Method, device and equipment for identifying running of a reverse shell by means of a dirty cow vulnerability and medium

Abstract

This application discloses a method, apparatus, device, and medium for identifying reverse shells using the Dirty Cow vulnerability, relating to the field of network security technology. The method includes: after the target host starts, reading the first kernel memory data of the current target host, and determining whether the current target host is running a reverse shell through the eBPF program in the target host's operating system kernel and a user-space custom eBPF application; if the current target host is running a reverse shell, extracting the target address of the first reverse shell from the eBPF event, and reading the second kernel memory data of the current target host; if the kernel memory data is inconsistent, determining that the current kernel memory data has been tampered with, extracting the target address of the second reverse shell in the target host's underlying dynamic library, and generating a first abnormal behavior event after determining that the target address is consistent, and feeding the first abnormal behavior event back to the target front end.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, and medium for identifying reverse shells that exploit the Dirty Cow vulnerability. Background Technology

[0002] DirtyCow is a serious Linux kernel security vulnerability that exploits a flaw in the copy-on-write mechanism of the Linux kernel's memory subsystem. It allows malicious modification of critical system files or process memory to escalate privileges or execute malicious code. One vulnerability involves using DirtyCow to modify the vDSO (a special dynamic shared library residing in kernel space) to inject reverse shell (a type of script) code, causing the host process to exhibit abnormal reverse shell behavior. While reverse shell execution can often be identified through eBPF event analysis, determining whether the vDSO modification was caused by DirtyCow requires manual verification, which is inefficient.

[0003] In conclusion, optimizing the identification method for exploiting the Dirty Cow vulnerability to run reverse shells in order to improve identification efficiency is a pressing technical problem that needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for identifying reverse shells using the Dirty Cow vulnerability, which can optimize the identification method to improve identification efficiency. The specific solution is as follows:

[0005] Firstly, this application provides a method for identifying reverse shells exploiting the Dirty Cow vulnerability, including:

[0006] After the target host starts up, the first kernel memory data of the target host is read, and the eBPF events captured by the eBPF program in the operating system kernel of the target host and the user-space custom eBPF application are used to determine whether the target host is running a reverse shell, so as to obtain the corresponding judgment result.

[0007] If the judgment result indicates that the target host is running a reverse shell, then the target address of the first reverse shell that was invoked is extracted from the eBPF event, and the second kernel memory data of the target host is read.

[0008] If the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current kernel memory data has been tampered with. The second reverse shell target address in the underlying dynamic library of the target host is extracted. After determining that the second reverse shell target address is consistent with the first reverse shell target address, a first abnormal behavior event is generated and the first abnormal behavior event is fed back to the target front end. The first abnormal behavior event is an abnormal behavior event of running a reverse shell through a first running mode. The first running mode is a way in which a malicious program uses the Dirty Cow vulnerability to tamper with the kernel memory data in order to run a reverse shell.

[0009] Optionally, the step of determining whether the target host is currently running a reverse shell by using eBPF events captured by the eBPF program in the target host's operating system kernel and the user-space custom eBPF application to obtain the corresponding determination result includes:

[0010] Load the eBPF program in the operating system kernel of the target host, and call the custom eBPF application located in user space through the eBPF program to run the custom eBPF application;

[0011] The eBPF events captured by the eBPF program and the custom eBPF application are used to determine whether the target host is running a reverse shell, so as to obtain the corresponding judgment result.

[0012] Optionally, the step of using the eBPF events captured by the eBPF program and the custom eBPF application to determine whether the target host is currently running a reverse shell, in order to obtain the corresponding determination result, includes:

[0013] The eBPF program captures the eBPF events of the target host, and the custom eBPF application aggregates the eBPF events captured by the eBPF program.

[0014] Determine the system call information of the target host based on the eBPF event;

[0015] The system call information is matched and detected based on context analysis methods and preset rule features to obtain corresponding detection results;

[0016] If the detection result indicates that the system call information conforms to the preset rule characteristics, then the judgment result is obtained that the target host is currently running a reverse shell.

[0017] Optionally, after extracting the target address of the invoked first reverse shell from the eBPF event and reading the second kernel memory data of the current target host, the method further includes:

[0018] If the second kernel memory data is consistent with the first kernel memory data, it is determined that the current kernel memory data has not been tampered with, a second abnormal behavior event is generated, and the second abnormal behavior event is fed back to the target front end; the second abnormal behavior event is an abnormal behavior event of running a reverse shell through a second running mode, and the second running mode is the method of running a reverse shell without tampering with the kernel memory data.

[0019] Optionally, after determining that the current kernel memory data has been tampered with if the second kernel memory data is inconsistent with the first kernel memory data, and extracting the second reverse shell target address from the underlying dynamic library of the target host, the method further includes:

[0020] If the second kernel memory data is inconsistent with the first kernel memory data, and the second reverse shell target address is inconsistent with the first reverse shell target address, or if the second reverse shell target address cannot be extracted from the underlying dynamic library, then a third abnormal behavior event is generated and the third abnormal behavior event is fed back to the target front end; the third abnormal behavior event is an abnormal behavior event of running a reverse shell through a third running mode; the third running mode is the method of running a reverse shell by tampering with kernel memory data through sensitive files, and the sensitive files are files whose sensitivity level meets the preset sensitivity level conditions.

[0021] Optionally, extracting the second reverse shell target address from the underlying dynamic library of the target host includes:

[0022] The second kernel memory data is disassembled and analyzed to locate malicious code within it. A preset address extraction technique is then used to scan the malicious code to identify target data related to network connectivity within it. The second kernel memory data is located in the underlying dynamic library of the target host.

[0023] Extract and verify the address and port with the latest call time from the target data, so that after the verification is successful, the address is used as the second reverse shell target address in the underlying dynamic library of the target host.

[0024] Optionally, the method for identifying reverse shells exploiting the Dirty Cow vulnerability further includes:

[0025] Identify the abnormal behavior events to be displayed on the target front end;

[0026] If the abnormal behavior event to be displayed is a second abnormal behavior event, then the second abnormal behavior event will be displayed on the target front end in a first preset color, and will be flashed on the target front end at a preset flashing frequency, and the second abnormal behavior event will be recorded in the audit log.

[0027] If the abnormal behavior event to be displayed is a third abnormal behavior event, then the third abnormal behavior event will be displayed on the target front end in a second preset color, and an alarm will be sent via email.

[0028] If the abnormal behavior event to be displayed is the first abnormal behavior event, then the first abnormal behavior event will be displayed on the target front end in a third preset color, and an alarm will be issued via SMS or voice.

[0029] The second abnormal behavior event is an abnormal behavior event of running a reverse shell through a second running mode, which is a way of running a reverse shell without tampering with kernel memory data; the third abnormal behavior event is an abnormal behavior event of running a reverse shell through a third running mode, which is a way of running a reverse shell by tampering with kernel memory data through a sensitive file; the sensitive file is a file whose sensitivity level meets the preset sensitivity level conditions; the first preset color, the second preset color, and the third preset color are all different from each other.

[0030] Secondly, this application provides a device for identifying reverse shells exploiting the Dirty Cow vulnerability, comprising:

[0031] The condition judgment module is used to read the first kernel memory data of the target host after the target host starts up, and to determine whether the target host is running a reverse shell by using the eBPF events captured by the eBPF program in the operating system kernel of the target host and the user-space custom eBPF application, so as to obtain the corresponding judgment result.

[0032] The data reading module is used to extract the target address of the first reverse shell from the eBPF event and read the second kernel memory data of the target host if the judgment result indicates that the target host is running a reverse shell.

[0033] The event feedback module is used to determine that the current kernel memory data has been tampered with if the second kernel memory data is inconsistent with the first kernel memory data, extract the second reverse shell target address from the underlying dynamic library of the target host, generate a first abnormal behavior event after determining that the second reverse shell target address is consistent with the first reverse shell target address, and feed the first abnormal behavior event back to the target front end; the first abnormal behavior event is an abnormal behavior event of running a reverse shell through a first running mode, the first running mode being a way in which a malicious program uses the Dirty Cow vulnerability to tamper with the kernel memory data in order to run a reverse shell.

[0034] Thirdly, this application provides an electronic device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor is used to execute the computer program to implement the aforementioned method for identifying reverse shells exploiting the Dirty Cow vulnerability.

[0037] Fourthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for identifying reverse shells exploiting the Dirty Cow vulnerability.

[0038] In this application, after the target host starts up, the first kernel memory data of the target host is read, and the eBPF events captured by the eBPF program in the operating system kernel of the target host and the user-space custom eBPF application are used to determine whether the target host is running a reverse shell, so as to obtain the corresponding judgment result; if the judgment result indicates that the target host is running a reverse shell, the target address of the first reverse shell that is called is extracted from the eBPF event, and the second kernel memory data of the target host is read; if the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current kernel memory data has been tampered with, the target address of the second reverse shell in the underlying dynamic library of the target host is extracted, and after determining that the second reverse shell target address is consistent with the first reverse shell target address, a first abnormal behavior event is generated, and the first abnormal behavior event is fed back to the target front end; the first abnormal behavior event is an abnormal behavior event of running a reverse shell through a first running mode, which is a way in which a malicious program uses the Dirty Cow vulnerability to tamper with the kernel memory data to run a reverse shell. As can be seen from the above, after the target host boots up, this application first reads its first kernel memory data. It then uses eBPF events captured by the eBPF program in the operating system kernel and compares them with a user-space custom eBPF application to determine if the target host is running a reverse shell. If it is determined to be running, it extracts the first reverse shell target address and reads the second kernel memory data. When the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current kernel memory data has been tampered with. The second reverse shell target address is then extracted from the underlying dynamic library. If the two addresses match, a first abnormal behavior event is generated indicating that the malicious program is using the Dirty Cow vulnerability to run a reverse shell, and this event is fed back to the target front-end. In this way, through the above process of this application, using eBPF technology, combined with kernel memory data comparison and target address matching, the abnormal behavior of malicious programs using the Dirty Cow vulnerability to run a reverse shell can be effectively detected, potential security threats can be discovered in a timely manner, and by feeding back the abnormal behavior event to the front-end, security personnel can take timely countermeasures, improving the security and protection capabilities of the target host, and thus optimizing the identification method for running a reverse shell using the Dirty Cow vulnerability to improve identification efficiency. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0040] Figure 1 This application discloses a flowchart of a method for identifying reverse shells exploiting the Dirty Cow vulnerability.

[0041] Figure 2 This is a schematic diagram illustrating the module interaction of a method for identifying reverse shells exploiting the Dirty Cow vulnerability disclosed in this application.

[0042] Figure 3 This is a flowchart illustrating the timing of a method for identifying reverse shells exploiting the Dirty Cow vulnerability disclosed in this application.

[0043] Figure 4 This is a schematic diagram of the system architecture for identifying a method for running a reverse shell using the Dirty Cow vulnerability disclosed in this application;

[0044] Figure 5 This is a schematic diagram of the structure of an identification device that uses the Dirty Cow vulnerability to run a reverse shell, as disclosed in this application.

[0045] Figure 6 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] DirtyCow is a serious Linux kernel security vulnerability that exploits a flaw in the copy-on-write mechanism of the Linux kernel's memory subsystem. It maliciously modifies critical system files or process memory to elevate privileges or execute malicious code. One vulnerability involves using the DirtyCow vulnerability to tamper with the vDSO (Virtual Dedicated Store) to implant reverse shell code, causing abnormal behavior of the reverse shell within the host process. While reverse shell execution can often be identified through eBPF event analysis, determining whether the reverse shell execution was caused by the DirtyCow vulnerability's vDSO tampering requires manual identification, which is inefficient.

[0048] To overcome the aforementioned technical problems, this application provides a method for identifying reverse shells exploiting the Dirty Cow vulnerability, thereby optimizing the identification method and improving identification efficiency.

[0049] See Figure 1As shown in the figure, this invention discloses a method for identifying reverse shells that exploit the Dirty Cow vulnerability, including:

[0050] Step S11: After the target host starts up, read the first kernel memory data of the target host, and determine whether the target host is running a reverse shell by using the eBPF events captured by the eBPF program in the operating system kernel of the target host and the user-space custom eBPF application, so as to obtain the corresponding judgment result.

[0051] In this embodiment, after the target host starts up, the first kernel memory data of the target host is read. Then, the eBPF events captured by the eBPF program in the target host's operating system kernel, and the user-space custom eBPF application are used to determine whether the target host is running a reverse shell, so as to obtain the corresponding judgment result. The kernel memory data can be vDSO (Linux Virtual Dynamic Shared Object) memory data; the eBPF program is a powerful kernel technology that provides efficient, flexible, and secure solutions for system monitoring, performance optimization, and security auditing, and is responsible for capturing Linux system events, including but not limited to system calls, file access, and network activity events; the custom eBPF application is used to collect and cache eBPF events, and perform some simple organization and analysis operations on the collected eBPF events.

[0052] It is important to note that the DirtyCow vulnerability is a serious Linux kernel security vulnerability that exploits a flaw in the copy-on-write mechanism of the Linux kernel memory subsystem to maliciously modify critical system files or process memory, thereby elevating privileges or executing malicious code. In Linux systems, vDSO, as a special shared library residing in kernel space, is mapped in read-only mode to the address space of each user-space process, providing commonly used interface functions for efficient interaction with the kernel, such as clock_gettime (a time function). Some malicious programs can exploit the DirtyCow vulnerability to tamper with vDS0 within containers or on the host machine, embedding reverse shell code into vDSO. When a program on the host machine calls the interfaces in vDSO normally, the reverse shell is triggered, enabling remote control of the host. Currently, while reverse shell execution can be analyzed through eBPF events, it's impossible to determine whether it was caused by the DirtyCow vulnerability tampering with vDSO; manual analysis is required, resulting in low identification efficiency. To address these issues, this application proposes a method for identifying reverse shells using the DirtyCow vulnerability, such as... Figure 2 The diagram shown is an interactive illustration of a module for identifying a reverse shell exploiting the Dirty Cow vulnerability, as provided in this application. Figure 3 The diagram illustrates a flowchart of a method for identifying reverse shells exploiting the DirtyCow vulnerability, as provided in this application. This application combines the eBPF program in the target host's operating system kernel, a user-space custom eBPF application, an abnormal behavior analysis module, and an abnormal behavior display and alerting module. By analyzing and summarizing several key characteristic phenomena that appear sequentially, it accurately identifies the abnormal behavior of malicious programs exploiting the DirtyCow vulnerability to run a reverse shell, improving identification efficiency and accuracy. Figure 4 The diagram shows a system architecture schematic for identifying a reverse shell exploiting the Dirty Cow vulnerability, as provided in this application. The abnormal behavior display and alert module displays abnormal behavior on a page in real time and issues alerts based on the level of the abnormal behavior. The abnormal behavior analysis module contextualizes various abnormal behaviors, summarizes eBPF events reported by the eBPF application and various status information in the host, and analyzes the abnormal behavior based on rule characteristics. eBPF refers to the eBPF program; user space refers to the user mode; and kernel space refers to the operating system kernel.

[0053] It should be noted that the process for determining whether the target host is currently running a reverse shell is as follows: The eBPF program in the target host's operating system kernel is loaded, and a custom eBPF application located in user space is called through the eBPF program to run the custom eBPF application; the eBPF events captured by the eBPF program and the custom eBPF application are used to determine whether the target host is currently running a reverse shell, and a corresponding determination result is obtained. That is, first, the eBPF program in the target host's operating system kernel is loaded, and a custom eBPF application located in user space is called through the eBPF program to run the custom eBPF application; simultaneously, the abnormal behavior display and alarm module is initialized; the eBPF events captured by the eBPF program and the custom eBPF application are used to determine whether the target host is currently running a reverse shell, and a corresponding determination result is obtained. It should be further noted that the processing flow for obtaining the judgment result is as follows: The eBPF program captures the eBPF events of the target host, and the custom eBPF application aggregates the eBPF events captured by the eBPF program; the system call information of the target host is determined based on the eBPF events; the system call information is matched and detected based on context analysis methods and preset rule features to obtain corresponding detection results; if the detection results indicate that the system call information conforms to the preset rule features, then the judgment result that the target host is currently running a reverse shell is obtained. The eBPF events include, but are not limited to, system call events, file descriptor read / write events, etc. That is, the eBPF program captures the eBPF events of the target host and sends the captured eBPF events to the custom eBPF application. The custom eBPF application then aggregates the eBPF events and reports them to the abnormal behavior analysis module. The abnormal behavior analysis module determines the system call information of the target host based on the eBPF events and performs matching and detection on the system call information based on context analysis methods and preset rule features to obtain corresponding detection results. If the detection results indicate that the system call information matches the preset rule features, it indicates that the target host is exhibiting abnormal behavior of running a reverse shell, thus obtaining the judgment result that the target host is running a reverse shell.In this way, this embodiment uses eBPF technology to capture system events and analyze abnormal behavior that runs a reverse shell, so as to further determine the cause of the reverse shell. At the same time, it simplifies the functions of eBPF, and delegates more complex event analysis operations to the abnormal behavior analysis module. This achieves precise layering and efficient collaboration of functions, allowing eBPF applications to focus on core functions, reducing their own complexity, alleviating the runtime burden of eBPF applications, and improving the efficiency and stability of data collection and basic processing.

[0054] Step S12: If the judgment result indicates that the target host is running a reverse shell, then extract the target address of the first reverse shell that was called from the eBPF event, and read the second kernel memory data of the target host.

[0055] In this embodiment, if the obtained judgment result indicates that the target host is running a reverse shell, it is necessary to further determine the reason for the reverse shell running, extract the target address of the first reverse shell that was called from the eBPF event, and at the same time, in order to determine whether the kernel memory data has been tampered with, it is also necessary to read the second kernel memory data of the target host.

[0056] It should be noted that after reading the second kernel memory data, it is necessary to compare the second kernel memory data with the first kernel memory data read when the host first boots up to determine whether it has been tampered with. If the comparison result indicates that the kernel memory data has not been tampered with, the processing flow is as follows: If the second kernel memory data is consistent with the first kernel memory data, it is determined that the current kernel memory data has not been tampered with, a second abnormal behavior event is generated, and the second abnormal behavior event is fed back to the target front end; the second abnormal behavior event is an abnormal behavior event of running a reverse shell through a second running mode, which is the method of running a reverse shell without tampering with the kernel memory data. That is, if the content of the second kernel memory data is consistent with the first kernel memory data, it is determined that the current kernel memory data has not been tampered with, and the reason for the current reverse shell running is not a malicious program exploiting the Dirty Cow vulnerability. Therefore, a second abnormal behavior event representing a normal reverse shell abnormal behavior event is generated, and the second abnormal behavior event is fed back to the target front end. Here, "normal" refers to the method of running a reverse shell without tampering with the kernel memory data. In this way, after discovering that the target host is running a reverse shell, this embodiment extracts the first reverse shell target address at the system call level based on the eBPF event, so as to further investigate the reason for the reverse shell running based on the target address. At the same time, after confirming that the kernel memory data has not been tampered with, the second abnormal behavior event is directly generated without further analysis, thus eliminating the possibility that malicious programs are using the Dirty Cow vulnerability to run a reverse shell, reducing unnecessary analysis processes and improving identification efficiency.

[0057] Step S13: If the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current memory kernel data has been tampered with. The second reverse shell target address in the underlying dynamic library of the target host is extracted. After determining that the second reverse shell target address is consistent with the first reverse shell target address, a first abnormal behavior event is generated, and the first abnormal behavior event is fed back to the target front end. The first abnormal behavior event is an abnormal behavior event of running a reverse shell through a first running mode. The first running mode is the way in which a malicious program uses the Dirty Cow vulnerability to tamper with the memory kernel data in order to run a reverse shell.

[0058] In this embodiment, if the comparison reveals that the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current kernel memory data has been tampered with, and there is a possibility that a malicious program is using the Dirty Cow vulnerability to run a reverse shell. Therefore, the target address of the second reverse shell is extracted from the underlying dynamic library of the target host, and the second reverse shell target address is compared with the first reverse shell target address. If the comparison determines that they are consistent, it is determined that a reverse shell is being run by a malicious program using the Dirty Cow vulnerability. A first abnormal behavior event is generated, and the first abnormal behavior event is fed back to the target front-end. The first abnormal behavior event is an abnormal behavior event of running a reverse shell through a first running mode, whereby the malicious program uses the Dirty Cow vulnerability to tamper with the kernel memory data to run a reverse shell. The target front-end is the abnormal behavior display and alarm module.

[0059] It should be noted that the processing flow after extracting the second reverse shell target address can also be as follows: If the second kernel memory data is inconsistent with the first kernel memory data, and the second reverse shell target address is inconsistent with the first reverse shell target address, or if the second reverse shell target address cannot be extracted from the underlying dynamic library, then a third abnormal behavior event is generated, and the third abnormal behavior event is fed back to the target front end; the third abnormal behavior event is an abnormal behavior event of running a reverse shell through a third running mode; the third running mode is the method of running a reverse shell by modifying kernel memory data through a sensitive file, and the sensitive file is a file whose sensitivity level meets the preset sensitivity level conditions. That is, if the second reverse shell target address cannot be extracted from the underlying dynamic library, that is, if a valid target address cannot be analyzed, or if the extracted second reverse shell target address is inconsistent with the first reverse shell target address and the kernel memory data is modified, then it indicates that the current reverse shell running reason is ordinary sensitive file modification of kernel memory data, generating the corresponding third abnormal behavior event, and feeding back the third abnormal behavior event to the target front end.

[0060] It should be further noted that the process for extracting the second reverse shell target address is as follows: The second kernel memory data is disassembled and analyzed to locate malicious code within it. A preset address extraction technique is then used to scan the malicious code to determine target data related to network connections within it. The second kernel memory data is located in the underlying dynamic library of the target host. The address and port with the latest call time in the target data are extracted and verified. After successful verification, this address is used as the second reverse shell target address in the underlying dynamic library of the target host. In other words, by disassembling and analyzing the second kernel memory data located in the underlying dynamic library of the target host, malicious code within it is located. A preset address extraction technique is then used to scan the malicious code to determine target data related to network connections within it. Simultaneously, the address and port with the latest call time in the target data are extracted, and to ensure their validity, they are verified. After successful verification, this address is used as the second reverse shell target address in the underlying dynamic library of the target host.

[0061] It should be noted that in this embodiment, all abnormal behavior events generated are fed back to the target front-end. Upon receiving an abnormal behavior event, the target front-end can display it according to its level. The processing flow is as follows: Determine the abnormal behavior event to be displayed on the target front-end; if the abnormal behavior event to be displayed is a second abnormal behavior event, then display the second abnormal behavior event on the target front-end in a first preset color and flash it at a preset flashing frequency, and record the second abnormal behavior event in the audit log; if the abnormal behavior event to be displayed is a third abnormal behavior event, then display the third abnormal behavior event on the target front-end in a second preset color and send an alert via email; if the abnormal behavior event to be displayed... If the event is the first abnormal behavior event, then the first abnormal behavior event will be displayed on the target front end in a third preset color, and an alarm will be issued via SMS or voice. The second abnormal behavior event is an abnormal behavior event that runs a reverse shell through a second running mode, where the second running mode is a method of running a reverse shell without tampering with kernel memory data. The third abnormal behavior event is an abnormal behavior event that runs a reverse shell through a third running mode, where the third running mode is a method of running a reverse shell by tampering with kernel memory data through a sensitive file. The sensitive file is a file whose sensitivity level meets a preset sensitivity level condition. The first preset color, the second preset color, and the third preset color are all different from each other. In other words, the target front-end can first determine the type of the abnormal behavior event to be displayed. If the abnormal behavior event to be displayed is the second abnormal behavior event, it means that the harm of the abnormal behavior event to be displayed is small, and the level is the lowest. It can be displayed on the target front-end in a first preset color, such as yellow, and flashed on the target front-end at a preset flashing frequency. The second abnormal behavior event is also recorded in the audit log for auditors to audit. If it is the third abnormal behavior event, it means that the harm of the abnormal behavior event to be displayed is moderate, and the level is intermediate. It can be displayed on the target front-end in a second preset color, such as orange, and an alarm can be sent via email to notify relevant personnel for handling. If it is the first abnormal behavior event, it means that the harm of the abnormal behavior event to be displayed is large, and the level is the highest. It can be displayed on the target front-end in a third preset color, such as red, and an alarm can be sent via SMS or voice to promptly notify relevant personnel so that they can take preventive measures against the attack as quickly as possible to avoid further losses, thereby improving the overall event handling efficiency and security protection level and ensuring network security.In this way, after comparing kernel memory data, this embodiment also compares the target address of the reverse shell at the system call level and the underlying kernel level to further confirm the reason for the current reverse shell's operation, thus improving the accuracy of abnormal behavior event identification. After extracting the address and port from the malicious code, it verifies them to ensure their effectiveness, thereby improving the ability to identify abnormal behavior of hosts or containers. On the target front end, corresponding warnings are displayed based on the severity level of the abnormal behavior event, so that relevant personnel can take appropriate preventive measures, improving the overall event handling efficiency and security protection level, ensuring network security, and providing strong support for hardening host or container security.

[0062] As can be seen from the above, in this embodiment, after the target host starts up, it first reads its first kernel memory data. Using eBPF events captured by the eBPF program in the operating system kernel, it compares the results with those from a user-space custom eBPF application to determine if the target host is running a reverse shell. If it is determined to be running, it extracts the first reverse shell target address and reads the second kernel memory data. When the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current kernel memory data has been tampered with. The second reverse shell target address is then extracted from the underlying dynamic library. If the two addresses are consistent, a first abnormal behavior event is generated, whereby the malicious program uses the Dirty Cow vulnerability to run a reverse shell, and this event is fed back to the target front-end. In this way, through the above process of this embodiment, on the one hand, eBPF technology is used to capture system events and analyze the abnormal behavior of running a reverse shell, so as to further determine the reason for running the reverse shell. On the other hand, it simplifies the function of eBPF, delegating more complex event analysis operations to the abnormal behavior analysis module. This achieves precise functional layering and efficient collaboration, allowing the eBPF application to focus on its core functions, reducing its own complexity, and alleviating the burden on eBPF. This reduces the application's runtime burden, improving the efficiency and stability of data collection and basic processing. Firstly, after discovering a reverse shell running on the target host, the first reverse shell target address at the system call level is extracted based on eBPF events. This allows for further investigation into the cause of the reverse shell's operation based on the target address. Simultaneously, after confirming that the kernel memory data has not been tampered with, a second abnormal behavior event is directly generated, eliminating the possibility of malicious programs exploiting the Dirty Cow vulnerability to run a reverse shell without further analysis. This reduces unnecessary analysis processes and improves identification efficiency. Secondly, after comparing kernel memory data, the reverse shell target address is compared at the system call level and the underlying kernel level to further confirm the cause of the current reverse shell's operation, improving the accuracy of abnormal behavior event identification. Thirdly, after extracting the address and port from the malicious code, it is verified to ensure validity, improving the ability to identify abnormal behavior in hosts or containers. Fourthly, corresponding alerts are displayed on the target front-end based on the severity level of the abnormal behavior event, enabling relevant personnel to take appropriate preventative measures. This improves overall event handling efficiency and security protection levels, ensuring network security and providing strong support for hardening host or container security. Furthermore, this optimizes the identification method for reverse shells exploiting the Dirty Cow vulnerability to improve identification efficiency.

[0063] Accordingly, see Figure 5 As shown in the illustration, this application also provides a device for identifying reverse shells exploiting the Dirty Cow vulnerability, comprising:

[0064] The condition judgment module 11 is used to read the first kernel memory data of the target host after the target host starts up, and to determine whether the target host is running a reverse shell by using the eBPF events captured by the eBPF program in the operating system kernel of the target host and the user-space custom eBPF application, so as to obtain the corresponding judgment result.

[0065] The data reading module 12 is used to extract the target address of the first reverse shell that was called from the eBPF event and read the second kernel memory data of the target host if the judgment result indicates that the target host is currently running a reverse shell.

[0066] The event feedback module 13 is used to determine that the current kernel memory data has been tampered with if the second kernel memory data is inconsistent with the first kernel memory data, extract the second reverse shell target address in the underlying dynamic library of the target host, generate a first abnormal behavior event after determining that the second reverse shell target address is consistent with the first reverse shell target address, and feed the first abnormal behavior event back to the target front end; the first abnormal behavior event is an abnormal behavior event of running a reverse shell through a first running mode, the first running mode is the way in which a malicious program uses the Dirty Cow vulnerability to tamper with the kernel memory data in order to run a reverse shell.

[0067] As can be seen from the above, in this embodiment, after the target host starts up, it first reads its first kernel memory data. Using eBPF events captured by the eBPF program in the operating system kernel, it compares the data with a user-space custom eBPF application to determine if the target host is running a reverse shell. If it is determined to be running, it extracts the first reverse shell target address and reads the second kernel memory data. When the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current kernel memory data has been tampered with. The second reverse shell target address in the underlying dynamic library is then extracted. If the two addresses match, a first abnormal behavior event is generated indicating that a malicious program is using the Dirty Cow vulnerability to run a reverse shell, and this event is fed back to the target front-end. In this way, through the above process of this embodiment, using eBPF technology, combined with kernel memory data comparison and target address matching, the abnormal behavior of a malicious program using the Dirty Cow vulnerability to run a reverse shell can be effectively detected, potential security threats can be discovered in a timely manner, and by feeding back the abnormal behavior event to the front-end, security personnel can take timely countermeasures, improving the security and protection capabilities of the target host, and thus optimizing the identification method for running a reverse shell using the Dirty Cow vulnerability to improve identification efficiency.

[0068] In some specific embodiments, the condition judgment module 11 may specifically include:

[0069] The program invocation unit is used to load the eBPF program in the operating system kernel of the target host, and call the custom eBPF application located in user space through the eBPF program to run the custom eBPF application.

[0070] The condition judgment submodule is used to determine whether the target host is running a reverse shell based on the eBPF events captured by the eBPF program and the custom eBPF application, so as to obtain the corresponding judgment result.

[0071] In some specific implementations, the condition judgment submodule may specifically include:

[0072] An event aggregation unit is used to capture eBPF events of the target host through the eBPF program, and to aggregate the eBPF events captured by the eBPF program through the custom eBPF application.

[0073] Information determination unit, used to determine the system call information of the target host based on the eBPF event;

[0074] The matching and detection unit is used to perform matching and detection on the system call information based on the context analysis method and preset rule features to obtain the corresponding detection results;

[0075] The result determination unit is used to determine whether the target host is currently running a reverse shell if the detection result indicates that the system call information conforms to the preset rule features.

[0076] In some specific embodiments, the identification device for running a reverse shell using the Dirty Cow vulnerability may further include:

[0077] The first event feedback unit is used to determine that the current kernel memory data has not been tampered with if the second kernel memory data is consistent with the first kernel memory data, generate a second abnormal behavior event, and feed the second abnormal behavior event back to the target front end; the second abnormal behavior event is an abnormal behavior event of running a reverse shell through a second running mode, the second running mode being a way of running a reverse shell without tampering with the kernel memory data.

[0078] In some specific embodiments, the identification device for running a reverse shell using the Dirty Cow vulnerability may further include:

[0079] The second event feedback unit is used to generate a third abnormal behavior event and feed the third abnormal behavior event back to the target front end if the second kernel memory data is inconsistent with the first kernel memory data, and the second reverse shell target address is inconsistent with the first reverse shell target address, or if the second reverse shell target address cannot be extracted from the underlying dynamic library; the third abnormal behavior event is an abnormal behavior event of running a reverse shell through a third running mode; the third running mode is to run a reverse shell by tampering with kernel memory data through a sensitive file, and the sensitive file is a file whose sensitivity level meets the preset sensitivity level conditions.

[0080] In some specific embodiments, the event feedback module 13 may specifically include:

[0081] The code scanning unit is used to perform disassembly analysis on the second kernel memory data to locate malicious code in the second kernel memory data, and to scan the malicious code using a preset address extraction technique to determine target data related to network connection in the malicious code; the second kernel memory data is located in the underlying dynamic library of the target host;

[0082] The port verification unit is used to extract and verify the address and port with the latest call time in the target data, so that after the verification is passed, the address is used as the second reverse shell target address in the underlying dynamic library of the target host.

[0083] In some specific embodiments, the identification device for running a reverse shell using the Dirty Cow vulnerability may further include:

[0084] The event determination unit is used to determine the abnormal behavior event to be displayed in the target front end.

[0085] The event recording unit is used to display the second abnormal behavior event in a first preset color on the target front end and flash the second abnormal behavior event on the target front end at a preset flashing frequency if the abnormal behavior event to be displayed is the second abnormal behavior event, and to record the second abnormal behavior event in the audit log.

[0086] The email alarm unit is used to display the third abnormal behavior event in a second preset color on the front end of the target if the abnormal behavior event to be displayed is a third abnormal behavior event, and to send an alarm via email.

[0087] The voice alarm unit is used to display the first abnormal behavior event in a third preset color on the front end of the target if the abnormal behavior event to be displayed is the first abnormal behavior event, and to issue an alarm via SMS or voice.

[0088] The second abnormal behavior event is an abnormal behavior event of running a reverse shell through a second running mode, which is a way of running a reverse shell without tampering with kernel memory data; the third abnormal behavior event is an abnormal behavior event of running a reverse shell through a third running mode, which is a way of running a reverse shell by tampering with kernel memory data through a sensitive file; the sensitive file is a file whose sensitivity level meets the preset sensitivity level conditions; the first preset color, the second preset color, and the third preset color are all different from each other.

[0089] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the identification method for running a reverse shell using the Dirty Cow vulnerability disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a computer.

[0090] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0091] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0092] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the identification method for running a reverse shell using the Dirty Cow vulnerability, which is executed by the electronic device 20 according to any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0093] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for identifying reverse shells exploiting the Dirty Cow vulnerability. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0094] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0095] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0097] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0098] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for identifying reverse shells exploiting the Dirty Cow vulnerability, characterized in that, include: After the target host starts up, the first kernel memory data of the target host is read, and the eBPF events captured by the eBPF program in the operating system kernel of the target host and the user-space custom eBPF application are used to determine whether the target host is running a reverse shell, so as to obtain the corresponding judgment result. If the judgment result indicates that the target host is running a reverse shell, then the target address of the first reverse shell that was invoked is extracted from the eBPF event, and the second kernel memory data of the target host is read. If the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current kernel memory data has been tampered with. The second reverse shell target address in the underlying dynamic library of the target host is extracted. After determining that the second reverse shell target address is consistent with the first reverse shell target address, a first abnormal behavior event is generated and the first abnormal behavior event is fed back to the target front end. The first abnormal behavior event is an abnormal behavior event in which a reverse shell is run through a first running mode. The first running mode is a method in which a malicious program uses the Dirty Cow vulnerability to tamper with kernel data in memory in order to run a reverse shell.

2. The method for identifying reverse shells exploiting the Dirty Cow vulnerability according to claim 1, characterized in that, The method of determining whether the target host is currently running a reverse shell by using eBPF events captured by the eBPF program in the operating system kernel of the target host and user-space custom eBPF applications to obtain the corresponding determination result includes: Load the eBPF program in the operating system kernel of the target host, and call the custom eBPF application located in user space through the eBPF program to run the custom eBPF application; The eBPF events captured by the eBPF program and the custom eBPF application are used to determine whether the target host is running a reverse shell, so as to obtain the corresponding judgment result.

3. The method for identifying reverse shells exploiting the Dirty Cow vulnerability according to claim 2, characterized in that, The process of capturing eBPF events through the eBPF program and determining whether the target host is currently running a reverse shell using the custom eBPF application to obtain the corresponding determination result includes: The eBPF program captures the eBPF events of the target host, and the custom eBPF application aggregates the eBPF events captured by the eBPF program. Determine the system call information of the target host based on the eBPF event; The system call information is matched and detected based on context analysis methods and preset rule features to obtain corresponding detection results; If the detection result indicates that the system call information conforms to the preset rule characteristics, then the judgment result is obtained that the target host is currently running a reverse shell.

4. The method for identifying reverse shells exploiting the Dirty Cow vulnerability according to claim 1, characterized in that, After extracting the target address of the invoked first reverse shell from the eBPF event and reading the second kernel memory data of the current target host, the process further includes: If the second kernel memory data is consistent with the first kernel memory data, it is determined that the current kernel memory data has not been tampered with, a second abnormal behavior event is generated, and the second abnormal behavior event is fed back to the target front end; the second abnormal behavior event is an abnormal behavior event of running a reverse shell through a second running mode, and the second running mode is the method of running a reverse shell without tampering with the kernel memory data.

5. The method for identifying reverse shells exploiting the Dirty Cow vulnerability according to claim 1, characterized in that, If the second kernel memory data is inconsistent with the first kernel memory data, it is determined that the current kernel memory data has been tampered with. After extracting the second reverse shell target address from the underlying dynamic library of the target host, the method further includes: If the second kernel memory data is inconsistent with the first kernel memory data, and the second reverse shell target address is inconsistent with the first reverse shell target address, or if the second reverse shell target address cannot be extracted from the underlying dynamic library, then a third abnormal behavior event is generated and the third abnormal behavior event is fed back to the target front end; the third abnormal behavior event is an abnormal behavior event of running a reverse shell through a third running mode; the third running mode is the method of running a reverse shell by tampering with kernel memory data through sensitive files, and the sensitive files are files whose sensitivity level meets the preset sensitivity level conditions.

6. The method for identifying reverse shells exploiting the Dirty Cow vulnerability according to claim 1, characterized in that, The extraction of the second reverse shell target address from the underlying dynamic library of the target host includes: The second kernel memory data is disassembled and analyzed to locate malicious code within it. A preset address extraction technique is then used to scan the malicious code to identify target data related to network connectivity within it. The second kernel memory data is located in the underlying dynamic library of the target host. Extract and verify the address and port with the latest call time from the target data, so that after the verification is successful, the address is used as the second reverse shell target address in the underlying dynamic library of the target host.

7. The method for identifying reverse shells exploiting the Dirty Cow vulnerability according to any one of claims 1 to 6, characterized in that, Also includes: Identify the abnormal behavior events to be displayed on the target front end; If the abnormal behavior event to be displayed is a second abnormal behavior event, then the second abnormal behavior event will be displayed on the target front end in a first preset color, and will be flashed on the target front end at a preset flashing frequency, and the second abnormal behavior event will be recorded in the audit log. If the abnormal behavior event to be displayed is a third abnormal behavior event, then the third abnormal behavior event will be displayed on the target front end in a second preset color, and an alarm will be sent via email. If the abnormal behavior event to be displayed is the first abnormal behavior event, then the first abnormal behavior event will be displayed on the target front end in a third preset color, and an alarm will be issued via SMS or voice. The second abnormal behavior event is an abnormal behavior event of running a reverse shell through a second running mode, which is a way of running a reverse shell without tampering with kernel memory data; the third abnormal behavior event is an abnormal behavior event of running a reverse shell through a third running mode, which is a way of running a reverse shell by tampering with kernel memory data through a sensitive file; the sensitive file is a file whose sensitivity level meets the preset sensitivity level conditions; the first preset color, the second preset color, and the third preset color are all different from each other.

8. A device for identifying reverse shells exploiting the Dirty Cow vulnerability, characterized in that, include: The condition judgment module is used to read the first kernel memory data of the target host after the target host starts up, and to determine whether the target host is running a reverse shell by using the eBPF events captured by the eBPF program in the operating system kernel of the target host and the user-space custom eBPF application, so as to obtain the corresponding judgment result. The data reading module is used to extract the target address of the first reverse shell from the eBPF event and read the second kernel memory data of the target host if the judgment result indicates that the target host is running a reverse shell. The event feedback module is used to determine that the current kernel memory data has been tampered with if the second kernel memory data is inconsistent with the first kernel memory data, extract the second reverse shell target address in the underlying dynamic library of the target host, generate a first abnormal behavior event after determining that the second reverse shell target address is consistent with the first reverse shell target address, and feed the first abnormal behavior event back to the target front end. The first abnormal behavior event is an abnormal behavior event in which a reverse shell is run through a first running mode. The first running mode is a method in which a malicious program uses the Dirty Cow vulnerability to tamper with kernel data in memory in order to run a reverse shell.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the identification method for running a reverse shell using the Dirty Cow vulnerability as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer program is executed by a processor, it implements the identification method for running a reverse shell using the Dirty Cow vulnerability as described in any one of claims 1 to 7.

Images