Awesome-Mirrors/awesome-linux-rootkits
1
0
Fork 0
mirror of https://github.com/milabs/awesome-linux-rootkits.git synced 2025-02-05 01:35:23 -05:00
Code Issues Packages Projects Releases Wiki Activity

Update reptile.md

Browse Source
This commit is contained in:
Ilya V. Matveychikov 2018-07-02 20:40:41 +04:00 committed by GitHub
parent aa53182b78
commit 84d6921c26
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
details/reptile.md
View File

@ -2,8 +2,8 @@
https://github.com/f0rb1dd3n/Reptile
- Not able to tamper file contents while reading byte-by-byte (:exclamation:)
- Not able to hide all threads and children of hidden (parent) process (:exclamation:)
- not able to tamper file contents while reading byte-by-byte (:exclamation:)
- not able to hide all threads and children of hidden (parent) process (:exclamation:)
## Environment
@ -39,14 +39,14 @@ Hooking of system calls by patching syscall-handlers in `sys_call_table[]`:
## Hiding (tampering) of file contents
Filtering of file content while reading by hooking:
- `sys_call_table[__NR_read]`
Filtering of file content while reading:
- hook `sys_call_table[__NR_read]`
## Hiding of files and directories
Filtering of directory entries by hoocking:
- `sys_call_table[__NR_getdents]`
- `sys_call_table[__NR_getdents64]`
Filtering of directory entries:
- hook `sys_call_table[__NR_getdents]`
- hook `sys_call_table[__NR_getdents64]`
## Hiding of processes and process trees
@ -57,5 +57,5 @@ Filtering PID-like numeric entries while listing `/proc`:
## Backdoor/shell
Reverse shell spawning by port-knocking-like technique:
- `ICMP/UDP/TCP` port-knocking
- magic packet with token used (`ICMP/UDP/TCP`)
- spawning root-shell connection to remote host