Nytro Posted January 16, 2015 Report Posted January 16, 2015 Unhide is a forensic tool to find hidden processes and TCP/UDP ports by rootkits / LKMs or by another hidden technique. Unhide runs in Unix/Linux and Windows Systems. It implements six main techniques. FeaturesCompare /proc vs /bin/ps outputCompare info gathered from /bin/ps with info gathered by walking thru the procfs. ONLY for unhide-linux versionCompare info gathered from /bin/ps with info gathered from syscalls (syscall scanning).Full PIDs space ocupation (PIDs bruteforcing). ONLY for unhide-linux versionCompare /bin/ps output vs /proc, procfs walking and syscall. ONLY for unhide-linux version. Reverse search, verify that all thread seen by ps are also seen in the kernel.Quick compare /proc, procfs walking and syscall vs /bin/ps output. ONLY for unhide-linux version. It’s about 20 times faster than tests 1+2+3 but maybe give more false positives.URL: http://www.unhide-forensics.infoVia: ToolsWatch.org – The Hackers Arsenal Tools Portal » 2014 Top Security Tools as Voted by ToolsWatch.org Readers Quote
fed Posted January 16, 2015 Report Posted January 16, 2015 Unhide is a forensic tool to find hidden processes and TCP/UDP ports by rootkits / LKMs or by another hidden technique. Unhide runs in Unix/Linux and Windows Systems. It implements six main techniques. FeaturesCompare /proc vs /bin/ps outputCompare info gathered from /bin/ps with info gathered by walking thru the procfs. ONLY for unhide-linux versionCompare info gathered from /bin/ps with info gathered from syscalls (syscall scanning).Full PIDs space ocupation (PIDs bruteforcing). ONLY for unhide-linux versionCompare /bin/ps output vs /proc, procfs walking and syscall. ONLY for unhide-linux version. Reverse search, verify that all thread seen by ps are also seen in the kernel.Quick compare /proc, procfs walking and syscall vs /bin/ps output. ONLY for unhide-linux version. It’s about 20 times faster than tests 1+2+3 but maybe give more false positives.URL: http://www.unhide-forensics.infoVia: ToolsWatch.org – The Hackers Arsenal Tools Portal » 2014 Top Security Tools as Voted by ToolsWatch.org ReadersCum opresc hidden pid-urile?Am incercat cu Process Explorer si TcpView de la Sysinternals inclusiv taskkill /f /pid ... : error the process ... not found Quote
Nytro Posted January 16, 2015 Author Report Posted January 16, 2015 Ce e ala "hidden pid"? Te referi la rootkit-uri? Quote
fed Posted January 16, 2015 Report Posted January 16, 2015 (edited) Ce e ala "hidden pid"? Te referi la rootkit-uri?Programul scaneaza si afiseaza Found Hidden port si Found HIDDEN PID: Edited January 16, 2015 by fed Quote
Nytro Posted January 16, 2015 Author Report Posted January 16, 2015 Daca ai antivirus, e posibil sa fie de la self defence-ul sau. Quote
fed Posted January 16, 2015 Report Posted January 16, 2015 Daca ai antivirus, e posibil sa fie de la self defence-ul sau.Nu am.Auto kill hidden processes doar pe var linux/unix ( for P in `unhide sys | grep -v “\*” | grep -i HIDEEN | cut -f2 -d':’ | awk ‘{print $1}’`; do kill -9 $P; done; ) , pacat pe win for ramane hidden in continuare plm rootkiturile Quote
