the shell executes commands read from files. The shell also provides a small set of built-in commands that implement functionality that is not possible or inconvenient to obtain through individual utilities.

[0004] Bash is the shell for the GNU operating system. It can currently run on almost every version of Unix and some other operating systems, including Linux and Mac OS X v10.4 and macOS Mojave, which use it as the default shell. It is one of the mainstream shells.

[0005] In Bash, user-executed commands are stored in ~ / .bash_history, and the `history` command can be used to view and perform other operations on them. However, user-executed commands are not written to ~ / .bash_history in real time; instead, they are first stored in a cache. Commands in the cache are only written to ~ / .bash_history when the user logs out or manually executes the `history -w` command. Therefore, real-time auditing of user-executed Bash commands is not possible. Summary of the Invention

[0006] To address this issue, this invention provides a method, apparatus, and device for obtaining Bash execution information based on Hook technology, thereby resolving the technical problem that existing technologies cannot obtain detailed user Bash execution information in real time for subsequent security auditing of Bash commands.

[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0008] According to a first aspect of the present invention, this application provides a method for obtaining Bash execution information based on Hook technology, the method comprising:

[0009] Construct instrumentation functions for obtaining Bash execution information and sockets for receiving Bash execution information;

[0010] Analyze the Bash source code logic, find suitable function insertion points, and insert the corresponding instrumentation functions.

[0011] Start the Bash command and use various instrumentation functions to obtain Bash execution information for each node in real time;

[0012] The Bash execution information is assembled and sent to the socket, waiting for an external program to retrieve it.

[0013] Preferably, the method further includes:

[0014] After the current Bash execution information is sent to the socket, it is determined whether the Bash session should continue to execute subsequent commands;

[0015] If the Bash session continues to execute subsequent commands, then the subsequent Bash commands are started, and the subsequent Bash execution information of each node is obtained in real time using each instrumentation function; then the subsequent Bash execution information is assembled and sent to the socket.

[0016] If the Bash session no longer executes subsequent commands, then exit the Bash session.

[0017] Furthermore, instrumentation functions for obtaining Bash execution information are constructed, including:

[0018] Define a Bash session sequence to record the command sequence number in the Bash session. The sequence number is incremented by 1 each time it is used, and the initial command sequence number is set to 0.

[0019] Define the required instrumentation function;

[0020] The instrumentation functions include:

[0021] The first instrumentation function is used to obtain initial information when a Bash session starts.

[0022] The second instrumentation function is used to obtain the first information before the Bash command is executed;

[0023] The third instrumentation function is used to obtain second information before a Bash command executes a built-in command or a disk file.

[0024] The fourth instrumentation function is used to obtain third information after the Bash command execution is completed.

[0025] Furthermore, a socket for receiving Bash execution information is constructed, including:

[0026] Define the socket name;

[0027] Defines a socket address of type sockaddr_un for use in local inter-process communication.

[0028] Further analysis of the Bash source code logic identifies suitable function insertion points, and the corresponding instrumentation functions are inserted, including:

[0029] The source code logic analysis begins with the main function. After the main function starts executing, it is determined whether a command needs to be executed.

[0030] If no command needs to be executed, the logic for extending the parameters is entered; if a command needs to be executed, the logic for determining whether the Bash command contains the "-c" parameter is entered.

[0031] Identify the first logical node where the main function begins execution and the second logical node to determine whether a command needs to be executed;

[0032] The position between the first logical node and the second logical node is determined as the first insertion position, and the first instrumentation function is inserted into the first insertion position.

[0033] If the Bash command does not have the "-c" parameter, it will directly enter the command loop to read the function execution logic;

[0034] After entering the command loop reading function execution logic, it checks whether the EOF flag has been read; if the EOF flag has been read, it exits Bash execution; if the EOF flag has not been read, it completes the reading and parsing of the user input command.

[0035] After parsing the user input command, the command execution function is called;

[0036] The first built-in command execution function is called through the command execution function to execute the parsed command;

[0037] If the command execution function completes, then return to the command loop reading function execution logic;

[0038] Identify the fifth logical node that completes the parsing of the user input command and the sixth logical node that enters the command execution logic;

[0039] The position between the fifth logical node and the sixth logical node is determined as the third insertion position, and the second instrumentation function is inserted into the third insertion position;

[0040] Identify the seventh logical node in the command execution function where command execution is complete and the eighth logical node where the logic for returning to the command loop reading function is executed;

[0041] The position between the seventh logical node and the eighth logical node is determined as the fourth insertion position, and the fourth instrumentation function is inserted into the fourth insertion position.

[0042] Preferably, analyzing the Bash source code logic, finding suitable function insertion points, and inserting the corresponding instrumentation functions further includes:

[0043] If the Bash command contains the "-c" parameter, then proceed to the command string required to determine whether the Bash command contains the "-c" parameter;

[0044] If the command string required by the "-c" parameter is not present in the Bash command, the command loop will be entered to read the function execution logic.

[0045] After entering the command loop reading function execution logic, it checks whether the EOF flag has been read; if the EOF flag has been read, it exits Bash execution; if the EOF flag has not been read, it completes the reading and parsing of the user input command.

[0046] After parsing the user input command, the command execution function is called;

[0047] The first built-in command execution function is called through the command execution function to execute the parsed command;

[0048] If the command execution function completes, then return to the command loop reading function execution logic;

[0049] Identify the fifth logical node that completes the parsing of the user input command and the sixth logical node that enters the command execution logic;

[0050] The position between the fifth logical node and the sixth logical node is determined as the third insertion position, and the second instrumentation function is inserted into the third insertion position;

[0051] Identify the seventh logical node in the command execution function where command execution is complete and the eighth logical node where the logic for returning to the command loop reading function is executed;

[0052] The position between the seventh logical node and the eighth logical node is determined as the fourth insertion position, and the fourth instrumentation function is inserted into the fourth insertion position.

[0053] Preferably, analyzing the Bash source code logic, finding suitable function insertion points, and inserting the corresponding instrumentation functions further includes:

[0054] If the Bash command contains the command string required by the "-c" parameter, then the call logic of the first built-in command execution function is entered;

[0055] The third logical node identifies the command string required to determine whether a Bash command contains the "-c" parameter, and the fourth logical node enters the logic for calling the first built-in command execution function.

[0056] The position between the third logical node and the fourth logical node is determined as the second insertion position, and the second instrumentation function is inserted into the second insertion position.

[0057] Preferably, analyzing the Bash source code logic, finding suitable function insertion points, and inserting the corresponding instrumentation functions further includes:

[0058] After the first built-in command execution function call logic is executed, it is determined whether the command to be executed is a simple command.

[0059] If the command to be executed is not a simple command, then different execution functions are called according to the type of the command, and the command execution function is called again.

[0060] If the command to be executed is a simple command, then the execution logic of the simple command execution function is entered to determine whether the command to be executed is an external command or a built-in command in a disk executable file;

[0061] If the command to be executed is a built-in command, then the second built-in command execution function is called, and after the execution logic of the second built-in command execution function is completed, the first built-in command execution function is called.

[0062] If the command to be executed is an external command in a disk executable file, then the disk file execution function is called, and the first built-in command execution function is called again;

[0063] Identify the ninth logical node that calls the second built-in command execution function;

[0064] The ninth logical node is determined as the fifth insertion position, and the third instrumentation function is inserted into the fifth insertion position;

[0065] Identify the tenth logical node that calls the function to execute the disk file;

[0066] The tenth logical node is determined as the sixth insertion position, and the third instrumentation function is inserted into the sixth insertion position.

[0067] According to a second aspect of the present invention, this application provides an apparatus for obtaining Bash execution information based on Hook technology, the apparatus comprising:

[0068] An instrumentation function construction module is used to construct instrumentation functions, which are used to obtain Bash execution information;

[0069] A socket construction module is used to construct sockets, which are used to receive Bash execution information;

[0070] The function insertion module is used to analyze the Bash source code logic, find suitable function insertion positions, and insert the corresponding instrumentation functions.

[0071] The information acquisition module is used to start Bash commands and use various instrumentation functions to obtain Bash execution information of each node in real time.

[0072] The information transmission module is used to assemble the Bash execution information and send it to the socket, waiting for the external program to retrieve it.

[0073] Preferably, the information acquisition module is further configured to:

[0074] After the current Bash execution information is sent to the socket, it is determined whether the Bash session should continue to execute subsequent commands;

[0075] If the Bash session continues to execute subsequent commands, then the subsequent Bash commands are started, and the subsequent Bash execution information of each node is obtained in real time using each instrumentation function; if the Bash session no longer continues to execute subsequent commands, then the Bash session is exited.

[0076] The information transmission module is also used to assemble the subsequent Bash execution information and send it to the socket.

[0077] Furthermore, instrumentation functions for obtaining Bash execution information are constructed, including:

[0078] Define a Bash session sequence to record the command sequence number in the Bash session. The sequence number is incremented by 1 each time it is used, and the initial command sequence number is set to 0.

[0079] Define the required instrumentation function;

[0080] The instrumentation functions include:

[0081] The first instrumentation function is used to obtain initial information when a Bash session starts.

[0082] The second instrumentation function is used to obtain the first information before the Bash command is executed;

[0083] The third instrumentation function is used to obtain second information before a Bash command executes a built-in command or a disk file.

[0084] The fourth instrumentation function is used to obtain third information after the Bash command execution is completed.

[0085] Furthermore, a socket for receiving Bash execution information is constructed, including:

[0086] Define the socket name;

[0087] Defines a socket address of type sockaddr_un for use in local inter-process communication.

[0088] Further analysis of the Bash source code logic identifies suitable function insertion points, and the corresponding instrumentation functions are inserted, including:

[0089] The source code logic analysis begins with the main function. After the main function starts executing, it is determined whether a command needs to be executed.

[0090] If no command needs to be executed, the logic for extending the parameters is entered; if a command needs to be executed, the logic for determining whether the Bash command contains the "-c" parameter is entered.

[0091] Identify the first logical node where the main function begins execution and the second logical node to determine whether a command needs to be executed;

[0092] The position between the first logical node and the second logical node is determined as the first insertion position, and the first instrumentation function is inserted into the first insertion position.

[0093] If the Bash command does not have the "-c" parameter, it will directly enter the command loop to read the function execution logic;

[0094] After entering the command loop reading function execution logic, it checks whether the EOF flag has been read; if the EOF flag has been read, it exits Bash execution; if the EOF flag has not been read, it completes the reading and parsing of the user input command.

[0095] After parsing the user input command, the command execution function is called;

[0096] The first built-in command execution function is called through the command execution function to execute the parsed command;

[0097] If the command execution function completes, then return to the command loop reading function execution logic;

[0098] Identify the fifth logical node that completes the parsing of the user input command and the sixth logical node that enters the command execution logic;

[0099] The position between the fifth logical node and the sixth logical node is determined as the third insertion position, and the second instrumentation function is inserted into the third insertion position;

[0100] Identify the seventh logical node in the command execution function where command execution is complete and the eighth logical node where the logic for returning to the command loop reading function is executed;

[0101] The position between the seventh logical node and the eighth logical node is determined as the fourth insertion position, and the fourth instrumentation function is inserted into the fourth insertion position.

[0102] Preferably, analyzing the Bash source code logic, finding suitable function insertion points, and inserting the corresponding instrumentation functions further includes:

[0103] If the Bash command contains the "-c" parameter, then proceed to the command string required to determine whether the Bash command contains the "-c" parameter;

[0104] If the command string required by the "-c" parameter is not present in the Bash command, the command loop will be entered to read the function execution logic.

[0105] After entering the command loop reading function execution logic, it checks whether the EOF flag has been read; if the EOF flag has been read, it exits Bash execution; if the EOF flag has not been read, it completes the reading and parsing of the user input command.

[0106] After parsing the user input command, the command execution function is called;

[0107] The first built-in command execution function is called through the command execution function to execute the parsed command;

[0108] If the command execution function completes, then return to the command loop reading function execution logic;

[0109] Identify the fifth logical node that completes the parsing of the user input command and the sixth logical node that enters the command execution logic;

[0110] The position between the fifth logical node and the sixth logical node is determined as the third insertion position, and the second instrumentation function is inserted into the third insertion position;

[0111] Identify the seventh logical node in the command execution function where command execution is complete and the eighth logical node where the logic for returning to the command loop reading function is executed;

[0112] The position between the seventh logical node and the eighth logical node is determined as the fourth insertion position, and the fourth instrumentation function is inserted into the fourth insertion position.

[0113] Preferably, analyzing the Bash source code logic, finding suitable function insertion points, and inserting the corresponding instrumentation functions further includes:

[0114] If the Bash command contains the command string required by the "-c" parameter, then the call logic of the first built-in command execution function is entered;

[0115] The third logical node identifies the command string required to determine whether a Bash command contains the "-c" parameter, and the fourth logical node enters the logic for calling the first built-in command execution function.

[0116] The position between the third logical node and the fourth logical node is determined as the second insertion position, and the second instrumentation function is inserted into the second insertion position.

[0117] Preferably, analyzing the Bash source code logic, finding suitable function insertion points, and inserting the corresponding instrumentation functions further includes:

[0118] After the calling logic of the first built-in command execution function is executed, it is determined whether the command to be executed is a simple command.

[0119] If the command to be executed is not a simple command, then different execution functions are called according to the type of the command, and the command execution function is called again.

[0120] If the command to be executed is a simple command, then the execution logic of the simple command execution function is entered to determine whether the command to be executed is an external command or a built-in command in a disk executable file;

[0121] If the command to be executed is a built-in command, then the second built-in command execution function is called, and after the execution logic of the second built-in command execution function is completed, the first built-in command execution function is called.

[0122] If the command to be executed is an external command in a disk executable file, then the disk file execution function is called, and the first built-in command execution function is called again;

[0123] Identify the ninth logical node that calls the second built-in command execution function;

[0124] The ninth logical node is determined as the fifth insertion position, and the third instrumentation function is inserted into the fifth insertion position;

[0125] Identify the tenth logical node that calls the function to execute the disk file;

[0126] The tenth logical node is determined as the sixth insertion position, and the third instrumentation function is inserted into the sixth insertion position.

[0127] According to a third aspect of the present invention, a device for obtaining Bash execution information based on Hook technology is provided, the device comprising: a processor and a memory;

[0128] The memory is used to store one or more program instructions;

[0129] The processor is configured to run one or more program instructions to perform the steps of a method for obtaining Bash execution information based on Hook technology as described in any of the preceding claims.

[0130] Compared with existing technologies, this invention provides a method, apparatus, and device for obtaining Bash execution information based on Hook technology. By constructing instrumentation functions and sockets, analyzing the Bash source code logic, finding suitable function insertion points, inserting corresponding instrumentation functions, and using these functions to obtain Bash execution information from each node in real time, which is then sent to the socket for external program retrieval. This invention can obtain detailed information about user (whether normal or malicious) operations on the Bash terminal in real time without the user's awareness, facilitating subsequent auditing of Bash commands and other scenarios, thereby better protecting user security. Attached Figure Description

[0131] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0132] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0133] Figure 1 A schematic diagram of a device for obtaining Bash execution information based on Hook technology, provided in an embodiment of the present invention;

[0134] Figure 2 A flowchart illustrating a method for obtaining Bash execution information based on Hook technology, provided in an embodiment of the present invention;

[0135] Figure 3 This is a schematic diagram illustrating the principle of finding a suitable position to insert the corresponding instrumentation function based on analyzing the Bash source code logic, as provided in an embodiment of the present invention. Detailed Implementation

[0136] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0137] The following are explanations of the abbreviations and key terms used in the embodiments of the present invention:

[0138] Hook technology, also known as hook function, involves a hook program capturing a message before the system calls the function. The hook function gains control first, allowing it to process (modify) the function's execution behavior or forcibly terminate message transmission. Simply put, it pulls code from other systems and makes it executable on the current system.

[0139] A socket is an abstraction of an endpoint for bidirectional communication between application processes on different hosts on a network. A socket represents one end of inter-process communication on the network, providing a mechanism for application-layer processes to exchange data using network protocols. In terms of its role, a socket connects to the application process above and the network protocol stack below; it is the interface through which applications communicate via network protocols and interact with the network protocol stack.

[0140] One method of inter-process communication (IPC) is using UNIX sockets, but instead of network sockets, people often use a method called local sockets. This avoids leaving backdoors for hackers. Unlike network socket bindings, local socket bindings are performed using the `struct sockaddr_un` structure. The `struct sockaddr_un` structure has two parameters: `sun_family` and `sun_path`. `sun_family` can only be `AF_LOCAL` or `AF_UNIX`, while `sun_path` is the path to the local file.

[0141] EOF is a computer term, short for End Of File, indicating in operating systems that there is no more data to read from the data source. The data source is usually called a file or stream. This character is typically present at the end of a text file to indicate the end of data.

[0142] A simple command is an atomic operation command that can be executed simply by calling the simple_command_execute() function.

[0143] To solve the above technical problems, such as Figure 1 As shown in the figure, this application provides a device for obtaining Bash execution information based on Hook technology. The device includes: an instrumentation function construction module 1, a socket construction module 2, a function insertion module 3, an information acquisition module 4, and an information transmission module 5.

[0144] Specifically, the instrumentation function construction module 1 is used to construct instrumentation functions, which are used to obtain Bash execution information; the socket construction module 2 is used to construct sockets, which are used to receive Bash execution information; the function insertion module 3 is used to analyze the Bash source code logic, find suitable function insertion positions, and insert the corresponding instrumentation functions; the information acquisition module 4 is used to start the Bash command and use each instrumentation function to obtain the Bash execution information of each node in real time; the information transmission module 5 is used to assemble the Bash execution information and send it to the socket, waiting for external programs to obtain it.

[0145] Preferably, the information acquisition module 4 is further configured to: determine whether the Bash session will continue to execute subsequent commands after the current Bash execution information is sent to the socket; if the Bash session continues to execute subsequent commands, then start the subsequent Bash commands and use each instrumentation function to obtain the subsequent Bash execution information of each node in real time; if the Bash session no longer continues to execute subsequent commands, then exit the Bash session; the information transmission module 5 is further configured to assemble the subsequent Bash execution information and send it to the socket.

[0146] Compared with existing technologies, this application provides a device for obtaining Bash execution information based on Hook technology. By constructing instrumentation functions and sockets, it analyzes the Bash source code logic, finds suitable function insertion points, inserts the corresponding instrumentation functions, and uses these functions to obtain Bash execution information from each node in real time. This information is then sent to the socket for external programs to retrieve. This invention can obtain detailed information about user (whether normal or malicious) operations on the Bash terminal in real time without the user's awareness. This facilitates subsequent auditing of Bash commands and other scenarios, thereby better protecting user security.

[0147] Corresponding to the aforementioned apparatus for obtaining Bash execution information based on Hook technology, this invention also discloses a method for obtaining Bash execution information based on Hook technology. The following details a method for obtaining Bash execution information based on Hook technology disclosed in this invention, in conjunction with the apparatus for obtaining Bash execution information based on Hook technology described above.

[0148] like Figure 2As shown below, the specific steps of a method for obtaining Bash execution information based on Hook technology provided in this application embodiment will be described in detail.

[0149] Step S11: Construct an instrumentation function for obtaining Bash execution information using instrumentation function construction module 1, and construct a socket for receiving Bash execution information using socket construction module 2.

[0150] Further, in step S11 above, the instrumentation function construction module 1 constructs an instrumentation function for obtaining Bash execution information, specifically including: defining a Bash session sequence cw_session_seq to record the command sequence number in the Bash session, incrementing by 1 each time it is used, and setting the initial command sequence number to 0, specifically as follows: static size_t cw_session_seq = 0; defining the required instrumentation function; the instrumentation function includes: a first instrumentation function cw_session_begin(), used to obtain the initial information when the Bash session starts; a second instrumentation function cw_cmd_start(), used to obtain the first information before the Bash command is executed; a third instrumentation function cw_command_start(), used to obtain the second information before the Bash command executes built-in commands or disk files; and a fourth instrumentation function cw_cmd_finish, used to obtain the third information after the Bash command is executed.

[0151] As described above, in this embodiment of the invention, the initial information obtained when a Bash session starts through the first instrumentation function cw_session_begin() includes, but is not limited to, the following:

[0152] “event”: Events used to mark the information obtained this time, including “SESSION_START”, “COMMAND_START”, “CMD_START”, and “CMD_FINISH”.

[0153] "session_id": Used to uniquely identify a Bash session. It is converted from a unique binary UUID and is a 36-byte string in the form of "1b4e28ba-2fa1-11d2-883f-0016d3cca427".

[0154] "time": Used to record the session start time;

[0155] "interactive": This indicates whether Bash was started interactively. "true" means interactive, and "false" means non-interactive.

[0156] "pid": Used to record the process ID of the current Bash process;

[0157] "path": Used to record the absolute path of the Bash program, such as " / usr / bin / bash";

[0158] "pname": Used to record the process name, such as "bash";

[0159] “cmdline”: Used to record the command to start Bash, such as “bash -i”;

[0160] "uid": Used to record the user ID that started Bash;

[0161] "uname": Used to record the username used to start Bash, such as "root";

[0162] “gid”: Used to record the user group ID to which the user belongs;

[0163] “gname”: Used to record the name of the user group to which the user belongs;

[0164] “euid”: Used to record the valid user ID for starting Bash;

[0165] “euname”: Used to record the valid username for starting Bash;

[0166] “egid”: Used to record the valid user group ID for starting Bash;

[0167] “egname”: Used to record the valid user group name for starting Bash;

[0168] “cwd”: Used to record the current working directory of Bash, such as “ / root”;

[0169] "proc_chain": Used to record process call chain information of the current Bash process, including information about the current process and its parent and grandparent processes.

[0170] As described above, in this embodiment of the invention, the first information obtained before the execution of a Bash command through the second instrumentation function cw_cmd_start() includes, but is not limited to, the following: "event", "session_id", "seq", "time", "cmdline", "cwd", and "env". "seq" records the sequence number of the executed command in the current Bash session, and "env" records the environment variables of the current command execution environment. The meanings of the other recorded contents are the same as or similar to those in the initial information obtained when starting a Bash session, and will not be explained further here.

[0171] As described above, in this embodiment of the invention, the second information obtained by the third instrumentation function cw_command_start() before the Bash command executes a built-in command or a disk file includes, but is not limited to, the following: "event", "session_id", "seq", "time", "cmdline", "cwd", "path", "pid", and "exename". Here, "exename" represents the name of the built-in command or the filename of the disk file executed by Bash. The meanings of the other recorded contents are the same as or similar to those in obtaining the initial information when a Bash session starts or the first information before the Bash command executes, and will not be explained further here.

[0172] As described above, in this embodiment of the invention, the third information obtained after the Bash command execution is completed through the fourth instrumentation function cw_cmd_finish includes, but is not limited to, the following: "event", "session_id", "seq", "time", and "exit_code". "exit_code" describes the return status after the command execution is completed. The meanings of the other recorded contents are the same as or similar to those in obtaining the initial information when the Bash session starts, the first information before the Bash command is executed, or the second information before the Bash command executes built-in commands or disk files; further explanation is not provided here.

[0173] In Bash, user-executed commands are stored in ~ / .bash_history, and the `history` command can be used to view and perform other operations on them. However, this only stores the commands executed by the user, without other detailed information such as execution time and process ID. The stored information is not comprehensive enough and is not conducive to subsequent Bash command auditing.

[0174] As described above, in this embodiment of the invention, the instrumentation function obtains Bash execution information at a suitable Hook location (insertion location). This information includes: information at the start of the Bash session, before and after the execution of Bash commands. The obtained information includes: events, session ID, command execution path, process ID, user ID, executed command, command execution time, and any other obtainable valid information. Therefore, in this embodiment of the invention, detailed information of the Bash commands executed by the user can be obtained in real time, and the obtained information can meet the requirements for command security auditing, etc.

[0175] It should be noted that, in this embodiment of the application, there is no restriction on the selection of specific information obtained, and it can be added or filtered out according to the specific needs of the scenario.

[0176] In addition, in step S11 above, the socket for receiving Bash execution information is constructed through the socket construction module 2, specifically including: defining the socket name CW_SOCKET_NAME: #define CW_SOCKET_NAME " / var / run / shell.sock"; defining the socket address of type sockaddr_un for local inter-process communication, for example, the socket address is: static struct sockaddr_un cw_socket_addr; the sockaddr_un structure format information includes: a variable of type sa_family_t sun_family, and an array variable of type char sun_path

[108] , which are as follows:

[0177] struct sockaddr_un {

[0178] sa_family_t sun_family; / * AF_UNIX * /

[0179] char sun_path

[108] ; / * Pathname * /

[0180] };

[0181] Among them, sun_family stores the protocol family of the address, such as AF_UNIX for the UNIX local domain protocol family; sun_path

[108] stores the path name of the socket, which can be up to 108 bytes long, such as " / var / run / shell.sock" mentioned above.

[0182] It should be noted that the socket illustrated in this embodiment is a local socket. Depending on actual needs, a socket suitable for network communication can also be selected. This embodiment does not impose any specific restrictions on this.

[0183] Step S12: Analyze the Bash source code logic through function insertion module 3, find a suitable function insertion position, and insert the corresponding instrumentation function.

[0184] Further, step S12 specifically includes: starting from the main function, performing source code logic analysis; after the main function starts executing, determining whether a command needs to be executed; if no command needs to be executed, entering the parameter expansion execution logic (i.e., entering the run_wordexp function execution logic); if a command needs to be executed, entering the execution logic to determine whether the Bash command contains the "-c" parameter; identifying the first logical node where the main function starts executing and the second logical node for determining whether a command needs to be executed; determining the position between the first logical node and the second logical node as the first insertion position. Figure 3 The first instrumentation function, cw_session_begin(), is inserted into the first insertion position H21.

[0185] Furthermore, if the Bash command does not have the "-c" parameter, it directly enters the command loop reading function (reader_loop function) execution logic; if the Bash command has the "-c" parameter, it enters the process of determining whether the Bash command has the command string required for the "-c" parameter; if the Bash command does not have the command string required for the "-c" parameter, it also enters the command loop reading function (reader_loop function) execution logic.

[0186] Regardless of the situation, after entering the command loop reading function (reader_loop function), the reader_loop function continuously reads and parses the user's input commands. During the execution of the reader_loop function, it checks whether the EOF flag has been read. If the EOF flag has been read, the exit_shell function is called to exit Bash execution. If the EOF flag has not been read, the read_command function is called to complete the reading and parsing of the user's input commands. The parsing of commands is accomplished by calling the parse_command function, which in turn calls the yyparese function to invoke the parser generated by YACC and returns the parsing status. After parsing the user input command, the command execution function (execute_command function) is called. This function then calls the first built-in command execution function (execute_command_interal function) to execute the parsed command. If the command execution in the execute_command function is complete, the process returns to the command loop reading function (reader_loop function) for execution logic. The fifth logical node that completed the user input command parsing and the sixth logical node that entered the command execution logic are identified. The position between the fifth and sixth logical nodes is determined as the third insertion position. Figure 3 The second instrumentation function, cw_cmd_start(), is inserted into the third insertion position H23. The seventh logical node, where command execution is complete, and the eighth logical node, which returns to the command loop reading function, are identified within the command execution function. The position between the seventh and eighth logical nodes is determined as the fourth insertion position. Figure 3 The value is H24, where the fourth instrumentation function cw_cmd_finish is inserted at the fourth insertion position H24.

[0187] Furthermore, if the Bash command contains the command string required by the "-c" parameter, then the call logic of the first built-in command execution function (execute_command_interal function) is entered. Specifically, if the Bash command contains the command string required by the "-c" parameter, then the execution logic of the run_one_command function is entered. The run_one_command function calls the parse_and_execute function to parse and execute the command, and the parse_and_execute function further calls the execute_command_interal function to execute the command. If the command execution in the execute_command_interal function is completed, then the execution logic of the execute_command function is returned. The third logical node that identifies whether the Bash command contains the command string required by the "-c" parameter and the fourth logical node that enters the call logic of the first built-in command execution function (execute_command_interal function) are further defined as the logical node that enters the execution logic of the run_one_command function. The position between the third and fourth logical nodes is determined as the second insertion position. Figure 3 The second instrumentation function, cw_cmd_start(), is inserted at the second insertion position H22.

[0188] Furthermore, regardless of the above, after the first built-in command execution function (execute_command_interal function) executes its logic, the execute_command_interal function first determines whether the command to be executed is a simple command; if the command to be executed is not a simple command, then different execution functions are called according to the command type, and the command execution function (execute_command function) is called again; if the command to be executed is a simple command... If the command is executed, the execution logic of the simple command execution function (execute_simple_command function) is entered. It determines whether the command to be executed is an external command or a built-in command in the disk executable file. If the command is built-in, the second built-in command execution function (execute_builtin function) is called. After the execution logic of the second built-in command execution function (execute_builtin function) is completed, the first built-in command execution function (execute_command_interal function) is called through the parse_and_execute function. If the command to be executed is an external command in the disk executable file, the disk file execution function (execute_disk_command) is called, and the first built-in command execution function (execute_command_interal function) is called again. The ninth logical node that called the second built-in command execution function (execute_builtin function) is identified. The ninth logical node is determined as the fifth insertion position. Figure 3 The third instrumentation function, cw_command_start(), is inserted into the fifth insertion position H25; the tenth logical node that calls the disk file execution function (execute_disk_command) is identified; the tenth logical node is determined as the sixth insertion position. Figure 3 The third instrumentation function, cw_command_start(), is inserted into the sixth insertion position H26, as shown in the diagram.

[0189] Step S13: Start the Bash command through the information acquisition module 4, and use each instrumentation function to obtain the Bash execution information of each node in real time.

[0190] As described above, the user initiates Bash commands according to actual needs. The first instrumentation function, cw_session_begin(), inserted at the first insertion position H21, is used to obtain information when Bash initialization is complete; the second instrumentation function, cw_cmd_start(), inserted at the second insertion position H22, is used to obtain information before Bash executes a command with the "-c" parameter and the command string required by the "-c" parameter; the second instrumentation function, cw_cmd_start(), inserted at the third insertion position H23, obtains information before most interactive Bash commands; the fourth instrumentation function, cw_cmd_finish(), inserted at the fourth insertion position H24, obtains information after Bash command execution is complete; the third instrumentation function, cw_command_start(), inserted at the fifth insertion position H25, obtains information before Bash executes built-in commands; and the third instrumentation function, cw_command_start(), inserted at the sixth insertion position H26, obtains information before Bash executes disk files.

[0191] Step S14: Assemble the Bash execution information through the information transmission module 5 and send it to the socket, waiting for the external program to obtain it.

[0192] Furthermore, the information transmission module 5 assembles the acquired information into a format suitable for transmission, such as a JSON pair, and sends it to the local socket CW_SOCKET_NAME, awaiting retrieval by an external program. For example, the assembled information might be:

[0193] {

[0194] "event": "CMD_START",

[0195] "session_id": "abcde-hijkl-opqrs-uvwxy",

[0196] "seq": 0,

[0197] "time": 123,

[0198] "cmdline": "ls -al",

[0199] "cwd": " / home / root",

[0200] "env": {

[0201] "key1": "value2",

[0202] "key2": "value2

[0203] }

[0204] }

[0205] At this point, the user has completed the required command in Bash, and this embodiment of the application has successfully completed the real-time acquisition of the information. Subsequent programs can analyze and provide feedback on the information according to actual needs.

[0206] Compared with existing technologies, this application provides a method for obtaining Bash execution information based on Hook technology. By constructing instrumentation functions and sockets, analyzing the Bash source code logic, finding suitable function insertion points, inserting corresponding instrumentation functions, and using these functions to obtain Bash execution information from each node in real time, which is then sent to the socket for external program retrieval. This invention can obtain detailed information about user (whether normal or malicious) operations on the Bash terminal in real time without the user's awareness, facilitating subsequent auditing of Bash commands and other scenarios, thereby better protecting user security.

[0207] This invention also provides a device for obtaining Bash execution information based on Hook technology. The device includes a processor and a memory; the memory is used to store one or more program instructions; the processor is used to run one or more program instructions to perform the steps of the method for obtaining Bash execution information based on Hook technology as described in any of the preceding embodiments.

[0208] In this embodiment of the invention, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0209] The various methods, steps, and logic diagrams disclosed in the embodiments of this invention can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor reads information from the storage medium and, in conjunction with its hardware, completes the steps of the above methods.

[0210] The storage medium can be memory, such as volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.

[0211] Among them, non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory.

[0212] Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DRRAM).

[0213] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

[0214] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using a combination of hardware and software. When applied as software, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0215] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A method for obtaining Bash execution information based on Hook technology, characterized in that, The method includes: Construct instrumentation functions for obtaining Bash execution information and sockets for receiving Bash execution information; Analyze the Bash source code logic, find suitable function insertion points, and insert the corresponding instrumentation functions. Start the Bash command and use the various instrumentation functions to obtain the Bash command execution information of each node in real time; The method further includes assembling the Bash command execution information and sending it to the socket, waiting for an external program to retrieve it; the method also includes: After the current Bash command execution information is sent to the socket, it is determined whether the Bash session should continue to execute subsequent commands; If the Bash session continues to execute subsequent commands, then the subsequent Bash commands are started, and the execution information of the subsequent Bash commands of each node is obtained in real time using each instrumentation function; then the execution information of the subsequent Bash commands is assembled and sent to the socket. If the Bash session no longer executes subsequent commands, then exit the Bash session.

2. The method for obtaining Bash execution information based on Hook technology as described in claim 1, characterized in that, Construct instrumentation functions for obtaining Bash execution information, including: Define a Bash session sequence to record the command sequence number in the Bash session. The sequence number is incremented by 1 each time it is used, and the initial command sequence number is set to 0. Define the required instrumentation function; The instrumentation functions include: The first instrumentation function is used to obtain initial information when a Bash session starts. The second instrumentation function is used to obtain the first information before the Bash command is executed; The third instrumentation function is used to obtain second information before a Bash command executes a built-in command or a disk file. The fourth instrumentation function is used to obtain third information after the Bash command execution is completed.

3. The method for obtaining Bash execution information based on Hook technology as described in claim 1, characterized in that, Construct a socket for receiving Bash execution information, including: Define the socket name; Defines a socket address of type sockaddr_un for use in local inter-process communication.

4. A method for obtaining Bash execution information based on Hook technology as described in claim 2 or 3, characterized in that, Analyze the Bash source code logic to find suitable function insertion points and insert the corresponding instrumentation functions, including: The source code logic analysis begins with the main function. After the main function starts executing, it is determined whether a command needs to be executed. If no command needs to be executed, the logic for extending the parameters is entered; if a command needs to be executed, the logic for determining whether the Bash command contains the "-c" parameter is entered. Identify the first logical node where the main function begins execution and the second logical node to determine whether a command needs to be executed; A first insertion position is determined between the first logical node and the second logical node, and a first instrumentation function is inserted into the first insertion position. If the Bash command does not have the "-c" parameter, it will directly enter the command loop to read the function execution logic; After entering the command loop reading function execution logic, it checks whether the EOF flag has been read; if the EOF flag has been read, it exits Bash execution; if the EOF flag has not been read, it completes the reading and parsing of the user input command. After parsing the user input command, the command execution function is called; The first built-in command execution function is called through the command execution function to execute the parsed command; If the command execution function completes, then return to the command loop reading function execution logic; Identify the fifth logical node that completes the parsing of the user input command and the sixth logical node that enters the command execution logic; A third insertion position is determined between the fifth logical node and the sixth logical node, and the second instrumentation function is inserted into the third insertion position. Identify the seventh logical node in the command execution function where command execution is complete and the eighth logical node where the logic for returning to the command loop reading function is executed; The fourth insertion position is determined between the seventh logical node and the eighth logical node, and the fourth instrumentation function is inserted into the fourth insertion position.

5. The method for obtaining Bash execution information based on Hook technology as described in claim 4, characterized in that, Analyzing the Bash source code logic to find suitable function insertion points and inserting the corresponding instrumentation functions also includes: If the Bash command contains the "-c" parameter, then proceed to the command string required to determine whether the Bash command contains the "-c" parameter. If the command string required by the "-c" parameter is not present in the Bash execution command, the command loop will be entered to read the function execution logic. After entering the command loop reading function execution logic, it checks whether the EOF flag has been read; if the EOF flag has been read, it exits Bash execution; if the EOF flag has not been read, it completes the reading and parsing of the user input command. After parsing the user input command, the command execution function is called; The first built-in command execution function is called through the command execution function to execute the parsed command; If the command execution function completes, then return to the command loop reading function execution logic; Identify the fifth logical node that completes the parsing of the user input command and the sixth logical node that enters the command execution logic; A third insertion position is determined between the fifth logical node and the sixth logical node, and the second instrumentation function is inserted into the third insertion position. Identify the seventh logical node in the command execution function where command execution is complete and the eighth logical node where the logic for returning to the command loop reading function is executed; The fourth insertion position is determined between the seventh logical node and the eighth logical node, and the fourth instrumentation function is inserted into the fourth insertion position.

6. The method for obtaining Bash execution information based on Hook technology as described in claim 5, characterized in that, Analyzing the Bash source code logic to find suitable function insertion points and inserting the corresponding instrumentation functions also includes: If the Bash execution command contains the command string required by the "-c" parameter, then the first built-in command execution function call and execution logic will be entered; The third logical node identifies the command string required to determine whether the Bash execution command contains the "-c" parameter, and the fourth logical node enters the first built-in command execution function call logic; A second insertion position is determined between the third logical node and the fourth logical node, and the second instrumentation function is inserted into the second insertion position.

7. The method for obtaining Bash execution information based on Hook technology as described in claim 6, characterized in that, Analyzing the Bash source code logic to find suitable function insertion points and inserting the corresponding instrumentation functions also includes: After the first built-in command execution function call logic is executed, it is determined whether the command to be executed is a simple command. If the command to be executed is not a simple command, then different execution functions are called according to the type of the command, and the command execution function is called again. If the command to be executed is a simple command, then the execution logic of the simple command execution function is entered to determine whether the command to be executed is a disk executable file or a built-in command; If the command to be executed is a built-in command, then the second built-in command execution function is called, and after the execution logic of the second built-in command execution function is completed, the first built-in command execution function is called. If the command to be executed is a disk executable file, then the disk file execution function is called, and the first built-in command execution function is called again; Identify the ninth logical node that calls the second built-in command execution function; The ninth logical node is determined as the fifth insertion position, and the third instrumentation function is inserted into the fifth insertion position; Identify the tenth logical node that calls the function to execute the disk file; The tenth logical node is determined as the sixth insertion position, and the third instrumentation function is inserted into the sixth insertion position.

8. A device for obtaining Bash execution information based on Hook technology, characterized in that, The device includes: An instrumentation function construction module is used to construct instrumentation functions, which are used to obtain Bash execution information; A socket construction module is used to construct sockets, which are used to receive Bash execution information; The function insertion module is used to analyze the Bash source code logic, find suitable function insertion positions, and insert the corresponding instrumentation functions. The information acquisition module is used to initiate Bash commands and, using various instrumentation functions, to obtain Bash command execution information from each node in real time. The information transmission module is used to assemble the Bash command execution information and send it to the socket, waiting for an external program to retrieve it; Also includes: After the current Bash command execution information is sent to the socket, it is determined whether the Bash session should continue to execute subsequent commands; If the Bash session continues to execute subsequent commands, then the subsequent Bash commands are started, and the execution information of the subsequent Bash commands of each node is obtained in real time using each instrumentation function; then the execution information of the subsequent Bash commands is assembled and sent to the socket. If the Bash session no longer executes subsequent commands, then exit the Bash session.

9. A device for obtaining Bash execution information based on Hook technology, characterized in that, The device includes: a processor and a memory; The memory is used to store one or more program instructions; The processor is configured to run one or more program instructions to perform the steps of a method for obtaining Bash execution information based on Hook technology as described in any one of claims 1 to 7.

Images