hiding process from "ps" command

[Kurtis D. Rader]

On Mon, 14 Jul 2003 21:31:36 +0000, ajay wrote:

> I was wondering if it is possible to hide a process, which doesn't get
> detected by ps command?

I know of no way to do so on the UNIX flavors I support. I certainly hope
no UNIX implementation allows this. Being able to enumerate all running
processes is fundamental to many sysadmin tasks.

[Bigdakine]

>Subject: hiding process from "ps" command

>From: [email]ajay_kumarsingh@yahoo.com[/email] (ajay)
>Date: 7/14/03 6:31 PM Hawaiian Standard Time
>Message-id: <2a0aec36.0307142031.25bb2357@posting.google.com >
>
>I was wondering if it is possible to hide a process, which doesn't get
>detected by ps command?

You can hack the ps command to hide processes.

A hacked ps command is a common feature of hacker exploit toolkits.

Stuart
Dr. Stuart A. Weinstein
Ewa Beach Institute of Tectonics
"To err is human, but to really foul things up
requires a creationist"

[Wojtek Walczak]

Dnia 14 Jul 2003 21:31:36 -0700, ajay napisa³(a):

> I was wondering if it is possible to hide a process, which doesn't get
> detected by ps command?

Well... yes. If you're using Linux take a look at this:

<http://www.underground.org.pl/gminick/patches/procps-hide.patch>

and:

<http://www.underground.org.pl/gminick/patches/proc-hide-3.1.11.patch>

--
[ Wojtek Walczak - gminick (at) underground.org.pl ]
[ <http://gminick.linuxsecurity.pl/> ]
[ "...rozmaite zwroty, matowe od patyny dawnosci." ]