在Linux权限维持时，将可执行文件进程名伪装成系统自带的进程，达到一定的隐藏效果。想起国庆期间处理的一起应急，攻击者用了个小工具可随意修改进程名。
优点：

  • 进程名称可随意指定，不带绝对路径，可包含特殊字符
  • 进程中不显示加载器进程

h.zip
源码：https://github.com/chenkaie/junkcode/blob/master/xhide.c
用法：

  1. XHide - Process Faker, by Schizoprenic Xnuxer Research (c) 2002
  3. Options:
  4. -s string       Fake name process
  5. -d              Run aplication as daemon/system (optional)
  6. -u uid[:gid]    Change UID/GID, use another user (optional)
  7. -p filename     Save PID to filename (optional)
  9. Example: ./h -s "klogd -m 0" -d -p test.pid ./egg bot.conf

image.png

常用命令

  1. nohup ./h -s "[kthreadd]" ./shell.elf > /dev/null 2>&1 &
  2. ( ./h -s "[kthreadd]" ./shell.elf > /dev/null 2>&1 ) &
  4. 带参数的程序：
  6. nohup ./h -s "[kthreadd]" ./frp -c config.ini > /dev/null 2>&1 &

运行效果：
image.png
Ububtu自带的一些系统进程名：

  1. /sbin/init
  2. [kthreadd]
  3. [kworker/0:0H]
  4. [mm_percpu_wq]
  5. [ksoftirqd/0]
  6. [rcu_sched]
  7. [rcu_bh]
  8. [migration/0]
  9. [watchdog/0]
  10. [cpuhp/0]
  11. [kdevtmpfs]
  12. [netns]
  13. [rcu_tasks_kthre]
  14. [kauditd]
  15. [khungtaskd]
  16. [oom_reaper]
  17. [writeback]
  18. [kcompactd0]
  19. [ksmd]
  20. [crypto]
  21. [kintegrityd]
  22. [kblockd]
  23. [ata_sff]
  24. [md]
  25. [edac-poller]
  26. [devfreq_wq]
  27. [watchdogd]
  28. [kswapd0]
  29. [ecryptfs-kthrea]
  30. [kthrotld]
  31. [acpi_thermal_pm]
  32. [scsi_eh_0]
  33. [scsi_tmf_0]
  34. [scsi_eh_1]
  35. [scsi_tmf_1]
  36. [ipv6_addrconf]
  37. [kstrp]
  38. [charger_manager]
  39. [scsi_eh_2]
  40. [scsi_tmf_2]
  41. [kworker/0:1H]
  42. [jbd2/sda2-8]
  43. [ext4-rsv-conver]

Centos自带的一些系统进程名：

  1. [kthreadd]
  2. [ksoftirqd/0]
  3. [migration/0]
  4. [rcu_bh]
  5. [rcu_sched]
  6. [watchdog/0]
  7. [watchdog/1]
  8. [migration/1]
  9. [ksoftirqd/1]
  10. [kdevtmpfs]
  11. [netns]
  12. [khungtaskd]
  13. [writeback]
  14. [kintegrityd]
  15. [bioset]
  16. [kblockd]
  17. [md]
  18. [kswapd0]
  19. [ksmd]
  20. [khugepaged]
  21. [fsnotify_mark]
  22. [crypto]
  23. [kthrotld]
  24. [kmpath_rdacd]
  25. [kpsmoused]
  26. [ipv6_addrconf]
  27. [deferwq]
  28. [kauditd]
  29. [ata_sff]
  30. [mpt_poll_0]
  31. [mpt/0]
  32. [scsi_eh_0]
  33. [scsi_tmf_0]
  34. [ttm_swap]
  35. [scsi_eh_1]
  36. [scsi_tmf_1]
  37. [scsi_eh_2]
  38. [scsi_tmf_2]
  39. [kdmflush]
  40. [bioset]
  41. [kdmflush]
  42. [bioset]
  43. [xfsalloc]
  44. [xfs_mru_cache]
  45. [xfs-buf/dm-0]
  46. [xfs-data/dm-0]
  47. [xfs-conv/dm-0]
  48. [xfs-cil/dm-0]
  49. [xfs-reclaim/dm-]
  50. [xfs-log/dm-0]
  51. [xfs-eofblocks/d]
  52. [xfsaild/dm-0]
  53. /usr/lib/systemd/systemd-journald