Awesome-Mirrors/awesome-linux-rootkits
1
0
Fork 0
mirror of https://github.com/milabs/awesome-linux-rootkits.git synced 2025-02-10 12:08:33 -05:00
Code Issues Packages Projects Releases Wiki Activity

Update reptile.md

Browse Source
This commit is contained in:
Ilya V. Matveychikov 2018-07-02 20:40:41 +04:00 committed by GitHub
parent aa53182b78
commit 84d6921c26
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
details/reptile.md
View File

@ -2,8 +2,8 @@
https://github.com/f0rb1dd3n/Reptile https://github.com/f0rb1dd3n/Reptile
- Not able to tamper file contents while reading byte-by-byte (:exclamation:) - not able to tamper file contents while reading byte-by-byte (:exclamation:)
- Not able to hide all threads and children of hidden (parent) process (:exclamation:) - not able to hide all threads and children of hidden (parent) process (:exclamation:)
## Environment ## Environment
@ -39,14 +39,14 @@ Hooking of system calls by patching syscall-handlers in `sys_call_table[]`:
## Hiding (tampering) of file contents ## Hiding (tampering) of file contents
Filtering of file content while reading by hooking: Filtering of file content while reading:
- `sys_call_table[__NR_read]` - hook `sys_call_table[__NR_read]`
## Hiding of files and directories ## Hiding of files and directories
Filtering of directory entries by hoocking: Filtering of directory entries:
- `sys_call_table[__NR_getdents]` - hook `sys_call_table[__NR_getdents]`
- `sys_call_table[__NR_getdents64]` - hook `sys_call_table[__NR_getdents64]`
## Hiding of processes and process trees ## Hiding of processes and process trees
@ -57,5 +57,5 @@ Filtering PID-like numeric entries while listing `/proc`:
## Backdoor/shell ## Backdoor/shell
Reverse shell spawning by port-knocking-like technique: Reverse shell spawning by port-knocking-like technique:
- `ICMP/UDP/TCP` port-knocking - magic packet with token used (`ICMP/UDP/TCP`)
- spawning root-shell connection to remote host - spawning root-shell connection to remote host